Merge master into staging-next

2026-09-29 03:10:19 +00:00 · 2026-09-27 17:27:07 +02:00
parent 0b867cf7b6 34b9e21553
commit 46b72ad79c
99 changed files with 999 additions and 316 deletions
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -38,6 +38,10 @@
 - `zabbix.<package>` now defaults to version 7.4. If you want to keep using Zabbix 6.0, use `pkgs.zabbix60.<package>`.
  Note that Zabbix 6.0 is in limited support, and will be deprecated on February 28, 2027. Consider upgrading.

+- `zabbix-agent2-plugin-postgresql` is now moved to `zabbix{60,70,74}.plugins.postgresql`.
+
+- Official Zabbix plugins (ember-plus, mongodb, and mssql) have been added under `zabbix{60,70,74}.plugins.<plugin>`.
+
 - `perlPackages.NetOAuth` has been updated from 0.28 to 0.33.
  Callers that verify messages must now set `allowed_signature_methods` per message or configure `@Net::OAuth::ALLOWED_SIGNATURE_METHODS`; `verify` otherwise throws an exception.
  See the [upstream changelog](https://metacpan.org/dist/Net-OAuth/changes) for details.
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -28992,6 +28992,13 @@
    github = "thelissimus";
    githubId = 70096720;
  };
+  thelolcoder2007 = {
+    name = "thelolcoder2007";
+    github = "thelolcoder2007";
+    githubId = 52106896;
+    matrix = "@erents:dapperepoging.nl";
+    keys = [ { fingerprint = "E374 815F C754 462B 1C34  3562 FDC3 99DE 8F7E 200B"; } ];
+  };
  themadbit = {
    name = "Mark Tanui";
    email = "marktanui75@gmail.com";
--- a/nixos/modules/config/nix-channel.nix
+++ b/nixos/modules/config/nix-channel.nix
@@ -42,7 +42,7 @@ in
        };
      };

-      nixPath = mkOption {
+      settings.nix-path = mkOption {
        type = types.listOf types.str;
        default =
          if cfg.channel.enable then
@@ -80,8 +80,11 @@ in
    };
  };

-  config = mkIf cfg.enable {
+  imports = [
+    (lib.mkRenamedOptionModule [ "nix" "nixPath" ] [ "nix" "settings" "nix-path" ])
+  ];

+  config = mkIf cfg.enable {
    environment.extraInit = mkIf cfg.channel.enable ''
      if [ -e "$HOME/.nix-defexpr/channels" ]; then
        export NIX_PATH="$HOME/.nix-defexpr/channels''${NIX_PATH:+:$NIX_PATH}"
@@ -95,7 +98,7 @@ in
    # NIX_PATH has a non-empty default according to Nix docs, so we don't unset
    # it when empty.
    environment.sessionVariables = {
-      NIX_PATH = cfg.nixPath;
+      NIX_PATH = cfg.settings.nix-path;
    };

    systemd.tmpfiles.rules = lib.mkIf cfg.channel.enable [
--- a/nixos/modules/misc/nixpkgs-flake.nix
+++ b/nixos/modules/misc/nixpkgs-flake.nix
@@ -102,7 +102,7 @@ in
        # because we would need some kind of evil shim taking the *calling* flake's self path,
        # perhaps, to ever make that work (in order to know where the Nix expr for the system came
        # from and how to call it).
-        nix.nixPath = lib.mkDefault (
+        nix.settings.nix-path = lib.mkDefault (
          [ "nixpkgs=flake:nixpkgs" ]
          ++ lib.optional config.nix.channel.enable "/nix/var/nix/profiles/per-user/root/channels"
        );
--- a/nixos/modules/services/monitoring/beszel-agent.nix
+++ b/nixos/modules/services/monitoring/beszel-agent.nix
@@ -136,6 +136,7 @@ in
      path =
        cfg.extraPath
        ++ lib.optionals cfg.smartmon.enable [ cfg.smartmon.package ]
+        ++ lib.optionals config.boot.zfs.enabled [ config.boot.zfs.package ]
        ++ lib.optionals (builtins.elem "nvidia" config.services.xserver.videoDrivers) [
          (lib.getBin config.hardware.nvidia.package)
        ]
@@ -182,9 +183,9 @@ in

        LockPersonality = true;
        NoNewPrivileges = !cfg.smartmon.enable;
-        PrivateDevices = !cfg.smartmon.enable;
+        PrivateDevices = !cfg.smartmon.enable && !config.boot.zfs.enabled;
        PrivateTmp = true;
-        PrivateUsers = !cfg.smartmon.enable && !cfg.environment.SKIP_SYSTEMD;
+        PrivateUsers = !cfg.smartmon.enable && !config.boot.zfs.enabled && !cfg.environment.SKIP_SYSTEMD;
        ProtectClock = true;
        ProtectControlGroups = "strict";
        ProtectHome = "read-only";
--- a/nixos/modules/services/web-apps/homebox.nix
+++ b/nixos/modules/services/web-apps/homebox.nix
@@ -43,7 +43,7 @@ in
      type = types.submodule { freeformType = types.attrsOf (types.nullOr types.str); };
      defaultText = lib.literalExpression ''
        {
-          HBOX_STORAGE_CONN_STRING = "file:///var/lib/homebox";
+          HBOX_STORAGE_CONN_STRING = "file:///var/lib/homebox?no_tmp_dir=1";
          HBOX_STORAGE_PREFIX_PATH = "data";
          HBOX_DATABASE_DRIVER = "sqlite3";
          HBOX_DATABASE_SQLITE_PATH = "/var/lib/homebox/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1";
@@ -51,7 +51,6 @@ in
          HBOX_OPTIONS_GITHUB_RELEASE_CHECK = "false";
          HBOX_MODE = "production";
          HOME = "/var/lib/homebox";
-          TMPDIR = "/var/lib/homebox/tmp";
        }
      '';
      description = ''
@@ -125,7 +124,9 @@ in

    services.homebox.settings = lib.mkMerge [
      (lib.mapAttrs (_: mkDefault) {
-        HBOX_STORAGE_CONN_STRING = "file:///var/lib/homebox";
+        # We cannot use a tempdir as homebox wants to rename the file, which does not work across filesystem boundaries
+        # also see: https://github.com/google/go-cloud/issues/3294 and https://pkg.go.dev/gocloud.dev/blob/fileblob#URLOpener
+        HBOX_STORAGE_CONN_STRING = "file:///var/lib/homebox?no_tmp_dir=1";
        HBOX_STORAGE_PREFIX_PATH = "data";
        HBOX_DATABASE_DRIVER = "sqlite3";
        HBOX_DATABASE_SQLITE_PATH = "/var/lib/homebox/data/homebox.db?_pragma=busy_timeout=999&_pragma=journal_mode=WAL&_fk=1";
@@ -134,10 +135,8 @@ in
        HBOX_MODE = "production";
        # Fix this startup issue:
        #   failed to create modcache index dir: mkdir /var/empty/.cache: read-only file system
+        # TODO: remove once https://github.com/golang/tools/commit/03cb4551c662c0e078502fe5f317ca4114b89cd8 is available
        HOME = "/var/lib/homebox";
-        # Fix uploading/saving attachments/images:
-        # [...] rename /tmp/ced4804c80b1ed1f6e88060f6d829db421e6dbf3a189715265900b5d6b0243ed.1889b3d16ab36e22.tmp /var/lib/homebox/data/5f42f81b-e9ad-4495-b6a6-9e9f704db30e/documents/ced4804c80b1ed1f6e88060f6d829db421e6dbf3a189715265900b5d6b0243ed: invalid cross-device link" [...]
-        TMPDIR = "/var/lib/homebox/tmp";
      })

      (mkIf cfg.database.createLocally {
--- a/nixos/tests/homebox.nix
+++ b/nixos/tests/homebox.nix
@@ -14,6 +14,8 @@ in
          services.homebox = {
            enable = true;
            settings.HBOX_WEB_PORT = port;
+            settings.HBOX_OPTIONS_ALLOW_REGISTRATION = "true";
+            settings.HBOX_LOG_LEVEL = "trace";
          };
        };

@@ -50,6 +52,7 @@ in
    in
    self;
  testScript = ''
+    import json
    def test_homebox(node):
      node.wait_for_unit("homebox.service")
      node.wait_for_open_port(${port})
@@ -57,6 +60,29 @@ in
      node.succeed("curl --fail -X GET 'http://localhost:${port}/'")
      out = node.succeed("curl --fail 'http://localhost:${port}/api/v1/status'")
      assert '"health":true' in out
+      node.succeed("curl --request POST --fail 'http://localhost:${port}/api/v1/users/register' \
+        --data '{\"email\":\"a@b.c\",\"name\":\"test\",\"password\":\"password\"}' \
+      ")
+      login = node.succeed("curl --request POST --fail 'http://localhost:${port}/api/v1/users/login' \
+        --data-urlencode 'password=password' \
+        --data-urlencode 'username=a@b.c' \
+      ")
+      login_data = json.loads(login)
+      token = login_data["token"]
+      locations = node.succeed(f"curl --request GET --fail 'http://localhost:${port}/api/v1/entities?isLocation=true' \
+        --header 'Authorization: {token}' \
+      ")
+      location_id = json.loads(locations)["items"][0]["id"]
+      item = node.succeed(f"curl --request POST --fail 'http://localhost:${port}/api/v1/entities' \
+        --header 'Authorization: {token}' \
+        --data '{{\"name\":\"testitem\",\"parentId\":\"{location_id}\"}}' \
+      ")
+      item_id = json.loads(item)["id"]
+      node.succeed(f"curl --request POST --fail 'http://localhost:${port}/api/v1/entities/{item_id}/attachments' \
+        --header 'Authorization: {token}' \
+        --form 'file=test;type=text/plain;filename=test.txt' \
+        --form name=test.txt \
+      ")

    test_homebox(simple)
    simple.send_monitor_command("quit")
--- a/nixos/tests/nix-required-mounts/default.nix
+++ b/nixos/tests/nix-required-mounts/default.nix
@@ -12,10 +12,12 @@ in
    {
      virtualisation.writableStore = true;
      system.extraDependencies = [ (pkgs.runCommand "deps" { } "mkdir $out").inputDerivation ];
-      nix.nixPath = [ "nixpkgs=${../../..}" ];
-      nix.settings.substituters = lib.mkForce [ ];
-      nix.settings.system-features = [ "supported-feature" ];
-      nix.settings.experimental-features = [ "nix-command" ];
+      nix.settings = {
+        experimental-features = [ "nix-command" ];
+        nix-path = [ "nixpkgs=${../../..}" ];
+        substituters = lib.mkForce [ ];
+        system-features = [ "supported-feature" ];
+      };
      nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
      programs.nix-required-mounts.enable = true;
      programs.nix-required-mounts.allowedPatterns.supported-feature = {
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -27,13 +27,13 @@
    "vendorHash": null
  },
  "aiven_aiven": {
-    "hash": "sha256-OOEtFEs8EBOlvAoAOVKS1yFCYBzJ/75G7arDkkjS5LA=",
+    "hash": "sha256-By/CEi2DEZSvrfyV9KTBp6VlaIK1m4xF71KEpJbtrG8=",
    "homepage": "https://registry.terraform.io/providers/aiven/aiven",
    "owner": "aiven",
    "repo": "terraform-provider-aiven",
-    "rev": "v4.62.0",
+    "rev": "v4.63.0",
    "spdx": "MIT",
-    "vendorHash": "sha256-TXeJPVyb3+t1wJyHXNbmy6iPrPTG47bedHB0UyEUv98="
+    "vendorHash": "sha256-jrr657aGldXtq4XHfYYpgr1HQpe+cg1mWa7gwRj30io="
  },
  "akamai_akamai": {
    "hash": "sha256-ui8w8z9kROptw0tCvtT645bbNJV/BRd10aVomwhl+hI=",
@@ -598,13 +598,13 @@
    "vendorHash": "sha256-9DiGgBQyN2lv7w4IkjMuWGNo9oTIvdK1qcdEpKpy5NE="
  },
  "hashicorp_google-beta": {
-    "hash": "sha256-EvcjgQupjAPKkbPObTTXNUsyyo7Udwc6rriD4/K7UhE=",
+    "hash": "sha256-JNPZ9nL5mkoqH0HNQr6mNWNadtnK1iZlMhy1UDds/v8=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/google-beta",
    "owner": "hashicorp",
    "repo": "terraform-provider-google-beta",
-    "rev": "v8.3.0",
+    "rev": "v8.4.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-t3lzDRh0v6vMbw8qLXTOjKNUtaBlXOZkqNO+mJyP9NQ="
+    "vendorHash": "sha256-KI1hUXlJVoKGRyDODIfHJCBmN08Hml5JK+BSYiWGeXQ="
  },
  "hashicorp_helm": {
    "hash": "sha256-O3QcQf+TBmSB/mY5wybk/8BUG5RTjLhJYU+9jOOUqBI=",
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -86,8 +86,8 @@ rec {
  thunderbird = thunderbird-latest;

  thunderbird-latest = common {
-    version = "156.0";
-    sha512 = "8fd524f9d622f007e9bd5e8bcc440f185427a928a04d3aae14fc476e011ff1c15b68607292624ea4c4e4d596722193dda88e233cdfb6bbf5d05bd180870532ba";
+    version = "156.0.1";
+    sha512 = "e9262a4666e0107c7bc45fc2ad4bac4d6e5db4bfd3325d1d1c418f00adee777db969f8c12d8f310f45fdfda61b26e31bd0eea8b7d64ed1ee0050b5ee9235cfb0";

