From 640ecbba9c98ab1a4076380eb612e8f454fa77a6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 12 Jun 2026 19:03:13 +0000
Subject: [PATCH 001/525] phpExtensions.wikidiff2: 1.14.1 -> 1.14.2

---
 pkgs/development/php-packages/wikidiff2/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/php-packages/wikidiff2/default.nix b/pkgs/development/php-packages/wikidiff2/default.nix
index 295e68783a7f..dd18af029da6 100644
--- a/pkgs/development/php-packages/wikidiff2/default.nix
+++ b/pkgs/development/php-packages/wikidiff2/default.nix
@@ -8,13 +8,13 @@
 
 buildPecl rec {
   pname = "wikidiff2";
-  version = "1.14.1";
+  version = "1.14.2";
 
   src = fetchFromGitHub {
     owner = "wikimedia";
     repo = "mediawiki-php-wikidiff2";
     tag = version;
-    hash = "sha256-UTOfLXv2QWdjThxfrPQDLB8Mqo4js6LzOKXePivdp9k=";
+    hash = "sha256-rBVwqeNioLXOd6Tr2I/Jw8phL7nYsWseYwk+lZDH2tw=";
   };
 
   nativeBuildInputs = [ pkg-config ];

From 458a46ec1bc39cf64063c8aa4458390c0306ffac Mon Sep 17 00:00:00 2001
From: h7x4 <h7x4@nani.wtf>
Date: Sun, 26 Oct 2025 20:45:15 +0900
Subject: [PATCH 002/525] nixos/ups: add commonmark tags to files and manpages
 in option descriptions

---
 nixos/modules/services/monitoring/ups.nix | 42 +++++++++++------------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/nixos/modules/services/monitoring/ups.nix b/nixos/modules/services/monitoring/ups.nix
index 7ca9a63d95af..29cbbdf98a18 100644
--- a/nixos/modules/services/monitoring/ups.nix
+++ b/nixos/modules/services/monitoring/ups.nix
@@ -93,7 +93,7 @@ let
   upsdUsers = pkgs.writeText "upsd.users" (
     let
       # This looks like INI, but it's not quite because the
-      # 'upsmon' option lacks a '='. See: man upsd.users
+      # 'upsmon' option lacks a '='. See: man upsd.users(5)
       userConfig =
         name: user:
         lib.concatStringsSep "\n      " (
@@ -128,7 +128,7 @@ let
         port = lib.mkOption {
           type = lib.types.str;
           description = ''
-            The serial port to which your UPS is connected.  /dev/ttyS0 is
+            The serial port to which your UPS is connected.  {file}`/dev/ttyS0` is
             usually the first port on Linux boxes, for example.
           '';
         };
@@ -176,7 +176,7 @@ let
           default = "";
           type = lib.types.lines;
           description = ''
-            Lines which would be added inside ups.conf for handling this UPS.
+            Lines which would be added inside {file}`ups.conf` for handling this UPS.
           '';
         };
 
@@ -203,7 +203,7 @@ let
         type = lib.types.str;
         description = ''
           Address of the interface for `upsd` to listen on.
-          See `man upsd.conf` for details.
+          See {manpage}`upsd.conf(5)` for details.
         '';
       };
 
@@ -212,7 +212,7 @@ let
         default = defaultPort;
         description = ''
           TCP port for `upsd` to listen on.
-          See `man upsd.conf` for details.
+          See {manpage}`upsd.conf(5)` for details.
         '';
       };
     };
@@ -240,7 +240,7 @@ let
         ];
         description = ''
           Address of the interface for `upsd` to listen on.
-          See `man upsd` for details`.
+          See {manpage}`upsd(8)` for details`.
         '';
       };
 
@@ -248,7 +248,7 @@ let
         type = lib.types.lines;
         default = "";
         description = ''
-          Additional lines to add to `upsd.conf`.
+          Additional lines to add to {file}`upsd.conf`.
         '';
       };
     };
@@ -272,7 +272,7 @@ let
           default = name;
           description = ''
             Identifier of the UPS to monitor, in this form: `<upsname>[@<hostname>[:<port>]]`
-            See `upsmon.conf` for details.
+            See {manpage}`upsmon.conf(5)` for details.
           '';
         };
 
@@ -281,7 +281,7 @@ let
           default = 1;
           description = ''
             Number of power supplies that the UPS feeds on this system.
-            See `upsmon.conf` for details.
+            See {file}`upsmon.conf` for details.
           '';
         };
 
@@ -289,7 +289,7 @@ let
           type = lib.types.str;
           description = ''
             Username from `upsd.users` for accessing this UPS.
-            See `upsmon.conf` for details.
+            See {manpage}`upsmon.conf(5)` for details.
           '';
         };
 
@@ -300,7 +300,7 @@ let
             The full path to a file containing the password from
             `upsd.users` for accessing this UPS. The password file
             is read on service start.
-            See `upsmon.conf` for details.
+            See {manpage}`upsmon.conf(5)` for details.
           '';
         };
 
@@ -309,7 +309,7 @@ let
           default = "master";
           description = ''
             The relationship with `upsd`.
-            See `upsmon.conf` for details.
+            See {manpage}`upsmon.conf(5)` for details.
           '';
         };
       };
@@ -331,7 +331,7 @@ let
         type = lib.types.str;
         default = "nutmon";
         description = ''
-          User to run `upsmon` as. `upsmon.conf` will have its owner set to this
+          User to run `upsmon` as. {file}`upsmon.conf` will have its owner set to this
           user. If not specified, a default user will be created.
         '';
       };
@@ -348,7 +348,7 @@ let
         type = with lib.types; attrsOf (submodule monitorOptions);
         default = { };
         description = ''
-          Set of UPS to monitor. See `man upsmon.conf` for details.
+          Set of UPS to monitor. See {manpage}`upsmon.conf(5)` for details.
         '';
       };
 
@@ -364,7 +364,7 @@ let
             SHUTDOWNCMD = "''${pkgs.systemd}/bin/shutdown now";
           }
         '';
-        description = "Additional settings to add to `upsmon.conf`.";
+        description = "Additional settings to add to {file}`upsmon.conf`.";
         example = lib.literalMD ''
           {
             MINSUPPLIES = 2;
@@ -418,7 +418,7 @@ let
         default = [ ];
         description = ''
           Allow the user to do certain things with upsd.
-          See `man upsd.users` for details.
+          See {manpage}`upsd.users(5)` for details.
         '';
       };
 
@@ -427,7 +427,7 @@ let
         default = [ ];
         description = ''
           Let the user initiate specific instant commands. Use "ALL" to grant all commands automatically. For the full list of what your UPS supports, use "upscmd -l".
-          See `man upsd.users` for details.
+          See {manpage}`upsd.users(5)` for details.
         '';
       };
 
@@ -441,7 +441,7 @@ let
         default = null;
         description = ''
           Add the necessary actions for a upsmon process to work.
-          See `man upsd.users` for details.
+          See {manpage}`upsd.users(5)` for details.
         '';
       };
     };
@@ -524,7 +524,7 @@ in
       upsmon = lib.mkOption {
         default = { };
         description = ''
-          Options for the `upsmon.conf` configuration file.
+          Options for the {file}`upsmon.conf` configuration file.
         '';
         type = lib.types.submodule upsmonOptions;
       };
@@ -532,7 +532,7 @@ in
       upsd = lib.mkOption {
         default = { };
         description = ''
-          Options for the `upsd.conf` configuration file.
+          Options for the {file}`upsd.conf` configuration file.
         '';
         type = lib.types.submodule upsdOptions;
       };
@@ -551,7 +551,7 @@ in
       users = lib.mkOption {
         default = { };
         description = ''
-          Users that can access upsd. See `man upsd.users`.
+          Users that can access upsd. See {manpage}`upsd.users(5)`.
         '';
         type = with lib.types; attrsOf (submodule userOptions);
       };

From 10d97e8b0107cdc0f1318b89ca3eed282491cf8f Mon Sep 17 00:00:00 2001
From: "Enjeck C." <patrathewhiz@gmail.com>
Date: Fri, 31 Jul 2026 06:26:30 +0100
Subject: [PATCH 003/525] doc: fix Perl hook PERL5LIB path

The setup hook adds lib/perl5/site_perl, not lib/site_perl
(pkgs/development/interpreters/perl/setup-hook.sh).
---
 doc/hooks/perl.section.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/doc/hooks/perl.section.md b/doc/hooks/perl.section.md
index 06942bd3c0e1..362a237d9b19 100644
--- a/doc/hooks/perl.section.md
+++ b/doc/hooks/perl.section.md
@@ -1,3 +1,4 @@
 # Perl {#setup-hook-perl}
 
-Adds the `lib/site_perl` subdirectory of each build input to the `PERL5LIB` environment variable. For instance, if `buildInputs` contains Perl, then the `lib/site_perl` subdirectory of each input is added to the `PERL5LIB` environment variable.
+Adds the `lib/perl5/site_perl` subdirectory of each build input to the `PERL5LIB` environment variable.
+The hook applies when `perl` is in `buildInputs`.

From b0b4fa364a2d1241d1f16438229b6ea78d5faa47 Mon Sep 17 00:00:00 2001
From: "Enjeck C." <patrathewhiz@gmail.com>
Date: Fri, 31 Jul 2026 17:56:45 +0100
Subject: [PATCH 004/525] doc: add xfce4-dev-tools hook example

---
 doc/hooks/xfce4-dev-tools.section.md | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/doc/hooks/xfce4-dev-tools.section.md b/doc/hooks/xfce4-dev-tools.section.md
index a18295f4db67..465317480351 100644
--- a/doc/hooks/xfce4-dev-tools.section.md
+++ b/doc/hooks/xfce4-dev-tools.section.md
@@ -1,5 +1,14 @@
 # `xfce4-dev-tools` {#xfce4-dev-tools}
 
-This setup hook attempts to run `xdt-autogen` in `xdtAutogenPhase`, which is part of `preConfigurePhases`.
+This setup hook adds an `xdtAutogenPhase` that runs `xdt-autogen` before configure.
 
-[]{#dontUseXdtAutogenPhase} This behavior can be disabled by setting `dontUseXdtAutogenPhase` to `true`.
+Use this hook for Xfce packages that need `xdt-autogen` before configure.
+Add `xfce4-dev-tools` to `nativeBuildInputs` to enable the phase.
+
+```nix
+{
+  nativeBuildInputs = [ xfce4-dev-tools ];
+}
+```
+
+[]{#dontUseXdtAutogenPhase} Disable this behavior by setting `dontUseXdtAutogenPhase` to `true`.

From 710869631538eef5ce021c031a1a65992133a50b Mon Sep 17 00:00:00 2001
From: zinzilulo <214774502+zinzilulo@users.noreply.github.com>
Date: Fri, 21 Aug 2026 20:19:28 +0800
Subject: [PATCH 005/525] gnat{14, 15, 16}: use matching Apple SDK

These GNAT versions are built with apple-sdk_15 while the default
wrapper uses apple-sdk_14. Use wrapCCWith to provide the matching SDK.
---
 pkgs/top-level/all-packages.nix | 159 +++++++++++++++++---------------
 1 file changed, 87 insertions(+), 72 deletions(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 1d5df6224d23..42d05d121f7a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3410,84 +3410,99 @@ with pkgs;
     }
   );
 
-  gnat14 = wrapCC (
-    gcc14.cc.override {
-      name = "gnat";
-      langC = true;
-      langCC = false;
-      langAda = true;
-      profiledCompiler = false;
-      # As per upstream instructions building a cross compiler
-      # should be done with a (native) compiler of the same version.
-      # If we are cross-compiling GNAT, we may as well do the same.
-      gnat-bootstrap =
-        if stdenv.hostPlatform == stdenv.targetPlatform && stdenv.buildPlatform == stdenv.hostPlatform then
-          buildPackages.gnat-bootstrap14
-        else
-          buildPackages.gnat14;
-      stdenv =
-        if
-          stdenv.hostPlatform == stdenv.targetPlatform
-          && stdenv.buildPlatform == stdenv.hostPlatform
-          && stdenv.buildPlatform.isDarwin
-        then
-          overrideCC gccStdenv gnat-bootstrap14
-        else
-          stdenv;
+  gnat14 = wrapCCWith (
+    {
+      cc = gcc14.cc.override {
+        name = "gnat";
+        langC = true;
+        langCC = false;
+        langAda = true;
+        profiledCompiler = false;
+        # As per upstream instructions building a cross compiler
+        # should be done with a (native) compiler of the same version.
+        # If we are cross-compiling GNAT, we may as well do the same.
+        gnat-bootstrap =
+          if stdenv.hostPlatform == stdenv.targetPlatform && stdenv.buildPlatform == stdenv.hostPlatform then
+            buildPackages.gnat-bootstrap14
+          else
+            buildPackages.gnat14;
+        stdenv =
+          if
+            stdenv.hostPlatform == stdenv.targetPlatform
+            && stdenv.buildPlatform == stdenv.hostPlatform
+            && stdenv.buildPlatform.isDarwin
+          then
+            overrideCC gccStdenv gnat-bootstrap14
+          else
+            stdenv;
+      };
+    }
+    // lib.optionalAttrs stdenv.targetPlatform.isDarwin {
+      apple-sdk = apple-sdk_15;
     }
   );
 
-  gnat15 = wrapCC (
-    gcc15.cc.override {
-      name = "gnat";
-      langC = true;
-      langCC = false;
-      langAda = true;
-      profiledCompiler = false;
-      # As per upstream instructions building a cross compiler
-      # should be done with a (native) compiler of the same version.
-      # If we are cross-compiling GNAT, we may as well do the same.
-      gnat-bootstrap =
-        if stdenv.hostPlatform == stdenv.targetPlatform && stdenv.buildPlatform == stdenv.hostPlatform then
-          buildPackages.gnat-bootstrap15
-        else
-          buildPackages.gnat15;
-      stdenv =
-        if
-          stdenv.hostPlatform == stdenv.targetPlatform
-          && stdenv.buildPlatform == stdenv.hostPlatform
-          && stdenv.buildPlatform.isDarwin
-        then
-          overrideCC gccStdenv gnat-bootstrap15
-        else
-          stdenv;
+  gnat15 = wrapCCWith (
+    {
+      cc = gcc15.cc.override {
+        name = "gnat";
+        langC = true;
+        langCC = false;
+        langAda = true;
+        profiledCompiler = false;
+        # As per upstream instructions building a cross compiler
+        # should be done with a (native) compiler of the same version.
+        # If we are cross-compiling GNAT, we may as well do the same.
+        gnat-bootstrap =
+          if stdenv.hostPlatform == stdenv.targetPlatform && stdenv.buildPlatform == stdenv.hostPlatform then
+            buildPackages.gnat-bootstrap15
+          else
+            buildPackages.gnat15;
+        stdenv =
+          if
+            stdenv.hostPlatform == stdenv.targetPlatform
+            && stdenv.buildPlatform == stdenv.hostPlatform
+            && stdenv.buildPlatform.isDarwin
+          then
+            overrideCC gccStdenv gnat-bootstrap15
+          else
+            stdenv;
+      };
+    }
+    // lib.optionalAttrs stdenv.targetPlatform.isDarwin {
+      apple-sdk = apple-sdk_15;
     }
   );
 
-  gnat16 = wrapCC (
-    gcc16.cc.override {
-      name = "gnat";
-      langC = true;
-      langCC = false;
-      langAda = true;
-      profiledCompiler = false;
-      # As per upstream instructions building a cross compiler
-      # should be done with a (native) compiler of the same version.
-      # If we are cross-compiling GNAT, we may as well do the same.
-      gnat-bootstrap =
-        if stdenv.hostPlatform == stdenv.targetPlatform && stdenv.buildPlatform == stdenv.hostPlatform then
-          buildPackages.gnat-bootstrap16
-        else
-          buildPackages.gnat16;
-      stdenv =
-        if
-          stdenv.hostPlatform == stdenv.targetPlatform
-          && stdenv.buildPlatform == stdenv.hostPlatform
-          && stdenv.buildPlatform.isDarwin
-        then
-          overrideCC gccStdenv gnat-bootstrap16
-        else
-          stdenv;
+  gnat16 = wrapCCWith (
+    {
+      cc = gcc16.cc.override {
+        name = "gnat";
+        langC = true;
+        langCC = false;
+        langAda = true;
+        profiledCompiler = false;
+        # As per upstream instructions building a cross compiler
+        # should be done with a (native) compiler of the same version.
+        # If we are cross-compiling GNAT, we may as well do the same.
+        gnat-bootstrap =
+          if stdenv.hostPlatform == stdenv.targetPlatform && stdenv.buildPlatform == stdenv.hostPlatform then
+            buildPackages.gnat-bootstrap16
+          else
+            buildPackages.gnat16;
+        stdenv =
+          if
+            stdenv.hostPlatform == stdenv.targetPlatform
+            && stdenv.buildPlatform == stdenv.hostPlatform
+            && stdenv.buildPlatform.isDarwin
+          then
+            overrideCC gccStdenv gnat-bootstrap16
+          else
+            stdenv;
+      };
+    }
+    // lib.optionalAttrs stdenv.targetPlatform.isDarwin {
+      apple-sdk = apple-sdk_15;
     }
   );
 

From 3295138139f44c601596e55372d31ac7396abdb7 Mon Sep 17 00:00:00 2001
From: zinzilulo <214774502+zinzilulo@users.noreply.github.com>
Date: Fri, 21 Aug 2026 20:20:37 +0800
Subject: [PATCH 006/525] gnat{13, 14, 15, 16}: fix Ada trampolines on Darwin

Use heap trampolines for Ada on all Darwin targets.
---
 .../compilers/gcc/patches/default.nix         |  2 ++
 .../gcc/patches/gnat-darwin-trampoline.patch  | 22 +++++++++++++++++++
 2 files changed, 24 insertions(+)
 create mode 100644 pkgs/development/compilers/gcc/patches/gnat-darwin-trampoline.patch

diff --git a/pkgs/development/compilers/gcc/patches/default.nix b/pkgs/development/compilers/gcc/patches/default.nix
index c9ff40d8de57..87c7f36198a0 100644
--- a/pkgs/development/compilers/gcc/patches/default.nix
+++ b/pkgs/development/compilers/gcc/patches/default.nix
@@ -176,6 +176,8 @@ optionals noSysDirs (
   is13 && langAda && stdenv.targetPlatform.isDarwin
 ) ./13/gnat13-aarch64-darwin-trampoline.patch
 
+++ optional (langAda && stdenv.targetPlatform.isDarwin) ./gnat-darwin-trampoline.patch
+
 ++ optional (targetPlatform.isWindows || targetPlatform.isCygwin) (fetchpatch {
   name = "libstdc-fix-compilation-in-freestanding-win32.patch";
   url = "https://inbox.sourceware.org/gcc-patches/20250922182808.2599390-2-corngood@gmail.com/raw";
diff --git a/pkgs/development/compilers/gcc/patches/gnat-darwin-trampoline.patch b/pkgs/development/compilers/gcc/patches/gnat-darwin-trampoline.patch
new file mode 100644
index 000000000000..00aae7f49fc6
--- /dev/null
+++ b/pkgs/development/compilers/gcc/patches/gnat-darwin-trampoline.patch
@@ -0,0 +1,22 @@
+Ada makes extensive use of nested functions, and gcc by default uses trampolines
+to avoid using fat pointers (carry link to parent stack frame along with link to
+actual function body). However, executable stack has been disabled on darwin
+since version 20 (macOS 11). Thus, make heap trampolines unconditionally used on
+darwin as we only support macOS version 13+
+--- a/gcc/config.gcc
++++ b/gcc/config.gcc
+@@ -1177,13 +1177,13 @@ esac
+ # Figure out if we need to enable heap trampolines
+ # and variadic functions handling.
+ case ${target} in
+-aarch64*-*-darwin2*)
++aarch64*-*-darwin* | arm64*-*-darwin*)
+   # This applies to arm64 Darwin variadic funtions.
+   tm_defines="$tm_defines STACK_USE_CUMULATIVE_ARGS_INIT=1"
+   # Executable stack is forbidden.
+   tm_defines="$tm_defines HEAP_TRAMPOLINES_INIT=1"
+   ;;
+-*-*-darwin2*)
++*-*-darwin*)
+   tm_defines="$tm_defines STACK_USE_CUMULATIVE_ARGS_INIT=0"
+   # Currently, we do this for macOS 11 and above.

From dbd701e6f00ac86d724d1673892bf8c29a808cd0 Mon Sep 17 00:00:00 2001
From: zinzilulo <214774502+zinzilulo@users.noreply.github.com>
Date: Fri, 21 Aug 2026 20:22:57 +0800
Subject: [PATCH 007/525] gpr2: fix collect_kb permissions

Make collect_kb executable before the build.
---
 pkgs/development/ada-modules/gpr2/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/ada-modules/gpr2/default.nix b/pkgs/development/ada-modules/gpr2/default.nix
index f984a0892f3f..781b603d0ebd 100644
--- a/pkgs/development/ada-modules/gpr2/default.nix
+++ b/pkgs/development/ada-modules/gpr2/default.nix
@@ -48,6 +48,7 @@ stdenv.mkDerivation rec {
   # fool make into thinking pregenerated targets are up to date
   preBuild = lib.optionalString (gpr2kbdir == null) ''
     touch .build/kb/{*.adb,*.ads,collect_kb}
+    chmod +x .build/kb/collect_kb
   '';
 
   propagatedBuildInputs = [

From b42ab33fd6b04fc5f2e332be81eb7509b37fa142 Mon Sep 17 00:00:00 2001
From: zinzilulo <214774502+zinzilulo@users.noreply.github.com>
Date: Fri, 21 Aug 2026 20:24:34 +0800
Subject: [PATCH 008/525] gnatcoll-core: avoid stdenv SDK

Use stdenvNoCC so gnatcoll-core only uses the SDK provided by GNAT.
---
 pkgs/development/ada-modules/gnatcoll/core.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/ada-modules/gnatcoll/core.nix b/pkgs/development/ada-modules/gnatcoll/core.nix
index e60230332945..86ef32a21910 100644
--- a/pkgs/development/ada-modules/gnatcoll/core.nix
+++ b/pkgs/development/ada-modules/gnatcoll/core.nix
@@ -1,5 +1,5 @@
 {
-  stdenv,
+  stdenvNoCC,
   lib,
   gnat,
   gprbuild,
@@ -18,7 +18,7 @@
 # gnatcoll-projects depends on gnatcoll-core
 assert enableGnatcollProjects -> enableGnatcollCore;
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "gnatcoll-core";
   version = "25.0.0";
 
@@ -62,7 +62,7 @@ stdenv.mkDerivation rec {
     "prefix=${placeholder "out"}"
     "PROCESSORS=$(NIX_BUILD_CORES)"
     # confusingly, for gprbuild --target is autoconf --host
-    "TARGET=${stdenv.hostPlatform.config}"
+    "TARGET=${stdenvNoCC.hostPlatform.config}"
     "GNATCOLL_MINIMAL_ONLY=${lib.boolToYesNo (!enableGnatcollCore)}"
     "GNATCOLL_PROJECTS=${lib.boolToYesNo enableGnatcollProjects}"
   ];

From b229e0e758c244003378756d2408be7e97786e54 Mon Sep 17 00:00:00 2001
From: zinzilulo <214774502+zinzilulo@users.noreply.github.com>
Date: Fri, 21 Aug 2026 20:25:17 +0800
Subject: [PATCH 009/525] gnatprove: fix Darwin source path

Rename the aarch64-darwin source directory to match the arm64-darwin
target used by nixpkgs.
---
 pkgs/development/ada-modules/gnatprove/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/ada-modules/gnatprove/default.nix b/pkgs/development/ada-modules/gnatprove/default.nix
index d4e39a3506d1..0f0452aeeb51 100644
--- a/pkgs/development/ada-modules/gnatprove/default.nix
+++ b/pkgs/development/ada-modules/gnatprove/default.nix
@@ -149,6 +149,8 @@ stdenv.mkDerivation {
     # gnat2why/gnat_src points to the GNAT sources
     tar xf ${gnat.cc.src} --wildcards 'gcc-*/gcc/ada'
     mv gcc-*/gcc/ada gnat2why/gnat_src
+
+    mv src/common/aarch64-darwin src/common/arm64-darwin
   '';
 
   configurePhase = ''

From d1c19500f228cff4cd36ff1bef70d8897984ff37 Mon Sep 17 00:00:00 2001
From: zinzilulo <214774502+zinzilulo@users.noreply.github.com>
Date: Fri, 21 Aug 2026 20:25:59 +0800
Subject: [PATCH 010/525] gnatprove: avoid stdenv SDK

Use stdenvNoCC so GNATprove uses the SDK provided by GNAT.
Add clang as ocamlc invokes it during compilation.
---
 pkgs/development/ada-modules/gnatprove/default.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/ada-modules/gnatprove/default.nix b/pkgs/development/ada-modules/gnatprove/default.nix
index 0f0452aeeb51..4a20610f7dca 100644
--- a/pkgs/development/ada-modules/gnatprove/default.nix
+++ b/pkgs/development/ada-modules/gnatprove/default.nix
@@ -1,7 +1,8 @@
 {
-  stdenv,
+  stdenvNoCC,
   lib,
   fetchFromGitHub,
+  clang,
   gnat,
   gnatcoll-core,
   gprbuild,
@@ -99,7 +100,7 @@ let
       or (throw "GNATprove depends on a specific GNAT version and can't be built using GNAT ${gnat_version}.");
 
 in
-stdenv.mkDerivation {
+stdenvNoCC.mkDerivation {
   pname = "gnatprove";
   version = "fsf-${gnat_version}_${thisSpark.commit_date}";
 
@@ -117,7 +118,8 @@ stdenv.mkDerivation {
     ocaml
     findlib
     menhir
-  ]);
+  ])
+  ++ lib.optional stdenvNoCC.targetPlatform.isDarwin clang;
 
   buildInputs = [
     gnatcoll-core

From 91ea81b5436c608641b969ebd15ae1246ae8337d Mon Sep 17 00:00:00 2001
From: zinzilulo <214774502+zinzilulo@users.noreply.github.com>
Date: Fri, 21 Aug 2026 20:39:10 +0800
Subject: [PATCH 011/525] gprbuild: package and patch gprconfig-kb

Upstream assumes the platform is named aarch64-darwin, while nixpkgs
uses arm64-darwin.
---
 .../development/ada-modules/gprbuild/boot.nix | 60 ++++++++++---------
 .../gprbuild/gprconfig_kb-darwin.patch        | 49 +++++++++++++++
 2 files changed, 80 insertions(+), 29 deletions(-)
 create mode 100644 pkgs/development/ada-modules/gprbuild/gprconfig_kb-darwin.patch

diff --git a/pkgs/development/ada-modules/gprbuild/boot.nix b/pkgs/development/ada-modules/gprbuild/boot.nix
index f23628f37b7a..ff7b5a17c708 100644
--- a/pkgs/development/ada-modules/gprbuild/boot.nix
+++ b/pkgs/development/ada-modules/gprbuild/boot.nix
@@ -1,6 +1,7 @@
 {
   stdenv,
   lib,
+  applyPatches,
   fetchFromGitHub,
   fetchpatch2,
   gnat,
@@ -11,15 +12,36 @@
 let
   version = "25.0.0";
 
-  gprConfigKbSrc = fetchFromGitHub {
-    name = "gprconfig-kb-${version}-src";
-    owner = "AdaCore";
-    repo = "gprconfig_kb";
-    rev = "v${version}";
-    sha256 = "09x1njq0i0z7fbwg0mg39r5ghy7369avbqvdycfj67lpmw17gb1r";
+  gprconfig_kb = applyPatches {
+    src = fetchFromGitHub {
+      owner = "AdaCore";
+      repo = "gprconfig_kb";
+      tag = "v${version}";
+      hash = "sha256-Oax3Aq+XHiMd823jtVUy43j4Sk7jVfD4cueDCLC0oSc=";
+    };
+
+    patches = [
+      ./gprconfig_kb-darwin.patch
+    ];
+
+    postPatch = ''
+      # Install custom compiler description which can detect nixpkgs'
+      # GNAT wrapper as a proper Ada compiler. The default compiler
+      # description expects the runtime library to be installed in
+      # the same prefix which isn't the case for nixpkgs. As a
+      # result, it would detect the unwrapped GNAT as a proper
+      # compiler which is unable to produce working binaries.
+      #
+      # Our compiler description is very similar to the upstream
+      # GNAT description except that we use a symlink in $out/nix-support
+      # created by the cc-wrapper to find the associated runtime
+      # libraries and use gnatmake instead of gnatls to find GNAT's
+      # bin directory.
+
+      install -m644 ${./nixpkgs-gnat.xml} db/nixpkgs-gnat.xml
+    '';
   };
 in
-
 stdenv.mkDerivation {
   pname = "gprbuild-boot";
   inherit version;
@@ -29,7 +51,7 @@ stdenv.mkDerivation {
     owner = "AdaCore";
     repo = "gprbuild";
     rev = "v${version}";
-    sha256 = "1mqsmc0q5bzg8223ls18kbvaz6mhzjz7ik8d3sqhhn24c0j6wjaw";
+    hash = "sha256-XEluJGBEWAixHg3NeL78sJqv9pooaDqEQO+vggGrGtc=";
   };
 
   nativeBuildInputs = [
@@ -84,23 +106,9 @@ stdenv.mkDerivation {
 
     ./bootstrap.sh \
       --with-xmlada=${xmlada.src} \
-      --with-kb=${gprConfigKbSrc} \
+      --with-kb=${gprconfig_kb} \
       --prefix=$out
 
-    # Install custom compiler description which can detect nixpkgs'
-    # GNAT wrapper as a proper Ada compiler. The default compiler
-    # description expects the runtime library to be installed in
-    # the same prefix which isn't the case for nixpkgs. As a
-    # result, it would detect the unwrapped GNAT as a proper
-    # compiler which is unable to produce working binaries.
-    #
-    # Our compiler description is very similar to the upstream
-    # GNAT description except that we use a symlink in $out/nix-support
-    # created by the cc-wrapper to find the associated runtime
-    # libraries and use gnatmake instead of gnatls to find GNAT's
-    # bin directory.
-    install -m644 ${./nixpkgs-gnat.xml} $out/share/gprconfig/nixpkgs-gnat.xml
-
     runHook postInstall
   '';
 
@@ -110,11 +118,5 @@ stdenv.mkDerivation {
     license = lib.licenses.gpl3Plus;
     maintainers = [ lib.maintainers.sternenseemann ];
     platforms = lib.platforms.all;
-    # gprbuild-boot builds on darwin, but `gprconfig` stack overflows whenever
-    # it runs during the enumeration of available toolchains
-    # This doesn't seem to be a problem with our compiler definition `./nixpkgs-gnat.xml`
-    # as a gprbuild system without that configuration also stack faults.
-    # Maybe a linker issue?
-    broken = stdenv.hostPlatform.isDarwin;
   };
 }
diff --git a/pkgs/development/ada-modules/gprbuild/gprconfig_kb-darwin.patch b/pkgs/development/ada-modules/gprbuild/gprconfig_kb-darwin.patch
new file mode 100644
index 000000000000..cbb62339c1c7
--- /dev/null
+++ b/pkgs/development/ada-modules/gprbuild/gprconfig_kb-darwin.patch
@@ -0,0 +1,49 @@
+--- a/db/fallback_targets.xml
++++ b/db/fallback_targets.xml
+@@ -14,6 +14,7 @@
+   <fallback_targets>
+     <target>x86_64-darwin</target>
+     <target>aarch64-darwin</target>
++    <target>arm64-darwin</target>
+   </fallback_targets>
+ 
+ </gprconfig>
+diff --git a/db/linker.xml b/db/linker.xml
+index e2489e88..0aa264e6 100644
+--- a/db/linker.xml
++++ b/db/linker.xml
+@@ -1207,6 +1207,7 @@
+        <target name="^powerpc-.*darwin.*$" />
+        <target name="^x86_64-.*darwin.*$" />
+        <target name="^aarch64-.*darwin.*$" />
++       <target name="^arm64-.*darwin.*$" />
+     </targets>
+     <config>
+    for Library_Builder use "${GPRCONFIG_PREFIX}libexec/gprbuild/gprlib";
+@@ -1242,6 +1243,8 @@
+        <target name="^i.86-.*darwin.*$" />
+        <target name="^powerpc-.*darwin.*$" />
+        <target name="^x86_64-.*darwin.*$" />
++       <target name="^aarch64.*darwin.*$" />
++       <target name="^arm64.*darwin.*$" />
+     </targets>
+     <config>
+     for Library_Rpath_Options ("C++") use ("-print-file-name=libstdc++.dylib");
+diff --git a/db/targetset.xml b/db/targetset.xml
+index 3fdda73e..a096e392 100644
+--- a/db/targetset.xml
++++ b/db/targetset.xml
+@@ -129,6 +129,13 @@
+     <target>x86_64-.*windows-gnu</target>
+   </targetset>
+ 
++  <!-- arm64-darwin -->
++  <targetset canonical="arm64-darwin">
++    <target>arm64-ios</target>
++    <target>arm64-darwin</target>
++    <target>arm64.*-darwin.*</target>
++  </targetset>
++
+   <!-- aarch64-darwin (iOS 64bit) -->
+   <targetset canonical="aarch64-darwin">
+     <target>aarch64-ios</target>

From 90572a738389d2c3321e1f2fff83a4587c3e609d Mon Sep 17 00:00:00 2001
From: zinzilulo <214774502+zinzilulo@users.noreply.github.com>
Date: Fri, 21 Aug 2026 20:39:55 +0800
Subject: [PATCH 012/525] gprbuild: remove relocatable build patch

The patch causes gprbuild to look for libgnarl in its own lib directory,
where it is not available.
---
 pkgs/development/ada-modules/gprbuild/default.nix | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/pkgs/development/ada-modules/gprbuild/default.nix b/pkgs/development/ada-modules/gprbuild/default.nix
index b722f012d431..cf9df1247d6a 100644
--- a/pkgs/development/ada-modules/gprbuild/default.nix
+++ b/pkgs/development/ada-modules/gprbuild/default.nix
@@ -47,13 +47,7 @@ stdenv.mkDerivation {
     NIX_LDFLAGS = "-headerpad_max_install_names";
   };
 
-  patches =
-    gprbuild-boot.patches
-    # Fixes gprbuild being linked statically always. Based on the AUR's patch:
-    # https://aur.archlinux.org/cgit/aur.git/plain/0001-Makefile-build-relocatable-instead-of-static-binary.patch?h=gprbuild&id=bac524c76cd59c68fb91ef4dfcbe427357b9f850
-    ++ lib.optionals (!stdenv.hostPlatform.isStatic) [
-      ./gprbuild-relocatable-build.patch
-    ];
+  patches = gprbuild-boot.patches;
 
   buildFlags = [
     "all"

From 92a132aa156f7db3e2c1586cd1fd9364f1d4360d Mon Sep 17 00:00:00 2001
From: zinzilulo <214774502+zinzilulo@users.noreply.github.com>
Date: Sat, 22 Aug 2026 02:50:44 +0800
Subject: [PATCH 013/525] gnatcoll-*: avoid stdenv SDK

Use stdenvNoCC so gnatcoll-* use the SDK provided by GNAT.
---
 pkgs/development/ada-modules/gnatcoll/bindings.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/ada-modules/gnatcoll/bindings.nix b/pkgs/development/ada-modules/gnatcoll/bindings.nix
index a370cc5f015e..2d5d34e3da57 100644
--- a/pkgs/development/ada-modules/gnatcoll/bindings.nix
+++ b/pkgs/development/ada-modules/gnatcoll/bindings.nix
@@ -1,5 +1,5 @@
 {
-  stdenv,
+  stdenvNoCC,
   lib,
   fetchFromGitHub,
   gnat,
@@ -34,7 +34,7 @@ let
   };
 in
 
-stdenv.mkDerivation rec {
+stdenvNoCC.mkDerivation rec {
   pname = "gnatcoll-${component}";
   version = "25.0.0";
 

From 45f62515834f104b74738e3eceb453ff5e18c569 Mon Sep 17 00:00:00 2001
From: zinzilulo <214774502+zinzilulo@users.noreply.github.com>
Date: Sat, 22 Aug 2026 02:51:42 +0800
Subject: [PATCH 014/525] alire: avoid stdenv SDK

Use stdenvNoCC so alire uses the SDK provided by GNAT.
---
 pkgs/by-name/al/alire/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/al/alire/package.nix b/pkgs/by-name/al/alire/package.nix
index 19311fab482b..069081082610 100644
--- a/pkgs/by-name/al/alire/package.nix
+++ b/pkgs/by-name/al/alire/package.nix
@@ -1,12 +1,12 @@
 {
   lib,
-  stdenv,
+  stdenvNoCC,
   fetchFromGitHub,
   gprbuild,
   gnat,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "alire";
   version = "2.1.1";
 

From 3cfe668d2f3e74a482cd6fff5d7eb3a47cfb9a91 Mon Sep 17 00:00:00 2001
From: zinzilulo <214774502+zinzilulo@users.noreply.github.com>
Date: Sat, 22 Aug 2026 21:04:07 +0800
Subject: [PATCH 015/525] gnat13Packages.gnatprove: fix aarch64 build

Apply the patch to suppress aarch64 warnings that cause the
gnat13Packages.gnatprove build to fail.
---
 pkgs/development/ada-modules/gnatprove/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/ada-modules/gnatprove/default.nix b/pkgs/development/ada-modules/gnatprove/default.nix
index 4a20610f7dca..1710885326cc 100644
--- a/pkgs/development/ada-modules/gnatprove/default.nix
+++ b/pkgs/development/ada-modules/gnatprove/default.nix
@@ -58,6 +58,9 @@ let
       };
       commit_date = "2023-01-05";
       patches = [
+        # Suppress warnings on aarch64: https://github.com/AdaCore/spark2014/issues/54
+        ./0002-mute-aarch64-warnings.patch
+
         # Changes to the GNAT frontend: https://github.com/AdaCore/spark2014/issues/58
         ./0003-Adjust-after-category-change-for-N_Formal_Package_De.patch
       ];

From a2f3d3d476b7315a8e33bdbd60c7a6077f9705f7 Mon Sep 17 00:00:00 2001
From: Tim Schubert <dadada@dadada.li>
Date: Sat, 22 Aug 2026 17:19:42 +0200
Subject: [PATCH 016/525] nixos/soft-serve: fix missing state directory

---
 nixos/modules/services/misc/soft-serve.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/misc/soft-serve.nix b/nixos/modules/services/misc/soft-serve.nix
index 63b4fc120638..fe63d92443f1 100644
--- a/nixos/modules/services/misc/soft-serve.nix
+++ b/nixos/modules/services/misc/soft-serve.nix
@@ -64,7 +64,7 @@ in
         # Hooks must be executable, but DynamicUser mounts /var/lib/private as noexec
         ExecPaths = "${stateDir}/repos";
 
-        StateDirectory = "soft-serve";
+        StateDirectory = "soft-serve soft-serve/repos";
         WorkingDirectory = stateDir;
         ProcSubset = "pid";
         ProtectProc = "invisible";

From 168807201806dd6d27af6e2cbad0277961f545ed Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Wed, 2 Sep 2026 07:50:11 -0700
Subject: [PATCH 017/525] pulseaudio-dlna: drop

Upstream fork is inactive since 2022: https://github.com/Cygn/pulseaudio-dlna
---
 ...etup.py-remove-dbus-python-from-list.patch | 25 ------
 pkgs/by-name/pu/pulseaudio-dlna/package.nix   | 80 -------------------
 pkgs/top-level/aliases.nix                    |  1 +
 3 files changed, 1 insertion(+), 105 deletions(-)
 delete mode 100644 pkgs/by-name/pu/pulseaudio-dlna/0001-setup.py-remove-dbus-python-from-list.patch
 delete mode 100644 pkgs/by-name/pu/pulseaudio-dlna/package.nix

diff --git a/pkgs/by-name/pu/pulseaudio-dlna/0001-setup.py-remove-dbus-python-from-list.patch b/pkgs/by-name/pu/pulseaudio-dlna/0001-setup.py-remove-dbus-python-from-list.patch
deleted file mode 100644
index 2f38386f96c0..000000000000
--- a/pkgs/by-name/pu/pulseaudio-dlna/0001-setup.py-remove-dbus-python-from-list.patch
+++ /dev/null
@@ -1,25 +0,0 @@
-From a4bf7df795146c843696daee8c02826ba0034298 Mon Sep 17 00:00:00 2001
-From: Florian Klink <flokli@flokli.de>
-Date: Sun, 21 Nov 2021 12:04:48 +0100
-Subject: [PATCH] setup.py: remove dbus-python from list
-
-I wasn't able to convince setuptools to find this.
----
- setup.py | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/setup.py b/setup.py
-index 61d6831..013fff3 100644
---- a/setup.py
-+++ b/setup.py
-@@ -42,7 +42,6 @@ setuptools.setup(
-     install_requires=[
-     'docopt',
-     'chardet',
--    'dbus-python',
-     'docopt',
-     'requests',
-     'setproctitle',
--- 
-2.33.1
-
diff --git a/pkgs/by-name/pu/pulseaudio-dlna/package.nix b/pkgs/by-name/pu/pulseaudio-dlna/package.nix
deleted file mode 100644
index f8fc1118d21b..000000000000
--- a/pkgs/by-name/pu/pulseaudio-dlna/package.nix
+++ /dev/null
@@ -1,80 +0,0 @@
-{
-  fetchFromGitHub,
-  lib,
-  python3Packages,
-  mp3Support ? true,
-  lame,
-  opusSupport ? true,
-  opus-tools,
-  faacSupport ? false,
-  faac,
-  flacSupport ? true,
-  flac,
-  soxSupport ? true,
-  sox,
-  vorbisSupport ? true,
-  vorbis-tools,
-  pulseaudio,
-}:
-
-python3Packages.buildPythonApplication {
-  pname = "pulseaudio-dlna";
-  version = "unstable-2021-11-09";
-  format = "setuptools";
-
-  src = fetchFromGitHub {
-    owner = "Cygn";
-    repo = "pulseaudio-dlna";
-    rev = "637a2e7bba2277137c5f12fb58e63100dab7cbe6";
-    sha256 = "sha256-Oda+zQQJE2D3fiNWTzxYvI8cZVHG5JAoV2Wf5Z6IU3M=";
-  };
-
-  patches = [
-    ./0001-setup.py-remove-dbus-python-from-list.patch
-  ];
-
-  propagatedBuildInputs =
-    with python3Packages;
-    [
-      dbus-python
-      docopt
-      requests
-      setproctitle
-      protobuf
-      psutil
-      chardet
-      netifaces
-      notify2
-      pyroute2
-      pygobject3
-      pychromecast
-      lxml
-      setuptools
-      zeroconf
-    ]
-    ++ lib.optional mp3Support lame
-    ++ lib.optional opusSupport opus-tools
-    ++ lib.optional faacSupport faac
-    ++ lib.optional flacSupport flac
-    ++ lib.optional soxSupport sox
-    ++ lib.optional vorbisSupport vorbis-tools;
-
-  # pulseaudio-dlna shells out to pactl to configure sinks and sources.
-  # As pactl might not be in $PATH, add --suffix it (so pactl configured by the
-  # user get priority)
-  makeWrapperArgs = [ "--suffix PATH : ${lib.makeBinPath [ pulseaudio ]}" ];
-
-  # upstream has no tests
-  checkPhase = ''
-    $out/bin/pulseaudio-dlna --help > /dev/null
-  '';
-
-  meta = {
-    description = "Lightweight streaming server which brings DLNA / UPNP and Chromecast support to PulseAudio and Linux";
-    mainProgram = "pulseaudio-dlna";
-    homepage = "https://github.com/Cygn/pulseaudio-dlna";
-    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ mog ];
-    platforms = lib.platforms.linux;
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 35cbb274e051..b6c3c205c53c 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -2087,6 +2087,7 @@ mapAliases {
   pscid = throw "'pscid' has been removed because it was unmaintained upstream"; # Added 2025-12-12
   psi = throw "'psi' has been removed as it depended on EOL qt5 webengine. Consider moving to psi-plus, a somewhat more maintained fork."; # Added 2026-04-15
   pulp = throw "'pulp' has been removed because it was unmaintained upstream"; # Added 2025-12-12
+  pulseaudio-dlna = throw "'pulseaudio-dlna' has been removed because its upstream fork is inactive and Debian removed it as RC-buggy; use 'pa-dlna' instead."; # Added 2026-09-02
   puppet = warnAlias "'puppet' has been replaced by 'openvox'" openvox; # Added 2026-07-07
   purescript-psa = throw "'purescript-psa' has been removed because it was unmaintained within nixpkgs"; # Added 2025-12-12
   purple-discord = throw "'purple-discord' has been renamed to/replaced by 'pidginPackages.purple-discord'"; # Converted to throw 2025-10-27

From 35a25e86d2fe0ecf6248c9764b47690aefd75c19 Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Wed, 2 Sep 2026 08:48:22 -0700
Subject: [PATCH 018/525] zsh-powerlevel9k: drop

Upstream archived it: https://github.com/Powerlevel9k/powerlevel9k
---
 pkgs/by-name/zs/zsh-powerlevel9k/package.nix | 36 --------------------
 pkgs/top-level/aliases.nix                   |  1 +
 2 files changed, 1 insertion(+), 36 deletions(-)
 delete mode 100644 pkgs/by-name/zs/zsh-powerlevel9k/package.nix

diff --git a/pkgs/by-name/zs/zsh-powerlevel9k/package.nix b/pkgs/by-name/zs/zsh-powerlevel9k/package.nix
deleted file mode 100644
index 160e39d2f44a..000000000000
--- a/pkgs/by-name/zs/zsh-powerlevel9k/package.nix
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-}:
-
-stdenv.mkDerivation {
-  pname = "powerlevel9k";
-  version = "2017-11-10";
-  src = fetchFromGitHub {
-    owner = "Powerlevel9k";
-    repo = "powerlevel9k";
-    rev = "87acc51acab3ed4fd33cda2386abed6f98c80720";
-    sha256 = "0v1dqg9hvycdkcvklg2njff97xwr8rah0nyldv4xm39r77f4yfvq";
-  };
-
-  strictDeps = true;
-  installPhase = ''
-    install -D powerlevel9k.zsh-theme --target-directory=$out/share/zsh/themes/powerlevel9k
-    install -D functions/* --target-directory=$out/share/zsh/themes/powerlevel9k/functions
-    ln -s $out/share/zsh/themes/powerlevel9k $out/share/zsh-powerlevel9k
-  '';
-
-  meta = {
-    description = "Beautiful theme for zsh";
-    longDescription = ''
-      To make use of this derivation, use
-      `programs.zsh.promptInit = "source ''${pkgs.zsh-powerlevel9k}/share/zsh-powerlevel9k/powerlevel9k.zsh-theme";`
-    '';
-    homepage = "https://github.com/Powerlevel9k/powerlevel9k";
-    license = lib.licenses.mit;
-
-    platforms = lib.platforms.unix;
-    maintainers = [ lib.maintainers.pierrechevalier83 ];
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 35cbb274e051..4d1d10cfd4b9 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -3072,6 +3072,7 @@ mapAliases {
   zq = throw "zq has been replaced by zed"; # Converted to throw 2025-10-26
   zscroll = throw "zscroll has been removed due to lack of maintenance."; # Added 2026-05-29
   zsh-git-prompt = throw "zsh-git-prompt was removed as it is unmaintained upstream"; # Added 2025-08-28
+  zsh-powerlevel9k = throw "'zsh-powerlevel9k' has been removed because Powerlevel9k is archived and unmaintained; use 'zsh-powerlevel10k' instead."; # Added 2026-09-02
   zuki-themes = throw "'zuki-themes' has been removed because it depended on 'gtk-engine-murrine', which was removed because it was unmaintained upstream and depended on GTK 2."; # Added 2026-07-22
   zulu23 = throw "Zulu OpenJDK 23 was removed as it has reached its end of life"; # Added 2025-11-14
   zulu24 = throw "Zulu OpenJDK 24 was removed as it has reached its end of life"; # Added 2025-11-14

From f8f73526666e59801a8b29bbbbb94831e2b53259 Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Wed, 2 Sep 2026 09:10:26 -0700
Subject: [PATCH 019/525] gohai: drop

Upstream archived it: https://github.com/DataDog/gohai
---
 pkgs/by-name/go/gohai/package.nix | 39 -------------------------------
 pkgs/top-level/aliases.nix        |  1 +
 2 files changed, 1 insertion(+), 39 deletions(-)
 delete mode 100644 pkgs/by-name/go/gohai/package.nix

diff --git a/pkgs/by-name/go/gohai/package.nix b/pkgs/by-name/go/gohai/package.nix
deleted file mode 100644
index c8b2e18af574..000000000000
--- a/pkgs/by-name/go/gohai/package.nix
+++ /dev/null
@@ -1,39 +0,0 @@
-{
-  lib,
-  buildGoModule,
-  fetchFromGitHub,
-}:
-
-buildGoModule {
-  pname = "gohai";
-  version = "0-unstable-2022-04-12";
-
-  src = fetchFromGitHub {
-    owner = "DataDog";
-    repo = "gohai";
-    rev = "c614f513e87f04d3d19b2d4ae853cc5703f3a9bc";
-    sha256 = "sha256-vdzGGTg9SHYS0OQUn3VvrQGpKxzqxBRXDKOm0c7FvYY=";
-  };
-
-  vendorHash = "sha256-aN1fwGbBm45e6qdRu+4wnv2ZI7SOsIPONB4vF9o2vlI=";
-
-  ldflags = [
-    "-s"
-    "-w"
-  ];
-
-  doCheck = false;
-
-  meta = {
-    description = "System information collector";
-    homepage = "https://github.com/DataDog/gohai";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ tazjin ];
-    longDescription = ''
-      Gohai is a tool which collects an inventory of system
-      information. It is used by the Datadog agent to provide detailed
-      system metrics.
-    '';
-    mainProgram = "gohai";
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 35cbb274e051..99a551463b89 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1049,6 +1049,7 @@ mapAliases {
   godot_4-export-templates = throw "'godot_4-export-templates' has been renamed to/replaced by 'godot_4-export-templates-bin'"; # Converted to throw 2025-10-27
   godot_4_3-export-templates = throw "'godot_4_3-export-templates' has been renamed to/replaced by 'godot_4_3-export-templates-bin'"; # Converted to throw 2025-10-27
   godot_4_4-export-templates = throw "'godot_4_4-export-templates' has been renamed to/replaced by 'godot_4_4-export-templates-bin'"; # Converted to throw 2025-10-27
+  gohai = throw "'gohai' has been removed because upstream archived the project in November 2023."; # Added 2026-09-02
   goldendict = throw "'goldendict' has been removed as upstream goldendict/goldendict is unmaintained and depends on deprecated qtwebkit; use the actively-developed Qt6 fork 'goldendict-ng' instead"; # Added 2026-04-26
   goldwarden = throw "'goldwarden' has been removed, as it no longer works with new Bitwarden versions and is abandoned upstream"; # Added 2025-09-16
   goocanvas2 = warnAlias "'goocanvas2' has been renamed to goocanvas_2" goocanvas_2; # Added 2026-01-17

From 73e609f72b464a434b0b46581ab18914050b443d Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Wed, 2 Sep 2026 09:09:56 -0700
Subject: [PATCH 020/525] dnsmon-go: drop

Upstream archived it: https://github.com/jonpulsifer/dnsmon-go
---
 pkgs/by-name/dn/dnsmon-go/package.nix | 32 ---------------------------
 pkgs/top-level/aliases.nix            |  1 +
 2 files changed, 1 insertion(+), 32 deletions(-)
 delete mode 100644 pkgs/by-name/dn/dnsmon-go/package.nix

diff --git a/pkgs/by-name/dn/dnsmon-go/package.nix b/pkgs/by-name/dn/dnsmon-go/package.nix
deleted file mode 100644
index 2757812bf968..000000000000
--- a/pkgs/by-name/dn/dnsmon-go/package.nix
+++ /dev/null
@@ -1,32 +0,0 @@
-{
-  lib,
-  buildGoModule,
-  fetchFromGitHub,
-  libpcap,
-}:
-
-buildGoModule {
-  pname = "dnsmon-go";
-  version = "0-unstable-2022-05-13";
-
-  src = fetchFromGitHub {
-    owner = "jonpulsifer";
-    repo = "dnsmon-go";
-    rev = "ec1d59f1f1314ce310ad4c04d2924e0ebd857f1d";
-    hash = "sha256-lAJ2bjs5VLzrHd09eFK4X0V/cCee2QsgdgiKq+y2c10=";
-  };
-
-  vendorHash = "sha256-aiX+NGUsFK0N9vC5baAHHMr28CbF5Xa4WgYLFFLBYTs=";
-
-  buildInputs = [
-    libpcap
-  ];
-
-  meta = {
-    description = "Tool to collect DNS traffic";
-    homepage = "https://github.com/jonpulsifer/dnsmon-go";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ fab ];
-    mainProgram = "dnsmon-go";
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 35cbb274e051..e17e1abf1c26 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -692,6 +692,7 @@ mapAliases {
   dleyna-renderer = throw "'dleyna-renderer' has been renamed to/replaced by 'dleyna'"; # Converted to throw 2025-10-27
   dleyna-server = throw "'dleyna-server' has been renamed to/replaced by 'dleyna'"; # Converted to throw 2025-10-27
   dnscrypt-proxy2 = throw "'dnscrypt-proxy2' has been renamed to/replaced by 'dnscrypt-proxy'"; # Converted to throw 2025-10-27
+  dnsmon-go = throw "'dnsmon-go' has been removed because upstream archived the project in August 2025."; # Added 2026-09-02
   docker-distribution = throw "'docker-distribution' has been renamed to/replaced by 'distribution'"; # Converted to throw 2025-10-27
   docker-machine-hyperkit = throw "docker-machine-hyperkit has been removed as it only supported x86_64-darwin"; # Added 2026-07-12
   docker-sync = throw "'docker-sync' has been removed because it was broken and unmaintained"; # Added 2025-08-26

From 60e2e5f07698e0523bed2a54eca8a7c5f3641787 Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Sat, 5 Sep 2026 00:19:00 +0700
Subject: [PATCH 021/525] xenomapper: drop unneeded statistics dependency

---
 pkgs/by-name/xe/xenomapper/package.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/by-name/xe/xenomapper/package.nix b/pkgs/by-name/xe/xenomapper/package.nix
index bfb24b7dfeea..0cac135be760 100644
--- a/pkgs/by-name/xe/xenomapper/package.nix
+++ b/pkgs/by-name/xe/xenomapper/package.nix
@@ -18,8 +18,6 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
 
   build-system = with python3.pkgs; [ setuptools ];
 
-  dependencies = with python3.pkgs; [ statistics ];
-
   pythonImportsCheck = [
     "xenomapper.xenomapper"
     "xenomapper.mappability"

From b2281f1d7dd3c8d9ac02d833886dfe1ab284a2a5 Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Sat, 5 Sep 2026 00:19:00 +0700
Subject: [PATCH 022/525] python3Packages.statistics: drop

---
 .../python-modules/statistics/default.nix     | 29 -------------------
 pkgs/top-level/python-aliases.nix             |  1 +
 pkgs/top-level/python-packages.nix            |  2 --
 3 files changed, 1 insertion(+), 31 deletions(-)
 delete mode 100644 pkgs/development/python-modules/statistics/default.nix

diff --git a/pkgs/development/python-modules/statistics/default.nix b/pkgs/development/python-modules/statistics/default.nix
deleted file mode 100644
index 5664dc2eaefb..000000000000
--- a/pkgs/development/python-modules/statistics/default.nix
+++ /dev/null
@@ -1,29 +0,0 @@
-{
-  lib,
-  fetchPypi,
-  buildPythonPackage,
-  docutils,
-}:
-
-buildPythonPackage rec {
-  pname = "statistics";
-  version = "1.0.3.5";
-  format = "setuptools";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "2dc379b80b07bf2ddd5488cad06b2b9531da4dd31edb04dc9ec0dc226486c138";
-  };
-
-  propagatedBuildInputs = [ docutils ];
-
-  # statistics package does not have any tests
-  doCheck = false;
-
-  meta = {
-    description = "Python 2.* port of 3.4 Statistics Module";
-    homepage = "https://github.com/digitalemagine/py-statistics";
-    license = lib.licenses.asl20;
-    maintainers = [ ];
-  };
-}
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 158bc6f23967..6f992cbbac2d 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -715,6 +715,7 @@ mapAliases {
   sqlalchemy-views = throw "'sqlalchemy-views' has been removed as it was broken and unmaintained upstream"; # Added 2025-11-09
   sqlalchemy_1_3 = throw "'sqlalchemy_1_3' has been removed because it was actually version 1.4.54"; # added 2026-07-20
   sqlalchemy_migrate = throw "'sqlalchemy_migrate' has been renamed to/replaced by 'sqlalchemy-migrate'"; # Converted to throw 2025-10-29
+  statistics = throw "'statistics' has been removed because it is unmaintained upstream"; # Added 2026-09-05
   steamship = throw "'steamship' has been removed because it is broken and unmaintained upstream"; # Added 2026-05-06
   stookalert = throw "'stookalert' has been removed because it is unmaintained upstream"; # Added 2026-08-04
   strawberry-django = strawberry-graphql-django; # Added 2026-07-14
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index b55259ee5e43..29035beea137 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -19885,8 +19885,6 @@ self: super: with self; {
 
   staticvectors = callPackage ../development/python-modules/staticvectors { };
 
-  statistics = callPackage ../development/python-modules/statistics { };
-
   statmake = callPackage ../development/python-modules/statmake { };
 
   statsd = callPackage ../development/python-modules/statsd { };

From 32e76d815df6bd43a642efdc9fe1c65f4507a584 Mon Sep 17 00:00:00 2001
From: Grayson Tinker <graysontinker@gmail.com>
Date: Thu, 10 Sep 2026 22:43:40 -0600
Subject: [PATCH 023/525] drawio-headless: inherit license from drawio

---
 pkgs/by-name/dr/drawio-headless/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/dr/drawio-headless/package.nix b/pkgs/by-name/dr/drawio-headless/package.nix
index 44349752154c..9fdd07d37e94 100644
--- a/pkgs/by-name/dr/drawio-headless/package.nix
+++ b/pkgs/by-name/dr/drawio-headless/package.nix
@@ -41,6 +41,6 @@ writeTextFile {
       tfc
     ];
     mainProgram = "drawio";
-    license = lib.licenses.mit; # Wrapper itself is MIT
+    inherit (drawio.meta) license;
   };
 }

From 3c70732e61673cd8651ba88bed8c2045965fde07 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 14 Sep 2026 22:24:51 +0000
Subject: [PATCH 024/525] tomcat-native: 2.0.15 -> 2.0.16

---
 pkgs/servers/http/tomcat/tomcat-native.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/http/tomcat/tomcat-native.nix b/pkgs/servers/http/tomcat/tomcat-native.nix
index 4691081c523f..e292da8a3dfe 100644
--- a/pkgs/servers/http/tomcat/tomcat-native.nix
+++ b/pkgs/servers/http/tomcat/tomcat-native.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "tomcat-native";
-  version = "2.0.15";
+  version = "2.0.16";
 
   src = fetchurl {
     url = "mirror://apache/tomcat/tomcat-connectors/native/${version}/source/${pname}-${version}-src.tar.gz";
-    hash = "sha256-jasJ8hrVGcnknlKH+NjeibsXal45aEefJ5SMMbKjtrQ=";
+    hash = "sha256-eF/dmaIC9EKwhbxxjS++s5O4WXmqSilDMCEYxKzWhjA=";
   };
 
   sourceRoot = "${pname}-${version}-src/native";

From 69280dc8157c542545e6705db397b1d61c4fae10 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Thu, 17 Sep 2026 21:43:33 -0400
Subject: [PATCH 025/525] nixosTests.gpauth-tls: init

Test utilizes tls gio plugin through embedded webkit.

Related: https://github.com/NixOS/nixpkgs/pull/564159

Assisted-by: Codex, gpt-5.6-sol high
---
 nixos/tests/all-tests.nix          |  1 +
 nixos/tests/gpauth-tls.nix         | 72 ++++++++++++++++++++++++++++++
 pkgs/by-name/gp/gpauth/package.nix |  6 ++-
 3 files changed, 78 insertions(+), 1 deletion(-)
 create mode 100644 nixos/tests/gpauth-tls.nix

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 386dc9914b98..9800f604757a 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -795,6 +795,7 @@ in
   gotify-server = runTest ./gotify-server.nix;
   gotosocial = runTest ./web-apps/gotosocial.nix;
   goupile = runTest ./web-apps/goupile;
+  gpauth-tls = runTest ./gpauth-tls.nix;
   grafana = import ./grafana {
     inherit runTest;
   };
diff --git a/nixos/tests/gpauth-tls.nix b/nixos/tests/gpauth-tls.nix
new file mode 100644
index 000000000000..1fb85dc654cc
--- /dev/null
+++ b/nixos/tests/gpauth-tls.nix
@@ -0,0 +1,72 @@
+{ config, ... }:
+
+{
+  name = "gpauth-tls";
+
+  meta.maintainers = config.node.pkgs.gpauth.meta.maintainers;
+
+  nodes.machine =
+    { pkgs, ... }:
+    let
+      httpsServer = pkgs.writeText "gpauth-test-server.py" ''
+        import ssl
+        from http.server import BaseHTTPRequestHandler, HTTPServer
+
+        class Handler(BaseHTTPRequestHandler):
+            def do_GET(self):
+                body = b"<html><body>authenticated</body></html>"
+                self.send_response(200)
+                self.send_header("Content-Type", "text/html")
+                self.send_header("Content-Length", str(len(body)))
+                self.send_header("saml-auth-status", "1")
+                self.send_header("saml-username", "fixture-user")
+                self.send_header("prelogin-cookie", "fixture-cookie")
+                self.end_headers()
+                self.wfile.write(body)
+
+            def log_message(self, format, *args):
+                pass
+
+        context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+        context.load_cert_chain("cert.pem", "key.pem")
+
+        server = HTTPServer(("127.0.0.1", 4443), Handler)
+        server.socket = context.wrap_socket(server.socket, server_side=True)
+        server.serve_forever()
+      '';
+    in
+    {
+      imports = [ ./common/x11.nix ];
+
+      environment.systemPackages = [ pkgs.gpauth ];
+
+      systemd.services.gpauth-test-server = {
+        description = "gpauth test SAML endpoint";
+        wantedBy = [ "multi-user.target" ];
+        preStart = ''
+          ${pkgs.openssl}/bin/openssl req -x509 -newkey rsa:2048 -noenc \
+            -subj /CN=localhost -keyout key.pem -out cert.pem
+        '';
+        serviceConfig = {
+          ExecStart = "${pkgs.python3}/bin/python ${httpsServer}";
+          RuntimeDirectory = "gpauth-test-server";
+          WorkingDirectory = "/run/gpauth-test-server";
+        };
+      };
+    };
+
+  testScript = ''
+    machine.wait_for_x()
+    machine.wait_for_unit("gpauth-test-server.service")
+    machine.wait_for_open_port(4443)
+
+    output = machine.succeed(
+      "DISPLAY=:0 timeout 30s gpauth localhost "
+      "--saml-request https://127.0.0.1:4443/ "
+      # self-signed cert is used
+      "--ignore-tls-errors"
+    )
+    assert "fixture-user" in output
+    assert "fixture-cookie" in output
+  '';
+}
diff --git a/pkgs/by-name/gp/gpauth/package.nix b/pkgs/by-name/gp/gpauth/package.nix
index 108138b85044..63d027b2347e 100644
--- a/pkgs/by-name/gp/gpauth/package.nix
+++ b/pkgs/by-name/gp/gpauth/package.nix
@@ -7,6 +7,7 @@
   perl,
   webkitgtk_4_1,
   stdenv,
+  nixosTests,
   nix-update-script,
 }:
 
@@ -43,7 +44,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "--skip=cli::tests::client_version_arg_sets_profile_client_version"
   ];
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.runtime-tls = nixosTests.gpauth-tls;
+  };
 
   meta = {
     changelog = "https://github.com/${finalAttrs.src.owner}/${finalAttrs.src.repo}/blob/${finalAttrs.src.rev}/changelog.md";

From c55e0756b703bc0bb5076a8a199775e725da8330 Mon Sep 17 00:00:00 2001
From: thegarchivist <aog@tuta.com>
Date: Tue, 29 Oct 2024 16:28:51 -0400
Subject: [PATCH 026/525] waydroid: add long description

---
 pkgs/by-name/wa/waydroid/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/wa/waydroid/package.nix b/pkgs/by-name/wa/waydroid/package.nix
index 661e6fe6581d..be2fae3d76dc 100644
--- a/pkgs/by-name/wa/waydroid/package.nix
+++ b/pkgs/by-name/wa/waydroid/package.nix
@@ -98,6 +98,10 @@ python3Packages.buildPythonApplication rec {
 
   meta = {
     description = "Container-based approach to boot a full Android system on a regular GNU/Linux system";
+    longDescription = ''
+      A container-based approach to boot a full Android system on regular GNU/Linux systems running Wayland based desktop environments.
+      To install on NixOS, please use the option `virtualisation.waydroid.enable = true`.
+    '';
     mainProgram = "waydroid";
     homepage = "https://github.com/waydroid/waydroid";
     license = lib.licenses.gpl3Only;

From d584bdf226a6ed770a2484fb93922a32521ed6a7 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 20 Sep 2026 16:35:30 +0200
Subject: [PATCH 027/525] nfswolf: mark as linux-only

---
 pkgs/by-name/nf/nfswolf/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/nf/nfswolf/package.nix b/pkgs/by-name/nf/nfswolf/package.nix
index db0c91400b47..ac270a103c56 100644
--- a/pkgs/by-name/nf/nfswolf/package.nix
+++ b/pkgs/by-name/nf/nfswolf/package.nix
@@ -37,5 +37,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "nfswolf";
+    platforms = lib.platforms.linux;
   };
 })

From 7e73ac2afdd9c7c07349e1aecd44755c752fab23 Mon Sep 17 00:00:00 2001
From: alliumm <33610620+alliumm@users.noreply.github.com>
Date: Tue, 22 Sep 2026 11:52:57 -0700
Subject: [PATCH 028/525] lms: pin boost to 1.90

avoids a segfault with boost 1.91
---
 pkgs/by-name/lm/lms/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/lm/lms/package.nix b/pkgs/by-name/lm/lms/package.nix
index 322d11f5457c..f765cb1072c5 100644
--- a/pkgs/by-name/lm/lms/package.nix
+++ b/pkgs/by-name/lm/lms/package.nix
@@ -5,7 +5,7 @@
   cmake,
   pkg-config,
   gtest,
-  boost,
+  boost190,
   wt,
   taglib,
   libconfig,
@@ -20,6 +20,9 @@
   onnxruntime,
 }:
 
+let
+  boost = boost190;
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "lms";
   version = "3.80.0";

From c7e1318405e8b6456f8b3b40ec2cce3e26816383 Mon Sep 17 00:00:00 2001
From: alliumm <33610620+alliumm@users.noreply.github.com>
Date: Tue, 22 Sep 2026 12:27:38 -0700
Subject: [PATCH 029/525] lms: 3.80.0 -> 3.81.0

---
 pkgs/by-name/lm/lms/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/lm/lms/package.nix b/pkgs/by-name/lm/lms/package.nix
index f765cb1072c5..ae02ebb1f80a 100644
--- a/pkgs/by-name/lm/lms/package.nix
+++ b/pkgs/by-name/lm/lms/package.nix
@@ -25,13 +25,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "lms";
-  version = "3.80.0";
+  version = "3.81.0";
 
   src = fetchFromGitHub {
     owner = "epoupon";
     repo = "lms";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-TXtSsQ6qsZd5WpW9d9o/ELcvkGEMj9Sih376AoyyaFA=";
+    hash = "sha256-wyMTnTlKMS4N3zTY4C574BTB88nRugsi21QWjDeLZrg=";
   };
 
   strictDeps = true;
@@ -55,6 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
     xxhash
     pugixml
     onnxruntime
+    ffmpeg
   ];
 
   postPatch = ''
@@ -62,7 +63,6 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   postInstall = ''
-    substituteInPlace $out/share/lms/lms.conf --replace-fail "/usr/bin/ffmpeg" "${lib.getExe ffmpeg}"
     substituteInPlace $out/share/lms/lms.conf --replace-fail "/usr/share/Wt/resources" "${wt}/share/Wt/resources"
     substituteInPlace $out/share/lms/lms.conf --replace-fail "/usr/share/lms" "$out/share/lms"
     substituteInPlace $out/share/lms/default.service --replace-fail "/usr/bin/lms" "$out/bin/lms"

From 8c2e42e91f270d16216a6b56c45d4e1842086dc7 Mon Sep 17 00:00:00 2001
From: Anton Tetov Johansson <anton@tetov.se>
Date: Tue, 22 Sep 2026 14:15:36 +0200
Subject: [PATCH 030/525] liblzf: provide cmake config, add bin output

Adds CMakeLists.txt from Debian, and switches from autoconf to CMake-based build.

This is to provide a CMake config, expose the headers in the same way as Debian does (<liblzf/liblzf.h>) and with a symlink to not break any existing includes.

Debian CMakeLists.txt patched to provide lzf executables, which now go in the bin output.
---
 pkgs/by-name/li/liblzf/cmake.patch |  65 ++++++++++++++++++
 pkgs/by-name/li/liblzf/lib_test.c  |   2 +-
 pkgs/by-name/li/liblzf/package.nix | 102 ++++++++++++++++++-----------
 3 files changed, 129 insertions(+), 40 deletions(-)
 create mode 100644 pkgs/by-name/li/liblzf/cmake.patch

diff --git a/pkgs/by-name/li/liblzf/cmake.patch b/pkgs/by-name/li/liblzf/cmake.patch
new file mode 100644
index 000000000000..a2b27f0ab260
--- /dev/null
+++ b/pkgs/by-name/li/liblzf/cmake.patch
@@ -0,0 +1,65 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index e1944f4564..f360948c1b 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -45,7 +45,7 @@
+ add_library(${PROJECT_NAME} lzf_c.c lzf_d.c lzf.h lzfP.h)
+ target_include_directories(${PROJECT_NAME} PUBLIC
+ 	$<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}>
+-	$<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}/${PROJECT_NAME}>
++	$<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>
+ )
+ set_target_properties(${PROJECT_NAME} PROPERTIES
+ 	VERSION ${API_VERSION}
+@@ -57,7 +57,7 @@
+ add_library(embed INTERFACE)
+ target_include_directories(embed INTERFACE
+ 	$<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}>
+-	$<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}/${PROJECT_NAME}>
++	$<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>
+ )
+ target_sources(embed INTERFACE
+ 	$<BUILD_INTERFACE:lzf_c.c> $<BUILD_INTERFACE:lzf_d.c>
+@@ -95,3 +95,21 @@
+ 	${CMAKE_CURRENT_BINARY_DIR}/${PROJECT_NAME}-config-version.cmake
+ 	DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/${PROJECT_NAME}
+ )
++
++include(CheckIncludeFile)
++include(CheckFunctionExists)
++
++check_include_file(getopt.h HAVE_GETOPT_H)
++check_function_exists(getopt_long HAVE_GETOPT_LONG)
++
++configure_file(config.h.cmake.in config.h)
++
++add_executable(lzf-bin lzf.c)
++set_target_properties(lzf-bin PROPERTIES OUTPUT_NAME lzf)
++target_include_directories(lzf-bin PRIVATE "${CMAKE_CURRENT_BINARY_DIR}")
++target_link_libraries(lzf-bin PRIVATE liblzf)
++
++install(
++  TARGETS lzf-bin
++  RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
++)
+diff --git a/config.h.cmake.in b/config.h.cmake.in
+new file mode 100644
+index 0000000000..854a88f142
+--- /dev/null
++++ b/config.h.cmake.in
+@@ -0,0 +1,2 @@
++#cmakedefine HAVE_GETOPT_H 1
++#cmakedefine HAVE_GETOPT_LONG 1
+diff --git a/liblzf.pc.in b/liblzf.pc.in
+index 1da19e3eeb..619287c82f 100644
+--- a/liblzf.pc.in
++++ b/liblzf.pc.in
+@@ -1,6 +1,6 @@
+ prefix=@CMAKE_INSTALL_PREFIX@
+-includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@/@PROJECT_NAME@
+-libdir=${prefix}/@CMAKE_INSTALL_LIBDIR@
++includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@
++libdir=@CMAKE_INSTALL_FULL_LIBDIR@
+ 
+ Name: @PROJECT_NAME@
+ Description: A very small data compression library
diff --git a/pkgs/by-name/li/liblzf/lib_test.c b/pkgs/by-name/li/liblzf/lib_test.c
index 04655d35a1e4..7f5137146cb7 100644
--- a/pkgs/by-name/li/liblzf/lib_test.c
+++ b/pkgs/by-name/li/liblzf/lib_test.c
@@ -1,4 +1,4 @@
-#include "lzf.h"
+#include <liblzf/lzf.h>
 #include <stdio.h>
 #include <string.h>
 
diff --git a/pkgs/by-name/li/liblzf/package.nix b/pkgs/by-name/li/liblzf/package.nix
index b75d4013d2ef..46c75dbd7124 100644
--- a/pkgs/by-name/li/liblzf/package.nix
+++ b/pkgs/by-name/li/liblzf/package.nix
@@ -2,76 +2,98 @@
   lib,
   stdenv,
   fetchDebianPatch,
-  fetchpatch,
   fetchurl,
-  pkg-config,
   testers,
   validatePkgConfig,
-  autoconf,
-  automake,
-  libtool,
+
+  cmake,
+  pkg-config,
 }:
+let
+  debianRevision = toString 4;
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "liblzf";
   version = "3.6";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   src = fetchurl {
     url = "https://dist.schmorp.de/liblzf/liblzf-${finalAttrs.version}.tar.gz";
     hash = "sha256-nF3gH3ucyuQMP2GdJqer7JmGwGw20mDBec7dBLiftGo=";
   };
 
+  outputs = [
+    "out"
+    "bin"
+    "dev"
+  ];
+
+  prePatch =
+    let
+      debianBaseUrl = "https://sources.debian.org/data/main/libl/liblzf/${finalAttrs.version}-${debianRevision}/debian";
+
+      debianCmakeLists = fetchurl {
+        url = "${debianBaseUrl}/extras/CMakeLists.txt";
+        hash = "sha256-QlgWq7xLhgvhBvtZ1e2ngMTpA/Dp6USdVgN+RfgO5x4=";
+      };
+
+      debianCmakeConfig = fetchurl {
+        url = "${debianBaseUrl}/extras/liblzf-config.cmake.in";
+        hash = "sha256-WvQ+QAFGxaPCz80ne3OA4L5cc/vUp5iMQe/2wGfoTMw=";
+      };
+
+      debianPkgConfig = fetchurl {
+        url = "${debianBaseUrl}/extras/liblzf.pc.in";
+        hash = "sha256-0KBA1duW420/DgaXQiyNlKBkQpVBH6LPucf11e4b8go=";
+      };
+    in
+    ''
+      cp --no-preserve=mode ${debianCmakeLists} CMakeLists.txt
+      cp --no-preserve=mode ${debianCmakeConfig} liblzf-config.cmake.in
+      cp --no-preserve=mode ${debianPkgConfig} liblzf.pc.in
+    '';
+
   patches = [
     (fetchDebianPatch {
       inherit (finalAttrs) pname version;
-      debianRevision = "4";
+      inherit debianRevision;
       patch = "0001-Make-sure-that-the-library-is-linked-with-C-symbols.patch";
       hash = "sha256-Rgfp/TysRcEJaogOo/Xno+G4HZzj9Loa69DL43Bp1Ok=";
     })
-    (
-      let
-        name = "liblzf-3.6-autoconf-20140314.patch";
-      in
-      fetchpatch {
-        inherit name;
-        url = "https://src.fedoraproject.org/rpms/liblzf/raw/53da654eead51a24ac81a28e1b1c531eb1afab28/f/${name}";
-        hash = "sha256-rkhI8w0HV3fGiDfHiXBzrnxqGDE/Yo5ntePrsscMiyg=";
-      }
-    )
+    ./cmake.patch
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_SHARED_LIBS" true)
   ];
 
   nativeBuildInputs = [
-    autoconf
-    automake
-    libtool
+    cmake
     pkg-config
     validatePkgConfig
   ];
 
-  preConfigure = ''
-    sh ./bootstrap.sh
-  '';
-
   postInstall = ''
-    pushd $out/bin
-    ln -s lzf unlzf
-    popd
+    ln -s lzf $bin/bin/unlzf
+    ln -s liblzf/lzf.h $dev/include/lzf.h
   '';
 
-  outputs = [
-    "out"
-    "dev"
-  ];
-
   passthru.tests = {
+    cmakeConfigTest = testers.hasCmakeConfigModules {
+      package = finalAttrs.finalPackage;
+      moduleNames = [ "liblzf" ];
+    };
+
     pkgConfigTest = testers.hasPkgConfigModules {
       package = finalAttrs.finalPackage;
-      version = "${finalAttrs.version}.0";
       versionCheck = true;
     };
 
     exeTest = testers.runCommand {
       name = "${finalAttrs.pname}-exe-test";
-      buildInputs = [ finalAttrs.finalPackage ];
+      buildInputs = [ finalAttrs.finalPackage.bin ];
       script = ''
         lzf -h 2> /dev/null
 
@@ -89,8 +111,6 @@ stdenv.mkDerivation (finalAttrs: {
           exit 1
         fi
 
-        echo "Decompressed output matches test string (lzf & unlzf)"
-
         touch $out
       '';
     };
@@ -101,16 +121,20 @@ stdenv.mkDerivation (finalAttrs: {
       nativeBuildInputs = [ pkg-config ];
       buildInputs = [
         finalAttrs.finalPackage.dev
-        finalAttrs.finalPackage
       ];
-      # tests both the library and pkg-config file
       script = ''
-        $CC -g ${./lib_test.c} -o lib_test \
+        substitute ${./lib_test.c} lib_test.c \
+          --replace-fail '#include <liblzf/lzf.h>' '#include <lzf.h>'
+        $CC -g lib_test.c -o lib_test \
           $(pkg-config --cflags --libs liblzf)
 
         ./lib_test >/dev/null
 
-        echo "Built and tested file linked against liblzf using pkg-config"
+        $CC -g ${./lib_test.c} -o lib_test-namespaced \
+          $(pkg-config --cflags --libs liblzf)
+
+        ./lib_test-namespaced >/dev/null
+
         touch $out
       '';
     };

From 22ce5b10d52ab79e142c574fe5663c087a5f27b9 Mon Sep 17 00:00:00 2001
From: Byte Flavour <synapse@byteflavour.dev>
Date: Wed, 23 Sep 2026 14:48:36 +0200
Subject: [PATCH 031/525] forgejo-mcp: 3.0.1 -> 3.2.0

Changelog: https://git.b4mad.industries/agentic-forges/forgejo-mcp/src/tag/v3.2.0/CHANGELOG.md

No breaking changes. 3.1.0 lets the issue tools take label names and
hardens the attachment uploads and the loopback transport binding;
3.2.0 adds an opt-in OAuth resource-server auth mode, package tools and
get_commit_statuses, plus cross-repo issue dependencies. The default
passthrough auth mode is unchanged.

Assisted-by: Claude Code (Claude Opus 5, claude-opus-5)
---
 pkgs/by-name/fo/forgejo-mcp/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fo/forgejo-mcp/package.nix b/pkgs/by-name/fo/forgejo-mcp/package.nix
index dc0dd473817e..0449411efdb8 100644
--- a/pkgs/by-name/fo/forgejo-mcp/package.nix
+++ b/pkgs/by-name/fo/forgejo-mcp/package.nix
@@ -8,17 +8,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "forgejo-mcp";
-  version = "3.0.1";
+  version = "3.2.0";
 
   # Plain git fetch: upstream's Forgejo instance has source-archive
   # downloads disabled, so fetchFromForgejo (tarball-based) cannot be used.
   src = fetchgit {
     url = "https://git.b4mad.industries/agentic-forges/forgejo-mcp.git";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Cq99Bj9I9oXM00fL9IBGq/EKj7Jv/fODffohR8APeik=";
+    hash = "sha256-dZ7k2c0abejHuwdRkXcOMKCnDeY193PYkIg0LVzbvII=";
   };
 
-  vendorHash = "sha256-Za1lwQQr+qeMIokRLSn2ywRg+5GxMS4KEg+99P1YHy0=";
+  vendorHash = "sha256-3RFWaohlUd6RpU531/DQH5wgVtjOi/Lh19Hyget7Bhw=";
 
   ldflags = [
     "-s"

From f99cdff6371b5e8d0e41c1fcbe353e45d1311a49 Mon Sep 17 00:00:00 2001
From: Byte Flavour <synapse@byteflavour.dev>
Date: Wed, 23 Sep 2026 14:48:41 +0200
Subject: [PATCH 032/525] forgejo-mcp: add byteflavour as maintainer

I use this package and intend to help keep it up to date alongside the
existing maintainer.

Assisted-by: Claude Code (Claude Opus 5, claude-opus-5)
---
 pkgs/by-name/fo/forgejo-mcp/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/fo/forgejo-mcp/package.nix b/pkgs/by-name/fo/forgejo-mcp/package.nix
index 0449411efdb8..e3c7676fa879 100644
--- a/pkgs/by-name/fo/forgejo-mcp/package.nix
+++ b/pkgs/by-name/fo/forgejo-mcp/package.nix
@@ -40,7 +40,10 @@ buildGoModule (finalAttrs: {
     homepage = "https://git.b4mad.industries/agentic-forges/forgejo-mcp";
     changelog = "https://git.b4mad.industries/agentic-forges/forgejo-mcp/src/tag/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ malik ];
+    maintainers = with lib.maintainers; [
+      malik
+      byteflavour
+    ];
     mainProgram = "forgejo-mcp";
   };
 })

From 623f73f8edeb2ea39674de688c9562bc4c8642d1 Mon Sep 17 00:00:00 2001
From: Rafael Ieda <git@ieda.me>
Date: Wed, 23 Sep 2026 13:00:59 -0300
Subject: [PATCH 033/525] xonotic-{dedicated,sdl}-unwrapped: restric to linux
 platform

---
 pkgs/games/xonotic/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/games/xonotic/default.nix b/pkgs/games/xonotic/default.nix
index 3dced799e8dc..82f8120be1e1 100644
--- a/pkgs/games/xonotic/default.nix
+++ b/pkgs/games/xonotic/default.nix
@@ -204,7 +204,7 @@ let
             --add-needed ${libtheora}/lib/libtheora.so \
             $out/bin/xonotic-sdl
       '';
-
+    meta.platforms = lib.platforms.linux;
     meta.mainProgram = "xonotic-${
       if withSDL then
         "sdl"

From b54ea29ee187556d047ef8abe8f99c432daaedea Mon Sep 17 00:00:00 2001
From: V3RM1N <mail@v3rm1n.dev>
Date: Wed, 23 Sep 2026 17:53:56 +0200
Subject: [PATCH 034/525] stoat-desktop: 1.5.3 -> 1.5.4

---
 pkgs/by-name/st/stoat-desktop/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/st/stoat-desktop/package.nix b/pkgs/by-name/st/stoat-desktop/package.nix
index 294eecdda758..50591d25f553 100644
--- a/pkgs/by-name/st/stoat-desktop/package.nix
+++ b/pkgs/by-name/st/stoat-desktop/package.nix
@@ -21,14 +21,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "stoat-desktop";
-  version = "1.5.3";
+  version = "1.5.4";
 
   src = fetchFromGitHub {
     owner = "stoatchat";
     repo = "for-desktop";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-UKMuMtBTfiA31K2i1buCFOtL9lf9xbv6BXVD5m4TARo=";
+    hash = "sha256-ouC+90Ulra+qbZbW4TeDS4IZraFULo+U/wKRYBwWR04=";
   };
 
   postPatch = ''
@@ -61,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     fetcherVersion = 4;
     pnpm = pnpm_11;
-    hash = "sha256-uiKTkXU0THzW46FiAfftqMWfrnFPCfgS/30ZuWmpHMI=";
+    hash = "sha256-ETP0S3H0MSzu7+5WvqnYGup2Nt4OJxQBMPUf7so92OU=";
   };
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";

From d6bc205ac9e1222d964ae6af7bb8df64d08a2d26 Mon Sep 17 00:00:00 2001
From: V3RM1N <mail@v3rm1n.dev>
Date: Wed, 23 Sep 2026 18:03:56 +0200
Subject: [PATCH 035/525] stoat-desktop: fix darwin build

---
 pkgs/by-name/st/stoat-desktop/package.nix | 40 +++++++++++++++++------
 1 file changed, 30 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/st/stoat-desktop/package.nix b/pkgs/by-name/st/stoat-desktop/package.nix
index 50591d25f553..8127ced50379 100644
--- a/pkgs/by-name/st/stoat-desktop/package.nix
+++ b/pkgs/by-name/st/stoat-desktop/package.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
   fetchPnpmDeps,
   makeDesktopItem,
-  desktopToDarwinBundle,
+  darwin,
   pnpmConfigHook,
   makeWrapper,
   removeReferencesTo,
@@ -12,6 +12,8 @@
   pnpm_11,
   nodejs,
   electron_43,
+  resvg,
+  libicns,
   zip,
   nix-update-script,
 }:
@@ -34,6 +36,21 @@ stdenv.mkDerivation (finalAttrs: {
   postPatch = ''
     # Disable auto-updates
     sed -i '/updateElectronApp([^)]*)/d' src/main.ts
+
+    # `@electron/fuses` tries to run `codesign` and fails, ad-hoc signing is
+    # done by autoSignDarwinBinariesHook instead
+    substituteInPlace forge.config.ts \
+      --replace-fail "version: FuseVersion.V1," "version: FuseVersion.V1, resetAdHocDarwinSignature: false,"
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    # Compiling the Icon Composer bundle needs actool from Xcode 26, which is
+    # unavailable in the sandbox. @electron/packager falls back to the icns
+    # variant of the same basename, so render one from the svg instead.
+    for size in 16 32 128 256 512; do
+      resvg --width "$size" --height "$size" assets/desktop/icon.svg "icon-$size.png"
+    done
+    png2icns assets/desktop/icon.icns icon-*.png
+    rm -r assets/desktop/icon.icon icon-*.png
   '';
 
   strictDeps = true;
@@ -44,13 +61,17 @@ stdenv.mkDerivation (finalAttrs: {
     pnpmConfigHook
     removeReferencesTo
     makeWrapper
-    copyDesktopItems
     nodejs
     pnpm_11
     zip
   ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    copyDesktopItems
+  ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    desktopToDarwinBundle
+    darwin.autoSignDarwinBinariesHook
+    resvg
+    libicns
   ];
 
   pnpmDeps = fetchPnpmDeps {
@@ -103,11 +124,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   installPhase = lib.concatStringsSep "\n" [
     "runHook preInstall"
-    # Make freedesktop stuff, then the convert hook should make them for Darwin
-    ''
-      install -Dm444 "assets/desktop/icon.svg" "$out/share/icons/hicolor/scalable/apps/stoat-desktop.svg"
-    ''
     (lib.optionalString stdenv.hostPlatform.isLinux ''
+      install -Dm444 "assets/desktop/icon.svg" "$out/share/icons/hicolor/scalable/apps/stoat-desktop.svg"
+
       # remove references to nodejs
       find out/*/resources/app/node_modules -type f -executable -exec remove-references-to -t ${nodejs} '{}' \;
 
@@ -121,8 +140,9 @@ stdenv.mkDerivation (finalAttrs: {
         --inherit-argv0
     '')
     (lib.optionalString stdenv.hostPlatform.isDarwin ''
-      mkdir -p "$out/Applications"
-      cp -r out/*/Stoat.app
+      # electron-forge already produces a complete application bundle
+      mkdir -p "$out/Applications" "$out/bin"
+      cp -r out/*/Stoat.app "$out/Applications/"
 
       makeWrapper "$out/Applications/Stoat.app/Contents/MacOS/stoat-desktop" "$out/bin/stoat-desktop" \
         --set ELECTRON_FORCE_IS_PACKAGED 1 \
@@ -158,7 +178,7 @@ stdenv.mkDerivation (finalAttrs: {
       v3rm1n0
       RossSmyth
     ];
-    platforms = with lib.platforms; linux ++ darwin;
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
     mainProgram = "stoat-desktop";
   };
 })

From 027ed6039aaec432b63b1e8aa0e37ee3d90dbd81 Mon Sep 17 00:00:00 2001
From: Rafael Ieda <git@ieda.me>
Date: Wed, 23 Sep 2026 13:42:57 -0300
Subject: [PATCH 036/525] supertuxkart-server: mark as broken on darwin

---
 pkgs/by-name/su/supertuxkart/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/su/supertuxkart/package.nix b/pkgs/by-name/su/supertuxkart/package.nix
index cb3ec3a73ead..2a80bf75c6c3 100644
--- a/pkgs/by-name/su/supertuxkart/package.nix
+++ b/pkgs/by-name/su/supertuxkart/package.nix
@@ -197,5 +197,8 @@ stdenv.mkDerivation (finalAttrs: {
     ];
     platforms = lib.platforms.all;
     changelog = "https://github.com/supertuxkart/stk-code/blob/${finalAttrs.version}/CHANGELOG.md";
+    # supertuxkart-server never built on darwin since first introduction in nixpkgs
+    # see https://hydra.nixos.org/build/345422087
+    broken = stdenv.hostPlatform.isDarwin && serverOnly;
   };
 })

From b35cd7370038dd9fad47f1a63a3b7a152290da07 Mon Sep 17 00:00:00 2001
From: en <54501296+2hexed@users.noreply.github.com>
Date: Wed, 23 Sep 2026 23:02:48 +0530
Subject: [PATCH 037/525] services/netdata: Improve descriptions in netdata
 configuration options

---
 nixos/modules/services/monitoring/netdata.nix | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/services/monitoring/netdata.nix b/nixos/modules/services/monitoring/netdata.nix
index e80650df3965..25d7db8fd15d 100644
--- a/nixos/modules/services/monitoring/netdata.nix
+++ b/nixos/modules/services/monitoring/netdata.nix
@@ -76,7 +76,7 @@ in
 {
   options = {
     services.netdata = {
-      enable = lib.mkEnableOption "netdata";
+      enable = lib.mkEnableOption "Netdata";
 
       package = lib.mkPackageOption pkgs "netdata" { };
 
@@ -180,7 +180,7 @@ in
       config = lib.mkOption {
         type = lib.types.attrsOf lib.types.attrs;
         default = { };
-        description = "netdata.conf configuration as nix attributes. cannot be combined with configText.";
+        description = "Configuration for `netdata.conf` as Nix attributes, cannot be combined with `configText`.";
         example = lib.literalExpression ''
           global = {
             "debug log" = "syslog";
@@ -194,13 +194,15 @@ in
         type = lib.types.attrsOf lib.types.path;
         default = { };
         description = ''
-          Complete netdata config directory except netdata.conf.
+          Complete netdata config directory except `netdata.conf`.
           The default configuration is merged with changes
           defined in this option.
+
           Each top-level attribute denotes a path in the configuration
-          directory as in environment.etc.
+          directory as in `environment.etc`.
+
           Its value is the absolute path and must be readable by netdata.
-          Cannot be combined with configText.
+          Cannot be combined with `configText`.
         '';
         example = lib.literalExpression ''
           "health_alarm_notify.conf" = pkgs.writeText "health_alarm_notify.conf" '''

From 9dd5cd6ca6661a48f182cd1d9af73786466a43ec Mon Sep 17 00:00:00 2001
From: wucke13 <wucke13+github@gmail.com>
Date: Fri, 17 Jul 2026 15:15:45 +0200
Subject: [PATCH 038/525] sssd: fix broken host keytab renewal

SSSD uses the `adcli` command to renew the host keytab, however, the
mechanism by which it discovers `adcli` changed over SSSD versions. This
commit fixes the discovery so that SSSD knows where to find the `adcli`
executable file.

Also, remove long-stale configure script args:

- Version 2.10.0 was the first release in which the `--with-semanage`
  `./configure` switch was removed; it is now fully covered by
  `--with-selinux` (0a254e4341d886c68394019fa610a67492f14fce).
- Version 2.6.0 was the first release in which the
  `-with-nscd` `./configure` switch was dropped
  (3e94b64daa7638fb53e3f527d4308d9d1875c517). Subsequently,
  version 2.11.0 was the first release in which the
  `--with-nscd-conf` `./configure` switch was then also dropped
  (5e16c957f212f7f71ed9e34a7f0dfab5f4350d6d).

Signed-off-by: wucke13 <wucke13+github@gmail.com>
---
 pkgs/by-name/ss/sssd/package.nix | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/ss/sssd/package.nix b/pkgs/by-name/ss/sssd/package.nix
index 5ce5da5efd02..4b7a551af802 100644
--- a/pkgs/by-name/ss/sssd/package.nix
+++ b/pkgs/by-name/ss/sssd/package.nix
@@ -5,7 +5,6 @@
   fetchpatch2,
   autoreconfHook,
   makeWrapper,
-  glibc,
   adcli,
   augeas,
   bashNonInteractive,
@@ -23,6 +22,7 @@
   python3,
   pam,
   popt,
+  realmd,
   talloc,
   tdb,
   tevent,
@@ -104,9 +104,6 @@ stdenv.mkDerivation (finalAttrs: {
   separateDebugInfo = true;
 
   env = {
-    NIX_CFLAGS_COMPILE = toString [
-      "-DRENEWAL_PROG_PATH=\"${adcli}/bin/adcli\""
-    ];
     KRB5_CONFIG = lib.getExe' (lib.getDev libkrb5) "krb5-config";
     NSUPDATE = lib.getExe' dnsutils "nsupdate";
     XMLLINT = lib.getExe' libxml2 "xmllint";
@@ -128,12 +125,12 @@ stdenv.mkDerivation (finalAttrs: {
       --with-syslog=journald
       --with-initscript=systemd
       --without-selinux
-      --without-semanage
       --with-xml-catalog-path=''${SGML_CATALOG_FILES%%:*}
       --with-ldb-lib-dir=$out/modules/ldb
-      --with-nscd=${glibc.bin}/sbin/nscd
       --with-sssd-user=root
       --with-ldb-modules-path="${placeholder "out"}/modules/ldb:${ldb}/modules/ldb"
+      --with-adcli-path=${lib.meta.getExe adcli}
+      --with-realm-path=${lib.meta.getExe realmd}
     )
   ''
   + lib.optionalString withSudo ''

From 697a238cab550abe35eb9504aae4cb59440208d7 Mon Sep 17 00:00:00 2001
From: Rafael Ieda <git@ieda.me>
Date: Fri, 25 Sep 2026 16:58:34 -0300
Subject: [PATCH 039/525] csol: fix build on darwin

---
 pkgs/by-name/cs/csol/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/cs/csol/package.nix b/pkgs/by-name/cs/csol/package.nix
index 501aa1489ecc..300b251cfa9f 100644
--- a/pkgs/by-name/cs/csol/package.nix
+++ b/pkgs/by-name/cs/csol/package.nix
@@ -30,6 +30,8 @@ stdenv.mkDerivation (finalAttrs: {
   ];
   buildInputs = [ ncurses ];
 
+  env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isDarwin "-D_DARWIN_C_SOURCE";
+
   postFixup = ''
     wrapProgram $out/bin/csol \
       --add-flags "-c $out/etc/xdg/csol/csolrc"

From a79aa10d4139fd7c0089178432f11103976e24d5 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 16:40:49 -0300
Subject: [PATCH 040/525] python3Packages.uvicorn: fix homepage

---
 pkgs/development/python-modules/uvicorn/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/uvicorn/default.nix b/pkgs/development/python-modules/uvicorn/default.nix
index 79d6596c40af..faffbe3d50ed 100644
--- a/pkgs/development/python-modules/uvicorn/default.nix
+++ b/pkgs/development/python-modules/uvicorn/default.nix
@@ -62,7 +62,7 @@ buildPythonPackage rec {
   };
 
   meta = {
-    homepage = "https://www.uvicorn.org/";
+    homepage = "https://uvicorn.dev";
     changelog = "https://github.com/Kludex/uvicorn/blob/${src.tag}/docs/release-notes.md";
     description = "Lightning-fast ASGI server";
     mainProgram = "uvicorn";

From 219a9a07783b6b938d47d7d23eb4748418b39748 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 16:40:20 -0300
Subject: [PATCH 041/525] python3Packages.telegram-text: fix homepage

---
 pkgs/development/python-modules/telegram-text/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/telegram-text/default.nix b/pkgs/development/python-modules/telegram-text/default.nix
index 89519d28d993..b68d55a3db78 100644
--- a/pkgs/development/python-modules/telegram-text/default.nix
+++ b/pkgs/development/python-modules/telegram-text/default.nix
@@ -25,7 +25,7 @@ buildPythonPackage rec {
   meta = {
     description = "Python markup module for Telegram messenger";
     downloadPage = "https://github.com/SKY-ALIN/telegram-text";
-    homepage = "https://telegram-text.alinsky.tech/";
+    homepage = "https://github.com/SKY-ALIN/telegram-text";
     changelog = "https://github.com/SKY-ALIN/telegram-text/blob/v${version}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ sikmir ];

From cb1ef57d2d8075390de17a131206208e9dbb550c Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 16:39:34 -0300
Subject: [PATCH 042/525] python3Packages.starlette: fix homepage

---
 pkgs/development/python-modules/starlette/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/starlette/default.nix b/pkgs/development/python-modules/starlette/default.nix
index b2024f5c8496..66ba7c5e50eb 100644
--- a/pkgs/development/python-modules/starlette/default.nix
+++ b/pkgs/development/python-modules/starlette/default.nix
@@ -65,7 +65,7 @@ buildPythonPackage rec {
   meta = {
     changelog = "https://github.com/Kludex/starlette/blob/${src.tag}/docs/release-notes.md";
     downloadPage = "https://github.com/Kludex/starlette";
-    homepage = "https://www.starlette.io/";
+    homepage = "https://starlette.dev";
     description = "Little ASGI framework that shines";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ wd15 ];

From fb01c5fdb86b22ce39ae9b434f0325936a19e53e Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 16:38:34 -0300
Subject: [PATCH 043/525] python3Packages.ropgadget: fix homepage

---
 pkgs/development/python-modules/ropgadget/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/ropgadget/default.nix b/pkgs/development/python-modules/ropgadget/default.nix
index 270ff4c0ae2c..f023b503a3db 100644
--- a/pkgs/development/python-modules/ropgadget/default.nix
+++ b/pkgs/development/python-modules/ropgadget/default.nix
@@ -30,7 +30,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Tool to search for gadgets in binaries to facilitate ROP exploitation";
     mainProgram = "ROPgadget";
-    homepage = "http://shell-storm.org/project/ROPgadget/";
+    homepage = "https://github.com/JonathanSalwan/ROPgadget";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ bennofs ];
   };

From eaac72fd1226739c814c65dcad36ac60caf61617 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 16:38:03 -0300
Subject: [PATCH 044/525] python3Packages.radon: fix homepage

---
 pkgs/development/python-modules/radon/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/radon/default.nix b/pkgs/development/python-modules/radon/default.nix
index 3fb25b1a1dde..f1dbbbcd2ea3 100644
--- a/pkgs/development/python-modules/radon/default.nix
+++ b/pkgs/development/python-modules/radon/default.nix
@@ -57,7 +57,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "Various code metrics for Python code";
-    homepage = "https://radon.readthedocs.org";
+    homepage = "https://radon.readthedocs.io";
     changelog = "https://github.com/rubik/radon/blob/v${version}/CHANGELOG";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ t4ccer ];

From 5f68192fde4c7ffd542ee886524c964387359461 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 16:37:39 -0300
Subject: [PATCH 045/525] python3Packages.pyrss2gen: fix homepage

---
 pkgs/development/python-modules/pyrss2gen/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/pyrss2gen/default.nix b/pkgs/development/python-modules/pyrss2gen/default.nix
index 0f525c4fef79..c3efd81888b0 100644
--- a/pkgs/development/python-modules/pyrss2gen/default.nix
+++ b/pkgs/development/python-modules/pyrss2gen/default.nix
@@ -19,7 +19,7 @@ buildPythonPackage rec {
   doCheck = false;
 
   meta = {
-    homepage = "http://www.dalkescientific.om/Python/PyRSS2Gen.html";
+    homepage = "http://dalkescientific.com/Python/PyRSS2Gen.html";
     description = "Library for generating RSS 2.0 feeds";
     license = lib.licenses.bsd2;
     maintainers = [ ];

From f92732811c21a50d5b5ea287fac057505cb2eb0f Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 16:36:27 -0300
Subject: [PATCH 046/525] python3Packages.pyfakefs: fix homepage

---
 pkgs/development/python-modules/pyfakefs/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/pyfakefs/default.nix b/pkgs/development/python-modules/pyfakefs/default.nix
index 16ae4ce87ead..3b8eeb90130e 100644
--- a/pkgs/development/python-modules/pyfakefs/default.nix
+++ b/pkgs/development/python-modules/pyfakefs/default.nix
@@ -60,7 +60,7 @@ let
 
     meta = {
       description = "Fake file system that mocks the Python file system modules";
-      homepage = "https://pyfakefs.org/";
+      homepage = "https://pytest-pyfakefs.readthedocs.io";
       changelog = "https://github.com/jmcgeheeiv/pyfakefs/blob/v${finalAttrs.version}/CHANGES.md";
       license = lib.licenses.asl20;
       maintainers = [ ];

From dee7ab1d8b67b4507d0e4279e68aa52019fd05af Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 16:35:23 -0300
Subject: [PATCH 047/525] python3Packages.potr: fix homepage

---
 pkgs/development/python-modules/potr/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/potr/default.nix b/pkgs/development/python-modules/potr/default.nix
index 50a0a1e6d3fc..7614880eae9f 100644
--- a/pkgs/development/python-modules/potr/default.nix
+++ b/pkgs/development/python-modules/potr/default.nix
@@ -19,7 +19,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "Pure Python OTR implementation";
-    homepage = "http://python-otr.pentabarf.de/";
+    homepage = "https://github.com/python-otr/pure-python-otr";
     license = lib.licenses.lgpl3Plus;
     maintainers = [ ];
   };

From 066cc28a8280316baaa3c2fe31bec4e19de1a520 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 16:34:53 -0300
Subject: [PATCH 048/525] python3Packages.pexif: fix homepage

---
 pkgs/development/python-modules/pexif/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/pexif/default.nix b/pkgs/development/python-modules/pexif/default.nix
index 7deb1e0c22e7..e5b1970b4fe3 100644
--- a/pkgs/development/python-modules/pexif/default.nix
+++ b/pkgs/development/python-modules/pexif/default.nix
@@ -16,7 +16,7 @@ buildPythonPackage (finalAttrs: {
 
   meta = {
     description = "Module for editing JPEG EXIF data";
-    homepage = "http://www.benno.id.au/code/pexif/";
+    homepage = "https://github.com/bennoleslie/pexif";
     license = lib.licenses.mit;
   };
 })

From 71bda6f0337042a1d175e68c7c0a210438c79a92 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 16:32:09 -0300
Subject: [PATCH 049/525] python3Packages.monai-deploy: fix homepage

---
 pkgs/development/python-modules/monai-deploy/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/monai-deploy/default.nix b/pkgs/development/python-modules/monai-deploy/default.nix
index a32d6ae8918a..600990c760ad 100644
--- a/pkgs/development/python-modules/monai-deploy/default.nix
+++ b/pkgs/development/python-modules/monai-deploy/default.nix
@@ -66,7 +66,7 @@ buildPythonPackage rec {
   meta = {
     description = "Framework and tools to design, develop and verify AI applications in healthcare imaging";
     mainProgram = "monai-deploy";
-    homepage = "https://monai.io/deploy.html";
+    homepage = "https://github.com/Project-MONAI/monai-deploy-app-sdk";
     changelog = "https://github.com/Project-MONAI/monai-deploy-app-sdk/blob/main/docs/source/release_notes/${src.tag}.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ bcdarwin ];

From 011f2a155ca6385c849e3c0179235946eef2b206 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 16:48:36 -0300
Subject: [PATCH 050/525] scrolls: fix homepage

---
 pkgs/by-name/sc/scrolls/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/sc/scrolls/package.nix b/pkgs/by-name/sc/scrolls/package.nix
index a30251275389..2b5a48e589f6 100644
--- a/pkgs/by-name/sc/scrolls/package.nix
+++ b/pkgs/by-name/sc/scrolls/package.nix
@@ -15,7 +15,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Strategy collectible card game";
-    homepage = "https://scrolls.com/";
+    homepage = "https://mojang.github.io/CallersBaneSiteArchive/";
     # http://www.reddit.com/r/Scrolls/comments/2j3pxw/linux_client_experimental/
 
     platforms = [ "x86_64-linux" ];

From 1b084a7f8b40dbf05f45bbe50e10fa63d8873dc2 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 14:07:22 -0300
Subject: [PATCH 051/525] eclipses.plugins.color-theme: fix homepage

---
 pkgs/applications/editors/eclipse/plugins.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/editors/eclipse/plugins.nix b/pkgs/applications/editors/eclipse/plugins.nix
index fef09c0a3ca6..32e2c1cf9318 100644
--- a/pkgs/applications/editors/eclipse/plugins.nix
+++ b/pkgs/applications/editors/eclipse/plugins.nix
@@ -317,7 +317,7 @@ rec {
     };
 
     meta = {
-      homepage = "http://eclipsecolorthemes.org/";
+      homepage = "https://github.com/eclipse-color-theme/eclipse-color-theme";
       description = "Plugin to switch color themes conveniently and without side effects";
       sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
       license = lib.licenses.epl10;

From ce80cae299c57581437e9485b145b4bb24cb7851 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sat, 19 Sep 2026 23:53:41 -0300
Subject: [PATCH 052/525] marvin: fix homepage

---
 pkgs/by-name/ma/marvin/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ma/marvin/package.nix b/pkgs/by-name/ma/marvin/package.nix
index bd952865e877..b28b0d12b8c9 100644
--- a/pkgs/by-name/ma/marvin/package.nix
+++ b/pkgs/by-name/ma/marvin/package.nix
@@ -88,7 +88,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Chemical modelling, analysis and structure drawing program";
-    homepage = "https://chemaxon.com/products/marvin";
+    homepage = "https://www.certara.com/marvin/";
     maintainers = with lib.maintainers; [ fusion809 ];
     license = lib.licenses.unfree;
     platforms = lib.platforms.linux;

From 36f8deaa12ea4d27f7554471a33a173cc23e4173 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sat, 19 Sep 2026 23:49:33 -0300
Subject: [PATCH 053/525] freenect: fix homepage

---
 pkgs/by-name/fr/freenect/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/fr/freenect/package.nix b/pkgs/by-name/fr/freenect/package.nix
index 96de60571fe8..4f7d2fc8a9dc 100644
--- a/pkgs/by-name/fr/freenect/package.nix
+++ b/pkgs/by-name/fr/freenect/package.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Drivers and libraries for the Xbox Kinect device on Windows, Linux, and macOS";
-    homepage = "http://openkinect.org";
+    homepage = "https://github.com/OpenKinect/libfreenect";
     license = with lib.licenses; [
       gpl2
       asl20

From c4cba1af6203c51d4f3f19c17f1810e853f01567 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sat, 19 Sep 2026 23:43:21 -0300
Subject: [PATCH 054/525] keystone: fix homepage

---
 pkgs/by-name/ke/keystone/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ke/keystone/package.nix b/pkgs/by-name/ke/keystone/package.nix
index 11b8ff7da8c4..f562438a7c61 100644
--- a/pkgs/by-name/ke/keystone/package.nix
+++ b/pkgs/by-name/ke/keystone/package.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Lightweight multi-platform, multi-architecture assembler framework";
-    homepage = "https://www.keystone-engine.org";
+    homepage = "https://github.com/keystone-engine/keystone";
     license = lib.licenses.gpl2Only;
     maintainers = [ ];
     mainProgram = "kstool";

From fd2e76de2c6650c4af1462271d535441b20c8fcd Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 16:44:39 -0300
Subject: [PATCH 055/525] rinf_cli: fix homepage

---
 pkgs/by-name/ri/rinf_cli/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ri/rinf_cli/package.nix b/pkgs/by-name/ri/rinf_cli/package.nix
index da62fb684284..78249c9cbb14 100644
--- a/pkgs/by-name/ri/rinf_cli/package.nix
+++ b/pkgs/by-name/ri/rinf_cli/package.nix
@@ -19,7 +19,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   meta = {
     description = "Framework for creating cross-platform Rust apps leveraging Flutter";
-    homepage = "https://rinf.cunarist.com";
+    homepage = "https://cunarist.github.io/rinf";
     changelog = "https://github.com/cunarist/rinf/blob/v${finalAttrs.version}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ Noah765 ];

From 7140d07833d27127c80fe4e0ed99ed2c43618b84 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 16:43:41 -0300
Subject: [PATCH 056/525] ratman: fix homepage

---
 pkgs/by-name/ra/ratman/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ra/ratman/package.nix b/pkgs/by-name/ra/ratman/package.nix
index 0c7e2422d2a7..47fc1f35d1c6 100644
--- a/pkgs/by-name/ra/ratman/package.nix
+++ b/pkgs/by-name/ra/ratman/package.nix
@@ -71,7 +71,7 @@ rustPlatform.buildRustPackage rec {
 
   meta = {
     description = "Modular decentralised peer-to-peer packet router and associated tools";
-    homepage = "https://git.irde.st/we/irdest";
+    homepage = "https://codeberg.org/irdest/irdest";
     platforms = lib.platforms.unix;
     license = lib.licenses.agpl3Only;
     maintainers = with lib.maintainers; [ spacekookie ];

From 076e4ae9562d3736216b2c2405b094f48bd10f37 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 16:43:01 -0300
Subject: [PATCH 057/525] ratox: fix homepage

---
 pkgs/by-name/ra/ratox/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ra/ratox/package.nix b/pkgs/by-name/ra/ratox/package.nix
index 499b5e788b06..dd8acb713934 100644
--- a/pkgs/by-name/ra/ratox/package.nix
+++ b/pkgs/by-name/ra/ratox/package.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation {
   meta = {
     description = "FIFO based tox client";
     mainProgram = "ratox";
-    homepage = "http://ratox.2f30.org/";
+    homepage = "https://git.2f30.org/ratox/file/README.html";
     license = lib.licenses.isc;
     platforms = lib.platforms.linux;
   };

From 7cbad2fc2be6e19f95582214e11006a43291f1b5 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 16:41:24 -0300
Subject: [PATCH 058/525] qm-dsp: fix homepage

---
 pkgs/by-name/qm/qm-dsp/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/qm/qm-dsp/package.nix b/pkgs/by-name/qm/qm-dsp/package.nix
index d1a40ccf04e5..c0ef2009fd91 100644
--- a/pkgs/by-name/qm/qm-dsp/package.nix
+++ b/pkgs/by-name/qm/qm-dsp/package.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "C++ library of functions for DSP and Music Informatics purposes";
-    homepage = "https://code.soundsoftware.ac.uk/projects/qm-dsp";
+    homepage = "https://github.com/c4dm/qm-dsp";
     license = lib.licenses.gpl2Plus;
     maintainers = [ ];
     platforms = lib.platforms.unix;

From a745123455a7d8ca71e3b792aded414450ccf6ee Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 16:30:14 -0300
Subject: [PATCH 059/525] isso: fix homepage

---
 pkgs/by-name/is/isso/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/is/isso/package.nix b/pkgs/by-name/is/isso/package.nix
index 0ffaead83077..71b4ab9a4d09 100644
--- a/pkgs/by-name/is/isso/package.nix
+++ b/pkgs/by-name/is/isso/package.nix
@@ -73,7 +73,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   meta = {
     description = "Commenting server similar to Disqus";
     mainProgram = "isso";
-    homepage = "https://posativ.org/isso/";
+    homepage = "https://isso-comments.de";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fgaz ];
   };

From f736162d4f9880cb3f6eda1a81006d1bdc939ee8 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 16:19:15 -0300
Subject: [PATCH 060/525] postlight-parser: fix homepage

---
 pkgs/by-name/po/postlight-parser/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/po/postlight-parser/package.nix b/pkgs/by-name/po/postlight-parser/package.nix
index 2a7f2418fcd1..19a630787e64 100644
--- a/pkgs/by-name/po/postlight-parser/package.nix
+++ b/pkgs/by-name/po/postlight-parser/package.nix
@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     changelog = "https://github.com/postlight/parser/blob/${finalAttrs.src.rev}/CHANGELOG.md";
-    homepage = "https://reader.postlight.com";
+    homepage = "https://github.com/postlight/parser";
     description = "Extracts the bits that humans care about from any URL you give it";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ viraptor ];

From 0cb848ed955e22f79ccaf87870d730c0f6201771 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 16:18:33 -0300
Subject: [PATCH 061/525] phpinsights: fix homepage

---
 pkgs/development/php-packages/phpinsights/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/php-packages/phpinsights/default.nix b/pkgs/development/php-packages/phpinsights/default.nix
index 686ffc0ae3a2..5b10af685cf6 100644
--- a/pkgs/development/php-packages/phpinsights/default.nix
+++ b/pkgs/development/php-packages/phpinsights/default.nix
@@ -27,7 +27,7 @@ php.buildComposerProject2 (finalAttrs: {
   meta = {
     changelog = "https://github.com/nunomaduro/phpinsights/releases/tag/v${finalAttrs.version}";
     description = "Instant PHP quality checks from your console";
-    homepage = "https://phpinsights.com/";
+    homepage = "https://github.com/nunomaduro/phpinsights";
     license = lib.licenses.mit;
     mainProgram = "phpinsights";
     teams = [ lib.teams.php ];

From 6e74a65e6e43bebbf5ae029ce145e10c80052187 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 16:17:54 -0300
Subject: [PATCH 062/525] pry: fix homepage

---
 pkgs/by-name/pr/pry/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/pr/pry/package.nix b/pkgs/by-name/pr/pry/package.nix
index 357a8ef0c434..38671b241790 100644
--- a/pkgs/by-name/pr/pry/package.nix
+++ b/pkgs/by-name/pr/pry/package.nix
@@ -13,7 +13,7 @@ bundlerApp {
 
   meta = {
     description = "Ruby runtime developer console and IRB alternative";
-    homepage = "https://pryrepl.org";
+    homepage = "https://pry.github.io/";
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.tckmn ];
     platforms = lib.platforms.unix;

From aed0976c7c13106cbbac51e8cdfce71d7de5eebc Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 16:17:11 -0300
Subject: [PATCH 063/525] postgresqlPackages.pg_bigm: fix homepage

---
 pkgs/servers/sql/postgresql/ext/pg_bigm.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/servers/sql/postgresql/ext/pg_bigm.nix b/pkgs/servers/sql/postgresql/ext/pg_bigm.nix
index 1cf6ea0a1547..2635113d73c2 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_bigm.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_bigm.nix
@@ -20,7 +20,7 @@ postgresqlBuildExtension (finalAttrs: {
 
   meta = {
     description = "Text similarity measurement and index searching based on bigrams";
-    homepage = "https://pgbigm.osdn.jp/";
+    homepage = "https://github.com/pgbigm/pg_bigm";
     maintainers = [ ];
     platforms = postgresql.meta.platforms;
     license = lib.licenses.postgresql;

From 9aa3d061effc2e5b8796430411fb38695f57a50e Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 15:55:35 -0300
Subject: [PATCH 064/525] pachyderm: fix homepage

---
 pkgs/by-name/pa/pachyderm/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/pa/pachyderm/package.nix b/pkgs/by-name/pa/pachyderm/package.nix
index fe7b49b712b8..5bf6eacb7910 100644
--- a/pkgs/by-name/pa/pachyderm/package.nix
+++ b/pkgs/by-name/pa/pachyderm/package.nix
@@ -27,7 +27,7 @@ buildGoModule (finalAttrs: {
 
   meta = {
     description = "Containerized Data Analytics";
-    homepage = "https://www.pachyderm.com/";
+    homepage = "https://github.com/pachyderm/pachyderm";
     license = lib.licenses.asl20;
     maintainers = [ ];
     mainProgram = "pachctl";

