Merge staging-next-26.05 into staging-26.05

2026-10-30 16:10:36 +00:00 · 2026-10-27 00:27:31 +00:00
parent 25d19422f1 8a52d236c5
commit 47e55e1b8b
40 changed files with 636 additions and 548 deletions
--- a/ci/github-script/prepare.ts
+++ b/ci/github-script/prepare.ts
@@ -57,11 +57,10 @@ export default async ({

    if (baseClassification.type.includes('channel')) {
      const { stable, version } = baseClassification
-      const correctBranch = stable ? `release-${version}` : 'master'
      const body = [
        'The `nixos-*` and `nixpkgs-*` branches are pushed to by the channel release script and should not be merged into directly.',
        '',
-        `Please target \`${correctBranch}\` instead.`,
+        `Make sure you know the [right base branch for your changes](https://github.com/NixOS/nixpkgs/blob/master/CONTRIBUTING.md#branch-conventions), then target the correct branch (probably \`release-${stable ? version : '*'}\` or \`master\`) instead.`,
      ].join('\n')

      await postReview({ github, context, core, dry, body, reviewKey })
--- a/nixos/modules/installer/tools/tools.nix
+++ b/nixos/modules/installer/tools/tools.nix
@@ -79,7 +79,7 @@ let
        # If you prefer a stable release instead, you can change the word unstable to the latest number shown here: https://nixos.org/download
        # i.e. nixos-24.11
        # Use `nix flake update` to update the flake to the latest revision of the chosen release channel.
-        nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
+        nixpkgs.url = "https://channels.nixos.org/nixos-unstable/nixexprs.tar.zst";
      };
      outputs = inputs\@{ self, nixpkgs, ... }: {
        # NOTE: '${options.networking.hostName.default}' is the default hostname
--- a/nixos/tests/repath-studio.nix
+++ b/nixos/tests/repath-studio.nix
@@ -43,7 +43,9 @@
  # ssh -o User=root vsock%3 (can also do vsock/3, but % works with scp etc.)
  interactive.sshBackdoor.enable = true;

-  testScript = /* python */ ''
+  testScript = /* py */ ''
+    from datetime import timedelta
+
    start_all()

    machine.wait_for_x()
@@ -53,6 +55,11 @@
    machine.screenshot("Repath-Studio-GUI-Welcome")
    machine.send_key("kp_enter") # OK

+    # Wait for the home screen and create a new document
+    machine.sleep(duration=timedelta(seconds=2))
+    machine.execute("su - alice -c \"DISPLAY=:0 xdotool key ctrl+n\"")
+    machine.sleep(duration=timedelta(seconds=2))
+
    # move the mouse to the "Save" icon on the toolbar
    machine.execute("su - alice -c \"DISPLAY=:0 xdotool mousemove --sync 95 65\"")

@@ -62,13 +69,13 @@
        if status == 0:
            break
        machine.execute("su - alice -c \"DISPLAY=:0 xdotool click 1\"")
-        machine.sleep(1)
+        machine.sleep(duration=timedelta(seconds=1))

    # wait for the GTK dialog to focus the text input field
-    machine.sleep(3)
+    machine.sleep(duration=timedelta(seconds=3))
    machine.send_chars("saved.rps") # avoid using absolute path here, doesn't work for some reason
    # wait for text to be typed
-    machine.sleep(2)
+    machine.sleep(duration=timedelta(seconds=2))

    machine.execute("su - alice -c \"DISPLAY=:0 xdotool key alt+s\"") # save file
    machine.wait_until_succeeds("ls /home/alice/saved.rps")
--- a/pkgs/applications/networking/mailreaders/thunderbird-bin/release_sources.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird-bin/release_sources.nix
--- a/pkgs/applications/office/libreoffice/wrapper.nix
+++ b/pkgs/applications/office/libreoffice/wrapper.nix
@@ -100,7 +100,12 @@ let
      (lib.escapeShellArg ''
        if ! ( test -n "$DBUS_SESSION_BUS_ADDRESS" ); then
            dbus_tmp_dir="/run/user/$(id -u)/libreoffice-dbus"
-            if ! test -d "$dbus_tmp_dir" && test -d "/run"; then
+            # Sometimes /run exists but is not writeable, (like when running in
+            # a linux builder on darwin) giving
+            # `mkdir: cannot create directory '/run/user': Permission denied`
+            # instead of going to the next fallback.  Ensure we test with `-w`
+            # and not `-d`.
+            if ! test -d "$dbus_tmp_dir" && test -w "/run"; then
                    mkdir -p "$dbus_tmp_dir"
            fi
            if ! test -d "$dbus_tmp_dir"; then
--- a/pkgs/by-name/bu/buildbox/package.nix
+++ b/pkgs/by-name/bu/buildbox/package.nix
@@ -23,13 +23,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "buildbox";
-  version = "1.4.27";
+  version = "1.4.30";

  src = fetchFromGitLab {
    owner = "BuildGrid";
    repo = "buildbox/buildbox";
    tag = finalAttrs.version;
-    hash = "sha256-RXCn6xJEWEK/4cPXobIh8Ll5m1nyY+zIVxIGQMOMhnU=";
+    hash = "sha256-pga8gzFNS3b9nYTqqLxiK7QBJbtwq5dufZTsP74NsNE=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/de/deploy-rs/package.nix
+++ b/pkgs/by-name/de/deploy-rs/package.nix
@@ -5,29 +5,30 @@
  nix-update-script,
 }:

-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage (finalAttrs: {
  pname = "deploy-rs";
-  version = "0-unstable-2026-10-07";
+  version = "1.0.0";

  src = fetchFromGitHub {
    owner = "serokell";
    repo = "deploy-rs";
-    rev = "45ba3f8c5cb28396fff71671806e2550b464ac86";
-    hash = "sha256-TQiEqCAQ4bWppfeRGX4O3lwopsgsd2OvcOHTEQRRwEQ=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-i5dTwfPglZYE1zpg2IvBq+n0wDxMdrLwgHuRxZmO6Tw=";
  };

-  cargoHash = "sha256-ONGMdmkKGPJ+6KF2hkZQBefkug/C5ZEqPidKR6OkCbU=";
+  cargoHash = "sha256-bgx2aKAYtq/8A2fa8xlhSjh2Jd6Pas5rUF+IiYEoxXQ=";

  # Tests use the FSEvents API on macOS, which the darwin sandbox blocks by default
  sandboxProfile = ''
    (allow mach-lookup (global-name "com.apple.FSEvents"))
  '';

-  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+  passthru.updateScript = nix-update-script { };

  meta = {
    description = "Multi-profile Nix-flake deploy tool";
    homepage = "https://github.com/serokell/deploy-rs";
+    changelog = "https://github.com/serokell/deploy-rs/blob/${finalAttrs.src.tag}/CHANGELOG.md";
    license = lib.licenses.mpl20;
    maintainers = with lib.maintainers; [
      teutat3s
@@ -35,4 +36,4 @@ rustPlatform.buildRustPackage {
    ];
    mainProgram = "deploy";
  };
-}
+})
--- a/pkgs/by-name/op/opentelemetry-cpp/package.nix
+++ b/pkgs/by-name/op/opentelemetry-cpp/package.nix
@@ -43,7 +43,10 @@ stdenv.mkDerivation (finalAttrs: {
  ]
  ++ lib.optional stdenv.hostPlatform.isDarwin ./0002-Disable-segfaulting-test-on-Darwin.patch;

-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [
+    cmake
+  ]
+  ++ lib.optionals (enableGrpc && !stdenv.buildPlatform.canExecute stdenv.hostPlatform) [ grpc ];

  buildInputs = [
    curl
@@ -70,6 +73,7 @@ stdenv.mkDerivation (finalAttrs: {
  cmakeFlags = [
    (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
    (lib.cmakeBool "WITH_BENCHMARK" false)
+    (lib.cmakeBool "WITH_EXAMPLES" (!enableGrpc))
    (lib.cmakeBool "WITH_OTLP_HTTP" enableHttp)
    (lib.cmakeBool "WITH_OTLP_GRPC" enableGrpc)
    (lib.cmakeBool "WITH_PROMETHEUS" enablePrometheus)
@@ -111,6 +115,21 @@ stdenv.mkDerivation (finalAttrs: {
      enableElasticSearch = true;
      enableZipkin = true;
    };
+    http = opentelemetry-cpp.override {
+      enableHttp = true;
+    };
+    grpc = opentelemetry-cpp.override {
+      enableGrpc = true;
+    };
+    prometheus = opentelemetry-cpp.override {
+      enablePrometheus = true;
+    };
+    elasticSearch = opentelemetry-cpp.override {
+      enableElasticSearch = true;
+    };
+    zipkin = opentelemetry-cpp.override {
+      enableZipkin = true;
+    };
  };

  meta = {
@@ -122,7 +141,5 @@ stdenv.mkDerivation (finalAttrs: {
      panicgh
    ];
    platforms = lib.platforms.all;
-    # https://github.com/protocolbuffers/protobuf/issues/14492
-    broken = !(stdenv.buildPlatform.canExecute stdenv.hostPlatform);
  };
 })
--- a/pkgs/by-name/pe/peertube/package.nix
+++ b/pkgs/by-name/pe/peertube/package.nix
@@ -22,7 +22,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "peertube";
-  version = "8.3.1";
+  version = "8.3.2";