    updateScript = callPackage ./update.nix {
      attrPath = "thunderbirdPackages.thunderbird-latest";
--- a/pkgs/by-name/ad/adminerevo/package.nix
+++ b/pkgs/by-name/ad/adminerevo/package.nix
@@ -64,7 +64,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {

  meta = {
    description = "Database management in a single PHP file";
-    homepage = "https://docs.adminerevo.org";
+    homepage = "https://github.com/adminerevo/adminerevo";
    license = with lib.licenses; [
      asl20
      gpl2Only
--- a/pkgs/by-name/an/analog/package.nix
+++ b/pkgs/by-name/an/analog/package.nix
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  meta = {
-    homepage = "https://www.c-amie.co.uk/software/analog/";
+    homepage = "https://github.com/c-amie/analog-ce";
    license = lib.licenses.gpl2Only;
    description = "Powerful tool to generate web server statistics";
    platforms = lib.platforms.all;
--- a/pkgs/by-name/ar/argus-clients/package.nix
+++ b/pkgs/by-name/ar/argus-clients/package.nix
@@ -57,7 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
      know what is going on in your network, right now or historically,
      you will find Argus a useful tool.
    '';
-    homepage = "http://qosient.com/argus";
+    homepage = "https://openargus.org";
    license = lib.licenses.gpl2Plus;
    platforms = lib.platforms.linux;
  };
--- a/pkgs/by-name/ar/argus/package.nix
+++ b/pkgs/by-name/ar/argus/package.nix
@@ -69,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
      know what is going on in your network, right now or historically,
      you will find Argus a useful tool.
    '';
-    homepage = "http://qosient.com/argus";
+    homepage = "https://openargus.org";
    license = lib.licenses.gpl2Plus;
    platforms = lib.platforms.linux;
  };
--- a/pkgs/by-name/au/audiality2/package.nix
+++ b/pkgs/by-name/au/audiality2/package.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    description = "Realtime scripted modular audio engine for video games and musical applications";
    mainProgram = "a2play";
-    homepage = "http://audiality.org";
+    homepage = "https://olofson.github.io/audiality2/";
    license = lib.licenses.zlib;
    platforms = lib.platforms.all;
    maintainers = with lib.maintainers; [ fgaz ];
--- a/pkgs/by-name/bo/bossa/package.nix
+++ b/pkgs/by-name/bo/bossa/package.nix
@@ -84,7 +84,7 @@ stdenv.mkDerivation (finalAttrs: {
      Atmel's SAM-BA software. BOSSA is an acronym for Basic Open
      Source SAM-BA Application to reflect that goal.
    '';
-    homepage = "http://www.shumatech.com/web/products/bossa";
+    homepage = "https://github.com/shumatech/BOSSA";
    license = lib.licenses.bsd3;
    platforms = lib.platforms.unix;
  };
--- a/pkgs/by-name/br/brutalmaze/package.nix
+++ b/pkgs/by-name/br/brutalmaze/package.nix
@@ -36,7 +36,7 @@ python312Packages.buildPythonApplication (finalAttrs: {
  meta = {
    description = "Minimalist thrilling shoot 'em up game";
    mainProgram = "brutalmaze";
-    homepage = "https://brutalmaze.rtfd.io";
+    homepage = "https://brutalmaze.readthedocs.io";
    license = lib.licenses.agpl3Plus;
    maintainers = [ lib.maintainers.McSinyx ];
  };
--- a/pkgs/by-name/ca/cabin/package.nix
+++ b/pkgs/by-name/ca/cabin/package.nix
@@ -38,7 +38,7 @@ stdenvNoCC.mkDerivation rec {
      adjusted. The curved stem endings have a 10 degree angle. E and F have
      shorter center arms. M is splashed.
    '';
-    homepage = "http://www.impallari.com/cabin";
+    homepage = "https://github.com/impallari/Cabin";
    license = lib.licenses.ofl;
    maintainers = [ ];
    platforms = lib.platforms.all;
--- a/pkgs/by-name/ca/cargo-tarpaulin/package.nix
+++ b/pkgs/by-name/ca/cargo-tarpaulin/package.nix
@@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-tarpaulin";
-  version = "0.37.2";
+  version = "0.37.5";

  src = fetchFromGitHub {
    owner = "xd009642";
    repo = "tarpaulin";
    tag = finalAttrs.version;
-    hash = "sha256-oD8k/M5PChKzG1ek1uH8UP7PoaL9LYot3HCO4Hmetsw=";
+    hash = "sha256-m3z4hBoktmFZTOhXmsQW9tsmbBGQwL1Pi9163tabjcY=";
  };

-  cargoHash = "sha256-lZ4wRI1PEcHDxGe8R1mnp/Gk0IDzqXLvosfzkZOIhug=";
+  cargoHash = "sha256-3dbDxnPTjSsU242gSiEUhhLCRuqsHLFN0ZVJ7oKROeo=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/ch/chunkfs/fuse3.diff
+++ b/pkgs/by-name/ch/chunkfs/fuse3.diff
@@ -0,0 +1,157 @@
+--- a/Makefile
+++ b/Makefile
+@@ -3,8 +3,11 @@ PREFIX?=/usr/local
+ 
+ VERSION=0.8
+ 
+-CFLAGS=-std=c99 -DVERSION='"$(VERSION)"' -O2 -Wall
+-LDFLAGS=-s -lfuse
+FUSE_CFLAGS:=$(shell pkg-config --cflags fuse3)
+CFLAGS=-std=c99 -DVERSION='"$(VERSION)"' -O2 -Wall $(FUSE_CFLAGS)
+LDFLAGS=-s
+FUSE_LIBS:=$(shell pkg-config --libs fuse3)
+LDLIBS=$(FUSE_LIBS)
+ 
+ all: chunkfs unchunkfs chunkfs.1.gz
+ 
+diff --git a/chunkfs.c b/chunkfs.c
+index 825553d..09b5e19 100644
+--- a/chunkfs.c
+++ b/chunkfs.c
+@@ -19,7 +19,7 @@
+ 
+ #define _FILE_OFFSET_BITS 64
+ #define _XOPEN_SOURCE 500
+-#define FUSE_USE_VERSION 25
+#define FUSE_USE_VERSION 317
+ 
+ #include <sys/types.h>
+ #include <unistd.h>
+@@ -87,7 +87,7 @@ static int resolve_path(const char *path,struct chunk_stat *st){
+ 	return 0;
+ }
+ 
+-static int chunkfs_getattr(const char *path,struct stat *buf){
+static int chunkfs_getattr(const char *path,struct stat *buf, struct fuse_file_info *fileinfo){
+ 	int r;
+ 	struct chunk_stat st;
+ 
+@@ -109,7 +109,7 @@ static int chunkfs_getattr(const char *path,struct stat *buf){
+ 	return 0;
+ }
+ 
+-static int chunkfs_readdir(const char *path,void *buf,fuse_fill_dir_t filler,off_t offset,struct fuse_file_info *fi){
+static int chunkfs_readdir(const char *path,void *buf,fuse_fill_dir_t filler,off_t offset,struct fuse_file_info *fi, enum fuse_readdir_flags flags){
+ 	int r;
+ 	struct chunk_stat st;
+ 	uint64_t chunks_per_entry;
+@@ -117,12 +117,12 @@ static int chunkfs_readdir(const char *path,void *buf,fuse_fill_dir_t filler,off
+ 	if((r=resolve_path(path,&st))<0)return r;
+ 	if(!S_ISDIR(st.mode))return -ENOTDIR;
+ 	chunks_per_entry=1ULL<<((8-1-st.level)*8);
+-	filler(buf,".",NULL,0);
+-	filler(buf,"..",NULL,0);
+	filler(buf,".",NULL,0,FUSE_FILL_DIR_DEFAULTS);
+	filler(buf,"..",NULL,0,FUSE_FILL_DIR_DEFAULTS);
+ 	for(uint64_t x=0;x<256&&(uint64_t)st.chunk+x*chunks_per_entry<(uint64_t)image_chunks;x++){
+ 		char nbuf[3];
+ 		sprintf(nbuf,"%02" PRIx64,x);
+-		filler(buf,nbuf,NULL,0);
+		filler(buf,nbuf,NULL,0,FUSE_FILL_DIR_DEFAULTS);
+ 	}
+ 	return 0;
+ }
+@@ -203,13 +203,13 @@ int main(int argc,char **argv){
+ 			"    -V                     print version\n"
+ 			"\n",
+ 			*argv);
+-		fake_argv[1]="-ho";
+-		fuse_main(2,fake_argv,&chunkfs_ops);
+		fake_argv[1]="--help";
+		fuse_main(2,fake_argv,&chunkfs_ops,NULL);
+ 		ret=validation_error;
+ 	}else if(show_version){
+ 		fprintf(stderr,"ChunkFS v" VERSION "\n");
+ 		fake_argv[1]="-V";
+-		fuse_main(2,fake_argv,&chunkfs_ops);
+		fuse_main(2,fake_argv,&chunkfs_ops,NULL);
+ 	}else{
+ 		errno=0;
+ 		chunk_size=strtoll(argv[optind],&end,10);
+@@ -228,7 +228,7 @@ int main(int argc,char **argv){
+ 		if(image_size%chunk_size)image_chunks++;
+ 		argv[optind]=argv[optind+2];
+ 		argc-=2;
+-		ret=fuse_main(argc,argv,&chunkfs_ops);
+		ret=fuse_main(argc,argv,&chunkfs_ops,NULL);
+ 	}
+ 	return ret;
+ }
+diff --git a/unchunkfs.c b/unchunkfs.c
+index 6302019..b8293e2 100644
+--- a/unchunkfs.c
+++ b/unchunkfs.c
+@@ -19,7 +19,7 @@
+ 
+ #define _FILE_OFFSET_BITS 64
+ #define _XOPEN_SOURCE 500
+-#define FUSE_USE_VERSION 25
+#define FUSE_USE_VERSION 317
+ 
+ #include <sys/types.h>
+ #include <unistd.h>
+@@ -72,7 +72,7 @@ static void gen_chunk_name(char *buf,off_t num){
+ 	}
+ }
+ 
+-static int unchunkfs_getattr(const char *path,struct stat *buf){
+static int unchunkfs_getattr(const char *path,struct stat *buf, struct fuse_file_info *fileinfo){
+ 	int r;
+ 	mode_t mode;
+ 
+@@ -94,15 +94,15 @@ static int unchunkfs_getattr(const char *path,struct stat *buf){
+ 	return 0;
+ }
+ 
+-static int unchunkfs_readdir(const char *path,void *buf,fuse_fill_dir_t filler,off_t offset,struct fuse_file_info *fi){
+static int unchunkfs_readdir(const char *path,void *buf,fuse_fill_dir_t filler,off_t offset,struct fuse_file_info *fi, enum fuse_readdir_flags flags){
+ 	int r;
+ 	mode_t mode;
+ 
+ 	if((r=resolve_path(path,&mode))<0)return r;
+ 	if(!S_ISDIR(mode))return -ENOTDIR;
+-	filler(buf,".",NULL,0);
+-	filler(buf,"..",NULL,0);
+-	filler(buf,"image",NULL,0);
+	filler(buf,".",NULL,0,FUSE_FILL_DIR_DEFAULTS);
+	filler(buf,"..",NULL,0,FUSE_FILL_DIR_DEFAULTS);
+	filler(buf,"image",NULL,0,FUSE_FILL_DIR_DEFAULTS);
+ 	return 0;
+ }
+ 
+@@ -190,13 +190,13 @@ int main(int argc,char **argv){
+ 			"    -V                     print version\n"
+ 			"\n",
+ 			*argv);
+-		fake_argv[1]="-ho";
+-		fuse_main(2,fake_argv,&unchunkfs_ops);
+		fake_argv[1]="--help";
+		fuse_main(2,fake_argv,&unchunkfs_ops,NULL);
+ 		ret=validation_error;
+ 	}else if(show_version){
+ 		fprintf(stderr,"UnChunkFS v" VERSION "\n");
+ 		fake_argv[1]="-V";
+-		fuse_main(2,fake_argv,&unchunkfs_ops);
+		fuse_main(2,fake_argv,&unchunkfs_ops,NULL);
+ 	}else{
+ 		if((cwd_fd=open(".",O_RDONLY))<0)die(true,"open(.)");
+ 		if((chunkdir_fd=open(argv[optind],O_RDONLY))<0)die(true,"open(<chunk dir>)");
+@@ -226,7 +226,7 @@ int main(int argc,char **argv){
+ 		argv[optind]=argv[optind+1];
+ 		argc--;
+ 		if(fchdir(cwd_fd)<0)die(true,"fchdir(<start cwd>)");
+-		ret=fuse_main(argc,argv,&unchunkfs_ops);
+		ret=fuse_main(argc,argv,&unchunkfs_ops,NULL);
+ 	}
+ 	return ret;
+ }
--- a/pkgs/by-name/ch/chunkfs/package.nix
+++ b/pkgs/by-name/ch/chunkfs/package.nix
@@ -3,21 +3,30 @@
  stdenv,
  fetchurl,
  perl,
-  fuse,
+  fuse3,
+  pkg-config,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "chunkfs";
  version = "0.8";

+  patches = [
+    ./fuse3.diff
+  ];
+
  src = fetchurl {
    url = "https://chunkfs.florz.de/chunkfs_${finalAttrs.version}.tar.xz";
    hash = "sha256-HFv51ta2eNW9Qt9CUp2oTTlC8Lpwc1XKR/uYzMDfd88=";
  };

+  nativeBuildInputs = [
+    pkg-config
+  ];
+
  buildInputs = [
    perl
-    fuse
+    fuse3
  ];

  makeFlags = [
@@ -25,6 +34,8 @@ stdenv.mkDerivation (finalAttrs: {
    "PREFIX="
  ];

