Merge staging-next into staging

2026-08-25 17:55:21 +00:00 · 2026-08-02 12:23:41 +00:00
parent ad9fa75920 e6738bb497
commit 55bef4e745
136 changed files with 3030 additions and 12435 deletions
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -263,15 +263,15 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /lib/licenses @alyssais @emilazy @jopejoe1

 # Qt
-/pkgs/development/libraries/qt-5 @K900 @NickCao @SuperSandro2000
-/pkgs/development/libraries/qt-6 @K900 @NickCao @SuperSandro2000
+/pkgs/development/libraries/qt-5 @NixOS/qt-kde
+/pkgs/development/libraries/qt-6 @NixOS/qt-kde

 # KDE Frameworks 5
-/pkgs/development/libraries/kde-frameworks @K900 @NickCao @SuperSandro2000
+/pkgs/development/libraries/kde-frameworks @NixOS/qt-kde

 # KDE / Plasma 6
-/pkgs/kde @K900 @NickCao @SuperSandro2000
-/maintainers/scripts/kde @K900 @NickCao @SuperSandro2000
+/pkgs/kde @NixOS/qt-kde
+/maintainers/scripts/kde @NixOS/qt-kde

 # PostgreSQL and related stuff
 /pkgs/by-name/po/postgresqlTestHook @NixOS/postgres
--- a/nixos/modules/services/networking/tinydns.nix
+++ b/nixos/modules/services/networking/tinydns.nix
@@ -58,10 +58,11 @@ with lib;
        ln -sf ${pkgs.writeText "tinydns-data" config.services.tinydns.data} data
        tinydns-data
      '';
-      script = ''
-        cd /var/lib/tinydns
-        exec ./run
-      '';
+      serviceConfig = {
+        StateDirectory = "tinydns";
+        WorkingDirectory = "/var/lib/tinydns";
+        ExecStart = "/var/lib/tinydns/run";
+      };
    };
  };
 }
--- a/nixos/modules/services/networking/toxvpn.nix
+++ b/nixos/modules/services/networking/toxvpn.nix
@@ -43,20 +43,19 @@ with lib;
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];

-      preStart = ''
-        mkdir -p /run/toxvpn || true
-        chown toxvpn /run/toxvpn
-      '';
-
-      path = [ pkgs.toxvpn ];
-
-      script = ''
-        exec toxvpn -i ${config.services.toxvpn.localip} -l /run/toxvpn/control -u toxvpn -p ${toString config.services.toxvpn.port} ${
-          lib.concatMapStringsSep " " (x: "-a ${x}") config.services.toxvpn.auto_add_peers
-        }
-      '';
-
      serviceConfig = {
+        ExecStart =
+          let
+            args = lib.cli.toCommandLineShellGNU { } {
+              i = config.services.toxvpn.localip;
+              l = "/run/toxvpn/control";
+              u = "toxvpn";
+              p = config.services.toxvpn.port;
+              a = config.services.toxvpn.auto_add_peers;
+            };
+          in
+          "${lib.getExe pkgs.toxvpn} ${args}";
+        RuntimeDirectory = "toxvpn";
        KillMode = "process";
        Restart = "on-success";
        Type = "notify";
--- a/nixos/modules/services/networking/twingate.nix
+++ b/nixos/modules/services/networking/twingate.nix
@@ -17,7 +17,7 @@ in
  config = lib.mkIf cfg.enable {
    systemd.packages = [ cfg.package ];
    systemd.services.twingate = {
-      preStart = "cp -r --update=none ${cfg.package}/etc/twingate/. /etc/twingate/";
+      serviceConfig.ExecStartPre = "${lib.getExe' pkgs.coreutils "cp"} -r --update=none ${cfg.package}/etc/twingate/. /etc/twingate/";
      wantedBy = [ "multi-user.target" ];
    };

--- a/nixos/modules/services/networking/xinetd.nix
+++ b/nixos/modules/services/networking/xinetd.nix
@@ -143,8 +143,7 @@ in
      description = "xinetd server";
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
-      path = [ pkgs.xinetd ];
-      script = "exec xinetd -syslog daemon -dontfork -stayalive -f ${configFile}";
+      serviceConfig.ExecStart = "${lib.getExe pkgs.xinetd} -syslog daemon -dontfork -stayalive -f ${configFile}";
    };
  };
 }
--- a/nixos/modules/services/networking/xray.nix
+++ b/nixos/modules/services/networking/xray.nix
@@ -93,10 +93,8 @@ with lib;
        description = "xray Daemon";
        after = [ "network.target" ];
        wantedBy = [ "multi-user.target" ];
-        script = ''
-          exec "${cfg.package}/bin/xray" -config "$CREDENTIALS_DIRECTORY/config.json"
-        '';
        serviceConfig = {
+          ExecStart = "${cfg.package}/bin/xray -config \"\${CREDENTIALS_DIRECTORY}\"/config.json";
          DynamicUser = true;
          LoadCredential = "config.json:${settingsFile}";
          CapabilityBoundingSet = "CAP_NET_ADMIN CAP_NET_BIND_SERVICE";
--- a/nixos/modules/services/networking/zerobin.nix
+++ b/nixos/modules/services/networking/zerobin.nix
@@ -91,14 +91,14 @@ in
      enable = true;
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];
+      serviceConfig.ExecStartPre = [
+        "${lib.getExe' pkgs.coreutils "mkdir"} -p ${cfg.dataDir}"
+        "${lib.getExe' pkgs.coreutils "chown"} ${cfg.user} ${cfg.dataDir}"
+      ];
      serviceConfig.ExecStart = "${pkgs.zerobin}/bin/zerobin ${cfg.listenAddress} ${toString cfg.listenPort} false ${cfg.user} ${cfg.group} ${zerobin_config}";
      serviceConfig.PrivateTmp = "yes";
      serviceConfig.User = cfg.user;
      serviceConfig.Group = cfg.group;
-      preStart = ''
-        mkdir -p ${cfg.dataDir}
-        chown ${cfg.user} ${cfg.dataDir}
-      '';
    };
  };
 }
--- a/nixos/modules/services/security/authelia.nix
+++ b/nixos/modules/services/security/authelia.nix
@@ -389,10 +389,10 @@ in
          // lib.mapAttrs (_: v: "%d/${v}") nonNullEnvSecretsMap
          // instance.environmentVariables;

-          preStart = "${execCommand} ${configArg} validate-config";
          serviceConfig = {
            User = instance.user;
            Group = instance.group;
+            ExecStartPre = "${execCommand} ${configArg} validate-config";
            ExecStart = "${execCommand} ${configArg}";
            Restart = "always";
            RestartSec = "5s";
--- a/nixos/modules/services/security/certmgr.nix
+++ b/nixos/modules/services/security/certmgr.nix
@@ -34,11 +34,6 @@ let
        [ spec ]
    ) (lib.attrValues cfg.specs)
  );
-
-  preStart = ''
-    ${lib.concatStringsSep " \\\n" ([ "mkdir -p" ] ++ map lib.escapeShellArg specPaths)}
-    ${cfg.package}/bin/certmgr -f ${certmgrYaml} check
-  '';
 in
 {
  options.services.certmgr = {
@@ -215,11 +210,14 @@ in
      wants = [ "network-online.target" ];
      after = [ "network-online.target" ];
      wantedBy = [ "multi-user.target" ];
-      inherit preStart;

      serviceConfig = {
        Restart = "always";
        RestartSec = "10s";
+        ExecStartPre = [
+          "${lib.getExe' pkgs.coreutils "mkdir"} -p ${lib.escapeShellArgs specPaths}"
+          "${lib.getExe cfg.package} -f ${certmgrYaml} check"
+        ];
        ExecStart = "${cfg.package}/bin/certmgr -f ${certmgrYaml}";
      };
    };
--- a/nixos/modules/services/security/hologram-agent.nix
+++ b/nixos/modules/services/security/hologram-agent.nix
@@ -55,10 +55,8 @@ in
        "network-link-dummy0.service"
        "network-addresses-dummy0.service"
      ];
-      preStart = ''
-        /run/current-system/sw/bin/rm -fv /run/hologram.sock
-      '';
      serviceConfig = {
+        ExecStartPre = "/run/current-system/sw/bin/rm -fv /run/hologram.sock";
        ExecStart = "${pkgs.hologram}/bin/hologram-agent -debug -conf ${cfgFile} -port ${cfg.httpPort}";
      };
    };
--- a/nixos/modules/services/web-apps/bluemap.nix
+++ b/nixos/modules/services/web-apps/bluemap.nix
@@ -298,10 +298,8 @@ in
        Type = "oneshot";
        Group = "nginx";
        UMask = "026";
+        ExecStart = "${lib.getExe pkgs.bluemap} -c ${configFolder} -gs -r";
      };
-      script = ''
-        ${lib.getExe pkgs.bluemap} -c ${configFolder} -gs -r
-      '';
    };

    systemd.timers."render-bluemap-maps" = lib.mkIf cfg.enableRender {
--- a/nixos/modules/services/web-apps/cloudlog.nix
+++ b/nixos/modules/services/web-apps/cloudlog.nix
@@ -380,37 +380,44 @@ in
        cloudlog-upload-lotw = {
          description = "Upload QSOs to LoTW if certs have been provided";
          enable = cfg.upload-lotw.enable;
-          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/lotw/lotw_upload";
+          serviceConfig.ExecStart = "${lib.getExe pkgs.curl} -s ${cfg.baseUrl}/lotw/lotw_upload";
+          serviceConfig.Type = "oneshot";
        };
        cloudlog-update-lotw-users = {
          description = "Update LOTW Users Database";
          enable = cfg.update-lotw-users.enable;
-          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/lotw/load_users";
+          serviceConfig.ExecStart = "${lib.getExe pkgs.curl} -s ${cfg.baseUrl}/lotw/load_users";
+          serviceConfig.Type = "oneshot";
        };
        cloudlog-update-dok = {
          description = "Update DOK File for autocomplete";
          enable = cfg.update-dok.enable;
-          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/update/update_dok";
+          serviceConfig.ExecStart = "${lib.getExe pkgs.curl} -s ${cfg.baseUrl}/update/update_dok";
+          serviceConfig.Type = "oneshot";
        };
        cloudlog-update-clublog-scp = {
          description = "Update Clublog SCP Database File";
          enable = cfg.update-clublog-scp.enable;
-          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/update/update_clublog_scp";
+          serviceConfig.ExecStart = "${lib.getExe pkgs.curl} -s ${cfg.baseUrl}/update/update_clublog_scp";
+          serviceConfig.Type = "oneshot";
        };
        cloudlog-update-wwff = {
          description = "Update WWFF File for autocomplete";
          enable = cfg.update-wwff.enable;
-          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/update/update_wwff";
+          serviceConfig.ExecStart = "${lib.getExe pkgs.curl} -s ${cfg.baseUrl}/update/update_wwff";
+          serviceConfig.Type = "oneshot";
        };
        cloudlog-upload-qrz = {
          description = "Upload QSOs to QRZ Logbook";
          enable = cfg.upload-qrz.enable;
-          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/qrz/upload";
+          serviceConfig.ExecStart = "${lib.getExe pkgs.curl} -s ${cfg.baseUrl}/qrz/upload";
+          serviceConfig.Type = "oneshot";
        };
        cloudlog-update-sota = {
          description = "Update SOTA File for autocomplete";
          enable = cfg.update-sota.enable;
-          script = "${pkgs.curl}/bin/curl -s ${cfg.baseUrl}/update/update_sota";
+          serviceConfig.ExecStart = "${lib.getExe pkgs.curl} -s ${cfg.baseUrl}/update/update_sota";
+          serviceConfig.Type = "oneshot";
        };
      };
      timers = {
--- a/nixos/modules/services/web-apps/galene.nix
+++ b/nixos/modules/services/web-apps/galene.nix
@@ -133,19 +133,16 @@ in
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];

-      preStart = ''
-        ${optionalString (cfg.insecure != true && cfg.certFile != null && cfg.keyFile != null) ''
-          install -m 700 -o '${cfg.user}' -g '${cfg.group}' ${cfg.certFile} ${cfg.dataDir}/cert.pem
-          install -m 700 -o '${cfg.user}' -g '${cfg.group}' ${cfg.keyFile} ${cfg.dataDir}/key.pem
-        ''}
-      '';
-
      serviceConfig = mkMerge [
        {
          Type = "simple";
          User = cfg.user;
          Group = cfg.group;
          WorkingDirectory = cfg.stateDir;
+          ExecStartPre = lib.mkIf (cfg.insecure != true && cfg.certFile != null && cfg.keyFile != null) [
+            "${lib.getExe' pkgs.coreutils "install"} -m 700 -o '${cfg.user}' -g '${cfg.group}' ${cfg.certFile} ${cfg.dataDir}/cert.pem"
+            "${lib.getExe' pkgs.coreutils "install"} -m 700 -o '${cfg.user}' -g '${cfg.group}' ${cfg.keyFile} ${cfg.dataDir}/key.pem"
+          ];
          ExecStart = ''
            ${cfg.package}/bin/galene \
            ${optionalString (cfg.insecure) "-insecure"} \
--- a/nixos/modules/services/web-apps/glitchtip.nix
+++ b/nixos/modules/services/web-apps/glitchtip.nix
@@ -280,13 +280,12 @@ in
          bindsTo = [ "glitchtip-worker.service" ];
          before = [ "glitchtip-worker.service" ];

-          preStart = ''
-            ${lib.getExe pkg} migrate
-            ${lib.getExe pkg} createcachetable
-            ${lib.getExe pkg} maintain_partitions
-          '';
-
          serviceConfig = commonServiceConfig // {
+            ExecStartPre = [
+              "${lib.getExe pkg} migrate"
+              "${lib.getExe pkg} createcachetable"
+              "${lib.getExe pkg} maintain_partitions"
+            ];
            ExecStart = ''
              ${lib.getExe python.pkgs.granian} \
                --interface ${if cfg.settings.GLITCHTIP_ENABLE_MCP then "asgi" else "asginl"} \
--- a/nixos/modules/services/web-apps/healthchecks.nix
+++ b/nixos/modules/services/web-apps/healthchecks.nix
@@ -237,14 +237,13 @@ in
          wantedBy = [ "healthchecks.target" ];
          after = [ "healthchecks-migration.service" ];