  __structuredAttrs = true;
  strictDeps = true;
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "Chocobozzz";
    repo = "PeerTube";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-9Arq6gvMZV+0WcHWGwFnMjtnZzW+hWPPsHkJDwMFZCM=";
+    hash = "sha256-x41ngH8fiuMm0xG/YP+qRQRWJ9bGd5vFae6aoK3j6qk=";
  };

  outputs = [
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
    inherit (finalAttrs) pname version src;
    pnpm = pnpm_10_latest;
    fetcherVersion = 3;
-    hash = "sha256-HbscF8sjgFCICJnpWopW5VWcD67XdzKOONWn+RHZThI=";
+    hash = "sha256-nGmDbJ+2ChGccC5cGJuG/Cbc/QVqH0t0S9/M/hbGY8A=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/po/podman/package.nix
+++ b/pkgs/by-name/po/podman/package.nix
@@ -42,13 +42,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "podman";
-  version = "5.8.8";
+  version = "5.8.9";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "podman";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-fl2/HyUh2EBbSw6O50H04Bltu2ZNF1Fay9XNNzKVpSE=";
+    hash = "sha256-nIWwG5QyIent0vJtEm8zDQLbqfTZmD4oKMbf2N5r2wA=";
  };

  patches = [
--- a/pkgs/by-name/re/repath-studio/0001-disable-auto-update-check.patch
+++ b/pkgs/by-name/re/repath-studio/0001-disable-auto-update-check.patch
@@ -9,28 +9,28 @@ Signed-off-by: phanirithvij <phanirithvij2000@gmail.com>
 1 file changed, 1 insertion(+), 4 deletions(-)

 diff --git a/src/electron/main.cljs b/src/electron/main.cljs
-index cdc2a5a0..e86922d6 100644
+index 4075cbb..561239c 100644
 --- a/src/electron/main.cljs
 +++ b/src/electron/main.cljs
@@ -5,7 +5,6 @@
    ["@sentry/electron/main" :as sentry-electron-main]
-    ["electron" :refer [app shell ipcMain BrowserWindow]]
+    ["electron" :refer [app shell ipcMain BrowserWindow Menu]]
    ["electron-log/main" :as log]
 -   ["electron-updater" :refer [autoUpdater]]
-    ["electron-window-state" :as window-state-keeper]
    ["os" :as os]
    ["path" :as path]
-@@ -148,9 +147,7 @@
-     (register-web-contents-events)
-     (register-ipc-on-events)
-     (register-ipc-handle-events)
-    (register-window-events)
+    ["url" :as url]
+@@ -164,9 +163,7 @@
+   (register-web-contents-events)
+   (register-ipc-on-events)
+   (register-ipc-handle-events)
+-  (register-window-events)
 -
-    (.checkForUpdatesAndNotify autoUpdater)))
-+    (register-window-events)))
+-  (.checkForUpdatesAndNotify autoUpdater))
+  (register-window-events))
 
 (defn init-loading-window! []
-   (set! (.-allowRendererProcessReuse app) false)
+   (reset! loading-window
 -- 
 2.55.0

--- a/pkgs/by-name/re/repath-studio/fix-karma-sandbox.patch
+++ b/pkgs/by-name/re/repath-studio/fix-karma-sandbox.patch
@@ -1,22 +1,29 @@
 --- a/karma.conf.js
 +++ b/karma.conf.js
-@@ -7,7 +7,7 @@
+@@ -2,13 +2,14 @@
+   var junitOutputDir = process.env.CIRCLE_TEST_REPORTS || "target/junit"
+ 
+   config.set({
+-    browserDisconnectTimeout: 10000,
+    browserDisconnectTimeout: 300000,
     customLaunchers: {
       ChromeHeadlessNoSandbox: {
         base: 'ChromeHeadless',
-        flags: ['--no-sandbox']
-+        flags: ['--no-sandbox', '--disable-dev-shm-usage']
+         flags: [
+           '--disable-gpu',
+-          '--no-sandbox'
+          '--no-sandbox',
+          '--disable-dev-shm-usage'
+         ]
       },
       CustomElectron: {
-         base: 'Electron',
-@@ -42,6 +42,10 @@
+@@ -44,6 +45,9 @@
       outputDir: junitOutputDir + '/karma', // results will be saved as outputDir/browserName.xml
       outputFile: undefined, // if included, results will be saved as outputDir/browserName/outputFile
       suite: '' // suite will become the package name attribute in xml testsuite element
 -    }
 +    },
 +
-+    browserDisconnectTimeout: 300000,
 +    browserNoActivityTimeout: 300000,
 +    pingTimeout: 300000
   })
--- a/pkgs/by-name/re/repath-studio/package.nix
+++ b/pkgs/by-name/re/repath-studio/package.nix
@@ -4,6 +4,7 @@

  buildNpmPackage,
  fetchFromGitHub,
+  runCommand,
  pkg-config,
  electron,
  chromium,
@@ -21,15 +22,49 @@

  nixosTests,
 }:
+let
+  jediSrc = fetchFromGitHub {
+    owner = "davidhalter";
+    repo = "jedi";
+    rev = "v0.19.2"; # updateScript
+    hash = "sha256-2nDQJS6LIaq91PG3Av85OMFfs1ZwId00K/kvog3PGXE=";
+    fetchSubmodules = true;
+  };
+
+  parsoSrc = fetchFromGitHub {
+    owner = "davidhalter";
+    repo = "parso";
+    rev = "v0.8.6"; # updateScript
+    hash = "sha256-SKXVU19zCYpPik8QF/r2J9V4+ygGiDPEc9Xv6qRb4dM=";
+  };
+
+  pyodideWheels =
+    runCommand "pyodide-wheels"
+      {
+        nativeBuildInputs = with python3.pkgs; [
+          build
+          flit-core
+          setuptools
+          wheel
+        ];
+      }
+      ''
+        mkdir -p $out
+        cp -r ${jediSrc} jedi && chmod -R u+w jedi
+        python -m build --wheel --no-isolation jedi --outdir $out
+        cp -r ${parsoSrc} parso && chmod -R u+w parso
+        python -m build --wheel --no-isolation parso --outdir $out
+      '';
+in
 buildNpmPackage (finalAttrs: {
  pname = "repath-studio";
-  version = "0.4.18";
+  version = "0.4.26";

  src = fetchFromGitHub {
    owner = "repath-studio";
    repo = "repath-studio";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-uHGF/SEbKZF6Ax1yrXYoAjXH5k6PzKF4aB85TXGJvk4=";
+    hash = "sha256-aLHQhhIF/GQYVO5p0Wlr8VGt71NOohRnu78tJhGvyp8=";
  };

  patches = [
@@ -39,11 +74,13 @@ buildNpmPackage (finalAttrs: {
    # checks have become flaky in nix build sandbox, increase timeout and disable dev/shm for chrome
    ./fix-karma-sandbox.patch
    ./0001-disable-auto-update-check.patch
+    # pyodide wheels are built locally from source
+    ./use-local-pyodide-wheels.patch
  ];

  makeCacheWritable = true;

-  npmDepsHash = "sha256-LBzauu5lpyfwOpnncsjPP4NpnoKqqcvX+HbK0YWNerA=";
+  npmDepsHash = "sha256-8fZjwwZuuiXYTq9NUkvcVaj+mewGfK2vaiq6z7rHoTo=";

  nativeBuildInputs = [
    finalAttrs.passthru.clojureWithHome
@@ -71,9 +108,9 @@ buildNpmPackage (finalAttrs: {
    substituteInPlace shadow-cljs.edn \
      --replace-fail ":shadow-git-inject/version" '"v${finalAttrs.version}"'

-    substituteInPlace src/renderer/shell/impl/python.cljs \
-      --replace-fail '"/pyodide/pyodide.js"' '"pyodide/pyodide.js"' \
-      --replace-fail '(js/loadPyodide)' '(js/loadPyodide #js {:indexURL "pyodide/"})'
+    mkdir -p resources/public/pyodide src/generated
+    cp ${pyodideWheels}/*.whl resources/public/pyodide/
+    chmod -R u+w resources/public/pyodide
  '';

  buildPhase = ''
@@ -175,7 +212,8 @@ buildNpmPackage (finalAttrs: {

        # -P       -> resolve all normal deps
        # -M:alias -> resolve extra-deps of the listed aliases
-        clojure -P -M:dev:cljs
+        clojure -P
+        clojure -M:dev

        runHook postBuild
      '';
@@ -213,7 +251,7 @@ buildNpmPackage (finalAttrs: {

      dontFixup = true;

-      outputHash = "sha256-0+7pPY/f7Cn+wgGZyM5gKS7g3dsL4j57oQE4GWdCpu0=";
+      outputHash = "sha256-7J1sK7fg/gBLln4KTt9q65Vt0FjCjR81vGRwhwSdw4o=";
      outputHashMode = "recursive";
      outputHashAlgo = "sha256";
    };
@@ -225,6 +263,7 @@ buildNpmPackage (finalAttrs: {
    '';

    updateScript = ./update.sh;
+    inherit jediSrc parsoSrc;
    tests = { inherit (nixosTests) repath-studio; };
  };