From 6d8a78e9ec3877ea7b850e52c1287bf6719b5382 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 15:54:33 -0300
Subject: [PATCH 065/525] openraPackages_2019.mods.ura: fix homepage

---
 pkgs/games/openra_2019/mods.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/games/openra_2019/mods.nix b/pkgs/games/openra_2019/mods.nix
index f26c9c86c289..b2fc7456e69c 100644
--- a/pkgs/games/openra_2019/mods.nix
+++ b/pkgs/games/openra_2019/mods.nix
@@ -315,7 +315,7 @@ in
     version = "431.git.128dc53";
     title = "Red Alert Unplugged";
     meta.description = "Re-imagination of the original Command & Conquer: Red Alert game";
-    meta.homepage = "http://redalertunplugged.com/";
+    meta.homepage = "https://github.com/RAunplugged/uRA";
     src = fetchFromGitHub {
       owner = "RAunplugged";
       repo = "uRA";

From 741d4c6eba65e0832e6a3a5c6a11396660f32e3c Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 15:53:40 -0300
Subject: [PATCH 066/525] tcpdirect: fix homepage

---
 pkgs/by-name/tc/tcpdirect/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/tc/tcpdirect/package.nix b/pkgs/by-name/tc/tcpdirect/package.nix
index b1361b7919e2..79576ad7f320 100644
--- a/pkgs/by-name/tc/tcpdirect/package.nix
+++ b/pkgs/by-name/tc/tcpdirect/package.nix
@@ -76,7 +76,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Ultra low latency kernel bypass TCP and UDP implementation for AMD Solarflare network adapters";
-    homepage = "https://www.openonload.org";
+    homepage = "https://github.com/Xilinx-CNS/tcpdirect";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ YorikSar ];
     # ARM64 build fails, see https://github.com/Xilinx-CNS/onload/issues/253

From 4349daea061b16a62d9a46b2aaf44a92d1662fd8 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 15:53:15 -0300
Subject: [PATCH 067/525] openonload: fix homepage

---
 pkgs/by-name/op/openonload/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/op/openonload/package.nix b/pkgs/by-name/op/openonload/package.nix
index 6673efd090e8..3808956a737c 100644
--- a/pkgs/by-name/op/openonload/package.nix
+++ b/pkgs/by-name/op/openonload/package.nix
@@ -149,7 +149,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "OpenOnLoad high performance network stack from Solarflare";
-    homepage = "https://www.openonload.org";
+    homepage = "https://github.com/Xilinx-CNS/onload";
     license = lib.licenses.gpl2;
     maintainers = with lib.maintainers; [ YorikSar ];
     # ARM64 build fails, see https://github.com/Xilinx-CNS/onload/issues/253

From b1d78e6fea1fa45d7b844488ce830bd95f3da455 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 15:49:39 -0300
Subject: [PATCH 068/525] ocaml_make: fix homepage

---
 pkgs/by-name/oc/ocaml_make/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/oc/ocaml_make/package.nix b/pkgs/by-name/oc/ocaml_make/package.nix
index 0f1431e07418..2e3e91da1c8f 100644
--- a/pkgs/by-name/oc/ocaml_make/package.nix
+++ b/pkgs/by-name/oc/ocaml_make/package.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation {
   setupHook = ./setup-hook.sh;
 
   meta = {
-    homepage = "http://www.ocaml.info/home/ocaml_sources.html";
+    homepage = "https://mmottl.github.io/ocaml-makefile/";
     description = "Generic OCaml Makefile for GNU Make";
     license = with lib.licenses; [
       lgpl21Only

From 6430a2a5c74af29564ecd84378ddad8d582e370f Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 15:40:40 -0300
Subject: [PATCH 069/525] sbc: fix homepage

---
 pkgs/by-name/sb/sbc/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/sb/sbc/package.nix b/pkgs/by-name/sb/sbc/package.nix
index adee703fa660..f68b63a270cd 100644
--- a/pkgs/by-name/sb/sbc/package.nix
+++ b/pkgs/by-name/sb/sbc/package.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "SubBand Codec Library";
-    homepage = "https://www.bluez.org/";
+    homepage = "https://bluez.github.io/";
     changelog = "https://git.kernel.org/pub/scm/bluetooth/sbc.git/tree/ChangeLog?h=${finalAttrs.version}";
     license = lib.licenses.gpl2;
     platforms = lib.platforms.linux;

From 40095dfa1f57f7c998f5de7990b46c99aa20574f Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 15:40:20 -0300
Subject: [PATCH 070/525] obexd: fix homepage

---
 pkgs/by-name/ob/obexd/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ob/obexd/package.nix b/pkgs/by-name/ob/obexd/package.nix
index eb20f172618f..98b6cd9e8ace 100644
--- a/pkgs/by-name/ob/obexd/package.nix
+++ b/pkgs/by-name/ob/obexd/package.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ pkg-config ];
 
   meta = {
-    homepage = "https://www.bluez.org/";
+    homepage = "https://bluez.github.io/";
     platforms = lib.platforms.linux;
     license = lib.licenses.gpl3;
   };

From 16b952caebe972fa5a68839b2110965b0851aa49 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 15:36:30 -0300
Subject: [PATCH 071/525] nix-weather: fix homepage and changelog

---
 pkgs/by-name/ni/nix-weather/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ni/nix-weather/package.nix b/pkgs/by-name/ni/nix-weather/package.nix
index 48ab325dc19f..419571635816 100644
--- a/pkgs/by-name/ni/nix-weather/package.nix
+++ b/pkgs/by-name/ni/nix-weather/package.nix
@@ -67,8 +67,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
       Heavily inspired by guix weather.
     '';
-    homepage = "https://git.fem.gg/cafkafk/nix-weather";
-    changelog = "https://git.fem.gg/cafkafk/nix-weather/releases/tag/v${finalAttrs.version}";
+    homepage = "https://github.com/cafkafk/nix-weather";
+    changelog = "https://github.com/cafkafk/nix-weather/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.eupl12;
     mainProgram = "nix-weather";
     maintainers = with lib.maintainers; [

From e88528de4c8c39fbc0db23a51d77545333ab7daa Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 15:35:18 -0300
Subject: [PATCH 072/525] ninka: fix homepage

---
 pkgs/by-name/ni/ninka/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ni/ninka/package.nix b/pkgs/by-name/ni/ninka/package.nix
index 8af94d092272..4e3564294074 100644
--- a/pkgs/by-name/ni/ninka/package.nix
+++ b/pkgs/by-name/ni/ninka/package.nix
@@ -40,7 +40,7 @@ perlPackages.buildPerlPackage {
   meta = {
     description = "Sentence based license detector";
     mainProgram = "ninka";
-    homepage = "http://ninka.turingmachine.org/";
+    homepage = "https://github.com/dmgerman/ninka";
     license = lib.licenses.gpl2;
     maintainers = [ ];
     platforms = lib.platforms.all;

From f77532ce0ca63513ec9b19d83375b32d89111b06 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 15:33:22 -0300
Subject: [PATCH 073/525] naev: fix homepage

---
 pkgs/by-name/na/naev/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/na/naev/package.nix b/pkgs/by-name/na/naev/package.nix
index a988a316c909..efe70d6916ec 100644
--- a/pkgs/by-name/na/naev/package.nix
+++ b/pkgs/by-name/na/naev/package.nix
@@ -123,7 +123,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "2D action/rpg space game";
     mainProgram = "naev";
-    homepage = "http://www.naev.org";
+    homepage = "http://naev.org";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ ralismark ];
     platforms = lib.platforms.linux;

From d34b95bdd402ed88a751a63dd8f543c5b0fa4f0d Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 15:00:50 -0300
Subject: [PATCH 074/525] qcustomplot: fix homepage

---
 pkgs/development/libraries/qcustomplot/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/qcustomplot/default.nix b/pkgs/development/libraries/qcustomplot/default.nix
index 89f490b70f6f..ed5294bc8186 100644
--- a/pkgs/development/libraries/qcustomplot/default.nix
+++ b/pkgs/development/libraries/qcustomplot/default.nix
@@ -58,7 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
-    homepage = "https://qtcustomplot.com/";
+    homepage = "https://www.qcustomplot.com/";
     description = "Qt C++ widget for plotting and data visualization";
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.unix;

From d9091a15fa531fa8345422a3c6411abee299fd30 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 14:58:26 -0300
Subject: [PATCH 075/525] jxrlib: fix homepage

---
 pkgs/by-name/jx/jxrlib/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/jx/jxrlib/package.nix b/pkgs/by-name/jx/jxrlib/package.nix
index 0ef86f2bc480..29d6f4f03fa9 100644
--- a/pkgs/by-name/jx/jxrlib/package.nix
+++ b/pkgs/by-name/jx/jxrlib/package.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Implementation of the JPEG XR image codec standard";
-    homepage = "https://jxrlib.codeplex.com";
+    homepage = "https://salsa.debian.org/debian-phototools-team/jxrlib";
     license = lib.licenses.bsd2;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ romildo ];

From 46be02bcd7b08b03b69a13ed8249ab60e8902374 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 14:57:44 -0300
Subject: [PATCH 076/525] jshon: fix homepage

---
 pkgs/by-name/js/jshon/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/js/jshon/package.nix b/pkgs/by-name/js/jshon/package.nix
index b2bfd1290487..f45b5b9660f6 100644
--- a/pkgs/by-name/js/jshon/package.nix
+++ b/pkgs/by-name/js/jshon/package.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation {
   '';
 
   meta = {
-    homepage = "http://kmkeen.com/jshon";
+    homepage = "https://github.com/keenerd/jshon";
     description = "JSON parser designed for maximum convenience within the shell";
     mainProgram = "jshon";
     license = lib.licenses.free;

From 747ee7c3c412376496e5cec5be424ad6a65a033e Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 14:57:15 -0300
Subject: [PATCH 077/525] jimtcl: fix homepage

---
 pkgs/by-name/ji/jimtcl/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ji/jimtcl/package.nix b/pkgs/by-name/ji/jimtcl/package.nix
index e551e07e3308..bb64472872f6 100644
--- a/pkgs/by-name/ji/jimtcl/package.nix
+++ b/pkgs/by-name/ji/jimtcl/package.nix
@@ -75,7 +75,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Open source small-footprint implementation of the Tcl programming language";
-    homepage = "http://jim.tcl.tk/";
+    homepage = "https://msteveb.github.io/jimtcl/";
     license = lib.licenses.bsd2;
     platforms = lib.platforms.all;
     mainProgram = "jimsh";

From f82a025716af70ca9a3aa65cc51d4f7ac50b9cca Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 14:56:43 -0300
Subject: [PATCH 078/525] ir-lv2: fix homepage

---
 pkgs/by-name/ir/ir-lv2/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ir/ir-lv2/package.nix b/pkgs/by-name/ir/ir-lv2/package.nix
index 4cf18e18afbf..7ad02d12b1e9 100644
--- a/pkgs/by-name/ir/ir-lv2/package.nix
+++ b/pkgs/by-name/ir/ir-lv2/package.nix
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
-    homepage = "http://factorial.hu/plugins/lv2/ir";
+    homepage = "https://tomscii.sig7.se/plugins/ir.lv2/";
     description = "Low-latency, realtime, high performance signal convolver especially for creating reverb effects.";
     license = lib.licenses.gpl2;
     maintainers = [ lib.maintainers.magnetophon ];

From 974fd53e403be3d213d2cde1ee68a4d52aa7fc23 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 14:56:02 -0300
Subject: [PATCH 079/525] ipam: fix homepage

---
 pkgs/by-name/ip/ipam/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ip/ipam/package.nix b/pkgs/by-name/ip/ipam/package.nix
index 32afc82dff79..553ed9d3d89b 100644
--- a/pkgs/by-name/ip/ipam/package.nix
+++ b/pkgs/by-name/ip/ipam/package.nix
@@ -42,7 +42,7 @@ buildGoModule (finalAttrs: {
 
   meta = {
     description = "Cli based IPAM written in Go with PowerDNS support";
-    homepage = "https://ipam.lauka.net/";
+    homepage = "https://ipam.adora.codes/";
     changelog = "https://codeberg.org/lauralani/ipam/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.gpl3Plus;
     maintainers = [ ];

From 1eada37e38e29cbb23febf8d87d0dd9c74b9923c Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 14:55:33 -0300
Subject: [PATCH 080/525] instead: fix homepage

---
 pkgs/by-name/in/instead/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/in/instead/package.nix b/pkgs/by-name/in/instead/package.nix
index 312d04704c3f..314c43daedd5 100644
--- a/pkgs/by-name/in/instead/package.nix
+++ b/pkgs/by-name/in/instead/package.nix
@@ -93,7 +93,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Simple text adventure interpreter for Unix and Windows";
-    homepage = "https://instead.syscall.ru/";
+    homepage = "https://sourceforge.net/projects/instead";
     license = lib.licenses.mit;
     platforms = with lib.platforms; linux;
     maintainers = with lib.maintainers; [ pSub ];

From acaaf1fccc3fe5617642d2ce14e887bfdffc5bd8 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 14:47:01 -0300
Subject: [PATCH 081/525] hanazono: fix homepage

---
 pkgs/by-name/ha/hanazono/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ha/hanazono/package.nix b/pkgs/by-name/ha/hanazono/package.nix
index 3afed4dbb3a2..e011e66be55f 100644
--- a/pkgs/by-name/ha/hanazono/package.nix
+++ b/pkgs/by-name/ha/hanazono/package.nix
@@ -27,7 +27,7 @@ stdenvNoCC.mkDerivation rec {
 
   meta = {
     description = "Japanese Mincho-typeface TrueType font";
-    homepage = "https://fonts.jp/hanazono/";
+    homepage = "https://glyphwiki.org/hanazono/";
     longDescription = ''
       Hanazono Mincho typeface is a Japanese TrueType font that developed with a
       support of Grant-in-Aid for Publication of Scientific Research Results

From c4af73364bb5594deb5c6f0c741e9afa2a74da82 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 14:46:21 -0300
Subject: [PATCH 082/525] hamster: fix homepage

---
 pkgs/by-name/ha/hamster/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ha/hamster/package.nix b/pkgs/by-name/ha/hamster/package.nix
index 537356bf9f5d..66f4fdbba5ea 100644
--- a/pkgs/by-name/ha/hamster/package.nix
+++ b/pkgs/by-name/ha/hamster/package.nix
@@ -68,7 +68,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   meta = {
     description = "Time tracking application";
     mainProgram = "hamster";
-    homepage = "http://projecthamster.org/";
+    homepage = "https://github.com/projecthamster/hamster";
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.all;
     maintainers = [ lib.maintainers.fabianhauser ];

From baace2b7b36c7791499e3bef067d13f1be8159fe Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 14:43:13 -0300
Subject: [PATCH 083/525] gnome-frog: fix homepage

---
 pkgs/by-name/gn/gnome-frog/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/gn/gnome-frog/package.nix b/pkgs/by-name/gn/gnome-frog/package.nix
index 6ef2f26f875e..091f2e09b944 100644
--- a/pkgs/by-name/gn/gnome-frog/package.nix
+++ b/pkgs/by-name/gn/gnome-frog/package.nix
@@ -89,7 +89,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
   '';
 
   meta = {
-    homepage = "https://getfrog.app/";
+    homepage = "https://github.com/TenderOwl/Frog";
     description = "Intuitive text extraction tool (OCR) for GNOME desktop";
     license = lib.licenses.mit;
     mainProgram = "frog";

From faa58d284a28a03d11f5872af0595f9a0bd5c2a9 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 14:42:04 -0300
Subject: [PATCH 084/525] gimpPlugins.gimplensfun: fix homepage

---
 pkgs/applications/graphics/gimp/plugins/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/graphics/gimp/plugins/default.nix b/pkgs/applications/graphics/gimp/plugins/default.nix
index 23e9d79732f2..80bac1e59244 100644
--- a/pkgs/applications/graphics/gimp/plugins/default.nix
+++ b/pkgs/applications/graphics/gimp/plugins/default.nix
@@ -359,7 +359,7 @@ lib.makeScope pkgs.newScope (
         broken = gimp.apiVersion != "2.0";
         description = "GIMP plugin to correct lens distortion using the lensfun library and database";
 
-        homepage = "http://lensfun.sebastiankraft.net/";
+        homepage = "https://seebk.github.io/GIMP-Lensfun/";
 
         license = lib.licenses.gpl3Plus;
         maintainers = [ ];

From 5c044b086eab53c2cdf476f66669051b82be924e Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 14:21:17 -0300
Subject: [PATCH 085/525] gimpPlugins.fourier: fix homepage

---
 pkgs/applications/graphics/gimp/plugins/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/graphics/gimp/plugins/default.nix b/pkgs/applications/graphics/gimp/plugins/default.nix
index 80bac1e59244..6bf0409a0a89 100644
--- a/pkgs/applications/graphics/gimp/plugins/default.nix
+++ b/pkgs/applications/graphics/gimp/plugins/default.nix
@@ -208,7 +208,7 @@ lib.makeScope pkgs.newScope (
       meta = {
         broken = gimp.apiVersion != "2.0";
         description = "GIMP plug-in to do the fourier transform";
-        homepage = "https://people.via.ecp.fr/~remi/soft/gimp/gimp_plugin_en.php3#fourier";
+        homepage = "https://www.lprp.fr/gimp_plugin_en/";
         license = lib.licenses.gpl3Plus;
       };
     };

From 9b59009526af968f277b9d97f527edc0d30c20a7 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 14:19:02 -0300
Subject: [PATCH 086/525] genimage: fix homepage

---
 pkgs/by-name/ge/genimage/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ge/genimage/package.nix b/pkgs/by-name/ge/genimage/package.nix
index c7a9d80a72f4..5fa6e839fe27 100644
--- a/pkgs/by-name/ge/genimage/package.nix
+++ b/pkgs/by-name/ge/genimage/package.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     broken = stdenv.hostPlatform.isDarwin;
-    homepage = "https://git.pengutronix.de/cgit/genimage";
+    homepage = "https://github.com/pengutronix/genimage";
     description = "Generate filesystem images from directory trees";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.all;

From 31741c0956e810121e6966c61346c1ed00a84010 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sat, 19 Sep 2026 23:42:18 -0300
Subject: [PATCH 087/525] libcpr: fix homepage

---
 pkgs/by-name/li/libcpr/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/li/libcpr/package.nix b/pkgs/by-name/li/libcpr/package.nix
index 82a38e7be001..082c36caa981 100644
--- a/pkgs/by-name/li/libcpr/package.nix
+++ b/pkgs/by-name/li/libcpr/package.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "C++ wrapper around libcurl";
-    homepage = "https://docs.libcpr.org/";
+    homepage = "https://docs.libcpr.dev/";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       phodina

From 8798f8b35a1779c7227066a83e3d85f56bd94050 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sat, 19 Sep 2026 23:41:21 -0300
Subject: [PATCH 088/525] clutter-gtk: fix homepage

---
 pkgs/by-name/cl/clutter-gtk/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/cl/clutter-gtk/package.nix b/pkgs/by-name/cl/clutter-gtk/package.nix
index 036171764216..e87e95a6469d 100644
--- a/pkgs/by-name/cl/clutter-gtk/package.nix
+++ b/pkgs/by-name/cl/clutter-gtk/package.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Clutter-GTK";
-    homepage = "http://www.clutter-project.org/";
+    homepage = "https://gitlab.gnome.org/Archive/clutter-gtk";
     license = lib.licenses.lgpl2Plus;
     maintainers = [ ];
     platforms = lib.platforms.unix;

From 002ad24aeb444ccb9d299fdc9b22ae12460e99be Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sat, 19 Sep 2026 23:41:04 -0300
Subject: [PATCH 089/525] clutter-gst: fix homepage

---
 pkgs/by-name/cl/clutter-gst/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/cl/clutter-gst/package.nix b/pkgs/by-name/cl/clutter-gst/package.nix
index 29d424469a71..c9329b10f4d0 100644
--- a/pkgs/by-name/cl/clutter-gst/package.nix
+++ b/pkgs/by-name/cl/clutter-gst/package.nix
@@ -66,7 +66,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "GStreamer bindings for clutter";
 
-    homepage = "http://www.clutter-project.org/";
+    homepage = "https://gitlab.gnome.org/Archive/clutter-gst";
 
     license = lib.licenses.lgpl2Plus;
 

From 0d58383cb3d1b2b92a7a9e9013a00e6b0f4e857c Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sat, 19 Sep 2026 23:40:36 -0300
Subject: [PATCH 090/525] clutter: fix homepage

---
 pkgs/by-name/cl/clutter/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/cl/clutter/package.nix b/pkgs/by-name/cl/clutter/package.nix
index 1c2c1ed2876f..b76a8d078031 100644
--- a/pkgs/by-name/cl/clutter/package.nix
+++ b/pkgs/by-name/cl/clutter/package.nix
@@ -109,7 +109,7 @@ stdenv.mkDerivation {
     '';
 
     license = lib.licenses.lgpl2Plus;
-    homepage = "http://www.clutter-project.org/";
+    homepage = "https://gitlab.gnome.org/Archive/clutter";
 
     maintainers = [ ];
     platforms = lib.platforms.unix;

From b3d07af513265544c89d20b0019564ddf5d5156d Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sat, 19 Sep 2026 23:38:49 -0300
Subject: [PATCH 091/525] libxc: fix homepage

---
 pkgs/by-name/li/libxc/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/li/libxc/package.nix b/pkgs/by-name/li/libxc/package.nix
index 4a70bc0610c3..68804d5519d3 100644
--- a/pkgs/by-name/li/libxc/package.nix
+++ b/pkgs/by-name/li/libxc/package.nix
@@ -73,7 +73,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Library of exchange-correlation functionals for density-functional theory";
     mainProgram = "xc-info";
-    homepage = "https://www.tddft.org/programs/Libxc/";
+    homepage = "https://libxc.gitlab.io";
     license = lib.licenses.mpl20;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ markuskowa ];

From beebeadb718084186b2cfd2fad57f96c1c137c6b Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sat, 19 Sep 2026 23:34:05 -0300
Subject: [PATCH 092/525] tinyxml: fix homepage

---
 pkgs/development/libraries/tinyxml/2.6.2.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/tinyxml/2.6.2.nix b/pkgs/development/libraries/tinyxml/2.6.2.nix
index 1d91b57e262c..70524ce15b03 100644
--- a/pkgs/development/libraries/tinyxml/2.6.2.nix
+++ b/pkgs/development/libraries/tinyxml/2.6.2.nix
@@ -91,7 +91,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Simple, small, C++ XML parser that can be easily integrating into other programs";
-    homepage = "http://www.grinninglizard.com/tinyxml/index.html";
+    homepage = "https://sourceforge.net/projects/tinyxml/";
     license = lib.licenses.zlib;
     platforms = lib.platforms.unix;
   };

From 65dec2c346d2b71cb90ecdde18f23ebde0fd5a64 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sat, 19 Sep 2026 23:33:12 -0300
Subject: [PATCH 093/525] tidyp: fix homepage

---
 pkgs/by-name/ti/tidyp/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ti/tidyp/package.nix b/pkgs/by-name/ti/tidyp/package.nix
index 2e7ac31337f5..5e21f253dc17 100644
--- a/pkgs/by-name/ti/tidyp/package.nix
+++ b/pkgs/by-name/ti/tidyp/package.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Program that can validate your HTML, as well as modify it to be more clean and standard";
     mainProgram = "tidyp";
-    homepage = "http://tidyp.com/";
+    homepage = "https://github.com/petdance/tidyp";
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ pSub ];
     license = lib.licenses.bsd3;

From 6c17ae2f3fc4be4aa37ea9fdbd58f189da55c6d8 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sat, 19 Sep 2026 23:32:17 -0300
Subject: [PATCH 094/525] swingsane: fix homepage

---
 pkgs/by-name/sw/swingsane/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/sw/swingsane/package.nix b/pkgs/by-name/sw/swingsane/package.nix
index eeb2a0203a64..e523d2f90651 100644
--- a/pkgs/by-name/sw/swingsane/package.nix
+++ b/pkgs/by-name/sw/swingsane/package.nix
@@ -64,7 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
       simultaneous scan jobs, image transformation jobs (deskew, binarize,
       crop, etc), PDF and PNG output.
     '';
-    homepage = "http://swingsane.com/";
+    homepage = "https://sourceforge.net/projects/swingsane/";
     sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
     license = lib.licenses.asl20;
     platforms = lib.platforms.all;

From cc0c9913a7d260b880e08594c9f096f766da97ef Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sat, 19 Sep 2026 23:31:14 -0300
Subject: [PATCH 095/525] selendroid: fix homepage

---
 pkgs/by-name/se/selendroid/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/se/selendroid/package.nix b/pkgs/by-name/se/selendroid/package.nix
index 656297f77272..dd4affc7e286 100644
--- a/pkgs/by-name/se/selendroid/package.nix
+++ b/pkgs/by-name/se/selendroid/package.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation {
   '';
 
   meta = {
-    homepage = "https://selendroid.io/";
+    homepage = "https://selendroid.github.io/selendroid.io/";
     description = "Test automation for native or hybrid Android apps and the mobile web";
     maintainers = [ ];
     platforms = lib.platforms.all;

From 16439e5cae3bbcb13e91950996450f80b0e5a018 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sat, 19 Sep 2026 23:30:27 -0300
Subject: [PATCH 096/525] intentbuilderc: fix homepage

---
 pkgs/by-name/re/re-intentbuilderc/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/re/re-intentbuilderc/package.nix b/pkgs/by-name/re/re-intentbuilderc/package.nix
index ff26751b8ff3..7e40fd0f738b 100644
--- a/pkgs/by-name/re/re-intentbuilderc/package.nix
+++ b/pkgs/by-name/re/re-intentbuilderc/package.nix
@@ -20,7 +20,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   meta = {
     mainProgram = "intentbuilderc";
     description = "Open reimplementation of Apple's intentbuilderc";
-    homepage = "https://codeberg.com/viraptor/re-intentbuilderc";
+    homepage = "https://codeberg.org/viraptor/re-intentbuilderc";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ viraptor ];
     platforms = lib.platforms.unix;

From efb752e0b8a180e9a06837f20ecc558fbecbf43e Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sat, 19 Sep 2026 23:29:59 -0300
Subject: [PATCH 097/525] pipelight: fix homepage

---
 pkgs/by-name/pi/pipelight/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/pi/pipelight/package.nix b/pkgs/by-name/pi/pipelight/package.nix
index d0b4c77d26e6..09a0b76e0b72 100644
--- a/pkgs/by-name/pi/pipelight/package.nix
+++ b/pkgs/by-name/pi/pipelight/package.nix
@@ -78,7 +78,7 @@ stdenv'.mkDerivation (finalAttrs: {
   enableParallelBuilding = true;
 
   meta = {
-    homepage = "http://pipelight.net/";
+    homepage = "https://bitbucket.org/mmueller2012/pipelight";
     license = with lib.licenses; [
       mpl11
       gpl2Only

From 786238304d3f62def2e6564bf361a23293039aa6 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sat, 19 Sep 2026 23:29:10 -0300
Subject: [PATCH 098/525] open-sans: fix homepage

---
 pkgs/by-name/op/open-sans/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/op/open-sans/package.nix b/pkgs/by-name/op/open-sans/package.nix
index 2c76c42b6e9c..aaa348263d4b 100644
--- a/pkgs/by-name/op/open-sans/package.nix
+++ b/pkgs/by-name/op/open-sans/package.nix
@@ -25,7 +25,7 @@ stdenvNoCC.mkDerivation {
       Open Sans is a humanist sans serif typeface designed by Steve Matteson,
       Type Director of Ascender Corp.
     '';
-    homepage = "https://www.opensans.com";
+    homepage = "https://salsa.debian.org/fonts-team/fonts-open-sans";
     license = lib.licenses.asl20;
     platforms = lib.platforms.all;
     teams = [ lib.teams.pantheon ];

From 09cfc0f1c745457b072de7f951290decf9f57aa7 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sat, 19 Sep 2026 23:28:12 -0300
Subject: [PATCH 099/525] modem-manager-gui: fix homepage

---
 pkgs/by-name/mo/modem-manager-gui/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/mo/modem-manager-gui/package.nix b/pkgs/by-name/mo/modem-manager-gui/package.nix
index bece7293f5ed..8756d8eda82c 100644
--- a/pkgs/by-name/mo/modem-manager-gui/package.nix
+++ b/pkgs/by-name/mo/modem-manager-gui/package.nix
@@ -79,7 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
       functions. You can check balance of your SIM card, send or receive SMS
       messages, control mobile traffic consumption and more.
     '';
-    homepage = "https://linuxonly.ru/page/modem-manager-gui";
+    homepage = "https://salsa.debian.org/debian/modem-manager-gui";
     license = lib.licenses.gpl3;
     maintainers = with lib.maintainers; [
       ahuzik

From 28d86030409c30bb6c8abd75708b3b385ab5e593 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sat, 19 Sep 2026 23:27:06 -0300
Subject: [PATCH 100/525] libmng: fix homepage

---
 pkgs/by-name/li/libmng/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/li/libmng/package.nix b/pkgs/by-name/li/libmng/package.nix
index 13b8b2fc4e9a..3d9d9dee4165 100644
--- a/pkgs/by-name/li/libmng/package.nix
+++ b/pkgs/by-name/li/libmng/package.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Reference library for reading, displaying, writing and examining Multiple-Image Network Graphics";
-    homepage = "http://www.libmng.com";
+    homepage = "https://sourceforge.net/projects/libmng/";
     license = lib.licenses.zlib;
     maintainers = [ ];
     platforms = lib.platforms.unix ++ lib.platforms.windows;

From b3341f1bd5f7d707075ceb2cd654919b9f60851d Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sat, 19 Sep 2026 23:22:24 -0300
Subject: [PATCH 101/525] gowebly: fix homepage

---
 pkgs/by-name/go/gowebly/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/go/gowebly/package.nix b/pkgs/by-name/go/gowebly/package.nix
index ae484dc3f453..4dde6bcf3657 100644
--- a/pkgs/by-name/go/gowebly/package.nix
+++ b/pkgs/by-name/go/gowebly/package.nix
@@ -60,7 +60,7 @@ buildGoModule rec {
       with Go on the backend, using htmx, hyperscript or Alpine.js,
       and the most popular CSS frameworks on the frontend.
     '';
-    homepage = "https://gowebly.org";
+    homepage = "https://github.com/gowebly/gowebly";
     changelog = "https://github.com/gowebly/gowebly/releases/tag/v${version}";
     license = lib.licenses.asl20;
     mainProgram = "gowebly";

From 2e867f1437d39ac9217e1e1af1a42452bd557403 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sat, 19 Sep 2026 23:15:12 -0300
Subject: [PATCH 102/525] _1oom: fix homepage

---
 pkgs/by-name/_1/_1oom/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/_1/_1oom/package.nix b/pkgs/by-name/_1/_1oom/package.nix
index 96e1c4c3d1c8..81c65dfb5d0c 100644
--- a/pkgs/by-name/_1/_1oom/package.nix
+++ b/pkgs/by-name/_1/_1oom/package.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
   passthru.updateScript = gitUpdater { rev-prefix = "v"; };
 
   meta = {
-    homepage = "https://fork1oom.sourcecraft.site/";
+    homepage = "https://sourcecraft.dev/fork1oom/1oom";
     changelog = "https://sourcecraft.dev/fork1oom/1oom/releases/v${finalAttrs.version}";
     description = "Master of Orion (1993) game engine recreation; a more updated fork";
     license = lib.licenses.gpl2Only;

From 15b2a4cd6fe10de3a5b7ccde2460195e8812aac3 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sat, 19 Sep 2026 23:06:30 -0300
Subject: [PATCH 103/525] trickle: fix homepage

---
 pkgs/by-name/tr/trickle/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/tr/trickle/package.nix b/pkgs/by-name/tr/trickle/package.nix
index f1d606714a0f..869ce26368c1 100644
--- a/pkgs/by-name/tr/trickle/package.nix
+++ b/pkgs/by-name/tr/trickle/package.nix
@@ -62,7 +62,7 @@ stdenv.mkDerivation {
   meta = {
     description = "Lightweight userspace bandwidth shaper";
     license = lib.licenses.bsd3;
-    homepage = "https://monkey.org/~marius/pages/?page=trickle";
+    homepage = "https://github.com/mariusae/trickle";
     platforms = lib.platforms.linux;
     mainProgram = "trickle";
   };

From 5d16348f136835c5059d7d124b4cff14b8dc1b3f Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sat, 19 Sep 2026 23:03:43 -0300
Subject: [PATCH 104/525] appfire-cli: fix homepage

---
 pkgs/by-name/ap/appfire-cli/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ap/appfire-cli/package.nix b/pkgs/by-name/ap/appfire-cli/package.nix
index 3514e508ffa3..013624d025b0 100644
--- a/pkgs/by-name/ap/appfire-cli/package.nix
+++ b/pkgs/by-name/ap/appfire-cli/package.nix
@@ -76,7 +76,7 @@ stdenv.mkDerivation (finalAttrs: {
       Since the /nix/store is not writable, you can instead place the file
       at {file}`$HOME/acli.properties` to achieve the same effect.
     '';
-    homepage = "https://apps.appf.re/acli";
+    homepage = "https://support.appfire.com/space/ACLI/60555464/Appfire+Command+Line+Interface+(CLI)";
     license = lib.licenses.unfreeRedistributable;
     sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
     maintainers = with lib.maintainers; [ twey ];

From 4312617bb85a8bf270060530639333373fa57b37 Mon Sep 17 00:00:00 2001
From: coolcuber <rpgeorg@clemson.edu>
Date: Sat, 26 Sep 2026 18:43:31 -0400
Subject: [PATCH 105/525] mio: fix version, modernize

---
 pkgs/by-name/mi/mio/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/mi/mio/package.nix b/pkgs/by-name/mi/mio/package.nix
index 845408564c58..d3f1fef08065 100644
--- a/pkgs/by-name/mi/mio/package.nix
+++ b/pkgs/by-name/mi/mio/package.nix
@@ -7,7 +7,10 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mio";
-  version = "unstable-2023-03-03";
+  version = "0-unstable-2023-03-03";
+
+  strictDeps = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "vimpunk";

From 27edb5c7fc078806903f19b8aa9b121d04332519 Mon Sep 17 00:00:00 2001
From: coolcuber <rpgeorg@clemson.edu>
Date: Sat, 26 Sep 2026 20:08:13 -0400
Subject: [PATCH 106/525] mro-unicode: fix version; enable strictDeps,
 structuredAttrs

---
 pkgs/by-name/mr/mro-unicode/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/mr/mro-unicode/package.nix b/pkgs/by-name/mr/mro-unicode/package.nix
index 8b87d66f2cb4..45c17cfec91e 100644
--- a/pkgs/by-name/mr/mro-unicode/package.nix
+++ b/pkgs/by-name/mr/mro-unicode/package.nix
@@ -6,7 +6,10 @@
 
 stdenvNoCC.mkDerivation {
   pname = "mro-unicode";
-  version = "unstable-2013-05-25";
+  version = "0-unstable-2013-05-31";
+
+  strictDeps = true;
+  __structuredAttrs = true;
 
   src = fetchurl {
     url = "https://github.com/phjamr/MroUnicode/raw/f297de070f7eba721a47c850e08efc119d3bfbe8/MroUnicode-Regular.ttf";

From c58d70a9aff09fb82479cfb9d76a1c93dfd145b4 Mon Sep 17 00:00:00 2001
From: kilianar <mail@kilianar.de>
Date: Mon, 28 Sep 2026 11:18:31 +0200
Subject: [PATCH 107/525] wealthfolio: 3.8.0 -> 3.9.1

https://github.com/wealthfolio/wealthfolio/releases/tag/v3.9.1
---
 pkgs/by-name/we/wealthfolio/package.nix | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/we/wealthfolio/package.nix b/pkgs/by-name/we/wealthfolio/package.nix
index 49aacefcc789..eb15b3b476ec 100644
--- a/pkgs/by-name/we/wealthfolio/package.nix
+++ b/pkgs/by-name/we/wealthfolio/package.nix
@@ -19,20 +19,20 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "wealthfolio";
-  version = "3.8.0";
+  version = "3.9.1";
 
   src = fetchFromGitHub {
     owner = "wealthfolio";
     repo = "wealthfolio";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-5CqLHnwBzqA+yf/sQM2ie3xuO+5aM5EDA0bhZ6r1VIM=";
+    hash = "sha256-ozdNgUytQMWzPf7N+8x2boNC/GgxMmzGzAnioGW20VA=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) src pname version;
     pnpm = pnpm_10;
     fetcherVersion = 4;
-    hash = "sha256-I9s1hFNb7oHYH5OhKmtMbMsmQZXE6ovpupusN6M1YKc=";
+    hash = "sha256-j9rqB5RYpoyQP58erDE5r1Kx7Aq9vOQbiOTBzGVoe9k=";
   };
 
   cargoRoot = ".";
@@ -45,7 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
       src
       cargoRoot
       ;
-    hash = "sha256-PFMmpQhQubMzomvLWMJZrriH9emwEzO/rTFCovzFt6w=";
+    hash = "sha256-skElXNXFcTwPv+rLKY90He8XLZfVrOJ8jYC4kL2vj9c=";
   };
 
   nativeBuildInputs = [
@@ -66,6 +66,8 @@ stdenv.mkDerivation (finalAttrs: {
     webkitgtk_4_1
   ];
 
+  env.OPENSSL_NO_VENDOR = "1";
+
   postPatch = ''
     jq \
       '.plugins.updater.endpoints = [ ]

From f1ae1c8d8af5814e129ccce6a77827054ff3042b Mon Sep 17 00:00:00 2001
From: figuld <55359236+figuld@users.noreply.github.com>
Date: Mon, 28 Sep 2026 20:45:05 +0300
Subject: [PATCH 108/525] mcpelauncher-{client,ui-qt}: 1.7.6-qt6 -> 1.8.4-qt6

---
 pkgs/by-name/mc/mcpelauncher-client/package.nix | 4 ++--
 pkgs/by-name/mc/mcpelauncher-ui-qt/package.nix  | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mc/mcpelauncher-client/package.nix b/pkgs/by-name/mc/mcpelauncher-client/package.nix
index 9b3e3b66db12..7f6d690d8dde 100644
--- a/pkgs/by-name/mc/mcpelauncher-client/package.nix
+++ b/pkgs/by-name/mc/mcpelauncher-client/package.nix
@@ -32,7 +32,7 @@ in
 # Bionic libc part doesn't compile with GCC
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "mcpelauncher-client";
-  version = "1.7.6-qt6";
+  version = "1.8.4-qt6";
 
   # NOTE: check mcpelauncher-ui-qt when updating
   src = fetchFromGitHub {
@@ -40,7 +40,7 @@ clangStdenv.mkDerivation (finalAttrs: {
     repo = "mcpelauncher-manifest";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-KAHAr1cAkG6B15CTwxRWZWT9IdTcvCSal3jrPe8C4wE=";
+    hash = "sha256-F54XFbXB0dkssva95pmKwPjmmnjupBHCxShySClFUgY=";
   };
 
   patches = [
diff --git a/pkgs/by-name/mc/mcpelauncher-ui-qt/package.nix b/pkgs/by-name/mc/mcpelauncher-ui-qt/package.nix
index 4731dac82c22..9a382a9e5df0 100644
--- a/pkgs/by-name/mc/mcpelauncher-ui-qt/package.nix
+++ b/pkgs/by-name/mc/mcpelauncher-ui-qt/package.nix
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
     repo = "mcpelauncher-ui-manifest";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-Oibi7+LJK7K1a1fFN2SKy4XiA0gSC4u7Wmk0t86SHaw=";
+    hash = "sha256-AFQEcSLcjuPZJI/w9LI0/Y/lrPpPXVqgAIULqToCqu8=";
   };
 
   patches = [

From 7a8a3bc4f03f8e61b102ed9383d160c4fa9bb89d Mon Sep 17 00:00:00 2001
From: Rhys-T <108157737+Rhys-T@users.noreply.github.com>
Date: Mon, 28 Sep 2026 15:14:14 -0400
Subject: [PATCH 109/525] soundfont-arachno: fix darwin build

---
 pkgs/by-name/so/soundfont-arachno/package.nix | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/so/soundfont-arachno/package.nix b/pkgs/by-name/so/soundfont-arachno/package.nix
index 7c28074bced8..364d26e54973 100644
--- a/pkgs/by-name/so/soundfont-arachno/package.nix
+++ b/pkgs/by-name/so/soundfont-arachno/package.nix
@@ -1,25 +1,31 @@
 {
   lib,
   stdenvNoCC,
-  fetchzip,
+  fetchurl,
+  unzip,
 }:
 
 stdenvNoCC.mkDerivation rec {
   pname = "soundfont-arachno";
   version = "1.0";
 
-  src = fetchzip {
+  # Many of the files in this archive have non-UTF-8 characters in their names,
+  # which causes it to fail to unpack correctly on e.g. macOS/APFS when using
+  # fetchzip. So instead, use fetchurl and extract the correct file directly.
+  src = fetchurl {
     # Linked on http://www.arachnosoft.com/main/download.php?id=soundfont-sf2:
     url = "https://www.dropbox.com/s/2rnpya9ecb9m4jh/arachno-soundfont-${
       builtins.replaceStrings [ "." ] [ "" ] version
     }-sf2.zip";
-    hash = "sha256-Z5ETe0AKPCi4KlM2xOlNcyQn1xvCuor3S/tcrF+AwNQ=";
-    stripRoot = false;
+    hash = "sha256-XAxXOr5sXho8zOul1SpCKdskKDYgyaPrH0AwGOKqIt8=";
   };
+  dontUnpack = true;
+  nativeBuildInputs = [ unzip ];
 
   installPhase = ''
     runHook preInstall
-    install -Dm444 Arachno*.sf2 $out/share/soundfonts/arachno.sf2
+    mkdir -p $out/share/soundfonts
+    unzip -p $src 'Arachno*.sf2' > $out/share/soundfonts/arachno.sf2
     runHook postInstall
   '';
 

From 3d018663f926191ae863a714cb9d0021bc0ad485 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Mon, 28 Sep 2026 23:23:13 +0200
Subject: [PATCH 110/525] eas-cli: 20.4.0 -> 24.8.0

Diff: https://github.com/expo/eas-cli/compare/v20.4.0...v24.8.0

Changelog: https://github.com/expo/eas-cli/releases/tag/v24.8.0
---
 pkgs/by-name/ea/eas-cli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ea/eas-cli/package.nix b/pkgs/by-name/ea/eas-cli/package.nix
index 3f61e5f469ea..69a2d1e6364d 100644
--- a/pkgs/by-name/ea/eas-cli/package.nix
+++ b/pkgs/by-name/ea/eas-cli/package.nix
@@ -11,12 +11,12 @@
   python3,
 }:
 let
-  version = "20.4.0";
+  version = "24.8.0";
   src = fetchFromGitHub {
     owner = "expo";
     repo = "eas-cli";
     rev = "v${version}";
-    hash = "sha256-WfzCV304xgTqiKBCsZc5rnzaC+UHA6c155FG+HWBY7s=";
+    hash = "sha256-HypTLf16HxL2Jile5ACulNJw8L6Xr+Bxgt6eNFRWYo8=";
 
     # Remove after upstream updates to Yarn 4.15
     # https://github.com/expo/eas-cli/blob/main/package.json#L38
@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   yarnOfflineCache = yarn-berry_4.fetchYarnBerryDeps {
     inherit src missingHashes;
-    hash = "sha256-Iqdk0MpXeiKm5hgF68XOKvl0a+5LpXsNNcelCcbfj3s=";
+    hash = "sha256-oSy6t6vDeFVfkUp6Dw5PNt1+6MXx2FQIEnzJCPW0ufw=";
   };
 
   nativeBuildInputs = [

From 99983fd7c922dda243da087efd2ac786c5664482 Mon Sep 17 00:00:00 2001
From: ozozka <ozkaya.ogzhn@gmail.com>
Date: Mon, 28 Sep 2026 15:11:54 +0300
Subject: [PATCH 111/525] maintainers: add ozozka

---
 maintainers/maintainer-list.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 356b6ef2a6c7..98492e1d96ed 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -22204,6 +22204,13 @@
     githubId = 5948762;
     name = "Berk Özkütük";
   };
+  ozozka = {
+    email = "ozkaya.ogzhn@gmail.com";
+    matrix = "@oguzhanozkaya:matrix.org";
+    github = "ozozka";
+    githubId = 53692091;
+    name = "Oğuzhan Özkaya";
+  };
   ozturkkl = {
     email = "97kemalozturk@gmail.com";
     github = "ozturkkl";

From 74636274b868585222262fdf0453162f10010605 Mon Sep 17 00:00:00 2001
From: ozozka <ozkaya.ogzhn@gmail.com>
Date: Mon, 28 Sep 2026 16:39:02 +0300
Subject: [PATCH 112/525] spectral: init at 2.005

---
 pkgs/by-name/sp/spectral/package.nix | 36 ++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 pkgs/by-name/sp/spectral/package.nix

diff --git a/pkgs/by-name/sp/spectral/package.nix b/pkgs/by-name/sp/spectral/package.nix
new file mode 100644
index 000000000000..54b10605dde0
--- /dev/null
+++ b/pkgs/by-name/sp/spectral/package.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  installFonts,
+}:
+
+stdenvNoCC.mkDerivation {
+  pname = "spectral";
+  version = "2.005";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  outputs = [
+    "out"
+    "webfont"
+  ];
+
+  src = fetchFromGitHub {
+    owner = "productiontype";
+    repo = "Spectral";
+    rev = "e1179c4fc05c1ba7efd40038e203312b4c90c376";
+    hash = "sha256-hoihZUeY8JC0pCnLfTwBAoX1OiTKyG/4B4XeXyc3iVg=";
+  };
+
+  nativeBuildInputs = [ installFonts ];
+
+  meta = {
+    homepage = "https://github.com/productiontype/Spectral/";
+    description = "Serif typeface designed for text-rich, screen-first environments";
+    license = lib.licenses.ofl;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ ozozka ];
+  };
+}

From 8e440e30b696000e893cab13f8c28df6b1e62678 Mon Sep 17 00:00:00 2001
From: Jose Luis Pereira <onaips@gmail.com>
Date: Tue, 29 Sep 2026 14:14:12 +0100
Subject: [PATCH 113/525] maintainers: add onaips

Assisted-by: Claude Code (Claude Opus 5.5, claude-opus-5-5)
---
 maintainers/maintainer-list.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 7609e2402b18..2ee9e3e7ccba 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -21924,6 +21924,11 @@
     githubId = 1538622;
     name = "Michael Reilly";
   };
+  onaips = {
+    github = "oNaiPs";
+    githubId = 374130;
+    name = "José Luis Pereira";
+  };
   onatustun = {
     email = "contact@onatustun.com";
     name = "Onat Ustun";

From 4aa6b8dba5ef7bcbbd73e93830077cc32d42bcf0 Mon Sep 17 00:00:00 2001
From: Jose Luis Pereira <onaips@gmail.com>
Date: Tue, 29 Sep 2026 14:15:59 +0100
Subject: [PATCH 114/525] dmenu-mac: init at 0.8.0

Keyboard-only application launcher for macOS.
https://github.com/oNaiPs/dmenu-mac

Assisted-by: Claude Code (Claude Opus 5.5, claude-opus-5-5)
---
 pkgs/by-name/dm/dmenu-mac/package.nix | 54 +++++++++++++++++++++++++++
 1 file changed, 54 insertions(+)
 create mode 100644 pkgs/by-name/dm/dmenu-mac/package.nix

diff --git a/pkgs/by-name/dm/dmenu-mac/package.nix b/pkgs/by-name/dm/dmenu-mac/package.nix
new file mode 100644
index 000000000000..50b12880a1bc
--- /dev/null
+++ b/pkgs/by-name/dm/dmenu-mac/package.nix
@@ -0,0 +1,54 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  unzip,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "dmenu-mac";
+  version = "0.8.0";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  # Upstream builds with Xcode; install the signed and notarized release,
+  # like maccy and aerospace do, so the app keeps its Developer ID signature.
+  src = fetchurl {
+    url = "https://github.com/oNaiPs/dmenu-mac/releases/download/${finalAttrs.version}/dmenu-mac.zip";
+    hash = "sha256-6SIzisxQmjWIICb7Zva5RnnliM2Gf6TrVylCC2xZqLA=";
+  };
+
+  nativeBuildInputs = [ unzip ];
+
+  sourceRoot = ".";
+
+  dontConfigure = true;
+  dontBuild = true;
+  # Keep the Developer ID signature and notarization intact.
+  dontFixup = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/Applications $out/bin
+    cp -R dmenu-mac.app $out/Applications/
+    ln -s $out/Applications/dmenu-mac.app/Contents/Resources/dmenu-mac $out/bin/dmenu-mac
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Keyboard-only application launcher for macOS";
+    homepage = "https://github.com/oNaiPs/dmenu-mac";
+    changelog = "https://github.com/oNaiPs/dmenu-mac/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.gpl3Only;
+    maintainers = [ lib.maintainers.onaips ];
+    mainProgram = "dmenu-mac";
+    platforms = lib.platforms.darwin;
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+  };
+})

From 8bcb7eb840fcfc428b633bc2c7431b431043d58a Mon Sep 17 00:00:00 2001
From: heki <186204649+ferris-qq@users.noreply.github.com>
Date: Wed, 30 Sep 2026 03:30:28 +0400
Subject: [PATCH 115/525] maintainers: add ferris-qq

Assisted-by: Claude Code (Claude Opus 5.5)
---
 maintainers/maintainer-list.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 356b6ef2a6c7..e04697ccb0bd 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -9381,6 +9381,11 @@
     githubId = 84565547;
     name = "fernvenue";
   };
+  ferris-qq = {
+    name = "heki";
+    github = "ferris-qq";
+    githubId = 186204649;
+  };
   feyorsh = {
     email = "george@feyor.sh";
     github = "Feyorsh";

From 22dab8054ea7c17cf7c93c291f4abe0217026077 Mon Sep 17 00:00:00 2001
From: heki <186204649+ferris-qq@users.noreply.github.com>
Date: Wed, 30 Sep 2026 03:30:48 +0400
Subject: [PATCH 116/525] winetricks: add ferris-qq to maintainers

winetricks has no maintainers.

Assisted-by: Claude Code (Claude Opus 5.5)
---
 pkgs/applications/emulators/wine/winetricks.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/applications/emulators/wine/winetricks.nix b/pkgs/applications/emulators/wine/winetricks.nix
index 346b14c453f3..621f9c858c5e 100644
--- a/pkgs/applications/emulators/wine/winetricks.nix
+++ b/pkgs/applications/emulators/wine/winetricks.nix
@@ -82,6 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
     mainProgram = "winetricks";
     license = lib.licenses.lgpl21;
     homepage = "https://github.com/Winetricks/winetricks";
+    maintainers = with lib.maintainers; [ ferris-qq ];
     platforms = with lib.platforms; linux ++ darwin;
   };
 })

From 00d69ba2b4c9f68508498e7ce6bc97f07ede46d1 Mon Sep 17 00:00:00 2001
From: y3 <git@yarncat.moe>
Date: Wed, 30 Sep 2026 08:39:34 +0100
Subject: [PATCH 117/525] pinless: init at 0-unstable-2026-08-06

---
 pkgs/by-name/pi/pinless/package.nix | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 create mode 100644 pkgs/by-name/pi/pinless/package.nix

diff --git a/pkgs/by-name/pi/pinless/package.nix b/pkgs/by-name/pi/pinless/package.nix
new file mode 100644
index 000000000000..745db720953a
--- /dev/null
+++ b/pkgs/by-name/pi/pinless/package.nix
@@ -0,0 +1,29 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+  lib,
+}:
+buildGoModule {
+  pname = "pinless";
+  version = "0-unstable-2026-08-06";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "bunk-im";
+    repo = "pinless";
+    rev = "87b560c911186b64b6337baa2e64658977891c7e";
+    hash = "sha256-IVPSFqutAUH4AWnGXjuN81Q004YeaY5sO0uf+/cqC7Q=";
+  };
+
+  vendorHash = "sha256-Ef2XLxGq8TO3WVh9EvLE30Is2CBwH4pqXxkq1tcuR0Q=";
+
+  meta = {
+    homepage = "https://github.com/bunk-im/pinless";
+    description = "Privacy-focused frontend for Pinterest";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ yarn ];
+    platforms = lib.platforms.unix;
+    mainProgram = "pinless";
+  };
+}

From c1008018a98849283c8b1ea51b80517dac96693f Mon Sep 17 00:00:00 2001
From: y3 <git@yarncat.moe>
Date: Wed, 30 Sep 2026 10:00:58 +0100
Subject: [PATCH 118/525] glance-agent: init at 0.1.0

---
 pkgs/by-name/gl/glance-agent/package.nix | 33 ++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 pkgs/by-name/gl/glance-agent/package.nix

diff --git a/pkgs/by-name/gl/glance-agent/package.nix b/pkgs/by-name/gl/glance-agent/package.nix
new file mode 100644
index 000000000000..cc3de3194337
--- /dev/null
+++ b/pkgs/by-name/gl/glance-agent/package.nix
@@ -0,0 +1,33 @@
+{
+  buildGoModule,
+  fetchFromGitHub,
+  lib,
+}:
+buildGoModule (finalAttrs: {
+  pname = "glance-agent";
+  version = "0.1.0";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "glanceapp";
+    repo = "agent";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-eNhOelHR3EB3RWWMe7fG6vklgADX7XFy6QMI4Lfr8oM=";
+  };
+
+  vendorHash = "sha256-vjcyZctfgnAhzFEF0c+GhtWQqa4gVvLLj0E3sCLS0RE=";
+
+  ldflags = [
+    "-s"
+    "-X github.com/glanceapp/agent/internal/agent.buildVersion=${finalAttrs.version}"
+  ];
+
+  meta = {
+    homepage = "https://github.com/glanceapp/agent";
+    description = "Lightweight service that exposes system metrics via an HTTP API";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "agent";
+    maintainers = with lib.maintainers; [ yarn ];
+  };
+})

From 18498ec0d05bc638dca16258d7bf626ed2c959f6 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 30 Sep 2026 20:49:42 +0200
Subject: [PATCH 119/525] python3Packages.nextdns: 5.0.1 -> 5.1.0

Changelog: https://github.com/bieniu/nextdns/releases/tag/5.1.0
---
 .../python-modules/nextdns/default.nix            | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/nextdns/default.nix b/pkgs/development/python-modules/nextdns/default.nix
index a9ced638a0c9..025270c3f62e 100644
--- a/pkgs/development/python-modules/nextdns/default.nix
+++ b/pkgs/development/python-modules/nextdns/default.nix
@@ -16,22 +16,20 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "nextdns";
-  version = "5.0.1";
+  version = "5.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bieniu";
     repo = "nextdns";
     tag = finalAttrs.version;
-    hash = "sha256-QCiosQHxuwDxztXMEkEosob8M2NMtnlGI33m5oAkaBw=";
+    hash = "sha256-+ih7QHmtQmWsi6HZZ3xepYBDYlCOyMKo0pQtr6oXpFs=";
   };
 
-  nativeBuildInputs = [
-    pyprojectVersionPatchHook
-  ];
-
   build-system = [ setuptools ];
 
+  nativeBuildInputs = [ pyprojectVersionPatchHook ];
+
   dependencies = [
     aiohttp
     tenacity
@@ -46,6 +44,11 @@ buildPythonPackage (finalAttrs: {
     syrupy
   ];
 
+  disabledTests = [
+    # Test is outdated
+    "test_valid_data"
+  ];
+
   pythonImportsCheck = [ "nextdns" ];
 
   meta = {

From fa4104a581d270ad5a0095b5d6454c9fe1243de8 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Wed, 30 Sep 2026 21:44:06 +0100
Subject: [PATCH 120/525] qemu: 11.1.1 -> 11.1.2

---
 pkgs/by-name/qe/qemu/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/qe/qemu/package.nix b/pkgs/by-name/qe/qemu/package.nix
index 7089a36f3e5f..be5822e4ef36 100644
--- a/pkgs/by-name/qe/qemu/package.nix
+++ b/pkgs/by-name/qe/qemu/package.nix
@@ -140,11 +140,11 @@ stdenv.mkDerivation (finalAttrs: {
     + lib.optionalString nixosTestRunner "-for-vm-tests"
     + lib.optionalString toolsOnly "-utils"
     + lib.optionalString userOnly "-user";
-  version = "11.1.1";
+  version = "11.1.2";
 
   src = fetchurl {
     url = "https://download.qemu.org/qemu-${finalAttrs.version}.tar.xz";
-    hash = "sha256-B5/7/4pxEbvIkCIQfLq/O7/WFNX8nXzGdZkRlqyhJII=";
+    hash = "sha256-cxtWgeS7GL4xMjFXm479ApbFsBX6NtxTOHS2ObqDgBY=";
   };
 
   depsBuildBuild = [

From 03e4c7d6806c0db61e5f2f575591988dc246f06e Mon Sep 17 00:00:00 2001
From: AlexAntonik <antonikavv@gmail.com>
Date: Thu, 1 Oct 2026 21:54:42 +0300
Subject: [PATCH 121/525] florist: fix license

Signed-off-by: AlexAntonik <antonikavv@gmail.com>
---
 pkgs/by-name/fl/florist/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/fl/florist/package.nix b/pkgs/by-name/fl/florist/package.nix
index 712bdd17f597..c6f21d8d9a55 100644
--- a/pkgs/by-name/fl/florist/package.nix
+++ b/pkgs/by-name/fl/florist/package.nix
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Posix Ada Bindings";
     homepage = "https://github.com/adacore/florist";
-    license = lib.licenses.mit;
+    license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ lutzberger ];
     platforms = lib.platforms.linux;
   };

From 2604b6219436b6ed23bfc150dacc81a229ccd0e2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?David=20L=C3=B3pez?= <hola@devel0pez.com>
Date: Fri, 2 Oct 2026 06:51:15 +0200
Subject: [PATCH 122/525] sail: 0.7.1 -> 0.7.2

---
 pkgs/by-name/sa/sail/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sa/sail/package.nix b/pkgs/by-name/sa/sail/package.nix
index 80ed47e8eef8..fa4d7dd14936 100644
--- a/pkgs/by-name/sa/sail/package.nix
+++ b/pkgs/by-name/sa/sail/package.nix
@@ -11,16 +11,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sail";
-  version = "0.7.1";
+  version = "0.7.2";
 
   src = fetchFromGitHub {
     owner = "lakehq";
     repo = "sail";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-UJP2d56IF0h9s/kZhNWVkCp/YfTf1RpQStM1NjzJKK4=";
+    hash = "sha256-IKGUK0BkgrnfRYe36X9MwRf/0/+x4u6cKSwUv4WRCvg=";
   };
 
-  cargoHash = "sha256-a0NOVMH5dObFpwUaEsB6w66XVSjnWQRiK5i/KylEgAU=";
+  cargoHash = "sha256-RjgvMjtRKiVe9QufzlTblEt9tReqjWuVJeTEMwAis3E=";
 
   cargoBuildFlags = [
     "-p"

From 383132fad3fd31986f52fcc1bc09e5baa017a7c7 Mon Sep 17 00:00:00 2001
From: curoky <cccuroky@gmail.com>
Date: Fri, 2 Oct 2026 13:33:40 +0800
Subject: [PATCH 123/525] catatonit: fix cross install check

Use the target-prefixed readelf from stdenv so the static linkage check
can find the tool when cross compiling.

Assisted-by: TraeCode (GPT-5)
---
 pkgs/by-name/ca/catatonit/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ca/catatonit/package.nix b/pkgs/by-name/ca/catatonit/package.nix
index 6b1827e827c7..03af1754594d 100644
--- a/pkgs/by-name/ca/catatonit/package.nix
+++ b/pkgs/by-name/ca/catatonit/package.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   doInstallCheck = true;
   installCheckPhase = ''
-    readelf -d $out/bin/catatonit | grep 'There is no dynamic section in this file.'
+    ${stdenv.cc.targetPrefix}readelf -d $out/bin/catatonit | grep 'There is no dynamic section in this file.'
   '';
 
   passthru.tests = { inherit (nixosTests) podman; };

From d31e6e4ae6f6e763911edc14b7fd297c8254d3ee Mon Sep 17 00:00:00 2001
From: Andy Zhang <zh4ng@noreply.codeberg.org>
Date: Thu, 1 Oct 2026 22:58:40 -0700
Subject: [PATCH 124/525] beeper: 4.3.73 -> 4.3.160

---
 pkgs/by-name/be/beeper/package.nix | 29 ++++++++++++++++-------------
 1 file changed, 16 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/be/beeper/package.nix b/pkgs/by-name/be/beeper/package.nix
index 123548f7790e..0198bde29fc3 100644
--- a/pkgs/by-name/be/beeper/package.nix
+++ b/pkgs/by-name/be/beeper/package.nix
@@ -14,23 +14,23 @@
 }:
 let
   pname = "beeper";
-  version = "4.3.73";
+  version = "4.3.160";
 
   inherit (stdenv.hostPlatform) system;
 
   sources = {
     x86_64-linux = fetchurl {
       url = "https://beeper-desktop.download.beeper.com/builds/Beeper-${version}-x86_64.AppImage";
-      hash = "sha256-j6HTTqU7+z8AJ20hYgia6wOH0/n3gxrUocCpMPmgQvQ=";
+      hash = "sha256-by07u75l8YjMnuL8VZWkAUjTkGmP/qwJoopIMtJX7Tc=";
     };
     aarch64-linux = fetchurl {
       url = "https://beeper-desktop.download.beeper.com/builds/Beeper-${version}-arm64.AppImage";
-      hash = "sha256-kWlKMZdicJ+DhGgYXCTqvSCYinI9QD0pJD4nb4yYdpI=";
+      hash = "sha256-4mUxNwPrHbJvYQmX4KdYZcEmfV2MuSOEXrQKgl7DIa0=";
     };
     aarch64-darwin = fetchurl {
       # Zip unpacks cleanly with unzip; the download API redirects to a .dmg.
       url = "https://beeper-desktop.download.beeper.com/builds/Beeper-${version}-arm64-mac.zip";
-      hash = "sha256-79T3pPLEt+tQQ2xoC3XBAI/xpxMdnY11qSmVA2VFiVw=";
+      hash = "sha256-XrFxN57uOXIbgL8va/tgWtAaFTDVp9IxDWGJU0Kskbs=";
     };
   };
 
@@ -97,16 +97,19 @@ let
           linuxConfigFilename=$appRoot/build/main/linux-*.mjs
           echo "export function registerLinuxConfig() {}" > $linuxConfigFilename
 
-          # Disable scheduled update checks.
-          autoUpdateConfigFilename=$(
-            grep -lF 'c=d??{},p=c.hw_acceleration??!0' $appRoot/build/main/index-*.mjs
-          )
-          substituteInPlace "$autoUpdateConfigFilename" \
-            --replace-fail 'c=d??{},p=c.hw_acceleration??!0' 'c={...(d??{}),auto_update_disabled:true},p=c.hw_acceleration??!0'
+          # Disable (no-op) updater setup and checks without removing the methods
+          updateEntryFilename=$appRoot/build/main/main-entry-*.mjs
+          for method in 'async checkForUpdates' 'async runCheck' scheduleNextAutomaticCheck; do
+            signature="$method\([^)]*\)\{"
+            [ "$(grep -oE "$signature" $updateEntryFilename | wc -l)" -eq 1 ] \
+              || (echo "Expected one $method updater method" >&2; exit 1)
+            sed -i -E "s/$signature/&return;/" $updateEntryFilename
+          done
 
-          # Disable user-triggered update checks, which ignore auto_update_disabled.
-          substituteInPlace $appRoot/build/main/main-entry-*.mjs \
-            --replace-fail 'async checkForUpdates(r=!1){' 'async checkForUpdates(r=!1){return;'
+          signature='(register\([^)]*\)\{)([^{}]*\.on\("error",this\.onError\))'
+          [ "$(grep -oE "$signature" $updateEntryFilename | wc -l)" -eq 1 ] \
+            || (echo "Expected one updater register method" >&2; exit 1)
+          sed -i -E "s/$signature/\1return;\2/" $updateEntryFilename
         '';
       };
     in

From 89260a66561cbd6fdaee2561faadddf70fcfb07f Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Fri, 2 Oct 2026 01:47:58 +0200
Subject: [PATCH 125/525] eternal-terminal: fix broken build due to C++
 standard setting

Newer abseil-cpp versions used by Protobuf default to C++20, but
EternalTerminal sets a fixed default of C++17 upstream.
Patch it to default to C++20.
---
 .../et/eternal-terminal/cmake-cxx-version.patch       | 11 +++++++++++
 pkgs/by-name/et/eternal-terminal/package.nix          |  8 ++++----
 2 files changed, 15 insertions(+), 4 deletions(-)
 create mode 100644 pkgs/by-name/et/eternal-terminal/cmake-cxx-version.patch

diff --git a/pkgs/by-name/et/eternal-terminal/cmake-cxx-version.patch b/pkgs/by-name/et/eternal-terminal/cmake-cxx-version.patch
new file mode 100644
index 000000000000..5f8d69219f40
--- /dev/null
+++ b/pkgs/by-name/et/eternal-terminal/cmake-cxx-version.patch
@@ -0,0 +1,11 @@
+--- result/CMakeLists.txt	1970-01-01 01:00:01.000000000 +0100
++++ ./CMakeLists.txt	2026-10-02 01:44:39.238936270 +0200
+@@ -249,7 +250,7 @@
+ endif()
+ 
+ # Enable C++-17
+-set(CMAKE_CXX_STANDARD 17)
++set(CMAKE_CXX_STANDARD 20)
+ set(CMAKE_CXX_STANDARD_REQUIRED ON)
+ 
+ # Enable compile commands export for vscode
diff --git a/pkgs/by-name/et/eternal-terminal/package.nix b/pkgs/by-name/et/eternal-terminal/package.nix
index 399a1d539608..c9efa3e98e8b 100644
--- a/pkgs/by-name/et/eternal-terminal/package.nix
+++ b/pkgs/by-name/et/eternal-terminal/package.nix
@@ -24,6 +24,10 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-uZnjtSubTljFlbIZEznfEmNRaUWsuZotRapn0wexkow=";
   };
 
+  patches = [
+    ./cmake-cxx-version.patch
+  ];
+
   nativeBuildInputs = [
     cmake
   ];
@@ -47,10 +51,6 @@ stdenv.mkDerivation (finalAttrs: {
     "-DDISABLE_CRASH_LOG=TRUE"
   ];
 
-  env = lib.optionalAttrs stdenv.cc.isClang {
-    CXXFLAGS = toString [ "-std=c++17" ];
-  };
-
   doCheck = true;
   doInstallCheck = true;
 

From 286af8e655b5e950557645c6cd4c402b40a29ef4 Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Fri, 2 Oct 2026 14:01:15 +0200
Subject: [PATCH 126/525] eternal-terminal: fix darwin build failure

Vendored ThreadPool library uses std::result_of, removed in C++20.
Patch the sources to replace usage with std::invoke_result.
---
 pkgs/by-name/et/eternal-terminal/package.nix  |  1 +
 .../thread-pool-c++20-result-of.patch         | 30 +++++++++++++++++++
 2 files changed, 31 insertions(+)
 create mode 100644 pkgs/by-name/et/eternal-terminal/thread-pool-c++20-result-of.patch

diff --git a/pkgs/by-name/et/eternal-terminal/package.nix b/pkgs/by-name/et/eternal-terminal/package.nix
index c9efa3e98e8b..3e5488c92d07 100644
--- a/pkgs/by-name/et/eternal-terminal/package.nix
+++ b/pkgs/by-name/et/eternal-terminal/package.nix
@@ -26,6 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     ./cmake-cxx-version.patch
+    ./thread-pool-c++20-result-of.patch
   ];
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/et/eternal-terminal/thread-pool-c++20-result-of.patch b/pkgs/by-name/et/eternal-terminal/thread-pool-c++20-result-of.patch
new file mode 100644
index 000000000000..da7df85a9be4
--- /dev/null
+++ b/pkgs/by-name/et/eternal-terminal/thread-pool-c++20-result-of.patch
@@ -0,0 +1,30 @@
+--- 1/external_imported/ThreadPool/ThreadPool.h
++++ 2/external_imported/ThreadPool/ThreadPool.h
+@@ -10,13 +10,14 @@
+ #include <future>
+ #include <functional>
+ #include <stdexcept>
++#include <type_traits>
+ 
+ class ThreadPool {
+ public:
+     ThreadPool(size_t);
+     template<class F, class... Args>
+     auto enqueue(F&& f, Args&&... args) 
+-        -> std::future<typename std::result_of<F(Args...)>::type>;
++        -> std::future<typename std::invoke_result<F, Args...>::type>;
+     ~ThreadPool();
+ private:
+     // need to keep track of threads so we can join them
+@@ -61,9 +62,9 @@ inline ThreadPool::ThreadPool(size_t threads)
+ // add new work item to the pool
+ template<class F, class... Args>
+ auto ThreadPool::enqueue(F&& f, Args&&... args) 
+-    -> std::future<typename std::result_of<F(Args...)>::type>
++    -> std::future<typename std::invoke_result<F, Args...>::type>
+ {
+-    using return_type = typename std::result_of<F(Args...)>::type;
++    using return_type = typename std::invoke_result<F, Args...>::type;
+ 
+     auto task = std::make_shared< std::packaged_task<return_type()> >(
+             std::bind(std::forward<F>(f), std::forward<Args>(args)...)

From 31fed7121195a7a554f00e71d5c77e9e21b39fc4 Mon Sep 17 00:00:00 2001
From: AlexAntonik <antonikavv@gmail.com>
Date: Fri, 2 Oct 2026 20:06:18 +0300
Subject: [PATCH 127/525] arduino-language-server: fix license

Signed-off-by: AlexAntonik <antonikavv@gmail.com>
---
 pkgs/by-name/ar/arduino-language-server/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ar/arduino-language-server/package.nix b/pkgs/by-name/ar/arduino-language-server/package.nix
index 9ea573df9e17..041b4ff1a4bf 100644
--- a/pkgs/by-name/ar/arduino-language-server/package.nix
+++ b/pkgs/by-name/ar/arduino-language-server/package.nix
@@ -37,7 +37,7 @@ buildGoModule (finalAttrs: {
     mainProgram = "arduino-language-server";
     homepage = "https://github.com/arduino/arduino-language-server";
     changelog = "https://github.com/arduino/arduino-language-server/releases/tag/${finalAttrs.version}";
-    license = lib.licenses.asl20;
+    license = lib.licenses.agpl3Only;
     maintainers = with lib.maintainers; [ BattleCh1cken ];
   };
 })

From d51bbba8fb823f8cbc269e0fdf8bea64c4488008 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 2 Oct 2026 22:36:59 +0000
Subject: [PATCH 128/525] git-credential-gopass: 1.17.0 -> 1.17.3

---
 pkgs/by-name/gi/git-credential-gopass/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gi/git-credential-gopass/package.nix b/pkgs/by-name/gi/git-credential-gopass/package.nix
index 2c9ec2ea8619..ba59675c1cb3 100644
--- a/pkgs/by-name/gi/git-credential-gopass/package.nix
+++ b/pkgs/by-name/gi/git-credential-gopass/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "git-credential-gopass";
-  version = "1.17.0";
+  version = "1.17.3";
 
   src = fetchFromGitHub {
     owner = "gopasspw";
     repo = "git-credential-gopass";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-V+SEkV4I925S6sL9YC0QtEp76xENUaQO+XixWzsSqvs=";
+    hash = "sha256-aVH4C8KVJusUxgU+EtQSdlV432y2fB6M215i1jHzY70=";
   };
 
-  vendorHash = "sha256-OgwsQQRaJSwdh0+n1FdqAJzJ4pyggaejwg7oMEzEd9Q=";
+  vendorHash = "sha256-vjKqYKycTcal6YQG1kFPvWVxZGfnatB3UzkW9uIUOWM=";
 
   subPackages = [ "." ];
 

From 429ac51fa88e5480e1abadacd0f75d2f93ede443 Mon Sep 17 00:00:00 2001
From: Raito Bezarius <masterancpp@gmail.com>
Date: Wed, 30 Sep 2026 16:03:33 +0200
Subject: [PATCH 129/525] linux: install vmlinux in the dev output for all
 kernels

Previously vmlinux (and therefore its .BTF section) was only copied to the
dev output for modular kernels. BPF CO-RE consumers need the kernel's BTF
regardless of whether modules are enabled, so always populate $dev.
---
 pkgs/os-specific/linux/kernel/build.nix | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/build.nix b/pkgs/os-specific/linux/kernel/build.nix
index 390238c89ba0..21e8b11290c8 100644
--- a/pkgs/os-specific/linux/kernel/build.nix
+++ b/pkgs/os-specific/linux/kernel/build.nix
@@ -188,11 +188,13 @@ lib.makeOverridable (
       "pic"
     ];
 
-    ${if isModular then "outputs" else null} = [
+    # `dev` carries `vmlinux` (with its .BTF section) so that BPF consumers
+    # (e.g. systemd's nsresourced/mountfsd) can derive a matching vmlinux.h.
+    outputs = [
       "out"
       "dev"
-      "modules"
-    ];
+    ]
+    ++ lib.optional isModular "modules";
 
     # We remove a bunch of stuff that is symlinked from other places to save space,
     # which trips the broken symlink check. So, just skip it. We'll know if it explodes.
@@ -357,10 +359,11 @@ lib.makeOverridable (
       cd $buildRoot
     '';
 
-    postInstall = optionalString isModular ''
+    postInstall = ''
       mkdir -p $dev
       cp vmlinux $dev/
-
+    ''
+    + optionalString isModular ''
       mkdir -p $dev/lib/modules/${modDirVersion}/build/scripts
       # Installing from source dir instead of $buildRoot so as to omit intermediate artifacts.
       cp -rL ../scripts/gdb/ $dev/lib/modules/${modDirVersion}/build/scripts

From 901ddf184efd2b3d57b165be664e87dd904be05b Mon Sep 17 00:00:00 2001
From: Karolis Stasaitis <contact@carlossless.io>
Date: Sat, 3 Oct 2026 16:21:16 +0200
Subject: [PATCH 130/525] kitty-bin: add meta.mainDarwinApp

---
 pkgs/by-name/ki/kitty-bin/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/ki/kitty-bin/package.nix b/pkgs/by-name/ki/kitty-bin/package.nix
index 4613e18acd8a..d9fff66f8e59 100644
--- a/pkgs/by-name/ki/kitty-bin/package.nix
+++ b/pkgs/by-name/ki/kitty-bin/package.nix
@@ -45,6 +45,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     platforms = lib.platforms.darwin;
     mainProgram = "kitty";
+    mainDarwinApp = "kitty.app";
     maintainers = with lib.maintainers; [ carlossless ];
   };
 })

From ce4165247dfa10b3d339feb13e90e8765ea4eebe Mon Sep 17 00:00:00 2001
From: Karolis Stasaitis <contact@carlossless.io>
Date: Sat, 3 Oct 2026 16:21:16 +0200
Subject: [PATCH 131/525] scopehal-apps: add meta.mainDarwinApp

---
 pkgs/by-name/sc/scopehal-apps/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/sc/scopehal-apps/package.nix b/pkgs/by-name/sc/scopehal-apps/package.nix
index 307b9a9a5a4d..ac7a139465e0 100644
--- a/pkgs/by-name/sc/scopehal-apps/package.nix
+++ b/pkgs/by-name/sc/scopehal-apps/package.nix
@@ -112,6 +112,7 @@ stdenv.mkDerivation {
     homepage = "https://www.ngscopeclient.org/";
     license = lib.licenses.bsd3;
     mainProgram = "ngscopeclient";
+    mainDarwinApp = "ngscopeclient.app";
     maintainers = with lib.maintainers; [
       bgamari
       carlossless

From 7633347c4296f3e7c12824ecb5853008cde0b2d3 Mon Sep 17 00:00:00 2001
From: Karolis Stasaitis <contact@carlossless.io>
Date: Sat, 3 Oct 2026 16:21:16 +0200
Subject: [PATCH 132/525] packetry: add meta.mainDarwinApp

---
 pkgs/by-name/pa/packetry/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/pa/packetry/package.nix b/pkgs/by-name/pa/packetry/package.nix
index a58af37bc1d7..ca9f36a9e9cb 100644
--- a/pkgs/by-name/pa/packetry/package.nix
+++ b/pkgs/by-name/pa/packetry/package.nix
@@ -72,6 +72,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ carlossless ];
     mainProgram = "packetry";
+    mainDarwinApp = "Packetry.app";
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
 })

From d6bbd68a921b9b871562557cdad8b11a18da405c Mon Sep 17 00:00:00 2001
From: Karolis Stasaitis <contact@carlossless.io>
Date: Sat, 3 Oct 2026 16:21:16 +0200
Subject: [PATCH 133/525] dsview: add meta.mainDarwinApp

---
 pkgs/by-name/ds/dsview/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/ds/dsview/package.nix b/pkgs/by-name/ds/dsview/package.nix
index 20f0fc1ae928..939193198248 100644
--- a/pkgs/by-name/ds/dsview/package.nix
+++ b/pkgs/by-name/ds/dsview/package.nix
@@ -57,6 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "GUI program for supporting various instruments from DreamSourceLab, including logic analyzer, oscilloscope, etc";
     mainProgram = "DSView";
+    mainDarwinApp = "DSView.app";
     homepage = "https://www.dreamsourcelab.com/";
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.unix;

From 5a1c9d4dfd03e5d75f9b8e64d12020e0198732c7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 3 Oct 2026 16:37:51 +0000
Subject: [PATCH 134/525] wine-staging: 11.18 -> 11.19

---
 pkgs/applications/emulators/wine/sources.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/wine/sources.nix b/pkgs/applications/emulators/wine/sources.nix
index 7d5f252b7515..910e6678d680 100644
--- a/pkgs/applications/emulators/wine/sources.nix
+++ b/pkgs/applications/emulators/wine/sources.nix
@@ -151,9 +151,9 @@ rec {
 
   unstable = fetchurl rec {
     # NOTE: Don't forget to change the hash for staging as well.
-    version = "11.18";
+    version = "11.19";
     url = "https://dl.winehq.org/wine/source/11.x/wine-${version}.tar.xz";
-    hash = "sha256-xigvbU2uzxHzq5+aK2xZj2e+fijDY7osroo8RLYR56Q=";
+    hash = "sha256-SCAGbtpo5VPTMCOf/GKBZKNI0cYj5J0FjgEcWnzalfE=";
 
     patches = [
       # Also look for root certificates at $NIX_SSL_CERT_FILE
@@ -163,7 +163,7 @@ rec {
     # see https://gitlab.winehq.org/wine/wine-staging
     staging = fetchFromGitLab {
       inherit version;
-      hash = "sha256-KZCkra0y3XFNrbD2lZ+YUCLyq1POC30Sd4sGCJZuwgQ=";
+      hash = "sha256-Dnb/CjzxWDdMDXfJB/hiWHhQLjU49F6OyM6qqC0g/v0=";
       domain = "gitlab.winehq.org";
       owner = "wine";
       repo = "wine-staging";

From d1f1d4fc149eac90cc44bb9a9a1ce3e57d159021 Mon Sep 17 00:00:00 2001
From: Steven Merino <115487425+yuuhikaze@users.noreply.github.com>
Date: Sat, 3 Oct 2026 12:37:32 -0500
Subject: [PATCH 135/525] structurizr-cli: set JAVA_HOME in wrapper

The Gradle-generated launcher script prefers $JAVA_HOME over PATH when
selecting a JVM, so the wrapper's `--prefix PATH` is ignored whenever the
user's environment already sets JAVA_HOME. If that points at a JDK older than
21, structurizr-cli fails to start:

  Error: LinkageError occurred while loading main class com.structurizr.cli.StructurizrCliApplication
          java.lang.UnsupportedClassVersionError: com/structurizr/cli/StructurizrCliApplication
          has been compiled by a more recent version of the Java Runtime
          (class file version 65.0), this version of the Java Runtime only
          recognizes class file versions up to 61.0

Nix builds do not inherit the user's environment, so versionCheckHook never
sees an ambient JAVA_HOME and the breakage does not surface at build time.

Setting JAVA_HOME explicitly makes the wrapper independent of the ambient
environment, as done for other JVM applications in Nixpkgs.

Assisted-by: Claude Code (claude-opus-5)
---
 pkgs/by-name/st/structurizr-cli/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/st/structurizr-cli/package.nix b/pkgs/by-name/st/structurizr-cli/package.nix
index 5db3e8af4252..56aae51b8796 100644
--- a/pkgs/by-name/st/structurizr-cli/package.nix
+++ b/pkgs/by-name/st/structurizr-cli/package.nix
@@ -93,6 +93,7 @@ stdenv.mkDerivation (finalAttrs: {
     cp -r build/install/structurizr-cli $out/lib/structurizr-cli
 
     makeBinaryWrapper $out/lib/structurizr-cli/bin/structurizr-cli $out/bin/structurizr-cli \
+      --set JAVA_HOME "${jre.home}" \
       --prefix PATH : "${
         lib.makeBinPath [
           coreutils

From 4a3c3dcb8b7ac51fe0db1d12845dcf21ed127d5c Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Sat, 3 Oct 2026 23:16:40 +0200
Subject: [PATCH 136/525] Reapply "nixos/wrappers: enforce target executable is
 ELF"

This reverts commit f515a2051f6338136d4481bcbc979bde4af9c11d.
---
 nixos/modules/security/wrappers/default.nix | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/security/wrappers/default.nix b/nixos/modules/security/wrappers/default.nix
index 907b6ac01b21..941a99323f9b 100644
--- a/nixos/modules/security/wrappers/default.nix
+++ b/nixos/modules/security/wrappers/default.nix
@@ -361,16 +361,18 @@ in
 
     ###### wrappers consistency checks
     system.checks = lib.singleton (
-      pkgs.runCommandLocal "ensure-all-wrappers-paths-exist"
+      pkgs.runCommandLocal "ensure-wrapper-integrity"
         {
-          nativeBuildInputs = [ pkgs.libcap-text-verifier ];
+          nativeBuildInputs = [
+            pkgs.libcap-text-verifier
+          ];
           preferLocalBuild = true;
         }
         ''
           # make sure we produce output
           mkdir -p $out
 
-          echo -n "Checking that Nix store paths of all wrapped programs exist... "
+          echo -n "Checking that Nix store paths of all wrapped programs exist and are ELF executables... "
           ${lib.toShellVar "wrappers" (lib.mapAttrs (n: v: v.source) wrappers)}
           for name in "''${!wrappers[@]}"; do
             path="''${wrappers[$name]}"
@@ -382,6 +384,15 @@ in
               test -t 1 && echo -ne '\033[0m'
               exit 1
             fi
+            read -r -n 4 magic < "$path"
+            if ! [[ "$magic" = $'\x7fELF' ]]; then
+              test -t 1 && echo -ne '\033[1;31m'
+              echo "FAIL"
+              echo "The target executable $path is not an ELF! This is a security risk."
+              echo "Script wrappers (e.g. bash or python) are commonly susceptible to dangerous env var injections."
+              test -t 1 && echo -ne '\033[0m'
+              exit 1
+            fi
           done
           echo "OK"
 

From c35244dd8da046c9a505417c9283c98a9071751a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 4 Oct 2026 00:48:08 +0000
Subject: [PATCH 137/525] tango-cpp: 10.3.3 -> 10.3.4.1

---
 pkgs/by-name/ta/tango-cpp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ta/tango-cpp/package.nix b/pkgs/by-name/ta/tango-cpp/package.nix
index 04e942f66b5b..f6da0bf01c50 100644
--- a/pkgs/by-name/ta/tango-cpp/package.nix
+++ b/pkgs/by-name/ta/tango-cpp/package.nix
@@ -16,14 +16,14 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "tango-cpp";
-  version = "10.3.3";
+  version = "10.3.4.1";
 
   src = fetchFromGitLab {
     owner = "tango-controls";
     repo = "cppTango";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-hiJHnv6H4IAW1tUVX2Oux6TleaZBI/+0mZMiKSkM4fA=";
+    hash = "sha256-bxP3UH2efUyrOSIHs5SgXWsm+ZvL1lUVJeYxUZT92GQ=";
   };
 
   nativeBuildInputs = [

From f1fb0541c0e0d02ea91b8dbe93f296d567a50e98 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 4 Oct 2026 04:04:55 +0000
Subject: [PATCH 138/525] roave-backward-compatibility-check: 8.22.0 -> 8.23.0

---
 .../ro/roave-backward-compatibility-check/package.nix       | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ro/roave-backward-compatibility-check/package.nix b/pkgs/by-name/ro/roave-backward-compatibility-check/package.nix
index 5ebefb264ad5..a50e679ba970 100644
--- a/pkgs/by-name/ro/roave-backward-compatibility-check/package.nix
+++ b/pkgs/by-name/ro/roave-backward-compatibility-check/package.nix
@@ -7,16 +7,16 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "roave-backward-compatibility-check";
-  version = "8.22.0";
+  version = "8.23.0";
 
   src = fetchFromGitHub {
     owner = "Roave";
     repo = "BackwardCompatibilityCheck";
     tag = finalAttrs.version;
-    hash = "sha256-RRfjaqelRIsjAOl1vgXZ/OGObBjd62o8C23LNVtqkKE=";
+    hash = "sha256-CiE6Yfj2lyVAOz6DhZHhqrvbkATponGUiZFXjdAjgeE=";
   };
 
-  vendorHash = "sha256-ODcA2rQVZ48VpKTW0XortUAWRZvhyCj2gbiF/GzKs+0=";
+  vendorHash = "sha256-quVGTY6teiKTePFZUcX20aDoQ0ydNHqYuoR4H9Hc37E=";
 
   nativeInstallCheckInputs = [
     versionCheckHook

From 173c973dbe19f440d9e910f166abd104d83e9d1d Mon Sep 17 00:00:00 2001
From: larry <26318510+larry0x@users.noreply.github.com>
Date: Tue, 8 Sep 2026 19:43:52 +0100
Subject: [PATCH 139/525] discord: keep modules outside the .app on darwin

Discord's .app carries a notarized Developer ID signature from Discord,
Inc. Its sealed resource envelope covers everything below Contents/, so
extracting the native modules into Contents/Resources/modules
invalidates it. macOS then refuses to launch the app through
LaunchServices, reporting that it is damaged:

  $ codesign --verify --deep --strict Discord.app
  Discord.app: a sealed resource is missing or invalid
  file added: .../Contents/Resources/modules/discord_rpc/index.js
  [...]

Every complaint is a "file added" line naming a file this derivation
puts there. Nothing Discord ships is modified.

Extract them to $out/share/<pname>/modules instead. Nothing reads them
through the bundle: stageModules uses that directory only as the source
for the symlinks it places in the user data directory, which is where
Discord's module loader looks. With it gone, the bundle verifies again
and Gatekeeper accepts the result:

  Discord.app: valid on disk
  Discord.app: satisfies its Designated Requirement
  Discord.app: accepted
  source=Notarized Developer ID
  origin=Developer ID Application: Discord, Inc. (53Q6R32WPB)

Resolves #544338

Assisted-by: Claude Code (claude-opus-5)
---
 pkgs/by-name/di/discord/darwin.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/di/discord/darwin.nix b/pkgs/by-name/di/discord/darwin.nix
index 50379bfb098e..59eec51f185d 100644
--- a/pkgs/by-name/di/discord/darwin.nix
+++ b/pkgs/by-name/di/discord/darwin.nix
@@ -102,8 +102,8 @@ stdenv.mkDerivation (finalAttrs: {
 
     ${lib.concatStringsSep "\n" (
       lib.mapAttrsToList (name: src: ''
-        mkdir -p "$out/Applications/${desktopName}.app/Contents/Resources/modules/${name}"
-        extractDistro ${src} "$out/Applications/${desktopName}.app/Contents/Resources/modules/${name}"
+        mkdir -p "$out/share/${pname}/modules/${name}"
+        extractDistro ${src} "$out/share/${pname}/modules/${name}"
       '') moduleSrcs
     )}
 
@@ -111,7 +111,7 @@ stdenv.mkDerivation (finalAttrs: {
     mkdir -p $out/bin
     makeWrapper "$out/Applications/${desktopName}.app/Contents/MacOS/${binaryName}" "$out/bin/${binaryName}" \
       ${lib.strings.optionalString disableUpdates "--run ${lib.getExe finalAttrs.disableBreakingUpdates}"} \
-      --run "${finalAttrs.stageModules} \"$out/Applications/${desktopName}.app/Contents/Resources/modules\"" \
+      --run "${finalAttrs.stageModules} \"$out/share/${pname}/modules\"" \
       --add-flags ${lib.escapeShellArg commandLineArgs}
 
     runHook postInstall

From 5a695621d33c85a2641acaf801d1bea8514ebad2 Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Sun, 4 Oct 2026 14:43:17 -0400
Subject: [PATCH 140/525] rocmPackages.rocm-smi: modernize

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 .../development/rocm-modules/rocm-smi/default.nix | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/rocm-modules/rocm-smi/default.nix b/pkgs/development/rocm-modules/rocm-smi/default.nix
index c0044c938a9e..188d78465252 100644
--- a/pkgs/development/rocm-modules/rocm-smi/default.nix
+++ b/pkgs/development/rocm-modules/rocm-smi/default.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "ROCm";
     repo = "rocm-systems";
-    rev = "rocm-${finalAttrs.version}";
+    tag = "rocm-${finalAttrs.version}";
     sparseCheckout = [
       "projects/rocm-smi-lib"
       "shared"
@@ -25,6 +25,9 @@ stdenv.mkDerivation (finalAttrs: {
   };
   sourceRoot = "${finalAttrs.src.name}/projects/rocm-smi-lib";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   propagatedBuildInputs = [
     libdrm
   ];
@@ -38,10 +41,10 @@ stdenv.mkDerivation (finalAttrs: {
   cmakeFlags = [
     # Manually define CMAKE_INSTALL_<DIR>
     # See: https://github.com/NixOS/nixpkgs/pull/197838
-    "-DCMAKE_INSTALL_BINDIR=bin"
-    "-DCMAKE_INSTALL_LIBDIR=lib"
-    "-DCMAKE_INSTALL_LIBEXECDIR=libexec"
-    "-DCMAKE_INSTALL_INCLUDEDIR=include"
+    (lib.cmakeFeature "CMAKE_INSTALL_BINDIR" "bin")
+    (lib.cmakeFeature "CMAKE_INSTALL_LIBDIR" "lib")
+    (lib.cmakeFeature "CMAKE_INSTALL_LIBEXECDIR" "libexec")
+    (lib.cmakeFeature "CMAKE_INSTALL_INCLUDEDIR" "include")
   ];
 
   postInstall =
@@ -65,7 +68,9 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "System management interface for AMD GPUs supported by ROCm";
     homepage = "https://github.com/ROCm/rocm-systems/tree/develop/projects/rocm-smi-lib";
+    changelog = "https://github.com/ROCm/rocm-systems/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
+    mainProgram = "rocm-smi";
     maintainers = with lib.maintainers; [ lovesegfault ];
     teams = [ lib.teams.rocm ];
     platforms = [ "x86_64-linux" ];

From b0544aceda02fe816018c1f76e8d506ffd2a0ba7 Mon Sep 17 00:00:00 2001
From: Colin <colin@uninsane.org>
Date: Sun, 4 Oct 2026 21:41:18 +0000
Subject: [PATCH 141/525] linux: increase NR_CPUS from 384 -> 512

NR_CPUS=384 was introduced in 2016 (1cd7dbc00b82d1a0d92dbdb4905cb9c48c6860ff).

meanwhile, AMD ships individual CPUs with as many as 384 logical CPUs
(EPYC 9965) and supports dual-socket use of those (i.e. 768 logical CPUs).

768 would seem a reasonable default, then, except that without enabling
additional settings, we can only rely on the kernel supporting 512.
512 remains an improvement for any dual-socket 256 cpu user, at least.

mainline Kconfig docs for NR_CPUS reads [1]:

> config NR_CPUS
> 	int "Maximum number of CPUs" if SMP && !MAXSMP
> 	range NR_CPUS_RANGE_BEGIN NR_CPUS_RANGE_END
> 	default NR_CPUS_DEFAULT
> 	help
> 	  This allows you to specify the maximum number of CPUs which this
> 	  kernel will support.  If CPUMASK_OFFSTACK is enabled, the maximum
> 	  supported value is 8192, otherwise the maximum value is 512.  The
> 	  minimum value which makes sense is 2.
>
> 	  This is purely to save memory: each supported CPU adds about 8KB
> 	  to the kernel image.

1: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/x86/Kconfig?id=v7.2#n1036
---
 pkgs/os-specific/linux/kernel/common-config.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 53008b3434e7..f0fbaa099d35 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -1539,8 +1539,8 @@ let
             SPARSEMEM = yes;
 
             # Bump the maximum number of CPUs to support systems like EC2 x1.*
-            # instances and Xeon Phi.
-            NR_CPUS = freeform "384";
+            # instances and Xeon Phi or AMD EPYC.
+            NR_CPUS = freeform "512";
 
             # Enable LEDS to display link-state status of PHY devices (i.e. eth lan/wan interfaces)
             LED_TRIGGER_PHY = yes;

From 17cf278a2f20a86dce85c6cbfe41e0a165f5063f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 5 Oct 2026 00:27:16 +0000
Subject: [PATCH 142/525] wezterm: 0-unstable-2026-09-17 ->
 0-unstable-2026-09-29

---
 pkgs/by-name/we/wezterm/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/we/wezterm/package.nix b/pkgs/by-name/we/wezterm/package.nix
index 8f3e650b5684..c97fed74abd3 100644
--- a/pkgs/by-name/we/wezterm/package.nix
+++ b/pkgs/by-name/we/wezterm/package.nix
@@ -29,14 +29,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wezterm";
-  version = "0-unstable-2026-09-17";
+  version = "0-unstable-2026-09-29";
 
   src = fetchFromGitHub {
     owner = "wezterm";
     repo = "wezterm";
-    rev = "b09b56c29c1e367e598b60ca266e2cc9038751e0";
+    rev = "cab25161054c50fd6c705db4ceefef0f1e5a9575";
     fetchSubmodules = true;
-    hash = "sha256-wVK9IcPezoEWeTlDkD/foGyRH2tnwEHX3ZgChpIX3Vw=";
+    hash = "sha256-u1cB9tKZ0nVmV8UHi6zq0esnSFX4flh3K0JjIQh5CE8=";
   };
 
   postPatch = ''

From 17847d405e0aac14ad4ceeb134c2d25f48e92369 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Mon, 5 Oct 2026 02:35:28 +0200
Subject: [PATCH 143/525] python3Packages.pyvista-validation: init at 0.2.2

---
 .../pyvista-validation/default.nix            | 42 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 44 insertions(+)
 create mode 100644 pkgs/development/python-modules/pyvista-validation/default.nix

diff --git a/pkgs/development/python-modules/pyvista-validation/default.nix b/pkgs/development/python-modules/pyvista-validation/default.nix
new file mode 100644
index 000000000000..c8fcee83cbf4
--- /dev/null
+++ b/pkgs/development/python-modules/pyvista-validation/default.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  setuptools-scm,
+  numpy,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "pyvista-validation";
+  version = "0.2.2";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "pyvista";
+    repo = "pyvista-validation";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-LuY3AYWmsETjItFdgKcK6nRm5GYlqWbrznxYO+EaUYY=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = [
+    numpy
+  ];
+
+  pythonImportsCheck = [
+    "pyvista_validation"
+  ];
+
+  meta = {
+    description = "Validate and standardize array-like input";
+    homepage = "https://github.com/pyvista/pyvista-validation";
+    changelog = "https://github.com/pyvista/pyvista-validation/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ wegank ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 8b8e2496e56a..ed6d86cd34f7 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -17509,6 +17509,8 @@ self: super: with self; {
 
   pyvista = callPackage ../development/python-modules/pyvista { };
 
+  pyvista-validation = callPackage ../development/python-modules/pyvista-validation { };
+
   pyviz-comms = callPackage ../development/python-modules/pyviz-comms { };
 
   pyvlx = callPackage ../development/python-modules/pyvlx { };

From 96e7b44085f2b42e83838bb93a4de2865651cd5e Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Mon, 5 Oct 2026 02:35:36 +0200
Subject: [PATCH 144/525] python3Packages.pyvista: 0.48.4 -> 0.49.0

---
 pkgs/development/python-modules/pyvista/default.nix | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyvista/default.nix b/pkgs/development/python-modules/pyvista/default.nix
index 7f8617da10e1..fee524bab9dd 100644
--- a/pkgs/development/python-modules/pyvista/default.nix
+++ b/pkgs/development/python-modules/pyvista/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   fetchFromGitHub,
   cyclopts,
@@ -7,6 +8,8 @@
   numpy,
   pillow,
   pooch,
+  pyobjc-framework-Cocoa,
+  pyvista-validation,
   scooby,
   setuptools,
   typing-extensions,
@@ -15,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "pyvista";
-  version = "0.48.4";
+  version = "0.49.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pyvista";
     repo = "pyvista";
     tag = "v${version}";
-    hash = "sha256-VF84EMS/FnLl0y1LpWaYosyG0qEWI/QghZQq32ktlLg=";
+    hash = "sha256-Qq6oJ/0Er2acaYMHYCLSSO49aZRPUvIKkkWRXsQ1RoA=";
   };
 
   build-system = [ setuptools ];
@@ -33,9 +36,13 @@ buildPythonPackage rec {
     numpy
     pillow
     pooch
+    pyvista-validation
     scooby
     typing-extensions
     vtk
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    pyobjc-framework-Cocoa
   ];
 
   # Fatal Python error: Aborted

From 2d750e59d6909c408ad6fe610f8523cb1c8e870c Mon Sep 17 00:00:00 2001
From: Raito Bezarius <masterancpp@gmail.com>
Date: Wed, 30 Sep 2026 16:03:34 +0200
Subject: [PATCH 145/525] linuxPackages.ebpf-headers: init
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Expose, per kernel package set, a vmlinux.h extracted from that kernel's
BTF (bpftool btf dump on $dev/vmlinux). This is the pure equivalent of
systemd's vmlinux-h=generated, which reads /sys/kernel/btf/vmlinux, and
it lets BPF CO-RE consumers compile against the kernel they run on
instead of a synthetic one.

More on this: BPF CO-RE is not yet a complete solution for a stable BPF
ABI. At the time of writing, CO-RE is only about offset/type relocation.
The history of the kernel private ABI evolution has shown this is not
enough, e.g. task_struct->utime/stime jiffies → nsecs after 4.6.
Operational expertise of BPF CO-RE is not great at the moment as well:
BPF verifier bugs can lead to rejection of valid programs, see
https://ebpfchirp.substack.com/p/why-does-my-ebpf-program-work-on.

For reminders, BTF is arch independent, so cross builds are fine.
---
 .../os-specific/linux/kernel/ebpf-headers.nix | 29 +++++++++++++++++++
 pkgs/top-level/linux-kernels.nix              |  9 ++++++
 2 files changed, 38 insertions(+)
 create mode 100644 pkgs/os-specific/linux/kernel/ebpf-headers.nix

diff --git a/pkgs/os-specific/linux/kernel/ebpf-headers.nix b/pkgs/os-specific/linux/kernel/ebpf-headers.nix
new file mode 100644
index 000000000000..559f237d62d2
--- /dev/null
+++ b/pkgs/os-specific/linux/kernel/ebpf-headers.nix
@@ -0,0 +1,29 @@
+{
+  lib,
+  bpftools,
+  kernel,
+  runCommand,
+}:
+
+# BTF is architecture-independent, so the extraction can run on the build
+# machine even when the kernel targets another architecture.
+runCommand "linux-${kernel.version}-ebpf-headers"
+  {
+    nativeBuildInputs = [ bpftools ];
+
+    passthru = {
+      inherit kernel;
+    };
+
+    meta = {
+      description = "vmlinux.h (kernel BTF) for BPF programs, from Linux ${kernel.version}";
+      homepage = "https://docs.kernel.org/bpf/btf.html";
+      license = lib.licenses.gpl2Only;
+      platforms = lib.platforms.linux;
+      teams = [ lib.teams.linux-kernel ];
+    };
+  }
+  ''
+    mkdir -p $out
+    bpftool btf dump file ${kernel.dev}/vmlinux format c > $out/vmlinux.h
+  ''
diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index c710cc74b62b..ddbbfcd5eace 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -220,6 +220,15 @@ in
       {
         inherit callPackage;
         kernel = kernel_;
+
+        # vmlinux.h derived from this kernel's BTF, for BPF consumers such as
+        # systemd's nsresourced/mountfsd.
+        # This derivation requires CONFIG_DEBUG_INFO_BTF-built kernel (this is
+        # the case in nixpkgs), otherwise it will fail.
+        ebpf-headers = callPackage ../os-specific/linux/kernel/ebpf-headers.nix {
+          inherit kernel;
+        };
+
         inherit (kernel) stdenv; # in particular, use the same compiler by default
 
         # to help determine module compatibility

From 63b2abad261d5b0174c66ca6a7a239f34da193bc Mon Sep 17 00:00:00 2001
From: Raito Bezarius <masterancpp@gmail.com>
Date: Wed, 30 Sep 2026 16:05:26 +0200
Subject: [PATCH 146/525] systemd: add a vmlinux-btf argument

When set, systemd is configured with -Dvmlinux-h=provided pointing at
the given vmlinux.h, which enables the BPF programs that need kernel
internal types (userns-restrict for nsresourced, sysctl-monitor, and
restrict-fsaccess for mountfsd).

Defaults to null, i.e. today's behaviour of skipping these features.
---
 pkgs/os-specific/linux/systemd/default.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 958c424ba30e..55f3c44f631f 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -80,6 +80,10 @@
   bpftools,
   libbpf,
 
+  # vmlinux.h (kernel BTF) for the systemd BPF programs.
+  # This is used for the linuxPackages*.systemd packages.
+  vmlinux-btf ? null,
+
   # Needed to produce a ukify that works for cross compiling UKIs.
   targetPackages,
 
@@ -559,6 +563,10 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonBool "smack" true)
     (lib.mesonBool "b_pie" true)
   ]
+  ++ lib.optionals (withLibBPF && vmlinux-btf != null) [
+    (lib.mesonOption "vmlinux-h" "provided")
+    (lib.mesonOption "vmlinux-h-path" "${vmlinux-btf}/vmlinux.h")
+  ]
   ++ lib.optionals withVConsole [
     (lib.mesonOption "loadkeys-path" "${kbd}/bin/loadkeys")
     (lib.mesonOption "setfont-path" "${kbd}/bin/setfont")

From 73761ef73de7465d9328199fc13c8ad7deeac03f Mon Sep 17 00:00:00 2001
From: Raito Bezarius <masterancpp@gmail.com>
Date: Wed, 30 Sep 2026 16:05:26 +0200
Subject: [PATCH 147/525] linuxPackages.systemd: build against the kernel's BTF

Expose a systemd per kernel package set, compiled with that kernel's
ebpf-headers, so it observes the kernel it will run on.

This choice has been discussed on the NixOS systemd Matrix chat for
months, taking feedback also from the systemd team on the question.
---
 pkgs/top-level/linux-kernels.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/top-level/linux-kernels.nix b/pkgs/top-level/linux-kernels.nix
index ddbbfcd5eace..58411c8d7c34 100644
--- a/pkgs/top-level/linux-kernels.nix
+++ b/pkgs/top-level/linux-kernels.nix
@@ -229,6 +229,12 @@ in
           inherit kernel;
         };
 
+        # systemd compiled against this kernel's BTF, so its BPF programs
+        # (nsresourced/mountfsd, networkd) match the kernel that will run.
+        systemd = pkgs.systemd.override {
+          vmlinux-btf = self.ebpf-headers;
+        };
+
         inherit (kernel) stdenv; # in particular, use the same compiler by default
 
         # to help determine module compatibility

From 7cd1850178e53e4b524f863f7041cd520f5f2712 Mon Sep 17 00:00:00 2001
From: Raito Bezarius <masterancpp@gmail.com>
Date: Wed, 30 Sep 2026 16:05:26 +0200
Subject: [PATCH 148/525] systemdMinimal: pin vmlinux-btf = null

Bootstrap path should not demand a kernel build.
---
 pkgs/top-level/all-packages.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d5df48b17dad..e75b72059e07 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7863,6 +7863,7 @@ with pkgs;
     withImportd = false;
     withImds = false;
     withLibBPF = false;
+    vmlinux-btf = null;
     withLibidn2 = false;
     withLocaled = false;
     withLogind = false;

From 9ff5c76c8bb48b744c83b66911e085df00b5a601 Mon Sep 17 00:00:00 2001
From: Raito Bezarius <masterancpp@gmail.com>
Date: Wed, 30 Sep 2026 16:07:39 +0200
Subject: [PATCH 149/525] systemd: add withNsresourced/withMountfsd options

These subsystems rely on the userns-restrict and restrict-fsaccess BPF
programs, which need a vmlinux.h, so default them to on only when a
kernel BTF is provided.
---
 pkgs/os-specific/linux/systemd/default.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 55f3c44f631f..4f52e3cf5e67 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -162,6 +162,10 @@
   # attempt to load a service which does not exist, resulting in errors.
   withUtmp ? !stdenv.hostPlatform.isMusl,
   withVmspawn ? true,
+  # The BPF programs backing nsresourced/mountfsd need a vmlinux.h, which is
+  # only available when a kernel BTF is provided (see vmlinux-btf above).
+  withNsresourced ? withLibBPF && vmlinux-btf != null,
+  withMountfsd ? withLibBPF && vmlinux-btf != null,
   # kernel-install shouldn't usually be used on NixOS, but can be useful, e.g. for
   # building disk images for non-NixOS systems. To save users from trying to use it
   # on their live NixOS system, we disable it by default.
@@ -190,6 +194,8 @@ assert withHomed -> withPam;
 assert withHomed -> withOpenSSL;
 assert withFido2 -> withOpenSSL;
 assert withSysupdate -> withOpenSSL;
+assert withNsresourced -> withLibBPF;
+assert withMountfsd -> withLibBPF;
 assert withImportd -> (withGcrypt || withOpenSSL);
 assert withUkify -> (withEfi && withBootloader);
 assert withRepart -> withCryptsetup;
@@ -546,6 +552,8 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonBool "hwdb" withHwdb)
     (lib.mesonBool "timedated" withTimedated)
     (lib.mesonBool "timesyncd" withTimesyncd)
+    (lib.mesonBool "nsresourced" withNsresourced)
+    (lib.mesonBool "mountfsd" withMountfsd)
     (lib.mesonBool "userdb" withUserDb)
     (lib.mesonBool "coredump" withCoredump)
     (lib.mesonBool "firstboot" withFirstboot)
@@ -718,6 +726,8 @@ stdenv.mkDerivation (finalAttrs: {
       withLogind
       withMachined
       withNetworkd
+      withNsresourced
+      withMountfsd
       withNspawn
       withRepart
       withPortabled

From 7d634a56d8dbb242db59e97f3c821ab073da574f Mon Sep 17 00:00:00 2001
From: Raito Bezarius <masterancpp@gmail.com>
Date: Wed, 30 Sep 2026 17:08:06 +0200
Subject: [PATCH 150/525] systemd: add a NixOS test for nsresourced and
 mountfsd

Boot a VM with the default (kernel-BTF-backed) systemd and verify that the
BPF LSM is active, both sockets come up, nsresourced delegates a user
namespace, and mountfsd mounts a DDI via systemd-dissect. This is the runtime
counterpart to compiling the userns-restrict/restrict-fsaccess BPF programs
against the kernel's vmlinux.h.
---
 nixos/tests/all-tests.nix                    |  1 +
 nixos/tests/systemd-nsresourced-mountfsd.nix | 68 ++++++++++++++++++++
 pkgs/os-specific/linux/systemd/default.nix   |  1 +
 3 files changed, 70 insertions(+)
 create mode 100644 nixos/tests/systemd-nsresourced-mountfsd.nix

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 8349e5fd6d7a..e424ec40be68 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1862,6 +1862,7 @@ in
   systemd-no-tainted = runTest ./systemd-no-tainted.nix;
   systemd-nspawn = runTest ./systemd-nspawn.nix;
   systemd-nspawn-configfile = runTest ./systemd-nspawn-configfile.nix;
+  systemd-nsresourced-mountfsd = runTest ./systemd-nsresourced-mountfsd.nix;
   systemd-oomd = runTest ./systemd-oomd.nix;
   systemd-portabled = runTest ./systemd-portabled.nix;
   systemd-pstore = runTest ./systemd-pstore.nix;
diff --git a/nixos/tests/systemd-nsresourced-mountfsd.nix b/nixos/tests/systemd-nsresourced-mountfsd.nix
new file mode 100644
index 000000000000..e8afb3aced17
--- /dev/null
+++ b/nixos/tests/systemd-nsresourced-mountfsd.nix
@@ -0,0 +1,68 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  name = "systemd-nsresourced-mountfsd";
+
+  meta.maintainers = with lib.maintainers; [ raitobezarius ];
+
+  nodes.machine = { config, ... }: {
+    # Currently, kernel BTF enabled systemd is not the default yet.
+    systemd.package = config.boot.kernelPackages.systemd;
+    systemd.additionalUpstreamSystemUnits = [
+      "systemd-nsresourced.socket"
+      "systemd-nsresourced.service"
+      "systemd-mountfsd.socket"
+      "systemd-mountfsd.service"
+    ];
+  };
+
+  testScript = ''
+    machine.wait_for_unit("multi-user.target")
+
+    with subtest("BPF LSM is active"):
+        lsm = machine.succeed("cat /sys/kernel/security/lsm")
+        assert "bpf" in lsm, f"BPF LSM is not active: {lsm}"
+
+    with subtest("nsresourced and mountfsd sockets are available"):
+        machine.systemctl("start systemd-nsresourced.socket systemd-mountfsd.socket")
+        machine.wait_for_unit("systemd-nsresourced.socket")
+        machine.wait_for_unit("systemd-mountfsd.socket")
+
+    with subtest("nsresourced serves its varlink interface and delegates a user namespace"):
+        machine.succeed("varlinkctl introspect /run/systemd/userdb/io.systemd.NamespaceResource")
+        machine.succeed(
+            "unshare --user varlinkctl --exec call "
+            "--push-fd=/proc/self/ns/user "
+            "/run/systemd/userdb/io.systemd.NamespaceResource "
+            "io.systemd.NamespaceResource.AllocateUserRange "
+            "'{\"name\":\"nixos-test\",\"size\":65536,\"userNamespaceFileDescriptor\":0}' "
+            "-- cat /proc/self/uid_map"
+        )
+
+    with subtest("mountfsd serves its varlink interface"):
+        machine.succeed("varlinkctl introspect /run/systemd/io.systemd.MountFileSystem")
+
+    with subtest("mountfsd mounts a DDI on behalf of a client"):
+        machine.succeed("mkdir -p /tmp/ddi-defs")
+        machine.succeed("echo '[Partition]' > /tmp/ddi-defs/10-root.conf")
+        machine.succeed("echo 'Type=root' >> /tmp/ddi-defs/10-root.conf")
+        machine.succeed("echo 'Format=ext4' >> /tmp/ddi-defs/10-root.conf")
+        machine.succeed(
+            "PATH=${pkgs.e2fsprogs}/bin:$PATH "
+            "systemd-repart --empty=create --size=64M "
+            "--definitions=/tmp/ddi-defs --offline=yes /var/tmp/ddi.raw"
+        )
+        # SYSTEMD_USE_MOUNTFSD forces systemd-dissect to go through
+        # systemd-mountfsd (and systemd-nsresourced) instead of mounting the
+        # image locally.
+        # NOTE: image-policy should be restricted but I failed to do so.
+        machine.succeed(
+            "SYSTEMD_USE_MOUNTFSD=1 systemd-dissect "
+            "--image-policy='*' --mtree /var/tmp/ddi.raw"
+        )
+  '';
+}
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 4f52e3cf5e67..16b3be82a8f0 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -822,6 +822,7 @@ stdenv.mkDerivation (finalAttrs: {
           systemd
           systemd-analyze
           systemd-bpf
+          systemd-nsresourced-mountfsd
           systemd-confinement
           systemd-coredump
           systemd-cryptenroll

From 78f344724e637cc3f3eadbc38d2b3a8be5ed9cba Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 5 Oct 2026 11:53:11 +0000
Subject: [PATCH 151/525] turtle-build: 0.5.7 -> 0.5.15

---
 pkgs/by-name/tu/turtle-build/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/tu/turtle-build/package.nix b/pkgs/by-name/tu/turtle-build/package.nix
index d057cbdad8df..db0679d72fb9 100644
--- a/pkgs/by-name/tu/turtle-build/package.nix
+++ b/pkgs/by-name/tu/turtle-build/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "turtle-build";
-  version = "0.5.7";
+  version = "0.5.15";
 
   src = fetchFromGitHub {
     owner = "raviqqe";
     repo = "turtle-build";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-WWPrTVCVLMVH28WitTFh3OE7ig0GwSBSh9RhGfOYCG4=";
+    hash = "sha256-9zCAZHG7GtVvOb+7Sva76VoRLg2ZzlJy77Xa17Mjclw=";
   };
 
-  cargoHash = "sha256-537IZEfCIRyJhAD3nv6l2iuuloosJmgmwHTFueTsTEk=";
+  cargoHash = "sha256-+blVNeolxnrf5hHk7ob6dXccfq28+Z1N/caPLILMlhU=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];

From c65c4055918e31f30f85a1fb326b1a43461f3ef9 Mon Sep 17 00:00:00 2001
From: OriOnChip <ori@orione.top>
Date: Mon, 5 Oct 2026 18:53:44 +0200
Subject: [PATCH 152/525] mountpoint-s3: 1.22.3 -> 1.24.0

---
 pkgs/by-name/mo/mountpoint-s3/package.nix | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mo/mountpoint-s3/package.nix b/pkgs/by-name/mo/mountpoint-s3/package.nix
index dafb8e5d5c27..4c6e805ac802 100644
--- a/pkgs/by-name/mo/mountpoint-s3/package.nix
+++ b/pkgs/by-name/mo/mountpoint-s3/package.nix
@@ -9,17 +9,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mountpoint-s3";
-  version = "1.22.3";
+  version = "1.24.0";
 
   src = fetchFromGitHub {
     owner = "awslabs";
     repo = "mountpoint-s3";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-22tx8ozXkzBNAflDPc7cdfUh9TWD6aB/Fe/z/dPZ694=";
+    hash = "sha256-UDL1y7xmVhv/KlWiDOdvRahUF831kXGBIOcSmDRJCGs=";
     fetchSubmodules = true;
   };
 
-  cargoHash = "sha256-SSSXqgJ3OERCVw81iXqXRRpVXgdwhlefHhI/qvQyl4g=";
+  cargoHash = "sha256-N2Rf6ikEBSsTQBsb5xGPWj0ElHjKnCx5FSd85DLqKM4=";
 
   # thread 'main' panicked at cargo-auditable/src/collect_audit_data.rs:77:9:
   # cargo metadata failure: error: none of the selected packages contains these features: libfuse3
@@ -42,6 +42,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ];
 
   checkFlags = [
+    "--skip=io::tls::test::build_tls_connection_options"
+    "--skip=s3::client::tests::tls_connection_options_wiring"
+    "--skip=s3::config::tests::test_read_part_size_exceeds_budget_default_clamps"
+    "--skip=mountpoint-s3-client/src/lib.rs"
+
     #thread 's3_crt_client::tests::test_expected_bucket_owner' panicked at mountpoint-s3-client/src/s3_crt_client.rs:1123:47:
     #Create test client: ProviderFailure(Error(1173, "aws-c-io: AWS_IO_TLS_ERROR_DEFAULT_TRUST_STORE_NOT_FOUND, Default TLS trust store not found on this system. Trusted CA certificates must be installed, or \"override default trust store\" must be used while creating the TLS context."))
     #

From dd24b95384292c7d145ff342747444aabfa69380 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 5 Oct 2026 20:17:03 +0000
Subject: [PATCH 153/525] soft-serve: 0.12.2 -> 0.12.3

---
 pkgs/by-name/so/soft-serve/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/so/soft-serve/package.nix b/pkgs/by-name/so/soft-serve/package.nix
index 2e37a261940c..716b760a106b 100644
--- a/pkgs/by-name/so/soft-serve/package.nix
+++ b/pkgs/by-name/so/soft-serve/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "soft-serve";
-  version = "0.12.2";
+  version = "0.12.3";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = "soft-serve";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QrLm88lcJRhgJw9RN7m3BsipOFEpAe1weEI5F3u+Bqw=";
+    hash = "sha256-uq6gWf61UFMtlSJ+IOMLYLHOPEHFDLJpaUVLCXfu9gg=";
   };
 
-  vendorHash = "sha256-Ri/njTAjpVCd/rXQt/ZxNe1iTfDWZb6JzoFipj/1UlA=";
+  vendorHash = "sha256-6QYgEuWTYQwJ7zPAjVv+GZ/4lKJxiS5x4Rp69Gnjt5c=";
 
   doCheck = false;
 

From 342bfe9cce724eec555bf11676e8077f666f65ba Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Mon, 5 Oct 2026 20:05:42 -0500
Subject: [PATCH 154/525] xournalpp: use Lua 5.5

Upstream made its default plugins compatible with Lua 5.5 in 1.3.4.
The packaged 1.3.8 includes those changes, so select Lua 5.5 for its
existing optional plugin dependency.

https://github.com/xournalpp/xournalpp/blob/v1.3.8/CHANGELOG.md#134
https://github.com/xournalpp/xournalpp/pull/7306
https://github.com/xournalpp/xournalpp/blob/v1.3.8/plugins/Example/main.lua

Built on x86_64-linux and confirmed linkage to Lua 5.5.1. An embedded
version assertion passed, and the bundled Example plugin registered its
menu and received both native dialog button results through Lua callbacks.
The isolated GUI check used --disable-audio; the package build was unchanged.