+  enableParallelBuilding = true;
+
  preInstall = ''
    mkdir -p $out/bin
    mkdir -p $out/share/man/man1
--- a/pkgs/by-name/un/unifiedpush-common-proxies/package.nix
+++ b/pkgs/by-name/un/unifiedpush-common-proxies/package.nix
@@ -5,21 +5,24 @@
 }:

 buildGoModule (finalAttrs: {
-  pname = "unifiedpush-common-proxies";
+  pname = "common-proxies";
  version = "3.1.0";

  src = fetchFromCodeberg {
    owner = "UnifiedPush";
    repo = "common-proxies";
    rev = finalAttrs.version;
-    sha256 = "sha256-VRxwEsQt1LlcMIMEkGqkVtMrqJ7f4tYh3OExE9VITh4=";
+    hash = "sha256-VRxwEsQt1LlcMIMEkGqkVtMrqJ7f4tYh3OExE9VITh4=";
  };

  vendorHash = "sha256-rGsSuO7cnb9e4A1SnIwfgfz4vu18JzxKtLnDfCSQqck=";

+  __structuredAttrs = true;
+  strictDeps = true;
+
  meta = {
    description = "Set of rewrite proxies and gateways for UnifiedPush";
-    homepage = "https://github.com/UnifiedPush/common-proxies";
+    homepage = "https://codeberg.org/UnifiedPush/common-proxies";
    license = lib.licenses.mit;
    maintainers = [ lib.maintainers.zimward ];
    mainProgram = "common-proxies";
--- a/pkgs/by-name/cu/cubicsdr/package.nix
+++ b/pkgs/by-name/cu/cubicsdr/package.nix
@@ -65,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  meta = {
-    homepage = "https://cubicsdr.com";
+    homepage = "https://github.com/cjcliffe/CubicSDR";
    description = "Software Defined Radio application";
    license = lib.licenses.gpl2Plus;
    maintainers = with lib.maintainers; [ lasandell ];
--- a/pkgs/by-name/de/defuddle/package.nix
+++ b/pkgs/by-name/de/defuddle/package.nix
@@ -7,16 +7,16 @@

 buildNpmPackage rec {
  pname = "defuddle";
-  version = "0.19.3";
+  version = "0.19.4";

  src = fetchFromGitHub {
    owner = "kepano";
    repo = "defuddle";
    tag = version;
-    hash = "sha256-fSJsNWShWjv1Riiq0DxkUnmUDlM2rQoqgdM9eD9aMts=";
+    hash = "sha256-H6/hZVe5nj6GNv00RMu1tKDRhCTvB7PX5gc70JWh9ik=";
  };

-  npmDepsHash = "sha256-BxGIVt2gkNQkWXQyLnPQQAtCNFJKlXmTctKVAxFzjfM=";
+  npmDepsHash = "sha256-B5uX7lIfII9nlCHn6d3zchsokpZFOuP1fuRRLJb7g1M=";

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/do/dosis/package.nix
+++ b/pkgs/by-name/do/dosis/package.nix
@@ -37,7 +37,7 @@ stdenvNoCC.mkDerivation rec {
      It comes in 7 incremental weights: ExtraLight, Light, Book, Medium,
      Semibold, Bold & ExtraBold
    '';
-    homepage = "http://www.impallari.com/dosis";
+    homepage = "https://github.com/impallari/Dosis";
    license = lib.licenses.ofl;
    maintainers = [ ];
    platforms = lib.platforms.all;
--- a/pkgs/by-name/do/doublecmd/package.nix
+++ b/pkgs/by-name/do/doublecmd/package.nix
@@ -9,6 +9,7 @@
  lazarus,
  libx11,
  libsForQt5,
+  lua,
  writableTmpDirAsHomeHook,
 }:

@@ -61,6 +62,13 @@ stdenv.mkDerivation (finalAttrs: {

    install/linux/install.sh -I $out

+    cd $out/lib64/doublecmd
+
+    ln -vs ${lib.getLib lua}/lib/liblua.so.${lua.version}
+
+    ln -vs ./liblua.so.${lua.version} ./liblua.so
+    ln -vs ./liblua.so.${lua.version} ./liblua.so.${lib.versions.majorMinor lua.version}
+
    runHook postInstall
  '';

--- a/pkgs/by-name/ep/epson-escpr2/package.nix
+++ b/pkgs/by-name/ep/epson-escpr2/package.nix
@@ -8,15 +8,16 @@

 stdenv.mkDerivation {
  pname = "epson-inkjet-printer-escpr2";
-  version = "1.2.37";
+  version = "1.2.42";

  src = fetchurl {
    # To find the most recent version go to
    # https://support.epson.net/linux/Printer/LSB_distribution_pages/en/escpr2.php
    # and retrieve the download link for source package for arm CPU for the tar.gz (the x86 link targets to rpm source files)
-
-    url = "https://download-center.epson.com/f/module/1316b6b0-77cd-438c-95e1-c71e760a7579/epson-inkjet-printer-escpr2-1.2.37-1.tar.gz";
-    hash = "sha256-jSh2HVb490CYJ/C+Eh1T5TmnBF7hmBmsGHuVbiWTHQ0=";
+    # or check https://download-center.epson.com/api/v1/modules/?device_id=XP-970%20Series&os=DEBARM32&region=US&language=en
+    curlOpts = "--user-agent ''";
+    url = "https://download-center.epson.com/f/module/4d70b84a-1686-4134-8ce0-4ac8a838f31c/epson-inkjet-printer-escpr2-1.2.42-1.tar.gz";
+    hash = "sha256-/gj4K6VPouXwS6p0Bc7dgF/j9Vl6YRVqH8pym1E/Tf4=";
  };

  buildInputs = [ cups ];
@@ -38,8 +39,6 @@ stdenv.mkDerivation {
    "--with-cupsppddir=${placeholder "out"}/share/cups/model"
  ];

-  passthru.updateScript = ./update.sh;
-
  meta = {
    homepage = "http://download.ebz.epson.net/dsc/search/01/search/";
    description = "ESC/P-R 2 Driver (generic driver)";
--- a/pkgs/by-name/ep/epson-escpr2/update.sh
+++ b/pkgs/by-name/ep/epson-escpr2/update.sh
@@ -1,21 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p bash curl jq common-updater-scripts
-set -eou pipefail
-
-result=$(curl -sSL 'https://download-center.epson.com/api/v1/modules/?device_id=XP-970%20Series&os=DEBARM32&region=US&language=en' | jq -r '.items[] | select(.module_name == "Epson Inkjet Printer Driver 2 (ESC/P-R) for Linux" and .cti_category == "Sources")')
-
-latestVersion=$(jq '.version' <<< "$result" | tr -d '"')
-currentVersion=$(nix-instantiate --eval -E "with import ./. {}; (lib.getVersion epson-escpr2)" | tr -d '"')
-
-echo "latest  version: $latestVersion"
-echo "current version: $currentVersion"
-
-if [[ "$latestVersion" == "$currentVersion" ]]; then
-    echo "package is up-to-date"
-    exit 0
-fi
-
-url=$(jq '.url' <<< "$result" | tr -d '"')
-
-hash=$(nix --extra-experimental-features nix-command hash convert --hash-algo sha256 --to sri $(nix-prefetch-url $url))
-update-source-version epson-escpr2 $latestVersion $hash $url --ignore-same-version
--- a/pkgs/by-name/eu/euro-office-desktopeditors/package.nix
+++ b/pkgs/by-name/eu/euro-office-desktopeditors/package.nix
@@ -0,0 +1,234 @@
+{
+  stdenv,
+  lib,
+  fetchurl,
+  buildFHSEnv,
+  unzip,
+  patchelfUnstable,
+  # Alphabetic ordering below
+  alsa-lib,
+  at-spi2-atk,
+  atk,
+  autoPatchelfHook,
+  cairo,
+  curl,
+  dbus,
+  dconf,
+  dpkg,
+  firebird,
+  fontconfig,
+  gcc-unwrapped,
+  gdk-pixbuf,
+  glib,
+  glibc,
+  gsettings-desktop-schemas,
+  gst_all_1,
+  gtk2,
+  gtk3,
+  libGL,
+  libdrm,
+  libgbm,
+  libmysqlclient,
+  libnotify,
+  libpulseaudio,
+  libudev0-shim,
+  libx11,
+  libxcb,
+  libxcb-cursor,
+  libxcomposite,
+  libxcursor,
+  libxdamage,
+  libxext,
+  libxfixes,
+  libxi,
+  libxrandr,
+  libxrender,
+  libxscrnsaver,
+  libxtst,
+  makeWrapper,
+  noto-fonts-cjk-sans,
+  nspr,
+  nss,
+  pulseaudio,
+  qt6,
+  wrapGAppsHook3,
+  xkeyboard_config,
+}:
+let
+
+  # Note on fonts:
+  #
+  # EuroOffice does not distribute unfree fonts, but makes it easy to pick up
+  # any fonts you install. See:
+  #
+  # * https://helpcenter.onlyoffice.com/en/installation/docs-community-install-fonts-linux.aspx
+  # * https://www.onlyoffice.com/blog/2020/04/how-to-add-new-fonts-to-onlyoffice-desktop-editors/
+  #
+  # As recommended there, you should download
+  #
+  #     arial.ttf, calibri.ttf, cour.ttf, symbol.ttf, times.ttf, wingding.ttf
+  #
+  # into `~/.local/share/fonts/`, otherwise the default template fonts, and
+  # things like bullet points, will not look as expected.
+
+  # TODO: Find out which of these fonts we'd be allowed to distribute along
+  #       with this package, or how to make this easier for users otherwise.
+
+  runtimeLibs = lib.makeLibraryPath [
+    curl
+    glibc
+    gcc-unwrapped.lib
+    libudev0-shim
+    pulseaudio
+  ];
+
+  derivation = stdenv.mkDerivation (finalAttrs: {
+    pname = "euro-office-desktopeditors";
+    # No release yet, pinning to latest version where Linux artifacts
+    # where provided.
+    version = "9.3.1-dev.1";
+    # Manual uploaded Github CI artifact (actions run 28295624289,
+    # artifact 7926798036) of linux-packages-amd64 tarball.
+    src = fetchurl {
+      url = "https://archive.org/download/euro-office-desktopeditors-9.3.1-dev.1-linux-amd64/linux-packages-amd64.zip";
+      hash = "sha256-OV3abn9nYq/FeBkpft+27iGt34Rqi2VkJkAZwBHu1lM=";
+    };
+
+    unpackPhase = ''
+      mkdir -p source
+      cd source
+      unzip $src
+      dpkg-deb -x euro-office-desktopeditors_*.deb .
+    '';
+
+    nativeBuildInputs = [
+      autoPatchelfHook
+      dpkg
+      makeWrapper
+      patchelfUnstable
+      unzip
+      wrapGAppsHook3
+    ];
+
+    buildInputs = [
+      alsa-lib
+      at-spi2-atk
+      atk
+      cairo
+      dbus
+      dconf
+      firebird
+      fontconfig
+      gdk-pixbuf
+      glib
+      gsettings-desktop-schemas
+      gst_all_1.gst-plugins-base
+      gst_all_1.gstreamer
+      gtk2
+      gtk3
+      libdrm
+      libgbm
+      libmysqlclient
+      libnotify
+      libpulseaudio
+      libx11
+      libxcb
+      libxcb-cursor
+      libxcomposite
+      libxcursor
+      libxdamage
+      libxext
+      libxfixes
+      libxi
+      libxrandr
+      libxrender
+      libxscrnsaver
+      libxtst
+      nspr
+      nss
+      qt6.qtbase
+      qt6.qtdeclarative
+      qt6.qtquick3d
+      qt6.qtsvg
+      qt6.qtwayland
+    ];
+
+    dontWrapQtApps = true;
+
+    dontStrip = 1;
+
+    autoPatchelfIgnoreMissingDeps = [
+      # 'mysql80' reached end of life on 2026-04-30 and has been removed.
+      "libmysqlclient.so.21"
+      # These libraries are not available in nixpkgs. They are Oracle Instant Client
+      # (libclntsh.so.23.1) and UCanAccess/Mimer SQL (libmimerapi.so) drivers that
+      # are bundled with Qt's SQlite database plugins (libqsqlora, libqsqlmimer).
+      "libclntsh.so.23.1"
+      "libmimerapi.so"
+    ];
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/{bin,lib,share}
+
+      mv usr/bin/* $out/bin
+      mv usr/share/* $out/share/
+      mv opt/euro-office/desktopeditors $out/share
+
+      substituteInPlace $out/bin/euro-office-desktopeditors \
+        --replace-fail "/opt/euro-office/" "$out/share/"
+
+      ln -s $out/share/desktopeditors/DesktopEditors $out/bin/DesktopEditors
+
+      runHook postInstall
+    '';
+
+    preFixup = ''
+      gappsWrapperArgs+=(
+        --prefix LD_LIBRARY_PATH : "${runtimeLibs}" \
+        --set QT_XKB_CONFIG_ROOT "${xkeyboard_config}/share/X11/xkb" \
+        --set QTCOMPOSE "${libx11.out}/share/X11/locale" \
+        --set QT_QPA_PLATFORM "xcb"
+        # the bundled version of qt does not support wayland
+      )
+    '';
+  });
+
+in
+
+# In order to download plugins, Euro-Office uses /usr/bin/curl so we have to wrap it.
+# Curl still needs to be in runtimeLibs because the library is used directly in other parts of the code.
+# Fonts are also discovered by looking in /usr/share/fonts, so adding fonts to targetPkgs will include them
+buildFHSEnv {
+  inherit (derivation) pname version;
+
+  targetPkgs = pkgs': [
+    curl
+    derivation
+    noto-fonts-cjk-sans
+    libGL
+  ];
+
+  runScript = "/bin/euro-office-desktopeditors";
+
+  extraInstallCommands = ''
+    mkdir -p $out/share
+    ln -s ${derivation}/share/icons $out/share
+    cp -r ${derivation}/share/applications $out/share
+    substituteInPlace $out/share/applications/euro-office-desktopeditors.desktop \
+        --replace-fail "/usr/bin/euro-office-desktopeditors" "$out/bin/euro-office-desktopeditors"
+  '';
+
+  meta = {
+    description = "Office suite that combines text, spreadsheet and presentation editors allowing to create, view and edit local documents";
+    homepage = "https://github.com/Euro-Office/DesktopEditors";
+    downloadPage = "https://github.com/Euro-Office/DesktopEditors/releases";
+    changelog = "https://github.com/Euro-Office/DesktopEditors/blob/v9.3.1/CHANGELOG.md";
+    platforms = [ "x86_64-linux" ];
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    license = lib.licenses.agpl3Plus;
+    maintainers = [ lib.maintainers.onny ];
+    mainProgram = "euro-office-desktopeditors";
+  };
+}
--- a/pkgs/by-name/gn/gnome-shell/icon-theme-directory-identity.patch
+++ b/pkgs/by-name/gn/gnome-shell/icon-theme-directory-identity.patch
@@ -0,0 +1,44 @@
+diff --git a/src/st/st-icon-theme.c b/src/st/st-icon-theme.c
+--- a/src/st/st-icon-theme.c
+++ b/src/st/st-icon-theme.c
+@@ -220,6 +220,8 @@ typedef struct
+ {
+   char *dir;
+   time_t mtime;
+  dev_t device;
+  ino_t inode;
+   StIconCache *cache;
+   gboolean exists;
+ } IconThemeDirMtime;
+@@ -792,6 +794,8 @@ insert_theme (StIconTheme *icon_theme,
+       dir_mtime->dir = path;
+       if (g_stat (path, &stat_buf) == 0 && S_ISDIR (stat_buf.st_mode)) {
+         dir_mtime->mtime = stat_buf.st_mtime;
+        dir_mtime->device = stat_buf.st_dev;
+        dir_mtime->inode = stat_buf.st_ino;
+         dir_mtime->exists = TRUE;
+       } else {
+         dir_mtime->mtime = 0;
+@@ -1029,6 +1033,8 @@ load_themes (StIconTheme *icon_theme)
+       if (g_stat (dir, &stat_buf) != 0 || !S_ISDIR (stat_buf.st_mode))
+         continue;
+       dir_mtime->mtime = stat_buf.st_mtime;
+      dir_mtime->device = stat_buf.st_dev;
+      dir_mtime->inode = stat_buf.st_ino;
+       dir_mtime->exists = TRUE;
+ 
+       dir_mtime->cache = st_icon_cache_new_for_path (dir);
+@@ -2120,10 +2126,12 @@ rescan_themes (StIconTheme *icon_theme)
+-      /* dir mtime didn't change */
+      /* dir identity and mtime didn't change. */
+       if (stat_res == 0 && dir_mtime->exists &&
+           S_ISDIR (stat_buf.st_mode) &&
+          dir_mtime->device == stat_buf.st_dev &&
+          dir_mtime->inode == stat_buf.st_ino &&
+           dir_mtime->mtime == stat_buf.st_mtime)
+         continue;
+       /* didn't exist before, and still doesn't */
+       if (!dir_mtime->exists &&
+           (stat_res != 0 || !S_ISDIR (stat_buf.st_mode)))
+         continue;
+ 
--- a/pkgs/by-name/gn/gnome-shell/package.nix
+++ b/pkgs/by-name/gn/gnome-shell/package.nix
@@ -100,6 +100,9 @@ stdenv.mkDerivation (finalAttrs: {
    # Make D-Bus services wrappable.
    ./wrap-services.patch