--- a/pkgs/by-name/re/repath-studio/pin-clojure.patch
+++ b/pkgs/by-name/re/repath-studio/pin-clojure.patch
@@ -3,7 +3,7 @@
@@ -1,5 +1,6 @@
 {:paths ["src"]
 - :deps {binaryage/devtools {:mvn/version "1.0.7"}
-+ :deps {org.clojure/clojure {:mvn/version "1.12.5"}
+ :deps {org.clojure/clojure {:mvn/version "1.12.6"}
 +        binaryage/devtools {:mvn/version "1.0.7"}
         camel-snake-kebab/camel-snake-kebab {:mvn/version "0.4.3"}
         clj-kdtree/clj-kdtree {:git/url "https://github.com/abscondment/clj-kdtree.git"
--- a/pkgs/by-name/re/repath-studio/update.sh
+++ b/pkgs/by-name/re/repath-studio/update.sh
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl jq nix-update gitMinimal diffutils gnused
+#!nix-shell -i bash -p curl jq nix-update gitMinimal diffutils gnused common-updater-scripts

 set -x
 set -eou pipefail
@@ -61,6 +61,28 @@ diff -u --label=a/deps.edn --label=b/deps.edn a/deps.edn b/deps.edn >"$PATCH_CLJ

 rm -rf a b

+# pyodide dependencies
+
+pyodide_version="$(jq -r '.devDependencies.pyodide // .dependencies.pyodide' "$src/package.json")"
+pyodide_lock="$(curl -sL "https://registry.npmjs.org/pyodide/-/pyodide-${pyodide_version}.tgz" | tar -zxOf - package/pyodide-lock.json)"
+
+update_pyodide_dep() {
+  local repo="$1"
+  local src_attr="$2"
+
+  local version
+  version="$(jq -r --arg r "$repo" '.packages[$r].version' <<<"$pyodide_lock")"
+  local current_rev
+  current_rev="$(nix-instantiate --eval -E "let pkgs = import $NIXPKGS_PATH {}; in pkgs.repath-studio.passthru.$src_attr.rev" | tr -d '"')"
+
+  if [[ -n "$version" && "$version" != "null" && "$current_rev" != "v$version" ]]; then
+    (cd "$NIXPKGS_PATH" && update-source-version repath-studio --source-key="passthru.$src_attr" --rev="v$version" --ignore-same-version)
+  fi
+}
+
+update_pyodide_dep jedi jediSrc
+update_pyodide_dep parso parsoSrc
+
 # clojure home

 dummy_hash="sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="
--- a/pkgs/by-name/re/repath-studio/use-local-pyodide-wheels.patch
+++ b/pkgs/by-name/re/repath-studio/use-local-pyodide-wheels.patch
@@ -0,0 +1,34 @@
+--- a/src/build/fetch-pyodide-wheels.mjs
+++ b/src/build/fetch-pyodide-wheels.mjs
+@@ -39,7 +39,8 @@ const wheelNames = new Set([...needed.values()].map((p) => p.file_name));
+ await mkdir(pyodideDir, { recursive: true });
+ for (const [name, pkg] of needed) {
+   const dest = path.join(pyodideDir, pkg.file_name);
+-  if (existsSync(dest) && sha256(await readFile(dest)) === pkg.sha256) {
+  if (existsSync(dest)) {
+    pkg.sha256 = sha256(await readFile(dest));
+     console.log(`up to date: ${pkg.file_name}`);
+     continue;
+   }
+@@ -57,6 +58,11 @@ for (const [name, pkg] of needed) {
+   console.log(`downloaded: ${pkg.file_name}`);
+ }
+ 
+await writeFile(
+  path.join(pyodideDir, "pyodide-lock.json"),
+  JSON.stringify(lock, null, 2)
+);
+
+ // Drop wheels left over from older pyodide versions.
+ for (const file of await readdir(pyodideDir)) {
+   if (file.endsWith(".whl") && !wheelNames.has(file)) {
+--- a/src/renderer/shell/impl/python.cljs
+++ b/src/renderer/shell/impl/python.cljs
+@@ -151,7 +151,7 @@
+ 
+ (defn load-pyodide
+   [{:keys [on-success on-error]}]
+-  (-> (js/loadPyodide)
+  (-> (js/loadPyodide #js {:indexURL "pyodide/"})
+       (.then (fn [^js pyodide]
+                (aset js/window "pyodide" pyodide)
--- a/pkgs/by-name/rs/rsyslog/package.nix
+++ b/pkgs/by-name/rs/rsyslog/package.nix
@@ -2,7 +2,6 @@
  lib,
  stdenv,
  fetchurl,
-  fetchpatch,
  pkg-config,
  autoreconfHook,
  autoconf-archive,
@@ -66,22 +65,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "rsyslog";
-  version = "8.2608.0";
+  version = "8.2610.0";

  src = fetchurl {
    url = "https://www.rsyslog.com/files/download/rsyslog/rsyslog-${finalAttrs.version}.tar.gz";
-    hash = "sha256-49YMg0BSaMQi+V/ux0BFWhzEuRHQC9hCTV0ScrxQmxo=";
+    hash = "sha256-e9+V6B6mwO5dWGNC1X0qbjlbCJ+zxnMYoNxVWBbeQEs=";
  };

-  patches = [
-    # Remove with the first rsyslog release containing this fix.
-    (fetchpatch {
-      name = "CVE-2026-78002.patch";
-      url = "https://github.com/rsyslog/rsyslog/commit/667e3f61aec5ee02c5c2ee6f0f8accf6fe4301a9.patch";
-      hash = "sha256-QsxOJCvr6VBbLbXzednwgvCfisSvNm6zfxPaMFxXVT0=";
-    })
-  ];
-
  nativeBuildInputs = [
    pkg-config
    autoreconfHook
@@ -206,10 +196,10 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    homepage = "https://www.rsyslog.com/";
    description = "Enhanced syslog implementation";
-    mainProgram = "rsyslogd";
    changelog = "https://raw.githubusercontent.com/rsyslog/rsyslog/v${finalAttrs.version}/ChangeLog";
    license = lib.licenses.gpl3Only;
    platforms = lib.platforms.linux;
    maintainers = [ ];
+    mainProgram = "rsyslogd";
  };
 })
--- a/pkgs/by-name/ru/rustls-ffi/package.nix
+++ b/pkgs/by-name/ru/rustls-ffi/package.nix
@@ -15,18 +15,18 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "rustls-ffi";
-  version = "0.15.6";
+  version = "0.15.7";

  src = fetchFromGitHub {
    owner = "rustls";
    repo = "rustls-ffi";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-qVsadtAxS+yTt9FZMszwxql0CBTuz9ofpTto1hw9Kzg=";
+    hash = "sha256-HwcK6av6LKZ34QK41izBXGrGS3p5E819yw4TUuqdHEo=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-rALR92Ia+I2axVTMVjI9UyNiiS4e6QuN5QU9JfM0UY8=";
+    hash = "sha256-kzAvxC1YAlzXJD0ku99ASJ7wbBJ3dI/d8h7VIT+vBSo=";
  };

  propagatedBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
--- a/pkgs/by-name/ve/veracrypt/package.nix
+++ b/pkgs/by-name/ve/veracrypt/package.nix
@@ -19,13 +19,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "veracrypt";
-  version = "1.26.29";
+  version = "1.26.30";

  src = fetchFromGitHub {
    owner = "veracrypt";
    repo = "VeraCrypt";
    tag = "VeraCrypt_${finalAttrs.version}";
-    hash = "sha256-Q+WUz8F63cP9/KlZUn9xLu2V9wO4FeY7AtErE1T9Km4=";
+    hash = "sha256-sjccuVsHU9C76tgRRw8Ew8scaDOT900+/7SnpqRjPRQ=";
  };

  patches = [
--- a/pkgs/by-name/vi/victoriametrics/package.nix
+++ b/pkgs/by-name/vi/victoriametrics/package.nix
@@ -15,13 +15,13 @@

 buildGo127Module (finalAttrs: {
  pname = "VictoriaMetrics";
-  version = "1.154.0";
+  version = "1.154.1";

  src = fetchFromGitHub {
    owner = "VictoriaMetrics";
    repo = "VictoriaMetrics";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-1c9hltpsAg7tHa+h0ROMql6Zc+Q2yTSULBtzf8RPlaE=";
+    hash = "sha256-PG0UTQtn1zgeoFoEG82lsrr/Bo4TRTX/UHLGrPV5tGY=";
  };

  vendorHash = null;
--- a/pkgs/development/beam-modules/build-mix.nix
+++ b/pkgs/development/beam-modules/build-mix.nix
@@ -8,6 +8,7 @@
  mixCompileHook,
  mixAppConfigPatchHook,

+  cacert,
  lib,
  stdenv,
  writeText,
@@ -86,5 +87,10 @@ lib.extendMkDerivation {
      passthru = (args.passthru or { }) // {
        inherit beamDeps;
      };
+    }
+    // lib.optionalAttrs (args.name == "castore") {
+      postPatch = (args.postPatch or "") + ''
+        cp ${cacert}/etc/ssl/certs/ca-bundle.crt priv/cacerts.pem
+      '';
    };
 }
--- a/pkgs/development/beam-modules/build-rebar3.nix
+++ b/pkgs/development/beam-modules/build-rebar3.nix
@@ -6,6 +6,7 @@
  rebar3WithPlugins,
  rebarDevendorPatchHook,