Assisted-by: Codex (GPT-6.1-sol)
---
 pkgs/by-name/xo/xournalpp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/xo/xournalpp/package.nix b/pkgs/by-name/xo/xournalpp/package.nix
index 572623c45554..1db08d3f993e 100644
--- a/pkgs/by-name/xo/xournalpp/package.nix
+++ b/pkgs/by-name/xo/xournalpp/package.nix
@@ -25,7 +25,7 @@
   zlib,
   # plugins
   withLua ? true,
-  lua5_3,
+  lua5_5,
   nix-update-script,
 }:
 
@@ -63,7 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
     zlib
   ]
   ++ lib.optional stdenv.hostPlatform.isLinux alsa-lib
-  ++ lib.optional withLua lua5_3;
+  ++ lib.optional withLua lua5_5;
 
   buildFlags = [ "translations" ];
 

From 0745ebc14f160bd3cbdaef6729581cfa2fa5e75a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 6 Oct 2026 02:46:46 +0000
Subject: [PATCH 155/525] phpExtensions.phalcon: 5.10.0 -> 5.22.1

---
 pkgs/development/php-packages/phalcon/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/php-packages/phalcon/default.nix b/pkgs/development/php-packages/phalcon/default.nix
index eec3382df576..ad92cb197d3d 100644
--- a/pkgs/development/php-packages/phalcon/default.nix
+++ b/pkgs/development/php-packages/phalcon/default.nix
@@ -9,13 +9,13 @@
 
 buildPecl rec {
   pname = "phalcon";
-  version = "5.10.0";
+  version = "5.22.1";
 
   src = fetchFromGitHub {
     owner = "phalcon";
     repo = "cphalcon";
     rev = "v${version}";
-    hash = "sha256-2dk/AjOWG2oJ3BoBODO9H4S32Jc/Z+W3qxvMkfR5oKE=";
+    hash = "sha256-eMb11feNg7BTEBy+FjQGAqDC0sBfdGqOzr6gLe/LWHY=";
   };
 
   internalDeps = [

From be15cb5a8671acbcd889c41e3521d14d4fc2d2f9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 6 Oct 2026 11:35:52 +0000
Subject: [PATCH 156/525] bluesky-pds: 0.4.5034 -> 0.4.5037

---
 pkgs/by-name/bl/bluesky-pds/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/bl/bluesky-pds/package.nix b/pkgs/by-name/bl/bluesky-pds/package.nix
index cb5a998ca0ae..4cd06de8f17a 100644
--- a/pkgs/by-name/bl/bluesky-pds/package.nix
+++ b/pkgs/by-name/bl/bluesky-pds/package.nix
@@ -27,13 +27,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pds";
-  version = "0.4.5034";
+  version = "0.4.5037";
 
   src = fetchFromGitHub {
     owner = "bluesky-social";
     repo = "pds";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fsbnD9y0wxXq3NmVe5vMhI613G4HlZyqsv7+DNKzZzY=";
+    hash = "sha256-4llWhrtPZ6ZsA2CIDquNdR7WAdl4aKeG6WP0Q1sTyjs=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/service";
@@ -63,7 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     inherit pnpm;
     fetcherVersion = 4;
-    hash = "sha256-nnhtJNw/D6Tir3n6rrURjL/cw1EWocs4/r4K7Yq4Fdk=";
+    hash = "sha256-Tfhv/PWnkPK/CuPzQ/vxS3UIO/TBjWBsshFRatjbcX4=";
   };
 
   buildPhase = ''

From ceda6b3e7d249e9cc1ae769282bdc9331f4de95a Mon Sep 17 00:00:00 2001
From: wrench-exile-legacy <hello@wrenchd.dev>
Date: Tue, 6 Oct 2026 12:24:27 +0100
Subject: [PATCH 157/525] papermc: migrate to pkgs/by-name

---
 .../{games => by-name/pa}/papermc/derivation.nix |  0
 pkgs/by-name/pa/papermc/package.nix              | 16 ++++++++++++++++
 pkgs/{games => by-name/pa}/papermc/update.py     |  0
 pkgs/{games => by-name/pa}/papermc/versions.json |  0
 .../pa/papermc/versions.nix}                     |  4 +---
 pkgs/top-level/all-packages.nix                  |  4 +---
 6 files changed, 18 insertions(+), 6 deletions(-)
 rename pkgs/{games => by-name/pa}/papermc/derivation.nix (100%)
 create mode 100644 pkgs/by-name/pa/papermc/package.nix
 rename pkgs/{games => by-name/pa}/papermc/update.py (100%)
 rename pkgs/{games => by-name/pa}/papermc/versions.json (100%)
 rename pkgs/{games/papermc/default.nix => by-name/pa/papermc/versions.nix} (99%)

diff --git a/pkgs/games/papermc/derivation.nix b/pkgs/by-name/pa/papermc/derivation.nix
similarity index 100%
rename from pkgs/games/papermc/derivation.nix
rename to pkgs/by-name/pa/papermc/derivation.nix
diff --git a/pkgs/by-name/pa/papermc/package.nix b/pkgs/by-name/pa/papermc/package.nix
new file mode 100644
index 000000000000..11888c3dc69e
--- /dev/null
+++ b/pkgs/by-name/pa/papermc/package.nix
@@ -0,0 +1,16 @@
+{
+  callPackage,
+  javaPackages,
+  lib,
+  ...
+}:
+
+let
+  versions = builtins.fromJSON (builtins.readFile ./versions.json);
+  latestVersion = lib.last (builtins.sort lib.versionOlder (builtins.attrNames versions));
+  getJavaVersion = v: (builtins.getAttr "openjdk${toString v}" javaPackages.compiler).headless;
+in
+callPackage ./derivation.nix {
+  inherit (versions.${latestVersion}) url version hash;
+  jre = getJavaVersion versions.${latestVersion}.javaVersion;
+}
diff --git a/pkgs/games/papermc/update.py b/pkgs/by-name/pa/papermc/update.py
similarity index 100%
rename from pkgs/games/papermc/update.py
rename to pkgs/by-name/pa/papermc/update.py
diff --git a/pkgs/games/papermc/versions.json b/pkgs/by-name/pa/papermc/versions.json
similarity index 100%
rename from pkgs/games/papermc/versions.json
rename to pkgs/by-name/pa/papermc/versions.json
diff --git a/pkgs/games/papermc/default.nix b/pkgs/by-name/pa/papermc/versions.nix
similarity index 99%
rename from pkgs/games/papermc/default.nix
rename to pkgs/by-name/pa/papermc/versions.nix
index 20c4a349c3db..e7912079b561 100644
--- a/pkgs/games/papermc/default.nix
+++ b/pkgs/by-name/pa/papermc/versions.nix
@@ -1,6 +1,3 @@
-let
-  versions = builtins.fromJSON (builtins.readFile ./versions.json);
-in
 {
   callPackage,
   javaPackages,
@@ -8,6 +5,7 @@ in
   ...
 }:
 let
+  versions = builtins.fromJSON (builtins.readFile ./versions.json);
   latestVersion = lib.last (builtins.sort lib.versionOlder (builtins.attrNames versions));
   escapeVersion = builtins.replaceStrings [ "." ] [ "_" ];
   getJavaVersion = v: (builtins.getAttr "openjdk${toString v}" javaPackages.compiler).headless;
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 29453644aeb6..e3446ff413b3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9778,9 +9778,7 @@ with pkgs;
 
   openraPackages = recurseIntoAttrs (callPackage ../by-name/op/openra/engines { });
 
-  papermcServers = callPackages ../games/papermc { };
-
-  papermc = papermcServers.papermc;
+  papermcServers = callPackage ../by-name/pa/papermc/versions.nix { };
 
   pokerth-server = pokerth.override { target = "server"; };
 

From 551837beddf248773aadd5f2d36e40eb509887ec Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 6 Oct 2026 13:53:26 +0000
Subject: [PATCH 158/525] mcp-searxng: 2.5.0 -> 2.5.1

---
 pkgs/by-name/mc/mcp-searxng/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mc/mcp-searxng/package.nix b/pkgs/by-name/mc/mcp-searxng/package.nix
index c839d0f1834f..879cfd239011 100644
--- a/pkgs/by-name/mc/mcp-searxng/package.nix
+++ b/pkgs/by-name/mc/mcp-searxng/package.nix
@@ -6,7 +6,7 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "mcp-searxng";
-  version = "2.5.0";
+  version = "2.5.1";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -15,10 +15,10 @@ buildNpmPackage (finalAttrs: {
     owner = "ihor-sokoliuk";
     repo = "mcp-searxng";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yfxnYD1onNw5J6yLq2RxqAtlNnH319DWD1Zu3JM8eq0=";
+    hash = "sha256-TqDj86FTOekTswNQkTkiC8Q/H46bz4iigr5GRlM9Tno=";
   };
 
-  npmDepsHash = "sha256-QhUqB/+R3BGwx8gH0MDn+PiMEtira3vZdosJj8oMsaI=";
+  npmDepsHash = "sha256-WuN8xzG5uU1wZdMLdiT2GfUn1BeHTdtIkBc4x2kz81Q=";
 
   meta = {
     description = "Private web search for AI assistants via SearXNG — supports Claude, Cursor, and any MCP client";

From 810d49a2ca77d51e80c37a6406bd06c2c1927c8a Mon Sep 17 00:00:00 2001
From: Bart Oostveen <bart@bartoostveen.nl>
Date: Tue, 6 Oct 2026 22:24:55 +0200
Subject: [PATCH 159/525] wordpress_7_1: 7.1.2 -> 7.1.3

Announcement: https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/
Release notes: https://wordpress.org/documentation/wordpress-version/version-7-1-3/
---
 pkgs/servers/web-apps/wordpress/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/web-apps/wordpress/default.nix b/pkgs/servers/web-apps/wordpress/default.nix
index e8087365d306..5217ea033add 100644
--- a/pkgs/servers/web-apps/wordpress/default.nix
+++ b/pkgs/servers/web-apps/wordpress/default.nix
@@ -10,7 +10,7 @@ builtins.mapAttrs (_: callPackage ./generic.nix) rec {
     hash = "sha256-W+/iSslL8f8YKSoaHzD9DHEbAJ+Rz9ytqo/rbgr6dc0=";
   };
   wordpress_7_1 = {
-    version = "7.1.2";
-    hash = "sha256-wMZmaJ1muHDYglUAu45ALtBN5SYCxhpvUWxiNrjJrGc=";
+    version = "7.1.3";
+    hash = "sha256-0qCay2oV47nEcdclV3U8Jm1vQaee0Zv+BMv+SeKDsqU=";
   };
 }

From 89b964490f4d3616447090322c5474a41562c462 Mon Sep 17 00:00:00 2001
From: Bart Oostveen <bart@bartoostveen.nl>
Date: Tue, 6 Oct 2026 22:26:29 +0200
Subject: [PATCH 160/525] wordpress_7_0: 7.0.6 -> 7.0.7

Announcement: https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/
Release notes: https://wordpress.org/documentation/wordpress-version/version-7-1-3/
---
 pkgs/servers/web-apps/wordpress/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/web-apps/wordpress/default.nix b/pkgs/servers/web-apps/wordpress/default.nix
index 5217ea033add..6c251dedde41 100644
--- a/pkgs/servers/web-apps/wordpress/default.nix
+++ b/pkgs/servers/web-apps/wordpress/default.nix
@@ -6,8 +6,8 @@ builtins.mapAttrs (_: callPackage ./generic.nix) rec {
     hash = "sha256-MiMbmsvnY6hhOOi7t7XE8/EjvsnWX8OJi8s7ZFBqc1g=";
   };
   wordpress_7_0 = {
-    version = "7.0.6";
-    hash = "sha256-W+/iSslL8f8YKSoaHzD9DHEbAJ+Rz9ytqo/rbgr6dc0=";
+    version = "7.0.7";
+    hash = "sha256-5PEraQhT5M9lqmdNAYU21cRqWGmDE8WZfKDF0sa4ug0=";
   };
   wordpress_7_1 = {
     version = "7.1.3";

From adc7c012e4ae44302f444410e7c88da56e61242b Mon Sep 17 00:00:00 2001
From: Bart Oostveen <bart@bartoostveen.nl>
Date: Tue, 6 Oct 2026 22:27:24 +0200
Subject: [PATCH 161/525] wordpress_6_9: 6.9.9 -> 6.9.10

Announcement: https://wordpress.org/news/2026/10/wordpress-7-1-3-maintenance-and-security-release/
Release notes: https://wordpress.org/documentation/wordpress-version/version-7-1-3/
---
 pkgs/servers/web-apps/wordpress/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/web-apps/wordpress/default.nix b/pkgs/servers/web-apps/wordpress/default.nix
index 6c251dedde41..e2cc6a34e315 100644
--- a/pkgs/servers/web-apps/wordpress/default.nix
+++ b/pkgs/servers/web-apps/wordpress/default.nix
@@ -2,8 +2,8 @@
 builtins.mapAttrs (_: callPackage ./generic.nix) rec {
   wordpress = wordpress_7_1;
   wordpress_6_9 = {
-    version = "6.9.9";
-    hash = "sha256-MiMbmsvnY6hhOOi7t7XE8/EjvsnWX8OJi8s7ZFBqc1g=";
+    version = "6.9.10";
+    hash = "sha256-ocDcEuInHGr6q/Mp1a96l2+NLIxZJ3MXiluq6vwtT0o=";
   };
   wordpress_7_0 = {
     version = "7.0.7";

From c607a22a55e333c49b839c4920f0e691181e3c10 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 6 Oct 2026 23:52:12 +0200
Subject: [PATCH 162/525] python3Packages.freenub: 0.1.0 -> 0.1.2

Diff: https://github.com/bdraco/freenub/compare/v0.1.0...v0.1.2

Changelog: https://github.com/bdraco/freenub/blob/0.1.2/CHANGELOG.md
---
 pkgs/development/python-modules/freenub/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/freenub/default.nix b/pkgs/development/python-modules/freenub/default.nix
index ee075de2559b..419a4e9a8a6b 100644
--- a/pkgs/development/python-modules/freenub/default.nix
+++ b/pkgs/development/python-modules/freenub/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "freenub";
-  version = "0.1.0";
+  version = "0.1.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bdraco";
     repo = "freenub";
     tag = "v${version}";
-    hash = "sha256-UkW/7KUQ4uCu3cxDSL+kw0gjKjs4KnmxRIOLVP4hwyA=";
+    hash = "sha256-2yUuopr7sT2FvsiXlHnc7AnXcCAAEAyD0Rpc4j/nGmQ=";
   };
 
   build-system = [ poetry-core ];

From 075f665a8ec0c65ed943f03f096e0f742b70157d Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 6 Oct 2026 23:54:27 +0200
Subject: [PATCH 163/525] python3Packages.freenub: migrate to finalAttrs

---
 pkgs/development/python-modules/freenub/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/freenub/default.nix b/pkgs/development/python-modules/freenub/default.nix
index 419a4e9a8a6b..b7aa4ed9d85e 100644
--- a/pkgs/development/python-modules/freenub/default.nix
+++ b/pkgs/development/python-modules/freenub/default.nix
@@ -14,7 +14,7 @@
   requests,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "freenub";
   version = "0.1.2";
   pyproject = true;
@@ -22,7 +22,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "bdraco";
     repo = "freenub";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-2yUuopr7sT2FvsiXlHnc7AnXcCAAEAyD0Rpc4j/nGmQ=";
   };
 
@@ -50,8 +50,8 @@ buildPythonPackage rec {
   meta = {
     description = "Fork of pubnub";
     homepage = "https://github.com/bdraco/freenub";
-    changelog = "https://github.com/bdraco/freenub/blob/${version}/CHANGELOG.md";
+    changelog = "https://github.com/bdraco/freenub/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

From 668e4550eeb87de7b57fb89eb6f000ea2ad993df Mon Sep 17 00:00:00 2001
From: Jose Garcia <501jag3@gmail.com>
Date: Tue, 6 Oct 2026 20:01:18 -0500
Subject: [PATCH 164/525] utpm: use libgit2 over vendored version

---
 pkgs/by-name/ut/utpm/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/ut/utpm/package.nix b/pkgs/by-name/ut/utpm/package.nix
index 8524b5ab1f14..958ec5582adb 100644
--- a/pkgs/by-name/ut/utpm/package.nix
+++ b/pkgs/by-name/ut/utpm/package.nix
@@ -7,6 +7,7 @@
   stdenv,
   buildPackages,
   installShellFiles,
+  libgit2,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "utpm";
@@ -23,8 +24,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   env.OPENSSL_NO_VENDOR = 1;
 
+  env.LIBGIT2_NO_VENDOR = 1;
+
   buildInputs = [
     openssl
+    libgit2
   ];
   nativeBuildInputs = [
     pkg-config

From 5baa0d0508715f8187b94e2798645400d4933ec8 Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Wed, 7 Oct 2026 06:31:55 +0200
Subject: [PATCH 165/525] ty: 0.0.84 -> 0.0.85

Changelog: https://github.com/astral-sh/ty/releases/tag/0.0.85
Diff: https://github.com/astral-sh/ty/compare/0.0.84...0.0.85
---
 pkgs/by-name/ty/ty/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix
index 8465175cf9b8..b03a472a8dd5 100644
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -17,7 +17,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.84";
+  version = "0.0.85";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-nIk35Ih3xuGHx06Cxaiw1gkClwfQ+sW61XbbwkU/+ds=";
+    hash = "sha256-vweZOl2P72ruvDh7RuDkhdYFT/ejAUw7l+aJwsjlL7o=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -39,7 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-iF+KUQMeACujyPoVRxjzslg7cmUFoYF+kXEWqIMaTqI=";
+  cargoHash = "sha256-j6A7j/bPHlIXU4BA7B8pNi2LAaCFL0B9ILDDCPE2GUU=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = [ rust-jemalloc-sys ];

From c9b24fb1b4c15b29eea1c16a6b3bb981ada0242f Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Wed, 7 Oct 2026 18:05:01 +0800
Subject: [PATCH 166/525] rectangle: 2.0.2 -> 2.0.3

---
 pkgs/by-name/re/rectangle/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/re/rectangle/package.nix b/pkgs/by-name/re/rectangle/package.nix
index d69aac301038..5440b05aa691 100644
--- a/pkgs/by-name/re/rectangle/package.nix
+++ b/pkgs/by-name/re/rectangle/package.nix
@@ -125,13 +125,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "rectangle";
-  version = "2.0.2";
+  version = "2.0.3";
 
   src = fetchFromGitHub {
     owner = "rxhanson";
     repo = "Rectangle";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-A/wQd68hXckjW7YrS9FnX91cvC0qgFg/AMNe9nnlWgU=";
+    hash = "sha256-pcDl+GHBgPHysS5q0pQgQbbMOAzsTvA/KJ2N+OlPIoA=";
   };
 
   nativeBuildInputs = [

From 286faaa04fabb8c64434ae321c78abdc5e8e9189 Mon Sep 17 00:00:00 2001
From: Hans Joachim Kliemeck <h0nIg@users.noreply.github.com>
Date: Wed, 7 Oct 2026 15:28:17 +0200
Subject: [PATCH 167/525] maintainers: add a-hassanin

---
 maintainers/maintainer-list.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index aeb115607db5..ee98003f5eb5 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -401,6 +401,11 @@
     github = "a-camarillo";
     githubId = 58638902;
   };
+  a-hassanin = {
+    github = "a-hassanin";
+    name = "Ahmed Hassanin";
+    githubId = 112945643;
+  };
   a-jay98 = {
     email = "ali@jamadi.me";
     github = "A-jay98";

From 1fd39e0c4e0b0a90339715b7e41d7681bb23a99b Mon Sep 17 00:00:00 2001
From: aHilsberg <78252946+aHilsberg@users.noreply.github.com>
Date: Wed, 23 Sep 2026 18:55:35 +0200
Subject: [PATCH 168/525] testers.runNixOSTest: QMPAPIError constructor
 refering to wrong fields of qmp error message

Fixes #566262
---
 .../src/test_driver/machine/qmp.py            |  5 +++--
 nixos/tests/all-tests.nix                     |  1 +
 .../tests/nixos-test-driver/qmp-api-error.nix | 22 +++++++++++++++++++
 3 files changed, 26 insertions(+), 2 deletions(-)
 create mode 100644 nixos/tests/nixos-test-driver/qmp-api-error.nix

diff --git a/nixos/lib/test-driver/src/test_driver/machine/qmp.py b/nixos/lib/test-driver/src/test_driver/machine/qmp.py
index f8d2b4e887d8..6a5612e8a0c4 100644
--- a/nixos/lib/test-driver/src/test_driver/machine/qmp.py
+++ b/nixos/lib/test-driver/src/test_driver/machine/qmp.py
@@ -14,9 +14,10 @@ logger = logging.getLogger(__name__)
 class QMPAPIError(RuntimeError):
     def __init__(self, message: dict[str, Any]):
         assert "error" in message, "Not an error message!"
+        error = message["error"]
         try:
-            self.class_name = message["class"]
-            self.description = message["desc"]
+            self.class_name = error["class"]
+            self.description = error["desc"]
             # NOTE: Some errors can occur before the Server is able to read the
             # id member; in these cases the id member will not be part of the
             # error response, even if provided by the client.
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index c004c98fe64e..1e61fc4e4e4f 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -193,6 +193,7 @@ in
     extra-python-packages = runTest ./nixos-test-driver/extra-python-packages.nix;
     lib-extend = handleTestOn [ "x86_64-linux" "aarch64-linux" ] ./nixos-test-driver/lib-extend.nix { };
     node-name = runTest ./nixos-test-driver/node-name.nix;
+    qmp-api-error = runTest ./nixos-test-driver/qmp-api-error.nix;
     busybox = runTest ./nixos-test-driver/busybox.nix;
     ssh-backdoor = runTestOn [ "x86_64-linux" ] ./nixos-test-driver/ssh-backdoor.nix;
     console-log = runTest ./nixos-test-driver/console-log.nix;
diff --git a/nixos/tests/nixos-test-driver/qmp-api-error.nix b/nixos/tests/nixos-test-driver/qmp-api-error.nix
new file mode 100644
index 000000000000..30a322721943
--- /dev/null
+++ b/nixos/tests/nixos-test-driver/qmp-api-error.nix
@@ -0,0 +1,22 @@
+{
+  name = "qmp-api-error";
+
+  nodes.machine = { };
+
+  testScript = ''
+    from test_driver.machine.qmp import QMPAPIError
+
+    machine.start()
+
+    assert machine.qmp_client is not None
+
+    try:
+        machine.qmp_client.send("this-command-does-not-exist")
+    except QMPAPIError as error:
+        t.assertEqual(error.class_name, "CommandNotFound")
+        t.assertTrue(error.description)
+        t.assertIsNone(error.transaction_id)
+    else:
+        raise AssertionError("expected QMPAPIError")
+  '';
+}

From b858904fd1569dc5a5bf3f4376b9a2a4bf3e68d0 Mon Sep 17 00:00:00 2001
From: Andreas Wendleder <andreas.wendleder@proton.me>
Date: Wed, 7 Oct 2026 19:19:01 +0200
Subject: [PATCH 169/525] openroad: pin to boost192 to fix dbSta segfault

Interim fix until the default boost is bumped to 1.92 (#571409, a mass
rebuild still pending review). openroad's default boost (1.91) + gcc16
segfaults in Boost.JSON's array allocator during dbSta's cell-usage
report test, breaking openroad and thus librelane. Fixed upstream in
Boost 1.92. Verified: openroad builds and passes its full CTest suite
(7631/7631) with this pin.

Assisted-by: Claude Code (claude-sonnet-5)
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_015nagR3thVVbRLcqE9rSr6w
---
 pkgs/by-name/op/openroad/package.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/op/openroad/package.nix b/pkgs/by-name/op/openroad/package.nix
index b5cf5f46a198..fbc293eadba1 100644
--- a/pkgs/by-name/op/openroad/package.nix
+++ b/pkgs/by-name/op/openroad/package.nix
@@ -18,7 +18,7 @@
   versionCheckHook,
 
   # buildInputs
-  boost,
+  boost192,
   cbc,
   cimg,
   clp,
@@ -66,7 +66,9 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    boost
+    # boost 1.91 + gcc16 segfaults in dbSta's Boost.JSON cell-usage report; fixed in 1.92.
+    # Drop this override once the default boost is bumped to 1.92 (see #571409).
+    boost192
     cbc
     cimg
     clp
@@ -151,7 +153,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "CMAKE_RULE_MESSAGES" false)
     (lib.cmakeFeature "TCL_HEADER" "${tcl}/include/tcl.h")
     (lib.cmakeFeature "TCL_LIBRARY" "${tcl}/lib/libtcl${stdenv.hostPlatform.extensions.sharedLibrary}")
-    (lib.cmakeFeature "BOOST_ROOT" "${boost}")
+    (lib.cmakeFeature "BOOST_ROOT" "${boost192}")
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
     (lib.cmakeFeature "CMAKE_CXX_FLAGS" "-DBOOST_STACKTRACE_GNU_SOURCE_NOT_REQUIRED -Wno-error=deprecated-declarations")

From 3f890f1ae62b637ac2ac3b396af5bade4e35ff32 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 8 Oct 2026 00:57:25 +0000
Subject: [PATCH 170/525] dalfox: 3.2.3 -> 3.2.4

---
 pkgs/by-name/da/dalfox/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/da/dalfox/package.nix b/pkgs/by-name/da/dalfox/package.nix
index 4e0469d46494..dceaaae29585 100644
--- a/pkgs/by-name/da/dalfox/package.nix
+++ b/pkgs/by-name/da/dalfox/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "dalfox";
-  version = "3.2.3";
+  version = "3.2.4";
 
   src = fetchFromGitHub {
     owner = "hahwul";
     repo = "dalfox";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NhYoxsV1xxCbteI691ld6rHdlBGyJr6yn0ZJvDHEt8w=";
+    hash = "sha256-sh4Occkkk3rK+NVCitO1KrcCf7TmueTwhc/3LhAfD4E=";
   };
 
-  cargoHash = "sha256-huOPIV2sblLQ5P5dO+qrBDl5F7LokTieyecjhjmhmP0=";
+  cargoHash = "sha256-KJwREnnqu0gAsGbDQX1rZmhKyJaKkMIjoWakbX9deX0=";
 
   nativeBuildInputs = [ pkg-config ];
 

From 624946c605579bd6c87147898f8a85fc7811be84 Mon Sep 17 00:00:00 2001
From: Grayson Tinker <graysontinker@gmail.com>
Date: Wed, 7 Oct 2026 20:25:41 -0600
Subject: [PATCH 171/525] onlyoffice-desktopeditors: fix update script

---
 pkgs/by-name/on/onlyoffice-desktopeditors/package.nix | 5 ++++-
 pkgs/by-name/on/onlyoffice-desktopeditors/update.sh   | 2 +-
 2 files changed, 5 insertions(+), 2 deletions(-)
 mode change 100644 => 100755 pkgs/by-name/on/onlyoffice-desktopeditors/update.sh

diff --git a/pkgs/by-name/on/onlyoffice-desktopeditors/package.nix b/pkgs/by-name/on/onlyoffice-desktopeditors/package.nix
index 482374cbdd0d..a6ab63978120 100644
--- a/pkgs/by-name/on/onlyoffice-desktopeditors/package.nix
+++ b/pkgs/by-name/on/onlyoffice-desktopeditors/package.nix
@@ -192,7 +192,10 @@ buildFHSEnv {
         --replace-fail "/usr/bin/onlyoffice-desktopeditors" "$out/bin/onlyoffice-desktopeditors"
   '';
 
-  passthru.updateScript = ./update.sh;
+  passthru = {
+    updateScript = ./update.sh;
+    inherit derivation;
+  };
 
   meta = {
     description = "Office suite that combines text, spreadsheet and presentation editors allowing to create, view and edit local documents";
diff --git a/pkgs/by-name/on/onlyoffice-desktopeditors/update.sh b/pkgs/by-name/on/onlyoffice-desktopeditors/update.sh
old mode 100644
new mode 100755
index d7b0bc106fa2..362ef184d530
--- a/pkgs/by-name/on/onlyoffice-desktopeditors/update.sh
+++ b/pkgs/by-name/on/onlyoffice-desktopeditors/update.sh
@@ -2,4 +2,4 @@
 #!nix-shell -i bash -p curl jq common-updater-scripts
 
 version="$(curl -sL "https://api.github.com/repos/ONLYOFFICE/DesktopEditors/releases?per_page=1" | jq -r ".[0].tag_name" | sed 's/^v//')"
-update-source-version onlyoffice-bin "$version"
+update-source-version onlyoffice-desktopeditors.derivation "$version"

From da747d699931bc1da3c268b76e2184966889266f Mon Sep 17 00:00:00 2001
From: kinnrai <me@kinnrai.com>
Date: Thu, 8 Oct 2026 10:40:54 +0800
Subject: [PATCH 172/525] iina: 1.4.4 -> 1.5.0

Changelog: https://github.com/iina/iina/releases/tag/v1.5.0
Diff: https://github.com/iina/iina/compare/v1.4.4...v1.5.0
---
 pkgs/by-name/ii/iina/package.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ii/iina/package.nix b/pkgs/by-name/ii/iina/package.nix
index b7a6ff958d1e..127d0bf3de54 100644
--- a/pkgs/by-name/ii/iina/package.nix
+++ b/pkgs/by-name/ii/iina/package.nix
@@ -8,17 +8,20 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "iina";
-  version = "1.4.4";
+  version = "1.5.0";
 
   src = fetchurl {
     url = "https://github.com/iina/iina/releases/download/v${finalAttrs.version}/IINA.v${finalAttrs.version}.dmg";
-    hash = "sha256-3Q/AvUs3+1ehyNMNbjIBs6ZLr9KZWf5WlTlkYTI3vrE=";
+    hash = "sha256-j61QR5sQ4JZFBTRXzsRr1T0FTO0iQs/mj3RYZzWiDcc=";
   };
 
   nativeBuildInputs = [ undmg ];
 
   sourceRoot = "IINA.app";
 
+  # Patching shebangs in the app bundle invalidates its code signature.
+  dontPatchShebangs = true;
+
   installPhase = ''
     mkdir -p $out/{bin,Applications/IINA.app}
     cp -R . "$out/Applications/IINA.app"

From c3adfa486d5a58aec777819c2de42f3b22fef80e Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Thu, 8 Oct 2026 10:07:27 +0200
Subject: [PATCH 173/525] systemd: work around rebuild count

Don't set meson flags for nsresourced/mountfsd to avoid rebuilds of
pkgs.systemd. Will be reverted on staging.

This gives 1840 rebuilds compare to upstream/master.
---
 pkgs/os-specific/linux/systemd/default.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 16b3be82a8f0..b2e9e731c107 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -552,8 +552,6 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonBool "hwdb" withHwdb)
     (lib.mesonBool "timedated" withTimedated)
     (lib.mesonBool "timesyncd" withTimesyncd)
-    (lib.mesonBool "nsresourced" withNsresourced)
-    (lib.mesonBool "mountfsd" withMountfsd)
     (lib.mesonBool "userdb" withUserDb)
     (lib.mesonBool "coredump" withCoredump)
     (lib.mesonBool "firstboot" withFirstboot)
@@ -571,6 +569,12 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.mesonBool "smack" true)
     (lib.mesonBool "b_pie" true)
   ]
+  ++ lib.optionals withNsresourced [
+    (lib.mesonBool "nsresourced" withNsresourced)
+  ]
+  ++ lib.optionals withMountfsd [
+    (lib.mesonBool "mountfsd" withMountfsd)
+  ]
   ++ lib.optionals (withLibBPF && vmlinux-btf != null) [
     (lib.mesonOption "vmlinux-h" "provided")
     (lib.mesonOption "vmlinux-h-path" "${vmlinux-btf}/vmlinux.h")

From 3aa2b8bea01afc1edd08c04ca33bed3a36ad86fd Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Thu, 8 Oct 2026 11:24:37 +0200
Subject: [PATCH 174/525] Revert "ty: 0.0.84 -> 0.0.85"

This reverts commit 5baa0d0508715f8187b94e2798645400d4933ec8.

Breaks nixos-test-driver. Reverting for now to speed up merge of
staging-nixos.
---
 pkgs/by-name/ty/ty/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix
index b03a472a8dd5..8465175cf9b8 100644
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -17,7 +17,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.85";
+  version = "0.0.84";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-vweZOl2P72ruvDh7RuDkhdYFT/ejAUw7l+aJwsjlL7o=";
+    hash = "sha256-nIk35Ih3xuGHx06Cxaiw1gkClwfQ+sW61XbbwkU/+ds=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -39,7 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-j6A7j/bPHlIXU4BA7B8pNi2LAaCFL0B9ILDDCPE2GUU=";
+  cargoHash = "sha256-iF+KUQMeACujyPoVRxjzslg7cmUFoYF+kXEWqIMaTqI=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = [ rust-jemalloc-sys ];

From 4fd54eba00c07f16997e92d62235ced9aa8eca77 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Thu, 8 Oct 2026 11:32:58 +0200
Subject: [PATCH 175/525] ty: add passthru to ensure no test-driver regression

---
 pkgs/by-name/ty/ty/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix
index 8465175cf9b8..32be3bc337dd 100644
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -13,6 +13,7 @@
   buildPackages,
   versionCheckHook,
   nix-update-script,
+  nixosTests,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -95,6 +96,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   passthru = {
     updateScript = nix-update-script { };
+
+    # ensure that an update doesn't break the test-driver.
+    tests = lib.optionalAttrs stdenv.hostPlatform.isLinux {
+      nixos-test-driver-busybox = nixosTests.nixos-test-driver.busybox;
+    };
   };
 
   requiredSystemFeatures = [ "big-parallel" ];

From 406d4eeacaee49b2feee5558b1b47ec25840049a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 8 Oct 2026 14:55:38 +0000
Subject: [PATCH 176/525] python3Packages.aubio-ledfx: 0.4.11 -> 0.4.12

---
 pkgs/development/python-modules/aubio-ledfx/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aubio-ledfx/default.nix b/pkgs/development/python-modules/aubio-ledfx/default.nix
index 91a0842961f1..4e90fdbc49ec 100644
--- a/pkgs/development/python-modules/aubio-ledfx/default.nix
+++ b/pkgs/development/python-modules/aubio-ledfx/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aubio-ledfx";
-  version = "0.4.11";
+  version = "0.4.12";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "LedFx";
     repo = "aubio-ledfx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ec6QiTj1AOza+ggJPl3EULNDB/rrpCDZW0HaSywy/4E=";
+    hash = "sha256-g/VdeoQSkq8FB3uWK0A+KME7OCmQTa4gjr7iGDwq0gU=";
   };
 
   build-system = [

From af67f07a995f222de48b2c0229f430233b81794a Mon Sep 17 00:00:00 2001
From: Hans Joachim Kliemeck <h0nIg@users.noreply.github.com>
Date: Wed, 7 Oct 2026 15:29:37 +0200
Subject: [PATCH 177/525] bosh-cli: add maintainer a-hassanin

---
 pkgs/by-name/bo/bosh-cli/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/bo/bosh-cli/package.nix b/pkgs/by-name/bo/bosh-cli/package.nix
index 0bcf8a0ed4b2..be0c350756a0 100644
--- a/pkgs/by-name/bo/bosh-cli/package.nix
+++ b/pkgs/by-name/bo/bosh-cli/package.nix
@@ -39,7 +39,10 @@ buildGoModule (finalAttrs: {
     homepage = "https://bosh.io";
     changelog = "https://github.com/cloudfoundry/bosh-cli/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ ris ];
+    maintainers = with lib.maintainers; [
+      ris
+      a-hassanin
+    ];
     mainProgram = "bosh";
   };
 })

From 0ef03d68fe9558fdb537896efe84bc0423b5267b Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Thu, 9 Jul 2026 16:35:29 +0100
Subject: [PATCH 178/525] buildLinux: enable structured attributes

---
 pkgs/os-specific/linux/kernel/generic.nix | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index 284f3f1e1820..8d4beab81183 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -162,7 +162,6 @@ lib.makeOverridable (
 
     configfile = stdenv.mkDerivation {
       inherit
-        ignoreConfigErrors
         autoModules
         preferBuiltin
         kernelArch
@@ -188,7 +187,10 @@ lib.makeOverridable (
         rustc-unwrapped
       ];
 
-      env.RUST_LIB_SRC = lib.optionalString withRust rustPlatform.rustLibSrc;
+      env = {
+        RUST_LIB_SRC = lib.optionalString withRust rustPlatform.rustLibSrc;
+        inherit ignoreConfigErrors;
+      };
 
       makeFlags = import ./common-flags.nix {
         inherit
@@ -221,17 +223,16 @@ lib.makeOverridable (
           export buildRoot="''${buildRoot:-build}"
 
           # Get a basic config file for later refinement with $generateConfig.
-          make $makeFlags \
+          make "''${makeFlags[@]}" \
               -C . O="$buildRoot" ${kernelBaseConfig} \
               ARCH=$kernelArch CROSS_COMPILE=${stdenv.cc.targetPrefix} \
-              $makeFlags
 
           # Create the config file.
           echo "generating kernel configuration..."
           ln -s "${kernelIntermediateConfig}" "$buildRoot/kernel-config"
           DEBUG=1 ARCH=$kernelArch CROSS_COMPILE=${stdenv.cc.targetPrefix} \
             KERNEL_CONFIG="$buildRoot/kernel-config" AUTO_MODULES=$autoModules \
-            PREFER_BUILTIN=$preferBuiltin BUILD_ROOT="$buildRoot" SRC=. MAKE_FLAGS="$makeFlags" \
+            PREFER_BUILTIN=$preferBuiltin BUILD_ROOT="$buildRoot" SRC=. MAKE_FLAGS="''${makeFlags[*]@Q}" \
             perl -w $generateConfig
         ''
         + lib.optionalString stdenv.cc.isClang ''
@@ -257,6 +258,8 @@ lib.makeOverridable (
 
       enableParallelBuilding = true;
 
+      __structuredAttrs = true;
+
       passthru = rec {
         module = import ../../../../nixos/modules/system/boot/kernel_config.nix;
         # used also in apache

From d5a370e199695a6819ba5fe98f53f5e730d51ff7 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Mon, 17 Aug 2026 08:48:32 +0100
Subject: [PATCH 179/525] buildLinux: inherit build inputs from the kernel

Otherwise the discrepancies can cause configuration inconsistency
because of e.g. Kconfig settings having defaults that depend on the
presence of the `openssl(1)` command.
---
 pkgs/os-specific/linux/kernel/generic.nix | 15 +--------------
 1 file changed, 1 insertion(+), 14 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index 8d4beab81183..7016c21eba69 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -172,20 +172,7 @@ lib.makeOverridable (
 
       generateConfig = ./generate-config.pl;
 
-      depsBuildBuild = [ buildPackages.stdenv.cc ];
-      nativeBuildInputs = [
-        perl
-        gmp
-        libmpc
-        mpfr
-        bison
-        flex
-      ]
-      ++ lib.optional (lib.versionAtLeast version "5.2") pahole
-      ++ lib.optionals withRust [
-        rust-bindgen-unwrapped
-        rustc-unwrapped
-      ];
+      inherit (kernel) depsBuildBuild nativeBuildInputs;
 
       env = {
         RUST_LIB_SRC = lib.optionalString withRust rustPlatform.rustLibSrc;

From d53079faf7e182aa44615be9f10c3ea0df022c93 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 19 Aug 2026 14:43:01 +0100
Subject: [PATCH 180/525] buildLinux: drop obsolete `preUnpack`

This was added in 2c38df1c5bd2f79b9c6f28118ae0520fdd95974b, and has
been inert since f620b1b693ec25af1aadcb0508710dc22e92453a.
---
 pkgs/os-specific/linux/kernel/generic.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/generic.nix b/pkgs/os-specific/linux/kernel/generic.nix
index 7016c21eba69..5790a2daeec7 100644
--- a/pkgs/os-specific/linux/kernel/generic.nix
+++ b/pkgs/os-specific/linux/kernel/generic.nix
@@ -194,8 +194,6 @@ lib.makeOverridable (
         sed -e '/fflush(stdout);/i\printf("###");' -i scripts/kconfig/conf.c
       '';
 
-      preUnpack = kernel.preUnpack or "";
-
       inherit (kernel) src patches;
 
       buildPhase =

From 470dce2c9e0e1327e843d31f518dcee5a39f0544 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 8 Jul 2026 09:15:39 +0100
Subject: [PATCH 181/525] =?UTF-8?q?linux:=20don=E2=80=99t=20append=20`extr?=
 =?UTF-8?q?aMakeFlags`=20to=20`buildFlags`?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

They’re already appended to `makeFlags`, so this was appending
them twice.
---
 pkgs/os-specific/linux/kernel/build.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/build.nix b/pkgs/os-specific/linux/kernel/build.nix
index 390238c89ba0..2167ff2c6b40 100644
--- a/pkgs/os-specific/linux/kernel/build.nix
+++ b/pkgs/os-specific/linux/kernel/build.nix
@@ -227,8 +227,7 @@ lib.makeOverridable (
     ++ optionals buildDTBs [
       "dtbs"
       "DTC_FLAGS=-@"
-    ]
-    ++ extraMakeFlags;
+    ];
 
     installFlags = [
       "INSTALL_PATH=${placeholder "out"}"

From 5bdfc097b1ac1123035669399ca02c7c31778b52 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 26 Aug 2026 21:11:09 +0100
Subject: [PATCH 182/525] linux: drop obsolete Makefile path replacement

Fixed upstream in 5.11 with [436e980e2ed526832de822cbf13c317a458b78e1],
backported to 5.10 with [3ca425885bb74e8b286308707c067aaabc6f4fce],
and moved out of the Makefile entirely in 6.6 with
[79b96c332241c06b4c63cfa0e23a539558b79b90].

[436e980e2ed526832de822cbf13c317a458b78e1]:
<https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=436e980e2ed526832de822cbf13c317a458b78e1>

[3ca425885bb74e8b286308707c067aaabc6f4fce]:
<https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=3ca425885bb74e8b286308707c067aaabc6f4fce>

[79b96c332241c06b4c63cfa0e23a539558b79b90]:
<https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=79b96c332241c06b4c63cfa0e23a539558b79b90>
---
 pkgs/os-specific/linux/kernel/build.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/build.nix b/pkgs/os-specific/linux/kernel/build.nix
index 2167ff2c6b40..dd49ad44673a 100644
--- a/pkgs/os-specific/linux/kernel/build.nix
+++ b/pkgs/os-specific/linux/kernel/build.nix
@@ -293,9 +293,6 @@ lib.makeOverridable (
     ++ commonMakeFlags;
 
     postPatch = ''
-      # Ensure that depmod gets resolved through PATH
-      sed -i Makefile -e 's|= /sbin/depmod|= depmod|'
-
       # Some linux-hardened patches now remove certain files in the scripts directory, so the file may not exist.
       [[ -f scripts/ld-version.sh ]] && patchShebangs scripts/ld-version.sh
 

From 7c34df332248f979b0331b9967db93c8ab21b57b Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 26 Aug 2026 21:11:09 +0100
Subject: [PATCH 183/525] linux: drop obsolete hardened variant patching

The hardened kernel was removed, but this is in any case redundant
to the blanket `patchShebangs scripts` a few lines below.
---
 pkgs/os-specific/linux/kernel/build.nix | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/build.nix b/pkgs/os-specific/linux/kernel/build.nix
index dd49ad44673a..42a7dcacae86 100644
--- a/pkgs/os-specific/linux/kernel/build.nix
+++ b/pkgs/os-specific/linux/kernel/build.nix
@@ -293,9 +293,6 @@ lib.makeOverridable (
     ++ commonMakeFlags;
 
     postPatch = ''
-      # Some linux-hardened patches now remove certain files in the scripts directory, so the file may not exist.
-      [[ -f scripts/ld-version.sh ]] && patchShebangs scripts/ld-version.sh
-
       # Set randstruct seed to a deterministic but diversified value. Note:
       # we could have instead patched gen-random-seed.sh to take input from
       # the buildFlags, but that would require also patching the kernel's

From cd5b3241f5bb23a7190bf7e47e3585ceb6958db9 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Thu, 10 Sep 2026 23:58:03 +0100
Subject: [PATCH 184/525] linux: drop obsolete AArch64 kept file

This has been obsolete since 4.15; see upstream commit
[be0f272bfc83797f70d44faca86954df62e2bbc0].

[be0f272bfc83797f70d44faca86954df62e2bbc0]:
<https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=be0f272bfc83797f70d44faca86954df62e2bbc0>
---
 pkgs/os-specific/linux/kernel/build.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/build.nix b/pkgs/os-specific/linux/kernel/build.nix
index 42a7dcacae86..2f99a68e0da1 100644
--- a/pkgs/os-specific/linux/kernel/build.nix
+++ b/pkgs/os-specific/linux/kernel/build.nix
@@ -382,8 +382,8 @@ lib.makeOverridable (
       # from a `try-run` call from the Makefile
       rm -f $dev/lib/modules/${modDirVersion}/build/.[0-9]*.d
 
-      # Keep some extra files on some arches (powerpc, aarch64)
-      for f in arch/powerpc/lib/crtsavres.o arch/arm64/kernel/ftrace-mod.o; do
+      # Keep an extra file on powerpc
+      for f in arch/powerpc/lib/crtsavres.o; do
         if [ -f "$buildRoot/$f" ]; then
           mkdir -p "$(dirname $dev/lib/modules/${modDirVersion}/build/$f)"
           cp $buildRoot/$f $dev/lib/modules/${modDirVersion}/build/$f

From e39ab317e1f16d81be6e348738449e97304383aa Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 8 Jul 2026 09:15:39 +0100
Subject: [PATCH 185/525] linux: drop obsolete reproducibility workaround

This was fixed in 4.16 with [e847f6aaf68f6156a5e9b26afe1a7316b9ab697e],
as was observed for 4.20 in the [original PR].

[e847f6aaf68f6156a5e9b26afe1a7316b9ab697e]:
<https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=e847f6aaf68f6156a5e9b26afe1a7316b9ab697e>

[original PR]: <https://github.com/NixOS/nixpkgs/pull/57100>
---
 pkgs/os-specific/linux/kernel/build.nix | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/build.nix b/pkgs/os-specific/linux/kernel/build.nix
index 2f99a68e0da1..61de3fb04060 100644
--- a/pkgs/os-specific/linux/kernel/build.nix
+++ b/pkgs/os-specific/linux/kernel/build.nix
@@ -378,10 +378,6 @@ lib.makeOverridable (
       cp $buildRoot/{.config,Module.symvers} $dev/lib/modules/${modDirVersion}/build
       make modules_prepare "''${makeFlags[@]}" O=$dev/lib/modules/${modDirVersion}/build
 
-      # For reproducibility, removes accidental leftovers from a `cc1` call
-      # from a `try-run` call from the Makefile
-      rm -f $dev/lib/modules/${modDirVersion}/build/.[0-9]*.d
-
       # Keep an extra file on powerpc
       for f in arch/powerpc/lib/crtsavres.o; do
         if [ -f "$buildRoot/$f" ]; then

From 31e42e49a67843460e63190feb132635234ffb9e Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 8 Jul 2026 09:15:39 +0100
Subject: [PATCH 186/525] linux: drop redundant `vmlinux` build target
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Kernel images already depend on `vmlinux` (also, `perf(8)` doesn’t
really need it any more, so the comment is inaccurate).
---
 pkgs/os-specific/linux/kernel/build.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/os-specific/linux/kernel/build.nix b/pkgs/os-specific/linux/kernel/build.nix
index 61de3fb04060..400bafc0adb5 100644
--- a/pkgs/os-specific/linux/kernel/build.nix
+++ b/pkgs/os-specific/linux/kernel/build.nix
@@ -220,7 +220,6 @@ lib.makeOverridable (
     buildFlags = [
       "KBUILD_BUILD_VERSION=1-NixOS"
       target
-      "vmlinux" # for "perf" and things like that
       "scripts_gdb"
     ]
     ++ optional isModular "modules"

From 1fe6e500193cbf68fca6620c1ffa93f9ce2cdf62 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 9 Sep 2026 17:26:05 +0100
Subject: [PATCH 187/525] linux: drop redundant Make parallelism from
 `preInstall`

The `enableParallelInstalling` logic already handles this by default.
---
 pkgs/os-specific/linux/kernel/build.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/os-specific/linux/kernel/build.nix b/pkgs/os-specific/linux/kernel/build.nix
index 400bafc0adb5..99e90f5084b0 100644
--- a/pkgs/os-specific/linux/kernel/build.nix
+++ b/pkgs/os-specific/linux/kernel/build.nix
@@ -480,7 +480,6 @@ lib.makeOverridable (
         '';
       in
       ''
-        installFlags+=("-j$NIX_BUILD_CORES")
         export HOME=${installkernel}
       '';
 

From 30e05543b6bebd6db54d2861c9231a8dc3604d94 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 9 Sep 2026 17:26:05 +0100
Subject: [PATCH 188/525] linux: move `installkernel` script wiring to
 `installFlags`

---
 pkgs/os-specific/linux/kernel/build.nix | 108 +++++++++++-------------
 1 file changed, 51 insertions(+), 57 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/build.nix b/pkgs/os-specific/linux/kernel/build.nix
index 99e90f5084b0..234d78931581 100644
--- a/pkgs/os-specific/linux/kernel/build.nix
+++ b/pkgs/os-specific/linux/kernel/build.nix
@@ -230,6 +230,57 @@ lib.makeOverridable (
 
     installFlags = [
       "INSTALL_PATH=${placeholder "out"}"
+
+      # All we really need to do here is copy the final image and System.map to $out,
+      # and use the kernel's modules_install, firmware_install, dtbs_install, etc. targets
+      # for the rest. Easy, right?
+      #
+      # Unfortunately for us, the obvious way of getting the built image path,
+      # make -s image_name, does not work correctly, because some architectures
+      # (*cough* aarch64 *cough*) change KBUILD_IMAGE on the fly in their install targets,
+      # so we end up attempting to install the thing we didn't actually build.
+      #
+      # Thankfully, there's a way out that doesn't involve just hardcoding everything.
+      #
+      # The kernel has an install target, which runs a pretty simple shell script
+      # (located at scripts/install.sh or arch/$arch/boot/install.sh, depending on
+      # which kernel version you're looking at) that tries to do something sensible.
+      #
+      # (it would be great to hijack this script immediately, as it has all the
+      #   information we need passed to it and we don't need it to try and be smart,
+      #   but unfortunately, the exact location of the scripts differs between kernel
+      #   versions, and they're seemingly not considered to be public API at all)
+      #
+      # One of the ways it tries to discover what "something sensible" actually is
+      # is by delegating to what's supposed to be a user-provided install script
+      # located at ~/bin/installkernel.
+      #
+      # (the other options are:
+      #   - a distribution-specific script at /sbin/installkernel,
+      #        which we can't really create in the sandbox easily
+      #   - an architecture-specific script at arch/$arch/boot/install.sh,
+      #        which attempts to guess _something_ and usually guesses very wrong)
+      #
+      # More specifically, the install script exec's into ~/bin/installkernel, if one
+      # exists, with the following arguments:
+      #
+      # $1: $KERNELRELEASE - full kernel version string
+      # $2: $KBUILD_IMAGE - the final image path
+      # $3: System.map - path to System.map file, seemingly hardcoded everywhere
+      # $4: $INSTALL_PATH - path to the destination directory as specified in installFlags
+      #
+      # $2 is exactly what we want, so hijack the script and use the knowledge given to it
+      # by the makefile overlords for our own nefarious ends.
+      #
+      # Note that the makefiles specifically look in ~/bin/installkernel, and
+      # writeShellScriptBin writes the script to <store path>/bin/installkernel,
+      # so HOME needs to be set to just the store path.
+      #
+      # FIXME: figure out a less roundabout way of doing this.
+      "HOME=${buildPackages.writeShellScriptBin "installkernel" ''
+        cp -av $2 $4
+        cp -av $3 $4
+      ''}"
     ]
     ++ (optional isModular "INSTALL_MOD_PATH=${placeholder "modules"}")
     ++ optionals buildDTBs [
@@ -426,63 +477,6 @@ lib.makeOverridable (
       find -empty -type d -delete
     '';
 
-    preInstall =
-      let
-        # All we really need to do here is copy the final image and System.map to $out,
-        # and use the kernel's modules_install, firmware_install, dtbs_install, etc. targets
-        # for the rest. Easy, right?
-        #
-        # Unfortunately for us, the obvious way of getting the built image path,
-        # make -s image_name, does not work correctly, because some architectures
-        # (*cough* aarch64 *cough*) change KBUILD_IMAGE on the fly in their install targets,
-        # so we end up attempting to install the thing we didn't actually build.
-        #
-        # Thankfully, there's a way out that doesn't involve just hardcoding everything.
-        #
-        # The kernel has an install target, which runs a pretty simple shell script
-        # (located at scripts/install.sh or arch/$arch/boot/install.sh, depending on
-        # which kernel version you're looking at) that tries to do something sensible.
-        #
-        # (it would be great to hijack this script immediately, as it has all the
-        #   information we need passed to it and we don't need it to try and be smart,
-        #   but unfortunately, the exact location of the scripts differs between kernel
-        #   versions, and they're seemingly not considered to be public API at all)
-        #
-        # One of the ways it tries to discover what "something sensible" actually is
-        # is by delegating to what's supposed to be a user-provided install script
-        # located at ~/bin/installkernel.
-        #
-        # (the other options are:
-        #   - a distribution-specific script at /sbin/installkernel,
-        #        which we can't really create in the sandbox easily
-        #   - an architecture-specific script at arch/$arch/boot/install.sh,
-        #        which attempts to guess _something_ and usually guesses very wrong)
-        #
-        # More specifically, the install script exec's into ~/bin/installkernel, if one
-        # exists, with the following arguments:
-        #
-        # $1: $KERNELRELEASE - full kernel version string
-        # $2: $KBUILD_IMAGE - the final image path
-        # $3: System.map - path to System.map file, seemingly hardcoded everywhere
-        # $4: $INSTALL_PATH - path to the destination directory as specified in installFlags
-        #
-        # $2 is exactly what we want, so hijack the script and use the knowledge given to it
-        # by the makefile overlords for our own nefarious ends.
-        #
-        # Note that the makefiles specifically look in ~/bin/installkernel, and
-        # writeShellScriptBin writes the script to <store path>/bin/installkernel,
-        # so HOME needs to be set to just the store path.
-        #
-        # FIXME: figure out a less roundabout way of doing this.
-        installkernel = buildPackages.writeShellScriptBin "installkernel" ''
-          cp -av $2 $4
-          cp -av $3 $4
-        '';
-      in
-      ''
-        export HOME=${installkernel}
-      '';
-
     preFixup = ''
       if [ -z "''${dontStrip-}" -a -e $out/vmlinux ]; then
         $STRIP -v -S -p $out/vmlinux

From 01351c4fc6f27552c4d2fc9358816ceb62e7c03d Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 9 Sep 2026 19:52:11 +0100
Subject: [PATCH 189/525] linux: move `DTC_FLAGS` to `makeFlags`

No reason for this to be inconsistent between invocations, and it
keeps flags out of our build targets variable.
---
 pkgs/os-specific/linux/kernel/build.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/kernel/build.nix b/pkgs/os-specific/linux/kernel/build.nix
index 234d78931581..984000cefb40 100644
--- a/pkgs/os-specific/linux/kernel/build.nix
+++ b/pkgs/os-specific/linux/kernel/build.nix
@@ -225,7 +225,6 @@ lib.makeOverridable (
     ++ optional isModular "modules"
     ++ optionals buildDTBs [
       "dtbs"
-      "DTC_FLAGS=-@"
     ];
 
     installFlags = [
@@ -326,6 +325,8 @@ lib.makeOverridable (
     makeFlags = [
       "O=$(buildRoot)"
 
+      "DTC_FLAGS=-@"
+
       # We have a `modules` variable in the environment for our
       # split output, but the kernel Makefiles also define their
       # own `modules` variable. Their definition wins, but Make

From d0b560c0d1a2d05bf1790d2044a77a5cd274ea0d Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 26 Aug 2026 17:15:38 +0100
Subject: [PATCH 190/525] linux: move `KBUILD_BUILD_TIMESTAMP` to `makeFlags`
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Per [the documentation]:

> The value has to be a string that can be passed to date -d.

So we don’t need to run this through `date(1)` ourselves.

[the documentation]:
<https://docs.kernel.org/kbuild/kbuild.html#kbuild-build-timestamp>
---
 pkgs/os-specific/linux/kernel/build.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/build.nix b/pkgs/os-specific/linux/kernel/build.nix
index 984000cefb40..41d5441c48c7 100644
--- a/pkgs/os-specific/linux/kernel/build.nix
+++ b/pkgs/os-specific/linux/kernel/build.nix
@@ -324,6 +324,7 @@ lib.makeOverridable (
 
     makeFlags = [
       "O=$(buildRoot)"
+      "KBUILD_BUILD_TIMESTAMP=@$(SOURCE_DATE_EPOCH)"
 
       "DTC_FLAGS=-@"
 
@@ -396,8 +397,6 @@ lib.makeOverridable (
         exit 1
       fi
 
-      buildFlags+=("KBUILD_BUILD_TIMESTAMP=$(date -u -d @$SOURCE_DATE_EPOCH)")
-
       cd $buildRoot
     '';
 

From 1d4847e8027583cdcfff3e55657025cb2891520f Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 9 Sep 2026 19:52:11 +0100
Subject: [PATCH 191/525] linux: move `KBUILD_BUILD_VERSION` to `makeFlags`

No reason for this to be inconsistent between invocations, and it
keeps flags out of our build targets variable.
---
 pkgs/os-specific/linux/kernel/build.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/kernel/build.nix b/pkgs/os-specific/linux/kernel/build.nix
index 41d5441c48c7..f7727dc39554 100644
--- a/pkgs/os-specific/linux/kernel/build.nix
+++ b/pkgs/os-specific/linux/kernel/build.nix
@@ -218,7 +218,6 @@ lib.makeOverridable (
           });
 
     buildFlags = [
-      "KBUILD_BUILD_VERSION=1-NixOS"
       target
       "scripts_gdb"
     ]
@@ -325,6 +324,7 @@ lib.makeOverridable (
     makeFlags = [
       "O=$(buildRoot)"
       "KBUILD_BUILD_TIMESTAMP=@$(SOURCE_DATE_EPOCH)"
+      "KBUILD_BUILD_VERSION=1-NixOS"
 
       "DTC_FLAGS=-@"
 

From 40371828afbd8eb29b2ccf0c4dcdd4a950d31cdf Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 26 Aug 2026 21:11:09 +0100
Subject: [PATCH 192/525] linux: move `src` unsetting to `makeFlags`

This is more consistent with how we handle the `modules` variable
and allows for easier reuse.
---
 pkgs/os-specific/linux/kernel/build.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/build.nix b/pkgs/os-specific/linux/kernel/build.nix
index f7727dc39554..97673a1cd1e2 100644
--- a/pkgs/os-specific/linux/kernel/build.nix
+++ b/pkgs/os-specific/linux/kernel/build.nix
@@ -341,6 +341,10 @@ lib.makeOverridable (
       # variable before any Makefiles are read, ensuring that the
       # kernel’s definition creates a new, unexported variable.
       "--eval=undefine modules"
+
+      # unset $src because the build system tries to use it and spams a bunch of warnings
+      # see: https://github.com/torvalds/linux/commit/b1992c3772e69a6fd0e3fc81cd4d2820c8b6eca0
+      "--eval=undefine src"
     ]
     ++ commonMakeFlags;
 
@@ -365,10 +369,6 @@ lib.makeOverridable (
       for i in $(find arch -name install.sh); do
           patchShebangs "$i"
       done
-
-      # unset $src because the build system tries to use it and spams a bunch of warnings
-      # see: https://github.com/torvalds/linux/commit/b1992c3772e69a6fd0e3fc81cd4d2820c8b6eca0
-      unset src
     '';
 
     configurePhase = ''

From 7d4bc611c0cc4a7c2c667cdeb5e343412139bb0e Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Fri, 10 Jul 2026 15:47:40 +0100
Subject: [PATCH 193/525] linux: move `INSTALL_MOD_STRIP` to `installFlags`

---
 pkgs/os-specific/linux/kernel/build.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/build.nix b/pkgs/os-specific/linux/kernel/build.nix
index 97673a1cd1e2..6d0f9d42ff1c 100644
--- a/pkgs/os-specific/linux/kernel/build.nix
+++ b/pkgs/os-specific/linux/kernel/build.nix
@@ -280,7 +280,10 @@ lib.makeOverridable (
         cp -av $3 $4
       ''}"
     ]
-    ++ (optional isModular "INSTALL_MOD_PATH=${placeholder "modules"}")
+    ++ optionals isModular [
+      "INSTALL_MOD_PATH=${placeholder "modules"}"
+      "INSTALL_MOD_STRIP=$(if $(dontStrip),,1)"
+    ]
     ++ optionals buildDTBs [
       "dtbs_install"
       "INSTALL_DTBS_PATH=${placeholder "out"}/dtbs"
@@ -410,9 +413,6 @@ lib.makeOverridable (
       # Installing `constants.py` from `$buildRoot` as it's generated.
       cp scripts/gdb/linux/constants.py $dev/lib/modules/${modDirVersion}/build/scripts/gdb/linux
 
-      if [ -z "''${dontStrip-}" ]; then
-        installFlags+=("INSTALL_MOD_STRIP=1")
-      fi
       make modules_install "''${makeFlags[@]}" "''${installFlags[@]}"
       unlink $modules/lib/modules/${modDirVersion}/build
 

From 4283026e6fd4d9c49ede2a9ea89a46cb45ecf8eb Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Fri, 10 Jul 2026 15:47:40 +0100
Subject: [PATCH 194/525] linux: move `modules_install` to `installTargets`
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There’s no reason to run this separately.
---
 pkgs/os-specific/linux/kernel/build.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/build.nix b/pkgs/os-specific/linux/kernel/build.nix
index 6d0f9d42ff1c..fe0ac3319f5b 100644
--- a/pkgs/os-specific/linux/kernel/build.nix
+++ b/pkgs/os-specific/linux/kernel/build.nix
@@ -413,7 +413,6 @@ lib.makeOverridable (
       # Installing `constants.py` from `$buildRoot` as it's generated.
       cp scripts/gdb/linux/constants.py $dev/lib/modules/${modDirVersion}/build/scripts/gdb/linux
 
-      make modules_install "''${makeFlags[@]}" "''${installFlags[@]}"
       unlink $modules/lib/modules/${modDirVersion}/build
 
       mkdir -p $dev/lib/modules/${modDirVersion}/{build,source}
@@ -526,7 +525,8 @@ lib.makeOverridable (
         else
           "install"
       )
-    ];
+    ]
+    ++ lib.optionals isModular [ "modules_install" ];
 
     karch = stdenv.hostPlatform.linuxArch;
 

From f64e61c6941cc259bfa7030a58fe25e9f88e77b8 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 9 Sep 2026 17:26:05 +0100
Subject: [PATCH 195/525] linux: move `dtbs_install` to `installTargets`

This keeps targets out of our flags variable.
---
 pkgs/os-specific/linux/kernel/build.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/build.nix b/pkgs/os-specific/linux/kernel/build.nix
index fe0ac3319f5b..5c782584b523 100644
--- a/pkgs/os-specific/linux/kernel/build.nix
+++ b/pkgs/os-specific/linux/kernel/build.nix
@@ -285,7 +285,6 @@ lib.makeOverridable (
       "INSTALL_MOD_STRIP=$(if $(dontStrip),,1)"
     ]
     ++ optionals buildDTBs [
-      "dtbs_install"
       "INSTALL_DTBS_PATH=${placeholder "out"}/dtbs"
     ];
 
@@ -526,7 +525,8 @@ lib.makeOverridable (
           "install"
       )
     ]
-    ++ lib.optionals isModular [ "modules_install" ];
+    ++ lib.optionals isModular [ "modules_install" ]
+    ++ lib.optionals buildDTBs [ "dtbs_install" ];
 
     karch = stdenv.hostPlatform.linuxArch;
 

From bb5aad922232b8a9789e3c63d145b71d8b6cb2a2 Mon Sep 17 00:00:00 2001
From: Philippe Loctaux <p@philippeloctaux.com>
Date: Thu, 20 Aug 2026 12:40:26 +0200
Subject: [PATCH 196/525] opencloud: merge subpackages into single package.nix

---
 pkgs/by-name/op/opencloud/idp-web.nix |  59 ------------
 pkgs/by-name/op/opencloud/package.nix | 127 +++++++++++++++++++++++---
 pkgs/by-name/op/opencloud/web.nix     |  61 -------------
 3 files changed, 116 insertions(+), 131 deletions(-)
 delete mode 100644 pkgs/by-name/op/opencloud/idp-web.nix
 delete mode 100644 pkgs/by-name/op/opencloud/web.nix

diff --git a/pkgs/by-name/op/opencloud/idp-web.nix b/pkgs/by-name/op/opencloud/idp-web.nix
deleted file mode 100644
index d2dd3553de39..000000000000
--- a/pkgs/by-name/op/opencloud/idp-web.nix
+++ /dev/null
@@ -1,59 +0,0 @@
-{
-  stdenvNoCC,
-  lib,
-  opencloud,
-  pnpm_11,
-  fetchPnpmDeps,
-  pnpmConfigHook,
-  pnpmBuildHook,
-  nodejs,
-}:
-stdenvNoCC.mkDerivation (finalAttrs: {
-  pname = "opencloud-idp-web";
-
-  inherit (opencloud) src version;
-
-  pnpmRoot = "services/idp";
-
-  pnpmDeps = fetchPnpmDeps {
-    inherit (finalAttrs) pname version src;
-    pnpm = pnpm_11;
-    sourceRoot = "${finalAttrs.src.name}/${finalAttrs.pnpmRoot}";
-    fetcherVersion = 4;
-    hash = "sha256-rj6KFrzuINVpxrrel2p2iWtJVH8Zg1jrZEIAs8S+8Qs=";
-  };
-
-  nativeBuildInputs = [
-    nodejs
-    pnpmConfigHook
-    pnpmBuildHook
-    pnpm_11
-  ];
-
-  postBuild = ''
-    mkdir -p services/idp/assets/identifier/static
-    cp -v services/idp/src/images/favicon.svg services/idp/assets/identifier/static/favicon.svg
-    cp -v services/idp/src/images/icon-lilac.svg services/idp/assets/identifier/static/icon-lilac.svg
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir $out
-    cp -r services/idp/assets $out
-
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "OpenCloud - IDP Web UI";
-    homepage = "https://github.com/opencloud-eu/opencloud";
-    changelog = "https://github.com/opencloud-eu/opencloud/blob/${finalAttrs.src.tag}/CHANGELOG.md";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [
-      christoph-heiss
-      k900
-    ];
-    platforms = lib.platforms.all;
-  };
-})
diff --git a/pkgs/by-name/op/opencloud/package.nix b/pkgs/by-name/op/opencloud/package.nix
index 5288e2454db0..553e445785e9 100644
--- a/pkgs/by-name/op/opencloud/package.nix
+++ b/pkgs/by-name/op/opencloud/package.nix
@@ -13,9 +13,22 @@
   nixosTests,
   nix-update-script,
   versionCheckHook,
+  stdenvNoCC,
+  nodejs,
+  pnpm_11,
+  fetchPnpmDeps,
+  pnpmBuildHook,
+  pnpmConfigHook,
 }:
 
 let
+  version = "7.5.0";
+  src = fetchFromGitHub {
+    owner = "opencloud-eu";
+    repo = "opencloud";
+    tag = "v${version}";
+    hash = "sha256-OMQuNfm9xqXaDexuoDRvvSEoEb7hXEMF7ynRU3CawbI=";
+  };
   bingoBinsMakefile = builtins.concatStringsSep "\n" (
     lib.mapAttrsToList (n: v: "${n} := ${v}\n\\$(${n}):") {
       GO_XGETTEXT = "xgettext";
@@ -25,18 +38,111 @@ let
       PROTOC_GO_INJECT_TAG = "protoc-go-inject-tag";
     }
   );
+  web = stdenvNoCC.mkDerivation (finalAttrs: {
+    pname = "opencloud-web";
+    version = "7.4.0";
+
+    src = fetchFromGitHub {
+      owner = "opencloud-eu";
+      repo = "web";
+      tag = "v${finalAttrs.version}";
+      hash = "sha256-idoR5R97k5ZfYBh7vboXzg2CdbVX5TBPrpL6s1k9qPA=";
+    };
+
+    pnpmDeps = fetchPnpmDeps {
+      inherit (finalAttrs) pname version src;
+      pnpm = pnpm_11;
+      fetcherVersion = 4;
+      hash = "sha256-h2QNq51GE8qnLsvPhDobzT/8am0jzbW6Mx6tnungY/k=";
+    };
+
+    nativeBuildInputs = [
+      nodejs
+      pnpmConfigHook
+      pnpm_11
+    ];
+
+    buildPhase = ''
+      runHook preBuild
+      pnpm build
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      mkdir $out
+      cp -r dist/* $out
+      runHook postInstall
+    '';
+
+    passthru.updateScript = nix-update-script { };
+
+    meta = {
+      description = "Web UI for OpenCloud built with Vue.js and TypeScript";
+      homepage = "https://github.com/opencloud-eu/web";
+      changelog = "https://github.com/opencloud-eu/web/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+      license = lib.licenses.agpl3Only;
+      maintainers = with lib.maintainers; [
+        christoph-heiss
+        k900
+      ];
+      platforms = lib.platforms.all;
+    };
+  });
+
+  idp-web = stdenvNoCC.mkDerivation (finalAttrs: {
+    pname = "opencloud-idp-web";
+
+    inherit src version;
+
+    pnpmRoot = "services/idp";
+
+    pnpmDeps = fetchPnpmDeps {
+      inherit (finalAttrs) pname version src;
+      pnpm = pnpm_11;
+      sourceRoot = "${finalAttrs.src.name}/${finalAttrs.pnpmRoot}";
+      fetcherVersion = 4;
+      hash = "sha256-rj6KFrzuINVpxrrel2p2iWtJVH8Zg1jrZEIAs8S+8Qs=";
+    };
+
+    nativeBuildInputs = [
+      nodejs
+      pnpmConfigHook
+      pnpmBuildHook
+      pnpm_11
+    ];
+
+    postBuild = ''
+      mkdir -p services/idp/assets/identifier/static
+      cp -v services/idp/src/images/favicon.svg services/idp/assets/identifier/static/favicon.svg
+      cp -v services/idp/src/images/icon-lilac.svg services/idp/assets/identifier/static/icon-lilac.svg
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir $out
+      cp -r services/idp/assets $out
+
+      runHook postInstall
+    '';
+
+    meta = {
+      description = "OpenCloud - IDP Web UI";
+      homepage = "https://github.com/opencloud-eu/opencloud";
+      changelog = "https://github.com/opencloud-eu/opencloud/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+      license = lib.licenses.asl20;
+      maintainers = with lib.maintainers; [
+        christoph-heiss
+        k900
+      ];
+      platforms = lib.platforms.all;
+    };
+  });
 in
 buildGoModule (finalAttrs: {
+  inherit version src;
   pname = "opencloud";
-  version = "7.5.0";
-
-  src = fetchFromGitHub {
-    owner = "opencloud-eu";
-    repo = "opencloud";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-OMQuNfm9xqXaDexuoDRvvSEoEb7hXEMF7ynRU3CawbI=";
-  };
-
   postPatch = ''
     echo "${bingoBinsMakefile}" >.bingo/Variables.mk
 
@@ -105,8 +211,7 @@ buildGoModule (finalAttrs: {
   excludedPackages = [ "tests/*" ];
 
   passthru = {
-    web = callPackage ./web.nix { };
-    idp-web = callPackage ./idp-web.nix { };
+    inherit web idp-web;
     tests = { inherit (nixosTests) opencloud; };
     updateScript = nix-update-script { };
   };
diff --git a/pkgs/by-name/op/opencloud/web.nix b/pkgs/by-name/op/opencloud/web.nix
deleted file mode 100644
index f6ab914c9099..000000000000
--- a/pkgs/by-name/op/opencloud/web.nix
+++ /dev/null
@@ -1,61 +0,0 @@
-{
-  lib,
-  stdenvNoCC,
-  fetchFromGitHub,
-  nodejs,
-  pnpm_11,
-  fetchPnpmDeps,
-  pnpmConfigHook,
-  nix-update-script,
-}:
-stdenvNoCC.mkDerivation (finalAttrs: {
-  pname = "opencloud-web";
-  version = "7.4.0";
-
-  src = fetchFromGitHub {
-    owner = "opencloud-eu";
-    repo = "web";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-idoR5R97k5ZfYBh7vboXzg2CdbVX5TBPrpL6s1k9qPA=";
-  };
-
-  pnpmDeps = fetchPnpmDeps {
-    inherit (finalAttrs) pname version src;
-    pnpm = pnpm_11;
-    fetcherVersion = 4;
-    hash = "sha256-h2QNq51GE8qnLsvPhDobzT/8am0jzbW6Mx6tnungY/k=";
-  };
-
-  nativeBuildInputs = [
-    nodejs
-    pnpmConfigHook
-    pnpm_11
-  ];
-
-  buildPhase = ''
-    runHook preBuild
-    pnpm build
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-    mkdir $out
-    cp -r dist/* $out
-    runHook postInstall
-  '';
-
-  passthru.updateScript = nix-update-script { };
-
-  meta = {
-    description = "Web UI for OpenCloud built with Vue.js and TypeScript";
-    homepage = "https://github.com/opencloud-eu/web";
-    changelog = "https://github.com/opencloud-eu/web/blob/${finalAttrs.src.tag}/CHANGELOG.md";
-    license = lib.licenses.agpl3Only;
-    maintainers = with lib.maintainers; [
-      christoph-heiss
-      k900
-    ];
-    platforms = lib.platforms.all;
-  };
-})

From 216c3f366e9d616a8d75d5d45a22e87433272f56 Mon Sep 17 00:00:00 2001
From: Philippe Loctaux <p@philippeloctaux.com>
Date: Thu, 20 Aug 2026 22:12:15 +0200
Subject: [PATCH 197/525] opencloud-production: init at 7.2.3

refactor opencloud package into generic packages, like it was done for forgejo
---
 pkgs/by-name/op/opencloud/generic.nix    | 247 +++++++++++++++++++++++
 pkgs/by-name/op/opencloud/package.nix    | 241 +---------------------
 pkgs/by-name/op/opencloud/production.nix |   9 +
 pkgs/top-level/all-packages.nix          |   2 +
 4 files changed, 266 insertions(+), 233 deletions(-)
 create mode 100644 pkgs/by-name/op/opencloud/generic.nix
 create mode 100644 pkgs/by-name/op/opencloud/production.nix

diff --git a/pkgs/by-name/op/opencloud/generic.nix b/pkgs/by-name/op/opencloud/generic.nix
new file mode 100644
index 000000000000..e97087a1d979
--- /dev/null
+++ b/pkgs/by-name/op/opencloud/generic.nix
@@ -0,0 +1,247 @@
+{
+  version,
+  production ? false,
+  hash,
+  webVersion,
+  webHash,
+  webPnpmDepsHash,
+  idpWebPnpmDepsHash,
+  nixUpdateExtraArgs ? [ ],
+}:
+
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  ncurses,
+  gettext,
+  pigeon,
+  protoc-go-inject-tag,
+  libxcrypt,
+  vips,
+  pkg-config,
+  nixosTests,
+  nix-update-script,
+  versionCheckHook,
+  stdenvNoCC,
+  nodejs,
+  pnpm_11,
+  fetchPnpmDeps,
+  pnpmBuildHook,
+  pnpmConfigHook,
+}:
+
+let
+  src = fetchFromGitHub {
+    owner = "opencloud-eu";
+    repo = "opencloud";
+    tag = "v${version}";
+    inherit hash;
+  };
+  bingoBinsMakefile = builtins.concatStringsSep "\n" (
+    lib.mapAttrsToList (n: v: "${n} := ${v}\n\\$(${n}):") {
+      GO_XGETTEXT = "xgettext";
+      # no need to generate mocks, as they are in-repo already
+      MOCKERY = "true";
+      PIGEON = "pigeon";
+      PROTOC_GO_INJECT_TAG = "protoc-go-inject-tag";
+    }
+  );
+  web = stdenvNoCC.mkDerivation (finalAttrs: {
+    pname = "opencloud-web";
+    version = webVersion;
+
+    src = fetchFromGitHub {
+      owner = "opencloud-eu";
+      repo = "web";
+      tag = "v${finalAttrs.version}";
+      hash = webHash;
+    };
+
+    pnpmDeps = fetchPnpmDeps {
+      inherit (finalAttrs) pname version src;
+      pnpm = pnpm_11;
+      fetcherVersion = 4;
+      hash = webPnpmDepsHash;
+    };
+
+    nativeBuildInputs = [
+      nodejs
+      pnpmConfigHook
+      pnpm_11
+    ];
+
+    buildPhase = ''
+      runHook preBuild
+      pnpm build
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      mkdir $out
+      cp -r dist/* $out
+      runHook postInstall
+    '';
+
+    passthru.updateScript = nix-update-script { };
+
+    meta = {
+      description = "Web UI for OpenCloud built with Vue.js and TypeScript";
+      homepage = "https://github.com/opencloud-eu/web";
+      changelog = "https://github.com/opencloud-eu/web/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+      license = lib.licenses.agpl3Only;
+      maintainers = with lib.maintainers; [
+        christoph-heiss
+        k900
+      ];
+      platforms = lib.platforms.all;
+    };
+  });
+
+  idp-web = stdenvNoCC.mkDerivation (finalAttrs: {
+    pname = "opencloud-idp-web";
+
+    inherit src version;
+
+    pnpmRoot = "services/idp";
+
+    pnpmDeps = fetchPnpmDeps {
+      inherit (finalAttrs) pname version src;
+      pnpm = pnpm_11;
+      sourceRoot = "${finalAttrs.src.name}/${finalAttrs.pnpmRoot}";
+      fetcherVersion = 4;
+      hash = idpWebPnpmDepsHash;
+    };
+
+    nativeBuildInputs = [
+      nodejs
+      pnpmConfigHook
+      pnpmBuildHook
+      pnpm_11
+    ];
+
+    postBuild = ''
+      mkdir -p services/idp/assets/identifier/static
+      cp -v services/idp/src/images/favicon.svg services/idp/assets/identifier/static/favicon.svg
+      cp -v services/idp/src/images/icon-lilac.svg services/idp/assets/identifier/static/icon-lilac.svg
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir $out
+      cp -r services/idp/assets $out
+
+      runHook postInstall
+    '';
+
+    meta = {
+      description = "OpenCloud - IDP Web UI";
+      homepage = "https://github.com/opencloud-eu/opencloud";
+      changelog = "https://github.com/opencloud-eu/opencloud/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+      license = lib.licenses.asl20;
+      maintainers = with lib.maintainers; [
+        christoph-heiss
+        k900
+      ];
+      platforms = lib.platforms.all;
+    };
+  });
+in
+buildGoModule (finalAttrs: {
+  inherit version src;
+  pname = "opencloud" + lib.optionalString production "-production";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  postPatch = ''
+    echo "${bingoBinsMakefile}" >.bingo/Variables.mk
+
+    # tries to build web assets, done separately
+    substituteInPlace services/idp/Makefile \
+      --replace-fail 'node-generate-prod: assets' 'node-generate-prod:'
+    # tries to download something web assets ..
+    substituteInPlace services/web/Makefile \
+      --replace-fail 'node-generate-prod: download-assets' 'node-generate-prod:'
+
+    # tries to build some random binaries off the internet and
+    # no need to build protobuf bindings anyway, as they are in-repo already
+    sed -i -e '/\$(BINGO) get/d' -e '/\$(BUF) generate/d' .make/protobuf.mk
+  '';
+
+  vendorHash = null;
+
+  preConfigure = ''
+    export HOME=$(mktemp -d)
+    make generate
+  '';
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X"
+    "github.com/opencloud-eu/opencloud/pkg/version.String=nixos"
+    "-X"
+    "github.com/opencloud-eu/opencloud/pkg/version.Tag=${finalAttrs.version}"
+    "-X"
+    "github.com/opencloud-eu/opencloud/pkg/version.Date=19700101"
+  ];
+
+  tags = [ "enable_vips" ];
+
+  nativeBuildInputs = [
+    ncurses
+    gettext
+    pigeon
+    protoc-go-inject-tag
+    pkg-config
+  ];
+
+  buildInputs = [
+    libxcrypt
+    vips
+  ];
+
+  # wants testcontainers and docker, and we don't have a good way to skip tests
+  # based on package name and not test name
+  preCheck = ''
+    rm services/search/pkg/opensearch/*_test.go
+  '';
+
+  # The activitylog tests start a local NATS server.
+  __darwinAllowLocalNetworking = true;
+
+  env = {
+    # avoids 'make generate' calling `git`, otherwise no-op
+    STRING = finalAttrs.version;
+    VERSION = finalAttrs.version;
+    # avoids weird test failure
+    AUTOMEMLIMIT = "off";
+  };
+
+  excludedPackages = [ "tests/*" ];
+
+  passthru = {
+    inherit web idp-web;
+    tests = { inherit (nixosTests) opencloud; }; # TODO: parametrize
+    updateScript = nix-update-script { }; # TODO: nixUpdateExtraArgs
+  };
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = [ "version" ];
+
+  meta = {
+    description = "OpenCloud gives you a secure and private way to store, access, and share your files";
+    homepage = "https://github.com/opencloud-eu/opencloud";
+    changelog = "https://github.com/opencloud-eu/opencloud/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      christoph-heiss
+      k900
+    ];
+    mainProgram = "opencloud";
+  };
+})
diff --git a/pkgs/by-name/op/opencloud/package.nix b/pkgs/by-name/op/opencloud/package.nix
index 553e445785e9..c3668d1fdcae 100644
--- a/pkgs/by-name/op/opencloud/package.nix
+++ b/pkgs/by-name/op/opencloud/package.nix
@@ -1,234 +1,9 @@
-{
-  lib,
-  callPackage,
-  buildGoModule,
-  fetchFromGitHub,
-  ncurses,
-  gettext,
-  pigeon,
-  protoc-go-inject-tag,
-  libxcrypt,
-  vips,
-  pkg-config,
-  nixosTests,
-  nix-update-script,
-  versionCheckHook,
-  stdenvNoCC,
-  nodejs,
-  pnpm_11,
-  fetchPnpmDeps,
-  pnpmBuildHook,
-  pnpmConfigHook,
-}:
-
-let
+import ./generic.nix {
   version = "7.5.0";
-  src = fetchFromGitHub {
-    owner = "opencloud-eu";
-    repo = "opencloud";
-    tag = "v${version}";
-    hash = "sha256-OMQuNfm9xqXaDexuoDRvvSEoEb7hXEMF7ynRU3CawbI=";
-  };
-  bingoBinsMakefile = builtins.concatStringsSep "\n" (
-    lib.mapAttrsToList (n: v: "${n} := ${v}\n\\$(${n}):") {
-      GO_XGETTEXT = "xgettext";
-      # no need to generate mocks, as they are in-repo already
-      MOCKERY = "true";
-      PIGEON = "pigeon";
-      PROTOC_GO_INJECT_TAG = "protoc-go-inject-tag";
-    }
-  );
-  web = stdenvNoCC.mkDerivation (finalAttrs: {
-    pname = "opencloud-web";
-    version = "7.4.0";
-
-    src = fetchFromGitHub {
-      owner = "opencloud-eu";
-      repo = "web";
-      tag = "v${finalAttrs.version}";
-      hash = "sha256-idoR5R97k5ZfYBh7vboXzg2CdbVX5TBPrpL6s1k9qPA=";
-    };
-
-    pnpmDeps = fetchPnpmDeps {
-      inherit (finalAttrs) pname version src;
-      pnpm = pnpm_11;
-      fetcherVersion = 4;
-      hash = "sha256-h2QNq51GE8qnLsvPhDobzT/8am0jzbW6Mx6tnungY/k=";
-    };
-
-    nativeBuildInputs = [
-      nodejs
-      pnpmConfigHook
-      pnpm_11
-    ];
-
-    buildPhase = ''
-      runHook preBuild
-      pnpm build
-      runHook postBuild
-    '';
-
-    installPhase = ''
-      runHook preInstall
-      mkdir $out
-      cp -r dist/* $out
-      runHook postInstall
-    '';
-
-    passthru.updateScript = nix-update-script { };
-
-    meta = {
-      description = "Web UI for OpenCloud built with Vue.js and TypeScript";
-      homepage = "https://github.com/opencloud-eu/web";
-      changelog = "https://github.com/opencloud-eu/web/blob/${finalAttrs.src.tag}/CHANGELOG.md";
-      license = lib.licenses.agpl3Only;
-      maintainers = with lib.maintainers; [
-        christoph-heiss
-        k900
-      ];
-      platforms = lib.platforms.all;
-    };
-  });
-
-  idp-web = stdenvNoCC.mkDerivation (finalAttrs: {
-    pname = "opencloud-idp-web";
-
-    inherit src version;
-
-    pnpmRoot = "services/idp";
-
-    pnpmDeps = fetchPnpmDeps {
-      inherit (finalAttrs) pname version src;
-      pnpm = pnpm_11;
-      sourceRoot = "${finalAttrs.src.name}/${finalAttrs.pnpmRoot}";
-      fetcherVersion = 4;
-      hash = "sha256-rj6KFrzuINVpxrrel2p2iWtJVH8Zg1jrZEIAs8S+8Qs=";
-    };
-
-    nativeBuildInputs = [
-      nodejs
-      pnpmConfigHook
-      pnpmBuildHook
-      pnpm_11
-    ];
-
-    postBuild = ''
-      mkdir -p services/idp/assets/identifier/static
-      cp -v services/idp/src/images/favicon.svg services/idp/assets/identifier/static/favicon.svg
-      cp -v services/idp/src/images/icon-lilac.svg services/idp/assets/identifier/static/icon-lilac.svg
-    '';
-
-    installPhase = ''
-      runHook preInstall
-
-      mkdir $out
-      cp -r services/idp/assets $out
-
-      runHook postInstall
-    '';
-
-    meta = {
-      description = "OpenCloud - IDP Web UI";
-      homepage = "https://github.com/opencloud-eu/opencloud";
-      changelog = "https://github.com/opencloud-eu/opencloud/blob/${finalAttrs.src.tag}/CHANGELOG.md";
-      license = lib.licenses.asl20;
-      maintainers = with lib.maintainers; [
-        christoph-heiss
-        k900
-      ];
-      platforms = lib.platforms.all;
-    };
-  });
-in
-buildGoModule (finalAttrs: {
-  inherit version src;
-  pname = "opencloud";
-  postPatch = ''
-    echo "${bingoBinsMakefile}" >.bingo/Variables.mk
-
-    # tries to build web assets, done separately
-    substituteInPlace services/idp/Makefile \
-      --replace-fail 'node-generate-prod: assets' 'node-generate-prod:'
-    # tries to download something web assets ..
-    substituteInPlace services/web/Makefile \
-      --replace-fail 'node-generate-prod: download-assets' 'node-generate-prod:'
-
-    # tries to build some random binaries off the internet and
-    # no need to build protobuf bindings anyway, as they are in-repo already
-    sed -i -e '/\$(BINGO) get/d' -e '/\$(BUF) generate/d' .make/protobuf.mk
-  '';
-
-  vendorHash = null;
-
-  preConfigure = ''
-    export HOME=$(mktemp -d)
-    make generate
-  '';
-
-  ldflags = [
-    "-s"
-    "-w"
-    "-X"
-    "github.com/opencloud-eu/opencloud/pkg/version.String=nixos"
-    "-X"
-    "github.com/opencloud-eu/opencloud/pkg/version.Tag=${finalAttrs.version}"
-    "-X"
-    "github.com/opencloud-eu/opencloud/pkg/version.Date=19700101"
-  ];
-
-  tags = [ "enable_vips" ];
-
-  nativeBuildInputs = [
-    ncurses
-    gettext
-    pigeon
-    protoc-go-inject-tag
-    pkg-config
-  ];
-
-  buildInputs = [
-    libxcrypt
-    vips
-  ];
-
-  # wants testcontainers and docker, and we don't have a good way to skip tests
-  # based on package name and not test name
-  preCheck = ''
-    rm services/search/pkg/opensearch/*_test.go
-  '';
-
-  # The activitylog tests start a local NATS server.
-  __darwinAllowLocalNetworking = true;
-
-  env = {
-    # avoids 'make generate' calling `git`, otherwise no-op
-    STRING = finalAttrs.version;
-    VERSION = finalAttrs.version;
-    # avoids weird test failure
-    AUTOMEMLIMIT = "off";
-  };
-
-  excludedPackages = [ "tests/*" ];
-
-  passthru = {
-    inherit web idp-web;
-    tests = { inherit (nixosTests) opencloud; };
-    updateScript = nix-update-script { };
-  };
-
-  doInstallCheck = true;
-  nativeInstallCheckInputs = [ versionCheckHook ];
-  versionCheckProgramArg = [ "version" ];
-
-  meta = {
-    description = "OpenCloud gives you a secure and private way to store, access, and share your files";
-    homepage = "https://github.com/opencloud-eu/opencloud";
-    changelog = "https://github.com/opencloud-eu/opencloud/blob/${finalAttrs.src.tag}/CHANGELOG.md";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [
-      christoph-heiss
-      k900
-    ];
-    mainProgram = "opencloud";
-  };
-})
+  production = false;
+  hash = "sha256-OMQuNfm9xqXaDexuoDRvvSEoEb7hXEMF7ynRU3CawbI=";
+  webVersion = "7.4.0";
+  webHash = "sha256-idoR5R97k5ZfYBh7vboXzg2CdbVX5TBPrpL6s1k9qPA=";
+  webPnpmDepsHash = "sha256-h2QNq51GE8qnLsvPhDobzT/8am0jzbW6Mx6tnungY/k=";
+  idpWebPnpmDepsHash = "sha256-rj6KFrzuINVpxrrel2p2iWtJVH8Zg1jrZEIAs8S+8Qs=";
+}
diff --git a/pkgs/by-name/op/opencloud/production.nix b/pkgs/by-name/op/opencloud/production.nix
new file mode 100644
index 000000000000..123376bb590f
--- /dev/null
+++ b/pkgs/by-name/op/opencloud/production.nix
@@ -0,0 +1,9 @@
+import ./generic.nix {
+  version = "7.2.3";
+  production = true;
+  hash = "sha256-5wmXBLO6wmlBRu0FWDGMzFipRSARyK2LED1BR0Vwnt0=";
+  webVersion = "7.1.4";
+  webHash = "sha256-Wg4VGweWBiTRGDRIbe4spFQB1MEC25zXZBAIa4+YttY=";
+  webPnpmDepsHash = "sha256-YEdZ5B11I6U140qam7e1TMOacRqUeINhr/TI13ddAa0=";
+  idpWebPnpmDepsHash = "sha256-pQ01vBvC29B5oxDWtt7anI5QtFbvQFFBVamQtA2WTNo=";
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index c22f3dc78d56..6fff5dfc1f3a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7302,6 +7302,8 @@ with pkgs;
 
   nsdiff = perlPackages.nsdiff;
 
+  opencloud-production = callPackage ../by-name/op/opencloud/production.nix { };
+
   openresty = callPackage ../servers/http/openresty {
     zlib-ng = zlib;
     withPerl = false;

From 3ba849776eb0f2aeb2d0b8f282e8682b28ce2b9b Mon Sep 17 00:00:00 2001
From: Philippe Loctaux <p@philippeloctaux.com>
Date: Thu, 20 Aug 2026 23:42:35 +0200
Subject: [PATCH 198/525] opencloud{,-production}: nix-update-script after
 generic packages

with version regex:
- opencloud-production: update until patch release of defined major.minor
- opencloud: update until latest release of defined major
---
 pkgs/by-name/op/opencloud/generic.nix    | 7 ++++++-
 pkgs/by-name/op/opencloud/package.nix    | 4 ++++
 pkgs/by-name/op/opencloud/production.nix | 4 ++++
 3 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/op/opencloud/generic.nix b/pkgs/by-name/op/opencloud/generic.nix
index e97087a1d979..4099ac3f1e65 100644
--- a/pkgs/by-name/op/opencloud/generic.nix
+++ b/pkgs/by-name/op/opencloud/generic.nix
@@ -226,7 +226,12 @@ buildGoModule (finalAttrs: {
   passthru = {
     inherit web idp-web;
     tests = { inherit (nixosTests) opencloud; }; # TODO: parametrize
-    updateScript = nix-update-script { }; # TODO: nixUpdateExtraArgs
+    updateScript = nix-update-script {
+      extraArgs = nixUpdateExtraArgs ++ [
+        "--version-regex"
+        "v(${if production then lib.versions.majorMinor else lib.versions.major version}\\.[0-9.]+)"
+      ];
+    };
   };
 
   doInstallCheck = true;
diff --git a/pkgs/by-name/op/opencloud/package.nix b/pkgs/by-name/op/opencloud/package.nix
index c3668d1fdcae..340cf30ff6db 100644
--- a/pkgs/by-name/op/opencloud/package.nix
+++ b/pkgs/by-name/op/opencloud/package.nix
@@ -6,4 +6,8 @@ import ./generic.nix {
   webHash = "sha256-idoR5R97k5ZfYBh7vboXzg2CdbVX5TBPrpL6s1k9qPA=";
   webPnpmDepsHash = "sha256-h2QNq51GE8qnLsvPhDobzT/8am0jzbW6Mx6tnungY/k=";
   idpWebPnpmDepsHash = "sha256-rj6KFrzuINVpxrrel2p2iWtJVH8Zg1jrZEIAs8S+8Qs=";
+  nixUpdateExtraArgs = [
+    "--override-filename"
+    "pkgs/by-name/op/opencloud/package.nix"
+  ];
 }
diff --git a/pkgs/by-name/op/opencloud/production.nix b/pkgs/by-name/op/opencloud/production.nix
index 123376bb590f..82cfab6702a5 100644
--- a/pkgs/by-name/op/opencloud/production.nix
+++ b/pkgs/by-name/op/opencloud/production.nix
@@ -6,4 +6,8 @@ import ./generic.nix {
   webHash = "sha256-Wg4VGweWBiTRGDRIbe4spFQB1MEC25zXZBAIa4+YttY=";
   webPnpmDepsHash = "sha256-YEdZ5B11I6U140qam7e1TMOacRqUeINhr/TI13ddAa0=";
   idpWebPnpmDepsHash = "sha256-pQ01vBvC29B5oxDWtt7anI5QtFbvQFFBVamQtA2WTNo=";
+  nixUpdateExtraArgs = [
+    "--override-filename"
+    "pkgs/by-name/op/opencloud/production.nix"
+  ];
 }

From 877d140e5525be7709459a6610660a4aa3869d8f Mon Sep 17 00:00:00 2001
From: Philippe Loctaux <p@philippeloctaux.com>
Date: Fri, 21 Aug 2026 11:24:30 +0200
Subject: [PATCH 199/525] nixos/tests: init opencloud-production, parametrize
 package for opencloud

---
 nixos/tests/all-tests.nix             | 11 ++++++++++-
 nixos/tests/opencloud.nix             | 11 +++++++++--
 pkgs/by-name/op/opencloud/generic.nix |  2 +-
 3 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 4e04d0703ac6..65cdc45271e1 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1394,7 +1394,16 @@ in
   openarena = runTest ./openarena.nix;
   openbao = runTest ./openbao.nix;
   openbao-agent = runTest ./openbao-agent.nix;
-  opencloud = runTest ./opencloud.nix;
+  opencloud = runTest {
+    imports = [ ./opencloud.nix ];
+    _module.args.opencloudPackage = pkgs.opencloud;
+    _module.args.name = "opencloud";
+  };
+  opencloud-production = runTest {
+    imports = [ ./opencloud.nix ];
+    _module.args.opencloudPackage = pkgs.opencloud-production;
+    _module.args.name = "opencloud-production";
+  };
   openldap = runTest ./openldap.nix;
   openresty-lua = runTest ./openresty-lua.nix;
   opensearch = discoverTests (import ./opensearch.nix);
diff --git a/nixos/tests/opencloud.nix b/nixos/tests/opencloud.nix
index 25bd5295f68c..f754374d80c6 100644
--- a/nixos/tests/opencloud.nix
+++ b/nixos/tests/opencloud.nix
@@ -1,4 +1,10 @@
-{ lib, pkgs, ... }:
+{
+  lib,
+  pkgs,
+  name,
+  opencloudPackage,
+  ...
+}:
 
 let
   certs = import ./common/acme/server/snakeoil-certs.nix;
@@ -49,7 +55,7 @@ let
 in
 
 {
-  name = "opencloud";
+  inherit name;
 
   meta.maintainers = with lib.maintainers; [
     christoph-heiss
@@ -69,6 +75,7 @@ in
 
     services.opencloud = {
       enable = true;
+      package = opencloudPackage;
       url = "https://${domain}:9200";
       environment = {
         ADMIN_PASSWORD = adminPassword;
diff --git a/pkgs/by-name/op/opencloud/generic.nix b/pkgs/by-name/op/opencloud/generic.nix
index 4099ac3f1e65..4fb43e8a77cc 100644
--- a/pkgs/by-name/op/opencloud/generic.nix
+++ b/pkgs/by-name/op/opencloud/generic.nix
@@ -225,7 +225,7 @@ buildGoModule (finalAttrs: {
 
   passthru = {
     inherit web idp-web;
-    tests = { inherit (nixosTests) opencloud; }; # TODO: parametrize
+    tests = if production then nixosTests.opencloud-production else nixosTests.opencloud;
     updateScript = nix-update-script {
       extraArgs = nixUpdateExtraArgs ++ [
         "--version-regex"

From 25e71db801c5fcbb80b6b9c4715db2a732dbf2bf Mon Sep 17 00:00:00 2001
From: Philippe Loctaux <p@philippeloctaux.com>
Date: Fri, 21 Aug 2026 12:05:17 +0200
Subject: [PATCH 200/525] opencloud: refactor maintainers, add deadbaed

---
 pkgs/by-name/op/opencloud/generic.nix | 20 ++++++++------------
 1 file changed, 8 insertions(+), 12 deletions(-)

diff --git a/pkgs/by-name/op/opencloud/generic.nix b/pkgs/by-name/op/opencloud/generic.nix
index 4fb43e8a77cc..b69442b723e5 100644
--- a/pkgs/by-name/op/opencloud/generic.nix
+++ b/pkgs/by-name/op/opencloud/generic.nix
@@ -32,6 +32,11 @@
 }:
 
 let
+  maintainers = with lib.maintainers; [
+    christoph-heiss
+    k900
+    deadbaed
+  ];
   src = fetchFromGitHub {
     owner = "opencloud-eu";
     repo = "opencloud";
@@ -91,11 +96,8 @@ let
       homepage = "https://github.com/opencloud-eu/web";
       changelog = "https://github.com/opencloud-eu/web/blob/${finalAttrs.src.tag}/CHANGELOG.md";
       license = lib.licenses.agpl3Only;
-      maintainers = with lib.maintainers; [
-        christoph-heiss
-        k900
-      ];
       platforms = lib.platforms.all;
+      inherit maintainers;
     };
   });
 
@@ -141,11 +143,8 @@ let
       homepage = "https://github.com/opencloud-eu/opencloud";
       changelog = "https://github.com/opencloud-eu/opencloud/blob/${finalAttrs.src.tag}/CHANGELOG.md";
       license = lib.licenses.asl20;
-      maintainers = with lib.maintainers; [
-        christoph-heiss
-        k900
-      ];
       platforms = lib.platforms.all;
+      inherit maintainers;
     };
   });
 in
@@ -243,10 +242,7 @@ buildGoModule (finalAttrs: {
     homepage = "https://github.com/opencloud-eu/opencloud";
     changelog = "https://github.com/opencloud-eu/opencloud/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [
-      christoph-heiss
-      k900
-    ];
     mainProgram = "opencloud";
+    inherit maintainers;
   };
 })

From d4fb4924f7dacf72c451d9aa4676b035855d2589 Mon Sep 17 00:00:00 2001
From: Philippe Loctaux <p@philippeloctaux.com>
Date: Fri, 21 Aug 2026 11:26:44 +0200
Subject: [PATCH 201/525] nixos/modules/opencloud: require explicit package
 selection

explain upstream release cycle
---
 doc/release-notes/rl-2611.section.md          |  2 ++
 nixos/modules/services/web-apps/opencloud.nix | 10 +++++++++-
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index ca55c9aecfd4..ac9d47afdeeb 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -238,6 +238,8 @@
   [pnpm `fetcherVersion` section](#javascript-pnpm-fetcherVersion) of the manual
   for details.
 
+- `services.opencloud.package` now requires explicit package selection. Possibilities are `opencloud` (the previous default) and `opencloud-production` to reflect [upstream release cycle](https://docs.opencloud.eu/docs/admin/resources/lifecycle/).
+
 - `makeSetupHook` now uses structured attributes and only makes substitutions based on the values of the `substitutions` argument - other derivation attributes are no longer considered.
 
 - `rebuilderd` has been updated to 0.27.0 introducing breaking changes. See upstream changelog for details: [0.26.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.26.0), [0.27.0](https://github.com/kpcyrd/rebuilderd/releases/tag/v0.27.0)
diff --git a/nixos/modules/services/web-apps/opencloud.nix b/nixos/modules/services/web-apps/opencloud.nix
index 21b3a139ea6a..ae6609766704 100644
--- a/nixos/modules/services/web-apps/opencloud.nix
+++ b/nixos/modules/services/web-apps/opencloud.nix
@@ -19,7 +19,15 @@ in
     services.opencloud = {
       enable = lib.mkEnableOption "OpenCloud";
 
-      package = lib.mkPackageOption pkgs "opencloud" { };
+      package = lib.mkPackageOption pkgs "opencloud" {
+        default = null;
+        extraDescription = ''
+          OpenCloud has 2 release cycles, explained on https://docs.opencloud.eu/docs/admin/resources/lifecycle.
+
+          Use `pkgs.opencloud` package for the rolling release.
+          Use `pkgs.opencloud-production` package for the production release.
+        '';
+      };
       webPackage = lib.mkPackageOption pkgs [ "opencloud" "web" ] { };
       idpWebPackage = lib.mkPackageOption pkgs [ "opencloud" "idp-web" ] { };
 

From b836c03e5a6797bd312539d9e917f5d5095d92f5 Mon Sep 17 00:00:00 2001
From: Philippe Loctaux <p@philippeloctaux.com>
Date: Tue, 8 Sep 2026 22:36:22 +0200
Subject: [PATCH 202/525] nixos/modules/opencloud: make package for webPackage
 and idpWebPackage follow refactor

---
 nixos/modules/services/web-apps/opencloud.nix | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/web-apps/opencloud.nix b/nixos/modules/services/web-apps/opencloud.nix
index ae6609766704..d2789d0fedbb 100644
--- a/nixos/modules/services/web-apps/opencloud.nix
+++ b/nixos/modules/services/web-apps/opencloud.nix
@@ -28,8 +28,18 @@ in
           Use `pkgs.opencloud-production` package for the production release.
         '';
       };
-      webPackage = lib.mkPackageOption pkgs [ "opencloud" "web" ] { };
-      idpWebPackage = lib.mkPackageOption pkgs [ "opencloud" "idp-web" ] { };
+      webPackage = lib.mkOption {
+        type = lib.types.package;
+        default = config.services.opencloud.package.web;
+        defaultText = "config.services.opencloud.package.web";
+        description = "The web package to use.";
+      };
+      idpWebPackage = lib.mkOption {
+        type = lib.types.package;
+        default = config.services.opencloud.package.idp-web;
+        defaultText = "config.services.opencloud.package.idp-web";
+        description = "The idp-web package to use.";
+      };
 
       user = lib.mkOption {
         type = types.str;

From 0231cda67904fe8edcaa589369843ffcf614663e Mon Sep 17 00:00:00 2001
From: Philippe Loctaux <p@philippeloctaux.com>
Date: Sun, 4 Oct 2026 17:09:25 +0200
Subject: [PATCH 203/525] nixos/modules/opencloud: document upstream does not
 support downgrades, help users make choice when choosing package

---
 doc/release-notes/rl-2611.section.md          | 3 +++
 nixos/modules/services/web-apps/opencloud.nix | 6 ++++--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/doc/release-notes/rl-2611.section.md b/doc/release-notes/rl-2611.section.md
index ac9d47afdeeb..0e271dc6bd08 100644
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -239,6 +239,9 @@
   for details.
 
 - `services.opencloud.package` now requires explicit package selection. Possibilities are `opencloud` (the previous default) and `opencloud-production` to reflect [upstream release cycle](https://docs.opencloud.eu/docs/admin/resources/lifecycle/).
+ - Users updating from `nixos-26.05` will prefer the new `opencloud-production` package.
+ - Users updating from `nixos-unstable` will prefer to keep using the existing `opencloud` package.
+ - Please note upstream does not support downgrading existing installations. Switching from `opencloud` to `opencloud-production` is considered a downgrade.
 
 - `makeSetupHook` now uses structured attributes and only makes substitutions based on the values of the `substitutions` argument - other derivation attributes are no longer considered.
 
diff --git a/nixos/modules/services/web-apps/opencloud.nix b/nixos/modules/services/web-apps/opencloud.nix
index d2789d0fedbb..cacb7ac7eb85 100644
--- a/nixos/modules/services/web-apps/opencloud.nix
+++ b/nixos/modules/services/web-apps/opencloud.nix
@@ -24,8 +24,10 @@ in
         extraDescription = ''
           OpenCloud has 2 release cycles, explained on https://docs.opencloud.eu/docs/admin/resources/lifecycle.
 
-          Use `pkgs.opencloud` package for the rolling release.
-          Use `pkgs.opencloud-production` package for the production release.
+          Use `pkgs.opencloud` package for the rolling release (every 3 weeks).
+          Use `pkgs.opencloud-production` package for the production release (about every 6 months).
+
+          OpenCloud does not support downgrading existing installations. Switching from `pkgs.opencloud` to `pkgs.opencloud-production` is considered a downgrade.
         '';
       };
       webPackage = lib.mkOption {

From e1fd73e425df244b1e5fb921eb4add54dbae8f3b Mon Sep 17 00:00:00 2001
From: Andrew Marshall <andrew@johnandrewmarshall.com>
Date: Thu, 8 Oct 2026 15:24:20 -0400
Subject: [PATCH 204/525] python3Packages.cuda-tile: fix build with newer glibc

See comment in patch for details.