+    # Detect profile switches even when icon directory mtimes are unchanged.
+    ./icon-theme-directory-identity.patch
+
    # Fix greeter logo being too big.
    # https://gitlab.gnome.org/GNOME/gnome-shell/issues/2591
    # Reverts https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/1101
--- a/pkgs/by-name/hu/hunk/package.nix
+++ b/pkgs/by-name/hu/hunk/package.nix
@@ -12,13 +12,13 @@

 let
  pname = "hunk";
-  version = "0.21.1";
+  version = "0.22.0";

  src = fetchFromGitHub {
    owner = "modem-dev";
    repo = "hunk";
    tag = "v${version}";
-    hash = "sha256-8faDOqDXSdp5j8WP07rTW0L44keCPpv9mWoXGKXgvpY=";
+    hash = "sha256-dc4/xLAyQe7mL/KMcpjsjgHzgf0tRomQAemVABwUWFY=";
  };

  node_modules = stdenv.mkDerivation {
@@ -58,7 +58,7 @@ let

    dontFixup = true;

-    outputHash = "sha256-r3LXoIx7fHWyTTs19N4CU9mIWYsQxP0QVpstlvAu3D0=";
+    outputHash = "sha256-hWfG2T3Tfa69nX50OFW5XNRQxMc5lideDEUPw6G26qA=";
    outputHashMode = "recursive";
  };
 in
@@ -75,16 +75,6 @@ stdenv.mkDerivation {
    writableTmpDirAsHomeHook
  ];

-  # Teach `hunk skill path` to find the FHS layout under share/skills/$pname
-  # (https://github.com/NixOS/nixpkgs/issues/547426) instead of $out/skills.
-  postPatch = ''
-    substituteInPlace src/core/run/paths.ts \
-      --replace-fail \
-        'join("node_modules", "hunkdiff", skillRelativePath),' \
-        'join("node_modules", "hunkdiff", skillRelativePath),
-    join("share", "skills", "hunk", name, "SKILL.md"),'
-  '';
-
  configurePhase = ''
    runHook preConfigure

@@ -98,13 +88,15 @@ stdenv.mkDerivation {
  buildPhase = ''
    runHook preBuild

+    # Entry points mirror upstream's scripts/build/build-bin.ts.
    mkdir -p .bun-tmp .bun-install
    BUN_TMPDIR=$PWD/.bun-tmp \
    BUN_INSTALL=$PWD/.bun-install \
      bun build --compile \
        --no-compile-autoload-bunfig \
        --no-compile-autoload-dotenv \
-        src/main.tsx \
+        packages/hunk/src/main.tsx \
+        packages/hunk/src/highlightWorkerEntry.ts \
        --outfile hunk

    runHook postBuild
@@ -115,8 +107,12 @@ stdenv.mkDerivation {
    runHook preInstall

    installBin hunk
-    installSkill skills/hunk-extensions hunk
-    installSkill skills/hunk-review hunk
+    for skill in packages/hunk/skills/*; do
+      installSkill "$skill"
+    done
+
+    # `hunk skill path` looks for skills/<name>/SKILL.md above the executable.
+    ln -s share/skills/${pname} $out/skills

    runHook postInstall
  '';
@@ -134,9 +130,8 @@ stdenv.mkDerivation {
  installCheckPhase = ''
    runHook preInstallCheck

-    $out/bin/hunk --version | grep -F ${version}
-    test -f "$($out/bin/hunk skill path)"
-    test -f "$($out/bin/hunk skill path hunk-extensions)"
+    cmp "$out/share/skills/${pname}/hunk-review/SKILL.md" "$($out/bin/hunk skill path)"
+    cmp "$out/share/skills/${pname}/hunk-extensions/SKILL.md" "$($out/bin/hunk skill path hunk-extensions)"

    runHook postInstallCheck
  '';
--- a/pkgs/by-name/ke/keycard-cli/package.nix
+++ b/pkgs/by-name/ke/keycard-cli/package.nix
@@ -32,7 +32,7 @@ buildGoModule (finalAttrs: {
  meta = {
    description = "Command line tool and shell to manage keycards";
    mainProgram = "keycard-cli";
-    homepage = "https://keycard.status.im";
+    homepage = "https://keycard.tech/";
    license = lib.licenses.mpl20;
    maintainers = [ lib.maintainers.zimbatm ];
    broken = stdenv.hostPlatform.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/trunk/keycard-cli.x86_64-darwin
--- a/pkgs/by-name/ki/kiln/package.nix
+++ b/pkgs/by-name/ki/kiln/package.nix
@@ -31,7 +31,7 @@ buildGoModule (finalAttrs: {

  meta = {
    description = "Simple static site generator for Gemini";
-    homepage = "https://kiln.adnano.co/";
+    homepage = "https://git.sr.ht/~adnano/kiln";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ sikmir ];
    mainProgram = "kiln";
--- a/pkgs/by-name/kl/klog/package.nix
+++ b/pkgs/by-name/kl/klog/package.nix
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
      KLog provides QSO management, useful QSL management DX-Cluster client, DXCC management,
      ClubLog integration, WSJT-X, DX-Marathon support and much more.
    '';
-    homepage = "https://www.klog.xyz/";
+    homepage = "https://github.com/ea4k/klog";
    license = lib.licenses.gpl2Plus;
    platforms = lib.platforms.linux;
    maintainers = with lib.maintainers; [ pulsation ];
--- a/pkgs/by-name/ku/kubernetes/package.nix
+++ b/pkgs/by-name/ku/kubernetes/package.nix
@@ -23,13 +23,13 @@

 buildGoModule (finalAttrs: {
  pname = "kubernetes";
-  version = "1.37.0";
+  version = "1.37.1";

  src = fetchFromGitHub {
    owner = "kubernetes";
    repo = "kubernetes";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-irRDtPf+bk2uQ/QOcAXzYcrm/0pys/e4M5ITyL6omqs=";
+    hash = "sha256-9p7t8EN6Iv3Q2ClJgCgSUJP1Qdp7B47fOe0roP5jZbg=";
  };

  vendorHash = null;
--- a/pkgs/by-name/ku/kuzu/package.nix
+++ b/pkgs/by-name/ku/kuzu/package.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    changelog = "https://github.com/kuzudb/kuzu/releases/tag/v${finalAttrs.version}";
    description = "Embeddable property graph database management system";
-    homepage = "https://kuzudb.com/";
+    homepage = "https://github.com/kuzudb/kuzu";
    license = lib.licenses.mit;
    mainProgram = "kuzu";
    maintainers = with lib.maintainers; [ sdht0 ];
--- a/pkgs/by-name/la/ladspaPlugins/package.nix
+++ b/pkgs/by-name/la/ladspaPlugins/package.nix
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  meta = {
-    homepage = "http://plugin.org.uk/";
+    homepage = "https://github.com/swh/ladspa";
    description = "LADSPA format audio plugins";
    license = lib.licenses.gpl2Only;
    maintainers = [ lib.maintainers.magnetophon ];
--- a/pkgs/by-name/lc/lcab/package.nix
+++ b/pkgs/by-name/lc/lcab/package.nix
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Create cabinet (.cab) archives";
-    homepage = "http://ohnopub.net/~ohnobinki/lcab";
+    homepage = "https://salsa.debian.org/debian/lcab";
    license = lib.licenses.gpl2Only;
    maintainers = with lib.maintainers; [ emilytrau ];
    platforms = lib.platforms.unix;
--- a/pkgs/by-name/ld/ldmud/package.nix
+++ b/pkgs/by-name/ld/ldmud/package.nix
@@ -116,7 +116,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Gamedriver for LPMuds including a LPC compiler, interpreter and runtime";
-    homepage = "https://ldmud.eu";
+    homepage = "https://github.com/ldmud/ldmud";
    changelog = "https://github.com/ldmud/ldmud/blob/${finalAttrs.version}/HISTORY";
    longDescription = ''
      LDMud started as a project to clean up and modernize Amylaar's LPMud
--- a/pkgs/by-name/li/libcint/package.nix
+++ b/pkgs/by-name/li/libcint/package.nix
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
      It provides C/Fortran API to evaluate one-electron / two-electron
      integrals for Cartesian / real-spheric / spinor Gaussian type functions.
    '';
-    homepage = "http://wiki.sunqm.net/libcint";
+    homepage = "https://github.com/sunqm/libcint";
    downloadPage = "https://github.com/sunqm/libcint";
    changelog = "https://github.com/sunqm/libcint/blob/master/ChangeLog";
    license = lib.licenses.bsd2;
--- a/pkgs/by-name/li/libeconf/package.nix
+++ b/pkgs/by-name/li/libeconf/package.nix
@@ -5,6 +5,7 @@
  meson,
  ninja,
  nix-update-script,
+  testers,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -18,6 +19,13 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-jIEsfX3Oz/koX0srLPGII99WaeFjKtXvB4kzMu7LbWs=";
  };

+  # unsupported flags that we can just remove
+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace meson.build \
+      --replace-fail "'-ffat-lto-objects'," "" \
+      --replace-fail "version_flag = ['-Wl,--version-script,@0@/@1@'.format(meson.current_source_dir(), mapfile)]" "version_flag = []"
+  '';
+
  __structuredAttrs = true;
  strictDeps = true;

@@ -26,7 +34,10 @@ stdenv.mkDerivation (finalAttrs: {
    ninja
  ];