-          preStart = ''
-            ${pkg}/opt/healthchecks/manage.py collectstatic --no-input
-            ${pkg}/opt/healthchecks/manage.py remove_stale_contenttypes --no-input
-          ''
-          + lib.optionalString (cfg.settings.DEBUG != "True") "${pkg}/opt/healthchecks/manage.py compress";
-
          serviceConfig = commonConfig // {
            Restart = "always";
+            ExecStartPre = [
+              "${pkg}/opt/healthchecks/manage.py collectstatic --no-input"
+              "${pkg}/opt/healthchecks/manage.py remove_stale_contenttypes --no-input"
+            ]
+            ++ lib.optionals (cfg.settings.DEBUG != "True") [ "${pkg}/opt/healthchecks/manage.py compress" ];
            ExecStart = ''
              ${pkgs.python3Packages.gunicorn}/bin/gunicorn hc.wsgi \
                --bind ${cfg.listenAddress}:${toString cfg.port} \
--- a/nixos/modules/services/web-apps/mediagoblin.nix
+++ b/nixos/modules/services/web-apps/mediagoblin.nix
@@ -310,19 +310,6 @@ in
      in
      {
        mediagoblin-celeryd = lib.recursiveUpdate serviceDefaults {
-          # we cannot change DEFAULT.data_dir inside mediagoblin.ini because of an annoying bug
-          # https://todo.sr.ht/~mediagoblin/mediagoblin/57
-          preStart = ''
-            cp --remove-destination ${
-              pkgs.writeText "mediagoblin.ini" (
-                lib.generators.toINI { } (lib.filterAttrsRecursive (n: v: n != "plugins") cfg.settings)
-                + "\n"
-                + lib.generators.toINI { mkKeyValue = mkSubSectionKeyValue 2; } {
-                  inherit (cfg.settings.mediagoblin) plugins;
-                }
-              )
-            } /var/lib/mediagoblin/mediagoblin.ini
-          '';
          serviceConfig = {
            Environment = [
              "CELERY_CONFIG_MODULE=mediagoblin.init.celery.from_celery"
@@ -331,6 +318,19 @@ in
              "MEDIAGOBLIN_CONFIG=/var/lib/mediagoblin/mediagoblin.ini"
              "PASTE_CONFIG=${pasteConfig}"
            ];
+            # we cannot change DEFAULT.data_dir inside mediagoblin.ini because of an annoying bug
+            # https://todo.sr.ht/~mediagoblin/mediagoblin/57
+            ExecStartPre = ''
+              ${lib.getExe' pkgs.coreutils "cp"} --remove-destination ${
+                pkgs.writeText "mediagoblin.ini" (
+                  lib.generators.toINI { } (lib.filterAttrsRecursive (n: v: n != "plugins") cfg.settings)
+                  + "\n"
+                  + lib.generators.toINI { mkKeyValue = mkSubSectionKeyValue 2; } {
+                    inherit (cfg.settings.mediagoblin) plugins;
+                  }
+                )
+              } /var/lib/mediagoblin/mediagoblin.ini
+            '';
            ExecStart = "${lib.getExe' finalPackage "celery"} worker --loglevel=INFO";
          };
          unitConfig.Description = "MediaGoblin Celery";
@@ -345,16 +345,16 @@ in
            "mediagoblin-celeryd.service"
            "postgresql.target"
          ];
-          preStart = ''
-            cp --remove-destination ${pasteConfig} /var/lib/mediagoblin/paste.ini
-            ${lib.getExe' finalPackage "gmg"} dbupdate
-          '';
          serviceConfig = {
            Environment = [
              "CELERY_ALWAYS_EAGER=false"
              "GI_TYPELIB_PATH=${GI_TYPELIB_PATH}"
              "GST_PLUGIN_PATH=${GST_PLUGIN_PATH}"
            ];
+            ExecStartPre = [
+              "${lib.getExe' pkgs.coreutils "cp"} --remove-destination ${pasteConfig} /var/lib/mediagoblin/paste.ini"
+              "${lib.getExe' finalPackage "gmg"} dbupdate"
+            ];
            ExecStart = "${lib.getExe' finalPackage "paster"} serve /var/lib/mediagoblin/paste.ini";
          };
          unitConfig.Description = "Mediagoblin";
--- a/nixos/modules/services/web-apps/miniflux.nix
+++ b/nixos/modules/services/web-apps/miniflux.nix
@@ -17,14 +17,6 @@ let
  cfg = config.services.miniflux;

  boolToInt = b: if b then 1 else 0;
-
-  pgbin = "${config.services.postgresql.package}/bin";
-  # The hstore extension is no longer needed as of v2.2.14
-  # and would prevent Miniflux from starting.
-  preStart = pkgs.writeScript "miniflux-pre-start" ''
-    #!${pkgs.runtimeShell}
-    ${pgbin}/psql "miniflux" -c "DROP EXTENSION IF EXISTS hstore"
-  '';
 in

 {
@@ -142,7 +134,9 @@ in
      serviceConfig = {
        Type = "oneshot";
        User = config.services.postgresql.superUser;
-        ExecStart = preStart;
+        # The hstore extension is no longer needed as of v2.2.14
+        # and would prevent Miniflux from starting.
+        ExecStart = ''${config.services.postgresql.package}/bin/psql "miniflux" -c "DROP EXTENSION IF EXISTS hstore"'';
      };
    };

--- a/nixos/modules/services/web-apps/misskey.nix
+++ b/nixos/modules/services/web-apps/misskey.nix
@@ -326,22 +326,22 @@ in
      environment = {
        MISSKEY_CONFIG_YML = "/run/misskey/default.yml";
      };
-      preStart = ''
-        install -m 700 ${settingsFormat.generate "misskey-config.yml" cfg.settings} /run/misskey/default.yml
-        install -m 700 ${
-          (pkgs.formats.json { }).generate "misskey-config.json" cfg.settings
-        } /run/misskey/default.json
-      ''
-      + (lib.optionalString (cfg.database.passwordFile != null) ''
-        ${pkgs.replace-secret}/bin/replace-secret '@DATABASE_PASSWORD@' "${cfg.database.passwordFile}" /run/misskey/default.yml
-      '')
-      + (lib.optionalString (cfg.redis.passwordFile != null) ''
-        ${pkgs.replace-secret}/bin/replace-secret '@REDIS_PASSWORD@' "${cfg.redis.passwordFile}" /run/misskey/default.yml
-      '')
-      + (lib.optionalString (cfg.meilisearch.keyFile != null) ''
-        ${pkgs.replace-secret}/bin/replace-secret '@MEILISEARCH_KEY@' "${cfg.meilisearch.keyFile}" /run/misskey/default.yml
-      '');
      serviceConfig = {
+        ExecStartPre = [
+          "${lib.getExe' pkgs.coreutils "install"} -m 700 ${settingsFormat.generate "misskey-config.yml" cfg.settings} /run/misskey/default.yml"
+          "${lib.getExe' pkgs.coreutils "install"} -m 700 ${
+            (pkgs.formats.json { }).generate "misskey-config.json" cfg.settings
+          } /run/misskey/default.json"
+        ]
+        ++ (lib.optionals (cfg.database.passwordFile != null) [
+          "${lib.getExe pkgs.replace-secret} '@DATABASE_PASSWORD@' '${cfg.database.passwordFile}' /run/misskey/default.yml"
+        ])
+        ++ (lib.optionals (cfg.redis.passwordFile != null) [
+          "${lib.getExe pkgs.replace-secret} '@REDIS_PASSWORD@' '${cfg.redis.passwordFile}' /run/misskey/default.yml"
+        ])
+        ++ (lib.optionals (cfg.meilisearch.keyFile != null) [
+          "${lib.getExe pkgs.replace-secret} '@MEILISEARCH_KEY@' '${cfg.meilisearch.keyFile}' /run/misskey/default.yml"
+        ]);
        ExecStart = "${cfg.package}/bin/misskey migrateandstart";
        RuntimeDirectory = "misskey";
        RuntimeDirectoryMode = "700";
--- a/nixos/modules/services/web-apps/nexus.nix
+++ b/nixos/modules/services/web-apps/nexus.nix
@@ -142,9 +142,8 @@ in
        fi
      '';

-      script = "${cfg.package}/bin/nexus run";
-
      serviceConfig = {
+        ExecStart = "${cfg.package}/bin/nexus run";
        User = cfg.user;
        Group = cfg.group;
        PrivateTmp = true;
--- a/nixos/modules/services/web-apps/part-db.nix
+++ b/nixos/modules/services/web-apps/part-db.nix
@@ -257,6 +257,7 @@ in
          ];
          wantedBy = [ "multi-user.target" ];
          serviceConfig = {
+            ExecStart = "${lib.getExe cfg.phpPackage} ${lib.getExe' cfg.package "console"} doctrine:migrations:migrate --no-interaction";
            Type = "oneshot";
            RemainAfterExit = true;
            User = "part-db";
@@ -264,10 +265,6 @@ in
          restartTriggers = [
            cfg.package
          ];
-          script = ''
-            set -euo pipefail
-            ${lib.getExe cfg.phpPackage} ${lib.getExe' cfg.package "console"} doctrine:migrations:migrate --no-interaction
-          '';
        };

        phpfpm-part-db = {
--- a/nixos/modules/services/web-apps/peering-manager.nix
+++ b/nixos/modules/services/web-apps/peering-manager.nix
@@ -307,11 +307,8 @@ in
          ]
          ++ lib.optionals (cfg.environmentFile != null) [ "peering-manager-config.service" ];

-          preStart = ''
-            ${pkg}/bin/peering-manager remove_stale_contenttypes --no-input
-          '';
-
          serviceConfig = {
+            ExecStartPre = "${pkg}/bin/peering-manager remove_stale_contenttypes --no-input";
            ExecStart = ''
              ${pkg.python.pkgs.gunicorn}/bin/gunicorn peering_manager.wsgi \
                --bind ${cfg.listenAddress}:${toString cfg.port} \
--- a/nixos/modules/services/web-apps/silverbullet.nix
+++ b/nixos/modules/services/web-apps/silverbullet.nix
@@ -95,7 +95,6 @@ in
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];

-      preStart = lib.mkIf (!lib.hasPrefix "/var/lib/" cfg.spaceDir) "mkdir -p '${cfg.spaceDir}'";
      serviceConfig = {
        Type = "simple";
        User = "${cfg.user}";
@@ -104,6 +103,9 @@ in
        StateDirectory = lib.mkIf (lib.hasPrefix "/var/lib/" cfg.spaceDir) (
          lib.last (lib.splitString "/" cfg.spaceDir)
        );
+        ExecStartPre = lib.mkIf (
+          !lib.hasPrefix "/var/lib/" cfg.spaceDir
+        ) "${lib.getExe' pkgs.coreutils "mkdir"} -p '${cfg.spaceDir}'";
        ExecStart =
          "${lib.getExe cfg.package} --port ${toString cfg.listenPort} --hostname '${cfg.listenAddress}' '${cfg.spaceDir}' "
          + lib.concatStringsSep " " cfg.extraArgs;
--- a/nixos/modules/services/web-apps/wakapi.nix
+++ b/nixos/modules/services/web-apps/wakapi.nix
@@ -144,13 +144,11 @@ in
      ++ optional (cfg.database.dialect == "postgres") "postgresql.target";
      wantedBy = [ "multi-user.target" ];

-      script = ''
-        exec ${getExe cfg.package} -config ${settingsFile}
-      '';
-
      serviceConfig = {
        EnvironmentFile = cfg.environmentFiles;

+        ExecStart = "${getExe cfg.package} -config ${settingsFile}";
+
        User = config.users.users.wakapi.name;
        Group = config.users.users.wakapi.group;

--- a/nixos/modules/services/web-servers/h2o/default.nix
+++ b/nixos/modules/services/web-servers/h2o/default.nix
@@ -443,6 +443,7 @@ in
      ++ map (certName: "acme-${certName}.service") acmeCertNames.all;

      serviceConfig = {
+        ExecStartPre = "${h2oExe} --mode 'test'";
        ExecStart = "${h2oExe} --mode 'master'";
        ExecReload = [
          "${h2oExe} --mode 'test'"
@@ -483,8 +484,6 @@ in
        AmbientCapabilities = [ "CAP_NET_BIND_SERVICE" ];
        CapabilitiesBoundingSet = [ "CAP_NET_BIND_SERVICE" ];
      };
-
-      preStart = "${h2oExe} --mode 'test'";
    };

    # This service waits for all certificates to be available before reloading
--- a/nixos/modules/services/web-servers/jboss/default.nix
+++ b/nixos/modules/services/web-servers/jboss/default.nix
@@ -93,7 +93,7 @@ in
  config = mkIf config.services.jboss.enable {
    systemd.services.jboss = {
      description = "JBoss server";
-      script = "${jbossService}/bin/control start";
+      serviceConfig.ExecStart = "${jbossService}/bin/control start";
      wantedBy = [ "multi-user.target" ];
    };
  };
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -4439,12 +4439,12 @@ final: prev: {
    pname = "d2-vim";
    version = "0-unstable-2025-08-19";
    src = fetchFromGitHub {
-      owner = "terrastruct";
+      owner = "d2lang";
      repo = "d2-vim";
      rev = "cb3eb7fcb1a2d45c4304bf2e91077d787b724a39";
      hash = "sha256-HmDQfOIoSV93wqRe7O4FPuHEmAxwoP1+Ut+sKhB62jA=";
    };
-    meta.homepage = "https://github.com/terrastruct/d2-vim/";
+    meta.homepage = "https://github.com/d2lang/d2-vim/";
    meta.license = getLicenseFromSpdxId "BSD-3-Clause";
    meta.hydraPlatforms = [ ];
  };
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -315,7 +315,7 @@ https://github.com/ctrlpvim/ctrlp.vim/,,
 https://github.com/gbprod/cutlass.nvim/,,
 https://github.com/scottmckendry/cyberdream.nvim/,,
 https://github.com/ghillb/cybu.nvim/,,
-https://github.com/terrastruct/d2-vim/,,
+https://github.com/d2lang/d2-vim/,,
 https://github.com/JachymPutta/dailies.nvim/,,
 https://github.com/Koalhack/darcubox-nvim/,,
 https://github.com/ptdewey/darkearth-nvim/,,
--- a/pkgs/by-name/bi/bird2/package.nix
+++ b/pkgs/by-name/bi/bird2/package.nix
@@ -12,14 +12,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bird";
-  version = "2.19.1";
+  version = "2.19.2";

  src = fetchFromGitLab {
    domain = "gitlab.nic.cz";
    owner = "labs";
    repo = "bird";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-8D83U9IgNQ0HDWk2WSQsRsy82bDmjkgectkCOXy2RyI=";
+    hash = "sha256-5C7hVUWy5QOD2r0Qcu2b2j+xxRek8NsYoWgeRm2Exis=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/bi/bird3/package.nix
+++ b/pkgs/by-name/bi/bird3/package.nix
@@ -12,14 +12,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bird";
-  version = "3.3.1";
+  version = "3.3.2";

  src = fetchFromGitLab {
    domain = "gitlab.nic.cz";
    owner = "labs";
    repo = "bird";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-aJo6Ut/ULBDGoekSXgN1WvmFmonTzNA3TES1FHqCiOM=";
+    hash = "sha256-qrzi8uYZiohpIRosdPQXxnDu6fP3V9i8PPo8BV8XTZI=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ce/cedar/package.nix
+++ b/pkgs/by-name/ce/cedar/package.nix
@@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cedar";
-  version = "4.11.2";
+  version = "4.12.0";

  src = fetchFromGitHub {
    owner = "cedar-policy";
    repo = "cedar";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-pJiSnaq2oz1uZVkLp9s2HLPdG2sZ0EtURlO8R2V+dJs=";
+    hash = "sha256-BU0D5VGHt2S9iWVFtBbgCBRKvnhn2YnvrKH38UazmhY=";
  };