Assisted-by: Deepseek V4.1 Flash (Pi)
---
 .../python-modules/cuda-tile/default.nix      |  4 ++++
 .../xla_ffi-include-python-first.patch        | 21 +++++++++++++++++++
 2 files changed, 25 insertions(+)
 create mode 100644 pkgs/development/python-modules/cuda-tile/xla_ffi-include-python-first.patch

diff --git a/pkgs/development/python-modules/cuda-tile/default.nix b/pkgs/development/python-modules/cuda-tile/default.nix
index 639f44217785..a47e2bbf8fd2 100644
--- a/pkgs/development/python-modules/cuda-tile/default.nix
+++ b/pkgs/development/python-modules/cuda-tile/default.nix
@@ -46,6 +46,10 @@ buildPythonPackage.override { stdenv = cudaPackages.backendStdenv; } (finalAttrs
     hash = "sha256-R5V69nJLQ3/1995ezH1/WuueA6cm1vhKZdOECqbwPbU=";
   };
 
+  patches = [
+    ./xla_ffi-include-python-first.patch
+  ];
+
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail "setuptools==80.10.2" "setuptools"
diff --git a/pkgs/development/python-modules/cuda-tile/xla_ffi-include-python-first.patch b/pkgs/development/python-modules/cuda-tile/xla_ffi-include-python-first.patch
new file mode 100644
index 000000000000..dbd23d81d14f
--- /dev/null
+++ b/pkgs/development/python-modules/cuda-tile/xla_ffi-include-python-first.patch
@@ -0,0 +1,21 @@
+Include Python.h before any glibc header in xla_ffi.cpp
+
+g++ defines _GNU_SOURCE, so glibc 2.44's features.h now defines
+_POSIX_C_SOURCE/_XOPEN_SOURCE. xla_ffi.cpp includes c_api.h (-> stdint.h ->
+features.h) before py.h/Python.h, so Python's pyconfig.h then redefines
+those macros, which the project's -Werror turns into a build failure.
+
+Include Python.h first so pyconfig.h sets the macros before features.h,
+which #undefs before redefining them.
+
+--- a/cext/xla_ffi.cpp
++++ b/cext/xla_ffi.cpp
+@@ -2,6 +2,8 @@
+ //
+ // SPDX-License-Identifier: Apache-2.0
+ 
++#include <Python.h>
++
+ #ifdef _WIN32
+ 
+ #include "xla/ffi/api/c_api.h"

From f8a6cc0f52a45ca8342c98860df7471bf1077e9c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 8 Oct 2026 21:21:22 +0000
Subject: [PATCH 205/525] python3Packages.dtw-python: 1.7.5 -> 1.9.0

---
 pkgs/development/python-modules/dtw-python/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dtw-python/default.nix b/pkgs/development/python-modules/dtw-python/default.nix
index c6fb04539644..b55abe826b7b 100644
--- a/pkgs/development/python-modules/dtw-python/default.nix
+++ b/pkgs/development/python-modules/dtw-python/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "dtw-python";
-  version = "1.7.5";
+  version = "1.9.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "DynamicTimeWarping";
     repo = "dtw-python";
     tag = "v${version}";
-    hash = "sha256-4OP6Fop04HLHURUagLMW4D93zTv9FwAtZ6xyNFbJILA=";
+    hash = "sha256-H0eYRS8cMz8pTRm4pmSX8RPkTxC7uMGArxTsmbSsL2E=";
   };
 
   build-system = [

From 4ec1839d42471fe04134923643242cfde308e56c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 8 Oct 2026 21:46:29 +0000
Subject: [PATCH 206/525] python3Packages.fastjet: 3.5.1.4 -> 3.5.2.0

---
 pkgs/development/python-modules/fastjet/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/fastjet/default.nix b/pkgs/development/python-modules/fastjet/default.nix
index b74816bc1269..6fe940ed4b32 100644
--- a/pkgs/development/python-modules/fastjet/default.nix
+++ b/pkgs/development/python-modules/fastjet/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "fastjet";
-  version = "3.5.1.4";
+  version = "3.5.2.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -33,7 +33,7 @@ buildPythonPackage (finalAttrs: {
     repo = "fastjet";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-Q2ukR7aA12d0+mRm/y8hAMpOo3vRkFo3B/fx6XChARI=";
+    hash = "sha256-uR7HK00s3uuojJ2x5LmNhvJHJ+umCOua4SUXafH0NEk=";
   };
 
   build-system = [

From ec0c919e221dfcff01fd57f5c013fa8f0549960e Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Thu, 8 Oct 2026 18:56:32 -0400
Subject: [PATCH 207/525] python3Packages.pypdfium2: 5.13.0 -> 5.14.0

Assisted-by: GPT-6.1-Sol medium
---
 .../python-modules/pypdfium2/default.nix      | 43 +++++++++----------
 1 file changed, 21 insertions(+), 22 deletions(-)

diff --git a/pkgs/development/python-modules/pypdfium2/default.nix b/pkgs/development/python-modules/pypdfium2/default.nix
index 1afeb15d1181..b11d48aa9d87 100644
--- a/pkgs/development/python-modules/pypdfium2/default.nix
+++ b/pkgs/development/python-modules/pypdfium2/default.nix
@@ -5,7 +5,8 @@
   buildPythonPackage,
   fetchFromGitHub,
   gitUpdater,
-  setuptools-scm,
+  packaging,
+  setuptools,
   pdfium,
   numpy,
   pillow,
@@ -15,42 +16,37 @@
 }:
 
 let
-  # They demand their own fork of ctypesgen
-  ctypesgen = buildPythonPackage rec {
-    pname = "ctypesgen";
-    version = "1.1.1+g${src.rev}"; # the most recent tag + git version
-    pyproject = true;
-
-    src = fetchFromGitHub {
-      owner = "pypdfium2-team";
-      repo = "ctypesgen";
-      rev = "3961621c3e057015362db82471e07f3a57822b15";
-      hash = "sha256-0OBY7/Zn12rG20jNYG65lANTRVRIFvE0SgUdYGFpRtU=";
-    };
-
-    build-system = [
-      setuptools-scm
-    ];
+  # Use the fork revision bundled with this release's source distribution.
+  ctypesgen = fetchFromGitHub {
+    owner = "pypdfium2-team";
+    repo = "ctypesgen";
+    rev = "4ddc2b2cdc4daefb0be450e8b5152e11337e9e3c";
+    hash = "sha256-S98kIimLZa3wJ5aKlADYOkqxsOhUlLqLHogC7Id0vVo=";
   };
-
 in
 buildPythonPackage rec {
   pname = "pypdfium2";
-  version = "5.13.0";
+  version = "5.14.0";
   pyproject = true;
 
+  # Use GitHub because the PyPI source distribution excludes the test suite.
   src = fetchFromGitHub {
     owner = "pypdfium2-team";
     repo = "pypdfium2";
     tag = version;
-    hash = "sha256-DbCbJUvYzjWIlGJyrUbJfzebHrPpRFEx60DYqs1UrkQ=";
+    hash = "sha256-KnZkIbV1ke0tL+VdUOkHElZXVrJixNBBoD0fpLPHNbY=";
   };
 
   build-system = [
-    ctypesgen
-    setuptools-scm
+    packaging
+    setuptools
   ];
 
+  postPatch = ''
+    mkdir -p deps
+    ln -s ${ctypesgen} deps/ctypesgen
+  '';
+
   nativeBuildInputs = [
     removeReferencesTo
   ];
@@ -78,6 +74,9 @@ buildPythonPackage rec {
     pytestCheckHook
   ];
 
+  # Avoid collecting ctypesgen's tests, which also define tests.conftest.
+  enabledTestPaths = [ "tests" ];
+
   disabledTestPaths = [
     # does not work on ZFS with normalization
     "tests/test_opener.py::test_open_garbled_filename"

From 6c1afaf3b1028c953d90becd3c78fbb956ce24b6 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Thu, 8 Oct 2026 18:56:43 -0400
Subject: [PATCH 208/525] python3Packages.pypdfium2: update ctypesgen with
 releases

Assisted-by: GPT-6.1-Sol medium
---
 .../python-modules/pypdfium2/default.nix      | 31 ++++++++++--
 .../python-modules/pypdfium2/update.sh        | 50 +++++++++++++++++++
 2 files changed, 77 insertions(+), 4 deletions(-)
 create mode 100644 pkgs/development/python-modules/pypdfium2/update.sh

diff --git a/pkgs/development/python-modules/pypdfium2/default.nix b/pkgs/development/python-modules/pypdfium2/default.nix
index b11d48aa9d87..fbeaa7e823e9 100644
--- a/pkgs/development/python-modules/pypdfium2/default.nix
+++ b/pkgs/development/python-modules/pypdfium2/default.nix
@@ -3,8 +3,16 @@
   lib,
   pkgsCross,
   buildPythonPackage,
+  common-updater-scripts,
+  coreutils,
+  curl,
+  diffutils,
   fetchFromGitHub,
-  gitUpdater,
+  gnutar,
+  gzip,
+  jq,
+  nix,
+  nix-update,
   packaging,
   setuptools,
   pdfium,
@@ -13,6 +21,7 @@
   pytestCheckHook,
   removeReferencesTo,
   python,
+  writeShellApplication,
 }:
 
 let
@@ -87,9 +96,23 @@ buildPythonPackage rec {
   ];
 
   passthru = {
-    updateScript = gitUpdater {
-      allowedVersions = "^[.0-9]+$";
-    };
+    inherit ctypesgen;
+
+    updateScript = lib.getExe (writeShellApplication {
+      name = "pypdfium2-update";
+      runtimeInputs = [
+        common-updater-scripts
+        coreutils
+        curl
+        diffutils
+        gnutar
+        gzip
+        jq
+        nix
+        nix-update
+      ];
+      text = builtins.readFile ./update.sh;
+    });
     tests.cross = pkgsCross.aarch64-multiplatform.python3Packages.pypdfium2;
   };
 
diff --git a/pkgs/development/python-modules/pypdfium2/update.sh b/pkgs/development/python-modules/pypdfium2/update.sh
new file mode 100644
index 000000000000..0cf55c18bdd5
--- /dev/null
+++ b/pkgs/development/python-modules/pypdfium2/update.sh
@@ -0,0 +1,50 @@
+nix-update "$UPDATE_NIX_ATTR_PATH" --version-regex='^([0-9.]+)$' "$@"
+
+version=$(nix eval --raw --file . "$UPDATE_NIX_ATTR_PATH.version")
+release_date=$(
+  curl -fsSL "https://api.github.com/repos/pypdfium2-team/pypdfium2/commits/$version" |
+    jq -er '.commit.committer.date'
+)
+
+# The fork has no release tags. Select its head at the time of the release,
+# then verify it against the source bundled in the published distribution.
+rev=$(
+  curl -fsSL --get "https://api.github.com/repos/pypdfium2-team/ctypesgen/commits" \
+    --data-urlencode 'sha=pypdfium2' \
+    --data-urlencode "until=$release_date" \
+    --data-urlencode 'per_page=1' |
+    jq -er '.[0].sha'
+)
+
+sdist_url=$(
+  curl -fsSL "https://pypi.org/pypi/pypdfium2/$version/json" |
+    jq -er '.urls[] | select(.packagetype == "sdist") | .url'
+)
+
+workdir=$(mktemp -d)
+trap 'rm -rf "$workdir"' EXIT
+
+extract_archive() {
+  local url="$1"
+  local destination="$2"
+
+  mkdir -p "$destination"
+  curl -fsSL "$url" | tar -xz --strip-components=1 -C "$destination"
+}
+
+extract_archive "$sdist_url" "$workdir/pypdfium2"
+extract_archive "https://github.com/pypdfium2-team/ctypesgen/archive/$rev.tar.gz" "$workdir/ctypesgen"
+
+if ! diff -qr "$workdir/pypdfium2/deps/ctypesgen/src" "$workdir/ctypesgen/src"; then
+  echo "ctypesgen $rev does not match the source bundled with pypdfium2 $version" >&2
+  exit 1
+fi
+
+current_rev=$(nix eval --raw --file . "$UPDATE_NIX_ATTR_PATH.ctypesgen.rev")
+if [[ "$rev" != "$current_rev" ]]; then
+  update-source-version \
+    "$UPDATE_NIX_ATTR_PATH" \
+    --source-key=ctypesgen \
+    --rev="$rev" \
+    --ignore-same-version
+fi

From 15f2aabf00254dd06d3b4810d6709a25800a9d81 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 9 Oct 2026 00:00:05 +0000
Subject: [PATCH 209/525] frida-tools: 14.10.4 -> 14.11.0

---
 pkgs/by-name/fr/frida-tools/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fr/frida-tools/package.nix b/pkgs/by-name/fr/frida-tools/package.nix
index c432e3780099..54cb3e99a6e5 100644
--- a/pkgs/by-name/fr/frida-tools/package.nix
+++ b/pkgs/by-name/fr/frida-tools/package.nix
@@ -6,13 +6,13 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "frida-tools";
-  version = "14.10.4";
+  version = "14.11.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) version;
     pname = "frida_tools";
-    hash = "sha256-eixUS1RdCVBA//vTdoooekJjQ9rYkJW0ok9LIDgtkmo=";
+    hash = "sha256-uMdy5ZUCvkO3bfn+zK3V00K1yjJQZt0MI4TmP6iNqSE=";
   };
 
   build-system = with python3Packages; [

From f9e9489b9f2f2d3b2a46a7d635f05feec458c0e2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 9 Oct 2026 01:34:49 +0000
Subject: [PATCH 210/525] python3Packages.nvidia-ml-py: 13.610.43 -> 13.615.71

---
 pkgs/development/python-modules/nvidia-ml-py/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/nvidia-ml-py/default.nix b/pkgs/development/python-modules/nvidia-ml-py/default.nix
index abe4a675a1ca..9afbab7bf7cd 100644
--- a/pkgs/development/python-modules/nvidia-ml-py/default.nix
+++ b/pkgs/development/python-modules/nvidia-ml-py/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "nvidia-ml-py";
-  version = "13.610.43";
+  version = "13.615.71";
   pyproject = true;
   __structuredAttrs = true;
 
   src = fetchPypi {
     pname = "nvidia_ml_py";
     inherit (finalAttrs) version;
-    hash = "sha256-ZUN+tz1o0MYskxyk1FA4Ry+v8DvQuHKau6S4mfcNYPI=";
+    hash = "sha256-vr5OSPUbHcdQKMCBXLe/oUoxpbuAvnDJ2YDGA2lT/D0=";
   };
 
   patches = [

From 9d734df99868919a02aea75516a2991ba8db5ecf Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Fri, 9 Oct 2026 13:36:12 +0700
Subject: [PATCH 211/525] casacore: fix build with GCC 16

---
 pkgs/by-name/ca/casacore/package.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/ca/casacore/package.nix b/pkgs/by-name/ca/casacore/package.nix
index 13323464fef4..e3bb41b2d06b 100644
--- a/pkgs/by-name/ca/casacore/package.nix
+++ b/pkgs/by-name/ca/casacore/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   gfortran,
   flex,
@@ -87,6 +88,13 @@ stdenv.mkDerivation (finalAttrs: {
     # leaving it empty, and remove hardcoded absolute cmake build paths from
     # Cflags (which would embed /nix/store paths from the build environment).
     ./casacore-pkgconfig.patch
+
+    # Fix undefined Dysco encoder template symbols with GCC 16
+    (fetchpatch {
+      url = "https://github.com/casacore/casacore/commit/60923a924d6380de04ee32042290c7e7426e3509.patch";
+      includes = [ "tables/Dysco/*" ];
+      hash = "sha256-j/Ukc6hvfGpWTlw3YZDjgu/UihFxfOoHMatpPP9KcO8=";
+    })
   ];
 
   enableParallelBuilding = true;

From 10f77e6e8de0690fd337104beef1fc7da894913f Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Fri, 9 Oct 2026 10:21:11 +0200
Subject: [PATCH 212/525] nixos/test-driver: fix for ty 0.0.85

We're supposed to return `Generator[T]` rather than `Iterator[T]` for
contextmanagers now.
---
 .../lib/test-driver/src/test_driver/driver.py |  4 ++--
 .../lib/test-driver/src/test_driver/logger.py | 22 +++++++++----------
 2 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/nixos/lib/test-driver/src/test_driver/driver.py b/nixos/lib/test-driver/src/test_driver/driver.py
index a3891313b817..7903e7e5c266 100644
--- a/nixos/lib/test-driver/src/test_driver/driver.py
+++ b/nixos/lib/test-driver/src/test_driver/driver.py
@@ -9,7 +9,7 @@ import tempfile
 import threading
 import traceback
 import warnings
-from collections.abc import Callable, Generator, Iterator
+from collections.abc import Callable, Generator
 from contextlib import AbstractContextManager, contextmanager
 from dataclasses import dataclass
 from pathlib import Path
@@ -314,7 +314,7 @@ class Driver:
 
     def test_symbols(self) -> dict[str, Any]:
         @contextmanager
-        def subtest(name: str) -> Iterator[None]:
+        def subtest(name: str) -> Generator[None]:
             return self.subtest(name)
 
         general_symbols = dict(
diff --git a/nixos/lib/test-driver/src/test_driver/logger.py b/nixos/lib/test-driver/src/test_driver/logger.py
index 7b786b351417..517a30a67876 100644
--- a/nixos/lib/test-driver/src/test_driver/logger.py
+++ b/nixos/lib/test-driver/src/test_driver/logger.py
@@ -4,7 +4,7 @@ import sys
 import time
 import unicodedata
 from abc import ABC, abstractmethod
-from collections.abc import Iterator
+from collections.abc import Generator
 from contextlib import ExitStack, contextmanager
 from enum import IntEnum
 from pathlib import Path
@@ -31,12 +31,12 @@ class AbstractLogger(ABC):
 
     @abstractmethod
     @contextmanager
-    def subtest(self, name: str, attributes: dict[str, str] = {}) -> Iterator[None]:
+    def subtest(self, name: str, attributes: dict[str, str] = {}) -> Generator[None]:
         pass
 
     @abstractmethod
     @contextmanager
-    def nested(self, message: str, attributes: dict[str, str] = {}) -> Iterator[None]:
+    def nested(self, message: str, attributes: dict[str, str] = {}) -> Generator[None]:
         pass
 
     @abstractmethod
@@ -94,7 +94,7 @@ class JunitXMLLogger(AbstractLogger):
             self.tests[self.currentSubtest].stdout += message + os.linesep
 
     @contextmanager
-    def subtest(self, name: str, attributes: dict[str, str] = {}) -> Iterator[None]:
+    def subtest(self, name: str, attributes: dict[str, str] = {}) -> Generator[None]:
         old_test = self.currentSubtest
         self.tests.setdefault(name, self.TestCaseState())
         self.currentSubtest = name
@@ -104,7 +104,7 @@ class JunitXMLLogger(AbstractLogger):
         self.currentSubtest = old_test
 
     @contextmanager
-    def nested(self, message: str, attributes: dict[str, str] = {}) -> Iterator[None]:
+    def nested(self, message: str, attributes: dict[str, str] = {}) -> Generator[None]:
         self.log(message)
         yield
 
@@ -185,14 +185,14 @@ class CompositeLogger(AbstractLogger):
             logger.log(message, attributes)
 
     @contextmanager
-    def subtest(self, name: str, attributes: dict[str, str] = {}) -> Iterator[None]:
+    def subtest(self, name: str, attributes: dict[str, str] = {}) -> Generator[None]:
         with ExitStack() as stack:
             for logger in self.logger_list:
                 stack.enter_context(logger.subtest(name, attributes))
             yield
 
     @contextmanager
-    def nested(self, message: str, attributes: dict[str, str] = {}) -> Iterator[None]:
+    def nested(self, message: str, attributes: dict[str, str] = {}) -> Generator[None]:
         with ExitStack() as stack:
             for logger in self.logger_list:
                 stack.enter_context(logger.nested(message, attributes))
@@ -250,12 +250,12 @@ class TerminalLogger(AbstractLogger):
         self._eprint(self.maybe_prefix(message, attributes))
 
     @contextmanager
-    def subtest(self, name: str, attributes: dict[str, str] = {}) -> Iterator[None]:
+    def subtest(self, name: str, attributes: dict[str, str] = {}) -> Generator[None]:
         with self.nested("subtest: " + name, attributes):
             yield
 
     @contextmanager
-    def nested(self, message: str, attributes: dict[str, str] = {}) -> Iterator[None]:
+    def nested(self, message: str, attributes: dict[str, str] = {}) -> Generator[None]:
         self._eprint(
             self.maybe_prefix(
                 Style.BRIGHT + Fore.GREEN + message + Style.RESET_ALL,  # ty: ignore[unsupported-operator]
@@ -381,12 +381,12 @@ class XMLLogger(AbstractLogger):
             pass
 
     @contextmanager
-    def subtest(self, name: str, attributes: dict[str, str] = {}) -> Iterator[None]:
+    def subtest(self, name: str, attributes: dict[str, str] = {}) -> Generator[None]:
         with self.nested("subtest: " + name, attributes):
             yield
 
     @contextmanager
-    def nested(self, message: str, attributes: dict[str, str] = {}) -> Iterator[None]:
+    def nested(self, message: str, attributes: dict[str, str] = {}) -> Generator[None]:
         self.xml.startElement("nest", attrs=AttributesImpl({}))
         self.xml.startElement("head", attrs=AttributesImpl(attributes))
         self.xml.characters(message)

From a77355c2989c3e4912617fc339aad0823b822e0a Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Fri, 9 Oct 2026 09:51:27 +0200
Subject: [PATCH 213/525] Reapply "ty: 0.0.84 -> 0.0.85"

This reverts commit 3aa2b8bea01afc1edd08c04ca33bed3a36ad86fd.
---
 pkgs/by-name/ty/ty/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix
index 32be3bc337dd..5c30334da081 100644
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -18,7 +18,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.84";
+  version = "0.0.85";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-nIk35Ih3xuGHx06Cxaiw1gkClwfQ+sW61XbbwkU/+ds=";
+    hash = "sha256-vweZOl2P72ruvDh7RuDkhdYFT/ejAUw7l+aJwsjlL7o=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -40,7 +40,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-iF+KUQMeACujyPoVRxjzslg7cmUFoYF+kXEWqIMaTqI=";
+  cargoHash = "sha256-j6A7j/bPHlIXU4BA7B8pNi2LAaCFL0B9ILDDCPE2GUU=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = [ rust-jemalloc-sys ];

From da3e319f54f3164c54e0bb6fcd879801f4466a76 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 9 Oct 2026 09:07:47 +0000
Subject: [PATCH 214/525] python3Packages.lizard: 1.24.0 -> 1.24.1

---
 pkgs/development/python-modules/lizard/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/lizard/default.nix b/pkgs/development/python-modules/lizard/default.nix
index 9f3447e0ecb1..145b063c40fe 100644
--- a/pkgs/development/python-modules/lizard/default.nix
+++ b/pkgs/development/python-modules/lizard/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "lizard";
-  version = "1.24.0";
+  version = "1.24.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "terryyin";
     repo = "lizard";
     tag = finalAttrs.version;
-    hash = "sha256-npxnl9QrsAMLgrSDGsmWTb17VLwJ9sYCi9dhROCblhg=";
+    hash = "sha256-vVnk/GMPiLwnFiRD8IA08u5zS2f85cTcbQTPUnc58f4=";
   };
 
   build-system = [ setuptools ];

From b96b01355740cf4261da47dadf8d60626e6f7cd8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 9 Oct 2026 09:15:40 +0000
Subject: [PATCH 215/525] python3Packages.firebase-admin: 7.6.0 -> 7.7.0

---
 pkgs/development/python-modules/firebase-admin/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/firebase-admin/default.nix b/pkgs/development/python-modules/firebase-admin/default.nix
index 8e95d23de5af..e089a99e1794 100644
--- a/pkgs/development/python-modules/firebase-admin/default.nix
+++ b/pkgs/development/python-modules/firebase-admin/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "firebase-admin";
-  version = "7.6.0";
+  version = "7.7.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "firebase";
     repo = "firebase-admin-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-y+7EXenVmBfd1IDBRzen1tNiralQkVQPadXmhY1N03k=";
+    hash = "sha256-epAACgTYIe4hgWXgXgKGjDwpMrhxVS3Kml8s/Ij4P5Y=";
   };
 
   build-system = [ setuptools ];

From d3e1e970479014ac4678f72ab3f01afa537320cb Mon Sep 17 00:00:00 2001
From: Adam Dinwoodie <adam@dinwoodie.org>
Date: Fri, 9 Oct 2026 10:35:05 +0100
Subject: [PATCH 216/525] git: withBreakingChanges requires rustSupport

Add a check to ensure that, if the `withBreakingChanges` flag is true
when defining the `git` derivation, `rustSupport` is also true.

Currently, Git will build with its breaking changes build flag enabled
and with rust support disabled.  However, one of the breaking changes
that is planned for Git v3 is to require Rust support, so make our
`withBreakingChanges` flag enforce that requirement too.
---
 pkgs/by-name/gi/git/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/gi/git/package.nix b/pkgs/by-name/gi/git/package.nix
index 0356eed7243a..b84bf8a6c4d6 100644
--- a/pkgs/by-name/gi/git/package.nix
+++ b/pkgs/by-name/gi/git/package.nix
@@ -62,6 +62,7 @@
 assert osxkeychainSupport -> stdenv.hostPlatform.isDarwin;
 assert sendEmailSupport -> perlSupport;
 assert svnSupport -> perlSupport;
+assert withBreakingChanges -> rustSupport;
 
 let
   version = "2.55.0";

From 1916e09d2019a6a7bd68f4444451e9f15f6de61e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 9 Oct 2026 12:43:16 +0000
Subject: [PATCH 217/525] python3Packages.raygeo: 1.53.0 -> 1.61.0

---
 pkgs/development/python-modules/raygeo/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/raygeo/default.nix b/pkgs/development/python-modules/raygeo/default.nix
index 0a3922e2374a..934b54d47c28 100644
--- a/pkgs/development/python-modules/raygeo/default.nix
+++ b/pkgs/development/python-modules/raygeo/default.nix
@@ -15,17 +15,17 @@
 
 buildPythonPackage rec {
   pname = "raygeo";
-  version = "1.53.0";
+  version = "1.61.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-J+K+dj+72RLkV2DQgbGMQanf23HdQnHfBYkTRnC9F5w=";
+    hash = "sha256-4oy/gCMPGAAcuJVSQBduagw6AHCRXP/WpuL5UJ0sxpQ=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-svCZ63IdEbb7wIXPX9n2zsXyG88d49/LIzSjv4LbEgE=";
+    hash = "sha256-OxnLS0MbhfpNNJ6l0XNCdcBLU8S9JmpgYTr9sdzlkHQ=";
   };
 
   nativeBuildInputs = [

From 15ba94a44988901c97248e006e168985dc8a589a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 9 Oct 2026 12:45:28 +0000
Subject: [PATCH 218/525] python3Packages.ruida-pa: 0.20.4 -> 0.22.0

---
 pkgs/development/python-modules/ruida-pa/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/ruida-pa/default.nix b/pkgs/development/python-modules/ruida-pa/default.nix
index 0fd86c48bf3c..1b344d952392 100644
--- a/pkgs/development/python-modules/ruida-pa/default.nix
+++ b/pkgs/development/python-modules/ruida-pa/default.nix
@@ -11,13 +11,13 @@
 
 buildPythonPackage rec {
   pname = "ruida-pa";
-  version = "0.20.4";
+  version = "0.22.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "ruida_pa";
     inherit version;
-    hash = "sha256-qvIdg0qkOmIn0ydapleONZHazueO6jzcB+PpsuiW02w=";
+    hash = "sha256-+O1lB9N5xPWU5EZRkj6Eo54Vvp6H4h/GdXUt1rWJesc=";
   };
 
   build-system = [ setuptools ];

From 4d95472a7956bd5bcfaa63755b8cf05fecf36026 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 9 Oct 2026 12:51:24 +0000
Subject: [PATCH 219/525] graphicsmagick: 1.3.48 -> 1.3.49

---
 pkgs/by-name/gr/graphicsmagick/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gr/graphicsmagick/package.nix b/pkgs/by-name/gr/graphicsmagick/package.nix
index 29e669edc997..c403b3f9b1e4 100644
--- a/pkgs/by-name/gr/graphicsmagick/package.nix
+++ b/pkgs/by-name/gr/graphicsmagick/package.nix
@@ -28,11 +28,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "graphicsmagick";
-  version = "1.3.48";
+  version = "1.3.49";
 
   src = fetchurl {
     url = "mirror://sourceforge/graphicsmagick/GraphicsMagick-${finalAttrs.version}.tar.xz";
-    hash = "sha256-khjreBeREPkTcQZqt1yztN0DS5u0ZLKc6bq3oRl5Iys=";
+    hash = "sha256-fvoHDcMRFrQxUGGzn4S8cYHosGC/YSFOya+FETGvnIE=";
   };
 
   outputs = [

From 2c0ebe772c494c9063eeb06af6d975d5afae22c5 Mon Sep 17 00:00:00 2001
From: BenZuckier <ben.zuckier@anterior.com>
Date: Fri, 9 Oct 2026 10:06:12 -0400
Subject: [PATCH 220/525] libreoffice: check writeable dir for dbus address
 fallback

---
 pkgs/applications/office/libreoffice/wrapper.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/office/libreoffice/wrapper.nix b/pkgs/applications/office/libreoffice/wrapper.nix
index 165482e3bf16..447e86780597 100644
--- a/pkgs/applications/office/libreoffice/wrapper.nix
+++ b/pkgs/applications/office/libreoffice/wrapper.nix
@@ -100,7 +100,12 @@ let
       (lib.escapeShellArg ''
         if ! ( test -n "$DBUS_SESSION_BUS_ADDRESS" ); then
             dbus_tmp_dir="/run/user/$(id -u)/libreoffice-dbus"
-            if ! test -d "$dbus_tmp_dir" && test -d "/run"; then
+            # Sometimes /run exists but is not writeable, (like when running in
+            # a linux builder on darwin) giving
+            # `mkdir: cannot create directory '/run/user': Permission denied`
+            # instead of going to the next fallback.  Ensure we test with `-w`
+            # and not `-d`.
+            if ! test -d "$dbus_tmp_dir" && test -w "/run"; then
                     mkdir -p "$dbus_tmp_dir"
             fi
             if ! test -d "$dbus_tmp_dir"; then

From c65e0725e2e0019c25a8f489a44fae311a2e37b9 Mon Sep 17 00:00:00 2001
From: Pascal Dietrich <cameo007@mintux.de>
Date: Fri, 9 Oct 2026 17:41:31 +0200
Subject: [PATCH 221/525] bulwark: 1.12.0 -> 1.13.0

---
 pkgs/by-name/bu/bulwark/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/bu/bulwark/package.nix b/pkgs/by-name/bu/bulwark/package.nix
index 3778fae6c781..3fbf044c8122 100644
--- a/pkgs/by-name/bu/bulwark/package.nix
+++ b/pkgs/by-name/bu/bulwark/package.nix
@@ -10,13 +10,13 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "bulwark";
-  version = "1.12.0";
+  version = "1.13.0";
 
   src = fetchFromGitHub {
     owner = "bulwarkmail";
     repo = "webmail";
     tag = finalAttrs.version;
-    hash = "sha256-Lt25tZBtxhqMiSM8lYP3M3MIQEItRC3L360WOEYTL84=";
+    hash = "sha256-oEpJj5w4nb3bp5WDmukn0Xn/OCZL3Clz1K2F09kJYWY=";
     leaveDotGit = true;
     postFetch = ''
       cd "$out"
@@ -24,7 +24,7 @@ buildNpmPackage (finalAttrs: {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  npmDepsHash = "sha256-9p9Dn20U//UpFrDV/dksjWkfTD8almHR07lHF5Vtm8g=";
+  npmDepsHash = "sha256-ufEJsieashae6hAvRDowEOG6yD178lCr+228KhZ41lk=";
 
   strictDeps = true;
 

From 9e527fe9d96c5ee460b2c660beb6a08241fa676c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 9 Oct 2026 15:44:55 +0000
Subject: [PATCH 222/525] python3Packages.python-calamine: 0.6.0 -> 0.8.3

---
 pkgs/development/python-modules/python-calamine/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/python-calamine/default.nix b/pkgs/development/python-modules/python-calamine/default.nix
index a9adcbd8bb8d..ffadaa09d098 100644
--- a/pkgs/development/python-modules/python-calamine/default.nix
+++ b/pkgs/development/python-modules/python-calamine/default.nix
@@ -13,19 +13,19 @@
 
 buildPythonPackage rec {
   pname = "python-calamine";
-  version = "0.6.0";
+  version = "0.8.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dimastbk";
     repo = "python-calamine";
     tag = "v${version}";
-    hash = "sha256-vPI2SWOMwEpN0w7BWvFFz1eeXiU9t4xhdl3TpO39l/Q=";
+    hash = "sha256-7P75jGsBMfdC6AusyRTdOx0NA3kadReacLUm9tY551g=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-DR84RulbTpwipYKHLtXdCa8Yr2Irv1W1o3NrCT8FRq4=";
+    hash = "sha256-ESp1ig2IQqN3TOcAMQ1vHCeeJMuj3cYs0O+8w8NA/2k=";
   };
 
   buildInputs = [ libiconv ];

From 26e8f4e85ab3d5165199a8522bb9acaf9a1f098d Mon Sep 17 00:00:00 2001
From: AlexAntonik <antonikavv@gmail.com>
Date: Fri, 9 Oct 2026 20:10:37 +0300
Subject: [PATCH 223/525] python3Packages.pystray: fix license

Signed-off-by: AlexAntonik <antonikavv@gmail.com>
---
 pkgs/development/python-modules/pystray/default.nix | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/pystray/default.nix b/pkgs/development/python-modules/pystray/default.nix
index 107d5508098c..b7e72d47950d 100644
--- a/pkgs/development/python-modules/pystray/default.nix
+++ b/pkgs/development/python-modules/pystray/default.nix
@@ -73,10 +73,7 @@ buildPythonPackage rec {
   meta = {
     homepage = "https://github.com/moses-palmer/pystray";
     description = "This library allows you to create a system tray icon";
-    license = with lib.licenses; [
-      gpl3Plus
-      lgpl3Plus
-    ];
+    license = lib.licenses.lgpl3Plus;
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ jojosch ];
   };

From 95a012f007f2207ddb9ba34a87367c3bcf9632b3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 9 Oct 2026 11:21:39 -0700
Subject: [PATCH 224/525] libdeltachat: 2.62.0 -> 2.63.0

Diff: https://github.com/chatmail/core/compare/v2.62.0...v2.63.0

Changelog: https://github.com/chatmail/core/blob/v2.63.0/CHANGELOG.md
---
 pkgs/by-name/li/libdeltachat/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/libdeltachat/package.nix b/pkgs/by-name/li/libdeltachat/package.nix
index e7d1c3d07b90..44cc70529349 100644
--- a/pkgs/by-name/li/libdeltachat/package.nix
+++ b/pkgs/by-name/li/libdeltachat/package.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libdeltachat";
-  version = "2.62.0";
+  version = "2.63.0";
 
   src = fetchFromGitHub {
     owner = "chatmail";
     repo = "core";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qjbxxcOvHkb8g4IMWXYXmnYhbEx3G5ptiysOvpTcCCI=";
+    hash = "sha256-asnP4ODHmbKb5coX1SSa5hdrNhqHF0vVjeevGq/6pnI=";
   };
 
   patches = [
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
   cargoDeps = rustPlatform.fetchCargoVendor {
     pname = "chatmail-core";
     inherit (finalAttrs) version src;
-    hash = "sha256-ceXhO8/k3+dphPQ74S+ZgEZzUWjgqBm6wcePvTqxHrE=";
+    hash = "sha256-ItwjZo1KCVVpqtdLWqnPwCDmjEXFdKc3Xdn6av51xXk=";
   };
 
   nativeBuildInputs = [

From a574685573268e7fed9bb12a22fbf413554856fc Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Thu, 1 Oct 2026 23:29:55 +0800
Subject: [PATCH 225/525] emacs: fix cl-lib require in withPackages test

In 88accc0c92639355ce8a1c62cfaac0e07bc09de9, besides cl-lib macros, we
started to use cl-lib function cl-remove-duplicates.  So we should
remove eval-when-compile from cl-lib require.
---
 .../editors/emacs/build-support/wrapper-test/with-packages.el   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
index 30735966656d..ee6cdcf322b5 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
+++ b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
@@ -3,7 +3,7 @@
 ;;; Code:
 
 (require 'ert)
-(eval-when-compile (require 'cl-lib))
+(require 'cl-lib)
 (require 'server)
 (require 'info)
 

From 8e11d4b0d1c4754ecafc40ce50cb683a7ba6bf86 Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Tue, 29 Sep 2026 06:31:36 +0800
Subject: [PATCH 226/525] emacs: remove unused function parameter from
 withPackages test

---
 .../editors/emacs/build-support/wrapper-test/default.nix         | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix b/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
index 09ba02c3aefb..7d85d6e9ca10 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
+++ b/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
@@ -1,7 +1,6 @@
 {
   runCommand,
   emacs,
-  writeText,
   cowsay,
   replaceVars,
 }:

From c27865a9cbcc821d67789b1a0efebe84cc8ed717 Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Mon, 14 Sep 2026 23:18:06 +0800
Subject: [PATCH 227/525] emacs: reduce closure size of withPackages test

cowsay has a 3 times larger closure than hello.  Notably, cowsay
depends on perl.

Build-time closure:

  $ nix build github:NixOS/nixpkgs/nixos-24.11#hello --dry-run
  these 5 paths will be fetched (6.8 MiB download, 31.3 MiB unpacked):
    /nix/store/5m9amsvvh2z8sl7jrnc87hzy21glw6k1-glibc-2.40-66
    /nix/store/hwz2l7ihv2skq7gr5l3paavs3rr9il7z-hello-2.12.1
    /nix/store/c47b963idja6h1d8n91pf28v2jcq96kp-libidn2-2.3.7
    /nix/store/2745pvn6cv32yn9gp2rlqiqhqgs01pb5-libunistring-1.2
    /nix/store/y4d9iir0yqmrcswaqfi368d8m1rkv14s-xgcc-13.3.0-libgcc

  $ nix build github:NixOS/nixpkgs/nixos-24.11#cowsay --dry-run
  these 16 paths will be fetched (18.9 MiB download, 101.0 MiB unpacked):
    /nix/store/b5m28ldipl5wlhzh92jlcl1r1qph3a7k-acl-2.3.2
    /nix/store/kg3qpx6z28js0ycsssgnp7awxcjyv1c6-attr-2.5.2
    /nix/store/mjhcjikhxps97mq5z54j4gjjfzgmsir5-bash-5.2p37
    /nix/store/f8bb29v1w8mhkkxc15xan6mxvbkcbg3s-coreutils-9.5
    /nix/store/bjb2xx943rkfl0r6x7wgp2069zym5wwi-cowsay-3.8.3
    /nix/store/aiwb07brfbdk3v9dmhfpl71lv27yi6ic-cowsay-3.8.3-man
    /nix/store/hh698a2nnpqr47lh52n26wi8fiah3hid-gcc-13.3.0-lib
    /nix/store/mkhhjfg2isjbfx87dz191bzpnwx1bbr9-gcc-13.3.0-libgcc
    /nix/store/5m9amsvvh2z8sl7jrnc87hzy21glw6k1-glibc-2.40-66
    /nix/store/6r9c4fhs945br8y1nmcy3xrnnm2dj00n-gmp-with-cxx-6.3.0
    /nix/store/c47b963idja6h1d8n91pf28v2jcq96kp-libidn2-2.3.7
    /nix/store/2745pvn6cv32yn9gp2rlqiqhqgs01pb5-libunistring-1.2
    /nix/store/iissy6zslzyb85rzjgq4waag9dixvv6s-libxcrypt-4.4.36
    /nix/store/hfzprd964nzxk9axsaaffm0ql4lrpvra-perl-5.40.0
    /nix/store/y4d9iir0yqmrcswaqfi368d8m1rkv14s-xgcc-13.3.0-libgcc
    /nix/store/b6mjyiadysqlh7nps52faznnqmp32604-zlib-1.3.1

Runtime closure:

  $ nix path-info -rSsh github:NixOS/nixpkgs/nixos-24.11#hello
  /nix/store/2745pvn6cv32yn9gp2rlqiqhqgs01pb5-libunistring-1.2  	  1.8 MiB	  1.8 MiB
  /nix/store/c47b963idja6h1d8n91pf28v2jcq96kp-libidn2-2.3.7     	352.6 KiB	  2.1 MiB
  /nix/store/y4d9iir0yqmrcswaqfi368d8m1rkv14s-xgcc-13.3.0-libgcc	155.9 KiB	155.9 KiB
  /nix/store/5m9amsvvh2z8sl7jrnc87hzy21glw6k1-glibc-2.40-66     	 28.8 MiB	 31.1 MiB
  /nix/store/hwz2l7ihv2skq7gr5l3paavs3rr9il7z-hello-2.12.1      	221.2 KiB	 31.3 MiB

  $ nix path-info -rSsh github:NixOS/nixpkgs/nixos-24.11#cowsay
  /nix/store/2745pvn6cv32yn9gp2rlqiqhqgs01pb5-libunistring-1.2  	  1.8 MiB	  1.8 MiB
  /nix/store/c47b963idja6h1d8n91pf28v2jcq96kp-libidn2-2.3.7     	352.6 KiB	  2.1 MiB
  /nix/store/y4d9iir0yqmrcswaqfi368d8m1rkv14s-xgcc-13.3.0-libgcc	155.9 KiB	155.9 KiB
  /nix/store/5m9amsvvh2z8sl7jrnc87hzy21glw6k1-glibc-2.40-66     	 28.8 MiB	 31.1 MiB
  /nix/store/mkhhjfg2isjbfx87dz191bzpnwx1bbr9-gcc-13.3.0-libgcc 	155.9 KiB	155.9 KiB
  /nix/store/hh698a2nnpqr47lh52n26wi8fiah3hid-gcc-13.3.0-lib    	  8.7 MiB	 39.9 MiB
  /nix/store/6r9c4fhs945br8y1nmcy3xrnnm2dj00n-gmp-with-cxx-6.3.0	749.0 KiB	 40.6 MiB
  /nix/store/aiwb07brfbdk3v9dmhfpl71lv27yi6ic-cowsay-3.8.3-man  	  4.3 KiB	  4.3 KiB
  /nix/store/kg3qpx6z28js0ycsssgnp7awxcjyv1c6-attr-2.5.2        	 90.6 KiB	 31.2 MiB
  /nix/store/b5m28ldipl5wlhzh92jlcl1r1qph3a7k-acl-2.3.2         	125.2 KiB	 31.3 MiB
  /nix/store/b6mjyiadysqlh7nps52faznnqmp32604-zlib-1.3.1        	125.2 KiB	 31.2 MiB
  /nix/store/f8bb29v1w8mhkkxc15xan6mxvbkcbg3s-coreutils-9.5     	  1.4 MiB	 42.3 MiB
  /nix/store/iissy6zslzyb85rzjgq4waag9dixvv6s-libxcrypt-4.4.36  	128.0 KiB	 31.2 MiB
  /nix/store/hfzprd964nzxk9axsaaffm0ql4lrpvra-perl-5.40.0       	 56.9 MiB	 99.4 MiB
  /nix/store/mjhcjikhxps97mq5z54j4gjjfzgmsir5-bash-5.2p37       	  1.6 MiB	 32.6 MiB
  /nix/store/bjb2xx943rkfl0r6x7wgp2069zym5wwi-cowsay-3.8.3      	 45.2 KiB	101.0 MiB
---
 .../editors/emacs/build-support/wrapper-test/default.nix      | 4 ++--
 .../editors/emacs/build-support/wrapper-test/with-packages.el | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix b/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
index 7d85d6e9ca10..e1e989acf06c 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
+++ b/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
@@ -1,7 +1,7 @@
 {
   runCommand,
   emacs,
-  cowsay,
+  hello,
   replaceVars,
 }:
 
@@ -25,7 +25,7 @@ runCommand "test-emacs-withPackages-wrapper"
         }) epkgs.melpaBuild)
         (mkEpkg "early-default" ./early-default.el epkgs.melpaBuild)
         (mkEpkg "default" ./default.el epkgs.melpaBuild)
-        cowsay
+        hello
         (epkgs.treesit-grammars.with-grammars (ps: [ ps.tree-sitter-nix ]))
       ]))
     ];
diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
index ee6cdcf322b5..338469032ea3 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
+++ b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
@@ -80,9 +80,9 @@ which is generated by nix when building this elisp package."
 
 (ert-deftest with-packages-binaries-of-requested-packages-are-available ()
   (ert-info ("find binary via PATH")
-    (should (equal (call-process-shell-command "cowsay") 0)))
+    (should (equal (call-process-shell-command "hello") 0)))
   (ert-info ("find binary via exec-path")
-    (should (executable-find "cowsay")))
+    (should (executable-find "hello")))
   (ert-info ("each item is unique")
     (cl-flet ((item-should-be-unique (items)
                 (should (equal items

From 722165ea4513128d00973531c240d518afa6d66a Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Mon, 28 Sep 2026 09:32:08 +0800
Subject: [PATCH 228/525] emacs: support skip, :expected-result and more in
 withPackages test

---
 .../emacs/build-support/wrapper-test/with-packages.el    | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
index 338469032ea3..5cf6d2baed3b 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
+++ b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
@@ -137,11 +137,14 @@ Return test result, a list of values.  Each is non-nil if the test passes."
      ;; Run the non-batch test and return test result.
      (eval-in-non-batch-emacs `(,test-name)))))
 
-(defmacro define-with-packages-non-batch-ert-test (test-name)
-  "See `with-packages--run-non-batch-test' for how the test is run."
-  (declare (indent 1) (debug (symbolp)))
+(defmacro define-with-packages-non-batch-ert-test (test-name &rest ert-forms)
+  "See `with-packages--run-non-batch-test' for how the test is run.
+ERT-FORMS are placed at the start of the ERT test,
+which can be used to add skip condition and :expected-result."
+  (declare (indent 1) (debug (symbolp &rest sexp)))
   (cl-check-type test-name symbol)
   `(ert-deftest ,test-name ()
+     ,@ert-forms
      (should (stringp with-packages-non-batch-emacs-socket))
      (should (file-readable-p with-packages-non-batch-emacs-socket))
      (let ((test-result (with-packages--run-non-batch-test (quote ,test-name))))

From bad7c41d26adc32fc9def912b5db0050a6535c01 Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Mon, 28 Sep 2026 09:45:48 +0800
Subject: [PATCH 229/525] emacs: suppress compile warning of Emacs without
 native-comp in test

---
 .../editors/emacs/build-support/wrapper-test/with-packages.el   | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
index 5cf6d2baed3b..eb6459628095 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
+++ b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
@@ -36,6 +36,7 @@ which is generated by nix when building this elisp package."
 
 (defun with-packages--locate-eln-file (library)
   "Locate the natively-compiled LIBRARY file."
+  (declare-function comp-el-to-eln-rel-filename "comp.c")
   (locate-eln-file (comp-el-to-eln-rel-filename (find-library-name library))))
 
 (defun with-packages-unwrapped-site-start-is-loaded ()
@@ -191,6 +192,7 @@ This is a regression test for URL `https://github.com/NixOS/nixpkgs/pull/538964'
     ;; because we use a hardcoded time span as the synchronization point.
     ;; Ideally, we should use a more robust synchronization point.
     (sleep-for 2.5)
+    (defvar native-comp-eln-load-path)
     (list (not (cl-loop for buffer being each buffer
                         thereis (string= (buffer-name buffer)
                                          "*Async-native-compile-log*")))

From d72db33862aa2af88381b15634c14aa0e19d0fa4 Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Mon, 28 Sep 2026 09:47:02 +0800
Subject: [PATCH 230/525] emacs: skip non-batch tests in withPackages using a
 standard ERT way

---
 .../wrapper-test/with-packages.el             | 35 ++++++++++---------
 1 file changed, 18 insertions(+), 17 deletions(-)

diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
index eb6459628095..b17616eaeabd 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
+++ b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
@@ -185,28 +185,29 @@ which can be used to add skip condition and :expected-result."
 (defun with-packages-no-jit-native-comp ()
   "Test no JIT native-comp is triggered during non-batch tests.
 This is a regression test for URL `https://github.com/NixOS/nixpkgs/pull/538964'."
-  (if (not (native-comp-available-p))
-      (list t)
-    ;; Give Emacs some time to generate JIT native-comp results.
-    ;; It is possible that this test passes even if there is JIT native-comp
-    ;; because we use a hardcoded time span as the synchronization point.
-    ;; Ideally, we should use a more robust synchronization point.
-    (sleep-for 2.5)
-    (defvar native-comp-eln-load-path)
-    (list (not (cl-loop for buffer being each buffer
-                        thereis (string= (buffer-name buffer)
-                                         "*Async-native-compile-log*")))
-          (let ((eln-dir (car native-comp-eln-load-path)))
-            (or (directory-empty-p eln-dir)
-                (and (not (file-exists-p eln-dir))
-                     (file-exists-p (file-name-parent-directory eln-dir))))))))
+  ;; Give Emacs some time to generate JIT native-comp results.
+  ;; It is possible that this test passes even if there is JIT native-comp
+  ;; because we use a hardcoded time span as the synchronization point.
+  ;; Ideally, we should use a more robust synchronization point.
+  (sleep-for 2.5)
+  (defvar native-comp-eln-load-path)
+  (list (not (cl-loop for buffer being each buffer
+                      thereis (string= (buffer-name buffer)
+                                       "*Async-native-compile-log*")))
+        (let ((eln-dir (car native-comp-eln-load-path)))
+          (or (directory-empty-p eln-dir)
+              (and (not (file-exists-p eln-dir))
+                   (file-exists-p (file-name-parent-directory eln-dir)))))))
 
 (define-with-packages-non-batch-ert-tests
   with-packages-early-default-is-loaded
   with-packages-default-is-loaded
   with-packages-early-default-is-loaded-before-default
-  with-packages-unwrapped-site-start-is-loaded-quietly
-  with-packages-no-jit-native-comp)
+  with-packages-unwrapped-site-start-is-loaded-quietly)
+
+(define-with-packages-non-batch-ert-test
+    with-packages-no-jit-native-comp
+  (skip-unless (native-comp-available-p)))
 
 (provide 'with-packages)
 

From 44f53035493066f9082f55ba73d28e59b8303f3e Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Tue, 29 Sep 2026 02:44:03 +0800
Subject: [PATCH 231/525] emacs: refer to *Message* buffer via messages-buffer
 in test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

(info "(elisp) Logging Messages") says:

> Any Lisp code that needs to access the ‘*Messages*’ buffer directly
> and wants to ensure that it exists should use the function
> ‘messages-buffer’.
---
 .../editors/emacs/build-support/wrapper-test/with-packages.el   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
index b17616eaeabd..9df059d8228e 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
+++ b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
@@ -172,7 +172,7 @@ which can be used to add skip condition and :expected-result."
 (defun with-packages-unwrapped-site-start-is-loaded-quietly ()
   (list (with-packages-unwrapped-site-start-is-loaded)
         (not (save-excursion
-               (with-current-buffer "*Messages*"
+               (with-current-buffer (messages-buffer)
                  (goto-char (point-min))
                  (save-match-data
                    (re-search-forward (rx line-start

From fe9168243017a67c1a67132ca2916fa8cbd9dc4a Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Tue, 29 Sep 2026 03:32:00 +0800
Subject: [PATCH 232/525] emacs: refactor withPackages test to make mkEpkg
 easier to extend

---
 .../build-support/wrapper-test/default.nix    | 25 +++++++++++++------
 1 file changed, 17 insertions(+), 8 deletions(-)

diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix b/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
index e1e989acf06c..a51a2ae23a31 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
+++ b/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
@@ -3,14 +3,22 @@
   emacs,
   hello,
   replaceVars,
+  lib,
 }:
 
 let
   mkEpkg =
-    pname: src: melpaBuild:
+    {
+      pname,
+      version ? "0.1.0", # a dummy value
+      src ? lib.path.append ./. "${pname}.el",
+    }:
+
+    {
+      melpaBuild,
+    }:
     melpaBuild {
-      inherit pname src;
-      version = "0.1.0"; # a dummy value
+      inherit pname version src;
       turnCompilationWarningToError = true;
     };
 in
@@ -20,11 +28,12 @@ runCommand "test-emacs-withPackages-wrapper"
       (emacs.pkgs.withPackages (epkgs: [
         epkgs.dash
         epkgs.flx-ido
-        (mkEpkg "with-packages" (replaceVars ./with-packages.el {
-          inherit (builtins) storeDir;
-        }) epkgs.melpaBuild)
-        (mkEpkg "early-default" ./early-default.el epkgs.melpaBuild)
-        (mkEpkg "default" ./default.el epkgs.melpaBuild)
+        (epkgs.callPackage (mkEpkg {
+          pname = "with-packages";
+          src = replaceVars ./with-packages.el { inherit (builtins) storeDir; };
+        }) { })
+        (epkgs.callPackage (mkEpkg { pname = "early-default"; }) { })
+        (epkgs.callPackage (mkEpkg { pname = "default"; }) { })
         hello
         (epkgs.treesit-grammars.with-grammars (ps: [ ps.tree-sitter-nix ]))
       ]))

From 804b4351ec56d51ff6c64e5b2f8e75529bfdd44d Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Tue, 29 Sep 2026 04:12:59 +0800
Subject: [PATCH 233/525] emacs: add metadata to with-packages.el to make
 package-lint happy

---
 .../emacs/build-support/wrapper-test/with-packages.el     | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
index 9df059d8228e..1e8244d8e89f 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
+++ b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
@@ -1,5 +1,13 @@
 ;;; with-packages.el --- Utils and ERT tests for withPackages  -*- lexical-binding: t; -*-
 
+;; Version: 0.1.0
+;; Package-Requires: ((emacs "29.1"))
+;; URL: https://example.com
+
+;;; Commentary:
+
+;; Utils and ERT tests for emacs.pkgs.withPackages.
+
 ;;; Code:
 
 (require 'ert)

From bc1fce3c72e950e4a1a1243a390f543d827fb899 Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Tue, 29 Sep 2026 04:22:07 +0800
Subject: [PATCH 234/525] emacs: run package-lint when building files of
 withPackages test

---
 .../build-support/wrapper-test/default.nix    | 30 +++++++++++++++++--
 1 file changed, 28 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix b/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
index a51a2ae23a31..df14c558557f 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
+++ b/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
@@ -12,14 +12,34 @@ let
       pname,
       version ? "0.1.0", # a dummy value
       src ? lib.path.append ./. "${pname}.el",
+      doLint ? true,
     }:
 
     {
       melpaBuild,
+      package-lint,
     }:
     melpaBuild {
       inherit pname version src;
       turnCompilationWarningToError = true;
+
+      packageRequires = lib.optional doLint package-lint;
+
+      doInstallCheck = doLint;
+      preInstallCheck = ''
+        lintEachFile() {
+          find $out/share/emacs \
+            -type f -name '*.el' \
+            -not -name "*-pkg.el" -not -name "*-autoloads.el" \
+            -print0 \
+          | xargs --verbose -0 -I {} -n 1 -P "$NIX_BUILD_CORES" "$@"
+        }
+
+        lintEachFile \
+          emacs --batch \
+            --funcall=package-activate-all \
+            --funcall=package-lint-batch-and-exit "{}"
+      '';
     };
 in
 runCommand "test-emacs-withPackages-wrapper"
@@ -32,8 +52,14 @@ runCommand "test-emacs-withPackages-wrapper"
           pname = "with-packages";
           src = replaceVars ./with-packages.el { inherit (builtins) storeDir; };
         }) { })
-        (epkgs.callPackage (mkEpkg { pname = "early-default"; }) { })
-        (epkgs.callPackage (mkEpkg { pname = "default"; }) { })
+        (epkgs.callPackage (mkEpkg {
+          pname = "early-default";
+          doLint = false; # no need to lint this simple file
+        }) { })
+        (epkgs.callPackage (mkEpkg {
+          pname = "default";
+          doLint = false; # no need to lint this simple file
+        }) { })
         hello
         (epkgs.treesit-grammars.with-grammars (ps: [ ps.tree-sitter-nix ]))
       ]))

From 6bb86f699a1ef9cc82983347ac0b43af9f1b3847 Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Tue, 29 Sep 2026 07:19:52 +0800
Subject: [PATCH 235/525] emacs: apply custom unpackCmd of genericBuild only to
 *.el file

This custom unpackCmd is only meant to be applied to files like
  /nix/store/hash-foo.el
but it was mistakenly also applied to dirs with similar names.

This patch fixes that.
---
 .../editors/emacs/build-support/generic.nix      | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/pkgs/applications/editors/emacs/build-support/generic.nix b/pkgs/applications/editors/emacs/build-support/generic.nix
index d0124876c6b2..b8f7314a516d 100644
--- a/pkgs/applications/editors/emacs/build-support/generic.nix
+++ b/pkgs/applications/editors/emacs/build-support/generic.nix
@@ -38,12 +38,16 @@ lib.extendMkDerivation {
         args.unpackCmd or ''
           case "$curSrc" in
             *.el)
-              # keep original source filename without the hash
-              local filename=$(basename "$curSrc")
-              filename="''${filename:33}"
-              cp $curSrc $filename
-              chmod +w $filename
-              sourceRoot="."
+              if [ -f "$curSrc" ]; then
+                # keep original source filename without the hash
+                local filename=$(basename "$curSrc")
+                filename="''${filename:33}"
+                cp $curSrc $filename
+                chmod +w $filename
+                sourceRoot="."
+              else
+                _defaultUnpack "$curSrc"
+              fi
               ;;
             *)
               _defaultUnpack "$curSrc"

From 7be2baa040af1f7c3c7429d742d93ce3897ea244 Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Tue, 29 Sep 2026 06:42:53 +0800
Subject: [PATCH 236/525] emacs: refactor with-packages.el src as a file in a
 store path dir

This is in preparation for running checkdoc as a linter during build.
---
 .../emacs/build-support/wrapper-test/default.nix    | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix b/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
index df14c558557f..0d029212e58f 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
+++ b/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
@@ -2,7 +2,7 @@
   runCommand,
   emacs,
   hello,
-  replaceVars,
+  replaceVarsWith,
   lib,
 }:
 
@@ -50,7 +50,16 @@ runCommand "test-emacs-withPackages-wrapper"
         epkgs.flx-ido
         (epkgs.callPackage (mkEpkg {
           pname = "with-packages";
-          src = replaceVars ./with-packages.el { inherit (builtins) storeDir; };
+          src = replaceVarsWith {
+            src = ./with-packages.el;
+            replacements = { inherit (builtins) storeDir; };
+
+            # generate a file in a store path dir
+            #   /nix/store/hash-with-packages.el/with-packages.el
+            # instead of a store path file, which checkdoc doesn't like
+            #   /nix/store/hash-with-packages.el
+            dir = "/";
+          };
         }) { })
         (epkgs.callPackage (mkEpkg {
           pname = "early-default";

From 838087ec98fe812f1bb8e550d5abef030a641a8c Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Tue, 29 Sep 2026 07:17:23 +0800
Subject: [PATCH 237/525] emacs: improve doc of with-packages.el to make
 checkdoc happy

This is in preparation for running checkdoc as a linter during build.
---
 .../wrapper-test/with-packages.el             | 20 ++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
index 1e8244d8e89f..2791abe0c8ee 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
+++ b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
@@ -113,13 +113,16 @@ which is generated by nix when building this elisp package."
 ;;;; Utils for non-batch tests
 
 (defmacro define-with-packages-non-batch-test-via-bound-and-true-p (test-name)
+  "Define a function named TEST-NAME which tests symbol TEST-NAME."
   (declare (indent 1) (debug (symbolp)))
   (cl-check-type test-name symbol)
   `(defun ,test-name ()
      (list (bound-and-true-p ,test-name))))
 
 (defmacro define-with-packages-non-batch-tests-via-bound-and-true-p (&rest test-names)
-  "See also `define-with-packages-non-batch-test-via-bound-and-true-p'."
+  "TEST-NAMES is a list of symbols.
+Each of them is passed to
+`define-with-packages-non-batch-test-via-bound-and-true-p'."
   (declare (indent 0) (debug (&rest symbolp)))
   `(progn
      ,@(cl-loop
@@ -147,7 +150,13 @@ Return test result, a list of values.  Each is non-nil if the test passes."
      (eval-in-non-batch-emacs `(,test-name)))))
 
 (defmacro define-with-packages-non-batch-ert-test (test-name &rest ert-forms)
-  "See `with-packages--run-non-batch-test' for how the test is run.
+  "Define an ERT test named TEST-NAME.
+
+That test first asks a non-batch Emacs to run function TEST-NAME.
+See `with-packages--run-non-batch-test' for how function TEST-NAME is run.
+The test then retrieves the result of function TEST-NAME.
+Depending on the result, the test passes or fails.
+
 ERT-FORMS are placed at the start of the ERT test,
 which can be used to add skip condition and :expected-result."
   (declare (indent 1) (debug (symbolp &rest sexp)))
@@ -164,7 +173,8 @@ which can be used to add skip condition and :expected-result."
                                collect (or item t)))))))
 
 (defmacro define-with-packages-non-batch-ert-tests (&rest test-names)
-  "See also `define-with-packages-non-batch-ert-test'."
+  "TEST-NAMES is a list of symbols.
+Each of them is passed to `define-with-packages-non-batch-ert-test'."
   (declare (indent 0) (debug (&rest symbolp)))
   `(progn
      ,@(cl-loop for test-name in test-names
@@ -220,3 +230,7 @@ This is a regression test for URL `https://github.com/NixOS/nixpkgs/pull/538964'
 (provide 'with-packages)
 
 ;;; with-packages.el ends here
+
+;; Local Variables:
+;; checkdoc-force-docstrings-flag: nil
+;; End:

From 053a0dbb90224a8aff29ee259d6488ff481521b8 Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Tue, 29 Sep 2026 07:54:01 +0800
Subject: [PATCH 238/525] emacs: run checkdoc when building files of
 withPackages test

---
 .../editors/emacs/build-support/wrapper-test/default.nix    | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix b/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
index 0d029212e58f..92467db6db6d 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
+++ b/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
@@ -39,6 +39,12 @@ let
           emacs --batch \
             --funcall=package-activate-all \
             --funcall=package-lint-batch-and-exit "{}"
+
+        lintEachFile \
+          emacs --batch \
+            "{}" \
+            --eval='(setopt checkdoc-arguments-in-order-flag t)' \
+            --funcall=checkdoc-batch
       '';
     };
 in

From d3ed4ef68ba6fb998fa6face4455aed253bee596 Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Wed, 30 Sep 2026 13:44:25 +0800
Subject: [PATCH 239/525] emacs: check indentation when building files of
 withPackages test

---
 .../build-support/wrapper-test/default.nix     | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix b/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
index 92467db6db6d..5fd1fcf9fcab 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
+++ b/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
@@ -45,6 +45,24 @@ let
             "{}" \
             --eval='(setopt checkdoc-arguments-in-order-flag t)' \
             --funcall=checkdoc-batch
+
+        lintEachFile \
+          emacs --batch \
+            "{}" \
+            --eval='
+              (progn
+                ;; load indentation settings, if any, see (info "(emacs) Lisp Indent")
+                (eval-buffer)
+                (indent-region (point-min) (point-max))
+                (with-current-buffer
+                    (diff-no-select buffer-file-name (current-buffer) nil t)
+                  (goto-char (point-min))
+                  (condition-case nil
+                      (let ((case-fold-search nil))
+                        (search-forward "Diff finished (no differences)"))
+                    (search-failed
+                     (princ (buffer-string))
+                     (error "%s" "File indentation is wrong")))))'
       '';
     };
 in

From 5dfc78e8d4ba4d934eec436def90964d46157dc6 Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Wed, 30 Sep 2026 13:54:14 +0800
Subject: [PATCH 240/525] emacs: use comp-async-buffer-name instead of its
 value in test

---
 .../editors/emacs/build-support/wrapper-test/with-packages.el | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
index 2791abe0c8ee..40b80bd5407a 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
+++ b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
@@ -209,9 +209,9 @@ This is a regression test for URL `https://github.com/NixOS/nixpkgs/pull/538964'
   ;; Ideally, we should use a more robust synchronization point.
   (sleep-for 2.5)
   (defvar native-comp-eln-load-path)
+  (defvar comp-async-buffer-name)
   (list (not (cl-loop for buffer being each buffer
-                      thereis (string= (buffer-name buffer)
-                                       "*Async-native-compile-log*")))
+                      thereis (string= (buffer-name buffer) comp-async-buffer-name)))
         (let ((eln-dir (car native-comp-eln-load-path)))
           (or (directory-empty-p eln-dir)
               (and (not (file-exists-p eln-dir))

From c12f6b61f0bacebd787eb6918d1670a87aa293b7 Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Thu, 1 Oct 2026 11:32:47 +0800
Subject: [PATCH 241/525] emacs: support eval in different subprocess Emacsen
 in test

---
 .../emacs/build-support/wrapper-test/with-packages.el      | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
index 40b80bd5407a..dd489d927d84 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
+++ b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
@@ -50,10 +50,11 @@ which is generated by nix when building this elisp package."
 (defun with-packages-unwrapped-site-start-is-loaded ()
   (fboundp 'nix--profile-paths))
 
-(defun with-packages-eval-in-sub-emacs (form)
-  "Evaluate FORM in a subprocess Emacs and return its result."
+(cl-defun with-packages-eval-in-sub-emacs (form &optional (emacs-program "emacs"))
+  "Evaluate FORM in a subprocess Emacs and return its result.
+EMACS-PROGRAM specifies the subprocess Emacs to start."
   (pcase-exhaustive
-      (process-lines "emacs" "--batch"
+      (process-lines emacs-program "--batch"
                      "--eval" (format "(prin1 %S)" form))
     (`(,result) (read result))))
 

From 254d697d7daf264366d5823f6514760354c30a8f Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Thu, 1 Oct 2026 08:54:50 +0800
Subject: [PATCH 242/525] emacs: test invocation-name and -directory point to
 wrapped Emacs

---
 .../build-support/wrapper-test/default.nix    |  1 +
 .../wrapper-test/with-packages.el             | 20 +++++++++++++++++++
 2 files changed, 21 insertions(+)

diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix b/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
index 5fd1fcf9fcab..19e64974c7a0 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
+++ b/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
@@ -112,6 +112,7 @@ runCommand "test-emacs-withPackages-wrapper"
 
     emacs --batch --load=with-packages \
       --eval="(setq with-packages-non-batch-emacs-socket \"$nonBatchEmacsSocket\")" \
+      --eval='(setq with-packages-unwrapped-emacs-program "${lib.getExe emacs}")' \
       --funcall=ert-run-tests-batch-and-exit
 
     touch $out
diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
index dd489d927d84..f891c7ee6613 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
+++ b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
@@ -58,6 +58,10 @@ EMACS-PROGRAM specifies the subprocess Emacs to start."
                      "--eval" (format "(prin1 %S)" form))
     (`(,result) (read result))))
 
+(defvar with-packages-unwrapped-emacs-program nil
+  "Absoluate file of an unwrapped Emacs binary.
+Set this variable before running related tests.")
+
 ;;;; Tests that can be run in a batch Emacs
 
 (ert-deftest with-packages-requested-packages-are-available ()
@@ -111,6 +115,22 @@ EMACS-PROGRAM specifies the subprocess Emacs to start."
   (skip-unless (treesit-available-p))
   (should (treesit-language-available-p 'nix)))
 
+(ert-deftest with-packages-invocation-name-and-directory-are-wrapped ()
+  "Test https://github.com/NixOS/nixpkgs/pull/361145."
+  ;; Generally, to a build filename, `expand-file-name' is better than `concat',
+  ;; because `expand-file-name' accepts a dir not ending with "/".
+  ;; We use `concat' because we want to support existing `concat' usages, such as esup.el:
+  ;; https://github.com/jschaf/esup/blob/4b49c8d599d4cc0fbf994e9e54a9c78e5ab62a5f/esup.el#L161
+  (ert-info ("wrapped Emacs has correct invocation-name and -directory")
+    (should (equal (file-truename (executable-find "emacs"))
+                   (concat invocation-directory invocation-name))))
+  (ert-info ("unwrapped subprocess Emacs has correct invocation-name and -directory")
+    (should (file-name-absolute-p with-packages-unwrapped-emacs-program))
+    (should
+     (equal with-packages-unwrapped-emacs-program
+            (with-packages-eval-in-sub-emacs '(concat invocation-directory invocation-name)
+                                             with-packages-unwrapped-emacs-program)))))
+
 ;;;; Utils for non-batch tests
 
 (defmacro define-with-packages-non-batch-test-via-bound-and-true-p (test-name)

From e4409bbe4524dbcd35ec253070125edbaed71ab2 Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Thu, 1 Oct 2026 23:33:34 +0800
Subject: [PATCH 243/525] emacs: test epkgs added by withPackages do not expose
 to sub Emacs

---
 .../emacs/build-support/wrapper-test/with-packages.el    | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
index f891c7ee6613..5216f0fd1f28 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
+++ b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
@@ -66,7 +66,14 @@ Set this variable before running related tests.")
 
 (ert-deftest with-packages-requested-packages-are-available ()
   (should (package-installed-p 'dash))
-  (should (package-installed-p 'flx-ido)))
+  (should (package-installed-p 'flx-ido))
+  ;; Test 23d4bfb6661ca57a9e331a2cf4184232d38ac38b.
+  (ert-info ("unwrapped subprocess Emacs does not have requested packages installed")
+    (should (file-name-absolute-p with-packages-unwrapped-emacs-program))
+    (should-not (with-packages-eval-in-sub-emacs '(package-installed-p 'dash)
+                                                 with-packages-unwrapped-emacs-program))
+    (should-not (with-packages-eval-in-sub-emacs '(package-installed-p 'flx-ido)
+                                                 with-packages-unwrapped-emacs-program))))
 
 (ert-deftest with-packages-deps-of-requested-packages-are-available ()
   "Test https://github.com/NixOS/nixpkgs/issues/388829."

From 1e0dbc33d7c6ddf458170d01186ef065c89efc60 Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Fri, 2 Oct 2026 00:17:37 +0800
Subject: [PATCH 244/525] emacs: rename with-packages--in-nix-store-p in test

---
 .../emacs/build-support/wrapper-test/with-packages.el  | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
index 5216f0fd1f28..3d8f46d07030 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
+++ b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
@@ -34,11 +34,11 @@ which is generated by nix when building this elisp package."
          (`(,store-dir) store-dir))
      (error "@storeDir@"))))
 
-(defun with-packages--nix-store-file-p (file)
-  "Return t if FILE is in nix store."
+(defun with-packages--in-nix-store-p (file-or-dir)
+  "Return t if FILE-OR-DIR is in nix store."
   (cl-loop
    with store-dir = (with-packages--nix-store-dir)
-   for parent = (file-name-parent-directory file) then (file-name-parent-directory parent)
+   for parent = (file-name-parent-directory file-or-dir) then (file-name-parent-directory parent)
    while parent
    thereis (string= parent store-dir)))
 
@@ -92,9 +92,9 @@ Set this variable before running related tests.")
 (ert-deftest with-packages-aot-native-comp-eln-files-are-available ()
   (skip-unless (native-comp-available-p))
   (ert-info ("search eln files of Emacs proper")
-    (should (with-packages--nix-store-file-p (with-packages--locate-eln-file "files"))))
+    (should (with-packages--in-nix-store-p (with-packages--locate-eln-file "files"))))
   (ert-info ("search eln files of requested packages")
-    (should (with-packages--nix-store-file-p (with-packages--locate-eln-file "dash")))))
+    (should (with-packages--in-nix-store-p (with-packages--locate-eln-file "dash")))))
 
 (ert-deftest with-packages-unwrapped-site-start-is-loaded ()
   (should (with-packages-unwrapped-site-start-is-loaded)))

From eeb00925037f9486aab775677628e374045875ea Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Fri, 2 Oct 2026 00:40:24 +0800
Subject: [PATCH 245/525] emacs: test withPackages-added eln files do not
 expose to sub Emacs

---
 .../wrapper-test/with-packages.el             | 25 ++++++++++++++++++-
 1 file changed, 24 insertions(+), 1 deletion(-)

diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
index 3d8f46d07030..b9fd90fe2141 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
+++ b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
@@ -94,7 +94,30 @@ Set this variable before running related tests.")
   (ert-info ("search eln files of Emacs proper")
     (should (with-packages--in-nix-store-p (with-packages--locate-eln-file "files"))))
   (ert-info ("search eln files of requested packages")
-    (should (with-packages--in-nix-store-p (with-packages--locate-eln-file "dash")))))
+    (should (with-packages--in-nix-store-p (with-packages--locate-eln-file "dash"))))
+  ;; `load' does not try to find .eln files if it cannot find .elc or .el files.
+  ;; Assuming unwrapped subprocess Emacs cannot find .elc or .el files of requested packages,
+  ;; which is tested in `with-packages-requested-packages-are-available',
+  ;; probably, the tested code in our site-start.el and this test are unnecessary.
+  ;; In addition, what we really want to test is that unwrapped subprocess Emacs does not
+  ;; see eln files of requested packages, which is not easy to test.
+  ;; So we test an easier-to-test proxy, which unfortunately can be seen as
+  ;; implementation detail of the wrapper.
+  (ert-info ("subprocess does not see wrapper-modified EMACSNATIVELOADPATH")
+    (let ((eln-dirs-added-by-wrapper
+           (cl-set-difference
+            (parse-colon-path (getenv-internal "EMACSNATIVELOADPATH" initial-environment))
+            (parse-colon-path (getenv "EMACSNATIVELOADPATH"))
+            :test #'string=)))
+      (should (equal (length eln-dirs-added-by-wrapper) 1))
+      (let ((eln-dir-added-by-wrapper (car eln-dirs-added-by-wrapper)))
+        (should (with-packages--in-nix-store-p eln-dir-added-by-wrapper))
+        (cl-flet ((ancestor-dir-of-file-p (dir file)
+                    (locate-dominating-file file
+                                            (lambda (current-dir)
+                                              (string= current-dir dir)))))
+          (should (ancestor-dir-of-file-p eln-dir-added-by-wrapper
+                                          (with-packages--locate-eln-file "dash"))))))))
 
 (ert-deftest with-packages-unwrapped-site-start-is-loaded ()
   (should (with-packages-unwrapped-site-start-is-loaded)))

From 4b5e570a2563b57fa67feacac05cb1984fffec20 Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Fri, 2 Oct 2026 04:31:04 +0800
Subject: [PATCH 246/525] emacs: move wrapper-related config to the wrapped
 site-start.el

Also simplify it a bit.
---
 .../editors/emacs/build-support/wrapper.nix   | 31 ++++++++++++++++++
 pkgs/applications/editors/emacs/site-start.el | 32 -------------------
 2 files changed, 31 insertions(+), 32 deletions(-)

diff --git a/pkgs/applications/editors/emacs/build-support/wrapper.nix b/pkgs/applications/editors/emacs/build-support/wrapper.nix
index 310d41d7a031..2a27d2a3dbbb 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper.nix
+++ b/pkgs/applications/editors/emacs/build-support/wrapper.nix
@@ -175,6 +175,37 @@ runCommand (lib.appendToName "with-packages" emacs).name
           ${lib.optionalString withTreeSitter ''
             (add-to-list 'treesit-extra-load-path "$out/lib/")
           ''}
+
+          ;; Remove wrapper-added dir from EMACSLOADPATH so it's not propagated
+          ;; to any other Emacsen that might be started as subprocesses.
+          ;; Also do it for EMACSNATIVELOADPATH, which probably unnecessary.
+          (let ((restore-load-path
+                 (lambda (load-path-env-var wrapper-dir-env-var)
+                   (when-let* ((wrapper-dir (getenv wrapper-dir-env-var)))
+                     (setenv wrapper-dir-env-var nil)
+                     (when-let* ((env-load-path (getenv load-path-env-var)))
+                       (let* ((env-load-path-list (split-string env-load-path
+                                                                path-separator))
+                              (restored-env-load-path-list (remove wrapper-dir
+                                                                   env-load-path-list)))
+                         (setenv load-path-env-var
+                                 (when restored-env-load-path-list
+                                   (string-join restored-env-load-path-list
+                                                path-separator)))))))))
+            (funcall restore-load-path
+                     "EMACSLOADPATH" "emacsWithPackages_siteLisp")
+            (funcall restore-load-path
+                     "EMACSNATIVELOADPATH" "emacsWithPackages_siteLispNative"))
+
+          (let ((set-from-env (lambda (symbol env-var &optional modify)
+                                (when-let* ((value (getenv env-var)))
+                                  (set symbol (funcall (or modify #'identity) value))
+                                  (setenv env-var nil)))))
+            (funcall set-from-env
+                     'invocation-directory "emacsWithPackages_invocationDirectory"
+                     #'file-name-as-directory)
+            (funcall set-from-env
+                     'invocation-name "emacsWithPackages_invocationName"))
           EOF
 
           # Generate a subdirs.el that statically adds all subdirectories to load-path.
diff --git a/pkgs/applications/editors/emacs/site-start.el b/pkgs/applications/editors/emacs/site-start.el
index 06e13c756759..4fcaf182cca5 100644
--- a/pkgs/applications/editors/emacs/site-start.el
+++ b/pkgs/applications/editors/emacs/site-start.el
@@ -17,38 +17,6 @@ least specific (the system profile)"
       (setq load-path (cons default-directory load-path))
       (normal-top-level-add-subdirs-to-load-path))))
 
-;;; Remove wrapper site-lisp from EMACSLOADPATH so it's not propagated
-;;; to any other Emacsen that might be started as subprocesses.
-(let ((wrapper-site-lisp (getenv "emacsWithPackages_siteLisp"))
-      (env-load-path (getenv "EMACSLOADPATH")))
-  (when wrapper-site-lisp
-    (setenv "emacsWithPackages_siteLisp" nil))
-  (when (and wrapper-site-lisp env-load-path)
-    (let* ((env-list (split-string env-load-path ":"))
-           (new-env-list (delete wrapper-site-lisp env-list)))
-      (setenv "EMACSLOADPATH" (when new-env-list
-                                (mapconcat 'identity new-env-list ":"))))))
-
-(let ((wrapper-site-lisp (getenv "emacsWithPackages_siteLispNative"))
-      (env-load-path (getenv "EMACSNATIVELOADPATH")))
-  (when wrapper-site-lisp
-    (setenv "emacsWithPackages_siteLispNative" nil))
-  (when (and wrapper-site-lisp env-load-path)
-    (let* ((env-list (split-string env-load-path ":"))
-           (new-env-list (delete wrapper-site-lisp env-list)))
-      (setenv "EMACSNATIVELOADPATH" (when new-env-list
-                                (mapconcat 'identity new-env-list ":"))))))
-
-(let ((wrapper-invocation-directory (getenv "emacsWithPackages_invocationDirectory")))
-  (when wrapper-invocation-directory
-    (setq invocation-directory (file-name-as-directory wrapper-invocation-directory))
-    (setenv "emacsWithPackages_invocationDirectory" nil)))
-
-(let ((wrapper-invocation-name (getenv "emacsWithPackages_invocationName")))
-  (when wrapper-invocation-name
-    (setq invocation-name wrapper-invocation-name)
-    (setenv "emacsWithPackages_invocationName" nil)))
-
 ;;; Set up native-comp load path.
 (when (featurep 'native-compile)
   ;; Append native-comp subdirectories from `NIX_PROFILES'.

From 1c3f929e2d0198e73d23386fdcbda77c9f9feca8 Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Fri, 2 Oct 2026 13:03:51 +0800
Subject: [PATCH 247/525] emacs: move test-related bash code to
 writeShellApplication

- writeShellApplication lints bash code while runCommand does not.
- It is easier to wrap the whole test.  For example, to test graphical
  stuff, such as font, we may want to wrap the whole test with
  xvfb-run.
---
 .../build-support/wrapper-test/default.nix    | 41 ++++++++++++-------
 1 file changed, 26 insertions(+), 15 deletions(-)

diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix b/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
index 19e64974c7a0..f3eb9f558968 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
+++ b/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
@@ -4,6 +4,7 @@
   hello,
   replaceVarsWith,
   lib,
+  writeShellApplication,
 }:
 
 let
@@ -65,10 +66,10 @@ let
                      (error "%s" "File indentation is wrong")))))'
       '';
     };
-in
-runCommand "test-emacs-withPackages-wrapper"
-  {
-    nativeBuildInputs = [
+
+  run-test = writeShellApplication {
+    name = "run-test";
+    runtimeInputs = [
       (emacs.pkgs.withPackages (epkgs: [
         epkgs.dash
         epkgs.flx-ido
@@ -97,23 +98,33 @@ runCommand "test-emacs-withPackages-wrapper"
         (epkgs.treesit-grammars.with-grammars (ps: [ ps.tree-sitter-nix ]))
       ]))
     ];
-    env = {
+    runtimeEnv = {
       # emulate a default NixOS env where INFOPATH is set like this (not ending with a ":")
       INFOPATH = "/fake-info-dir1:/fake-info-dir2";
       EMACS_TEST_VERBOSE = 1; # make ERT output verbose
     };
+    text = ''
+      # Give Emacs a HOME to emulate a real user environment.
+      HOME="$PWD"
+
+      nonBatchEmacsSocket="$PWD/non-batch-emacs-socket"
+      emacs --daemon="$nonBatchEmacsSocket"
+
+      emacs --batch --load=with-packages \
+        --eval="(setq with-packages-non-batch-emacs-socket \"$nonBatchEmacsSocket\")" \
+        --eval='(setq with-packages-unwrapped-emacs-program "${lib.getExe emacs}")' \
+        --funcall=ert-run-tests-batch-and-exit
+    '';
+  };
+in
+runCommand "test-emacs-withPackages-wrapper"
+  {
+    nativeBuildInputs = [
+      run-test
+    ];
   }
   ''
-    # Give Emacs a HOME to emulate a real user environment.
-    HOME="$PWD"
-
-    nonBatchEmacsSocket="$PWD/non-batch-emacs-socket"
-    emacs --daemon="$nonBatchEmacsSocket"
-
-    emacs --batch --load=with-packages \
-      --eval="(setq with-packages-non-batch-emacs-socket \"$nonBatchEmacsSocket\")" \
-      --eval='(setq with-packages-unwrapped-emacs-program "${lib.getExe emacs}")' \
-      --funcall=ert-run-tests-batch-and-exit
+    run-test
 
     touch $out
   ''

From 2ce77ced1f4ec886cc4610d3ba7e16fa2558ce05 Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Sat, 10 Oct 2026 02:50:36 +0800
Subject: [PATCH 248/525] emacs: factor out test lib mkEpkg into a separate
 file

mkEpkg will be reused in an upcoming NixOS test.
---
 .../build-support/wrapper-test/default.nix    | 59 +-----------------
 .../build-support/wrapper-test/mk-epkg.nix    | 61 +++++++++++++++++++
 2 files changed, 62 insertions(+), 58 deletions(-)
 create mode 100644 pkgs/applications/editors/emacs/build-support/wrapper-test/mk-epkg.nix

diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix b/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
index f3eb9f558968..5125cce2e5b8 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
+++ b/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
@@ -8,64 +8,7 @@
 }:
 
 let
-  mkEpkg =
-    {
-      pname,
-      version ? "0.1.0", # a dummy value
-      src ? lib.path.append ./. "${pname}.el",
-      doLint ? true,
-    }:
-
-    {
-      melpaBuild,
-      package-lint,
-    }:
-    melpaBuild {
-      inherit pname version src;
-      turnCompilationWarningToError = true;
-
-      packageRequires = lib.optional doLint package-lint;
-
-      doInstallCheck = doLint;
-      preInstallCheck = ''
-        lintEachFile() {
-          find $out/share/emacs \
-            -type f -name '*.el' \
-            -not -name "*-pkg.el" -not -name "*-autoloads.el" \
-            -print0 \
-          | xargs --verbose -0 -I {} -n 1 -P "$NIX_BUILD_CORES" "$@"
-        }
-
-        lintEachFile \
-          emacs --batch \
-            --funcall=package-activate-all \
-            --funcall=package-lint-batch-and-exit "{}"
-
-        lintEachFile \
-          emacs --batch \
-            "{}" \
-            --eval='(setopt checkdoc-arguments-in-order-flag t)' \
-            --funcall=checkdoc-batch
-
-        lintEachFile \
-          emacs --batch \
-            "{}" \
-            --eval='
-              (progn
-                ;; load indentation settings, if any, see (info "(emacs) Lisp Indent")
-                (eval-buffer)
-                (indent-region (point-min) (point-max))
-                (with-current-buffer
-                    (diff-no-select buffer-file-name (current-buffer) nil t)
-                  (goto-char (point-min))
-                  (condition-case nil
-                      (let ((case-fold-search nil))
-                        (search-forward "Diff finished (no differences)"))
-                    (search-failed
-                     (princ (buffer-string))
-                     (error "%s" "File indentation is wrong")))))'
-      '';
-    };
+  mkEpkg = import ./mk-epkg.nix { inherit lib; };
 
   run-test = writeShellApplication {
     name = "run-test";
diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/mk-epkg.nix b/pkgs/applications/editors/emacs/build-support/wrapper-test/mk-epkg.nix
new file mode 100644
index 000000000000..f3e5615724b3
--- /dev/null
+++ b/pkgs/applications/editors/emacs/build-support/wrapper-test/mk-epkg.nix
@@ -0,0 +1,61 @@
+{
+  lib,
+}:
+
+{
+  pname,
+  version ? "0.1.0", # a dummy value
+  src ? lib.path.append ./. "${pname}.el",
+  doLint ? true,
+}:
+
+{
+  melpaBuild,
+  package-lint,
+}:
+melpaBuild {
+  inherit pname version src;
+  turnCompilationWarningToError = true;
+
+  packageRequires = lib.optional doLint package-lint;
+
+  doInstallCheck = doLint;
+  preInstallCheck = ''
+    lintEachFile() {
+      find $out/share/emacs \
+        -type f -name '*.el' \
+        -not -name "*-pkg.el" -not -name "*-autoloads.el" \
+        -print0 \
+      | xargs --verbose -0 -I {} -n 1 -P "$NIX_BUILD_CORES" "$@"
+    }
+
+    lintEachFile \
+      emacs --batch \
+        --funcall=package-activate-all \
+        --funcall=package-lint-batch-and-exit "{}"
+
+    lintEachFile \
+      emacs --batch \
+        "{}" \
+        --eval='(setopt checkdoc-arguments-in-order-flag t)' \
+        --funcall=checkdoc-batch
+
+    lintEachFile \
+      emacs --batch \
+        "{}" \
+        --eval='
+          (progn
+            ;; load indentation settings, if any, see (info "(emacs) Lisp Indent")
+            (eval-buffer)
+            (indent-region (point-min) (point-max))
+            (with-current-buffer
+                (diff-no-select buffer-file-name (current-buffer) nil t)
+              (goto-char (point-min))
+              (condition-case nil
+                  (let ((case-fold-search nil))
+                    (search-forward "Diff finished (no differences)"))
+                (search-failed
+                 (princ (buffer-string))
+                 (error "%s" "File indentation is wrong")))))'
+  '';
+}

From 4a183d7eb2598769b0fc4afe3c2b60b595d159ee Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Sat, 10 Oct 2026 02:52:24 +0800
Subject: [PATCH 249/525] emacs: test C source is available in withPackages
 test

This test will also be part of unwrapped Emacs test.
---
 .../emacs/build-support/wrapper-test/with-packages.el    | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
index b9fd90fe2141..7b61d22692e2 100644
--- a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
+++ b/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
@@ -161,6 +161,15 @@ Set this variable before running related tests.")
             (with-packages-eval-in-sub-emacs '(concat invocation-directory invocation-name)
                                              with-packages-unwrapped-emacs-program)))))
 
+(ert-deftest with-packages-c-source-is-available ()
+  :tags '(:shared-with-unwrapped)
+  (let ((function-to-find 'eval))
+    (ert-info ("this function is written in C")
+      (should (subr-primitive-p (symbol-function function-to-find))))
+    (ert-info ("C source code of this function can be found")
+      (should find-function-C-source-directory)
+      (should (cdr (find-function-noselect function-to-find))))))
+
 ;;;; Utils for non-batch tests
 
 (defmacro define-with-packages-non-batch-test-via-bound-and-true-p (test-name)

From 84dd9be79bdecca04ea65aa2b6bc166840682b03 Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Sat, 10 Oct 2026 02:54:07 +0800
Subject: [PATCH 250/525] emacs: rename test dir in preparation for more tests

---
 .../emacs/build-support/{wrapper-test => tests}/default.el      | 0
 .../emacs/build-support/{wrapper-test => tests}/default.nix     | 0
 .../build-support/{wrapper-test => tests}/early-default.el      | 0
 .../emacs/build-support/{wrapper-test => tests}/mk-epkg.nix     | 0
 .../build-support/{wrapper-test => tests}/with-packages.el      | 0
 pkgs/applications/editors/emacs/make-emacs.nix                  | 2 +-
 6 files changed, 1 insertion(+), 1 deletion(-)
 rename pkgs/applications/editors/emacs/build-support/{wrapper-test => tests}/default.el (100%)
 rename pkgs/applications/editors/emacs/build-support/{wrapper-test => tests}/default.nix (100%)
 rename pkgs/applications/editors/emacs/build-support/{wrapper-test => tests}/early-default.el (100%)
 rename pkgs/applications/editors/emacs/build-support/{wrapper-test => tests}/mk-epkg.nix (100%)
 rename pkgs/applications/editors/emacs/build-support/{wrapper-test => tests}/with-packages.el (100%)

diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/default.el b/pkgs/applications/editors/emacs/build-support/tests/default.el
similarity index 100%
rename from pkgs/applications/editors/emacs/build-support/wrapper-test/default.el
rename to pkgs/applications/editors/emacs/build-support/tests/default.el
diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix b/pkgs/applications/editors/emacs/build-support/tests/default.nix
similarity index 100%
rename from pkgs/applications/editors/emacs/build-support/wrapper-test/default.nix
rename to pkgs/applications/editors/emacs/build-support/tests/default.nix
diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/early-default.el b/pkgs/applications/editors/emacs/build-support/tests/early-default.el
similarity index 100%
rename from pkgs/applications/editors/emacs/build-support/wrapper-test/early-default.el
rename to pkgs/applications/editors/emacs/build-support/tests/early-default.el
diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/mk-epkg.nix b/pkgs/applications/editors/emacs/build-support/tests/mk-epkg.nix
similarity index 100%
rename from pkgs/applications/editors/emacs/build-support/wrapper-test/mk-epkg.nix
rename to pkgs/applications/editors/emacs/build-support/tests/mk-epkg.nix
diff --git a/pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el b/pkgs/applications/editors/emacs/build-support/tests/with-packages.el
similarity index 100%
rename from pkgs/applications/editors/emacs/build-support/wrapper-test/with-packages.el
rename to pkgs/applications/editors/emacs/build-support/tests/with-packages.el
diff --git a/pkgs/applications/editors/emacs/make-emacs.nix b/pkgs/applications/editors/emacs/make-emacs.nix
index 0f7e1f71879c..148ecb2d315f 100644
--- a/pkgs/applications/editors/emacs/make-emacs.nix
+++ b/pkgs/applications/editors/emacs/make-emacs.nix
@@ -485,7 +485,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkgs = lib.recurseIntoAttrs (emacsPackagesFor finalAttrs.finalPackage);
     tests = {
       inherit (nixosTests) emacs-daemon;
-      withPackages = callPackage ./build-support/wrapper-test {
+      withPackages = callPackage ./build-support/tests {
         emacs = finalAttrs.finalPackage;
       };
     };

From 5e6a4363881ba45df512f83c76670bf59560f2c6 Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Sat, 10 Oct 2026 02:58:04 +0800
Subject: [PATCH 251/525] emacs: rename withPackages test file in preparation
 for more tests

---
 .../build-support/tests/{default.nix => with-packages.nix}      | 0
 pkgs/applications/editors/emacs/make-emacs.nix                  | 2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename pkgs/applications/editors/emacs/build-support/tests/{default.nix => with-packages.nix} (100%)

diff --git a/pkgs/applications/editors/emacs/build-support/tests/default.nix b/pkgs/applications/editors/emacs/build-support/tests/with-packages.nix
similarity index 100%
rename from pkgs/applications/editors/emacs/build-support/tests/default.nix
rename to pkgs/applications/editors/emacs/build-support/tests/with-packages.nix
diff --git a/pkgs/applications/editors/emacs/make-emacs.nix b/pkgs/applications/editors/emacs/make-emacs.nix
index 148ecb2d315f..fc7017769db0 100644
--- a/pkgs/applications/editors/emacs/make-emacs.nix
+++ b/pkgs/applications/editors/emacs/make-emacs.nix
@@ -485,7 +485,7 @@ stdenv.mkDerivation (finalAttrs: {
     pkgs = lib.recurseIntoAttrs (emacsPackagesFor finalAttrs.finalPackage);
     tests = {
       inherit (nixosTests) emacs-daemon;
-      withPackages = callPackage ./build-support/tests {
+      withPackages = callPackage ./build-support/tests/with-packages.nix {
         emacs = finalAttrs.finalPackage;
       };
     };

From 86ba3b3e74e6e46dc40ba31e1aef42d625374d89 Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Sat, 10 Oct 2026 03:02:32 +0800
Subject: [PATCH 252/525] emacs: add unwrapped test

---
 .../emacs/build-support/tests/unwrapped.nix   | 33 +++++++++++++++++++
 .../applications/editors/emacs/make-emacs.nix |  3 ++
 2 files changed, 36 insertions(+)
 create mode 100644 pkgs/applications/editors/emacs/build-support/tests/unwrapped.nix

diff --git a/pkgs/applications/editors/emacs/build-support/tests/unwrapped.nix b/pkgs/applications/editors/emacs/build-support/tests/unwrapped.nix
new file mode 100644
index 000000000000..a9ac70dcc384
--- /dev/null
+++ b/pkgs/applications/editors/emacs/build-support/tests/unwrapped.nix
@@ -0,0 +1,33 @@
+{
+  runCommand,
+  emacs,
+  writeShellApplication,
+}:
+
+let
+  run-test = writeShellApplication {
+    name = "run-test";
+    runtimeInputs = [
+      emacs
+    ];
+    runtimeEnv = {
+      EMACS_TEST_VERBOSE = 1; # make ERT output verbose
+    };
+    text = ''
+      emacs --batch \
+        --load=${./with-packages.el} \
+        --eval="(ert-run-tests-batch-and-exit '(tag :shared-with-unwrapped))"
+    '';
+  };
+in
+runCommand "test-emacs-unwrapped"
+  {
+    nativeBuildInputs = [
+      run-test
+    ];
+  }
+  ''
+    run-test
+
+    touch $out
+  ''
diff --git a/pkgs/applications/editors/emacs/make-emacs.nix b/pkgs/applications/editors/emacs/make-emacs.nix
index fc7017769db0..346bfcd98824 100644
--- a/pkgs/applications/editors/emacs/make-emacs.nix
+++ b/pkgs/applications/editors/emacs/make-emacs.nix
@@ -488,6 +488,9 @@ stdenv.mkDerivation (finalAttrs: {
       withPackages = callPackage ./build-support/tests/with-packages.nix {
         emacs = finalAttrs.finalPackage;
       };
+      unwrapped = callPackage ./build-support/tests/unwrapped.nix {
+        emacs = finalAttrs.finalPackage;
+      };
     };
   };
 

From 3e486d119150f3e00d6c8a2bfb0c989a0d02882a Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Sat, 10 Oct 2026 03:05:08 +0800
Subject: [PATCH 253/525] emacs: do not add /run/current-system/sw/bin to
 tramp-remote-path

The default value of tramp-remote-path contains
tramp-default-remote-path which contains /run/current-system/sw/bin.
---
 pkgs/applications/editors/emacs/site-start.el | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/pkgs/applications/editors/emacs/site-start.el b/pkgs/applications/editors/emacs/site-start.el
index 4fcaf182cca5..ab193513d5d4 100644
--- a/pkgs/applications/editors/emacs/site-start.el
+++ b/pkgs/applications/editors/emacs/site-start.el
@@ -54,9 +54,7 @@ least specific (the system profile)"
   ;; TODO: We should also add the other `NIX_PROFILES' to this path.
   ;; However, these are user-specific, so we would need to discover
   ;; them dynamically after connecting via `tramp'
-  '(progn
-     (add-to-list 'tramp-remote-path "/run/current-system/sw/bin")
-     (add-to-list 'tramp-remote-path "/run/wrappers/bin")))
+  '(add-to-list 'tramp-remote-path "/run/wrappers/bin"))
 
 ;;; C source directory
 ;;;

From 049760681863a682da39236334e01b55d861a795 Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Sat, 10 Oct 2026 03:08:19 +0800
Subject: [PATCH 254/525] emacs: re-compute package-directory-list after
 extending load-path

Otherwise, package-installed-p does not work for Emacs lisp packages
in Nix profiles.  This is tested in the upcoming NixOS test.
---
 pkgs/applications/editors/emacs/site-start.el | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/applications/editors/emacs/site-start.el b/pkgs/applications/editors/emacs/site-start.el
index ab193513d5d4..dea915528e6b 100644
--- a/pkgs/applications/editors/emacs/site-start.el
+++ b/pkgs/applications/editors/emacs/site-start.el
@@ -16,6 +16,10 @@ least specific (the system profile)"
     (when (file-exists-p default-directory)
       (setq load-path (cons default-directory load-path))
       (normal-top-level-add-subdirs-to-load-path))))
+;; The default/standard value of `package-directory-list' depends on `load-path'.
+;; So we re-compute `package-directory-list' after modifying `load-path'.
+;; See Emacs bug https://debbugs.gnu.org/cgi/bugreport.cgi?bug=81982.
+(custom-reevaluate-setting 'package-directory-list)
 
 ;;; Set up native-comp load path.
 (when (featurep 'native-compile)

From bd18cd2a26fc5598e665750047dd11c97db4cc4f Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Sat, 10 Oct 2026 03:10:25 +0800
Subject: [PATCH 255/525] emacs: add a NixOS test

---
 nixos/tests/all-tests.nix                     |   1 +
 nixos/tests/emacs/default.nix                 | 132 ++++++++++++++++++
 nixos/tests/emacs/nixos.el                    |  90 ++++++++++++
 .../applications/editors/emacs/make-emacs.nix |   5 +
 4 files changed, 228 insertions(+)
 create mode 100644 nixos/tests/emacs/default.nix
 create mode 100644 nixos/tests/emacs/nixos.el

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 5b2eb1e4fc9d..7be797ca53e7 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -595,6 +595,7 @@ in
   ejabberd = runTest ./xmpp/ejabberd.nix;
   elk = handleTestOn [ "x86_64-linux" ] ./elk.nix { };
   elk-zone = runTest ./web-apps/elk.nix;
+  emacs = runTest ./emacs;
   emacs-daemon = runTest ./emacs-daemon.nix;
   endlessh = runTest ./endlessh.nix;
   endlessh-go = runTest ./endlessh-go.nix;
diff --git a/nixos/tests/emacs/default.nix b/nixos/tests/emacs/default.nix
new file mode 100644
index 000000000000..7740024b627b
--- /dev/null
+++ b/nixos/tests/emacs/default.nix
@@ -0,0 +1,132 @@
+{
+  lib,
+  nodes,
+  ...
+}:
+
+{
+  name = "emacs";
+  meta.maintainers = lib.teams.emacs.members;
+
+  defaults =
+    {
+      lib,
+      pkgs,
+      config,
+      ...
+    }:
+    {
+      options.tests.emacs = {
+        package = lib.mkPackageOption pkgs "Emacs" {
+          default = [ "emacs" ];
+          example = [ "emacs-nox" ];
+        };
+        wrappedPackage = lib.mkOption {
+          type = lib.types.package;
+          default = config.tests.emacs.package.pkgs.withPackages (epkgs: [
+            epkgs.project-nix-store
+          ]);
+          defaultText = lib.literalExpression ''
+            package.pkgs.withPackages (epkgs: [ epkgs.project-nix-store ])
+          '';
+          readOnly = true;
+          description = "Emacs wrapped by withPackages.";
+        };
+      };
+    };
+
+  nodes.local =
+    {
+      pkgs,
+      config,
+      lib,
+      ...
+    }:
+    let
+      cfg = config.tests.emacs;
+      mkEpkg = import ../../../pkgs/applications/editors/emacs/build-support/tests/mk-epkg.nix {
+        inherit lib;
+      };
+    in
+    {
+      environment.systemPackages = [
+        # Make sure closure of this machine contains both unwrapped and wrapped Emacs
+        # so that we can run them in the test script.
+        cfg.wrappedPackage
+
+        # Tests
+        (cfg.package.pkgs.callPackage (mkEpkg {
+          pname = "nixos";
+          src = ./nixos.el;
+        }) { })
+      ]
+      ++ [
+        cfg.package.pkgs.orderless
+        pkgs.cmatrix
+      ];
+      users.users.root.packages = [
+        cfg.package.pkgs.dash
+        pkgs.hello
+      ];
+
+      environment.etc.ssh-private-key = {
+        source = (import ../ssh-keys.nix pkgs).snakeOilEd25519PrivateKey;
+        mode = "0600";
+      };
+      programs.ssh.extraConfig = ''
+        StrictHostKeyChecking=no
+        IdentityFile=/etc/${config.environment.etc.ssh-private-key.target}
+      '';
+      systemd.targets.network-online.wantedBy = [ "multi-user.target" ];
+      systemd.services.wait-ssh-to-remote = {
+        description = "Wait for SSH to Remote";
+        documentation = [
+          "https://systemd.io/NETWORK_ONLINE/#modifying-the-meaning-of-network-onlinetarget"
+          "man:systemd.special(7)"
+        ];
+        after = [ "nss-lookup.target" ];
+        before = [ "network-online.target" ];
+        wantedBy = [ "network-online.target" ];
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+        };
+        path = [ config.programs.ssh.package ];
+        script = ''
+          until ssh -o ConnectTimeout=1 ${nodes.remote.networking.hostName} true
+          do
+            sleep 1
+          done
+        '';
+      };
+
+      environment.sessionVariables = {
+        EMACS_TEST_VERBOSE = 1; # Make ERT output verbose
+      };
+    };
+
+  nodes.remote = { pkgs, ... }: {
+    environment.systemPackages = [
+      pkgs.sl
+    ];
+    security.sudo.enable = true;
+
+    services.openssh.enable = true;
+    users.users.root.openssh.authorizedKeys.keys = [
+      (import ../ssh-keys.nix pkgs).snakeOilEd25519PublicKey
+    ];
+  };
+
+  testScript = ''
+    start_all()
+
+    for machine in (local, remote):
+      machine.wait_for_unit("default.target")
+
+    for emacs in (
+      "${lib.getExe nodes.local.tests.emacs.package}",
+      "${lib.getExe nodes.local.tests.emacs.wrappedPackage}",
+    ):
+      local.succeed(f'{emacs} --batch --load=nixos --funcall=ert-run-tests-batch-and-exit')
+  '';
+}
diff --git a/nixos/tests/emacs/nixos.el b/nixos/tests/emacs/nixos.el
new file mode 100644
index 000000000000..58c0c63fa439
--- /dev/null
+++ b/nixos/tests/emacs/nixos.el
@@ -0,0 +1,90 @@
+;;; nixos.el --- Emacs tests related to Nix or NixOS  -*- lexical-binding: t; -*-
+
+;; Version: 0.1.0
+;; Package-Requires: ((emacs "29.1"))
+;; URL: https://example.com
+
+;;; Commentary:
+
+;; Emacs tests related to Nix or NixOS.
+
+;;; Code:
+
+(require 'ert)
+(eval-when-compile (require 'cl-lib))
+(require 'woman)
+(require 'info)
+
+;;;; Utils
+
+(defun nixos--locate-eln-file (library)
+  "Locate the natively-compiled LIBRARY file."
+  (declare-function comp-el-to-eln-rel-filename "comp.c")
+  (locate-eln-file (comp-el-to-eln-rel-filename (find-library-name library))))
+
+(defun nixos--ancestor-dir-of-file-p (dir file)
+  "Return t if DIR is an ancestor of FILE."
+  (locate-dominating-file file
+                          (lambda (current-dir)
+                            (string= current-dir (file-name-as-directory dir)))))
+
+(defun nixos--in-nix-profiles-p (file)
+  "Return t if FILE is in nix profiles."
+  (declare-function nix--profile-paths "site-start")
+  (cl-loop for profile-dir in (nix--profile-paths)
+           thereis (nixos--ancestor-dir-of-file-p profile-dir file)))
+
+;;;; Tests
+
+(ert-deftest nixos-packages-in-nix-profiles-are-available ()
+  (ert-info ("nix system profile")
+    (should (package-installed-p 'orderless)))
+  (ert-info ("nix user profile")
+    (should (package-installed-p 'dash))))
+
+(ert-deftest nixos-aot-native-comp-eln-files-of-packages-in-nix-profiles-are-available ()
+  (skip-unless (native-comp-available-p))
+  (ert-info ("nix system profile")
+    (should (nixos--in-nix-profiles-p (nixos--locate-eln-file "orderless"))))
+  (ert-info ("nix user profile")
+    (should (nixos--in-nix-profiles-p (nixos--locate-eln-file "dash")))))
+
+(ert-deftest nixos-woman-can-find-manuals-in-nix-profiles ()
+  (ert-info ("nix system profile")
+    (should (woman-file-name "cmatrix")))
+  (ert-info ("nix user profile")
+    (should (woman-file-name "hello"))))
+
+(ert-deftest nixos-info-manuals-of-packages-in-nix-profiles-are-available ()
+  "Test https://debbugs.gnu.org/cgi/bugreport.cgi?bug=81105."
+  (unless package--activated
+    (package-activate-all))
+  (ert-info ("nix system profile")
+    (should (Info-find-file "orderless" t)))
+  (ert-info ("nix user profile")
+    (should (Info-find-file "dash" t))))
+
+(ert-deftest nixos-tramp-knows-nix-specific-path ()
+  ;; Security wrappers are added to two PATH dirs:
+  ;;   /run/wrappers/bin/ and /run/current-system/sw/bin.
+  ;; So, in addition to testing if the security wrapper can be found,
+  ;; we also test if the found security wrapper is the right one.
+  (cl-loop
+   for (program program-dir) in '(("sl")
+                                  ("sudo" "/run/wrappers/bin"))
+   do
+   (ert-info ((format "program %s is found remotely" program))
+     (let ((found-program (let ((default-directory "/ssh:remote:"))
+                            (executable-find program t))))
+       (should found-program)
+       (when program-dir
+         (should (equal found-program
+                        (expand-file-name program program-dir))))))))
+
+(provide 'nixos)
+
+;;; nixos.el ends here
+
+;; Local Variables:
+;; checkdoc-force-docstrings-flag: nil
+;; End:
diff --git a/pkgs/applications/editors/emacs/make-emacs.nix b/pkgs/applications/editors/emacs/make-emacs.nix
index 346bfcd98824..435e2750b213 100644
--- a/pkgs/applications/editors/emacs/make-emacs.nix
+++ b/pkgs/applications/editors/emacs/make-emacs.nix
@@ -485,6 +485,11 @@ stdenv.mkDerivation (finalAttrs: {
     pkgs = lib.recurseIntoAttrs (emacsPackagesFor finalAttrs.finalPackage);
     tests = {
       inherit (nixosTests) emacs-daemon;
+      nixos = nixosTests.emacs.extendNixOS {
+        module = {
+          tests.emacs.package = finalAttrs.finalPackage;
+        };
+      };
       withPackages = callPackage ./build-support/tests/with-packages.nix {
         emacs = finalAttrs.finalPackage;
       };

From 6238195bacb81280f906fd40e63896b778896cb7 Mon Sep 17 00:00:00 2001
From: Andrew Marshall <andrew@johnandrewmarshall.com>
Date: Wed, 7 Oct 2026 23:12:25 -0400
Subject: [PATCH 256/525] python3Packages.vllm: fix not propagating environ in
 model reg

The patch adds PYTHONPATH, but that also meant the entire existing
environment was removed unlike before. This means some things like
TRITON_CACHE_DIR do not get passed and respected. Fix.
---
 .../python-modules/vllm/0003-propagate-pythonpath.patch         | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/vllm/0003-propagate-pythonpath.patch b/pkgs/development/python-modules/vllm/0003-propagate-pythonpath.patch
index b7ca770d45d6..afafe28c0287 100644
--- a/pkgs/development/python-modules/vllm/0003-propagate-pythonpath.patch
+++ b/pkgs/development/python-modules/vllm/0003-propagate-pythonpath.patch
@@ -7,7 +7,7 @@ index a2de597c8..4c2410209 100644
          # contains relative imports
          returned = subprocess.run(
 -            _SUBPROCESS_COMMAND, input=input_bytes, capture_output=True
-+            _SUBPROCESS_COMMAND, input=input_bytes, capture_output=True, env={'PYTHONPATH': ':'.join(sys.path)},
++            _SUBPROCESS_COMMAND, input=input_bytes, capture_output=True, env={**os.environ, 'PYTHONPATH': ':'.join(sys.path)},
          )
  
          # check if the subprocess is successful

From 1e01958d2ac18f493a22d18a0f6424e9334ce208 Mon Sep 17 00:00:00 2001
From: Felix Buehler <account@buehler.rocks>
Date: Fri, 9 Oct 2026 22:59:23 +0200
Subject: [PATCH 257/525] canokey-usbip: fix build with GCC 16

The vendored mbedtls is compiled with -Werror, and GCC 16 reports
set-but-unused variables and parameters (-Wunused-but-set-variable,
-Wunused-but-set-parameter).

Assisted-by: claude-opus-5-5
---
 pkgs/by-name/ca/canokey-usbip/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/ca/canokey-usbip/package.nix b/pkgs/by-name/ca/canokey-usbip/package.nix
index 4fde140277b4..56f339e4b716 100644
--- a/pkgs/by-name/ca/canokey-usbip/package.nix
+++ b/pkgs/by-name/ca/canokey-usbip/package.nix
@@ -37,6 +37,9 @@ stdenv.mkDerivation (finalAttrs: {
   env = {
     NIX_CFLAGS_COMPILE = toString [
       "-Wno-error=incompatible-pointer-types"
+      # GCC 16 warns about set-but-unused variables/parameters in the vendored mbedtls
+      "-Wno-error=unused-but-set-variable"
+      "-Wno-error=unused-but-set-parameter"
       (lib.optionalString stdenv.cc.isClang "-Wno-error=documentation")
     ];
   };

From a82ee29597a857680adb1cf0b98630e94d59d148 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 9 Oct 2026 22:14:09 +0000
Subject: [PATCH 258/525] python3Packages.google-cloud-resource-manager: 1.18.0
 -> 1.19.0

---
 .../python-modules/google-cloud-resource-manager/default.nix  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-resource-manager/default.nix b/pkgs/development/python-modules/google-cloud-resource-manager/default.nix
index 1724591a76f9..f19ffc2c3f85 100644
--- a/pkgs/development/python-modules/google-cloud-resource-manager/default.nix
+++ b/pkgs/development/python-modules/google-cloud-resource-manager/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "google-cloud-resource-manager";
-  version = "1.18.0";
+  version = "1.19.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_resource_manager";
     inherit (finalAttrs) version;
-    hash = "sha256-22ifgAoUxm0EEZan+7i7iq6NyH8owpKeEBpex2axVRI=";
+    hash = "sha256-aOXSjtkJGrGt8Ep3h2sJ1VPpekQPungWP2zitf5fJVg=";
   };
 
   build-system = [ setuptools ];

From ce1414cdfbbc72c9d453362b263d2c1a9adfa144 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 10 Oct 2026 00:39:29 +0000
Subject: [PATCH 259/525] emacsPackages.ghostel: 0.56.0 -> 0.57.0

---
 .../emacs/elisp-packages/manual-packages/ghostel/package.nix  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix
index b0ec9c32f574..c2bc461573d1 100644
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/ghostel/package.nix
@@ -58,13 +58,13 @@ in
 melpaBuild (finalAttrs: {
   pname = "ghostel";
 
-  version = "0.56.0";
+  version = "0.57.0";
 
   src = fetchFromGitHub {
     owner = "dakra";
     repo = "ghostel";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NpfnlggAcThNw9uY7Uq4qFPEJ+md8aZ8i32CQSUKz+w=";
+    hash = "sha256-vPegePT5n11cI+eq9VWl0u068b2o50A4Wo8qcdYwJ34=";
   };
 
   # these can be put into mkModule, but we put them here to ease user overrideAttrs

From 3141b43b6501e2b7a639e122da2636f14db6e30a Mon Sep 17 00:00:00 2001
From: mmenanno <1358708+mmenanno@users.noreply.github.com>
Date: Fri, 9 Oct 2026 20:40:50 -0400
Subject: [PATCH 260/525] gh-stack: 0.1.1 -> 0.2.1

Changelog: https://github.com/github/gh-stack/releases/tag/v0.2.1

Run `git init` in preCheck: the new modifyview insert tests check branch
names through git and fail outside a repository.

Skip installAgentSkills in the go-modules derivation, which inherits the
hook but has no pname.
---
 pkgs/by-name/gh/gh-stack/package.nix | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gh/gh-stack/package.nix b/pkgs/by-name/gh/gh-stack/package.nix
index c5652e927b7c..f223a4c1bf79 100644
--- a/pkgs/by-name/gh/gh-stack/package.nix
+++ b/pkgs/by-name/gh/gh-stack/package.nix
@@ -10,7 +10,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "gh-stack";
-  version = "0.1.1";
+  version = "0.2.1";
 
   __structuredAttrs = true;
 
@@ -18,10 +18,15 @@ buildGoModule (finalAttrs: {
     owner = "github";
     repo = "gh-stack";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jwfqiCnCOOW0AKA52hbgvCCoLzfFX+QfM+vXABkzZgw=";
+    hash = "sha256-Mq4jAqeSHDuCiDYSa40okrq06UhC3dZGjgCXJKMbgzU=";
   };
 
-  vendorHash = "sha256-0Xtr/MOpX4u5GnbRdNxKPA0GpSzi8PIbVc9MmP05De4=";
+  vendorHash = "sha256-TC1mSXYjOQo00fb2yuGdk1rl6z6rp0WT3AmzXomPzis=";
+
+  # the go-modules derivation inherits the installAgentSkills hook but has no pname
+  overrideModAttrs = _: {
+    dontInstallAgentSkills = true;
+  };
 
   ldflags = [
     "-s"
@@ -34,6 +39,11 @@ buildGoModule (finalAttrs: {
 
   nativeCheckInputs = [ gitMinimal ];
 
+  # some tests resolve branches through git and need to run inside a repository
+  preCheck = ''
+    git init --quiet
+  '';
+
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
 

From 57dccec55f91cf839776b48e7efe60ddaae99049 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 7 Oct 2026 05:31:25 +0100
Subject: [PATCH 261/525] linux: fix Rust source path remapping on Linux < 7.0

---
 pkgs/os-specific/linux/kernel/build.nix | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/kernel/build.nix b/pkgs/os-specific/linux/kernel/build.nix
index 6f5f6857504b..d3d87964e717 100644
--- a/pkgs/os-specific/linux/kernel/build.nix
+++ b/pkgs/os-specific/linux/kernel/build.nix
@@ -322,7 +322,14 @@ lib.makeOverridable (
 
       # avoid leaking Rust source file names into the final binary, which adds
       # a false dependency on rust-lib-src on targets with uncompressed kernels
-      KRUSTFLAGS = lib.optionalString withRust "--remap-path-prefix ${rustPlatform.rustLibSrc}=/";
+      KRUSTFLAGS = lib.optionalString withRust (
+        "--remap-path-prefix ${rustPlatform.rustLibSrc}=/"
+        # Apply the equivalent of upstream commit
+        # dda135077ecc9f15c407f094dcfe7800376be867 to older versions to
+        # avoid cyclic output dependency issues when building
+        # uncompressed kernel images.
+        + lib.optionalString (lib.versionOlder version "7.0") " --remap-path-prefix=${placeholder "dev"}/lib/modules/${modDirVersion}/source/= --remap-path-scope=macro"
+      );
     };
 
     makeFlags = [

From 42f4cc3a70dfee64ba246bcb2be5764414432201 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 8 Jul 2026 09:15:39 +0100
Subject: [PATCH 262/525] linux: unpack source tree into the final location

This saves copying it after the build, and avoids issues relating
to the kernel build system recording the absolute directory of the
source tree and triggering unnecessary rebuilds when it changes.
---
 pkgs/os-specific/linux/kernel/build.nix | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/build.nix b/pkgs/os-specific/linux/kernel/build.nix
index d3d87964e717..9be928f40796 100644
--- a/pkgs/os-specific/linux/kernel/build.nix
+++ b/pkgs/os-specific/linux/kernel/build.nix
@@ -359,6 +359,16 @@ lib.makeOverridable (
     ]
     ++ commonMakeFlags;
 
+    preUnpack = ''
+      mkdir -p "$dev/lib/modules/${modDirVersion}"
+      cd "$dev/lib/modules/${modDirVersion}"
+    '';
+
+    postUnpack = ''
+      mv "$sourceRoot" source
+      sourceRoot=source
+    '';
+
     postPatch = ''
       # Set randstruct seed to a deterministic but diversified value. Note:
       # we could have instead patched gen-random-seed.sh to take input from
@@ -385,8 +395,8 @@ lib.makeOverridable (
     configurePhase = ''
       runHook preConfigure
 
-      mkdir build
-      export buildRoot="$(pwd)/build"
+      export buildRoot="$NIX_BUILD_TOP/build"
+      mkdir -- "$buildRoot"
 
       echo "manual-config configurePhase buildRoot=$buildRoot pwd=$PWD"
 
@@ -424,12 +434,7 @@ lib.makeOverridable (
 
       unlink $modules/lib/modules/${modDirVersion}/build
 
-      mkdir -p $dev/lib/modules/${modDirVersion}/{build,source}
-
-      # To save space, exclude a bunch of unneeded stuff when copying.
-      (cd .. && rsync --archive --prune-empty-dirs \
-          --exclude='/build/' \
-          * $dev/lib/modules/${modDirVersion}/source/)
+      mkdir -p $dev/lib/modules/${modDirVersion}/build
 
       cd $dev/lib/modules/${modDirVersion}/source
 

From 739a9b2ec00abde3d3aca56288329c12e5da8c27 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 8 Jul 2026 09:15:39 +0100
Subject: [PATCH 263/525] linux: use `make clean` instead of explicit
 `modules_prepare`

`make clean` is [documented] to leave enough to build external modules,
which it almost does for our purposes (we also need to keep `vmlinux`
and `resolve_btfids`, and PowerPC is weird). We can avoid redundant
builds and simplify our packaging by using it and then moving the
entire build directory.

[documented]:
<https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Makefile?h=v7.2#n1982>

This also shrinks the `dev` output by dropping some intermediate
object files from `scripts/`.
---
 pkgs/os-specific/linux/kernel/build.nix | 70 +++++++++++++++----------
 1 file changed, 42 insertions(+), 28 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/build.nix b/pkgs/os-specific/linux/kernel/build.nix
index 9be928f40796..f9dd194fdf59 100644
--- a/pkgs/os-specific/linux/kernel/build.nix
+++ b/pkgs/os-specific/linux/kernel/build.nix
@@ -417,51 +417,63 @@ lib.makeOverridable (
         echo "Error: modDirVersion ${modDirVersion} specified in the Nix expression is wrong, it should be: $actualModDirVersion"
         exit 1
       fi
-
-      cd $buildRoot
     '';
 
     postInstall = ''
-      mkdir -p $dev
-      cp vmlinux $dev/
-    ''
-    + optionalString isModular ''
-      mkdir -p $dev/lib/modules/${modDirVersion}/build/scripts
-      # Installing from source dir instead of $buildRoot so as to omit intermediate artifacts.
-      cp -rL ../scripts/gdb/ $dev/lib/modules/${modDirVersion}/build/scripts
-      # Installing `constants.py` from `$buildRoot` as it's generated.
-      cp scripts/gdb/linux/constants.py $dev/lib/modules/${modDirVersion}/build/scripts/gdb/linux
+      # Keep some extra files.
+      shopt -s extglob
+      keepPaths=(
+        # Required for building external modules with BTF information.
+        "$buildRoot/vmlinux"
+        "$buildRoot/tools/bpf/resolve_btfids/resolve_btfids"
 
-      unlink $modules/lib/modules/${modDirVersion}/build
+        # Possibly not required by anything, but we kept it before,
+        # Fedora and Arch keep it around, and it seems like it might be
+        # generally useful.
+        "$buildRoot/.config"
 
-      mkdir -p $dev/lib/modules/${modDirVersion}/build
+        # Required for building external modules on some PowerPC
+        # configurations.
+        "$buildRoot/arch/powerpc/lib/crtsavres.o"
+      )
+      shopt -u extglob
 
-      cd $dev/lib/modules/${modDirVersion}/source
-
-      cp $buildRoot/{.config,Module.symvers} $dev/lib/modules/${modDirVersion}/build
-      make modules_prepare "''${makeFlags[@]}" O=$dev/lib/modules/${modDirVersion}/build
-
-      # Keep an extra file on powerpc
-      for f in arch/powerpc/lib/crtsavres.o; do
-        if [ -f "$buildRoot/$f" ]; then
-          mkdir -p "$(dirname $dev/lib/modules/${modDirVersion}/build/$f)"
-          cp $buildRoot/$f $dev/lib/modules/${modDirVersion}/build/$f
+      keepRoot=$(mktemp -d)
+      for path in "''${keepPaths[@]}"; do
+        if [[ -e $path ]]; then
+          keepPath=''${path/#"$buildRoot"/"$keepRoot"}
+          mkdir -p -- "''${keepPath%/*}"
+          mv -- "$path" "$keepPath"
         fi
       done
 
+      make "''${makeFlags[@]}" clean
+
+      find -- "$buildRoot" -type d -empty -delete
+      mv -- "$buildRoot" ..
+      buildRoot="$dev/lib/modules/${modDirVersion}/build"
+      cp -a -- "$keepRoot/." "$buildRoot/"
+
+      # Ensure that `KBUILD_OUTPUT` is set correctly in the retained
+      # build tree’s Makefile; otherwise e.g. the ZFS build breaks.
+      make "''${makeFlags[@]}" outputmakefile
+
+      ln -s "$buildRoot/vmlinux" "$dev/"
+
+      if [[ -v modules ]]; then
+        unlink $modules/lib/modules/${modDirVersion}/build
+      fi
+
       # !!! No documentation on how much of the source tree must be kept
       # If/when kernel builds fail due to missing files, you can add
       # them here. Note that we may see packages requiring headers
       # from drivers/ in the future; it adds 50M to keep all of its
       # headers on 3.10 though.
 
-      chmod u+w -R ..
-      buildArchDir="$dev/lib/modules/${modDirVersion}/build/arch"
-
       # Remove unused arches
       for d in $(cd arch/; ls); do
-        if [ -d "$buildArchDir/$d" ]; then continue; fi
-        if [ -d "$buildArchDir/arm64" ] && [ "$d" = arm ]; then continue; fi
+        if [ -d "$buildRoot/arch/$d" ]; then continue; fi
+        if [ -d "$buildRoot/arch/arm64" ] && [ "$d" = arm ]; then continue; fi
         rm -rf arch/$d
       done
 
@@ -496,6 +508,8 @@ lib.makeOverridable (
       fi
     '';
 
+    stripExclude = [ "lib/modules/${modDirVersion}/build/vmlinux" ];
+
     requiredSystemFeatures = [ "big-parallel" ];
 
     passthru = rec {

From b47137a0622978d0e301cbf2d7d37897a323dbd0 Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 9 Sep 2026 23:35:48 +0100
Subject: [PATCH 264/525] linux: use `stripDebugList` to strip `$out/vmlinux`
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is only relevant when the `vmlinux` ELF target is used.