-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    updateScript = nix-update-script { };
+  };

  meta = {
    description = "Enhanced config file parser, which merges config files placed in several locations into one";
@@ -36,5 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
    maintainers = with lib.maintainers; [ grimmauld ];
    mainProgram = "econftool";
    platforms = lib.platforms.all;
+    pkgConfigModules = [ "libeconf" ];
+    identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "opensuse" finalAttrs.version;
  };
 })
--- a/pkgs/by-name/li/libfm/package.nix
+++ b/pkgs/by-name/li/libfm/package.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    broken = stdenv.hostPlatform.isDarwin;
-    homepage = "https://blog.lxde.org/category/pcmanfm/";
+    homepage = "https://github.com/lxde/libfm";
    license = lib.licenses.lgpl21Plus;
    description = "Glib-based library for file management";
    maintainers = [ ];
--- a/pkgs/by-name/li/liblogging/package.nix
+++ b/pkgs/by-name/li/liblogging/package.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
  env.NIX_CFLAGS_COMPILE = "-Wno-error=implicit-int -Wno-error=implicit-function-declaration";

  meta = {
-    homepage = "http://www.liblogging.org/";
+    homepage = "https://github.com/rsyslog/liblogging";
    description = "Lightweight signal-safe logging library";
    mainProgram = "stdlogctl";
    license = lib.licenses.bsd2;
--- a/pkgs/by-name/li/libre-baskerville/package.nix
+++ b/pkgs/by-name/li/libre-baskerville/package.nix
@@ -30,7 +30,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
      counters and less contrast that allow it to work on small sizes in any
      screen.
    '';
-    homepage = "http://www.impallari.com/projects/overview/libre-baskerville";
+    homepage = "https://github.com/impallari/Libre-Baskerville";
    license = lib.licenses.ofl;
    maintainers = with lib.maintainers; [ pancaek ];
    platforms = lib.platforms.all;
--- a/pkgs/by-name/li/libre-caslon/package.nix
+++ b/pkgs/by-name/li/libre-caslon/package.nix
@@ -42,7 +42,10 @@ stdenv.mkDerivation rec {

  meta = {
    description = "Caslon fonts based on hand-lettered American Caslons of 1960s";
-    homepage = "http://www.impallari.com/librecaslon";
+    homepage = [
+      "https://github.com/impallari/Libre-Caslon-Text"
+      "https://github.com/impallari/Libre-Caslon-Display/"
+    ];
    license = lib.licenses.ofl;
    maintainers = [ ];
    platforms = lib.platforms.all;
--- a/pkgs/by-name/li/libsieve/package.nix
+++ b/pkgs/by-name/li/libsieve/package.nix
@@ -14,7 +14,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Interpreter for RFC 3028 Sieve and various extensions";
-    homepage = "http://sodabrew.com/libsieve/";
+    homepage = "https://github.com/sodabrew/libsieve";
    license = lib.licenses.lgpl21;
    platforms = lib.platforms.unix;
  };
--- a/pkgs/by-name/lk/lklug-sinhala/package.nix
+++ b/pkgs/by-name/lk/lklug-sinhala/package.nix
@@ -23,7 +23,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {

  meta = {
    description = "Unicode Sinhala font by Lanka Linux User Group";
-    homepage = "http://www.lug.lk/fonts/lklug";
+    homepage = "https://sinhala.sourceforge.net/";
    license = lib.licenses.gpl2Plus;
    maintainers = with lib.maintainers; [ serge ];
    platforms = lib.platforms.all;
--- a/pkgs/by-name/lo/loxodo/package.nix
+++ b/pkgs/by-name/lo/loxodo/package.nix
@@ -46,7 +46,7 @@ python3.pkgs.buildPythonApplication {
  meta = {
    description = "Password Safe V3 compatible password vault";
    mainProgram = "loxodo";
-    homepage = "https://www.christoph-sommer.de/loxodo/";
+    homepage = "https://github.com/sommer/loxodo";
    license = lib.licenses.gpl2Plus;
    platforms = lib.platforms.linux;
    maintainers = [ ];
--- a/pkgs/by-name/lx/lxsession/package.nix
+++ b/pkgs/by-name/lx/lxsession/package.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation (finalAttrs: {
  patches = [ ./repect-xml-catalog-file-var.patch ];

  meta = {
-    homepage = "https://wiki.lxde.org/en/LXSession";
+    homepage = "https://github.com/lxde/lxsession";
    description = "Classic LXDE session manager";
    license = lib.licenses.gpl2Plus;
    platforms = lib.platforms.linux;
--- a/pkgs/by-name/me/meli/package.nix
+++ b/pkgs/by-name/me/meli/package.nix
@@ -81,7 +81,7 @@ rustPlatform.buildRustPackage rec {
  meta = {
    description = "Terminal e-mail client and e-mail client library";
    mainProgram = "meli";
-    homepage = "https://meli.delivery";
+    homepage = "https://meli-email.org/";
    license = lib.licenses.gpl3;
    maintainers = with lib.maintainers; [
      _0x4A6F
--- a/pkgs/by-name/mo/moonshine/package.nix
+++ b/pkgs/by-name/mo/moonshine/package.nix
@@ -29,19 +29,19 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "moonshine";
-  version = "0.16.0";
+  version = "0.16.1";

  src = fetchFromGitHub {
    owner = "hgaiser";
    repo = "moonshine";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-SpDGhIi6FTYAWDzMZwPdNbwPmDEA3w/xOi2z5wRR1Qc=";
+    hash = "sha256-CmSOU263HD4qDFwGRxyozo2u2BlM+bT8AE7EwFPEhnA=";
  };

  __structuredAttrs = true;
  strictDeps = true;

-  cargoHash = "sha256-GhHjXPx3aEYPO9OsuB1ZAiwvessXoOOQ8MqFwmORJOs=";
+  cargoHash = "sha256-g9X9tiO+mUW4eTYi16nvesHIvWsQgAft7ZLEK1/CQHg=";

  # Build Moonshine binary and Vulkan layer
  cargoBuildFlags = [
--- a/pkgs/by-name/mo/mozillavpn/package.nix
+++ b/pkgs/by-name/mo/mozillavpn/package.nix
@@ -128,7 +128,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    description = "Client for the Mozilla VPN service";
    mainProgram = "mozillavpn";
-    homepage = "https://vpn.mozilla.org/";
+    homepage = "https://www.mozilla.org/en-US/products/vpn/";
    license = lib.licenses.mpl20;
    maintainers = with lib.maintainers; [ andersk ];
    platforms = lib.platforms.linux;
--- a/pkgs/by-name/mp/mps/package.nix
+++ b/pkgs/by-name/mp/mps/package.nix
@@ -59,7 +59,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Flexible memory management and garbage collection library";
-    homepage = "https://www.ravenbrook.com/project/mps";
+    homepage = "https://github.com/Ravenbrook/mps";
    license = lib.licenses.sleepycat;
    platforms = lib.platforms.linux ++ lib.platforms.darwin;
    maintainers = [ lib.maintainers.thoughtpolice ];
--- a/pkgs/by-name/mr/mrsh/package.nix
+++ b/pkgs/by-name/mr/mrsh/package.nix
@@ -32,7 +32,7 @@ stdenv.mkDerivation {
  meta = {
    description = "Minimal POSIX shell";
    mainProgram = "mrsh";
-    homepage = "https://mrsh.sh";
+    homepage = "https://github.com/emersion/mrsh";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ matthiasbeyer ];
    platforms = lib.platforms.unix;
--- a/pkgs/by-name/ne/ne/package.nix
+++ b/pkgs/by-name/ne/ne/package.nix
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Nice editor";
-    homepage = "https://ne.di.unimi.it/";
+    homepage = "https://github.com/vigna/ne";
    changelog = "https://github.com/vigna/ne/releases/tag/${finalAttrs.version}";
    downloadPage = "https://github.com/vigna/ne";
    longDescription = ''
--- a/pkgs/by-name/or/orioledb/extension.nix
+++ b/pkgs/by-name/or/orioledb/extension.nix
@@ -10,14 +10,14 @@

 postgresqlBuildExtension (finalAttrs: {
  pname = "orioledb";
-  # SQL extension version is 1.9, official version is beta17
-  version = "1.9-beta17";
+  # SQL extension version is 1.10, official version is beta18
+  version = "1.10-beta18";

  src = fetchFromGitHub {
    owner = "orioledb";
    repo = "orioledb";
-    tag = "beta17";
-    hash = "sha256-gDX28/CHlbLj+jC3Qx6z/Hg6M73K4mFPw3iysc1Xv6I=";
+    tag = "beta18";
+    hash = "sha256-kmNfneISVhlD9Pmnl69pkiAX77MzpzyJQB/5wQ1wiZc=";
  };

  buildInputs = postgresql.buildInputs ++ [
--- a/pkgs/by-name/or/orioledb/package.nix
+++ b/pkgs/by-name/or/orioledb/package.nix
@@ -8,13 +8,13 @@ let
  orioledb-postgres = postgresql_18.overrideAttrs (
    finalAttrs: oldAttrs: {
      pname = "orioledb-postgres";
-      version = "18.2";
+      version = "18.3";

      src = fetchFromGitHub {
        owner = "orioledb";
        repo = "postgres";
-        tag = "patches18_2";
-        hash = "sha256-n/Bl48D20evMo9c0PwdSCvdICDd3Z41OCJEuP3MJ8B4=";
+        tag = "patches18_3";
+        hash = "sha256-XzUVkPSVt6DTMrEWV80KLYoMuNdVVtZvg8Iqq1RSlAs=";
      };

      # Configure extracts the patch version from the git tag. This
--- a/pkgs/by-name/pc/pcmanfm/package.nix
+++ b/pkgs/by-name/pc/pcmanfm/package.nix
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
  passthru.updateScript = nix-update-script { };

  meta = {
-    homepage = "https://blog.lxde.org/category/pcmanfm/";
+    homepage = "https://github.com/lxde/pcmanfm";
    license = lib.licenses.gpl2Plus;
    description = "File manager with GTK interface";
    maintainers = [ ];
--- a/pkgs/by-name/pr/prl-tools/package.nix
+++ b/pkgs/by-name/pr/prl-tools/package.nix
@@ -44,13 +44,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "prl-tools";
-  version = "27.0.1-58670";
+  version = "27.0.2-58673";

  # We download the full distribution to extract prl-tools-lin.iso from
  # => ${dmg}/Parallels\ Desktop.app/Contents/Resources/Tools/prl-tools-lin.iso
  src = fetchurl {
    url = "https://download.parallels.com/desktop/v${lib.versions.major finalAttrs.version}/${finalAttrs.version}/ParallelsDesktop-${finalAttrs.version}.dmg";
-    hash = "sha256-ZchIQQ/FyzLmcL2ust1YAqlSsRZWJmDO3t3Ywxo39P0=";
+    hash = "sha256-/buPuva2r9dxSpLdNI9Qg/YTk0Y82XRwFt2XhF24wh0=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/pr/proj-datumgrid/package.nix
+++ b/pkgs/by-name/pr/proj-datumgrid/package.nix
@@ -28,7 +28,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Repository for proj datum grids";
-    homepage = "https://proj4.org";
+    homepage = "https://proj.org";
    license = lib.licenses.mit;
    maintainers = [ ];
    mainProgram = "nad2bin";
--- a/pkgs/by-name/pr/proxytunnel/package.nix
+++ b/pkgs/by-name/pr/proxytunnel/package.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    mainProgram = "proxytunnel";
-    homepage = "http://proxytunnel.sf.net/";
+    homepage = "https://proxytunnel.sourceforge.io";
    description = "Stealth tunneling through HTTP(S) proxies";
    platforms = lib.platforms.unix;
    license = lib.licenses.gpl2Only;
--- a/pkgs/by-name/px/px0/package.nix
+++ b/pkgs/by-name/px/px0/package.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "px0";
+  version = "0.1.4";
+
+  src = fetchFromGitHub {
+    owner = "px0-ai";
+    repo = "px0";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-1r000izgL1EFsBpIkyb8u6+RVhV58qHf+AshSYtINmY=";
+  };
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  vendorHash = "sha256-71+6I0u3en/Aw3PVMXx6dF+NQtCiE1T+kd7MENCKnlk=";
+
+  checkFlags = lib.optionals stdenv.hostPlatform.isDarwin [
+    "-skip"
+    "TestListenPortFallback|TestTelemetrySessionLifecycle"
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "-version";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Fast, ultra-light, remote-first IDE for code navigation and review in your browser";
+    homepage = "https://github.com/px0-ai/px0";
+    changelog = "https://github.com/px0-ai/px0/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ sheeeng ];
+    mainProgram = "px0";
+  };
+})
--- a/pkgs/by-name/ro/rofi-games/package.nix
+++ b/pkgs/by-name/ro/rofi-games/package.nix
@@ -19,18 +19,18 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "rofi-games";
-  version = "1.18.0";
+  version = "1.19.0";

  src = fetchFromGitHub {
    owner = "Rolv-Apneseth";
    repo = "rofi-games";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-6/UeQ+j38NeQFkeP0Pb2UKUbwruPgUos3e9TUQwv9WI=";
+    hash = "sha256-+2I4WR5SOLYSWnPUrJFlRwhnebu4RNy3Dd4/gKW8xXU=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-oWmfzlt/qqg1CYfk1pKWhaapiP3iqFU4Idn6pBivjko=";
+    hash = "sha256-dPm9+rxEtx32HVaXLrbxZiVyUrYwFPvuk/gRQR4Fo+s=";
  };

  patches = [
--- a/pkgs/by-name/sh/shelter/package.nix
+++ b/pkgs/by-name/sh/shelter/package.nix
@@ -10,12 +10,12 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "shelter";
-  version = "0-unstable-2026-09-06";
+  version = "0-unstable-2026-09-16";
  src = fetchFromGitHub {
    owner = "uwu";
    repo = "shelter";
-    rev = "ee10d4ecb2fd62fb86ebfdbd37a4e28df9e72f11";
-    hash = "sha256-Ew6RUhIS2gRuCNkbNCNtlmtYSGtjBR4h+UebuDVWhmk=";
+    rev = "0397ffe539fce088f8cab25cc086055d4a5feb71";
+    hash = "sha256-Qagye5ksJyvoOIpoozfWmHTO8Or2F7KWOyXQgbK2vVY=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/su/subnetcalc/package.nix
+++ b/pkgs/by-name/su/subnetcalc/package.nix
@@ -5,17 +5,19 @@
  cmake,
  ninja,
  gettext,
+  libidn2,
+  libmaxminddb,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "subnetcalc";
-  version = "2.6.6";
+  version = "2.7.5";

  src = fetchFromGitHub {
    owner = "dreibh";
    repo = "subnetcalc";
    tag = "subnetcalc-${finalAttrs.version}";
-    hash = "sha256-8tC8hBeKy8nxi6nUhWNwnwDgS6NV/9g5L75dsM097IA=";
+    hash = "sha256-xMWEd8F6tQuKVL4aybdwsidBbmPItuNd6iCZUfzjVLA=";
  };

  nativeBuildInputs = [
@@ -24,9 +26,14 @@ stdenv.mkDerivation (finalAttrs: {
    gettext
  ];

