Merge master into staging-nixos

2026-09-19 22:30:23 +00:00 · 2026-08-09 12:09:54 +00:00
parent 3ecdde1b2a 38bba8d156
commit 5c1c19e8ca
47 changed files with 496 additions and 165 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5737,6 +5737,11 @@
    githubId = 3077118;
    name = "David McFarland";
  };
+  corps-fini = {
+    github = "corps-fini";
+    githubId = 44802527;
+    name = "corps-fini";
+  };
  costrouc = {
    email = "chris.ostrouchov@gmail.com";
    github = "costrouc";
@@ -6325,6 +6330,13 @@
    github = "darkyzhou";
    githubId = 7220778;
  };
+  daroche = {
+    name = "daroche";
+    email = "him@daroche.me";
+    matrix = "@him:daroche.me";
+    github = "RealDaroche";
+    githubId = 94007359;
+  };
  darshancode2005 = {
    name = "Darshan Thakare";
    email = "darshanthakaregsoc2023@gmail.com";
@@ -12007,6 +12019,13 @@
    githubId = 7685264;
    name = "Indexyz";
  };
+  indium114 = {
+    name = "indium114";
+    github = "indium114";
+    githubId = 156162907;
+    matrix = "@indium114:matrix.org";
+    keys = [ { fingerprint = "FEC7 A1E4 0F1A 528B 865C  A0B8 6249 5C16 5883 2CF0"; } ];
+  };
  ineol = {
    email = "leo.stefanesco@gmail.com";
    github = "ineol";
--- a/pkgs/applications/emulators/libretro/cores/beetle-wswan.nix
+++ b/pkgs/applications/emulators/libretro/cores/beetle-wswan.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "mednafen-wswan";
-  version = "0-unstable-2026-04-20";
+  version = "0-unstable-2026-07-31";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "beetle-wswan-libretro";
-    rev = "da6d0d9acb8d4e9bd6725ab44225a275325d8352";
-    hash = "sha256-ky/8ywP7scg8VXpqwDISw3A0zKwWbh7zAdaLhM91+Rw=";
+    rev = "4b01295838ea89e3f1355bbe4cb5cf98aa6108cd";
+    hash = "sha256-vCkh6duAEK/Am5oy1SYybE75gcc3idpd3Uvjt09a9uA=";
  };

  makefile = "Makefile";
--- a/pkgs/applications/emulators/libretro/cores/flycast.nix
+++ b/pkgs/applications/emulators/libretro/cores/flycast.nix
@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
  core = "flycast";
-  version = "0-unstable-2026-07-21";
+  version = "0-unstable-2026-08-07";

  src = fetchFromGitHub {
    owner = "flyinghead";
    repo = "flycast";
-    rev = "4126f1464fbc77c6bcec9cad00c32017ecabb799";
-    hash = "sha256-8SRw+GMuu2LXNhui0Zi2BoRajo3qp0DrzXYSHcUVATA=";
+    rev = "a172e0001351dfbc49b86860a13d5390b1c493fe";
+    hash = "sha256-0vBKit2Ce5ihTtQjOrbwrFBEg1Qig/8+H86eJb7EjZs=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/ad/adminneo/package.nix
+++ b/pkgs/by-name/ad/adminneo/package.nix
@@ -8,13 +8,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "adminneo";
-  version = "5.4.1";
+  version = "5.5.0";

  src = fetchFromGitHub {
    owner = "adminneo-org";
    repo = "adminneo";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-vnvLRPMiVuSEAQJSPBGM63LppQ7pZv6ZaQnUTpUw9W0=";
+    hash = "sha256-8A+sCojrtwsQdsJck1Cy1UBl8gFhuvsWq2ISbVkhh0Q=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ae/aerion-creds/package.nix
+++ b/pkgs/by-name/ae/aerion-creds/package.nix
@@ -5,7 +5,7 @@
 }:

 let
-  version = "0.3.2";
+  version = "0.3.3";

  archMap = {
    "x86_64-linux" = "x86_64";
--- a/pkgs/by-name/ae/aerion/package.nix
+++ b/pkgs/by-name/ae/aerion/package.nix
@@ -15,13 +15,13 @@
 }:

 let
-  version = "0.3.2";
+  version = "0.3.3";

  src = fetchFromGitHub {
    owner = "hkdb";
    repo = "aerion";
    rev = "v${version}";
-    hash = "sha256-elmk4huz4mvc7t+5/ZM5AK2R4pSKrLsZM0HxWFmQldE=";
+    hash = "sha256-erBpAeDi5liSDLkzTCOhht8UxIX7eyTIOGwqBTMMWMQ=";
  };

  frontend = buildNpmPackage {
@@ -30,7 +30,7 @@ let

    sourceRoot = "${src.name}/frontend";

-    npmDepsHash = "sha256-dC+xGwSqdzItIfDipAVIVnbUJHiFkmzanjV/5xFsbkc=";
+    npmDepsHash = "sha256-lIlnMIGjFEDvC0ktP88bYMMoDyghtr6SlxaJmfq0Z7o=";

    buildPhase = ''
      npm run build
@@ -49,7 +49,7 @@ buildGoModule {

  __structuredAttrs = true;

-  vendorHash = "sha256-ptsrOpJo3i+yRSCGuHynbzi+C+GD/mBmPuHqWSVV/+4=";
+  vendorHash = "sha256-4zAFF4hlCrVWgvmmyoyZzBtgFd1pVRoFl8Wg0FbmM+g=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/am/amdenc/package.nix
+++ b/pkgs/by-name/am/amdenc/package.nix
@@ -7,16 +7,16 @@
 }:

 let
-  amdgpuVersion = "6.1.3";
-  ubuntuVersion = "22.04";
+  amdgpuVersion = "6.4.4";
+  ubuntuVersion = "24.04";
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "amdenc";
-  version = "1.0-1787253";
+  version = "25.10-2203192";

  src = fetchurl {
    url = "https://repo.radeon.com/amdgpu/${amdgpuVersion}/ubuntu/pool/proprietary/liba/libamdenc-amdgpu-pro/libamdenc-amdgpu-pro_${finalAttrs.version}.${ubuntuVersion}_amd64.deb";
-    hash = "sha256-RSkWQ3g++uKVrk5J9R8WA6qL0f+B2z8/mlflQ/cQZcg=";
+    hash = "sha256-jEvHZxTzN8TzZJuouYaOGw9xaRINA/zEg+56s/13ruw=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/am/amf/package.nix
+++ b/pkgs/by-name/am/amf/package.nix
@@ -9,16 +9,16 @@
 }:

 let
-  amdgpuVersion = "6.1.3";
-  ubuntuVersion = "22.04";
+  amdgpuVersion = "6.4.4";
+  ubuntuVersion = "24.04";
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "amf";
-  version = "1.4.34-1787253";
+  version = "1.4.37-2203192";

  src = fetchurl {
    url = "https://repo.radeon.com/amdgpu/${amdgpuVersion}/ubuntu/pool/proprietary/a/amf-amdgpu-pro/amf-amdgpu-pro_${finalAttrs.version}.${ubuntuVersion}_amd64.deb";
-    hash = "sha256-5sMI0ktqQDTu5xOKP9T9vjaSIHQizF1wHhqJcVnY40c=";
+    hash = "sha256-pklpKaWLrcClRRaY9jJhFZLbyFXPUY9H5UpmARrgFPU=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/an/anubis/package.nix
+++ b/pkgs/by-name/an/anubis/package.nix
@@ -15,21 +15,21 @@

 buildGoModule (finalAttrs: {
  pname = "anubis";
-  version = "1.26.2";
+  version = "1.27.0";

  src = fetchFromGitHub {
    owner = "TecharoHQ";
    repo = "anubis";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-yY8dwWyQy/N3A32MYtxLWAJCmR9rtSyzaYUHBNXRm/0=";
+    hash = "sha256-YFjUgePFDH6OvlLNEF2F55Z5lr4lw5vXXXSnEySQDRk=";
  };