As before, we don’t strip the `vmlinux` in the `dev` output (which
makes it extremely huge and makes the stripping of the source tree
we do quite pointless, but that’s a matter for another day…),
as that’s a symlink since the previous commit.
---
 pkgs/os-specific/linux/kernel/build.nix | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/build.nix b/pkgs/os-specific/linux/kernel/build.nix
index f9dd194fdf59..76c502277b04 100644
--- a/pkgs/os-specific/linux/kernel/build.nix
+++ b/pkgs/os-specific/linux/kernel/build.nix
@@ -502,11 +502,13 @@ lib.makeOverridable (
       find -empty -type d -delete
     '';
 
-    preFixup = ''
-      if [ -z "''${dontStrip-}" -a -e $out/vmlinux ]; then
-        $STRIP -v -S -p $out/vmlinux
-      fi
-    '';
+    stripDebugList = [
+      "lib"
+
+      # Only relevant for `$out/vmlinux` when that target is used; this
+      # doesn’t strip `$dev/vmlinux`, as it’s a symbolic link.
+      "vmlinux"
+    ];
 
     stripExclude = [ "lib/modules/${modDirVersion}/build/vmlinux" ];
 

From cf4da14a338e16c9509e4ca2d7d451506478c42a Mon Sep 17 00:00:00 2001
From: Emily <vcs@emily.moe>
Date: Wed, 8 Jul 2026 09:15:39 +0100
Subject: [PATCH 265/525] =?UTF-8?q?linux:=20don=E2=80=99t=20run=20`make=20?=
 =?UTF-8?q?prepare`=20before=20checking=20`modDirVersion`?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The kernel has an explicit top‐level target for this file we can use
to catch the error more quickly.
---
 pkgs/os-specific/linux/kernel/build.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/kernel/build.nix b/pkgs/os-specific/linux/kernel/build.nix
index 76c502277b04..f9db4974c5d4 100644
--- a/pkgs/os-specific/linux/kernel/build.nix
+++ b/pkgs/os-specific/linux/kernel/build.nix
@@ -411,7 +411,7 @@ lib.makeOverridable (
       make "''${makeFlags[@]}" oldconfig
       runHook postConfigure
 
-      make "''${makeFlags[@]}" prepare
+      make "''${makeFlags[@]}" include/config/kernel.release
       actualModDirVersion="$(cat $buildRoot/include/config/kernel.release)"
       if [ "$actualModDirVersion" != "${modDirVersion}" ]; then
         echo "Error: modDirVersion ${modDirVersion} specified in the Nix expression is wrong, it should be: $actualModDirVersion"

From a9a6f047e5e4484d35c6257689385b117fdd5e86 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 10 Oct 2026 02:15:01 +0000
Subject: [PATCH 266/525] newsboat: 2.44 -> 2.45

---
 pkgs/by-name/ne/newsboat/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ne/newsboat/package.nix b/pkgs/by-name/ne/newsboat/package.nix
index f803c4446e68..3ec056f6b321 100644
--- a/pkgs/by-name/ne/newsboat/package.nix
+++ b/pkgs/by-name/ne/newsboat/package.nix
@@ -21,18 +21,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "newsboat";
-  version = "2.44";
+  version = "2.45";
 
   src = fetchFromGitHub {
     owner = "newsboat";
     repo = "newsboat";
     tag = "r${finalAttrs.version}";
-    hash = "sha256-OV7WpM0NBfqOtFv9Co728UwHut4HhT2u5qgvamy/FAg=";
+    hash = "sha256-3joEytlm0KPLF7hbIG+9X6X+D6ydeLFTRrWf14j3p+E=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-HJZnbQ7TDJ9zg0Rav1PCMEymaYy/mSxnrr2gkv4pTX0=";
+    hash = "sha256-Tp1P/kE21jtM8vxBwy0FmScPU2LTHx9EH6YfhCWn0kE=";
   };
 
   # allow other ncurses versions on Darwin

From c65180d90deb915a825c9e3cd5eae613e4cadf4e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 10 Oct 2026 03:46:53 +0000
Subject: [PATCH 267/525] diffoscope: 332 -> 333

---
 pkgs/by-name/di/diffoscope/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/di/diffoscope/package.nix b/pkgs/by-name/di/diffoscope/package.nix
index c0a7887ff6ee..3858158f9d5a 100644
--- a/pkgs/by-name/di/diffoscope/package.nix
+++ b/pkgs/by-name/di/diffoscope/package.nix
@@ -112,12 +112,12 @@ in
 # Note: when upgrading this package, please run the list-missing-tools.sh script as described below!
 python.pkgs.buildPythonApplication rec {
   pname = "diffoscope";
-  version = "332";
+  version = "333";
   pyproject = true;
 
   src = fetchurl {
     url = "https://diffoscope.org/archive/diffoscope-${version}.tar.bz2";
-    hash = "sha256-eNmrIxt0yQlby20WRXgKBVXZ2jNnNLpksOvr25dXJvI=";
+    hash = "sha256-KHjYLCd2f5DRQRhG0L97Og8b20dZUyJq4BtWShVKFos=";
   };
 
   outputs = [

From 73d04a3d8630d6daca8bc603256fe2c79a0c8c7d Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Fri, 25 Sep 2026 11:56:03 -0400
Subject: [PATCH 268/525] codex: stamp builds with release commit

The voice helper accepts only clients carrying the same build
identity. Codex doctor also reports the revision as build
provenance. Resolve each release tag to its commit and pass that
revision to both upstream stamping interfaces.

Assisted-by: Codex, gpt-5.6-sol high
---
 pkgs/by-name/co/codex/package.nix            |  8 +++++++-
 pkgs/by-name/co/codex/update-build-commit.sh | 18 ++++++++++++++++++
 2 files changed, 25 insertions(+), 1 deletion(-)
 create mode 100755 pkgs/by-name/co/codex/update-build-commit.sh

diff --git a/pkgs/by-name/co/codex/package.nix b/pkgs/by-name/co/codex/package.nix
index 37c7ea40cc76..5fb12488221a 100644
--- a/pkgs/by-name/co/codex/package.nix
+++ b/pkgs/by-name/co/codex/package.nix
@@ -34,10 +34,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
   src = fetchFromGitHub {
     owner = "openai";
     repo = "codex";
-    tag = "rust-v${finalAttrs.version}";
+    rev = finalAttrs.buildCommit;
     hash = "sha256-vYVQoXQdaK0bejUzcpf9uVrzNWWWAct9AsO/t261FAs=";
   };
 
+  # Matching client/helper stamps; build_id() requires a full commit SHA.
+  buildCommit = "092d3acd6bec3e3a14bdc7e7a2810ab628ab759d";
+
   sourceRoot = "${finalAttrs.src.name}/codex-rs";
 
   cargoHash = "sha256-UTu+ws1DqL375C+1jaVI9HBqDHnTuAQr7/h1rSzsEzg=";
@@ -94,6 +97,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # stringop-overflow in BoringSSL's a_bitstr.cc) while keeping Clang's
   # character-conversion warning-as-error disabled.
   env = {
+    CODEX_BUILD_COMMIT = finalAttrs.buildCommit;
     LIBCLANG_PATH = "${lib.getLib libclang}/lib";
     NIX_CFLAGS_COMPILE = toString (
       lib.optionals stdenv.cc.isGNU [
@@ -105,6 +109,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     );
     RUSTY_V8_ARCHIVE = librusty_v8;
     RUSTY_V8_SRC_BINDING_PATH = librusty_v8_src_binding;
+    STABLE_GIT_COMMIT = finalAttrs.buildCommit;
   }
   // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
     # Link with lld on Darwin. nixpkgs' classic open-source ld64 fails to insert
@@ -137,6 +142,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   nativeInstallCheckInputs = [ versionCheckHook ];
 
   passthru.updateScript = _experimental-update-script-combinators.sequence [
+    ./update-build-commit.sh
     (nix-update-script {
       extraArgs = [
         "--use-github-releases"
diff --git a/pkgs/by-name/co/codex/update-build-commit.sh b/pkgs/by-name/co/codex/update-build-commit.sh
new file mode 100755
index 000000000000..1962e9df2b7c
--- /dev/null
+++ b/pkgs/by-name/co/codex/update-build-commit.sh
@@ -0,0 +1,18 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq gnused
+# shellcheck shell=bash
+
+set -eu -o pipefail
+
+package_dir=$(dirname "$(readlink --canonicalize-existing "${BASH_SOURCE[0]}")")
+package_file="$package_dir/package.nix"
+release=$(curl ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} --silent --fail --location \
+  "https://api.github.com/repos/openai/codex/releases/latest")
+tag=$(jq --exit-status --raw-output '.tag_name' <<<"$release")
+commit=$(curl ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} --silent --fail --location \
+  "https://api.github.com/repos/openai/codex/commits/$tag" \
+  | jq --exit-status --raw-output '.sha')
+
+sed --in-place --regexp-extended \
+  "s|buildCommit = \"[0-9a-f]{40}\";|buildCommit = \"$commit\";|" \
+  "$package_file"

From 29f74b5c1c113f9d2ccbe325622910dc805a0fcc Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Fri, 25 Sep 2026 11:56:50 -0400
Subject: [PATCH 269/525] codex: install package layout metadata

The voice client discovers companion binaries only through an
installed package layout. Source builds lack the distribution metadata,
so install the equivalent metadata beside the Codex binary.

Link rg, and bwrap on Linux, from their immutable Nix store outputs.
Allow only declared dependency roots when the daemon validates the
package; it materializes those file links in the managed copy. Use the
packaged ps path when recording daemon process identity.

A wrapper is redundant and makes the running executable differ from the
manifest entrypoint, preventing daemon startup.

Exercise the packaged daemon startup path on Linux to keep the layout
complete.

Assisted-by: Codex, gpt-5.6-sol high
---
 .../by-name/co/codex/nix-package-layout.patch | 30 +++++++++++
 pkgs/by-name/co/codex/package.nix             | 52 +++++++++++++++----
 .../co/codex/test-app-server-daemon.nix       | 22 ++++++++
 3 files changed, 95 insertions(+), 9 deletions(-)
 create mode 100644 pkgs/by-name/co/codex/nix-package-layout.patch
 create mode 100644 pkgs/by-name/co/codex/test-app-server-daemon.nix

diff --git a/pkgs/by-name/co/codex/nix-package-layout.patch b/pkgs/by-name/co/codex/nix-package-layout.patch
new file mode 100644
index 000000000000..486464dac63a
--- /dev/null
+++ b/pkgs/by-name/co/codex/nix-package-layout.patch
@@ -0,0 +1,30 @@
+diff --git a/app-server-daemon/src/backend/pid.rs b/app-server-daemon/src/backend/pid.rs
+index 22e34d9..298c989 100644
+--- a/app-server-daemon/src/backend/pid.rs
++++ b/app-server-daemon/src/backend/pid.rs
+@@ -732,7 +732,7 @@ async fn read_process_start_time(pid: u32) -> Result<String> {
+
+ #[cfg(unix)]
+ async fn read_process_details(pid: u32) -> Result<(String, String)> {
+-    let output = Command::new("ps")
++    let output = Command::new("@ps@")
+         .args(["-p", &pid.to_string(), "-o", "stat=", "-o", "lstart="])
+         .output()
+         .await
+diff --git a/app-server-daemon/src/prepare_install.rs b/app-server-daemon/src/prepare_install.rs
+index 290ceae..2c3c966 100644
+--- a/app-server-daemon/src/prepare_install.rs
++++ b/app-server-daemon/src/prepare_install.rs
+@@ -373,8 +373,11 @@ fn package_tree(root: &Path, destination: Option<&Path>) -> Result<String> {
+         {
+             continue;
+         }
++        let canonical = path.canonicalize()?;
++        let is_nix_package_file = std::env::split_paths("@packageLinkRoots@")
++            .any(|root| canonical.starts_with(&root) && canonical != root);
+         anyhow::ensure!(
+-            path.canonicalize()?.starts_with(&canonical_root),
++            canonical.starts_with(&canonical_root) || is_nix_package_file,
+             "package link escapes its root"
+         );
+         let metadata = path.metadata()?;
diff --git a/pkgs/by-name/co/codex/package.nix b/pkgs/by-name/co/codex/package.nix
index 5fb12488221a..701ef009c206 100644
--- a/pkgs/by-name/co/codex/package.nix
+++ b/pkgs/by-name/co/codex/package.nix
@@ -18,12 +18,14 @@
     inherit (callPackage ./fetchers.nix { }) fetchLibrustyV8SrcBinding;
   },
   lld,
-  makeBinaryWrapper,
   nix-update-script,
   pkg-config,
   openssl,
+  ps,
+  replaceVars,
   ripgrep,
   versionCheckHook,
+  writeText,
   installShellCompletions ? stdenv.buildPlatform.canExecute stdenv.hostPlatform,
   _experimental-update-script-combinators,
 }:
@@ -63,6 +65,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ];
 
   patches = [
+    # Allow declared store links through daemon package validation.
+    (replaceVars ./nix-package-layout.patch {
+      ps = lib.getExe ps;
+      packageLinkRoots = lib.concatStringsSep ":" (
+        [ (toString (lib.getBin ripgrep)) ]
+        ++ lib.optionals stdenv.hostPlatform.isLinux [ (toString (lib.getBin bubblewrap)) ]
+      );
+    })
     # https://github.com/openai/codex/issues/48195
     ./no-daemon_auto_start.patch
   ];
@@ -80,7 +90,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     cmake
     gitMinimal
     installShellFiles
-    makeBinaryWrapper
     pkg-config
   ];
 
@@ -125,19 +134,40 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # the future once this software stabilizes.
   doCheck = false;
 
-  postInstall = lib.optionalString installShellCompletions ''
+  # Metadata enables voice package discovery even without a daemon.
+  # Patch ps and package rg/bwrap directly: a wrapper fails the daemon's
+  # staged-vs-running executable content check.
+  postInstall = ''
+    install -Dm444 \
+      ${
+        writeText "codex-package.json" (
+          builtins.toJSON {
+            layoutVersion = 1;
+            version = finalAttrs.version;
+            target = stdenv.hostPlatform.rust.rustcTarget;
+            variant = "codex";
+            entrypoint = "bin/codex";
+            resourcesDir = "codex-resources";
+          }
+        )
+      } \
+      $out/codex-package.json
+
+    # Daemon validation requires packaged rg/bwrap despite their PATH fallback.
+    install -d $out/codex-path
+    ln -s ${lib.getExe ripgrep} $out/codex-path/rg
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
+    install -d $out/codex-resources
+    ln -s ${lib.getExe bubblewrap} $out/codex-resources/bwrap
+  ''
+  + lib.optionalString installShellCompletions ''
     installShellCompletion --cmd codex \
       --bash <($out/bin/codex completion bash) \
       --fish <($out/bin/codex completion fish) \
       --zsh <($out/bin/codex completion zsh)
   '';
 
-  postFixup = ''
-    wrapProgram $out/bin/codex --prefix PATH : ${
-      lib.makeBinPath ([ ripgrep ] ++ lib.optionals stdenv.hostPlatform.isLinux [ bubblewrap ])
-    }
-  '';
-
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
 
@@ -153,6 +183,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ./update-librusty.sh
   ];
 
+  passthru.tests = {
+    app-server-daemon = callPackage ./test-app-server-daemon.nix { codex = finalAttrs.finalPackage; };
+  };
+
   meta = {
     description = "Lightweight coding agent that runs in your terminal";
     homepage = "https://github.com/openai/codex";
diff --git a/pkgs/by-name/co/codex/test-app-server-daemon.nix b/pkgs/by-name/co/codex/test-app-server-daemon.nix
new file mode 100644
index 000000000000..99d08212e3ab
--- /dev/null
+++ b/pkgs/by-name/co/codex/test-app-server-daemon.nix
@@ -0,0 +1,22 @@
+{
+  codex,
+  lib,
+  runCommand,
+}:
+let
+  codexBin = lib.getExe codex;
+in
+runCommand "${codex.name}-app-server-daemon-test"
+  {
+    meta.platforms = lib.platforms.linux;
+  }
+  ''
+    export CODEX_HOME="$TMPDIR/codex-home"
+    mkdir -p "$CODEX_HOME/app-server-daemon"
+    printf '%s\n' '{ "shutdownGraceSeconds": 0 }' > "$CODEX_HOME/app-server-daemon/settings.json"
+
+    ${codexBin} app-server daemon start
+    ${codexBin} app-server daemon stop
+
+    touch $out
+  ''

From 1bc29c0e286fa4b4ba630b0e1afe3f69bf201fb4 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Tue, 6 Oct 2026 07:12:21 -0700
Subject: [PATCH 270/525] sqlite: fix tests on musl

Since test failures now fail the build, pkgsMusl.sqlite fails in
checkPhase for two reasons:

- testrunner builds fuzzcheck-asan and fuzzcheck-ubsan, which cannot be
  linked because neither GCC's libsanitizer nor compiler-rt's sanitizers
  are built for musl. Exclude them with a testrunner pattern.

- capi3c.test, a copy of capi3.test, still runs the intentional
  use-after-free cases that upstream disabled in capi3.test because they
  occasionally segfault. musl's allocator makes them segfault reliably.
  Disable them the same way upstream did.

Assisted-by: Claude Code (claude-opus-5-5)
(cherry picked from commit a66e91bfe80ca283699cc40cffb9943395cdeb81)
---
 pkgs/development/libraries/sqlite/default.nix | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index 6a278055e950..65ee34162a9d 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -110,6 +110,16 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
+  # capi3c.test is a copy of capi3.test, but upstream only disabled the
+  # intentional use-after-free cases in the original. They segfault with
+  # allocators that return freed memory to the OS eagerly, such as musl's.
+  ${if stdenv.hostPlatform.isMusl then "postPatch" else null} = ''
+    substituteInPlace test/capi3c.test \
+      --replace-fail \
+        'if {[clang_sanitize_address]==0} {' \
+        'if {0 && [clang_sanitize_address]==0} {'
+  '';
+
   buildInputs = [
     zlib
   ]
@@ -199,6 +209,9 @@ stdenv.mkDerivation (finalAttrs: {
   doCheck = stdenv.hostPlatform.isLinux;
   # When tcl is not available, only run test targets that don't need it.
   checkTarget = lib.optionalString stdenv.hostPlatform.isStatic "fuzztest sourcetest";
+  # Neither GCC's libsanitizer nor compiler-rt's sanitizers are built for
+  # musl, so the fuzzcheck-asan and fuzzcheck-ubsan programs cannot be linked.
+  ${if stdenv.hostPlatform.isMusl then "checkFlags" else null} = [ "TSTRNNR_OPTS=~fuzzcheck-%san" ];
 
   passthru = {
     tests = {

From 170b51900fc767b77d5ad92ee04c1d2e98634461 Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Fri, 9 Oct 2026 05:59:23 -0700
Subject: [PATCH 271/525] python3Packages.rapidgzip: fix newer setuptools
 compiler API

---
 .../python-modules/rapidgzip/default.nix            |  3 +++
 .../rapidgzip/setuptools-compiler-api.patch         | 13 +++++++++++++
 2 files changed, 16 insertions(+)
 create mode 100644 pkgs/development/python-modules/rapidgzip/setuptools-compiler-api.patch

diff --git a/pkgs/development/python-modules/rapidgzip/default.nix b/pkgs/development/python-modules/rapidgzip/default.nix
index 26bf7b15bb14..b3d0f94e5c07 100644
--- a/pkgs/development/python-modules/rapidgzip/default.nix
+++ b/pkgs/development/python-modules/rapidgzip/default.nix
@@ -17,6 +17,9 @@ buildPythonPackage rec {
     hash = "sha256-ixJPKbwS3kJJq4HoPlrTXmd0KhqP9Ky2G3TA2f2hwU4=";
   };
 
+  # Newer setuptools removed the dry_run compiler constructor argument.
+  patches = [ ./setuptools-compiler-api.patch ];
+
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail "setuptools >= 61.2, < 72" setuptools
diff --git a/pkgs/development/python-modules/rapidgzip/setuptools-compiler-api.patch b/pkgs/development/python-modules/rapidgzip/setuptools-compiler-api.patch
new file mode 100644
index 000000000000..04eaade85b8f
--- /dev/null
+++ b/pkgs/development/python-modules/rapidgzip/setuptools-compiler-api.patch
@@ -0,0 +1,13 @@
+diff --git a/nasm_extension/nasmcompiler.py b/nasm_extension/nasmcompiler.py
+--- a/nasm_extension/nasmcompiler.py
++++ b/nasm_extension/nasmcompiler.py
+@@ -30,7 +30,8 @@ class NasmCompiler(UnixCCompiler):
+ 
+     def __init__(self, verbose=0, dry_run=0, force=0):
+ 
+-        UnixCCompiler.__init__(self, verbose, dry_run, force)
++        UnixCCompiler.__init__(self, verbose=verbose, force=force)
++        self.dry_run = dry_run
+         self.set_executable("compiler", "nasm")
+ 
+     def _is_gcc(self, compiler_name):

From 312758095fa305f8bd99ec8fb880efad03e59281 Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Sat, 10 Oct 2026 07:02:40 +0200
Subject: [PATCH 272/525] ty: 0.0.85 -> 0.0.86

Changelog: https://github.com/astral-sh/ty/releases/tag/0.0.86
Diff: https://github.com/astral-sh/ty/compare/0.0.85...0.0.86
---
 pkgs/by-name/ty/ty/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix
index 5c30334da081..13ce1472760e 100644
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -18,7 +18,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.85";
+  version = "0.0.86";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-vweZOl2P72ruvDh7RuDkhdYFT/ejAUw7l+aJwsjlL7o=";
+    hash = "sha256-LlKVXb7S57t5cLe1iUcfcEkQSYtPHs6pBM+lkcZ36co=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -40,7 +40,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-j6A7j/bPHlIXU4BA7B8pNi2LAaCFL0B9ILDDCPE2GUU=";
+  cargoHash = "sha256-Fv5SwPXdn9Ggo0Yy2Y2NSP2n6FP1mlRePIA2+vOmnjM=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = [ rust-jemalloc-sys ];

From 28ed7cca15386b0a4c940558604d04573732e039 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 10 Oct 2026 05:06:41 +0000
Subject: [PATCH 273/525] pdfcpu: 0.16.0 -> 0.16.1

---
 pkgs/by-name/pd/pdfcpu/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pd/pdfcpu/package.nix b/pkgs/by-name/pd/pdfcpu/package.nix
index d7624851c2fe..e63bee88408b 100644
--- a/pkgs/by-name/pd/pdfcpu/package.nix
+++ b/pkgs/by-name/pd/pdfcpu/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "pdfcpu";
-  version = "0.16.0";
+  version = "0.16.1";
 
   src = fetchFromGitHub {
     owner = "pdfcpu";
     repo = "pdfcpu";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-aOU4biSZObEr62FPvyr0RCYR4yEvbST132dbPHNNC5E=";
+    hash = "sha256-kVSzMa1Jil2moY3BP5cu3O4482OBMxUlMVPiDwJz1zs=";
     # Apparently upstream requires that the compiled executable will know the
     # commit hash and the date of the commit. This information is also presented
     # in the output of `pdfcpu version` which we use as a sanity check in the
@@ -38,7 +38,7 @@ buildGoModule (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-OcS5pMV6dVx8VkDH4Lkks88OBRN/Rd8gjldtMnCl124=";
+  vendorHash = "sha256-iSDCCftx3hFZ2M3Cxeeq0Dta8hMXBYcviYRMgdrQfKI=";
 
   ldflags = [
     "-s"

From d2960b55c1c5254be787492e5b80c9c2b0bf04e7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 10 Oct 2026 05:07:32 +0000
Subject: [PATCH 274/525] cook-cli: 0.37.0 -> 0.38.1

---
 pkgs/by-name/co/cook-cli/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/co/cook-cli/package.nix b/pkgs/by-name/co/cook-cli/package.nix
index 38cf3ca4e31d..0537066a5048 100644
--- a/pkgs/by-name/co/cook-cli/package.nix
+++ b/pkgs/by-name/co/cook-cli/package.nix
@@ -11,16 +11,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cook-cli";
-  version = "0.37.0";
+  version = "0.38.1";
 
   src = fetchFromGitHub {
     owner = "cooklang";
     repo = "cookcli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-tHPVKigUqHZo84E+2wnky21UQfE7bQ1ZB1vZZNPlm7E=";
+    hash = "sha256-XvEUpPrkgWxtBoInx6jM0gHF3igZcyf5ykR9Z3wQScc=";
   };
 
-  cargoHash = "sha256-DOXHQMYWyuArVwS+odyjImGCfzS4flNZM7NRSnLkLfc=";
+  cargoHash = "sha256-gbJo6qzj2c3tzZuEjP8/XxJQjbZrYbjZAWIkqfpwhiM=";
 
   # Build without the self-updating feature
   buildNoDefaultFeatures = true;
@@ -40,7 +40,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
-    hash = "sha256-n/pxjcgDqhlUC09ynWExxClVT9WixahpPYRU3GAvzBc=";
+    hash = "sha256-zAtFsSpJFdthb0E8FLVRGWzGcReDsZxZF+NvHZ+wcY4=";
   };
 
   preBuild = ''

From 70ebf0efe0f566ad7a07987b19ce6174b41bba22 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 10 Oct 2026 05:48:16 +0000
Subject: [PATCH 275/525] phpExtensions.mongodb: 2.5.3 -> 2.5.4

---
 pkgs/development/php-packages/mongodb/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/php-packages/mongodb/default.nix b/pkgs/development/php-packages/mongodb/default.nix
index 59aa5193a49b..23335da9157d 100644
--- a/pkgs/development/php-packages/mongodb/default.nix
+++ b/pkgs/development/php-packages/mongodb/default.nix
@@ -15,13 +15,13 @@
 
 buildPecl rec {
   pname = "mongodb";
-  version = "2.5.3";
+  version = "2.5.4";
 
   src = fetchFromGitHub {
     owner = "mongodb";
     repo = "mongo-php-driver";
     rev = version;
-    hash = "sha256-zhF1YF/jZpXS0PfVwZ2uDluHY8HTqWhXVa0J1TGo5aA=";
+    hash = "sha256-tBWkKsHDd25E1nIMYOUgKSlzk5OXBkWLUxj29UrjktQ=";
     fetchSubmodules = true;
   };
 

From e620e3e1c00b2ab3bb383d3a95568e46672e45cb Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 10 Oct 2026 06:42:02 +0000
Subject: [PATCH 276/525] asmc-linux: 2.39.07 -> 2.40

---
 pkgs/by-name/as/asmc-linux/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/as/asmc-linux/package.nix b/pkgs/by-name/as/asmc-linux/package.nix
index 05877430e0d3..85576efa2570 100644
--- a/pkgs/by-name/as/asmc-linux/package.nix
+++ b/pkgs/by-name/as/asmc-linux/package.nix
@@ -6,12 +6,12 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "asmc-linux";
-  version = "2.39.07";
+  version = "2.40";
   src = fetchFromGitHub {
     owner = "nidud";
     repo = "asmc_linux";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JtJsyaw4UqMf9epMLGH+iQA0FYYlE9k2NG1aPOu6pec=";
+    hash = "sha256-5fbfLYQEoeAJJqZJ4Rs8WcHm2hD05OZOirNVxY66SdM=";
   };
 
   enableParallelBuilding = true;

From 47a02b048e62b6b1e6bfbbb469a3a9fede2430e4 Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Sat, 10 Oct 2026 14:05:55 +0700
Subject: [PATCH 277/525] cosmopolitan: fix build

---
 pkgs/by-name/co/cosmopolitan/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/co/cosmopolitan/package.nix b/pkgs/by-name/co/cosmopolitan/package.nix
index cd72590a18e3..6c68a1500736 100644
--- a/pkgs/by-name/co/cosmopolitan/package.nix
+++ b/pkgs/by-name/co/cosmopolitan/package.nix
@@ -80,6 +80,8 @@ stdenv.mkDerivation (finalAttrs: {
         "test/libc/calls/cachestat_test.c"
         "test/libc/calls/getprogramexecutablename_test.c"
         "test/libc/proc/posix_spawn_test.c"
+        # asserts st_blocks of a sparse file, which depends on the builder's filesystem
+        "test/tool/net/lunix_test.lua"
       ];
     in
     lib.concatStringsSep ";\n" (map (t: "rm -v ${t}") failingTests);

From bd0789216d75d341c9ab734feebab4e27b54a409 Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Thu, 8 Oct 2026 14:44:27 +0200
Subject: [PATCH 278/525] nextcloud-spreed-signaling: add aarch64-linux &
 riscv64-linux

---
 pkgs/by-name/ne/nextcloud-spreed-signaling/package.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ne/nextcloud-spreed-signaling/package.nix b/pkgs/by-name/ne/nextcloud-spreed-signaling/package.nix
index 9591312f9c39..bf80c02464a5 100644
--- a/pkgs/by-name/ne/nextcloud-spreed-signaling/package.nix
+++ b/pkgs/by-name/ne/nextcloud-spreed-signaling/package.nix
@@ -8,6 +8,7 @@
 buildGoModule (finalAttrs: {
   pname = "nextcloud-spreed-signaling";
   version = "2.1.1";
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "strukturag";
@@ -30,6 +31,10 @@ buildGoModule (finalAttrs: {
     maintainers = with lib.maintainers; [
       hensoko
     ];
-    platforms = [ "x86_64-linux" ];
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "riscv64-linux"
+    ];
   };
 })

From 2b824d6e645457aeb76ec9dbf88fb8b7696d26f0 Mon Sep 17 00:00:00 2001
From: dfjay <mail@dfjay.com>
Date: Sat, 10 Oct 2026 13:43:56 +0500
Subject: [PATCH 279/525] jan: 0.8.4 -> 0.8.6

Assisted-by: Claude Code (Claude Opus 5.5)
---
 pkgs/by-name/ja/jan/package.nix | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/ja/jan/package.nix b/pkgs/by-name/ja/jan/package.nix
index ed7871c99459..dc09678dba00 100644
--- a/pkgs/by-name/ja/jan/package.nix
+++ b/pkgs/by-name/ja/jan/package.nix
@@ -11,16 +11,16 @@
 }:
 
 let
-  version = "0.8.4";
+  version = "0.8.6";
 
   darwin-src = fetchzip {
     url = "https://github.com/janhq/jan/releases/download/v${version}/jan-mac-universal-${version}.zip";
-    hash = "sha256-hK9cu9c2kJRCJ3iy0CucRP0whgDgF5K29JgR4AIKXVg=";
+    hash = "sha256-jQIY69PT+jMh3bUd2tgscKzvT/TBy8TqF6pFrsl7XAg=";
   };
 
   linux-src = fetchurl {
     url = "https://github.com/janhq/jan/releases/download/v${version}/Jan_${version}_amd64.AppImage";
-    hash = "sha256-NNTIq02kisIjINS2TCh0Rb2UyRMSlJLR2+uzZmWxSVo=";
+    hash = "sha256-L+cPsIhHOnvbSZ5c4HHVpXPFR1VpFIJduYnsHdEFIGY=";
   };
 
   appimageContents = appimageTools.extract {
@@ -37,7 +37,7 @@ let
     homepage = "https://github.com/janhq/jan";
     license = lib.licenses.asl20;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    mainProgram = "Jan";
+    mainProgram = "Jan-Desktop";
     maintainers = with lib.maintainers; [ dfjay ];
     platforms =
       lib.platforms.darwin
@@ -49,6 +49,8 @@ let
     inherit version;
     src = linux-src;
 
+    executableName = "Jan-Desktop";
+
     extraInstallCommands = ''
       install -Dm444 ${appimageContents}/Jan.desktop -t $out/share/applications
       cp -r ${appimageContents}/usr/share/icons $out/share
@@ -80,9 +82,7 @@ let
       mkdir -p $out/Applications/Jan.app
       mkdir -p $out/bin
       cp -R $src/. $out/Applications/Jan.app/
-      if [ -x "$out/Applications/Jan.app/Contents/MacOS/Jan" ]; then
-        makeWrapper "$out/Applications/Jan.app/Contents/MacOS/Jan" $out/bin/Jan
-      fi
+      makeWrapper "$out/Applications/Jan.app/Contents/MacOS/Jan-Desktop" $out/bin/Jan-Desktop
 
       runHook postInstall
     '';

From 62106da1614fb5f4bf69e0bd7bc4594a28290666 Mon Sep 17 00:00:00 2001
From: dfjay <mail@dfjay.com>
Date: Sat, 10 Oct 2026 13:44:47 +0500
Subject: [PATCH 280/525] jan: lowercase pname

Assisted-by: Claude Code (Claude Opus 5.5)
---
 pkgs/by-name/ja/jan/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ja/jan/package.nix b/pkgs/by-name/ja/jan/package.nix
index dc09678dba00..ff11275295cb 100644
--- a/pkgs/by-name/ja/jan/package.nix
+++ b/pkgs/by-name/ja/jan/package.nix
@@ -24,7 +24,7 @@ let
   };
 
   appimageContents = appimageTools.extract {
-    pname = "Jan";
+    pname = "jan";
     inherit version;
     src = linux-src;
   };
@@ -45,7 +45,7 @@ let
   };
 
   linux = appimageTools.wrapType2 {
-    pname = "Jan";
+    pname = "jan";
     inherit version;
     src = linux-src;
 
@@ -62,7 +62,7 @@ let
   };
 
   darwin = stdenvNoCC.mkDerivation {
-    pname = "Jan";
+    pname = "jan";
     inherit version;
 
     strictDeps = true;

From 94aaa61751724d32342ab634fde9c3c52ba2e2d2 Mon Sep 17 00:00:00 2001
From: dfjay <mail@dfjay.com>
Date: Sat, 10 Oct 2026 13:45:17 +0500
Subject: [PATCH 281/525] jan: drop cuda_cudart

Assisted-by: Claude Code (Claude Opus 5.5)
---
 pkgs/by-name/ja/jan/package.nix | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/pkgs/by-name/ja/jan/package.nix b/pkgs/by-name/ja/jan/package.nix
index ff11275295cb..48a5bbc4cb4a 100644
--- a/pkgs/by-name/ja/jan/package.nix
+++ b/pkgs/by-name/ja/jan/package.nix
@@ -2,9 +2,6 @@
   lib,
   appimageTools,
   fetchurl,
-  config,
-  cudaPackages,
-  cudaSupport ? config.cudaSupport,
   stdenvNoCC,
   fetchzip,
   makeWrapper,
@@ -56,8 +53,6 @@ let
       cp -r ${appimageContents}/usr/share/icons $out/share
     '';
 
-    extraPkgs = pkgs: lib.optionals cudaSupport [ cudaPackages.cuda_cudart ];
-
     inherit passthru meta;
   };
 

From 1c371ae2d81169d21bf35fb7e2cf00bc3318c068 Mon Sep 17 00:00:00 2001
From: Dmitry Bogatov <kaction.cc@gmail.com>
Date: Sat, 3 Oct 2026 06:00:00 -0400
Subject: [PATCH 282/525] treefmt: sha256 -> hash for fetchFromCodeberg

Ref: nixos/nixpkgs#325892
---
 pkgs/by-name/co/colorpanes/package.nix | 2 +-
 pkgs/by-name/di/didu/package.nix       | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/co/colorpanes/package.nix b/pkgs/by-name/co/colorpanes/package.nix
index 7606aac7673f..32cf12da3240 100644
--- a/pkgs/by-name/co/colorpanes/package.nix
+++ b/pkgs/by-name/co/colorpanes/package.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "annaaurora";
     repo = "colorpanes";
     rev = "v${finalAttrs.version}";
-    sha256 = "qaOH+LXNDq+utwyI1yzHWNt25AvdAXCTAziGV9ElroU=";
+    hash = "sha256-qaOH+LXNDq+utwyI1yzHWNt25AvdAXCTAziGV9ElroU=";
   };
 
   cargoHash = "sha256-+ltcTuLksNwe7KIt8apYNZkMoA2w4EObG5dhJliRb6Y=";
diff --git a/pkgs/by-name/di/didu/package.nix b/pkgs/by-name/di/didu/package.nix
index 8bb7998517eb..3302fee980aa 100644
--- a/pkgs/by-name/di/didu/package.nix
+++ b/pkgs/by-name/di/didu/package.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "annaaurora";
     repo = "didu";
     rev = "v${finalAttrs.version}";
-    sha256 = "szYWRN1NZbfpshipwMMJSWJw/NG4w7I+aqwtmqpT0R0=";
+    hash = "sha256-szYWRN1NZbfpshipwMMJSWJw/NG4w7I+aqwtmqpT0R0=";
   };
 
   cargoHash = "sha256-NDri4VuTI/ZsY3ZvpWmu/2I5GpmldQaoUSzyjGlq9lE=";

From da08e1727865663920c3226a88e9d0875cb91a58 Mon Sep 17 00:00:00 2001
From: illustris <rharikrishnan95@gmail.com>
Date: Sat, 10 Oct 2026 17:10:56 +0530
Subject: [PATCH 283/525] sssd: backport fix for CVE-2026-68742

Assisted-by: OpenAI Codex (Daybreak Blue)
---
 pkgs/by-name/ss/sssd/package.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/ss/sssd/package.nix b/pkgs/by-name/ss/sssd/package.nix
index 489f6eb38e45..2b4845820fb3 100644
--- a/pkgs/by-name/ss/sssd/package.nix
+++ b/pkgs/by-name/ss/sssd/package.nix
@@ -90,6 +90,13 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/SSSD/sssd/commit/ba207eab76ff5253662a763b9b6e9ea42f03d31b.patch?full_index=1";
       hash = "sha256-55V8RfIcGF49GGebg+pgCLPU9MGY2S/7PaOGIqwNL0w=";
     })
+
+    # Remove once a release containing this upstream fix is packaged.
+    (fetchpatch2 {
+      name = "CVE-2026-68742.patch";
+      url = "https://github.com/SSSD/sssd/commit/db60088e31d9c0c51c12206f069c305c7f4288a4.patch?full_index=1";
+      hash = "sha256-MOchRnq7/MMEzzGFXsfo3m36ljFTo6AIccjcyPwCb+0=";
+    })
   ];
 
   postPatch = ''

From 2696d207610e07e83217979d48bea24897123cc5 Mon Sep 17 00:00:00 2001
From: kaynetik <aleksandar@nesovic.dev>
Date: Sat, 10 Oct 2026 14:34:44 +0200
Subject: [PATCH 284/525] hunk: 0.22.0 -> 0.23.0

Signed-off-by: kaynetik <aleksandar@nesovic.dev>
---
 pkgs/by-name/hu/hunk/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/hu/hunk/package.nix b/pkgs/by-name/hu/hunk/package.nix
index 37b679ceed69..85fb957f6d07 100644
--- a/pkgs/by-name/hu/hunk/package.nix
+++ b/pkgs/by-name/hu/hunk/package.nix
@@ -12,13 +12,13 @@
 
 let
   pname = "hunk";
-  version = "0.22.0";
+  version = "0.23.0";
 
   src = fetchFromGitHub {
     owner = "modem-dev";
     repo = "hunk";
     tag = "v${version}";
-    hash = "sha256-dc4/xLAyQe7mL/KMcpjsjgHzgf0tRomQAemVABwUWFY=";
+    hash = "sha256-JQRNs0JG3v7lN1rFNikMyevAQjV0vfCCXjfPxmcKmqQ=";
   };
 
   node_modules = stdenv.mkDerivation {
@@ -58,7 +58,7 @@ let
 
     dontFixup = true;
 
-    outputHash = "sha256-hWfG2T3Tfa69nX50OFW5XNRQxMc5lideDEUPw6G26qA=";
+    outputHash = "sha256-svON/Z2rtRHLQlbks65si2U/vjrwOw2G4QziXTGVWjo=";
     outputHashMode = "recursive";
   };
 in

From 3a94319963f5f0ff465d0b3c1a8712c0ef0bf02e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 10 Oct 2026 12:40:09 +0000
Subject: [PATCH 285/525] spglib: 2.7.0 -> 2.8.0

---
 pkgs/development/libraries/spglib/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/spglib/default.nix b/pkgs/development/libraries/spglib/default.nix
index 83ec38c364ce..795e310a9f67 100644
--- a/pkgs/development/libraries/spglib/default.nix
+++ b/pkgs/development/libraries/spglib/default.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation rec {
   pname = "spglib";
-  version = "2.7.0"; # N.B: if you change this, please update: pythonPackages.spglib
+  version = "2.8.0"; # N.B: if you change this, please update: pythonPackages.spglib
 
   src = fetchFromGitHub {
     owner = "spglib";
     repo = "spglib";
     rev = "v${version}";
-    hash = "sha256-RFvd/j/14YRIcQTpnYPx5edeF3zbHbi90jb32i3ZU/c=";
+    hash = "sha256-lnD/tUY/fXxgOS/aB8tesTyLcqpOBzjZaMO2Kjznf1M=";
   };
 
   nativeBuildInputs = [

From 0a9a825ad5818ca0d647aee65069fe0b5716b026 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Sat, 10 Oct 2026 12:39:23 +0000
Subject: [PATCH 286/525] hydra: 0-unstable-2026-10-04 -> 0-unstable-2026-10-08

Co-assisted-by: Claude Opus 5.5
---
 .../continuous-integration/hydra/default.nix         | 12 ++++++++----
 pkgs/by-name/hy/hydra-ad-hoc/package.nix             |  2 +-
 pkgs/by-name/hy/hydra-builder/package.nix            |  2 +-
 pkgs/by-name/hy/hydra-evaluator/package.nix          |  2 +-
 pkgs/by-name/hy/hydra-queue-runner/package.nix       |  2 +-
 pkgs/by-name/hy/hydra-ws/package.nix                 |  2 +-
 pkgs/by-name/hy/hydra/package.nix                    |  6 +++---
 7 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/nixos/modules/services/continuous-integration/hydra/default.nix b/nixos/modules/services/continuous-integration/hydra/default.nix
index b15840252cdf..cc5a1a2ed868 100644
--- a/nixos/modules/services/continuous-integration/hydra/default.nix
+++ b/nixos/modules/services/continuous-integration/hydra/default.nix
@@ -599,6 +599,11 @@ in
                   Whether builders upload to S3 themselves instead of the queue
                   runner. Requires an S3 remote store as well as substitution on
                   the builders, see {option}`forcedSubstituters`.
+
+                  Presigned URLs stop working when the credentials that signed
+                  them expire. With temporary credentials, such as instance
+                  profiles or STS, uploads can fail before
+                  `presigned-url-expiry` is reached.
                 '';
               };
 
@@ -1264,10 +1269,9 @@ in
         pkgs.jq
         hydra-package # hydra-eval-jobset
       ];
-      restartTriggers = [
-        hydraConf
-        config.environment.etc."hydra/evaluator.toml".source
-      ];
+      # Not `hydra.conf`: only the Perl the evaluator runs reads it, and that
+      # starts afresh for each evaluation.
+      restartTriggers = [ config.environment.etc."hydra/evaluator.toml".source ];
       environment = env // {
         HYDRA_DATABASE_URL = dbUrlWithAppName "hydra-evaluator";
       };
diff --git a/pkgs/by-name/hy/hydra-ad-hoc/package.nix b/pkgs/by-name/hy/hydra-ad-hoc/package.nix
index 4b145d3fca03..9734aadc2b71 100644
--- a/pkgs/by-name/hy/hydra-ad-hoc/package.nix
+++ b/pkgs/by-name/hy/hydra-ad-hoc/package.nix
@@ -14,7 +14,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   inherit (hydra) version src;
   __structuredAttrs = true;
 
-  cargoHash = "sha256-TYFxKCXxe5oCbmjWaaQM98VjInKBgVRr8Ygy+2LKUew=";
+  cargoHash = "sha256-Hkf6DS/MUrxqD/xp9mIv0CjbRq2FL3QNGIkZMw8BehY=";
 
   cargoBuildFlags = [
     "--package"
diff --git a/pkgs/by-name/hy/hydra-builder/package.nix b/pkgs/by-name/hy/hydra-builder/package.nix
index 9897b79d8ddf..ec1a5e6e0cb7 100644
--- a/pkgs/by-name/hy/hydra-builder/package.nix
+++ b/pkgs/by-name/hy/hydra-builder/package.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   inherit (hydra) version src;
   __structuredAttrs = true;
 
-  cargoHash = "sha256-TYFxKCXxe5oCbmjWaaQM98VjInKBgVRr8Ygy+2LKUew=";
+  cargoHash = "sha256-Hkf6DS/MUrxqD/xp9mIv0CjbRq2FL3QNGIkZMw8BehY=";
 
   cargoBuildFlags = [
     "--package"
diff --git a/pkgs/by-name/hy/hydra-evaluator/package.nix b/pkgs/by-name/hy/hydra-evaluator/package.nix
index 41f22cb466bb..41a551876d1d 100644
--- a/pkgs/by-name/hy/hydra-evaluator/package.nix
+++ b/pkgs/by-name/hy/hydra-evaluator/package.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   inherit (hydra) version src;
   __structuredAttrs = true;
 
-  cargoHash = "sha256-TYFxKCXxe5oCbmjWaaQM98VjInKBgVRr8Ygy+2LKUew=";
+  cargoHash = "sha256-Hkf6DS/MUrxqD/xp9mIv0CjbRq2FL3QNGIkZMw8BehY=";
 
   cargoBuildFlags = [
     "--package"
diff --git a/pkgs/by-name/hy/hydra-queue-runner/package.nix b/pkgs/by-name/hy/hydra-queue-runner/package.nix
index e9d3ce3bb95f..82a82273c15f 100644
--- a/pkgs/by-name/hy/hydra-queue-runner/package.nix
+++ b/pkgs/by-name/hy/hydra-queue-runner/package.nix
@@ -13,7 +13,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   inherit (hydra) version src;
   __structuredAttrs = true;
 
-  cargoHash = "sha256-TYFxKCXxe5oCbmjWaaQM98VjInKBgVRr8Ygy+2LKUew=";
+  cargoHash = "sha256-Hkf6DS/MUrxqD/xp9mIv0CjbRq2FL3QNGIkZMw8BehY=";
 
   cargoBuildFlags = [
     "--package"
diff --git a/pkgs/by-name/hy/hydra-ws/package.nix b/pkgs/by-name/hy/hydra-ws/package.nix
index c9a6ceac22ed..dcc283de1ea9 100644
--- a/pkgs/by-name/hy/hydra-ws/package.nix
+++ b/pkgs/by-name/hy/hydra-ws/package.nix
@@ -12,7 +12,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   inherit (hydra) version src;
   __structuredAttrs = true;
 
-  cargoHash = "sha256-TYFxKCXxe5oCbmjWaaQM98VjInKBgVRr8Ygy+2LKUew=";
+  cargoHash = "sha256-Hkf6DS/MUrxqD/xp9mIv0CjbRq2FL3QNGIkZMw8BehY=";
 
   cargoBuildFlags = [
     "--package"
diff --git a/pkgs/by-name/hy/hydra/package.nix b/pkgs/by-name/hy/hydra/package.nix
index ec8343f60c20..1ee249927370 100644
--- a/pkgs/by-name/hy/hydra/package.nix
+++ b/pkgs/by-name/hy/hydra/package.nix
@@ -45,13 +45,13 @@ let
   # Keep in sync with the nix input of https://github.com/NixOS/hydra/blob/master/flake.nix
   nixComponents = nixVersions.nixComponents_2_35;
 
-  version = "0-unstable-2026-10-04";
+  version = "0-unstable-2026-10-08";
 
   src = fetchFromGitHub {
     owner = "NixOS";
     repo = "hydra";
-    rev = "588f42497842e9c0172067c8156f8d1b1ea691ff";
-    hash = "sha256-GifY4tTG00WPp8RZCFqv/quwuG9rxwuGmTyAUbAgEJ0=";
+    rev = "35d9058fa00edcc9c4a1d3489f929a9cbfc75208";
+    hash = "sha256-or1nAWkxlPbKegdarYmXKjQfNixpxb4Dlrbp2jrUDdk=";
   };
 
   nix-perl = callPackage ./nix-perl.nix {

From 42570f24f79f3f373730123876b83e974936a18e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 10 Oct 2026 13:22:05 +0000
Subject: [PATCH 287/525] protoc-gen-grpc-java: 1.84.0 -> 1.84.1

---
 pkgs/by-name/pr/protoc-gen-grpc-java/data.nix | 20 +++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix b/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix
index a20ac02513b6..6fe839bcea75 100644
--- a/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix
+++ b/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix
@@ -1,14 +1,14 @@
 {
-  version = "1.84.0";
+  version = "1.84.1";
   hashes = {
-    linux-aarch_64 = "sha256-2TV3YbTmndx6vsPTqA4QlrXto+JdbtbQserQcGZgCoY=";
-    linux-ppcle_64 = "sha256-/CsKC+8AIRHWDJGsHGayu1heJ8+SOC3ZC6CI2Um2J2M=";
-    linux-s390_64 = "sha256-ugcWqz1IrtGsHhyEYobtQH2o7fW5f04cQvrTZAjeBnw=";
-    linux-x86_32 = "sha256-gPff10mQtLlDNmG3PE3p5okrSvH8tniVTnyrathlE2Q=";
-    linux-x86_64 = "sha256-kHwtTvwrrpshytp1wxs284IeFbe+ljEeIUpr5lvNIKo=";
-    osx-aarch_64 = "sha256-Saq55WowqEhOnDLTa+EqNR1Xg+AL2q/p7Cwv2MkClQQ=";
-    osx-x86_64 = "sha256-Saq55WowqEhOnDLTa+EqNR1Xg+AL2q/p7Cwv2MkClQQ=";
-    windows-x86_32 = "sha256-5NbC2ei2ZF/PwBGRv6F6Lg6b0DbF8LTZyY4P83UiazM=";
-    windows-x86_64 = "sha256-HQtYT0NsJSFUKpiRTY5sQroKpdhrRZvGMuTDiEo7XU0=";
+    linux-aarch_64 = "sha256-Gx5EUj2xBQiNXw5+3FO2XKymsCXHXXlOVNqN9y+eQDs=";
+    linux-ppcle_64 = "sha256-0QDXmHTqzS4fHuC7B+YmnFzDCaUHqp0T1XTKz4hKiDI=";
+    linux-s390_64 = "sha256-3Smte68bNqJj4Q2w1iq2DILTLNcqwFlEAB/unLFilmg=";
+    linux-x86_32 = "sha256-E/QAINeeVMGK+EP8scvHBjnxmu1+s62NsZL57wLnJB0=";
+    linux-x86_64 = "sha256-Gq6RJ48NgYdkGGJxB0jfLBY1gtffChd+VJ99gjipo/4=";
+    osx-aarch_64 = "sha256-ieV9tBgsrGhUDsDaSZYmSbTj5+7eOD7JIjHiy6aODWU=";
+    osx-x86_64 = "sha256-ieV9tBgsrGhUDsDaSZYmSbTj5+7eOD7JIjHiy6aODWU=";
+    windows-x86_32 = "sha256-XPRy9dyyDqDm0+q5OppiimE5/Gy0/nwlA1k7sH7Wqx0=";
+    windows-x86_64 = "sha256-xSGYOkC31sQl7y/kewPTNhoQa1hcWr9hz7P+SwZGmsY=";
   };
 }

From a9adba93586174fb269397b819d6e8e4d1767076 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 10 Oct 2026 13:48:46 +0000
Subject: [PATCH 288/525] python3Packages.asyncua: 2.0.1 -> 2.1.0

---
 pkgs/development/python-modules/asyncua/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/asyncua/default.nix b/pkgs/development/python-modules/asyncua/default.nix
index 4641a20d9fba..2d86f5500c52 100644
--- a/pkgs/development/python-modules/asyncua/default.nix
+++ b/pkgs/development/python-modules/asyncua/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "asyncua";
-  version = "2.0.1";
+  version = "2.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "FreeOpcUa";
     repo = "opcua-asyncio";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZbLY6Qu8EikD70ZHLeLz9NMhVGBu65o0CICafuTLOuM=";
+    hash = "sha256-8IyTMKk+cPZZI0m/PW5CvxMSgngmMeQkznT7IlN6Qxs=";
     fetchSubmodules = true;
   };
 

From b94267cbd990f5c6bdc6d8aeb09d0667143bf3e9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 10 Oct 2026 14:02:02 +0000
Subject: [PATCH 289/525] nwg-panel: 0.10.15 -> 0.12.1

---
 pkgs/by-name/nw/nwg-panel/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/nw/nwg-panel/package.nix b/pkgs/by-name/nw/nwg-panel/package.nix
index a33a524a55e2..9b18dd4480a7 100644
--- a/pkgs/by-name/nw/nwg-panel/package.nix
+++ b/pkgs/by-name/nw/nwg-panel/package.nix
@@ -23,14 +23,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "nwg-panel";
-  version = "0.10.15";
+  version = "0.12.1";
   format = "setuptools";
 
   src = fetchFromGitHub {
     owner = "nwg-piotr";
     repo = "nwg-panel";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zRoOsVnwn2DQctB9ZP0pAAnf9Ragd2RZGHZGN1KnMsQ=";
+    hash = "sha256-KGaBDb2CXK0zel2mPGhdSXC2j8nysV9ktWn6wn8a8eQ=";
   };
 
   # No tests

From 4e95ddf461b891afff63b60b3d5d2e5de91a0cf0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 10 Oct 2026 14:09:58 +0000
Subject: [PATCH 290/525] gopass-jsonapi: 1.17.3 -> 1.17.4

---
 pkgs/by-name/go/gopass-jsonapi/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/go/gopass-jsonapi/package.nix b/pkgs/by-name/go/gopass-jsonapi/package.nix
index ae7f2d43c344..e7ed9fef83b1 100644
--- a/pkgs/by-name/go/gopass-jsonapi/package.nix
+++ b/pkgs/by-name/go/gopass-jsonapi/package.nix
@@ -25,16 +25,16 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "gopass-jsonapi";
-  version = "1.17.3";
+  version = "1.17.4";
 
   src = fetchFromGitHub {
     owner = "gopasspw";
     repo = "gopass-jsonapi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-eVvZvicLoS/3Y1Fcl9HgAUhyYFKnqvFQ3BDukGtr1ho=";
+    hash = "sha256-LHC1cFq25/3qdOACve4rbBPIw3sxZzmKw/lytsHNpds=";
   };
 
-  vendorHash = "sha256-aFJ7VPpD5A7bvwESFj9m2VZ7KsCAKl3La4iQzRhbuHc=";
+  vendorHash = "sha256-X+Z6QBoqFGi8uLDKefDDTqj/ACSfloFRkZEWDGLySJc=";
 
   subPackages = [ "." ];
 

From 06f42e13fbf460a5ef1882d38dc16d71909b6125 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 10 Oct 2026 14:10:43 +0000
Subject: [PATCH 291/525] gopass-hibp: 1.17.3 -> 1.17.4

---
 pkgs/by-name/go/gopass-hibp/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/go/gopass-hibp/package.nix b/pkgs/by-name/go/gopass-hibp/package.nix
index f88307fe6765..08235b6c1d82 100644
--- a/pkgs/by-name/go/gopass-hibp/package.nix
+++ b/pkgs/by-name/go/gopass-hibp/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gopass-hibp";
-  version = "1.17.3";
+  version = "1.17.4";
 
   src = fetchFromGitHub {
     owner = "gopasspw";
     repo = "gopass-hibp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Dc+lZrOP8XbHlJJqET1i9/KeSZUeHOV3huGPt9ieRZY=";
+    hash = "sha256-IJE/3Mi6tmxhbaxM09QgzvGmJ0FN6f7ciNeu99Ej4Fo=";
   };
 
-  vendorHash = "sha256-9BNnieu+IbZxYfWtwaWgdk86yv0gdK2z8fMbebkO5L8=";
+  vendorHash = "sha256-O3lcvqkLHvByXyWDdspnUyvk41c2iJX3mFMQpFi1ThI=";
 
   subPackages = [ "." ];
 

From 68a8e02222be58b41326ef324a7bfbc16b865c8b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 10 Oct 2026 14:14:16 +0000
Subject: [PATCH 292/525] gopass-summon-provider: 1.17.3 -> 1.17.4

---
 pkgs/by-name/go/gopass-summon-provider/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/go/gopass-summon-provider/package.nix b/pkgs/by-name/go/gopass-summon-provider/package.nix
index 21860d975851..4f44926e4577 100644
--- a/pkgs/by-name/go/gopass-summon-provider/package.nix
+++ b/pkgs/by-name/go/gopass-summon-provider/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "gopass-summon-provider";
-  version = "1.17.3";
+  version = "1.17.4";
 
   src = fetchFromGitHub {
     owner = "gopasspw";
     repo = "gopass-summon-provider";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bb9kxaDosx3xrjPcu+n2ROdFdyETTePvObWIGkKOcrM=";
+    hash = "sha256-RUwTnDMa0ZVhVnRTOulTH5XiaKG+0Ml9hgwf3dPMp+w=";
   };
 
-  vendorHash = "sha256-9BNnieu+IbZxYfWtwaWgdk86yv0gdK2z8fMbebkO5L8=";
+  vendorHash = "sha256-O3lcvqkLHvByXyWDdspnUyvk41c2iJX3mFMQpFi1ThI=";
 
   subPackages = [ "." ];
 

From 8d845ef9d4cc2b038e88ebe3933bf3e34663eb5e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 10 Oct 2026 14:26:56 +0000
Subject: [PATCH 293/525] greenbone-feed-sync: 25.4.2 -> 25.5.0

---
 pkgs/by-name/gr/greenbone-feed-sync/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gr/greenbone-feed-sync/package.nix b/pkgs/by-name/gr/greenbone-feed-sync/package.nix
index 9dad061a3111..9786f0b1a199 100644
--- a/pkgs/by-name/gr/greenbone-feed-sync/package.nix
+++ b/pkgs/by-name/gr/greenbone-feed-sync/package.nix
@@ -7,14 +7,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "greenbone-feed-sync";
-  version = "25.4.2";
+  version = "25.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "greenbone";
     repo = "greenbone-feed-sync";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Nh5Nw2Rq+Zw4IiBOwcLzayO2J/dFSOJpjHPYcJ/L3Fs=";
+    hash = "sha256-y7eWpLOTq8MWsmgeF7/CsuequBHU7ESrnJUOF1DbXRo=";
   };
 
   build-system = with python3.pkgs; [ hatchling ];

From a0d6854964f5f73548c473058fb32b3f12389454 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 10 Oct 2026 14:51:10 +0000
Subject: [PATCH 294/525] python3Packages.google-cloud-network-connectivity:
 2.17.0 -> 2.18.0

---
 .../google-cloud-network-connectivity/default.nix             | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-network-connectivity/default.nix b/pkgs/development/python-modules/google-cloud-network-connectivity/default.nix
index e373320d3ce4..faf368c67323 100644
--- a/pkgs/development/python-modules/google-cloud-network-connectivity/default.nix
+++ b/pkgs/development/python-modules/google-cloud-network-connectivity/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "google-cloud-network-connectivity";
-  version = "2.17.0";
+  version = "2.18.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) version;
     pname = "google_cloud_network_connectivity";
-    hash = "sha256-L7sJtKXR7CTeFnCn5DzmlFxvZRnyHYDsA8ESuXJ2rmM=";
+    hash = "sha256-YNYELqtjHDzKQ8HA9w5G+iZSuxqoh+35c+cop7O8/O0=";
   };
 
   build-system = [ setuptools ];

From ac5326782620aacc149ab971df2582fda72558a5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 10 Oct 2026 15:03:12 +0000
Subject: [PATCH 295/525] python3Packages.pyupgrade: 3.21.2 -> 3.22.0

---
 pkgs/development/python-modules/pyupgrade/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyupgrade/default.nix b/pkgs/development/python-modules/pyupgrade/default.nix
index b1e4744e31f0..e7342745bcdb 100644
--- a/pkgs/development/python-modules/pyupgrade/default.nix
+++ b/pkgs/development/python-modules/pyupgrade/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyupgrade";
-  version = "3.21.2";
+  version = "3.22.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "asottile";
     repo = "pyupgrade";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-u4iudzPhVuAOS9cL3z6FCVpWKJZHg7UGpe9aHnN7Byc=";
+    hash = "sha256-B3x1ykS+8gzaDIYb1f6locaHw/wBMdGfniEbthDdrL4=";
   };
 
   build-system = [ setuptools ];

From cf160f0501a7265662df655e5cca6d3571c6fc91 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 10 Oct 2026 15:33:17 +0000
Subject: [PATCH 296/525] dependabot-cli: 1.93.0 -> 1.94.0

---
 pkgs/by-name/de/dependabot-cli/package.nix | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/de/dependabot-cli/package.nix b/pkgs/by-name/de/dependabot-cli/package.nix
index a8e98d93e3d8..d8e281ecd05b 100644
--- a/pkgs/by-name/de/dependabot-cli/package.nix
+++ b/pkgs/by-name/de/dependabot-cli/package.nix
@@ -12,20 +12,20 @@
 }:
 let
   pname = "dependabot-cli";
-  version = "1.93.0";
+  version = "1.94.0";
 
   # `tag` is what `dependabot` uses to find the relevant docker images.
   tag = "nixpkgs-dependabot-cli-${version}";
 
   # Get these hashes from
   # nix run nixpkgs#nix-prefetch-docker -- --image-name ghcr.io/dependabot/proxy --image-tag latest --final-image-name dependabot-update-job-proxy --final-image-tag ${tag}
-  updateJobProxy.imageDigest = "sha256:56d8f53a1ea2da7ddd61cc4c36e68cdd0c3ae8dfcc64bdc20979d28be6dbbf92";
-  updateJobProxy.hash = "sha256-wqeihcbVo+x/SXGqvjtccjrFu9seOAoY1zMLiTeVhxw=";
+  updateJobProxy.imageDigest = "sha256:a39e7ef7188c9a4b36692df47a0e8f876e83199e657cd0b6be00e736fbe03c2f";
+  updateJobProxy.hash = "sha256-5/2v869kKBjxhrhWz7M8eVqLfKghPZw8lbyazdOJ9bs=";
 
   # Get these hashes from
   # nix run nixpkgs#nix-prefetch-docker -- --image-name ghcr.io/dependabot/dependabot-updater-github-actions --image-tag latest --final-image-name dependabot-updater-github-actions --final-image-tag ${tag}
-  updaterGitHubActions.imageDigest = "sha256:75f4843d57695da308d73940c9d885cc57ed8f1fbaf96affdee38b260812dcad";
-  updaterGitHubActions.hash = "sha256-jL38pYoGFV6cpkzTVQn0UZ39gJvOBfQrI6ywefCNwMU=";
+  updaterGitHubActions.imageDigest = "sha256:463c173f72e3f1824d0255a864fc0e075e7704a58448973878ad8c1b94f79d52";
+  updaterGitHubActions.hash = "sha256-0zYX1raxkOU30hwLpXOzQQ747xt6WsCxgJY55nlJNlc=";
 in
 buildGoModule {
   inherit pname version;
@@ -34,10 +34,10 @@ buildGoModule {
     owner = "dependabot";
     repo = "cli";
     rev = "v${version}";
-    hash = "sha256-5cVLfaAw9179JAWpCvXgEb2EmkwalPPKyBeQMgAC274=";
+    hash = "sha256-m7dyJqd1kmjcyqiVTKF/06VRrKHi0n+Gcqp9GDiPJgs=";
   };
 
-  vendorHash = "sha256-me7iH8XRAagnZFfijnWzCh3CZ3sbd1R7Xp8nFhTk0i4=";
+  vendorHash = "sha256-48OdlduXPRXzDmfTzM2Kn/gUpdYZ58TDQe5R30FiSDY=";
 
   ldflags = [
     "-s"

From bc77bfcf7d8ce23236cc343ba0a2f4c857dcb9c1 Mon Sep 17 00:00:00 2001
From: 9R <git@9-r.net>
Date: Tue, 22 Sep 2026 19:22:54 +0200
Subject: [PATCH 297/525] python3Packages.sendspin: 0.7.5 -> 0.7.6

changelog: https://github.com/Sendspin/sendspin-python-cli/releases
---
 pkgs/development/python-modules/sendspin/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/sendspin/default.nix b/pkgs/development/python-modules/sendspin/default.nix
index 4ef44584596a..3e5bd1c9470c 100644
--- a/pkgs/development/python-modules/sendspin/default.nix
+++ b/pkgs/development/python-modules/sendspin/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "sendspin";
-  version = "7.5.0";
+  version = "7.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Sendspin";
     repo = "sendspin-cli";
     tag = finalAttrs.version;
-    hash = "sha256-Oux9hEtN5AiPf3gAqXGVinDfDIuNVugchUNuLMfMoYc=";
+    hash = "sha256-unNlx0A5Jh3mkPp4G86DY41UExA5IEwMM8E0/jfaBkY=";
   };
 
   nativeBuildInputs = [

From 9c95ccb8bee4153b53203eff9a05e9abc5d49513 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 10 Oct 2026 15:50:44 +0000
Subject: [PATCH 298/525] still: 0.0.10 -> 0.1.0

---
 pkgs/by-name/st/still/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/st/still/package.nix b/pkgs/by-name/st/still/package.nix
index 0539fd2a6eea..bcc6010aeedc 100644
--- a/pkgs/by-name/st/still/package.nix
+++ b/pkgs/by-name/st/still/package.nix
@@ -14,13 +14,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "still";
-  version = "0.0.10";
+  version = "0.1.0";
 
   src = fetchFromGitHub {
     owner = "faergeek";
     repo = "still";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4ysI2U4k93ccC8gRoA+AcgTamSIL1ficLfqS8bc8vlY=";
+    hash = "sha256-AGArWr/T8VMZpEVbr/SIvERGTOAgoREH+68PSL6k6yg=";
   };
 
   nativeBuildInputs = [

From 8c9298fa6f58868601e9eb58188f68d90b6a1b27 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 10 Oct 2026 16:14:34 +0000
Subject: [PATCH 299/525] zoneminder: 1.38.4 -> 1.38.6

---
 pkgs/by-name/zo/zoneminder/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/zo/zoneminder/package.nix b/pkgs/by-name/zo/zoneminder/package.nix
index 4a8d3c29205a..c8ed6602fb6c 100644
--- a/pkgs/by-name/zo/zoneminder/package.nix
+++ b/pkgs/by-name/zo/zoneminder/package.nix
@@ -89,13 +89,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "zoneminder";
-  version = "1.38.4";
+  version = "1.38.6";
 
   src = fetchFromGitHub {
     owner = "ZoneMinder";
     repo = "zoneminder";
     tag = version;
-    hash = "sha256-bowVUTRtrTyS1zSaF+wKua6Wx5F7C5S40y7BKr6q9sE=";
+    hash = "sha256-sSFEarFMbCHDMbrWRJT1Y/0owLJqr033t0eaVDPjzdw=";
     fetchSubmodules = true;
   };
 

From e0eee401dd4b097506ad10d13099ff8b2f72c000 Mon Sep 17 00:00:00 2001
From: Keenan Weaver <keenanweaver@protonmail.com>
Date: Sat, 10 Oct 2026 11:17:02 -0500
Subject: [PATCH 300/525] game-devices-udev-rules: 1.0 -> 1.1

---
 pkgs/by-name/ga/game-devices-udev-rules/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ga/game-devices-udev-rules/package.nix b/pkgs/by-name/ga/game-devices-udev-rules/package.nix
index 12d0a898d999..8ee825a2df33 100644
--- a/pkgs/by-name/ga/game-devices-udev-rules/package.nix
+++ b/pkgs/by-name/ga/game-devices-udev-rules/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "game-devices-udev-rules";
-  version = "1.0";
+  version = "1.1";
 
   src = fetchFromCodeberg {
     owner = "fabiscafe";
     repo = "game-devices-udev";
     tag = finalAttrs.version;
-    hash = "sha256-J4LfRifTqBM+B/dryLHERaVa1UUWEbfjEUj+exCFVsU=";
+    hash = "sha256-EWEfmKSSnJqVYx8oTxJu2el7bA6hEngHQ0a0kiffdNA=";
   };
 
   nativeBuildInputs = [

From 559caf15e76cc4408636d8acab3493ea893fec7c Mon Sep 17 00:00:00 2001
From: Keenan Weaver <keenanweaver@protonmail.com>
Date: Sat, 10 Oct 2026 11:17:57 -0500
Subject: [PATCH 301/525] game-devices-udev-rules: modernize

---
 .../ga/game-devices-udev-rules/package.nix    | 30 ++++++++++++-------
 1 file changed, 19 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/ga/game-devices-udev-rules/package.nix b/pkgs/by-name/ga/game-devices-udev-rules/package.nix
index 8ee825a2df33..46a5059951e6 100644
--- a/pkgs/by-name/ga/game-devices-udev-rules/package.nix
+++ b/pkgs/by-name/ga/game-devices-udev-rules/package.nix
@@ -1,8 +1,11 @@
 {
   lib,
   stdenv,
-  fetchFromCodeberg,
   bash,
+  fetchFromCodeberg,
+  meson,
+  ninja,
+  nix-update-script,
   udevCheckHook,
 }:
 
@@ -10,6 +13,9 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "game-devices-udev-rules";
   version = "1.1";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   src = fetchFromCodeberg {
     owner = "fabiscafe";
     repo = "game-devices-udev";
@@ -17,29 +23,31 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-EWEfmKSSnJqVYx8oTxJu2el7bA6hEngHQ0a0kiffdNA=";
   };
 
+  postPatch = ''
+    substituteInPlace src/powera-gdu.rules \
+      --replace-fail '"/bin/sh -c' '"${lib.getExe bash} -c'
+  '';
+
   nativeBuildInputs = [
+    meson
+    ninja
     udevCheckHook
   ];
 
   doInstallCheck = true;
-
-  postInstall = ''
-    install -Dm444 -t "$out/lib/udev/rules.d" src/*.rules
-    substituteInPlace $out/lib/udev/rules.d/powera-gdu.rules \
-      --replace-fail "/bin/sh" "${bash}/bin/bash"
-  '';
+  passthru.updateScript = nix-update-script { };
 
   meta = {
     description = "Udev rules to make supported controllers available with user-grade permissions";
-    homepage = "https://codeberg.org/fabiscafe/game-devices-udev";
-    license = lib.licenses.mit;
     longDescription = ''
       These udev rules are intended to be used as a package under 'services.udev.packages'.
       They will not be activated if installed as 'environment.systemPackages' or 'users.user.<user>.packages'.
-
       Additionally, you may need to enable 'hardware.uinput'.
     '';
-    platforms = lib.platforms.linux;
+    homepage = "https://codeberg.org/fabiscafe/game-devices-udev";
+    changelog = "https://codeberg.org/fabiscafe/game-devices-udev/src/tag/${finalAttrs.version}/NEWS.md";
+    license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ keenanweaver ];
+    platforms = lib.platforms.linux;
   };
 })

From 85f76d04fa6f96741220e11c1db64123f4ff6bab Mon Sep 17 00:00:00 2001
From: Luke Granger-Brown <git@lukegb.com>
Date: Sat, 10 Oct 2026 18:43:36 +0100
Subject: [PATCH 302/525] gotosocial: 0.22.1 -> 0.22.2

---
 pkgs/by-name/go/gotosocial/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/go/gotosocial/package.nix b/pkgs/by-name/go/gotosocial/package.nix
index 07b2455c1e61..c65ac3fa4767 100644
--- a/pkgs/by-name/go/gotosocial/package.nix
+++ b/pkgs/by-name/go/gotosocial/package.nix
@@ -23,13 +23,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "gotosocial";
-  version = "0.22.1";
+  version = "0.22.2";
 
   src = fetchFromCodeberg {
     owner = "superseriousbusiness";
     repo = "gotosocial";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fRMQISOYf0rGcnNBpdlDeYWO0vvVwW0UPXdeT1y0+Ec=";
+    hash = "sha256-gzTiXcDiE7QwX/xcvtLOroDd1p1TU+XyH/On00Q51gU=";
   };
 
   vendorHash = null;

From 35528fefb6d9e7a8ce750b5f1725d7cf08d86351 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Sat, 10 Oct 2026 14:06:18 -0400
Subject: [PATCH 303/525] python3Packages.debugpy: fix tests on darwin

---
 .../python-modules/debugpy/hardcode-lldb.patch      | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/pkgs/development/python-modules/debugpy/hardcode-lldb.patch b/pkgs/development/python-modules/debugpy/hardcode-lldb.patch
index 07c5ff8c7d03..72bc2aaabe51 100644
--- a/pkgs/development/python-modules/debugpy/hardcode-lldb.patch
+++ b/pkgs/development/python-modules/debugpy/hardcode-lldb.patch
@@ -11,3 +11,16 @@ index ba7221fe..24efc1ed 100644
          "--no-lldbinit",  # Do not automatically parse any '.lldbinit' files.
          # '--attach-pid',
          # str(pid),
+diff --git a/tests/debugpy/server/test_add_code_to_python_process.py b/tests/debugpy/server/test_add_code_to_python_process.py
+--- a/tests/debugpy/server/test_add_code_to_python_process.py
++++ b/tests/debugpy/server/test_add_code_to_python_process.py
+@@ -117,8 +117,8 @@ def test_lldb_command(acpp):
+     (cmd,), kwargs = check_call.call_args
+     assert kwargs["shell"]
+ 
+-    assert cmd.startswith("lldb --no-lldbinit --script-language Python ")
++    assert cmd.startswith("@lldb@/bin/lldb --no-lldbinit --script-language Python ")
+     assert "-o 'process attach --pid 4242'" in cmd
+     assert "-o 'command script import \"%s\"'" % (lldb_prepare,) in cmd
+     assert '-o \'load_lib_and_attach "%s" 0 "print(1)" 7\'' % (target_dll,) in cmd
+     assert "-o 'process detach'" in cmd

From e473b65eb3de5d7377803da66293430e5b6a0ea7 Mon Sep 17 00:00:00 2001
From: Acid Bong <acidbong@tilde.club>
Date: Sat, 10 Oct 2026 21:15:38 +0300
Subject: [PATCH 304/525] python3Packages.pyowm: drop setuptools from
 dependencies (revert #305275)

It was dropped in csparpa/pyowm#435 due to the API deprecation
---
 pkgs/development/python-modules/pyowm/default.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/development/python-modules/pyowm/default.nix b/pkgs/development/python-modules/pyowm/default.nix
index 3f0ca9fbd483..ae95c320ff52 100644
--- a/pkgs/development/python-modules/pyowm/default.nix
+++ b/pkgs/development/python-modules/pyowm/default.nix
@@ -29,7 +29,6 @@ buildPythonPackage rec {
     geojson
     pysocks
     requests
-    setuptools
   ];
 
   nativeCheckInputs = [ pytestCheckHook ];

From 90f0ad6eb21ecbacbee4c074d42f067bc54a8d3f Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Sat, 10 Oct 2026 14:44:05 -0400
Subject: [PATCH 305/525] codex: package voice support

Build the voice helper on supported platforms and link it against
nixpkgs libopus. Assemble its fixed GStreamer runtime from nixpkgs
libraries and plugins, and test the packaged helper handshake and
runtime initialization.

Assisted-by: Codex, gpt-5.6-sol high
---
 pkgs/by-name/co/codex/nix-voice-runtime.patch | 20 ++++
 pkgs/by-name/co/codex/package.nix             | 92 +++++++++++++++++++
 pkgs/by-name/co/codex/test-voice-runtime.nix  | 15 +++
 pkgs/by-name/co/codex/test-voice-runtime.py   | 71 ++++++++++++++
 4 files changed, 198 insertions(+)
 create mode 100644 pkgs/by-name/co/codex/nix-voice-runtime.patch
 create mode 100644 pkgs/by-name/co/codex/test-voice-runtime.nix
 create mode 100644 pkgs/by-name/co/codex/test-voice-runtime.py

diff --git a/pkgs/by-name/co/codex/nix-voice-runtime.patch b/pkgs/by-name/co/codex/nix-voice-runtime.patch
new file mode 100644
index 000000000000..0bed0e9f5295
--- /dev/null
+++ b/pkgs/by-name/co/codex/nix-voice-runtime.patch
@@ -0,0 +1,20 @@
+diff --git a/voice-host/src/runtime.rs b/voice-host/src/runtime.rs
+index 0c795188d452..52b61449cd5e 100644
+--- a/voice-host/src/runtime.rs
++++ b/voice-host/src/runtime.rs
+@@ -127,10 +127,13 @@ impl Runtime {
+
+ fn private_file(root: &Path, relative: &str) -> io::Result<PathBuf> {
+     let path = root.join(relative);
+-    if path.canonicalize()? != path || !path.is_file() {
++    let canonical = path.canonicalize()?;
++    let is_nix_runtime_file = std::env::split_paths("@voiceRuntimeRoots@")
++        .any(|root| canonical.starts_with(&root) && canonical != root);
++    if !path.is_file() || (canonical != path && !is_nix_runtime_file) {
+         return Err(runtime_error());
+     }
+-    Ok(path)
++    Ok(canonical)
+ }
+
+ fn load(path: &Path) -> io::Result<ManuallyDrop<Library>> {
diff --git a/pkgs/by-name/co/codex/package.nix b/pkgs/by-name/co/codex/package.nix
index 701ef009c206..93dbf78b925b 100644
--- a/pkgs/by-name/co/codex/package.nix
+++ b/pkgs/by-name/co/codex/package.nix
@@ -5,18 +5,22 @@
   rustPlatform,
   fetchFromGitHub,
   installShellFiles,
+  alsa-lib,
   bubblewrap,
   clang,
   cmake,
   gitMinimal,
+  gst_all_1,
   libcap,
   libclang,
+  libopus,
   librusty_v8 ? callPackage ./librusty_v8.nix {
     inherit (callPackage ./fetchers.nix { }) fetchLibrustyV8;
   },
   librusty_v8_src_binding ? callPackage ./librusty_v8_src_binding.nix {
     inherit (callPackage ./fetchers.nix { }) fetchLibrustyV8SrcBinding;
   },
+  linkFarm,
   lld,
   nix-update-script,
   pkg-config,
@@ -29,6 +33,39 @@
   installShellCompletions ? stdenv.buildPlatform.canExecute stdenv.hostPlatform,
   _experimental-update-script-combinators,
 }:
+let
+  supportsVoice =
+    stdenv.hostPlatform.isDarwin || (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isGnu);
+  voiceRuntimeRoots = [
+    (lib.getLib gst_all_1.gstreamer)
+    (lib.getLib gst_all_1.gst-plugins-base)
+    (lib.getLib gst_all_1.gst-plugins-good)
+  ];
+  # Voice loads a fixed package-relative runtime, ignoring GStreamer discovery.
+  voiceRuntime =
+    let
+      pluginDirectory = if stdenv.hostPlatform.isDarwin then "plugins" else "lib/gstreamer-1.0";
+      pluginSuffix = stdenv.hostPlatform.extensions.sharedLibrary;
+      plugin = package: name: {
+        path = "${lib.getLib package}/lib/gstreamer-1.0/libgst${name}${pluginSuffix}";
+        name = "${pluginDirectory}/libgst${name}${pluginSuffix}";
+      };
+      coreSuffix = if stdenv.hostPlatform.isDarwin then "0.dylib" else "so.0";
+    in
+    linkFarm "codex-voice-runtime" [
+      {
+        path = "${lib.getLib gst_all_1.gstreamer}/lib/libgstreamer-1.0.${coreSuffix}";
+        name = "lib/libgstreamer-1.0.${coreSuffix}";
+      }
+      (plugin gst_all_1.gstreamer "coreelements")
+      (plugin gst_all_1.gst-plugins-base "app")
+      (plugin gst_all_1.gst-plugins-base "audioconvert")
+      (plugin gst_all_1.gst-plugins-base "audioresample")
+      (plugin gst_all_1.gst-plugins-base "opus")
+      (plugin gst_all_1.gst-plugins-good "rtp")
+      (plugin gst_all_1.gst-plugins-good "rtpmanager")
+    ];
+in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "codex";
   version = "0.162.1";
@@ -46,6 +83,24 @@ rustPlatform.buildRustPackage (finalAttrs: {
   sourceRoot = "${finalAttrs.src.name}/codex-rs";
 
   cargoHash = "sha256-UTu+ws1DqL375C+1jaVI9HBqDHnTuAQr7/h1rSzsEzg=";
+  # Disable bundled Opus so OPUS_LIB_DIR selects nixpkgs' libopus.
+  cargoDeps =
+    (rustPlatform.fetchCargoVendor {
+      inherit (finalAttrs)
+        pname
+        version
+        src
+        sourceRoot
+        ;
+      hash = finalAttrs.cargoHash;
+    }).overrideAttrs
+      (previousAttrs: {
+        buildCommand = previousAttrs.buildCommand + ''
+          chmod +w "$out/source-registry-0/opusic-sys-0.7.5/Cargo.toml"
+          substituteInPlace "$out/source-registry-0/opusic-sys-0.7.5/Cargo.toml" \
+            --replace-fail 'default = ["bundled"]' 'default = []'
+        '';
+      });
 
   __structuredAttrs = true;
 
@@ -56,12 +111,20 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "codex-cli"
     "--package"
     "codex-code-mode-host"
+  ]
+  ++ lib.optionals supportsVoice [
+    "--package"
+    "codex-voice-host"
   ];
   cargoCheckFlags = [
     "--package"
     "codex-cli"
     "--package"
     "codex-code-mode-host"
+  ]
+  ++ lib.optionals supportsVoice [
+    "--package"
+    "codex-voice-host"
   ];
 
   patches = [
@@ -71,8 +134,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
       packageLinkRoots = lib.concatStringsSep ":" (
         [ (toString (lib.getBin ripgrep)) ]
         ++ lib.optionals stdenv.hostPlatform.isLinux [ (toString (lib.getBin bubblewrap)) ]
+        ++ lib.optionals supportsVoice (map toString voiceRuntimeRoots)
       );
     })
+  ]
+  ++ lib.optionals supportsVoice [
+    # Likewise for the voice loader, independently of daemon mode.
+    (replaceVars ./nix-voice-runtime.patch {
+      voiceRuntimeRoots = lib.concatStringsSep ":" (map toString voiceRuntimeRoots);
+    })
+  ]
+  ++ [
     # https://github.com/openai/codex/issues/48195
     ./no-daemon_auto_start.patch
   ];
@@ -97,6 +169,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
     libclang
     openssl
   ]
+  ++ lib.optionals supportsVoice [
+    gst_all_1.gstreamer
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
+    libopus
+  ]
+  ++ lib.optionals (supportsVoice && stdenv.hostPlatform.isLinux) [
+    alsa-lib
+  ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     libcap
   ];
@@ -120,6 +201,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     RUSTY_V8_SRC_BINDING_PATH = librusty_v8_src_binding;
     STABLE_GIT_COMMIT = finalAttrs.buildCommit;
   }
+  // lib.optionalAttrs supportsVoice {
+    OPUS_LIB_DIR = "${lib.getLib libopus}/lib";
+  }
   // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
     # Link with lld on Darwin. nixpkgs' classic open-source ld64 fails to insert
     # ARM64 branch thunks for this binary, producing `b(l) ARM64 branch out of range`.
@@ -161,6 +245,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     install -d $out/codex-resources
     ln -s ${lib.getExe bubblewrap} $out/codex-resources/bwrap
   ''
+  + lib.optionalString supportsVoice ''
+    install -d $out/codex-resources/voice/bin
+    mv $out/bin/codex-voice-host $out/codex-resources/voice/bin/
+    cp -a ${voiceRuntime}/. $out/codex-resources/voice/
+  ''
   + lib.optionalString installShellCompletions ''
     installShellCompletion --cmd codex \
       --bash <($out/bin/codex completion bash) \
@@ -185,6 +274,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   passthru.tests = {
     app-server-daemon = callPackage ./test-app-server-daemon.nix { codex = finalAttrs.finalPackage; };
+  }
+  // lib.optionalAttrs supportsVoice {
+    voice-runtime = callPackage ./test-voice-runtime.nix { codex = finalAttrs.finalPackage; };
   };
 
   meta = {
diff --git a/pkgs/by-name/co/codex/test-voice-runtime.nix b/pkgs/by-name/co/codex/test-voice-runtime.nix
new file mode 100644
index 000000000000..298ba206dabf
--- /dev/null
+++ b/pkgs/by-name/co/codex/test-voice-runtime.nix
@@ -0,0 +1,15 @@
+{
+  codex,
+  python3,
+  runCommand,
+}:
+runCommand "${codex.name}-voice-runtime-test"
+  {
+    nativeBuildInputs = [ python3 ];
+  }
+  ''
+    python3 ${./test-voice-runtime.py} \
+      ${codex} \
+      ${codex.buildCommit}
+    touch $out
+  ''
diff --git a/pkgs/by-name/co/codex/test-voice-runtime.py b/pkgs/by-name/co/codex/test-voice-runtime.py
new file mode 100644
index 000000000000..e7ff2ad07946
--- /dev/null
+++ b/pkgs/by-name/co/codex/test-voice-runtime.py
@@ -0,0 +1,71 @@
+import json
+import os
+from pathlib import Path
+import select
+import struct
+import subprocess
+import sys
+
+
+package = Path(sys.argv[1])
+build_commit = sys.argv[2]
+
+runtime_environment = {
+    "GST_PLUGIN_PATH": "",
+    "GST_PLUGIN_PATH_1_0": "",
+    "GST_PLUGIN_SYSTEM_PATH": "",
+    "GST_PLUGIN_SYSTEM_PATH_1_0": "",
+    "GST_REGISTRY": "/dev/null",
+    "GST_REGISTRY_UPDATE": "no",
+    "GST_REGISTRY_FORK": "no",
+}
+
+
+def frame(message: dict[str, object]) -> bytes:
+    payload = json.dumps(message, separators=(",", ":")).encode()
+    return struct.pack(">I", len(payload)) + payload
+
+
+def read_exact(stream: subprocess.Popen[bytes], size: int) -> bytes:
+    output = bytearray()
+    assert stream.stdout is not None
+    while len(output) < size:
+        readable, _, _ = select.select([stream.stdout], [], [], 10)
+        if not readable:
+            raise TimeoutError("voice helper response timed out")
+        chunk = os.read(stream.stdout.fileno(), size - len(output))
+        if not chunk:
+            raise EOFError("voice helper exited before replying")
+        output.extend(chunk)
+    return bytes(output)
+
+
+def exchange(stream: subprocess.Popen[bytes], message: dict[str, object]) -> object:
+    assert stream.stdin is not None
+    stream.stdin.write(frame(message))
+    stream.stdin.flush()
+    length = struct.unpack(">I", read_exact(stream, 4))[0]
+    return json.loads(read_exact(stream, length))
+
+
+environment = os.environ.copy()
+environment.update(runtime_environment)
+process = subprocess.Popen(
+    [package / "codex-resources/voice/bin/codex-voice-host"],
+    cwd=package,
+    env=environment,
+    stdin=subprocess.PIPE,
+    stdout=subprocess.PIPE,
+    stderr=subprocess.PIPE,
+    bufsize=0,
+)
+assert exchange(
+    process, {"type": "hello", "protocol": 1, "buildCommit": build_commit}
+) == {"type": "ready"}
+assert exchange(process, {"type": "initializeRuntime"}) == {"type": "runtimeReady"}
+assert exchange(process, {"type": "close"}) == {"type": "closed"}
+assert process.stdin is not None
+assert process.stderr is not None
+process.stdin.close()
+status = process.wait(timeout=10)
+assert status == 0, process.stderr.read().decode(errors="replace")

From 23d223d9495f66caa44849b821b7c13d12ca4f26 Mon Sep 17 00:00:00 2001
From: repparw <ubritos@gmail.com>
Date: Sat, 10 Oct 2026 16:28:04 -0300
Subject: [PATCH 306/525] voxtype: provide pactl for audio ducking

Voxtype uses pactl for media ducking and volume restoration. Add
pulseaudio to the runtime wrapper so it works without a user-installed
pactl executable.

Assisted-by: ChatGPT (OpenAI GPT-6)
---
 pkgs/by-name/vo/voxtype/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/vo/voxtype/package.nix b/pkgs/by-name/vo/voxtype/package.nix
index 89f707c104a5..72f4c750df3b 100644
--- a/pkgs/by-name/vo/voxtype/package.nix
+++ b/pkgs/by-name/vo/voxtype/package.nix
@@ -19,6 +19,7 @@
   libnotify,
   openssl,
   pciutils,
+  pulseaudio,
   wl-clipboard,
   wtype,
   which,
@@ -154,6 +155,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
         (lib.makeBinPath (
           [
             libnotify
+            pulseaudio # pactl for media ducking
             which
           ]
           ++ lib.optionals vulkanSupport [

From f5941abcd0456f7cc5a2d2be1c6a53b60cec7435 Mon Sep 17 00:00:00 2001
From: Raito Bezarius <masterancpp@gmail.com>
Date: Sat, 3 Oct 2026 15:26:45 +0200
Subject: [PATCH 307/525] treewide: use systemdLibs for Wayland compositors and
 session helpers

---
 pkgs/by-name/ca/cagebreak/package.nix        | 4 ++--
 pkgs/by-name/co/cosmic-comp/package.nix      | 6 +++---
 pkgs/by-name/df/dfl-login1/package.nix       | 4 ++--
 pkgs/by-name/ga/gamemode/package.nix         | 4 ++--
 pkgs/by-name/hy/hyprland/package.nix         | 6 +++---
 pkgs/by-name/ir/ironbar/package.nix          | 4 ++--
 pkgs/by-name/li/lightlocker/package.nix      | 4 ++--
 pkgs/by-name/ph/phosh/package.nix            | 4 ++--
 pkgs/by-name/st/stevia/package.nix           | 4 ++--
 pkgs/by-name/sw/sway-unwrapped/package.nix   | 4 ++--
 pkgs/by-name/sw/swayfx-unwrapped/package.nix | 4 ++--
 pkgs/by-name/sw/swaylock-plugin/package.nix  | 4 ++--
 pkgs/by-name/uw/uwsm/package.nix             | 4 ++--
 pkgs/by-name/wa/waydroid-helper/package.nix  | 4 ++--
 pkgs/by-name/wi/wivrn/package.nix            | 4 ++--
 pkgs/by-name/xa/xarcan/package.nix           | 4 ++--
 pkgs/by-name/xw/xwayland/package.nix         | 4 ++--
 17 files changed, 36 insertions(+), 36 deletions(-)

diff --git a/pkgs/by-name/ca/cagebreak/package.nix b/pkgs/by-name/ca/cagebreak/package.nix
index adabf5144bfc..eed7ab693f65 100644
--- a/pkgs/by-name/ca/cagebreak/package.nix
+++ b/pkgs/by-name/ca/cagebreak/package.nix
@@ -17,7 +17,7 @@
   pixman,
   pkg-config,
   scdoc,
-  systemd,
+  systemdLibs,
   wayland,
   wayland-protocols,
   wayland-scanner,
@@ -56,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
     libxcb-wm
     pango
     pixman
-    systemd
+    systemdLibs
     wayland
     wayland-protocols
     wlroots_0_19
diff --git a/pkgs/by-name/co/cosmic-comp/package.nix b/pkgs/by-name/co/cosmic-comp/package.nix
index 3c9665ec757b..1e32dcb5f675 100644
--- a/pkgs/by-name/co/cosmic-comp/package.nix
+++ b/pkgs/by-name/co/cosmic-comp/package.nix
@@ -11,12 +11,12 @@
   pixman,
   seatd,
   udev,
-  systemd,
+  systemdLibs,
   xrdb,
   nix-update-script,
   nixosTests,
 
-  useSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
+  useSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
   withXWayland ? true,
 }:
 
@@ -53,7 +53,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     seatd
     udev
   ]
-  ++ lib.optional useSystemd systemd;
+  ++ lib.optional useSystemd systemdLibs;
 
   makeFlags = [
     "prefix=${placeholder "out"}"
diff --git a/pkgs/by-name/df/dfl-login1/package.nix b/pkgs/by-name/df/dfl-login1/package.nix
index 528b6687d933..51d169c45a35 100644
--- a/pkgs/by-name/df/dfl-login1/package.nix
+++ b/pkgs/by-name/df/dfl-login1/package.nix
@@ -6,7 +6,7 @@
   ninja,
   pkg-config,
   qt6,
-  systemd,
+  systemdLibs,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     qt6.qtbase
-    systemd
+    systemdLibs
   ];
 
   dontWrapQtApps = true;
diff --git a/pkgs/by-name/ga/gamemode/package.nix b/pkgs/by-name/ga/gamemode/package.nix
index ed512d32f76a..f260059dde5e 100644
--- a/pkgs/by-name/ga/gamemode/package.nix
+++ b/pkgs/by-name/ga/gamemode/package.nix
@@ -9,7 +9,7 @@
   pkg-config,
   dbus,
   inih,
-  systemd,
+  systemdLibs,
   appstream,
   findutils,
   gawk,
@@ -65,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     dbus
     inih
-    systemd
+    systemdLibs
   ];
 
   mesonFlags = [
diff --git a/pkgs/by-name/hy/hyprland/package.nix b/pkgs/by-name/hy/hyprland/package.nix
index 163dba3f7589..9e28edd5de79 100644
--- a/pkgs/by-name/hy/hyprland/package.nix
+++ b/pkgs/by-name/hy/hyprland/package.nix
@@ -37,7 +37,7 @@
   python3,
   re2,
   readline,
-  systemd,
+  systemdLibs,
   tomlplusplus,
   udis86,
   uwsm,
@@ -52,7 +52,7 @@
   xwayland,
   debug ? false,
   enableXWayland ? true,
-  withSystemd ? lib.meta.availableOn gcc16Stdenv.hostPlatform systemd,
+  withSystemd ? lib.meta.availableOn gcc16Stdenv.hostPlatform systemdLibs,
   wrapRuntimeDeps ? true,
 }:
 let
@@ -190,7 +190,7 @@ customStdenv.mkDerivation (finalAttrs: {
       libxdmcp
       xwayland
     ])
-    (optionals withSystemd [ systemd ])
+    (optionals withSystemd [ systemdLibs ])
   ];
 
   cmakeBuildType = if debug then "Debug" else "RelWithDebInfo";
diff --git a/pkgs/by-name/ir/ironbar/package.nix b/pkgs/by-name/ir/ironbar/package.nix
index e412b8efc7a9..16ee62131ad8 100644
--- a/pkgs/by-name/ir/ironbar/package.nix
+++ b/pkgs/by-name/ir/ironbar/package.nix
@@ -23,7 +23,7 @@
   libinput,
   libevdev,
   features ? [ ],
-  systemd,
+  systemdLibs,
   dbus,
 }:
 
@@ -54,7 +54,7 @@ rustPlatform.buildRustPackage rec {
     hicolor-icon-theme
     gsettings-desktop-schemas
     libxkbcommon
-    systemd
+    systemdLibs
     dbus
   ]
   ++ lib.optionals (hasFeature "volume") [ libpulseaudio ]
diff --git a/pkgs/by-name/li/lightlocker/package.nix b/pkgs/by-name/li/lightlocker/package.nix
index 1f155094a21c..6040dc709eb7 100644
--- a/pkgs/by-name/li/lightlocker/package.nix
+++ b/pkgs/by-name/li/lightlocker/package.nix
@@ -14,7 +14,7 @@
   libxscrnsaver,
   libxxf86vm,
   libxext,
-  systemd,
+  systemdLibs,
   pantheon,
   wrapGAppsHook3,
 }:
@@ -51,7 +51,7 @@ stdenv.mkDerivation rec {
     libxscrnsaver
     libxext
     libxxf86vm
-    systemd
+    systemdLibs
   ];
 
   mesonFlags = [
diff --git a/pkgs/by-name/ph/phosh/package.nix b/pkgs/by-name/ph/phosh/package.nix
index 353a27887e98..490ba74c9ae2 100644
--- a/pkgs/by-name/ph/phosh/package.nix
+++ b/pkgs/by-name/ph/phosh/package.nix
@@ -26,7 +26,7 @@
   gnome-shell,
   gcr_3,
   pam,
-  systemd,
+  systemdLibs,
   upower,
   wayland,
   dbus,
@@ -118,7 +118,7 @@ stdenv.mkDerivation (finalAttrs: {
     gnome-session
     gtk4
     pam
-    systemd
+    systemdLibs
     upower
     wayland
     feedbackd
diff --git a/pkgs/by-name/st/stevia/package.nix b/pkgs/by-name/st/stevia/package.nix
index 360abbd01815..f21bd9af3927 100644
--- a/pkgs/by-name/st/stevia/package.nix
+++ b/pkgs/by-name/st/stevia/package.nix
@@ -20,7 +20,7 @@
   json-glib,
   libhandy,
   libxkbcommon,
-  systemd,
+  systemdLibs,
   nix-update-script,
   dconf,
 }:
@@ -69,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
     json-glib
     libhandy
     libxkbcommon
-    systemd
+    systemdLibs
     dconf
   ];
 
diff --git a/pkgs/by-name/sw/sway-unwrapped/package.nix b/pkgs/by-name/sw/sway-unwrapped/package.nix
index 6764aa45dbdd..44d3cc9ba7b7 100644
--- a/pkgs/by-name/sw/sway-unwrapped/package.nix
+++ b/pkgs/by-name/sw/sway-unwrapped/package.nix
@@ -29,8 +29,8 @@
   isNixOS ? false,
   enableXWayland ? true,
   libxcb-wm,
-  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd,
-  systemd,
+  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
+  systemdLibs,
   trayEnabled ? systemdSupport,
 }:
 
diff --git a/pkgs/by-name/sw/swayfx-unwrapped/package.nix b/pkgs/by-name/sw/swayfx-unwrapped/package.nix
index 59968a93d18a..bf7aed390dbd 100644
--- a/pkgs/by-name/sw/swayfx-unwrapped/package.nix
+++ b/pkgs/by-name/sw/swayfx-unwrapped/package.nix
@@ -2,7 +2,7 @@
   lib,
   fetchFromGitHub,
   stdenv,
-  systemd,
+  systemdLibs,
   meson,
   replaceVars,
   swaybg,
@@ -31,7 +31,7 @@
   # Used by the NixOS module:
   isNixOS ? false,
   enableXWayland ? true,
-  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemd,
+  systemdSupport ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
   trayEnabled ? systemdSupport,
 }:
 
diff --git a/pkgs/by-name/sw/swaylock-plugin/package.nix b/pkgs/by-name/sw/swaylock-plugin/package.nix
index 5dfa969f69f3..c37e916f68ec 100644
--- a/pkgs/by-name/sw/swaylock-plugin/package.nix
+++ b/pkgs/by-name/sw/swaylock-plugin/package.nix
@@ -14,7 +14,7 @@
   scdoc,
   stdenv,
   swaybg,
-  systemd,
+  systemdLibs,
   versionCheckHook,
   wayland,
   wayland-protocols,
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
     gdk-pixbuf
     libxkbcommon
     pam
-    systemd
+    systemdLibs
     wayland
     wayland-protocols
   ];
diff --git a/pkgs/by-name/uw/uwsm/package.nix b/pkgs/by-name/uw/uwsm/package.nix
index 3dd6fceee2ec..bc0717b3b2af 100644
--- a/pkgs/by-name/uw/uwsm/package.nix
+++ b/pkgs/by-name/uw/uwsm/package.nix
@@ -14,7 +14,7 @@
   libnotify,
   newt,
   python3Packages,
-  systemd,
+  systemdLibs,
   util-linux,
   fumonSupport ? true,
   uuctlSupport ? true,
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
     newt # whiptail
     libnotify # notify-send
     bash # sh
-    systemd
+    systemdLibs
     python
   ]
   ++ lib.optionals uuctlSupport [ dmenu ];
diff --git a/pkgs/by-name/wa/waydroid-helper/package.nix b/pkgs/by-name/wa/waydroid-helper/package.nix
index 33eeb4bc76b7..e9cffd51d4b9 100644
--- a/pkgs/by-name/wa/waydroid-helper/package.nix
+++ b/pkgs/by-name/wa/waydroid-helper/package.nix
@@ -19,7 +19,7 @@
   fakeroot,
   libadwaita,
   libxml2,
-  systemd,
+  systemdLibs,
   unzip,
   vte-gtk4,
   nix-update-script,
@@ -83,7 +83,7 @@ python3Packages.buildPythonApplication {
     dbus
     libadwaita
     libxml2
-    systemd
+    systemdLibs
     vte-gtk4
   ];
 
diff --git a/pkgs/by-name/wi/wivrn/package.nix b/pkgs/by-name/wi/wivrn/package.nix
index 4d7f2d9413bf..60985cce8f8f 100644
--- a/pkgs/by-name/wi/wivrn/package.nix
+++ b/pkgs/by-name/wi/wivrn/package.nix
@@ -40,7 +40,7 @@
   qt6,
   sdl2-compat,
   shaderc,
-  systemd,
+  systemdLibs,
   udev,
   vulkan-headers,
   vulkan-loader,
@@ -120,7 +120,7 @@ stdenv.mkDerivation (finalAttrs: {
     libxrandr
     openxr-loader
     shaderc
-    systemd
+    systemdLibs
     udev
     vulkan-headers
     vulkan-loader
diff --git a/pkgs/by-name/xa/xarcan/package.nix b/pkgs/by-name/xa/xarcan/package.nix
index df3ccaf4a28d..6f7da8d1ccc9 100644
--- a/pkgs/by-name/xa/xarcan/package.nix
+++ b/pkgs/by-name/xa/xarcan/package.nix
@@ -29,7 +29,7 @@
   openssl,
   pixman,
   pkg-config,
-  systemd,
+  systemdLibs,
   libxcb-util,
   libxcb-wm,
   libxcb-image,
@@ -82,7 +82,7 @@ stdenv.mkDerivation (finalPackages: rec {
     nettle
     openssl
     pixman
-    systemd
+    systemdLibs
     libxcb-util
     libxcb-wm
     libxcb-image
diff --git a/pkgs/by-name/xw/xwayland/package.nix b/pkgs/by-name/xw/xwayland/package.nix
index 6e601a598632..05d2799c66c2 100644
--- a/pkgs/by-name/xw/xwayland/package.nix
+++ b/pkgs/by-name/xw/xwayland/package.nix
@@ -41,7 +41,7 @@
   pkg-config,
   pixman,
   stdenv,
-  systemd,
+  systemdLibs,
   wayland,
   wayland-protocols,
   wayland-scanner,
@@ -116,7 +116,7 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
     libtirpc
-    systemd
+    systemdLibs
   ]
   ++ lib.optionals stdenv.hostPlatform.isFreeBSD [
     epoll-shim

From e19e18e59401c4e22286fe8280e46307950cd3d6 Mon Sep 17 00:00:00 2001
From: OPNA2608 <opna2608@protonmail.com>
Date: Sat, 10 Oct 2026 21:53:12 +0200
Subject: [PATCH 308/525] box2d: Actually run the tests again

- doCheck setting dropped during the 3.x bump, defaults is false
- cmake code doesn't use add_test(), so need to manually call the test binary
- hash results during UpdateFallingHinges are not the same across endiannesses, so restrict test running to little-endian
---
 pkgs/by-name/bo/box2d/package.nix | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/pkgs/by-name/bo/box2d/package.nix b/pkgs/by-name/bo/box2d/package.nix
index 881f29239669..7d3e5695043f 100644
--- a/pkgs/by-name/bo/box2d/package.nix
+++ b/pkgs/by-name/bo/box2d/package.nix
@@ -85,6 +85,19 @@ stdenv.mkDerivation (finalAttrs: {
     (cmakeBool "BOX2D_BUILD_UNIT_TESTS" finalAttrs.finalPackage.doCheck)
   ];
 
+  doCheck =
+    stdenv.buildPlatform.canExecute stdenv.hostPlatform
+    # b2Hash calls get struct reinterpreted as byte array for input, results not stable across endiannesses
+    && stdenv.hostPlatform.isLittleEndian;
+
+  checkPhase = ''
+    runHook preCheck
+
+    ./bin/test
+
+    runHook postCheck
+  '';
+
   passthru = {
     updateScript = nix-update-script { };
   };

From 1b52e5d4ef513fc6dc0d14d4de8eb740968b0bca Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 10 Oct 2026 20:17:28 +0000
Subject: [PATCH 309/525] throne: 1.3.1 -> 1.3.2

---
 pkgs/by-name/th/throne/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/th/throne/package.nix b/pkgs/by-name/th/throne/package.nix
index 93d66872fbc0..70f896671b24 100644
--- a/pkgs/by-name/th/throne/package.nix
+++ b/pkgs/by-name/th/throne/package.nix
@@ -28,13 +28,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "throne";
-  version = "1.3.1";
+  version = "1.3.2";
 
   src = fetchFromGitHub {
     owner = "throneproj";
     repo = "Throne";
     tag = finalAttrs.version;
-    hash = "sha256-G1i8nFMabkg7qUbqYq/GYXsREXRcSXtDSO+RgiuulIE=";
+    hash = "sha256-Jj8IVXUm+36sE/195DdrU2l/MpaN4WJtW3ST/j8xKVU=";
   };
 
   # NKR_ELEVATION_HINT contains spaces
@@ -120,7 +120,7 @@ stdenv.mkDerivation (finalAttrs: {
     # the main package has no tests, checkPhase would only rebuild all deps without -trimpath
     doCheck = false;
 
-    vendorHash = "sha256-L189eeaYDdDKGJYT5vr412YpTgHptVfC4jpNSjNcyuk=";
+    vendorHash = "sha256-NWTXF1f9yNxhzqgF9A7eYWCmGrJ2DV/z/wKW4Yf94ZA=";
 
     nativeBuildInputs = [
       protobuf

From b3609dce8d9eedb77394fcc3eb687fef3d7a545c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 10 Oct 2026 20:39:06 +0000
Subject: [PATCH 310/525] atmos: 1.230.0 -> 1.231.0

---
 pkgs/by-name/at/atmos/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/at/atmos/package.nix b/pkgs/by-name/at/atmos/package.nix
index 3a22a2c933ed..da9b82ec7165 100644
--- a/pkgs/by-name/at/atmos/package.nix
+++ b/pkgs/by-name/at/atmos/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "atmos";
-  version = "1.230.0";
+  version = "1.231.0";
 
   src = fetchFromGitHub {
     owner = "cloudposse";
     repo = "atmos";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2iyRkQQ+NKER60jBiGrcq+QKBO8+pt3nfHm9Tn3e+iU=";
+    hash = "sha256-8jTwgmqoz4/W61JvCnoIq+l0eFTmU+Y5aaYqUivfDXo=";
   };
 
-  vendorHash = "sha256-J5TNPXzEz4gaNi2mEqkQ+t1JzmocbRRLwUwzLgAZU40=";
+  vendorHash = "sha256-Mzi4xP9cDmdnOYaVWfKaWnZ/HM/rCbdgPb+gBBTrASE=";
 
   env.CGO_ENABLED = 0; # Compiles a pure statically linked Go binary.
 