+  cacert,
  libyaml,
  openssl,

@@ -82,5 +83,10 @@ lib.extendMkDerivation {
      passthru = {
        inherit beamDeps;
      };
+    }
+    // lib.optionalAttrs (args.name == "certifi") {
+      postPatch = (args.postPatch or "") + ''
+        cp ${cacert}/etc/ssl/certs/ca-bundle.crt priv/cacerts.pem
+      '';
    };
 }
--- a/pkgs/development/beam-modules/hex/default.nix
+++ b/pkgs/development/beam-modules/hex/default.nix
@@ -1,6 +1,7 @@
 {
  lib,
  stdenv,
+  cacert,
  fetchFromGitHub,
  writeText,
  elixir,
@@ -27,6 +28,10 @@ let
        sha256 = "sha256-lOoD6mzctGk9xHNJiribDMVWQ9xrr2N5eluJalirESk=";
      };

+      postPatch = ''
+        cp ${cacert}/etc/ssl/certs/ca-bundle.crt lib/hex/http/ca-bundle.crt
+      '';
+
      setupHook = writeText "setupHook.sh" ''
        addToSearchPath ERL_LIBS "$1/lib/erlang/lib/"
      '';
--- a/pkgs/development/beam-modules/mix-release.nix
+++ b/pkgs/development/beam-modules/mix-release.nix
@@ -17,6 +17,7 @@
  gnugrep,
  gawk,
  mixBuildDirHook,
+  cacert,
 }@inputs:

 {
@@ -165,6 +166,13 @@ stdenv.mkDerivation (
        # writable, thus a copy to the $TEMPDIR is inevitable here.
        export MIX_DEPS_PATH="$TEMPDIR/deps"
        cp --no-preserve=mode -R "${mixFodDeps}" "$MIX_DEPS_PATH"
+
+        local dep
+        for dep in castore certifi; do
+          if [ -f "$MIX_DEPS_PATH/$dep/priv/cacerts.pem" ]; then
+            cp "${cacert}/etc/ssl/certs/ca-bundle.crt"  "$MIX_DEPS_PATH/$dep/priv/cacerts.pem"
+          fi
+        done
      ''}
    ''
    + (attrs.postUnpack or "");
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -565,4 +565,33 @@ in
      license = lib.licenses.asl20;
    };
  };
+
+  openssl_4_1 = common {
+    version = "4.1.0";
+    hash = "sha256-UMF7r1TLAI9s5C1Q3rSygFChqtcRY2yr1LJBx+kMwv0=";
+
+    patches = [
+      # Support for NIX_SSL_CERT_FILE, motivation:
+      # https://github.com/NixOS/nixpkgs/commit/942dbf89c6120cb5b52fb2ab456855d1fbf2994e
+      ./3.0/nix-ssl-cert-file.patch
+
+      # openssl will only compile in KTLS if the current kernel supports it.
+      # This patch disables build-time detection.
+      ./3.0/openssl-disable-kernel-detection.patch
+
+      # Look up SSL certificates in /etc rather than the immutable installation directory
+      (
+        if stdenv.hostPlatform.isDarwin then
+          ./3.5/use-etc-ssl-certs-darwin.patch
+        else
+          ./3.5/use-etc-ssl-certs.patch
+      )
+    ];
+
+    withDocs = true;
+
+    extraMeta = {
+      license = lib.licenses.asl20;
+    };
+  };
 }
--- a/pkgs/development/python-modules/pillow-heif/default.nix
+++ b/pkgs/development/python-modules/pillow-heif/default.nix
@@ -27,14 +27,14 @@

 buildPythonPackage rec {
  pname = "pillow-heif";
-  version = "1.4.0";
+  version = "1.8.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "bigcat88";
    repo = "pillow_heif";
    tag = "v${version}";
-    hash = "sha256-EaislmA4v2qKCDQ87I85Pn8IlS4VJWyNXkITipKSBC8=";
+    hash = "sha256-jDQDcKsHKCG3RJ1AlMx+XB0R1/MhT+avI7/aBo8+sFo=";
  };

  postPatch = ''
--- a/pkgs/development/tools/electron/binary/info.json
+++ b/pkgs/development/tools/electron/binary/info.json
@@ -45,34 +45,34 @@
    },
    "42": {
        "hashes": {
-            "aarch64-darwin": "15856346793e4e7f3f2200a898473379b51eda1a7aea55c6b1a326d58750bad4",
-            "aarch64-linux": "94988ccf40f739495ceb010b73b69018aeac79ba24c14fd0cd40a5ba27ff8221",
-            "armv7l-linux": "c984aefaa4ca5b07051dd45321b03fa35b5ee530e5655143f00820894b323e10",
+            "aarch64-darwin": "07bb5205c7e6c94cc1b254e0f71b9f924add59307cfe20efd5dac8e50a1a360e",
+            "aarch64-linux": "7a2325a068b39271166bc93e21996047fd82e207e603ca37fe8350347851908e",
+            "armv7l-linux": "10c007a4da8e1d70127f739771caf7ffba92d87d15c7ee305d2f0870206de762",
            "headers": "01yk8qsddgpx89lggmsn0735kjkci4fqkfv300p39qm7pd4lwgs5",
-            "x86_64-darwin": "3c509d3c2f59cfe235b81e26c3a490cb5ed07c49b88af110a84cfed5663db629",
-            "x86_64-linux": "0c8d31b8c2f2d30ffbb78cd4837e145e158971285777d67588ee2c166ecd7ed1"
+            "x86_64-darwin": "bcbb66d317979d39399a380186d5cc3104609f85f7cbc6775358858cba46ea6a",
+            "x86_64-linux": "c703693e5df41a413dd0464888bbabc8537a7000fb6d6e4f027fea0e90481a96"
        },
-        "version": "42.11.14"
+        "version": "42.11.18"
    },
    "43": {
        "hashes": {
-            "aarch64-darwin": "e60ad7fb9c030ddfb5005a6bc54712bc78c2d3e760f7f010fa5b997e956aaefa",
-            "aarch64-linux": "79e05a363b236acc16d2fe304c0a21ea3ac48885d96b6bd572446820abe06a51",
-            "armv7l-linux": "6bd149bd01cd1b0274d16dd012b7e1c323d7108a1073c1ca12474b54bd1358c4",
-            "headers": "1dfdkm72jbxylql74i8z5lznw3zlhq2kc1qizlwvjhx16l9v46kk",
-            "x86_64-darwin": "96510a54405ca2747d93af2d472483fc93d8e7a5d147bde53b9b36a3794f86bc",
-            "x86_64-linux": "37342601dc246db0269487b786856044b2476e58cdd07d00a57ac155329c5130"
+            "aarch64-darwin": "08e693ae36cfd230105aabe70c626b1a243c13534a529c35a80c1b87cb8da7b4",
+            "aarch64-linux": "b814ab22abf0bce90fd2fffc1490efc94f388353bcdb2f744950744998fd97b1",
+            "armv7l-linux": "ce65b4ba52dabe1cf8e98933d057cb656b9b9c745ac0e1c859d331bc7a5da1ae",
+            "headers": "1k3idywwl7fxqjxx7i8r5la1h6v4fvmxs4lvfwipxx59vjnmncki",
+            "x86_64-darwin": "3e16ccaed7473a763e1a8cd16e8f17e796229d2a269b9c36bfbb6d93a6ba8443",
+            "x86_64-linux": "73d7d6fe120c998db75834c23c8ce7ce8390607c198b2e167a28acd7937bef22"
        },
-        "version": "43.7.11"
+        "version": "43.8.3"
    },
    "44": {
        "hashes": {
-            "aarch64-darwin": "07d73d3d6dd0b8679c2f1849e30df179ea50c1d6b17630fcc398ae05221f0bd2",
-            "aarch64-linux": "f8ecb0702b6a0b10274d2c3043dddaa22da77addcab98e7e0b1e0d4f6c2d93e9",
-            "headers": "1qjfzgx602dpidlw8bwasi83nhq95dbyh664l5xrzikhvibc9jxx",
-            "x86_64-darwin": "915cb638692e3595926fa64903ee0562c3c0c5a1febb84724175756ca2f0f3b7",
-            "x86_64-linux": "777b26a64aee3d185acb9f93c04782bb51eae7c2c61c793963ef24374e5a1539"
+            "aarch64-darwin": "4af51382278d00291dfcda265eddd9bab6e98cebb09f46aadc8438bf606de162",
+            "aarch64-linux": "8e70d53d920d84db869023280e5a1fbda82ecc58fea4443748e58309a3c80238",
+            "headers": "0q32b3nnz6m4a58fbgrqb5riqz9kg1d58hkhfhq5nfs2fs2y9x13",
+            "x86_64-darwin": "451363b59bb7d2c1c9e0c4baa99106004eaabe724aa21a0c6b4c87469293531a",
+            "x86_64-linux": "6e7fd2d450d442507b846ace4ae6e2bd17e1b1653e86a033b5231abfc23e6df4"
        },
-        "version": "44.7.2"
+        "version": "44.9.3"
    }
 }
--- a/pkgs/development/tools/electron/chromedriver/info.json
+++ b/pkgs/development/tools/electron/chromedriver/info.json
@@ -45,34 +45,34 @@
    },
    "42": {
        "hashes": {
-            "aarch64-darwin": "df600a318802e81d7072f83406d73f2962d16f1d9731f55f44c070c30c18cd18",
-            "aarch64-linux": "e4eb2787cc32649808173daa521bf4acc2ee3cf5d8fc55ad3f8c7f88833b0db3",
-            "armv7l-linux": "31ea3acd1c7074b208c624f3cf2dade480e371140747c595631216331306a046",
+            "aarch64-darwin": "9c928bc8ea6c7fcfc66bff2fd9ae5307c705717dd13ffaa76474de0ab6aee616",
+            "aarch64-linux": "8f17afed5c1b69a48e767d868e0282f5c57d0c3fcc946fd0d98a126b52b8fc5a",
+            "armv7l-linux": "b80329d73c5cc0d76c74d1cb94f0ecb15899e525432f77af4a02a4f2c771589f",
            "headers": "01yk8qsddgpx89lggmsn0735kjkci4fqkfv300p39qm7pd4lwgs5",
-            "x86_64-darwin": "74a2e383498dadfa8708bb2403485a950d2559f71dae5bd6c2e17a359c8e6a26",
-            "x86_64-linux": "7098681887e4641a8f04011a36c4d8e7e11792f42f3bc66979feb7e657c341e5"
+            "x86_64-darwin": "399835093ea23c3c67acd37ee63923148776aeb26d2e00861e6c8bbfb4fd779b",
+            "x86_64-linux": "37977f55379613baed1275d9be9bbd325686643450ace265ebd91a0dc20ea6f1"
        },
-        "version": "42.11.14"
+        "version": "42.11.18"
    },
    "43": {
        "hashes": {
-            "aarch64-darwin": "0f4e43230f281c9518938f884dca652dfcd850b5c0950faccba83df46ec5c7bf",
-            "aarch64-linux": "c69df6e8fbb8fd545d96a33d47aec4087c01b57553cf9b08f42deac2abbd12e6",
-            "armv7l-linux": "6f05b0693ba85ecd7910bbdc9e912dbdb6c4b4b060cf0ad0ecd8b7abd560f168",
-            "headers": "1dfdkm72jbxylql74i8z5lznw3zlhq2kc1qizlwvjhx16l9v46kk",
-            "x86_64-darwin": "b9f1023e45702e75681cdeff77af88f0c738ae8fe70bdeea2eecdb5a294ed091",
-            "x86_64-linux": "2155508082d3749e924d83b649f46630c26268da0a87ed24996728d63c6646f5"
+            "aarch64-darwin": "37e278ec348a0a97b45f36f9e4a43f6b1f57c6b70baa1e91ec895cac9e912547",
+            "aarch64-linux": "929cda53a3a544cb6a3b03e75e3d0ff9f44c077be89ce0a6c66287199cd51940",
+            "armv7l-linux": "4d35c68f3015b1b12c4cd58744df2e6ca66fd6ef901a76d66f3aaf88a1207d5e",
+            "headers": "1k3idywwl7fxqjxx7i8r5la1h6v4fvmxs4lvfwipxx59vjnmncki",
+            "x86_64-darwin": "e8a913dff24d2d3f3e5039fe74ef754ea642a3320282495ec8076e702612f69c",
+            "x86_64-linux": "110d5bf9d1e03841cdc29ae5bb6f997913b02f34de4caeedddf7e2c7b20ee396"
        },
-        "version": "43.7.11"
+        "version": "43.8.3"
    },
    "44": {
        "hashes": {
-            "aarch64-darwin": "0b72483b23183ac8dd9193125d06044e999f3923f8143ff7683323cea1997040",
-            "aarch64-linux": "62127c18c542649d9052ff3205968cb0621c2da253715138737edcfcbf5c31d9",
-            "headers": "1qjfzgx602dpidlw8bwasi83nhq95dbyh664l5xrzikhvibc9jxx",
-            "x86_64-darwin": "6d8f9bf77466f1394e83bcb884f607f4432d8eb78f42c4ba68901f001fdaad11",
-            "x86_64-linux": "92e9fa4f3baf56373a2e6406113f5b478cd4c384c2c6c38d62bd5cf39d4c7e17"
+            "aarch64-darwin": "8777821e0f4d7a39efabfaedd67a2ac6167e9127b5d63ae8b497795716e8891f",
+            "aarch64-linux": "46e021041db497176ab792e4d214c92637ee44086b76e6b453a04fff28feffd5",
+            "headers": "0q32b3nnz6m4a58fbgrqb5riqz9kg1d58hkhfhq5nfs2fs2y9x13",
+            "x86_64-darwin": "25360ce0400aacbc26a7535427c166aa88485c557e0758fab8bb8606a763aa10",
+            "x86_64-linux": "3bc92381261d31254d3921a15015bde389ce65c8a1c475d7f2dcad524e13e1b0"
        },
-        "version": "44.7.2"
+        "version": "44.9.3"
    }
 }
--- a/pkgs/development/tools/electron/common.nix
+++ b/pkgs/development/tools/electron/common.nix
@@ -190,6 +190,12 @@ in
      cd third_party/node
      grep patch update_npm_deps | sh
    )
+
+    gnFlags+=' v8_version_hash_salt_files=["//electron/patches/v8/.patches"'
+    for patch in $(cat electron/patches/v8/.patches); do
+      gnFlags+=",\"//electron/patches/v8/$patch\""
+    done
+    gnFlags+=']'
  ''
  + (base.preConfigure or "");