+  buildInputs = [
+    libidn2
+    libmaxminddb
+  ];
+
  meta = {
    description = "IPv4/IPv6 subnet address calculator";
-    homepage = "https://www.uni-due.de/~be0001/subnetcalc/";
+    homepage = "https://www.nntb.no/~dreibh/subnetcalc/";
    license = lib.licenses.gpl3Plus;
    longDescription = ''
      SubNetCalc is an IPv4/IPv6 subnet address calculator. For given IPv4 or
--- a/pkgs/by-name/tr/tre/package.nix
+++ b/pkgs/by-name/tr/tre/package.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {

  meta = {
    description = "Lightweight and robust POSIX compliant regexp matching library";
-    homepage = "https://laurikari.net/tre/";
+    homepage = "https://github.com/laurikari/tre";
    changelog = "https://github.com/laurikari/tre/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.bsd2;
    mainProgram = "agrep";
--- a/pkgs/by-name/tr/treefmt/check-wrapper.nix
+++ b/pkgs/by-name/tr/treefmt/check-wrapper.nix
@@ -2,7 +2,8 @@
  lib,
  gitMinimal,
  runCommandLocal,
-  stdenv,
+  gitSetupHook,
+  stdenvNoCC,
  wrapper,
 }:
 /**
@@ -17,12 +18,13 @@ runCommandLocal "${lib.getName wrapper}-check"
    strictDeps = true;
    nativeBuildInputs = [
      gitMinimal
+      gitSetupHook
      wrapper
    ];
    inherit project;
    env = {
-      LANG = if stdenv.buildPlatform.isDarwin then "en_US.UTF-8" else "C.UTF-8";
-      LC_ALL = if stdenv.buildPlatform.isDarwin then "en_US.UTF-8" else "C.UTF-8";
+      LANG = if stdenvNoCC.buildPlatform.isDarwin then "en_US.UTF-8" else "C.UTF-8";
+      LC_ALL = if stdenvNoCC.buildPlatform.isDarwin then "en_US.UTF-8" else "C.UTF-8";
    };
    meta.description = "Check that the project tree is formatted";
  }
@@ -34,8 +36,6 @@ runCommandLocal "${lib.getName wrapper}-check"

    # Setup a git repo
    git init --initial-branch main
-    git config user.name nixbld
-    git config user.email nixbld@example.com
    git add .
    git commit -m init --quiet

--- a/pkgs/by-name/tr/trezor-suite/package.nix
+++ b/pkgs/by-name/tr/trezor-suite/package.nix
@@ -10,7 +10,7 @@

 let
  pname = "trezor-suite";
-  version = "26.8.2";
+  version = "26.9.2";

  suffix =
    {
@@ -24,8 +24,8 @@ let
    hash =
      {
        # curl -Lfs https://github.com/trezor/trezor-suite/releases/download/v${version}/latest-linux{-arm64,}.yml | grep ^sha512 | sed 's/: /-/'
-        aarch64-linux = "sha512-vbMku80aY5zTa6ObmkuZNkCeONZYsLxnjVxL7QBv14OcDE+vENQ3lyQzVe+spqufMRhCe3hy2ehpA8CewFQKBA==";
-        x86_64-linux = "sha512-bnosz6dtKFaUXaFHXtJSSChSHbW2bj9CK2Dn5X6btB/Xpcsm9Rbnm3If4qh9w1yQYwTlIDBPTRrh8Mh0BGgcag==";
+        aarch64-linux = "sha512-TYPJbatTO9FPsOCSDY+a74xCaiMHozsktSpfW8EaL0yd/74jy0+0VNM8gkHbGANiC7CASygsHfomEe5o5fvBXQ==";
+        x86_64-linux = "sha512-Hd7tkGqLeQJqjnrEVzeULpPxTRpnPS/IZLTU6tyq0PQClrsl/Z2ADuPydfH4g2QlCmMGZMF0TBRvSzRIIrwchw==";
      }
      .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
  };
--- a/pkgs/by-name/tr/trimal/package.nix
+++ b/pkgs/by-name/tr/trimal/package.nix
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
    description = "Tool for the automated removal of spurious sequences or poorly aligned regions from a multiple sequence alignment";
    license = lib.licenses.gpl3;
    platforms = lib.platforms.linux ++ lib.platforms.darwin;
-    homepage = "http://trimal.cgenomics.org";
+    homepage = "https://trimal.readthedocs.io/en/latest/";
    maintainers = [ lib.maintainers.bzizou ];
  };
 })
--- a/pkgs/by-name/vl/vlc/package.nix
+++ b/pkgs/by-name/vl/vlc/package.nix
@@ -101,14 +101,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "${optionalString onlyLibVLC "lib"}vlc";
-  version = "3.0.23-2";
+  version = "3.0.24";

  src = fetchFromGitLab {
    domain = "code.videolan.org";
    owner = "videolan";
    repo = "vlc";
    rev = finalAttrs.version;
-    hash = "sha256-vg/kKNrIpGF7Olz8EiA1ZsW5SB4iHlvFbREDp4JokB0=";
+    hash = "sha256-WzgWspA1Jpc6FZ3kaEsxNEOI3Xj37Zp43NNbn6LamXg=";
  };

  depsBuildBuild = optionals waylandSupport [ pkg-config ];
--- a/pkgs/by-name/wa/wavelog/package.nix
+++ b/pkgs/by-name/wa/wavelog/package.nix
@@ -8,7 +8,7 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "wavelog";
-  version = "3.2.2";
+  version = "3.2.3";

  __structuredAttrs = true;
  strictDeps = true;
@@ -17,7 +17,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    owner = "wavelog";
    repo = "wavelog";
    tag = finalAttrs.version;
-    hash = "sha256-jB096icPC4q24/yylkmwuOswMxqxJxsUUVCKb4Xq7dw=";
+    hash = "sha256-ccpUHvoXYBqLvWh6seq7d6uwrKBzIJlzPN055+CBRJY=";
  };

  installPhase = ''
--- a/pkgs/by-name/wp/wpa_supplicant/package.nix
+++ b/pkgs/by-name/wp/wpa_supplicant/package.nix
@@ -28,6 +28,7 @@ stdenv.mkDerivation (finalAttrs: {

  patches = [
    ./multiple-configs.patch
+    ./revert-change-breaking-auth-broadcom.patch
  ]
  ++ lib.optional unprivileged ./unprivileged-daemon.patch;

--- a/pkgs/by-name/wp/wpa_supplicant/revert-change-breaking-auth-broadcom.patch
+++ b/pkgs/by-name/wp/wpa_supplicant/revert-change-breaking-auth-broadcom.patch
@@ -0,0 +1,47 @@
+From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
+From: Janne Grunau <janne-fdr@jannau.net>
+Date: Sun, 4 Aug 2024 13:24:42 +0200
+Subject: [PATCH] Revert "Mark authorization completed on driver indication
+ during 4-way HS offload"
+
+This reverts commit 41638606054a09867fe3f9a2b5523aa4678cbfa5.
+---
+ wpa_supplicant/events.c | 25 ++++++++-----------------
+ 1 file changed, 8 insertions(+), 17 deletions(-)
+
+diff --git a/wpa_supplicant/events.c b/wpa_supplicant/events.c
+index 4f85da193608..919a0732b813 100644
+--- a/wpa_supplicant/events.c
+++ b/wpa_supplicant/events.c
+@@ -4925,23 +4925,14 @@ static int wpa_supplicant_event_assoc(struct wpa_supplicant *wpa_s,
+ 		    wpa_key_mgmt_wpa_psk(wpa_s->key_mgmt)) ||
+ 		   ((wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_OWE_OFFLOAD_STA) &&
+ 		    wpa_s->key_mgmt == WPA_KEY_MGMT_OWE)) {
+-		if (already_authorized) {
+-			/*
+-			 * We are done; the driver will take care of RSN 4-way
+-			 * handshake.
+-			 */
+-			wpa_supplicant_cancel_auth_timeout(wpa_s);
+-			wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
+-			eapol_sm_notify_portValid(wpa_s->eapol, true);
+-			eapol_sm_notify_eap_success(wpa_s->eapol, true);
+-		} else {
+-			/* Update port, WPA_COMPLETED state from the
+-			 * EVENT_PORT_AUTHORIZED handler when the driver is done
+-			 * with the 4-way handshake.
+-			 */
+-			wpa_msg(wpa_s, MSG_DEBUG,
+-				"ASSOC INFO: wait for driver port authorized indication");
+-		}
+		/*
+		 * We are done; the driver will take care of RSN 4-way
+		 * handshake.
+		 */
+		wpa_supplicant_cancel_auth_timeout(wpa_s);
+		wpa_supplicant_set_state(wpa_s, WPA_COMPLETED);
+		eapol_sm_notify_portValid(wpa_s->eapol, true);
+		eapol_sm_notify_eap_success(wpa_s->eapol, true);
+ 	} else if ((wpa_s->drv_flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE_8021X) &&
+ 		   wpa_key_mgmt_wpa_ieee8021x(wpa_s->key_mgmt)) {
+ 		/*
--- a/pkgs/by-name/xp/xpra/package.nix
+++ b/pkgs/by-name/xp/xpra/package.nix
@@ -294,8 +294,7 @@ effectiveBuildPythonApplication rec {
  };

  meta = {
-    homepage = "https://xpra.org/";
-    downloadPage = "https://xpra.org/src/";
+    homepage = "https://github.com/Xpra-org/xpra";
    description = "Persistent remote applications for X";
    changelog = "https://github.com/Xpra-org/xpra/releases/tag/v${version}";
    platforms = lib.platforms.linux;
--- a/pkgs/by-name/xr/xremap/package.nix
+++ b/pkgs/by-name/xr/xremap/package.nix
@@ -58,13 +58,13 @@ assert (
 );
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "xremap${variant.suffix or ""}";
-  version = "0.15.13";
+  version = "0.15.14";

  src = fetchFromGitHub {
    owner = "xremap";
    repo = "xremap";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-EOZjn1mObQV1C4VevrVdSPRdqw0q5vCLxDJOlIR19C4=";
+    hash = "sha256-KwKIHFBnlq2nIh4E1OeVdr4QSPwa+/zn8B44/84rJko=";
  };

  nativeBuildInputs = [ pkg-config ];
@@ -72,7 +72,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  buildNoDefaultFeatures = true;
  buildFeatures = variant.features;

-  cargoHash = "sha256-fE4lwnC1AtdK2Ev+NT77Q4PqWU07sHccBbEpzd4YATA=";
+  cargoHash = "sha256-lkg1bnTEGUO7ce1Y6a1iK5khoswG3trlSthtp3otem4=";

  passthru = lib.mapAttrs (name: lib.const (xremap.override { withVariant = name; })) variants;

--- a/pkgs/by-name/yo/yoda/package.nix
+++ b/pkgs/by-name/yo/yoda/package.nix
@@ -13,13 +13,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "yoda";
-  version = "2.1.2";
+  version = "2.1.4";

  src = fetchFromGitLab {
    owner = "hepcedar";
    repo = "yoda";
    rev = "yoda-${finalAttrs.version}";
-    hash = "sha256-cgThoxqPX6dVyGNTLXatW3uQV+41o38fTfkvHXsDs9A=";
+    hash = "sha256-nj/hvwVqYRqRBiDs5dSXSX/HHEmIXPc8rl5MXXhWhyw=";
  };

  nativeBuildInputs = with python3.pkgs; [
--- a/pkgs/by-name/za/zabbix-agent2-plugin-postgresql/package.nix
+++ b/pkgs/by-name/za/zabbix-agent2-plugin-postgresql/package.nix
@@ -1,30 +0,0 @@
-{
-  lib,
-  buildGoModule,
-  fetchurl,
-}:
-
-buildGoModule (finalAttrs: {
-  pname = "zabbix-agent2-plugin-postgresql";
-  version = "7.4.14";
-
-  src = fetchurl {
-    url = "https://cdn.zabbix.com/zabbix-agent2-plugins/sources/postgresql/zabbix-agent2-plugin-postgresql-${finalAttrs.version}.tar.gz";
-    hash = "sha256-H+WwJ9RrITeWKErMW+vcEG/Z2rAjbznVg/dK3ZM7j0I=";
-  };
-
-  vendorHash = null;
-
-  meta = {
-    description = "Required tool for Zabbix agent integrated PostgreSQL monitoring";
-    mainProgram = "postgresql";
-    homepage = "https://www.zabbix.com/integrations/postgresql";
-    license =
-      if (lib.versions.major finalAttrs.version >= "7") then
-        lib.licenses.agpl3Only
-      else
-        lib.licenses.gpl2Plus;
-    maintainers = with lib.maintainers; [ gador ];
-    platforms = lib.platforms.linux;
-  };
-})
--- a/pkgs/by-name/zu/zulip/package.nix
+++ b/pkgs/by-name/zu/zulip/package.nix
@@ -19,13 +19,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "zulip";
-  version = "5.13.1";
+  version = "5.13.2";

  src = fetchFromGitHub {
    owner = "zulip";
    repo = "zulip-desktop";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-bYN63EQo+c0SIz3BBIwkAS1QqS7+sg7JdpoOekVYq5Q=";
+    hash = "sha256-QFKyslnO+C64ursHyFWFbBzOqFHFXwiavDNfA13eJww=";
  };