-  vendorHash = "sha256-+NPwL4p0p/s74m1Ld0z2GEcsWk5FqhcLbHrTNP3yEzk=";
+  vendorHash = "sha256-5eHlR1zMogegkCO9yCU0kZcNQhTdDha0WhUPeR5eep8=";

  npmDeps = fetchNpmDeps {
    name = "anubis-npm-deps";
    inherit (finalAttrs) src;
-    hash = "sha256-SPoI66jy2XS4FM6BaJPt18dV1QM12nIOdeD5sAMaOzQ=";
+    hash = "sha256-DDql6lIZdqv59wl7oJSY6SrXe+EYpy6aaRqOGukunm8=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/cl/clickhouse/lts.nix
+++ b/pkgs/by-name/cl/clickhouse/lts.nix
@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "26.3.17.56-lts";
-  rev = "c57540de480d8a501b601163471d3843674378cf";
-  hash = "sha256-fcRxZbcp7t28bC9vlmgVAV9gB63cQwFWsc0gyKxGhvQ=";
+  version = "26.3.17.110-lts";
+  rev = "59141459d999fabdcf3d1dd88cdd5ed6f10136ee";
+  hash = "sha256-d2PWzWyZNVC9gdT8WKkjK8zwnMVx2bMIje8Q8GnLQNc=";
  lts = true;
 }
--- a/pkgs/by-name/de/debcraft/package.nix
+++ b/pkgs/by-name/de/debcraft/package.nix
@@ -6,14 +6,14 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "debcraft";
-  version = "0.9.2";
+  version = "0.9.3";

  src = fetchFromGitLab {
    domain = "salsa.debian.org";
    owner = "debian";
    repo = "debcraft";
    tag = "debian/${finalAttrs.version}";
-    hash = "sha256-U8qWT26qno2zpfdsLqlqZg0SipvHCN6dUjUCjGuyrkY=";
+    hash = "sha256-o/rFKsAryj+lFaRpKD1x1z+2XgnuXmZsaTKGhJdU1Zo=";
  };

  strictDeps = true;
--- a/pkgs/by-name/fn/fn-cli/package.nix
+++ b/pkgs/by-name/fn/fn-cli/package.nix
@@ -7,13 +7,13 @@

 buildGoModule (finalAttrs: {
  pname = "fn";
-  version = "0.6.61";
+  version = "0.6.63";

  src = fetchFromGitHub {
    owner = "fnproject";
    repo = "cli";
    rev = finalAttrs.version;
-    hash = "sha256-uw4fH3PyuAnNEhrvw0dl2jJxP4jau3tVuAjzSgeu1Lw=";
+    hash = "sha256-KBLssIJ8s8wPIg7kOo1hiFnWB44vO9uMVHLdCGuFnY8=";
  };

  vendorHash = null;
--- a/pkgs/by-name/fo/folia-major/package.nix
+++ b/pkgs/by-name/fo/folia-major/package.nix
@@ -14,7 +14,7 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "folia-major";
-  version = "0.6.8";
+  version = "0.6.15";

  strictDeps = true;
  __structuredAttrs = true;
@@ -23,12 +23,12 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    owner = "chthollyphile";
    repo = "folia-major";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-wC6HUeSeKYupGG6TfZrmuO7XZ5xQWnlntkH/FPXoIwA=";
+    hash = "sha256-UGISQdUPQAEn80VeBf+l+HYNJtFW5bDhAw2lA5jQjfk=";
  };

  npmDeps = fetchNpmDeps {
    inherit (finalAttrs) src;
-    hash = "sha256-JvpobXMszpFU1rgdRHrtzhotBMO5aTptpVyK6T49xMM=";
+    hash = "sha256-iLem10jROG1SEHCdDO8LeV0qaJHUC5JQeXf2HAk6EgU=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/gg/ggml/package.nix
+++ b/pkgs/by-name/gg/ggml/package.nix
@@ -7,7 +7,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ggml";
-  version = "0.18.0";
+  version = "0.19.0";

  __structuredAttrs = true;
  strictDeps = true;
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "ggml-org";
    repo = "ggml";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-vXh5Kf0sXTcKa7IefyWzIC5EQC8c8ehzn+Dqhue+/nk=";
+    hash = "sha256-i2hrJMKK+Z4Vvlz4UD+XUr7jZu7/juBayBu5oQ1w580=";
  };

  # The cmake package does not handle absolute CMAKE_INSTALL_LIBDIR and CMAKE_INSTALL_INCLUDEDIR
--- a/pkgs/by-name/gv/gvm-libs/package.nix
+++ b/pkgs/by-name/gv/gvm-libs/package.nix
@@ -26,13 +26,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gvm-libs";
-  version = "23.9.1";
+  version = "23.9.2";

  src = fetchFromGitHub {
    owner = "greenbone";
    repo = "gvm-libs";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-qSXBLAMK52pbYCmxburoeN9PKFMKs3HXgrpLvGgL2Co=";
+    hash = "sha256-sHSlHxIN5aJLxciAbDu0yesnCdcVOJ59X46WRXOEKMg=";
  };

  postPatch = ''
--- a/pkgs/by-name/ha/hayabusa-sec/package.nix
+++ b/pkgs/by-name/ha/hayabusa-sec/package.nix
@@ -3,26 +3,26 @@
  rustPlatform,
  fetchFromGitHub,
  makeWrapper,
-  unstableGitUpdater,
+  nix-update-script,
  pkg-config,
  openssl,
  rust-jemalloc-sys,
 }:

-rustPlatform.buildRustPackage {
+rustPlatform.buildRustPackage (finalAttrs: {
  pname = "hayabusa-sec";
-  version = "3.7.0-unstable-2025-12-02";
+  version = "4.0.0";

  src = fetchFromGitHub {
    owner = "Yamato-Security";
    repo = "hayabusa";
-    rev = "1c4f332b446f20af154257b2e9b581f7bcb4b1a2";
-    hash = "sha256-JWb54yudfB6pOMZca8sFeoRqNA7M//xJ3IBKfIcGBnM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-MabwaHKbbC8fbnICkVMA+bu7zBasIztMR4m0ro8vhYA=";
    # Include the hayabusa-rules
    fetchSubmodules = true;
  };

-  cargoHash = "sha256-JIHkFokaZ+nt1hW+gRxFrb1DVZcm4jsZKT12gx/BRCA=";
+  cargoHash = "sha256-PbzMVJPyBOfpS9j3d0RHOlFNJLApU1Gc5O1ro2LROYY=";

  nativeBuildInputs = [
    makeWrapper
@@ -49,15 +49,17 @@ rustPlatform.buildRustPackage {
    makeWrapper $out/share/hayabusa-sec/hayabusa $out/bin/hayabusa
  '';