@@ -225,6 +231,8 @@ in
    enable_linux_installer = false;
    enable_pdf_save_to_drive = false;
    node_openssl_path = "//third_party/boringssl";
+    node_v8_path = "//v8";
+    node_use_v8_platform = false;
  }
  // lib.optionalAttrs (lib.versionOlder info.version "43") {
    enterprise_cloud_content_analysis = false;
--- a/pkgs/development/tools/electron/info.json
+++ b/pkgs/development/tools/electron/info.json
@@ -56,10 +56,10 @@
            },
            "src/electron": {
                "args": {
-                    "hash": "sha256-P/zoInRtKQXlzPkyu+f4LW5rgIp/5VTY7yaQB5Jo8Ag=",
+                    "hash": "sha256-5QBlmxMu7DKPYPQxADNtjnKTxVFdXKj940Adn/sG+V4=",
                    "owner": "electron",
                    "repo": "electron",
-                    "tag": "v42.11.14"
+                    "tag": "v42.11.18"
                },
                "fetcher": "fetchFromGitHub"
            },
@@ -1367,7 +1367,7 @@
            }
        },
        "electron_yarn_data": {
-            "hash": "sha256-EIdGb0MAZeYelJujwLvjFIRjvuayq5qBu8eAfCQSG0Q=",
+            "hash": "sha256-i4bos0RAZ67kAnmqBahpZX9FmLADVnuz3p/+EFo2CVk=",
            "missing_hashes": {
                "@oxfmt/binding-android-arm-eabi@npm:0.42.0": "42c08d87ce491086843070241f8777fa2cb968f4a08f67b3f6c33a8f67e0b3eac50eae146daede743e90e3bc32326951c5188814eea02e9c3e4a9764a4b492ba",
                "@oxfmt/binding-android-arm64@npm:0.42.0": "73e6609498d05c655c6a435af9f3e4f341137c260c7ae27fbb0377573574ca5200bd9f187aa90d442879733bbd0c4e91ae023c3b4579c9a57413a0b2922c023a",
@@ -1437,7 +1437,7 @@
        },
        "modules": "146",
        "node": "24.19.0",
-        "version": "42.11.14"
+        "version": "42.11.18"
    },
    "43": {
        "chrome": "150.0.7871.250",
@@ -1504,10 +1504,10 @@
            },
            "src/electron": {
                "args": {
-                    "hash": "sha256-tB4xqttVDCRSxP1jnAXCWKWtVSrVXc+ml2FvzdJns0o=",
+                    "hash": "sha256-adUyEUqbjAEfBYxBPaeRPDtoTkwuBGMHIR6YZJ5e6qE=",
                    "owner": "electron",
                    "repo": "electron",
-                    "tag": "v43.7.11"
+                    "tag": "v43.8.3"
                },
                "fetcher": "fetchFromGitHub"
            },
@@ -1849,10 +1849,10 @@
            },
            "src/third_party/electron_node": {
                "args": {
-                    "hash": "sha256-D0Emw+F+8fz41onhxfiCQuxEQx+4jjsT7Ym2mqrKkRI=",
+                    "hash": "sha256-055FP6A2CjODxhrh2R4csRsiTNOIsxnuC9zWjTP9U34=",
                    "owner": "nodejs",
                    "repo": "node",
-                    "tag": "v24.21.0"
+                    "tag": "v24.22.0"
                },
                "fetcher": "fetchFromGitHub"
            },
@@ -1864,15 +1864,6 @@
                },
                "fetcher": "fetchFromGitiles"
            },
-            "src/third_party/engflow-reclient-configs": {
-                "args": {
-                    "hash": "sha256-aZXYPj9KYBiZnljqOLlWJWS396Fg3EhjiQLZmkwCBsY=",
-                    "owner": "EngFlow",
-                    "repo": "reclient-configs",
-                    "rev": "955335c30a752e9ef7bff375baab5e0819b6c00d"
-                },
-                "fetcher": "fetchFromGitHub"
-            },
            "src/third_party/expat/src": {
                "args": {
                    "hash": "sha256-veGg5/QjtBSmxYa8IyHF0NxEdJzlcJSZfzw8ay3ASVU=",
@@ -2823,7 +2814,7 @@
            }
        },
        "electron_yarn_data": {
-            "hash": "sha256-8r0r7WXrM4HlS2qKMHbyxS+4zet646JKjTEtSyCTqqs=",
+            "hash": "sha256-s6iBBgvQvvPN97/pSoHrZZcAyE4dWOmYtAT5Z5cQ9d8=",
            "missing_hashes": {
                "@oxfmt/binding-android-arm-eabi@npm:0.42.0": "42c08d87ce491086843070241f8777fa2cb968f4a08f67b3f6c33a8f67e0b3eac50eae146daede743e90e3bc32326951c5188814eea02e9c3e4a9764a4b492ba",
                "@oxfmt/binding-android-arm64@npm:0.42.0": "73e6609498d05c655c6a435af9f3e4f341137c260c7ae27fbb0377573574ca5200bd9f187aa90d442879733bbd0c4e91ae023c3b4579c9a57413a0b2922c023a",
@@ -2892,11 +2883,11 @@
            }
        },
        "modules": "148",
-        "node": "24.21.0",
-        "version": "43.7.11"
+        "node": "24.22.0",
+        "version": "43.8.3"
    },
    "44": {
-        "chrome": "152.0.7977.149",
+        "chrome": "152.0.7977.167",
        "chromium": {
            "deps": {
                "gn": {
@@ -2905,15 +2896,15 @@
                    "version": "0-unstable-2026-07-23"
                }
            },
-            "version": "152.0.7977.149"
+            "version": "152.0.7977.167"
        },
        "chromium_npm_hash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg=",
        "deps": {
            "src": {
                "args": {
-                    "hash": "sha256-hGjd8i2ESBREWG5lekdtEK5CVFjxT3Po7NRG1PvD3xM=",
+                    "hash": "sha256-DzIhUc7a9USmm8MCUgkDcLtb5GRs7eKzT4FlsZADmJU=",
                    "postFetch": "rm -rf $(find $out/third_party/blink/web_tests ! -name BUILD.gn -mindepth 1 -maxdepth 1); rm -r $out/content/test/data; rm -rf $out/courgette/testdata; rm -r $out/extensions/test/data; rm -r $out/media/test/data; ",
-                    "tag": "152.0.7977.149",
+                    "tag": "152.0.7977.167",
                    "url": "https://chromium.googlesource.com/chromium/src.git"
                },
                "fetcher": "fetchFromGitiles"
@@ -2960,10 +2951,10 @@
            },
            "src/electron": {
                "args": {
-                    "hash": "sha256-HkV7zfjl6BbMVowgNBtHl8DZVVSgSMjQFOn37qPxA60=",
+                    "hash": "sha256-9FaI//rjfeUeVlcqTITMiHb4Cuk7npzEggrhoJhYTrs=",
                    "owner": "electron",
                    "repo": "electron",
-                    "tag": "v44.7.2"
+                    "tag": "v44.9.3"
                },
                "fetcher": "fetchFromGitHub"
            },
@@ -2993,8 +2984,8 @@
            },
            "src/third_party/angle": {
                "args": {
-                    "hash": "sha256-YRPVefAR1xcqWJApIYb9ynGfwTtoRhhj6a6GpSIVykM=",
-                    "rev": "6c47c4b6dae794245a23a16b3826efc09ebdefd0",
+                    "hash": "sha256-RGAZFJh5IM1NYRqOPAvEX9MnA9lTTXS2ZEDPcvc7DNw=",