From 73a2359945e1047e689c78423d578ee8c40c090a Mon Sep 17 00:00:00 2001
From: Raito Bezarius <masterancpp@gmail.com>
Date: Sat, 3 Oct 2026 15:26:45 +0200
Subject: [PATCH 311/525] treewide: use systemdLibs for Electron and
 browser-based desktop apps

---
 pkgs/applications/editors/android-studio/linux.nix | 4 ++--
 pkgs/by-name/ai/airtame/package.nix                | 4 ++--
 pkgs/by-name/al/alfaview/package.nix               | 4 ++--
 pkgs/by-name/an/antigravity-hub/package.nix        | 4 ++--
 pkgs/by-name/az/azuredatastudio/package.nix        | 4 ++--
 pkgs/by-name/be/beekeeper-studio/package.nix       | 4 ++--
 pkgs/by-name/ce/celestegame/package.nix            | 2 +-
 pkgs/by-name/ci/citrix-workspace/package.nix       | 4 ++--
 pkgs/by-name/en/envision/package.nix               | 2 +-
 pkgs/by-name/ex/exodus/package.nix                 | 4 ++--
 pkgs/by-name/fe/feishu/package.nix                 | 4 ++--
 pkgs/by-name/ge/genymotion/package.nix             | 4 ++--
 pkgs/by-name/go/google-chrome/package.nix          | 4 ++--
 pkgs/by-name/ha/hakuneko/package.nix               | 4 ++--
 pkgs/by-name/he/hey-mail/package.nix               | 4 ++--
 pkgs/by-name/le/legends-of-equestria/package.nix   | 4 ++--
 pkgs/by-name/mi/microsoft-edge/package.nix         | 4 ++--
 pkgs/by-name/mo/mongodb-compass/package.nix        | 4 ++--
 pkgs/by-name/ne/nemu/package.nix                   | 4 ++--
 pkgs/by-name/ne/nextcloud-talk-desktop/package.nix | 4 ++--
 pkgs/by-name/no/nordpass/package.nix               | 4 ++--
 pkgs/by-name/nw/nwjs/package.nix                   | 4 ++--
 pkgs/by-name/pe/pencil/package.nix                 | 4 ++--
 pkgs/by-name/pi/pineflash/package.nix              | 4 ++--
 pkgs/by-name/pl/plasticity/package.nix             | 4 ++--
 pkgs/by-name/po/positron-bin/package.nix           | 4 ++--
 pkgs/by-name/pu/pulsar/package.nix                 | 4 ++--
 pkgs/by-name/qq/qq/package.nix                     | 4 ++--
 pkgs/by-name/si/sidequest/package.nix              | 4 ++--
 pkgs/by-name/sp/spotify/linux.nix                  | 4 ++--
 pkgs/by-name/st/staruml/package.nix                | 4 ++--
 pkgs/by-name/ti/ticktick/package.nix               | 4 ++--
 pkgs/by-name/ti/tidal-hifi/package.nix             | 4 ++--
 pkgs/by-name/tr/tradingview/package.nix            | 4 ++--
 pkgs/by-name/up/upwork/package.nix                 | 6 +++---
 pkgs/by-name/vi/vivaldi/package.nix                | 4 ++--
 pkgs/by-name/we/wechat-uos/package.nix             | 4 ++--
 pkgs/by-name/xm/xmind/package.nix                  | 4 ++--
 38 files changed, 75 insertions(+), 75 deletions(-)

diff --git a/pkgs/applications/editors/android-studio/linux.nix b/pkgs/applications/editors/android-studio/linux.nix
index 7a79ab2d3bd9..4ea463cfecdb 100644
--- a/pkgs/applications/editors/android-studio/linux.nix
+++ b/pkgs/applications/editors/android-studio/linux.nix
@@ -64,7 +64,7 @@
   setxkbmap,
   lib,
   stdenv,
-  systemd,
+  systemdLibs,
   unzip,
   usbutils,
   which,
@@ -190,7 +190,7 @@ let
             libpng
             nspr
             nss_latest
-            systemd
+            systemdLibs
 
             # For GTKLookAndFeel
             gtk3
diff --git a/pkgs/by-name/ai/airtame/package.nix b/pkgs/by-name/ai/airtame/package.nix
index 54ca7d7333a7..20e774b63ceb 100644
--- a/pkgs/by-name/ai/airtame/package.nix
+++ b/pkgs/by-name/ai/airtame/package.nix
@@ -31,7 +31,7 @@
   lib,
   libnotify,
   libappindicator,
-  systemd,
+  systemdLibs,
   pciutils,
 }:
 let
@@ -86,7 +86,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = deps;
   runtimeDependencies = [
-    (lib.getLib systemd)
+    (lib.getLib systemdLibs)
     libnotify
     libappindicator
     pulseaudio
diff --git a/pkgs/by-name/al/alfaview/package.nix b/pkgs/by-name/al/alfaview/package.nix
index ce7c9c69dcae..404fb22e4bc2 100644
--- a/pkgs/by-name/al/alfaview/package.nix
+++ b/pkgs/by-name/al/alfaview/package.nix
@@ -20,7 +20,7 @@
   libxkbcommon,
   libgbm,
   openssl,
-  systemd,
+  systemdLibs,
   libxcb-cursor,
   libxcb-wm,
   libxcb-render-util,
@@ -63,7 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
     libgbm
     openssl
     stdenv.cc.cc
-    systemd
+    systemdLibs
     libxcb-cursor
     libx11
     libxcb-wm
diff --git a/pkgs/by-name/an/antigravity-hub/package.nix b/pkgs/by-name/an/antigravity-hub/package.nix
index ec8105d975c0..83f6f7d263de 100644
--- a/pkgs/by-name/an/antigravity-hub/package.nix
+++ b/pkgs/by-name/an/antigravity-hub/package.nix
@@ -36,7 +36,7 @@
   nss,
   pango,
   pipewire,
-  systemd,
+  systemdLibs,
   unzip,
   wrapGAppsHook3,
 }:
@@ -113,7 +113,7 @@ stdenv.mkDerivation (finalAttrs: {
     nspr
     nss
     pango
-    systemd
+    systemdLibs
   ];
 
   # Loaded with dlopen() by the main binary, so autoPatchelfHook cannot discover them.
diff --git a/pkgs/by-name/az/azuredatastudio/package.nix b/pkgs/by-name/az/azuredatastudio/package.nix
index 6739d0cac653..aef772b50d4c 100644
--- a/pkgs/by-name/az/azuredatastudio/package.nix
+++ b/pkgs/by-name/az/azuredatastudio/package.nix
@@ -27,7 +27,7 @@
   nss,
   openssl,
   pango,
-  systemd,
+  systemdLibs,
   wrapGAppsHook3,
   libxrandr,
   libxfixes,
@@ -183,7 +183,7 @@ stdenv.mkDerivation rec {
       libxkbfile
       pango
       stdenv.cc.cc
-      systemd
+      systemdLibs
     ])
     targetPath
     sqltoolsserviceRpath
diff --git a/pkgs/by-name/be/beekeeper-studio/package.nix b/pkgs/by-name/be/beekeeper-studio/package.nix
index 77a6dd9db7d1..03bb6df51867 100644
--- a/pkgs/by-name/be/beekeeper-studio/package.nix
+++ b/pkgs/by-name/be/beekeeper-studio/package.nix
@@ -32,7 +32,7 @@
   libxkbcommon,
   libgbm,
   vulkan-loader,
-  systemd,
+  systemdLibs,
   libGL,
   krb5,
   unixodbc,
@@ -100,7 +100,7 @@ stdenv.mkDerivation (finalAttrs: {
     unixodbc
   ];
 
-  runtimeDependencies = lib.optionals stdenv.hostPlatform.isLinux (lib.getLib systemd);
+  runtimeDependencies = lib.optionals stdenv.hostPlatform.isLinux (lib.getLib systemdLibs);
 
   installPhase = ''
     runHook preInstall
diff --git a/pkgs/by-name/ce/celestegame/package.nix b/pkgs/by-name/ce/celestegame/package.nix
index e67c0a2749cd..6a45ec6fac3c 100644
--- a/pkgs/by-name/ce/celestegame/package.nix
+++ b/pkgs/by-name/ce/celestegame/package.nix
@@ -99,7 +99,7 @@ buildFHSEnv {
       util-linux.lib
       libselinux
       nspr
-      systemd
+      systemdLibs
       gtk3
       pango
       harfbuzz
diff --git a/pkgs/by-name/ci/citrix-workspace/package.nix b/pkgs/by-name/ci/citrix-workspace/package.nix
index 5e8d68ded2ab..b43d11cf6565 100644
--- a/pkgs/by-name/ci/citrix-workspace/package.nix
+++ b/pkgs/by-name/ci/citrix-workspace/package.nix
@@ -55,7 +55,7 @@
   sane-backends,
   speex,
   symlinkJoin,
-  systemd,
+  systemdLibs,
   tzdata,
   which,
   woff2,
@@ -194,7 +194,7 @@ stdenv.mkDerivation (finalAttrs: {
     sane-backends
     speex
     stdenv.cc.cc
-    (lib.getLib systemd)
+    (lib.getLib systemdLibs)
     woff2
     webkitgtk_4_1
     libxscrnsaver
diff --git a/pkgs/by-name/en/envision/package.nix b/pkgs/by-name/en/envision/package.nix
index 830615a493de..35c0e2a67ac5 100644
--- a/pkgs/by-name/en/envision/package.nix
+++ b/pkgs/by-name/en/envision/package.nix
@@ -94,7 +94,7 @@ buildFHSEnv {
         openxr-loader
         pipewire
         pulseaudio
-        systemd
+        systemdLibs
         vulkan-loader
         x264
       ])
diff --git a/pkgs/by-name/ex/exodus/package.nix b/pkgs/by-name/ex/exodus/package.nix
index 0294e7751c55..64d1bb88d2db 100644
--- a/pkgs/by-name/ex/exodus/package.nix
+++ b/pkgs/by-name/ex/exodus/package.nix
@@ -4,7 +4,7 @@
   requireFile,
   unzip,
   glib,
-  systemd,
+  systemdLibs,
   nss,
   nspr,
   gtk3-x11,
@@ -95,7 +95,7 @@ stdenv.mkDerivation (finalAttrs: {
         at-spi2-core
         cups.lib
         libpulseaudio
-        systemd
+        systemdLibs
         vivaldi-ffmpeg-codecs
         libxkbcommon
         libgbm
diff --git a/pkgs/by-name/fe/feishu/package.nix b/pkgs/by-name/fe/feishu/package.nix
index ebf04b023ce9..0c04b3f4c445 100644
--- a/pkgs/by-name/fe/feishu/package.nix
+++ b/pkgs/by-name/fe/feishu/package.nix
@@ -53,7 +53,7 @@
   pipewire,
   pixman,
   stdenv,
-  systemd,
+  systemdLibs,
   wayland,
   xdg-utils,
   writeScript,
@@ -127,7 +127,7 @@ let
     pipewire
     pixman
     stdenv.cc.cc
-    systemd
+    systemdLibs
     wayland
     xdg-utils
   ];
diff --git a/pkgs/by-name/ge/genymotion/package.nix b/pkgs/by-name/ge/genymotion/package.nix
index 08b406a5b03c..55a128b9f1dd 100644
--- a/pkgs/by-name/ge/genymotion/package.nix
+++ b/pkgs/by-name/ge/genymotion/package.nix
@@ -15,7 +15,7 @@
   libxrender,
   fontconfig,
   freetype,
-  systemd,
+  systemdLibs,
   libpulseaudio,
   cairo,
   gdk-pixbuf,
@@ -46,7 +46,7 @@ let
     libxrender
     fontconfig
     freetype
-    systemd
+    systemdLibs
     libpulseaudio
     cairo
     gdk-pixbuf
diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix
index 3c6a8aefa306..2a51b56fdfd8 100644
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -55,7 +55,7 @@
   commandLineArgs ? "",
 
   # Will crash without.
-  systemd,
+  systemdLibs,
 
   # Loaded at runtime.
   libexif,
@@ -159,7 +159,7 @@ let
     pipewire
     snappy
     speechd-minimal
-    systemd
+    systemdLibs
     util-linux
     vulkan-loader
     wayland
diff --git a/pkgs/by-name/ha/hakuneko/package.nix b/pkgs/by-name/ha/hakuneko/package.nix
index bab7e86d7799..1083ad949081 100644
--- a/pkgs/by-name/ha/hakuneko/package.nix
+++ b/pkgs/by-name/ha/hakuneko/package.nix
@@ -11,7 +11,7 @@
   alsa-lib,
   nss,
   nspr,
-  systemd,
+  systemdLibs,
   libxtst,
   libxscrnsaver,
 }:
@@ -64,7 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
     nspr
     libxscrnsaver
     libxtst
-    systemd
+    systemdLibs
   ];
 
   unpackPhase = ''
diff --git a/pkgs/by-name/he/hey-mail/package.nix b/pkgs/by-name/he/hey-mail/package.nix
index 156699f2c79c..24316e0dcc5b 100644
--- a/pkgs/by-name/he/hey-mail/package.nix
+++ b/pkgs/by-name/he/hey-mail/package.nix
@@ -22,7 +22,7 @@
   atk,
   libgbm,
   cups,
-  systemd,
+  systemdLibs,
   alsa-lib,
   at-spi2-atk,
   at-spi2-core,
@@ -63,7 +63,7 @@ let
     atk
     libgbm
     cups
-    systemd
+    systemdLibs
     alsa-lib
     at-spi2-atk
     at-spi2-core
diff --git a/pkgs/by-name/le/legends-of-equestria/package.nix b/pkgs/by-name/le/legends-of-equestria/package.nix
index 65539a30db33..f187814b4a4c 100644
--- a/pkgs/by-name/le/legends-of-equestria/package.nix
+++ b/pkgs/by-name/le/legends-of-equestria/package.nix
@@ -12,7 +12,7 @@
   cairo,
   dbus,
   xorg_sys_opengl,
-  systemd,
+  systemdLibs,
   libcap,
   libdrm,
   pulseaudio,
@@ -61,7 +61,7 @@ let
   runtimeDeps = [
     dbus.lib
     xorg_sys_opengl
-    systemd
+    systemdLibs
     libcap.lib
     libdrm
     pulseaudio
diff --git a/pkgs/by-name/mi/microsoft-edge/package.nix b/pkgs/by-name/mi/microsoft-edge/package.nix
index 73481a602e34..7cfd8ec51171 100644
--- a/pkgs/by-name/mi/microsoft-edge/package.nix
+++ b/pkgs/by-name/mi/microsoft-edge/package.nix
@@ -56,7 +56,7 @@
   commandLineArgs ? "",
 
   # Will crash without.
-  systemd,
+  systemdLibs,
 
   # Loaded at runtime.
   libexif,
@@ -169,7 +169,7 @@ let
     pipewire
     snappy
     speechd-minimal
-    systemd
+    systemdLibs
     util-linux
     vulkan-loader
     wayland
diff --git a/pkgs/by-name/mo/mongodb-compass/package.nix b/pkgs/by-name/mo/mongodb-compass/package.nix
index 03b84e869b1a..5805255434a4 100644
--- a/pkgs/by-name/mo/mongodb-compass/package.nix
+++ b/pkgs/by-name/mo/mongodb-compass/package.nix
@@ -38,7 +38,7 @@
   libxkbcommon,
   libgbm,
   vulkan-loader,
-  systemd,
+  systemdLibs,
   libGL,
   krb5,
   fontconfig,
@@ -99,7 +99,7 @@ let
     nss
     pango
     stdenv.cc.cc
-    systemd
+    systemdLibs
     libx11
     libxscrnsaver
     libxcomposite
diff --git a/pkgs/by-name/ne/nemu/package.nix b/pkgs/by-name/ne/nemu/package.nix
index af1be5c21d61..d179cc9fd407 100644
--- a/pkgs/by-name/ne/nemu/package.nix
+++ b/pkgs/by-name/ne/nemu/package.nix
@@ -21,7 +21,7 @@
   socat,
   sqlite,
   stdenv,
-  systemd,
+  systemdLibs,
   tigervnc,
 }:
 
@@ -65,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
     qemu
     socat
     sqlite
-    systemd # for libudev
+    systemdLibs # for libudev
     tigervnc
   ];
 
diff --git a/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix b/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix
index cf9e5cbececd..45bbf6859007 100644
--- a/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix
+++ b/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix
@@ -24,7 +24,7 @@
   gtk3,
   libGL,
   libglvnd,
-  systemd,
+  systemdLibs,
   patchelf,
   undmg,
   makeWrapper,
@@ -110,7 +110,7 @@ let
     runtimeDependencies = [
       # Required to launch the application and proceed past the zygote_linux fork() process
       # Fixes `Zygote could not fork`
-      systemd
+      systemdLibs
 
       # Fixes input/output audio device selection
       libpulseaudio
diff --git a/pkgs/by-name/no/nordpass/package.nix b/pkgs/by-name/no/nordpass/package.nix
index 9c1f9e310da9..108de6ef1746 100644
--- a/pkgs/by-name/no/nordpass/package.nix
+++ b/pkgs/by-name/no/nordpass/package.nix
@@ -32,7 +32,7 @@
   libpng,
   libnotify,
   libgcrypt,
-  systemd,
+  systemdLibs,
   fontconfig,
   dbus,
   expat,
@@ -83,7 +83,7 @@ let
     nss_latest
     pango
     stdenv.cc.cc
-    systemd
+    systemdLibs
     libice
     libsm
     libx11
diff --git a/pkgs/by-name/nw/nwjs/package.nix b/pkgs/by-name/nw/nwjs/package.nix
index a1261e82f52a..848f22d8e041 100644
--- a/pkgs/by-name/nw/nwjs/package.nix
+++ b/pkgs/by-name/nw/nwjs/package.nix
@@ -46,7 +46,7 @@
   nss,
   pango,
   sqlite,
-  systemd,
+  systemdLibs,
   udev,
 
   # update script
@@ -160,7 +160,7 @@ stdenv.mkDerivation (finalAttrs: {
     cp -R * $out/share/nwjs
     find $out/share/nwjs
 
-    ln -s ${lib.getLib systemd}/lib/libudev.so $out/share/nwjs/libudev.so.0
+    ln -s ${lib.getLib systemdLibs}/lib/libudev.so $out/share/nwjs/libudev.so.0
 
     mkdir -p $out/bin
     ln -s $out/share/nwjs/nw $out/bin
diff --git a/pkgs/by-name/pe/pencil/package.nix b/pkgs/by-name/pe/pencil/package.nix
index b68c4797c766..0e315c1ab1c6 100644
--- a/pkgs/by-name/pe/pencil/package.nix
+++ b/pkgs/by-name/pe/pencil/package.nix
@@ -35,7 +35,7 @@
   libxcomposite,
   libx11,
   libxcb,
-  systemd,
+  systemdLibs,
 }:
 let
 
@@ -129,7 +129,7 @@ stdenv.mkDerivation (finalAttrs: {
         $out/opt/pencil/pencil
 
       # fix missing libudev
-      ln -s ${lib.getLib systemd}/lib/libudev.so.1 $out/opt/pencil/libudev.so.1
+      ln -s ${lib.getLib systemdLibs}/lib/libudev.so.1 $out/opt/pencil/libudev.so.1
       wrapProgram $out/opt/pencil/pencil \
         --prefix LD_LIBRARY_PATH : $out/opt/pencil
     '';
diff --git a/pkgs/by-name/pi/pineflash/package.nix b/pkgs/by-name/pi/pineflash/package.nix
index 59d5b32c7d23..fc71c1851129 100644
--- a/pkgs/by-name/pi/pineflash/package.nix
+++ b/pkgs/by-name/pi/pineflash/package.nix
@@ -11,7 +11,7 @@
   glib,
   gtk3,
   openssl,
-  systemd,
+  systemdLibs,
   imagemagick,
   libGL,
   libxkbcommon,
@@ -44,7 +44,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     glib
     gtk3
     openssl
-    systemd
+    systemdLibs
   ];
 
   runtimeDependencies = [
diff --git a/pkgs/by-name/pl/plasticity/package.nix b/pkgs/by-name/pl/plasticity/package.nix
index 8012b208add8..7a45c6ef7767 100644
--- a/pkgs/by-name/pl/plasticity/package.nix
+++ b/pkgs/by-name/pl/plasticity/package.nix
@@ -25,7 +25,7 @@
   pango,
   rpmextract,
   stdenv,
-  systemd,
+  systemdLibs,
   trash-cli,
   vulkan-loader,
   wrapGAppsHook3,
@@ -82,7 +82,7 @@ stdenv.mkDerivation rec {
   ];
 
   runtimeDependencies = [
-    systemd
+    systemdLibs
     libglvnd
     vulkan-loader # may help with nvidia users
     libx11
diff --git a/pkgs/by-name/po/positron-bin/package.nix b/pkgs/by-name/po/positron-bin/package.nix
index 1de17268cfc3..52bb3509aafe 100644
--- a/pkgs/by-name/po/positron-bin/package.nix
+++ b/pkgs/by-name/po/positron-bin/package.nix
@@ -2,7 +2,7 @@
   lib,
   _7zz,
   alsa-lib,
-  systemd,
+  systemdLibs,
   wrapGAppsHook4,
   autoPatchelfHook,
   blas,
@@ -95,7 +95,7 @@ stdenv.mkDerivation {
 
   runtimeDependencies = lib.optionals stdenv.hostPlatform.isLinux [
     # Needed to fix the "Zygote could not fork" error.
-    (lib.getLib systemd)
+    (lib.getLib systemdLibs)
   ];
 
   installPhase =
diff --git a/pkgs/by-name/pu/pulsar/package.nix b/pkgs/by-name/pu/pulsar/package.nix
index 63455c752aa4..3c890139c87e 100644
--- a/pkgs/by-name/pu/pulsar/package.nix
+++ b/pkgs/by-name/pu/pulsar/package.nix
@@ -35,7 +35,7 @@
   libsecret,
   libxkbcommon,
   pango,
-  systemd,
+  systemdLibs,
   hunspellDicts,
   useHunspell ? true,
   languages ? [ "en_US" ],
@@ -75,7 +75,7 @@ let
     libxkbfile
     pango
     stdenv.cc.cc
-    systemd
+    systemdLibs
   ];
 
   # Hunspell
diff --git a/pkgs/by-name/qq/qq/package.nix b/pkgs/by-name/qq/qq/package.nix
index a711590a247c..ff933c90fa6f 100644
--- a/pkgs/by-name/qq/qq/package.nix
+++ b/pkgs/by-name/qq/qq/package.nix
@@ -20,7 +20,7 @@
   libGL,
   nss,
   libxdamage,
-  systemd,
+  systemdLibs,
   runCommandLocal,
   stdenv,
   undmg,
@@ -147,7 +147,7 @@ else
     dontWrapGApps = true;
 
     runtimeDependencies = map lib.getLib [
-      systemd
+      systemdLibs
       libkrb5
     ];
 
diff --git a/pkgs/by-name/si/sidequest/package.nix b/pkgs/by-name/si/sidequest/package.nix
index 74d69551017b..6dd529821df3 100644
--- a/pkgs/by-name/si/sidequest/package.nix
+++ b/pkgs/by-name/si/sidequest/package.nix
@@ -31,7 +31,7 @@
   libxkbcommon,
   libxshmfence,
   pango,
-  systemd,
+  systemdLibs,
   icu,
   openssl,
   zlib,
@@ -112,7 +112,7 @@ let
             libxkbfile
             pango
             (lib.getLib stdenv.cc.cc)
-            systemd
+            systemdLibs
           ]
         }:$out/libexec/sidequest" \
         --add-needed libGL.so.1 \
diff --git a/pkgs/by-name/sp/spotify/linux.nix b/pkgs/by-name/sp/spotify/linux.nix
index 44906e981492..962e4a2569f7 100644
--- a/pkgs/by-name/sp/spotify/linux.nix
+++ b/pkgs/by-name/sp/spotify/linux.nix
@@ -35,7 +35,7 @@
   libpng,
   libnotify,
   libgcrypt,
-  systemd,
+  systemdLibs,
   fontconfig,
   dbus,
   expat,
@@ -100,7 +100,7 @@ let
     pango
     pciutils
     stdenv.cc.cc
-    systemd
+    systemdLibs
     libice
     libsm
     libx11
diff --git a/pkgs/by-name/st/staruml/package.nix b/pkgs/by-name/st/staruml/package.nix
index 5c6e99f2b7a1..6aaeae91adc4 100644
--- a/pkgs/by-name/st/staruml/package.nix
+++ b/pkgs/by-name/st/staruml/package.nix
@@ -7,7 +7,7 @@
   hicolor-icon-theme,
   gtk3,
   glib,
-  systemd,
+  systemdLibs,
   libxtst,
   libxrender,
   libxrandr,
@@ -71,7 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     mkdir -p $out/lib
     ln -s ${lib.getLib stdenv.cc.cc}/lib/libstdc++.so.6 $out/lib/
-    ln -s ${lib.getLib systemd}/lib/libudev.so.1 $out/lib/libudev.so.0
+    ln -s ${lib.getLib systemdLibs}/lib/libudev.so.1 $out/lib/libudev.so.0
 
     patchelf --interpreter ${bintools.dynamicLinker} --add-needed libGL.so.1 $out/opt/StarUML/staruml
 
diff --git a/pkgs/by-name/ti/ticktick/package.nix b/pkgs/by-name/ti/ticktick/package.nix
index 02c1ac8bf960..065855bcbfcf 100644
--- a/pkgs/by-name/ti/ticktick/package.nix
+++ b/pkgs/by-name/ti/ticktick/package.nix
@@ -12,7 +12,7 @@
   libgbm,
   alsa-lib,
   xdg-utils,
-  systemd,
+  systemdLibs,
 }:
 let
   baseUrl = "https://d2atcrkye2ik4e.cloudfront.net/download";
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   # Needed to make the process get past zygote_linux fork()'ing
-  runtimeDependencies = [ systemd ];
+  runtimeDependencies = [ systemdLibs ];
 
   unpackPhase = ''
     runHook preUnpack
diff --git a/pkgs/by-name/ti/tidal-hifi/package.nix b/pkgs/by-name/ti/tidal-hifi/package.nix
index 9c0c90ec1b17..8236582fcd07 100644
--- a/pkgs/by-name/ti/tidal-hifi/package.nix
+++ b/pkgs/by-name/ti/tidal-hifi/package.nix
@@ -35,7 +35,7 @@
   libxrandr,
   libxkbfile,
   pango,
-  systemd,
+  systemdLibs,
   pciutils,
   libnotify,
   pipewire,
@@ -76,7 +76,7 @@ let
     pango
     pciutils
     stdenv.cc.cc
-    systemd
+    systemdLibs
     libnotify
     pipewire
     libsecret
diff --git a/pkgs/by-name/tr/tradingview/package.nix b/pkgs/by-name/tr/tradingview/package.nix
index 723776a88bf0..d4762b5a66e0 100644
--- a/pkgs/by-name/tr/tradingview/package.nix
+++ b/pkgs/by-name/tr/tradingview/package.nix
@@ -17,7 +17,7 @@
   libGL,
   pango,
   sqlite,
-  systemd,
+  systemdLibs,
   wayland,
   libxext,
   libx11,
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
     libGL
     pango
     sqlite
-    systemd
+    systemdLibs
     wayland
     libxcb
     libx11
diff --git a/pkgs/by-name/up/upwork/package.nix b/pkgs/by-name/up/upwork/package.nix
index 1c2611612547..c7061e79a844 100644
--- a/pkgs/by-name/up/upwork/package.nix
+++ b/pkgs/by-name/up/upwork/package.nix
@@ -40,7 +40,7 @@
   nss,
   openssl,
   pango,
-  systemd,
+  systemdLibs,
 }:
 
 stdenv.mkDerivation rec {
@@ -61,7 +61,7 @@ stdenv.mkDerivation rec {
 
   buildInputs = [
     libcxx
-    systemd
+    systemdLibs
     libpulseaudio
     stdenv.cc.cc
     alsa-lib
@@ -96,7 +96,7 @@ stdenv.mkDerivation rec {
     nspr
     nss
     pango
-    systemd
+    systemdLibs
   ];
 
   libPath = lib.makeLibraryPath buildInputs;
diff --git a/pkgs/by-name/vi/vivaldi/package.nix b/pkgs/by-name/vi/vivaldi/package.nix
index 30a48e961149..4665e9a68a6d 100644
--- a/pkgs/by-name/vi/vivaldi/package.nix
+++ b/pkgs/by-name/vi/vivaldi/package.nix
@@ -23,7 +23,7 @@
   dbus,
   cups,
   libexif,
-  systemd,
+  systemdLibs,
   libva,
   libGL,
   freetype,
@@ -130,7 +130,7 @@ stdenv.mkDerivation rec {
     gtk3
     gdk-pixbuf
     libexif
-    systemd
+    systemdLibs
     libva
     qt6.qtbase
     qt6.qtwayland
diff --git a/pkgs/by-name/we/wechat-uos/package.nix b/pkgs/by-name/we/wechat-uos/package.nix
index f400ca0d0a1c..c5a559c5a567 100644
--- a/pkgs/by-name/we/wechat-uos/package.nix
+++ b/pkgs/by-name/we/wechat-uos/package.nix
@@ -51,7 +51,7 @@
   libexif,
   ffmpeg,
   pulseaudio,
-  systemd,
+  systemdLibs,
   libuuid,
   expat,
   bzip2,
@@ -133,7 +133,7 @@ let
     libdrm
     libgbm
     vulkan-loader
-    systemd
+    systemdLibs
     wayland
     pulseaudio
     qt6.qt5compat
diff --git a/pkgs/by-name/xm/xmind/package.nix b/pkgs/by-name/xm/xmind/package.nix
index c18c9bf0b28e..65a4d0ab6748 100644
--- a/pkgs/by-name/xm/xmind/package.nix
+++ b/pkgs/by-name/xm/xmind/package.nix
@@ -26,7 +26,7 @@
   libxkbfile,
   libxcb,
   libgbm,
-  systemd,
+  systemdLibs,
   libGL,
 }:
 
@@ -71,7 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   runtimeDependencies = map lib.getLib [
-    systemd
+    systemdLibs
   ];
 
   installPhase = ''

From 7749a2aa857da4e54baf8ecc4c23a28d68a26fb9 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sat, 10 Oct 2026 21:59:24 +0100
Subject: [PATCH 312/525] rust-analyzer-unwrapped: 2026-09-28 -> 2026-10-05

Changes: https://github.com/rust-lang/rust-analyzer/releases#release-2026-10-05
---
 pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix b/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
index fbf780d664c5..fc9617022d8d 100644
--- a/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
+++ b/pkgs/by-name/ru/rust-analyzer-unwrapped/package.nix
@@ -13,15 +13,15 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rust-analyzer-unwrapped";
-  version = "2026-09-28";
+  version = "2026-10-05";
 
-  cargoHash = "sha256-pCbofUTBCIRID5icso1SKdMNjO8Eowy2c/pVBJplaqY=";
+  cargoHash = "sha256-bkogttBcSy+X1Xeft6q9gD0C2yBne6ZWMq5zwvhGxvo=";
 
   src = fetchFromGitHub {
     owner = "rust-lang";
     repo = "rust-analyzer";
     rev = finalAttrs.version;
-    hash = "sha256-j8y/AO3AMDF9p+11aIDhnA21JnNj5PjvcejTI43vI8Q=";
+    hash = "sha256-KlPoiDKQ7xCoUAaxJzCYctw2acbtunTD3SFjO79MXzE=";
   };
 
   cargoBuildFlags = [

From c96d4ed3b1781b10b8afb70873e72d1a2f9dcf77 Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Sat, 10 Oct 2026 17:02:57 -0400
Subject: [PATCH 313/525] omp: 18.8.7 -> 18.8.9

Changelog: https://github.com/can1357/oh-my-pi/releases/tag/v18.8.9

Assisted-By: OpenAI Codex GPT-6 Luna in omp
---
 pkgs/by-name/om/omp/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/om/omp/package.nix b/pkgs/by-name/om/omp/package.nix
index 7ed1309ebf45..3e72f9333443 100644
--- a/pkgs/by-name/om/omp/package.nix
+++ b/pkgs/by-name/om/omp/package.nix
@@ -32,7 +32,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "omp";
-  version = "18.8.7";
+  version = "18.8.9";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -41,12 +41,12 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "can1357";
     repo = "oh-my-pi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nWuBvVNeJW9rgrSMhx5JP4CjFFJnfuMzjOlaGDCPVUU=";
+    hash = "sha256-t3OZP4E0mWFJU0RW3OMcGU2G52p5uasQdVPhITHnZec=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
-    hash = "sha256-wfGvns/9Supk3QUuVfchUy7talfwhJswbLd8LWoZMXU=";
+    hash = "sha256-fiKnCLgcEPZ+WtMD6oBNJfzXHW28y/NN7KOo9oIKMWE=";
   };
 
   postPatch = ''

From 7e39cb399c3c8e1631c76033f87ab8d2e113cc1f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 10 Oct 2026 21:04:52 +0000
Subject: [PATCH 314/525] egl-wayland: 1.1.23 -> 1.1.24

---
 pkgs/by-name/eg/egl-wayland/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/eg/egl-wayland/package.nix b/pkgs/by-name/eg/egl-wayland/package.nix
index ea05058a1bec..99d1cfc81c3e 100644
--- a/pkgs/by-name/eg/egl-wayland/package.nix
+++ b/pkgs/by-name/eg/egl-wayland/package.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "egl-wayland";
-  version = "1.1.23";
+  version = "1.1.24";
 
   outputs = [
     "out"
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "NVIDIA";
     repo = "egl-wayland";
     tag = finalAttrs.version;
-    hash = "sha256-M+s2R0vSDCEN9lMma6RiJTqzUgClnszwS4aKBJeBvFQ=";
+    hash = "sha256-FoDxYIFhjatrt+q1S24ZP6inFAvF4nNxfOb3MqAxr9M=";
   };
 
   postPatch = ''

From cf3bc0075ab2defad6ee0a71574c9c14b38e5ccd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 10 Oct 2026 21:08:28 +0000
Subject: [PATCH 315/525] python3Packages.apycula: 0.33 -> 0.34

---
 pkgs/development/python-modules/apycula/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/apycula/default.nix b/pkgs/development/python-modules/apycula/default.nix
index fda52ff2746b..653cfad7e7c0 100644
--- a/pkgs/development/python-modules/apycula/default.nix
+++ b/pkgs/development/python-modules/apycula/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "apycula";
-  version = "0.33";
+  version = "0.34";
   pyproject = true;
 
   # The Pypi archive contains necessary files generated with proprietary tools.
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-njVvWr8sH2UABEDxvTSDXBuTgaZNIHfphwiHB14IbhY=";
+    hash = "sha256-sLFRh1vlKJ66OF1Mb6YtGzvkkobfcPB+B2ra+RZ4siw=";
   };
 
   build-system = [ setuptools-scm ];

From 430495a1ba878fe7a508562a5c9f0c6ecd224417 Mon Sep 17 00:00:00 2001
From: Grayson Tinker <graysontinker@gmail.com>
Date: Sat, 10 Oct 2026 15:08:36 -0600
Subject: [PATCH 316/525] doc: don't specify version of XDG desktop spec

---
 doc/build-helpers/trivial-build-helpers.chapter.md | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/doc/build-helpers/trivial-build-helpers.chapter.md b/doc/build-helpers/trivial-build-helpers.chapter.md
index 590cd691c019..6bf75c8be1b2 100644
--- a/doc/build-helpers/trivial-build-helpers.chapter.md
+++ b/doc/build-helpers/trivial-build-helpers.chapter.md
@@ -225,15 +225,13 @@ writeShellScript "evaluate-my-file.sh" ''
 
 ### `makeDesktopItem` {#trivial-builder-makeDesktopItem}
 
-Write an [XDG desktop file](https://specifications.freedesktop.org/desktop-entry-spec/1.4/) to the Nix store.
+Write an [XDG desktop file](https://specifications.freedesktop.org/desktop-entry-spec/latest) to the Nix store.
 
 This function is usually used to add desktop items to a package through the `copyDesktopItems` hook.
 
-`makeDesktopItem` adheres to version 1.4 of the specification.
-
 #### Inputs {#trivial-builder-makeDesktopItem-inputs}
 
-`makeDesktopItem` takes an attribute set that accepts most values from the [XDG specification](https://specifications.freedesktop.org/desktop-entry-spec/1.4/ar01s06.html).
+`makeDesktopItem` takes an attribute set that accepts most values from the [XDG specification](https://specifications.freedesktop.org/desktop-entry-spec/latest/ar01s06.html).
 
 All recognised keys from the specification are supported with the exception of the "Hidden" field. The keys are converted into camelCase format, but correspond 1:1 to their equivalent in the specification: `genericName`, `noDisplay`, `comment`, `icon`, `onlyShowIn`, `notShowIn`, `dbusActivatable`, `tryExec`, `exec`, `path`, `terminal`, `mimeTypes`, `categories`, `implements`, `keywords`, `startupNotify`, `startupWMClass`, `url`, `prefersNonDefaultGPU`.
 

From a3de62692de023d9eb262b5f14bd2727f1d31ba6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 9 Oct 2026 18:21:00 -0700
Subject: [PATCH 317/525] nixos/forgejo: make sshd pass GIT_PROTOCOL only to
 forgejo user

---
 nixos/modules/services/misc/forgejo.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/services/misc/forgejo.nix b/nixos/modules/services/misc/forgejo.nix
index 5ed68d6df619..a1d01f8db214 100644
--- a/nixos/modules/services/misc/forgejo.nix
+++ b/nixos/modules/services/misc/forgejo.nix
@@ -801,9 +801,11 @@ in
       // lib.listToAttrs (map (e: lib.nameValuePair e.env "%d/${e.env}") secrets);
     };
 
-    services.openssh.settings.AcceptEnv = mkIf (!cfg.settings.server.START_SSH_SERVER or false) [
-      "GIT_PROTOCOL"
-    ];
+    services.openssh.extraConfig = mkIf (!cfg.settings.server.START_SSH_SERVER or false) ''
+      Match User ${cfg.user}
+        AcceptEnv GIT_PROTOCOL
+      Match All
+    '';
 
     users.users = mkIf (cfg.user == "forgejo") {
       forgejo = {

From b3448e44e8c44c4925e1348bc7f9d6f99de60726 Mon Sep 17 00:00:00 2001
From: Dan Xin <davinci42.cn@gmail.com>
Date: Sun, 11 Oct 2026 05:18:03 +0800
Subject: [PATCH 318/525] crush: 0.96.1 -> 0.98.1

Diff: https://github.com/charmbracelet/crush/compare/v0.96.1...v0.98.1

Changelog: https://github.com/charmbracelet/crush/releases/tag/v0.98.1
---
 pkgs/by-name/cr/crush/package.nix | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/cr/crush/package.nix b/pkgs/by-name/cr/crush/package.nix
index 5090923c65d3..67911d5e46d3 100644
--- a/pkgs/by-name/cr/crush/package.nix
+++ b/pkgs/by-name/cr/crush/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   buildGo127Module,
   fetchFromGitHub,
+  git,
   installShellFiles,
   nix-update-script,
   writableTmpDirAsHomeHook,
@@ -11,16 +12,16 @@
 
 buildGo127Module (finalAttrs: {
   pname = "crush";
-  version = "0.96.1";
+  version = "0.98.1";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = "crush";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iaZ0rw9585iLVj+HSWCiQnaj2XZ+eYr6zprpUs/47z0=";
+    hash = "sha256-sz/jlpWH43pgUqKDzaRVKJPK2u7smJLoL2eNrGkXtOY=";
   };
 
-  vendorHash = "sha256-ADDHgngAChNch8Sp6Zltw52eSlk7swEQG+R4fCxDbY8=";
+  vendorHash = "sha256-yEV/cBQ2XsmbsYrSWiyEj/dznzSVrpY9QHXMpuw2lpc=";
 
   ldflags = [
     "-s"
@@ -46,7 +47,10 @@ buildGo127Module (finalAttrs: {
 
   __darwinAllowLocalNetworking = true;
 
-  nativeCheckInputs = [ writableTmpDirAsHomeHook ];
+  nativeCheckInputs = [
+    git
+    writableTmpDirAsHomeHook
+  ];
 
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;

From bcac77d986f84373a9a5115a940803f1b23b68c0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 9 Oct 2026 07:01:05 +0000
Subject: [PATCH 319/525] python3Packages.aiounifi: 96 -> 97

---
 pkgs/development/python-modules/aiounifi/default.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aiounifi/default.nix b/pkgs/development/python-modules/aiounifi/default.nix
index cef82ef59f3b..2407b091051d 100644
--- a/pkgs/development/python-modules/aiounifi/default.nix
+++ b/pkgs/development/python-modules/aiounifi/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "aiounifi";
-  version = "96";
+  version = "97";
   pyproject = true;
 
   disabled = pythonOlder "3.13";
@@ -27,7 +27,7 @@ buildPythonPackage (finalAttrs: {
     owner = "Kane610";
     repo = "aiounifi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tDob4Hq78tfVoOZ89cdjmTW34Of0r6Y9c9GtFSCKXqw=";
+    hash = "sha256-dOY+Tps7l/9TybTOzff4DpaA1BvSMYAXDMCySDtX038=";
   };
 
   postPatch = ''
@@ -54,6 +54,8 @@ buildPythonPackage (finalAttrs: {
     trustme
   ];
 
+  __darwinAllowLocalNetworking = true;
+
   pythonImportsCheck = [ "aiounifi" ];
 
   meta = {

From df446607484f21c593bc845463fcd0fe819fd3af Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 10 Oct 2026 22:07:49 +0000
Subject: [PATCH 320/525] _3proxy: 1.0.0 -> 1.0.1

---
 pkgs/by-name/_3/_3proxy/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/_3/_3proxy/package.nix b/pkgs/by-name/_3/_3proxy/package.nix
index daf6746a2fc2..85a86b6a10e5 100644
--- a/pkgs/by-name/_3/_3proxy/package.nix
+++ b/pkgs/by-name/_3/_3proxy/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "3proxy";
-  version = "1.0.0";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "3proxy";
     repo = "3proxy";
     tag = finalAttrs.version;
-    sha256 = "sha256-JRoSCmoTIXHsUWZt9OyDVp1Veuy2w1ZPFe0rUGdJv0k=";
+    sha256 = "sha256-hLxafFU6nJ3I3NT3R24LPD7PBmQ1IZEbrVqvfmMZHIM=";
   };
 
   # They use 'install -s', that calls the native strip instead of the cross.

From 3becfec0e41273549bfd3c0cc70b195d91f44370 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 10 Oct 2026 22:12:34 +0000
Subject: [PATCH 321/525] alistral: 0.6.9 -> 0.6.10

---
 pkgs/by-name/al/alistral/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/al/alistral/package.nix b/pkgs/by-name/al/alistral/package.nix
index 0ac3f3e8e833..b159d738ad8d 100644
--- a/pkgs/by-name/al/alistral/package.nix
+++ b/pkgs/by-name/al/alistral/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "alistral";
-  version = "0.6.9";
+  version = "0.6.10";
 
   src = fetchFromGitHub {
     owner = "RustyNova016";
     repo = "Alistral";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tujuv6+V7n8uthV+3yc2aqZydgMRJDlunWi1ITofl14=";
+    hash = "sha256-G/DC2JtdnElm1iQf2TLWroej8eNsRAb9ZoeDYrEMdJg=";
   };
 
-  cargoHash = "sha256-kzrWhE2S6XXU6wLDfYp76kMRnk3juxXWX4EdL3NjgSo=";
+  cargoHash = "sha256-77NF6t1WMHi7wtbJf1NjyYoj4amXh69/AJvFT/aEsQY=";
 
   buildNoDefaultFeatures = true;
   # Would be cleaner with an "--all-features" option

From 2d73c8054ef9107628e3bdbc15916fa6a198d705 Mon Sep 17 00:00:00 2001
From: Dmitry Bogatov <kaction.cc@gmail.com>
Date: Sat, 10 Oct 2026 18:36:57 +0000
Subject: [PATCH 322/525] snooze: enable strictDeps and structuredAttrs

---
 pkgs/by-name/sn/snooze/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/sn/snooze/package.nix b/pkgs/by-name/sn/snooze/package.nix
index 179c146f6712..64cc45a97fbd 100644
--- a/pkgs/by-name/sn/snooze/package.nix
+++ b/pkgs/by-name/sn/snooze/package.nix
@@ -6,6 +6,10 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "snooze";
   version = "0.6";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "leahneukirchen";
     repo = "snooze";

From ee6c1a4d790a5ddb5848b970697a86cbaf26ad86 Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Sun, 4 Oct 2026 05:55:07 +0200
Subject: [PATCH 323/525] grsync: drop libunity dependency

Drop libunity dependency, together with some related build inputs that are
no longer required when not providing libunity.
libunity can be considered obsolete, and removing the dependency should not
negatively impact users.
---
 pkgs/by-name/gr/grsync/package.nix | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/pkgs/by-name/gr/grsync/package.nix b/pkgs/by-name/gr/grsync/package.nix
index 514a194af9f7..20915e37a877 100644
--- a/pkgs/by-name/gr/grsync/package.nix
+++ b/pkgs/by-name/gr/grsync/package.nix
@@ -2,11 +2,8 @@
   lib,
   stdenv,
   fetchurl,
-  dee,
   gtk3,
   intltool,
-  libdbusmenu-gtk3,
-  libunity,
   pkg-config,
   rsync,
   wrapGAppsHook3,
@@ -28,10 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    dee
     gtk3
-    libdbusmenu-gtk3
-    libunity
     rsync
   ];
 

From 3a11951149125984656e0fab1b2e83aa28f2644b Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Sun, 4 Oct 2026 05:55:30 +0200
Subject: [PATCH 324/525] grsync: remove rsync from buildInputs

rsync is not used by grsync at build time.
---
 pkgs/by-name/gr/grsync/package.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/by-name/gr/grsync/package.nix b/pkgs/by-name/gr/grsync/package.nix
index 20915e37a877..0435423cafe7 100644
--- a/pkgs/by-name/gr/grsync/package.nix
+++ b/pkgs/by-name/gr/grsync/package.nix
@@ -5,7 +5,6 @@
   gtk3,
   intltool,
   pkg-config,
-  rsync,
   wrapGAppsHook3,
 }:
 
@@ -26,7 +25,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   buildInputs = [
     gtk3
-    rsync
   ];
 
   meta = {

From 2a0f88b2587b9dd937495b7baa130e832de63b3b Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Sun, 4 Oct 2026 05:56:52 +0200
Subject: [PATCH 325/525] discord: drop libunity dependency

libunity used to be used for notification features until Electron 44.
See https://github.com/electron/electron/pull/51649 for the upstream removal PR.
---
 pkgs/by-name/di/discord/linux.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/by-name/di/discord/linux.nix b/pkgs/by-name/di/discord/linux.nix
index 3f9782c147e2..1c6fbbe47a68 100644
--- a/pkgs/by-name/di/discord/linux.nix
+++ b/pkgs/by-name/di/discord/linux.nix
@@ -65,7 +65,6 @@
   libglvnd,
   libnotify,
   libxcomposite,
-  libunity,
   libva,
   libxcursor,
   libxext,
@@ -117,7 +116,6 @@ let
         libnotify
         libx11
         libxcomposite
-        libunity
         libuuid
         libva
         libxcursor

From fc72db288449e6551dc930b3e335369411211733 Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Sun, 4 Oct 2026 06:03:28 +0200
Subject: [PATCH 326/525] libunity: drop

---
 pkgs/by-name/li/libunity/fix-vala.patch | 12 ----
 pkgs/by-name/li/libunity/package.nix    | 75 -------------------------
 pkgs/top-level/aliases.nix              |  1 +
 3 files changed, 1 insertion(+), 87 deletions(-)
 delete mode 100644 pkgs/by-name/li/libunity/fix-vala.patch
 delete mode 100644 pkgs/by-name/li/libunity/package.nix

diff --git a/pkgs/by-name/li/libunity/fix-vala.patch b/pkgs/by-name/li/libunity/fix-vala.patch
deleted file mode 100644
index 555c2ad7bcb0..000000000000
--- a/pkgs/by-name/li/libunity/fix-vala.patch
+++ /dev/null
@@ -1,12 +0,0 @@
---- a/protocol/protocol-icon.vala	2013-08-27 12:53:57 +0000
-+++ b/protocol/protocol-icon.vala	2021-04-13 22:34:41 +0000
-@@ -185,7 +185,7 @@
-   }
- 
-   /* Added to GIcon interface in 2.37 */
--  private Variant serialize ()
-+  private Variant? serialize ()
-   {
-     Variant? ret = null;
-     return ret;
-
diff --git a/pkgs/by-name/li/libunity/package.nix b/pkgs/by-name/li/libunity/package.nix
deleted file mode 100644
index 2aa39b5e3ba1..000000000000
--- a/pkgs/by-name/li/libunity/package.nix
+++ /dev/null
@@ -1,75 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchgit,
-  pkg-config,
-  glib,
-  vala,
-  dee,
-  gobject-introspection,
-  libdbusmenu,
-  gtk3,
-  intltool,
-  python3,
-  autoreconfHook,
-}:
-
-stdenv.mkDerivation {
-  pname = "libunity";
-  version = "7.1.4-unstable-2021-02-01";
-
-  outputs = [
-    "out"
-    "dev"
-    "py"
-  ];
-
-  # Obtained from https://git.launchpad.net/ubuntu/+source/libunity/log/
-  src = fetchgit {
-    url = "https://git.launchpad.net/ubuntu/+source/libunity";
-    rev = "import/7.1.4+19.04.20190319-5";
-    sha256 = "LHUs6kl1srS6Xektx+jmm4SXLR47VuQ9IhYbBxf2Wc8=";
-  };
-
-  patches = [
-    # Fix builf with latest Vala
-    # https://code.launchpad.net/~jtojnar/libunity/libunity
-    # Did not send upstream because Ubuntu is stuck on Vala 0.48.
-    ./fix-vala.patch
-  ];
-
-  nativeBuildInputs = [
-    autoreconfHook
-    gobject-introspection
-    intltool
-    pkg-config
-    python3
-    vala
-  ];
-
-  buildInputs = [
-    glib
-    gtk3
-  ];
-
-  propagatedBuildInputs = [
-    dee
-    libdbusmenu
-  ];
-
-  preConfigure = ''
-    intltoolize
-  '';
-
-  configureFlags = [
-    "--with-pygi-overrides-dir=${placeholder "py"}/${python3.sitePackages}/gi/overrides"
-  ];
-
-  meta = {
-    description = "Library for instrumenting and integrating with all aspects of the Unity shell";
-    homepage = "https://launchpad.net/libunity";
-    license = lib.licenses.lgpl3;
-    platforms = lib.platforms.linux;
-    maintainers = [ ];
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index c26d8f45c984..31ee3e204499 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1459,6 +1459,7 @@ mapAliases {
   libubox-wolfssl = throw "'libubox-wolfssl' has been removed, use 'libubox' or 'libubox-mbedtls'"; # Added 2026-03-29
   libuinputplus = throw "'libuinputplus' has been removed, as it was unmaintained upstream since 2021, no longer builds, and is no longer used by anything"; # Added 2025-11-02
   libunique = throw "'libunique' has been removed, as it depended on the deprecated GTK2 engine."; # Added 2026-08-11
+  libunity = throw "'libunity' has been removed as it is no longer required and is unmaintained"; # Added 2026-10-04
   libva1 = throw "'libva1' has been removed, as it is no longer required. Please use libva."; # Added 2026-05-14
   libva1-minimal = throw "'libva1-minimal' has been removed, as it is no longer required. Please use libva-minimal."; # Added 2026-05-14
   libviper = throw "'libviper' was removed as it is broken and not maintained upstream"; # Added 2025-05-17

From 4110ceed55d6e1ed1b0a65d78e5bfef2fe426727 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 10 Oct 2026 23:49:13 +0000
Subject: [PATCH 327/525] python3Packages.sendspin: 7.5.0 -> 7.6.0

---
 pkgs/development/python-modules/sendspin/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/sendspin/default.nix b/pkgs/development/python-modules/sendspin/default.nix
index 4ef44584596a..3e5bd1c9470c 100644
--- a/pkgs/development/python-modules/sendspin/default.nix
+++ b/pkgs/development/python-modules/sendspin/default.nix
@@ -21,14 +21,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "sendspin";
-  version = "7.5.0";
+  version = "7.6.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Sendspin";
     repo = "sendspin-cli";
     tag = finalAttrs.version;
-    hash = "sha256-Oux9hEtN5AiPf3gAqXGVinDfDIuNVugchUNuLMfMoYc=";
+    hash = "sha256-unNlx0A5Jh3mkPp4G86DY41UExA5IEwMM8E0/jfaBkY=";
   };
 
   nativeBuildInputs = [

From 710c6b402b936887fcd9889ee88d97f614db228d Mon Sep 17 00:00:00 2001
From: Dan Callaghan <djc@djc.id.au>
Date: Sun, 11 Oct 2026 11:25:23 +1100
Subject: [PATCH 328/525] python3Packages.axisregistry: point at Github release
 changelogs

Upstream removed CHANGELOG.md in:
https://github.com/googlefonts/axisregistry/commit/cf69ce2ccf
They are publishing changelogs on the Github releases instead.

Relates to #514132.
---
 pkgs/development/python-modules/axisregistry/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/axisregistry/default.nix b/pkgs/development/python-modules/axisregistry/default.nix
index fb955db78325..823d92eded58 100644
--- a/pkgs/development/python-modules/axisregistry/default.nix
+++ b/pkgs/development/python-modules/axisregistry/default.nix
@@ -42,7 +42,7 @@ buildPythonPackage rec {
   meta = {
     description = "Google Fonts registry of OpenType variation axis tags";
     homepage = "https://github.com/googlefonts/axisregistry";
-    changelog = "https://github.com/googlefonts/axisregistry/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/googlefonts/axisregistry/releases/tag/v${version}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       danc86

From f8a5dde82e44dc7e4ae1952c978bafb4dd2b62fc Mon Sep 17 00:00:00 2001
From: en <54501296+2hexed@users.noreply.github.com>
Date: Sat, 26 Sep 2026 16:19:06 +0530
Subject: [PATCH 329/525] services/hylafax: Refine option descriptions