-  cargoHash = "sha256-6AtFdE7vXoevOU3uWP4sgibakNHK8ffnuWCzJxFt/wo=";
+  cargoHash = "sha256-fQ8oPE3fpHh61lhsaXyMpd70/nmdKFHrcKfQ/1Ih1uE=";

  cargoBuildFlags = [
    "--bin"
--- a/pkgs/by-name/co/copilot-language-server/package.nix
+++ b/pkgs/by-name/co/copilot-language-server/package.nix
@@ -10,11 +10,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "copilot-language-server";
-  version = "1.526.0";
+  version = "1.527.1";

  src = fetchzip {
    url = "https://github.com/github/copilot-language-server-release/releases/download/${finalAttrs.version}/copilot-language-server-js-${finalAttrs.version}.zip";
-    hash = "sha256-T1DYN/mVqISYtNGD1KBitXPgEIcrKQMqxquC7CywDo4=";
+    hash = "sha256-RLcfAld0vJYyE6ndqwkFqfJNNWD/PmoNQy8NWDRBa6g=";
    stripRoot = false;
  };

--- a/pkgs/by-name/cr/crush/package.nix
+++ b/pkgs/by-name/cr/crush/package.nix
@@ -11,16 +11,16 @@

 buildGo126Module (finalAttrs: {
  pname = "crush";
-  version = "0.86.0";
+  version = "0.88.0";

  src = fetchFromGitHub {
    owner = "charmbracelet";
    repo = "crush";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-dUeXU65A9/d365a9Z+eUoHOR0RnJV9SAYsks+Vtz9js=";
+    hash = "sha256-5yfYpjwfQtioSTnpO9VIv4+V7A+Hrv6X/LItfbyw2i4=";
  };

-  vendorHash = "sha256-9WkkosPMwXsj32a5Zj4ZxphuB7aVteKq/YTzxP9Xmf0=";
+  vendorHash = "sha256-qXR+z31tZ3FWclBUWkBF0k/F463iKSGZ6dCgJMBcWi8=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/d2/d2/package.nix
+++ b/pkgs/by-name/d2/d2/package.nix
@@ -23,7 +23,7 @@ buildGoModule (finalAttrs: {
  version = "0.7.1";

  src = fetchFromGitHub {
-    owner = "terrastruct";
+    owner = "d2lang";
    repo = "d2";
    tag = "v${finalAttrs.version}";
    hash = "sha256-ZRAvMcJKQmvcBbT2foKDYS0gTeqOZqFu3V3iXIbfLsQ=";
@@ -62,7 +62,7 @@ buildGoModule (finalAttrs: {
  '';

  preCheck = ''
-    # See https://github.com/terrastruct/d2/blob/master/docs/CONTRIBUTING.md#running-tests.
+    # See https://github.com/d2lang/d2/blob/master/docs/CONTRIBUTING.md#running-tests.
    export TESTDATA_ACCEPT=1
  '';

@@ -75,7 +75,7 @@ buildGoModule (finalAttrs: {
    description = "Modern diagram scripting language that turns text to diagrams";
    mainProgram = "d2";
    homepage = "https://d2lang.com";
-    changelog = "https://github.com/terrastruct/d2/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/d2lang/d2/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.mpl20;
    maintainers = with lib.maintainers; [
      kashw2
--- a/pkgs/by-name/dc/dcp/package.nix
+++ b/pkgs/by-name/dc/dcp/package.nix
@@ -15,16 +15,16 @@

 buildGoModule (finalAttrs: {
  pname = "dcp";
-  version = "0.25.9";
+  version = "0.25.10";

  src = fetchFromGitHub {
    owner = "microsoft";
    repo = "dcp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-MjBnJRdlGF2efEH0TcJjM3JVEByRzeqAZ13sR9EL0Ik=";
+    hash = "sha256-29LPAR5TbWfFP24eQjFg01vt6gCOUrzNarrczd1UVoo=";
  };

-  vendorHash = "sha256-eJAMl1vGX2JANdYe8SWWLsNImd3raEEYvSfvwwfV4Xk=";
+  vendorHash = "sha256-WBre4iBMYzx1unqz9+F1wDogYbPEsm3DyUgeceB8yko=";

  # This is required so we:
  # - Delete an inconsistent vendor directory from upstream
--- a/pkgs/by-name/ex/exo/package.nix
+++ b/pkgs/by-name/ex/exo/package.nix
@@ -29,8 +29,12 @@ let

  pyo3-bindings = python3Packages.buildPythonPackage (finalAttrs: {
    pname = "exo-pyo3-bindings";
-    inherit version src;
+    # Check version in
+    # https://github.com/exo-explore/exo/blob/v<EXO_VERSION>/rust/exo_pyo3_bindings/pyproject.toml
+    version = "0.2.1";
+    inherit src;
    pyproject = true;
+    __structuredAttrs = true;

    buildAndTestSubdir = "rust/exo_pyo3_bindings";

@@ -54,6 +58,7 @@ let
  dashboard = buildNpmPackage (finalAttrs: {
    pname = "exo-dashboard";
    inherit src version;
+    __structuredAttrs = true;

    sourceRoot = "${finalAttrs.src.name}/dashboard";
    npmDepsFetcherVersion = 3;
@@ -73,6 +78,7 @@ in
 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "exo";
  pyproject = true;
+  __structuredAttrs = true;

  inherit version src;

--- a/pkgs/by-name/gn/gnss-sdr/package.nix
+++ b/pkgs/by-name/gn/gnss-sdr/package.nix
@@ -25,13 +25,13 @@

 gnuradio.pkgs.mkDerivation rec {
  pname = "gnss-sdr";
-  version = "0.0.20";
+  version = "0.0.21";

  src = fetchFromGitHub {
    owner = "gnss-sdr";
    repo = "gnss-sdr";
    rev = "v${version}";
-    hash = "sha256-kQv8I4dcWeRuAfYtD5EAAMwvfnOTi+QWDogUZb4M/qQ=";
+    hash = "sha256-3oBF9FajapmXxvE4tQOuzwTkjwmk1DF806nMYdZqQUY=";
  };

  patches = [
@@ -39,10 +39,6 @@ gnuradio.pkgs.mkDerivation rec {
    # cpu_features which is bundled in the source. NOTE: Perhaps this patch
    # should be sent upstream.
    ./fix_libcpu_features_install_path.patch
-    (fetchpatch {
-      url = "https://sources.debian.org/data/main/g/gnss-sdr/0.0.20-2/debian/patches/boost1.90.diff";
-      hash = "sha256-IeLV0DIVzw+Nix9RmrqrbGDEjquvSws114UsdYphV58=";
-    })
  ];

  nativeBuildInputs = [
--- a/pkgs/by-name/gp/gpxsee/package.nix
+++ b/pkgs/by-name/gp/gpxsee/package.nix
@@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gpxsee";
-  version = "16.9";
+  version = "16.11";

  src = fetchFromGitHub {
    owner = "tumic0";
    repo = "GPXSee";
    tag = finalAttrs.version;
-    hash = "sha256-pb5HsmGIiC2A5IjGYm+M636J7vM8LP9LFGINkSaSSj4=";
+    hash = "sha256-Kfwm72PBLjnOIF/G/XMyOa5BmoYzV2Bb4aDQiDd51PI=";
  };

  buildInputs = [
--- a/pkgs/by-name/gr/greybird/package.nix
+++ b/pkgs/by-name/gr/greybird/package.nix
@@ -0,0 +1,50 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  gdk-pixbuf,
+  glib,
+  meson,
+  ninja,
+  pkg-config,
+  sassc,
+  librsvg,
+  gitUpdater,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "greybird";
+  version = "3.23.4";
+
+  src = fetchFromGitHub {
+    owner = "shimmerproject";
+    repo = "greybird";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-De8y+LRQ26UKrUECLCcbCg7p9Z+aRssQ/7YzegAUPw4=";
+  };
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    gdk-pixbuf
+    glib
+    meson
+    ninja
+    pkg-config
+    sassc
+  ];
+
+  buildInputs = [
+    librsvg
+  ];
+
+  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
+
+  meta = {
+    description = "Desktop suite for Xfce";
+    homepage = "https://github.com/shimmerproject/Greybird";
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.linux;
+    teams = [ lib.teams.xfce ];
+  };
+})
--- a/pkgs/by-name/kl/kloak/package.nix
+++ b/pkgs/by-name/kl/kloak/package.nix
@@ -17,13 +17,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "kloak";
-  version = "0.8.6-1";
+  version = "0.8.9-1";

  src = fetchFromGitHub {
    owner = "Whonix";
    repo = "kloak";
    tag = finalAttrs.version;
-    hash = "sha256-zaoKVPocL8iaX6hhZh0Q+cgYg3JLWBcMgGU0nLlNcjo=";
+    hash = "sha256-PzKaOaGDzn+1rbfW1daY/DcAwNflJ+nMaBdtiVSQJf0=";
  };

  strictDeps = true;
--- a/pkgs/by-name/le/lean-lsp-mcp/package.nix
+++ b/pkgs/by-name/le/lean-lsp-mcp/package.nix
@@ -6,7 +6,7 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "lean-lsp-mcp";
-  version = "0.26.2";
+  version = "0.28.1";
  pyproject = true;

  __structuredAttrs = true;
@@ -15,7 +15,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
    owner = "oOo0oOo";
    repo = "lean-lsp-mcp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-NWX+r6hz04WnSkERqVj57ruw47RhqOeEofYUaxuU/uM=";
+    hash = "sha256-dpVWJ598in9S/GlYrnqZgz2T/5vQV1m/eI+lQBiD8w4=";
  };

  build-system = with python3Packages; [ setuptools ];
--- a/pkgs/by-name/mh/mhabit/git-hashes.json
+++ b/pkgs/by-name/mh/mhabit/git-hashes.json
@@ -1,3 +1 @@
-{
-  "icon_font_generator": "sha256-QmChsa2qP+gZyZ2IrJMrY/zBP/J5QigidjIHahp3V0g="
-}
+{}
--- a/pkgs/by-name/mh/mhabit/package.nix
+++ b/pkgs/by-name/mh/mhabit/package.nix
@@ -1,7 +1,7 @@
 {
  lib,
  fetchFromGitHub,
-  flutter338,
+  flutter341,
  sqlite,
  libsecret,
  _experimental-update-script-combinators,
@@ -12,16 +12,16 @@
 }:

 let
-  version = "1.23.11+151";
+  version = "1.26.1+174";

  src = fetchFromGitHub {
    owner = "FriesI23";
    repo = "mhabit";
    tag = "v${version}";
-    hash = "sha256-1MGZE50ruHBLQ4Dma6mpJuLNevPIGtjHjlMucAwlK0c=";
+    hash = "sha256-GF7O28vv6KT+O3yYKdtgRkXq9o6uz4l0xkq5typOy+g=";
  };
 in
-flutter338.buildFlutterApplication {
+flutter341.buildFlutterApplication {
  pname = "mhabit";
  inherit version src;

--- a/pkgs/by-name/mh/mhabit/pubspec.lock.json
+++ b/pkgs/by-name/mh/mhabit/pubspec.lock.json
--- a/pkgs/by-name/no/normcap/package.nix
+++ b/pkgs/by-name/no/normcap/package.nix
@@ -46,6 +46,7 @@ ps.buildPythonApplication (finalAttrs: {
  pythonRelaxDeps = [
    "jeepney"
    "shiboken6"
+    "zxing-cpp"
  ];

  build-system = [
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -152,13 +152,13 @@ let
 in
 goBuild (finalAttrs: {
  pname = "ollama";
-  version = "0.32.4";
+  version = "0.32.5";

  src = fetchFromGitHub {
    owner = "ollama";
    repo = "ollama";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-jeoxQIIrUsjJurBQuyKjGGOAPjfONGTF7n2+Cq4ulNY=";
+    hash = "sha256-SqxFMKTGu5e6FdB5abuYez8Aejf7JY7C6e6GuOMYd4w=";
  };

  vendorHash = "sha256-HMwoaFBMbpoy8f0I+O+i7kIa9BslLu3FcVWeaIOkpvs=";
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -16,7 +16,7 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "opencode";
-  version = "1.18.9";
+  version = "1.18.11";

  __structuredAttrs = true;
  strictDeps = true;
@@ -25,7 +25,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    owner = "anomalyco";
    repo = "opencode";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-uvKzjPquhjm5OdDdoqexJQfDkN0OOXOW8RbdSka12NQ=";
+    hash = "sha256-Rg+NeRLeu0e+WSTZd8oJzV3XMMxXZCZ5LImDcCraX8g=";
  };

  node_modules = stdenvNoCC.mkDerivation {
@@ -78,7 +78,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    # NOTE: Required else we get errors that our fixed-output derivation references store paths
    dontFixup = true;