+                    "rev": "4f2e7d39252ed0e8387ebee1b222d4715f2dea7d",
                    "url": "https://chromium.googlesource.com/angle/angle.git"
                },
                "fetcher": "fetchFromGitiles"
@@ -3137,8 +3128,8 @@
            },
            "src/third_party/crabbyavif/src": {
                "args": {
-                    "hash": "sha256-N9YwO68d3CXPje43fWs9CoO5Sc3wIULta7n8cp+2Efs=",
-                    "rev": "61f5abadda7b179f90e557fed6ae7a3d78bd8231",
+                    "hash": "sha256-D5cYECQYGfDn4ubl9yhpK3XGq1vjzOZI5tOV8s67SuQ=",
+                    "rev": "05103ee49f6dc58dfbbaf24286dcedacffb26d6d",
                    "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git"
                },
                "fetcher": "fetchFromGitiles"
@@ -3313,10 +3304,10 @@
            },
            "src/third_party/electron_node": {
                "args": {
-                    "hash": "sha256-D0Emw+F+8fz41onhxfiCQuxEQx+4jjsT7Ym2mqrKkRI=",
+                    "hash": "sha256-055FP6A2CjODxhrh2R4csRsiTNOIsxnuC9zWjTP9U34=",
                    "owner": "nodejs",
                    "repo": "node",
-                    "tag": "v24.21.0"
+                    "tag": "v24.22.0"
                },
                "fetcher": "fetchFromGitHub"
            },
@@ -3328,15 +3319,6 @@
                },
                "fetcher": "fetchFromGitiles"
            },
-            "src/third_party/engflow-reclient-configs": {
-                "args": {
-                    "hash": "sha256-aZXYPj9KYBiZnljqOLlWJWS396Fg3EhjiQLZmkwCBsY=",
-                    "owner": "EngFlow",
-                    "repo": "reclient-configs",
-                    "rev": "955335c30a752e9ef7bff375baab5e0819b6c00d"
-                },
-                "fetcher": "fetchFromGitHub"
-            },
            "src/third_party/expat/src": {
                "args": {
                    "hash": "sha256-WAxyD34gYgQzu+t4BFaG9cktulKFsM6V+XYi8x+h9ls=",
@@ -3860,8 +3842,8 @@
            },
            "src/third_party/pdfium": {
                "args": {
-                    "hash": "sha256-4OhJcWZJ3UC/Mf4DJNzLLYQtrw0y0suO/wy0d1GYP4w=",
-                    "rev": "8f3e90282ef137adf7d380079c3178b24407104a",
+                    "hash": "sha256-X30F4eqkkY5mttzA0yKwMX/rpbrFiZDc5iigg82PrTM=",
+                    "rev": "23f70fdae651eff9740ef8c0eb31158029314f84",
                    "url": "https://pdfium.googlesource.com/pdfium.git"
                },
                "fetcher": "fetchFromGitiles"
@@ -3972,8 +3954,8 @@
            },
            "src/third_party/skia": {
                "args": {
-                    "hash": "sha256-eXQ9FXOKVzVpXjDUFdkO4e3YRcgSHDszbM2nsZDHTXw=",
-                    "rev": "f593e0fb883333745ab2c8568c1449a60904b244",
+                    "hash": "sha256-GH1yObHvyEH2rgVMRJKEG00NON1WLX8dW2w5TPf05M4=",
+                    "rev": "747cf654ed6f864f4402e7d6eb54a6ede60141e5",
                    "url": "https://skia.googlesource.com/skia.git"
                },
                "fetcher": "fetchFromGitiles"
@@ -4264,8 +4246,8 @@
            },
            "src/third_party/webrtc": {
                "args": {
-                    "hash": "sha256-c0h6bD8zNZbacnOgRei+yVB+5+AvfglW+eQDNZU945M=",
-                    "rev": "6f37672d358475cd17544121a12494da454d85fb",
+                    "hash": "sha256-SNuTzeMeu5hF6SQWDI4Y9tgbDifiPpcAlmycLko3P00=",
+                    "rev": "e1991d7f7bd00eaa701dcdd8d6786b746c623c30",
                    "url": "https://webrtc.googlesource.com/src.git"
                },
                "fetcher": "fetchFromGitiles"
@@ -4304,15 +4286,15 @@
            },
            "src/v8": {
                "args": {
-                    "hash": "sha256-Oohc8euPVyridd0SMjRd8vdsIJgrzfSYfN9LM/dtT3Y=",
-                    "rev": "55f2189ccf587e664e289e900d8ed99dfff2acfa",
+                    "hash": "sha256-cv8pAZxlSuLLCQEfVc7+/mkco8PZQqS/smSpa8VAsMo=",
+                    "rev": "a11d960c1c22c067ff898ceb4a8e4e0687014d41",
                    "url": "https://chromium.googlesource.com/v8/v8.git"
                },
                "fetcher": "fetchFromGitiles"
            }
        },
        "electron_yarn_data": {
-            "hash": "sha256-o40KUJ1YYQ9ImompIMsovGQT3kuXDKJyfZHW/k7+8mE=",
+            "hash": "sha256-uPMmYNUPFw7LC/MUr6duZYjVgcaJ2Q5DN6qO+iCqXao=",
            "missing_hashes": {
                "@oxfmt/binding-android-arm-eabi@npm:0.42.0": "42c08d87ce491086843070241f8777fa2cb968f4a08f67b3f6c33a8f67e0b3eac50eae146daede743e90e3bc32326951c5188814eea02e9c3e4a9764a4b492ba",
                "@oxfmt/binding-android-arm64@npm:0.42.0": "73e6609498d05c655c6a435af9f3e4f341137c260c7ae27fbb0377573574ca5200bd9f187aa90d442879733bbd0c4e91ae023c3b4579c9a57413a0b2922c023a",
@@ -4381,7 +4363,7 @@
            }
        },
        "modules": "149",
-        "node": "24.21.0",
-        "version": "44.7.2"
+        "node": "24.22.0",
+        "version": "44.9.3"
    }
 }
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -30,13 +30,13 @@
        "lts": true
    },
    "6.18": {
-        "version": "6.18.58",
-        "hash": "sha256:04w0h6dwm9jvwlpdbxm9887wmssxqch6ajxf960sqk9c0gwik6q6",
+        "version": "6.18.59",
+        "hash": "sha256:0qrrw85mbg2dqjkjhm3x2b8hs962wka83qxqjbi4fm9shv4mm9ak",
        "lts": true
    },
    "7.2": {
-        "version": "7.2.12",
-        "hash": "sha256:0krdl05l7y8nigrvgdjnxqzxmdppagklcr5a1jh8m5y8in54c65v",
+        "version": "7.2.13",
+        "hash": "sha256:0v7accir5bx5l7bsqmmcj29ri64sb1g4n9ysfbwp26fxyb2b1rq8",
        "lts": false
    },
    "7.3": {
--- a/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/xanmod-kernels.nix
@@ -15,14 +15,14 @@ let
  variants = {
    # ./update-xanmod.sh lts
    lts = {
-      version = "6.18.58";
-      hash = "sha256-qb/wngB9sURju6P+tq9/cyV3DpDDkRPSeBmFmTVUSJ4=";
+      version = "6.18.59";
+      hash = "sha256-ptzICfzK/yCeCCBtsCSnE11VeuKFBYb/mGqqX9zvQgA=";
      isLTS = true;
    };
    # ./update-xanmod.sh main
    main = {
-      version = "7.2.12";
-      hash = "sha256-Z+JTKbWyaD8TOfzcAnmPLRI1hIGeK/QscmnCK2GFS8s=";
+      version = "7.2.13";
+      hash = "sha256-QU+0ri/6caunv5OE9uVbIz/o03vkVT5Sp/0/jIakckw=";
    };
  };