---
 .../services/networking/hylafax/options.nix   | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/nixos/modules/services/networking/hylafax/options.nix b/nixos/modules/services/networking/hylafax/options.nix
index ec7adf5af49f..862ce4b63f0a 100644
--- a/nixos/modules/services/networking/hylafax/options.nix
+++ b/nixos/modules/services/networking/hylafax/options.nix
@@ -199,13 +199,15 @@ in
       type = path;
       default = "/etc/hosts.hfaxd";
       description = ''
-        The {file}`hosts.hfaxd`
-        file entry in the spooling area
+        The {file}`hosts.hfaxd` file entry in the spooling area
         will be symlinked to the location given here.
-        This file must exist and be
-        readable only by the `uucp` user.
+        This file must exist and be readable only by the `uucp` user.
         See {manpage}`hosts.hfaxd(5)` for details.
-        This configuration permits access for all users:
+        The example shown below permits access for all users.
+        Note that host-based access can be controlled with
+        {option}`config.systemd.sockets.hylafax-hfaxd.listenStreams`;
+        by default, only `127.0.0.1` is permitted to connect.
+
         ```
           environment.etc."hosts.hfaxd" = {
             mode = "0600";
@@ -213,9 +215,6 @@ in
             text = ".*";
           };
         ```
-        Note that host-based access can be controlled with
-        {option}`config.systemd.sockets.hylafax-hfaxd.listenStreams`;
-        by default, only 127.0.0.1 is permitted to connect.
       '';
     };
 
@@ -306,7 +305,7 @@ in
       default = null;
       example = "daily";
       description = ''
-        purging old files from the spooling area with
+        Purges old files from the spooling area with
         {file}`faxcron` with the given frequency
         (see {manpage}`systemd.time(7)`)
       '';
@@ -346,7 +345,7 @@ in
       default = null;
       example = "daily";
       description = ''
-        Purge old files from the spooling area with
+        Purges old files from the spooling area with
         {file}`faxcron` with the given frequency
         (see {manpage}`systemd.time(7)`).
       '';

From 24a5c96adbfa4d940bf3ae0f942327c84ade8c44 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 00:31:23 +0000
Subject: [PATCH 330/525] cdncheck: 1.3.1 -> 1.3.2

---
 pkgs/by-name/cd/cdncheck/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/cd/cdncheck/package.nix b/pkgs/by-name/cd/cdncheck/package.nix
index 9186aa7d00f6..4205ccfd54fb 100644
--- a/pkgs/by-name/cd/cdncheck/package.nix
+++ b/pkgs/by-name/cd/cdncheck/package.nix
@@ -8,7 +8,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "cdncheck";
-  version = "1.3.1";
+  version = "1.3.2";
 
   __structuredAttrs = true;
 
@@ -16,7 +16,7 @@ buildGoModule (finalAttrs: {
     owner = "projectdiscovery";
     repo = "cdncheck";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lM+sw5AhM5gkrvcLqOZXwcKEtS3UBQYMmM5pPSS4xxQ=";
+    hash = "sha256-QBggYJ8DOTi1mLJZCv2sQ9BeZHPQ1clj9zTb9Abu/Fw=";
   };
 
   vendorHash = "sha256-TYCYAKhytk249YJkRrgFrH8RWl0yrxr5z0dNONKBufU=";

From 574bcfa4be2e2dc6ab433ee70050ba7b75e66ad4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Mon, 28 Sep 2026 01:35:41 +0200
Subject: [PATCH 331/525] python3Packages.firecrawl-anydoc: init at 0.2.4

---
 .../firecrawl-anydoc/default.nix              | 60 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 62 insertions(+)
 create mode 100644 pkgs/development/python-modules/firecrawl-anydoc/default.nix

diff --git a/pkgs/development/python-modules/firecrawl-anydoc/default.nix b/pkgs/development/python-modules/firecrawl-anydoc/default.nix
new file mode 100644
index 000000000000..165df6bfd403
--- /dev/null
+++ b/pkgs/development/python-modules/firecrawl-anydoc/default.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  rustPlatform,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "firecrawl-anydoc";
+  version = "0.2.4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "firecrawl";
+    repo = "anydoc";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-rGv3Bh+zmF9xFUgf8RaSmfyB/gfuQ13iC389i6VZIlM=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/python";
+
+  nativeBuildInputs = with rustPlatform; [
+    cargoSetupHook
+    maturinBuildHook
+  ];
+
+  # The workspace root is outside of `sourceRoot`, hence not writable
+  env.CARGO_TARGET_DIR = "./target";
+
+  cargoRoot = "..";
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      cargoRoot
+      sourceRoot
+      ;
+    hash = "sha256-yhW5HSzVrZCms4x36J2NGIn1e5YLIgjuNKXM9EJ9J8c=";
+  };
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  preCheck = ''
+    rm -r anydoc/
+  '';
+
+  __darwinAllowLocalNetworking = true;
+
+  meta = {
+    description = "Convert documents (doc, docx, odt, rtf, epub, pdf, presentations, spreadsheets, csv) to GitHub-Flavored Markdown";
+    changelog = "https://github.com/firecrawl/anydoc/releases/tag/${finalAttrs.src.tag}";
+    homepage = "https://github.com/firecrawl/anydoc";
+    maintainers = with lib.maintainers; [ SuperSandro2000 ];
+    license = lib.licenses.mit;
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 0bab3400bde4..70e20f55b698 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -6135,6 +6135,8 @@ self: super: with self; {
 
   firebase-messaging = callPackage ../development/python-modules/firebase-messaging { };
 
+  firecrawl-anydoc = callPackage ../development/python-modules/firecrawl-anydoc { };
+
   firecrawl-py = callPackage ../development/python-modules/firecrawl-py { };
 
   firedrake = callPackage ../development/python-modules/firedrake { };

From be0c5d5af2b53d4e26795cb16205248a2a806b18 Mon Sep 17 00:00:00 2001
From: dmfrpro <dmfr2021y@gmail.com>
Date: Sun, 11 Oct 2026 03:51:53 +0300
Subject: [PATCH 332/525] mtkclient: fix icon

---
 pkgs/by-name/mt/mtkclient/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/mt/mtkclient/package.nix b/pkgs/by-name/mt/mtkclient/package.nix
index e6e67a53a8eb..6f272686c00f 100644
--- a/pkgs/by-name/mt/mtkclient/package.nix
+++ b/pkgs/by-name/mt/mtkclient/package.nix
@@ -52,6 +52,11 @@ python3Packages.buildPythonApplication rec {
   #       systemd 258 or newer and 51-edl.rules only applies to Qualcomm (i.e. not MTK).
   postInstall = ''
     install -Dm444 Setup/Linux/52-mtk.rules -t $out/lib/udev/rules.d
+
+    for size in 32 64 256 512; do
+      install -Dm444 mtkclient/gui/images/logo_$size.png \
+        $out/share/icons/hicolor/''${size}x''${size}/apps/mtkclient.png
+    done
   '';
 
   desktopItems = [
@@ -60,6 +65,7 @@ python3Packages.buildPythonApplication rec {
       desktopName = "MTKClient";
       comment = "Mediatek Flash and Repair Utility";
       exec = "mtk_gui";
+      icon = "mtkclient";
       categories = [
         "Development"
       ];

From faa3035c3bc7026c288adce1e8dd1969c51045a0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 00:54:06 +0000
Subject: [PATCH 333/525] sshp: 1.1.4 -> 1.1.5

---
 pkgs/by-name/ss/sshp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ss/sshp/package.nix b/pkgs/by-name/ss/sshp/package.nix
index d0e0fea6110b..a8876d82272d 100644
--- a/pkgs/by-name/ss/sshp/package.nix
+++ b/pkgs/by-name/ss/sshp/package.nix
@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sshp";
-  version = "1.1.4";
+  version = "1.1.5";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "bahamas10";
     repo = "sshp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4DrNGQQ1ETKuLiB3N+3KnRxx4BEhrCOgskpowbF/KWc=";
+    hash = "sha256-5sVXBqu/bqBCf7FjT7WxirrVG8XX9461jNdpNY31RXQ=";
   };
 
   outputs = [

From e3098c600c175379cc72416ea18862ebc78e25ac Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Sun, 11 Oct 2026 09:51:53 +0800
Subject: [PATCH 334/525] pantheon.elementary-files: 7.3.2 -> 7.3.3

https://github.com/elementary/files/compare/7.3.2...7.3.3
---
 pkgs/desktops/pantheon/apps/elementary-files/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/desktops/pantheon/apps/elementary-files/default.nix b/pkgs/desktops/pantheon/apps/elementary-files/default.nix
index 57a7c71d414d..96cd136a3506 100644
--- a/pkgs/desktops/pantheon/apps/elementary-files/default.nix
+++ b/pkgs/desktops/pantheon/apps/elementary-files/default.nix
@@ -27,7 +27,7 @@
 
 stdenv.mkDerivation rec {
   pname = "elementary-files";
-  version = "7.3.2";
+  version = "7.3.3";
 
   outputs = [
     "out"
@@ -38,7 +38,7 @@ stdenv.mkDerivation rec {
     owner = "elementary";
     repo = "files";
     rev = version;
-    hash = "sha256-DFW2C9Uoa9RIqP7DoskEK0X0RQxb0nYe85xsgogOaKs=";
+    hash = "sha256-Na5aiIgdAogSRwysz4v6U47tphVYVWleJ6OokXT+HMw=";
   };
 
   nativeBuildInputs = [

From 461ae7c41b10fd6ebf5935218668770fda14aee5 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Sun, 11 Oct 2026 09:54:20 +0800
Subject: [PATCH 335/525] pantheon.gala: 8.6.1 -> 8.6.2

https://github.com/elementary/gala/compare/8.6.1...8.6.2
---
 pkgs/desktops/pantheon/desktop/gala/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/desktops/pantheon/desktop/gala/default.nix b/pkgs/desktops/pantheon/desktop/gala/default.nix
index c63880cf5d01..bba228b8b64e 100644
--- a/pkgs/desktops/pantheon/desktop/gala/default.nix
+++ b/pkgs/desktops/pantheon/desktop/gala/default.nix
@@ -30,13 +30,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gala";
-  version = "8.6.1";
+  version = "8.6.2";
 
   src = fetchFromGitHub {
     owner = "elementary";
     repo = "gala";
     tag = finalAttrs.version;
-    hash = "sha256-q2GoJSa/ECn54UM0t8Z86bdTVea6XAflotkMoEOXK0Q=";
+    hash = "sha256-M3EqQS7xJbNryQ2emJdhOZfm1l2iO6qmG0X/6cRwpN4=";
   };
 
   depsBuildBuild = [ pkg-config ];

From 2e5e4d11be15709e2961553cbfb77da58116a4c3 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Sun, 11 Oct 2026 09:59:42 +0800
Subject: [PATCH 336/525] nixos/pantheon: Replace evince with papers

https://github.com/elementary/evince/commit/ce545eb13010ec29ce2851695d134ea687df45ed
---
 nixos/modules/services/desktop-managers/pantheon.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/nixos/modules/services/desktop-managers/pantheon.nix b/nixos/modules/services/desktop-managers/pantheon.nix
index 9ff9d1a02539..2f91d8796110 100644
--- a/nixos/modules/services/desktop-managers/pantheon.nix
+++ b/nixos/modules/services/desktop-managers/pantheon.nix
@@ -324,12 +324,11 @@ in
     })
 
     (mkIf serviceCfg.apps.enable {
-      programs.evince.enable = mkDefault (notExcluded pkgs.evince);
-
       environment.systemPackages = utils.removePackagesByName (
         [
           pkgs.gnome-font-viewer
           pkgs.file-roller
+          pkgs.papers
         ]
         ++ (
           with pkgs.pantheon;

From 295cc5144680f18cd20239ae3127db3a3dc16168 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 02:10:02 +0000
Subject: [PATCH 337/525] terraform-providers.rootlyhq_rootly: 5.23.0 -> 5.23.3

---
 .../networking/cluster/terraform-providers/providers.json     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index bdf3d4544709..b3a46a539c2c 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1148,11 +1148,11 @@
     "vendorHash": "sha256-6M6jTrukO0VhyZRdYbbICm22upbGyOkUSuHqMLTPcEM="
   },
   "rootlyhq_rootly": {
-    "hash": "sha256-sWCG6mD7fYi2Yon5Wu/54+m+T8KcUYd38yDt8M3LS+E=",
+    "hash": "sha256-lkMgGYayDMrhqmbwLysqoQ8L7mUvXoT4xDZ9ltxnSy8=",
     "homepage": "https://registry.terraform.io/providers/rootlyhq/rootly",
     "owner": "rootlyhq",
     "repo": "terraform-provider-rootly",
-    "rev": "v5.23.0",
+    "rev": "v5.23.3",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-Lusa+8VL8wQGIHYMiuiNTy4tqza4zO1A4ROpZ7X42KM="
   },

From 00cc1f9df5e7599bad5d459d3e500e779eff1195 Mon Sep 17 00:00:00 2001
From: novalkun <novalkun@gmail.com>
Date: Sun, 11 Oct 2026 09:11:42 +0700
Subject: [PATCH 338/525] opencode: 1.18.35 -> 1.19.0

---
 pkgs/by-name/op/opencode/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix
index b099934384b2..4c093283769c 100644
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -77,14 +77,14 @@ let
       # NOTE: Required else we get errors that our fixed-output derivation references store paths
       dontFixup = true;
 
-      outputHash = "sha256-cQLuGI8MBh9l8GisM2k5WXBcZrsdgrNsXUOsYzZVwYY=";
+      outputHash = "sha256-RLHrfyBM6fMglKyEkdkW+Mmfzzr6q/U7R38goaQcIhA=";
       outputHashAlgo = "sha256";
       outputHashMode = "recursive";
     };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "opencode";
-  version = "1.18.35";
+  version = "1.19.0";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -93,7 +93,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "anomalyco";
     repo = "opencode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NM5AbX99hDW+oIojiHSRA+QDz27d8L/v42bwZY+6Imk=";
+    hash = "sha256-XL76Qpm4GEFEn7Pt7g84sx+djEKnlpTTZXRgXJF3NRs=";
   };
 
   postPatch =

From dc6e5b087490ea33a9e0f1530848f96fcc2c1eec Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Sun, 11 Oct 2026 10:08:02 +0800
Subject: [PATCH 339/525] nixos/pantheon: Use epiphany without granite

Unfortunately new styling issues happen on every GNOME updates.
---
 nixos/modules/services/desktop-managers/pantheon.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/desktop-managers/pantheon.nix b/nixos/modules/services/desktop-managers/pantheon.nix
index 2f91d8796110..7cfcb21454e0 100644
--- a/nixos/modules/services/desktop-managers/pantheon.nix
+++ b/nixos/modules/services/desktop-managers/pantheon.nix
@@ -326,6 +326,7 @@ in
     (mkIf serviceCfg.apps.enable {
       environment.systemPackages = utils.removePackagesByName (
         [
+          pkgs.epiphany
           pkgs.gnome-font-viewer
           pkgs.file-roller
           pkgs.papers
@@ -347,7 +348,6 @@ in
             elementary-tasks
             elementary-terminal
             elementary-videos
-            epiphany
           ]
           ++ lib.optionals config.services.flatpak.enable [
             # Only install appcenter if flatpak is enabled before

From 087f48b19af9351593b537fff164512cf8c1ef98 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 02:38:23 +0000
Subject: [PATCH 340/525] terraform-providers.terraform-lxd_lxd: 3.1.0 -> 3.1.1

---
 .../networking/cluster/terraform-providers/providers.json     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index bdf3d4544709..321f57453ff4 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1355,11 +1355,11 @@
     "vendorHash": "sha256-SF11E60OQiRdf+Pf6XyJg60yGRnGOcSzhrYccrWaeYE="
   },
   "terraform-lxd_lxd": {
-    "hash": "sha256-U/x3CkUynyMvB9FWzlYgXIfC6/RWeNRV++4ceGW3Rnc=",
+    "hash": "sha256-9+3sVezHfhlbfytxt6h871ybdIaXDko16WLQNNzrNNQ=",
     "homepage": "https://registry.terraform.io/providers/terraform-lxd/lxd",
     "owner": "terraform-lxd",
     "repo": "terraform-provider-lxd",
-    "rev": "v3.1.0",
+    "rev": "v3.1.1",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-OHCnxqn09NyqsdTCRUJseNAL1DMpvl6Icu3YEzjLgPM="
   },

From 0e3bf78bffc2459bf94c2fd9a50e9040bfd11d4c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 02:59:33 +0000
Subject: [PATCH 341/525] all-the-package-names: 2.0.2578 -> 2.0.2590

---
 pkgs/by-name/al/all-the-package-names/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/al/all-the-package-names/package.nix b/pkgs/by-name/al/all-the-package-names/package.nix
index 25db9428b5cd..315ad7931927 100644
--- a/pkgs/by-name/al/all-the-package-names/package.nix
+++ b/pkgs/by-name/al/all-the-package-names/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "all-the-package-names";
-  version = "2.0.2578";
+  version = "2.0.2590";
 
   src = fetchFromGitHub {
     owner = "nice-registry";
     repo = "all-the-package-names";
     tag = "v${version}";
-    hash = "sha256-fFJuN1MPpnpYCotAiQoRU5qEsyC6HjOTrjxfnyWj/+o=";
+    hash = "sha256-j8x2SSo7TaPy37ET1NWYz6GU/zMjjOL9jzFP0mRCwZ8=";
   };
 
-  npmDepsHash = "sha256-8xzyypPgtfxYxPcVIJYLNL0a6EE7L93eISanWqPFGM4=";
+  npmDepsHash = "sha256-sA4kiDo4Q8WPqhxuIYIvU6R9cGYTTzxNMR224U864Gk=";
 
   passthru.updateScript = nix-update-script { };
 

From caf19e4eb8d6858eba9c8fbc03ecaa7b731e4c55 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 03:02:05 +0000
Subject: [PATCH 342/525] pyroscope: 2.3.1 -> 2.4.0

---
 pkgs/by-name/py/pyroscope/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/py/pyroscope/package.nix b/pkgs/by-name/py/pyroscope/package.nix
index 9baa7857e015..feb40bbc2e4a 100644
--- a/pkgs/by-name/py/pyroscope/package.nix
+++ b/pkgs/by-name/py/pyroscope/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "pyroscope";
-  version = "2.3.1";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "grafana";
     repo = "pyroscope";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-kKqIe+3q+qHcgKhEXtVxLLIE822G5ryFW7SD0pEWznY=";
+    hash = "sha256-fU8EKYEfj78xWfoxJe7uNdv8U57OuRcxiutqR6abdfs=";
   };
 
-  vendorHash = "sha256-KBdVCQZA2mDynpsWBzF06MMHb0rX++mXpFTHW0SFN9U=";
+  vendorHash = "sha256-7hV66g9SZb9qglWUdjastCtxJrCP5RDiZeMF6sp1aPQ=";
   proxyVendor = true;
 
   subPackages = [

From 26e96452db3179839acbe496174e910e549393bb Mon Sep 17 00:00:00 2001
From: Rafael Ieda <git@ieda.me>
Date: Fri, 18 Sep 2026 10:35:57 -0300
Subject: [PATCH 343/525] dnslink-std-go: drop

---
 pkgs/by-name/dn/dnslink-std-go/package.nix | 25 ----------------------
 pkgs/top-level/aliases.nix                 |  1 +
 2 files changed, 1 insertion(+), 25 deletions(-)
 delete mode 100644 pkgs/by-name/dn/dnslink-std-go/package.nix

diff --git a/pkgs/by-name/dn/dnslink-std-go/package.nix b/pkgs/by-name/dn/dnslink-std-go/package.nix
deleted file mode 100644
index a94aa8567519..000000000000
--- a/pkgs/by-name/dn/dnslink-std-go/package.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-{
-  lib,
-  buildGoModule,
-  fetchFromGitHub,
-}:
-
-buildGoModule (finalAttrs: {
-  pname = "dnslink";
-  version = "0.6.0";
-  src = fetchFromGitHub {
-    owner = "dnslink-std";
-    repo = "go";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-aATnNDUogNS4jBoWxUAFYFMa2ZS0+th3XH+1KWqwfWQ=";
-  };
-  vendorHash = "sha256-RH55yfIO9jHLbjtEdUF5QpL5ILV5ctX2hBYBJWutmUA=";
-  doCheck = false; # Uses network, unsurprisingly.
-  meta = {
-    changelog = "https://github.com/dnslink-std/go/releases/tag/v${finalAttrs.version}";
-    description = "Reference implementation for DNSLink in golang";
-    homepage = "https://dnslink.org/";
-    license = lib.licenses.mit;
-    mainProgram = "dnslink";
-  };
-})
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 1a3ab9ea37ad..027af45cc5f0 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -721,6 +721,7 @@ mapAliases {
   dleyna-renderer = throw "'dleyna-renderer' has been renamed to/replaced by 'dleyna'"; # Converted to throw 2025-10-27
   dleyna-server = throw "'dleyna-server' has been renamed to/replaced by 'dleyna'"; # Converted to throw 2025-10-27
   dnscrypt-proxy2 = throw "'dnscrypt-proxy2' has been renamed to/replaced by 'dnscrypt-proxy'"; # Converted to throw 2025-10-27
+  dnslink-std-go = throw "'dnslink-std-go' has been removed as it is broken, unmaintained, and upstream archived the project in July 2026"; # Added 2026-09-18
   dnsmon-go = throw "'dnsmon-go' has been removed because upstream archived the project in August 2025."; # Added 2026-09-02
   docker-distribution = throw "'docker-distribution' has been renamed to/replaced by 'distribution'"; # Converted to throw 2025-10-27
   docker-machine-hyperkit = throw "docker-machine-hyperkit has been removed as it only supported x86_64-darwin"; # Added 2026-07-12

From cdd66d765aa3287493fc3209d90ab3fa7ffc1163 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 03:16:33 +0000
Subject: [PATCH 344/525] python3Packages.python-roborock: 7.12.1 -> 7.12.2

---
 pkgs/development/python-modules/python-roborock/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-roborock/default.nix b/pkgs/development/python-modules/python-roborock/default.nix
index d442cfbd461d..6a5494cb1eee 100644
--- a/pkgs/development/python-modules/python-roborock/default.nix
+++ b/pkgs/development/python-modules/python-roborock/default.nix
@@ -28,14 +28,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "python-roborock";
-  version = "7.12.1";
+  version = "7.12.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Python-roborock";
     repo = "python-roborock";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZOCUCMaVpn45c6ZWYv/qNQMIeC43C3JdrJGzFBYuY84=";
+    hash = "sha256-rxDyZmq/ETOLIDNmtCvN+3OJM9MXOwMgVjVZQcBQ2CM=";
   };
 
   pythonRelaxDeps = [

From 98075f730d8e2ecce42323a9025f5b7b29969a2d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Niklas=20Hamb=C3=BCchen?= <mail@nh2.me>
Date: Sun, 11 Oct 2026 03:27:12 +0000
Subject: [PATCH 345/525] onlyoffice-desktopeditors: make update script fail on
 errors

---
 pkgs/by-name/on/onlyoffice-desktopeditors/update.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/on/onlyoffice-desktopeditors/update.sh b/pkgs/by-name/on/onlyoffice-desktopeditors/update.sh
index 362ef184d530..499030834cd7 100755
--- a/pkgs/by-name/on/onlyoffice-desktopeditors/update.sh
+++ b/pkgs/by-name/on/onlyoffice-desktopeditors/update.sh
@@ -1,5 +1,6 @@
 #!/usr/bin/env nix-shell
 #!nix-shell -i bash -p curl jq common-updater-scripts
+set -euo pipefail
 
-version="$(curl -sL "https://api.github.com/repos/ONLYOFFICE/DesktopEditors/releases?per_page=1" | jq -r ".[0].tag_name" | sed 's/^v//')"
+version="$(curl -fsSL ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://api.github.com/repos/ONLYOFFICE/DesktopEditors/releases?per_page=1" | jq -er ".[0].tag_name" | sed 's/^v//')"
 update-source-version onlyoffice-desktopeditors.derivation "$version"

From 8aa2baf1af6ca99131c979cbdadad7a08e2ca69a Mon Sep 17 00:00:00 2001
From: novalkun <novalkun@gmail.com>
Date: Sun, 11 Oct 2026 10:25:07 +0700
Subject: [PATCH 346/525] nixos/tests/atuin-programs: fix test

The test has never passed:

- `atuin init bash` returns false in non-interactive shells and when it
  has already been sourced, which the module does from /etc/bashrc in
  interactive shells. Test it in an interactive shell without bashrc.
- root has no running user manager, so querying its user units fails.
  Enable lingering for root first.

Assisted-by: Claude Code (Claude Opus 5.5)
---
 nixos/tests/atuin-programs.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/nixos/tests/atuin-programs.nix b/nixos/tests/atuin-programs.nix
index 14477bae9b08..821a963205e7 100644
--- a/nixos/tests/atuin-programs.nix
+++ b/nixos/tests/atuin-programs.nix
@@ -26,7 +26,8 @@
     machine.succeed("atuin --version")
 
     # Check shell integration - verify the init scripts can be sourced without error
-    machine.succeed("bash -c 'eval \"$(atuin init bash)\"'")
+    # bash init only runs in interactive shells; skip bashrc, which already sources it
+    machine.succeed("bash --norc -ic 'eval \"$(atuin init bash)\"'")
     machine.succeed("zsh -c 'eval \"$(atuin init zsh)\"'")
     machine.succeed("fish -c 'atuin init fish | source'")
 
@@ -34,6 +35,8 @@
     machine.succeed("grep -q 'auto_sync = false' /etc/atuin/config.toml")
 
     # Verify daemon socket unit is enabled
-    machine.succeed("systemctl --user --machine=root@ is-enabled atuin-daemon.socket")
+    # needs a running user manager for root
+    machine.succeed("loginctl enable-linger root")
+    machine.wait_until_succeeds("systemctl --user --machine=root@ is-enabled atuin-daemon.socket")
   '';
 }

From dcc3e41a75b1944a119c0ce83519a25141c41244 Mon Sep 17 00:00:00 2001
From: novalkun <novalkun@gmail.com>
Date: Sun, 11 Oct 2026 10:19:39 +0700
Subject: [PATCH 347/525] atuin: 18.21.0 -> 18.23.0

Changelog: https://github.com/atuinsh/atuin/releases/tag/v18.23.0
Diff: https://github.com/atuinsh/atuin/compare/v18.21.0...v18.23.0

The new e2e_pty tests need an interactive bash, `clear` and git.

Assisted-by: Claude Code (Claude Opus 5.5)
---
 pkgs/by-name/at/atuin/package.nix | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/at/atuin/package.nix b/pkgs/by-name/at/atuin/package.nix
index 166007ec881b..cbd861321beb 100644
--- a/pkgs/by-name/at/atuin/package.nix
+++ b/pkgs/by-name/at/atuin/package.nix
@@ -1,7 +1,10 @@
 {
   lib,
+  bashInteractive,
   fetchFromGitHub,
+  gitMinimal,
   installShellFiles,
+  ncurses,
   nix-update-script,
   nixosTests,
   openssl,
@@ -12,16 +15,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "atuin";
-  version = "18.21.0";
+  version = "18.23.0";
 
   src = fetchFromGitHub {
     owner = "atuinsh";
     repo = "atuin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kz8qdgxg79jX3hfPi7EY9c9SmFqUK6lWnMTLb3TKDQQ=";
+    hash = "sha256-NBn7C9ssLSXYrHWv5qWM5dZ2E8URbRJZOOCvHaNgxW4=";
   };
 
-  cargoHash = "sha256-chuGpLq8XAZrCCtx2L/tVQSXNLrTgG2rnBGcCEvDjFg=";
+  cargoHash = "sha256-rkDDs8gviBpoLR4mrrKRu2eTlmlpvjICVRFu22AeOaU=";
 
   # atuin's default features include 'check-updates', which do not make sense
   # for distribution builds. List all other default features.
@@ -45,6 +48,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
     openssl
   ];
 
+  # e2e_pty tests drive an interactive bash (needs readline), run `clear`,
+  # and create git repositories for workspace filtering
+  nativeCheckInputs = [
+    bashInteractive
+    gitMinimal
+    ncurses
+  ];
+
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installShellCompletion --cmd atuin \
       --bash <($out/bin/atuin gen-completions -s bash) \

From 475ae82ca55651800594778899f397c42c0bbfeb Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 03:31:42 +0000
Subject: [PATCH 348/525] twinejs: 2.12.0 -> 2.12.1

---
 pkgs/by-name/tw/twinejs/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/tw/twinejs/package.nix b/pkgs/by-name/tw/twinejs/package.nix
index 5f5a5d138e74..22b318f413e3 100644
--- a/pkgs/by-name/tw/twinejs/package.nix
+++ b/pkgs/by-name/tw/twinejs/package.nix
@@ -14,16 +14,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "twine";
-  version = "2.12.0";
+  version = "2.12.1";
 
   src = fetchFromGitHub {
     owner = "klembot";
     repo = "twinejs";
     tag = finalAttrs.version;
-    hash = "sha256-3/0pEzN90ZAeAoN7i+f604DvJl4VaQWkoOia1r5yQZY=";
+    hash = "sha256-zVBZ8LfrbatwfSSJSCRnx9GbjOlmYfaIWYD+abnG6HE=";
   };
 
-  npmDepsHash = "sha256-k2OHeLcGcVCurTSefEqtqwUzolZ72rKA4WRFJifUPyY=";
+  npmDepsHash = "sha256-ubreU9dwZptQhRIhlXVfsFUf9mJZ9GIqroOlMhMcn4I=";
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
   env.PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD = "1";

From f2dfc4a92b40f2afe85538d8dec183f57b9b3f69 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 03:38:11 +0000
Subject: [PATCH 349/525] fzf: 0.74.4 -> 0.74.5

---
 pkgs/by-name/fz/fzf/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fz/fzf/package.nix b/pkgs/by-name/fz/fzf/package.nix
index ef3e4c9f499f..7c23e0c4e80e 100644
--- a/pkgs/by-name/fz/fzf/package.nix
+++ b/pkgs/by-name/fz/fzf/package.nix
@@ -11,7 +11,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "fzf";
-  version = "0.74.4";
+  version = "0.74.5";
 
   __structuredAttrs = true;
 
@@ -19,7 +19,7 @@ buildGoModule (finalAttrs: {
     owner = "junegunn";
     repo = "fzf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QQ4hwbTeZ6MSojjCFn7dlISz1aGQbewGq4wnfs3/4K0=";
+    hash = "sha256-+v3oSlf3HBpPkNqS3QxRV/B1yHYb07/a70WYuS0aopY=";
   };
 
   vendorHash = "sha256-NojjUf/3c4q4B96eQ/qcI+GdRvHakHUyMRaQ6/IZpEw=";

From d3df871f6871e2bfd081dbf211059cc88ade8cee Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Sun, 11 Oct 2026 06:31:42 +0200
Subject: [PATCH 350/525] ladybird: drop riscv64 support

---
 pkgs/by-name/la/ladybird/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/la/ladybird/package.nix b/pkgs/by-name/la/ladybird/package.nix
index 31f9c28fb95e..843b6ad9fed5 100644
--- a/pkgs/by-name/la/ladybird/package.nix
+++ b/pkgs/by-name/la/ladybird/package.nix
@@ -312,7 +312,6 @@ stdenv.mkDerivation (finalAttrs: {
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
-      "riscv64-linux"
       "aarch64-darwin"
     ];
     mainProgram = "Ladybird";

From 62690d88cd00f7293132e107046c90a5dbeed547 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 04:37:19 +0000
Subject: [PATCH 351/525] python3Packages.pycrdt: 0.14.6 -> 0.14.8

---
 .../python-modules/pycrdt/Cargo.lock          | 50 +++++++++----------
 .../python-modules/pycrdt/default.nix         |  4 +-
 2 files changed, 27 insertions(+), 27 deletions(-)

diff --git a/pkgs/development/python-modules/pycrdt/Cargo.lock b/pkgs/development/python-modules/pycrdt/Cargo.lock
index 544a494e48e8..0e9d520932e8 100644
--- a/pkgs/development/python-modules/pycrdt/Cargo.lock
+++ b/pkgs/development/python-modules/pycrdt/Cargo.lock
@@ -30,7 +30,7 @@ checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.6",
+ "syn 3.0.7",
 ]
 
 [[package]]
@@ -149,9 +149,9 @@ dependencies = [
 
 [[package]]
 name = "libc"
-version = "0.2.189"
+version = "0.2.190"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3eaf3ede3fee6db1a4c2ee091bf8a8b4dccdc6d17f656fb07896ee72867612f2"
+checksum = "ce5d3ddc6d3fa000eb1536d85e147bfe31aacaba692ed6a876f95cb7c855be78"
 
 [[package]]
 name = "lock_api"
@@ -216,7 +216,7 @@ dependencies = [
 
 [[package]]
 name = "pycrdt"
-version = "0.14.6"
+version = "0.14.8"
 dependencies = [
  "futures-task",
  "pyo3",
@@ -227,9 +227,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3"
-version = "0.29.2"
+version = "0.29.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4688ddedf473e32662b9b067670129a8afb8c18e351482c70d62ba4a88171e8b"
+checksum = "700d18fa267b73b9b521fd7e13580e2f446916f176cacee1ab63fcc8191f1655"
 dependencies = [
  "libc",
  "once_cell",
@@ -241,18 +241,18 @@ dependencies = [
 
 [[package]]
 name = "pyo3-build-config"
-version = "0.29.2"
+version = "0.29.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f41027e41b4bd03f6e60f9f417fe24a6341a6bb744edd62b6f709f2a52ea30e9"
+checksum = "7b3fc0c4d08f6bb10e71fe39dfb9e2f59c6eb6854e22ec8092f50c69a4499adb"
 dependencies = [
  "target-lexicon",
 ]
 
 [[package]]
 name = "pyo3-ffi"
-version = "0.29.2"
+version = "0.29.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e591a95526fead067432c3b3a33fc74770b87b1e04e73671090d9c2055a2b327"
+checksum = "dfc0b8e19df29aad7086cf977bb0c2a2f143e30567eb113e9cf72b62ca698330"
 dependencies = [
  "libc",
  "pyo3-build-config",
@@ -260,9 +260,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros"
-version = "0.29.2"
+version = "0.29.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "73225868fc1cd84eef2c3c230ddb91273bf1de46aeb8a4248da76d32a0924a1c"
+checksum = "6100e8a4b5eba53afaa5ed078364851a0b2499c553a44c31026b929049b49dc6"
 dependencies = [
  "proc-macro2",
  "pyo3-macros-backend",
@@ -272,9 +272,9 @@ dependencies = [
 
 [[package]]
 name = "pyo3-macros-backend"
-version = "0.29.2"
+version = "0.29.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "571575aa3749fa6216757dd47d2a3e7ef360f329a40f0666a9fbd14889024952"
+checksum = "6143877a16e82b5a727b7127ff4cd86858a24a28d745d72f43e6f227c7b1bdb3"
 dependencies = [
  "heck",
  "proc-macro2",
@@ -345,14 +345,14 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.6",
+ "syn 3.0.7",
 ]
 
 [[package]]
 name = "serde_json"
-version = "1.0.151"
+version = "1.0.152"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c841b55ecdae098c80dcae9cf767f6f8a0c2cdb3416bbef72181df4d0fe73f14"
+checksum = "1741ab7a6cc54a03a89b5d563ed60075c277d9e3cfa73ad0c1f23f23974703c6"
 dependencies = [
  "itoa",
  "memchr",
@@ -372,9 +372,9 @@ dependencies = [
 
 [[package]]
 name = "smallvec"
-version = "1.16.2"
+version = "1.16.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9395f0f0eee849a9b707b2f06bb92a6a422090e2123bb2ef8e87a0e61892a8e"
+checksum = "5b3dc8af474f516a851ff4bd12db780f948b9250ad37211e4eec0bccea54e01b"
 
 [[package]]
 name = "syn"
@@ -389,9 +389,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "3.0.6"
+version = "3.0.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8593e8e72159ed2257d083c7a454a85cbf854f37a0966d8d483aff8c8a3ebcee"
+checksum = "d62a2e0561533f2ca2561d0cf27fd9fedb640a1bf2616ff5d5c80d99017faadc"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -421,7 +421,7 @@ checksum = "fe5197923287db20a58125f0bc85c062f7f2c892de97b18c356f9efb14b28524"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.6",
+ "syn 3.0.7",
 ]
 
 [[package]]
@@ -462,7 +462,7 @@ dependencies = [
  "bumpalo",
  "proc-macro2",
  "quote",
- "syn 3.0.6",
+ "syn 3.0.7",
  "wasm-bindgen-shared",
 ]
 
@@ -483,9 +483,9 @@ checksum = "f0805222e57f7521d6a62e36fa9163bc891acd422f971defe97d64e70d0a4fe5"
 
 [[package]]
 name = "yrs"
-version = "0.27.4"
+version = "0.28.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3987db9bdbe6f0f49c58ec3d0daf4750a70b40019c190f6c6708abfcdfe6bea0"
+checksum = "52c70dc8beca8666c77612a96889106ca3cd65318609721f464624ff79685da9"
 dependencies = [
  "arc-swap",
  "async-lock",
diff --git a/pkgs/development/python-modules/pycrdt/default.nix b/pkgs/development/python-modules/pycrdt/default.nix
index ab82b6f75bf4..6fda103349a0 100644
--- a/pkgs/development/python-modules/pycrdt/default.nix
+++ b/pkgs/development/python-modules/pycrdt/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pycrdt";
-  version = "0.14.6";
+  version = "0.14.8";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -28,7 +28,7 @@ buildPythonPackage (finalAttrs: {
     owner = "y-crdt";
     repo = "pycrdt";
     tag = finalAttrs.version;
-    hash = "sha256-gO1QReYcrsCJLkCLPt0ihydPjAarJlYnISZG6NfMj6o=";
+    hash = "sha256-HnmufoV91CA/036BkTGo62je7cKFDytrU6FgVjI/dEI=";
   };
 
   postPatch = ''

From f5f35fd25b634422c87eeddf9cf7f4fb9d6bf237 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 04:41:46 +0000
Subject: [PATCH 352/525] terraform-providers.metio_migadu: 2026.9.24 ->
 2026.10.1

---
 .../networking/cluster/terraform-providers/providers.json     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index bdf3d4544709..d8b38d3a0c00 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -914,11 +914,11 @@
     "vendorHash": "sha256-8Zj4nrEJ38Tz0LOYtghlMnJZJnD2zJjsqawVMTEX0Wk="
   },
   "metio_migadu": {
-    "hash": "sha256-3RCE2KCWgS8j30Ggh0HfX0D9ZPpgiTtgIk7+YmzYSfc=",
+    "hash": "sha256-hcHx/pFGBzXfa0EoIUW5L8ZLrT+pUpHfx4r7NxEk5uw=",
     "homepage": "https://registry.terraform.io/providers/metio/migadu",
     "owner": "metio",
     "repo": "terraform-provider-migadu",
-    "rev": "2026.9.24",
+    "rev": "2026.10.1",
     "spdx": "0BSD",
     "vendorHash": "sha256-b2YIkwpeYCGsENzXSAPD7nhvmZ1Phxfcm3S5xsiC2t0="
   },

From 27cc8f6e9e68665ade8ecbc3b251a2bc65f65246 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 04:45:53 +0000
Subject: [PATCH 353/525] secrethound: 1.2.0 -> 1.3.0

---
 pkgs/by-name/se/secrethound/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/se/secrethound/package.nix b/pkgs/by-name/se/secrethound/package.nix
index 1e90e726faf2..293bd2d84aee 100644
--- a/pkgs/by-name/se/secrethound/package.nix
+++ b/pkgs/by-name/se/secrethound/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "secrethound";
-  version = "1.2.0";
+  version = "1.3.0";
 
   src = fetchFromGitHub {
     owner = "rafabd1";
     repo = "SecretHound";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ca0AwD1oFBB8F2J4gLMtaDssacczugAkkSYdBTvT4VQ=";
+    hash = "sha256-wTed0dJNhh8LpTYN/R6uyuWPyuHGAJdnR8Sbv+UPV5c=";
   };
 
-  vendorHash = "sha256-oTyI3/+evDTzyH+BjfSP0A1r2bYVAMxtWRsg0G1d2zQ=";
+  vendorHash = "sha256-Gpbz7Cc6CyQDd3BaNfVIVKL36W/u+sM5g7dJ0Ey+6y8=";
 
   ldflags = [
     "-s"

From db947aee8a23eca9744f9f66130f8d629083b2db Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 04:55:16 +0000
Subject: [PATCH 354/525] syswatch: 0.14.2 -> 0.14.3

---
 pkgs/by-name/sy/syswatch/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sy/syswatch/package.nix b/pkgs/by-name/sy/syswatch/package.nix
index 9358daa90150..7fb2fd3a82ac 100644
--- a/pkgs/by-name/sy/syswatch/package.nix
+++ b/pkgs/by-name/sy/syswatch/package.nix
@@ -7,18 +7,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "syswatch";
-  version = "0.14.2";
+  version = "0.14.3";
 
   src = fetchFromGitHub {
     owner = "matthart1983";
     repo = "syswatch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-udVUX1qNaPDBI+nEjm7LQ+2+HG6TBlgsjyQOP8pBqao=";
+    hash = "sha256-39GA6OnrCRKlqFN7guaPzOXXdSnpFjjSNMU9Iie38lA=";
   };
 
   __structuredAttrs = true;
 
-  cargoHash = "sha256-iFqECXUMODxvjXQ4o0mD4dTdG9RYbpOBeyJzvteZZmI=";
+  cargoHash = "sha256-sokTz+OFFsDn6SbZ9lXoCgXz6iFPOOEMheF16aLKFAc=";
 
   nativeCheckInputs = [ versionCheckHook ];
 

From 058d7db57fdce488f7e07ded5f751345bbabac26 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 05:08:52 +0000
Subject: [PATCH 355/525] abracadabra: 4.2.1 -> 4.3.0

---
 pkgs/by-name/ab/abracadabra/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ab/abracadabra/package.nix b/pkgs/by-name/ab/abracadabra/package.nix
index 7f24a9e435cd..ce208ece0990 100644
--- a/pkgs/by-name/ab/abracadabra/package.nix
+++ b/pkgs/by-name/ab/abracadabra/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "abracadabra";
-  version = "4.2.1";
+  version = "4.3.0";
 
   src = fetchFromGitHub {
     owner = "KejPi";
     repo = "AbracaDABra";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-35E2a3UXyxcDixN5OAsiqlV0X+wkhS2vI6myHlpA2GA=";
+    hash = "sha256-wc2DuBUnD5AWjDUez2ZlgnJ4Kh2kizoJyW0evV3Iics=";
   };
 
   nativeBuildInputs = [

From 60d8f25848b3363f3c7a13ca301a13bf40fd4673 Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Sun, 11 Oct 2026 07:10:23 +0200
Subject: [PATCH 356/525] sbsigntool: add riscv64-linux support

---
 pkgs/by-name/sb/sbsigntool/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/sb/sbsigntool/package.nix b/pkgs/by-name/sb/sbsigntool/package.nix
index 1b9cad610339..8b546b35fd53 100644
--- a/pkgs/by-name/sb/sbsigntool/package.nix
+++ b/pkgs/by-name/sb/sbsigntool/package.nix
@@ -79,6 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
+      "riscv64-linux"
     ]; # Broken on i686
     license = lib.licenses.gpl3;
   };

From fc5e1868ca770193ed9671db5fa708a64a3527d6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 05:10:48 +0000
Subject: [PATCH 357/525] sgdboop: 1.4.3 -> 1.4.4

---
 pkgs/by-name/sg/sgdboop/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sg/sgdboop/package.nix b/pkgs/by-name/sg/sgdboop/package.nix
index fdf0d134da15..d4ff60b206a2 100644
--- a/pkgs/by-name/sg/sgdboop/package.nix
+++ b/pkgs/by-name/sg/sgdboop/package.nix
@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "sgdboop";
-  version = "1.4.3";
+  version = "1.4.4";
 
   src = fetchFromGitHub {
     owner = "SteamGridDB";
     repo = "SGDBoop";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-l4l5CWupL/V/qlnFZIgqUBagc5qg0DDv/zz2yc0mtng=";
+    hash = "sha256-OO4DXZlmCMaVl+z24Xy7BHVKc36QkWxVzilkNnAXkUA=";
   };
 
   installPhase = ''

From 5e2fc7ad64690760894456a78a07f29e9b5d7085 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 05:11:59 +0000
Subject: [PATCH 358/525] aws-lc: 5.10.0 -> 5.11.0

---
 pkgs/by-name/aw/aws-lc/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/aw/aws-lc/package.nix b/pkgs/by-name/aw/aws-lc/package.nix
index 548d1a2b0498..3aefbade8655 100644
--- a/pkgs/by-name/aw/aws-lc/package.nix
+++ b/pkgs/by-name/aw/aws-lc/package.nix
@@ -13,13 +13,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "aws-lc";
-  version = "5.10.0";
+  version = "5.11.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-lc";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-fQl7rh9edy+ZtFZ1aB8FezP9ORJkqlRkR16y3Ke1vQQ=";
+    hash = "sha256-2gsjaMgP8NcJVSdW2g4hGFySVfTfKJuSkjSrG8KTKWI=";
   };
 
   outputs = [

From 6cc460a8c04a06d12dc4acc6aa63c9dd2a54a78a Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 11 Oct 2026 07:14:28 +0200
Subject: [PATCH 359/525] python3Packages.iamdata: 0.1.202610101 ->
 0.1.202610111

Diff: https://github.com/cloud-copilot/iam-data-python/compare/v0.1.202610101...v0.1.202610111

Changelog: https://github.com/cloud-copilot/iam-data-python/releases/tag/v0.1.202610111
---
 pkgs/development/python-modules/iamdata/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index a3beb2d06cda..5807aa3e334a 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202610101";
+  version = "0.1.202610111";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NVC45Tp53PqZ8oiiaf9OfKP3TP5UNjubhI0HktImLvk=";
+    hash = "sha256-RihrWdIJBURHdgSWjUEXysuA4JOza7z1gISvbnW7JDo=";
   };
 
   __darwinAllowLocalNetworking = true;

From a03c55e5df742459facf553a8459b74746859d60 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 11 Oct 2026 07:16:51 +0200
Subject: [PATCH 360/525] python3Packages.publicsuffixlist: adjust build-system

---
 .../python-modules/publicsuffixlist/default.nix        | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/publicsuffixlist/default.nix b/pkgs/development/python-modules/publicsuffixlist/default.nix
index 15fa35bb6edf..864ec61af74d 100644
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@@ -2,21 +2,21 @@
   lib,
   buildPythonPackage,
   fetchPypi,
+  hatchling,
   pandoc,
+  publicsuffix-list,
   pytestCheckHook,
   requests,
-  setuptools,
-  publicsuffix-list,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "publicsuffixlist";
-  version = "1.0.2.20261007";
+  version = "1.1.0.20261010";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-TxvtwsLFzEsLYLJwxXnUdcdYDmRB0mLR/Pxi89RaWOA=";
+    hash = "sha256-Hr1Mntreimyb0BmVpvnmciCUjcpYebH9SKVly0Kdmus=";
   };
 
   postPatch = ''
@@ -24,7 +24,7 @@ buildPythonPackage (finalAttrs: {
     ln -s ${publicsuffix-list}/share/publicsuffix/public_suffix_list.dat publicsuffixlist/public_suffix_list.dat
   '';
 
-  build-system = [ setuptools ];
+  build-system = [ hatchling ];
 
   optional-dependencies = {
     update = [ requests ];

From 57df63f29b86c8c887dc208562aa0487075beb72 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 11 Oct 2026 07:19:21 +0200
Subject: [PATCH 361/525] python3Packages.ttp-templates: 0.6.10 -> 0.6.14

Diff: https://github.com/dmulyalin/ttp_templates/compare/0.6.10...0.6.14

Changelog: https://github.com/dmulyalin/ttp_templates/releases/tag/0.6.14
---
 pkgs/development/python-modules/ttp-templates/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/ttp-templates/default.nix b/pkgs/development/python-modules/ttp-templates/default.nix
index 6a6fc414f73d..01c902e862b4 100644
--- a/pkgs/development/python-modules/ttp-templates/default.nix
+++ b/pkgs/development/python-modules/ttp-templates/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ttp-templates";
-  version = "0.6.10";
+  version = "0.6.14";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "dmulyalin";
     repo = "ttp_templates";
     tag = finalAttrs.version;
-    hash = "sha256-j//8gAzBXyQkSmmnJZofi2Q/lYklT/QjiU8k0a3ENDg=";
+    hash = "sha256-KTXUbxmXKTg5Xj5p4pnU3abvBgphaXjI+6NPdIJ3xIY=";
   };
 
   build-system = [ poetry-core ];

From a40cf46f6fc2138f9b4c2165a98537ff7d86af50 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 11 Oct 2026 07:29:23 +0200
Subject: [PATCH 362/525] python3Packages.uritools: 6.0.2 -> 6.1.3

Changelog: https://github.com/tkem/uritools/blob/v6.1.3/CHANGELOG.rst
---
 pkgs/development/python-modules/uritools/default.nix | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/uritools/default.nix b/pkgs/development/python-modules/uritools/default.nix
index 4c6de860c585..14ccca540440 100644
--- a/pkgs/development/python-modules/uritools/default.nix
+++ b/pkgs/development/python-modules/uritools/default.nix
@@ -3,19 +3,23 @@
   buildPythonPackage,
   fetchPypi,
   setuptools,
+  setuptools-scm,
 }:
 
 buildPythonPackage rec {
   pname = "uritools";
-  version = "6.0.2";
+  version = "6.1.3";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-TWccO4yiMKXUfvpfimk/PQFTHzj09SMXApm+c0zJhRs=";
+    hash = "sha256-OkmOfoXvMkk0PVcQYY1kGkFNoPuubSMFOtp5du6D6l8=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
 
   pythonImportsCheck = [ "uritools" ];
 

From a3392b79fc6ddd5f55781b95747ad877026e26a2 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 11 Oct 2026 07:32:48 +0200
Subject: [PATCH 363/525] python3Packages.uritools: enable tests

---
 .../development/python-modules/uritools/default.nix | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/uritools/default.nix b/pkgs/development/python-modules/uritools/default.nix
index 14ccca540440..a2bab30a920a 100644
--- a/pkgs/development/python-modules/uritools/default.nix
+++ b/pkgs/development/python-modules/uritools/default.nix
@@ -1,7 +1,8 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
+  pytestCheckHook,
   setuptools,
   setuptools-scm,
 }:
@@ -11,9 +12,11 @@ buildPythonPackage rec {
   version = "6.1.3";
   pyproject = true;
 
-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-OkmOfoXvMkk0PVcQYY1kGkFNoPuubSMFOtp5du6D6l8=";
+  src = fetchFromGitHub {
+    owner = "tkem";
+    repo = "uritools";
+    tag = "v${version}";
+    hash = "sha256-pZzsdl/q5Piul1Q2cLPkeRmZbW12ACKuI2OYbnG+rMc=";
   };
 
   build-system = [
@@ -21,6 +24,8 @@ buildPythonPackage rec {
     setuptools-scm
   ];
 
+  nativeCheckInputs = [ pytestCheckHook ];
+
   pythonImportsCheck = [ "uritools" ];
 
   meta = {

From 6f6785bce25ca7f54c0e8194e423cc8811dbb8d6 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 11 Oct 2026 07:33:38 +0200
Subject: [PATCH 364/525] python3Packages.uritools: migrate to finalAttrs

---
 pkgs/development/python-modules/uritools/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/uritools/default.nix b/pkgs/development/python-modules/uritools/default.nix
index a2bab30a920a..b31f324f3c8f 100644
--- a/pkgs/development/python-modules/uritools/default.nix
+++ b/pkgs/development/python-modules/uritools/default.nix
@@ -7,7 +7,7 @@
   setuptools-scm,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "uritools";
   version = "6.1.3";
   pyproject = true;
@@ -15,7 +15,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "tkem";
     repo = "uritools";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-pZzsdl/q5Piul1Q2cLPkeRmZbW12ACKuI2OYbnG+rMc=";
   };
 
@@ -31,8 +31,8 @@ buildPythonPackage rec {
   meta = {
     description = "RFC 3986 compliant, Unicode-aware, scheme-agnostic replacement for urlparse";
     homepage = "https://github.com/tkem/uritools/";
-    changelog = "https://github.com/tkem/uritools/blob/v${version}/CHANGELOG.rst";
+    changelog = "https://github.com/tkem/uritools/blob/v${finalAttrs.version}/CHANGELOG.rst";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ rvolosatovs ];
   };
-}
+})

From 8d184fa05a6f502e17b4885af29a92641a207f38 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 05:48:12 +0000
Subject: [PATCH 365/525] home-assistant-matter-hub: 2.0.57 -> 2.0.58

---
 pkgs/by-name/ho/home-assistant-matter-hub/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ho/home-assistant-matter-hub/package.nix b/pkgs/by-name/ho/home-assistant-matter-hub/package.nix
index 40561297251b..02968b1fd0c7 100644
--- a/pkgs/by-name/ho/home-assistant-matter-hub/package.nix
+++ b/pkgs/by-name/ho/home-assistant-matter-hub/package.nix
@@ -14,13 +14,13 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "home-assistant-matter-hub";
-  version = "2.0.57";
+  version = "2.0.58";
 
   src = fetchFromGitHub {
     owner = "RiDDiX";
     repo = "home-assistant-matter-hub";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3Pi069urd/FAT0eWz2tpcx/JbP/90iTcoswdAZt1viQ=";
+    hash = "sha256-Mytoc24bhq7nHvkD4vKHE8LxEGtqJh1nRr8lMXh+2mE=";
   };
 
   # The bundled cli.js imports transitive dependencies (e.g. @noble/curves)
@@ -38,7 +38,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       ;
     inherit pnpm;
     fetcherVersion = 4;
-    hash = "sha256-h4oQ01Bmj9bbm2YY7t/lJukIgJ99YQwRqyERHZlBXj4=";
+    hash = "sha256-y1Q6b9W0MxGThRhbaAJ8TigO4sfM8T3Rz4WDxrlwoFU=";
   };
 
   __structuredAttrs = true;

From 3265556057000116fcdb3d9f360be8e69ff343ba Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 11 Oct 2026 07:53:28 +0200
Subject: [PATCH 366/525] python3Packages.pyowm: migrate to finalAttrs

---
 pkgs/development/python-modules/pyowm/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/pyowm/default.nix b/pkgs/development/python-modules/pyowm/default.nix
index ae95c320ff52..118f39a49c2f 100644
--- a/pkgs/development/python-modules/pyowm/default.nix
+++ b/pkgs/development/python-modules/pyowm/default.nix
@@ -9,7 +9,7 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pyowm";
   version = "3.5.0";
   pyproject = true;
@@ -17,7 +17,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "csparpa";
     repo = "pyowm";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-D1Cl3uWoEIUqA0R+bjRL2YgsVKj5inuBAVLJYluADg0=";
   };
 
@@ -41,8 +41,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python wrapper around the OpenWeatherMap web API";
     homepage = "https://pyowm.readthedocs.io/";
-    changelog = "https://github.com/csparpa/pyowm/releases/tag/${version}";
+    changelog = "https://github.com/csparpa/pyowm/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

From 4340f6f844986ac082b60fa12253112da5908e81 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 06:02:04 +0000
Subject: [PATCH 367/525] fosrl-olm: 1.10.0 -> 1.10.1

---
 pkgs/by-name/fo/fosrl-olm/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fo/fosrl-olm/package.nix b/pkgs/by-name/fo/fosrl-olm/package.nix
index c50a3040218f..2b7b7edbbab0 100644
--- a/pkgs/by-name/fo/fosrl-olm/package.nix
+++ b/pkgs/by-name/fo/fosrl-olm/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "olm";
-  version = "1.10.0";
+  version = "1.10.1";
 
   src = fetchFromGitHub {
     owner = "fosrl";
     repo = "olm";
     tag = finalAttrs.version;
-    hash = "sha256-A3SpDzl/cW/4tCVFWrRpWoaLmBD8J3eniKf/p9ZX/g8=";
+    hash = "sha256-/FhfpVwBEwx7HoaTzdgqSdN0rd2rqkx/FwC+GWofSlo=";
   };
 
-  vendorHash = "sha256-p4ClY6MT7JNGYI4qOdLBAGyyEAqW4DVlwRta+xSmd9E=";
+  vendorHash = "sha256-L0317eHaf0mt79kcquIh1IN5vVsGn3XyVQC6rdrayPA=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 

From 2e54a53723b046d8eb417e224fd4cce7ea28fe3f Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 11 Oct 2026 08:04:31 +0200
Subject: [PATCH 368/525] checkov: 3.3.9 -> 3.3.26

Changelog: https://github.com/bridgecrewio/checkov/releases/tag/3.3.26
---
 pkgs/by-name/ch/checkov/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ch/checkov/package.nix b/pkgs/by-name/ch/checkov/package.nix
index d359fb3b638a..2182e08bac01 100644
--- a/pkgs/by-name/ch/checkov/package.nix
+++ b/pkgs/by-name/ch/checkov/package.nix
@@ -35,14 +35,14 @@ let
 in
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "checkov";
-  version = "3.3.9";
+  version = "3.3.26";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bridgecrewio";
     repo = "checkov";
     tag = finalAttrs.version;
-    hash = "sha256-XbfuMOXpG1sQgqiq42kJB3zmcKrBGhgLaopvSV0fFVY=";
+    hash = "sha256-q2aZfFoeBvg78uCLQxws4KaWH7yaE9CDm5TIOokscTs=";
   };
 
   pythonRelaxDeps = [

From e1b57f8abc359dae15d4ed11f101913400760018 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 06:06:47 +0000
Subject: [PATCH 369/525] python3Packages.odp-amsterdam: 7.1.0 -> 7.2.0

---
 pkgs/development/python-modules/odp-amsterdam/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/odp-amsterdam/default.nix b/pkgs/development/python-modules/odp-amsterdam/default.nix
index f152a50c2819..460d9fa17734 100644
--- a/pkgs/development/python-modules/odp-amsterdam/default.nix
+++ b/pkgs/development/python-modules/odp-amsterdam/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "odp-amsterdam";
-  version = "7.1.0";
+  version = "7.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "klaasnicolaas";
     repo = "python-odp-amsterdam";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YUO8L40FjqjdDWLcmDldQ+5hkdVgBQHvAhd1rBTfDLg=";
+    hash = "sha256-aK6BGOkkHdKkiojg56qxkyZklpdstQWNzaTLM1s8//s=";
   };
 
   postPatch = ''

From 5c410562fc4ef890c1685f74f05df0786cf1ecfb Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Sun, 11 Oct 2026 08:08:04 +0200
Subject: [PATCH 370/525] deadbeef: add riscv64-linux support

---
 pkgs/by-name/de/deadbeef/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/de/deadbeef/package.nix b/pkgs/by-name/de/deadbeef/package.nix
index 919017ab9d6b..c29fa77ed966 100644
--- a/pkgs/by-name/de/deadbeef/package.nix
+++ b/pkgs/by-name/de/deadbeef/package.nix
@@ -162,6 +162,7 @@ clangStdenv.mkDerivation (finalAttrs: {
     platforms = [
       "x86_64-linux"
       "i686-linux"
+      "riscv64-linux"
     ];
     maintainers = [ ];
   };

From 2cb090cb9a748aa169b0544c02201f004178885e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 06:16:44 +0000
Subject: [PATCH 371/525] python3Packages.datamodeldict: 0.9.10 -> 0.9.11

---
 pkgs/development/python-modules/datamodeldict/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/datamodeldict/default.nix b/pkgs/development/python-modules/datamodeldict/default.nix
index 1e6a85a5292e..e9480eaddb81 100644
--- a/pkgs/development/python-modules/datamodeldict/default.nix
+++ b/pkgs/development/python-modules/datamodeldict/default.nix
@@ -9,14 +9,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "datamodeldict";
-  version = "0.9.10";
+  version = "0.9.11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "usnistgov";
     repo = "DataModelDict";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4tyf3zlzxbtHkvADP+Kmw3/XMugAGi4FNO0qM16m8DU=";
+    hash = "sha256-/wvA/CS3DKuD7kBmzaIvhElkpdEPjRA3UiJUvzCSths=";
   };
 
   build-system = [ uv-build ];

From b29b04b74ab525982fcca7f0a4f1d252d09f0f5d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 06:31:31 +0000
Subject: [PATCH 372/525] terraform-providers.gitlabhq_gitlab: 19.3.0 -> 19.4.1

---
 .../networking/cluster/terraform-providers/providers.json   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index bdf3d4544709..95f878e88b28 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -454,13 +454,13 @@
     "vendorHash": "sha256-FcxAh8EOvnT8r1GHu0Oj2C5Jgbr2WPwD7/vY4/qIvTA="
   },
   "gitlabhq_gitlab": {
-    "hash": "sha256-t37l0B8fHIQNPJKV2ryKOy/2y7SogMdl36XdR3Emcj0=",
+    "hash": "sha256-ceM9uXqefS7kvGWmWWR3KjnuGoWEihliwkkfOTCZQWI=",
     "homepage": "https://registry.terraform.io/providers/gitlabhq/gitlab",
     "owner": "gitlabhq",
     "repo": "terraform-provider-gitlab",
-    "rev": "v19.3.0",
+    "rev": "v19.4.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-w72kbVx+4J0BmOT0k3ZY892Tp7dvSA0QKH9u0I1D/tE="
+    "vendorHash": "sha256-14LfF5ryqFVLici3iOrbJfqRYMBnDM2D+jky+NUAL1w="
   },
   "go-gandi_gandi": {
     "hash": "sha256-fsCtmwyxkXfOtiZG27VEb010jglK35yr4EynnUWlFog=",

From 8ecd013dcdc6829ab06976f6b26b8a720999698a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 06:39:43 +0000
Subject: [PATCH 373/525] ndg: 2.10.1 -> 2.10.2

---
 pkgs/by-name/nd/ndg/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/nd/ndg/package.nix b/pkgs/by-name/nd/ndg/package.nix
index 2ae61dc755c3..5ece13d67cbd 100644
--- a/pkgs/by-name/nd/ndg/package.nix
+++ b/pkgs/by-name/nd/ndg/package.nix
@@ -10,17 +10,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ndg";
-  version = "2.10.1";
+  version = "2.10.2";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "feel-co";
     repo = "ndg";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-yytpu/au9gPC9ItFvSkHBl7lbsR8W4+J5qXaVYpLyj4=";
+    hash = "sha256-BjReQjJR7LJxHmkqLIGEvulq/vvv8bzgGtK0J8CvAvk=";
   };
 
-  cargoHash = "sha256-loFStzNGs0WRvf1KzS3Sw9Hd0NWds6ZRbcZqYJNpVLA=";
+  cargoHash = "sha256-H+IiwGS08l2mR5pjnIhmzVnw3Xyz++/jmjAyh/TVGcc=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From e13326f46cb622e4be6a7b7d34830c4d5dc0428d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 07:02:46 +0000
Subject: [PATCH 374/525] python3Packages.langchain-huggingface: 1.2.2 -> 1.2.3

---
 .../python-modules/langchain-huggingface/default.nix          | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/langchain-huggingface/default.nix b/pkgs/development/python-modules/langchain-huggingface/default.nix
index c2e9cd8c0ec2..8d8bd5fb1c43 100644
--- a/pkgs/development/python-modules/langchain-huggingface/default.nix
+++ b/pkgs/development/python-modules/langchain-huggingface/default.nix
@@ -33,7 +33,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langchain-huggingface";
-  version = "1.2.2";
+  version = "1.2.3";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -41,7 +41,7 @@ buildPythonPackage (finalAttrs: {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-huggingface==${finalAttrs.version}";
-    hash = "sha256-jMbFqui0XoKZ15B+5kJAamW5Dasv/JCIZS2KtteRBXg=";
+    hash = "sha256-muibdSyBybUR1YTVsWr00mg0uSgUm2zwKRM3KU9Ju38=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/partners/huggingface";

From 16c79566bf8b5cdc48155e164c7da3af181a87d2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 07:15:37 +0000
Subject: [PATCH 375/525] adscan: 13.1.0 -> 13.2.0

---
 pkgs/by-name/ad/adscan/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ad/adscan/package.nix b/pkgs/by-name/ad/adscan/package.nix
index bb3e2f517c52..543e8f596f6b 100644
--- a/pkgs/by-name/ad/adscan/package.nix
+++ b/pkgs/by-name/ad/adscan/package.nix
@@ -7,7 +7,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "adscan";
-  version = "13.1.0";
+  version = "13.2.0";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -16,7 +16,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "ADScanPro";
     repo = "adscan";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BmzXsbgS4gE5osU5Vt2GZrSYKOgKRkiPPoK2gurAk0I=";
+    hash = "sha256-5sMoN+aH+u9Fp+AWorhrm4TlKaIWTwjVhuvO33SnMGg=";
   };
 
   pythonRelaxDeps = [ "credsweeper" ];

From 12a0de1675099a9772a55236c5509440e0b5c05e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 07:20:18 +0000
Subject: [PATCH 376/525] python3Packages.google-cloud-tasks: 2.25.0 -> 2.26.0

---
 .../development/python-modules/google-cloud-tasks/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-tasks/default.nix b/pkgs/development/python-modules/google-cloud-tasks/default.nix
index ab5c98271127..42703a4cb7a0 100644
--- a/pkgs/development/python-modules/google-cloud-tasks/default.nix
+++ b/pkgs/development/python-modules/google-cloud-tasks/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-tasks";
-  version = "2.25.0";
+  version = "2.26.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_tasks";
     inherit version;
-    hash = "sha256-UeG5GBiSUSTD73KAGbFA8NSlBo2HHw8noXxtqAMy8eQ=";
+    hash = "sha256-3zO+V0EcV715FGHQu81tBLTg5V+cZbaGgnBsrSR8WwY=";
   };
 
   build-system = [ setuptools ];

From d1162251865f2ceb43cdb8159d4e32e95a227a52 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Sun, 11 Oct 2026 09:25:20 +0200
Subject: [PATCH 377/525] run0-sudo-shim: change my github handle

---
 pkgs/by-name/ru/run0-sudo-shim/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ru/run0-sudo-shim/package.nix b/pkgs/by-name/ru/run0-sudo-shim/package.nix
index e9e8eb0ff4c4..3cd6e0e643c1 100644
--- a/pkgs/by-name/ru/run0-sudo-shim/package.nix
+++ b/pkgs/by-name/ru/run0-sudo-shim/package.nix
@@ -13,7 +13,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   version = "1.4.2";
 
   src = fetchFromGitHub {
-    owner = "LordGrimmauld";
+    owner = "GrimmTheShrimp";
     repo = "run0-sudo-shim";
     tag = finalAttrs.version;
     hash = "sha256-J/I7VPXpOwNtEk9H+lbZVT+xJYBsSKgnMlwzlVIJSWk=";

From 1b12efb26887baa32cf2a06c53c199f00ea10121 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Sun, 11 Oct 2026 09:26:35 +0200
Subject: [PATCH 378/525] nix-check-deps: change my github handle

---
 pkgs/by-name/ni/nix-check-deps/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ni/nix-check-deps/package.nix b/pkgs/by-name/ni/nix-check-deps/package.nix
index 9dff89cdbe75..7b9831d97a99 100644
--- a/pkgs/by-name/ni/nix-check-deps/package.nix
+++ b/pkgs/by-name/ni/nix-check-deps/package.nix
@@ -10,7 +10,7 @@ rustPlatform.buildRustPackage {
   version = "0-unstable-2025-04-09";
 
   src = fetchFromGitHub {
-    owner = "LordGrimmauld";
+    owner = "GrimmTheShrimp";
     repo = "nix-check-deps";
     rev = "263701905ec40a19c52d23d0fdceb1126e20c99e";
     hash = "sha256-RaPk8Cd5ovskxFFvFd0+auIopCo1YHyH+6199qK+d18=";

From 1772e1331ad2c64e7081a917472bada21c661342 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 07:29:05 +0000
Subject: [PATCH 379/525] python3Packages.lg-rs232-tv: 1.2.0 -> 1.3.0

---
 pkgs/development/python-modules/lg-rs232-tv/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/lg-rs232-tv/default.nix b/pkgs/development/python-modules/lg-rs232-tv/default.nix
index ee78cae64c73..2d871e34cb58 100644
--- a/pkgs/development/python-modules/lg-rs232-tv/default.nix
+++ b/pkgs/development/python-modules/lg-rs232-tv/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "lg-rs232-tv";
-  version = "1.2.0";
+  version = "1.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
     repo = "lg-rs232-tv";
     tag = finalAttrs.version;
-    hash = "sha256-gMjRyZ/gUMAsS0v465ISD38YAlrOB8N/5VAFZkXtyAE=";
+    hash = "sha256-dnXu5UVqUlKMQTBOsFDa/9Jco2OR07UDR1yhWKftQ4o=";
   };
 
   postPatch = ''

From 947cdd756c3517fc3e63ad36544b1a867170c015 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Sun, 11 Oct 2026 09:29:34 +0200
Subject: [PATCH 380/525] maintainers: update grimmauld

- change the email to my self-hosted one
- change matrix handle to my current homeserver
- change github handle
  - I changed my handle in github as I no longer felt comfortable with my old handle
  - rename of the entry on committer list will follow
---
 maintainers/maintainer-list.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 20f82df9919e..ff3b66bfbf2e 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -10922,10 +10922,10 @@
   };
   grimmauld = {
     name = "Sören Bender";
-    email = "soeren@benjos.de";
-    github = "LordGrimmauld";
+    email = "grimmauld@grimmauld.de";
+    github = "GrimmTheShrimp";
     githubId = 49513131;
-    matrix = "@grimmauld:grimmauld.de";
+    matrix = "@grimmauld:m.grimmauld.de";
   };
   grindhold = {
     name = "grindhold";

From 1487b3d49396640f275bb423e9195caf8677956e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 07:45:14 +0000
Subject: [PATCH 381/525] python3Packages.rucio: 41.3.0 -> 41.4.0

---
 pkgs/development/python-modules/rucio/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/rucio/default.nix b/pkgs/development/python-modules/rucio/default.nix
index 933939dd5d2f..4408cafa3ef0 100644
--- a/pkgs/development/python-modules/rucio/default.nix
+++ b/pkgs/development/python-modules/rucio/default.nix
@@ -39,13 +39,13 @@
 }:
 
 let
-  version = "41.3.0";
+  version = "41.4.0";
 
   src = fetchFromGitHub {
     owner = "rucio";
     repo = "rucio";
     tag = version;
-    hash = "sha256-POVV0conRsDBbvK2tmy8USv2WpgPKhNvGB3aXAGcuMc=";
+    hash = "sha256-C1COIE3q9Fozw8pFikhzS/tR1huLJcZtwd/DOYvz6+o=";
   };
 in
 buildPythonPackage {

From 3e5de57d0b48e17e0e5244a2fd1c577dad95fa3b Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 11 Oct 2026 09:47:54 +0200
Subject: [PATCH 382/525] python3Packages.connect-box: 0.4.0 -> 0.5.0

Changelog: https://github.com/home-assistant-ecosystem/python-connect-box/releases/tag/0.5.0
---
 .../python-modules/connect-box/default.nix    | 25 ++++++++-----------
 1 file changed, 10 insertions(+), 15 deletions(-)

diff --git a/pkgs/development/python-modules/connect-box/default.nix b/pkgs/development/python-modules/connect-box/default.nix
index f32defffe207..630d68ff3ce9 100644
--- a/pkgs/development/python-modules/connect-box/default.nix
+++ b/pkgs/development/python-modules/connect-box/default.nix
@@ -5,28 +5,28 @@
   buildPythonPackage,
   defusedxml,
   fetchFromGitHub,
+  hatchling,
   pytest-asyncio,
-  pytestCheckHook,
-  setuptools,
   pytest-vcr,
+  pytestCheckHook,
   syrupy,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "connect-box";
-  version = "0.4.0";
+  version = "0.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "home-assistant-ecosystem";
     repo = "python-connect-box";
-    tag = version;
-    hash = "sha256-zUvZRnxVzg9izvUbp7QVcyu6Bw3dUXHOr0kOQRWEZVc=";
+    tag = finalAttrs.version;
+    hash = "sha256-lQfa/GP9XSQJrPBIIR7PZR8F0cmDueTcFDIJTbopRv4=";
   };
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ hatchling ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     aiohttp
     attrs
     defusedxml
@@ -41,11 +41,6 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "connect_box" ];
 
-  pytestFlags = [
-    "--vcr-record=none"
-    "-Wignore::DeprecationWarning"
-  ];
-
   meta = {
     description = "Interact with a Compal CH7465LG cable modem/router";
     longDescription = ''
@@ -55,8 +50,8 @@ buildPythonPackage rec {
       Hub 3.0 (IE), Ziggo Connectbox (NL) or Unitymedia Connect Box (DE).
     '';
     homepage = "https://github.com/home-assistant-ecosystem/python-connect-box";
-    changelog = "https://github.com/home-assistant-ecosystem/python-connect-box/releases/tag/${version}";
+    changelog = "https://github.com/home-assistant-ecosystem/python-connect-box/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

From f0aac80bd4eac9b8ba7c089b73fa16d4e729458e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 07:51:16 +0000
Subject: [PATCH 383/525] postgresqlPackages.pg-semver: 0.41.0 -> 0.42.0

---
 pkgs/servers/sql/postgresql/ext/pg-semver.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/ext/pg-semver.nix b/pkgs/servers/sql/postgresql/ext/pg-semver.nix
index 1f598447f027..287aa4d31bbc 100644
--- a/pkgs/servers/sql/postgresql/ext/pg-semver.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg-semver.nix
@@ -8,13 +8,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "pg-semver";
-  version = "0.41.0";
+  version = "0.42.0";
 
   src = fetchFromGitHub {
     owner = "theory";
     repo = "pg-semver";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-b/fXPOPjjwSAy4GlyHjZsPVFEvdYYO4qkwFAfrmY+OE=";
+    hash = "sha256-PxhywN53nTkvu7Uvc12UUFVrjYQ7fosd5J4ple7LSoU=";
   };
 
   passthru.tests = {

From 3a39ad31c1092a9ec0ac80cc17baf6e945a3179e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 08:02:09 +0000
Subject: [PATCH 384/525] vacuum-tube: 1.8.2 -> 2.0.0

---
 pkgs/by-name/va/vacuum-tube/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/va/vacuum-tube/package.nix b/pkgs/by-name/va/vacuum-tube/package.nix
index f68fa7fb8a6a..dc6b74df3c2c 100644
--- a/pkgs/by-name/va/vacuum-tube/package.nix
+++ b/pkgs/by-name/va/vacuum-tube/package.nix
@@ -10,16 +10,16 @@
 
 buildNpmPackage rec {
   pname = "vacuum-tube";
-  version = "1.8.2";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "shy1132";
     repo = "VacuumTube";
     tag = "v${version}";
-    hash = "sha256-KgXV6fSvV6jl8V2YEjJm+CIG8ATvb1/iEhLog91DPY0=";
+    hash = "sha256-OA3UjqJTELqe2nn2y2/ztQxipENt873Iw5WDsjyjjRc=";
   };
 
-  npmDepsHash = "sha256-Wtyft343sSs018v5bagCvvta5z+yzU9IgkJ4LH+HQzs=";
+  npmDepsHash = "sha256-kKyOjpl6LwUOdWP5+AN8m2RxMcDhzov3YLw1rhUna3k=";
   makeCacheWritable = true;
 
   env = {

From f637fdcc1dc802fb4c4b8c1ec7477e1b73bb8d3b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 08:02:39 +0000
Subject: [PATCH 385/525] fable: 5.18.0 -> 5.20.0

---
 pkgs/by-name/fa/fable/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fa/fable/package.nix b/pkgs/by-name/fa/fable/package.nix
index df4d3cf7ffc2..0fbee50db548 100644
--- a/pkgs/by-name/fa/fable/package.nix
+++ b/pkgs/by-name/fa/fable/package.nix
@@ -7,9 +7,9 @@
 
 buildDotnetGlobalTool (finalAttrs: {
   pname = "fable";
-  version = "5.18.0";
+  version = "5.20.0";
 
-  nugetHash = "sha256-zaa7UJnn5IM7fhGUBmogRUDe/2rpH79UR+k6dym7kmQ=";
+  nugetHash = "sha256-sMzIlCx/XiCTqFq/3N2naZXX7HbSsq74F48D6aMDqpg=";
 
   dotnet-sdk = dotnetCorePackages.sdk_10_0;
   dotnet-runtime = dotnetCorePackages.runtime_10_0;

From 80fb15eb2be337052d69ff5d1896906d35dff955 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 08:19:57 +0000
Subject: [PATCH 386/525] pods: 3.1.1 -> 3.2.0

---
 pkgs/by-name/po/pods/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/po/pods/package.nix b/pkgs/by-name/po/pods/package.nix
index 47994603b8ea..8fe86a2d3f16 100644
--- a/pkgs/by-name/po/pods/package.nix
+++ b/pkgs/by-name/po/pods/package.nix
@@ -23,18 +23,18 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "pods";
-  version = "3.1.1";
+  version = "3.2.0";
 
   src = fetchFromGitHub {
     owner = "marhkb";
     repo = "pods";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tI3ZFR4DYdcIH+MYpRgjRXnbL0HOVcPG3x7mrMWwGOY=";
+    hash = "sha256-9uZMERhCh3OFdJ7XnVDRm0ponRuSIIj/7lq3vVopv0s=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-g1xk4Haz8Q04ASOpfoiRC36oaszl3pqkLV0rgiJgGN4=";
+    hash = "sha256-Qje5GJG6LnFQAPIZkxo7xinU1AlFUXHMK/yBLO7+mPw=";
   };
 
   nativeBuildInputs = [

From af4138fe50aef3b4662edc6a0ddface0e8bd3ee6 Mon Sep 17 00:00:00 2001
From: Thomas Butter <tbutter@gmail.com>
Date: Sun, 11 Oct 2026 08:06:13 +0000
Subject: [PATCH 387/525] cbirds: init at 1.6.0

---
 pkgs/by-name/cb/cbirds/package.nix | 42 ++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)
 create mode 100644 pkgs/by-name/cb/cbirds/package.nix

diff --git a/pkgs/by-name/cb/cbirds/package.nix b/pkgs/by-name/cb/cbirds/package.nix
new file mode 100644
index 000000000000..08aadf84aa77
--- /dev/null
+++ b/pkgs/by-name/cb/cbirds/package.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "cbirds";
+  version = "1.6.0";
+
+  src = fetchFromGitHub {
+    owner = "clainstone";
+    repo = "cbirds";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-MMctTFtEUYt3xn7gFYWcMlRFLkFXW+wu6/hTtTkO6Og=";
+  };
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  installFlags = [ "PREFIX=${placeholder "out"}" ];
+
+  doCheck = true;
+  checkTarget = "test";
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Flock of birds (Craig Reynolds' boids) in your terminal";
+    homepage = "https://github.com/clainstone/cbirds";
+    changelog = "https://github.com/clainstone/cbirds/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ tbutter ];
+    mainProgram = "cbirds";
+    platforms = lib.platforms.unix;
+  };
+})

From dd5864e73421623d49aaf5305e4732fafe30b742 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 11 Oct 2026 10:36:41 +0200
Subject: [PATCH 388/525] python3Packages.yalexs: disable failing test

---
 pkgs/development/python-modules/yalexs/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/yalexs/default.nix b/pkgs/development/python-modules/yalexs/default.nix
index 3aaf74a50b39..6b4a8fa4b51d 100644
--- a/pkgs/development/python-modules/yalexs/default.nix
+++ b/pkgs/development/python-modules/yalexs/default.nix
@@ -63,6 +63,7 @@ buildPythonPackage (finalAttrs: {
   disabledTests = [
     # aiohttp api breakage, remove when bumping to 9.2.8 or newer
     "test__raise_response_exceptions"
+    "test_async_refresh_token"
   ];
 
   pythonImportsCheck = [ "yalexs" ];

From 0a72a40906d9b92582aeb2a0d78f92e06d34ec5c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 08:44:07 +0000
Subject: [PATCH 389/525] python3Packages.google-cloud-trace: 1.20.0 -> 1.21.0

---
 .../development/python-modules/google-cloud-trace/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-trace/default.nix b/pkgs/development/python-modules/google-cloud-trace/default.nix
index 0166e8e10dfc..d606457365f7 100644
--- a/pkgs/development/python-modules/google-cloud-trace/default.nix
+++ b/pkgs/development/python-modules/google-cloud-trace/default.nix
@@ -14,13 +14,13 @@
 
 buildPythonPackage rec {
   pname = "google-cloud-trace";
-  version = "1.20.0";
+  version = "1.21.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_trace";
     inherit version;
-    hash = "sha256-9ab5uNpTC3bEUhY7g+UIHBaW8bT2cpDIeLDnNw8ekQo=";
+    hash = "sha256-Xg4CtR253vC+0vg2J/pQQ6juzQDkd6f7mNHgTDGnE8A=";
   };
 
   build-system = [ setuptools ];

From 80a2b5423f82002714565e99029f2fd2c48baa9b Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 11 Oct 2026 11:45:24 +0300
Subject: [PATCH 390/525] picard: fix build with pyobj-framework missing dep

---
 pkgs/by-name/pi/picard/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/pi/picard/package.nix b/pkgs/by-name/pi/picard/package.nix
index 581ce38d5002..9cae641a94a4 100644
--- a/pkgs/by-name/pi/picard/package.nix
+++ b/pkgs/by-name/pi/picard/package.nix
@@ -66,6 +66,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     ++ lib.optionals stdenv.hostPlatform.isDarwin [
       pyobjc-core
       pyobjc-framework-Cocoa
+      pyobjc-framework-MediaPlayer
     ]
   );
 

From 382bf76dfc36a3719513b1ed05ea3fd8380eb963 Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Fri, 9 Oct 2026 23:12:48 +0200
Subject: [PATCH 391/525] picard: 3.0 -> 3.0.1

Changelog: https://github.com/metabrainz/picard/releases/tag/release-3.0.1
Diff: https://github.com/metabrainz/picard/compare/release-3.0...release-3.0.1
---
 pkgs/by-name/pi/picard/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pi/picard/package.nix b/pkgs/by-name/pi/picard/package.nix
index 9cae641a94a4..adb31b9384ca 100644
--- a/pkgs/by-name/pi/picard/package.nix
+++ b/pkgs/by-name/pi/picard/package.nix
@@ -17,7 +17,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "picard";
-  version = "3.0";
+  version = "3.0.1";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -25,7 +25,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "metabrainz";
     repo = "picard";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-aUiXmiGZTg2nQtHlE8B1/DFgvK5jLVOzN8i21fPsNk4=";
+    hash = "sha256-CvL/jD+/MiYgSjbQS3nbVkL09TEZCgqGgXdDTRlCsAo=";
   };
 
   nativeBuildInputs = [

From 26d6a204e581f0daaa8d4d4291e9a0e8679b09e2 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Sun, 11 Oct 2026 11:51:35 +0300
Subject: [PATCH 392/525] linux: don't fail if sourceRoot is already source

If the source is a fetchFromGitHub or a flake input, the sourceRoot
will already be "source", and postUnpack will try to move it inside
itself.

Co-authored-by: Tom Hubrecht <tom@hubrecht.ovh>
---
 pkgs/os-specific/linux/kernel/build.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/os-specific/linux/kernel/build.nix b/pkgs/os-specific/linux/kernel/build.nix
index f9db4974c5d4..892d58b439cf 100644
--- a/pkgs/os-specific/linux/kernel/build.nix
+++ b/pkgs/os-specific/linux/kernel/build.nix
@@ -365,7 +365,7 @@ lib.makeOverridable (
     '';
 
     postUnpack = ''
-      mv "$sourceRoot" source
+      mv -Tn "$sourceRoot" source
       sourceRoot=source
     '';
 

From 9d25903ab8f699d87ffa0874d738d97b84b4d0af Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 09:05:09 +0000
Subject: [PATCH 393/525] python3Packages.zwave-js-server-python: 0.73.1 ->
 0.74.0

---
 .../python-modules/zwave-js-server-python/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/zwave-js-server-python/default.nix b/pkgs/development/python-modules/zwave-js-server-python/default.nix
index 43e06c64c75e..db687315557e 100644
--- a/pkgs/development/python-modules/zwave-js-server-python/default.nix
+++ b/pkgs/development/python-modules/zwave-js-server-python/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "zwave-js-server-python";
-  version = "0.73.1";
+  version = "0.74.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
     repo = "zwave-js-server-python";
     tag = finalAttrs.version;
-    hash = "sha256-KhVXaqGFbLnaLaP0LbFWV7GiRXycQ00EYaNR8VqtWe8=";
+    hash = "sha256-a4OYCR+Bi1GvE7BgnGm74GDo3xlRAPdIsWMGXwpBolc=";
   };
 
   build-system = [ setuptools ];

From ef521f5162b715cb7682d830b371e8086741f2cd Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 09:05:45 +0000
Subject: [PATCH 394/525] museum: 1.3.64 -> 1.3.65

---
 pkgs/by-name/mu/museum/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mu/museum/package.nix b/pkgs/by-name/mu/museum/package.nix
index a3157e99aae6..2f042f648fda 100644
--- a/pkgs/by-name/mu/museum/package.nix
+++ b/pkgs/by-name/mu/museum/package.nix
@@ -10,17 +10,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "museum";
-  version = "1.3.64";
+  version = "1.3.65";
 
   src = fetchFromGitHub {
     owner = "ente";
     repo = "ente";
     sparseCheckout = [ "server" ];
     tag = "photos-v${finalAttrs.version}";
-    hash = "sha256-QX+XrA2lAbmP5O36ViAwBmR1yRJw+35SH4PaG9qOuyw=";
+    hash = "sha256-VzeawAO4nGE5lwaRMSznbX0qwrvCbTaZxoi7hxCvTj8=";
   };
 
-  vendorHash = "sha256-iiytPsRsu0iBqDwSr5NavRfWOd/7ZLd5KBpLDuTkbz0=";
+  vendorHash = "sha256-NADYbTkO0ng3lYll9+W7ICGOkUuYim8FRLtkoraMgRY=";
 
   sourceRoot = "${finalAttrs.src.name}/server";
 

From 6f4527d7a12cf09f3498e3af5fc49bec00e9450a Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 5 Sep 2026 02:02:49 +0200
Subject: [PATCH 395/525] python3Packages.ida-domain: 0.5.0 -> 0.5.1

Diff: https://github.com/HexRaysSA/ida-domain/compare/v0.5.0...v0.5.1

Changelog: https://github.com/HexRaysSA/ida-domain/releases/tag/v0.5.1
---
 pkgs/development/python-modules/ida-domain/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/ida-domain/default.nix b/pkgs/development/python-modules/ida-domain/default.nix
index 3574a4ee0c93..f23b15c7fcd3 100644
--- a/pkgs/development/python-modules/ida-domain/default.nix
+++ b/pkgs/development/python-modules/ida-domain/default.nix
@@ -3,19 +3,19 @@
   buildPythonPackage,
   fetchFromGitHub,
   graphviz,
+  hatchling,
   idapro,
   nix-update-script,
   packaging,
   pytest-cov-stub,
   pytestCheckHook,
-  setuptools,
   typing-extensions,
   writableTmpDirAsHomeHook,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "ida-domain";
-  version = "0.5.0";
+  version = "0.5.1";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -24,10 +24,10 @@ buildPythonPackage (finalAttrs: {
     owner = "HexRaysSA";
     repo = "ida-domain";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oa3VQgWDEr4tPQ166EugfS7QrW1DlRb/hwypwKP+Xv4=";
+    hash = "sha256-vlVJnRaRNMelQ3w1SgCDvtIQJKBuULLOqKKdAvDK2y4=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [ hatchling ];
 
   dependencies = [
     idapro

From 8d034120f9a91303bf656e62b2f3acb63803e74d Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 5 Sep 2026 02:06:10 +0200
Subject: [PATCH 396/525] python3Packages.ida-hcli: 0.18.5 -> 0.21.0

Changelog: https://github.com/HexRaysSA/ida-hcli/blob/refs/tags/v0.21.0/CHANGELOG.md
---
 pkgs/development/python-modules/ida-hcli/default.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/ida-hcli/default.nix b/pkgs/development/python-modules/ida-hcli/default.nix
index a8ffdb60c9ec..fde793025e70 100644
--- a/pkgs/development/python-modules/ida-hcli/default.nix
+++ b/pkgs/development/python-modules/ida-hcli/default.nix
@@ -27,7 +27,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ida-hcli";
-  version = "0.18.5";
+  version = "0.21.0";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -36,7 +36,7 @@ buildPythonPackage (finalAttrs: {
     owner = "HexRaysSA";
     repo = "ida-hcli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-n8hLgVgxqaU7Au6HVgOEUKOm1LV3Wx/v42gi2gOD3Jk=";
+    hash = "sha256-GCR+DcZ3RZevfS2OO44LpkiQ7Fk1WtZpivLh2VONbHg=";
   };
 
   build-system = [ setuptools ];
@@ -73,7 +73,6 @@ buildPythonPackage (finalAttrs: {
     "tests/integration/"
     "tests/lib/test_ida_python.py"
     "tests/lib/test_ida.py"
-    "tests/lib/test_plugin_bundle_install.py"
     "tests/lib/test_plugin_collisions.py"
     "tests/lib/test_plugin_install.py"
     "tests/lib/test_plugin_records.py"

From 8e5f32e5dedef6fc28db6f11b7f5583357f45b1d Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Sun, 11 Oct 2026 11:33:44 +0200
Subject: [PATCH 397/525] lazygit: 0.66.0 -> 0.66.1

Changelog: https://github.com/jesseduffield/lazygit/releases/tag/v0.66.1
Diff: https://github.com/jesseduffield/lazygit/compare/v0.66.0...v0.66.1
---
 pkgs/by-name/la/lazygit/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/la/lazygit/package.nix b/pkgs/by-name/la/lazygit/package.nix
index 66c6b57091bd..7c6b68b0a82c 100644
--- a/pkgs/by-name/la/lazygit/package.nix
+++ b/pkgs/by-name/la/lazygit/package.nix
@@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "lazygit";
-  version = "0.66.0";
+  version = "0.66.1";
 
   src = fetchFromGitHub {
     owner = "jesseduffield";
     repo = "lazygit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2edvYQQxCkGNj3CJrLibaUgFF+uxnwULlO7G6SdgWPU=";
+    hash = "sha256-87OrUGi7xhQhAzV6S3r5evlLWt/1anheCd58v6GW42g=";
   };
 
   vendorHash = null;

From 470d73b71e70376a62198c205a9096ec0683b211 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 09:45:13 +0000
Subject: [PATCH 398/525] reindeer: 2026.09.28.00 -> 2026.10.05.00

---
 pkgs/by-name/re/reindeer/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/re/reindeer/package.nix b/pkgs/by-name/re/reindeer/package.nix
index dcf4e5b4170e..a21fed03a314 100644
--- a/pkgs/by-name/re/reindeer/package.nix
+++ b/pkgs/by-name/re/reindeer/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "reindeer";
-  version = "2026.09.28.00";
+  version = "2026.10.05.00";
 
   src = fetchFromGitHub {
     owner = "facebookincubator";
     repo = "reindeer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ruOXPHqLJfk/Y6EHssb4wF1iFHgVKPmjJ6ydtU2hE44=";
+    hash = "sha256-ZaK2T/v7oVwzzQHsHUiM4hEdpmd7g7yRCRqVIwMCL8k=";
   };
 
-  cargoHash = "sha256-WMzXFVdl80PREiRG1uP+dPBEr5So9eV/gg1g+AeGDLc=";
+  cargoHash = "sha256-C/3mmSDv9g1rrkJxwBIk6Jb5YBxNRXNi6UEgaguOpmc=";
 
   nativeBuildInputs = [ pkg-config ];
 

From 9126f2b3e1a2adf2c3ab9a99b1ece960731faf81 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 09:48:33 +0000
Subject: [PATCH 399/525] python3Packages.google-cloud-workflows: 1.23.0 ->
 1.24.0

---
 .../python-modules/google-cloud-workflows/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/google-cloud-workflows/default.nix b/pkgs/development/python-modules/google-cloud-workflows/default.nix
index 5c147f3c176b..f99d6157c706 100644
--- a/pkgs/development/python-modules/google-cloud-workflows/default.nix
+++ b/pkgs/development/python-modules/google-cloud-workflows/default.nix
@@ -13,13 +13,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "google-cloud-workflows";
-  version = "1.23.0";
+  version = "1.24.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "google_cloud_workflows";
     inherit (finalAttrs) version;
-    hash = "sha256-vo4IpdE0GG2834Z8BbFZrYrH3jtkJbIb76q39PJY1Kg=";
+    hash = "sha256-AP3XgkAq8gqoI9gargPd+JSxu3YcfZTLsqkQWaBthCI=";
   };
 
   build-system = [ setuptools ];

From be822aca388467cf4eeb7c2edeecf73f91c886db Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 11 Oct 2026 11:55:24 +0200
Subject: [PATCH 400/525] ldapin: init at 0.1.1

CLI tool to perform basic LDAP task for security assessments

https://github.com/affolter-engineering/ldapin
---
 pkgs/by-name/ld/ldapin/package.nix | 37 ++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)
 create mode 100644 pkgs/by-name/ld/ldapin/package.nix

diff --git a/pkgs/by-name/ld/ldapin/package.nix b/pkgs/by-name/ld/ldapin/package.nix
new file mode 100644
index 000000000000..0d4225c944d7
--- /dev/null
+++ b/pkgs/by-name/ld/ldapin/package.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+  rustPlatform,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "ldapin";
+  version = "0.1.1";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "affolter-engineering";
+    repo = "ldapin";
+    tag = finalAttrs.version;
+    hash = "sha256-bo0TY9EVIe2etJKeVJBbhYdS7DEe4XgeClkYq8NGDfA=";
+  };
+
+  cargoHash = "sha256-0wKHutC6ZXPKQT7ucjZSXd6VbrzrzTlXGjI0ll0ZQvU=";
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "CLI tool to perform basic LDAP task for security assessments";
+    homepage = "https://github.com/affolter-engineering/ldapin";
+    changelog = "https://github.com/affolter-engineering/ldapin/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "ldapin";
+  };
+})

From 27caefee03aab8660c0c37c66bcce4dbe18b5172 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 09:55:43 +0000
Subject: [PATCH 401/525] python3Packages.ibm-cloud-sdk-core: 3.26.2 -> 3.28.0

---
 .../development/python-modules/ibm-cloud-sdk-core/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix b/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix
index 95e3642d9361..df519540468f 100644
--- a/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix
+++ b/pkgs/development/python-modules/ibm-cloud-sdk-core/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "ibm-cloud-sdk-core";
-  version = "3.26.2";
+  version = "3.28.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "IBM";
     repo = "python-sdk-core";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-i3j4E8egDjO8sJt3wLn4ZyJH8jS0BF8y5LY0iEhJpLo=";
+    hash = "sha256-kqpoV65z4lr+VGZJDL0hQsQ5oWpdFSJBISxDtl75KH4=";
   };
 
   pythonRelaxDeps = [ "requests" ];

From bd39917bd99da777907f718cf8a46fdffc379c00 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 09:58:56 +0000
Subject: [PATCH 402/525] databricks-cli: 1.18.0 -> 1.20.0

---
 pkgs/by-name/da/databricks-cli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/da/databricks-cli/package.nix b/pkgs/by-name/da/databricks-cli/package.nix
index 06284e99f7f5..1b31ee86bba7 100644
--- a/pkgs/by-name/da/databricks-cli/package.nix
+++ b/pkgs/by-name/da/databricks-cli/package.nix
@@ -9,7 +9,7 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "databricks-cli";
-  version = "1.18.0";
+  version = "1.20.0";
 
   __structuredAttrs = true;
 
@@ -17,10 +17,10 @@ buildGoModule (finalAttrs: {
     owner = "databricks";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-I0w62sVpL27gtnir8mZtGs6PbsNH8nwWc5JyCXfnlqI=";
+    hash = "sha256-RFtDUvoJskKikLQyunVo5DN0Hr5s/hlKjgl8Y+c2W48=";
   };
 
-  vendorHash = "sha256-6b++JxHIU6Zhv4357nEH4VHnCOty9KOMbwM6gVHU2qE=";
+  vendorHash = "sha256-moXbF1k1zg5DwVxysaK0ULYx7Ldh4V7SBt9PXI4NAdk=";
 
   subPackages = [ "." ];
 

From 73230461035b38a1eaf37867871cc51fed695dfa Mon Sep 17 00:00:00 2001
From: Dmitry Bogatov <kaction.cc@gmail.com>
Date: Sat, 10 Oct 2026 12:43:49 +0000
Subject: [PATCH 403/525] apacheHttpdPackages.mod_crl: migrate to finalAttrs

Assisted-by: claude-opus-4-8
---
 pkgs/servers/http/apache-modules/mod_crl/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/http/apache-modules/mod_crl/default.nix b/pkgs/servers/http/apache-modules/mod_crl/default.nix
index eb840288de78..24d8f25c1882 100644
--- a/pkgs/servers/http/apache-modules/mod_crl/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_crl/default.nix
@@ -9,12 +9,12 @@
   stdenv,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mod_crl";
   version = "0.2.4";
 
   src = fetchurl {
-    url = "https://redwax.eu/dist/rs/${pname}-${version}.tar.gz";
+    url = "https://redwax.eu/dist/rs/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
     hash = "sha256-w8YIhed9J1uo5uwhfOVe5LhNLUvFZCgUO4FrHm344Rg=";
   };
 
@@ -40,4 +40,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ dirkx ];
   };
-}
+})

From f39a916cae05224baad1cbc3308b97b164e73db5 Mon Sep 17 00:00:00 2001
From: Dmitry Bogatov <kaction.cc@gmail.com>
Date: Sat, 10 Oct 2026 12:43:50 +0000
Subject: [PATCH 404/525] apacheHttpdPackages.mod_csr: migrate to finalAttrs

Assisted-by: claude-opus-4-8
---
 pkgs/servers/http/apache-modules/mod_csr/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/http/apache-modules/mod_csr/default.nix b/pkgs/servers/http/apache-modules/mod_csr/default.nix
index 5e8b8faa6b40..f4fabdcd616b 100644
--- a/pkgs/servers/http/apache-modules/mod_csr/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_csr/default.nix
@@ -9,12 +9,12 @@
   stdenv,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mod_csr";
   version = "0.2.4";
 
   src = fetchurl {
-    url = "https://redwax.eu/dist/rs/${pname}-${version}.tar.gz";
+    url = "https://redwax.eu/dist/rs/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
     hash = "sha256-JVd5N5UnAxDwq6AavEHA0HsY2TRa+9RmLLJeRZbj+4Q=";
   };
 
@@ -40,4 +40,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ dirkx ];
   };
-}
+})

From a0b41822e3257c5b5eeff12f095488e3bfd673ca Mon Sep 17 00:00:00 2001
From: Dmitry Bogatov <kaction.cc@gmail.com>
Date: Sat, 10 Oct 2026 12:43:51 +0000
Subject: [PATCH 405/525] apacheHttpdPackages.mod_ocsp: migrate to finalAttrs

Assisted-by: claude-opus-4-8
---
 pkgs/servers/http/apache-modules/mod_ocsp/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/http/apache-modules/mod_ocsp/default.nix b/pkgs/servers/http/apache-modules/mod_ocsp/default.nix
index 92bdbcee2fa9..9a8502c13deb 100644
--- a/pkgs/servers/http/apache-modules/mod_ocsp/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_ocsp/default.nix
@@ -9,12 +9,12 @@
   stdenv,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mod_ocsp";
   version = "0.2.3";
 
   src = fetchurl {
-    url = "https://redwax.eu/dist/rs/${pname}-${version}.tar.gz";
+    url = "https://redwax.eu/dist/rs/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
     hash = "sha256-G+m/KdJCCTlSMeJzUnCRJkBEQ8cOQ+rJhA3NPrwh1Us=";
   };
 
@@ -40,4 +40,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ dirkx ];
   };
-}
+})

From e8ad43908547da9e9ef8be6a25c1daef925ac283 Mon Sep 17 00:00:00 2001
From: Dmitry Bogatov <kaction.cc@gmail.com>
Date: Sat, 10 Oct 2026 12:43:52 +0000
Subject: [PATCH 406/525] apacheHttpdPackages.mod_perl: migrate to finalAttrs

Assisted-by: claude-opus-4-8
---
 pkgs/servers/http/apache-modules/mod_perl/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/http/apache-modules/mod_perl/default.nix b/pkgs/servers/http/apache-modules/mod_perl/default.nix
index 4c08d2aaf22d..b6dd43ce4fe3 100644
--- a/pkgs/servers/http/apache-modules/mod_perl/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_perl/default.nix
@@ -8,12 +8,12 @@
   stdenv,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mod_perl";
   version = "2.0.13";
 
   src = fetchurl {
-    url = "mirror://apache/perl/${pname}-${version}.tar.gz";
+    url = "mirror://apache/perl/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
     sha256 = "sha256-reO+McRHuESIaf7N/KziWNbVh7jGx3PF8ic19w2C1to=";
   };
 
@@ -55,4 +55,4 @@ stdenv.mkDerivation rec {
     maintainers = [ ];
     platforms = lib.platforms.unix;
   };
-}
+})

From dd40e897716a818d1c04e7deb621b71fe2246cc5 Mon Sep 17 00:00:00 2001
From: Dmitry Bogatov <kaction.cc@gmail.com>
Date: Sat, 10 Oct 2026 12:43:54 +0000
Subject: [PATCH 407/525] apacheHttpdPackages.mod_pkcs12: migrate to finalAttrs

Assisted-by: claude-opus-4-8
---
 pkgs/servers/http/apache-modules/mod_pkcs12/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/http/apache-modules/mod_pkcs12/default.nix b/pkgs/servers/http/apache-modules/mod_pkcs12/default.nix
index d7a216b6ee07..f6bab9b9b78b 100644
--- a/pkgs/servers/http/apache-modules/mod_pkcs12/default.nix
+++ b/pkgs/servers/http/apache-modules/mod_pkcs12/default.nix
@@ -9,12 +9,12 @@
   stdenv,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "mod_pkcs12";
   version = "0.2.3";
 
   src = fetchurl {
-    url = "https://redwax.eu/dist/rs/${pname}-${version}.tar.gz";
+    url = "https://redwax.eu/dist/rs/${finalAttrs.pname}-${finalAttrs.version}.tar.gz";
     hash = "sha256-k7BZ5d0WigyTmoUyFds7UCJ/tFBiUxd5pS4cVxmAI1g=";
   };
 
@@ -40,4 +40,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ dirkx ];
   };
-}
+})

From dfd57e20d70f751cf433cddaee0874c74fdd4991 Mon Sep 17 00:00:00 2001
From: Dmitry Bogatov <kaction.cc@gmail.com>
Date: Sat, 10 Oct 2026 18:36:58 +0000
Subject: [PATCH 408/525] rcshist: enable strictDeps and structuredAttrs

---
 pkgs/by-name/rc/rcshist/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/rc/rcshist/package.nix b/pkgs/by-name/rc/rcshist/package.nix
index 098a9308178a..e7a5b0437636 100644
--- a/pkgs/by-name/rc/rcshist/package.nix
+++ b/pkgs/by-name/rc/rcshist/package.nix
@@ -13,6 +13,9 @@ stdenv.mkDerivation {
 
   buildInputs = lib.optional stdenv.hostPlatform.isMusl musl-fts;
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchurl {
     url = "https://web.archive.org/web/20220508220019/https://invisible-island.net/datafiles/release/rcshist.tar.gz";
     sha256 = "01ab3xwgm934lxr8bm758am3vxwx4hxx7cc9prbgqj5nh30vdg1n";

From 0e54deaf8f2e616a642ad3887f4a13dab68fedc5 Mon Sep 17 00:00:00 2001
From: Dmitry Bogatov <kaction.cc@gmail.com>
Date: Sat, 10 Oct 2026 18:05:38 +0000
Subject: [PATCH 409/525] pkgsStatic.mc: fix build

---
 pkgs/by-name/mc/mc/package.nix | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/mc/mc/package.nix b/pkgs/by-name/mc/mc/package.nix
index 8bc916ea2253..fa63ec0295b2 100644
--- a/pkgs/by-name/mc/mc/package.nix
+++ b/pkgs/by-name/mc/mc/package.nix
@@ -83,12 +83,14 @@ stdenv.mkDerivation (finalAttrs: {
       --replace /bin/rm ${coreutils}/bin/rm
   '';
 
-  postFixup = lib.optionalString ((!stdenv.hostPlatform.isDarwin) && x11Support) ''
-    # libX11.so is loaded dynamically so autopatch doesn't detect it
-    patchelf \
-      --add-needed ${libx11}/lib/libX11.so \
-      $out/bin/mc
-  '';
+  postFixup =
+    lib.optionalString (!stdenv.hostPlatform.isDarwin && x11Support && !stdenv.hostPlatform.isStatic)
+      ''
+        # libX11.so is loaded dynamically so autopatch doesn't detect it
+        patchelf \
+          --add-needed ${libx11}/lib/libX11.so \
+          $out/bin/mc
+      '';
 
   passthru.updateScript = writeScript "update-mc" ''
     #!/usr/bin/env nix-shell

From fcb9e397383343e54cc55b49ea2b6a574d860028 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 11 Oct 2026 12:03:38 +0200
Subject: [PATCH 410/525] postgresqlPackages.wal2jon: 2.6 -> 2.7

Release Notes:
https://github.com/eulerto/wal2json/releases/tag/wal2json_2_7
---
 pkgs/servers/sql/postgresql/ext/wal2json.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/ext/wal2json.nix b/pkgs/servers/sql/postgresql/ext/wal2json.nix
index 44a54bf17a9e..3aa405eb52b2 100644
--- a/pkgs/servers/sql/postgresql/ext/wal2json.nix
+++ b/pkgs/servers/sql/postgresql/ext/wal2json.nix
@@ -9,13 +9,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "wal2json";
-  version = "2.6";
+  version = "2.7";
 
   src = fetchFromGitHub {
     owner = "eulerto";
     repo = "wal2json";
     tag = "wal2json_${lib.replaceString "." "_" finalAttrs.version}";
-    hash = "sha256-+QoACPCKiFfuT2lJfSUmgfzC5MXf75KpSoc2PzPxKyM=";
+    hash = "sha256-9MgrR5szMoFskiyG162AuqNw3k+YznN/sjIAScLFP/8=";
   };
 
   makeFlags = [ "USE_PGXS=1" ];

From 3cd7bb37a993adb766f3c3617cc0f3583d0f01c0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sun, 11 Oct 2026 12:06:22 +0200
Subject: [PATCH 411/525] 
 home-assistant-custom-lovelace-modules.tankerkoenig-card: 1.9.1 -> 1.9.2

Diff: https://github.com/timmaurice/lovelace-tankerkoenig-card/compare/1.9.1...1.9.2

Changelog: https://github.com/timmaurice/lovelace-tankerkoenig-card/releases/tag/1.9.2
---
 .../custom-lovelace-modules/tankerkoenig-card/package.nix   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/tankerkoenig-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/tankerkoenig-card/package.nix
index 157b03edab84..0ef45e28059a 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/tankerkoenig-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/tankerkoenig-card/package.nix
@@ -6,16 +6,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "tankerkoenig-card";
-  version = "1.9.1";
+  version = "1.9.2";
 
   src = fetchFromGitHub {
     owner = "timmaurice";
     repo = "lovelace-tankerkoenig-card";
     tag = finalAttrs.version;
-    hash = "sha256-XSeTrmnGQ5O711z99ELzVIh06pHEyw4GXksuxkkfCpA=";
+    hash = "sha256-CLO6kQXm+Xbsi5hJLjT9I/xYg8mEptFqdRSw56CGuaE=";
   };
 
-  npmDepsHash = "sha256-ewTbWFTnT/yz13CT0UIuW0PHLr2hDqfO66z8H0jzdAQ=";
+  npmDepsHash = "sha256-PvljUtxp7mbUqSZ/0ynTjMo3rlPXvhWFMJ5UJk6jrVw=";
 
   installPhase = ''
     runHook preInstall

From 3d6eac48da88a4b21a84e3a03ae652bbf1ed4eb8 Mon Sep 17 00:00:00 2001
From: Yifei Sun <ysun@hey.com>
Date: Sun, 11 Oct 2026 12:12:20 +0200
Subject: [PATCH 412/525] nixVersions.git: 2.36pre20260912 -> 2.36pre20261010

---
 pkgs/tools/package-management/nix/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 6d9b64d53b6d..66cee724da4f 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -214,12 +214,12 @@ lib.makeExtensible (
           src = fetchFromGitHub {
             owner = "NixOS";
             repo = "nix";
-            rev = "203f85b2e851fc52e253e8e33eff5fb92936736a";
-            hash = "sha256-ahm58Y+ASv19VGVzC2IwNsQpkVR8rgEwwHDYwnMadkI=";
+            rev = "979a87c97bef7b96cd4ec4b142188089851e47ad";
+            hash = "sha256-B9oFHwWHisWIvsjo7jeoke0OzxRYZYFhpBm/ancphUk=";
           };
         in
         (nixDependencies.callPackage ./modular/packages.nix {
-          version = "2.36pre20260912_${lib.substring 0 8 src.rev}";
+          version = "2.36pre20261010_${lib.substring 0 8 src.rev}";
           inherit teams;
           otherSplices = generateSplicesForNixComponents "nixComponents_git";
           src = removeFunctionalTests commonDisabledTests src;

From db4e027be563ca390fadcb46ea036e80cbd6136c Mon Sep 17 00:00:00 2001
From: Randy Eckenrode <randy@largeandhighquality.com>
Date: Sun, 9 Aug 2026 08:38:12 -0400
Subject: [PATCH 413/525] teams/swift: ping during Feature Freeze announcements
 on releases

---
 maintainers/team-list.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index 47b3b8f6ae60..943dedca55f1 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -760,6 +760,7 @@ with lib.maintainers;
     ];
     scope = "Maintain Swift compiler suite for NixOS.";
     shortName = "Swift";
+    enableFeatureFreezePing = true;
   };
 
   systemd = {

From 641c46ad838d590cf3ea4dc2aaff0fa7c1bf03f6 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Mon, 9 Feb 2026 15:34:57 +0000
Subject: [PATCH 414/525] cudaPackages: 12.9.2 -> 13.4.2

---
 pkgs/top-level/all-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 2365d6f1aadd..0cf36b528350 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1842,7 +1842,7 @@ with pkgs;
 
   cudaPackages_13 = cudaPackages_13_4;
 
-  cudaPackages = recurseIntoAttrs cudaPackages_12;
+  cudaPackages = recurseIntoAttrs cudaPackages_13;
 
   dconf2nix = callPackage ../development/tools/haskell/dconf2nix { };
 

From 8fa7cef2559ec46008e7b1bd4f00d5837818bf51 Mon Sep 17 00:00:00 2001
From: Diogo Correia <me@diogotc.com>
Date: Sat, 1 Aug 2026 01:57:36 +0100
Subject: [PATCH 415/525] nixos/bazarr: harden systemd service

---
 nixos/modules/services/misc/bazarr.nix | 35 ++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/nixos/modules/services/misc/bazarr.nix b/nixos/modules/services/misc/bazarr.nix
index f6064efcc965..34a2ff1fe160 100644
--- a/nixos/modules/services/misc/bazarr.nix
+++ b/nixos/modules/services/misc/bazarr.nix
@@ -193,6 +193,41 @@ in
         KillSignal = "SIGINT";
         SuccessExitStatus = "0 156";
         LoadCredential = credentials;
+
+        # Hardening
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateIPC = true;
+        PrivateTmp = "disconnected";
+        PrivateUsers = true;
+        ProcSubset = "pid";
+        ProtectClock = true;
+        ProtectControlGroups = "strict";
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectProc = "invisible";
+        ProtectSystem = "full";
+        RemoveIPC = true;
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_UNIX"
+        ];
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallErrorNumber = "EPERM";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
       };
       unitConfig.RequiresMountsFor = [ cfg.dataDir ];
     };

From 5588cca6fcfbbfe0da5f921e1ee5400f3d8d98ac Mon Sep 17 00:00:00 2001
From: Diogo Correia <me@diogotc.com>
Date: Sun, 23 Aug 2026 15:59:57 +0100
Subject: [PATCH 416/525] nixos/doc: mention bazarr systemd hardening in 26.11
 release notes

---
 nixos/doc/manual/release-notes/rl-2611.section.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index 7427d7232f42..e855f9077971 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -270,6 +270,8 @@
   `services.bazarr.listenPort` is now `services.bazarr.settings.general.port`; existing configurations continue working via `mkRenamedOptionModule`.
   [`services.bazarr.settings.analytics.enabled`](#opt-services.bazarr.settings.analytics.enabled) defaults to `false` on NixOS to opt users out of upstream's enabled-by-default telemetry.
 
+- The [bazarr](#opt-services.bazarr.enable) systemd service has been security hardened. If you are storing/accessing data in `/home`, you will need to adjust the `ProtectHome` option.
+
 - `security.polkit.enablePkexecWrapper` has been introduced, making the `pkexec` setuid wrapper opt-in.
 
 - `services.pghero` has been removed because the `pghero` package was unmaintained and thus dropped from Nixpkgs.

From 7a36b5e3bd04dc3019168d49a6d6940e3ee6eee8 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 11 Oct 2026 14:33:31 +0200
Subject: [PATCH 417/525] evcc: 0.317.0 -> 0.317.1

https://github.com/evcc-io/evcc/releases/tag/0.317.1
---
 pkgs/by-name/ev/evcc/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ev/evcc/package.nix b/pkgs/by-name/ev/evcc/package.nix
index 0df3e2e36afd..fc9bca5a58e2 100644
--- a/pkgs/by-name/ev/evcc/package.nix
+++ b/pkgs/by-name/ev/evcc/package.nix
@@ -17,13 +17,13 @@
 }:
 
 let
-  version = "0.317.0";
+  version = "0.317.1";
 
   src = fetchFromGitHub {
     owner = "evcc-io";
     repo = "evcc";
     tag = version;
-    hash = "sha256-3M3R/rqHgcoWHZ8qaK2Hhrp9+lJfwiOK+zk9A6DN81c=";
+    hash = "sha256-wtqqmmhb0zdwmA+aYPTEK/mMK8lQefJgJxmZEBu2Ayc=";
   };
 
   vendorHash = "sha256-0u3qIry84kZoj/pqL20uaVn2p+vRfmT5lYY43G0q9RI=";

From 3a8fc9855d83abd9d0b01b1bc95a4430c3e15ab1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 12:51:25 +0000
Subject: [PATCH 418/525] govulncheck: 1.8.0 -> 1.9.0

---
 pkgs/by-name/go/govulncheck/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/go/govulncheck/package.nix b/pkgs/by-name/go/govulncheck/package.nix
index ce44fd0ffc85..8872dca1b8da 100644
--- a/pkgs/by-name/go/govulncheck/package.nix
+++ b/pkgs/by-name/go/govulncheck/package.nix
@@ -8,13 +8,13 @@
 
 buildGoLatestModule (finalAttrs: {
   pname = "govulncheck";
-  version = "1.8.0";
+  version = "1.9.0";
 
   src = fetchFromGitHub {
     owner = "golang";
     repo = "vuln";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OvgAEWf7WtPNXZEZYNeSqy7dZP9cF3wfQSt9WU79OIM=";
+    hash = "sha256-XChu+f2RVp9flyk6R7n090Xbcgzi2ThQPuTqktkOC+U=";
   };
 
   patches = [
@@ -24,7 +24,7 @@ buildGoLatestModule (finalAttrs: {
     })
   ];
 
-  vendorHash = "sha256-wSSxsmEzpFiaDfRsgFWOtA9UnoENm57VVltB+MA6y0E=";
+  vendorHash = "sha256-vPBwW2DtmJbX1UeJeC3J8wnRvq9+C/XDazbsXKkHkaQ=";
 
   subPackages = [
     "cmd/govulncheck"

From dd4f4e4de3816a32514ab5966bdcad58017b1218 Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Sun, 11 Oct 2026 14:51:16 +0200
Subject: [PATCH 419/525] kvmtool: 0-unstable-2024-04-09 ->
 0-unstable-2026-08-06

---
 pkgs/by-name/kv/kvmtool/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/kv/kvmtool/package.nix b/pkgs/by-name/kv/kvmtool/package.nix
index f89324a5909d..ea22703abe0a 100644
--- a/pkgs/by-name/kv/kvmtool/package.nix
+++ b/pkgs/by-name/kv/kvmtool/package.nix
@@ -7,12 +7,12 @@
 
 stdenv.mkDerivation {
   pname = "kvmtool";
-  version = "0-unstable-2024-04-09";
+  version = "0-unstable-2026-08-06";
 
   src = fetchgit {
     url = "https://git.kernel.org/pub/scm/linux/kernel/git/will/kvmtool.git";
-    rev = "da4cfc3e540341b84c4bbad705b5a15865bc1f80";
-    hash = "sha256-05tNsZauOXe1L1y1YchzvLZm3xOctPJhHCjyAyRnwy4=";
+    rev = "f67bc0bdae9433a9cfd05e65ea2c1bb6102566d9";
+    hash = "sha256-eVE3lM0Xsv11T9IQ694639rLqvjjaee1Ob60vq3Ho3g=";
   };
 
   patches = [ ./strlcpy-glibc-2.38-fix.patch ];

From 136eba16abc6b4044b18741dec59fedb58bc3974 Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Sun, 11 Oct 2026 09:03:25 +0200
Subject: [PATCH 420/525] kvmtool: add riscv64-linux support

---
 pkgs/by-name/kv/kvmtool/package.nix | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/kv/kvmtool/package.nix b/pkgs/by-name/kv/kvmtool/package.nix
index ea22703abe0a..147ea7b6425c 100644
--- a/pkgs/by-name/kv/kvmtool/package.nix
+++ b/pkgs/by-name/kv/kvmtool/package.nix
@@ -5,6 +5,10 @@
   dtc,
 }:
 
+let
+  withLibfdt = stdenv.hostPlatform.isAarch64 || stdenv.hostPlatform.isRiscV64;
+in
+
 stdenv.mkDerivation {
   pname = "kvmtool";
   version = "0-unstable-2026-08-06";
@@ -17,7 +21,7 @@ stdenv.mkDerivation {
 
   patches = [ ./strlcpy-glibc-2.38-fix.patch ];
 
-  buildInputs = lib.optionals stdenv.hostPlatform.isAarch64 [ dtc ];
+  buildInputs = lib.optionals withLibfdt [ dtc ];
 
   # glibc 2.43 C23 const-preserving strchr/strstr macros
   env.NIX_CFLAGS_COMPILE = "-Wno-error=discarded-qualifiers";
@@ -29,7 +33,7 @@ stdenv.mkDerivation {
     "CROSS_COMPILE=${stdenv.cc.targetPrefix}"
     "ARCH=${stdenv.hostPlatform.linuxArch}"
   ]
-  ++ lib.optionals stdenv.hostPlatform.isAarch64 [
+  ++ lib.optionals withLibfdt [
     "LIBFDT_DIR=${dtc}/lib"
   ];
 
@@ -45,6 +49,7 @@ stdenv.mkDerivation {
     platforms = [
       "x86_64-linux"
       "aarch64-linux"
+      "riscv64-linux"
     ];
     mainProgram = "lkvm";
   };

From 71938ff8233b38bfe4c98bb714246853030a9ea7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sun, 11 Oct 2026 14:29:02 +0200
Subject: [PATCH 421/525] open-webui: 0.11.4 -> 0.12.0

Diff: https://github.com/open-webui/open-webui/compare/v0.11.4...v0.12.0

Changelog: https://github.com/open-webui/open-webui/blob/v0.12.0/CHANGELOG.md
---
 pkgs/by-name/op/open-webui/package.nix | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/op/open-webui/package.nix b/pkgs/by-name/op/open-webui/package.nix
index 0109a8b25530..96cc08615278 100644
--- a/pkgs/by-name/op/open-webui/package.nix
+++ b/pkgs/by-name/op/open-webui/package.nix
@@ -8,13 +8,13 @@
 }:
 let
   pname = "open-webui";
-  version = "0.11.4";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "open-webui";
     repo = "open-webui";
     tag = "v${version}";
-    hash = "sha256-Z7pc1o6AK9XySZLYF8YNSnHyrp85nh8ZmiCw4FWCwW8=";
+    hash = "sha256-x8Mxy7KHGqC1qmOp6/UsO7ntq07l1jrKTaR9XiOK2d0=";
   };
 
   # we need datasets_3 for SpeechT5 embeddings
@@ -35,7 +35,7 @@ let
       url = "https://github.com/pyodide/pyodide/releases/download/${pyodideVersion}/pyodide-${pyodideVersion}.tar.bz2";
     };
 
-    npmDepsHash = "sha256-hdgWZAJstRqYtzNuCTeiRIi+rjRsogulSfWXr8EP2UI=";
+    npmDepsHash = "sha256-FD433gQae9Ip5awPau83UqCezbsnyUbOgpnSka+nFng=";
 
     npmFlags = [ "--force" ];
 
@@ -142,6 +142,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
       onnxruntime
       openai
       opencv-python-headless
+      openpyxl
+      opensearch-py
       opentelemetry-api
       opentelemetry-exporter-otlp
       opentelemetry-instrumentation
@@ -153,8 +155,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
       opentelemetry-instrumentation-requests
       opentelemetry-instrumentation-sqlalchemy
       opentelemetry-sdk
-      openpyxl
-      opensearch-py
       orjson
       pandas
       pillow
@@ -167,6 +167,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
       pyjwt
       pymdown-extensions
       pymysql
+      pyotp
       pypandoc
       pypdf
       python-docx
@@ -178,6 +179,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
       pytube
       pytz
       pyxlsb
+      qrcode
       rank-bm25
       rapidocr
       redis

From bb4013672dac137a1d60f8fc3e3faaebdee7e66a Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Sun, 11 Oct 2026 15:34:26 +0200
Subject: [PATCH 422/525] hypridle: use lib.platforms.linux

---
 pkgs/by-name/hy/hypridle/package.nix | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/pkgs/by-name/hy/hypridle/package.nix b/pkgs/by-name/hy/hypridle/package.nix
index 0c0c883f3392..ed692e9e7769 100644
--- a/pkgs/by-name/hy/hypridle/package.nix
+++ b/pkgs/by-name/hy/hypridle/package.nix
@@ -59,9 +59,6 @@ gcc16Stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.bsd3;
     teams = [ lib.teams.hyprland ];
     mainProgram = "hypridle";
-    platforms = [
-      "aarch64-linux"
-      "x86_64-linux"
-    ];
+    platforms = lib.platforms.linux;
   };
 })

From 1bdaaad86e55b464866272180686f45740010719 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 16:23:13 -0300
Subject: [PATCH 423/525] python3Packages.docplex: fix homepage

---
 pkgs/development/python-modules/docplex/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/docplex/default.nix b/pkgs/development/python-modules/docplex/default.nix
index f9bf7f9a907c..fee63c378efa 100644
--- a/pkgs/development/python-modules/docplex/default.nix
+++ b/pkgs/development/python-modules/docplex/default.nix
@@ -36,7 +36,7 @@ buildPythonPackage (finalAttrs: {
 
   meta = {
     description = "IBM Decision Optimization CPLEX Modeling for Python";
-    homepage = "https://onboarding-oaas.docloud.ibmcloud.com/software/analytics/docloud/";
+    homepage = "https://ibmdecisionoptimization.github.io/docplex-doc/";
     license = lib.licenses.asl20;
     maintainers = [ ];
   };

From 57071dc35d46a3cbd117634d5adef0d842a44307 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 16:22:56 -0300
Subject: [PATCH 424/525] python3Packages.docloud: fix homepage

---
 pkgs/development/python-modules/docloud/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/docloud/default.nix b/pkgs/development/python-modules/docloud/default.nix
index a15fc3ba7255..246b06fad485 100644
--- a/pkgs/development/python-modules/docloud/default.nix
+++ b/pkgs/development/python-modules/docloud/default.nix
@@ -27,7 +27,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "IBM Decision Optimization on Cloud Python client";
-    homepage = "https://onboarding-oaas.docloud.ibmcloud.com/software/analytics/docloud/";
+    homepage = "https://community.ibm.com/community/user/groups/community-home?communitykey=ab7de0fd-6f43-47a9-8261-33578a231bb7";
     license = lib.licenses.asl20;
     maintainers = [ ];
   };

From 9b5b354d09dfc640525e35034158ecd8aac90aa5 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 16:21:13 -0300
Subject: [PATCH 425/525] python3Packages.autobahn: fix homepage

---
 pkgs/development/python-modules/autobahn/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/autobahn/default.nix b/pkgs/development/python-modules/autobahn/default.nix
index c0c31b346e2e..5b02ba077ad1 100644
--- a/pkgs/development/python-modules/autobahn/default.nix
+++ b/pkgs/development/python-modules/autobahn/default.nix
@@ -142,7 +142,7 @@ buildPythonPackage (finalAttrs: {
 
   meta = {
     description = "WebSocket and WAMP in Python for Twisted and asyncio";
-    homepage = "https://crossbar.io/autobahn";
+    homepage = "https://autobahn.readthedocs.io";
     downloadPage = "https://github.com/crossbario/autobahn-python";
     changelog = "https://github.com/crossbario/autobahn-python/blob/${finalAttrs.src.tag}/docs/changelog.rst";
     license = lib.licenses.mit;

From 4d99284ee5be95cb2e1d93e60da833c001853649 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 15:05:00 -0300
Subject: [PATCH 426/525] python3Packages.kuzu: fix homepage

---
 pkgs/development/python-modules/kuzu/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/kuzu/default.nix b/pkgs/development/python-modules/kuzu/default.nix
index 106e14d3313d..4f787daea054 100644
--- a/pkgs/development/python-modules/kuzu/default.nix
+++ b/pkgs/development/python-modules/kuzu/default.nix
@@ -28,7 +28,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "Python bindings for Kuzu, an embeddable property graph database management system";
-    homepage = "https://kuzudb.com/";
+    homepage = "https://github.com/kuzudb/kuzu";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ sdht0 ];
   };

From c95c72ff41dd5310c09bc782af3b0f1afda3940d Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 12:33:37 -0300
Subject: [PATCH 427/525] python3Packages.aircot: fix homepage

---
 pkgs/development/python-modules/aircot/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/aircot/default.nix b/pkgs/development/python-modules/aircot/default.nix
index 7aecb9951168..9f08de388143 100644
--- a/pkgs/development/python-modules/aircot/default.nix
+++ b/pkgs/development/python-modules/aircot/default.nix
@@ -27,7 +27,7 @@ buildPythonPackage (finalAttrs: {
 
   meta = {
     description = "Display Ships in TAK - AIS to TAK Gateway";
-    homepage = "https://aircot.rtfd.io";
+    homepage = "https://aircot.readthedocs.io";
     changelog = "https://github.com/snstac/aircot/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ felbinger ];

From d7747a47c89c5c7af6e4395f0341fe02e630d237 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 12:33:10 -0300
Subject: [PATCH 428/525] python3Packages.faker: fix homepage

---
 pkgs/development/python-modules/faker/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/faker/default.nix b/pkgs/development/python-modules/faker/default.nix
index a1b4270087bd..afb5dee4c3c8 100644
--- a/pkgs/development/python-modules/faker/default.nix
+++ b/pkgs/development/python-modules/faker/default.nix
@@ -46,7 +46,7 @@ buildPythonPackage rec {
   meta = {
     description = "Python library for generating fake user data";
     mainProgram = "faker";
-    homepage = "http://faker.rtfd.org";
+    homepage = "https://faker.readthedocs.io";
     license = lib.licenses.mit;
     maintainers = [ ];
   };

From 1528d066e523ea95bb891d9f26534aeb1e3c072d Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 12:32:48 -0300
Subject: [PATCH 429/525] python3Packages.helper: fix homepage

---
 pkgs/development/python-modules/helper/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/helper/default.nix b/pkgs/development/python-modules/helper/default.nix
index 12cdd3ac1d15..2ebf33e32ae6 100644
--- a/pkgs/development/python-modules/helper/default.nix
+++ b/pkgs/development/python-modules/helper/default.nix
@@ -33,7 +33,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "Development library for quickly writing configurable applications and daemons";
-    homepage = "https://helper.readthedocs.org/";
+    homepage = "https://github.com/gmr/helper";
     license = lib.licenses.bsd3;
   };
 }

From 2f2e2373856ab30f7b1877380f35167ca4f3de49 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 12:32:04 -0300
Subject: [PATCH 430/525] python3Packages.leather: fix homepage

---
 pkgs/development/python-modules/leather/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/leather/default.nix b/pkgs/development/python-modules/leather/default.nix
index bec3ea53e10a..dcb9b22fb9a0 100644
--- a/pkgs/development/python-modules/leather/default.nix
+++ b/pkgs/development/python-modules/leather/default.nix
@@ -27,7 +27,7 @@ buildPythonPackage rec {
   ];
 
   meta = {
-    homepage = "http://leather.rtfd.io";
+    homepage = "https://leather.readthedocs.io";
     description = "Python charting library";
     license = lib.licenses.mit;
     platforms = lib.platforms.all;

From 9a53e68b0b202d7ce9f6c84bd0b7f715746ec17e Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 12:31:15 -0300
Subject: [PATCH 431/525] python3Packages.pygame-original: fix homepage

---
 pkgs/development/python-modules/pygame-original/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/pygame-original/default.nix b/pkgs/development/python-modules/pygame-original/default.nix
index f3c18549dfc7..34e95a42fbf4 100644
--- a/pkgs/development/python-modules/pygame-original/default.nix
+++ b/pkgs/development/python-modules/pygame-original/default.nix
@@ -132,7 +132,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "Python library for games (original distribution)";
-    homepage = "https://www.pygame.org/";
+    homepage = "https://github.com/pygame/pygame";
     changelog = "https://github.com/pygame/pygame/releases/tag/${src.tag}";
     license = lib.licenses.lgpl21Plus;
     maintainers = with lib.maintainers; [ emilytrau ];

From 7abce6ea17deb7888f8f17a795685a5292712642 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 12:30:43 -0300
Subject: [PATCH 432/525] python3Packages.pygal: fix homepage

---
 pkgs/development/python-modules/pygal/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/pygal/default.nix b/pkgs/development/python-modules/pygal/default.nix
index d394c200ffd9..503b3d2fc833 100644
--- a/pkgs/development/python-modules/pygal/default.nix
+++ b/pkgs/development/python-modules/pygal/default.nix
@@ -64,7 +64,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "Module for dynamic SVG charting";
-    homepage = "http://www.pygal.org";
+    homepage = "https://www.pygal.org";
     changelog = "https://github.com/Kozea/pygal/blob/${version}/docs/changelog.rst";
     downloadPage = "https://github.com/Kozea/pygal";
     license = lib.licenses.lgpl3Plus;

From 749fbf93d567ac8ae2ddd0528983a7bc6592266b Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 12:30:19 -0300
Subject: [PATCH 433/525] python3Packages.rawkit: fix homepage

---
 pkgs/development/python-modules/rawkit/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/rawkit/default.nix b/pkgs/development/python-modules/rawkit/default.nix
index eae89d508da0..ec1191875a27 100644
--- a/pkgs/development/python-modules/rawkit/default.nix
+++ b/pkgs/development/python-modules/rawkit/default.nix
@@ -39,7 +39,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "CTypes based LibRaw bindings for Python";
-    homepage = "https://rawkit.readthedocs.org/";
+    homepage = "https://rawkit.readthedocs.io/";
     license = lib.licenses.mit;
     maintainers = [ ];
   };

From 306e3716365d704466bdffc774d5bce291df5a70 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 12:29:39 -0300
Subject: [PATCH 434/525] python3Packages.requests-toolbelt: fix homepage

---
 pkgs/development/python-modules/requests-toolbelt/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/requests-toolbelt/default.nix b/pkgs/development/python-modules/requests-toolbelt/default.nix
index 59354d41092b..c029912372e0 100644
--- a/pkgs/development/python-modules/requests-toolbelt/default.nix
+++ b/pkgs/development/python-modules/requests-toolbelt/default.nix
@@ -44,7 +44,7 @@ buildPythonPackage (finalAttrs: {
 
   meta = {
     description = "Toolbelt of useful classes and functions to be used with requests";
-    homepage = "http://toolbelt.rtfd.org";
+    homepage = "https://toolbelt.readthedocs.io";
     changelog = "https://github.com/requests/toolbelt/blob/${finalAttrs.version}/HISTORY.rst";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ matthiasbeyer ];

From 802b9ee8f59ec5b2b58044e00d9261a571697c02 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 12:25:57 -0300
Subject: [PATCH 435/525] python3Packages.virtualenv: fix homepage

---
 pkgs/development/python-modules/virtualenv/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/virtualenv/default.nix b/pkgs/development/python-modules/virtualenv/default.nix
index ffdd174c3b66..fb5d18fd3b94 100644
--- a/pkgs/development/python-modules/virtualenv/default.nix
+++ b/pkgs/development/python-modules/virtualenv/default.nix
@@ -74,7 +74,7 @@ buildPythonPackage rec {
   meta = {
     description = "Tool to create isolated Python environments";
     mainProgram = "virtualenv";
-    homepage = "http://www.virtualenv.org";
+    homepage = "https://virtualenv.pypa.io/en/latest/";
     changelog = "https://github.com/pypa/virtualenv/blob/${version}/docs/changelog.rst";
     license = lib.licenses.mit;
     maintainers = [ ];

From 4fc4f5706c944b110291132d78237a7c794015ce Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 11:06:19 -0300
Subject: [PATCH 436/525] python3Packages.formencode: fix homepage

---
 pkgs/development/python-modules/formencode/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/formencode/default.nix b/pkgs/development/python-modules/formencode/default.nix
index 71625b5d7ba3..2644a08942f1 100644
--- a/pkgs/development/python-modules/formencode/default.nix
+++ b/pkgs/development/python-modules/formencode/default.nix
@@ -45,7 +45,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "FormEncode validates and converts nested structures";
-    homepage = "http://formencode.org";
+    homepage = "https://www.formencode.org";
     license = lib.licenses.mit;
     maintainers = [ ];
   };

From 839293468a84d73cc527b4f202aa4c24243bf242 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 11:00:39 -0300
Subject: [PATCH 437/525] python3Packages.hsaudiotag3k: fix homepage

---
 pkgs/development/python-modules/hsaudiotag3k/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/hsaudiotag3k/default.nix b/pkgs/development/python-modules/hsaudiotag3k/default.nix
index 0b56ee91e224..a0ab3f77d2b6 100644
--- a/pkgs/development/python-modules/hsaudiotag3k/default.nix
+++ b/pkgs/development/python-modules/hsaudiotag3k/default.nix
@@ -21,7 +21,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "Pure Python library that lets one to read metadata from media files";
-    homepage = "http://hg.hardcoded.net/hsaudiotag/";
+    homepage = "https://github.com/chrrrisw/hsaudiotag";
     license = lib.licenses.bsd3;
   };
 }

From 65a889f6ed44529e0324921f8c5343691dece9a1 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 10:59:58 -0300
Subject: [PATCH 438/525] python3Packages.minichain: fix homepage

---
 pkgs/development/python-modules/minichain/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/minichain/default.nix b/pkgs/development/python-modules/minichain/default.nix
index 58475976b568..d651e9587a2f 100644
--- a/pkgs/development/python-modules/minichain/default.nix
+++ b/pkgs/development/python-modules/minichain/default.nix
@@ -63,7 +63,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "Tiny library for coding with large language models";
-    homepage = "https://srush-minichain.hf.space";
+    homepage = "https://github.com/srush/MiniChain";
     changelog = "https://github.com/srush/MiniChain/releases/tag/v${version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ samuela ];

From cf81f9e0cfb82fbb565c5b1571cdf4bd69ea316e Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 10:59:25 -0300
Subject: [PATCH 439/525] python3Packages.pycurl: fix homepage

---
 pkgs/development/python-modules/pycurl/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/pycurl/default.nix b/pkgs/development/python-modules/pycurl/default.nix
index c7c32e9e20d3..2ec4c2da4391 100644
--- a/pkgs/development/python-modules/pycurl/default.nix
+++ b/pkgs/development/python-modules/pycurl/default.nix
@@ -98,7 +98,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "Python Interface To The cURL library";
-    homepage = "http://pycurl.io/";
+    homepage = "https://pycurl.github.io/";
     changelog =
       "https://github.com/pycurl/pycurl/blob/REL_"
       + lib.replaceStrings [ "." ] [ "_" ] version

From c73ac5ab325ef858abdc5759f41c81729e6ca540 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 10:57:22 -0300
Subject: [PATCH 440/525] python3Packages.python-uinput: fix homepage

---
 pkgs/development/python-modules/python-uinput/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/python-uinput/default.nix b/pkgs/development/python-modules/python-uinput/default.nix
index d2598e60f84b..e4ad3d4704b2 100644
--- a/pkgs/development/python-modules/python-uinput/default.nix
+++ b/pkgs/development/python-modules/python-uinput/default.nix
@@ -23,7 +23,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "Pythonic API to Linux uinput kernel module";
-    homepage = "https://tjjr.fi/sw/python-uinput/";
+    homepage = "https://github.com/pyinput/python-uinput";
     license = lib.licenses.gpl3Plus;
     maintainers = [ ];
   };

From e1a4ac319f872c157739059189da450e1e09ae6e Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 10:56:43 -0300
Subject: [PATCH 441/525] python3Packages.twiggy: fix homepage

---
 pkgs/by-name/tw/twiggy/package.nix                 | 2 +-
 pkgs/development/python-modules/twiggy/default.nix | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/tw/twiggy/package.nix b/pkgs/by-name/tw/twiggy/package.nix
index 814db9513754..f1faca43b918 100644
--- a/pkgs/by-name/tw/twiggy/package.nix
+++ b/pkgs/by-name/tw/twiggy/package.nix
@@ -16,7 +16,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoHash = "sha256-FaoEqCdMb3h93zGvc+EZ8LfYgMPY3dT/fScpRgGVeAo=";
 
   meta = {
-    homepage = "https://rustwasm.github.io/twiggy/";
+    homepage = "https://alexene.dev/twiggy/";
     description = "Code size profiler for Wasm";
     mainProgram = "twiggy";
     license = with lib.licenses; [
diff --git a/pkgs/development/python-modules/twiggy/default.nix b/pkgs/development/python-modules/twiggy/default.nix
index 420cc3336f49..3d50f8dcccee 100644
--- a/pkgs/development/python-modules/twiggy/default.nix
+++ b/pkgs/development/python-modules/twiggy/default.nix
@@ -20,7 +20,7 @@ buildPythonPackage rec {
   doCheck = false;
 
   meta = {
-    homepage = "http://twiggy.wearpants.org";
+    homepage = "https://github.com/wearpants/twiggy";
     # Taken from http://i.wearpants.org/blog/meet-twiggy/
     description = "Twiggy is the first totally new design for a logger since log4j";
     license = lib.licenses.bsd3;

From 475840b9de73432a9ad89b9b595c210c1897294e Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 10:38:33 -0300
Subject: [PATCH 442/525] python3Packages.repoze-lru: fix homepage

---
 pkgs/development/python-modules/repoze-lru/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/repoze-lru/default.nix b/pkgs/development/python-modules/repoze-lru/default.nix
index 45f5a7fedcc4..9055f1f58db8 100644
--- a/pkgs/development/python-modules/repoze-lru/default.nix
+++ b/pkgs/development/python-modules/repoze-lru/default.nix
@@ -35,7 +35,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "Tiny LRU cache implementation and decorator";
-    homepage = "http://www.repoze.org/";
+    homepage = "https://github.com/repoze/repoze.lru";
     changelog = "https://github.com/repoze/repoze.lru/blob/${version}/CHANGES.rst";
     license = lib.licenses.bsd0;
     maintainers = [ ];

From d47e33b28829040b38f5e843463f4bc799e4493c Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 10:09:22 -0300
Subject: [PATCH 443/525] python3Packages.redisvl: fix homepage

---
 pkgs/development/python-modules/redisvl/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/redisvl/default.nix b/pkgs/development/python-modules/redisvl/default.nix
index 498a906f213a..a6cd41aa677a 100644
--- a/pkgs/development/python-modules/redisvl/default.nix
+++ b/pkgs/development/python-modules/redisvl/default.nix
@@ -45,7 +45,7 @@ buildPythonPackage (finalAttrs: {
 
   meta = {
     description = "Python client library and CLI for using Redis as a vector database";
-    homepage = " https://redisvl.com";
+    homepage = "https://redisvl.com";
     changelog = "https://github.com/redis/redis-vl-python/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.mit;
     mainProgram = "rvl";

From ba623aa9531d09894e2de5c130296de801bddb28 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sat, 19 Sep 2026 23:47:41 -0300
Subject: [PATCH 444/525] python3Packages.soco: fix homepage

---
 pkgs/development/python-modules/soco/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/soco/default.nix b/pkgs/development/python-modules/soco/default.nix
index 9a79fa651032..0e3fb734149d 100644
--- a/pkgs/development/python-modules/soco/default.nix
+++ b/pkgs/development/python-modules/soco/default.nix
@@ -53,7 +53,7 @@ buildPythonPackage (finalAttrs: {
 
   meta = {
     description = "CLI and library to control Sonos speakers";
-    homepage = "http://python-soco.com/";
+    homepage = "https://github.com/SoCo/SoCo";
     changelog = "https://github.com/SoCo/SoCo/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ lovesegfault ];

From 7c9fa95f3a65e100c3cad2e6509917fcc6117410 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sat, 19 Sep 2026 23:47:05 -0300
Subject: [PATCH 445/525] python3Packages.pykka: fix homepage

---
 pkgs/development/python-modules/pykka/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/pykka/default.nix b/pkgs/development/python-modules/pykka/default.nix
index 96b37163576f..f181052353f1 100644
--- a/pkgs/development/python-modules/pykka/default.nix
+++ b/pkgs/development/python-modules/pykka/default.nix
@@ -31,7 +31,7 @@ buildPythonPackage rec {
   pythonImportsCheck = [ "pykka" ];
 
   meta = {
-    homepage = "https://www.pykka.org/";
+    homepage = "https://pykka.readthedocs.io/";
     description = "Python implementation of the actor model";
     changelog = "https://github.com/jodal/pykka/releases/tag/${src.tag}";
     maintainers = [ ];

From f54dfea27ba42409197f1849b432ab384372a5c5 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sat, 19 Sep 2026 23:46:23 -0300
Subject: [PATCH 446/525] python3Packages.meinheld: fix homepage

---
 pkgs/development/python-modules/meinheld/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/meinheld/default.nix b/pkgs/development/python-modules/meinheld/default.nix
index fa0b6fccec7b..62781ee9b265 100644
--- a/pkgs/development/python-modules/meinheld/default.nix
+++ b/pkgs/development/python-modules/meinheld/default.nix
@@ -35,7 +35,7 @@ buildPythonPackage rec {
 
   meta = {
     description = "High performance asynchronous Python WSGI Web Server";
-    homepage = "https://meinheld.org/";
+    homepage = "https://github.com/mopemope/meinheld";
     license = lib.licenses.bsd3;
   };
 }

From 1a96a65fb4471806b99263d28e6a3e9bacbca9f9 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sat, 19 Sep 2026 23:43:52 -0300
Subject: [PATCH 447/525] python3Packages.keystone-engine: fix homepage

---
 pkgs/development/python-modules/keystone-engine/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/keystone-engine/default.nix b/pkgs/development/python-modules/keystone-engine/default.nix
index a9d537cbc8c1..45dacca71297 100644
--- a/pkgs/development/python-modules/keystone-engine/default.nix
+++ b/pkgs/development/python-modules/keystone-engine/default.nix
@@ -40,7 +40,7 @@ buildPythonPackage (finalAttrs: {
 
   meta = {
     description = "Lightweight multi-platform, multi-architecture assembler framework";
-    homepage = "https://www.keystone-engine.org";
+    homepage = "https://github.com/keystone-engine/keystone";
     maintainers = with lib.maintainers; [ dump_stack ];
     license = lib.licenses.gpl2Only;
   };

From aaabf43a2a1437f18d91cbed2b824508266b8dac Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 13:42:18 +0000
Subject: [PATCH 448/525] ratty: 0.5.0 -> 0.6.0

---
 pkgs/by-name/ra/ratty/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ra/ratty/package.nix b/pkgs/by-name/ra/ratty/package.nix
index 6493c24d0a68..0eba2c9ac846 100644
--- a/pkgs/by-name/ra/ratty/package.nix
+++ b/pkgs/by-name/ra/ratty/package.nix
@@ -14,16 +14,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ratty";
-  version = "0.5.0";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "orhun";
     repo = "ratty";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gQ9qeR9IyPUCy4V2ynnnXeN15Fs7aNDEwjQ+33gonRU=";
+    hash = "sha256-oCz5PWfESX6eDNkMnbLsMHsOlyxAn/sjhxwN8qZ5s+s=";
   };
 
-  cargoHash = "sha256-mSb7QCYQ4EL76S7wmSdHBkjE5wzbVK8ln6oPdAv5BuA=";
+  cargoHash = "sha256-HHrAJy/XuTqkEpfvrbiS+CFPKBRJsB21s5TdmBpD7Nk=";
 
   nativeBuildInputs = [
     pkg-config

From 1f858f9e408deb7d9dae54b58161ab220f0b60d1 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 14:03:16 -0300
Subject: [PATCH 449/525] cxxtools: fix homepage

---
 pkgs/by-name/cx/cxxtools/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/cx/cxxtools/package.nix b/pkgs/by-name/cx/cxxtools/package.nix
index bad3b441dcaf..262941f94da3 100644
--- a/pkgs/by-name/cx/cxxtools/package.nix
+++ b/pkgs/by-name/cx/cxxtools/package.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
   enableParallelBuilding = true;
 
   meta = {
-    homepage = "http://www.tntnet.org/cxxtools.html";
+    homepage = "https://github.com/maekitalo/cxxtools";
     description = "Comprehensive C++ class library for Unix and Linux";
     platforms = lib.platforms.linux;
     license = lib.licenses.lgpl21;

From 728c3614dc1f756d461dfe0134af5f8faca78308 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 14:02:45 -0300
Subject: [PATCH 450/525] cryptopp: fix homepage

---
 pkgs/by-name/cr/cryptopp/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/cr/cryptopp/package.nix b/pkgs/by-name/cr/cryptopp/package.nix
index d1aaf2dbd1d1..1f8c01294b8e 100644
--- a/pkgs/by-name/cr/cryptopp/package.nix
+++ b/pkgs/by-name/cr/cryptopp/package.nix
@@ -57,7 +57,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Free C++ class library of cryptographic schemes";
-    homepage = "https://cryptopp.com/";
+    homepage = "https://github.com/weidai11/cryptopp";
     changelog = [
       "https://raw.githubusercontent.com/weidai11/cryptopp/CRYPTOPP_${underscoredVersion}/History.txt"
       "https://github.com/weidai11/cryptopp/releases/tag/CRYPTOPP_${underscoredVersion}"

From 2e383b90a4478e6ff2a3cbb1ef14878f92f789fe Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 14:02:17 -0300
Subject: [PATCH 451/525] cozy: fix homepage

---
 pkgs/by-name/co/cozy/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/co/cozy/package.nix b/pkgs/by-name/co/cozy/package.nix
index 4cb9fcfbb301..29e66f3446cc 100644
--- a/pkgs/by-name/co/cozy/package.nix
+++ b/pkgs/by-name/co/cozy/package.nix
@@ -75,7 +75,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   meta = {
     description = "Modern audio book player for Linux";
-    homepage = "https://cozy.geigi.de/";
+    homepage = "https://github.com/geigi/cozy";
     maintainers = with lib.maintainers; [
       makefu
       aleksana

From 12bc86c88fd3915dd76e170c3624218030b99b55 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 14:01:41 -0300
Subject: [PATCH 452/525] comicneue: fix homepage

---
 pkgs/by-name/co/comic-neue/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/co/comic-neue/package.nix b/pkgs/by-name/co/comic-neue/package.nix
index c57c3661b2a9..7b601f6b8555 100644
--- a/pkgs/by-name/co/comic-neue/package.nix
+++ b/pkgs/by-name/co/comic-neue/package.nix
@@ -31,7 +31,7 @@ stdenv.mkDerivation rec {
   '';
 
   meta = {
-    homepage = "http://comicneue.com/";
+    homepage = "https://github.com/crozynski/comicneue";
     description = "Casual type face: Make your lemonade stand look like a fortune 500 company";
     longDescription = ''
       ComicNeue is inspired by Comic Sans but more regular. It was

From b4834589fdd79d87461c85be58a1d7ee5e71d5f2 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 14:01:18 -0300
Subject: [PATCH 453/525] colormake: fix homepage

---
 pkgs/by-name/co/colormake/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/co/colormake/package.nix b/pkgs/by-name/co/colormake/package.nix
index 2a352f0cad87..956426095036 100644
--- a/pkgs/by-name/co/colormake/package.nix
+++ b/pkgs/by-name/co/colormake/package.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Simple wrapper around make to colorize the output";
-    homepage = "https://bre.klaki.net/programs/colormake/";
+    homepage = "https://github.com/pagekite/Colormake";
     license = lib.licenses.gpl2;
     platforms = lib.platforms.unix;
   };

From 5b7310dd35ecfc4893fd56aa83bc848b794e9ecc Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 13:59:51 -0300
Subject: [PATCH 454/525] eigen_5: fix homepage

---
 pkgs/by-name/ei/eigen_5/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ei/eigen_5/package.nix b/pkgs/by-name/ei/eigen_5/package.nix
index 83c2928b6eb6..a3af1ffc779a 100644
--- a/pkgs/by-name/ei/eigen_5/package.nix
+++ b/pkgs/by-name/ei/eigen_5/package.nix
@@ -64,7 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