-    outputHash = "sha256-cXA4umq5rPApiQdpFGB8jGmFB+e1+WkoFZUXKak1za0=";
+    outputHash = "sha256-lHr4g4Kw9CvyDHiuyuCDsyk9vOXzz/My5bI9/zd5aYE=";
    outputHashAlgo = "sha256";
    outputHashMode = "recursive";
  };
--- a/pkgs/by-name/op/openobserve/package.nix
+++ b/pkgs/by-name/op/openobserve/package.nix
@@ -50,13 +50,13 @@ rustPlatform.buildRustPackage (
  in
  {
    pname = "openobserve";
-    version = "0.91.3";
+    version = "0.91.5";

    src = fetchFromGitHub {
      owner = "openobserve";
      repo = "openobserve";
      tag = "v${finalAttrs.version}";
-      hash = "sha256-XPldg4q6PeBDHV0W9tkWg7tdbp7rLDCRP8ux0a1jqec=";
+      hash = "sha256-3K6xaXFmhWY0ElqiFgR8mEi0XUVBF/cRNwONqLhniPc=";
    };

    patches = [
--- a/pkgs/by-name/op/openwebrx/package.nix
+++ b/pkgs/by-name/op/openwebrx/package.nix
@@ -134,5 +134,7 @@ python3Packages.buildPythonApplication rec {
    description = "Simple DSP library and command-line tool for Software Defined Radio";
    mainProgram = "openwebrx";
    license = lib.licenses.gpl3Only;
+    # Hasn't been updated in a long time, and is broken since 2026-07-14
+    broken = true;
  };
 }
--- a/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix
+++ b/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix
@@ -1,14 +1,14 @@
 {
-  version = "1.83.0";
+  version = "1.83.1";
  hashes = {
-    linux-aarch_64 = "sha256-Nwnk4Upg8VZCVbR/bpJDct/wI6GGaTICK+Sh711ZVEM=";
-    linux-ppcle_64 = "sha256-xUwugnrRQQqEkupYFh7SPtqtNmXmNCjAE+msHskmPXY=";
-    linux-s390_64 = "sha256-hj+QMaSxtX+hs6G5qCxf7ON2bDvpEGovt9iuVFwsXAQ=";
-    linux-x86_32 = "sha256-qJ034I7Im1pEn5u6W16y662y4+d7ZpB9EQtd7hkSCG4=";
-    linux-x86_64 = "sha256-oZrnSqTLA+HQEmlWKsYWXsMqhIp769AyrqmguVaXGLo=";
-    osx-aarch_64 = "sha256-w+3q+DtvfVzsqm9PfeMq6WyUn0jJorp0NngnH6HQh3I=";
-    osx-x86_64 = "sha256-w+3q+DtvfVzsqm9PfeMq6WyUn0jJorp0NngnH6HQh3I=";
-    windows-x86_32 = "sha256-fwDjhD8Jhy7M7qPSc8vJSUA8H/OhWeOyV/69uuZX+9Y=";
-    windows-x86_64 = "sha256-MER2cr8kaMO3zVTLujYr4jPX8jcbBqbHf9/Fxb0CbJY=";
+    linux-aarch_64 = "sha256-WvVUQ2m9hVcRGr++0hRTu2+oZ78yol8v/l9yNm5wXO8=";
+    linux-ppcle_64 = "sha256-X3+mYub01d3mwGZ6aNRfXSxfjNE2Tw1+xETUc/jC9Oc=";
+    linux-s390_64 = "sha256-CgdF8/0GCb/P8sUCMCdxByqHeD86PN6P4V1q9SbPLPs=";
+    linux-x86_32 = "sha256-N8xukQz+zPnnTi8RaELXjiP/PoT+ZBemSjvoXjp49R8=";
+    linux-x86_64 = "sha256-20BE54OR1aI0ORQ8gUfwe6WHdnVYe01I87aPvuOJNYk=";
+    osx-aarch_64 = "sha256-Ny4TslywWOpuOrbLVLoUWNXSu+HP3NN7xX6CuHJlbiE=";
+    osx-x86_64 = "sha256-Ny4TslywWOpuOrbLVLoUWNXSu+HP3NN7xX6CuHJlbiE=";
+    windows-x86_32 = "sha256-DdroVwr0NVeFGrM0JxnqfRJFXx1j3DVhGrEzTyJ6++8=";
+    windows-x86_64 = "sha256-9GVLC44frt+Jf0q811TFJQy0iv4H1ZXlbvyftHhzbHM=";
  };
 }
--- a/pkgs/by-name/qo/qogir-theme/package.nix
+++ b/pkgs/by-name/qo/qogir-theme/package.nix
@@ -0,0 +1,80 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  gitUpdater,
+  jdupes,
+  sassc,
+  which,
+  themeVariants ? [ ], # default: blue
+  colorVariants ? [ ], # default: all
+  tweaks ? [ ],
+}:
+
+let
+  pname = "qogir-theme";
+
+in
+lib.checkListOfEnum "${pname}: theme variants" [ "default" "manjaro" "ubuntu" "all" ] themeVariants
+  lib.checkListOfEnum
+  "${pname}: color variants"
+  [ "standard" "light" "dark" ]
+  colorVariants
+  lib.checkListOfEnum
+  "${pname}: tweaks"
+  [ "image" "square" "round" ]
+  tweaks
+
+  stdenv.mkDerivation
+  rec {
+    inherit pname;
+    version = "2025-08-17";
+
+    src = fetchFromGitHub {
+      owner = "vinceliuice";
+      repo = "qogir-theme";
+      rev = version;
+      hash = "sha256-LS1BE2jR08/JW2+rixYhTmctAfK2yZVWIE4QnAX9PDQ=";
+    };
+
+    nativeBuildInputs = [
+      jdupes
+      sassc
+      which
+    ];
+
+    postPatch = ''
+      patchShebangs install.sh
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/share/themes
+
+      name= HOME="$TMPDIR" ./install.sh \
+        ${lib.optionalString (themeVariants != [ ]) "--theme " + toString themeVariants} \
+        ${lib.optionalString (colorVariants != [ ]) "--color " + toString colorVariants} \
+        ${lib.optionalString (tweaks != [ ]) "--tweaks " + toString tweaks} \
+        --dest $out/share/themes
+
+      mkdir -p $out/share/doc/qogir-theme
+      cp -a src/firefox $out/share/doc/qogir-theme
+
+      rm $out/share/themes/*/{AUTHORS,COPYING}
+
+      jdupes --quiet --link-soft --recurse $out/share
+
+      runHook postInstall
+    '';
+
+    passthru.updateScript = gitUpdater { };
+
+    meta = {
+      description = "Flat Design theme for GTK based desktop environments";
+      homepage = "https://github.com/vinceliuice/Qogir-theme";
+      license = lib.licenses.gpl3Only;
+      platforms = lib.platforms.unix;
+      maintainers = [ lib.maintainers.romildo ];
+    };
+  }
--- a/pkgs/by-name/rs/rs-lxmf/package.nix
+++ b/pkgs/by-name/rs/rs-lxmf/package.nix
@@ -9,14 +9,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rs-lxmf";
-  version = "1.0.1";
+  version = "1.1.0";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "ratspeak";
    repo = "rsLXMF";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-VxtuDM34EnDya/OPA9H+ihrAdueczqjXsjQZMYenDIE=";
+    hash = "sha256-NxCLMFPQwNp1Igm1It+71jkyBCBHh6TQmTKMAjYi82k=";
  };

  postPatch = ''
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    done
  '';

-  cargoHash = "sha256-qMDqCH2oCZDJ8TQTDtgxooL1Ltn4khVyXr186NfWtKY=";
+  cargoHash = "sha256-ayEH6+Y0tkA38S0nVCqHhPoIOl+ZsO/AtbVbn13ZpUM=";

  doInstallCheck = true;
  nativeInstallCheckInputs = [ versionCheckHook ];
--- a/pkgs/by-name/rs/rs-reticulum/package.nix
+++ b/pkgs/by-name/rs/rs-reticulum/package.nix
@@ -13,17 +13,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rs-reticulum";
-  version = "1.0.1";
+  version = "1.1.0";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "ratspeak";
    repo = "rsReticulum";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-MSvIgB/E1Ce8M8vOaXlHQGYnxFf0lT2hg8g0tx6QY/w=";
+    hash = "sha256-zl29V4dtmEpHHEHgoMnaIeynE+JcMsY7O3d+pycwI1M=";
  };

-  cargoHash = "sha256-Kv3aVET69yI28muyaJop4YQEqOxNeyajK7j5J+jDhe0=";
+  cargoHash = "sha256-uKdNrCMPeDuS21rcZ9azDkUdsrTZk/JQLiKzSNWjcRw=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/se/secp256k1-jdk/package.nix
+++ b/pkgs/by-name/se/secp256k1-jdk/package.nix
@@ -7,20 +7,20 @@

 maven.buildMavenPackage (finalAttrs: {
  pname = "secp256k1-jdk";
-  version = "0.3";
+  version = "0.3.1";

  src = fetchFromGitHub {
    owner = "bitcoinj";
    repo = "secp256k1-jdk";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-kIWBgJ9OueNNDRKf1HHaxt6PFxK2iCuO0TFr8swbiL0=";
+    hash = "sha256-F2e4NDPEU7ZAu4+fvEd4BRbE2JwCvUiMeXHTMDXbIJE=";
  };

  mvnJdk = jdk25;
  mvnGoal = "deploy"; # The secp256k1-jdk POM targets a `local-staging` repository using a file URL
  mvnOffline = false; # We need actions not allowed in Maven offline mode, but Nix sandboxing will still be enforced
  mvnParameters = "-Drevision=${finalAttrs.version}"; # make snapshot builds reproducible
-  mvnHash = "sha256-87iDewdy/7lSyvROf1YyrsgvVUJtaivdHdSLig3Ea1Y=";
+  mvnHash = "sha256-a62jDFapnYV/mguZ/5PDzI5Unz7BnuvieLmpsocYMO4=";

  strictDeps = true;
  __structuredAttrs = true;
--- a/pkgs/by-name/so/soapyuhd/boost-lexical-cast.patch
+++ b/pkgs/by-name/so/soapyuhd/boost-lexical-cast.patch
@@ -0,0 +1,38 @@
+From 8b86a301540566dad533119a4d3fc6ec721e08ab Mon Sep 17 00:00:00 2001
+From: Martin Pluskal <martin@pluskal.org>
+Date: Thu, 18 Jun 2026 19:47:28 +0200
+Subject: [PATCH] Include <boost/lexical_cast.hpp> explicitly
+
+UHDSoapyDevice.cpp and SoapyUHDDevice.cpp use boost::lexical_cast but
+relied on it being pulled in transitively by another boost header.
+Recent Boost no longer does so, breaking the build with
+'lexical_cast is not a member of boost'. Include it directly.
+---
+ SoapyUHDDevice.cpp | 1 +
+ UHDSoapyDevice.cpp | 1 +
+ 2 files changed, 2 insertions(+)
+
+diff --git a/SoapyUHDDevice.cpp b/SoapyUHDDevice.cpp
+index 41140a8..673f06c 100644
+--- a/SoapyUHDDevice.cpp
+++ b/SoapyUHDDevice.cpp
+@@ -22,6 +22,7 @@
+ #include <uhd/version.hpp>
+ #include <cctype>
+ #include <iostream>
+#include <boost/lexical_cast.hpp>
+ 
+ /***********************************************************************
+  * Stream wrapper
+diff --git a/UHDSoapyDevice.cpp b/UHDSoapyDevice.cpp
+index 88641c5..8ed6574 100644
+--- a/UHDSoapyDevice.cpp
+++ b/UHDSoapyDevice.cpp
+@@ -37,6 +37,7 @@
+ #include <boost/bind.hpp>
+ #include <boost/weak_ptr.hpp>
+ #include <boost/algorithm/string.hpp>
+#include <boost/lexical_cast.hpp>
+ 
+ #include <algorithm>
+ #include <cctype>
--- a/pkgs/by-name/so/soapyuhd/package.nix
+++ b/pkgs/by-name/so/soapyuhd/package.nix
@@ -21,6 +21,11 @@ stdenv.mkDerivation {
    hash = "sha256-/hJ78dUL477gX3c2kV8kUknIk01PUf+ie1Gl7Ujq1Ac=";
  };

+  # Newer versions of Boost do not pull in boost::lexical_cast transitively, so
+  # it must be explicitly specified.
+  # Vendored from https://github.com/pothosware/SoapyUHD/pull/76
+  patches = [ ./boost-lexical-cast.patch ];
+
  nativeBuildInputs = [
    cmake
    pkg-config
@@ -33,8 +38,14 @@ stdenv.mkDerivation {

  cmakeFlags = [ "-DSoapySDR_DIR=${soapysdr}/share/cmake/SoapySDR/" ];

+  # SoapyUHD was originally pinned to C++14 as that was required by UHD at the
+  # time, but UHD 4.10 upgrades to C++20, so we switch to that here as well.
+  # https://github.com/pothosware/SoapyUHD/commit/1f7b6fa245f782e5d18453f5cbc6d9f27e6b26df
  postPatch = ''
    sed -i "s:DESTINATION .*uhd/modules:DESTINATION $out/lib/uhd/modules:" CMakeLists.txt
+
+    substituteInPlace CMakeLists.txt --replace-fail \
+      "set(CMAKE_CXX_STANDARD 14)" "set(CMAKE_CXX_STANDARD 20)"
  '';

  meta = {
--- a/pkgs/by-name/sr/srsran/package.nix
+++ b/pkgs/by-name/sr/srsran/package.nix
@@ -68,7 +68,10 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  cmakeFlags = [
-    "-DENABLE_WERROR=OFF"
+    (lib.cmakeBool "ENABLE_WERROR" false)
+    # The headers provided by UHD 4.10 use features introduced in C++17, and
+    # srsRAN does not build with higher standard versions such as C++20.
+    (lib.cmakeFeature "CMAKE_CXX_STANDARD" "17")
    (lib.cmakeBool "USE_LTE_RATES" enableLteRates)
    (lib.cmakeBool "ENABLE_AVX" enableAvx)
    (lib.cmakeBool "ENABLE_AVX2" enableAvx2)
--- a/pkgs/by-name/tr/trunk-recorder/package.nix
+++ b/pkgs/by-name/tr/trunk-recorder/package.nix
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  fetchpatch,
  cmake,
  git,
  makeWrapper,
@@ -23,15 +24,25 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "trunk-recorder";
-  version = "5.1.1";
+  version = "5.2.1";

  src = fetchFromGitHub {
    owner = "TrunkRecorder";
    repo = "trunk-recorder";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-2qy6krI5NglkC+bUFfJaEuHIcBoYJrxBRnFs8O0NcZA=";
+    hash = "sha256-cLreyYLPIMPLYBcsj8QUukbeRnIMIEF3VSTTg9AOumM=";
  };