  __structuredAttrs = true;
--- a/pkgs/development/haskell-modules/configuration-darwin.nix
+++ b/pkgs/development/haskell-modules/configuration-darwin.nix
@@ -16,18 +16,6 @@ self: super:
    # see: https://github.com/psibi/shell-conduit/issues/12
    shell-conduit = dontCheck super.shell-conduit;

-    conduit-extra = overrideCabal (drv: {
-      __darwinAllowLocalNetworking = true;
-    }) super.conduit-extra;
-
-    spacecookie = overrideCabal (_: {
-      __darwinAllowLocalNetworking = true;
-    }) super.spacecookie;
-
-    streaming-commons = overrideCabal (_: {
-      __darwinAllowLocalNetworking = true;
-    }) super.streaming-commons;
-
    # Hakyll's tests are broken on Darwin (3 failures); and they require util-linux
    hakyll = overrideCabal {
      testToolDepends = [ ];
@@ -134,12 +122,6 @@ self: super:
      + (oldAttrs.preCompileBuildDriver or "");
    }) super.llvm-hs;

-    yesod-core = overrideCabal (drv: {
-      # Allow access to local networking when the Darwin sandbox is enabled, so yesod-core can
-      # run tests that access localhost.
-      __darwinAllowLocalNetworking = true;
-    }) super.yesod-core;
-
    hidapi = super.hidapi.override { systemd = null; };

    # Ensure the necessary frameworks are propagatedBuildInputs on darwin
@@ -234,12 +216,6 @@ self: super:
    # Otherwise impure gcc is used, which is Apple's weird wrapper
    c2hsc = addTestToolDepends [ pkgs.gcc ] super.c2hsc;

-    http2 = overrideCabal (drv: {
-      # Allow access to local networking when the Darwin sandbox is enabled, so http2 can run tests
-      # that access localhost.
-      __darwinAllowLocalNetworking = true;
-    }) super.http2;
-
    # https://hydra.nixos.org/build/230964714/nixlog/1
    inline-c-cpp = appendPatch (pkgs.fetchpatch {
      url = "https://github.com/fpco/inline-c/commit/e8dc553b13bb847409fdced649a6a863323cff8a.patch";
@@ -252,45 +228,57 @@ self: super:
    # Tests fail on macOS https://github.com/mrkkrp/zip/issues/112
    zip = dontCheck super.zip;

-    dap = overrideCabal (drv: {
-      __darwinAllowLocalNetworking = true;
-    }) super.dap;
-
-    essence-of-live-coding-warp = overrideCabal (drv: {
-      __darwinAllowLocalNetworking = true;
-    }) super.essence-of-live-coding-warp;
-
-    http-streams = overrideCabal (drv: {
-      __darwinAllowLocalNetworking = true;
-    }) super.http-streams;
-
-    io-streams = overrideCabal (drv: {
-      __darwinAllowLocalNetworking = true;
-    }) super.io-streams;
-
-    io-streams-haproxy = overrideCabal (drv: {
-      __darwinAllowLocalNetworking = true;
-    }) super.io-streams-haproxy;
-
-    jsaddle-warp = overrideCabal (drv: {
-      __darwinAllowLocalNetworking = true;
-    }) super.jsaddle-warp;
-
-    openssl-streams = overrideCabal (drv: {
-      __darwinAllowLocalNetworking = true;
-    }) super.openssl-streams;
-
-    servant-auth-client = overrideCabal (drv: {
-      __darwinAllowLocalNetworking = true;
-    }) super.servant-auth-client;
-
-    servant-client = overrideCabal (drv: {
-      __darwinAllowLocalNetworking = true;
-    }) super.servant-client;
-
-    snap = overrideCabal (drv: {
-      __darwinAllowLocalNetworking = true;
-    }) super.snap;
+    inherit
+      (lib.mapAttrs (
+        _:
+        overrideCabal (drv: {
+          __darwinAllowLocalNetworking = true;
+        })
+      ) super)
+      cisco-spark-api
+      conduit-extra
+      context-http-client
+      context-wai-middleware
+      dap
+      essence-of-live-coding-warp
+      haskell-bee-redis
+      http-client-websockets
+      http-io-streams
+      http-streams
+      http2
+      io-streams
+      io-streams-haproxy
+      jsaddle-warp
+      katip-wai
+      keter
+      monad-metrics-extensible
+      mysql-haskell
+      network
+      network-transport-tcp
+      network-wait
+      om-socket
+      openssl-streams
+      polysemy-webserver
+      port-utils
+      servant-auth-client
+      servant-client
+      servant-hmac-auth
+      servant-prometheus
+      snap
+      spacecookie
+      streaming-commons
+      sydtest-servant
+      sydtest-wai
+      sydtest-yesod
+      wai-app-file-cgi
+      wai-make-assets
+      wai-token-bucket-ratelimiter
+      webex-teams-api
+      webex-teams-pipes
+      ws-chans
+      yesod-core
+      zeromq4-haskell
+      ;

    warp = overrideCabal (drv: {
      __darwinAllowLocalNetworking = true;
@@ -376,10 +364,6 @@ self: super:
    servant-auth-server = dontCheck super.servant-auth-server;

    sysinfo = dontCheck super.sysinfo;
-
-    network = overrideCabal (drv: {
-      __darwinAllowLocalNetworking = true;
-    }) super.network;
  }
  // lib.optionalAttrs pkgs.stdenv.hostPlatform.isAarch64 {
    # aarch64-darwin
--- a/pkgs/development/lua-modules/overrides.nix
+++ b/pkgs/development/lua-modules/overrides.nix
@@ -98,6 +98,12 @@ in

  cjson = prev.lua-cjson;

+  cosmo = prev.cosmo.overrideAttrs (old: {
+    meta = (old.meta or { }) // {
+      homepage = "https://github.com/mascarenhas/cosmo";
+    };
+  });
+
  cqueues = prev.cqueues.overrideAttrs (old: {
    # Parse out a version number without the Lua version inserted
    version =
@@ -348,6 +354,7 @@ in
    '';
    meta = (old.meta or { }) // {
      broken = luaOlder "5.1" || luaAtLeast "5.3";
+      homepage = "https://github.com/justincormack/ljsyscall";
    };

    propagatedBuildInputs = old.propagatedBuildInputs ++ lib.optional (!isLuaJIT) final.luaffi;
@@ -1310,6 +1317,7 @@ in

  vicious = prev.vicious.overrideAttrs (old: {
    meta = (old.meta or { }) // {
+      homepage = "https://vicious.readthedocs.io/";
      changelog = "https://github.com/vicious-widgets/vicious/blob/v${old.version}/CHANGELOG.rst";
      maintainers = with lib.maintainers; [
        makefu
--- a/pkgs/development/python-modules/detect-secrets/default.nix
+++ b/pkgs/development/python-modules/detect-secrets/default.nix
@@ -65,8 +65,20 @@ buildPythonPackage rec {
    "test_make_decisions"
    "test_saves_to_baseline"
    "test_start_halfway"
+  ]
+  ++ lib.optionals (!withGibberish) [
+    "test_load_and_output"
+    "test_quit_if_baseline_is_changed_but_not_staged"
  ];

+  disabledTestPaths =
+    lib.optionals (!withGibberish) [
+      "tests/filters/gibberish_filter_test.py"
+    ]
+    ++ lib.optionals (!withWordList) [
+      "tests/filters/wordlist_filter_test.py"
+    ];
+
  pythonImportsCheck = [ "detect_secrets" ];

  meta = {
--- a/pkgs/development/python-modules/notobuilder/default.nix
+++ b/pkgs/development/python-modules/notobuilder/default.nix
@@ -21,14 +21,14 @@

 buildPythonPackage {
  pname = "notobuilder";
-  version = "0-unstable-2026-06-26";
+  version = "0-unstable-2026-09-24";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "notofonts";
    repo = "notobuilder";
-    rev = "5b55818eb3f535481135a5f57a337eec6d28cda0";
-    hash = "sha256-pdfWl8rp4tizgb7j0UR7hOW/Ae2dPhTSw1IHljM15LE=";
+    rev = "efda64ea4bdb249cfa69cad28d9cf2febfc7b0c8";
+    hash = "sha256-xAddENwuFPc3Yk0xqWZKbnUAdj3Ka7hoOl+YmYSh3XI=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/pdf2image/default.nix
+++ b/pkgs/development/python-modules/pdf2image/default.nix
@@ -20,7 +20,9 @@ buildPythonPackage rec {
    # replace all default values of paths to poppler-utils
    substituteInPlace pdf2image/pdf2image.py \
      --replace-fail 'poppler_path: Union[str, PurePath] = None' \
-                     'poppler_path: Union[str, PurePath] = "${poppler-utils}/bin"'
+                     'poppler_path: Union[str, PurePath] = "${poppler-utils}/bin"' \
+      --replace-fail 'poppler_path: str = None' \
+                     'poppler_path: str = "${poppler-utils}/bin"'
  '';

  propagatedBuildInputs = [ pillow ];
--- a/pkgs/development/python-modules/pyfribidi/default.nix
+++ b/pkgs/development/python-modules/pyfribidi/default.nix
@@ -1,31 +0,0 @@
-{
-  lib,
-  stdenv,
-  buildPythonPackage,
-  fetchPypi,
-  isPyPy,
-  six,
-}:
-
-buildPythonPackage rec {
-  version = "0.12.0";
-  format = "setuptools";
-  pname = "pyfribidi";
-  disabled = isPyPy;
-
-  src = fetchPypi {
-    inherit pname version;
-    extension = "zip";
-    sha256 = "64726a4a56783acdc79c6b9b3a15f16e6071077c897a0b999f3b43f744bc621c";
-  };
-
-  patches = lib.optional stdenv.cc.isClang ./pyfribidi-clang.patch;
-
-  propagatedBuildInputs = [ six ];
-
-  meta = {
-    description = "Simple wrapper around fribidi";
-    homepage = "https://github.com/pediapress/pyfribidi";
-    license = lib.licenses.gpl2;
-  };
-}
--- a/pkgs/development/python-modules/pyfribidi/pyfribidi-clang.patch
+++ b/pkgs/development/python-modules/pyfribidi/pyfribidi-clang.patch
@@ -1,17 +0,0 @@
-diff --git a/pyfribidi.c b/pyfribidi.c
-index 9a0120d..238134a 100644
--- a/pyfribidi.c
-+++ b/pyfribidi.c
-@@ -148,10 +148,11 @@ init_pyfribidi (void)
- {
- #if PY_MAJOR_VERSION >= 3
-         PyObject *module = PyModule_Create (&pyfribidi_moduledef);
-+        if (module == NULL) return NULL;
- #else
-         PyObject *module = Py_InitModule ("_pyfribidi", PyfribidiMethods);
-+        if (module == NULL) return;
- #endif
-	if (module == NULL) return NULL;
- 
- 	PyModule_AddIntConstant (module, "RTL", (long) FRIBIDI_TYPE_RTL);
- 	PyModule_AddIntConstant (module, "LTR", (long) FRIBIDI_TYPE_LTR);
--- a/pkgs/development/python-modules/sphinx-fortran/default.nix
+++ b/pkgs/development/python-modules/sphinx-fortran/default.nix
@@ -37,7 +37,7 @@ buildPythonPackage {

  meta = {
    description = "Fortran domain and autodoc extensions to Sphinx";
-    homepage = "http://sphinx-fortran.readthedocs.org/";
+    homepage = "http://sphinx-fortran.readthedocs.io/";
    license = lib.licenses.cecill21;
    maintainers = with lib.maintainers; [ loicreynier ];
  };
--- a/pkgs/development/tools/rust/cargo-pgrx/buildPgrxExtension.nix
+++ b/pkgs/development/tools/rust/cargo-pgrx/buildPgrxExtension.nix
@@ -124,6 +124,8 @@ lib.extendMkDerivation {
      cargoPgrxFlags' = lib.escapeShellArgs cargoPgrxFlags;
    in
    {
+      __structuredAttrs = true;
+
      buildInputs = (args.buildInputs or [ ]);