-  passthru.updateScript = unstableGitUpdater { };
+  passthru.updateScript = nix-update-script { rev-prefix = "v"; };

  meta = {
    description = "Sigma-based threat hunting and fast forensics timeline generator for Windows event logs";
    homepage = "https://github.com/Yamato-Security/hayabusa";
+    changelog = "https://github.com/Yamato-Security/hayabusa/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.agpl3Plus;
    maintainers = with lib.maintainers; [
      jk
+      d3vil0p3r
    ];
    mainProgram = "hayabusa";
  };
-}
+})
--- a/pkgs/by-name/ho/home-manager/package.nix
+++ b/pkgs/by-name/ho/home-manager/package.nix
@@ -18,14 +18,14 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "home-manager";
-  version = "0-unstable-2026-07-21";
+  version = "0-unstable-2026-08-06";

  src = fetchFromGitHub {
    name = "home-manager-source";
    owner = "nix-community";
    repo = "home-manager";
-    rev = "deeb6b7eb7e0c44ae1819c051ce175bd92a85100";
-    hash = "sha256-ouZe80aWEhMLVMkqICFDN+JUw+0FJtCr/bh+hHtRtMg=";
+    rev = "7834e82588860aaf780cec1366524456a70898d7";
+    hash = "sha256-TIDlLTLI1/pB7IqgjzcKQjpODQsZE2oII4XGG9B6KjI=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/it/itch-dl/package.nix
+++ b/pkgs/by-name/it/itch-dl/package.nix
@@ -6,14 +6,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "itch-dl";
-  version = "0.7.2";
+  version = "1.0.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "DragoonAethis";
    repo = "itch-dl";
    tag = finalAttrs.version;
-    hash = "sha256-4+Idh76o/VbdQ6hgvQsrz9AGYeOGC2hgN0kMJz+ik2E=";
+    hash = "sha256-var0iT10MT/QjCkF9GUlLufXdMi5tweH8HAlhqXckpU=";
  };

  nativeBuildInputs = with python3Packages; [
--- a/pkgs/by-name/ja/jackett/package.nix
+++ b/pkgs/by-name/ja/jackett/package.nix
@@ -12,13 +12,13 @@

 buildDotnetModule (finalAttrs: {
  pname = "jackett";
-  version = "0.24.2288";
+  version = "0.24.2335";

  src = fetchFromGitHub {
    owner = "jackett";
    repo = "jackett";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-6K/9napcF5T57ziPhbU5glQAkWCEOzFjn9KToB1vVO4=";
+    hash = "sha256-QDpjw525VHumabdeRwDxvsUxzJXTxQneezR8YDEHdLE=";
  };

  projectFile = "src/Jackett.Server/Jackett.Server.csproj";
--- a/pkgs/by-name/mi/mindustry/package.nix
+++ b/pkgs/by-name/mi/mindustry/package.nix
@@ -260,6 +260,7 @@ stdenv.mkDerivation {
      chkno
      fgaz
      thekostins
+      indium114
    ];
    platforms = lib.platforms.all;
    # TODO alsa-lib is linux-only, figure out what dependencies are required on Darwin
--- a/pkgs/by-name/n8/n8n/package.nix
+++ b/pkgs/by-name/n8/n8n/package.nix
@@ -27,20 +27,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "n8n";
-  version = "2.32.6";
+  version = "2.33.7";

  src = fetchFromGitHub {
    owner = "n8n-io";
    repo = "n8n";
    tag = "n8n@${finalAttrs.version}";
-    hash = "sha256-wWm6vGyJ2I2SBU38gRGaZG2FR5FBxH6V/sWQwn5B4Ac=";
+    hash = "sha256-6QysdmXgSxfJpNaL10HogrnNYEyrxZLdkfgBnRiXWX4=";
  };

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
    pnpm = pnpm_10;
    fetcherVersion = 4;
-    hash = "sha256-D8CKJxU2RoMjNrqIgGDE3mFBjc0kqFLQzT/DdUpiNmY=";
+    hash = "sha256-Ei/8j+KvhZVgqteA+bqNsL11IMGzWn3OHngDpsEH6jk=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/nr/nrsc5/package.nix
+++ b/pkgs/by-name/nr/nrsc5/package.nix
@@ -21,13 +21,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "nrsc5";
-  version = "3.1.0";
+  version = "3.2.0";

  src = fetchFromGitHub {
    owner = "theori-io";
    repo = "nrsc5";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-xfgTUIaXt/nb5hNiwi4ws7pzeVGOW72LDSIXg+yLwkw=";
+    hash = "sha256-0YTkgTxXBSu4AHBx6ry07WW8T/9UR7n4g/lXBVW23A0=";
  };

  postUnpack = ''
--- a/pkgs/by-name/ol/olympus-unwrapped/package.nix
+++ b/pkgs/by-name/ol/olympus-unwrapped/package.nix
@@ -22,9 +22,9 @@ let

  phome = "$out/lib/olympus";
  # The following variables are to be updated by the update script.
-  version = "26.07.27.01";
-  buildId = "5729"; # IMPORTANT: This line is matched with regex in update.sh.
-  rev = "27b8912f014cebb985a9216efef82f1cfe0eb016";
+  version = "26.08.04.01";
+  buildId = "5755"; # IMPORTANT: This line is matched with regex in update.sh.
+  rev = "f70fb434a072b34f25d2adc83da76a1e36748242";
 in
 buildDotnetModule {
  pname = "olympus-unwrapped";
@@ -37,7 +37,7 @@ buildDotnetModule {
    owner = "EverestAPI";
    repo = "Olympus";
    fetchSubmodules = true; # Required. See upstream's README.
-    hash = "sha256-XLP0OOI+qb10pZ135BBVw9MI4s7fFIEmXJVgKbxW6oA=";
+    hash = "sha256-/cnzAcmRB7wVylLlddgO2lgB9J9hR81zLIYDiiXieak=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/pl/plexRaw/package.nix
+++ b/pkgs/by-name/pl/plexRaw/package.nix
@@ -14,7 +14,7 @@
 # server, and the FHS userenv and corresponding NixOS module should
 # automatically pick up the changes.
 stdenv.mkDerivation rec {
-  version = "1.43.2.10687-563d026ea";
+  version = "1.43.3.10861-07dfddaeb";
  pname = "plexmediaserver";

  # Fetch the source
@@ -22,12 +22,12 @@ stdenv.mkDerivation rec {
    if stdenv.hostPlatform.system == "aarch64-linux" then
      fetchurl {
        url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_arm64.deb";
-        sha256 = "188xk00gdd0ya7c2n26f4n6zpkndmmswbz23dl33zwcf14275hbz";
+        sha256 = "1bhm5y803ggzhss4va9hfkal7f91vf1yr2idr0h3kkam1q8hch1d";
      }
    else
      fetchurl {
        url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_amd64.deb";
-        sha256 = "13mfmlwvpimyrm3dkdlsr0b9qpbyy5l62q2ckh1xvzgj978j62bn";
+        sha256 = "0cnk5zqiyq59z5xc8p0hj33ikfzagc56n6c4f6kxhzfbnh8akhxk";
      };
  outputs = [
    "out"
--- a/pkgs/by-name/pr/prometheus-atlas-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-atlas-exporter/package.nix
@@ -4,24 +4,27 @@
  fetchFromGitHub,
 }:

-buildGoModule rec {
+buildGoModule (finalAttrs: {
  pname = "atlas-exporter";
-  version = "1.0.4";
+  version = "1.0.5";
+
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "czerwonk";
    repo = "atlas_exporter";
-    rev = version;
-    sha256 = "sha256-vhUhWO7fQpUHT5nyxbT8AylgUqDNZRSb+EGRNGZJ14E=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-GvjZhQsKR0qqSnfHarLct1z5BdusvODLnVxOtZCLAXo=";
  };

-  vendorHash = "sha256-tR+OHxj/97AixuAp0Kx9xQsKPAxpvF6hDha5BgMBha0=";
+  vendorHash = "sha256-Wq1rMkKfGiLG3qIL51VZoUWIsb3ANs1p81g94iYNJwE=";

  meta = {
    description = "Prometheus exporter for RIPE Atlas measurement results";
    mainProgram = "atlas_exporter";
    homepage = "https://github.com/czerwonk/atlas_exporter";
+    changelog = "https://github.com/czerwonk/atlas_exporter/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.lgpl3;
    maintainers = with lib.maintainers; [ clerie ];
  };
-}
+})
--- a/pkgs/by-name/re/restate/package.nix
+++ b/pkgs/by-name/re/restate/package.nix
@@ -26,16 +26,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "restate";
-  version = "1.7.2";
+  version = "1.7.3";

  src = fetchFromGitHub {
    owner = "restatedev";
    repo = "restate";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-UXyDlrhCVD4lPVnlNvLg8QcV+nBOmHrq8m0eiJFsq/c=";
+    hash = "sha256-b3IjQDTl8ci5gimlGLkynNbihIbOzh58GqYPFqJGJF0=";
  };

-  cargoHash = "sha256-Enouq6a0V0q/raMfjXIDIijF1gb7ezBn1kFIqxwklp4=";
+  cargoHash = "sha256-ElTTl2erDT3+b21lKfkPRyFrn3cvL0+VziEMLELwNaU=";

  env = {
    PROTOC = lib.getExe protobuf;
--- a/pkgs/by-name/ri/rime-wanxiang/package.nix
+++ b/pkgs/by-name/ri/rime-wanxiang/package.nix
@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "rime-wanxiang";
-  version = "16.3.2";
+  version = "17.2.2";

  src = fetchFromGitHub {
    owner = "amzxyz";
    repo = "rime-wanxiang";
    tag = "v" + finalAttrs.version;
-    hash = "sha256-lSfoL7fX1SYlcgGz24vpgjBq/ixomISnWDuOuPh/0eE=";
+    hash = "sha256-wMBhRSSo/PwQ8kW7URflrYO5xqB7qCEo1ME+ai0SJQ4=";
  };

  installPhase = ''
--- a/pkgs/by-name/s7/s7/package.nix
+++ b/pkgs/by-name/s7/s7/package.nix
@@ -26,14 +26,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "s7";
-  version = "11.9-unstable-2026-07-10";
+  version = "11.9-unstable-2026-07-29";

  src = fetchFromGitLab {
    domain = "cm-gitlab.stanford.edu";
    owner = "bil";
    repo = "s7";
-    rev = "2a631b545cbe66d9cf3f5343fbaab1449e3d8957";
-    hash = "sha256-gYgwQDcWgugZemM2kNu09hwNtJqT49AmvXPlxj+/Ink=";
+    rev = "779e11342679c7f5082e1fac8af50535fbf7513e";
+    hash = "sha256-7IkWDY07K7byE+yBvswjAP/9m719wp/EOuxSjmCfE4g=";
  };

  buildInputs =
--- a/pkgs/by-name/sh/sh4d0wup/package.nix
+++ b/pkgs/by-name/sh/sh4d0wup/package.nix
@@ -20,16 +20,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "sh4d0wup";
-  version = "0.11.0";
+  version = "0.11.1";

  src = fetchFromGitHub {
    owner = "kpcyrd";
    repo = "sh4d0wup";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-gzkh+JYwuYvdNljB6agEVd7WxqJ5lI3sseY3BlkLmXs=";
+    hash = "sha256-r3ACagjyCWNNQAoDLhUAk2lybIU2TXvNHii7r0g2DrI=";
  };

-  cargoHash = "sha256-FjRlKlOX78QClzhhFhkZuaOLA6XpFziSghJltlRPt20=";
+  cargoHash = "sha256-ELFiW3OKI/FrTl9jMxzSUbXVV2KLfQdQ1dZc0KdNxEo=";

  nativeBuildInputs = [
    makeWrapper
--- a/pkgs/by-name/st/stalwart_0_15/webadmin.nix
+++ b/pkgs/by-name/st/stalwart_0_15/webadmin.nix
@@ -3,6 +3,7 @@
  rustPlatform,
  stalwart_0_15,
  fetchFromGitHub,
+  fetchpatch,
  trunk,
  tailwindcss_3,
  fetchNpmDeps,
@@ -15,6 +16,24 @@
  zip,
 }:

+let
+
+  # apply upstream fix https://github.com/wasm-bindgen/wasm-bindgen/pull/4380,
+  # as we cannot change the wasm-bindgen version, as it's pinned to 0.2.93.
+  wasmBindgenCliPatched =
+    let
+      wasmBindgenCliDedupExportsPatch = fetchpatch {
+        url = "https://github.com/wasm-bindgen/wasm-bindgen/commit/b375e974cf30a203f1ea7f6320ad32759c5cb9e6.patch";
+        relative = "crates/cli-support";
+        hash = "sha256-pejDKqNbtlpLLqNcdpwgxDSxsGxyv5V8/QeK+OCY3qw=";
+      };
+    in
+    wasm-bindgen-cli_0_2_93.overrideAttrs (old: {
+      postPatch = (old.postPatch or "") + ''
+        patch -p1 -d "$cargoDepsCopy"/*/wasm-bindgen-cli-support-* < ${wasmBindgenCliDedupExportsPatch}
+      '';
+    });
+in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "webadmin";
  version = "0.1.37";
@@ -46,7 +65,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    tailwindcss_3
    trunk
    # needs to match with wasm-bindgen version in upstreams Cargo.lock
-    wasm-bindgen-cli_0_2_93
+    wasmBindgenCliPatched

    zip
  ];
--- a/pkgs/by-name/st/stremio-linux-shell/package.nix
+++ b/pkgs/by-name/st/stremio-linux-shell/package.nix
@@ -26,7 +26,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "stremio-linux-shell";
-  version = "1.1.4";
+  version = "1.2.0";

  strictDeps = true;
  __structuredAttrs = true;
@@ -35,10 +35,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "Stremio";
    repo = "stremio-linux-shell";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-cwETbsY9WEqOi59jObTUKfcoWZxJ0JS4Ql31dCxz2TA=";
+    hash = "sha256-JFG+sUuK+l8Ik00vHPiXJwan0rmMBiY85DnvudYKCsw=";
  };