--- a/pkgs/servers/web-apps/discourse/default.nix
+++ b/pkgs/servers/web-apps/discourse/default.nix
@@ -54,13 +54,13 @@
 }:

 let
-  version = "2026.9.0";
+  version = "2026.9.1";

  src = fetchFromGitHub {
    owner = "discourse";
    repo = "discourse";
    tag = "v${version}";
-    hash = "sha256-xOZyoDA+/UPV/art5z8lNSM7RfNejeYcZAL+JzrPk7A=";
+    hash = "sha256-j3JjLYNcv3lluoCekyUUKMfkSX/ExeDsa8zrQ+pDrwg=";
  };

  pnpm = pnpm_10_latest;
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-docs/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-docs/default.nix
@@ -9,8 +9,8 @@ mkDiscoursePlugin {
  src = fetchFromGitHub {
    owner = "discourse";
    repo = "discourse-docs";
-    rev = "89bae0e929387ed5697fd3c5eedf9b3dbe85bead";
-    sha256 = "sha256-ycDyYRi7uab4vxHY8K2kUytWBmTuFTFHYGD1AHpzC+0=";
+    rev = "5764be5b8ce440df9059f05cf6273c50f90f7905";
+    sha256 = "sha256-BXeWJuokl9FnE1wtpJZ1e1AsU2MhO65I8vkRf1nF76I=";
  };
  meta = {
    homepage = "https://github.com/discourse/discourse-docs";
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-prometheus/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-prometheus/default.nix
@@ -10,8 +10,8 @@ mkDiscoursePlugin {
  src = fetchFromGitHub {
    owner = "discourse";
    repo = "discourse-prometheus";
-    rev = "8850b2ee1acb69266f8697c3741f34cca80cad61";
-    sha256 = "sha256-7koWRb0ifMwHdtpjV6X4yTiKmK7zVCdIJlewkY5Vgzs=";
+    rev = "635f45bf06cc2fba9b5c3e1b0a06398bdd0ec718";
+    sha256 = "sha256-tEfejuJ7cBVXfSiee1kE4EWqYqBWiLtQABE2PKCbZbM=";
  };

  patches = [
--- a/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile
+++ b/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile
@@ -1,6 +1,6 @@
 # frozen_string_literal: true

-ruby "~> 3.4"
+ruby ">= 3.4", "< 4.1"

 source "https://rubygems.org"
 # if there is a super emergency and rubygems is playing up, try
@@ -73,7 +73,6 @@ gem "unf", require: false

 gem "email_reply_trimmer"

-gem "image_optim"
 gem "multi_json"
 gem "mustache"
 gem "liquid", "5.12.0"
@@ -201,7 +200,7 @@ gem "pitchfork", require: false

 # Used by discourse-prometheus to collect socket queue stats.
 # Was previously a transitive dependency of the unicorn gem.
-gem "raindrops", require: false, platform: :ruby
+gem "raindrops", git: "https://github.com/discourse/raindrops", require: false, platform: :ruby