+  patches = [
+    # Fixes build with boost 1.89, reported here:
+    # https://github.com/TrunkRecorder/trunk-recorder/issues/1140 and fixed in
+    # https://github.com/TrunkRecorder/trunk-recorder/commit/a7810f36fd3c1e0fb61877f5b8e02a1376f01635
+    (fetchpatch {
+      url = "https://github.com/TrunkRecorder/trunk-recorder/commit/a7810f36fd3c1e0fb61877f5b8e02a1376f01635.patch";
+      hash = "sha256-AB0EPHnJJwwHrz59mNlOcyAFOgzisYI0cJOnHjeu3V4=";
+    })
+  ];
+
  cmakeFlags = [ "-DCMAKE_SKIP_BUILD_RPATH=ON" ];

  nativeBuildInputs = [
--- a/pkgs/by-name/tu/tumbler/package.nix
+++ b/pkgs/by-name/tu/tumbler/package.nix
@@ -25,14 +25,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "tumbler";
-  version = "4.20.1";
+  version = "4.20.2";

  src = fetchFromGitLab {
    domain = "gitlab.xfce.org";
    owner = "xfce";
    repo = "tumbler";
    tag = "tumbler-${finalAttrs.version}";
-    hash = "sha256-p4lAFNvCakqrsDa2FP0xbc/khx6eYqAlHwWkk8yEB7Y=";
+    hash = "sha256-jLSJr3QUl6f1gpdfKw8ycb2+hw9sr1cudBeBwJWI1mk=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/uh/uhd/downstream-pkgs-boost1.89-fix.patch
+++ b/pkgs/by-name/uh/uhd/downstream-pkgs-boost1.89-fix.patch
@@ -0,0 +1,46 @@
+commit 57706d6f6c9117fbd919228a06365aa6a1999f8a
+Author: Doron Behar <doron.behar@gmail.com>
+Date:   Thu Jul 30 13:15:25 2026 +0300
+
+    cmake: Remove `Boost::system` from `UHDConfig.cmake` component list
+    
+    Boost.System has been header-only since Boost 1.69, and as of Boost 1.89
+    its CMake package config was removed entirely.[1]
+    
+    This makes the `find_dependency(Boost ... COMPONENTS ... system ...)`
+    call in the installed `UHDConfig.cmake` fail on any downstream project
+    that does `find_package(UHD)` while linked against `Boost >= 1.89`.
+    
+    Timeline of how this happened, for reference:
+    
+    - Up to and including v4.9.0.1, UHDConfig.cmake.in had no Boost
+      dependency check at all.
+    - ab724a30ec59219b6556a95a76247277aa90854f introduced the
+      `find_dependency(Boost ... COMPONENTS ... system ...)` call here, to
+      correctly declare Boost as a transitive dependency of the newly added
+      `UHD::uhd` imported target.
+    - c45c296d8fd8d23e1f8cf0b154c23556d90973b0 fixed UHD's own build to stop
+      requiring `Boost::system`, in response to it being dropped as of Boost
+      1.89. That commit did not touch `UHDConfig.cmake.in`, which had only
+      just gained its own separate `Boost::system` reference ten days
+      earlier via ab724a30ec59219b6556a95a76247277aa90854f, and so was
+      missed.
+    - `v4.10.0.0` ships with both commits, making it the first release where
+      `UHDConfig.cmake.in`'s Boost dependency check exists but still lists
+      `system`, breaking `find_package(UHD)` for any consumer linked against
+      Boost >= 1.89.
+    
+    [1]: https://github.com/boostorg/system/commit/7a495bb46d7ccd808e4be2a6589260839b0fd3a3
+
+diff --git a/host/cmake/Modules/UHDConfig.cmake.in b/host/cmake/Modules/UHDConfig.cmake.in
+index 85fc3e158..ac7417684 100644
+--- a/host/cmake/Modules/UHDConfig.cmake.in
+++ b/host/cmake/Modules/UHDConfig.cmake.in
+@@ -30,7 +30,6 @@ find_dependency(Boost ${UHD_BOOST_MIN_VERSION}
+   date_time
+   filesystem
+   program_options
+-  system
+   serialization
+   thread
+   unit_test_framework
--- a/pkgs/by-name/uh/uhd/fix-pkg-config.patch
+++ b/pkgs/by-name/uh/uhd/fix-pkg-config.patch
@@ -1,48 +0,0 @@
-From 32944bbdbf2c7611e72ec9828464978ca42824ce Mon Sep 17 00:00:00 2001
-From: Jakob Kukla <jakob.kukla@gmail.com>
-Date: Fri, 12 Sep 2025 10:31:22 +0000
-Subject: [PATCH] cmake: support absolute paths for install dirs in pkg-config
-
-The GNUInstallDirs module supports absolute paths for CMAKE_INSTALL_LIBDIR and CMAKE_INSTALL_INCLUDEDIR. Some package managers like Nix depend on this behaviour. See https://github.com/NixOS/nixpkgs/issues/144170 for the nixpkgs tracking issue.
---
- host/CMakeLists.txt | 12 ++++++++++++
- host/uhd.pc.in      |  4 ++--
- 2 files changed, 14 insertions(+), 2 deletions(-)
-
-diff --git a/host/CMakeLists.txt b/host/CMakeLists.txt
-index 3e93ea1f0c..4cd0afad9d 100644
--- a/host/CMakeLists.txt
-+++ b/host/CMakeLists.txt
-@@ -559,6 +559,18 @@ if(CMAKE_CROSSCOMPILING)
-     set(UHD_PC_LIBS)
- endif(CMAKE_CROSSCOMPILING)
- 
-+# Support absolute paths for LIBDIR and INCLUDEDIR
-+if(IS_ABSOLUTE "${CMAKE_INSTALL_LIBDIR}")
-+    set(UHD_PC_LIBDIR "${CMAKE_INSTALL_LIBDIR}")
-+else()
-+    set(UHD_PC_LIBDIR "\${exec_prefix}/${CMAKE_INSTALL_LIBDIR}")
-+endif()
-+if(IS_ABSOLUTE "${CMAKE_INSTALL_INCLUDEDIR}")
-+    set(UHD_PC_INCLUDEDIR "${CMAKE_INSTALL_INCLUDEDIR}")
-+else()
-+    set(UHD_PC_INCLUDEDIR "\${prefix}/${CMAKE_INSTALL_INCLUDEDIR}")
-+endif()
-+
- configure_file(
-     ${CMAKE_CURRENT_SOURCE_DIR}/uhd.pc.in
-     ${CMAKE_CURRENT_BINARY_DIR}/uhd.pc
-diff --git a/host/uhd.pc.in b/host/uhd.pc.in
-index 4a5f67c969..f121e2fb70 100644
--- a/host/uhd.pc.in
-+++ b/host/uhd.pc.in
-@@ -1,7 +1,7 @@
- prefix=@CMAKE_INSTALL_PREFIX@
- exec_prefix=${prefix}
-libdir=${exec_prefix}/@CMAKE_INSTALL_LIBDIR@
-includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@
-+libdir=@UHD_PC_LIBDIR@
-+includedir=@UHD_PC_INCLUDEDIR@
- 
- Name: @CPACK_PACKAGE_NAME@
- Description: @CPACK_PACKAGE_DESCRIPTION_SUMMARY@
--- a/pkgs/by-name/uh/uhd/package.nix
+++ b/pkgs/by-name/uh/uhd/package.nix
@@ -1,7 +1,6 @@
 {
  lib,
  stdenv,
-  llvmPackages_20,
  fetchurl,
  fetchFromGitHub,
  cmake,
@@ -31,27 +30,21 @@
  enableN320 ? true,
  enableE300 ? true,
  enableE320 ? true,
+  # passthru.tests
+  soapyuhd,
 }:

 let
  inherit (lib) optionals cmakeBool;
-  stdenv' = (
-    # Fix a compilation issue on Darwin, that upstream is aware of:
-    # https://github.com/EttusResearch/uhd/issues/881
-    if stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64 then
-      llvmPackages_20.stdenv
-    else
-      stdenv
-  );
 in

-stdenv'.mkDerivation (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
  pname = "uhd";
  # NOTE: Use the following command to update the package, and the uhdImageSrc attribute:
  #
  #     nix-shell maintainers/scripts/update.nix --argstr package uhd --arg commit true
  #
-  version = "4.9.0.1";
+  version = "4.10.0.0";

  outputs = [
    "out"
@@ -64,15 +57,22 @@ stdenv'.mkDerivation (finalAttrs: {
    rev = "v${finalAttrs.version}";
    # The updateScript relies on the `src` using `hash`, and not `sha256. To
    # update the correct hash for the `src` vs the `uhdImagesSrc`
-    hash = "sha256-AOZYCmkgsM09YORW7dVsPAwecXNZQOxOscJnVOlMoP0=";
+    hash = "sha256-nqazjHfYIVbqFnfiHdkz1Glws4+t5rgWmojWbi0Ymk8=";
  };
  # Firmware images are downloaded (pre-built) from the respective release on Github
  uhdImagesSrc = fetchurl {
    url = "https://github.com/EttusResearch/uhd/releases/download/v${finalAttrs.version}/uhd-images_${finalAttrs.version}.tar.xz";
    # Please don't convert this to a hash, in base64, see comment near src's
    # hash.
-    sha256 = "15ahcxb7hsylvdzzv0q0shd3wqm7p2y4kzbqk85cvsxbdklxhsvn";
+    sha256 = "1pqx5ajg1z8jk1lfh44m58sqf6ypbvn9jm89walfc1h38q4ykj38";
  };
+
+  patches = [
+    # Fixes detection of uhd for packages that depend on uhd, see:
+    # https://github.com/EttusResearch/uhd/pull/939
+    ./downstream-pkgs-boost1.89-fix.patch
+  ];
+
  inherit (finalAttrs.finalPackage.passthru) pythonPath;
  passthru = {
    runtimePython = python3.withPackages (ps: finalAttrs.finalPackage.passthru.pythonPath);
@@ -156,7 +156,7 @@ stdenv'.mkDerivation (finalAttrs: {
    # ABI differences GCC 7.1
    # /nix/store/wd6r25miqbk9ia53pp669gn4wrg9n9cj-gcc-7.3.0/include/c++/7.3.0/bits/vector.tcc:394:7: note: parameter passing for argument of type 'std::vector<uhd::range_t>::iterator {aka __gnu_cxx::__normal_iterator<uhd::range_t*, std::vector<uhd::range_t> >}' changed in GCC 7.1
  ]
-  ++ optionals stdenv'.hostPlatform.isAarch32 [
+  ++ optionals stdenv.hostPlatform.isAarch32 [
    "-DCMAKE_CXX_FLAGS=-Wno-psabi"
  ];

@@ -184,12 +184,8 @@ stdenv'.mkDerivation (finalAttrs: {
      dpdk
    ];

-  patches = [
-    ./fix-pkg-config.patch
-  ];
-
  # many tests fails on darwin, according to ofborg
-  doCheck = !stdenv'.hostPlatform.isDarwin;
+  doCheck = !stdenv.hostPlatform.isDarwin;

  doInstallCheck = true;

@@ -200,7 +196,7 @@ stdenv'.mkDerivation (finalAttrs: {
    "installFirmware"
    "removeInstalledTests"
  ]
-  ++ optionals (enableUtils && stdenv'.hostPlatform.isLinux) [
+  ++ optionals (enableUtils && stdenv.hostPlatform.isLinux) [
    "moveUdevRules"
  ];

@@ -230,6 +226,8 @@ stdenv'.mkDerivation (finalAttrs: {
    python3
  ];

+  passthru.tests = { inherit soapyuhd; };
+
  meta = {
    description = "USRP Hardware Driver (for Software Defined Radio)";
    longDescription = ''
--- a/pkgs/by-name/un/unity-test/package.nix
+++ b/pkgs/by-name/un/unity-test/package.nix
@@ -44,13 +44,13 @@ stdenv.mkDerivation (finalAttrs: {
  patches = [
    # The meson file does not have the subdir set correctly
    (fetchpatch2 {
-      url = "https://patch-diff.githubusercontent.com/raw/ThrowTheSwitch/Unity/pull/771.patch";
-      hash = "sha256-r8ldVb7WrzVwTC2CtGul9Jk4Rzt+6ejk+paYAfFlR5M=";
+      url = "https://patch-diff.githubusercontent.com/raw/ThrowTheSwitch/Unity/pull/771.patch?full_index=1";
+      hash = "sha256-b1TGYkqeAVbYftN5/YBdiFB7EsSh56S8PCx53fY8lDo=";
    })
    # Fix up the shebangs in the auto directory as not all are correct
    (fetchpatch2 {
-      url = "https://patch-diff.githubusercontent.com/raw/ThrowTheSwitch/Unity/pull/790.patch";
-      hash = "sha256-K+OxMe/ZMXPPjZXjGhgc5ULLN7plBwL0hV5gwmgA3FM=";
+      url = "https://patch-diff.githubusercontent.com/raw/ThrowTheSwitch/Unity/pull/790.patch?full_index=1";
+      hash = "sha256-N3DVkSuhZUA+9RIynPwuISf4XkVSA2eNqJqrt67XOhA=";
    })
  ];