-  cargoHash = "sha256-n1JBFJxYPhndkPx8izuUNkiefKHXrL19sk+XK7+W0xA=";
+  cargoHash = "sha256-FnQ2FN9NtL/YyRmLlyGQApjzV/4uS8OnnY8kbTWTGe8=";

  patches = [
    ./out-path.patch
--- a/pkgs/by-name/uc/ucx/package.nix
+++ b/pkgs/by-name/uc/ucx/package.nix
@@ -125,6 +125,8 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    description = "Unified Communication X library";
    homepage = "https://www.openucx.org";
+    downloadPage = "https://github.com/openucx/ucx";
+    changelog = "https://github.com/openucx/ucx/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.bsd3;
    platforms = lib.platforms.linux;
    # LoongArch64 is not supported.
--- a/pkgs/by-name/un/unifi/package.nix
+++ b/pkgs/by-name/un/unifi/package.nix
@@ -11,7 +11,7 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "unifi-controller";
-  version = "10.5.54";
+  version = "10.5.67";

  # See https://community.ui.com/releases or https://www.ui.com/download/unifi.
  #
@@ -19,7 +19,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  # as well.
  src = fetchurl {
    url = "https://dl.ui.com/unifi/${finalAttrs.version}/unifi_sysvinit_all.deb";
-    hash = "sha256-Ed6N6lbxPgCaDm7w9m8H/nlw9hBJELnzIKr0s7MoaYU=";
+    hash = "sha256-7juZuVZ4vk4di1jjgm6JEVMbErMu6L8epLSft+dvl4M=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/us/user-scanner/package.nix
+++ b/pkgs/by-name/us/user-scanner/package.nix
@@ -8,7 +8,7 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "user-scanner";
-  version = "1.4.2";
+  version = "1.4.3.1";
  pyproject = true;

  __structuredAttrs = true;
@@ -17,7 +17,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
    owner = "kaifcodec";
    repo = "user-scanner";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-IQx8xZYfTBu6bqaaHK+xKH6+lfL7i4qDOW/khHP+va4=";
+    hash = "sha256-7A4XxxUHyvEcZcAgGWzg79B/X0ePAdIt7yPM+nGsZGc=";
  };

  build-system = with python3Packages; [ flit-core ];
--- a/pkgs/by-name/va/vale/styles.nix
+++ b/pkgs/by-name/va/vale/styles.nix
@@ -62,12 +62,12 @@ in

  google = buildStyle rec {
    name = "Google";
-    version = "0.7.0";
+    version = "0.7.1";
    src = fetchFromGitHub {
      owner = "errata-ai";
      repo = "Google";
      rev = "v${version}";
-      hash = "sha256-ZNAQ9ITsp+DJxyCI1jd7c7JQIPnR5C3H4SvkaF6CV2Q=";
+      hash = "sha256-fGhbLgi3HQF8iKnUBgxPFlctQr8ebZfmYEksxyv0reQ=";
    };
    meta = {
      description = "Vale-compatible implementation of the Google Developer Documentation Style Guide";
--- a/pkgs/by-name/ve/verilator/package.nix
+++ b/pkgs/by-name/ve/verilator/package.nix
@@ -74,6 +74,11 @@ stdenv.mkDerivation (finalAttrs: {
    ci/* ci/docker/run/* ci/docker/run/hooks/* ci/docker/buildenv/build.sh
    # verilator --gdbbt uses /bin/sh to test if gdb works.
    substituteInPlace bin/verilator --replace-fail "/bin/sh" "${bash}/bin/sh"
+  ''
+  # prevent rewriting the lexer signatures to size_t for macOS 26+; upstream flex's FlexLexer.h uses int.
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace src/flexfix \
+      --replace-fail 'if platform.system() == "Darwin":' 'if False:'
  '';
  # grep '^#!/' -R . | grep -v /nix/store | less
  # (in nix-shell after patchPhase)
@@ -103,6 +108,7 @@ stdenv.mkDerivation (finalAttrs: {
    platforms = lib.platforms.unix;
    maintainers = with lib.maintainers; [
      thoughtpolice
+      carlossless
    ];
  };
 })
--- a/pkgs/by-name/vi/vim-classic/package.nix
+++ b/pkgs/by-name/vi/vim-classic/package.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  stdenv,
+  fetchFromSourcehut,
+  ncurses,
+  nix-update-script,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "vim-classic";
+  version = "8.3.0";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromSourcehut {
+    owner = "~sircmpwn";
+    repo = "vim-classic";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-BJuxs7pOMmPVew+W3d/6KFEah6I8TQoRJ4SK8/4daas=";
+  };
+
+  buildInputs = [
+    ncurses
+  ];
+
+  # Same as `vim`: fortified glibc aborts on `:syntax on` ("buffer overflow detected")
+  hardeningDisable =
+    if stdenv.cc.isClang then
+      [
+        "strictflexarrays1"
+      ]
+    else
+      [ "fortify" ];
+
+  enableParallelBuilding = true;
+  # The `install` target races between `strip`ping the installed binary and running it to generate
+  # the help tags: "strip: ...: Text file busy"
+  enableParallelInstalling = false;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Long-term maintenance fork of Vim 8.2";
+    homepage = "https://vim-classic.org";
+    downloadPage = "https://sr.ht/~sircmpwn/vim-classic/";
+    changelog = "https://git.sr.ht/~sircmpwn/vim-classic/refs/${finalAttrs.src.tag}";
+    license = lib.licenses.vim;
+    maintainers = with lib.maintainers; [ corps-fini ];
+    platforms = lib.platforms.unix;
+    mainProgram = "vim";
+  };
+})
--- a/pkgs/development/cuda-modules/packages/nccl-ep.nix
+++ b/pkgs/development/cuda-modules/packages/nccl-ep.nix
@@ -0,0 +1,91 @@
+{
+  _cuda,
+  backendStdenv,
+  cudaAtLeast,
+  cudaNamePrefix,
+  cudaOlder,
+  lib,
+
+  # nativeBuildInputs
+  python3Packages,
+  autoAddDriverRunpath,
+  cuda_nvcc,
+  which,
+
+  # buildInputs
+  cccl,
+  cuda_crt ? null, # only exists in cudaPackages with CUDA >= 13.0
+  cuda_cudart,
+  nccl,
+}:
+
+let
+  epFlags = _cuda.lib.formatCapabilities {
+    inherit (_cuda.db) cudaCapabilityToInfo;
+    inherit (backendStdenv) cudaForwardCompat;
+    cudaCapabilities = lib.filter (
+      cudaCapability: lib.versionAtLeast cudaCapability "9.0"
+    ) backendStdenv.cudaCapabilities;
+  };
+in
+
+backendStdenv.mkDerivation (finalAttrs: {
+  name = "${cudaNamePrefix}-${finalAttrs.pname}-${finalAttrs.version}";
+  pname = "nccl-ep";
+  inherit (nccl) src version;
+  sourceRoot = "${finalAttrs.src.name}/contrib/nccl_ep";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    autoAddDriverRunpath
+    cuda_nvcc
+    which
+  ];
+
+  buildInputs = [
+    cccl
+    cuda_cudart
+    (lib.getLib nccl)
+  ]
+
+  ++ lib.optionals (cudaOlder "13.0") [ (lib.getInclude cuda_nvcc) ]
+  ++ lib.optionals (cudaAtLeast "13.0") [ cuda_crt ];
+
+  makeFlags = [
+    "CUDA_HOME=${lib.getBin cuda_nvcc}"
+    "CUDA_INC=${lib.getInclude cuda_cudart}/include"
+    "CUDA_LIB=${lib.getLib cuda_cudart}/lib"
+    "LDFLAGS=-L${lib.getLib cuda_cudart}/lib/stubs"
+    "NCCL_INCDIR=${lib.getInclude nccl}/include"
+    "NCCL_LIBDIR=${lib.getLib nccl}/lib"
+    "NCCL_EP_BUILDDIR=${placeholder "out"}"
+  ]
+  ++ lib.optionals (epFlags.cudaCapabilities != [ ]) [ "NVCC_GENCODE=${epFlags.gencodeString}" ];
+  buildFlags = [ "lib" ];
+
+  installPhase = ''
+    runHook preInstall
+
+    rm -rf "$out/obj"
+
+    ln -s ${lib.getInclude nccl}/include/nccl.h "$out/include/nccl.h"
+    ln -s ${lib.getInclude nccl}/include/nccl_device.h "$out/include/nccl_device.h"
+    ln -s ${lib.getInclude nccl}/include/nccl_device "$out/include/nccl_device"
+
+    runHook postInstall
+  '';
+
+  passthru.tests = {
+    inherit (python3Packages) nccl4py;
+  };
+
+  meta = {
+    description = "Expert-parallelism (MoE dispatch/combine) extension library for NCCL";
+    homepage = "https://github.com/NVIDIA/nccl/blob/master/contrib/nccl_ep/README.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ thefossguy ];
+    inherit (nccl.meta) platforms badPlatforms;
+  };
+})
--- a/pkgs/development/python-modules/cuda-core/default.nix
+++ b/pkgs/development/python-modules/cuda-core/default.nix
@@ -24,6 +24,8 @@