      nativeBuildInputs =
--- a/pkgs/servers/monitoring/zabbix/versions.nix
+++ b/pkgs/servers/monitoring/zabbix/versions.nix
@@ -2,13 +2,25 @@ generic: {
  v74 = generic {
    version = "7.4.14";
    hash = "sha256-795fbxmJbwIAu1JF44ZgNWZyccex6EYm0mCV8kpvu0I=";
+    emberPlusHash = "sha256-riwnpB9ziZhIy9Lqt+JBEfdMR89ZRDmaGC1ibKu6fcU=";
+    mongodbHash = "sha256-zW4wmh422+BlMgtR8+zrrOgTMMtWJbXPRu9MgZwNUt8=";
+    mssqlHash = "sha256-wygP7Li39+MfX+b3h5YJmYhDQKd/ta/sMuLtZI6UgiE=";
+    postgresqlHash = "sha256-H+WwJ9RrITeWKErMW+vcEG/Z2rAjbznVg/dK3ZM7j0I=";
  };
  v70 = generic {
    version = "7.0.30";
    hash = "sha256-wMpAeRGa3uxBNeM1HRuEkVet4HbDUsAGco5zLxcHIyw=";
+    emberPlusHash = "sha256-BXFaELxPrUSIF8+/Jpv+WfGYpJA4VK8wdL4oDFPn+/A=";
+    mongodbHash = "sha256-DhDqLXjGAQXBn9U5fVhZgxsP0MHMKgz35YI8K74mWxo=";
+    mssqlHash = "sha256-Ow15PXUq+kKyeM7j/TNZe/LKKDcmdpB04XE3SkagdRI=";
+    postgresqlHash = "sha256-7BFLstJRAh+rdDW9G7kspMYqRubdfXS9AimMDuMB8UM=";
  };
  v60 = generic {
    version = "6.0.48";
    hash = "sha256-cIibBi7O1e5YKjznoyli/lq7gX/UhoPEc8K8a1kDZJw=";
+    emberPlusHash = "sha256-KtypkgjExw0aajGGr8gFi6VCpofaI/fd+BgBUqdvgBQ=";
+    mongodbHash = "sha256-5RC9rYj4/2MkGPpCmR/hVERp1NxDSTcyn0DZRarFAIM=";
+    mssqlHash = "sha256-UoIHydaa8CPRF2uXXLQAGnX+ImMyMqE3vdMB8e8Zn1c=";
+    postgresqlHash = "sha256-uBkcF5J9BgmqNPTiMPGf4EgUHbidqrLygud7dHFLSe0=";
  };
 }
--- a/pkgs/servers/monitoring/zabbix/zabbix-agent2-plugins/ember-plus.nix
+++ b/pkgs/servers/monitoring/zabbix/zabbix-agent2-plugins/ember-plus.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  buildGoModule,
+  fetchurl,
+}:
+
+import ../versions.nix (
+  { version, emberPlusHash, ... }:
+  buildGoModule (finalAttrs: {
+    pname = "zabbix-agent2-plugin-ember-plus";
+    inherit version;
+
+    src = fetchurl {
+      url = "https://cdn.zabbix.com/zabbix-agent2-plugins/sources/ember-plus/zabbix-agent2-plugin-ember-plus-${finalAttrs.version}.tar.gz";
+      hash = emberPlusHash;
+    };
+
+    vendorHash = null;
+
+    meta = {
+      description = "Zabbix agent2 plugin for monitoring Ember Plus";
+      mainProgram = "ember-plus";
+      homepage = "https://www.zabbix.com/documentation/current/en/manual/appendix/config/zabbix_agent2_plugins/ember_plus_plugin";
+      license =
+        if (lib.versions.major finalAttrs.version >= "7") then
+          lib.licenses.agpl3Only
+        else
+          lib.licenses.gpl2Plus;
+      maintainers = with lib.maintainers; [ thelolcoder2007 ];
+      platforms = lib.platforms.linux;
+    };
+  })
+)
--- a/pkgs/servers/monitoring/zabbix/zabbix-agent2-plugins/mongodb.nix
+++ b/pkgs/servers/monitoring/zabbix/zabbix-agent2-plugins/mongodb.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  buildGoModule,
+  fetchurl,
+}:
+
+import ../versions.nix (
+  { version, mongodbHash, ... }:
+  buildGoModule (finalAttrs: {
+    pname = "zabbix-agent2-plugin-mongodb";
+    inherit version;
+
+    src = fetchurl {
+      url = "https://cdn.zabbix.com/zabbix-agent2-plugins/sources/mongodb/zabbix-agent2-plugin-mongodb-${finalAttrs.version}.tar.gz";
+      hash = mongodbHash;
+    };
+
+    vendorHash = null;
+
+    meta = {
+      description = "Zabbix agent2 plugin for monitoring Mongodb";
+      mainProgram = "mongodb";
+      homepage = "https://www.zabbix.com/documentation/current/en/manual/appendix/config/zabbix_agent2_plugins/mongodb_plugin";
+      license =
+        if (lib.versions.major finalAttrs.version >= "7") then
+          lib.licenses.agpl3Only
+        else
+          lib.licenses.gpl2Plus;
+      maintainers = with lib.maintainers; [ thelolcoder2007 ];
+      platforms = lib.platforms.linux;
+    };
+  })
+)
--- a/pkgs/servers/monitoring/zabbix/zabbix-agent2-plugins/mssql.nix
+++ b/pkgs/servers/monitoring/zabbix/zabbix-agent2-plugins/mssql.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  buildGoModule,
+  fetchurl,
+}:
+
+import ../versions.nix (
+  { version, mssqlHash, ... }:
+  buildGoModule (finalAttrs: {
+    pname = "zabbix-agent2-plugin-mssql";
+    inherit version;
+
+    src = fetchurl {
+      url = "https://cdn.zabbix.com/zabbix-agent2-plugins/sources/mssql/zabbix-agent2-plugin-mssql-${finalAttrs.version}.tar.gz";
+      hash = mssqlHash;
+    };
+
+    vendorHash = null;
+
+    meta = {
+      description = "Zabbix agent2 plugin for monitoring Microsoft SQL servers";
+      mainProgram = "mssql";
+      homepage = "https://www.zabbix.com/documentation/current/en/manual/appendix/config/zabbix_agent2_plugins/mssql_plugin";
+      license =
+        if (lib.versions.major finalAttrs.version >= "7") then
+          lib.licenses.agpl3Only
+        else
+          lib.licenses.gpl2Plus;
+      maintainers = with lib.maintainers; [ thelolcoder2007 ];
+      platforms = lib.platforms.linux;
+    };
+  })
+)
--- a/pkgs/servers/monitoring/zabbix/zabbix-agent2-plugins/postgresql.nix
+++ b/pkgs/servers/monitoring/zabbix/zabbix-agent2-plugins/postgresql.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  buildGoModule,
+  fetchurl,
+}:
+
+import ../versions.nix (
+  { version, postgresqlHash, ... }:
+  buildGoModule (finalAttrs: {
+    pname = "zabbix-agent2-plugin-postgresql";
+    inherit version;
+
+    src = fetchurl {
+      url = "https://cdn.zabbix.com/zabbix-agent2-plugins/sources/postgresql/zabbix-agent2-plugin-postgresql-${finalAttrs.version}.tar.gz";
+      hash = postgresqlHash;
+    };
+
+    vendorHash = null;
+
+    meta = {
+      description = "Required tool for Zabbix agent integrated PostgreSQL monitoring";
+      mainProgram = "postgresql";
+      homepage = "https://www.zabbix.com/integrations/postgresql";
+      license =
+        if (lib.versions.major finalAttrs.version >= "7") then
+          lib.licenses.agpl3Only
+        else
+          lib.licenses.gpl2Plus;
+      maintainers = with lib.maintainers; [
+        gador
+        thelolcoder2007
+      ];
+      platforms = lib.platforms.linux;
+    };
+  })
+)
--- a/pkgs/servers/sql/postgresql/ext/tsja.nix
+++ b/pkgs/servers/sql/postgresql/ext/tsja.nix
@@ -24,6 +24,9 @@ stdenv.mkDerivation (finalAttrs: {
    substituteInPlace tsja.c --replace-fail /usr/local/lib/mecab ${mecab}/lib/mecab
  '';

+  strictDeps = true;
+  __structuredAttrs = true;
+
  buildInputs = [
    mecab
    postgresql
--- a/pkgs/servers/sql/postgresql/postgresqlBuildExtension.nix
+++ b/pkgs/servers/sql/postgresql/postgresqlBuildExtension.nix
@@ -89,6 +89,7 @@ lib.extendMkDerivation {
        };

      strictDeps = true;
+      __structuredAttrs = true;
      buildInputs = [ postgresql ] ++ prevAttrs.buildInputs or [ ];
      nativeBuildInputs = [ postgresql.pg_config ] ++ prevAttrs.nativeBuildInputs or [ ];

--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -2565,6 +2565,7 @@ mapAliases {
  theme-jade1 = throw "'theme-jade1' has been removed because it depended on 'gtk-engine-murrine', which was removed because it was unmaintained upstream and depended on GTK 2."; # Added 2026-07-22
  theme-obsidian2 = throw "'theme-obsidian2' has been removed because it depended on 'gtk-engine-murrine', which was removed because it was unmaintained upstream and depended on GTK 2."; # Added 2026-07-22
  theme-vertex = throw "'theme-vertex' has been removed because it depended on 'gtk-engine-murrine', which was removed because it was unmaintained upstream and depended on GTK 2."; # Added 2026-07-22
+  themes = throw "'themes' has ben removed because it was unused"; # Added 2026-09-27
  thinkingRock = throw "'thinkingRock' has been removed due to being unmaintained decades old software"; # Added 2026-02-12
  thrust = throw "'thrust' has been removed due to lack of maintenance"; # Added 2025-08-21
  thunderbird-128 = throw "Thunderbird 128 support ended in August 2025"; # Added 2025-09-30
@@ -2632,6 +2633,7 @@ mapAliases {
  uhttpmock_1_0 = warnAlias "'uhttpmock_1_0' has been renamed to 'uhttpmock'" uhttpmock; # Added 2026-05-30
  unicap = throw "'unicap' has been removed because it is unmaintained"; # Added 2025-05-17
  unifi-poller = throw "'unifi-poller' has been renamed to/replaced by 'unpoller'"; # Converted to throw 2025-10-27
+  unifiedpush-common-proxies = warnAlias "'unifiedpush-common-proxies' has been renamed to 'common-proxies'" common-proxies; # Added 2026-09-27
  unixODBC = warnAlias "'unixODBC' has been renamed to 'unixodbc'" unixodbc; # Added 2026-02-12
  unixODBCDrivers = warnAlias "'unixODBCDrivers' has been renamed to 'unixodbcDrivers'" unixodbcDrivers; # Added 2026-02-12
  unrar_6 = throw "'unrar_6' has been renamed to/replaced by 'unrar'"; # Added 2026-03-11
@@ -3144,6 +3146,7 @@ mapAliases {
  yubikey-manager-qt = throw "'yubikey-manager-qt' has been removed due to being archived upstream. Consider using 'yubioath-flutter' instead."; # Added 2025-06-07
  yubikey-personalization-gui = throw "'yubikey-personalization-gui' has been removed due to being archived upstream. Consider using 'yubioath-flutter' instead."; # Added 2025-06-07
  zabbix72 = throw "'zabbix72' was removed as it has reached its end of life"; # Added 2026-02-11
+  zabbix-agent2-plugin-postgresql = throw "'zabbix-agent2-plugin-postgresql' is moved to 'zabbix74.plugins.postgresql'"; # Added 2026-09-27
  zandronum-alpha = throw "'zandronum-alpha' has been removed as it was broken and the stable version has caught up"; # Added 2025-10-19
  zandronum-alpha-server = throw "'zandronum-alpha-server' has been removed as it was broken and the stable version has caught up"; # Added 2025-10-19
  zap-chip-gui = throw "the gui variant of zap-chip was removed as it was not really functional"; # Added 2026-05-30
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7519,6 +7519,18 @@ with pkgs;
    web = (callPackages ../servers/monitoring/zabbix/web.nix { }).${version};
    agent2 = (callPackages ../servers/monitoring/zabbix/agent2.nix { }).${version};

+    plugins = {
+      ember-plus =
+        (callPackages ../servers/monitoring/zabbix/zabbix-agent2-plugins/ember-plus.nix { }).${version};
+      mongodb =
+        (callPackages ../servers/monitoring/zabbix/zabbix-agent2-plugins/mongodb.nix { }).${version};
+      mssql = (callPackages ../servers/monitoring/zabbix/zabbix-agent2-plugins/mssql.nix { }).${version};
+      nvidia-gpu =
+        (callPackages ../servers/monitoring/zabbix/zabbix-agent2-plugins/nvidia-gpu.nix { }).${version};
+      postgresql =
+        (callPackages ../servers/monitoring/zabbix/zabbix-agent2-plugins/postgresql.nix { }).${version};
+    };
+
    # backwards compatibility
    server = server-pgsql;
  };
@@ -8202,8 +8214,6 @@ with pkgs;
    source-han-serif-vf-ttf
    ;

-  themes = name: callPackage (../data/misc/themes + ("/" + name + ".nix")) { };
-
  tex-gyre = recurseIntoAttrs (callPackages ../data/fonts/tex-gyre { });

  tex-gyre-math = recurseIntoAttrs (callPackages ../data/fonts/tex-gyre-math { });
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -534,6 +534,7 @@ mapAliases {
  pyfantom = throw "pyfantom has been removed because it does not work with python3 and has not been updated for 12 years"; # added 2025-03-25
  pyflick = throw "pyflick was removed because Flick Electric no longer exists"; # added 2025-12-03
  pyflunearyou = throw "'pyflunearyou' has been renamed to/replaced by 'pyoutbreaksnearme'"; # Converted to throw 2025-10-29
+  pyfribidi = throw "'pyfribidi' has been removed because it is unmaintained upstream"; # added 2026-09-27
  pygame_sdl2 = throw "'pygame_sdl2' has been renamed to/replaced by 'pygame-sdl2'"; # Converted to throw 2025-10-29
  PyGithub = throw "'PyGithub' has been renamed to/replaced by 'pygithub'"; # Converted to throw 2025-10-29
  pygls_2 = pygls; # added 2026-01-05
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -15012,8 +15012,6 @@ self: super: with self; {

  pyfreshr = callPackage ../development/python-modules/pyfreshr { };

-  pyfribidi = callPackage ../development/python-modules/pyfribidi { };
-
  pyfritzhome = callPackage ../development/python-modules/pyfritzhome { };

  pyfronius = callPackage ../development/python-modules/pyfronius { };