--- a/pkgs/by-name/ve/vencord/fix-deps.patch
+++ b/pkgs/by-name/ve/vencord/fix-deps.patch
@@ -1,15 +1,15 @@
 diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
-index 92c50e4e..67a306eb 100644
+index ddf8750c..655c9a7d 100644
 --- a/pnpm-lock.yaml
 +++ b/pnpm-lock.yaml
-@@ -162,8 +162,8 @@ importers:
-         specifier: ^22.13.4
-         version: 22.13.13
+@@ -160,8 +160,8 @@ importers:
+         specifier: ^26.0.1
+         version: 26.0.1
       '@types/react':
 -        specifier: 18.3.1
 -        version: 18.3.1
-+        specifier: 19.0.12
-+        version: 19.0.12
+        specifier: 19.1.0
+        version: 19.1.0
       '@types/react-dom':
         specifier: 18.3.1
         version: 18.3.1
--- a/pkgs/by-name/ve/vencord/package.nix
+++ b/pkgs/by-name/ve/vencord/package.nix
@@ -6,7 +6,7 @@
  lib,
  nix-update,
  nodejs,
-  pnpm_10,
+  pnpm_11,
  fetchPnpmDeps,
  pnpmConfigHook,
  stdenv,
@@ -18,24 +18,24 @@
  buildWebExtension ? false,
 }:
 let
-  pnpm = pnpm_10;
+  pnpm = pnpm_11;
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "vencord";
-  version = "1.14.15";
+  version = "1.15.0";

  src = fetchFromGitHub {
    owner = "Vendicated";
    repo = "Vencord";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-jQeLZa1rpKDkzWSpAqOa8snGRKLpv9xf9cwJ6hUwMzA=";
+    hash = "sha256-z3EY/nc9pHPjuMteY8ubYM3sqgjASznEG6B1U4mNCU4=";
  };

  patches = [ ./fix-deps.patch ];

  postPatch = ''
    substituteInPlace packages/vencord-types/package.json \
-      --replace-fail '"@types/react": "18.3.1"' '"@types/react": "19.0.12"'
+      --replace-fail '"@types/react": "18.3.1"' '"@types/react": "19.1.0"'
  '';

  pnpmDeps = fetchPnpmDeps {
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
      ;
    inherit pnpm;
    fetcherVersion = 4;
-    hash = "sha256-pm5f6bGm07pzNCqpDHRyKFnuX2ZTE5w9BtJu5xXPHiI=";
+    hash = "sha256-JmTSfUVHsMG0TcOwXkZWinRxpONZagtwKzESd8Q4LlQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/xf/xfce4-panel/package.nix
+++ b/pkgs/by-name/xf/xfce4-panel/package.nix
@@ -31,7 +31,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "xfce4-panel";
-  version = "4.20.7";
+  version = "4.20.8";

  outputs = [
    "out"
@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "xfce";
    repo = "xfce4-panel";
    tag = "xfce4-panel-${finalAttrs.version}";
-    hash = "sha256-tL32ymLhV1QK84223iEgGrKdZXm5/nB3MumDyDIrSHQ=";
+    hash = "sha256-Q+QV0NFM3vL92o6ApPI9qmkkmZiqyjo/Q+lRHLudtGg=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/xf/xfce4-power-manager/package.nix
+++ b/pkgs/by-name/xf/xfce4-power-manager/package.nix
@@ -22,14 +22,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "xfce4-power-manager";
-  version = "4.20.0";
+  version = "4.20.1";

  src = fetchFromGitLab {
    domain = "gitlab.xfce.org";
    owner = "xfce";
    repo = "xfce4-power-manager";
    tag = "xfce4-power-manager-${finalAttrs.version}";
-    hash = "sha256-qKUdrr+giLzNemhT3EQsOKTSiIx50NakmK14Ak7ZOCE=";
+    hash = "sha256-0Pgk5N+Cr75RwOp2dbYB8OOEzmXDVUHzoqFbaUF/Z0k=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/xf/xfce4-settings/package.nix
+++ b/pkgs/by-name/xf/xfce4-settings/package.nix
@@ -36,14 +36,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "xfce4-settings";
-  version = "4.20.4";
+  version = "4.20.5";

  src = fetchFromGitLab {
    domain = "gitlab.xfce.org";
    owner = "xfce";
    repo = "xfce4-settings";
    tag = "xfce4-settings-${finalAttrs.version}";
-    hash = "sha256-EAiu29wctXg0EjdFVJOl+0nh1A0l2E44v+i/o5l/PQ8=";
+    hash = "sha256-sHhoxE9YTlIcrJ/G414pwc3wy3Gv0ksnBePqgEbmV8Q=";
  };

  depsBuildBuild = [
--- a/pkgs/development/interpreters/php/default.nix
+++ b/pkgs/development/interpreters/php/default.nix
@@ -69,16 +69,16 @@ let
 in
 {
  php82 = mkPhp {
-    version = "8.2.32";
-    hash = "sha256-jyHpiMpN1eFN2fuImIRIeENWbkhygAJ8Tvq2yTGIotE=";
+    version = "8.2.33";
+    hash = "sha256-U2Lyp6DnFoznIv6gBIsaHSjg98wmXEF99nDGVnBpUBg=";
  };
  php83 = mkPhp {
-    version = "8.3.32";
-    hash = "sha256-93fKJGYZZvlLMfaEDNrUN88wUBU324uHKxt6HCRLjQI=";
+    version = "8.3.33";
+    hash = "sha256-+cn00M12ksbj2jY81MpyqCakmuGPXtQwtvyue8KIHhg=";
  };
  php84 = mkPhp {
-    version = "8.4.23";
-    hash = "sha256-wULAY7EM/2jQcnZuP/v7NlSgibk4ZosIMDVkN+6V4Po=";
+    version = "8.4.24";
+    hash = "sha256-KGiQRHWIUQ3xEO3p6c4J8etPmFZjC0f9xA7OcOIDc88=";
  };
  php85 = mkPhp {
    version = "8.5.9";
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -358,13 +358,13 @@

 buildPythonPackage (finalAttrs: {
  pname = "boto3-stubs";
-  version = "1.43.59";
+  version = "1.43.62";
  pyproject = true;

  src = fetchPypi {
    pname = "boto3_stubs";
    inherit (finalAttrs) version;
-    hash = "sha256-FYhYt3M6EjpTb52WZcmdZRRShCbjVIC5XeJoSpgYMYE=";
+    hash = "sha256-pUG/DSBCStQnlAuJOP/zS+oo/A05mQa989GTNxAWRVo=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/daft/Cargo.lock
+++ b/pkgs/development/python-modules/daft/Cargo.lock
--- a/pkgs/development/python-modules/daft/default.nix
+++ b/pkgs/development/python-modules/daft/default.nix
@@ -5,7 +5,6 @@
  fetchFromGitHub,

  # cargoDeps
-  fetchgit,
  rustPlatform,

  # nativeBuildInputs
@@ -91,29 +90,16 @@ buildPythonPackage (finalAttrs: {
    hash = "sha256-vz9lCm2zQaWM+9jPH2fnhGEQiCYPH0Jl477yaZDQ370=";
  };

-  cargoDeps =
-    (rustPlatform.importCargoLock.override {
-      fetchgit =
-        args:
-        if (args.url or null) == "https://github.com/Eventual-Inc/azure-sdk-for-rust" then
-          fetchgit (
-            args
-            // {
-              postFetch = (args.postFetch or "") + ''
-                substituteInPlace $out/services/Cargo.toml \
-                  --replace-fail '"mgmt/batch",' '"mgmt/batch", "svc/blobstorage",'
-              '';
-            }
-          )
-        else
-          fetchgit args;
-    })
-      {
-        lockFile = ./Cargo.lock;
-        outputHashes = {
-          "azure_core-0.21.0" = "sha256-I8kzIkguRa3REwii0xsFFpNhE90/QX5msXwE6rrzDlY=";
-        };
-      };
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit (finalAttrs) pname version src;
+    hash = "sha256-8pezsGc2iYlYdPgZFjmFq1shkCWCG6F69Cx/+P1iKU8=";
+
+    # azure-sdk-for-rust omits svc/blobstorage from the services workspace
+    postBuild = ''
+      substituteInPlace "$out"/git/*/services/Cargo.toml \
+        --replace-fail '"mgmt/batch",' '"mgmt/batch", "svc/blobstorage",'
+    '';
+  };

  postPatch = ''
    substituteInPlace Cargo.toml \
--- a/pkgs/development/python-modules/environs/default.nix
+++ b/pkgs/development/python-modules/environs/default.nix
@@ -13,14 +13,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "environs";
-  version = "15.0.1";
+  version = "15.1.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "sloria";
    repo = "environs";
    tag = finalAttrs.version;
-    hash = "sha256-rsXR3KjLRdGnF8EX0TXzd0r61xY2rrNO5TDdoX1SnO0=";
+    hash = "sha256-t3T31kI2Bh5biJrIzHJXJpEXWps9cLQRnlTZYKwtAtA=";
  };

  build-system = [ flit-core ];
--- a/pkgs/development/python-modules/gradio/client.nix
+++ b/pkgs/development/python-modules/gradio/client.nix
@@ -31,7 +31,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "gradio-client";
-  version = "2.5.0";
+  version = "2.6.0";
  pyproject = true;

  # no tests on pypi
--- a/pkgs/development/python-modules/gradio/default.nix
+++ b/pkgs/development/python-modules/gradio/default.nix
@@ -82,7 +82,7 @@ let
 in
 buildPythonPackage (finalAttrs: {
  pname = "gradio";
-  version = "6.20.0"; # please always backport gradio changes
+  version = "6.22.0"; # please always backport gradio changes
  pyproject = true;
  __structuredAttrs = true;

@@ -90,7 +90,7 @@ buildPythonPackage (finalAttrs: {
    owner = "gradio-app";
    repo = "gradio";
    tag = "gradio@${finalAttrs.version}";
-    hash = "sha256-q5OoMguG/f0A3c6X+zotafc3kRRuebxMBPUIlrlcNFI=";
+    hash = "sha256-9FcGnZ/yktKM8sTGpgTv3QLIe2IoGbSw10rLWgj1zSU=";
  };

  patches = [
@@ -107,7 +107,7 @@ buildPythonPackage (finalAttrs: {
    inherit (finalAttrs) version src;
    inherit pnpm;
    fetcherVersion = 4;
-    hash = "sha256-xCxr/jnp9emeB6THGt4cumvApw6fSZQwG2NGOcvR0yQ=";
+    hash = "sha256-TX4sLAfka/j002OsUKqxqi5B6Fb+DXSGdeL+w6V9XuM=";
  };

  env = {
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -59,8 +59,8 @@ in
      "sha256-o5hZAxSZklg7hzL7MWCBYnnYTRoBSSAKPLpub1NVO74=";

  mypy-boto3-amp =
-    buildMypyBoto3Package "amp" "1.43.54"
-      "sha256-i/iC+OeJWJMOqBlegdYokbH7NJ/H8ahKLhctUZAarBs=";
+    buildMypyBoto3Package "amp" "1.43.62"
+      "sha256-h42x1hJbjLtZrYis16d9HkcASfrFAkboeedwrwOthZk=";

  mypy-boto3-amplify =
    buildMypyBoto3Package "amplify" "1.43.0"
@@ -223,8 +223,8 @@ in
      "sha256-Ula0Hx4jZ6JVlT9v4P88bmtQSYyFtofeZiN9vAILqxw=";

  mypy-boto3-cloudformation =
-    buildMypyBoto3Package "cloudformation" "1.43.38"
-      "sha256-u0rjspNF01rMTNE1gCrxMlA85Ve1Ma0KGb7FzHuCGjo=";
+    buildMypyBoto3Package "cloudformation" "1.43.62"
+      "sha256-dcBm0aFySX9u7mKe1+RHl4faTkkpGU65ef6ocxGAXhk=";

  mypy-boto3-cloudfront =
    buildMypyBoto3Package "cloudfront" "1.43.8"
@@ -602,8 +602,8 @@ in
      "sha256-oPQuxAKSUTpHGyq1J80W57cISh+d+4IGN8ClJdhkfnw=";

  mypy-boto3-iam =
-    buildMypyBoto3Package "iam" "1.43.29"
-      "sha256-kcinFHd0QJt3ELvYR4xm4o1j6NZ+hzfHA0pZHgDvCUA=";
+    buildMypyBoto3Package "iam" "1.43.60"
+      "sha256-Sh82poyz+WLAAPIFYgQ0bRwZYWoSJ5l8VweyY55zTYM=";

  mypy-boto3-identitystore =
    buildMypyBoto3Package "identitystore" "1.43.0"
@@ -706,8 +706,8 @@ in
      "sha256-9XMdnVsYUmz8Uf9kAgVMbG960vy0TOJturoD9/ZoM98=";

  mypy-boto3-kafka =
-    buildMypyBoto3Package "kafka" "1.43.36"
-      "sha256-MUtSVAMTjMWokZVY8t6VLsGnqzp/M1yg50lGtV+irL8=";
+    buildMypyBoto3Package "kafka" "1.43.60"
+      "sha256-yl6FIgBJslNzGQtSXomgJEb3GCXdxYBeimlhfTssejk=";

  mypy-boto3-kafkaconnect =
    buildMypyBoto3Package "kafkaconnect" "1.43.0"
@@ -766,8 +766,8 @@ in
      "sha256-gYTCgaRwH3zKi6gg4MC8DUwXQT+jZO6lqc/vi+JUahU=";

  mypy-boto3-lambda =
-    buildMypyBoto3Package "lambda" "1.43.48"
-      "sha256-94PUbPDQAeunE7As6Yo5Vv+Q9KAt/phsDde6wyA0ywc=";
+    buildMypyBoto3Package "lambda" "1.43.60"
+      "sha256-wPfm2YTA/FEglmeGkV7zAS6czJ04LeQS4LcfMJZnhRw=";

  mypy-boto3-lex-models =
    buildMypyBoto3Package "lex-models" "1.43.3"
@@ -806,8 +806,8 @@ in
      "sha256-EunrKwNaYp0CDiwp8frI7zASilMF4wYHjDSuCsJ6aJM=";

  mypy-boto3-logs =
-    buildMypyBoto3Package "logs" "1.43.41"
-      "sha256-HAB24HG1jburH8wOPipqP1G1U7PX3i5BGp6mPUSa100=";
+    buildMypyBoto3Package "logs" "1.43.62"
+      "sha256-qF00eFrV3huxoy0GDbRoACCUayzRe5fHjuhdtUNlaaU=";

  mypy-boto3-lookoutequipment =
    buildMypyBoto3Package "lookoutequipment" "1.43.0"
@@ -842,8 +842,8 @@ in
      "sha256-ce8c73a1ksdQpCN6cSg5KMkbVqomFNyZnaf7pag9wBg=";

  mypy-boto3-marketplace-catalog =
-    buildMypyBoto3Package "marketplace-catalog" "1.43.42"
-      "sha256-MPkuedDLQD9OY3lBkdQ+R+Np3y+MTOUiLZkWm2T4rTY=";
+    buildMypyBoto3Package "marketplace-catalog" "1.43.62"
+      "sha256-MAW9xJR1wGS5oWB1hovpJkh2q1VDx0psAC/GOKJRXzo=";