  # passthru
  cuda-core,
+  python,
+  runCommand,

  cudaSupport ? config.cudaSupport,
 }:
@@ -80,6 +82,7 @@ buildPythonPackage.override { stdenv = cudaPackages.backendStdenv; } (finalAttrs
  '';

  dependencies = [
+    cuda-bindings
    cuda-pathfinder
    numpy
  ];
@@ -118,9 +121,22 @@ buildPythonPackage.override { stdenv = cudaPackages.backendStdenv; } (finalAttrs
  # Tests require a GPU
  doCheck = false;

-  passthru.gpuCheck = cuda-core.overridePythonAttrs {
-    requiredSystemFeatures = [ "cuda" ];
-    doCheck = true;
+  passthru = {
+    tests = {
+      import-clean-env =
+        runCommand "import-clean-env-cuda-core"
+          {
+            nativeBuildInputs = [ (python.withPackages (_: [ finalAttrs.finalPackage ])) ];
+          }
+          ''
+            python -c 'import cuda.core'
+            touch $out
+          '';
+    };
+    gpuCheck = cuda-core.overridePythonAttrs {
+      requiredSystemFeatures = [ "cuda" ];
+      doCheck = true;
+    };
  };

  meta = {
--- a/pkgs/development/python-modules/digi-xbee/default.nix
+++ b/pkgs/development/python-modules/digi-xbee/default.nix
@@ -4,20 +4,25 @@
  pyserial,
  srp,
  lib,
+  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "digi-xbee";
  version = "1.5.0";
-  format = "setuptools";
+
+  __structuredAttrs = true;
+  pyproject = true;

  src = fetchPypi {
    pname = "digi_xbee";
-    inherit version;
+    inherit (finalAttrs) version;
    hash = "sha256-amUrhHIpeRHuShD0cxb2sbbRTpJQZ9/b8otsa1Bo+bI=";
  };

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    pyserial
    srp
  ];
@@ -45,8 +50,9 @@ buildPythonPackage rec {

  meta = {
    description = "Python library to interact with Digi International's XBee radio frequency modules";
+    changelog = "https://github.com/digidotcom/xbee-python/blob/${finalAttrs.version}/CHANGELOG.rst";
    homepage = "https://github.com/digidotcom/xbee-python";
    license = lib.licenses.mpl20;
    maintainers = with lib.maintainers; [ jefflabonte ];
  };
-}
+})
--- a/pkgs/development/python-modules/kserve/default.nix
+++ b/pkgs/development/python-modules/kserve/default.nix
@@ -60,7 +60,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "kserve";
-  version = "0.19.0";
+  version = "0.20.0";
  pyproject = true;
  __structuredAttrs = true;

@@ -68,7 +68,7 @@ buildPythonPackage (finalAttrs: {
    owner = "kserve";
    repo = "kserve";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-i8eFdXwNLPTdEj2MnNAMbefxQGkMLHNwZXxg8+zv6v0=";
+    hash = "sha256-XSEdhYrsSdrKjHnFCoMPoS0nAZ+Fa8JGj+izVw3wl0o=";
  };

  sourceRoot = "${finalAttrs.src.name}/python/kserve";
--- a/pkgs/development/python-modules/nccl4py/default.nix
+++ b/pkgs/development/python-modules/nccl4py/default.nix
@@ -14,6 +14,10 @@
  packaging,
  pythonOlder,
  typing-extensions,
+
+  # passthru
+  runCommand,
+  python,
 }:

 buildPythonPackage (finalAttrs: {
@@ -50,6 +54,21 @@ buildPythonPackage (finalAttrs: {
        --replace-fail \
          'cdef uintptr_t handle = load_nvidia_dynamic_lib("nccl")._handle_uint' \
          'cdef uintptr_t handle = <uintptr_t>dlopen("${lib.getLib cudaPackages.nccl}/lib/libnccl.so.2", RTLD_NOW | RTLD_GLOBAL)'
+
+      substituteInPlace nccl/bindings/_internal/nccl_ep_linux.pyx \
+        --replace-fail \
+          "handle = dlopen('libcuda.so.1'" \
+          "handle = dlopen('${libCudaPath}/lib/libcuda.so.1'"
+
+      substituteInPlace nccl/bindings/_internal/nccl_ep_linux.pyx \
+        --replace-fail \
+          'load_nvidia_dynamic_lib("nccl")' \
+          'dlopen("${lib.getLib cudaPackages.nccl}/lib/libnccl.so.2", RTLD_NOW | RTLD_GLOBAL)'
+
+      substituteInPlace nccl/bindings/_internal/nccl_ep_linux.pyx \
+        --replace-fail \
+          'cdef bytes path_bytes = _resolve_library_path().encode()' \
+          'cdef bytes path_bytes = b"${lib.getLib cudaPackages.nccl-ep}/lib/libnccl_ep.so"'
    '';

  build-system = [
@@ -60,6 +79,10 @@ buildPythonPackage (finalAttrs: {
  env = {
    # `${sourceRoot}/setup.py` insists on reading only from $CUDA_HOME/include
    CUDA_HOME = (lib.getInclude cudaPackages.cuda_cudart).outPath;
+    # Since `cudaPackages.nccl-ep` is used as a byte string, it gets
+    # compressed and no dependency is created. Disable string
+    # compression for Nix to correctly detect the dependency.
+    NIX_CLFAGS_COMPILE = "-DCYTHON_COMPRESS_STRINGS=0";
  };

  buildInputs =
@@ -84,6 +107,19 @@ buildPythonPackage (finalAttrs: {
    "nccl.bindings"
  ];

+  passthru.tests = {
+    import-clean-env =
+      runCommand "import-clean-env-nccl4py-ep"
+        {
+          nativeBuildInputs = [ (python.withPackages (_: [ finalAttrs.finalPackage ])) ];
+        }
+        ''
+          LD_LIBRARY_PATH="${lib.getLib cudaPackages.cuda_cudart}/lib/stubs" \
+              python -c 'import nccl.ep'
+          touch $out
+        '';
+  };
+
  # Upstream doesn't ship any tests.
  doCheck = false;