 gem "rbtrace", require: false, platform: :mri

--- a/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
+++ b/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
@@ -1,3 +1,9 @@
+GIT
+  remote: https://github.com/discourse/raindrops
+  revision: d2ef03efc23504db76a9fd92eb35f508ac4f7546
+  specs:
+    raindrops (0.20.1)
+
 PATH
  remote: migrations/converters
  specs:
@@ -225,9 +231,8 @@ GEM
    email_reply_trimmer (0.4.0)
    erb (6.0.7)
    erubi (1.13.1)
-    excon (1.7.1)
+    excon (1.8.0)
      logger
-    exifr (1.5.1)
    extralite-bundle (3.0.1)
    fabrication (3.0.0)
    faker (3.5.3)
@@ -255,7 +260,6 @@ GEM
    fiber-local (1.1.0)
      fiber-storage
    fiber-storage (1.0.1)
-    fspath (3.1.2)
    globalid (1.4.0)
      activesupport (>= 6.1)
    goldiloader (6.0.0)
@@ -294,14 +298,6 @@ GEM
    http_accept_language (2.1.1)
    i18n (1.14.8)
      concurrent-ruby (~> 1.0)
-    image_optim (0.32.0)
-      exifr (~> 1.2, >= 1.2.2)
-      fspath (~> 3.0)
-      image_size (>= 1.5, < 4)
-      in_threads (~> 1.3)
-      progress (~> 3.0, >= 3.0.1)
-    image_size (3.6.0)
-    in_threads (1.6.0)
    inflection (1.0.0)
    io-console (0.9.2)
    irb (1.18.0)
@@ -323,7 +319,7 @@ GEM
      simpleidn (~> 0.2)
    jwt (3.2.0)
      base64
-    landlock (0.5.1)
+    landlock (0.6.0)
    language_server-protocol (3.17.0.6)
    libv8-node (24.12.0.1)
    libv8-node (24.12.0.1-aarch64-linux)
@@ -511,7 +507,6 @@ GEM
    prettier_print (1.2.1)
    prettyprint (0.2.0)
    prism (1.9.0)
-    progress (3.6.0)
    propshaft (1.3.2)
      actionpack (>= 7.0.0)
      activesupport (>= 7.0.0)
@@ -563,7 +558,6 @@ GEM
      tsort (>= 0.2)
      zeitwerk (~> 2.6)
    rainbow (3.1.1)
-    raindrops (0.20.1)
    rake (13.4.2)
    rake-compiler-dock (1.12.0)
    rb-fsevent (0.11.2)
@@ -903,7 +897,6 @@ DEPENDENCIES
  highline
  htmlentities
  http_accept_language
-  image_optim
  inflection
  iso8601
  json
@@ -964,7 +957,7 @@ DEPENDENCIES
  rails_failover
  rails_multisite
  railties (~> 8.1.0)
-  raindrops
+  raindrops!
  rake
  rb-fsevent
  rbtrace
@@ -1088,8 +1081,7 @@ CHECKSUMS
  email_reply_trimmer (0.4.0) sha256=cdb8e90649f0d3972c17392063af052e337d13902f5a33a04fac900d544f8f57
  erb (6.0.7) sha256=c5ca6dc25b0ef974a44dc8f59fe847577122483b1968a38dec305c60bf91ee92
  erubi (1.13.1) sha256=a082103b0885dbc5ecf1172fede897f9ebdb745a4b97a5e8dc63953db1ee4ad9
-  excon (1.7.1) sha256=dd2d870eece1b5ce4e4f9efd938e67a69ccd8c003c3825b638b937e1082eaac2
-  exifr (1.5.1) sha256=ad87a5dbc92946fbf1d8ccd178d557d95d9168e8b3c5c5f381ea2bffcc312521
+  excon (1.8.0) sha256=56d414519bff28bf95dd800ad4690a2fc0b8a49caf00367b70ecdbac71f91c93
  extralite-bundle (3.0.1) sha256=49b9b6d459b194b44519d80936d6a98a9e54522e34a8a725fd4e81fdb3944aac
  fabrication (3.0.0) sha256=a6a0bfad9071348ad3cb1701df788524b888c0cdd044b988893e7509f7463be3
  faker (3.5.3) sha256=b961482dc0bb15ccb9a98ea7878b925669e9ae8f5e59b607da540b768137d765
@@ -1109,7 +1101,6 @@ CHECKSUMS
  fiber-annotation (0.2.0) sha256=7abfadf1d119f508867d4103bf231c0354d019cc39a5738945dec2edadaf6c03
  fiber-local (1.1.0) sha256=c885f94f210fb9b05737de65d511136ea602e00c5105953748aa0f8793489f06
  fiber-storage (1.0.1) sha256=f48e5b6d8b0be96dac486332b55cee82240057065dc761c1ea692b2e719240e1
-  fspath (3.1.2) sha256=b5ac9bafb97e2c8f8f9e303cd98ebd484be76fe9aa588bc4d01c6d99e78c9d75
  globalid (1.4.0) sha256=037f12fbf1d9d7a014d501c2d5c77356fd4ddd96d7a7991d6700bba96706f427
  goldiloader (6.0.0) sha256=613db1b28e9964291255a67a521f04d481b6afd6b9ca56ea1a612fd86e9a89c7
  google-protobuf (4.36.1) sha256=893ac9d66b36b6ea50da5418f856bc7c2d2072099a578aeefc2d7757dcab6a77
@@ -1128,9 +1119,6 @@ CHECKSUMS
  htmlentities (4.4.2) sha256=bbafbdf69f2eca9262be4efef7e43e6a1de54c95eb600f26984f71d2fe96c5c3
  http_accept_language (2.1.1) sha256=0043f0d55a148cf45b604dbdd197cb36437133e990016c68c892d49dbea31634
  i18n (1.14.8) sha256=285778639134865c5e0f6269e0b818256017e8cde89993fdfcbfb64d088824a5
-  image_optim (0.32.0) sha256=457d5ea28ee93244c2aabc7134e06455587fb670f210e88e1be40aea882c2ba3
-  image_size (3.6.0) sha256=1b9c4196cb658bf503a887920543a3991e927a4b767a5c770fb9665bce0dcb28
-  in_threads (1.6.0) sha256=91a7e6138d279dc632f59b8a9a409e47148948e297c0f69c92f9a2479a182149
  inflection (1.0.0) sha256=ceba9b26fc28b9af82e33e822d28f78a4312af75687efec81d5ef1062498d355
  io-console (0.9.2) sha256=efa74f891dd03c0939a931dfc6e74c2813d904763d456ea9762b0525e748db08
  irb (1.18.0) sha256=de9454a0703a54704b9811a5ef31a60c86949fbf4013fcf244fabc7c775248e3
@@ -1141,7 +1129,7 @@ CHECKSUMS
  json_completer (1.2.0) sha256=4665749172634eccb208c562eb59ea81dd7a612a1fa9a36df441ac473ff177b1
  json_schemer (2.5.0) sha256=2f01fb4cce721a4e08dd068fc2030cffd0702a7f333f1ea2be6e8991f00ae396
  jwt (3.2.0) sha256=5419b1fe37b1da0982bd07051f573a8b8789ab724c2aa7e785e4784a3ed217d7
-  landlock (0.5.1) sha256=4c66c5ea238ce0fb4dbf0ea8697da3af01f396f86b34f1f5c323969bc524eba0
+  landlock (0.6.0) sha256=fb8ae70640636a170770dcd28c77a5a0e29d4edce29f9f421b6d641f02f6f3b6
  language_server-protocol (3.17.0.6) sha256=5ef2c0c138f8267e1bc631d3328347d354f96724b0af22f2c79516120443b7f0
  libv8-node (24.12.0.1) sha256=d93d23b861bfe5de3ba829e34a142402fb83b4c3592dd58d9ac4e027588d739a
  libv8-node (24.12.0.1-aarch64-linux) sha256=22bd0246cde85d70c88cf772727ac3677a20ac1d169105f82efe5f1f7c39f755
@@ -1235,7 +1223,6 @@ CHECKSUMS
  prettier_print (1.2.1) sha256=a72838b5f23facff21f90a5423cdcdda19e4271092b41f4ea7f50b83929e6ff9
  prettyprint (0.2.0) sha256=2bc9e15581a94742064a3cc8b0fb9d45aae3d03a1baa6ef80922627a0766f193
  prism (1.9.0) sha256=7b530c6a9f92c24300014919c9dcbc055bf4cdf51ec30aed099b06cd6674ef85
-  progress (3.6.0) sha256=360ed306dfa43d6174e847d563c70736dca249e2333cfec4b0387306c86cd573
  propshaft (1.3.2) sha256=1d56a3e56a92c21bfc29caf07406b5386b00d4c47ddf357cf989a5a234b1389e
  pry (0.16.0) sha256=d76c69065698ed1f85e717bd33d7942c38a50868f6b0673c636192b3d1b6054e
  pry-rails (0.3.11) sha256=a69e28e24a34d75d1f60bcf241192a54253f8f7ef8a62cba1e75750a9653593d
@@ -1254,7 +1241,7 @@ CHECKSUMS
  rails_multisite (9.0.0) sha256=2bc88f0405cb88d1055712095a11c4eb8ce1d4a36599d1226c6779946be495e6
  railties (8.1.3.1) sha256=2388a232579a00cefea4487de66c8553c3408c1300abdc6cf1799d86ffb04487
  rainbow (3.1.1) sha256=039491aa3a89f42efa1d6dec2fc4e62ede96eb6acd95e52f1ad581182b79bc6a
-  raindrops (0.20.1) sha256=aa0eb9ff6834f2d9e232ba688bd49cb30be893bc5a3452e74722c94c1fab4730
+  raindrops (0.20.1)
  rake (13.4.2) sha256=cb825b2bd5f1f8e91ca37bddb4b9aaf345551b4731da62949be002fa89283701
  rake-compiler-dock (1.12.0) sha256=f13205c2738f3d2053afcd03491a9e4541b22a59a0bfc53fc8bc883bd8188023
  rb-fsevent (0.11.2) sha256=43900b972e7301d6570f64b850a5aa67833ee7d87b458ee92805d56b7318aefe
--- a/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix
+++ b/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix
@@ -986,20 +986,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1hma5q4f2dxr72v2af1w026cv756cy797zcy9x7cxdg1xh78fbfx";
+      sha256 = "14qwz5qsrnzcf1xkc05gkjjbih1g19lx82l0vnavya7zkd8i9m2n";
      type = "gem";
    };
-    version = "1.7.1";
-  };
-  exifr = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0895676gyazah7rwbidkx1l92pfrazapilfcv3qznii9r7dsb1xd";
-      type = "gem";
-    };
-    version = "1.5.1";
+    version = "1.8.0";
  };
  extralite-bundle = {
    groups = [
@@ -1180,16 +1170,6 @@ src: {
    };
    version = "1.0.1";
  };
-  fspath = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0xcxikkrjv8ws328nn5ax5pyfjs8pn7djg1hks7qyb3yp6prpb5m";
-      type = "gem";
-    };
-    version = "3.1.2";
-  };
  globalid = {
    dependencies = [ "activesupport" ];
    groups = [ "default" ];
@@ -1330,43 +1310,6 @@ src: {
    };
    version = "1.14.8";
  };
-  image_optim = {
-    dependencies = [
-      "exifr"
-      "fspath"
-      "image_size"
-      "in_threads"
-      "progress"
-    ];
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "18rb5j4fl2p43f7fh47jf2v7yn2mckh38wdwmb148cp9isi5wza5";
-      type = "gem";
-    };
-    version = "0.32.0";
-  };
-  image_size = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0a6b1p75nrmr1xvmqykn9dx947lrld1hb4l7m01zb2v5rfb4370v";
-      type = "gem";
-    };
-    version = "3.6.0";
-  };
-  in_threads = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0j9132d4g8prjafgdh4pw948j527kr09m2lvylrcd797il9yd9wi";
-      type = "gem";
-    };
-    version = "1.6.0";
-  };
  inflection = {
    groups = [ "default" ];
    platforms = [ ];
@@ -1506,10 +1449,10 @@ src: {
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "187b4k2rp5i3qgsz2d3bz2bg60dgldynka0fpx6zpq4c4gmcarjc";
+      sha256 = "1dpkyq11yr3d3d19z7z2vi79vqm0lmvqrlnwf03ifsk3803fg2pv";
      type = "gem";
    };
-    version = "0.5.1";
+    version = "0.6.0";
  };
  language_server-protocol = {
    groups = [
@@ -2582,16 +2525,6 @@ src: {
    };
    version = "1.9.0";
  };
-  progress = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0wymdk40cwrqn32gwg1kw94s5p1n0z3n7ma7x1s62gd4vw3d63in";
-      type = "gem";
-    };
-    version = "3.6.0";
-  };
  propshaft = {
    dependencies = [
      "actionpack"
@@ -2884,9 +2817,11 @@ src: {
      }
    ];
    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0c27mcglrj928zkm4d2spj9yh2xkkka8ns5s6bidkwild3zvj3ma";
-      type = "gem";
+      fetchSubmodules = false;
+      rev = "d2ef03efc23504db76a9fd92eb35f508ac4f7546";
+      sha256 = "1i2dgxiqamkp18591pnp0xdf2ichyxax31jb11zcbvpi31wpzvf6";
+      type = "git";
+      url = "https://github.com/discourse/raindrops";
    };
    version = "0.20.1";
  };
--- a/pkgs/tools/filesystems/garage/default.nix
+++ b/pkgs/tools/filesystems/garage/default.nix
@@ -112,6 +112,7 @@ let
        knownVulnerabilities = (lib.optional eol "Garage version ${version} is EOL");
        inherit broken;
        mainProgram = "garage";
+        platforms = lib.platforms.linux;
      };
    };
 in
@@ -123,9 +124,9 @@ rec {
  };

  garage_2 = generic {
-    version = "2.4.1";
-    hash = "sha256-+3w4R0IGxc7GCVW3t7Izt6Y5PVUjxHsdLrr74ckR9Mg=";
-    cargoHash = "sha256-G928EsavtEgxugLzpBGSbo2RMHLzu9PZf9r3GqU5J3E=";
+    version = "2.5.0";
+    hash = "sha256-5jWgH+hi0Ouqszapw00KOBHFjxlV/y4T7IB22IRaEHE=";
+    cargoHash = "sha256-xk1lMNnGp4qWK7BvgdUKIvc+cR5HDw0GFfV6q64yMso=";
  };

  garage = garage_1;
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6828,6 +6828,7 @@ with pkgs;
    openssl_3_5
    openssl_3_6
    openssl_4_0
+    openssl_4_1
    ;

  # pcre32 seems unused