  mypy-boto3-marketplace-entitlement =
    buildMypyBoto3Package "marketplace-entitlement" "1.43.0"
@@ -946,8 +946,8 @@ in
      "sha256-rkVxsY4MQ+eB3uQhD3kI7bBpCHiDVcQDNUXA5zUyeok=";

  mypy-boto3-network-firewall =
-    buildMypyBoto3Package "network-firewall" "1.43.38"
-      "sha256-kkxtrL98SOemo4LBPn5d2U0R0a5Yb9C0XBGTqAhRurM=";
+    buildMypyBoto3Package "network-firewall" "1.43.62"
+      "sha256-byxKwV6TDM/mo/my8h9aVDzbYMywCVSU/RfyNv9sW6Q=";

  mypy-boto3-networkmanager =
    buildMypyBoto3Package "networkmanager" "1.43.0"
@@ -990,8 +990,8 @@ in
      "sha256-0rAEnU+3VsESGKlu8OTnY//rzwRqvROhRFga+vnwd1k=";

  mypy-boto3-outposts =
-    buildMypyBoto3Package "outposts" "1.43.40"
-      "sha256-f+z9dYLo4uhsRvaCUcR+dbYpEv7xmlfgvUR1+eM+NeU=";
+    buildMypyBoto3Package "outposts" "1.43.62"
+      "sha256-OVufytfGy6zctCHDMblG+bHySHJQE66Ly4Umid4Dx2g=";

  mypy-boto3-panorama =
    buildMypyBoto3Package "panorama" "1.43.0"
@@ -1070,8 +1070,8 @@ in
      "sha256-YrrEKl3aGz//5Z5JGapHhWtk6hBXQ4cuRQmLqGYztzg=";

  mypy-boto3-quicksight =
-    buildMypyBoto3Package "quicksight" "1.43.57"
-      "sha256-otcgily4wXXQktUyD34UjHsosKnlDhW/v5oeFS49jDg=";
+    buildMypyBoto3Package "quicksight" "1.43.62"
+      "sha256-+OasKLJhOVR7NtZuUYL79KQKyV4ztY6kgooTgDIvLmU=";

  mypy-boto3-ram =
    buildMypyBoto3Package "ram" "1.43.0"
@@ -1082,8 +1082,8 @@ in
      "sha256-ZmYC3YQujmfSUK0pOGCGFwT7LrSa3oJfo9juUb+2Xpk=";

  mypy-boto3-rds =
-    buildMypyBoto3Package "rds" "1.43.51"
-      "sha256-YFCezjQ5tIk0JdeOajx3jg59D9KiB7opjoaBOomNq6c=";
+    buildMypyBoto3Package "rds" "1.43.62"
+      "sha256-2DJ8h1PXMiIf5KIvqdEx17ZS44Hz8MXVcM5xbNkc1VI=";

  mypy-boto3-rds-data =
    buildMypyBoto3Package "rds-data" "1.43.37"
@@ -1170,8 +1170,8 @@ in
      "sha256-T+JIJpHxD7IzAwq8yxgq6zbVMj/btpbhKnylMyfFvvU=";

  mypy-boto3-sagemaker =
-    buildMypyBoto3Package "sagemaker" "1.43.57"
-      "sha256-zjWk5zLO9t38AOAzx3vpM6neltfvKdE8P0uLVdvkp68=";
+    buildMypyBoto3Package "sagemaker" "1.43.60"
+      "sha256-1ruaaxLwOdyzh0OFgyEhPu7DDEqyV6bt2WEhiw8Rtow=";

  mypy-boto3-sagemaker-a2i-runtime =
    buildMypyBoto3Package "sagemaker-a2i-runtime" "1.43.0"
--- a/pkgs/development/python-modules/svgdigitizer/default.nix
+++ b/pkgs/development/python-modules/svgdigitizer/default.nix
@@ -28,7 +28,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "svgdigitizer";
-  version = "0.14.4";
+  version = "0.14.5";
  pyproject = true;
  __structuredAttrs = true;

@@ -36,7 +36,7 @@ buildPythonPackage (finalAttrs: {
    owner = "echemdb";
    repo = "svgdigitizer";
    tag = finalAttrs.version;
-    hash = "sha256-sDMSzoXa8RnygFjveh1SrF+bFit7OMQh2kbiZ478cM4=";
+    hash = "sha256-7a+IY3bxZI3DpkyUx4TQeDNBz80LhfK4s70Bl94liM0=";
  };

  build-system = [
--- a/pkgs/development/python-modules/torpy/default.nix
+++ b/pkgs/development/python-modules/torpy/default.nix
@@ -2,24 +2,29 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+  setuptools,
  cryptography,
  pytestCheckHook,
  requests,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "torpy";
  version = "1.1.6";
-  format = "setuptools";
+  pyproject = true;
+
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "torpyorg";
    repo = "torpy";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-Ni7GcpkxzAMtP4wBOFsi4KnxK+nC0XCZR/2Z/eS/C+w=";
  };

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    cryptography
    requests
  ];
@@ -39,4 +44,4 @@ buildPythonPackage rec {
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ larsr ];
  };
-}
+})
--- a/pkgs/development/python-modules/types-aiobotocore-packages/default.nix
+++ b/pkgs/development/python-modules/types-aiobotocore-packages/default.nix
--- a/pkgs/development/python-modules/types-aiobotocore/update.sh
+++ b/pkgs/development/python-modules/types-aiobotocore/update.sh
@@ -167,8 +167,8 @@ packages=(
  types-aiobotocore-iot-jobs-data
  # types-aiobotocore-iotanalytics
  types-aiobotocore-iotdeviceadvisor
-  types-aiobotocore-iotevents
-  types-aiobotocore-iotevents-data
+  # types-aiobotocore-iotevents
+  # types-aiobotocore-iotevents-data
  types-aiobotocore-iotfleetwise
  types-aiobotocore-iotsecuretunneling
  types-aiobotocore-iotsitewise
@@ -245,7 +245,7 @@ packages=(
  types-aiobotocore-organizations
  types-aiobotocore-osis
  types-aiobotocore-outposts
-  types-aiobotocore-panorama
+  # types-aiobotocore-panorama
  types-aiobotocore-payment-cryptography
  types-aiobotocore-payment-cryptography-data
  types-aiobotocore-personalize
@@ -314,7 +314,7 @@ packages=(
  types-aiobotocore-sesv2
  types-aiobotocore-shield
  types-aiobotocore-signer
-  types-aiobotocore-simspaceweaver
+  # types-aiobotocore-simspaceweaver
  types-aiobotocore-snow-device-management
  types-aiobotocore-snowball
  types-aiobotocore-sns
--- a/pkgs/kde/misc/ktextaddons/default.nix
+++ b/pkgs/kde/misc/ktextaddons/default.nix
@@ -8,11 +8,11 @@
 }:
 mkKdeDerivation rec {
  pname = "ktextaddons";
-  version = "2.1.1";
+  version = "2.1.2";

  src = fetchurl {
    url = "mirror://kde/stable/ktextaddons/ktextaddons-${version}.tar.xz";
-    hash = "sha256-fOWWG3qCrVDk/ytDhtdkzSnTCGAOu7X9duJJLTHg9fA=";
+    hash = "sha256-87REiQTxZW1tfNWlV9Iv4cUGJOsy7TafNHJr7/nOBYk=";
  };

  extraBuildInputs = [
--- a/pkgs/servers/http/nginx/generic.nix
+++ b/pkgs/servers/http/nginx/generic.nix
@@ -51,11 +51,7 @@ outer@{

 let

-  moduleNames = map (
-    mod:
-    mod.name
-      or (throw "The nginx module with source ${toString mod.src} does not have a `name` attribute. This prevents duplicate module detection and is no longer supported.")
-  ) modules;
+  moduleNames = map (mod: mod.pname) modules;

  mapModules =
    attrPath:
@@ -67,7 +63,7 @@ let
      if supports nginxVersion then
        mod.${attrPath} or [ ]
      else
-        throw "Module at ${toString mod.src} does not support nginx version ${nginxVersion}!"
+        throw "Module ${mod.name} does not support nginx version ${nginxVersion}!"
    );

 in
@@ -107,7 +103,7 @@ stdenv.mkDerivation {
    perl
  ]
  ++ buildInputs
-  ++ mapModules "inputs"
+  ++ mapModules "buildInputs"
  ++ lib.optional withGeoIP geoip
  ++ lib.optional withImageFilter gd;

@@ -171,8 +167,7 @@ stdenv.mkDerivation {
  ++ lib.optional (
    stdenv.buildPlatform != stdenv.hostPlatform
  ) "--crossbuild=${stdenv.hostPlatform.uname.system}::${stdenv.hostPlatform.uname.processor}"
-  ++ configureFlags
-  ++ map (mod: "--add-module=${mod.src}") modules;
+  ++ configureFlags;

  env = {
    NIX_CFLAGS_COMPILE = toString (
@@ -213,6 +208,15 @@ stdenv.mkDerivation {
  preConfigure = ''
    setOutputFlags=
  ''
+  # Make all modules source trees writable
+  + ''
+    for module in ${toString modules}; do
+      dst="$NIX_BUILD_TOP/$(basename "$module")"
+      cp --recursive "$module" "$dst"
+      chmod --recursive +w "$dst"
+      appendToVar configureFlags "--add-module=$dst"
+    done
+  ''
  + preConfigure
  + lib.concatMapStringsSep "\n" (mod: mod.preConfigure or "") modules;

@@ -243,7 +247,7 @@ stdenv.mkDerivation {
          sha256 = "sha256-M7V3ZJfKImur2OoqXcoL+CbgFj/huWnfZ4xMCmvkqfc=";
        })
      ]
-      ++ mapModules "patches"
+      ++ mapModules "nginxPatches"
    )
    ++ extraPatches;

--- a/pkgs/servers/http/nginx/modules.nix
+++ b/pkgs/servers/http/nginx/modules.nix
--- a/pkgs/servers/http/nginx/modules/akamai-token-validate/package.nix
+++ b/pkgs/servers/http/nginx/modules/akamai-token-validate/package.nix
@@ -0,0 +1,27 @@
+{
+  fetchFromGitHub,
+  lib,
+  mkNginxPlugin,
+  openssl,
+}:
+
+mkNginxPlugin (finalAttrs: {
+  pname = "akamai-token-validate";
+  version = "0-unstable-2026-06-26";
+
+  src = fetchFromGitHub {
+    owner = "kaltura";
+    repo = "nginx-akamai-token-validate-module";
+    rev = "34fd0c94d2c43c642f323491c4f4a226cd83b962";
+    hash = "sha256-nh0l5txpQAn5lBOeujfSMN1Rn5XP0MUHoGy+HYImw3k=";
+  };
+
+  buildInputs = [ openssl ];
+
+  meta = {
+    description = "Validates Akamai v2 query string tokens";
+    homepage = "https://github.com/kaltura/nginx-akamai-token-validate-module";
+    license = lib.licenses.agpl3Only;
+    maintainers = [ ];
+  };
+})
--- a/pkgs/servers/http/nginx/modules/aliases.nix
+++ b/pkgs/servers/http/nginx/modules/aliases.nix
@@ -0,0 +1,14 @@
+# Removed or renamed nginx modules
+
+self: {
+  # keep-sorted start case=no numeric=yes block=yes
+
+  fastcgi-cache-purge = throw "fastcgi-cache-purge was renamed to cache-purge";
+  http_proxy_connect_module_v24 = throw "http_proxy_connect_module_v24 was removed because it was not compatible with any supported nginx version"; # Added 2026-07-29
+  http_proxy_connect_module_v25 = throw "http_proxy_connect_module_v25 was removed because it was not compatible with any supported nginx version"; # Added 2026-07-29
+  modsecurity-nginx = self.modsecurity;
+  ngx_aws_auth = throw "ngx_aws_auth was renamed to aws-auth";
+  opentracing = throw "opentracing-cpp was removed because opentracing as been archived upstream"; # Added 2025-10-19
+  statsd = throw "statsd was removed because its upstream source vanished"; # Added 2026-07-28
+  # keep-sorted end
+}
--- a/pkgs/servers/http/nginx/modules/auth-a2aclr/package.nix
+++ b/pkgs/servers/http/nginx/modules/auth-a2aclr/package.nix
@@ -0,0 +1,39 @@
+{
+  fetchFromGitLab,
+  lib,
+  mkNginxPlugin,
+  arpa2common,
+}:
+
+mkNginxPlugin (finalAttrs: {
+  pname = "auth-a2aclr";
+  version = "0-unstable-2020-08-03";
+
+  src = fetchFromGitLab {
+    owner = "arpa2";
+    repo = "nginx-auth-a2aclr";
+    rev = "bbabf9480bb2b40ac581551883a18dfa6522dd63";
+    hash = "sha256-h2LgMhreCgod+H/bNQzY9BvqG9ezkwikwWB3T6gHH04=";
+  };
+
+  buildInputs = [
+    (arpa2common.overrideAttrs (old: rec {
+      version = "0.7.1";
+
+      src = fetchFromGitLab {
+        owner = "arpa2";
+        repo = "arpa2common";
+        rev = "v${version}";
+        hash = "sha256-8zVsAlGtmya9EK4OkGUMu2FKJRn2Q3bg2QWGjqcii64=";
+      };
+    }))
+  ];
+
+  meta = {
+    broken = true; # overridden arpa2common package fails to build
+    description = "Integrate ARPA2 Resource ACLs into nginx";
+    homepage = "https://gitlab.com/arpa2/nginx-auth-a2aclr";
+    license = lib.licenses.isc;
+    maintainers = [ ];
+  };
+})
--- a/pkgs/servers/http/nginx/modules/aws-auth/package.nix
+++ b/pkgs/servers/http/nginx/modules/aws-auth/package.nix
@@ -0,0 +1,24 @@
+{
+  fetchFromGitHub,
+  lib,
+  mkNginxPlugin,
+}:
+
+mkNginxPlugin (finalAttrs: {
+  pname = "aws-auth";
+  version = "2.1.1";
+
+  src = fetchFromGitHub {
+    owner = "anomalizer";
+    repo = "ngx_aws_auth";
+    tag = finalAttrs.version;
+    hash = "sha256-CRofdhJ5HQGp4R1tEoOx0Nzx1rTTd+5GaJcfDsg75oM=";
+  };
+
+  meta = {
+    description = "Proxy to authenticated AWS services";
+    homepage = "https://github.com/anomalizer/ngx_aws_auth";
+    license = lib.licenses.bsd2;
+    maintainers = [ ];
+  };
+})
--- a/pkgs/servers/http/nginx/modules/brotli/package.nix
+++ b/pkgs/servers/http/nginx/modules/brotli/package.nix
@@ -0,0 +1,32 @@
+{
+  brotli,
+  fetchFromGitHub,
+  lib,
+  mkNginxPlugin,
+}:
+
+mkNginxPlugin (finalAttrs: {
+  pname = "brotli";
+  version = "1.0.0rc-unstable-2022-04-29";
+
+  src = fetchFromGitHub {
+    owner = "google";
+    repo = "ngx_brotli";
+    rev = "6e975bcb015f62e1f303054897783355e2a877dc";
+    hash = "sha256-G0IDYlvaQzzJ6cNTSGbfuOuSXFp3RsEwIJLGapTbDgo=";
+  };
+
+  postPatch = ''
+    substituteInPlace filter/config \
+      --replace-fail '$ngx_addon_dir/deps/brotli/c' ${lib.getDev brotli}
+  '';
+
+  buildInputs = [ brotli ];
+
+  meta = {
+    description = "Brotli compression";
+    homepage = "https://github.com/google/ngx_brotli";
+    license = lib.licenses.bsd2;
+    maintainers = [ ];
+  };
+})
--- a/pkgs/servers/http/nginx/modules/builder.nix
+++ b/pkgs/servers/http/nginx/modules/builder.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  stdenv,
+  nix-update-script,
+  nginx,
+}:
+
+# This builder provides a thin facade that wraps the fod into a derivation
+# so that plugins can be picked up for automated updates. The actual build
+# happens when they are passed into the nginx build, which is why there is
+# no need to build these in hydra.
+
+lib.extendMkDerivation {
+  constructDrv = stdenv.mkDerivation;
+  extendDrvArgs = finalAttrs: args: {
+    name = "nginx-mod-${args.pname}-${args.version}";
+    dontConfigure = true;
+    dontBuild = true;
+    dontFixup = true;
+
+    installPhase = ''
+      runHook preInstall
+      cp \
+        --recursive \
+        --no-preserve=ownership \
+        . \
+        "$out"
+      runHook postInstall
+    '';
+
+    passthru = args.passthru or { } // {
+      updateScript =
+        args.passthru.updateScript or (nix-update-script {
+          extraArgs = [ "--version=stable" ];
+        });
+      tests = {
+        nginx = nginx.override {
+          modules = [ finalAttrs.finalPackage ];
+        };
+      }
+      // args.passthru.tests or { };
+    };
+
+    meta = (
+      args.meta or { }
+      // {
+        hydraPlatforms = [ ];
+      }
+    );
+  };
+}
--- a/pkgs/servers/http/nginx/modules/cache-purge/package.nix
+++ b/pkgs/servers/http/nginx/modules/cache-purge/package.nix
@@ -0,0 +1,24 @@
+{
+  fetchFromGitHub,
+  lib,
+  mkNginxPlugin,
+}:
+
+mkNginxPlugin (finalAttrs: {
+  pname = "cache-purge";
+  version = "2.5.1";
+
+  src = fetchFromGitHub {
+    owner = "nginx-modules";
+    repo = "ngx_cache_purge";
+    tag = finalAttrs.version;
+    hash = "sha256-jVm8E4u1NkjtBoGdRzUDo6l27XPDFoCrNUf2asaXRG0=";
+  };
+
+  meta = {
+    description = "Adds ability to purge content from FastCGI, proxy, SCGI and uWSGI caches";
+    homepage = "https://github.com/nginx-modules/ngx_cache_purge";
+    license = lib.licenses.bsd2;
+    maintainers = [ ];
+  };
+})
--- a/pkgs/servers/http/nginx/modules/coolkit/package.nix
+++ b/pkgs/servers/http/nginx/modules/coolkit/package.nix
@@ -0,0 +1,24 @@
+{
+  fetchFromGitHub,
+  lib,
+  mkNginxPlugin,
+}:
+
+mkNginxPlugin (finalAttrs: {
+  pname = "coolkit";
+  version = "0.2";
+
+  src = fetchFromGitHub {
+    owner = "FRiCKLE";
+    repo = "ngx_coolkit";
+    tag = finalAttrs.version;
+    hash = "sha256-EF/psh+aXUc1FRPrGUqczYFjsHYhX8wkV7hpVzEDssU=";
+  };
+
+  meta = {
+    description = "Collection of small and useful nginx add-ons";
+    homepage = "https://github.com/FRiCKLE/ngx_coolkit";
+    license = lib.licenses.bsd2;
+    maintainers = [ ];
+  };
+})
--- a/pkgs/servers/http/nginx/modules/dav/package.nix
+++ b/pkgs/servers/http/nginx/modules/dav/package.nix
@@ -0,0 +1,27 @@
+{
+  lib,
+  fetchFromGitHub,
+  mkNginxPlugin,
+  expat,
+}:
+
+mkNginxPlugin (finalAttrs: {
+  pname = "dav";
+  version = "3.0.0";
+
+  src = fetchFromGitHub {
+    owner = "arut";
+    repo = "nginx-dav-ext-module";
+    tag = "v${finalAttrs.version}";
+    sha256 = "000dm5zk0m1hm1iq60aff5r6y8xmqd7djrwhgnz9ig01xyhnjv9w";
+  };
+
+  buildInputs = [ expat ];
+
+  meta = {
+    description = "WebDAV PROPFIND,OPTIONS,LOCK,UNLOCK support";
+    homepage = "https://github.com/arut/nginx-dav-ext-module";
+    license = lib.licenses.bsd2;
+    maintainers = [ ];
+  };
+})
--- a/pkgs/servers/http/nginx/modules/develkit/package.nix
+++ b/pkgs/servers/http/nginx/modules/develkit/package.nix
@@ -0,0 +1,24 @@
+{
+  lib,
+  fetchFromGitHub,
+  mkNginxPlugin,
+}:
+
+mkNginxPlugin (finalAttrs: {
+  pname = "develkit";
+  version = "0.3.3";
+
+  src = fetchFromGitHub {
+    owner = "vision5";
+    repo = "ngx_devel_kit";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-/RQUVHwIdNqm3UemQ/oNs2ksg8beziA4Pxejd5Yg0Pg=";
+  };
+
+  meta = {
+    description = "Adds additional generic tools that module developers can use in their own modules";
+    homepage = "https://github.com/vision5/ngx_devel_kit";
+    license = lib.licenses.bsd3;
+    maintainers = [ ];
+  };
+})
--- a/pkgs/servers/http/nginx/modules/echo/package.nix
+++ b/pkgs/servers/http/nginx/modules/echo/package.nix
@@ -0,0 +1,25 @@
+{
+  fetchFromGitHub,
+  lib,
+  mkNginxPlugin,
+}:
+
+mkNginxPlugin (finalAttrs: {
+  pname = "echo";
+  version = "0.63";
+
+  src = fetchFromGitHub {
+    name = "echo";
+    owner = "openresty";
+    repo = "echo-nginx-module";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-K7oOE0yxPYLf+3YMVbBsncpHRpGHXjs/8B5QPO3MQC4=";
+  };
+
+  meta = {
+    description = "Brings echo, sleep, time, exec and more shell-style goodies to Nginx";
+    homepage = "https://github.com/openresty/echo-nginx-module";
+    license = lib.licenses.bsd2;
+    maintainers = [ ];
+  };
+})
--- a/pkgs/servers/http/nginx/modules/fancyindex/package.nix
+++ b/pkgs/servers/http/nginx/modules/fancyindex/package.nix
@@ -0,0 +1,24 @@
+{
+  fetchFromGitHub,
+  lib,
+  mkNginxPlugin,
+}:
+
+mkNginxPlugin (finalAttrs: {
+  pname = "fancyindex";
+  version = "0.5.2";
+
+  src = fetchFromGitHub {
+    owner = "aperezdc";
+    repo = "ngx-fancyindex";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-70bEZ5EVM3jjY5b9azXYBvJnFDoqgGXu0F7JcWkhWVk=";
+  };
+
+  meta = {
+    description = "Fancy indexes module";
+    homepage = "https://github.com/aperezdc/ngx-fancyindex";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ aneeshusa ];
+  };
+})
--- a/pkgs/servers/http/nginx/modules/fluentd/package.nix
+++ b/pkgs/servers/http/nginx/modules/fluentd/package.nix
@@ -0,0 +1,24 @@
+{
+  fetchFromGitHub,
+  lib,
+  mkNginxPlugin,
+}:
+
+mkNginxPlugin (finalAttrs: {
+  pname = "fluentd";
+  version = "0.3-unstable-2014-03-28";
+
+  src = fetchFromGitHub {
+    owner = "fluent";
+    repo = "nginx-fluentd-module";
+    rev = "8af234043059c857be27879bc547c141eafd5c13";
+    hash = "sha256-tf+jrac1QGOEwQnmDPmMMvM/Tg1TXTmKysBwndovi/k=";
+  };
+
+  meta = {
+    description = "Fluentd data collector";
+    homepage = "https://github.com/fluent/nginx-fluentd-module";
+    license = lib.licenses.asl20;
+    maintainers = [ ];
+  };
+})
--- a/pkgs/servers/http/nginx/modules/geoip2/package.nix
+++ b/pkgs/servers/http/nginx/modules/geoip2/package.nix
@@ -0,0 +1,27 @@
+{
+  fetchFromGitHub,
+  lib,
+  libmaxminddb,
+  mkNginxPlugin,
+}:
+
+mkNginxPlugin (finalAttrs: {
+  pname = "geoip2";
+  version = "3.4";
+
+  src = fetchFromGitHub {
+    owner = "leev";
+    repo = "ngx_http_geoip2_module";
+    tag = finalAttrs.version;
+    hash = "sha256-CAs1JZsHY7RymSBYbumC2BENsXtZP3p4ljH5QKwz5yg=";
+  };
+
+  buildInputs = [ libmaxminddb ];
+
+  meta = {
+    description = "Creates variables with values from the maxmind geoip2 databases";
+    homepage = "https://github.com/leev/ngx_http_geoip2_module";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ pinpox ];
+  };
+})
--- a/pkgs/servers/http/nginx/modules/ipscrub/package.nix
+++ b/pkgs/servers/http/nginx/modules/ipscrub/package.nix
@@ -0,0 +1,29 @@
+{
+  fetchFromGitHub,
+  lib,
+  libbsd,
+  mkNginxPlugin,
+}:
+
+mkNginxPlugin (finalAttrs: {
+  pname = "ipscrub";
+  version = "1.0.1";
+
+  src = fetchFromGitHub {
+    owner = "masonicboom";
+    repo = "ipscrub";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-/4f6dwER39md7aqq1CdBNlh8mi/e1wnF91UvjlgJnWE=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/ipscrub";
+
+  buildInputs = [ libbsd ];
+
+  meta = {
+    description = "IP address anonymizer";
+    homepage = "https://github.com/masonicboom/ipscrub";
+    license = lib.licenses.bsd3;
+    maintainers = [ ];
+  };
+})
--- a/pkgs/servers/http/nginx/modules/limit-speed/package.nix
+++ b/pkgs/servers/http/nginx/modules/limit-speed/package.nix
@@ -0,0 +1,24 @@
+{
+  fetchFromGitHub,
+  lib,
+  mkNginxPlugin,
+}:
+
+mkNginxPlugin (finalAttrs: {
+  pname = "limit-speed";
+  version = "0.1-unstable-2014-03-21";
+
+  src = fetchFromGitHub {
+    owner = "yaoweibin";
+    repo = "nginx_limit_speed_module";
+    rev = "f77ad4a56fbb134878e75827b40cf801990ed936";
+    hash = "sha256-6Mr6dlzoq08eWEr+fpLdU75r8D5ARxHRSJ2z+xFoeU4=";
+  };
+
+  meta = {
+    description = "Limit the total speed from the specific user";
+    homepage = "https://github.com/yaoweibin/nginx_limit_speed_module";
+    license = lib.licenses.bsd2;
+    maintainers = [ ];
+  };
+})
--- a/pkgs/servers/http/nginx/modules/live/package.nix
+++ b/pkgs/servers/http/nginx/modules/live/package.nix
@@ -0,0 +1,24 @@
+{
+  fetchFromGitHub,
+  lib,
+  mkNginxPlugin,
+}:
+
+mkNginxPlugin (finalAttrs: {
+  pname = "live";
+  version = "0-unstable-2018-11-18";
+
+  src = fetchFromGitHub {
+    owner = "arut";
+    repo = "nginx-live-module";
+    rev = "5e4a1e3a718e65e5206c24eba00d42b0d1c4b7dd";
+    hash = "sha256-n4ZEnl84smKF138WtBTakmDXfcdQCfEJqvGDsgiF9s4=";
+  };
+
+  meta = {
+    description = "HTTP live module";
+    homepage = "https://github.com/arut/nginx-live-module";
+    license = lib.licenses.bsd2;
+    maintainers = [ ];
+  };
+})
--- a/pkgs/servers/http/nginx/modules/lua-upstream/package.nix
+++ b/pkgs/servers/http/nginx/modules/lua-upstream/package.nix
@@ -0,0 +1,30 @@
+{
+  fetchFromGitHub,
+  lib,
+  luajit_openresty,
+  mkNginxPlugin,
+}:
+
+mkNginxPlugin (finalAttrs: {
+  pname = "lua-upstream";
+  version = "0.07";
+
+  src = fetchFromGitHub {
+    name = "lua-upstream";
+    owner = "openresty";
+    repo = "lua-upstream-nginx-module";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-886qZB6gTOyWW0riMgQ8osrF3Q/7DxBSHJHmqNBjDL8=";
+  };
+
+  buildInputs = [ luajit_openresty ];
+
+  allowMemoryWriteExecute = true;
+
+  meta = {
+    description = "Expose Lua API to ngx_lua for Nginx upstreams";
+    homepage = "https://github.com/openresty/lua-upstream-nginx-module";
+    license = lib.licenses.bsd2;
+    maintainers = [ ];
+  };
+})
--- a/Show More
+++ b/Show More