--- a/pkgs/development/python-modules/notobuilder/default.nix
+++ b/pkgs/development/python-modules/notobuilder/default.nix
@@ -21,14 +21,14 @@

 buildPythonPackage {
  pname = "notobuilder";
-  version = "0-unstable-2026-02-25";
+  version = "0-unstable-2026-06-26";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "notofonts";
    repo = "notobuilder";
-    rev = "5c15f266be1f24587adad807e2f1f3ff9ff537a8";
-    hash = "sha256-Tw1riTHORtIpOq8PjSspIR044TBupYgXkI8fBiBkgJI=";
+    rev = "5b55818eb3f535481135a5f57a337eec6d28cda0";
+    hash = "sha256-pdfWl8rp4tizgb7j0UR7hOW/Ae2dPhTSw1IHljM15LE=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/ttfautohint-py/default.nix
+++ b/pkgs/development/python-modules/ttfautohint-py/default.nix
@@ -13,14 +13,14 @@

 buildPythonPackage rec {
  pname = "ttfautohint-py";
-  version = "0.6.0";
+  version = "0.6.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "fonttools";
    repo = "ttfautohint-py";
    tag = "v${version}";
-    hash = "sha256-wA8su7HEQnDbCShrX9fiP/VKNMtMqeayHbQXHqy8iOA=";
+    hash = "sha256-fLtGg2SsdeI58agZ10CB2/bOdSnrfkRloCPKkMwwXU8=";
  };

  postPatch = ''
--- a/pkgs/kde/default.nix
+++ b/pkgs/kde/default.nix
@@ -76,6 +76,7 @@ let
        kirigami-addons = self.callPackage ./misc/kirigami-addons { };
        kio-extras-kf5 = self.callPackage ./misc/kio-extras-kf5 { };
        kio-fuse = self.callPackage ./misc/kio-fuse { };
+        kio-s3 = self.callPackage ./misc/kio-s3 { };
        klevernotes = self.callPackage ./misc/klevernotes { };
        ktextaddons = self.callPackage ./misc/ktextaddons { };
        kup = self.callPackage ./misc/kup { };
--- a/pkgs/kde/misc/kio-s3/default.nix
+++ b/pkgs/kde/misc/kio-s3/default.nix
@@ -0,0 +1,35 @@
+{
+  lib,
+  mkKdeDerivation,
+  fetchurl,
+  pkg-config,
+  aws-sdk-cpp,
+  kcmutils,
+}:
+let
+  aws-sdk-cpp-s3 = aws-sdk-cpp.override { apis = [ "s3" ]; };
+in
+mkKdeDerivation rec {
+  pname = "kio-s3";
+  version = "1.0.2";
+
+  src = fetchurl {
+    url = "mirror://kde/stable/kio-s3/kio-s3-${version}.tar.xz";
+    hash = "sha256-zixxrZm1U6iaCyZeGBe1lP9ojDqd2qOaekkEa6dyEao=";
+  };
+
+  extraNativeBuildInputs = [ pkg-config ];
+  extraBuildInputs = [
+    aws-sdk-cpp-s3
+    kcmutils
+  ];
+
+  meta = {
+    license = with lib.licenses; [
+      bsd3
+      cc-by-10
+      gpl2Plus
+    ];
+    maintainers = with lib.maintainers; [ daroche ];
+  };
+}
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -8,40 +8,50 @@

 let
  inherit (lib)
-    all
    attrValues
+    concatMap
    concatMapStrings
    concatStrings
+    concatStringsSep
    filter
    findFirst
+    foldl'
    getName
+    isAttrs
+    isFunction
+    isString
    length
-    concatMap
    mutuallyExclusive
    optional
-    isAttrs
-    isString
+    optionalString
+    seq
+    unsafeGetAttrPos
    warn
-    foldl'
+    all
    ;

  inherit (lib.lists)
    any
-    toList
-    isList
    elem
+    isList
+    toList
    unique
    ;

  inherit (lib.meta)
-    platformMatch
    cpeFullVersionWithVendor
+    platformMatch
    ;

  inherit (lib.generators)
    toPretty
    ;

+  inherit (lib.licenses)
+    containsLicenses
+    isFree
+    ;
+
  inherit (builtins)
    getEnv
    ;
@@ -69,7 +79,9 @@ let
    if envVar != "" then envVar != "0" else config.allowNonSource or true;

  allowlist = config.allowlistedLicenses or config.whitelistedLicenses or [ ];
+  nonEmptyAllowList = allowlist != [ ];
  blocklist = config.blocklistedLicenses or config.blacklistedLicenses or [ ];
+  nonEmptyBlocklist = blocklist != [ ];

  areLicenseListsValid =
    if mutuallyExclusive allowlist blocklist then
@@ -81,7 +93,7 @@ let
    assert areLicenseListsValid;
    list:
    let
-      containsListLicenses = lib.licenses.containsLicenses list;
+      containsListLicenses = containsLicenses list;
    in
    attrs:
    attrs ? meta.license
@@ -103,8 +115,9 @@ let

  isUnfree =
    licenses:
-    if isAttrs licenses && licenses ? "licenseType" then
-      !(lib.licenses.isFree licenses)
+    # ? is non-strict in its type, so it doubles as performing an isAttrs check
+    if licenses ? licenseType then
+      !(isFree licenses)
    else if isAttrs licenses then
      !(licenses.free or true)
    # TODO: Returning false in the case of a string is a bug that should be fixed.
@@ -114,7 +127,8 @@ let
    else if isString licenses then
      false
    else
-      any (l: !(l.free or true)) licenses;
+      # on a list, check if any of the licenses weren't free (boolean AND)
+      any (l: !l.free or false) licenses;

  hasUnfreeLicense = attrs: attrs ? meta.license && isUnfree attrs.meta.license;

@@ -122,55 +136,83 @@ let

  # Logical inversion of meta.availableOn for hostPlatform
  hasUnsupportedPlatform =
-    hostPlatform:
-    let
-      inherit (hostPlatform) system;
-      # in almost all cases, meta.platforms is a simple list of strings, and we
-      # can just check if it contains the current system. we only run the more
+    if allowUnsupportedSystem then
+      _: _: false
+    else
+      hostPlatform:
+      let
+        containsHostSystem = elem hostPlatform.system;
+        matchesHostPlatform = any (platformMatch hostPlatform);
+      in
+      pkg:
+      # in almost all cases, platforms are a simple list of strings, and we
+      # can just check if they contains the current system. we only run the more
      # intensive platformMatch if necessary
-      anyHostPlatform = list: elem system list || any (platformMatch hostPlatform) list;
-    in
-    pkg:
-    pkg ? meta.platforms && !(anyHostPlatform pkg.meta.platforms)
-    || pkg ? meta.badPlatforms && anyHostPlatform pkg.meta.badPlatforms;
+      (
+        pkg ? meta.platforms
+        && !(containsHostSystem pkg.meta.platforms || matchesHostPlatform pkg.meta.platforms)
+      )
+      || (
+        pkg ? meta.badPlatforms
+        && (containsHostSystem pkg.meta.badPlatforms || matchesHostPlatform pkg.meta.badPlatforms)
+      );