   passthru.updateScript = nix-update-script { };
 
   meta = {
-    homepage = "https://eigen.tuxfamily.org";
+    homepage = "https://libeigen.gitlab.io/";
     description = "C++ template library for linear algebra: vectors, matrices, and related algorithms";
     changelog = "https://gitlab.com/libeigen/eigen/-/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.lgpl3Plus;

From d2bd5feac5b8db8ba2bdce773c9a86c95c7a9c0a Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 13:59:36 -0300
Subject: [PATCH 455/525] eigen_3_4_0: fix homepage

---
 pkgs/by-name/ei/eigen_3_4_0/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ei/eigen_3_4_0/package.nix b/pkgs/by-name/ei/eigen_3_4_0/package.nix
index 774c9e89e651..b92fc2660b7b 100644
--- a/pkgs/by-name/ei/eigen_3_4_0/package.nix
+++ b/pkgs/by-name/ei/eigen_3_4_0/package.nix
@@ -37,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [ cmake ];
 
   meta = {
-    homepage = "https://eigen.tuxfamily.org";
+    homepage = "https://libeigen.gitlab.io/";
     description = "C++ template library for linear algebra: vectors, matrices, and related algorithms";
     license = lib.licenses.lgpl3Plus;
     maintainers = with lib.maintainers; [

From 46b986f9a8fe44d5e14fffa6c4ef12e0d8b5ccb4 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 13:59:23 -0300
Subject: [PATCH 456/525] eigen2: fix homepage

---
 pkgs/by-name/ei/eigen2/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ei/eigen2/package.nix b/pkgs/by-name/ei/eigen2/package.nix
index 660d758f827f..b8d59d996eb2 100644
--- a/pkgs/by-name/ei/eigen2/package.nix
+++ b/pkgs/by-name/ei/eigen2/package.nix
@@ -23,7 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
   patches = [ ./cmake-4-build.patch ];
 
   meta = {
-    homepage = "https://eigen.tuxfamily.org";
+    homepage = "https://libeigen.gitlab.io/";
     description = "C++ template library for linear algebra: vectors, matrices, and related algorithms";
     license = lib.licenses.lgpl3Plus;
     maintainers = with lib.maintainers; [

From 773563fb70d3197b7c33d3d3976515449022ac3f Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 13:59:09 -0300
Subject: [PATCH 457/525] eigen: fix homepage

---
 pkgs/by-name/ei/eigen/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ei/eigen/package.nix b/pkgs/by-name/ei/eigen/package.nix
index 8b1c86f12fd8..7700878c1122 100644
--- a/pkgs/by-name/ei/eigen/package.nix
+++ b/pkgs/by-name/ei/eigen/package.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
   __structuredAttrs = true;
 
   meta = {
-    homepage = "https://eigen.tuxfamily.org";
+    homepage = "https://libeigen.gitlab.io/";
     description = "C++ template library for linear algebra: vectors, matrices, and related algorithms";
     license = lib.licenses.lgpl3Plus;
     maintainers = with lib.maintainers; [

From 80d987991a89c59b9058d51d1cec489f8f2ff86d Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 13:56:56 -0300
Subject: [PATCH 458/525] libsepol: fix homepage

---
 pkgs/by-name/li/libsepol/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/li/libsepol/package.nix b/pkgs/by-name/li/libsepol/package.nix
index a81941faaf6c..1d28815ffb93 100644
--- a/pkgs/by-name/li/libsepol/package.nix
+++ b/pkgs/by-name/li/libsepol/package.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "SELinux binary policy manipulation library";
-    homepage = "http://userspace.selinuxproject.org";
+    homepage = "https://github.com/SELinuxProject/selinux";
     platforms = lib.platforms.linux;
     # Note: changing maintainers here changes maintainers for all SELinux-related libraries
     maintainers = with lib.maintainers; [

From 21450265c44594e91e79f1c46715496c86edcc37 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 13:55:02 -0300
Subject: [PATCH 459/525] cddiscid: fix homepage

---
 pkgs/by-name/cd/cddiscid/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/cd/cddiscid/package.nix b/pkgs/by-name/cd/cddiscid/package.nix
index e866796f09d5..83c904dfcbc1 100644
--- a/pkgs/by-name/cd/cddiscid/package.nix
+++ b/pkgs/by-name/cd/cddiscid/package.nix
@@ -19,7 +19,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   meta = {
-    homepage = "http://linukz.org/cd-discid.shtml";
+    homepage = "https://github.com/taem/cd-discid";
     license = lib.licenses.gpl2Plus;
     platforms = lib.platforms.unix;
     description = "Command-line utility to get CDDB discid information from a CD-ROM disc";

From 33bee2d20f310df093818d811548e1cc1f3a9795 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 13:54:54 -0300
Subject: [PATCH 460/525] cdist: fix homepage

---
 pkgs/by-name/cd/cdist/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/cd/cdist/package.nix b/pkgs/by-name/cd/cdist/package.nix
index b877f383572e..6da2bdf4608e 100644
--- a/pkgs/by-name/cd/cdist/package.nix
+++ b/pkgs/by-name/cd/cdist/package.nix
@@ -59,7 +59,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
 
   meta = {
     description = "Minimalistic configuration management system";
-    homepage = "https://www.sdi.st";
+    homepage = "https://www.cdi.st";
     changelog = "https://code.ungleich.ch/ungleich-public/cdist/src/tag/${finalAttrs.version}/docs/changelog";
 
     # Mostly. There are still couple types that are gpl3-only.

From 2398331594a9e4888c8c7aaa0b1f4035ee28110c Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 13:52:02 -0300
Subject: [PATCH 461/525] cd-hit: fix homepage

---
 pkgs/by-name/cd/cd-hit/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/cd/cd-hit/package.nix b/pkgs/by-name/cd/cd-hit/package.nix
index 11eb2fe7646f..819357235139 100644
--- a/pkgs/by-name/cd/cd-hit/package.nix
+++ b/pkgs/by-name/cd/cd-hit/package.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation rec {
   '';
   meta = {
     description = "Clustering and comparing protein or nucleotide sequences";
-    homepage = "http://weizhongli-lab.org/cd-hit/";
+    homepage = "https://github.com/weizhongli/cdhit";
     license = lib.licenses.gpl2;
     maintainers = [ lib.maintainers.bzizou ];
     platforms = lib.platforms.unix;

From 56aa334b227d25fa7e262d0aee7d5908f14c1a5c Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 13:51:37 -0300
Subject: [PATCH 462/525] cctv-viewer: fix homepage

---
 pkgs/by-name/cc/cctv-viewer/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/cc/cctv-viewer/package.nix b/pkgs/by-name/cc/cctv-viewer/package.nix
index 089b55b0c568..bfa3192e0b23 100644
--- a/pkgs/by-name/cc/cctv-viewer/package.nix
+++ b/pkgs/by-name/cc/cctv-viewer/package.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation {
 
   meta = {
     description = "Viewer and mounter for video streams";
-    homepage = "https://cctv-viewer.org";
+    homepage = "https://github.com/iEvgeny/cctv-viewer";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [ teohz ];
     platforms = lib.platforms.linux;

From 68b4e4b201a5de937d1f35c44f38b4d41c1c9682 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 13:47:26 -0300
Subject: [PATCH 463/525] bullet: fix homepage

---
 pkgs/by-name/bu/bullet/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/bu/bullet/package.nix b/pkgs/by-name/bu/bullet/package.nix
index ed46639f290b..0cb491932a32 100644
--- a/pkgs/by-name/bu/bullet/package.nix
+++ b/pkgs/by-name/bu/bullet/package.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
       Bullet 3D Game Multiphysics Library provides state of the art collision
       detection, soft body and rigid body dynamics.
     '';
-    homepage = "http://bulletphysics.org";
+    homepage = "https://github.com/bulletphysics/bullet3";
     license = lib.licenses.zlib;
     maintainers = with lib.maintainers; [ aforemny ];
     platforms = lib.platforms.unix;

From 149088d3f11e34c70db83fec48cfe5b49f770eee Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 13:46:49 -0300
Subject: [PATCH 464/525] bsdgames: fix homepage

---
 pkgs/by-name/bs/bsdgames/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/bs/bsdgames/package.nix b/pkgs/by-name/bs/bsdgames/package.nix
index 9fca2faa5ffd..807e915f908b 100644
--- a/pkgs/by-name/bs/bsdgames/package.nix
+++ b/pkgs/by-name/bs/bsdgames/package.nix
@@ -102,7 +102,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   meta = {
-    homepage = "http://www.t2-project.org/packages/bsd-games.html";
+    homepage = "https://t2linux.com/packages/bsd-games.html";
     description = "Ports of all the games from NetBSD-current that are free";
     license = lib.licenses.free;
     maintainers = with lib.maintainers; [ viric ];

From e6b1842c6864e273f2910ff3f33f762f7cf1967d Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 13:36:51 -0300
Subject: [PATCH 465/525] azpainter: fix homepage

---
 pkgs/by-name/az/azpainter/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/az/azpainter/package.nix b/pkgs/by-name/az/azpainter/package.nix
index 585f0d2e0f06..132da25b120c 100644
--- a/pkgs/by-name/az/azpainter/package.nix
+++ b/pkgs/by-name/az/azpainter/package.nix
@@ -63,7 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Full color painting software for illustration drawing";
-    homepage = "http://azsky2.html.xdomain.jp/soft/azpainter.html";
+    homepage = "https://azelpg.gitlab.io/azsky2/";
     license = lib.licenses.gpl3Plus;
     maintainers = [ ];
     platforms = with lib.platforms; linux ++ darwin;

From 5b511826d49742b163db9d60bc26ef4e744a65b8 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 13:36:04 -0300
Subject: [PATCH 466/525] aurulent-sans: fix homepage

---
 pkgs/by-name/au/aurulent-sans/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/au/aurulent-sans/package.nix b/pkgs/by-name/au/aurulent-sans/package.nix
index 62d438afb654..444b5797e184 100644
--- a/pkgs/by-name/au/aurulent-sans/package.nix
+++ b/pkgs/by-name/au/aurulent-sans/package.nix
@@ -24,7 +24,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   meta = {
     description = "Aurulent Sans";
     longDescription = "Aurulent Sans is a humanist sans serif intended to be used as an interface font";
-    homepage = "http://delubrum.org/";
+    homepage = "https://github.com/deepfire/hartke-aurulent-sans";
     maintainers = with lib.maintainers; [ pancaek ];
     license = lib.licenses.ofl;
     platforms = lib.platforms.all;

From 84d099c8063951d851d849fa3f29937d960f1f8a Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 13:33:33 -0300
Subject: [PATCH 467/525] apfel: fix homepage

---
 pkgs/by-name/ap/apfel/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ap/apfel/package.nix b/pkgs/by-name/ap/apfel/package.nix
index 71ff36540574..675b5201380e 100644
--- a/pkgs/by-name/ap/apfel/package.nix
+++ b/pkgs/by-name/ap/apfel/package.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "PDF Evolution Library";
-    homepage = "https://apfel.mi.infn.it/";
+    homepage = "https://github.com/scarrazza/apfel";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [ veprbl ];
     platforms = lib.platforms.unix;

From ac8a3a80504960df4ef1ebb75111efdc8d6f0f45 Mon Sep 17 00:00:00 2001
From: RogueOneEcho <Um9ndWVPbmVFY2hv@pm.me>
Date: Sun, 11 Oct 2026 14:32:13 +0100
Subject: [PATCH 468/525] caesura: 0.31.0 -> 0.32.0

https://github.com/RogueOneEcho/caesura/releases/tag/v0.32.0

- Drop spectrogram width patch
- Drop `cacert`, `SSL_CERT_FILE` and `CAESURA_NIX`; tests no longer make HTTP requests
- Add install check with `caesura version --offline`
---
 pkgs/by-name/ca/caesura/package.nix | 25 +++++++------------------
 1 file changed, 7 insertions(+), 18 deletions(-)

diff --git a/pkgs/by-name/ca/caesura/package.nix b/pkgs/by-name/ca/caesura/package.nix
index ff1ef9060abe..3b16e91fe402 100644
--- a/pkgs/by-name/ca/caesura/package.nix
+++ b/pkgs/by-name/ca/caesura/package.nix
@@ -1,9 +1,7 @@
 {
   lib,
   fetchFromGitHub,
-  fetchpatch2,
   rustPlatform,
-  cacert,
   writableTmpDirAsHomeHook,
   flac,
   lame,
@@ -19,39 +17,25 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "caesura";
-  version = "0.31.0";
+  version = "0.32.0";
 
   src = fetchFromGitHub {
     owner = "RogueOneEcho";
     repo = "caesura";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-+REt+MKImO7fnYWJ32P6mKzulGJTnxc+9ednVF5aCJU=";
+    hash = "sha256-7PRYjKwnLiHLQ0+egzwf3YAmyu6+/2ysHfMmyv/VUZY=";
   };
 
-  patches = [
-    (fetchpatch2 {
-      name = "normalize-sox-dependent-full-spectrogram-widths.patch";
-      url = "https://github.com/RogueOneEcho/caesura/commit/3af818ae35a3e18f444c889d9d3b88294f4f110f.patch?full_index=1";
-      hash = "sha256-znAbk6hFVj198BUUwwDo76SWei0cKINeXzlYEFvTwHA=";
-    })
-  ];
-
   cargoHash = "sha256-0+vZma8AC44XqVHzmJT/roV7sy8w6DYhujRK9N91J5c=";
 
   nativeBuildInputs = [
     makeBinaryWrapper
   ];
   nativeCheckInputs = [
-    cacert
     writableTmpDirAsHomeHook
   ]
   ++ runtimeDeps;
 
-  env = {
-    CAESURA_NIX = "1";
-    SSL_CERT_FILE = "${cacert}/etc/ssl/certs/ca-bundle.crt";
-  };
-
   postPatch = ''
     substituteInPlace Cargo.toml crates/*/Cargo.toml \
       --replace-fail 'version = "0.0.0"' 'version = "${finalAttrs.version}"'
@@ -68,6 +52,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --prefix PATH : ${lib.makeBinPath finalAttrs.passthru.runtimeDeps}
   '';
 
+  doInstallCheck = true;
+  installCheckPhase = ''
+    $out/bin/caesura version --offline
+  '';
+
   passthru = {
     inherit runtimeDeps;
   };

From 49a7e43a7d8a0dc43bfc2c51a1508340c481488d Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sun, 11 Oct 2026 13:52:42 +0000
Subject: [PATCH 469/525] linux_7_2: 7.2.9 -> 7.2.10

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index f18f063c3fe6..d91373420c6b 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -25,8 +25,8 @@
         "lts": true
     },
     "7.2": {
-        "version": "7.2.9",
-        "hash": "sha256:1fnqp28vrikz9gqhb42k0dsggqf8i07j0s9qy33scr53a6zdzidl",
+        "version": "7.2.10",
+        "hash": "sha256:1wzbyb7kh1c5aj073nd38npq3q38h66hgjd5wqdm87z9ac2agsig",
         "lts": false
     }
 }

From 764c4eaef7cbff1c8342c9ff01ea6ced7d2b3ccc Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sun, 11 Oct 2026 13:52:45 +0000
Subject: [PATCH 470/525] linux_6_18: 6.18.55 -> 6.18.56

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index d91373420c6b..4d2fed9dbe0b 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -20,8 +20,8 @@
         "lts": true
     },
     "6.18": {
-        "version": "6.18.55",
-        "hash": "sha256:1yadaa2gz74nh3pawpwv6lamalnd7wpiv1xb88pw2rd1c606647l",
+        "version": "6.18.56",
+        "hash": "sha256:12dzxyn3ljxg65ajcik95v3mjrqx8lv1417lg8maypmr5bdbncs6",
         "lts": true
     },
     "7.2": {

From 259af5471039f88e44edf6d68abc3aea1c2ee635 Mon Sep 17 00:00:00 2001
From: Frederic Ruget <fred@atlant.is>
Date: Sat, 10 Oct 2026 19:13:08 +0000
Subject: [PATCH 471/525] prototext: init at 0.3.0

Assisted-by: Claude Code (Claude Opus 5.5)
---
 pkgs/by-name/pr/prototext/package.nix | 79 +++++++++++++++++++++++++++
 1 file changed, 79 insertions(+)
 create mode 100644 pkgs/by-name/pr/prototext/package.nix

diff --git a/pkgs/by-name/pr/prototext/package.nix b/pkgs/by-name/pr/prototext/package.nix
new file mode 100644
index 000000000000..b1b587f27e46
--- /dev/null
+++ b/pkgs/by-name/pr/prototext/package.nix
@@ -0,0 +1,79 @@
+{
+  lib,
+  stdenv,
+  rustPlatform,
+  fetchFromGitHub,
+  installShellFiles,
+  protobuf,
+  versionCheckHook,
+
+  # passthru
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "prototext";
+  version = "0.3.0";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "douzebis";
+    repo = "prototools";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ka/Pg/YMrRPYaUO4M1fdevLSPyZ+8XhWYa2EQu3Xq6o=";
+  };
+
+  cargoHash = "sha256-5DgWKXYzrEB/3l2uDs2vc/VwRMlZ5trwJhor4ZnHEaw=";
+
+  cargoBuildFlags = [
+    "-p"
+    "prototext"
+  ];
+  cargoTestFlags = [
+    "-p"
+    "prototext"
+  ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  # The roundtrip tests compare with protoc's decoding; without it, they skip.
+  nativeCheckInputs = [ protobuf ];
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd prototext \
+      --bash <(PROTOTEXT_COMPLETE=bash $out/bin/prototext) \
+      --zsh <(PROTOTEXT_COMPLETE=zsh $out/bin/prototext) \
+      --fish <(PROTOTEXT_COMPLETE=fish $out/bin/prototext)
+    $out/bin/prototext-gen-man $out/share/man/man1
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  # Only v-prefixed release tags: the repository also has workshop tags
+  # (grehack2026-*), which are not versions.
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "^v(\\d+\\.\\d+\\.\\d+)$"
+    ];
+  };
+
+  meta = {
+    description = "Lossless converter between binary protobuf and enhanced textproto";
+    longDescription = ''
+      prototext decodes binary protobuf to an enhanced textproto and encodes
+      it back, byte for byte, with or without the message's schema. Given a
+      schema database it infers the message type, and it reports every
+      encoding anomaly it meets (non-canonical varints, unknown fields,
+      wire-type mismatches) in the text, so that the round trip stays
+      lossless.
+    '';
+    homepage = "https://github.com/douzebis/prototools";
+    changelog = "https://github.com/douzebis/prototools/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ douzebis ];
+    mainProgram = "prototext";
+    platforms = lib.platforms.unix;
+  };
+})

From a8543e0c8258eb26c31f0a207554d5790ffde161 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 14:16:39 -0300
Subject: [PATCH 472/525] fxlinuxprintutil: fix homepage

---
 pkgs/by-name/fx/fxlinuxprintutil/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/fx/fxlinuxprintutil/package.nix b/pkgs/by-name/fx/fxlinuxprintutil/package.nix
index 2bc0a978e924..119d5de7e92c 100644
--- a/pkgs/by-name/fx/fxlinuxprintutil/package.nix
+++ b/pkgs/by-name/fx/fxlinuxprintutil/package.nix
@@ -78,7 +78,7 @@ stdenv.mkDerivation rec {
 
   meta = {
     description = "Optional configuration tool for fxlinuxprint";
-    homepage = "https://onlinesupport.fujixerox.com";
+    homepage = "https://support-fb.fujifilm.com/";
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     maintainers = [ ];

From 93e4e536933ee2da5d648c31b7dc17d882dff6f1 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 14:16:22 -0300
Subject: [PATCH 473/525] fxlinuxprint: fix homepage

---
 pkgs/by-name/fx/fxlinuxprint/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/fx/fxlinuxprint/package.nix b/pkgs/by-name/fx/fxlinuxprint/package.nix
index be2b75c669fa..f89af12cb5d6 100644
--- a/pkgs/by-name/fx/fxlinuxprint/package.nix
+++ b/pkgs/by-name/fx/fxlinuxprint/package.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
       DocuCentre-VI C2271/C3370/C3371/C4471/C5571/C6671/C7771
       DocuPrint 3205 d/3208 d/3505 d/3508 d/4405 d/4408 d
     '';
-    homepage = "https://onlinesupport.fujixerox.com";
+    homepage = "https://support-fb.fujifilm.com/";
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     license = lib.licenses.unfree;
     maintainers = [ ];

From 40aa9479574ece6c611840b487c169d389b2fbb7 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 14:13:31 -0300
Subject: [PATCH 474/525] fixedsys-excelsior: fix homepage

---
 pkgs/by-name/fi/fixedsys-excelsior/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/fi/fixedsys-excelsior/package.nix b/pkgs/by-name/fi/fixedsys-excelsior/package.nix
index f0d4154b98fd..1549d1b19a9b 100644
--- a/pkgs/by-name/fi/fixedsys-excelsior/package.nix
+++ b/pkgs/by-name/fi/fixedsys-excelsior/package.nix
@@ -24,7 +24,7 @@ stdenvNoCC.mkDerivation rec {
   '';
 
   meta = {
-    homepage = "http://www.fixedsysexcelsior.com/";
+    homepage = "https://github.com/chrissimpkins/codeface";
     description = "Pan-unicode version of Fixedsys, a classic DOS font";
     platforms = lib.platforms.all;
     license = lib.licenses.publicDomain;

From 7c636eabb96eb27f584405581fca696968687a87 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 14:12:27 -0300
Subject: [PATCH 475/525] fbset: fix homepage

---
 pkgs/by-name/fb/fbset/package.nix | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/pkgs/by-name/fb/fbset/package.nix b/pkgs/by-name/fb/fbset/package.nix
index b774a3906eca..cee8247b4edd 100644
--- a/pkgs/by-name/fb/fbset/package.nix
+++ b/pkgs/by-name/fb/fbset/package.nix
@@ -33,10 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Framebuffer device maintenance program";
-    # NOTE: the website of the original author disappeared, the only remaining
-    # repository is maintained by the debian maintainer of the package at
-    # https://github.com/sudipm-mukherjee/fbset
-    homepage = "http://users.telenet.be/geertu/Linux/fbdev/";
+    homepage = "https://github.com/sudipm-mukherjee/fbset";
     license = lib.licenses.gpl2Only;
     mainProgram = "fbset";
     maintainers = with lib.maintainers; [ baloo ];

From e1c46a15b08c991f72f8443d7874989d5780fa5f Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 14:11:45 -0300
Subject: [PATCH 476/525] fastd: fix homepage

---
 pkgs/by-name/fa/fastd/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/fa/fastd/package.nix b/pkgs/by-name/fa/fastd/package.nix
index 6c53a65b74b4..386e5d5dffa5 100644
--- a/pkgs/by-name/fa/fastd/package.nix
+++ b/pkgs/by-name/fa/fastd/package.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   meta = {
     description = "Fast and Secure Tunneling Daemon";
-    homepage = "https://projects.universe-factory.net/projects/fastd/wiki";
+    homepage = "https://fastd.readthedocs.io/";
     license = with lib.licenses; [
       bsd2
       bsd3

From 63918e6fadd1bf524224a56439f4762c40f47ea1 Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 14:11:11 -0300
Subject: [PATCH 477/525] evans: fix homepage

---
 pkgs/by-name/ev/evans/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ev/evans/package.nix b/pkgs/by-name/ev/evans/package.nix
index 5d66dfad7e8f..2cf754f8119a 100644
--- a/pkgs/by-name/ev/evans/package.nix
+++ b/pkgs/by-name/ev/evans/package.nix
@@ -22,7 +22,7 @@ buildGoModule (finalAttrs: {
   meta = {
     description = "More expressive universal gRPC client";
     mainProgram = "evans";
-    homepage = "https://evans.syfm.me/";
+    homepage = "https://github.com/ktr0731/evans";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ diogox ];
   };

From 2f491975b36316963fa264e55aa8438e5f7c11db Mon Sep 17 00:00:00 2001
From: Eric Rodrigues Pires <eric@eric.dev.br>
Date: Sun, 20 Sep 2026 14:10:42 -0300
Subject: [PATCH 478/525] enlightenment.ephoto: fix homepage

---
 pkgs/desktops/enlightenment/ephoto/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/desktops/enlightenment/ephoto/default.nix b/pkgs/desktops/enlightenment/ephoto/default.nix
index bc26507df812..7aba470668f1 100644
--- a/pkgs/desktops/enlightenment/ephoto/default.nix
+++ b/pkgs/desktops/enlightenment/ephoto/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Image viewer and editor written using the Enlightenment Foundation Libraries";
     mainProgram = "ephoto";
-    homepage = "https://www.smhouston.us/ephoto/";
+    homepage = "https://www.enlightenment.org/about-ephoto";
     license = lib.licenses.bsd2;
     platforms = lib.platforms.linux;
     teams = [ lib.teams.enlightenment ];

From 72315501e3517c0eed1fb76ee64d35bed0d0f5c7 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Sun, 11 Oct 2026 13:46:31 +0000
Subject: [PATCH 479/525] mistral-rs: replace meta.broken with meta.problems

---
 pkgs/by-name/mi/mistral-rs/package.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/mi/mistral-rs/package.nix b/pkgs/by-name/mi/mistral-rs/package.nix
index 00745ebebd18..8d7d31caf092 100644
--- a/pkgs/by-name/mi/mistral-rs/package.nix
+++ b/pkgs/by-name/mi/mistral-rs/package.nix
@@ -294,6 +294,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
         [ "x86_64-linux" ]
       else
         lib.platforms.unix;
-    broken = mklSupport;
+    problems = lib.optionalAttrs mklSupport {
+      broken-mkl-support = {
+        kind = "broken";
+        message = "mistral-rs' MKL support is currently broken.";
+      };
+    };
   };
 })

From d93a9f1ea78136d985e1c24dd2e00725adebed29 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Sun, 11 Oct 2026 13:57:13 +0000
Subject: [PATCH 480/525] mistral-rs: mark as broken on cuda 13.4

---
 pkgs/by-name/mi/mistral-rs/package.nix | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/mi/mistral-rs/package.nix b/pkgs/by-name/mi/mistral-rs/package.nix
index 8d7d31caf092..e7e48296088c 100644
--- a/pkgs/by-name/mi/mistral-rs/package.nix
+++ b/pkgs/by-name/mi/mistral-rs/package.nix
@@ -294,11 +294,18 @@ rustPlatform.buildRustPackage (finalAttrs: {
         [ "x86_64-linux" ]
       else
         lib.platforms.unix;
-    problems = lib.optionalAttrs mklSupport {
-      broken-mkl-support = {
-        kind = "broken";
-        message = "mistral-rs' MKL support is currently broken.";
+    problems =
+      lib.optionalAttrs mklSupport {
+        broken-mkl-support = {
+          kind = "broken";
+          message = "mistral-rs' MKL support is currently broken.";
+        };
+      }
+      // lib.optionalAttrs (cudaSupport && (cudaPackages.cudaAtLeast "13.4")) {
+        unsupported-cuda-toolkit = {
+          kind = "broken";
+          message = "mistral-rs is not compatible with CUDA ${cudaPackages.cudaMajorMinorVersion}.";
+        };
       };
-    };
   };
 })

From d0123a29f7e1dd5866671987d29e4d8002090e77 Mon Sep 17 00:00:00 2001
From: Nia <hakase@litdevs.org>
Date: Sun, 11 Oct 2026 16:10:52 +0200
Subject: [PATCH 481/525] raycast: 2.6.3.0 -> 2.7.3.0

---
 pkgs/by-name/ra/raycast/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ra/raycast/package.nix b/pkgs/by-name/ra/raycast/package.nix
index 30662a247f6d..45ca493b8dc2 100644
--- a/pkgs/by-name/ra/raycast/package.nix
+++ b/pkgs/by-name/ra/raycast/package.nix
@@ -11,15 +11,15 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "raycast";
-  version = "2.6.3.0";
+  version = "2.7.3.0";
 
   __structuredAttrs = true;
   strictDeps = true;
 
   src = fetchurl {
     name = "Raycast.dmg";
-    url = "https://x-r2.raycast-releases.com/Raycast_2.6.3.0_2bca862541_arm64.dmg";
-    hash = "sha256-s5xIV0SN6mzkLoBWdfoqTu/hUhIXUzQOmRyIygVZCLE=";
+    url = "https://x-r2.raycast-releases.com/Raycast_2.7.3.0_758e1a8dbb_arm64.dmg";
+    hash = "sha256-7b20Mc93W48NTOm/68d+YwXQLTPFJfBdEfrKFztihuw=";
   };
 
   dontPatch = true;

From d7c1ed0f3d59eb5a92e67180b1fe63602ba30595 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Sat, 10 Oct 2026 21:02:46 +0000
Subject: [PATCH 482/525] python3Packages.radio-beam: 0.3.9 -> 0.3.10

Changelog: https://github.com/radio-astro-tools/radio-beam/releases/tag/v0.3.10
---
 .../python-modules/radio-beam/default.nix     | 34 ++++++++++++-------
 1 file changed, 22 insertions(+), 12 deletions(-)

diff --git a/pkgs/development/python-modules/radio-beam/default.nix b/pkgs/development/python-modules/radio-beam/default.nix
index 9ad35951491c..4b562dde5be2 100644
--- a/pkgs/development/python-modules/radio-beam/default.nix
+++ b/pkgs/development/python-modules/radio-beam/default.nix
@@ -1,31 +1,41 @@
 {
   lib,
-  fetchPypi,
   buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
   setuptools-scm,
+
+  # dependencies
   astropy,
   numpy,
   matplotlib,
   scipy,
   six,
+
+  # tests
   pytestCheckHook,
   pytest-astropy,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "radio-beam";
-  version = "0.3.9";
+  version = "0.3.10";
   pyproject = true;
+  __structuredAttrs = true;
 
-  src = fetchPypi {
-    inherit version;
-    pname = "radio_beam"; # Tarball was uploaded with an underscore in this version
-    hash = "sha256-m1/qe8ybJlQyE3hGM7MugWMMnAhVB3t6v0tGz42E5kQ=";
+  src = fetchFromGitHub {
+    owner = "radio-astro-tools";
+    repo = "radio-beam";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-EO3tyT2wF3TeXDRCt7WUoSEd1s+umciGEkdgA4Bfmqs=";
   };
 
-  nativeBuildInputs = [ setuptools-scm ];
+  build-system = [
+    setuptools-scm
+  ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     astropy
     numpy
     scipy
@@ -33,9 +43,9 @@ buildPythonPackage rec {
   ];
 
   nativeCheckInputs = [
-    pytestCheckHook
     matplotlib
     pytest-astropy
+    pytestCheckHook
   ];
 
   pythonImportsCheck = [ "radio_beam" ];
@@ -43,8 +53,8 @@ buildPythonPackage rec {
   meta = {
     description = "Tools for Beam IO and Manipulation";
     homepage = "http://radio-astro-tools.github.io";
-    changelog = "https://github.com/radio-astro-tools/radio-beam/releases/tag/v${version}";
+    changelog = "https://github.com/radio-astro-tools/radio-beam/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ smaret ];
   };
-}
+})

From 34dfe4fd9c6597f1773679b62ea54bf61692c6b6 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Fri, 9 Oct 2026 14:09:32 +0000
Subject: [PATCH 483/525] python3Packages.spectral-cube: 0.6.7 -> 0.7.0

Diff: https://github.com/radio-astro-tools/spectral-cube/compare/v0.6.7...v0.7.0

Changelog: https://github.com/radio-astro-tools/spectral-cube/releases/tag/v0.7.0
---
 .../python-modules/spectral-cube/default.nix        | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/spectral-cube/default.nix b/pkgs/development/python-modules/spectral-cube/default.nix
index 7ae803f315c6..b70bf47d25fc 100644
--- a/pkgs/development/python-modules/spectral-cube/default.nix
+++ b/pkgs/development/python-modules/spectral-cube/default.nix
@@ -24,16 +24,17 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "spectral-cube";
-  version = "0.6.7";
+  version = "0.7.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "radio-astro-tools";
     repo = "spectral-cube";
-    tag = "v${version}";
-    hash = "sha256-l5r7oeWr/JrmGOmUo4po2VlGldh8y7E3ufd+Gw1/JmM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-G/G3OtyhJ84KfnsmrOMK8Z6I/QTp8Wr8Fdo5R1CRnwU=";
   };
 
   build-system = [
@@ -84,8 +85,8 @@ buildPythonPackage rec {
   meta = {
     description = "Library for reading and analyzing astrophysical spectral data cubes";
     homepage = "https://spectral-cube.readthedocs.io";
-    changelog = "https://github.com/radio-astro-tools/spectral-cube/releases/tag/v${version}";
+    changelog = "https://github.com/radio-astro-tools/spectral-cube/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ smaret ];
   };
-}
+})

From 5f66d26746b09b9ce0dae2d593f75fe3d4b8ff59 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?L=C3=A9ana?= <leana.jiang+git@icloud.com>
Date: Sun, 11 Oct 2026 16:29:47 +0200
Subject: [PATCH 484/525] gnome: remove unused installerIso module

---
 pkgs/desktops/gnome/default.nix   |  3 ---
 pkgs/desktops/gnome/installer.nix | 22 ----------------------
 2 files changed, 25 deletions(-)
 delete mode 100644 pkgs/desktops/gnome/installer.nix

diff --git a/pkgs/desktops/gnome/default.nix b/pkgs/desktops/gnome/default.nix
index 1fd527d60fc3..0375cc05d60f 100644
--- a/pkgs/desktops/gnome/default.nix
+++ b/pkgs/desktops/gnome/default.nix
@@ -17,9 +17,6 @@ lib.makeScope pkgs.newScope (
     # This will go away, do not use outside Nixpkgs.
     _gdkPixbufCacheBuilder_DO_NOT_USE = callPackage ./gdk-pixbuf-cache-builder.nix { };
 
-    # ISO installer
-    # installerIso = callPackage ./installer.nix {};
-
     #### Core (http://ftp.acc.umu.se/pub/GNOME/core/)
 
     gvfs = pkgs.gvfs.override { gnomeSupport = true; };
diff --git a/pkgs/desktops/gnome/installer.nix b/pkgs/desktops/gnome/installer.nix
deleted file mode 100644
index 3076a9a872cd..000000000000
--- a/pkgs/desktops/gnome/installer.nix
+++ /dev/null
@@ -1,22 +0,0 @@
-{
-  isoBaseName ? "nixos-graphical-gnome",
-  system ? builtins.currentSystem,
-  extraModules ? [ ],
-}:
-
-let
-
-  module = ../../../../nixos/modules/installer/cd-dvd/installation-cd-graphical-gnome.nix;
-
-  config =
-    (import ../../../../nixos/lib/eval-config.nix {
-      inherit system;
-      modules = [
-        module
-        { image.baseName = isoBaseName; }
-      ]
-      ++ extraModules;
-    }).config;
-
-in
-config.system.build.isoImage

From 23f2c6d0462003145d3a81b8c8b248e38d73862b Mon Sep 17 00:00:00 2001
From: heki <186204649+ferris-qq@users.noreply.github.com>
Date: Fri, 2 Oct 2026 23:11:43 +0400
Subject: [PATCH 485/525] nixos/nvidia: enable acpid with mkDefault

Otherwise, one has to `lib.mkForce false`.

Assisted-by: Claude Code (Claude Opus 5.5)
---
 nixos/modules/hardware/video/nvidia.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/hardware/video/nvidia.nix b/nixos/modules/hardware/video/nvidia.nix
index 68ed2cb3a3fb..91424fbb643d 100644
--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@@ -777,7 +777,7 @@ in
               })
             ];
 
-          services.acpid.enable = true;
+          services.acpid.enable = lib.mkDefault true;
 
           services.dbus.packages = lib.optional cfg.dynamicBoost.enable nvidia_x11.bin;
 

From 5df5a24a7a90f2e5092eac6590f9b45a0f32ff7d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 09:29:42 +0000
Subject: [PATCH 486/525] forecast: 0-unstable-2026-09-29 ->
 0-unstable-2026-10-01

---
 pkgs/by-name/fo/forecast/package.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fo/forecast/package.nix b/pkgs/by-name/fo/forecast/package.nix
index 37ca504f2eff..41a6f02abb4b 100644
--- a/pkgs/by-name/fo/forecast/package.nix
+++ b/pkgs/by-name/fo/forecast/package.nix
@@ -16,13 +16,14 @@
 
 rustPlatform.buildRustPackage {
   pname = "forecast";
-  version = "0-unstable-2026-09-29";
+  version = "0-unstable-2026-10-01";
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "cosmic-utils";
     repo = "forecast";
-    rev = "5e4d33ebe06eae86612213c1cd153b3de0cbeb05";
-    hash = "sha256-ESjZ1N/tZxJ44DE0YBOqxboU4QQCxYymzYmJ6J/DCxM=";
+    rev = "86b44fa1643e72e127933a8a7e9599b84d4c73b5";
+    hash = "sha256-acr3o76CQoJAMXvFGl6y6gcoiJlbOS9f5xS3SxnhueQ=";
   };
 
   cargoHash = "sha256-S27A8pn+mrbUmuo5Wd1C9R9r6UxGFAAL9od6tpsBWPY=";

From 9772afce7852507b165290dc6c095d681260e017 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 14:53:22 +0000
Subject: [PATCH 487/525] depot-cli: 2.102.14 -> 2.102.19

---
 pkgs/by-name/de/depot-cli/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/de/depot-cli/package.nix b/pkgs/by-name/de/depot-cli/package.nix
index 971821f4d51d..fbaf68991136 100644
--- a/pkgs/by-name/de/depot-cli/package.nix
+++ b/pkgs/by-name/de/depot-cli/package.nix
@@ -10,7 +10,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "depot-cli";
-  version = "2.102.14";
+  version = "2.102.19";
 
   __structuredAttrs = true;
   __darwinAllowLocalNetworking = true;
@@ -19,7 +19,7 @@ buildGoModule (finalAttrs: {
     owner = "depot";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9/XgZKG4amV04Mu9SPDVszsfAngDaCbRn+kZlu7fnKo=";
+    hash = "sha256-7LfluyZP8FL4OYG3/ovdiMJkm21EAkuSeqIISUjLrFs=";
   };
 
   vendorHash = "sha256-VCd0qdEmjuTB5HvQ9jEVoKKSKJpPxQ7iHOFQoifPIgY=";

From 8012cedc843d93b5c184d41455e9109c5f5d75b7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 14:59:33 +0000
Subject: [PATCH 488/525] zerobyte: 0.43.1 -> 0.43.2

---
 pkgs/by-name/ze/zerobyte/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ze/zerobyte/package.nix b/pkgs/by-name/ze/zerobyte/package.nix
index 89f8b90efc3e..2815066868ec 100644
--- a/pkgs/by-name/ze/zerobyte/package.nix
+++ b/pkgs/by-name/ze/zerobyte/package.nix
@@ -68,14 +68,14 @@ let
       # Required, otherwise the fixed-output derivation references store paths.
       dontFixup = true;
 
-      outputHash = "sha256-dW1OJ2AE4HaaJQAHPuyLu5vyv7It3r6OeXlAzEc4OlI=";
+      outputHash = "sha256-4MuYKmi4Vit50g5kUQhHuTTyz7aL73igFcD0yaLRckw=";
       outputHashAlgo = "sha256";
       outputHashMode = "recursive";
     };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "zerobyte";
-  version = "0.43.1";
+  version = "0.43.2";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -84,7 +84,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "nicotsx";
     repo = "zerobyte";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-iZmXWxPnp7vYt3joPbluYQ3GXKGoN9qcrUfkWTO3Y7c=";
+    hash = "sha256-Bv2ZFOWYiKEwjVLHnAY/N8+KqZVaF03mRGl9rkNyohI=";
   };
 
   nativeBuildInputs = [

From 782f778de53d5a92e132805c721cbc33b18ddfa9 Mon Sep 17 00:00:00 2001
From: Moraxyc <i@qaq.li>
Date: Wed, 12 Aug 2026 09:49:00 +0800
Subject: [PATCH 489/525] chatgpt: support linux

Assisted-by: OpenAI Codex, GPT-5, GPT-6, GPT-6.1
Co-authored-by: Michael Daniels <mdaniels5757@gmail.com>
Co-authored-by: ooonea <35407790+ooonea@users.noreply.github.com>
---
 pkgs/by-name/ch/chatgpt/launcher.nix  |  67 +++++++
 pkgs/by-name/ch/chatgpt/package.nix   | 259 ++++++++++++++++++++++++--
 pkgs/by-name/ch/chatgpt/source.json   |  23 +++
 pkgs/by-name/ch/chatgpt/source.nix    |   7 -
 pkgs/by-name/ch/chatgpt/tmpfiles.conf |   1 +
 pkgs/by-name/ch/chatgpt/update.sh     | 112 +++++++++--
 6 files changed, 429 insertions(+), 40 deletions(-)
 create mode 100644 pkgs/by-name/ch/chatgpt/launcher.nix
 create mode 100644 pkgs/by-name/ch/chatgpt/source.json
 delete mode 100644 pkgs/by-name/ch/chatgpt/source.nix
 create mode 100644 pkgs/by-name/ch/chatgpt/tmpfiles.conf

diff --git a/pkgs/by-name/ch/chatgpt/launcher.nix b/pkgs/by-name/ch/chatgpt/launcher.nix
new file mode 100644
index 000000000000..403b9b45e3bc
--- /dev/null
+++ b/pkgs/by-name/ch/chatgpt/launcher.nix
@@ -0,0 +1,67 @@
+# Electron rewrites bundled plugin manifests, so they need a writable copy.
+{
+  coreutils,
+  flock,
+  writeShellApplication,
+}:
+
+writeShellApplication {
+  name = "chatgpt-launcher";
+
+  runtimeInputs = [
+    coreutils
+    flock
+  ];
+
+  text = ''
+    : "''${CHATGPT_EXECUTABLE:?}"
+    : "''${CHATGPT_RESOURCES_SOURCE:?}"
+    : "''${CHATGPT_RESOURCES_CACHE_KEY:?}"
+
+    cacheHome="''${XDG_CACHE_HOME:-''${HOME:?XDG_CACHE_HOME and HOME are unset}/.cache}"
+    cacheRoot="$cacheHome/chatgpt/bundled-plugins-v2"
+    resourcesPath="$cacheRoot/$CHATGPT_RESOURCES_CACHE_KEY"
+
+    mkdir -p "$cacheRoot"
+    exec {initLockFd}> "$cacheRoot.lock"
+    flock --exclusive "$initLockFd"
+
+    # tmpfiles may remove the directory before its lock is acquired.
+    while true; do
+      mkdir -p "$resourcesPath"
+      if exec {resourcesLockFd}< "$resourcesPath"; then
+        flock --shared "$resourcesLockFd"
+        [[ "$resourcesPath" -ef "/proc/self/fd/$resourcesLockFd" ]] && break
+        exec {resourcesLockFd}>&-
+      else
+        [[ ! -d "$resourcesPath" ]] || exit 1
+      fi
+    done
+
+    if [[ ! -f "$resourcesPath/.complete" ]]; then
+      ln -sfn -t "$resourcesPath" \
+        "$CHATGPT_RESOURCES_SOURCE"/{codex,codex-code-mode-host,cua_node,native,rg,tectonic}
+      mkdir -p "$resourcesPath/plugins"
+      chmod -R u+w "$resourcesPath/plugins"
+      cp -RT --preserve=mode "$CHATGPT_RESOURCES_SOURCE/plugins" "$resourcesPath/plugins"
+      chmod -R u+w "$resourcesPath/plugins"
+      sync --file-system "$resourcesPath"
+      touch "$resourcesPath/.complete"
+      sync --file-system "$resourcesPath"
+    fi
+    exec {initLockFd}>&-
+
+    export CODEX_ELECTRON_BUNDLED_PLUGINS_RESOURCES_PATH="$resourcesPath"
+
+    waylandFlags=()
+    if [[ -n "''${NIXOS_OZONE_WL:-}" && -n "''${WAYLAND_DISPLAY:-}" ]]; then
+      waylandFlags=(
+        --ozone-platform=wayland
+        --enable-features=WaylandWindowDecorations
+        --enable-wayland-ime=true
+      )
+    fi
+
+    exec "$CHATGPT_EXECUTABLE" "''${waylandFlags[@]}" "$@"
+  '';
+}
diff --git a/pkgs/by-name/ch/chatgpt/package.nix b/pkgs/by-name/ch/chatgpt/package.nix
index d9e32b3ae907..17ddda9505e5 100644
--- a/pkgs/by-name/ch/chatgpt/package.nix
+++ b/pkgs/by-name/ch/chatgpt/package.nix
@@ -1,49 +1,274 @@
 {
   lib,
-  stdenvNoCC,
+  stdenv,
+  callPackage,
   fetchurl,
+
+  # hooks
+  autoPatchelfHook,
+  makeWrapper,
+  versionCheckHook,
+  wrapGAppsHook3,
+  writableTmpDirAsHomeHook,
+
+  # native build inputs
+  asar,
+  dpkg,
+  patchelf,
   unzip,
+
+  # build inputs
+  alsa-lib,
+  at-spi2-atk,
+  at-spi2-core,
+  atk,
+  cairo,
+  cups,
+  dbus,
+  dconf,
+  expat,
+  gdk-pixbuf,
+  glib,
+  gtk3,
+  libgbm,
+  libnotify,
+  libusb1,
+  libx11,
+  libxcb,
+  libxcomposite,
+  libxdamage,
+  libxext,
+  libxfixes,
+  libxkbcommon,
+  libxrandr,
+  nspr,
+  nss,
+  pango,
+  qt6,
+  systemdLibs,
+
+  # runtime deps
+  bubblewrap,
+  coreutils,
+  gitMinimal,
+  libGL,
+  libpulseaudio,
+  libsecret,
+  lsb-release,
+  nodejs-slim,
+  pipewire,
+  ripgrep,
+  tectonic-unwrapped,
+  vulkan-loader,
+  xdg-utils,
+  # override to null to use bundled codex
+  codex,
 }:
-
 let
-  source = import ./source.nix;
+  inherit (stdenv.hostPlatform) isLinux isDarwin system;
+  inherit (stdenv.hostPlatform.node) arch platform;
 in
-stdenvNoCC.mkDerivation {
+stdenv.mkDerivation (finalAttrs: {
   pname = "chatgpt";
-  inherit (source) version;
+  inherit (finalAttrs.passthru.source) version;
 
-  src = fetchurl source.src;
+  src = fetchurl finalAttrs.passthru.source.src;
 
   strictDeps = true;
   __structuredAttrs = true;
 
+  postPatch = lib.optionalString isLinux ''
+    # autoPatchelf moves PT_INTERP beyond detect-libc's 2 KiB limit.
+    # Its process.report fallback crashes Electron.
+    asar extract usr/lib/chatgpt/resources/app.asar app
+    substituteInPlace app/node_modules/@parcel/watcher/index.js \
+      --replace-fail 'const family = familySync();' "const family = '${stdenv.hostPlatform.libc}';"
+    # Don't pack packages that were originally unpacked
+    unpackedDirs="$(
+      # Only descend into @scope directories
+      find usr/lib/chatgpt/resources/app.asar.unpacked/node_modules \
+        -mindepth 1 -maxdepth 2 \
+        ! -name '@*' -printf '%P\n' -prune |
+        paste -sd,
+    )"
+    asar pack app usr/lib/chatgpt/resources/app.asar \
+      --unpack-dir "node_modules/{$unpackedDirs}"
+  '';
+
   nativeBuildInputs = [
+    makeWrapper
+  ]
+  ++ lib.optionals isDarwin [
     unzip
+    patchelf
+  ]
+  ++ lib.optionals isLinux [
+    asar
+    autoPatchelfHook
+    dpkg
+    qt6.wrapQtAppsHook
+    wrapGAppsHook3
   ];
 
-  sourceRoot = ".";
+  buildInputs = lib.optionals isLinux [
+    alsa-lib
+    at-spi2-atk
+    at-spi2-core
+    atk
+    cairo
+    cups
+    dbus
+    dconf
+    expat
+    gdk-pixbuf
+    glib
+    gtk3
+    libgbm
+    libnotify
+    libusb1
+    libx11
+    libxcb
+    libxcomposite
+    libxdamage
+    libxext
+    libxfixes
+    libxkbcommon
+    libxrandr
+    nspr
+    nss
+    pango
+    qt6.qtbase
+    stdenv.cc.cc.lib
+    systemdLibs
+  ];
+
+  runtimeDependencies = lib.optionals isLinux [
+    libGL
+    libnotify
+    libpulseaudio
+    libsecret
+    pipewire
+    vulkan-loader
+  ];
+
+  dontWrapGApps = true;
+  dontWrapQtApps = true;
+
+  sourceRoot = if isLinux then "root" else ".";
 
   installPhase = ''
     runHook preInstall
+  ''
+  + (
+    if isDarwin then
+      ''
+        mkdir -p "$out/Applications" "$out/bin"
+        cp -a ChatGPT.app "$out/Applications"
+        makeWrapper "$out/Applications/ChatGPT.app/Contents/MacOS/ChatGPT" "$out/bin/ChatGPT"
+      ''
+    else
+      ''
+        mkdir -p "$out"
+        cp -r usr/* "$out"
 
-    mkdir -p "$out/Applications"
-    mkdir -p "$out/bin"
-    cp -a ChatGPT.app "$out/Applications"
-    ln -s "$out/Applications/ChatGPT.app/Contents/MacOS/ChatGPT" "$out/bin/ChatGPT"
+        # Remove the unused Qt 5 fallback shim.
+        rm -f "$out/lib/chatgpt/libqt5_shim.so"
 
+        # Keep only the native prebuild for this platform and architecture.
+        resources="$out/lib/chatgpt/resources"
+        find "$resources" -type d -name prebuilds -print0 | while IFS= read -r -d "" prebuildsPath; do
+          find "$prebuildsPath" -mindepth 1 -maxdepth 1 \
+            ! -name "*${platform}-${arch}" \
+            -exec rm -rf -- {} +
+        done
+      ''
+      + lib.optionalString stdenv.hostPlatform.isGnu ''
+        find "$resources" -type f -name '*.musl.node' -delete
+      ''
+      + ''
+
+        ln -sf ${lib.getExe tectonic-unwrapped} "$resources/tectonic/tectonic"
+        ln -sf ${lib.getExe ripgrep} "$resources/rg"
+        mkdir -p "$resources/cua_node/bin"
+        ln -sf ${lib.getExe nodejs-slim} "$resources/cua_node/bin/node"
+
+        install -Dm755 ${lib.getExe finalAttrs.passthru.launcher} "$out/bin/chatgpt"
+        install -Dm644 ${./tmpfiles.conf} "$out/share/user-tmpfiles.d/chatgpt.conf"
+      ''
+      + lib.optionalString (codex != null) ''
+        ln -sf ${lib.getExe codex} "$resources/codex"
+        ln -sf ${lib.getExe' codex "codex-code-mode-host"} "$resources/codex-code-mode-host"
+      ''
+      + ''
+        # The launcher assumes this bundled-plugin resource layout.
+        for resource in codex codex-code-mode-host cua_node native rg tectonic plugins; do
+          if [[ ! -e "$resources/$resource" ]]; then
+            echo "Missing ChatGPT bundled-plugin resource: $resources/$resource" >&2
+            exit 1
+          fi
+        done
+      ''
+  )
+  + ''
     runHook postInstall
   '';
 
-  passthru.updateScript = ./update.sh;
+  postFixup = lib.optionalString isLinux ''
+    wrapProgram "$out/bin/chatgpt" \
+      "''${gappsWrapperArgs[@]}" \
+      "''${qtWrapperArgs[@]}" \
+      --set CHATGPT_EXECUTABLE "$out/lib/chatgpt/ChatGPT" \
+      --set CHATGPT_RESOURCES_SOURCE "$out/lib/chatgpt/resources" \
+      --set CHATGPT_RESOURCES_CACHE_KEY "''${out##*/}" \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          bubblewrap
+          coreutils
+          gitMinimal
+          lsb-release
+          nodejs-slim
+          nodejs-slim.npm
+          xdg-utils
+        ]
+      } \
+      --set-default CODEX_BROWSER_USE_NODE_PATH ${lib.getExe nodejs-slim} \
+      --set-default NODE_REPL_NODE_PATH ${lib.getExe nodejs-slim} \
+      ${lib.escapeShellArgs (
+        lib.optionals (codex != null) [
+          "--set-default"
+          "CODEX_CLI_PATH"
+          (lib.getExe codex)
+        ]
+      )}
+  '';
+
+  dontStrip = true;
+  dontPatchELF = isDarwin;
+  dontPatchShebangs = isDarwin;
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+  versionCheckKeepEnvironment = [ "HOME" ];
+
+  passthru = {
+    updateScript = ./update.sh;
+    sources = lib.importJSON ./source.json;
+    source = finalAttrs.passthru.sources.${system} or (throw "chatgpt is not supported on ${system}");
+    launcher = callPackage ./launcher.nix { };
+  };
 
   meta = {
     description = "Desktop application for ChatGPT";
-    homepage = "https://openai.com/chatgpt/desktop/";
-    changelog = "https://help.openai.com/en/articles/9703738-macos-app-release-notes";
+    homepage = "https://developers.openai.com/codex/app";
+    changelog = "https://learn.chatgpt.com/docs/changelog?type=codex-app";
     license = lib.licenses.unfree;
     maintainers = with lib.maintainers; [ wattmto ];
-    platforms = lib.platforms.darwin;
+    broken = stdenv.hostPlatform.isMusl;
+    platforms = lib.attrNames finalAttrs.passthru.sources;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    mainProgram = "ChatGPT";
+    mainProgram = if isDarwin then "ChatGPT" else "chatgpt";
   };
-}
+})
diff --git a/pkgs/by-name/ch/chatgpt/source.json b/pkgs/by-name/ch/chatgpt/source.json
new file mode 100644
index 000000000000..580704533af9
--- /dev/null
+++ b/pkgs/by-name/ch/chatgpt/source.json
@@ -0,0 +1,23 @@
+{
+  "aarch64-darwin": {
+    "version": "26.924.51851",
+    "src": {
+      "url": "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-arm64-26.924.51851.zip",
+      "hash": "sha256-jqsNtrgVAc9Xfx8/pCoMEUs/1vvFS0NdxbGNxgHVsN0="
+    }
+  },
+  "aarch64-linux": {
+    "version": "26.924.51851",
+    "src": {
+      "url": "https://persistent.oaistatic.com/codex-app-prod/linux/deb/pool/main/c/chatgpt/chatgpt_26.924.51851_arm64.deb",
+      "hash": "sha256-2l5GjF/OZEQRNMNR//v0OOOW7DrcanjDDpqk2/haMWg="
+    }
+  },
+  "x86_64-linux": {
+    "version": "26.924.51851",
+    "src": {
+      "url": "https://persistent.oaistatic.com/codex-app-prod/linux/deb/pool/main/c/chatgpt/chatgpt_26.924.51851_amd64.deb",
+      "hash": "sha256-fSW5n+ObA83D2DYx+yA9t3GGeIpTOHreDnBqJh6JaTU="
+    }
+  }
+}
diff --git a/pkgs/by-name/ch/chatgpt/source.nix b/pkgs/by-name/ch/chatgpt/source.nix
deleted file mode 100644
index cff4771c84e4..000000000000
--- a/pkgs/by-name/ch/chatgpt/source.nix
+++ /dev/null
@@ -1,7 +0,0 @@
-{
-  version = "26.803.81509";
-  src = {
-    url = "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-arm64-26.803.81509.zip";
-    hash = "sha256-NMfmKWeK1dY6Y57GlKW4O4X04b18Ie4qvP77sEEJW5w=";
-  };
-}
diff --git a/pkgs/by-name/ch/chatgpt/tmpfiles.conf b/pkgs/by-name/ch/chatgpt/tmpfiles.conf
new file mode 100644
index 000000000000..05be7f0f21b2
--- /dev/null
+++ b/pkgs/by-name/ch/chatgpt/tmpfiles.conf
@@ -0,0 +1 @@
+e %C/chatgpt/bundled-plugins-v2 - - - 0
diff --git a/pkgs/by-name/ch/chatgpt/update.sh b/pkgs/by-name/ch/chatgpt/update.sh
index 37fc5cf5d264..fd5078d2be60 100755
--- a/pkgs/by-name/ch/chatgpt/update.sh
+++ b/pkgs/by-name/ch/chatgpt/update.sh
@@ -1,23 +1,103 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl libxml2
+#!nix-shell -i bash -p curl gzip jq libxml2
+# shellcheck shell=bash
 
-XML_URL="https://persistent.oaistatic.com/codex-app-prod/appcast.xml"
+set -o errexit
+set -o nounset
+set -o pipefail
 
-XML_DATA=$(curl -s $XML_URL)
+BASE_URL="https://persistent.oaistatic.com/codex-app-prod"
+DARWIN_APPCAST_URL="$BASE_URL/appcast.xml"
+LINUX_REPOSITORY_URL="$BASE_URL/linux/deb"
 
-LATEST_VERSION=$(echo "$XML_DATA" | xmllint --xpath '/rss/channel/item[1]/*[local-name()="shortVersionString"]/text()' -)
-DOWNLOAD_URL=$(echo "$XML_DATA" | xmllint --xpath 'string(//item[1]/enclosure/@url)' -)
+SOURCE_JSON=${SOURCE_JSON:-"$(dirname "${BASH_SOURCE[0]}")/source.json"}
 
-HASH=$(nix-prefetch-url $DOWNLOAD_URL | xargs nix --extra-experimental-features nix-command hash convert --hash-algo sha256)
+get_field() {
+  local field="$1"
+  local metadata="$2"
 
-SOURCE_NIX="$(dirname ${BASH_SOURCE[0]})/source.nix"
-
-cat > "${SOURCE_NIX}" << _EOF_
-{
-  version = "$LATEST_VERSION";
-  src = {
-    url = "$DOWNLOAD_URL";
-    hash = "$HASH";
-  };
+  sed -n "s/^$field: //p" <<< "$metadata" | head -n 1
 }
-_EOF_
+
+fetch_linux_metadata() {
+  local architecture="$1"
+
+  curl --fail --location --silent --show-error \
+    "$LINUX_REPOSITORY_URL/dists/stable/main/binary-$architecture/Packages.gz" \
+    | gzip --decompress --stdout
+}
+
+DARWIN_XML=$(curl --fail --location --silent --show-error "$DARWIN_APPCAST_URL")
+DARWIN_VERSION=$(xmllint --xpath '/rss/channel/item[1]/*[local-name()="shortVersionString"]/text()' - <<< "$DARWIN_XML")
+DARWIN_URL=$(xmllint --xpath 'string(//item[1]/enclosure/@url)' - <<< "$DARWIN_XML")
+
+for pair in \
+  "x86_64-linux amd64" \
+  "aarch64-linux arm64"; do
+  read -r system architecture <<< "$pair"
+  metadata=$(fetch_linux_metadata "$architecture")
+
+  [[ $(get_field Package "$metadata") == chatgpt ]]
+  [[ $(get_field Architecture "$metadata") == "$architecture" ]]
+
+  version=$(get_field Version "$metadata")
+  filename=$(get_field Filename "$metadata")
+
+  if [[ "$system" == x86_64-linux ]]; then
+    AMD64_VERSION=$version
+    AMD64_URL="$LINUX_REPOSITORY_URL/$filename"
+  else
+    ARM64_VERSION=$version
+    ARM64_URL="$LINUX_REPOSITORY_URL/$filename"
+  fi
+done
+
+if [[ -f "$SOURCE_JSON" ]] && jq -e \
+  --arg darwin_version "$DARWIN_VERSION" \
+  --arg darwin_url "$DARWIN_URL" \
+  --arg amd64_version "$AMD64_VERSION" \
+  --arg amd64_url "$AMD64_URL" \
+  --arg arm64_version "$ARM64_VERSION" \
+  --arg arm64_url "$ARM64_URL" \
+  '.["aarch64-darwin"].version == $darwin_version
+    and .["aarch64-darwin"].src.url == $darwin_url
+    and .["x86_64-linux"].version == $amd64_version
+    and .["x86_64-linux"].src.url == $amd64_url
+    and .["aarch64-linux"].version == $arm64_version
+    and .["aarch64-linux"].src.url == $arm64_url' \
+  "$SOURCE_JSON" >/dev/null; then
+  echo "chatgpt is already up to date" >&2
+  exit 0
+fi
+
+DARWIN_HASH=$(nix --extra-experimental-features nix-command hash convert \
+  --hash-algo sha256 "$(nix-prefetch-url "$DARWIN_URL")")
+AMD64_HASH=$(nix --extra-experimental-features nix-command hash convert \
+  --hash-algo sha256 "$(nix-prefetch-url "$AMD64_URL")")
+ARM64_HASH=$(nix --extra-experimental-features nix-command hash convert \
+  --hash-algo sha256 "$(nix-prefetch-url "$ARM64_URL")")
+
+jq -n \
+  --arg darwin_version "$DARWIN_VERSION" \
+  --arg darwin_url "$DARWIN_URL" \
+  --arg darwin_hash "$DARWIN_HASH" \
+  --arg amd64_version "$AMD64_VERSION" \
+  --arg amd64_url "$AMD64_URL" \
+  --arg amd64_hash "$AMD64_HASH" \
+  --arg arm64_version "$ARM64_VERSION" \
+  --arg arm64_url "$ARM64_URL" \
+  --arg arm64_hash "$ARM64_HASH" \
+  '{
+    "aarch64-darwin": {
+      "version": $darwin_version,
+      "src": { "url": $darwin_url, "hash": $darwin_hash }
+    },
+    "aarch64-linux": {
+      "version": $arm64_version,
+      "src": { "url": $arm64_url, "hash": $arm64_hash }
+    },
+    "x86_64-linux": {
+      "version": $amd64_version,
+      "src": { "url": $amd64_url, "hash": $amd64_hash }
+    }
+  }' > "$SOURCE_JSON"

From fee6cf80d97193382a1a728f79f4817928ae374f Mon Sep 17 00:00:00 2001
From: Moraxyc <i@qaq.li>
Date: Wed, 12 Aug 2026 09:49:47 +0800
Subject: [PATCH 490/525] chatgpt: add moraxyc as maintainer

---
 pkgs/by-name/ch/chatgpt/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ch/chatgpt/package.nix b/pkgs/by-name/ch/chatgpt/package.nix
index 17ddda9505e5..58caba99c55e 100644
--- a/pkgs/by-name/ch/chatgpt/package.nix
+++ b/pkgs/by-name/ch/chatgpt/package.nix
@@ -265,7 +265,10 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://developers.openai.com/codex/app";
     changelog = "https://learn.chatgpt.com/docs/changelog?type=codex-app";
     license = lib.licenses.unfree;
-    maintainers = with lib.maintainers; [ wattmto ];
+    maintainers = with lib.maintainers; [
+      wattmto
+      moraxyc
+    ];
     broken = stdenv.hostPlatform.isMusl;
     platforms = lib.attrNames finalAttrs.passthru.sources;
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];

From 5bd179da8ae6d0a33cb6fdbd9c9aadbfc21e92f8 Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Fri, 9 Oct 2026 19:46:41 -0400
Subject: [PATCH 491/525] chatgpt: add mdaniels5757 as maintainer

---
 pkgs/by-name/ch/chatgpt/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/ch/chatgpt/package.nix b/pkgs/by-name/ch/chatgpt/package.nix
index 58caba99c55e..eb068b2575ef 100644
--- a/pkgs/by-name/ch/chatgpt/package.nix
+++ b/pkgs/by-name/ch/chatgpt/package.nix
@@ -268,6 +268,7 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [
       wattmto
       moraxyc
+      mdaniels5757
     ];
     broken = stdenv.hostPlatform.isMusl;
     platforms = lib.attrNames finalAttrs.passthru.sources;

From f0a84255ca13d3f7a3209c4df7a94b29a10f5166 Mon Sep 17 00:00:00 2001
From: AiroPi <47398145+AiroPi@users.noreply.github.com>
Date: Sun, 11 Oct 2026 17:11:35 +0200
Subject: [PATCH 492/525] whatsapp-for-mac: 2.26.31.27 -> 2.26.40.20

---
 pkgs/by-name/wh/whatsapp-for-mac/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/wh/whatsapp-for-mac/package.nix b/pkgs/by-name/wh/whatsapp-for-mac/package.nix
index 9e59bd17f557..ae02fa961448 100644
--- a/pkgs/by-name/wh/whatsapp-for-mac/package.nix
+++ b/pkgs/by-name/wh/whatsapp-for-mac/package.nix
@@ -10,13 +10,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "whatsapp-for-mac";
-  version = "2.26.31.27";
+  version = "2.26.40.20";
 
   src = fetchzip {
     extension = "zip";
     name = "WhatsApp.app";
     url = "https://web.whatsapp.com/desktop/mac_native/release/?version=${finalAttrs.version}&extension=zip&configuration=Release&branch=master";
-    hash = "sha256-bB4RVqk+v5QdsOvgTc4hA6EF/s1KIBnrL+HXwsm89/c=";
+    hash = "sha256-WN2mOYL/rQgStXIgV4YqC8mGAKdQXPY0a4qeawnnJjA=";
   };
 
   dontConfigure = true;

From b69e583d48048f589e5912f5be2c1e04879290dc Mon Sep 17 00:00:00 2001
From: eymeric <hatchchien@protonmail.com>
Date: Sat, 19 Sep 2026 12:17:35 +0200
Subject: [PATCH 493/525] music-assistant: fix librespot patch

---
 pkgs/by-name/mu/music-assistant/librespot.patch | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/mu/music-assistant/librespot.patch b/pkgs/by-name/mu/music-assistant/librespot.patch
index 840a10e27df5..891a1d8969a5 100644
--- a/pkgs/by-name/mu/music-assistant/librespot.patch
+++ b/pkgs/by-name/mu/music-assistant/librespot.patch
@@ -1,17 +1,16 @@
 diff --git a/music_assistant/providers/spotify/helpers.py b/music_assistant/providers/spotify/helpers.py
-index d0f5512b0..b8ac0f329 100644
+index 58623de63..ba3b2ca75 100644
 --- a/music_assistant/providers/spotify/helpers.py
 +++ b/music_assistant/providers/spotify/helpers.py
-@@ -6,6 +6,7 @@
- import os
- import platform
+@@ -9,6 +9,7 @@ import platform
+ import re
+ import tempfile
  import time
 +from shutil import which
  from contextlib import suppress
  from pathlib import Path
  from typing import TYPE_CHECKING, Any
- 
-@@ -28,16 +29,12 @@ async def check_librespot(librespot_path: str) -> str | None:
+@@ -59,16 +60,12 @@ async def get_librespot_binary() -> str:
          except OSError:
              return None
  

From 127119550e96a6b3cb6c28917e8aff6a52033895 Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Sun, 11 Oct 2026 17:36:23 +0200
Subject: [PATCH 494/525] picard: 3.0.1 -> 3.0.2

Changelog: https://github.com/metabrainz/picard/releases/tag/release-3.0.2
Diff: https://github.com/metabrainz/picard/compare/release-3.0.1...release-3.0.2
---
 pkgs/by-name/pi/picard/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pi/picard/package.nix b/pkgs/by-name/pi/picard/package.nix
index adb31b9384ca..d1885ce1fb96 100644
--- a/pkgs/by-name/pi/picard/package.nix
+++ b/pkgs/by-name/pi/picard/package.nix
@@ -17,7 +17,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "picard";
-  version = "3.0.1";
+  version = "3.0.2";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -25,7 +25,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "metabrainz";
     repo = "picard";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-CvL/jD+/MiYgSjbQS3nbVkL09TEZCgqGgXdDTRlCsAo=";
+    hash = "sha256-Br7mBWB16jv6p7VoYipCa2TXTQabx9oV8DaS5gxIxzg=";
   };
 
   nativeBuildInputs = [

From 9d7c1925da449a2f99107bc68ef965b10af1e5c8 Mon Sep 17 00:00:00 2001
From: Sergio Idarraga Aguirre <sergioidarraga2110@gmail.com>
Date: Sun, 11 Oct 2026 10:21:56 -0500
Subject: [PATCH 495/525] vimPlugins: fix ordering of two vim-plugin-names
 entries

`vim-plugins-updater` orders vim-plugin-names by normalized plugin name
(case-sensitive, `.` replaced by `-`). Two entries on master are not in that
order, so a run of the updater relocates them together with their
`generated.nix` blocks:

- `anoopkcn/filemarks.nvim` is in the uppercase group, while `filemarks-nvim`
  sorts with the lowercase `f` entries
- `whatyouhide/vim-textobj-xmlattr` precedes
  `Julian/vim-textobj-variable-segment`

No entry is added, removed or modified: both files contain exactly the same
lines as before, only in a different position.

Split out of the vim-dadbod-manager-ui addition so that commit contains only
that package.

Assisted-by: Pi 0.86.1 (deepseek-flash)
---
 .../editors/vim/plugins/generated.nix         | 56 +++++++++----------
 .../editors/vim/plugins/vim-plugin-names      |  4 +-
 2 files changed, 30 insertions(+), 30 deletions(-)

diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 0254b17d5cd6..d100a0ffec2c 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -122,20 +122,6 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
-  filemarks-nvim = buildVimPlugin {
-    pname = "filemarks.nvim";
-    version = "1.6.0";
-    src = fetchFromGitHub {
-      owner = "anoopkcn";
-      repo = "filemarks.nvim";
-      tag = "1.6.0";
-      hash = "sha256-qSHHsBb7MAceNV3QnZiTFN4d1i2zH8CItlzQWsYNjno=";
-    };
-    meta.homepage = "https://github.com/anoopkcn/filemarks.nvim/";
-    meta.license = getLicenseFromSpdxId "MIT";
-    meta.hydraPlatforms = [ ];
-  };
-
   FTerm-nvim = buildVimPlugin {
     pname = "FTerm.nvim";
     version = "0-unstable-2022-11-13";
@@ -6063,6 +6049,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  filemarks-nvim = buildVimPlugin {
+    pname = "filemarks.nvim";
+    version = "1.6.0";
+    src = fetchFromGitHub {
+      owner = "anoopkcn";
+      repo = "filemarks.nvim";
+      tag = "1.6.0";
+      hash = "sha256-qSHHsBb7MAceNV3QnZiTFN4d1i2zH8CItlzQWsYNjno=";
+    };
+    meta.homepage = "https://github.com/anoopkcn/filemarks.nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   filemention-nvim = buildVimPlugin {
     pname = "filemention.nvim";
     version = "0-unstable-2026-05-30";
@@ -24831,20 +24831,6 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
-  vim-textobj-xmlattr = buildVimPlugin {
-    pname = "vim-textobj-xmlattr";
-    version = "0.1.1";
-    src = fetchFromGitHub {
-      owner = "whatyouhide";
-      repo = "vim-textobj-xmlattr";
-      tag = "0.1.1";
-      hash = "sha256-EFn7Ql7SFWwcjR5WdQkl2/lJZY9qZN9ml6625lGtTzY=";
-    };
-    meta.homepage = "https://github.com/whatyouhide/vim-textobj-xmlattr/";
-    meta.license = getLicenseFromSpdxId "WTFPL";
-    meta.hydraPlatforms = [ ];
-  };
-
   vim-textobj-variable-segment = buildVimPlugin {
     pname = "vim-textobj-variable-segment";
     version = "0-unstable-2024-09-06";
@@ -24859,6 +24845,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  vim-textobj-xmlattr = buildVimPlugin {
+    pname = "vim-textobj-xmlattr";
+    version = "0.1.1";
+    src = fetchFromGitHub {
+      owner = "whatyouhide";
+      repo = "vim-textobj-xmlattr";
+      tag = "0.1.1";
+      hash = "sha256-EFn7Ql7SFWwcjR5WdQkl2/lJZY9qZN9ml6625lGtTzY=";
+    };
+    meta.homepage = "https://github.com/whatyouhide/vim-textobj-xmlattr/";
+    meta.license = getLicenseFromSpdxId "WTFPL";
+    meta.hydraPlatforms = [ ];
+  };
+
   vim-themis = buildVimPlugin {
     pname = "vim-themis";
     version = "1.7.0-unstable-2025-08-29";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 07a699ba53d5..df465e6d8104 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -7,7 +7,6 @@ https://github.com/vim-scripts/Colour-Sampler-Pack/,,
 https://github.com/CopilotC-Nvim/CopilotChat.nvim/,,
 https://github.com/whonore/Coqtail/,,
 https://github.com/vim-scripts/DoxygenToolkit.vim/,,
-https://github.com/anoopkcn/filemarks.nvim/,,
 https://github.com/numToStr/FTerm.nvim/,,
 https://github.com/antoinemadec/FixCursorHold.nvim/,,
 https://github.com/Aaronik/GPTModels.nvim/,,
@@ -431,6 +430,7 @@ https://github.com/micampe/fennel.vim/,,
 https://github.com/wincent/ferret/,,
 https://github.com/bogado/file-line/,,
 https://github.com/lewis6991/fileline.nvim/,,
+https://github.com/anoopkcn/filemarks.nvim/,,
 https://github.com/not-manu/filemention.nvim/,,
 https://github.com/VonHeikemen/fine-cmdline.nvim/,,
 https://github.com/glacambre/firenvim/,,
@@ -1771,8 +1771,8 @@ https://github.com/kana/vim-textobj-line/,,
 https://github.com/osyo-manga/vim-textobj-multiblock/,,
 https://github.com/preservim/vim-textobj-quote/,,
 https://github.com/kana/vim-textobj-user/,,
-https://github.com/whatyouhide/vim-textobj-xmlattr/,,
 https://github.com/Julian/vim-textobj-variable-segment/,,
+https://github.com/whatyouhide/vim-textobj-xmlattr/,,
 https://github.com/thinca/vim-themis/,,
 https://github.com/tmux-plugins/vim-tmux/,,
 https://github.com/roxma/vim-tmux-clipboard/,,

From c86be8db72ca5ecb6f5d62d751f87102dd9844c7 Mon Sep 17 00:00:00 2001
From: Sergio Idarraga Aguirre <sergioidarraga2110@gmail.com>
Date: Sun, 11 Oct 2026 10:21:56 -0500
Subject: [PATCH 496/525] vimPlugins.vim-dadbod-manager-ui: init at
 0-unstable-2026-10-11

https://github.com/sergioia-dev/vim-dadbod-manager-ui

Assisted-by: Pi 0.86.1 (deepseek-flash)
---
 .../applications/editors/vim/plugins/generated.nix | 14 ++++++++++++++
 .../applications/editors/vim/plugins/overrides.nix | 10 ++++++++++
 .../editors/vim/plugins/vim-plugin-names           |  1 +
 3 files changed, 25 insertions(+)

diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index d100a0ffec2c..ddf5a84f2c30 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -20603,6 +20603,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  vim-dadbod-manager-ui = buildVimPlugin {
+    pname = "vim-dadbod-manager-ui";
+    version = "0-unstable-2026-10-11";
+    src = fetchFromGitHub {
+      owner = "sergioia-dev";
+      repo = "vim-dadbod-manager-ui";
+      rev = "3aba12f946f72e3d0797a26786851c9759260657";
+      hash = "sha256-pqLM7r4q7QYrc+OkOAH2gGPN3AJheabscYsbddqSe5g=";
+    };
+    meta.homepage = "https://github.com/sergioia-dev/vim-dadbod-manager-ui/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   vim-dadbod-ui = buildVimPlugin {
     pname = "vim-dadbod-ui";
     version = "0-unstable-2026-06-19";
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 2d7db76b1f32..6b813a6772d1 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -5118,6 +5118,16 @@ assertNoAdditions {
     };
   });
 
+  vim-dadbod-manager-ui = super.vim-dadbod-manager-ui.overrideAttrs {
+    # Only vim-dadbod: the drawer this plugin extends is vendored, and upstream
+    # states that a separate vim-dadbod-ui "must not be installed next to it",
+    # so it is deliberately not listed here.
+    dependencies = [ self.vim-dadbod ];
+
+    doInstallCheck = true;
+    vimCommandCheck = "DBManager";
+  };
+
   vim-dadbod-ui = super.vim-dadbod-ui.overrideAttrs {
     dependencies = [ self.vim-dadbod ];
 
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index df465e6d8104..7ade42295186 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -1469,6 +1469,7 @@ https://github.com/itchyny/vim-cursorword/,,
 https://github.com/ehamberg/vim-cute-python/,,
 https://github.com/tpope/vim-dadbod/,,
 https://github.com/kristijanhusak/vim-dadbod-completion/,,
+https://github.com/sergioia-dev/vim-dadbod-manager-ui/,,
 https://github.com/kristijanhusak/vim-dadbod-ui/,,
 https://github.com/sunaku/vim-dasht/,,
 https://github.com/ajmwagar/vim-deus/,,

From da5b133b13d296da5241707724cf7329aa42ca4b Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Sun, 11 Oct 2026 11:47:45 -0400
Subject: [PATCH 497/525] chatgpt: fix Darwin build

Oops!
---
 pkgs/by-name/ch/chatgpt/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ch/chatgpt/package.nix b/pkgs/by-name/ch/chatgpt/package.nix
index eb068b2575ef..adb41649dc17 100644
--- a/pkgs/by-name/ch/chatgpt/package.nix
+++ b/pkgs/by-name/ch/chatgpt/package.nix
@@ -242,7 +242,7 @@ stdenv.mkDerivation (finalAttrs: {
       )}
   '';
 
-  dontStrip = true;
+  dontStrip = isLinux;
   dontPatchELF = isDarwin;
   dontPatchShebangs = isDarwin;
 

From 6b7416ab6d6a29918486c44a0f58e8d13cb3020f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?David=20L=C3=B3pez?= <hola@devel0pez.com>
Date: Fri, 2 Oct 2026 06:51:41 +0200
Subject: [PATCH 498/525] python3Packages.pysail: 0.7.1 -> 0.7.2

Inherit version, src and cargoDeps from sail, which is built from the
same source tree, so both packages stay in sync. Drop the update script
and mark the package to be skipped by nixpkgs-update.

Assisted-by: Claude Code (Claude Opus 5.5)
---
 .../python-modules/pysail/default.nix         | 24 ++++---------------
 1 file changed, 4 insertions(+), 20 deletions(-)

diff --git a/pkgs/development/python-modules/pysail/default.nix b/pkgs/development/python-modules/pysail/default.nix
index 60e48aaea6c2..8081bf3097be 100644
--- a/pkgs/development/python-modules/pysail/default.nix
+++ b/pkgs/development/python-modules/pysail/default.nix
@@ -1,11 +1,10 @@
 {
   lib,
   buildPythonPackage,
-  fetchFromGitHub,
   rustPlatform,
-  nix-update-script,
   testers,
   pysail,
+  sail,
 
   protoc,
   protobuf,
@@ -13,21 +12,9 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pysail";
-  version = "0.7.1";
+  inherit (sail) version src cargoDeps; # nixpkgs-update: no auto update
   pyproject = true;
 
-  src = fetchFromGitHub {
-    owner = "lakehq";
-    repo = "sail";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-UJP2d56IF0h9s/kZhNWVkCp/YfTf1RpQStM1NjzJKK4=";
-  };
-
-  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs) pname src version;
-    hash = "sha256-a0NOVMH5dObFpwUaEsB6w66XVSjnWQRiK5i/KylEgAU=";
-  };
-
   # The `generate-import-lib` PyO3 feature only matters when building Windows
   # import libraries; on other platforms it just pulls in the `python3-dll-a`
   # crate, which is not vendored. Drop it so the offline maturin build resolves.
@@ -55,11 +42,8 @@ buildPythonPackage (finalAttrs: {
   # heavyweight optional dependencies (pyspark-client, duckdb, ...).
   doCheck = false;
 
-  passthru = {
-    updateScript = nix-update-script { };
-    tests.version = testers.testVersion {
-      package = pysail;
-    };
+  passthru.tests.version = testers.testVersion {
+    package = pysail;
   };
 
   meta = {

From 59e1380e0eb03c55913a6b0fe1f44d5198a13202 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 15:55:24 +0000
Subject: [PATCH 499/525] fosrl-newt: 1.18.0 -> 1.18.1

---
 pkgs/by-name/fo/fosrl-newt/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fo/fosrl-newt/package.nix b/pkgs/by-name/fo/fosrl-newt/package.nix
index edd0317d2dc5..78ed0cf77c0e 100644
--- a/pkgs/by-name/fo/fosrl-newt/package.nix
+++ b/pkgs/by-name/fo/fosrl-newt/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "newt";
-  version = "1.18.0";
+  version = "1.18.1";
 
   src = fetchFromGitHub {
     owner = "fosrl";
     repo = "newt";
     tag = finalAttrs.version;
-    hash = "sha256-1ZS3KmEldOq2r+p4ayF852IS94/Wmkhqdw/Jx/W0Wcg=";
+    hash = "sha256-rzovIgrVKzO3sJFoRYdDWthFUF2anUOoXVSAmGCX4yk=";
   };
 
-  vendorHash = "sha256-VOXZWcPnBSc8EKYLKhsrQTHSjXvpaEYoewYLCxJ8Nk8=";
+  vendorHash = "sha256-Ijuc5/1Pv//6Z+tFgkHGe1W1Bw7q6WNTPCwukk91414=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 

From 2a8c86bc625fe3f592181e47efd8b4c9930b61d3 Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Sun, 11 Oct 2026 11:25:41 -0400
Subject: [PATCH 500/525] chatgpt: 26.924.51851 -> 26.1007.21434 (Linux) /
 26.1007.30912 (Darwin)

---
 pkgs/by-name/ch/chatgpt/source.json | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/ch/chatgpt/source.json b/pkgs/by-name/ch/chatgpt/source.json
index 580704533af9..bc508c9a0ac6 100644
--- a/pkgs/by-name/ch/chatgpt/source.json
+++ b/pkgs/by-name/ch/chatgpt/source.json
@@ -1,23 +1,23 @@
 {
   "aarch64-darwin": {
-    "version": "26.924.51851",
+    "version": "26.1007.30912",
     "src": {
-      "url": "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-arm64-26.924.51851.zip",
-      "hash": "sha256-jqsNtrgVAc9Xfx8/pCoMEUs/1vvFS0NdxbGNxgHVsN0="
+      "url": "https://persistent.oaistatic.com/codex-app-prod/ChatGPT-darwin-arm64-26.1007.30912.zip",
+      "hash": "sha256-tpmowtWi8jysWdxnOI4lr0v1/C+2qzD/okOpaOT4FaM="
     }
   },
   "aarch64-linux": {
-    "version": "26.924.51851",
+    "version": "26.1007.21434",
     "src": {
-      "url": "https://persistent.oaistatic.com/codex-app-prod/linux/deb/pool/main/c/chatgpt/chatgpt_26.924.51851_arm64.deb",
-      "hash": "sha256-2l5GjF/OZEQRNMNR//v0OOOW7DrcanjDDpqk2/haMWg="
+      "url": "https://persistent.oaistatic.com/codex-app-prod/linux/deb/pool/main/c/chatgpt/chatgpt_26.1007.21434_arm64.deb",
+      "hash": "sha256-Vfrh4/sdYGmpBiDp5wc33Pi/IlVgTRV+KCzGdIobr0k="
     }
   },
   "x86_64-linux": {
-    "version": "26.924.51851",
+    "version": "26.1007.21434",
     "src": {
-      "url": "https://persistent.oaistatic.com/codex-app-prod/linux/deb/pool/main/c/chatgpt/chatgpt_26.924.51851_amd64.deb",
-      "hash": "sha256-fSW5n+ObA83D2DYx+yA9t3GGeIpTOHreDnBqJh6JaTU="
+      "url": "https://persistent.oaistatic.com/codex-app-prod/linux/deb/pool/main/c/chatgpt/chatgpt_26.1007.21434_amd64.deb",
+      "hash": "sha256-J2tTQcPXSyYdOtUhBvf6ft3gaEHkdn/ipAy1QJmx8+0="
     }
   }
 }

From 0d3e348e26f7ce58f3f592b2c5c3e6318b615a8b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 16:05:48 +0000
Subject: [PATCH 501/525] terraform-providers.aliyun_alicloud: 1.293.0 ->
 1.294.0

---
 .../networking/cluster/terraform-providers/providers.json     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 5a75fa069724..a6120529bbf2 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -45,11 +45,11 @@
     "vendorHash": "sha256-HlX2EfTgDa7K7qkzmR/9Rsamyi/f4EXT3T7eaReGeK4="
   },
   "aliyun_alicloud": {
-    "hash": "sha256-u4u8p3+Gxwa+gCDgcqZqi1RXYG9c+O27uZoOlc+RoKc=",
+    "hash": "sha256-D2/3OuB+7MeMZhydRAYKS1trQjRyKkr1+ulDDfntWBo=",
     "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
     "owner": "aliyun",
     "repo": "terraform-provider-alicloud",
-    "rev": "v1.293.0",
+    "rev": "v1.294.0",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-GIKSIlWD+TTm0EsUu9ga3emENwGLXMDYqp//BmjNwDA="
   },

From 6dda82bae07e500fea09a04ffbcbeb3f200a92cb Mon Sep 17 00:00:00 2001
From: airone01 <airone01@proton.me>
Date: Thu, 8 Oct 2026 14:47:12 +0200
Subject: [PATCH 502/525] gravit: drop

---
 pkgs/by-name/gr/gravit/package.nix | 91 ------------------------------
 pkgs/top-level/aliases.nix         |  1 +
 2 files changed, 1 insertion(+), 91 deletions(-)
 delete mode 100644 pkgs/by-name/gr/gravit/package.nix

diff --git a/pkgs/by-name/gr/gravit/package.nix b/pkgs/by-name/gr/gravit/package.nix
deleted file mode 100644
index 9f96fb30e3fc..000000000000
--- a/pkgs/by-name/gr/gravit/package.nix
+++ /dev/null
@@ -1,91 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchpatch,
-  SDL,
-  SDL_ttf,
-  SDL_image,
-  libsm,
-  libice,
-  libGLU,
-  libGL,
-  libpng,
-  lua5_2_compat,
-  autoconf,
-  automake,
-  mesa,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "gravit";
-  version = "0.5.1";
-
-  src = fetchFromGitHub {
-    owner = "gak";
-    repo = "gravit";
-    rev = finalAttrs.version;
-    hash = "sha256-JuqnLLD5+Ec8kQI0SK98V1O6TTbGM6+yKn5KCHe85eM=";
-  };
-
-  patches = [
-    # Pull fix pending upstream inclusion for -fno-common toolchains:
-    #   https://github.com/gak/gravit/pull/100
-    (fetchpatch {
-      name = "fno-common.patch";
-      url = "https://github.com/gak/gravit/commit/0f848834889212f16201fd404d2d5b9bb5b47d23.patch";
-      hash = "sha256-k1aMIg7idMt53o6dFgIKJflOMp0Jp5NwgWEijcIwXrQ=";
-    })
-  ];
-
-  buildInputs = [
-    libGLU
-    libGL
-    SDL
-    SDL_ttf
-    SDL_image
-    lua5_2_compat
-    libpng
-    libsm
-    libice
-  ];
-
-  nativeBuildInputs = [
-    autoconf
-    automake
-  ];
-
-  preConfigure = ''
-    ./autogen.sh
-
-    # Build fails on Linux with windres.
-    export ac_cv_prog_WINDRES=
-  '';
-
-  enableParallelBuilding = true;
-
-  env.NIX_CFLAGS_COMPILE = toString [
-    "-DSDL_INCLUDE_GLU_H"
-  ];
-
-  meta = {
-    broken = (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64);
-    homepage = "https://github.com/gak/gravit";
-    description = "Beautiful OpenGL-based gravity simulator";
-    mainProgram = "gravit";
-    license = lib.licenses.gpl2Plus;
-
-    longDescription = ''
-      Gravit is a gravity simulator which runs under Linux, Windows and
-      macOS. It uses Newtonian physics using the Barnes-Hut N-body
-      algorithm. Although the main goal of Gravit is to be as accurate
-      as possible, it also creates beautiful looking gravity patterns.
-      It records the history of each particle so it can animate and
-      display a path of its travels. At any stage you can rotate your
-      view in 3D and zoom in and out.
-    '';
-
-    inherit (mesa.meta) platforms;
-    hydraPlatforms = lib.platforms.linux; # darwin times out
-  };
-})
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index c7805522365d..7c0d049dd26e 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1129,6 +1129,7 @@ mapAliases {
   graphia = throw "'graphia' has been removed due to being unmaintained and broken"; # Added 2026-05-05
   graphite-gtk-theme = throw "'graphite-gtk-theme' has been removed because it depended on 'gtk-engine-murrine', which was removed because it was unmaintained upstream and depended on GTK 2."; # Added 2026-07-22
   graphite-kde-theme = throw "'graphite-kde-theme' has been removed, as it is only compatible with Plasma 5, which is EOL"; # Added 2025-08-20
+  gravit = throw "'gravit' has been removed, as it has been unmaintained upstream since June 2022"; # Added 2026-10-11
   grepm = throw "'grepm' has been removed as it was unmaintained"; # Added 2026-09-20
   grig = throw "'grig' has been removed as it depended on the deprecated GTK 2 engine."; # Added 2026-08-14
   gringo = throw "'gringo' has been renamed to/replaced by 'clingo'"; # Converted to throw 2025-10-27

From e431540120640f54431fa7f3366b723c5fe86d9e Mon Sep 17 00:00:00 2001
From: Felix Buehler <account@buehler.rocks>
Date: Mon, 28 Sep 2026 22:26:37 +0200
Subject: [PATCH 503/525] nixos/nix: document that root is always a trusted
 user

---
 nixos/modules/config/nix.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/config/nix.nix b/nixos/modules/config/nix.nix
index db9e70bb9c3f..c9407050b724 100644
--- a/nixos/modules/config/nix.nix
+++ b/nixos/modules/config/nix.nix
@@ -347,7 +347,6 @@ in
             trusted-users = mkOption {
               type = types.listOf types.str;
               example = [
-                "root"
                 "alice"
                 "@wheel"
               ];
@@ -357,8 +356,9 @@ in
                 additional binary caches, or to import unsigned NARs. You
                 can also specify groups by prefixing them with
                 `@`; for instance,
-                `@wheel` means all users in the wheel
-                group.
+                `@wheel` means all users in the wheel group.
+                `root` is included as a regular definition, so you do not have to repeat it.
+                Furthermore, `root` normally bypasses the daemon.
               '';
             };
 

From 8ba2600c3e6380e6dd05f8b4a0d92155e42729cd Mon Sep 17 00:00:00 2001
From: Sergio Idarraga Aguirre <sergioidarraga2110@gmail.com>
Date: Sun, 11 Oct 2026 11:25:33 -0500
Subject: [PATCH 504/525] vimPlugins.toggable-term-nvim: 0-unstable-2026-10-05
 -> 0-unstable-2026-10-11

https://github.com/sergioia-dev/toggable-term-nvim

Assisted-by: Pi 0.86.1 (deepseek-flash)
---
 pkgs/applications/editors/vim/plugins/generated.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 0254b17d5cd6..ceee2affd865 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -18446,12 +18446,12 @@ final: prev: {
 
   toggable-term-nvim = buildVimPlugin {
     pname = "toggable-term-nvim";
-    version = "0-unstable-2026-10-05";
+    version = "0-unstable-2026-10-11";
     src = fetchFromGitHub {
       owner = "sergioia-dev";
       repo = "toggable-term-nvim";
-      rev = "713633355ced060f5337e6ce5271db67367bbf16";
-      hash = "sha256-Bs3elJzzzi1WiqwP0TnXEkUdwjizO2OckaNBTX6iGRM=";
+      rev = "f16258898a1fe879ad69402edeb9915518cd691b";
+      hash = "sha256-Maco2xfRvwxCXHAZQ3bMdCbqhhOBHd+92tegEvgdrg0=";
     };
     meta.homepage = "https://github.com/sergioia-dev/toggable-term-nvim/";
     meta.license = getLicenseFromSpdxId "MIT";

From dffe82f5b6009334b1ff885e419e0235e9fc37ad Mon Sep 17 00:00:00 2001
From: Sergio Idarraga Aguirre <sergioidarraga2110@gmail.com>
Date: Sun, 11 Oct 2026 11:25:36 -0500
Subject: [PATCH 505/525] vimPlugins: fix ordering of two vim-plugin-names
 entries

`vim-plugins-updater` orders vim-plugin-names by normalized plugin name
(case-sensitive, `.` replaced by `-`). Two entries on master are not in that
order, so a run of the updater relocates them together with their
`generated.nix` blocks:

- `anoopkcn/filemarks.nvim` is in the uppercase group, while `filemarks-nvim`
  sorts with the lowercase `f` entries
- `whatyouhide/vim-textobj-xmlattr` precedes
  `Julian/vim-textobj-variable-segment`

No entry is added, removed or modified: both files contain exactly the same
lines as before, only in a different position.

Split out of the vimPlugins.toggable-term-nvim update so that commit contains
only that package.

Assisted-by: Pi 0.86.1 (deepseek-flash)
---
 .../editors/vim/plugins/generated.nix         | 56 +++++++++----------
 .../editors/vim/plugins/vim-plugin-names      |  4 +-
 2 files changed, 30 insertions(+), 30 deletions(-)

diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index ceee2affd865..bb2528e9d39a 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -122,20 +122,6 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
-  filemarks-nvim = buildVimPlugin {
-    pname = "filemarks.nvim";
-    version = "1.6.0";
-    src = fetchFromGitHub {
-      owner = "anoopkcn";
-      repo = "filemarks.nvim";
-      tag = "1.6.0";
-      hash = "sha256-qSHHsBb7MAceNV3QnZiTFN4d1i2zH8CItlzQWsYNjno=";
-    };
-    meta.homepage = "https://github.com/anoopkcn/filemarks.nvim/";
-    meta.license = getLicenseFromSpdxId "MIT";
-    meta.hydraPlatforms = [ ];
-  };
-
   FTerm-nvim = buildVimPlugin {
     pname = "FTerm.nvim";
     version = "0-unstable-2022-11-13";
@@ -6063,6 +6049,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  filemarks-nvim = buildVimPlugin {
+    pname = "filemarks.nvim";
+    version = "1.6.0";
+    src = fetchFromGitHub {
+      owner = "anoopkcn";
+      repo = "filemarks.nvim";
+      tag = "1.6.0";
+      hash = "sha256-qSHHsBb7MAceNV3QnZiTFN4d1i2zH8CItlzQWsYNjno=";
+    };
+    meta.homepage = "https://github.com/anoopkcn/filemarks.nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   filemention-nvim = buildVimPlugin {
     pname = "filemention.nvim";
     version = "0-unstable-2026-05-30";
@@ -24831,20 +24831,6 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
-  vim-textobj-xmlattr = buildVimPlugin {
-    pname = "vim-textobj-xmlattr";
-    version = "0.1.1";
-    src = fetchFromGitHub {
-      owner = "whatyouhide";
-      repo = "vim-textobj-xmlattr";
-      tag = "0.1.1";
-      hash = "sha256-EFn7Ql7SFWwcjR5WdQkl2/lJZY9qZN9ml6625lGtTzY=";
-    };
-    meta.homepage = "https://github.com/whatyouhide/vim-textobj-xmlattr/";
-    meta.license = getLicenseFromSpdxId "WTFPL";
-    meta.hydraPlatforms = [ ];
-  };
-
   vim-textobj-variable-segment = buildVimPlugin {
     pname = "vim-textobj-variable-segment";
     version = "0-unstable-2024-09-06";
@@ -24859,6 +24845,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  vim-textobj-xmlattr = buildVimPlugin {
+    pname = "vim-textobj-xmlattr";
+    version = "0.1.1";
+    src = fetchFromGitHub {
+      owner = "whatyouhide";
+      repo = "vim-textobj-xmlattr";
+      tag = "0.1.1";
+      hash = "sha256-EFn7Ql7SFWwcjR5WdQkl2/lJZY9qZN9ml6625lGtTzY=";
+    };
+    meta.homepage = "https://github.com/whatyouhide/vim-textobj-xmlattr/";
+    meta.license = getLicenseFromSpdxId "WTFPL";
+    meta.hydraPlatforms = [ ];
+  };
+
   vim-themis = buildVimPlugin {
     pname = "vim-themis";
     version = "1.7.0-unstable-2025-08-29";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 07a699ba53d5..df465e6d8104 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -7,7 +7,6 @@ https://github.com/vim-scripts/Colour-Sampler-Pack/,,
 https://github.com/CopilotC-Nvim/CopilotChat.nvim/,,
 https://github.com/whonore/Coqtail/,,
 https://github.com/vim-scripts/DoxygenToolkit.vim/,,
-https://github.com/anoopkcn/filemarks.nvim/,,
 https://github.com/numToStr/FTerm.nvim/,,
 https://github.com/antoinemadec/FixCursorHold.nvim/,,
 https://github.com/Aaronik/GPTModels.nvim/,,
@@ -431,6 +430,7 @@ https://github.com/micampe/fennel.vim/,,
 https://github.com/wincent/ferret/,,
 https://github.com/bogado/file-line/,,
 https://github.com/lewis6991/fileline.nvim/,,
+https://github.com/anoopkcn/filemarks.nvim/,,
 https://github.com/not-manu/filemention.nvim/,,
 https://github.com/VonHeikemen/fine-cmdline.nvim/,,
 https://github.com/glacambre/firenvim/,,
@@ -1771,8 +1771,8 @@ https://github.com/kana/vim-textobj-line/,,
 https://github.com/osyo-manga/vim-textobj-multiblock/,,
 https://github.com/preservim/vim-textobj-quote/,,
 https://github.com/kana/vim-textobj-user/,,
-https://github.com/whatyouhide/vim-textobj-xmlattr/,,
 https://github.com/Julian/vim-textobj-variable-segment/,,
+https://github.com/whatyouhide/vim-textobj-xmlattr/,,
 https://github.com/thinca/vim-themis/,,
 https://github.com/tmux-plugins/vim-tmux/,,
 https://github.com/roxma/vim-tmux-clipboard/,,

From a36f93104c68dd8012c6698757bcf2fb3b4fb5fe Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 16:31:17 +0000
Subject: [PATCH 506/525] everest: 6580 -> 6623

---
 pkgs/by-name/ev/everest-bin/package.nix | 6 +++---
 pkgs/by-name/ev/everest/package.nix     | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/ev/everest-bin/package.nix b/pkgs/by-name/ev/everest-bin/package.nix
index 573827cf4fbb..13a6cb3892ac 100644
--- a/pkgs/by-name/ev/everest-bin/package.nix
+++ b/pkgs/by-name/ev/everest-bin/package.nix
@@ -8,15 +8,15 @@
 
 let
   pname = "everest";
-  version = "6580";
+  version = "6623";
   phome = "$out/lib/Celeste";
 in
 stdenvNoCC.mkDerivation {
   inherit pname version;
   src = fetchzip {
-    url = "https://github.com/EverestAPI/Everest/releases/download/stable-1.6580.0/main.zip";
+    url = "https://github.com/EverestAPI/Everest/releases/download/stable-1.6623.0/main.zip";
     extension = "zip";
-    hash = "sha256-O2/VfrP53HtA7ajsrlfalAsvYvjY4ABCYWCOwUKYio0=";
+    hash = "sha256-nGQggGBSEq/NAaE3AKau6BAFrWIUtKIt4Nswi4clXOM=";
   };
   buildInputs = [
     icu
diff --git a/pkgs/by-name/ev/everest/package.nix b/pkgs/by-name/ev/everest/package.nix
index d88af39198ba..329ff88cc1a3 100644
--- a/pkgs/by-name/ev/everest/package.nix
+++ b/pkgs/by-name/ev/everest/package.nix
@@ -11,8 +11,8 @@
 
 let
   pname = "everest";
-  version = "6580";
-  rev = "082e21b0b6dd7ff7c96d65b2ca2c632f4fd8df75";
+  version = "6623";
+  rev = "47d6a61fa918c17b8085b93b61ee59a7465968f8";
   phome = "$out/lib/Celeste";
 in
 buildDotnetModule {
@@ -25,7 +25,7 @@ buildDotnetModule {
     fetchSubmodules = true;
     # TODO: use leaveDotGit = true and modify external/MonoMod in postFetch to please SourceLink
     # Microsoft.SourceLink.Common.targets(53,5): warning : Source control information is not available - the generated source link is empty.
-    hash = "sha256-SGcrNjKiLlUik7dsGN9JkBd0TCtKUYRBp+q9ET0v3oo=";
+    hash = "sha256-u21rht+XimQ557RP1Sy3xhGzfhwcbvFRHw12HGccIFg=";
   };
 
   nativeBuildInputs = [ autoPatchelfHook ];

From b60a7cb571cb70aaf3e1eb892ebafafe68d5a04b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 16:57:34 +0000
Subject: [PATCH 507/525] nginxModules.vod: 1.10.0 -> 1.10.1

---
 pkgs/servers/http/nginx/modules/vod/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/http/nginx/modules/vod/package.nix b/pkgs/servers/http/nginx/modules/vod/package.nix
index 564dba5c8ec3..04f4e660eea1 100644
--- a/pkgs/servers/http/nginx/modules/vod/package.nix
+++ b/pkgs/servers/http/nginx/modules/vod/package.nix
@@ -12,13 +12,13 @@
 
 mkNginxPlugin (finalAttrs: {
   pname = "vod";
-  version = "1.10.0";
+  version = "1.10.1";
 
   src = fetchFromGitHub {
     owner = "dio-az";
     repo = "nginx-vod-module";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1c9KyxZq45/AsAg9wRUD+RWfTgrCOJJwAceFYNXnVsU=";
+    hash = "sha256-DuQ6648BHhjTUsCEYmcgl8nWgwwRy8PNzgzQwthiDZk=";
   };
 
   postPatch = ''

From 70ce06d50bd4225c66e2aacd192270dfd382d6f4 Mon Sep 17 00:00:00 2001
From: RockWolf <git@rockwolf.eu>
Date: Sat, 10 Oct 2026 20:06:18 +0200
Subject: [PATCH 508/525] nixos-rebuild-ng: support `--specialisation` for
 `build-image`

---
 .../nixos-rebuild-ng/src/nixos_rebuild/nix.py |  16 +-
 .../src/nixos_rebuild/services.py             |  34 ++-
 .../nixos-rebuild-ng/src/tests/test_main.py   | 238 ++++++++++++++++++
 .../ni/nixos-rebuild-ng/src/tests/test_nix.py |   6 +-
 .../src/tests/test_services.py                |  80 +++++-
 5 files changed, 353 insertions(+), 21 deletions(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
index e7782b545828..fdc41a27f902 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/nix.py
@@ -286,6 +286,7 @@ def find_file(file: str, nix_flags: Args | None = None) -> Path | None:
 def get_build_image_name(
     build_attr: BuildAttr,
     image_variant: str,
+    specialisation: str | None,
     instantiate_flags: Args | None = None,
 ) -> str:
     path = (
@@ -305,7 +306,7 @@ def get_build_image_name(
               value = import {path};
               set = if builtins.isFunction value then value {{}} else value;
             in
-              set.{build_attr.to_attr("config.system.build.images", image_variant, "passthru", "filePath")}
+              set.{build_attr.to_attr(get_build_image_attr(specialisation), image_variant, "passthru", "filePath")}
             """),
             *dict_to_flags(instantiate_flags),
         ],
@@ -318,6 +319,7 @@ def get_build_image_name(
 def get_build_image_name_flake(
     flake: Flake,
     image_variant: str,
+    specialisation: str | None,
     eval_flags: Args | None = None,
 ) -> str:
     r = run_wrapper(
@@ -327,7 +329,7 @@ def get_build_image_name_flake(
             "eval",
             "--json",
             flake.to_attr(
-                "config.system.build.images", image_variant, "passthru", "filePath"
+                get_build_image_attr(specialisation), image_variant, "passthru", "filePath"
             ),
             *dict_to_flags(eval_flags),
         ],
@@ -339,6 +341,7 @@ def get_build_image_name_flake(
 
 def get_build_image_variants(
     build_attr: BuildAttr,
+    specialisation: str | None,
     instantiate_flags: Args | None = None,
 ) -> ImageVariants:
     path = (
@@ -358,7 +361,7 @@ def get_build_image_variants(
               value = import {path};
               set = if builtins.isFunction value then value {{}} else value;
             in
-              builtins.attrNames set.{build_attr.to_attr("config.system.build.images")}
+              builtins.attrNames set.{build_attr.to_attr(get_build_image_attr(specialisation))}
             """),
             *dict_to_flags(instantiate_flags),
         ],
@@ -370,6 +373,7 @@ def get_build_image_variants(
 
 def get_build_image_variants_flake(
     flake: Flake,
+    specialisation: str | None,
     eval_flags: Args | None = None,
 ) -> ImageVariants:
     r = run_wrapper(
@@ -378,7 +382,7 @@ def get_build_image_variants_flake(
             *FLAKE_FLAGS,
             "eval",
             "--json",
-            flake.to_attr("config.system.build.images"),
+            flake.to_attr(get_build_image_attr(specialisation)),
             "--apply",
             "builtins.attrNames",
             *dict_to_flags(eval_flags),
@@ -388,6 +392,10 @@ def get_build_image_variants_flake(
     j: ImageVariants = json.loads(r.stdout.strip())
     return j
 
+def get_build_image_attr(specialisation: str | None) -> str:
+    if specialisation:
+        return f"config.specialisation.{specialisation}.configuration.system.build.images"
+    return "config.system.build.images"
 
 def get_nixpkgs_rev(nixpkgs_path: Path | None) -> str | None:
     """Get Nixpkgs path as a Git revision.
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
index 018705d3a03a..2b1b3280e67e 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/nixos_rebuild/services.py
@@ -96,20 +96,26 @@ def _get_system_attr(
     grouped_nix_args: GroupedNixArgs,
 ) -> str:
     match action:
-        case Action.BUILD_IMAGE if flake:
-            variants = nix.get_build_image_variants_flake(
-                flake,
-                eval_flags=grouped_nix_args.flake_eval_flags,
-            )
+        case Action.BUILD_IMAGE:
+            variants: ImageVariants = {}
+            if flake:
+                variants = nix.get_build_image_variants_flake(
+                    flake,
+                    args.specialisation,
+                    eval_flags=grouped_nix_args.flake_eval_flags,
+                )
+            elif build_attr:
+                variants = nix.get_build_image_variants(
+                    build_attr,
+                    args.specialisation,
+                    instantiate_flags=grouped_nix_args.common_flags,
+                )
+            else:
+                raise NixOSRebuildError("failed to get image variants: both `flake` and `build_attr` are None")
+
             _validate_image_variant(args.image_variant, variants)
-            return f"config.system.build.images.{args.image_variant}"
-        case Action.BUILD_IMAGE if build_attr:
-            variants = nix.get_build_image_variants(
-                build_attr,
-                instantiate_flags=grouped_nix_args.common_flags,
-            )
-            _validate_image_variant(args.image_variant, variants)
-            return f"config.system.build.images.{args.image_variant}"
+            return f"{nix.get_build_image_attr(args.specialisation)}.{args.image_variant}"
+
         case Action.BUILD_VM:
             if args.specialisation:
                 return f"config.specialisation.{args.specialisation}.configuration.system.build.vm"
@@ -261,12 +267,14 @@ def _activate_system(
                 image_name = nix.get_build_image_name_flake(
                     flake,
                     args.image_variant,
+                    args.specialisation,
                     eval_flags=grouped_nix_args.flake_eval_flags,
                 )
             else:
                 image_name = nix.get_build_image_name(
                     build_attr,
                     args.image_variant,
+                    args.specialisation,
                     instantiate_flags=grouped_nix_args.common_flags,
                 )
             disk_path = path_to_config / image_name
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
index 91c3bf93c729..403dca07c585 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
@@ -467,6 +467,159 @@ def test_execute_nix_build_vm_with_bootloader_and_specialisation(
         ),
     ]
 
+@patch.dict(os.environ, {}, clear=True)
+@patch("subprocess.run", autospec=True)
+def test_execute_nix_build_image(mock_run: Mock, tmp_path: Path) -> None:
+    config_path = tmp_path / "test"
+    config_path.touch()
+
+    def run_side_effect(args: list[str], **kwargs: Any) -> CompletedProcess[str]:
+        if args[0] == "nix-instantiate" and "--eval" in args:
+            return CompletedProcess(
+                [],
+                0,
+                '"nixos-image-azure-25.05.20250102.6df2492-x86_64-linux.vhd"',
+            )
+        elif args[0] == "nix-build":
+            return CompletedProcess([], 0, str(config_path))
+        elif args[0] == "nix-instantiate":
+            return CompletedProcess([], 1)
+        else:
+            return CompletedProcess([], 0)
+
+    mock_run.side_effect = run_side_effect
+
+    nr.execute(
+        [
+            "nixos-rebuild",
+            "build-image",
+            "--image-variant",
+            "azure",
+            "--no-flake",
+        ]
+    )
+
+    assert mock_run.mock_calls == [
+        call(
+            ["nix-instantiate", "--find-file", "nixos-system"],
+            check=False,
+            capture_output=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix-instantiate",
+                "--eval",
+                "--strict",
+                "--json",
+                "--expr", "\nlet\n  value = import <nixpkgs/nixos>;\n  set = if builtins.isFunction value then value {} else value;\nin\n  builtins.attrNames set.config.system.build.images\n"
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix-build",
+                "<nixpkgs/nixos>",
+                "--attr",
+                "config.system.build.images.azure"
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix-instantiate",
+                "--eval",
+                "--strict",
+                "--json",
+                "--expr", "\nlet\n  value = import <nixpkgs/nixos>;\n  set = if builtins.isFunction value then value {} else value;\nin\n  set.config.system.build.images.azure.passthru.filePath\n"
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+    ]
+
+@patch.dict(os.environ, {}, clear=True)
+@patch("subprocess.run", autospec=True)
+def test_execute_nix_build_image_and_specialisation(mock_run: Mock, tmp_path: Path) -> None:
+    config_path = tmp_path / "test"
+    config_path.touch()
+
+    def run_side_effect(args: list[str], **kwargs: Any) -> CompletedProcess[str]:
+        if args[0] == "nix-instantiate" and "--eval" in args:
+            return CompletedProcess(
+                [],
+                0,
+                '"nixos-image-azure-25.05.20250102.6df2492-x86_64-linux.vhd"',
+            )
+        elif args[0] == "nix-build":
+            return CompletedProcess([], 0, str(config_path))
+        elif args[0] == "nix-instantiate":
+            return CompletedProcess([], 1)
+        else:
+            return CompletedProcess([], 0)
+
+    mock_run.side_effect = run_side_effect
+
+    nr.execute(
+        [
+            "nixos-rebuild",
+            "build-image",
+            "--image-variant",
+            "azure",
+            "--no-flake",
+            "--specialisation",
+            "custom-specialisation",
+        ]
+    )
+
+    assert mock_run.mock_calls == [
+        call(
+            ["nix-instantiate", "--find-file", "nixos-system"],
+            check=False,
+            capture_output=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix-instantiate",
+                "--eval",
+                "--strict",
+                "--json",
+                "--expr", "\nlet\n  value = import <nixpkgs/nixos>;\n  set = if builtins.isFunction value then value {} else value;\nin\n  builtins.attrNames set.config.specialisation.custom-specialisation.configuration.system.build.images\n"
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix-build",
+                "<nixpkgs/nixos>",
+                "--attr",
+                "config.specialisation.custom-specialisation.configuration.system.build.images.azure"
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix-instantiate",
+                "--eval",
+                "--strict",
+                "--json",
+                "--expr", "\nlet\n  value = import <nixpkgs/nixos>;\n  set = if builtins.isFunction value then value {} else value;\nin\n  set.config.specialisation.custom-specialisation.configuration.system.build.images.azure.passthru.filePath\n"
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+    ]
 
 @patch.dict(os.environ, {}, clear=True)
 @patch("subprocess.run", autospec=True)
@@ -551,6 +704,91 @@ def test_execute_nix_build_image_flake(mock_run: Mock, tmp_path: Path) -> None:
         ),
     ]
 
+@patch.dict(os.environ, {}, clear=True)
+@patch("subprocess.run", autospec=True)
+def test_execute_nix_build_image_flake_and_specialisation(mock_run: Mock, tmp_path: Path) -> None:
+    config_path = tmp_path / "test"
+    config_path.touch()
+
+    def run_side_effect(args: list[str], **kwargs: Any) -> CompletedProcess[str]:
+        if args[0] == "nix" and "eval" in args:
+            return CompletedProcess(
+                [],
+                0,
+                '"nixos-image-azure-25.05.20250102.6df2492-x86_64-linux.vhd"',
+            )
+        elif args[0] == "nix":
+            return CompletedProcess([], 0, str(config_path))
+        elif args[0] == "nix-instantiate":
+            return CompletedProcess([], 1)
+        else:
+            return CompletedProcess([], 0)
+
+    mock_run.side_effect = run_side_effect
+
+    nr.execute(
+        [
+            "nixos-rebuild",
+            "build-image",
+            "--image-variant",
+            "azure",
+            "--flake",
+            "/path/to/config#hostname",
+            "--specialisation",
+            "custom-specialisation",
+        ]
+    )
+
+    assert mock_run.mock_calls == [
+        call(
+            ["nix-instantiate", "--find-file", "nixos-system"],
+            check=False,
+            capture_output=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix",
+                "--extra-experimental-features",
+                "nix-command flakes",
+                "eval",
+                "--json",
+                '/path/to/config#nixosConfigurations."hostname".config.specialisation.custom-specialisation.configuration.system.build.images',
+                "--apply",
+                "builtins.attrNames",
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix",
+                "--extra-experimental-features",
+                "nix-command flakes",
+                "build",
+                "--print-out-paths",
+                '/path/to/config#nixosConfigurations."hostname".config.specialisation.custom-specialisation.configuration.system.build.images.azure',
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix",
+                "--extra-experimental-features",
+                "nix-command flakes",
+                "eval",
+                "--json",
+                '/path/to/config#nixosConfigurations."hostname".config.specialisation.custom-specialisation.configuration.system.build.images.azure.passthru.filePath',
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+    ]
+
 
 @patch.dict(
     os.environ,
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
index fcad913e1b68..70ef43b44c9c 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
@@ -351,7 +351,7 @@ def test_edit_flake(mock_run: Mock) -> None:
 )
 def test_get_build_image_variants(mock_run: Mock, tmp_path: Path) -> None:
     build_attr = m.BuildAttr("<nixpkgs/nixos>", None)
-    assert n.get_build_image_variants(build_attr) == {
+    assert n.get_build_image_variants(build_attr, None) == {
         "azure": "nixos-image-azure-25.05.20250102.6df2492-x86_64-linux.vhd",
         "vmware": "nixos-image-vmware-25.05.20250102.6df2492-x86_64-linux.vmdk",
     }
@@ -374,7 +374,7 @@ def test_get_build_image_variants(mock_run: Mock, tmp_path: Path) -> None:
     )
 
     build_attr = m.BuildAttr(tmp_path, "preAttr")
-    assert n.get_build_image_variants(build_attr, {"inst_flag": True}) == {
+    assert n.get_build_image_variants(build_attr, None, {"inst_flag": True}) == {
         "azure": "nixos-image-azure-25.05.20250102.6df2492-x86_64-linux.vhd",
         "vmware": "nixos-image-vmware-25.05.20250102.6df2492-x86_64-linux.vmdk",
     }
@@ -414,7 +414,7 @@ def test_get_build_image_variants(mock_run: Mock, tmp_path: Path) -> None:
 )
 def test_get_build_image_variants_flake(mock_run: Mock) -> None:
     flake = m.Flake("/flake.nix", "myAttr")
-    assert n.get_build_image_variants_flake(flake, {"eval_flag": True}) == {
+    assert n.get_build_image_variants_flake(flake, None, {"eval_flag": True}) == {
         "azure": "nixos-image-azure-25.05.20250102.6df2492-x86_64-linux.vhd",
         "vmware": "nixos-image-vmware-25.05.20250102.6df2492-x86_64-linux.vmdk",
     }
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_services.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_services.py
index 2d158da1be70..ac16ac3eb3bd 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_services.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_services.py
@@ -4,6 +4,7 @@ from pathlib import Path
 from subprocess import CompletedProcess
 from unittest.mock import ANY, Mock, call, patch
 
+import pytest
 from pytest import MonkeyPatch
 
 import nixos_rebuild as n
@@ -20,13 +21,13 @@ grouped_nix_args = n.models.GroupedNixArgs(
 )
 
 
-# TODO: add tests for Action.BUILD_IMAGE
 def test__get_system_attr() -> None:
     args = argparse.Namespace(specialisation=None)
     tests = {
         n.models.Action.BOOT: "config.system.build.toplevel",
         n.models.Action.BUILD_VM: "config.system.build.vm",
         n.models.Action.BUILD_VM_WITH_BOOTLOADER: "config.system.build.vmWithBootLoader",
+        # Action.BUILD_IMAGE is handled in the below test
     }
     for action, expected_system_attr in tests.items():
         assert (
@@ -45,6 +46,7 @@ def test__get_system_attr() -> None:
         n.models.Action.BOOT: "config.system.build.toplevel",
         n.models.Action.BUILD_VM: "config.specialisation.custom-specialisation.configuration.system.build.vm",
         n.models.Action.BUILD_VM_WITH_BOOTLOADER: "config.specialisation.custom-specialisation.configuration.system.build.vmWithBootLoader",
+        # Action.BUILD_IMAGE is handled in the below test
     }
     for action, expected_system_attr in tests.items():
         assert (
@@ -58,6 +60,82 @@ def test__get_system_attr() -> None:
             == expected_system_attr
         )
 
+@patch(
+    get_qualified_name(n.nix.run_wrapper, n.nix),
+    autospec=True,
+    return_value=CompletedProcess([], 0, stdout='["amazon","azure","cloudstack","digital-ocean","google-compute","hyperv","iso","iso-installer","kexec","kubevirt","linode","lxc","lxc-metadata","oci","openstack","openstack-zfs","proxmox","proxmox-lxc","qemu","qemu-efi","raw","raw-efi","sd-card","vagrant-virtualbox","virtualbox","vmware"]\n'),
+)
+def test__get_system_attr__build_image(
+    mock_run: Mock,
+    monkeypatch: MonkeyPatch,
+    tmpdir: Path,
+) -> None:
+    monkeypatch.chdir(tmpdir)
+
+    # both `flake` & `build_attr` None
+    args = argparse.Namespace(specialisation=None)
+    with pytest.raises(Exception) as e:
+        s._get_system_attr(
+            action=n.models.Action.BUILD_IMAGE,
+            args=args,
+            flake=None,
+            build_attr=None,
+            grouped_nix_args=grouped_nix_args,
+        )
+
+    # no specialisation
+    ## flake
+    args = argparse.Namespace(image_variant="iso", specialisation=None)
+    assert (
+        s._get_system_attr(
+            action=n.models.Action.BUILD_IMAGE,
+            args=args,
+            flake=n.models.Flake.parse("/flake.nix#hostname"),
+            build_attr=None,
+            grouped_nix_args=grouped_nix_args,
+        )
+        == "config.system.build.images.iso"
+    )
+
+    ## build_attr
+    args = argparse.Namespace(image_variant="iso", specialisation=None)
+    assert (
+        s._get_system_attr(
+            action=n.models.Action.BUILD_IMAGE,
+            args=args,
+            flake=None,
+            build_attr=n.BuildAttr.from_arg(None, None),
+            grouped_nix_args=grouped_nix_args,
+        )
+        == "config.system.build.images.iso"
+    )
+
+    # with specialisation
+    ## flake
+    args = argparse.Namespace(image_variant="iso", specialisation="custom-specialisation")
+    assert (
+        s._get_system_attr(
+            action=n.models.Action.BUILD_IMAGE,
+            args=args,
+            flake=n.models.Flake.parse("/flake.nix#hostname"),
+            build_attr=None,
+            grouped_nix_args=grouped_nix_args,
+        )
+        == "config.specialisation.custom-specialisation.configuration.system.build.images.iso"
+    )
+
+    ## build_attr
+    args = argparse.Namespace(image_variant="iso", specialisation="custom-specialisation")
+    assert (
+        s._get_system_attr(
+            action=n.models.Action.BUILD_IMAGE,
+            args=args,
+            flake=None,
+            build_attr=n.BuildAttr.from_arg(None, None),
+            grouped_nix_args=grouped_nix_args,
+        )
+        == "config.specialisation.custom-specialisation.configuration.system.build.images.iso"
+    )
 
 @patch.dict(os.environ, {}, clear=True)
 @patch("os.execve", autospec=True)

From 6a183284fa10cce962d1297b14f18a0b6a0ca784 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Sun, 11 Oct 2026 12:25:01 +0200
Subject: [PATCH 509/525] tgrep: 1.0.11 -> 1.1.0

Diff: https://github.com/microsoft/tgrep/compare/v1.0.11...v1.1.0

Changelog: https://github.com/microsoft/tgrep/releases/tag/v1.1.0
---
 pkgs/by-name/tg/tgrep/package.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/tg/tgrep/package.nix b/pkgs/by-name/tg/tgrep/package.nix
index 620b9adf463a..01b194cb6b54 100644
--- a/pkgs/by-name/tg/tgrep/package.nix
+++ b/pkgs/by-name/tg/tgrep/package.nix
@@ -10,7 +10,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tgrep";
-  version = "1.0.11";
+  version = "1.1.0";
   __structuredAttrs = true;
   __darwinAllowLocalNetworking = true;
 
@@ -18,10 +18,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "microsoft";
     repo = "tgrep";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TkllXBOyxEl1NVXIRmRYOVlUqm65GRCNnoetGcR7kyE=";
+    hash = "sha256-Sr7xFT3dbpkCjalQ2CtUzIaWUrSDC3lPs1WV0Iiqk/U=";
   };
 
-  cargoHash = "sha256-xPXLkW/YeCBbRCGf4+VYLQqm4D5WkKo2yIJhkLOxO+s=";
+  cargoHash = "sha256-+28RGFPraepj4nrTATb51pwoYTewexhjcSkURbP+Xr4=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];
@@ -45,6 +45,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "--skip=watcher_reconciles_forced_add_and_rm_cached_inside_an_ignored_tree"
     "--skip=native_watcher_tracks_hidden_updates_ignore_transitions_and_restart"
     "--skip=git_metadata_stays_out_of_native_and_persisted_indexes"
+    "--skip=native_watching_includes_searchable_nested_tgrep_directories"
+    "--skip=polling_and_native_events_reconcile_without_queries"
+    "--skip=stateful::seeded_shared_search_parity_native_watcher"
   ];
 
   passthru.updateScript = nix-update-script { };

From 4fdfe61260876742ca1bcdae9552086917b35354 Mon Sep 17 00:00:00 2001
From: eljamm <fedi.jamoussi@protonmail.ch>
Date: Sun, 11 Oct 2026 17:42:26 +0000
Subject: [PATCH 510/525] linux_xanmod: 6.18.55 -> 6.18.56

- Changelog: https://dl.xanmod.org/changelog/6.18/ChangeLog-6.18.56-xanmod1.gz
- Diff: https://gitlab.com/xanmod/linux/-/compare/6.18.55-xanmod1..6.18.56-xanmod1?from_project_id=51590166
---
 pkgs/os-specific/linux/kernel/xanmod-kernels.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index 7106cca710db..02c77a10b82a 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -15,8 +15,8 @@ let
   variants = {
     # ./update-xanmod.sh lts
     lts = {
-      version = "6.18.55";
-      hash = "sha256-iaXQh/16QepauEYqDTrDpb2nR/pYpXVFbjAh4PFbf4Q=";
+      version = "6.18.56";
+      hash = "sha256-kUTu56sFisfwyJfa0svToWAEkDBhPmNQbBNWkidBRLM=";
       isLTS = true;
     };
     # ./update-xanmod.sh main

From c21a6a91d12a9b047a416ae32ce2e60bed46e4da Mon Sep 17 00:00:00 2001
From: eljamm <fedi.jamoussi@protonmail.ch>
Date: Sun, 11 Oct 2026 17:44:35 +0000
Subject: [PATCH 511/525] linux_xanmod_latest: 7.2.9 -> 7.2.10

- Changelog: https://dl.xanmod.org/changelog/7.2/ChangeLog-7.2.10-xanmod1.gz
- Diff: https://gitlab.com/xanmod/linux/-/compare/7.2.9-xanmod1..7.2.10-xanmod1?from_project_id=51590166
---
 pkgs/os-specific/linux/kernel/xanmod-kernels.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
index 02c77a10b82a..698d447beffe 100644
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -21,8 +21,8 @@ let
     };
     # ./update-xanmod.sh main
     main = {
-      version = "7.2.9";
-      hash = "sha256-BQU4U4YdDVxUGasAiCgoZ7jWMkPcTfkHDiimyKIhwQ4=";
+      version = "7.2.10";
+      hash = "sha256-mix9hVthsoqJdf/2vZ/qltl2wb+yIMw8Kw6o5rkkzQg=";
     };
   };
 

From 777f622c42291b15dc3a078d749d59a287088372 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 17:50:57 +0000
Subject: [PATCH 512/525] solanum: 0-unstable-2026-09-13 ->
 0-unstable-2026-09-22

---
 pkgs/by-name/so/solanum/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/so/solanum/package.nix b/pkgs/by-name/so/solanum/package.nix
index 4a18388d7fb1..5ab017dbeded 100644
--- a/pkgs/by-name/so/solanum/package.nix
+++ b/pkgs/by-name/so/solanum/package.nix
@@ -26,13 +26,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "solanum";
-  version = "0-unstable-2026-09-13";
+  version = "0-unstable-2026-09-22";
 
   src = fetchFromGitHub {
     owner = "solanum-ircd";
     repo = "solanum";
-    rev = "96b2cfa1a13a8ad30a6dd85af540cd0f6f74a621";
-    hash = "sha256-q1OAi6pEpmuc4G2PiiEBPBANKIkg7tvFw/jJigxTRH0=";
+    rev = "03503ff488ea5757a0fdfd62b7509b02b41904ab";
+    hash = "sha256-Z6ujkb4VzgoMdUKnKoUdDpX8DDjxcb06YqrbojNXfFc=";
   };
 
   postPatch = ''

From a04774964e7cfa4328b7bff05a053d6c8ced9f83 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 17:59:12 +0000
Subject: [PATCH 513/525] terraform-providers.spacelift-io_spacelift: 1.55.0 ->
 1.57.0

---
 .../networking/cluster/terraform-providers/providers.json   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 5a75fa069724..79648d5eae0c 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1247,13 +1247,13 @@
     "vendorHash": "sha256-skswuFKhN4FFpIunbom9rM/FVRJVOFb1WwHeAIaEjn8="
   },
   "spacelift-io_spacelift": {
-    "hash": "sha256-Kn43SQM/uxNd32g+nm40fmLStPXyHhuGUX48g16AvKw=",
+    "hash": "sha256-MTxohgv1eMkzixc66sICFa6CC+uBRGjYQ64lBwlxiRE=",
     "homepage": "https://registry.terraform.io/providers/spacelift-io/spacelift",
     "owner": "spacelift-io",
     "repo": "terraform-provider-spacelift",
-    "rev": "v1.55.0",
+    "rev": "v1.57.0",
     "spdx": "MIT",
-    "vendorHash": "sha256-XpXZqb6j6WdTFowdwNf3e8i9lg69tavzb2H65LyQJvE="
+    "vendorHash": "sha256-raw9hcAvzBKy8bLbUNM36JZTYYE//r7b3HdZ3qFLtPY="
   },
   "splunk-terraform_signalfx": {
     "hash": "sha256-TjJQdzxB7X7RbiBJnaCvAGJTtDwfeOxc7lApl7jjrA8=",

From 122950c5fb16e3756eeb1cde2a60961b233f8ebe Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Wed, 23 Sep 2026 12:13:33 -0700
Subject: [PATCH 514/525] python3Packages.saiph: 2.0.8 -> 3.0.1

---
 .../python-modules/saiph/default.nix          | 35 +++++++++++--------
 1 file changed, 21 insertions(+), 14 deletions(-)

diff --git a/pkgs/development/python-modules/saiph/default.nix b/pkgs/development/python-modules/saiph/default.nix
index 7e809c6e20a6..14983c27c9ca 100644
--- a/pkgs/development/python-modules/saiph/default.nix
+++ b/pkgs/development/python-modules/saiph/default.nix
@@ -6,6 +6,7 @@
   pytestCheckHook,
   doubles,
   msgspec,
+  matplotlib,
   numpy,
   pandas,
   pydantic,
@@ -14,26 +15,26 @@
   toolz,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "saiph";
-  version = "2.0.8";
+  version = "3.0.1";
+  pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "octopize";
     repo = "saiph";
-    tag = "saiph-v${version}";
-    hash = "sha256-3KcCiGgcJ+1WLQPvxDJyGrn8TEiBVIh/9TsCMkku3ls=";
+    tag = "saiph-v${finalAttrs.version}";
+    hash = "sha256-e41fa0C3ZT8mg+oHLU6VsQKgnCh59uO3bksO46A4t1M=";
   };
 
-  pyproject = true;
-
   build-system = [
     hatchling
   ];
 
   dependencies = [
-    doubles
     msgspec
+    matplotlib
     numpy
     pandas
     pydantic
@@ -42,16 +43,22 @@ buildPythonPackage rec {
     toolz
   ];
 
-  # No need for benchmarks
-  disabledTests = [
-    "benchmark_test.py"
-  ];
-
   nativeCheckInputs = [
     pytestCheckHook
+    doubles
   ];
 
-  pythonRelaxDeps = true;
+  disabledTests = [
+    # No need for benchmarks
+    "benchmark_test.py"
+
+    # pluggy.PluggyTeardownRaisedWarning: A plugin raised an exception during an old-style hookwrapper teardown.
+    "test_encode_decode_model"
+    "test_fit_mix"
+    "test_var_cor"
+    "test_var_ratio"
+    "test_get_variable_contributions"
+  ];
 
   pythonImportsCheck = [
     "saiph"
@@ -63,4 +70,4 @@ buildPythonPackage rec {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ b-rodrigues ];
   };
-}
+})

From 4134fc5926a9f8e9d68d58d10c9c8600fde19151 Mon Sep 17 00:00:00 2001
From: Skye Soss <skye@soss.website>
Date: Mon, 5 Oct 2026 19:45:03 -0500
Subject: [PATCH 515/525] weechatScripts.weechat-matrix-bridge: drop

---
 doc/packages/weechat.section.md               |  3 +-
 .../irc/weechat/scripts/default.nix           |  5 --
 .../scripts/weechat-matrix-bridge/default.nix | 64 -------------------
 .../weechat-matrix-bridge/library-path.patch  | 28 --------
 4 files changed, 1 insertion(+), 99 deletions(-)
 delete mode 100644 pkgs/applications/networking/irc/weechat/scripts/weechat-matrix-bridge/default.nix
 delete mode 100644 pkgs/applications/networking/irc/weechat/scripts/weechat-matrix-bridge/library-path.patch

diff --git a/doc/packages/weechat.section.md b/doc/packages/weechat.section.md
index cdc9ccba5a96..60e99302879a 100644
--- a/doc/packages/weechat.section.md
+++ b/doc/packages/weechat.section.md
@@ -86,8 +86,7 @@ weechat.override {
     { availablePlugins, ... }:
     {
       scripts = with pkgs.weechatScripts; [
-        weechat-xmpp
-        weechat-matrix-bridge
+        weechat-matrix
         wee-slack
       ];
       init = ''
diff --git a/pkgs/applications/networking/irc/weechat/scripts/default.nix b/pkgs/applications/networking/irc/weechat/scripts/default.nix
index 6898a56a6357..251c662ad51f 100644
--- a/pkgs/applications/networking/irc/weechat/scripts/default.nix
+++ b/pkgs/applications/networking/irc/weechat/scripts/default.nix
@@ -1,6 +1,5 @@
 {
   callPackage,
-  lua52Packages,
   perlPackages,
   python3Packages,
 }:
@@ -20,10 +19,6 @@
 
   weechat-grep = callPackage ./weechat-grep { };
 
-  weechat-matrix-bridge = callPackage ./weechat-matrix-bridge {
-    inherit (lua52Packages) cjson luaffi;
-  };
-
   weechat-matrix = python3Packages.callPackage ./weechat-matrix { };
 
   weechat-notify-send = python3Packages.callPackage ./weechat-notify-send { };
diff --git a/pkgs/applications/networking/irc/weechat/scripts/weechat-matrix-bridge/default.nix b/pkgs/applications/networking/irc/weechat/scripts/weechat-matrix-bridge/default.nix
deleted file mode 100644
index 29c761b6fbed..000000000000
--- a/pkgs/applications/networking/irc/weechat/scripts/weechat-matrix-bridge/default.nix
+++ /dev/null
@@ -1,64 +0,0 @@
-{
-  lib,
-  stdenv,
-  curl,
-  fetchFromGitHub,
-  cjson,
-  olm,
-  luaffi,
-}:
-
-stdenv.mkDerivation {
-  pname = "weechat-matrix-bridge";
-  version = "unstable-2018-11-19";
-  src = fetchFromGitHub {
-    owner = "torhve";
-    repo = "weechat-matrix-protocol-script";
-    rev = "8d32e90d864a8f3f09ecc2857cd5dd6e39a8c3f7";
-    sha256 = "0qqd6qmkrdc0r3rnl53c3yp93fbcz7d3mdw3vq5gmdqxyym4s9lj";
-  };
-
-  patches = [
-    ./library-path.patch
-  ];
-
-  buildInputs = [
-    curl
-    cjson
-    olm
-    luaffi
-  ];
-
-  postPatch = ''
-    substituteInPlace matrix.lua \
-      --replace "/usr/bin/curl" "${curl}/bin/curl" \
-      --replace "__NIX_LIB_PATH__" "$out/lib/?.so" \
-      --replace "__NIX_OLM_PATH__" "$out/share/?.lua"
-
-    substituteInPlace olm.lua \
-      --replace "__NIX_LIB_PATH__" "$out/lib/?.so"
-  '';
-
-  passthru.scripts = [ "matrix.lua" ];
-
-  installPhase = ''
-    mkdir -p $out/{share,lib}
-
-    cp {matrix.lua,olm.lua} $out/share
-    cp ${cjson}/lib/lua/${cjson.lua.luaversion}/cjson.so $out/lib/cjson.so
-    cp ${olm}/lib/libolm.so $out/lib/libolm.so
-    cp ${luaffi}/lib/lua/${luaffi.lua.luaversion}/ffi.so $out/lib/ffi.so
-  '';
-
-  meta = {
-    description = "WeeChat script in Lua that implements the matrix.org chat protocol";
-    homepage = "https://github.com/torhve/weechat-matrix-protocol-script";
-    maintainers = [ ];
-    license = lib.licenses.mit; # see https://github.com/torhve/weechat-matrix-protocol-script/blob/0052e7275ae149dc5241226391c9b1889ecc3c6b/matrix.lua#L53
-    platforms = lib.platforms.unix;
-
-    # As of 2019-06-30, all of the dependencies are available on macOS but the
-    # package itself does not build.
-    broken = stdenv.hostPlatform.isDarwin;
-  };
-}
diff --git a/pkgs/applications/networking/irc/weechat/scripts/weechat-matrix-bridge/library-path.patch b/pkgs/applications/networking/irc/weechat/scripts/weechat-matrix-bridge/library-path.patch
deleted file mode 100644
index d9945c2993b7..000000000000
--- a/pkgs/applications/networking/irc/weechat/scripts/weechat-matrix-bridge/library-path.patch
+++ /dev/null
@@ -1,28 +0,0 @@
-diff --git a/matrix.lua b/matrix.lua
-index b79f500..32b37a2 100644
---- a/matrix.lua
-+++ b/matrix.lua
-@@ -43,6 +43,9 @@ This script maps this as follows:
- 
- ]]
- 
-+package.cpath = package.cpath .. ";__NIX_LIB_PATH__"
-+package.path = package.path .. ";__NIX_OLM_PATH__"
-+
- local json = require 'cjson' -- apt-get install lua-cjson
- local olmstatus, olm = pcall(require, 'olm') -- LuaJIT olm FFI binding ln -s ~/olm/olm.lua /usr/local/share/lua/5.1
- local w = weechat
-diff --git a/olm.lua b/olm.lua
-index 114649c..4828371 100644
---- a/olm.lua
-+++ b/olm.lua
-@@ -17,6 +17,9 @@
-  * limitations under the License.
-  */
- --]]
-+
-+package.cpath = package.cpath .. ";__NIX_LIB_PATH__"
-+
- local ffi = require'ffi'
- 
- ffi.cdef[[

From b6296096de360ddc1fccb765425dbd07cda718b1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 20:11:20 +0000
Subject: [PATCH 516/525] remind: 06.03.05 -> 06.03.06

---
 pkgs/by-name/re/remind/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/re/remind/package.nix b/pkgs/by-name/re/remind/package.nix
index afe903c242e2..7a5283e7c96a 100644
--- a/pkgs/by-name/re/remind/package.nix
+++ b/pkgs/by-name/re/remind/package.nix
@@ -16,11 +16,11 @@
 
 tcl.mkTclDerivation (finalAttrs: {
   pname = "remind";
-  version = "06.03.05";
+  version = "06.03.06";
 
   src = fetchzip {
     url = "https://dianne.skoll.ca/projects/remind/download/remind-${finalAttrs.version}.tar.gz";
-    hash = "sha256-4TESOZrPqa2LahojSy27qgIzkuS/tr8ElAS7nw/t5Fo=";
+    hash = "sha256-5x6SbABTQHAu61/Cg0PJgY5k9py/YsrN0bNxEoSSEhI=";
   };
 
   buildInputs = [

From 2a145980019a9375fc0bd171441b405101bc4df9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 20:11:38 +0000
Subject: [PATCH 517/525] unciv: 4.22.5 -> 4.22.8

---
 pkgs/by-name/un/unciv/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/un/unciv/package.nix b/pkgs/by-name/un/unciv/package.nix
index 5af0b1ea8b9a..423cecb1cb0c 100644
--- a/pkgs/by-name/un/unciv/package.nix
+++ b/pkgs/by-name/un/unciv/package.nix
@@ -12,7 +12,7 @@
   nix-update-script,
 }:
 let
-  version = "4.22.5";
+  version = "4.22.8";
 
   desktopItem = makeDesktopItem {
     name = "unciv";
@@ -42,7 +42,7 @@ stdenv.mkDerivation rec {
 
   src = fetchurl {
     url = "https://github.com/yairm210/Unciv/releases/download/${version}/Unciv.jar";
-    hash = "sha256-fIdv48YxqcKlBNhflhwUkhBkBs9q7pbc8PQ3bwqRXYg=";
+    hash = "sha256-BCVNMG6e3qDSWklcGIt9VGpQCcXNtYUPj8hmaei0KOM=";
   };
 
   dontUnpack = true;

From 62185f5f62194e6aa173e184e47d13e6addfc0e3 Mon Sep 17 00:00:00 2001
From: gquetel <quetel.gregor@gmail.com>
Date: Sun, 11 Oct 2026 22:10:43 +0200
Subject: [PATCH 518/525] 
 python3Packages.{mlflow,mlflow-skinny,mlflow-tracing}: 3.16.1 -> 3.17.0

https://github.com/mlflow/mlflow/releases/tag/v3.17.0
---
 pkgs/development/python-modules/mlflow-skinny/default.nix  | 2 +-
 pkgs/development/python-modules/mlflow-tracing/default.nix | 2 +-
 pkgs/development/python-modules/mlflow/default.nix         | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/mlflow-skinny/default.nix b/pkgs/development/python-modules/mlflow-skinny/default.nix
index 81bf46519e69..c13ec54236e4 100644
--- a/pkgs/development/python-modules/mlflow-skinny/default.nix
+++ b/pkgs/development/python-modules/mlflow-skinny/default.nix
@@ -41,7 +41,7 @@ buildPythonPackage (finalAttrs: {
     owner = "mlflow";
     repo = "mlflow";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gJzEKig5txbfi17AikC2ecdSJMaSoAb9ATIIZuVXkMw=";
+    hash = "sha256-uEvUfr1PM1BAMgvQ6Q6IVjZd0q40ZUXqhojlDUB3tvQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/mlflow-tracing/default.nix b/pkgs/development/python-modules/mlflow-tracing/default.nix
index 471bac86d607..b674dfbcbc2b 100644
--- a/pkgs/development/python-modules/mlflow-tracing/default.nix
+++ b/pkgs/development/python-modules/mlflow-tracing/default.nix
@@ -27,7 +27,7 @@ buildPythonPackage (finalAttrs: {
     owner = "mlflow";
     repo = "mlflow";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gJzEKig5txbfi17AikC2ecdSJMaSoAb9ATIIZuVXkMw=";
+    hash = "sha256-uEvUfr1PM1BAMgvQ6Q6IVjZd0q40ZUXqhojlDUB3tvQ=";
   };
 
   postPatch = ''
diff --git a/pkgs/development/python-modules/mlflow/default.nix b/pkgs/development/python-modules/mlflow/default.nix
index e921d5d535a9..42f172da219f 100644
--- a/pkgs/development/python-modules/mlflow/default.nix
+++ b/pkgs/development/python-modules/mlflow/default.nix
@@ -28,7 +28,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "mlflow";
-  version = "3.16.1";
+  version = "3.17.0";
   format = "wheel";
   __structuredAttrs = true;
 
@@ -40,7 +40,7 @@ buildPythonPackage (finalAttrs: {
     format = "wheel";
     dist = "py3";
     python = "py3";
-    hash = "sha256-5N/mnOrjHfx7hIDnb/5qfzZ1K9+sMOBY5kMK3h+1kgs=";
+    hash = "sha256-OVTqqZjU3UrIdyiUKTooW7XjpCj2+bN8rCmOeHQj6v0=";
   };
 
   # Nix-wrapped python populates sys.path via NIX_PYTHONPATH/site hooks,

From 81d01f3e6c9980576e07362881528ec6ee53e43a Mon Sep 17 00:00:00 2001
From: Frederic Ruget <fred@atlant.is>
Date: Sun, 11 Oct 2026 14:04:45 +0000
Subject: [PATCH 519/525] base91: 0.1.0 -> 0.3.2

https://github.com/douzebis/base91/blob/v0.3.2/CHANGELOG.md

Upstream replaced its C command-line tool (Joachim Henke's basE91 0.6.0
CLI) with a Rust implementation of the same format.  The same three
commands are installed (base91, and b91enc / b91dec as symlinks), with
the same options and output; the package definition changes
accordingly:

- Switch from stdenv.mkDerivation (make -C src) to
  rustPlatform.buildRustPackage; the Cargo workspace is in rust/
  (cargoRoot), the CLI in rust/base91-cli (buildAndTestSubdir), whose
  tests run in the check phase.
- Install the man page (with b91enc.1 and b91dec.1 links, as before)
  and bash, zsh and fish completions, generated by the built binary
  (base91 --man, --completions); skipped when cross-compiling.
- versionCheckHook, nix-update-script, meta.changelog,
  meta.mainProgram, longDescription; src uses tag instead of rev.

Assisted-by: Claude Code (Claude Opus 5.5)
---
 pkgs/by-name/ba/base91/package.nix | 64 ++++++++++++++++++++++--------
 1 file changed, 47 insertions(+), 17 deletions(-)

diff --git a/pkgs/by-name/ba/base91/package.nix b/pkgs/by-name/ba/base91/package.nix
index 7acf2197edf8..0529cdc840e9 100644
--- a/pkgs/by-name/ba/base91/package.nix
+++ b/pkgs/by-name/ba/base91/package.nix
@@ -1,38 +1,68 @@
 {
   lib,
   stdenv,
+  rustPlatform,
   fetchFromGitHub,
+  installShellFiles,
+  versionCheckHook,
+  nix-update-script,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "base91";
-  version = "0.1.0";
+  version = "0.3.2";
+
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "douzebis";
     repo = "base91";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-Lx569OtNU0z884763FSByH0yXIq6GzeXyp5NVvMejco="; # update as needed
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-1v/kvv+IUoYmrs6MrBmnA4UYIRjN4KICW/Q0zaiiGq0=";
   };
 
-  makeFlags = [
-    "CC=cc"
-    "-C"
-    "src"
-    "all"
-  ];
-  installFlags = [
-    "-C"
-    "src"
-    "install"
-    "prefix=$(out)"
-  ];
+  cargoRoot = "rust";
+  buildAndTestSubdir = "rust/base91-cli";
+
+  cargoHash = "sha256-5ubqTQQz0OBZoe3Ql/e1H5S1cL1EhYVabcZ9FkfQzao=";
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    ln -s base91 $out/bin/b91enc
+    ln -s base91 $out/bin/b91dec
+  ''
+  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    $out/bin/base91 --man > base91.1
+    installManPage base91.1
+    ln -s base91.1 $out/share/man/man1/b91enc.1
+    ln -s base91.1 $out/share/man/man1/b91dec.1
+    installShellCompletion --cmd base91 \
+      --bash <($out/bin/base91 --completions bash) \
+      --zsh <($out/bin/base91 --completions zsh) \
+      --fish <($out/bin/base91 --completions fish)
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
 
   meta = {
-    description = "CLI tool for encoding binary data as ASCII characters";
+    description = "Binary-to-text encoder and decoder for the basE91 format";
+    longDescription = ''
+      base91 encodes binary data as printable ASCII with about 23% overhead
+      (base64: 33%). It reads and writes Joachim Henke's basE91 format, as
+      the original C tool does. It also offers a fixed-width variant of the
+      format (--simd), designed for SIMD instructions: with SSE4.1, AVX2 or
+      NEON, it encodes and decodes at several GiB/s. b91enc and b91dec are
+      the encoder and decoder under their traditional names.
+    '';
     homepage = "https://github.com/douzebis/base91";
+    changelog = "https://github.com/douzebis/base91/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ douzebis ];
+    mainProgram = "base91";
     platforms = lib.platforms.unix;
   };
 })

From ec81376b20c2a896250b87f093172522042d348b Mon Sep 17 00:00:00 2001
From: Leonard Sheng Sheng Lee <leonard.sheng.sheng.lee@gmail.com>
Date: Wed, 7 Oct 2026 15:15:27 +0200
Subject: [PATCH 520/525] ci/github-script/reminders: improve style guide
 reminder

---
 ci/github-script/reminders/docs-styleguide.md | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/ci/github-script/reminders/docs-styleguide.md b/ci/github-script/reminders/docs-styleguide.md
index 7947d5fac888..db30873ca5bf 100644
--- a/ci/github-script/reminders/docs-styleguide.md
+++ b/ci/github-script/reminders/docs-styleguide.md
@@ -1,12 +1,12 @@
-Thanks for contributing to the documentation
+Thanks for contributing to the documentation.
 
-Make sure you follow the [documentation style guide](https://github.com/NixOS/nixpkgs/blob/master/doc/styleguide.md), most notably:
+Follow the [documentation style guide](https://github.com/NixOS/nixpkgs/blob/master/doc/styleguide.md), especially:
 
-- Show, don't tell: lead with a minimal working example; explanation follows the code.
-- No meta-commentary: don't write "This section explains how to…", just do it.
-- Imperative mood and active voice: "Run the command", not "The user should run the following command".
-- Present tense: "This creates a folder", not "This will create a folder".
-- Be confident: no hedging with "should", "might", "typically", "usually".
-- Cut filler words: "simply", "just", "easily", "basically"; "to", not "in order to".
+- Show, don’t tell. Start with a minimal working example. Explain after the code.
+- Avoid meta-commentary. Don’t write "This section explains how to…".
+- Use present tense, imperative mood, and active voice. For example: "Run the command," not "The user should run the following command."
+- Avoid vague references like "this" when the referent is unclear. Write "This command creates a folder," not "This will create a folder."
+- Be direct. Avoid "should", "might", "typically", and "usually".
+- Cut filler words like "simply", "just", "easily", and "basically". Use "to" instead of "in order to".
 
-For larger changes, like adding or removing whole sections, ask the NixOS documentation team for a review.
+For larger changes, such as adding or removing whole sections, ask the NixOS documentation team for review.

From ac7b1aaed03db4b794502641cdeed685ed777889 Mon Sep 17 00:00:00 2001
From: Marcel <me@m4rc3l.de>
Date: Sun, 11 Oct 2026 22:28:32 +0200
Subject: [PATCH 521/525] typescript-language-server: fix pnpm hash

---
 pkgs/by-name/ty/typescript-language-server/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ty/typescript-language-server/package.nix b/pkgs/by-name/ty/typescript-language-server/package.nix
index b5572ad7980c..2df906a9e92b 100644
--- a/pkgs/by-name/ty/typescript-language-server/package.nix
+++ b/pkgs/by-name/ty/typescript-language-server/package.nix
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_12;
     fetcherVersion = 4;
-    hash = "sha256-MUSxDMlbG21KSesGdEvqa2kEpuVfLlXRUX1qV/FGsSo=";
+    hash = "sha256-xR/EF60lVBsITKgH7wCM2wHM46PFQevD51KfCENSUH4=";
   };
 
   nativeBuildInputs = [

From bf540df4f83b35b34c208b28052471ceb621d716 Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Sun, 11 Oct 2026 17:02:50 -0400
Subject: [PATCH 522/525] omp: 18.8.9 -> 18.9.2

Changelog: https://github.com/can1357/oh-my-pi/releases/tag/v18.9.2

Assisted-By: OpenAI Codex GPT-6 Luna in omp
---
 pkgs/by-name/om/omp/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/om/omp/package.nix b/pkgs/by-name/om/omp/package.nix
index 3e72f9333443..b41c684e369e 100644
--- a/pkgs/by-name/om/omp/package.nix
+++ b/pkgs/by-name/om/omp/package.nix
@@ -32,7 +32,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "omp";
-  version = "18.8.9";
+  version = "18.9.2";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -41,12 +41,12 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "can1357";
     repo = "oh-my-pi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-t3OZP4E0mWFJU0RW3OMcGU2G52p5uasQdVPhITHnZec=";
+    hash = "sha256-thp9cUYJJqbwLlYBBuGkbmQLG0nKlOxCKoZBQHIDJ+w=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) src;
-    hash = "sha256-fiKnCLgcEPZ+WtMD6oBNJfzXHW28y/NN7KOo9oIKMWE=";
+    hash = "sha256-WF7MYb81AqteoeMuuw8movvQHMFWJL7DkdplddFF8dE=";
   };
 
   postPatch = ''

From b94bed07e6200020a7c555c03fb5d7441078c0f4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 21:20:46 +0000
Subject: [PATCH 523/525] resterm: 1.10.2 -> 1.14.0

---
 pkgs/by-name/re/resterm/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/re/resterm/package.nix b/pkgs/by-name/re/resterm/package.nix
index 0b84e59ecda8..328488eaecbc 100644
--- a/pkgs/by-name/re/resterm/package.nix
+++ b/pkgs/by-name/re/resterm/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "resterm";
-  version = "1.10.2";
+  version = "1.14.0";
 
   src = fetchFromGitHub {
     owner = "unkn0wn-root";
     repo = "resterm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wzH/5TN2cIcGqUk+n56qFlKS6XPOpqc2UkXudekeuOI=";
+    hash = "sha256-YOpKdFTnIN5KwmOeLmP/yLCTt5akG9na0o9AYb6nbaw=";
   };
 
-  vendorHash = "sha256-8nu7E7jwj2EodR2yICPQpbpLUJlXY32SzEEGm783s0A=";
+  vendorHash = "sha256-sAcV1O5ns7gAVomai68rkcrMYPHNoQZp7BKv3bEvD40=";
 
   # modernc.org/libc (via modernc.org/sqlite) tries to read /etc/protocols
   modPostBuild = ''

From 554995732f7d20b7a00012a137d56f3c7ef6c74a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 22:00:27 +0000
Subject: [PATCH 524/525] python3Packages.snakemake-logger-plugin-rich: 0.4.2
 -> 0.5.0

---
 .../python-modules/snakemake-logger-plugin-rich/default.nix   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/snakemake-logger-plugin-rich/default.nix b/pkgs/development/python-modules/snakemake-logger-plugin-rich/default.nix
index a5e094a715af..309cd192666a 100644
--- a/pkgs/development/python-modules/snakemake-logger-plugin-rich/default.nix
+++ b/pkgs/development/python-modules/snakemake-logger-plugin-rich/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "snakemake-logger-plugin-rich";
-  version = "0.4.2";
+  version = "0.5.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -28,7 +28,7 @@ buildPythonPackage (finalAttrs: {
     owner = "cademirch";
     repo = "snakemake-logger-plugin-rich";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vdPM1nRovZ5QhKudzCebMNMndzOWPvTmI5I1oTbzg9o=";
+    hash = "sha256-SoxmCp12S8PE3/qbEpa1VGccPS/VRmaqfSEOB1D+nyk=";
   };
 
   build-system = [

From 3d931d5e554fb4f3dd0db05b2d85b231b36a499f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 11 Oct 2026 22:36:09 +0000
Subject: [PATCH 525/525] python3Packages.esp-pylib: 1.1.5 -> 1.2.0

---
 pkgs/development/python-modules/esp-pylib/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/esp-pylib/default.nix b/pkgs/development/python-modules/esp-pylib/default.nix
index 0db9a8f014a6..f15d9bb786aa 100644
--- a/pkgs/development/python-modules/esp-pylib/default.nix
+++ b/pkgs/development/python-modules/esp-pylib/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "esp-pylib";
-  version = "1.1.5";
+  version = "1.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "espressif";
     repo = "esp-pylib";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-omkTO5a8aqAoYqp0W3KaW2P/O8KJYeYZ51uGcOIPQew=";
+    hash = "sha256-wj9Enkaxj6LlNfJlmditKFZ8lKfVq9SbQg8f5xIyXP8=";
   };
 
   build-system = [ setuptools ];