-  isMarkedInsecure = attrs: (attrs.meta.knownVulnerabilities or [ ]) != [ ];
+  isMarkedInsecure =
+    attrs: attrs ? meta.knownVulnerabilities && attrs.meta.knownVulnerabilities != [ ];

-  # Allow granular checks to allow only some unfree packages
+  # Check whether unfree packages are allowed and if not, whether the
+  # package has an unfree license and is not explicitly allowed by the
+  # `allowUnfreePredicate` function.
+  #
  # Example:
  # {pkgs, ...}:
  # {
  #   allowUnfree = false;
  #   allowUnfreePredicate = (x: pkgs.lib.hasPrefix "vscode" x.name);
+  #   allowUnfreePackages = [ "steam" ];
  # }
-  # Defaults to allow all names defined in config.allowUnfreePackages
-  allowUnfreePredicate =
-    let
-      listPredicate = pkg: builtins.elem (lib.getName pkg) (config.allowUnfreePackages or [ ]);
-
-      # Be robust against misconfigured allowUnfreePredicate values such as null
-      explicitPredicate =
-        let
-          raw = config.allowUnfreePredicate or null;
-        in
-        if builtins.isFunction raw then raw else (_: false);
-    in
-    pkg: (listPredicate pkg) || (explicitPredicate pkg);
-
-  # Check whether unfree packages are allowed and if not, whether the
-  # package has an unfree license and is not explicitly allowed by the
-  # `allowUnfreePredicate` function.
+  # Defaults to allow all names defined in config.allowUnfreePackages, and all
+  # packages that match the unfree predicate function
  hasDeniedUnfreeLicense =
-    attrs: hasUnfreeLicense attrs && !allowUnfree && !allowUnfreePredicate attrs;
+    if allowUnfree then
+      _: false
+    else
+      let
+        listPredicate = pkg: elem (getName pkg) config.allowUnfreePackages;
+        definedListPredicate = config.allowUnfreePackages or [ ] != [ ];

-  allowInsecureDefaultPredicate =
-    x: elem (getNameWithVersion x) (config.permittedInsecurePackages or [ ]);
-  allowInsecurePredicate = config.allowInsecurePredicate or allowInsecureDefaultPredicate;
+        explicitPredicate = config.allowUnfreePredicate;
+        # Be robust against misconfigured allowUnfreePredicate values such as null
+        definedExplicitPredicate = isFunction (config.allowUnfreePredicate or null);
+      in
+      if definedListPredicate then
+        if definedExplicitPredicate then
+          attrs: hasUnfreeLicense attrs && !(listPredicate attrs || explicitPredicate attrs)
+        else
+          attrs: hasUnfreeLicense attrs && !listPredicate attrs
+      else if definedExplicitPredicate then
+        attrs: hasUnfreeLicense attrs && !explicitPredicate attrs
+      else
+        hasUnfreeLicense;

  allowInsecure = getEnv "NIXPKGS_ALLOW_INSECURE" == "1";

  hasDisallowedInsecure =
-    attrs: isMarkedInsecure attrs && !allowInsecure && !allowInsecurePredicate attrs;
+    if allowInsecure then
+      _: false
+    else if config ? allowInsecurePredicate then
+      let
+        inherit (config) allowInsecurePredicate;
+      in
+      attrs: isMarkedInsecure attrs && !allowInsecurePredicate attrs
+    else if config ? permittedInsecurePackages then
+      let
+        inherit (config) permittedInsecurePackages;
+        allowInsecurePredicate = x: elem (getNameWithVersion x) permittedInsecurePackages;
+      in
+      attrs: isMarkedInsecure attrs && !allowInsecurePredicate attrs
+    else
+      isMarkedInsecure;

  # Allow granular checks to allow only some non-source-built packages
  # Example:
@@ -290,9 +332,9 @@ let
      missingOutputs = filter (output: !elem output actualOutputs) expectedOutputs;
    in
    ''
-      The package ${getNameWithVersion attrs} has set meta.outputsToInstall to: ${builtins.concatStringsSep ", " expectedOutputs}
+      The package ${getNameWithVersion attrs} has set meta.outputsToInstall to: ${concatStringsSep ", " expectedOutputs}

-      however ${getNameWithVersion attrs} only has the outputs: ${builtins.concatStringsSep ", " actualOutputs}
+      however ${getNameWithVersion attrs} only has the outputs: ${concatStringsSep ", " actualOutputs}

      and is missing the following outputs:

@@ -427,13 +469,13 @@ let
      }

    # --- Put checks that can be ignored here ---
-    else if hasDeniedUnfreeLicense attrs && !(allowlist != [ ] && hasAllowlistedLicense attrs) then
+    else if hasDeniedUnfreeLicense attrs && !(nonEmptyAllowList && hasAllowlistedLicense attrs) then
      {
        reason = "unfree";
        msg = "has an unfree license (‘${showLicense attrs.meta.license}’)";
        remediation = remediate_allowlist "Unfree" (remediate_predicate "allowUnfreePredicate" attrs);
      }
-    else if blocklist != [ ] && hasBlocklistedLicense attrs then
+    else if nonEmptyBlocklist && hasBlocklistedLicense attrs then
      {
        reason = "blocklisted";
        msg = "has a blocklisted license (‘${showLicense attrs.meta.license}’)";
@@ -445,7 +487,7 @@ let
        msg = "contains elements not built from source (‘${showSourceType attrs.meta.sourceProvenance}’)";
        remediation = remediate_allowlist "NonSource" (remediate_predicate "allowNonSourcePredicate" attrs);
      }
-    else if hasUnsupportedPlatform' attrs && !allowUnsupportedSystem then
+    else if hasUnsupportedPlatform' attrs then
      let
        toPretty' = toPretty {
          allowPrettyValues = true;
@@ -520,9 +562,9 @@ let
    }:
    let
      outputs = attrs.outputs or [ "out" ];
-      hasOutput = out: builtins.elem out outputs;
-      maintainersPosition = builtins.unsafeGetAttrPos "maintainers" (attrs.meta or { });
-      teamsPosition = builtins.unsafeGetAttrPos "teams" (attrs.meta or { });
+      hasOutput = out: elem out outputs;
+      maintainersPosition = unsafeGetAttrPos "maintainers" (attrs.meta or { });
+      teamsPosition = unsafeGetAttrPos "teams" (attrs.meta or { });
    in
    {
      # `name` derivation attribute includes cross-compilation cruft,
@@ -675,7 +717,7 @@ let
          let
            msg =
              "Refusing to evaluate package '${getNameWithVersion attrs}' in ${pos_str meta} because it ${error.msg}"
-              + lib.optionalString (!inHydra && error.remediation != "") "\n${error.remediation}";
+              + optionalString (!inHydra && error.remediation != "") "\n${error.remediation}";
          in
          if config ? handleEvalIssue then
            if error.reason == "problem" then
@@ -690,12 +732,12 @@ let
        let
          msg =
            "Package '${getNameWithVersion attrs}' in ${pos_str meta} ${warning.msg}"
-            + lib.optionalString (!inHydra && warning.remediation != "") " ${warning.remediation}";
+            + optionalString (!inHydra && warning.remediation != "") " ${warning.remediation}";
        in
        warn msg acc;
    in
    # Give all warnings first, then error if any
-    builtins.seq (foldl' giveWarning null warnings) withError;
+    seq (foldl' giveWarning null warnings) withError;

  assertValidity =
    hostPlatform: