From 5f6876faa1b340550c753e750e7ef03b3cee4996 Mon Sep 17 00:00:00 2001
From: Ryan Omasta <git@ryand.ca>
Date: Wed, 20 May 2026 14:41:27 -0600
Subject: [PATCH 001/117] python3Packages.systemd-python: switch to systemdLibs

---
 pkgs/development/python-modules/systemd-python/default.nix | 4 ++--
 pkgs/top-level/python-packages.nix                         | 4 +---
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/systemd-python/default.nix b/pkgs/development/python-modules/systemd-python/default.nix
index 4722cb04ff40..157b4682cbda 100644
--- a/pkgs/development/python-modules/systemd-python/default.nix
+++ b/pkgs/development/python-modules/systemd-python/default.nix
@@ -3,7 +3,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   libredirect,
-  systemd,
+  systemdLibs,
   pkg-config,
   pytest,
   python,
@@ -26,7 +26,7 @@ buildPythonPackage rec {
 
   nativeBuildInputs = [ pkg-config ];
 
-  buildInputs = [ systemd ];
+  buildInputs = [ systemdLibs ];
 
   nativeCheckInputs = [
     libredirect.hook
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 29646463f2b7..5d99ef317ab6 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -19158,9 +19158,7 @@ self: super: with self; {
 
   systembridgemodels = callPackage ../development/python-modules/systembridgemodels { };
 
-  systemd-python = callPackage ../development/python-modules/systemd-python {
-    inherit (pkgs) systemd;
-  };
+  systemd-python = callPackage ../development/python-modules/systemd-python { };
 
   systemdunitparser = callPackage ../development/python-modules/systemdunitparser { };
 

From caa704f0c7618ba6a175cec4a1124b7af37c5cb5 Mon Sep 17 00:00:00 2001
From: Anton Mosich <anton@mosich.at>
Date: Sat, 20 Jun 2026 20:45:41 +0200
Subject: [PATCH 002/117] pimsync: 0.5.9 -> 0.5.10

See https://pimsync.whynothugo.nl/changelog.html#v0-5-10 for the
changelog
---
 pkgs/by-name/pi/pimsync/package.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pi/pimsync/package.nix b/pkgs/by-name/pi/pimsync/package.nix
index 630fa8ce4074..27822ef73d98 100644
--- a/pkgs/by-name/pi/pimsync/package.nix
+++ b/pkgs/by-name/pi/pimsync/package.nix
@@ -7,22 +7,23 @@
   installShellFiles,
   makeWrapper,
   xandikos,
+  cacert,
   versionCheckHook,
   nix-update-script,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "pimsync";
-  version = "0.5.9";
+  version = "0.5.10";
 
   src = fetchFromSourcehut {
     owner = "~whynothugo";
     repo = "pimsync";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-bNE0YY7bws8lEGoVg/sXuepBU1/oJPWBdn1wBGzF8s8=";
+    hash = "sha256-YqLOkv0I+1HOlWNA8HoKB6/3ccYbV8u/0BJ/+4xvde4=";
   };
 
-  cargoHash = "sha256-w3o3qxe/EADeH6LDwBxm0kvdYuwEcuj8GcoVPtBqylA=";
+  cargoHash = "sha256-9sEYeKZDMsbEUQc5V8xJzcKIzF6ugGsk3d5bTOCtYnw=";
 
   env.PIMSYNC_VERSION = finalAttrs.version;
 
@@ -38,6 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   nativeCheckInputs = [
     xandikos
+    cacert
   ];
 
   postInstall = ''

From e40cf6e6cab1ae09e5ae6085b0b8986d829f0186 Mon Sep 17 00:00:00 2001
From: Anton Mosich <anton@mosich.at>
Date: Sat, 20 Jun 2026 20:50:53 +0200
Subject: [PATCH 003/117] pimsync: add antonmosich as maintainer

---
 pkgs/by-name/pi/pimsync/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/pi/pimsync/package.nix b/pkgs/by-name/pi/pimsync/package.nix
index 27822ef73d98..d9ba3e201adb 100644
--- a/pkgs/by-name/pi/pimsync/package.nix
+++ b/pkgs/by-name/pi/pimsync/package.nix
@@ -63,7 +63,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     }";
     license = lib.licenses.eupl12;
     platforms = lib.platforms.unix;
-    maintainers = [ lib.maintainers.qxrein ];
+    maintainers = [
+      lib.maintainers.qxrein
+      lib.maintainers.antonmosich
+    ];
     mainProgram = "pimsync";
   };
 })

From 9d280168ccc67309ede60df194b8a830a164cf71 Mon Sep 17 00:00:00 2001
From: Sam Pointon <sampointon@gmail.com>
Date: Fri, 26 Jun 2026 22:18:46 +0100
Subject: [PATCH 004/117] nixos/getty: allow disabling

https://github.com/NixOS/nixpkgs/pull/480686 made getty unconditional, fixing
several bugs and bad interactions. This imposes no runtime costs due to lazy
systemd-based activation, but it does drag getty and its closure in to images.
For many NixOS installations, this is fine - they want console login and such
anyway - but it's a burden on lights-out containers aiming for minimal image
sizes.

This change adds a new configuration knob to totally disable getty for these
sorts of headless/lights-out/appliance-style set-ups. The option's description
is deliberately made stern to hopefully dissuade anyone from toggling it if
their system isn't in that class. As the option defaults to enabling getty,
there should be no behaviour change for anyone not explicitly opting themselves
in - hopefully with full knowledge of the consequences.

My local testing chopped a whole 15% off one of my images by being able to
remove getty (the big contributor being util-linux and its friends), and that's
just for one random image - others might be even bigger relative gains. I think
that's more than enough to justify this configuration knob.

I had a look for uses of getty in NixOS to see if anywhere wanted to either
have a hard dependency on getty and hence explicitly enable it (so that weird
configurations get picked up at evaluation time rather than runtime) or disable
it. The use sites fall into two categories:

0. Virtualised set-ups that wire up units to getty listening on ttyS0. These
probably don't want a hard dependency: it's reasonable to run these lights-out,
and just disabling getty will DTRT here.

1. `modules/profiles/headless.nix`, which disables some of the getty units.
This _could_ instead disable getty as a whole, but that might break e.g.
`machinectl shell`, and I can imagine set-ups where you want that even without
console login, so I have left it alone. Maybe someone else feels differently
and more strongly, and then that someone else can put together a PR and argue
their case.
---
 nixos/modules/services/ttys/getty.nix | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/ttys/getty.nix b/nixos/modules/services/ttys/getty.nix
index e8116920be47..693716e738d7 100644
--- a/nixos/modules/services/ttys/getty.nix
+++ b/nixos/modules/services/ttys/getty.nix
@@ -76,6 +76,24 @@ in
         '';
       };
 
+      enable = mkOption {
+        type = types.bool;
+        default = true;
+        description = ''
+          Include getty in the system.
+
+          getty is quiescent until called into action and does not have
+          runtime costs if it is not used. The benefit of disabling it is
+          in reducing closure size.
+
+          Disabling getty means that console login may not be possible,
+          `machinectl shell` and `login` may not work, and other ills.
+          It is only recommended for lights-out, headless containers,
+          appliances, and similar configurations not meant for any human
+          interaction ever.
+        '';
+      };
+
       loginProgram = mkOption {
         type = types.path;
         default = "${pkgs.shadow}/bin/login";
@@ -133,7 +151,7 @@ in
 
   ###### implementation
 
-  config = {
+  config = mkIf cfg.enable {
     # Note: this is set here rather than up there so that changing
     # nixos.label would not rebuild manual pages
     services.getty.greetingLine = mkDefault ''<<< Welcome to ${config.system.nixos.distroName} ${config.system.nixos.label} (\m) - \l >>>'';

From ca12f956496422789b0b10b3f71ea396d1d10388 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Charlotte=20=F0=9F=A6=9D=20Dele=C5=84kec?= <lotte@chir.rs>
Date: Thu, 2 Jul 2026 11:39:44 +0100
Subject: [PATCH 005/117] git-lfs: fix cross compile

---
 pkgs/by-name/gi/git-lfs/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gi/git-lfs/package.nix b/pkgs/by-name/gi/git-lfs/package.nix
index 345aa81d8370..f77729d8594b 100644
--- a/pkgs/by-name/gi/git-lfs/package.nix
+++ b/pkgs/by-name/gi/git-lfs/package.nix
@@ -21,7 +21,8 @@ buildGoModule (finalAttrs: {
     hash = "sha256-N5ckTnyA3mueZre+rMhFZBiAFgEu4pmtzkiUidXnan8=";
   };
 
-  vendorHash = "sha256-6H0KpLin+DqwEg5bdzaxj2CoNSneZ/ET43MTrrdF3h8=";
+  proxyVendor = true;
+  vendorHash = "sha256-SUnZ9uN43CAw/iHC8cPBm3nYD03d3Pg2pYS2PwjDCnE=";
 
   nativeBuildInputs = [
     asciidoctor
@@ -37,7 +38,7 @@ buildGoModule (finalAttrs: {
   subPackages = [ "." ];
 
   preBuild = ''
-    GOARCH= go generate ./commands
+    CC= GOOS= GOARCH= go generate ./commands
   '';
 
   postBuild = ''

From 36b929d4f4c13e0e8d74dd5f188ffc88d2b1ed47 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 2 Jul 2026 12:32:56 +0000
Subject: [PATCH 006/117] innernet: 1.7.1 -> 2.0.0

---
 pkgs/by-name/in/innernet/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/in/innernet/package.nix b/pkgs/by-name/in/innernet/package.nix
index c9604914b1f7..4b5fee216a6e 100644
--- a/pkgs/by-name/in/innernet/package.nix
+++ b/pkgs/by-name/in/innernet/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "innernet";
-  version = "1.7.1";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "tonarino";
     repo = "innernet";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wGxTdoWMHVUldW+bjli+5zqo3PRU/8tn7fxAeVrynjs=";
+    hash = "sha256-7pvQFxXf1MCmnNNQIGGkI2jhL9jC/ZLZqwiJPSFC1b8=";
   };
 
-  cargoHash = "sha256-vDPs+EEl/ZbKxOrNHc86N7+5ij+4YmsZRo5/Sxja6ms=";
+  cargoHash = "sha256-CaE2VH5CuOuEATcYrt7p7yQFQ5s0tZZomvy9VltRpRI=";
 
   nativeBuildInputs = [
     rustPlatform.bindgenHook

From f3098292215ac6a120093b3ab42df06a2d826afb Mon Sep 17 00:00:00 2001
From: Diogo Correia <me@diogotc.com>
Date: Mon, 4 May 2026 15:30:03 +0100
Subject: [PATCH 007/117] nixos/phpfpm: escape ini values

Passing a value that contains special characters (e.g., `=`) causes
phpfpm to be unable to parse the configuration file.
As per PHP's parse_ini_file function documentation [1], all values
containing non-alphanumeric characters must be enclosed in double
quotes:
> If a value in the ini file contains any non-alphanumeric characters it
> needs to be enclosed in double-quotes (").

This commit ensures string values are enclosed in double-quotes, and
appropriately escapes double-quotes, backslashes, and line breaks.

[1]: https://www.php.net/parse_ini_file
---
 .../services/web-servers/phpfpm/default.nix      |  9 +++++++++
 nixos/tests/php/fpm.nix                          | 16 ++++++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/nixos/modules/services/web-servers/phpfpm/default.nix b/nixos/modules/services/web-servers/phpfpm/default.nix
index 34845589fabe..43d394ad39f4 100644
--- a/nixos/modules/services/web-servers/phpfpm/default.nix
+++ b/nixos/modules/services/web-servers/phpfpm/default.nix
@@ -18,6 +18,15 @@ let
       "yes"
     else if false == value then
       "no"
+    else if isString value then
+      # Escape according to https://www.php.net/manual/en/function.parse-ini-file.php
+      # Not escaping `$` since users might want to use that to interpolate environment variables.
+      # Additionally, php-fpm applies post-processing to env values that start with `$` and replaces
+      # them with the respective env variable, with no way to escape: https://github.com/php/php-src/blob/631c366f9f58c8ba4078a48d1f56187cfbf8e549/sapi/fpm/fpm/fpm_env.c#L171-L180
+      # In all platforms except for Windows, PHP_EOL is the line feed `\n` character,
+      # which we use here as an escape value since php-fpm parses the config line-by-line.
+      # See https://github.com/NixOS/nixpkgs/pull/516530#issuecomment-4878738511 for more information.
+      ''"${replaceString "\n" ''" PHP_EOL "'' (escape [ "\"" "\\" ] value)}"''
     else
       toString value;
 
diff --git a/nixos/tests/php/fpm.nix b/nixos/tests/php/fpm.nix
index cb128df26ebe..16377ec19c24 100644
--- a/nixos/tests/php/fpm.nix
+++ b/nixos/tests/php/fpm.nix
@@ -44,6 +44,13 @@
           "pm.min_spare_servers" = 1;
           "pm.start_servers" = 2;
         };
+        phpEnv = {
+          # check that keywords and special characters are escaped properly
+          keyword = "false";
+          characters = "^ = \\";
+          quoted = "\"'";
+          newline = "hello\nworld";
+        };
       };
     };
   testScript =
@@ -56,6 +63,15 @@
       response = machine.wait_until_succeeds("curl -fvvv -s http://127.0.0.1:80/")
       t.assertIn("PHP Version ${php.version}", response, "PHP version not detected")
 
+      expected_env = {
+        "keyword": "false",
+        "characters": "^ = \\",
+        "quoted": "&quot;&#039;",
+        "newline": "hello\nworld",
+      }
+      for env, value in expected_env.items():
+        assert f'<tr><td class="e">{env} </td><td class="v">{value} </td></tr>' in response, f"phpEnv.{env} not detected"
+
       # Check so we have database and some other extensions loaded
       for ext in ["json", "opcache", "pdo_mysql", "pdo_pgsql", "pdo_sqlite", "apcu"]:
           assert ext in response, f"Missing {ext} extension"

From 03ac107a963d2c7910be4443cdd6ed399c5d4c92 Mon Sep 17 00:00:00 2001
From: Diogo Correia <me@diogotc.com>
Date: Sat, 4 Jul 2026 11:57:56 +0100
Subject: [PATCH 008/117] doc: add phpfpm module value escaping to 26.11 nixos
 release notes

---
 nixos/doc/manual/release-notes/rl-2611.section.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index 3ec838a06844..1526a0d536a9 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -59,6 +59,8 @@
 
 - When Avahi's mDNS resolver is enabled (`services.avahi.nssmdns4` or `services.avahi.nssmdns6`), only the minimal mDNS resolver is enabled by default to avoid adding a 5 second delay to every failed reverse hostname lookup (e.g., delaying ping by 5 seconds). The "full" mDNS resolver now remains disabled unless `services.avahi.nssmdnsFull` is also enabled. Users who have customized [`/etc/mdns.allow`](https://github.com/avahi/nss-mdns/tree/master#etcmdnsallow) to allow mDNS domains not ending `.local` must enable `services.avahi.nssmdnsFull` to continue to resolve such domains.
 
+- String values passed to `services.phpfpm.settings`, `services.phpfpm.pools.<name>.phpEnv`, and `services.phpfpm.pools.<name>.settings` are now properly quoted and escaped, except for the `${}` syntax that is left as-is. If you are manually escaping these values, please adjust accordingly.
+
 - `systemd.user.extraConfig` has been removed in favor of the structured [](#opt-systemd.user.settings.Manager) option. Use `systemd.user.settings.Manager` to set any `systemd-user.conf(5)` option directly. For example, replace `systemd.user.extraConfig = "DefaultTimeoutStartSec=60";` with `systemd.user.settings.Manager.DefaultTimeoutStartSec = 60;`.
 
 - `services.timesyncd.extraConfig` has been removed in favor of the structured [](#opt-services.timesyncd.settings.Time) option. Use `services.timesyncd.settings.Time` to set any `timesyncd.conf(5)` option directly. For example, replace `services.timesyncd.extraConfig = "PollIntervalMaxSec=180";` with `services.timesyncd.settings.Time.PollIntervalMaxSec = 180;`.

From de714bfc99046d99b99b7b70455ca3cabd298cdf Mon Sep 17 00:00:00 2001
From: Patrick <patrick@failmail.dev>
Date: Sun, 5 Jul 2026 13:39:54 +0200
Subject: [PATCH 009/117] firezone-gui-client: 1.5.1 -> 1.5.2

---
 pkgs/by-name/fi/firezone-gui-client/package.nix | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/fi/firezone-gui-client/package.nix b/pkgs/by-name/fi/firezone-gui-client/package.nix
index 4a5530b6878a..bbc69b367a77 100644
--- a/pkgs/by-name/fi/firezone-gui-client/package.nix
+++ b/pkgs/by-name/fi/firezone-gui-client/package.nix
@@ -19,7 +19,7 @@
   libayatana-appindicator,
   webkitgtk_4_1,
   wrapGAppsHook3,
-  pnpm_9,
+  pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
   nodejs,
@@ -27,12 +27,12 @@
   copyDesktopItems,
 }:
 let
-  version = "1.5.1";
+  version = "1.5.2";
   src = fetchFromGitHub {
     owner = "firezone";
     repo = "firezone";
     tag = "gui-client-${version}";
-    hash = "sha256-KozSy44Opx6cukA0QTXeMpI3fP49iyabFzPLIJckOZ4=";
+    hash = "sha256-Ew6oLVL7u9RtidHNsz29lzH9WPxKNneEoVACuLdP7yo=";
   };
 
   frontend = stdenvNoCC.mkDerivation rec {
@@ -41,10 +41,10 @@ let
 
     pnpmDeps = fetchPnpmDeps {
       inherit pname version;
-      pnpm = pnpm_9;
+      pnpm = pnpm_10;
       src = "${src}/rust/gui-client";
-      fetcherVersion = 3;
-      hash = "sha256-akanXiWehhQRx6WHN75PjYvFxFiSsJ5dJaguJBTM9J0=";
+      fetcherVersion = 4;
+      hash = "sha256-770+06rpf/P9hOFLgEWc0/BKjIxHyCWB2E3tqdEskAA=";
     };
     pnpmRoot = "rust/gui-client";
 
@@ -52,7 +52,7 @@ let
 
     nativeBuildInputs = [
       pnpmConfigHook
-      pnpm_9
+      pnpm_10
       nodejs
     ];
 
@@ -79,7 +79,7 @@ rustPlatform.buildRustPackage rec {
   pname = "firezone-gui-client";
   inherit version src;
 
-  cargoHash = "sha256-TDP1Z4MeQaSER8MGnCEQfIhRsakaSCeJ7boUMBYkkI0=";
+  cargoHash = "sha256-LHHaklGIMuDuZwikXiQzLPbmkUbPyYR04UBQTBxq2ps=";
   sourceRoot = "${src.name}/rust";
   buildAndTestSubdir = "gui-client";
   env.RUSTFLAGS = "--cfg system_certs";

From 7053e317be40117eb5b44087b2cad49131fa5625 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 4 Jul 2026 22:52:45 -0700
Subject: [PATCH 010/117] nixos/nfsd: allow exports to be an attrset

This is in the spirit of RFC 42.
---
 .../services/network-filesystems/nfsd.nix     | 24 ++++++++++++++++++-
 nixos/tests/nfs/kerberos.nix                  | 13 +++++++---
 nixos/tests/nfs/simple.nix                    | 13 +++++++---
 3 files changed, 43 insertions(+), 7 deletions(-)

diff --git a/nixos/modules/services/network-filesystems/nfsd.nix b/nixos/modules/services/network-filesystems/nfsd.nix
index 9d3c3f9e4188..38986dcd85f8 100644
--- a/nixos/modules/services/network-filesystems/nfsd.nix
+++ b/nixos/modules/services/network-filesystems/nfsd.nix
@@ -6,6 +6,14 @@
 }:
 let
 
+  attrsToExports = lib.concatMapAttrsStringSep "\n" (
+    exportPoint: clientsAndOptions:
+    exportPoint
+    + lib.concatMapAttrsStringSep "" (
+      client: options: " ${client}(${lib.concatStringsSep "," options})"
+    ) clientsAndOptions
+  );
+
   cfg = config.services.nfs.server;
 
   exports = pkgs.writeText "exports" cfg.exports;
@@ -48,12 +56,26 @@ in
         };
 
         exports = lib.mkOption {
-          type = lib.types.lines;
+          type = with lib.types; coercedTo (attrsOf (attrsOf (listOf str))) attrsToExports lines;
           default = "";
           description = ''
             Contents of the /etc/exports file.  See
             {manpage}`exports(5)` for the format.
           '';
+          example = {
+            "/usr" = {
+              "*.local.domain" = [ "ro" ];
+              "@trusted" = [ "rw" ];
+            };
+            "/home/joe" = {
+              "pc001" = [
+                "rw"
+                "all_squash"
+                "anonuid=150"
+                "anongid=100"
+              ];
+            };
+          };
         };
 
         hostName = lib.mkOption {
diff --git a/nixos/tests/nfs/kerberos.nix b/nixos/tests/nfs/kerberos.nix
index f9720cfb87e2..ae787f8b7436 100644
--- a/nixos/tests/nfs/kerberos.nix
+++ b/nixos/tests/nfs/kerberos.nix
@@ -83,9 +83,16 @@ import ../make-test-python.nix (
 
           services.nfs.server.enable = true;
           services.nfs.server.createMountPoints = true;
-          services.nfs.server.exports = ''
-            /data *(rw,no_root_squash,fsid=0,sec=krb5p)
-          '';
+          services.nfs.server.exports = {
+            "/data" = {
+              "*" = [
+                "rw"
+                "no_root_squash"
+                "fsid=0"
+                "sec=krb5p"
+              ];
+            };
+          };
         };
     };
 
diff --git a/nixos/tests/nfs/simple.nix b/nixos/tests/nfs/simple.nix
index 3f2b8d3bbb1c..eebcb36cc0a5 100644
--- a/nixos/tests/nfs/simple.nix
+++ b/nixos/tests/nfs/simple.nix
@@ -37,9 +37,16 @@ import ../make-test-python.nix (
         { ... }:
         {
           services.nfs.server.enable = true;
-          services.nfs.server.exports = ''
-            /data 192.168.1.0/255.255.255.0(rw,no_root_squash,no_subtree_check,fsid=0)
-          '';
+          services.nfs.server.exports = {
+            "/data" = {
+              "192.168.1.0/255.255.255.0" = [
+                "rw"
+                "no_root_squash"
+                "no_subtree_check"
+                "fsid=0"
+              ];
+            };
+          };
           services.nfs.server.createMountPoints = true;
           networking.firewall.enable = false; # FIXME: figure out what ports need to be allowed
         };

From a9b06ca330b2c6f3c4dd206d5eb0c6f80e5fd539 Mon Sep 17 00:00:00 2001
From: Harish Rajagopal <harish.rajagopals@gmail.com>
Date: Sat, 4 Jul 2026 02:21:36 +0200
Subject: [PATCH 011/117] feishin: add override for web version

---
 pkgs/by-name/fe/feishin/package.nix | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/fe/feishin/package.nix b/pkgs/by-name/fe/feishin/package.nix
index f8a1a7ee214c..242b0cfa105b 100644
--- a/pkgs/by-name/fe/feishin/package.nix
+++ b/pkgs/by-name/fe/feishin/package.nix
@@ -14,6 +14,7 @@
   copyDesktopItems,
   makeDesktopItem,
   nix-update-script,
+  webVersion ? false,
 }:
 let
   pname = "feishin";
@@ -34,6 +35,7 @@ buildNpmPackage {
   inherit src;
 
   npmConfigHook = pnpmConfigHook;
+  npmBuildScript = if webVersion then "build:web" else "build";
 
   npmDeps = null;
   pnpmDeps = fetchPnpmDeps {
@@ -52,8 +54,8 @@ buildNpmPackage {
   nativeBuildInputs = [
     pnpm_10
   ]
-  ++ lib.optionals (stdenv.hostPlatform.isLinux) [ copyDesktopItems ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+  ++ lib.optionals (stdenv.hostPlatform.isLinux && !webVersion) [ copyDesktopItems ]
+  ++ lib.optionals (stdenv.hostPlatform.isDarwin && !webVersion) [
     darwin.autoSignDarwinBinariesHook
     actool
   ];
@@ -73,7 +75,7 @@ buildNpmPackage {
     ln -s ${dart-sass}/bin/dart-sass "$dir"/sass
   '';
 
-  postBuild = ''
+  postBuild = lib.optionalString (!webVersion) ''
     cp -r ${electron.dist} electron-dist
     chmod -R u+w electron-dist
 
@@ -88,14 +90,18 @@ buildNpmPackage {
   installPhase = ''
     runHook preInstall
   ''
-  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+  + lib.optionalString webVersion ''
+    mkdir -p $out
+    cp -r out/web/* $out
+  ''
+  + lib.optionalString (stdenv.hostPlatform.isDarwin && !webVersion) ''
     mkdir -p $out/{Applications,bin}
     cp -r dist/**/Feishin.app $out/Applications/
     makeWrapper $out/Applications/Feishin.app/Contents/MacOS/Feishin $out/bin/feishin \
       --prefix PATH : "${lib.makeBinPath [ mpv-unwrapped ]}" \
       --set DISABLE_AUTO_UPDATES 1
   ''
-  + lib.optionalString stdenv.hostPlatform.isLinux ''
+  + lib.optionalString (stdenv.hostPlatform.isLinux && !webVersion) ''
     mkdir -p $out/share/feishin
 
     pushd dist/*-unpacked/
@@ -126,7 +132,7 @@ buildNpmPackage {
     runHook postInstall
   '';
 
-  desktopItems = [
+  desktopItems = lib.optionals (!webVersion) [
     (makeDesktopItem {
       name = "feishin";
       desktopName = "Feishin";
@@ -152,11 +158,11 @@ buildNpmPackage {
     sourceProvenance = with lib.sourceTypes; [ fromSource ];
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.unix;
-    mainProgram = "feishin";
     maintainers = with lib.maintainers; [
       BatteredBunny
       onny
       jlbribeiro
     ];
-  };
+  }
+  // lib.optionalAttrs (!webVersion) { mainProgram = "feishin"; };
 }

From 3b58f40f690a77aca370cd42dc9f2d1569b9c166 Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Mon, 6 Jul 2026 23:29:02 -0400
Subject: [PATCH 012/117] ipxe: add upstream patches for gcc 16

gcc 16 emits more warnings than previous versions for unused attributes
and variables, which are made into build failures by the use of -Werror
in ipxe. these warnings were fixed upstream (on may 1, the day after gcc
16's release!) so we fetch the relevant patches until they make it into
a release.
---
 pkgs/by-name/ip/ipxe/package.nix | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/pkgs/by-name/ip/ipxe/package.nix b/pkgs/by-name/ip/ipxe/package.nix
index 2b1b5de07650..c5ba8007293c 100644
--- a/pkgs/by-name/ip/ipxe/package.nix
+++ b/pkgs/by-name/ip/ipxe/package.nix
@@ -2,6 +2,7 @@
   stdenv,
   lib,
   fetchFromGitHub,
+  fetchpatch,
   nix-update-script,
   buildPackages,
   mtools,
@@ -105,6 +106,31 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-O7jUpnP+wa9zBIEqYa7FQ9Zo1Ii1oVH10nlk+c4iHwg=";
   };
 
+  patches = [
+    # GCC 16 gains stronger analysis for unused variables and emits a warning
+    # (made fatal by -Werror), so the usage of this variable is made
+    # unconditional.
+    (fetchpatch {
+      name = "w89c840-unused-variable.patch";
+      url = "https://github.com/ipxe/ipxe/commit/2d28657ef63217b9a1774605267d84f89d751441.patch";
+      hash = "sha256-p1r1iDOJbss458LlmfpuIkk+6VqthDl0mcK/EfcCqS4=";
+    })
+
+    # GCC 16 adds a warning (made fatal by -Werror) for attributes that do not
+    # apply. Since the regparm attribute only applies for i386, it is dropped
+    # for x86_64.
+    (fetchpatch {
+      name = "x86_64-drop-regparm-attribute.patch";
+      url = "https://github.com/ipxe/ipxe/commit/c18d0a23b634ae001ea877020c0236bfca1468e5.patch";
+      hash = "sha256-spEIdyw30zYiYmhnvYQEVUrr/uMnFqJO/yLWnPb+QMc=";
+    })
+    (fetchpatch {
+      name = "librm-regparm-attribute-only-for-i386.patch";
+      url = "https://github.com/ipxe/ipxe/commit/be35d67a029485f461ce83cbeda15056a52cb069.patch";
+      hash = "sha256-ki6gUPC6njGvu27RsD3f1L0m82NOKj9es0/o0jXCpqk=";
+    })
+  ];
+
   enableParallelBuilding = true;
   strictDeps = true;
 

From 50001e14af6aa3bd2ab3def894e74ec7123d3b00 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Wed, 8 Jul 2026 13:53:18 +0200
Subject: [PATCH 013/117] wget: add patches for several CVEs

---
 pkgs/by-name/wg/wget/package.nix | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/pkgs/by-name/wg/wget/package.nix b/pkgs/by-name/wg/wget/package.nix
index f49dbaa45108..c5435366569a 100644
--- a/pkgs/by-name/wg/wget/package.nix
+++ b/pkgs/by-name/wg/wget/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
 
   gettext,
   pkg-config,
@@ -32,6 +33,29 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-GSJcx1awoIj8gRSNxqQKDI8ymvf9hIPxx7L+UPTgih8=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "fix-cve-2026-58471";
+      url = "https://gitlab.com/gnuwget/wget/-/commit/c2640fe5171c59f87c58dc9fcb195b2d18b010ee.patch";
+      hash = "sha256-ZnCLK9ILpHMqpmI39sBl3Q3NRNc/H8jukvBrECqJ6OI=";
+    })
+    (fetchpatch {
+      name = "fix-cve-2026-58470";
+      url = "https://gitlab.com/gnuwget/wget/-/commit/43d3ba9336bc94937e6fae2365c6ffd30c34ffcf.patch";
+      hash = "sha256-aR5lW8t6ME2Os/NPXjFaUbNr3QuiUSQKsa2Zk292mrk=";
+    })
+    (fetchpatch {
+      name = "fix-cve-2026-58469";
+      url = "https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826.patch";
+      hash = "sha256-lkHQufl8XFZ1Ig8EoRUw3JuCgDPQod9PKAIsTBWzvm4=";
+    })
+    (fetchpatch {
+      name = "fix-cve-2026-58472";
+      url = "https://gitlab.com/gnuwget/wget/-/commit/dd692d9cea5335b181d877ae917fe6e75587a812.patch";
+      hash = "sha256-FAlglKTZili9Y4ivSRLOEaOgektFmq4u6yyH+8WzQao=";
+    })
+  ];
+
   preConfigure = ''
     patchShebangs doc
   '';

From bbc1b6531a0721d750685f165be3076941bb7c7b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Jul 2026 22:12:45 +0000
Subject: [PATCH 014/117] searxng: 0-unstable-2026-06-20 ->
 0-unstable-2026-07-08

---
 pkgs/by-name/se/searxng/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/se/searxng/package.nix b/pkgs/by-name/se/searxng/package.nix
index f46146869948..1ffdb81ee103 100644
--- a/pkgs/by-name/se/searxng/package.nix
+++ b/pkgs/by-name/se/searxng/package.nix
@@ -13,14 +13,14 @@ in
 python.pkgs.toPythonModule (
   python.pkgs.buildPythonApplication rec {
     pname = "searxng";
-    version = "0-unstable-2026-06-20";
+    version = "0-unstable-2026-07-08";
     pyproject = true;
 
     src = fetchFromGitHub {
       owner = "searxng";
       repo = "searxng";
-      rev = "fd42d4fda142901416038f4748ca8222d2ff7822";
-      hash = "sha256-x88O+TuPi/BjZug0NAHLbD5jaVK4/NDoxhVkSvRXkA4=";
+      rev = "1412926f5c80ffabc90719450578eb98fda9e161";
+      hash = "sha256-w3nXXI2qVFqIsnaYgzsyjDdvQ0nQmQdVMClw2fG2Zmg=";
     };
 
     nativeBuildInputs = with python.pkgs; [ pythonRelaxDepsHook ];

From b9b0b4b1e097c7521dc97d23d56da2096db146e3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Christina=20S=C3=B8rensen?= <ces@fem.gg>
Date: Thu, 9 Jul 2026 12:26:28 +0200
Subject: [PATCH 015/117] eza: 0.23.4 -> 0.23.5

changelog: https://github.com/eza-community/eza/releases/tag/v0.23.5
---
 pkgs/by-name/ez/eza/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ez/eza/package.nix b/pkgs/by-name/ez/eza/package.nix
index 2bbc21ac8708..fffd96089b3b 100644
--- a/pkgs/by-name/ez/eza/package.nix
+++ b/pkgs/by-name/ez/eza/package.nix
@@ -16,7 +16,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "eza";
-  version = "0.23.4";
+  version = "0.23.5";
 
   __structuredAttrs = true;
 
@@ -24,10 +24,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "eza-community";
     repo = "eza";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zLb2VPfmv9J9UdPAXS+QPHI+hvDRl5UBcvW84J6nUK8=";
+    hash = "sha256-4XgPePl90mnQxmTUJfOvIsCcTRSYNBuRUNOb/3kmO1k=";
   };
 
-  cargoHash = "sha256-3KLjlEZhGEyOcaiBnfIafR509oRbsWllqf1e6Z0M8Sg=";
+  cargoHash = "sha256-IRG+mVgU8ZZ8PsxZWqmf3ZjW8fGL0RD0CwIrjsL366I=";
 
   nativeBuildInputs = [
     cmake

From fd79cfd13ce0898ef732916a46780f0087b43cc3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 10 Jul 2026 01:09:08 +0000
Subject: [PATCH 016/117] vivaldi: 8.0.4033.54 -> 8.1.4087.48

---
 pkgs/by-name/vi/vivaldi/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/vi/vivaldi/package.nix b/pkgs/by-name/vi/vivaldi/package.nix
index f1f08fc50e47..66f5ac76805c 100644
--- a/pkgs/by-name/vi/vivaldi/package.nix
+++ b/pkgs/by-name/vi/vivaldi/package.nix
@@ -67,7 +67,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vivaldi";
-  version = "8.0.4033.54";
+  version = "8.1.4087.48";
 
   suffix =
     {
@@ -80,8 +80,8 @@ stdenv.mkDerivation rec {
     url = "https://downloads.vivaldi.com/stable/vivaldi-stable_${version}-1_${suffix}.deb";
     hash =
       {
-        aarch64-linux = "sha256-i2FAMp3MFsnXTjQoF4Y/BuB6j+x3ugfsu0ePGI/h5Po=";
-        x86_64-linux = "sha256-a4ZLX/DpygZgPPjt4BQxTuRbFoPmNuRgdZFiI6UclQI=";
+        aarch64-linux = "sha256-T6mBi4FpHz2iGXeF91giTbuVp4KjFG1DUnPNpKEV06c=";
+        x86_64-linux = "sha256-/Bgh+Y6DHWe7al9vLsWWH1HM5JQGwv91KUxQ9TNkqjs=";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };

From f5ba480aa96d1a2768f8a961b8db0542871a7c58 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 10 Jul 2026 10:39:46 +0000
Subject: [PATCH 017/117] enzyme: 0.0.277 -> 0.0.280

---
 pkgs/by-name/en/enzyme/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/en/enzyme/package.nix b/pkgs/by-name/en/enzyme/package.nix
index 79d889e24f39..1cc4ed5aabdf 100644
--- a/pkgs/by-name/en/enzyme/package.nix
+++ b/pkgs/by-name/en/enzyme/package.nix
@@ -7,13 +7,13 @@
 }:
 llvmPackages.stdenv.mkDerivation rec {
   pname = "enzyme";
-  version = "0.0.277";
+  version = "0.0.280";
 
   src = fetchFromGitHub {
     owner = "EnzymeAD";
     repo = "Enzyme";
     rev = "v${version}";
-    hash = "sha256-GAICiChPRRFBsZsQtCpPBzNvjWpx5YSAlwYL0/fEe5A=";
+    hash = "sha256-EVs7gBEDFINdbob51AlUsgH21sR/V/5/Cc+ADnOwDgM=";
   };
 
   postPatch = ''

From e6b7601eb79e9d5ad4eee721a0bcfff7a871321b Mon Sep 17 00:00:00 2001
From: Johannes Kirschbauer <hsjobeki@gmail.com>
Date: Fri, 10 Jul 2026 16:05:44 +0200
Subject: [PATCH 018/117] doc/style.css: add pill background to inline-code

---
 doc/style.css | 26 ++++++++++++--------------
 1 file changed, 12 insertions(+), 14 deletions(-)

diff --git a/doc/style.css b/doc/style.css
index 3cb0330b0b3b..5155db7c6675 100644
--- a/doc/style.css
+++ b/doc/style.css
@@ -114,7 +114,7 @@ html {
 body {
   font-size: 1rem;
   font-family: "Roboto", sans-serif;
-  font-weight: 300;
+  font-weight: 400;
   color: var(--main-text-color);
   background-color: var(--background);
   min-height: 100vh;
@@ -264,13 +264,9 @@ code {
 }
 
 code {
-  color: #ff8657;
-  background: #f4f4f4;
-  display: inline-block;
-  padding: 0 0.5rem;
-  border: 1px solid #d8d8d8;
-  border-radius: 0.5rem;
-  line-height: 1.57777778;
+  padding: 0.2em 0.4em;
+  background: var(--inline-code-background);
+  border-radius: 0.375rem;
 }
 
 div.book .programlisting,
@@ -378,11 +374,6 @@ div.appendix dt {
 
 div.book code,
 div.appendix code {
-  padding: 0;
-  border: 0;
-  background-color: inherit;
-  color: inherit;
-  font-size: 100%;
   -webkit-hyphens: none;
   -moz-hyphens: none;
   hyphens: none;
@@ -441,6 +432,7 @@ div.appendix .variablelist .term {
   --caution-background: #ffebe8;
   --codeblock-background: #f2f8fd;
   --codeblock-text-color: #000;
+  --inline-code-background: #818b981f;
 }
 
 @media (prefers-color-scheme: dark) {
@@ -466,6 +458,7 @@ div.appendix .variablelist .term {
     --caution-background: #422522;
     --codeblock-background: #393939;
     --codeblock-text-color: #fff;
+    --inline-code-background: #656c7633;
   }
 
   :is(.note, .tip, .warning, .caution, .important) {
@@ -476,7 +469,12 @@ div.appendix .variablelist .term {
 
 @font-face {
   font-family: Roboto;
-  src: url(Roboto.ttf);
+  src:
+    url(Roboto.ttf) format("truetype") tech(variations),
+    url(Roboto.ttf) format("truetype-variations");
+  font-weight: 100 900;
+  font-style: normal;
+  font-display: swap;
 }
 
 .chapter {

From ae2e8f41c50e652bed723a34534956c5a8668c76 Mon Sep 17 00:00:00 2001
From: Johannes Kirschbauer <hsjobeki@gmail.com>
Date: Fri, 10 Jul 2026 17:09:16 +0200
Subject: [PATCH 019/117] doc/style.css: use major second scale for headings

---
 doc/style.css | 62 +++++++++++++++++++++------------------------------
 1 file changed, 25 insertions(+), 37 deletions(-)

diff --git a/doc/style.css b/doc/style.css
index 3cb0330b0b3b..bdc5b02a3c15 100644
--- a/doc/style.css
+++ b/doc/style.css
@@ -184,59 +184,52 @@ hr {
   margin-bottom: 1rem;
 }
 
-h1 {
+h1,
+h2,
+h3,
+h4,
+h5,
+h6 {
   font-weight: 800;
-  line-height: 110%;
-  font-size: 200%;
-  margin-bottom: 1rem;
+  line-height: 1.1;
+  margin: 1.5rem 0 0.5rem;
+}
+
+/*
+  Major-second scale see: https://typescale.com/
+  rounded to .025rem (0.4px)
+*/
+h1 {
+  font-size: 2rem;
   color: var(--heading-color);
 }
 
 h2 {
-  font-weight: 800;
-  line-height: 110%;
-  font-size: 170%;
-  margin-bottom: 0.625rem;
+  font-size: 1.8rem;
   color: var(--heading-color);
 }
 
-h2:not(:first-child) {
-  margin-top: 1rem;
-}
-
 h3 {
-  font-weight: 800;
-  line-height: 110%;
-  margin-bottom: 1rem;
-  font-size: 150%;
+  font-size: 1.6rem;
   color: var(--heading-color);
 }
 
-:is(.note, .tip, .warning, .caution, .important) h3 {
-  font-size: 120%;
-}
-
 h4 {
-  font-weight: 800;
-  line-height: 110%;
-  margin-bottom: 1rem;
-  font-size: 140%;
+  font-size: 1.425rem;
   color: var(--heading-color);
 }
 
 h5 {
-  font-weight: 800;
-  line-height: 110%;
-  margin-bottom: 1rem;
-  font-size: 130%;
+  font-size: 1.275rem;
   color: var(--small-heading-color);
 }
 
 h6 {
-  font-weight: 800;
-  line-height: 110%;
-  margin-bottom: 1rem;
-  font-size: 120%;
+  font-size: 1.125rem;
+}
+
+:is(.note, .tip, .warning, .caution, .important) h3 {
+  font-size: 1.425rem;
 }
 
 strong {
@@ -330,11 +323,6 @@ div.appendix .programlisting {
   background: var(--caution-background);
 }
 
-div.book .section,
-div.appendix .section {
-  margin-top: 2em;
-}
-
 div.book div.example,
 div.appendix div.example {
   margin-top: 1.5em;

From c191186f6824f631a72812342a2635403aeea3bc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Fri, 10 Jul 2026 21:53:15 +0200
Subject: [PATCH 020/117] topgrade: 17.6.2 -> 17.7.0

Diff: https://github.com/topgrade-rs/topgrade/compare/v17.6.2...v17.7.0

Changelog: https://github.com/topgrade-rs/topgrade/releases/tag/v17.7.0
---
 pkgs/by-name/to/topgrade/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/to/topgrade/package.nix b/pkgs/by-name/to/topgrade/package.nix
index 5fa657b75a44..c3609237d5a3 100644
--- a/pkgs/by-name/to/topgrade/package.nix
+++ b/pkgs/by-name/to/topgrade/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "topgrade";
-  version = "17.6.2";
+  version = "17.7.0";
 
   src = fetchFromGitHub {
     owner = "topgrade-rs";
     repo = "topgrade";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6WdHfIMuwlJ4QWAfIjX3XmZuFVCeGC2/VsV9lz2dgRY=";
+    hash = "sha256-2oydjlPZLWlGNvahsRK7kG5gxEKEHMDNxteaOeYupPA=";
   };
 
-  cargoHash = "sha256-2lj6hAFA41BT5xWG3/i3iMLzbM+zam7/ZMrmE4uvDCg=";
+  cargoHash = "sha256-8pK6ZUlMNcczbmMJvQUsJKp0RoXnimnkbAc7SzrIcJQ=";
 
   nativeBuildInputs = [
     installShellFiles

From 49530795fcb6b7507e692b52b9f6405e1c1bcf42 Mon Sep 17 00:00:00 2001
From: Tyce Herrman <Tyce.Herrman@pm.me>
Date: Tue, 7 Jul 2026 18:33:00 -0400
Subject: [PATCH 021/117] proton-vpn: 6.5.0 -> 6.5.1

Assisted-by: OpenAI Codex (GPT-5)
---
 pkgs/by-name/pr/proton-vpn/darwin.nix | 36 +++++++++++++++++++--------
 1 file changed, 25 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/pr/proton-vpn/darwin.nix b/pkgs/by-name/pr/proton-vpn/darwin.nix
index b5985c5e7ae4..f688f1d78e1f 100644
--- a/pkgs/by-name/pr/proton-vpn/darwin.nix
+++ b/pkgs/by-name/pr/proton-vpn/darwin.nix
@@ -4,15 +4,19 @@
   stdenvNoCC,
   _7zz,
   fetchurl,
-  nix-update-script,
+  writeShellScript,
+  coreutils,
+  curl,
+  xmlstarlet,
+  common-updater-scripts,
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "proton-vpn";
-  version = "6.5.0";
+  version = "6.5.1";
 
   src = fetchurl {
-    url = "https://github.com/ProtonVPN/ios-mac-app/releases/download/mac%2F${finalAttrs.version}/ProtonVPN_mac_v${finalAttrs.version}.dmg";
-    hash = "sha256-lB44pIA5AxdcYQ/iccWcqJDOrQkVLRVl0vy1HuPPl8o=";
+    url = "https://protonvpn.com/download/macos/${finalAttrs.version}/ProtonVPN_mac_v${finalAttrs.version}.dmg";
+    hash = "sha256-1QpJ8UxQsO+K1oqJ/JaF1WmbotT5LLTDQxcpG0JUNfg=";
   };
 
   __structuredAttrs = true;
@@ -31,15 +35,25 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  passthru.updateScript = nix-update-script {
-    extraArgs = [
-      "--version-regex"
-      "mac/(.*)"
-    ];
-  };
+  passthru.updateScript = writeShellScript "proton-vpn-update-script" ''
+    set -euo pipefail
+    export PATH="${
+      lib.makeBinPath [
+        curl
+        xmlstarlet
+        common-updater-scripts
+        coreutils
+      ]
+    }"
+
+    xml=$(curl -s "https://protonvpn.com/download/macos/updates/v5/sparkle.xml")
+
+    version=$(echo "$xml" | xmlstarlet sel -t -v '//enclosure/@sparkle:shortVersionString' | head -1)
+
+    update-source-version proton-vpn "$version" --file=./pkgs/by-name/pr/proton-vpn/darwin.nix
+  '';
 
   meta = meta // {
-    changelog = "https://github.com/ProtonVPN/ios-mac-app/releases/tag/mac%2F${finalAttrs.version}";
     platforms = [
       "x86_64-darwin"
       "aarch64-darwin"

From ff0da59e6465457a795af762d2035ac9eac9ca93 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 10 Jul 2026 14:31:43 -0700
Subject: [PATCH 022/117] python3Packages.aioruckus: 0.42 -> 0.46.3

Diff: https://github.com/ms264556/aioruckus/compare/v0.42...v0.46.3
---
 .../development/python-modules/aioruckus/default.nix | 12 ++++++++----
 pkgs/servers/home-assistant/component-packages.nix   |  2 +-
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/aioruckus/default.nix b/pkgs/development/python-modules/aioruckus/default.nix
index dff50a2a73ce..47b80bfbd148 100644
--- a/pkgs/development/python-modules/aioruckus/default.nix
+++ b/pkgs/development/python-modules/aioruckus/default.nix
@@ -5,25 +5,29 @@
   buildPythonPackage,
   cryptography,
   fetchFromGitHub,
+  hatch-vcs,
+  hatchling,
   pytest-asyncio,
   pytestCheckHook,
-  setuptools,
   xmltodict,
 }:
 
 buildPythonPackage rec {
   pname = "aioruckus";
-  version = "0.42";
+  version = "0.46.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ms264556";
     repo = "aioruckus";
     tag = "v${version}";
-    hash = "sha256-UfyB3qGEDOQ39YA1AueCBXeoJhGH+XDCLZSFA+kpT2k=";
+    hash = "sha256-17vcYdggtoeAtGShshseBMB4PSiIOf00nRNIHOAP9Jw=";
   };
 
-  build-system = [ setuptools ];
+  build-system = [
+    hatch-vcs
+    hatchling
+  ];
 
   dependencies = [
     aiohttp
diff --git a/pkgs/servers/home-assistant/component-packages.nix b/pkgs/servers/home-assistant/component-packages.nix
index faa30054e360..4a97f5fde2eb 100644
--- a/pkgs/servers/home-assistant/component-packages.nix
+++ b/pkgs/servers/home-assistant/component-packages.nix
@@ -2,7 +2,7 @@
 # Do not edit!
 
 {
-  version = "2026.7.1";
+  version = "2026.7.2";
   components = {
     "3_day_blinds" =
       ps: with ps; [

From 10efb6d8e99e85f20115020a5ef16d14460e86d1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 10 Jul 2026 14:32:09 -0700
Subject: [PATCH 023/117] python3Packages.axis: 72 -> 74

Diff: https://github.com/Kane610/axis/compare/v72...v74

Changelog: https://github.com/Kane610/axis/releases/tag/v74
---
 pkgs/development/python-modules/axis/default.nix | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/axis/default.nix b/pkgs/development/python-modules/axis/default.nix
index ec8c4321c657..a5ccc6d91180 100644
--- a/pkgs/development/python-modules/axis/default.nix
+++ b/pkgs/development/python-modules/axis/default.nix
@@ -4,18 +4,19 @@
   buildPythonPackage,
   faust-cchardet,
   fetchFromGitHub,
-  httpx,
   orjson,
   packaging,
   pythonOlder,
   setuptools,
-  typing-extensions,
+  tomli,
+  tomli-w,
   xmltodict,
+  zeroconf,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "axis";
-  version = "72";
+  version = "74";
   pyproject = true;
 
   disabled = pythonOlder "3.14";
@@ -24,7 +25,7 @@ buildPythonPackage (finalAttrs: {
     owner = "Kane610";
     repo = "axis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xNqV3j7fQ+FmOZavVdV907m1ndAhk5HWIV5xE/a8hFI=";
+    hash = "sha256-fWhQe4NklAva4znXUwYhrMdC/VCu4oZgwsyGuGd9csk=";
   };
 
   postPatch = ''
@@ -38,11 +39,12 @@ buildPythonPackage (finalAttrs: {
   dependencies = [
     aiohttp
     faust-cchardet
-    httpx
     orjson
     packaging
-    typing-extensions
+    tomli
+    tomli-w
     xmltodict
+    zeroconf
   ];
 
   # Tests requires a server on localhost

From d7cff14e56f8263ed74cd2cf9f839ff7ff44fabf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 10 Jul 2026 14:33:39 -0700
Subject: [PATCH 024/117] python3Packages.bleak-esphome: 3.9.5 -> 3.9.7

Diff: https://github.com/bluetooth-devices/bleak-esphome/compare/v3.9.5...v3.9.7

Changelog: https://github.com/bluetooth-devices/bleak-esphome/blob/v3.9.7/CHANGELOG.md
---
 .../bluetooth-adapters-2.4.0-compat.patch     | 21 -------------------
 .../python-modules/bleak-esphome/default.nix  |  8 ++-----
 2 files changed, 2 insertions(+), 27 deletions(-)
 delete mode 100644 pkgs/development/python-modules/bleak-esphome/bluetooth-adapters-2.4.0-compat.patch

diff --git a/pkgs/development/python-modules/bleak-esphome/bluetooth-adapters-2.4.0-compat.patch b/pkgs/development/python-modules/bleak-esphome/bluetooth-adapters-2.4.0-compat.patch
deleted file mode 100644
index 7eccf5dc5228..000000000000
--- a/pkgs/development/python-modules/bleak-esphome/bluetooth-adapters-2.4.0-compat.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-diff --git a/tests/conftest.py b/tests/conftest.py
-index 55defbe..551d19e 100644
---- a/tests/conftest.py
-+++ b/tests/conftest.py
-@@ -9,7 +9,7 @@ from aioesphomeapi import (
-     ReconnectLogic,
- )
- from bleak_retry_connector import BleakSlotManager
--from bluetooth_adapters import BluetoothAdapters
-+from bluetooth_adapters import get_adapters
- from habluetooth import (
-     BluetoothManager,
-     set_manager,
-@@ -20,7 +20,7 @@ from zeroconf import Zeroconf
- @pytest.fixture(scope="session", autouse=True)
- def manager():
-     slot_manager = BleakSlotManager()
--    bluetooth_adapters = BluetoothAdapters()
-+    bluetooth_adapters = get_adapters()
-     set_manager(BluetoothManager(bluetooth_adapters, slot_manager))
- 
diff --git a/pkgs/development/python-modules/bleak-esphome/default.nix b/pkgs/development/python-modules/bleak-esphome/default.nix
index 3e934714e5b0..3153981b2948 100644
--- a/pkgs/development/python-modules/bleak-esphome/default.nix
+++ b/pkgs/development/python-modules/bleak-esphome/default.nix
@@ -19,20 +19,16 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "bleak-esphome";
-  version = "3.9.5";
+  version = "3.9.7";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "bluetooth-devices";
     repo = "bleak-esphome";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-S4tYL/fq7wMjq81WRftZ1A+RVxs7kGpaM/TfVBNBgaI=";
+    hash = "sha256-MimbUCaGbzAs1qom2ET9dGn1WHjcoaWBWGcoqWVuaF8=";
   };
 
-  patches = [
-    ./bluetooth-adapters-2.4.0-compat.patch
-  ];
-
   postPatch = ''
     substituteInPlace pyproject.toml \
       --replace-fail "setuptools>=75.8.2" setuptools

From 229d39dfd0a1deb03a9c786cfd8cdd64a718e5f3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 10 Jul 2026 14:37:51 -0700
Subject: [PATCH 025/117] python3Packages.dsmr-parser: 1.11.0 -> 1.11.1

Diff: https://github.com/ndokter/dsmr_parser/compare/v1.11.0...v1.11.1

Changelog: https://github.com/ndokter/dsmr_parser/releases/tag/v1.11.1
---
 pkgs/development/python-modules/dsmr-parser/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/dsmr-parser/default.nix b/pkgs/development/python-modules/dsmr-parser/default.nix
index a5013edf7e7a..db6368ea97ee 100644
--- a/pkgs/development/python-modules/dsmr-parser/default.nix
+++ b/pkgs/development/python-modules/dsmr-parser/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "dsmr-parser";
-  version = "1.11.0";
+  version = "1.11.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ndokter";
     repo = "dsmr_parser";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-utpirGJ9M+2HAOcTAE325hIHOHgHrsBYisDGGQ1PKWY=";
+    hash = "sha256-2q2e1/xt8a24QmACZUc9zWOnAiFhEYMg+44kOlx1JAk=";
   };
 
   pythonRelaxDeps = [ "dlms_cosem" ];

From a1bb26f84af5bd730f0560fe635f96a09ac6d010 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 10 Jul 2026 14:38:02 -0700
Subject: [PATCH 026/117] python3Packages.onvif-zeep-async: 4.2.0 -> 4.2.1

Diff: https://github.com/openvideolibs/python-onvif-zeep-async/compare/v4.2.0...v4.2.1

Changelog: https://github.com/openvideolibs/python-onvif-zeep-async/releases/tag/v4.2.1
---
 pkgs/development/python-modules/onvif-zeep-async/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/onvif-zeep-async/default.nix b/pkgs/development/python-modules/onvif-zeep-async/default.nix
index 48e38d8e160d..b2c8ae47f452 100644
--- a/pkgs/development/python-modules/onvif-zeep-async/default.nix
+++ b/pkgs/development/python-modules/onvif-zeep-async/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "onvif-zeep-async";
-  version = "4.2.0";
+  version = "4.2.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "openvideolibs";
     repo = "python-onvif-zeep-async";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GmrXU+aGjllrZ6MEaACTEXBQTd0UU45eD0yoMIn1dUI=";
+    hash = "sha256-7o9rzpXLNX5Ibaj74bNbFZ6v55SMDyzYjutvimOxbYk=";
   };
 
   postPatch = ''

From 303cd8b46410b053ade8a181a9b68cb15dd6c2e3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 10 Jul 2026 14:38:26 -0700
Subject: [PATCH 027/117] python3Packages.py-synologydsm-api: 2.10.2 -> 2.10.4

Diff: https://github.com/mib1185/py-synologydsm-api/compare/v2.10.2...v2.10.4

Changelog: https://github.com/mib1185/py-synologydsm-api/releases/tag/v2.10.4
---
 .../development/python-modules/py-synologydsm-api/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/py-synologydsm-api/default.nix b/pkgs/development/python-modules/py-synologydsm-api/default.nix
index 02db8b9fae26..44d0a7315eb5 100644
--- a/pkgs/development/python-modules/py-synologydsm-api/default.nix
+++ b/pkgs/development/python-modules/py-synologydsm-api/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage rec {
   pname = "py-synologydsm-api";
-  version = "2.10.2";
+  version = "2.10.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mib1185";
     repo = "py-synologydsm-api";
     tag = "v${version}";
-    hash = "sha256-LILtlgUCSL+107axBZOIjqbS4kAXWLxt9936tpvW3XA=";
+    hash = "sha256-r2f/fVcDg9zDjTBKupkNQD4zQbeTKvZB7AWyncrRKH8=";
   };
 
   build-system = [ setuptools ];

From 4b220cdb08af1dd3e7a1d4c35cf4d75c53e8b723 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 10 Jul 2026 14:38:47 -0700
Subject: [PATCH 028/117] python3Packages.pyoverkiz: 2.0.3 -> 2.0.5

Diff: https://github.com/iMicknl/python-overkiz-api/compare/v2.0.3...v2.0.5

Changelog: https://github.com/iMicknl/python-overkiz-api/releases/tag/v2.0.5
---
 pkgs/development/python-modules/pyoverkiz/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyoverkiz/default.nix b/pkgs/development/python-modules/pyoverkiz/default.nix
index 28d49bf3d6f1..8d43f92e62ce 100644
--- a/pkgs/development/python-modules/pyoverkiz/default.nix
+++ b/pkgs/development/python-modules/pyoverkiz/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyoverkiz";
-  version = "2.0.3";
+  version = "2.0.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "iMicknl";
     repo = "python-overkiz-api";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kKaT9YimH9o5yI7x9T9TSrcvwKEQ5M/HRnZp5S4xbGE=";
+    hash = "sha256-LdOVhOWxejTXhgUwlbucYNDqhKJDov56IaEcvJvEBQ4=";
   };
 
   build-system = [ hatchling ];

From e5800220a0e9ea019bdbe12cb9676cc8829014fe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 10 Jul 2026 14:38:57 -0700
Subject: [PATCH 029/117] python3Packages.python-bsblan: 6.1.5 -> 6.1.6

Diff: https://github.com/liudger/python-bsblan/compare/v6.1.5...v6.1.6

Changelog: https://github.com/liudger/python-bsblan/releases/tag/v6.1.6
---
 pkgs/development/python-modules/python-bsblan/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-bsblan/default.nix b/pkgs/development/python-modules/python-bsblan/default.nix
index 3df45379234a..067dda6325b6 100644
--- a/pkgs/development/python-modules/python-bsblan/default.nix
+++ b/pkgs/development/python-modules/python-bsblan/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "python-bsblan";
-  version = "6.1.5";
+  version = "6.1.6";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "liudger";
     repo = "python-bsblan";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-D3uhEk4VK9kpuwPh3R+oswMaQZQfuTIUwvUnb5HAMFM=";
+    hash = "sha256-1nq1m1jGks4YPn64pUz8lKlES2PwvdfsMlRFYiAEbYg=";
   };
 
   postPatch = ''

From ef832060ab814e716203f73553816df2a42debc0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 10 Jul 2026 14:39:06 -0700
Subject: [PATCH 030/117] python3Packages.pywmspro: 0.4.1 -> 0.4.2

Diff: https://github.com/mback2k/pywmspro/compare/0.4.1...0.4.2

Changelog: https://github.com/mback2k/pywmspro/releases/tag/0.4.2
---
 pkgs/development/python-modules/pywmspro/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pywmspro/default.nix b/pkgs/development/python-modules/pywmspro/default.nix
index 3e84f4f90a6d..5b10d2b01d29 100644
--- a/pkgs/development/python-modules/pywmspro/default.nix
+++ b/pkgs/development/python-modules/pywmspro/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pywmspro";
-  version = "0.4.1";
+  version = "0.4.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mback2k";
     repo = "pywmspro";
     tag = finalAttrs.version;
-    hash = "sha256-gpAAGrM/dLSD7rCbYM9O3hVCvDb0QA0joZG7h+jTfCg=";
+    hash = "sha256-V23YvQ2J+Jj0FFhB0Z4h3vwl8Uz5TOX0/T6qox7pj+0=";
   };
 
   build-system = [

From 995a053e077aea6fa34b8b4cee07c41eb24907e0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 10 Jul 2026 14:39:26 -0700
Subject: [PATCH 031/117] python3Packages.reolink-aio: 0.21.3 -> 0.21.4

Diff: https://github.com/starkillerOG/reolink_aio/compare/0.21.3...0.21.4

Changelog: https://github.com/starkillerOG/reolink_aio/releases/tag/0.21.4
---
 pkgs/development/python-modules/reolink-aio/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/reolink-aio/default.nix b/pkgs/development/python-modules/reolink-aio/default.nix
index 6efd2ecd025f..63c4674a47ef 100644
--- a/pkgs/development/python-modules/reolink-aio/default.nix
+++ b/pkgs/development/python-modules/reolink-aio/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "reolink-aio";
-  version = "0.21.3";
+  version = "0.21.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "starkillerOG";
     repo = "reolink_aio";
     tag = finalAttrs.version;
-    hash = "sha256-XL6Z+1dr35XgMczUcxp4v3ejBcdgWkhUOISFA4lpjU4=";
+    hash = "sha256-qBGUhqjHur3vKhpHmOHIQUxeBn+YAIjECdm33o1c3jg=";
   };
 
   build-system = [ setuptools ];

From 7e0b8d645dd705dfd01ff781defa2ec4eb8770d9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 10 Jul 2026 14:39:39 -0700
Subject: [PATCH 032/117] python3Packages.tuya-device-handlers: 0.0.24 ->
 0.0.25

Diff: https://github.com/home-assistant-libs/tuya-device-handlers/compare/v0.0.24...v0.0.25

Changelog: https://github.com/home-assistant-libs/tuya-device-handlers/releases/tag/v0.0.25
---
 .../python-modules/tuya-device-handlers/default.nix           | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tuya-device-handlers/default.nix b/pkgs/development/python-modules/tuya-device-handlers/default.nix
index d5036e207ca2..96f84b9bec26 100644
--- a/pkgs/development/python-modules/tuya-device-handlers/default.nix
+++ b/pkgs/development/python-modules/tuya-device-handlers/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tuya-device-handlers";
-  version = "0.0.24";
+  version = "0.0.25";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "home-assistant-libs";
     repo = "tuya-device-handlers";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-O08/NRB3xPjCGWjv5GHJJmn8/rL1rP6J7OlqR17zHeA=";
+    hash = "sha256-nJX7N3PCqMmlE2KipeCKTFLn91sJmzmPTizY9cxjnb0=";
   };
 
   build-system = [ poetry-core ];

From 475bea58343002d5a69e2e6d6ab8c43d25565d90 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 10 Jul 2026 14:40:35 -0700
Subject: [PATCH 033/117] python3Packages.uiprotect: 15.4.1 -> 15.4.3

Diff: https://github.com/uilibs/uiprotect/compare/v15.4.1...v15.4.3

Changelog: https://github.com/uilibs/uiprotect/blob/v15.4.3/CHANGELOG.md
---
 pkgs/development/python-modules/uiprotect/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/uiprotect/default.nix b/pkgs/development/python-modules/uiprotect/default.nix
index 815ad685f6b0..6306bf2c76cb 100644
--- a/pkgs/development/python-modules/uiprotect/default.nix
+++ b/pkgs/development/python-modules/uiprotect/default.nix
@@ -39,14 +39,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "uiprotect";
-  version = "15.4.1";
+  version = "15.4.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "uilibs";
     repo = "uiprotect";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qsGLheVKhIM1aEq/KRsclf3ZQtRhtX/S8cQ5Aem8dEw=";
+    hash = "sha256-H5ymzsqdCcL9C4suW2Gk1Op7UmmwztqNrB1VeGIFUFE=";
   };
 
   build-system = [ poetry-core ];

From 3527ece8c1c62a01166d1315a7763f9287552b56 Mon Sep 17 00:00:00 2001
From: lactose <15185244+juuyokka@users.noreply.github.com>
Date: Fri, 10 Jul 2026 14:47:56 -0700
Subject: [PATCH 034/117] maintainers: update lactose email

---
 maintainers/maintainer-list.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 30952dd7302a..d248d2323ed2 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -15381,7 +15381,7 @@
   };
   lactose = {
     name = "lactose";
-    email = "lactose@allthingslinux.com";
+    email = "mail@lactose.dev";
     github = "juuyokka";
     githubId = 15185244;
   };

From 057c027a2b377cb545433cb80d2d22e0e6308aaa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Fri, 10 Jul 2026 22:35:41 +0200
Subject: [PATCH 035/117] music-assistant-desktop: 0.5.0 -> 0.5.5

Diff: https://github.com/music-assistant/desktop-app/compare/0.5.0...0.5.5

Changelog: https://github.com/music-assistant/desktop-app/releases/tag/0.5.5
---
 .../by-name/mu/music-assistant-desktop/package.nix | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mu/music-assistant-desktop/package.nix b/pkgs/by-name/mu/music-assistant-desktop/package.nix
index 0e36e6f23d9e..5054e829fa08 100644
--- a/pkgs/by-name/mu/music-assistant-desktop/package.nix
+++ b/pkgs/by-name/mu/music-assistant-desktop/package.nix
@@ -8,6 +8,8 @@
 
   # nativeBuildInputs
   cargo-tauri,
+  jq,
+  moreutils,
   nodejs,
   pkg-config,
   yarnBuildHook,
@@ -30,13 +32,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "music-assistant-desktop";
-  version = "0.5.0";
+  version = "0.5.5";
 
   src = fetchFromGitHub {
     owner = "music-assistant";
     repo = "desktop-app";
     tag = finalAttrs.version;
-    hash = "sha256-UfHodoDGsBQUcTaQ5x04jf0nG4jX47TzXXPJzAwYbEQ=";
+    hash = "sha256-q7aExLYYiox9voo1pX6o8D2wSoV39lNiUVxR61p2w7Q=";
   };
 
   patches = [
@@ -47,12 +49,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
     # set version
     substituteInPlace package.json src-tauri/tauri.conf.json \
       --replace-fail "0.0.0" "${finalAttrs.version}"
+
+    # disable upstream updater
+    jq '.plugins.updater.endpoints = [ ] | .bundle.createUpdaterArtifacts = false' src-tauri/tauri.conf.json \
+      | sponge src-tauri/tauri.conf.json
   '';
 
   cargoRoot = "src-tauri";
   buildAndTestSubdir = finalAttrs.cargoRoot;
 
-  cargoHash = "sha256-xc1eT9TKAqREC2fMi4eFR9Ag1c8Ksq4mGoRnO9WZggI=";
+  cargoHash = "sha256-H17FmiWSHIi1vRmo1Zq/2rscvmJXoBy4lqEblGe/XNk=";
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
@@ -61,6 +67,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   nativeBuildInputs = [
     cargo-tauri.hook
+    jq
+    moreutils
     nodejs
     pkg-config
     yarnBuildHook

From a260673303dc7d62c1058619c8b94b838890bdfa Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 10 Jul 2026 23:47:57 +0000
Subject: [PATCH 036/117] ft2-clone: 2.20 -> 2.21

---
 pkgs/by-name/ft/ft2-clone/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ft/ft2-clone/package.nix b/pkgs/by-name/ft/ft2-clone/package.nix
index 3c55fd88d488..cf4e5c3be7c9 100644
--- a/pkgs/by-name/ft/ft2-clone/package.nix
+++ b/pkgs/by-name/ft/ft2-clone/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ft2-clone";
-  version = "2.20";
+  version = "2.21";
 
   src = fetchFromGitHub {
     owner = "8bitbubsy";
     repo = "ft2-clone";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-e0oIn/g5bWYMFhvd54reacGI8/s7pMfujnEPzYnUbF4=";
+    hash = "sha256-H8vU4ipNKVS7hB26o57incA7I8k8byuwqQXplel2mOE=";
   };
 
   nativeBuildInputs = [ cmake ];

From 455d916d0c1750d67b097386947fc52d1bb2f28d Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Sat, 11 Jul 2026 03:13:39 +0200
Subject: [PATCH 037/117] python3Packages.catppuccin: fix build with matplotlib
 3.11+

---
 .../python-modules/catppuccin/default.nix     |  5 +++
 .../catppuccin/matplotlib-3.11.patch          | 37 +++++++++++++++++++
 2 files changed, 42 insertions(+)
 create mode 100644 pkgs/development/python-modules/catppuccin/matplotlib-3.11.patch

diff --git a/pkgs/development/python-modules/catppuccin/default.nix b/pkgs/development/python-modules/catppuccin/default.nix
index 87a1e7b6f592..8e7a775de2f1 100644
--- a/pkgs/development/python-modules/catppuccin/default.nix
+++ b/pkgs/development/python-modules/catppuccin/default.nix
@@ -22,6 +22,11 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-wumJ8kpr+C2pdw8jYf+IqYTdSB6Iy37yZqPKycYmOSs=";
   };
 
+  patches = [
+    # https://github.com/catppuccin/python/pull/130
+    ./matplotlib-3.11.patch
+  ];
+
   build-system = [ hatchling ];
 
   optional-dependencies = {
diff --git a/pkgs/development/python-modules/catppuccin/matplotlib-3.11.patch b/pkgs/development/python-modules/catppuccin/matplotlib-3.11.patch
new file mode 100644
index 000000000000..6d21107c492c
--- /dev/null
+++ b/pkgs/development/python-modules/catppuccin/matplotlib-3.11.patch
@@ -0,0 +1,37 @@
+From 11ab7be947064f11453f1063f63455b343b7253d Mon Sep 17 00:00:00 2001
+From: Raziman T V <razimantv@gmail.com>
+Date: Fri, 3 Jul 2026 13:36:29 +0100
+Subject: [PATCH] Fix #129 (caused by matplotlib 3.11 deprecating
+ mpl.style.core) by direct implementation
+
+---
+ catppuccin/extras/matplotlib.py | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+diff --git a/catppuccin/extras/matplotlib.py b/catppuccin/extras/matplotlib.py
+index 52934d1..f0ffafb 100644
+--- a/catppuccin/extras/matplotlib.py
++++ b/catppuccin/extras/matplotlib.py
+@@ -72,6 +72,7 @@
+ import matplotlib as mpl
+ import matplotlib.colors
+ import matplotlib.style
++from matplotlib import rc_params_from_file
+ 
+ from catppuccin.palette import PALETTE
+ 
+@@ -84,10 +85,10 @@
+ 
+ def _register_styles() -> None:
+     """Register the included stylesheets in the mpl style library."""
+-    catppuccin_stylesheets = mpl.style.core.read_style_directory(  # type: ignore [attr-defined]
+-        CATPPUCCIN_STYLE_DIRECTORY
+-    )
+-    mpl.style.core.update_nested_dict(mpl.style.library, catppuccin_stylesheets)  # type: ignore [attr-defined]
++    for path in Path(CATPPUCCIN_STYLE_DIRECTORY).glob(f"*.mplstyle"):
++        stylename = path.stem
++        style = rc_params_from_file(path, use_default_template=False)
++        mpl.style.library.setdefault(stylename, {}).update(style)
+ 
+ 
+ def _register_colormap_list() -> None:

From 4e232d577582d7f672a3bb7548b2f8c3677080b7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Jul 2026 01:24:04 +0000
Subject: [PATCH 038/117] oklch-color-picker: 2.3.3 -> 2.3.4

---
 pkgs/by-name/ok/oklch-color-picker/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ok/oklch-color-picker/package.nix b/pkgs/by-name/ok/oklch-color-picker/package.nix
index 0887821eb931..dc0b2b31a9ab 100644
--- a/pkgs/by-name/ok/oklch-color-picker/package.nix
+++ b/pkgs/by-name/ok/oklch-color-picker/package.nix
@@ -13,16 +13,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "oklch-color-picker";
-  version = "2.3.3";
+  version = "2.3.4";
 
   src = fetchFromGitHub {
     owner = "eero-lehtinen";
     repo = "oklch-color-picker";
     tag = finalAttrs.version;
-    hash = "sha256-IwG3oUYArr6cHSa3fNukQ7CjasUMaVWX9JXChSHTnEs=";
+    hash = "sha256-AdLpP01VeeAAOBEeX/dxLPdAqTfgH9X+NDCmFgqA3hs=";
   };
 
-  cargoHash = "sha256-Vs6bMHHHRdqSYjOzJuq2agmuXSjGRagIATVzQa3Z/M8=";
+  cargoHash = "sha256-FB8zvWhO+ZbzWjkQCnf3ghgM+IL4px7QNO4dLPcczec=";
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ autoPatchelfHook ];
 

From 4f01ee5ca6911778e8e48291419a0b6255f1af35 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 10 Jul 2026 18:33:50 -0700
Subject: [PATCH 039/117] parla: 0.6.0 -> 0.6.4

Diff: https://github.com/trufae/parla/compare/0.6.0...0.6.4

Changelog: https://github.com/trufae/parla/releases/tag/0.6.4
---
 pkgs/by-name/pa/parla/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pa/parla/package.nix b/pkgs/by-name/pa/parla/package.nix
index 6437d46ac993..738fc018fb4f 100644
--- a/pkgs/by-name/pa/parla/package.nix
+++ b/pkgs/by-name/pa/parla/package.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "parla";
-  version = "0.6.0";
+  version = "0.6.4";
   __structuredAttrs = true;
   strictDeps = true;
 
@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "trufae";
     repo = "parla";
     tag = finalAttrs.version;
-    hash = "sha256-UnLZQ71M1yMpoYNbMdoRq+dmMFr2A/pk7GjMXtSChkY=";
+    hash = "sha256-tlqrUxzQS+u4DlSIKAp9oR69KRW2gTgwBoroUJzvsaY=";
   };
 
   nativeBuildInputs = [

From d28882d2e65e5ef69cab82b2e4967a8870640a99 Mon Sep 17 00:00:00 2001
From: Bas van den Wollenberg <hi@bas.sh>
Date: Sat, 11 Jul 2026 03:56:53 +0200
Subject: [PATCH 040/117] vivaldi-ffmpeg-codecs: update from vivaldi
 8.1.4087.48 update-ffmpeg

---
 pkgs/by-name/vi/vivaldi-ffmpeg-codecs/package.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/vi/vivaldi-ffmpeg-codecs/package.nix b/pkgs/by-name/vi/vivaldi-ffmpeg-codecs/package.nix
index f0bf0210332e..e6dd2eef3663 100644
--- a/pkgs/by-name/vi/vivaldi-ffmpeg-codecs/package.nix
+++ b/pkgs/by-name/vi/vivaldi-ffmpeg-codecs/package.nix
@@ -11,19 +11,19 @@
 let
   sources = {
     x86_64-linux = fetchurl {
-      url = "https://api.snapcraft.io/api/v1/snaps/download/XXzVIXswXKHqlUATPqGCj2w2l7BxosS8_82.snap";
-      hash = "sha256-G9RcOuFjkLDJUNlw2G8GiONpWHYvyTnv3Nr0JSdW0As=";
+      url = "https://api.snapcraft.io/api/v1/snaps/download/XXzVIXswXKHqlUATPqGCj2w2l7BxosS8_117.snap";
+      hash = "sha256-YEE7oF8NLGDCQ3gpY5z6B+7xDxcOumjOzwUztJUM+/s=";
     };
     aarch64-linux = fetchurl {
-      url = "https://api.snapcraft.io/api/v1/snaps/download/XXzVIXswXKHqlUATPqGCj2w2l7BxosS8_83.snap";
-      hash = "sha256-6XMdH4dnvYB1FaJLMi/MFnTzkelmOHMedVcIg/Fh7h4=";
+      url = "https://api.snapcraft.io/api/v1/snaps/download/XXzVIXswXKHqlUATPqGCj2w2l7BxosS8_116.snap";
+      hash = "sha256-4RmVOQ9emlRyzAGxeiSLwvkGv+7R/mKLVYm5IWXqLpo=";
     };
   };
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "chromium-codecs-ffmpeg-extra";
 
-  version = "120726";
+  version = "2026-05-18";
 
   src = sources."${stdenv.hostPlatform.system}";
 
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   installPhase = ''
-    install -vD chromium-ffmpeg-${finalAttrs.version}/chromium-ffmpeg/libffmpeg.so $out/lib/libffmpeg.so
+    install -vD chromium-ffmpeg-git-${finalAttrs.version}/chromium-ffmpeg/libffmpeg.so $out/lib/libffmpeg.so
   '';
 
   passthru = {

From d526ecb286c01fa0dab3febffbcb2ac11d1dcb6a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Jul 2026 05:44:22 +0000
Subject: [PATCH 041/117] archon-lite: 9.3.85 -> 9.3.172

---
 pkgs/by-name/ar/archon-lite/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ar/archon-lite/package.nix b/pkgs/by-name/ar/archon-lite/package.nix
index 059315879d8c..d5177c4a810d 100644
--- a/pkgs/by-name/ar/archon-lite/package.nix
+++ b/pkgs/by-name/ar/archon-lite/package.nix
@@ -6,10 +6,10 @@
 }:
 let
   pname = "archon-lite";
-  version = "9.3.85";
+  version = "9.3.172";
   src = fetchurl {
     url = "https://github.com/RPGLogs/Uploaders-archon-lite/releases/download/v${version}/archon-lite-v${version}.AppImage";
-    hash = "sha256-ooNvgbtV6HKgzRLgHZul92NLnEB8oX6fHL6iwfHajVA=";
+    hash = "sha256-Jl1/40jtdG9acb2SSef4G91hs/b1UdOp6gPnoGPnQ60=";
   };
 
   extracted = appimageTools.extractType2 { inherit pname version src; };

From cd38ee6784e7cd8c785c5dcd2fe42b10aa70bbc1 Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Sat, 11 Jul 2026 10:36:54 +0200
Subject: [PATCH 042/117] libuv: fix riscv64-linux build

---
 pkgs/by-name/li/libuv/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/li/libuv/package.nix b/pkgs/by-name/li/libuv/package.nix
index 34b680b32e91..bcbf5472a7e2 100644
--- a/pkgs/by-name/li/libuv/package.nix
+++ b/pkgs/by-name/li/libuv/package.nix
@@ -129,6 +129,10 @@ stdenv.mkDerivation (finalAttrs: {
         # https://github.com/libuv/libuv/issues/1871
         "shutdown_close_pipe"
       ]
+      ++ lib.optionals stdenv.hostPlatform.isRiscV64 [
+        # Aborts (SIGABRT, exit 134)
+        "poll_nested_epoll"
+      ]
       ++ lib.optionals stdenv.hostPlatform.isFreeBSD [
         # ENETUNREACH when performed in jailed build env
         "tcp_connect"

From 894acc94f63aae4b9483cf5d9f64c183398e2454 Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Sat, 11 Jul 2026 11:09:26 +0200
Subject: [PATCH 043/117] catppuccin-gtk: fix build with python314+

---
 pkgs/by-name/ca/catppuccin-gtk/package.nix    |  5 ++++-
 .../ca/catppuccin-gtk/python-3.14.patch       | 20 +++++++++++++++++++
 2 files changed, 24 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/by-name/ca/catppuccin-gtk/python-3.14.patch

diff --git a/pkgs/by-name/ca/catppuccin-gtk/package.nix b/pkgs/by-name/ca/catppuccin-gtk/package.nix
index 256f5d549fe3..f0b16b2eb9b2 100644
--- a/pkgs/by-name/ca/catppuccin-gtk/package.nix
+++ b/pkgs/by-name/ca/catppuccin-gtk/package.nix
@@ -75,7 +75,10 @@ lib.checkListOfEnum "${pname}: theme accent" validAccents accents lib.checkListO
       hash = "sha256-q5/VcFsm3vNEw55zq/vcM11eo456SYE5TQA3g2VQjGc=";
     };
 
-    patches = [ ./fix-inconsistent-theme-name.patch ];
+    patches = [
+      ./fix-inconsistent-theme-name.patch
+      ./python-3.14.patch # Fix build with python 3.14+
+    ];
 
     nativeBuildInputs = [
       gtk3
diff --git a/pkgs/by-name/ca/catppuccin-gtk/python-3.14.patch b/pkgs/by-name/ca/catppuccin-gtk/python-3.14.patch
new file mode 100644
index 000000000000..93b4cc868349
--- /dev/null
+++ b/pkgs/by-name/ca/catppuccin-gtk/python-3.14.patch
@@ -0,0 +1,20 @@
+diff --git a/sources/build/args.py b/sources/build/args.py
+index 38a0a12..9221dec 100644
+--- a/sources/build/args.py
++++ b/sources/build/args.py
+@@ -84,7 +84,6 @@ def parse_args():
+     parser.add_argument(
+         "--zip",
+         help="Whether to bundle the theme into a zip",
+-        type=bool,
+         default=False,
+         action=argparse.BooleanOptionalAction,
+     )
+@@ -92,7 +91,6 @@ def parse_args():
+     parser.add_argument(
+         "--patch",
+         help="Whether to patch the colloid submodule",
+-        type=bool,
+         default=True,
+         action=argparse.BooleanOptionalAction,
+     )

From 39eaf7d0f3c675c67e4fcaa070158ea43a53db12 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Jul 2026 10:52:27 +0000
Subject: [PATCH 044/117] shopware-cli: 0.15.11 -> 0.15.12

---
 pkgs/by-name/sh/shopware-cli/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sh/shopware-cli/package.nix b/pkgs/by-name/sh/shopware-cli/package.nix
index 0bd5f4767cd9..8d4f42e265cc 100644
--- a/pkgs/by-name/sh/shopware-cli/package.nix
+++ b/pkgs/by-name/sh/shopware-cli/package.nix
@@ -11,12 +11,12 @@
 
 buildGoModule (finalAttrs: {
   pname = "shopware-cli";
-  version = "0.15.11";
+  version = "0.15.12";
   src = fetchFromGitHub {
     repo = "shopware-cli";
     owner = "shopware";
     tag = finalAttrs.version;
-    hash = "sha256-N+V1ta+NM2PpS2BS7wSpS8JaZFRMdVy6fM8HtGh7PjA=";
+    hash = "sha256-9T04G88OPjdgHKWpuRAma5HGudVfep0cN5tR+MHL28Q=";
   };
 
   nativeBuildInputs = [

From 807522fa05ee027d4145cfe7ba0997b914cbcf2b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 10 Jul 2026 14:30:19 -0700
Subject: [PATCH 045/117] home-assistant: 2026.7.1 -> 2026.7.2

Diff: https://github.com/home-assistant/core/compare/2026.7.1...2026.7.2

Changelog: https://github.com/home-assistant/core/releases/tag/2026.7.2
---
 pkgs/servers/home-assistant/default.nix |  6 ++--
 pkgs/servers/home-assistant/tests.nix   | 45 ++++++++++---------------
 2 files changed, 21 insertions(+), 30 deletions(-)

diff --git a/pkgs/servers/home-assistant/default.nix b/pkgs/servers/home-assistant/default.nix
index 49d422039124..cb5d580a01db 100644
--- a/pkgs/servers/home-assistant/default.nix
+++ b/pkgs/servers/home-assistant/default.nix
@@ -270,7 +270,7 @@ let
   extraBuildInputs = extraPackages python3Packages;
 
   # Don't forget to run update-component-packages.py after updating
-  hassVersion = "2026.7.1";
+  hassVersion = "2026.7.2";
 
 in
 python3Packages.buildPythonApplication rec {
@@ -291,13 +291,13 @@ python3Packages.buildPythonApplication rec {
     owner = "home-assistant";
     repo = "core";
     tag = version;
-    hash = "sha256-3QQ4zDbhr6wD0AR7QOnG3mfbtKYcesCF9qrFwRleQfU=";
+    hash = "sha256-5DEcg2DJwK2oItZD5BSK+B9rNGvbNOY/5YylOWe62Bs=";
   };
 
   # Secondary source is pypi sdist for translations
   sdist = fetchPypi {
     inherit pname version;
-    hash = "sha256-++Hb/ZXXhqnf7wOzmi5kmENFHqhLavZFJijRFMQu9Lg=";
+    hash = "sha256-3ODw2n/BH6qxJwakED3wuJ0XW9iNxjaESxR7bBCAxHU=";
   };
 
   build-system = with python3Packages; [
diff --git a/pkgs/servers/home-assistant/tests.nix b/pkgs/servers/home-assistant/tests.nix
index bb7452f8bdd5..9a7b873fa77b 100644
--- a/pkgs/servers/home-assistant/tests.nix
+++ b/pkgs/servers/home-assistant/tests.nix
@@ -53,6 +53,7 @@ let
       "frontend"
       "homeassistant_hardware"
     ];
+    influxdb = getComponentDeps "isal";
     intelliclima = getComponentDeps "intellifire";
     logbook = getComponentDeps "alexa";
     lovelace = getComponentDeps "frontend" ++ [
@@ -111,16 +112,16 @@ let
   };
 
   extraDisabledTestPaths = {
-    bluetooth = [
-      # [2026.7.1] Fails to replace HCI device after advertisement became stale
-      "tests/components/bluetooth/test_manager.py::test_switching_adapters_based_on_stale_with_discovered_interval"
+    ecovacs = [
+      # [2026.7.2] Outdated snapshots
+      "tests/components/ecovacs/test_vacuum.py::test_clean_area_room_from_not_current_map"
+      "tests/components/ecovacs/test_vacuum.py::test_clean_area_no_map"
+      "tests/components/ecovacs/test_vacuum.py::test_clean_area_invalid_map_id"
     ];
-    influxdb = [
-      # These tests fail because they check for the number of warnings in the
-      # logs and there is an extra warning in the logs:
-      # `WARNING:aiohttp_fast_zlib:zlib_ng and isal are not available, falling back to zlib, performance will be degraded.`
-      "tests/components/influxdb/test_sensor.py::test_state_for_no_results"
-      "tests/components/influxdb/test_sensor.py::test_state_matches_first_query_result_for_multiple_return"
+    izone = [
+      # [2026.7.2] Failed: Description not found for placeholder `host` in component.izone.config.step.confirm.description
+      "tests/components/izone/test_config_flow.py::test_not_found"
+      "tests/components/izone/test_config_flow.py::test_found"
     ];
     jellyfin = [
       # AssertionError: assert 'audio/x-flac' == 'audio/flac'
@@ -135,6 +136,14 @@ let
       "tests/components/minecraft_server/test_init.py"
       "tests/components/minecraft_server/test_sensor.py"
     ];
+    netatmo = [
+      # [2026.7.2] Language string mismatch (id vs ID)
+      "tests/components/netatmo/test_media_source.py::test_async_browse_media"
+    ];
+    wmspro = [
+      # [2026.7.2] Outdated snapshot
+      "tests/components/wmspro/test_number.py::test_number_update"
+    ];
     systemmonitor = [
       # sandbox doesn't grant access to /sys/class/power_supply
       "tests/components/systemmonitor/test_config_flow.py::test_add_and_remove_processes"
@@ -142,10 +151,6 @@ let
   };
 
   extraDisabledTests = {
-    bsblan = [
-      # [2026.7.1] outdated snapshot
-      "test_diagnostics"
-    ];
     conversation = lib.optionals stdenv.hostPlatform.isAarch64 [
       # intent fixture mismatch on aarch64
       "test_error_no_device_on_floor"
@@ -158,24 +163,10 @@ let
       # disabled via nixos-was-never-supported.patch
       "test_deprecated_installation_issue_core"
     ];
-    opendisplay = [
-      # [2026.6.0] Failed: Description not found for placeholder `reason` in component.opendisplay.exceptions.device_not_found.message
-      # https://github.com/home-assistant/core/pull/172909
-      "test_upload_image_device_not_in_range"
-    ];
     smlight = [
       # [2026.7.1] outdated snapshot
       "test_entry_diagnostics"
     ];
-    teslemetry = [
-      # [2026.6.4] http://github.com/home-assistant/core/commit/a33a92982af19e682a0d0fa7bec0cb16929c00d1
-      "test_sensors"
-      "test_sensors_streaming"
-    ];
-    yardian = [
-      # [2026.6.1] failing snapshot
-      "test_all_entities"
-    ];
     zeroconf = [
       # multicast socket bind, not possible in the sandbox
       "test_subscribe_discovery"

From 66ca25dbe43f8f2bb57b15359d5d5c1fc4389f4f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 10 Jul 2026 14:44:08 -0700
Subject: [PATCH 046/117] home-assistant.frontend: 20260624.4 -> 20260624.5

Changelog: https://github.com/home-assistant/frontend/releases/tag/20260624.5
---
 pkgs/servers/home-assistant/frontend.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/frontend.nix b/pkgs/servers/home-assistant/frontend.nix
index b984654efa37..ae187d666d35 100644
--- a/pkgs/servers/home-assistant/frontend.nix
+++ b/pkgs/servers/home-assistant/frontend.nix
@@ -8,7 +8,7 @@ buildPythonPackage (finalAttrs: {
   # the frontend version corresponding to a specific home-assistant version can be found here
   # https://github.com/home-assistant/home-assistant/blob/master/homeassistant/components/frontend/manifest.json
   pname = "home-assistant-frontend";
-  version = "20260624.4";
+  version = "20260624.5";
   format = "wheel";
 
   src = fetchPypi {
@@ -17,7 +17,7 @@ buildPythonPackage (finalAttrs: {
     pname = "home_assistant_frontend";
     dist = "py3";
     python = "py3";
-    hash = "sha256-mC3+BGVT9sDlHhj2aNeqh0YMehE3BAAT8SfMOQKv4/E=";
+    hash = "sha256-7o0IaunCHh6jKlW8NxbMSwoNCfqcIKDqPV6Xgjz42Qg=";
   };
 
   # there is nothing to strip in this package

From 1cc38ff49ddf435e73db4617095718844bcbacbc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 10 Jul 2026 15:02:36 -0700
Subject: [PATCH 047/117] home-assistant-custom-components.browser-mod: 3.0.0
 -> 3.0.2

Diff: https://github.com/thomasloven/hass-browser_mod/compare/v3.0.0...v3.0.2

Changelog: https://github.com/thomasloven/hass-browser_mod/blob/v3.0.2/CHANGELOG.md
---
 .../custom-components/browser-mod/package.nix               | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/browser-mod/package.nix b/pkgs/servers/home-assistant/custom-components/browser-mod/package.nix
index 66c811fa989f..c2722cb77bb4 100644
--- a/pkgs/servers/home-assistant/custom-components/browser-mod/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/browser-mod/package.nix
@@ -10,13 +10,13 @@
 buildHomeAssistantComponent rec {
   owner = "thomasloven";
   domain = "browser_mod";
-  version = "3.0.0";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "hass-browser_mod";
     tag = "v${version}";
-    hash = "sha256-s9b5JeMyT7pYyHWJtuqw2xVHrmU98kG5dBE4aBsJ+u8=";
+    hash = "sha256-5OzM3fzoDIiy46/MEJnYpgw3pOGWwVgCyQeorFRQm9M=";
   };
 
   nativeBuildInputs = [
@@ -27,7 +27,7 @@ buildHomeAssistantComponent rec {
 
   npmDeps = fetchNpmDeps {
     inherit src;
-    hash = "sha256-p+1yRZVyo/EunNjBkdkl8xajZO4U7KpdIu1GzU7L8gE=";
+    hash = "sha256-4S8v0YWm3mom+U6Kk09u/eBQFccoSjxHwwTwCH3qSGQ=";
   };
 
   npmBuildScript = "build";

From 9a2168edf9ceeedd854b63e61a4965c54efc8705 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 10 Jul 2026 15:03:00 -0700
Subject: [PATCH 048/117] home-assistant-custom-components.daikin_onecta: 4.6.8
 -> 4.6.10

Diff: https://github.com/jwillemsen/daikin_onecta/compare/v4.6.8...v4.6.10

Changelog: https://github.com/jwillemsen/daikin_onecta/releases/tag/v4.6.10
---
 .../custom-components/daikin_onecta/package.nix               | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/daikin_onecta/package.nix b/pkgs/servers/home-assistant/custom-components/daikin_onecta/package.nix
index 0673b346eed7..35fe4b9cabae 100644
--- a/pkgs/servers/home-assistant/custom-components/daikin_onecta/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/daikin_onecta/package.nix
@@ -7,13 +7,13 @@
 buildHomeAssistantComponent rec {
   owner = "jwillemsen";
   domain = "daikin_onecta";
-  version = "4.6.8";
+  version = "4.6.10";
 
   src = fetchFromGitHub {
     owner = "jwillemsen";
     repo = "daikin_onecta";
     tag = "v${version}";
-    hash = "sha256-+bkzzJ/8O0rwHV4qNvsCFeB3ku88zBeDGwSFvGPbtos=";
+    hash = "sha256-kUwtgjwDPuQ2Kce7Oi2IMXSpNuW9tBqQLKro9W0bDlU=";
   };
 
   meta = {

From ac6894c2db9e77ad5d160942381eb4bd4b01a8e7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 10 Jul 2026 15:03:06 -0700
Subject: [PATCH 049/117] home-assistant-custom-components.dreo: 1.9.23 ->
 1.10.1

Diff: https://github.com/JeffSteinbok/hass-dreo/compare/v1.9.23...v1.10.1

Changelog: https://github.com/JeffSteinbok/hass-dreo/releases/tag/v1.10.1
---
 .../servers/home-assistant/custom-components/dreo/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/dreo/package.nix b/pkgs/servers/home-assistant/custom-components/dreo/package.nix
index 9a661b28de07..011c2cb18c85 100644
--- a/pkgs/servers/home-assistant/custom-components/dreo/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/dreo/package.nix
@@ -12,13 +12,13 @@
 buildHomeAssistantComponent rec {
   owner = "JeffSteinbok";
   domain = "dreo";
-  version = "1.9.23";
+  version = "1.10.1";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "hass-dreo";
     tag = "v${version}";
-    hash = "sha256-yNe36tQRrW6dE7Kfe3Wg6CLPgaqP4cRVspj3ysV+xlU=";
+    hash = "sha256-/PBTWmqx/KTKvJ5K3KeKbVeypLtiT24TOZkWO62l7wA=";
   };
 
   dependencies = [ websockets ];

From e8eee1a2b63077d2046823db3beb63d4f1b5f357 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 10 Jul 2026 15:03:14 -0700
Subject: [PATCH 050/117] home-assistant-custom-components.ecoflow_ble: 0.9.4
 -> 1.0.1

Diff: https://github.com/rabits/ha-ef-ble/compare/v0.9.4...v1.0.1

Changelog: https://github.com/rabits/ha-ef-ble/releases/tag/v1.0.1
---
 .../home-assistant/custom-components/ecoflow_ble/package.nix  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/ecoflow_ble/package.nix b/pkgs/servers/home-assistant/custom-components/ecoflow_ble/package.nix
index 10e012e22196..7714ce87a959 100644
--- a/pkgs/servers/home-assistant/custom-components/ecoflow_ble/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/ecoflow_ble/package.nix
@@ -18,13 +18,13 @@
 buildHomeAssistantComponent rec {
   owner = "rabits";
   domain = "ef_ble";
-  version = "0.9.4";
+  version = "1.0.1";
 
   src = fetchFromGitHub {
     owner = "rabits";
     repo = "ha-ef-ble";
     tag = "v${version}";
-    hash = "sha256-OGU5PkW+H+tIPRwMWFEAMUZbJsm880HurLAdjIV0zG4=";
+    hash = "sha256-LPu4Autma/1MOrfs6FG9cQZFL3kRofVPbScEEZjAi6w=";
   };
 
   dependencies = [

From a0d578b9538508cdc72ce8d56fba412fb6e36443 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 10 Jul 2026 15:03:24 -0700
Subject: [PATCH 051/117] home-assistant-custom-components.elegoo_printer:
 2.10.1 -> 2.10.2

Diff: https://github.com/danielcherubini/elegoo-homeassistant/compare/v2.10.1...v2.10.2

Changelog: https://github.com/danielcherubini/elegoo-homeassistant/releases/tag/v2.10.2
---
 .../custom-components/elegoo_printer/package.nix              | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/elegoo_printer/package.nix b/pkgs/servers/home-assistant/custom-components/elegoo_printer/package.nix
index a76ec8273dcf..e39b8c68bccf 100644
--- a/pkgs/servers/home-assistant/custom-components/elegoo_printer/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/elegoo_printer/package.nix
@@ -19,13 +19,13 @@
 buildHomeAssistantComponent rec {
   owner = "danielcherubini";
   domain = "elegoo_printer";
-  version = "2.10.1";
+  version = "2.10.2";
 
   src = fetchFromGitHub {
     owner = "danielcherubini";
     repo = "elegoo-homeassistant";
     tag = "v${version}";
-    hash = "sha256-8L4uJC9TmZ4lkEAQzDUd2txAGPveA/3iiIYzguLtOSA=";
+    hash = "sha256-+bL43ACj/8dI7dNVNQ+3n2WvDaYhuh3tiwX98yXmTm4=";
   };
 
   dependencies = [

From b8c5b84080011effdca4d23b40311cb093f571fb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 10 Jul 2026 15:05:53 -0700
Subject: [PATCH 052/117] home-assistant-custom-components.octopus_energy:
 18.3.2 -> 18.3.3

Diff: https://github.com/BottlecapDave/HomeAssistant-OctopusEnergy/compare/v18.3.2...v18.3.3

Changelog: https://github.com/BottlecapDave/HomeAssistant-OctopusEnergy/releases/tag/v18.3.3
---
 .../custom-components/octopus_energy/package.nix              | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/octopus_energy/package.nix b/pkgs/servers/home-assistant/custom-components/octopus_energy/package.nix
index 75f5ea66d66e..17e9081d747c 100644
--- a/pkgs/servers/home-assistant/custom-components/octopus_energy/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/octopus_energy/package.nix
@@ -11,13 +11,13 @@
 buildHomeAssistantComponent rec {
   owner = "BottlecapDave";
   domain = "octopus_energy";
-  version = "18.3.2";
+  version = "18.3.3";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "HomeAssistant-OctopusEnergy";
     tag = "v${version}";
-    hash = "sha256-KSnpebEUzp25PsBMFqCajdnTINk51hdswmV9rGtG+3Q=";
+    hash = "sha256-HETG4kp76j8nKpacuQtVMeSvu70VVe1XfZXu+bGi1eU=";
   };
 
   dependencies = [ pydantic ];

From 32cc1693b12284ec5a1c6387b4923ec10a2010da Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 10 Jul 2026 15:07:14 -0700
Subject: [PATCH 053/117] home-assistant-custom-components.smarthq: 1.2.1 ->
 1.2.2

Diff: https://github.com/geappliances/geappliances-smarthq-integration/compare/v1.2.1...v1.2.2

Changelog: https://github.com/geappliances/geappliances-smarthq-integration/releases/tag/v1.2.2
---
 .../home-assistant/custom-components/smarthq/package.nix      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/smarthq/package.nix b/pkgs/servers/home-assistant/custom-components/smarthq/package.nix
index 496dc54787cf..1abf81c5ca88 100644
--- a/pkgs/servers/home-assistant/custom-components/smarthq/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/smarthq/package.nix
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent (finalAttrs: {
   owner = "geappliances";
   domain = "smarthq";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchFromGitHub {
     owner = "geappliances";
     repo = "geappliances-smarthq-integration";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8DAnALqtFuMfEXF4Kcu/RMmcK2LS7TLrvgrFP+Jwo/4=";
+    hash = "sha256-PwCorYIqRK4gQLaYxoebIVRIeTcIrDo3CRNs/6DUc9o=";
   };
 
   dependencies = [

From a0022327d2a70e10870196685f1cdbba5dadef8e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 10 Jul 2026 15:07:24 -0700
Subject: [PATCH 054/117] home-assistant-custom-components.solax_modbus:
 2026.06.7 -> 2026.07.1

Diff: https://github.com/wills106/homeassistant-solax-modbus/compare/2026.06.7...2026.07.1

Changelog: https://github.com/wills106/homeassistant-solax-modbus/releases/tag/2026.07.1
---
 .../home-assistant/custom-components/solax_modbus/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/solax_modbus/package.nix b/pkgs/servers/home-assistant/custom-components/solax_modbus/package.nix
index 2b7d21fcf948..286d16846e70 100644
--- a/pkgs/servers/home-assistant/custom-components/solax_modbus/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/solax_modbus/package.nix
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
   owner = "wills106";
   domain = "solax_modbus";
-  version = "2026.06.7";
+  version = "2026.07.1";
 
   src = fetchFromGitHub {
     owner = "wills106";
     repo = "homeassistant-solax-modbus";
     tag = version;
-    hash = "sha256-hZB+b81IezTDiJ6Z3Yy5TPJ+MTcyxtGvKVLYZx8CiNI=";
+    hash = "sha256-7/Wprn5PJhfnmSHenPFrQY3c1EBdmzqyH8ZclAmDwoI=";
   };
 
   dependencies = [ pymodbus ];

From 27e788f9b49734ce2980a3b4b95ea65c141d9988 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 10 Jul 2026 15:07:53 -0700
Subject: [PATCH 055/117] home-assistant-custom-components.systemair: 1.0.26 ->
 1.0.28

Diff: https://github.com/AN3Orik/systemair/compare/v1.0.26...v1.0.28

Changelog: https://github.com/AN3Orik/systemair/releases/tag/v1.0.28
---
 .../home-assistant/custom-components/systemair/package.nix    | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/systemair/package.nix b/pkgs/servers/home-assistant/custom-components/systemair/package.nix
index a03c7c5d83e6..e549e8d87c87 100644
--- a/pkgs/servers/home-assistant/custom-components/systemair/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/systemair/package.nix
@@ -10,13 +10,13 @@
 buildHomeAssistantComponent rec {
   owner = "AN3Orik";
   domain = "systemair";
-  version = "1.0.26";
+  version = "1.0.28";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "systemair";
     tag = "v${version}";
-    hash = "sha256-tY/5gEjMCbrVwIyEsWWsB/ePju9+8wgbi23XLdCVKrA=";
+    hash = "sha256-6JLcWBZU5YXgdcZUuCIs2KAJJJ8U7nawYwOgSjsNajc=";
   };
 
   dependencies = [

From 53ce63d15c7035226077b0b510b6db5ce43e0dee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 10 Jul 2026 15:48:25 -0700
Subject: [PATCH 056/117] python3Packages.tinytuya: 1.18.1 -> 1.20.0

Diff: https://github.com/jasonacox/tinytuya/compare/v1.18.1...v1.20.0

Changelog: https://github.com/jasonacox/tinytuya/releases/tag/v1.20.0
---
 pkgs/development/python-modules/tinytuya/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tinytuya/default.nix b/pkgs/development/python-modules/tinytuya/default.nix
index a940f99f06c0..34301f62bb73 100644
--- a/pkgs/development/python-modules/tinytuya/default.nix
+++ b/pkgs/development/python-modules/tinytuya/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "tinytuya";
-  version = "1.18.1";
+  version = "1.20.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jasonacox";
     repo = "tinytuya";
     tag = "v${version}";
-    hash = "sha256-skDCQ1ubsOGfPH0DPdTH1n5mIHGAkB/rSCnmVIoIl18=";
+    hash = "sha256-kyLRTfhTB8olZ48rUm+WtnuGZmCojnlUY4CeF+FADWg=";
   };
 
   build-system = [ setuptools ];

From 9f2708788a08a63f18a4101a23169d084159356f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 10 Jul 2026 15:08:04 -0700
Subject: [PATCH 057/117] home-assistant-custom-components.tuya_local: 2026.6.4
 -> 2026.7.1

Diff: https://github.com/make-all/tuya-local/compare/2026.6.4...2026.7.1

Changelog: https://github.com/make-all/tuya-local/releases/tag/2026.7.1
---
 .../home-assistant/custom-components/tuya_local/package.nix   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/tuya_local/package.nix b/pkgs/servers/home-assistant/custom-components/tuya_local/package.nix
index 26b653c45218..ee2560e06e52 100644
--- a/pkgs/servers/home-assistant/custom-components/tuya_local/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/tuya_local/package.nix
@@ -11,13 +11,13 @@
 buildHomeAssistantComponent rec {
   owner = "make-all";
   domain = "tuya_local";
-  version = "2026.6.4";
+  version = "2026.7.1";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "tuya-local";
     tag = version;
-    hash = "sha256-VJ2c8wegviirCT+hygg9LKPN5ZLqxfkQl6zayaXZRU0=";
+    hash = "sha256-NljzFG1uEg0J1eSXdPeZqPnA3eBrurUvHaAdnUffjgY=";
   };
 
   dependencies = [

From ac1fae6f8a2f2c727ffe249db17482da53008fb2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 10 Jul 2026 15:10:52 -0700
Subject: [PATCH 058/117] 
 home-assistant-custom-lovelace-modules.weather-forecast-card: 1.0.0 -> 1.1.0

Diff: https://github.com/troinine/ha-weather-forecast-card/compare/v1.0.0...v1.1.0
---
 .../weather-forecast-card/package.nix                       | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/weather-forecast-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/weather-forecast-card/package.nix
index 797d12b749b7..b673a107ac3a 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/weather-forecast-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/weather-forecast-card/package.nix
@@ -10,20 +10,20 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "weather-forecast-card";
-  version = "1.0.0";
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "troinine";
     repo = "ha-weather-forecast-card";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-N3bE6HSXx6Vst6ZiMsJ490XBnlDQJDm+MoEunlLusnQ=";
+    hash = "sha256-/i0BUUmiRvH1ZycS8t7yUFeuO9e5SIHlBvWz98tMAZo=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 4;
-    hash = "sha256-DDJpfkblo3E6YxWThs0rtkMabhRuDW2k5fszTo4Gud8=";
+    hash = "sha256-01AGz1k7I/ENOHhk7ycVFftd6yh/3Y9X1+Bc6lJshhU=";
   };
 
   nativeBuildInputs = [

From 2766577a34d2800275c15c00c91821a55d13ee2e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 10 Jul 2026 20:00:13 -0700
Subject: [PATCH 059/117] python3Packages.bumble: 0.0.229 -> 0.0.232

Diff: https://github.com/google/bumble/compare/v0.0.229...v0.0.232

Changelog: https://github.com/google/bumble/releases/tag/v0.0.232
---
 pkgs/development/python-modules/bumble/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/bumble/default.nix b/pkgs/development/python-modules/bumble/default.nix
index 8bc6b25c42ad..b19ce91259b4 100644
--- a/pkgs/development/python-modules/bumble/default.nix
+++ b/pkgs/development/python-modules/bumble/default.nix
@@ -28,14 +28,14 @@
 
 buildPythonPackage rec {
   pname = "bumble";
-  version = "0.0.229";
+  version = "0.0.232";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "bumble";
     tag = "v${version}";
-    hash = "sha256-sc4cUYfhHLc4sHGVfLkn1Zqmu0Tlpytkbit9ieQjNHE=";
+    hash = "sha256-NT8WNfkYHorjNfsZWry63Uuxk7zyOQDOHTqxZxJNypI=";
   };
 
   build-system = [

From 72ca08613ccc1b9e28bbd6de18fc1a54177281fd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 10 Jul 2026 22:09:56 -0700
Subject: [PATCH 060/117] python3Packages.homeassistant-stubs: 2026.7.1 ->
 2026.7.2

Diff: https://github.com/KapJI/homeassistant-stubs/compare/2026.7.1...2026.7.2

Changelog: https://github.com/KapJI/homeassistant-stubs/releases/tag/2026.7.2
---
 pkgs/servers/home-assistant/stubs.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/stubs.nix b/pkgs/servers/home-assistant/stubs.nix
index e8f663e4afdc..af89653cb3f5 100644
--- a/pkgs/servers/home-assistant/stubs.nix
+++ b/pkgs/servers/home-assistant/stubs.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "homeassistant-stubs";
-  version = "2026.7.1";
+  version = "2026.7.2";
   pyproject = true;
 
   disabled = python.version != home-assistant.python3Packages.python.version;
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "KapJI";
     repo = "homeassistant-stubs";
     tag = version;
-    hash = "sha256-pk6SGLbTLhA94Pg2FdWWRDNHbXif3EGGZzfDfziSFyY=";
+    hash = "sha256-QeUE2C3BZyOAF3le2wXWpW6g46chqANWOv1bAsSE8+U=";
   };
 
   build-system = [

From e0729128ed52d2730198562d9b459388f6806ccb Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sat, 11 Jul 2026 12:32:25 +0200
Subject: [PATCH 061/117] 
 home-assistant.python3Packages.pytest-homeassistant-custom-component:
 0.13.345 -> 0.13.346

https://github.com/MatthewFlamm/pytest-homeassistant-custom-component/blob/0.13.346/CHANGELOG.md
---
 .../home-assistant/pytest-homeassistant-custom-component.nix  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix b/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix
index da0e2cc1bb76..7cc26ca6ebbe 100644
--- a/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix
+++ b/pkgs/servers/home-assistant/pytest-homeassistant-custom-component.nix
@@ -19,7 +19,7 @@
 
 buildPythonPackage rec {
   pname = "pytest-homeassistant-custom-component";
-  version = "0.13.345";
+  version = "0.13.346";
   pyproject = true;
 
   disabled = pythonOlder "3.13";
@@ -28,7 +28,7 @@ buildPythonPackage rec {
     owner = "MatthewFlamm";
     repo = "pytest-homeassistant-custom-component";
     tag = version;
-    hash = "sha256-Px4uPBn/drE9gbpszJDMwlaHNWk/dLvdmgqcgY770V0=";
+    hash = "sha256-GUUz6gbhmIgZCH9y3oEmf1Y+Gp2yUf8zvxM//uGvsNw=";
   };
 
   build-system = [ setuptools ];

From 467d388060a2c8708d1d09a0fea37344de3894c8 Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Sat, 11 Jul 2026 13:19:38 +0100
Subject: [PATCH 062/117] ndstrim-rs: renamed from ndstrim

---
 pkgs/by-name/nd/{ndstrim => ndstrim-rs}/package.nix | 8 ++++----
 pkgs/top-level/aliases.nix                          | 1 +
 2 files changed, 5 insertions(+), 4 deletions(-)
 rename pkgs/by-name/nd/{ndstrim => ndstrim-rs}/package.nix (74%)

diff --git a/pkgs/by-name/nd/ndstrim/package.nix b/pkgs/by-name/nd/ndstrim-rs/package.nix
similarity index 74%
rename from pkgs/by-name/nd/ndstrim/package.nix
rename to pkgs/by-name/nd/ndstrim-rs/package.nix
index 5a081cc270fd..e51eaf195a70 100644
--- a/pkgs/by-name/nd/ndstrim/package.nix
+++ b/pkgs/by-name/nd/ndstrim-rs/package.nix
@@ -5,12 +5,12 @@
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
-  pname = "ndstrim";
+  pname = "ndstrim-rs";
   version = "0.2.1";
 
   src = fetchFromGitHub {
     owner = "Nemris";
-    repo = "ndstrim";
+    repo = "ndstrim-rs";
     rev = "v${finalAttrs.version}";
     hash = "sha256-KgtejBbFg6+klc8OpCs1CIb+7uVPCtP0/EM671vxauk=";
   };
@@ -19,8 +19,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   meta = {
     description = "Trim the excess padding found in Nintendo DS(i) ROMs";
-    homepage = "https://github.com/Nemris/ndstrim";
-    changelog = "https://github.com/Nemris/ndstrim/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    homepage = "https://github.com/Nemris/ndstrim-rs";
+    changelog = "https://github.com/Nemris/ndstrim-rs/blob/${finalAttrs.src.rev}/CHANGELOG.md";
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ thiagokokada ];
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index c7589389c542..430a151fb473 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1588,6 +1588,7 @@ mapAliases {
   nats-streaming-server = throw "'nats-streaming-server' has been removed as critical bug fixes and security fixes will no longer be performed as of June of 2023"; # Added 2025-10-13
   ncdu_2 = throw "'ncdu_2' has been renamed to/replaced by 'ncdu'"; # Converted to throw 2025-10-27
   ndjbdns = throw "'ndjbdns' has been removed as it has been pulled upstream"; # Added 2025-12-18
+  ndstrim = ndstrim-rs; # Added 2026-07-11
   near-cli = throw "'near-cli' has been removed as upstream has deprecated it and archived the source code repo"; # Added 2025-11-10
   neardal = throw "neardal has been removed because it has been marked as broken since at least November 2024."; # Added 2025-09-29
   nekoray = lib.warnOnInstantiate "nekoray has been renamed to throne" throne; # Added 2025-11-10

From 93de10dc0d3b4ee080f1cdb70da6cc9bdf10883a Mon Sep 17 00:00:00 2001
From: Harish Rajagopal <harish.rajagopals@gmail.com>
Date: Sat, 11 Jul 2026 14:35:49 +0200
Subject: [PATCH 063/117] feishin-web: init at 1.13.0

---
 pkgs/by-name/fe/feishin/package.nix | 2 ++
 pkgs/top-level/all-packages.nix     | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/pkgs/by-name/fe/feishin/package.nix b/pkgs/by-name/fe/feishin/package.nix
index 242b0cfa105b..ba20d7cc33bd 100644
--- a/pkgs/by-name/fe/feishin/package.nix
+++ b/pkgs/by-name/fe/feishin/package.nix
@@ -34,6 +34,8 @@ buildNpmPackage {
 
   inherit src;
 
+  __structuredAttrs = true;
+
   npmConfigHook = pnpmConfigHook;
   npmBuildScript = if webVersion then "build:web" else "build";
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 075a6b9b2a72..c17bd5727b2e 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11208,4 +11208,6 @@ with pkgs;
     enableWayland = false;
     enableX11 = true;
   };
+
+  feishin-web = feishin.override { webVersion = true; };
 }

From c57d218fbe6fa07ff9a83a59fa23ab7892f32bbd Mon Sep 17 00:00:00 2001
From: Felix Singer <felixsinger@posteo.net>
Date: Fri, 10 Jul 2026 00:39:22 +0200
Subject: [PATCH 064/117] redmine: Remove windows targets from bundler
 platforms

We only support the `ruby` target and no native targets.

Signed-off-by: Felix Singer <felixsinger@posteo.net>
---
 pkgs/by-name/re/redmine/update.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/re/redmine/update.sh b/pkgs/by-name/re/redmine/update.sh
index 11ad8e6e5b25..0a67e9dd88e7 100755
--- a/pkgs/by-name/re/redmine/update.sh
+++ b/pkgs/by-name/re/redmine/update.sh
@@ -15,6 +15,10 @@ for file in "gemset.nix" "Gemfile.lock"; do
 done
 
 bundle lock --add-platform ruby
+bundle lock --remove-platform mingw
+bundle lock --remove-platform x64_mingw
+bundle lock --remove-platform mswin
+bundle lock --remove-platform windows
 bundle lock --remove-platform aarch64-linux
 bundle lock --remove-platform aarch64-linux-gnu
 bundle lock --remove-platform aarch64-linux-musl

From bc8e8eaa79b20d0456459fa78209b555a6347911 Mon Sep 17 00:00:00 2001
From: Felix Singer <felixsinger@posteo.net>
Date: Thu, 9 Jul 2026 23:59:40 +0200
Subject: [PATCH 065/117] redmine: 6.1.3 -> 7.0.0

Signed-off-by: Felix Singer <felixsinger@posteo.net>
---
 pkgs/by-name/re/redmine/Gemfile      |  48 ++-
 pkgs/by-name/re/redmine/Gemfile.lock | 278 +++++++++---------
 pkgs/by-name/re/redmine/gemset.nix   | 421 +++++++++++----------------
 pkgs/by-name/re/redmine/package.nix  |   6 +-
 4 files changed, 331 insertions(+), 422 deletions(-)

diff --git a/pkgs/by-name/re/redmine/Gemfile b/pkgs/by-name/re/redmine/Gemfile
index cf30bf9e288f..cf4bd7f86f8a 100644
--- a/pkgs/by-name/re/redmine/Gemfile
+++ b/pkgs/by-name/re/redmine/Gemfile
@@ -1,34 +1,35 @@
 source 'https://rubygems.org'
 
-ruby '>= 3.2.0', '< 3.5.0'
+ruby '>= 3.2.0', '< 4.1.0'
 
-gem 'rails', '7.2.3.1'
-gem 'rouge', '~> 4.5'
+gem 'rails', '8.1.3'
+gem 'rouge', '~> 5.0'
 gem 'mini_mime', '~> 1.1.0'
 gem "actionpack-xml_parser"
-gem 'roadie-rails', '~> 3.3.0'
+gem 'roadie-rails', '~> 3.4.0'
 gem 'marcel'
-gem 'mail', '~> 2.8.1'
+gem 'mail', '~> 2.9.0'
 gem 'nokogiri', '~> 1.19.1'
-gem 'i18n', '~> 1.14.1'
+gem 'i18n', '~> 1.15.2'
 gem 'rbpdf', '~> 1.21.4'
 gem 'addressable'
-gem 'rubyzip', '~> 2.4.0'
-gem 'propshaft', '~> 1.1.0'
+gem 'rubyzip', '~> 3.4.0'
+gem 'propshaft', '~> 1.3.0'
 gem 'rack', '>= 3.1.3'
 gem "stimulus-rails", "~> 1.3"
 gem "importmap-rails", "~> 2.0"
-gem 'commonmarker', '~> 2.3.0'
+gem 'commonmarker', '~> 2.8.2'
 gem "doorkeeper", "~> 5.8.2"
 gem "bcrypt", require: false
 gem "doorkeeper-i18n", "~> 5.2"
 gem "requestjs-rails", "~> 0.0.13"
 
 #  Ruby Standard Gems
-gem 'csv', '~> 3.3.2'
-gem 'net-imap', '~> 0.5.7'
+gem 'csv', '~> 3.3.5'
+gem 'net-imap', '~> 0.6.1'
 gem 'net-pop', '~> 0.1.2'
-gem 'net-smtp', '~> 0.5.0'
+gem 'net-smtp', '~> 0.5.1'
+gem 'ostruct'
 
 # Windows does not include zoneinfo files, so bundle the tzinfo-data gem
 gem 'tzinfo-data', platforms: [:mingw, :x64_mingw, :mswin]
@@ -37,13 +38,12 @@ gem 'tzinfo-data', platforms: [:mingw, :x64_mingw, :mswin]
 gem 'rotp', '>= 5.0.0'
 gem 'rqrcode'
 
-# HTML pipeline and sanitization
-gem "html-pipeline", "~> 2.13.2"
-gem "sanitize", "~> 6.0"
+# HTML sanitization
+gem "sanitize", "~> 7.0"
 
 # Optional gem for LDAP authentication
 group :ldap do
-  gem 'net-ldap', '~> 0.17.0'
+  gem 'net-ldap', '~> 0.20.0'
 end
 
 # Optional gem for exporting the gantt to a PNG file
@@ -54,10 +54,10 @@ end
 # Include database gems for the database adapters NixOS supports
 gem 'mysql2', '~> 0.5.0'
 gem "with_advisory_lock"
-gem 'trilogy', '~> 2.9.0'
+gem 'trilogy', '~> 2.12.4'
 gem "with_advisory_lock"
-gem 'pg', '~> 1.5.3'
-gem 'sqlite3', '~> 2.5.0'
+gem 'pg', '~> 1.6.2'
+gem 'sqlite3', '~> 2.9.4'
 
 group :development, :test do
   gem 'debug'
@@ -80,15 +80,13 @@ group :test do
   gem "capybara", ">= 3.39"
   gem 'selenium-webdriver', '>= 4.11.0'
   # RuboCop
-  gem 'rubocop', '~> 1.76.0', require: false
-  gem 'rubocop-performance', '~> 1.25.0', require: false
-  gem 'rubocop-rails', '~> 2.32.0', require: false
+  gem 'rubocop', '~> 1.88.0', require: false
+  gem 'rubocop-performance', '~> 1.26.0', require: false
+  gem 'rubocop-rails', '~> 2.34.3', require: false
   gem 'bundle-audit', require: false
   # for testing oauth provider capabilities
   gem 'oauth2'
-  gem 'rest-client'
-  # Lock minitest to 5.x until a Rails release includes support for minitest 6.0
-  gem 'minitest', '~> 5.27'
+  gem 'webrick'
 end
 
 gem "webrick"
diff --git a/pkgs/by-name/re/redmine/Gemfile.lock b/pkgs/by-name/re/redmine/Gemfile.lock
index 5a4881050674..bba1523f1286 100644
--- a/pkgs/by-name/re/redmine/Gemfile.lock
+++ b/pkgs/by-name/re/redmine/Gemfile.lock
@@ -1,33 +1,33 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    actioncable (7.2.3.1)
-      actionpack (= 7.2.3.1)
-      activesupport (= 7.2.3.1)
+    action_text-trix (2.1.19)
+      railties
+    actioncable (8.1.3)
+      actionpack (= 8.1.3)
+      activesupport (= 8.1.3)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
       zeitwerk (~> 2.6)
-    actionmailbox (7.2.3.1)
-      actionpack (= 7.2.3.1)
-      activejob (= 7.2.3.1)
-      activerecord (= 7.2.3.1)
-      activestorage (= 7.2.3.1)
-      activesupport (= 7.2.3.1)
+    actionmailbox (8.1.3)
+      actionpack (= 8.1.3)
+      activejob (= 8.1.3)
+      activerecord (= 8.1.3)
+      activestorage (= 8.1.3)
+      activesupport (= 8.1.3)
       mail (>= 2.8.0)
-    actionmailer (7.2.3.1)
-      actionpack (= 7.2.3.1)
-      actionview (= 7.2.3.1)
-      activejob (= 7.2.3.1)
-      activesupport (= 7.2.3.1)
+    actionmailer (8.1.3)
+      actionpack (= 8.1.3)
+      actionview (= 8.1.3)
+      activejob (= 8.1.3)
+      activesupport (= 8.1.3)
       mail (>= 2.8.0)
       rails-dom-testing (~> 2.2)
-    actionpack (7.2.3.1)
-      actionview (= 7.2.3.1)
-      activesupport (= 7.2.3.1)
-      cgi
+    actionpack (8.1.3)
+      actionview (= 8.1.3)
+      activesupport (= 8.1.3)
       nokogiri (>= 1.8.5)
-      racc
-      rack (>= 2.2.4, < 3.3)
+      rack (>= 2.2.4)
       rack-session (>= 1.0.1)
       rack-test (>= 0.6.3)
       rails-dom-testing (~> 2.2)
@@ -36,51 +36,54 @@ GEM
     actionpack-xml_parser (2.0.1)
       actionpack (>= 5.0)
       railties (>= 5.0)
-    actiontext (7.2.3.1)
-      actionpack (= 7.2.3.1)
-      activerecord (= 7.2.3.1)
-      activestorage (= 7.2.3.1)
-      activesupport (= 7.2.3.1)
+    actiontext (8.1.3)
+      action_text-trix (~> 2.1.15)
+      actionpack (= 8.1.3)
+      activerecord (= 8.1.3)
+      activestorage (= 8.1.3)
+      activesupport (= 8.1.3)
       globalid (>= 0.6.0)
       nokogiri (>= 1.8.5)
-    actionview (7.2.3.1)
-      activesupport (= 7.2.3.1)
+    actionview (8.1.3)
+      activesupport (= 8.1.3)
       builder (~> 3.1)
-      cgi
       erubi (~> 1.11)
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
-    activejob (7.2.3.1)
-      activesupport (= 7.2.3.1)
+    activejob (8.1.3)
+      activesupport (= 8.1.3)
       globalid (>= 0.3.6)
-    activemodel (7.2.3.1)
-      activesupport (= 7.2.3.1)
-    activerecord (7.2.3.1)
-      activemodel (= 7.2.3.1)
-      activesupport (= 7.2.3.1)
+    activemodel (8.1.3)
+      activesupport (= 8.1.3)
+    activerecord (8.1.3)
+      activemodel (= 8.1.3)
+      activesupport (= 8.1.3)
       timeout (>= 0.4.0)
-    activestorage (7.2.3.1)
-      actionpack (= 7.2.3.1)
-      activejob (= 7.2.3.1)
-      activerecord (= 7.2.3.1)
-      activesupport (= 7.2.3.1)
+    activestorage (8.1.3)
+      actionpack (= 8.1.3)
+      activejob (= 8.1.3)
+      activerecord (= 8.1.3)
+      activesupport (= 8.1.3)
       marcel (~> 1.0)
-    activesupport (7.2.3.1)
+    activesupport (8.1.3)
       base64
-      benchmark (>= 0.3)
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.3.1)
       connection_pool (>= 2.2.5)
       drb
       i18n (>= 1.6, < 2)
+      json
       logger (>= 1.4.2)
-      minitest (>= 5.1, < 6)
+      minitest (>= 5.1)
       securerandom (>= 0.3)
       tzinfo (~> 2.0, >= 2.0.5)
+      uri (>= 0.13.1)
     addressable (2.9.0)
       public_suffix (>= 2.0.2, < 8.0)
+    anonymous_loader (0.1.2)
+      version_gem (~> 1.1, >= 1.1.13)
     ast (2.4.3)
-    auth-sanitizer (0.2.1)
+    auth-sanitizer (0.2.2)
       version_gem (~> 1.1, >= 1.1.10)
     base64 (0.3.0)
     bcrypt (3.1.22)
@@ -104,13 +107,12 @@ GEM
       rack-test (>= 0.6.3)
       regexp_parser (>= 1.5, < 3.0)
       xpath (~> 3.2)
-    cgi (0.5.1)
     chunky_png (1.4.0)
-    commonmarker (2.3.2)
+    commonmarker (2.8.3)
       rb_sys (~> 0.9)
     concurrent-ruby (1.3.7)
     connection_pool (3.0.2)
-    crass (1.0.6)
+    crass (1.0.7)
     css_parser (2.2.0)
       addressable
     csv (3.3.5)
@@ -119,7 +121,6 @@ GEM
       irb (~> 1.10)
       reline (>= 0.3.8)
     docile (1.4.1)
-    domain_name (0.6.20240107)
     doorkeeper (5.8.2)
       railties (>= 5)
     doorkeeper-i18n (5.2.9)
@@ -134,18 +135,12 @@ GEM
     faraday-net_http (3.4.4)
       net-http (~> 0.5)
     ffi (1.17.4)
-    globalid (1.3.0)
+    globalid (1.4.0)
       activesupport (>= 6.1)
     hashie (5.1.0)
       logger
-    html-pipeline (2.13.2)
-      activesupport (>= 2)
-      nokogiri (>= 1.4)
     htmlentities (4.4.2)
-    http-accept (1.7.0)
-    http-cookie (1.1.6)
-      domain_name (~> 0.5)
-    i18n (1.14.8)
+    i18n (1.15.2)
       concurrent-ruby (~> 1.0)
     importmap-rails (2.2.3)
       actionpack (>= 6.0.0)
@@ -157,10 +152,10 @@ GEM
       prism (>= 1.3.0)
       rdoc (>= 4.0.0)
       reline (>= 0.4.2)
-    json (2.19.9)
+    json (2.20.0)
     jwt (3.2.0)
       base64
-    language_server-protocol (3.17.0.5)
+    language_server-protocol (3.17.0.6)
     lint_roller (1.1.0)
     listen (3.10.0)
       logger
@@ -170,23 +165,22 @@ GEM
     loofah (2.25.1)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
-    mail (2.8.1)
+    mail (2.9.1)
+      logger
       mini_mime (>= 0.1.1)
       net-imap
       net-pop
       net-smtp
     marcel (1.2.1)
     matrix (0.4.3)
-    mime-types (3.7.0)
-      logger
-      mime-types-data (~> 3.2025, >= 3.2025.0507)
-    mime-types-data (3.2026.0414)
     mini_magick (5.2.0)
       benchmark
       logger
     mini_mime (1.1.5)
     mini_portile2 (2.8.9)
-    minitest (5.27.0)
+    minitest (6.0.6)
+      drb (~> 2.0)
+      prism (~> 1.5)
     mocha (3.1.0)
       ruby2_keywords (>= 0.0.5)
     multi_xml (0.9.1)
@@ -195,47 +189,46 @@ GEM
       bigdecimal
     net-http (0.9.1)
       uri (>= 0.11.1)
-    net-imap (0.5.15)
+    net-imap (0.6.4.1)
       date
       net-protocol
-    net-ldap (0.17.1)
+    net-ldap (0.20.0)
+      base64
+      ostruct
     net-pop (0.1.2)
       net-protocol
     net-protocol (0.2.2)
       timeout
     net-smtp (0.5.1)
       net-protocol
-    netrc (0.11.0)
     nio4r (2.7.5)
-    nokogiri (1.19.3)
+    nokogiri (1.19.4)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
-    oauth2 (2.0.23)
-      auth-sanitizer (~> 0.2, >= 0.2.1)
+    oauth2 (2.0.24)
+      anonymous_loader (~> 0.1, >= 0.1.1)
+      auth-sanitizer (~> 0.2, >= 0.2.2)
       faraday (>= 0.17.3, < 4.0)
       jwt (>= 1.0, < 4.0)
       logger (~> 1.2)
       multi_xml (~> 0.5)
       rack (>= 1.2, < 4)
       snaky_hash (~> 2.0, >= 2.0.6)
-      version_gem (~> 1.1, >= 1.1.11)
-    parallel (1.28.0)
+      version_gem (~> 1.1, >= 1.1.12)
+    ostruct (0.6.3)
+    parallel (2.1.0)
     parser (3.3.11.1)
       ast (~> 2.4.1)
       racc
-    pg (1.5.9)
-    pp (0.6.3)
+    pg (1.6.3)
+    pp (0.6.4)
       prettyprint
     prettyprint (0.2.0)
     prism (1.9.0)
-    propshaft (1.1.0)
+    propshaft (1.3.2)
       actionpack (>= 7.0.0)
       activesupport (>= 7.0.0)
       rack
-      railties (>= 7.0.0)
-    psych (5.4.0)
-      date
-      stringio
     public_suffix (7.0.5)
     puma (8.0.2)
       nio4r (~> 2.0)
@@ -248,20 +241,20 @@ GEM
       rack (>= 1.3)
     rackup (2.3.1)
       rack (>= 3)
-    rails (7.2.3.1)
-      actioncable (= 7.2.3.1)
-      actionmailbox (= 7.2.3.1)
-      actionmailer (= 7.2.3.1)
-      actionpack (= 7.2.3.1)
-      actiontext (= 7.2.3.1)
-      actionview (= 7.2.3.1)
-      activejob (= 7.2.3.1)
-      activemodel (= 7.2.3.1)
-      activerecord (= 7.2.3.1)
-      activestorage (= 7.2.3.1)
-      activesupport (= 7.2.3.1)
+    rails (8.1.3)
+      actioncable (= 8.1.3)
+      actionmailbox (= 8.1.3)
+      actionmailer (= 8.1.3)
+      actionpack (= 8.1.3)
+      actiontext (= 8.1.3)
+      actionview (= 8.1.3)
+      activejob (= 8.1.3)
+      activemodel (= 8.1.3)
+      activerecord (= 8.1.3)
+      activestorage (= 8.1.3)
+      activesupport (= 8.1.3)
       bundler (>= 1.15.0)
-      railties (= 7.2.3.1)
+      railties (= 8.1.3)
     rails-dom-testing (2.3.0)
       activesupport (>= 5.0.0)
       minitest
@@ -269,10 +262,9 @@ GEM
     rails-html-sanitizer (1.7.0)
       loofah (~> 2.25)
       nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
-    railties (7.2.3.1)
-      actionpack (= 7.2.3.1)
-      activesupport (= 7.2.3.1)
-      cgi
+    railties (8.1.3)
+      actionpack (= 8.1.3)
+      activesupport (= 8.1.3)
       irb (~> 1.13)
       rackup (>= 1.0.0)
       rake (>= 12.2)
@@ -291,52 +283,53 @@ GEM
       htmlentities
       rbpdf-font (~> 1.19.0)
     rbpdf-font (1.19.1)
-    rdoc (7.2.0)
+    rbs (4.0.3)
+      logger
+      prism (>= 1.6.0)
+      tsort
+    rdoc (8.0.0)
       erb
-      psych (>= 4.0.0)
+      prism (>= 1.6.0)
+      rbs (>= 4.0.0)
       tsort
     regexp_parser (2.12.0)
     reline (0.6.3)
       io-console (~> 0.5)
     requestjs-rails (0.0.14)
       railties (>= 7.1.0)
-    rest-client (2.1.0)
-      http-accept (>= 1.7.0, < 2.0)
-      http-cookie (>= 1.0.2, < 2.0)
-      mime-types (>= 1.16, < 4.0)
-      netrc (~> 0.8)
     rexml (3.4.4)
     roadie (5.3.0)
       css_parser (>= 1.4, < 3.0)
       nokogiri (~> 1.15)
-    roadie-rails (3.3.0)
-      railties (>= 5.1, < 8.1)
+    roadie-rails (3.4.0)
+      railties (>= 5.1, < 8.2)
       roadie (~> 5.0)
     rotp (6.3.0)
-    rouge (4.7.0)
+    rouge (5.0.0)
+      strscan (~> 3.1)
     rqrcode (3.2.0)
       chunky_png (~> 1.0)
       rqrcode_core (~> 2.0)
     rqrcode_core (2.1.0)
-    rubocop (1.76.2)
+    rubocop (1.88.2)
       json (~> 2.3)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.1.0)
-      parallel (~> 1.10)
+      parallel (>= 1.10)
       parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 2.9.3, < 3.0)
-      rubocop-ast (>= 1.45.1, < 2.0)
+      rubocop-ast (>= 1.49.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.49.1)
+    rubocop-ast (1.50.0)
       parser (>= 3.3.7.2)
       prism (~> 1.7)
-    rubocop-performance (1.25.0)
+    rubocop-performance (1.26.1)
       lint_roller (~> 1.1)
       rubocop (>= 1.75.0, < 2.0)
-      rubocop-ast (>= 1.38.0, < 2.0)
-    rubocop-rails (2.32.0)
+      rubocop-ast (>= 1.47.1, < 2.0)
+    rubocop-rails (2.34.3)
       activesupport (>= 4.2.0)
       lint_roller (~> 1.1)
       rack (>= 1.1)
@@ -344,10 +337,10 @@ GEM
       rubocop-ast (>= 1.44.0, < 2.0)
     ruby-progressbar (1.13.0)
     ruby2_keywords (0.0.5)
-    rubyzip (2.4.1)
-    sanitize (6.1.3)
+    rubyzip (3.4.1)
+    sanitize (7.0.0)
       crass (~> 1.0.2)
-      nokogiri (>= 1.12.0)
+      nokogiri (>= 1.16.8)
     securerandom (0.4.1)
     selenium-webdriver (4.45.0)
       base64 (~> 0.2)
@@ -364,11 +357,11 @@ GEM
     snaky_hash (2.0.6)
       hashie (>= 0.1.0, < 6)
       version_gem (>= 1.1.8, < 3)
-    sqlite3 (2.5.0)
+    sqlite3 (2.9.5)
       mini_portile2 (~> 2.8.0)
     stimulus-rails (1.3.4)
       railties (>= 6.0.0)
-    stringio (3.2.0)
+    strscan (3.1.8)
     svg_optimizer (0.3.0)
       nokogiri
     svg_sprite (1.0.3)
@@ -377,7 +370,8 @@ GEM
       thor
     thor (1.5.0)
     timeout (0.6.1)
-    trilogy (2.9.0)
+    trilogy (2.12.6)
+      bigdecimal
     tsort (0.2.0)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
@@ -387,10 +381,10 @@ GEM
     uniform_notifier (1.18.0)
     uri (1.1.1)
     useragent (0.16.11)
-    version_gem (1.1.12)
+    version_gem (1.1.13)
     webrick (1.9.2)
     websocket (1.2.11)
-    websocket-driver (0.8.1)
+    websocket-driver (0.8.2)
       base64
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
@@ -412,53 +406,51 @@ DEPENDENCIES
   bullet
   bundle-audit
   capybara (>= 3.39)
-  commonmarker (~> 2.3.0)
-  csv (~> 3.3.2)
+  commonmarker (~> 2.8.2)
+  csv (~> 3.3.5)
   debug
   doorkeeper (~> 5.8.2)
   doorkeeper-i18n (~> 5.2)
   ffi
-  html-pipeline (~> 2.13.2)
-  i18n (~> 1.14.1)
+  i18n (~> 1.15.2)
   importmap-rails (~> 2.0)
   listen (~> 3.3)
-  mail (~> 2.8.1)
+  mail (~> 2.9.0)
   marcel
   mini_magick (~> 5.2.0)
   mini_mime (~> 1.1.0)
-  minitest (~> 5.27)
   mocha (>= 2.0.1)
   mysql2 (~> 0.5.0)
-  net-imap (~> 0.5.7)
-  net-ldap (~> 0.17.0)
+  net-imap (~> 0.6.1)
+  net-ldap (~> 0.20.0)
   net-pop (~> 0.1.2)
-  net-smtp (~> 0.5.0)
+  net-smtp (~> 0.5.1)
   nokogiri (~> 1.19.1)
   oauth2
-  pg (~> 1.5.3)
-  propshaft (~> 1.1.0)
+  ostruct
+  pg (~> 1.6.2)
+  propshaft (~> 1.3.0)
   puma
   rack (>= 3.1.3)
-  rails (= 7.2.3.1)
+  rails (= 8.1.3)
   rails-dom-testing (>= 2.3.0)
   rbpdf (~> 1.21.4)
   requestjs-rails (~> 0.0.13)
-  rest-client
-  roadie-rails (~> 3.3.0)
+  roadie-rails (~> 3.4.0)
   rotp (>= 5.0.0)
-  rouge (~> 4.5)
+  rouge (~> 5.0)
   rqrcode
-  rubocop (~> 1.76.0)
-  rubocop-performance (~> 1.25.0)
-  rubocop-rails (~> 2.32.0)
-  rubyzip (~> 2.4.0)
-  sanitize (~> 6.0)
+  rubocop (~> 1.88.0)
+  rubocop-performance (~> 1.26.0)
+  rubocop-rails (~> 2.34.3)
+  rubyzip (~> 3.4.0)
+  sanitize (~> 7.0)
   selenium-webdriver (>= 4.11.0)
   simplecov (~> 0.22.0)
-  sqlite3 (~> 2.5.0)
+  sqlite3 (~> 2.9.4)
   stimulus-rails (~> 1.3)
   svg_sprite
-  trilogy (~> 2.9.0)
+  trilogy (~> 2.12.4)
   tzinfo-data
   webrick
   with_advisory_lock
diff --git a/pkgs/by-name/re/redmine/gemset.nix b/pkgs/by-name/re/redmine/gemset.nix
index b8b1c5989d7e..ca4639de3b75 100644
--- a/pkgs/by-name/re/redmine/gemset.nix
+++ b/pkgs/by-name/re/redmine/gemset.nix
@@ -1,4 +1,15 @@
 {
+  action_text-trix = {
+    dependencies = [ "railties" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "02a0yz97d12cf6wcj5r43ak57mhlcj4r84k5ma2g570046aga4kh";
+      type = "gem";
+    };
+    version = "2.1.19";
+  };
   actioncable = {
     dependencies = [
       "actionpack"
@@ -11,10 +22,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0g5kbrqvhwlliyrzd2bhc3kdiqm58df0x3w716bs0ygwyjil1gyk";
+      sha256 = "1w40bbkjd0lds57bfr24hbj9qfkwj9v33x6457g24sjfwispzg75";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "8.1.3";
   };
   actionmailbox = {
     dependencies = [
@@ -29,10 +40,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0hf59r6sk0qb5va0ga549rbadcb5n1a2ry8nlkszzcksr6039rx4";
+      sha256 = "0ndf98dpzmz8xs6m253zpwnhyfrvxdkfyvssxps0vrx0x9sa8zfz";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "8.1.3";
   };
   actionmailer = {
     dependencies = [
@@ -47,18 +58,16 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0rq4aan18y6gwziabnj1q1486349k1v1i5m7ysv206pqqpavcy7m";
+      sha256 = "13a4329lgrda8s9mqrfbaakvc90i6ak82rfpljmd0w5vj54747w3";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "8.1.3";
   };
   actionpack = {
     dependencies = [
       "actionview"
       "activesupport"
-      "cgi"
       "nokogiri"
-      "racc"
       "rack"
       "rack-session"
       "rack-test"
@@ -70,10 +79,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1jp4w493wvfh9246wxk7g00m1a3vmzkvs0rznq62fwvjjdzzwsmn";
+      sha256 = "18r93ii2ayw8n60qsx259dy8nwgbfxf3ndncla0xbia79np8r6dg";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "8.1.3";
   };
   actionpack-xml_parser = {
     dependencies = [
@@ -91,6 +100,7 @@
   };
   actiontext = {
     dependencies = [
+      "action_text-trix"
       "actionpack"
       "activerecord"
       "activestorage"
@@ -102,16 +112,15 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1qs350j3zm7sd6xxn61d93mv3lx1ravbjqja12c7nd7a0zs1h52v";
+      sha256 = "1ln7mwflqf7nsgkj9lm1p7bmc6h8yqaa47q1cdj9xsp102f034fj";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "8.1.3";
   };
   actionview = {
     dependencies = [
       "activesupport"
       "builder"
-      "cgi"
       "erubi"
       "rails-dom-testing"
       "rails-html-sanitizer"
@@ -120,10 +129,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0z7zy6ibfpsdj9jbdm54bx3ws4dszcq7qa564jn645rr8dlbh6fy";
+      sha256 = "0pgxl9p2q2zbwb6626yw7rgpbmv2bvxykq2w1h83inrygy6chiqk";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "8.1.3";
   };
   activejob = {
     dependencies = [
@@ -134,10 +143,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1n3fiwm1x3dxwj36n9pspd2bgffyw28ys9yd36hjvf3iwdy25i0b";
+      sha256 = "1lz8bxb6pcf9yvxwyj6355aws3ylxi5rwc577ly4q858d9vb2jd1";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "8.1.3";
   };
   activemodel = {
     dependencies = [ "activesupport" ];
@@ -145,10 +154,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1l60a6mqx1wgp15ki1cp68djci0czgrikpydii5bd877hndqdq9r";
+      sha256 = "06c23jww82grgvxw19g4bi9c957aj5hh24wzyyw4jdpg9jz5rh4h";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "8.1.3";
   };
   activerecord = {
     dependencies = [
@@ -160,10 +169,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0pd0f1hy6rvyanmrklqir33xq0jb2my4jajz7hc38nysfpi175dq";
+      sha256 = "1avhmih54xqyj14zrv6ciw2ndpb11bmkwq0fcwm0mfk64ixvw0w0";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "8.1.3";
   };
   activestorage = {
     dependencies = [
@@ -177,24 +186,25 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1azzbpfp726yigwzmj8g2jji149wisnwrgb86zix6mk25sj4w8hb";
+      sha256 = "0k9q8sdlf576r8rp2hgdxy5lpr8f157bpq8mfsk52f8l169wwr05";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "8.1.3";
   };
   activesupport = {
     dependencies = [
       "base64"
-      "benchmark"
       "bigdecimal"
       "concurrent-ruby"
       "connection_pool"
       "drb"
       "i18n"
+      "json"
       "logger"
       "minitest"
       "securerandom"
       "tzinfo"
+      "uri"
     ];
     groups = [
       "default"
@@ -204,10 +214,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0d6bhg9cim83g8cypjd7cms45ng4p9ga69v26i3vp823d98yvsqi";
+      sha256 = "03m2vjhq3nmc8c3hpivxhvkjd8igg16nmv0p2fgdsgacppgy1991";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "8.1.3";
   };
   addressable = {
     dependencies = [ "public_suffix" ];
@@ -223,6 +233,20 @@
     };
     version = "2.9.0";
   };
+  anonymous_loader = {
+    dependencies = [ "version_gem" ];
+    groups = [
+      "default"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1hpghmcr15x53i1v2g2fhqskhjil61pxsvwm8wyvjbw1y31pgkwc";
+      type = "gem";
+    };
+    version = "0.1.2";
+  };
   ast = {
     groups = [
       "default"
@@ -245,15 +269,16 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0xy5gjb12kv6zjn4zyd16yfv4bygd02ykbr6cz10d6sqyw0wyzci";
+      sha256 = "1bkvybb3ahhzzdd785p8f14p82ga1iwrg9k79xx5xzk7pgg1409h";
       type = "gem";
     };
-    version = "0.2.1";
+    version = "0.2.2";
   };
   base64 = {
     groups = [
       "default"
       "development"
+      "ldap"
       "test"
     ];
     platforms = [ ];
@@ -277,9 +302,7 @@
   benchmark = {
     groups = [
       "default"
-      "development"
       "minimagick"
-      "test"
     ];
     platforms = [ ];
     source = {
@@ -372,16 +395,6 @@
     };
     version = "3.40.0";
   };
-  cgi = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1s8qdw1nfh3njd47q154njlfyc2llcgi4ik13vz39adqd7yclgz9";
-      type = "gem";
-    };
-    version = "0.5.1";
-  };
   chunky_png = {
     groups = [ "default" ];
     platforms = [ ];
@@ -398,10 +411,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "04g73hpmrn92jcj1cfblg4aq2k6sijd6i4xa4n0y0p2fbxry715z";
+      sha256 = "0yldrij8c0fpdjz9aic2in4jqkyifzfxlklan9bzd2aj07jvs6ki";
       type = "gem";
     };
-    version = "2.3.2";
+    version = "2.8.3";
   };
   concurrent-ruby = {
     groups = [
@@ -436,10 +449,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0pfl5c0pyqaparxaqxi6s4gfl21bdldwiawrc0aknyvflli60lfw";
+      sha256 = "15djj19ynz3sbw54fsf8n7y3sha8a333f2mgvjfwhr46jhcqg1ll";
       type = "gem";
     };
-    version = "1.0.6";
+    version = "1.0.7";
   };
   css_parser = {
     dependencies = [ "addressable" ];
@@ -463,11 +476,7 @@
     version = "3.3.5";
   };
   date = {
-    groups = [
-      "default"
-      "development"
-      "test"
-    ];
+    groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
@@ -506,19 +515,6 @@
     };
     version = "1.4.1";
   };
-  domain_name = {
-    groups = [
-      "default"
-      "test"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0cyr2xm576gqhqicsyqnhanni47408w2pgvrfi8pd13h2li3nsaz";
-      type = "gem";
-    };
-    version = "0.6.20240107";
-  };
   doorkeeper = {
     dependencies = [ "railties" ];
     groups = [ "default" ];
@@ -647,10 +643,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "04gzhqvsm4z4l12r9dkac9a75ah45w186ydhl0i4andldsnkkih5";
+      sha256 = "09zl0rkskfq0cwfrk9ypjvflvzanfg3xbhh1slaa1myry7xi4zq3";
       type = "gem";
     };
-    version = "1.3.0";
+    version = "1.4.0";
   };
   hashie = {
     dependencies = [ "logger" ];
@@ -666,20 +662,6 @@
     };
     version = "5.1.0";
   };
-  html-pipeline = {
-    dependencies = [
-      "activesupport"
-      "nokogiri"
-    ];
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "00xqmlny1b4ixff8sk0rkl4wcgwqc6v93qv8l3rn8d1dppvq7pm1";
-      type = "gem";
-    };
-    version = "2.13.2";
-  };
   htmlentities = {
     groups = [ "default" ];
     platforms = [ ];
@@ -690,33 +672,6 @@
     };
     version = "4.4.2";
   };
-  http-accept = {
-    groups = [
-      "default"
-      "test"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "09m1facypsdjynfwrcv19xcb1mqg8z6kk31g8r33pfxzh838c9n6";
-      type = "gem";
-    };
-    version = "1.7.0";
-  };
-  http-cookie = {
-    dependencies = [ "domain_name" ];
-    groups = [
-      "default"
-      "test"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1aga7z4p0dka4zcqw9i05wa4ab1q7h7cgnj328ldqqfycjz84jxs";
-      type = "gem";
-    };
-    version = "1.1.6";
-  };
   i18n = {
     dependencies = [ "concurrent-ruby" ];
     groups = [
@@ -727,10 +682,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1994i044vdmzzkyr76g8rpl1fq1532wf0sb21xg5r1ilj5iphmr8";
+      sha256 = "1dfikmmd9dllirsfq0kjiyxpmlq0afkxm5sslsr97r9g85ifpy80";
       type = "gem";
     };
-    version = "1.14.8";
+    version = "1.15.2";
   };
   importmap-rails = {
     dependencies = [
@@ -784,15 +739,16 @@
   json = {
     groups = [
       "default"
+      "development"
       "test"
     ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "16mp8vzgxa8nsa81np042za453j8b0ihpjkf666s7byxrnvjb44v";
+      sha256 = "0ay31y1yl208xrpcsw6b0k4q309magq7q5prmdbb0lm9ampbqqlk";
       type = "gem";
     };
-    version = "2.19.9";
+    version = "2.20.0";
   };
   jwt = {
     dependencies = [ "base64" ];
@@ -816,10 +772,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1k0311vah76kg5m6zr7wmkwyk5p2f9d9hyckjpn3xgr83ajkj7px";
+      sha256 = "1w5p8c2145lmqzr25bxh4ikzjm6k8y1k5lriqqdpw9pq730w1wjy";
       type = "gem";
     };
-    version = "3.17.0.5";
+    version = "3.17.0.6";
   };
   lint_roller = {
     groups = [
@@ -880,6 +836,7 @@
   };
   mail = {
     dependencies = [
+      "logger"
       "mini_mime"
       "net-imap"
       "net-pop"
@@ -889,10 +846,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1bf9pysw1jfgynv692hhaycfxa8ckay1gjw5hz3madrbrynryfzc";
+      sha256 = "1s30l5z7jkazgi4m6l6mh80rgsyhh2pp1pa5h70xclsj8z54wmq6";
       type = "gem";
     };
-    version = "2.8.1";
+    version = "2.9.1";
   };
   marcel = {
     groups = [ "default" ];
@@ -917,36 +874,6 @@
     };
     version = "0.4.3";
   };
-  mime-types = {
-    dependencies = [
-      "logger"
-      "mime-types-data"
-    ];
-    groups = [
-      "default"
-      "test"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0mjyxl7c0xzyqdqa8r45hqg7jcw2prp3hkp39mdf223g4hfgdsyw";
-      type = "gem";
-    };
-    version = "3.7.0";
-  };
-  mime-types-data = {
-    groups = [
-      "default"
-      "test"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1k28j6ww8rf43r5i8278jvm2cq3pnzsvqm7yqpb4p93kadjlq726";
-      type = "gem";
-    };
-    version = "3.2026.0414";
-  };
   mini_magick = {
     dependencies = [
       "benchmark"
@@ -989,6 +916,10 @@
     version = "2.8.9";
   };
   minitest = {
+    dependencies = [
+      "drb"
+      "prism"
+    ];
     groups = [
       "default"
       "development"
@@ -997,10 +928,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1mbpz92ml19rcxxfjrj91gmkif9khb1xpzyw38f81rvglgw1ffrd";
+      sha256 = "1wfnqyfayx9n9j7x871v2ars4hjhfisi1dl24fa64ylq3mns6ghm";
       type = "gem";
     };
-    version = "5.27.0";
+    version = "6.0.6";
   };
   mocha = {
     dependencies = [ "ruby2_keywords" ];
@@ -1061,20 +992,24 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0506bhwr62szwcagcvxayhwz0d20k5ax1sh742va3mjnnkqcfkgn";
+      sha256 = "03ga2h4i5hsk8pdlicyfvqfsbh55vrbikb0nkx9x7vx7fl6kdw19";
       type = "gem";
     };
-    version = "0.5.15";
+    version = "0.6.4.1";
   };
   net-ldap = {
+    dependencies = [
+      "base64"
+      "ostruct"
+    ];
     groups = [ "ldap" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1ycw0qsw3hap8svakl0i30jkj0ffd4lpyrn17a1j0w8mz5ainmsj";
+      sha256 = "0wjkrvcwnxa6ggq0nfz004f1blm1c67fv7c6614sraak0wshn25j";
       type = "gem";
     };
-    version = "0.17.1";
+    version = "0.20.0";
   };
   net-pop = {
     dependencies = [ "net-protocol" ];
@@ -1109,19 +1044,6 @@
     };
     version = "0.5.1";
   };
-  netrc = {
-    groups = [
-      "default"
-      "test"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0gzfmcywp1da8nzfqsql2zqi648mfnx6qwkig3cv36n9m0yy676y";
-      type = "gem";
-    };
-    version = "0.11.0";
-  };
   nio4r = {
     groups = [
       "default"
@@ -1148,13 +1070,14 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1s30b7h7qpyim30m8060xs415mbr3ci7i5hdg09chh1aqfx2qcbq";
+      sha256 = "1d9safb4dly6qmc2g06444l0zifby52yy6j1a5fa1g4j3ihm3jah";
       type = "gem";
     };
-    version = "1.19.3";
+    version = "1.19.4";
   };
   oauth2 = {
     dependencies = [
+      "anonymous_loader"
       "auth-sanitizer"
       "faraday"
       "jwt"
@@ -1168,10 +1091,23 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0k428i1mlk6g7c054iks86g2h4h2p1y0mg2l3g6w84gd9l8604g6";
+      sha256 = "11n1hbn40gbrv7y91a4gj4qpcd3vxwsrdjkbhcy7vyxr7ac68j1x";
       type = "gem";
     };
-    version = "2.0.23";
+    version = "2.0.24";
+  };
+  ostruct = {
+    groups = [
+      "default"
+      "ldap"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "04nrir9wdpc4izqwqbysxyly8y7hsfr4fsv69rw91lfi9d5fv8lm";
+      type = "gem";
+    };
+    version = "0.6.3";
   };
   parallel = {
     groups = [
@@ -1181,10 +1117,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0w697335hi5dk5ay9kyn53399sy87y8v0y6ij93m5wmshhadxrik";
+      sha256 = "0mlkn1vhh9lr7vljibpgspwsswk7mzm8nw6bbr616c9fbj35hlmk";
       type = "gem";
     };
-    version = "1.28.0";
+    version = "2.1.0";
   };
   parser = {
     dependencies = [
@@ -1208,10 +1144,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1p2gqqrm895fzr9vi8d118zhql67bm8ydjvgqbq1crdnfggzn7kn";
+      sha256 = "16caca7lcz5pwl82snarqrayjj9j7abmxqw92267blhk7rbd120k";
       type = "gem";
     };
-    version = "1.5.9";
+    version = "1.6.3";
   };
   pp = {
     dependencies = [ "prettyprint" ];
@@ -1223,10 +1159,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1xlxmg86k5kifci1xvlmgw56x88dmqf04zfzn7zcr4qb8ladal99";
+      sha256 = "0w5mha75hs8gdj75g8vl0sxpyp8rzvwq8a4jcmi4ah8cf370zjyz";
       type = "gem";
     };
-    version = "0.6.3";
+    version = "0.6.4";
   };
   prettyprint = {
     groups = [
@@ -1261,34 +1197,15 @@
       "actionpack"
       "activesupport"
       "rack"
-      "railties"
     ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0sqg0xf46xd47zdpm8d12kfnwl0y5jb2hj10imzb3bk6mwgkd2fk";
+      sha256 = "17iqn4sa59c9z5y3bpvxqka00srqnl379w6a57y1phljdbjs6mhx";
       type = "gem";
     };
-    version = "1.1.0";
-  };
-  psych = {
-    dependencies = [
-      "date"
-      "stringio"
-    ];
-    groups = [
-      "default"
-      "development"
-      "test"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1dx5bc3s1mb1i53np4cdkypg7ccygnvagr3hglyndbqilrljvxql";
-      type = "gem";
-    };
-    version = "5.4.0";
+    version = "1.3.2";
   };
   public_suffix = {
     groups = [
@@ -1399,10 +1316,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "155skqkjrckvzj1qy37lrnafrillc47qhf3l80g3zvw100ba1h4n";
+      sha256 = "1lww7i686rm9s50d34hb596y2kfl46dida2kjy8gr64c6jjpn0bd";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "8.1.3";
   };
   rails-dom-testing = {
     dependencies = [
@@ -1437,7 +1354,6 @@
     dependencies = [
       "actionpack"
       "activesupport"
-      "cgi"
       "irb"
       "rackup"
       "rake"
@@ -1449,10 +1365,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0np1m8xqb4wbzwpg66yjnqjban0di92lbjzcrgnwwhq2w4z3k8xf";
+      sha256 = "08nyhsigcvjpj9i3r0s73yi8zm16sxmr2x7xgxlaq2jjrghb0gli";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "8.1.3";
   };
   rainbow = {
     groups = [
@@ -1549,10 +1465,10 @@
     };
     version = "1.19.1";
   };
-  rdoc = {
+  rbs = {
     dependencies = [
-      "erb"
-      "psych"
+      "logger"
+      "prism"
       "tsort"
     ];
     groups = [
@@ -1563,10 +1479,30 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "14iiyb4yi1chdzrynrk74xbhmikml3ixgdayjma3p700singfl46";
+      sha256 = "050f0b6bv94k4vszy366m5l5krfgn93y9sj43yd9sm184q7gfyss";
       type = "gem";
     };
-    version = "7.2.0";
+    version = "4.0.3";
+  };
+  rdoc = {
+    dependencies = [
+      "erb"
+      "prism"
+      "rbs"
+      "tsort"
+    ];
+    groups = [
+      "default"
+      "development"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0sf4909q2mr9z0rpygv94z12b0yamg07gz8cba2mi5k3m448rgq3";
+      type = "gem";
+    };
+    version = "8.0.0";
   };
   regexp_parser = {
     groups = [
@@ -1607,22 +1543,6 @@
     };
     version = "0.0.14";
   };
-  rest-client = {
-    dependencies = [
-      "http-accept"
-      "http-cookie"
-      "mime-types"
-      "netrc"
-    ];
-    groups = [ "test" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1qs74yzl58agzx9dgjhcpgmzfn61fqkk33k1js2y5yhlvc5l19im";
-      type = "gem";
-    };
-    version = "2.1.0";
-  };
   rexml = {
     groups = [
       "default"
@@ -1659,10 +1579,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0phadjq9xyx91535y2xn09jywhgzj8ljpm3yywyznqjrcdxgd020";
+      sha256 = "1acs3ynpiyx5qnplw8v85b7m9z69qi4n0qxv3sjylla0nz9jpc7p";
       type = "gem";
     };
-    version = "3.3.0";
+    version = "3.4.0";
   };
   rotp = {
     groups = [ "default" ];
@@ -1675,14 +1595,15 @@
     version = "6.3.0";
   };
   rouge = {
+    dependencies = [ "strscan" ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0fd77qcz603mli4lyi97cjzkv02hsfk60m495qv5qcn02mkqk9fv";
+      sha256 = "1g2y2z07niw4ylbgf6zr6a7kjaqbaqxn98xwff58zf4w5yx9ppp2";
       type = "gem";
     };
-    version = "4.7.0";
+    version = "5.0.0";
   };
   rqrcode = {
     dependencies = [
@@ -1725,10 +1646,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0csnyhcjrxjiiz849rc8rjdqg9w5ixwi2wcj7ii3vghbp9rg2i5f";
+      sha256 = "1gwvjfd3zh40dhggh3p99h62b4v8nl5dqgma9pmmz5fdj0f2bvwd";
       type = "gem";
     };
-    version = "1.76.2";
+    version = "1.88.2";
   };
   rubocop-ast = {
     dependencies = [
@@ -1742,10 +1663,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0dahfpnzz63hyqxa03x8rypnrxzwyvh4i5a8ri34bzpnf3pg64j4";
+      sha256 = "1nw84xk6vc2ls8sxqvyhxs2agh4l0jrws85d4bi3x0501lq8ijmr";
       type = "gem";
     };
-    version = "1.49.1";
+    version = "1.50.0";
   };
   rubocop-performance = {
     dependencies = [
@@ -1757,10 +1678,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1h9flnqk2f3llwf8g0mk0fvzzznfj7hsil3qg88m803pi9b06zbg";
+      sha256 = "0d0qyyw1332afi9glwfjkb4bd62gzlibar6j55cghv8rzwvbj6fd";
       type = "gem";
     };
-    version = "1.25.0";
+    version = "1.26.1";
   };
   rubocop-rails = {
     dependencies = [
@@ -1774,10 +1695,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1404nfa0gw3p0xzmv4b9zg9v1da0nwc4m7796pl73zi2hwy65k4z";
+      sha256 = "1llsxc8wm2pq8glpv5mczd1h36fazbri3wwrh7dfqra80a4pklqh";
       type = "gem";
     };
-    version = "2.32.0";
+    version = "2.34.3";
   };
   ruby-progressbar = {
     groups = [
@@ -1813,10 +1734,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "05an0wz87vkmqwcwyh5rjiaavydfn5f4q1lixcsqkphzvj7chxw5";
+      sha256 = "00nafgqjhwa504xrjv32v0757a2xcvspsia8s7mp4n62nm2yfy8a";
       type = "gem";
     };
-    version = "2.4.1";
+    version = "3.4.1";
   };
   sanitize = {
     dependencies = [
@@ -1827,10 +1748,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0lj1jjxn1znxmaf6jnngfrz26rw85smxb69m4jl6a9yq6gwyab54";
+      sha256 = "111r4xdcf6ihdnrs6wkfc6nqdzrjq0z69x9sf83r7ri6fffip796";
       type = "gem";
     };
-    version = "6.1.3";
+    version = "7.0.0";
   };
   securerandom = {
     groups = [
@@ -1927,10 +1848,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0sqshkafxa1r34yj4yxisd4kddmjq9jrhx6azqy3z71nwqv01yl7";
+      sha256 = "01i6k25fv3w3f5ph5cix9ipg19ajsy6zrzxdm18ashzrldrjjmq4";
       type = "gem";
     };
-    version = "2.5.0";
+    version = "2.9.5";
   };
   stimulus-rails = {
     dependencies = [ "railties" ];
@@ -1943,19 +1864,15 @@
     };
     version = "1.3.4";
   };
-  stringio = {
-    groups = [
-      "default"
-      "development"
-      "test"
-    ];
+  strscan = {
+    groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1q92y9627yisykyscv0bdsrrgyaajc2qr56dwlzx7ysgigjv4z63";
+      sha256 = "17k75zrwf4ag9yl9wjjkcb90zrm4r5jigdzv3zr5jm9239hxpqma";
       type = "gem";
     };
-    version = "3.2.0";
+    version = "3.1.8";
   };
   svg_optimizer = {
     dependencies = [ "nokogiri" ];
@@ -2011,14 +1928,15 @@
     version = "0.6.1";
   };
   trilogy = {
+    dependencies = [ "bigdecimal" ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0zq6yrp1074yd5lflz7yqzpicpcg4bxrl7sxw5c4g2m67dk3pmm2";
+      sha256 = "1xww2n01yl2g7q3i3sz1k3mgalmdhb1h9hxc87n2zjah444rf3rf";
       type = "gem";
     };
-    version = "2.9.0";
+    version = "2.12.6";
   };
   tsort = {
     groups = [
@@ -2092,6 +2010,7 @@
   uri = {
     groups = [
       "default"
+      "development"
       "test"
     ];
     platforms = [ ];
@@ -2120,10 +2039,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0gfv1qxfn202xffasw2mrrrf2jkdp6hsps0177k9fyc0fwb6k3xp";
+      sha256 = "0q3jb2cal9c8b0xgdz1xl47w3n1vsb1gwj06c4acsxsqqid07wvp";
       type = "gem";
     };
-    version = "1.1.12";
+    version = "1.1.13";
   };
   webrick = {
     groups = [ "default" ];
@@ -2157,10 +2076,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "15idgibqpdaj97f734drx8a7k1jcc8wvxlk2nbafac72ihikicjs";
+      sha256 = "0ij19k6034x0c4hw0ywa7wnk5s912r8aq0hhjss10d5z36q5dicp";
       type = "gem";
     };
-    version = "0.8.1";
+    version = "0.8.2";
   };
   websocket-extensions = {
     groups = [ "default" ];
diff --git a/pkgs/by-name/re/redmine/package.nix b/pkgs/by-name/re/redmine/package.nix
index aacda5507597..bc4831c08510 100644
--- a/pkgs/by-name/re/redmine/package.nix
+++ b/pkgs/by-name/re/redmine/package.nix
@@ -15,7 +15,7 @@
 }:
 
 let
-  version = "6.1.3";
+  version = "7.0.0";
   rubyEnv = bundlerEnv {
     name = "redmine-env-${version}";
 
@@ -41,7 +41,7 @@ let
             unpackPhase
             nativeBuildInputs
             ;
-          hash = "sha256-rUNsf7DUVueD9revOR6Mab36XnVEmjL4bVv6TIMMqjM=";
+          hash = "sha256-Xw0VWl3qZLvNNmRFHuWkltC1XfoIaHJKWM8Po4FSmoQ=";
         };
         dontBuild = false;
         nativeBuildInputs = [
@@ -69,7 +69,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://www.redmine.org/releases/redmine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-YdswCMf9GKOvxVntZW/Tj9+N+CIKxpWYsxkJUYMZC3o=";
+    hash = "sha256-hX6fiGDDHkxTE4nl2T7qJkiNummDBISjsKqQS+YV6Qo=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 580d265da668df7215d367eb7bb4f875ccf070f3 Mon Sep 17 00:00:00 2001
From: Felix Singer <felixsinger@posteo.net>
Date: Fri, 10 Jul 2026 01:51:50 +0200
Subject: [PATCH 066/117] redmine: Bump Ruby to version 4.0

Signed-off-by: Felix Singer <felixsinger@posteo.net>
---
 pkgs/by-name/re/redmine/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/re/redmine/package.nix b/pkgs/by-name/re/redmine/package.nix
index bc4831c08510..2d7bb53ec9f6 100644
--- a/pkgs/by-name/re/redmine/package.nix
+++ b/pkgs/by-name/re/redmine/package.nix
@@ -4,7 +4,7 @@
   stdenvNoCC,
   fetchurl,
   bundlerEnv,
-  ruby_3_4,
+  ruby_4_0,
   makeWrapper,
   nixosTests,
   openssl,
@@ -19,7 +19,7 @@ let
   rubyEnv = bundlerEnv {
     name = "redmine-env-${version}";
 
-    ruby = ruby_3_4;
+    ruby = ruby_4_0;
     gemdir = ./.;
     groups = [
       "development"

From cc935801b60e8fdbf1d0dc509ae9b744faafa732 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Jul 2026 14:51:36 +0000
Subject: [PATCH 067/117] vscode-extensions.github.codespaces: 1.18.14 ->
 1.18.15

---
 pkgs/applications/editors/vscode/extensions/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index b370a1d0d017..58c011dda03d 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1950,8 +1950,8 @@ let
         mktplcRef = {
           publisher = "github";
           name = "codespaces";
-          version = "1.18.14";
-          hash = "sha256-i/J5inu6iJ3CPgoBf+pMFuM33Ex/0KqhfzfRl/BIe7Y=";
+          version = "1.18.15";
+          hash = "sha256-NcW2XVQ6F7s6k4mIesEXhCkVVRfudwFr3glqB+TjrqM=";
         };
 
         meta = {

From 9c478074234c3a5ca66413c517340491141e412c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Jul 2026 15:43:35 +0000
Subject: [PATCH 068/117] openlinkhub: 0.8.8 -> 0.8.9

---
 pkgs/by-name/op/openlinkhub/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/op/openlinkhub/package.nix b/pkgs/by-name/op/openlinkhub/package.nix
index 067c2d28ddfc..d056564f6c43 100644
--- a/pkgs/by-name/op/openlinkhub/package.nix
+++ b/pkgs/by-name/op/openlinkhub/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "openlinkhub";
-  version = "0.8.8";
+  version = "0.8.9";
 
   src = fetchFromGitHub {
     owner = "jurkovic-nikola";
     repo = "OpenLinkHub";
     tag = finalAttrs.version;
-    hash = "sha256-uYuhmvdHNVs19egakwDOvIJ2IEAeZEAV6qgMYEl+Ie4=";
+    hash = "sha256-g8ZdiBaEelS+LhnOA23mMR+irN1wKD6Rp66sCnSD2tU=";
   };
 
   proxyVendor = true;

From 64387acfe4e6742d9ae6f559b6e83ce324ccb547 Mon Sep 17 00:00:00 2001
From: Mirza Arnaut <mirza.arnaut45@gmail.com>
Date: Sat, 11 Jul 2026 15:14:56 +0200
Subject: [PATCH 069/117] cliamp: fix darwin build

Darwin wasn't building due to the length of the socket paths being
allowed (104 bytes). This makes a new TMPDIR which is shorter and the
build succeeds now.

Also, I added the platforms tag which reflects the two platforms I have
tested cliamp for. Maybe changing it to unix would also be okay, but I
haven't tested it.
---
 pkgs/by-name/cl/cliamp/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/cl/cliamp/package.nix b/pkgs/by-name/cl/cliamp/package.nix
index 0c28952a16a3..fbd4c958f9e2 100644
--- a/pkgs/by-name/cl/cliamp/package.nix
+++ b/pkgs/by-name/cl/cliamp/package.nix
@@ -41,6 +41,11 @@ buildGoModule (finalAttrs: {
     alsa-lib
   ];
 
+  # macOS limits Unix socket paths to 104 bytes; use a shorter TMPDIR.
+  preCheck = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    export TMPDIR="$(mktemp -d /tmp/cliamp-XXXXXX)"
+  '';
+
   postInstall = ''
     wrapProgram $out/bin/cliamp \
       --prefix PATH : ${
@@ -60,6 +65,7 @@ buildGoModule (finalAttrs: {
     description = "Terminal Winamp - a retro terminal music player inspired by Winamp 2.x";
     homepage = "https://github.com/bjarneo/cliamp";
     license = lib.licenses.mit;
+    platforms = with lib.platforms; darwin ++ linux;
     maintainers = with lib.maintainers; [ supermarin ];
     mainProgram = "cliamp";
   };

From 71b4b75542983c411dba6a881eb9cb30785ea4d1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Jul 2026 16:39:22 +0000
Subject: [PATCH 070/117] tev: 2.13.0 -> 2.13.1

---
 pkgs/by-name/te/tev/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/te/tev/package.nix b/pkgs/by-name/te/tev/package.nix
index 20aae9e777cc..c8cce90f0f09 100644
--- a/pkgs/by-name/te/tev/package.nix
+++ b/pkgs/by-name/te/tev/package.nix
@@ -24,14 +24,14 @@
 
 stdenv.mkDerivation rec {
   pname = "tev";
-  version = "2.13.0";
+  version = "2.13.1";
 
   src = fetchFromGitHub {
     owner = "Tom94";
     repo = "tev";
     tag = "v${version}";
     fetchSubmodules = true;
-    hash = "sha256-4rWItev1/oOevWdo7QWlZWN0Va6d6tQc6tjm+zTLFp0=";
+    hash = "sha256-+11GpyUCtVvIeSTEJx6WTvN6aUcvuF/lDlA/+6IduKQ=";
   };
 
   postPatch = lib.optionalString stdenv.hostPlatform.isLinux (

From e55d02dc2d46b563ce76d39bb0743df312a9ead5 Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Sat, 11 Jul 2026 17:41:45 +0100
Subject: [PATCH 071/117] ndstrim-rs: enable __structuredAttrs

---
 pkgs/by-name/nd/ndstrim-rs/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/nd/ndstrim-rs/package.nix b/pkgs/by-name/nd/ndstrim-rs/package.nix
index e51eaf195a70..cb59f36e4b64 100644
--- a/pkgs/by-name/nd/ndstrim-rs/package.nix
+++ b/pkgs/by-name/nd/ndstrim-rs/package.nix
@@ -8,6 +8,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ndstrim-rs";
   version = "0.2.1";
 
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "Nemris";
     repo = "ndstrim-rs";

From 289406ed1c45ec6c8f68c3f2f82aaac9a6f6f79c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Jul 2026 17:30:57 +0000
Subject: [PATCH 072/117] syncthing-relay: 2.1.1 -> 2.1.2

---
 pkgs/by-name/sy/syncthing/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sy/syncthing/package.nix b/pkgs/by-name/sy/syncthing/package.nix
index 4bbd0bed0b2a..20238288794d 100644
--- a/pkgs/by-name/sy/syncthing/package.nix
+++ b/pkgs/by-name/sy/syncthing/package.nix
@@ -22,16 +22,16 @@ assert builtins.elem target [
 
 buildGoModule (finalAttrs: {
   pname = "syncthing";
-  version = "2.1.1";
+  version = "2.1.2";
 
   src = fetchFromGitHub {
     owner = "syncthing";
     repo = "syncthing";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OwR1OiwtlJSRnFXFEyyHcL3q6NdDUQd4JEy0YSQ18fg=";
+    hash = "sha256-tR4yXoEYbCi8Uh3wCyATc+J4+cGvD7k0d9egjHS5H4k=";
   };
 
-  vendorHash = "sha256-gfGuXBvGdQr+o8zV4MM1FYnOy2fpytIIEdQ9waGNSW4=";
+  vendorHash = "sha256-t2wjl4eWvcUHMaBS7KEPzZejqrlI+7c5fRqWqxuCZy8=";
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     # Recent versions of macOS seem to require binaries to be signed when

From 4fb7d5e459a5de43fd9674a9a498aa4375aff91d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Jul 2026 17:37:32 +0000
Subject: [PATCH 073/117] terraform-config-inspect: 0-unstable-2026-02-24 ->
 0-unstable-2026-07-09

---
 pkgs/by-name/te/terraform-config-inspect/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/te/terraform-config-inspect/package.nix b/pkgs/by-name/te/terraform-config-inspect/package.nix
index 302b1d434ae5..073b95d91a27 100644
--- a/pkgs/by-name/te/terraform-config-inspect/package.nix
+++ b/pkgs/by-name/te/terraform-config-inspect/package.nix
@@ -7,13 +7,13 @@
 }:
 buildGoModule {
   pname = "terraform-config-inspect";
-  version = "0-unstable-2026-02-24";
+  version = "0-unstable-2026-07-09";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "terraform-config-inspect";
-    rev = "813a9753022088a8e29290e3ba8806131a3329c2";
-    hash = "sha256-kjX7tSU5p5kssqIDnxuLyfmUul8UH83Aeq7ftN0HJCM=";
+    rev = "2fb54c236733ee65ee877105d595c124c993c64d";
+    hash = "sha256-f8DyPP0XhOlgVdp0yjjFVyjaO2+ypfMfEEv6lwA8u3M=";
   };
 
   vendorHash = "sha256-iYrSk9JqxvhYSJuSv/nhZep41gRr644ZzGFWXMGQgyc=";

From 29841f943a1ec9e8f99b7e8392b3f46f71aee3f2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Jul 2026 17:46:11 +0000
Subject: [PATCH 074/117] syncthing-discovery: 2.1.1 -> 2.1.2

---
 pkgs/by-name/sy/syncthing/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sy/syncthing/package.nix b/pkgs/by-name/sy/syncthing/package.nix
index 4bbd0bed0b2a..20238288794d 100644
--- a/pkgs/by-name/sy/syncthing/package.nix
+++ b/pkgs/by-name/sy/syncthing/package.nix
@@ -22,16 +22,16 @@ assert builtins.elem target [
 
 buildGoModule (finalAttrs: {
   pname = "syncthing";
-  version = "2.1.1";
+  version = "2.1.2";
 
   src = fetchFromGitHub {
     owner = "syncthing";
     repo = "syncthing";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-OwR1OiwtlJSRnFXFEyyHcL3q6NdDUQd4JEy0YSQ18fg=";
+    hash = "sha256-tR4yXoEYbCi8Uh3wCyATc+J4+cGvD7k0d9egjHS5H4k=";
   };
 
-  vendorHash = "sha256-gfGuXBvGdQr+o8zV4MM1FYnOy2fpytIIEdQ9waGNSW4=";
+  vendorHash = "sha256-t2wjl4eWvcUHMaBS7KEPzZejqrlI+7c5fRqWqxuCZy8=";
 
   nativeBuildInputs = lib.optionals stdenv.hostPlatform.isDarwin [
     # Recent versions of macOS seem to require binaries to be signed when

From 5f7a35a9b36bfc2a6d41a568bb797e46bd237abd Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Tue, 7 Jul 2026 12:15:00 +0200
Subject: [PATCH 075/117] remark42: switch to pnpm_9

pnpm_10 and later do not support the old lockfile format used by remark42.

A future version will be compatible with pnpm 10 at least: https://github.com/umputun/remark42/commit/f5ccfaa0e1f6f9107ad1e21bcc3ef56cba192595

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
---
 pkgs/by-name/re/remark42/package.nix | 42 +++++++++++++++++++---------
 1 file changed, 29 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/re/remark42/package.nix b/pkgs/by-name/re/remark42/package.nix
index df1192589b50..c461a9aae6d5 100644
--- a/pkgs/by-name/re/remark42/package.nix
+++ b/pkgs/by-name/re/remark42/package.nix
@@ -3,14 +3,15 @@
   stdenv,
   fetchFromGitHub,
   buildGoModule,
-  nodejs_22,
-  pnpm_8,
+  nodejs-slim_22,
+  pnpm_9,
   fetchPnpmDeps,
   pnpmConfigHook,
   testers,
 }:
 
 let
+  pnpm = pnpm_9.override { nodejs-slim = nodejs-slim_22; };
   version = "1.15.0";
 
   src = fetchFromGitHub {
@@ -26,34 +27,49 @@ let
 
     strictDeps = true;
 
-    pnpmRoot = "frontend";
+    sourceRoot = "${src.name}/frontend";
 
     nativeBuildInputs = [
-      nodejs_22
-      pnpm_8
+      nodejs-slim_22
+      pnpm
       pnpmConfigHook
     ];
 
     pnpmDeps = fetchPnpmDeps {
-      inherit (finalAttrs) pname version src;
-      sourceRoot = "${finalAttrs.src.name}/frontend";
-      pnpm = pnpm_8;
-      fetcherVersion = 3;
-      hash = "sha256-E2tUZXhcufuztXS+Z//uZk9omvaPrevNbGqVd41Lwhw=";
+      inherit (finalAttrs)
+        pname
+        version
+        src
+        sourceRoot
+        postPatch
+        ;
+      inherit pnpm;
+      fetcherVersion = 4;
+      hash = "sha256-wFrMoSeD87H1yfMD0jBcw60DKDeh4yjka5aWyHuQssA=";
     };
 
+    postPatch = ''
+      substituteInPlace "package.json" "apps/remark42/package.json" \
+        --replace-fail "pnpm@8.15.9" "pnpm@${pnpm.version}"
+
+      substituteInPlace "apps/remark42/package.json" \
+        --replace-fail '"pnpm": "8.*"' '"pnpm": "9.*"'
+    '';
+
     buildPhase = ''
       runHook preBuild
-      pushd "$pnpmRoot"
+
       pnpm --filter ./apps/remark42 --fail-if-no-match run build
-      popd
+
       runHook postBuild
     '';
 
     installPhase = ''
       runHook preInstall
+
       mkdir -p $out/web
-      cp -r "$pnpmRoot/apps/remark42/public/." $out/web/
+      cp -r "apps/remark42/public/." $out/web/
+
       runHook postInstall
     '';
   });

From 020298927184473939dbb61b2628ea3082e15d99 Mon Sep 17 00:00:00 2001
From: Sefa Eyeoglu <contact@scrumplex.net>
Date: Tue, 7 Jul 2026 12:17:31 +0200
Subject: [PATCH 076/117] pnpm_8: drop

Insecure and unmaintained. No consumers in nixpkgs anymore so it can go.

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
---
 doc/languages-frameworks/javascript.section.md |  2 +-
 pkgs/development/tools/pnpm/default.nix        | 16 ----------------
 pkgs/top-level/aliases.nix                     |  1 +
 pkgs/top-level/all-packages.nix                |  1 -
 4 files changed, 2 insertions(+), 18 deletions(-)

diff --git a/doc/languages-frameworks/javascript.section.md b/doc/languages-frameworks/javascript.section.md
index 19335a88da18..c506db3469c8 100644
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@@ -305,7 +305,7 @@ This package puts the corepack wrappers for pnpm and yarn in your PATH, and they
 
 ### pnpm {#javascript-pnpm}
 
-pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_8`, `pnpm_9`, `pnpm_10`, `pnpm_10_29_2` and `pnpm_11`, which support different sets of lock file versions.
+pnpm is available as the top-level package `pnpm`. Additionally, there are variants pinned to certain major versions, like `pnpm_9`, `pnpm_10`, `pnpm_10_29_2` and `pnpm_11`, which support different sets of lock file versions.
 
 When packaging an application that includes a `pnpm-lock.yaml`, you need to fetch the pnpm store for that project using a fixed-output-derivation. The function `fetchPnpmDeps` can create this pnpm store derivation. In conjunction, the setup hook `pnpmConfigHook` will prepare the build environment to install the pre-fetched dependencies store. Here is an example for a package that contains `package.json` and a `pnpm-lock.yaml` files using the fetcher and setup hook above:
 
diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index 6b7b4209bf59..4f5f52787ebb 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -6,22 +6,6 @@ let
   inherit (lib) mapAttrs' nameValuePair;
 
   variants = {
-    "8" = {
-      version = "8.15.9";
-      hash = "sha256-2qJ6C1QbxjUyP/lsLe2ZVGf/n+bWn/ZwIVWKqa2dzDY=";
-      knownVulnerabilities = [
-        "CVE-2026-48995"
-        "CVE-2026-50014"
-        "CVE-2026-50015"
-        "CVE-2026-50016"
-        "CVE-2026-50017"
-        "CVE-2026-50573"
-        "CVE-2026-55699"
-        "CVE-2026-59194"
-        "CVE-2026-59195"
-        "CVE-2026-59196"
-      ];
-    };
     "9" = {
       version = "9.15.9";
       hash = "sha256-z4anrXZEBjldQoam0J1zBxFyCsxtk+nc6ax6xNxKKKc=";
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index c569d7201957..fcf6886f152c 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1843,6 +1843,7 @@ mapAliases {
   pltScheme = throw "'pltScheme' has been renamed to/replaced by 'racket'"; # Converted to throw 2025-10-27
   plv8 = throw "'plv8' has been removed. Use 'postgresqlPackages.plv8' instead."; # Added 2025-07-19
   pn = throw "'pn' has been removed as upstream was archived in 2020"; # Added 2025-10-17
+  pnpm_8 = throw "'pnpm_8' has been removed as it hasn't been updated since 2024. Please use 'pnpm'"; # Added 2026-07-07
   poac = throw "'poac' has been renamed to/replaced by 'cabinpkg'"; # Converted to throw 2025-10-27
   pocket-updater-utility = throw "'pocket-updater-utility' has been renamed to/replaced by 'pupdate'"; # Converted to throw 2025-10-27
   podofo010 = throw "'podofo010' has been renamed to 'podofo0'"; # Converted to throw 2025-10-27
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8a89d44d2572..71844dc080a5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2801,7 +2801,6 @@ with pkgs;
   tdarr-node = tdarrPackages.node;
 
   inherit (callPackage ../development/tools/pnpm { })
-    pnpm_8
     pnpm_9
     pnpm_10_29_2
     pnpm_10_34_0

From 95668228d272766b21a62dd781cef03c04906bfa Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 11 Jul 2026 10:28:18 -0700
Subject: [PATCH 077/117] python3Packages.langgraph-checkpoint-sqlite: disable
 alpha, beta, dev, and rc versions for updates

---
 .../python-modules/langgraph-checkpoint-sqlite/default.nix       | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/langgraph-checkpoint-sqlite/default.nix b/pkgs/development/python-modules/langgraph-checkpoint-sqlite/default.nix
index c80953130757..9a877713fd69 100644
--- a/pkgs/development/python-modules/langgraph-checkpoint-sqlite/default.nix
+++ b/pkgs/development/python-modules/langgraph-checkpoint-sqlite/default.nix
@@ -80,6 +80,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "checkpointsqlite==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

From 1fbdc5f87189a47cbea23b650beec80de5cefd9e Mon Sep 17 00:00:00 2001
From: EarthGman <EarthGman@protonmail.com>
Date: Sat, 11 Jul 2026 13:12:25 -0500
Subject: [PATCH 078/117] maintainers: update earthgman keys

---
 maintainers/maintainer-list.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 1c547d958410..1359e46a3343 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -7747,6 +7747,7 @@
     name = "EarthGman";
     github = "EarthGman";
     githubId = 117403037;
+    keys = [ { fingerprint = "A06C 1E72 4626 7B4C EE16  CC2E 4862 31CD BCE3 AA32"; } ];
   };
   EBADBEEF = {
     name = "EBADBEEF";

From a8e1169b8fb03ec585c39f80b37f6d11be441165 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 11 Jul 2026 11:12:36 -0700
Subject: [PATCH 079/117] python3Packages.langchain-anthropic: disable alpha,
 beta, dev, and rc versions for updates

---
 pkgs/development/python-modules/langchain-anthropic/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/langchain-anthropic/default.nix b/pkgs/development/python-modules/langchain-anthropic/default.nix
index 968e52b49a00..41ca94f6aa84 100644
--- a/pkgs/development/python-modules/langchain-anthropic/default.nix
+++ b/pkgs/development/python-modules/langchain-anthropic/default.nix
@@ -74,6 +74,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-anthropic==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

From bc240f541b5987667c5baadebe1ad9cb5ba0a7e2 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 11 Jul 2026 11:15:10 -0700
Subject: [PATCH 080/117] python3Packages.langchain-aws: disable alpha, beta,
 dev, and rc versions for updates

---
 pkgs/development/python-modules/langchain-aws/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/langchain-aws/default.nix b/pkgs/development/python-modules/langchain-aws/default.nix
index ea7b7541b8d7..8cdfe2866918 100644
--- a/pkgs/development/python-modules/langchain-aws/default.nix
+++ b/pkgs/development/python-modules/langchain-aws/default.nix
@@ -91,6 +91,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-aws==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

From d3486aacb5ccaf8d7ca9fdf066ca5e40087bcd0b Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 11 Jul 2026 11:15:12 -0700
Subject: [PATCH 081/117] python3Packages.langchain-azure-dynamic-sessions:
 disable alpha, beta, dev, and rc versions for updates

---
 .../python-modules/langchain-azure-dynamic-sessions/default.nix  | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/langchain-azure-dynamic-sessions/default.nix b/pkgs/development/python-modules/langchain-azure-dynamic-sessions/default.nix
index dafa4f5af501..5c8f6ba38faf 100644
--- a/pkgs/development/python-modules/langchain-azure-dynamic-sessions/default.nix
+++ b/pkgs/development/python-modules/langchain-azure-dynamic-sessions/default.nix
@@ -79,6 +79,7 @@ buildPythonPackage rec {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-azure-dynamic-sessions==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

From e9f835685d08fc3c2118bb1a891a01c37b87e6d3 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 11 Jul 2026 11:15:14 -0700
Subject: [PATCH 082/117] python3Packages.langchain-chroma: disable alpha,
 beta, dev, and rc versions for updates

---
 pkgs/development/python-modules/langchain-chroma/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/langchain-chroma/default.nix b/pkgs/development/python-modules/langchain-chroma/default.nix
index ecb321864727..13aed9c69921 100644
--- a/pkgs/development/python-modules/langchain-chroma/default.nix
+++ b/pkgs/development/python-modules/langchain-chroma/default.nix
@@ -62,6 +62,7 @@ buildPythonPackage rec {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-chroma==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

From e315ee857ae9094f70d1f5f14bb9d7c8eb050e73 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 11 Jul 2026 11:15:16 -0700
Subject: [PATCH 083/117] python3Packages.langchain-classic: disable alpha,
 beta, dev, and rc versions for updates

---
 pkgs/development/python-modules/langchain-classic/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/langchain-classic/default.nix b/pkgs/development/python-modules/langchain-classic/default.nix
index b9949fd389ee..fab7fe6d5d14 100644
--- a/pkgs/development/python-modules/langchain-classic/default.nix
+++ b/pkgs/development/python-modules/langchain-classic/default.nix
@@ -106,6 +106,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-classic==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

From cd0287795e8d8db6bc028e0b95f39412725bf728 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 11 Jul 2026 11:15:18 -0700
Subject: [PATCH 084/117] python3Packages.langchain-community: disable alpha,
 beta, dev, and rc versions for updates

---
 pkgs/development/python-modules/langchain-community/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/langchain-community/default.nix b/pkgs/development/python-modules/langchain-community/default.nix
index ccc254acac7d..c6b904a7259a 100644
--- a/pkgs/development/python-modules/langchain-community/default.nix
+++ b/pkgs/development/python-modules/langchain-community/default.nix
@@ -129,6 +129,7 @@ buildPythonPackage rec {
 
   passthru.updateScript = gitUpdater {
     rev-prefix = "libs/community/v";
+    ignoredVersions = "a|b|dev|rc";
   };
 
   meta = {

From ab7979d9d48a6ad2525f4fb7d365c7df194d9761 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 11 Jul 2026 11:15:20 -0700
Subject: [PATCH 085/117] python3Packages.langchain-core: disable alpha, beta,
 dev, and rc versions for updates

---
 pkgs/development/python-modules/langchain-core/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/langchain-core/default.nix b/pkgs/development/python-modules/langchain-core/default.nix
index 1189a2063143..4d65b64a3881 100644
--- a/pkgs/development/python-modules/langchain-core/default.nix
+++ b/pkgs/development/python-modules/langchain-core/default.nix
@@ -92,6 +92,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-core==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

From 5caf5479b7c904ad7266bed25e52cb798388ffb0 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 11 Jul 2026 11:15:22 -0700
Subject: [PATCH 086/117] python3Packages.langchain-deepseek: disable alpha,
 beta, dev, and rc versions for updates

---
 pkgs/development/python-modules/langchain-deepseek/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/langchain-deepseek/default.nix b/pkgs/development/python-modules/langchain-deepseek/default.nix
index 2d6dfa1563ed..419cc2b06599 100644
--- a/pkgs/development/python-modules/langchain-deepseek/default.nix
+++ b/pkgs/development/python-modules/langchain-deepseek/default.nix
@@ -65,6 +65,7 @@ buildPythonPackage rec {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-deepseek==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

From 9edf6155da2924af5529c0df1fb1fd97ba03240d Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 11 Jul 2026 11:15:24 -0700
Subject: [PATCH 087/117] python3Packages.langchain-fireworks: disable alpha,
 beta, dev, and rc versions for updates

---
 pkgs/development/python-modules/langchain-fireworks/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/langchain-fireworks/default.nix b/pkgs/development/python-modules/langchain-fireworks/default.nix
index 51ab8b247feb..0ef8a04a5377 100644
--- a/pkgs/development/python-modules/langchain-fireworks/default.nix
+++ b/pkgs/development/python-modules/langchain-fireworks/default.nix
@@ -73,6 +73,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-fireworks==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

From e46c939ca1969e459bf7059f34c06f5d289faefb Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 11 Jul 2026 11:15:26 -0700
Subject: [PATCH 088/117] python3Packages.langchain-google-genai: disable
 alpha, beta, dev, and rc versions for updates

---
 .../python-modules/langchain-google-genai/default.nix            | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/langchain-google-genai/default.nix b/pkgs/development/python-modules/langchain-google-genai/default.nix
index c95a5411f292..f613cccc2e3d 100644
--- a/pkgs/development/python-modules/langchain-google-genai/default.nix
+++ b/pkgs/development/python-modules/langchain-google-genai/default.nix
@@ -87,6 +87,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "libs/genai/v";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

From 28ac3e1f9835b2029d6bae74bcdbb399a8be64c7 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 11 Jul 2026 11:15:28 -0700
Subject: [PATCH 089/117] python3Packages.langchain-groq: disable alpha, beta,
 dev, and rc versions for updates

---
 pkgs/development/python-modules/langchain-groq/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/langchain-groq/default.nix b/pkgs/development/python-modules/langchain-groq/default.nix
index fc37e5488931..96931c62cfa3 100644
--- a/pkgs/development/python-modules/langchain-groq/default.nix
+++ b/pkgs/development/python-modules/langchain-groq/default.nix
@@ -68,6 +68,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-groq==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

From f9f8d108faf5a15f8bd8f0eea955f9e8846e8cfb Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 11 Jul 2026 11:15:30 -0700
Subject: [PATCH 090/117] python3Packages.langchain-huggingface: disable alpha,
 beta, dev, and rc versions for updates

---
 .../development/python-modules/langchain-huggingface/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/langchain-huggingface/default.nix b/pkgs/development/python-modules/langchain-huggingface/default.nix
index 9b0c2fe820f1..c2e9cd8c0ec2 100644
--- a/pkgs/development/python-modules/langchain-huggingface/default.nix
+++ b/pkgs/development/python-modules/langchain-huggingface/default.nix
@@ -87,6 +87,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-huggingface==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

From be8b7ce249831ecada9f49c798ce97ec0589d006 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 11 Jul 2026 11:15:32 -0700
Subject: [PATCH 091/117] python3Packages.langchain-mistralai: disable alpha,
 beta, dev, and rc versions for updates

---
 pkgs/development/python-modules/langchain-mistralai/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/langchain-mistralai/default.nix b/pkgs/development/python-modules/langchain-mistralai/default.nix
index ffb4717240d8..ff71b424443f 100644
--- a/pkgs/development/python-modules/langchain-mistralai/default.nix
+++ b/pkgs/development/python-modules/langchain-mistralai/default.nix
@@ -72,6 +72,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-mistralai==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

From 17ee34ef957f589a521e1595b09d0da5fa6ee45e Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 11 Jul 2026 11:15:34 -0700
Subject: [PATCH 092/117] python3Packages.langchain-mongodb: disable alpha,
 beta, dev, and rc versions for updates

---
 pkgs/development/python-modules/langchain-mongodb/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/langchain-mongodb/default.nix b/pkgs/development/python-modules/langchain-mongodb/default.nix
index 95285e50dc5f..15dae2afcc70 100644
--- a/pkgs/development/python-modules/langchain-mongodb/default.nix
+++ b/pkgs/development/python-modules/langchain-mongodb/default.nix
@@ -100,6 +100,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "libs/langchain-mongodb/v";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

From f88feddd71e19124290bfa6f8031b4a864a67357 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 11 Jul 2026 11:15:36 -0700
Subject: [PATCH 093/117] python3Packages.langchain-ollama: disable alpha,
 beta, dev, and rc versions for updates

---
 pkgs/development/python-modules/langchain-ollama/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/langchain-ollama/default.nix b/pkgs/development/python-modules/langchain-ollama/default.nix
index 11ec12bb1f9c..cbe175a371ac 100644
--- a/pkgs/development/python-modules/langchain-ollama/default.nix
+++ b/pkgs/development/python-modules/langchain-ollama/default.nix
@@ -69,6 +69,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-ollama==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

From 3e160f934cd76f1de3c0cdc58ec26961690aeff0 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 11 Jul 2026 11:15:38 -0700
Subject: [PATCH 094/117] python3Packages.langchain-openai: disable alpha,
 beta, dev, and rc versions for updates

---
 pkgs/development/python-modules/langchain-openai/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/langchain-openai/default.nix b/pkgs/development/python-modules/langchain-openai/default.nix
index 80514602546c..9b3f0556bd2f 100644
--- a/pkgs/development/python-modules/langchain-openai/default.nix
+++ b/pkgs/development/python-modules/langchain-openai/default.nix
@@ -98,6 +98,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-openai==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

From 34b5be0017deb05de0673282f9081306af48e815 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 11 Jul 2026 11:15:40 -0700
Subject: [PATCH 095/117] python3Packages.langchain-perplexity: disable alpha,
 beta, dev, and rc versions for updates

---
 pkgs/development/python-modules/langchain-perplexity/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/langchain-perplexity/default.nix b/pkgs/development/python-modules/langchain-perplexity/default.nix
index f796254e8d9d..1121df1d6dd0 100644
--- a/pkgs/development/python-modules/langchain-perplexity/default.nix
+++ b/pkgs/development/python-modules/langchain-perplexity/default.nix
@@ -68,6 +68,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-perplexity==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

From 8bee7e7a8295fb845948f03fd18fe0bac2c21160 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 11 Jul 2026 11:15:42 -0700
Subject: [PATCH 096/117] python3Packages.langchain-tests: disable alpha, beta,
 dev, and rc versions for updates

---
 pkgs/development/python-modules/langchain-tests/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/langchain-tests/default.nix b/pkgs/development/python-modules/langchain-tests/default.nix
index 9bf1ba4f8073..367414938f26 100644
--- a/pkgs/development/python-modules/langchain-tests/default.nix
+++ b/pkgs/development/python-modules/langchain-tests/default.nix
@@ -81,6 +81,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-tests==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

From 71175c8bf40bf77b9e1845fc86f1344d857c0d86 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 11 Jul 2026 11:15:44 -0700
Subject: [PATCH 097/117] python3Packages.langchain-text-splitters: disable
 alpha, beta, dev, and rc versions for updates

---
 .../python-modules/langchain-text-splitters/default.nix          | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/langchain-text-splitters/default.nix b/pkgs/development/python-modules/langchain-text-splitters/default.nix
index 90b04c0ef3ff..f6541ba9bd38 100644
--- a/pkgs/development/python-modules/langchain-text-splitters/default.nix
+++ b/pkgs/development/python-modules/langchain-text-splitters/default.nix
@@ -53,6 +53,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-text-splitters==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

From 47a8b13fe99338d44b49054a86a9806fb3173e5f Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 11 Jul 2026 11:15:46 -0700
Subject: [PATCH 098/117] python3Packages.langchain-xai: disable alpha, beta,
 dev, and rc versions for updates

---
 pkgs/development/python-modules/langchain-xai/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/langchain-xai/default.nix b/pkgs/development/python-modules/langchain-xai/default.nix
index 36fc76d6557f..905ad7dbf3cb 100644
--- a/pkgs/development/python-modules/langchain-xai/default.nix
+++ b/pkgs/development/python-modules/langchain-xai/default.nix
@@ -67,6 +67,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain-xai==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

From e91b38dd862560ad693b23686a59f3070755e28a Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 11 Jul 2026 11:15:48 -0700
Subject: [PATCH 099/117] python3Packages.langchain: disable alpha, beta, dev,
 and rc versions for updates

---
 pkgs/development/python-modules/langchain/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/langchain/default.nix b/pkgs/development/python-modules/langchain/default.nix
index ada34e3ea9c7..4ddce4e5a348 100644
--- a/pkgs/development/python-modules/langchain/default.nix
+++ b/pkgs/development/python-modules/langchain/default.nix
@@ -144,6 +144,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "langchain==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

From 0ace86a6c60e5ba3a0e8bd25b95f3ca179a06427 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 11 Jul 2026 11:15:50 -0700
Subject: [PATCH 100/117] python3Packages.langgraph-checkpoint-postgres:
 disable alpha, beta, dev, and rc versions for updates

---
 .../python-modules/langgraph-checkpoint-postgres/default.nix     | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/langgraph-checkpoint-postgres/default.nix b/pkgs/development/python-modules/langgraph-checkpoint-postgres/default.nix
index 3187783f9d4a..f6871fcefe6b 100644
--- a/pkgs/development/python-modules/langgraph-checkpoint-postgres/default.nix
+++ b/pkgs/development/python-modules/langgraph-checkpoint-postgres/default.nix
@@ -97,6 +97,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "checkpointpostgres==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

From f9939b25caf35d76c0575480cf2d7a9bc7ea127c Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 11 Jul 2026 11:15:52 -0700
Subject: [PATCH 101/117] python3Packages.langgraph-checkpoint: disable alpha,
 beta, dev, and rc versions for updates

---
 pkgs/development/python-modules/langgraph-checkpoint/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/langgraph-checkpoint/default.nix b/pkgs/development/python-modules/langgraph-checkpoint/default.nix
index 2e7d1f64b4fd..21b76619252f 100644
--- a/pkgs/development/python-modules/langgraph-checkpoint/default.nix
+++ b/pkgs/development/python-modules/langgraph-checkpoint/default.nix
@@ -66,6 +66,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "checkpoint==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

From 2c03ef89ce2035ba3293e59d321aaaaaa01d03aa Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 11 Jul 2026 11:15:54 -0700
Subject: [PATCH 102/117] python3Packages.langgraph-checkpoint-mongodb: disable
 alpha, beta, dev, and rc versions for updates

---
 .../python-modules/langgraph-checkpoint-mongodb/default.nix      | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/langgraph-checkpoint-mongodb/default.nix b/pkgs/development/python-modules/langgraph-checkpoint-mongodb/default.nix
index 837a8e42e8a1..a55c9368db9b 100644
--- a/pkgs/development/python-modules/langgraph-checkpoint-mongodb/default.nix
+++ b/pkgs/development/python-modules/langgraph-checkpoint-mongodb/default.nix
@@ -51,6 +51,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "libs/langgraph-checkpoint-mongodb/v";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

From a358d64bb7dbf2fe9fd419c7e62572a812a154e8 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 11 Jul 2026 11:15:57 -0700
Subject: [PATCH 103/117] python3Packages.langgraph-cli: disable alpha, beta,
 dev, and rc versions for updates

---
 pkgs/development/python-modules/langgraph-cli/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/langgraph-cli/default.nix b/pkgs/development/python-modules/langgraph-cli/default.nix
index b79fd25259e0..ba04442c5ab8 100644
--- a/pkgs/development/python-modules/langgraph-cli/default.nix
+++ b/pkgs/development/python-modules/langgraph-cli/default.nix
@@ -93,6 +93,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "cli==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

From 6e705e7ace11707c8c7c688ac8436aae5cf203c0 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 11 Jul 2026 11:15:59 -0700
Subject: [PATCH 104/117] python3Packages.langgraph-prebuilt: disable alpha,
 beta, dev, and rc versions for updates

---
 pkgs/development/python-modules/langgraph-prebuilt/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/langgraph-prebuilt/default.nix b/pkgs/development/python-modules/langgraph-prebuilt/default.nix
index e729568ba4c9..b37ebd432f84 100644
--- a/pkgs/development/python-modules/langgraph-prebuilt/default.nix
+++ b/pkgs/development/python-modules/langgraph-prebuilt/default.nix
@@ -97,6 +97,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "prebuilt==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

From dc03541d1ccadf5b3e463dd7310eb11e0122903e Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Sat, 11 Jul 2026 11:16:01 -0700
Subject: [PATCH 105/117] python3Packages.langgraph-sdk: disable alpha, beta,
 dev, and rc versions for updates

---
 pkgs/development/python-modules/langgraph-sdk/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/langgraph-sdk/default.nix b/pkgs/development/python-modules/langgraph-sdk/default.nix
index c5687317824c..ef2243288a6d 100644
--- a/pkgs/development/python-modules/langgraph-sdk/default.nix
+++ b/pkgs/development/python-modules/langgraph-sdk/default.nix
@@ -57,6 +57,7 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = gitUpdater {
       rev-prefix = "sdk==";
+      ignoredVersions = "a|b|dev|rc";
     };
   };
 

From d03baf9dac5995badf7259e5630894d69d4a85f4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Jul 2026 18:28:50 +0000
Subject: [PATCH 106/117] libretro.flycast: 0-unstable-2026-06-26 ->
 0-unstable-2026-07-10

---
 pkgs/applications/emulators/libretro/cores/flycast.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/libretro/cores/flycast.nix b/pkgs/applications/emulators/libretro/cores/flycast.nix
index 9ab9835acaae..d7c4f0b6a0c4 100644
--- a/pkgs/applications/emulators/libretro/cores/flycast.nix
+++ b/pkgs/applications/emulators/libretro/cores/flycast.nix
@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
   core = "flycast";
-  version = "0-unstable-2026-06-26";
+  version = "0-unstable-2026-07-10";
 
   src = fetchFromGitHub {
     owner = "flyinghead";
     repo = "flycast";
-    rev = "7ec978e8521f75427ad38eb8f8f4f3cabaa891d0";
-    hash = "sha256-3ChQnJP6xI/Wd3BOlkauTYCNQz1MjSHk0lDmjX+Iugg=";
+    rev = "f09d1f22ef8d199b8b7a2395d0b46774e08a58c2";
+    hash = "sha256-labl5MPpBNkg/M95WzJgiKVdvHJDN6jeFSLsHg5+G78=";
     fetchSubmodules = true;
   };
 

From 0f6266fc077750e5e199ffc9f5f7ae8366d75bd5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Jul 2026 19:02:45 +0000
Subject: [PATCH 107/117] steamguard-cli: 0.18.1 -> 0.18.2

---
 pkgs/by-name/st/steamguard-cli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/st/steamguard-cli/package.nix b/pkgs/by-name/st/steamguard-cli/package.nix
index fe31cf743e4e..07a347d16fe0 100644
--- a/pkgs/by-name/st/steamguard-cli/package.nix
+++ b/pkgs/by-name/st/steamguard-cli/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "steamguard-cli";
-  version = "0.18.1";
+  version = "0.18.2";
 
   src = fetchFromGitHub {
     owner = "dyc3";
     repo = "steamguard-cli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Y2o9xJP7ENXXcoPJiuFOstPnzGFQo0LFmr7ss66ojAM";
+    hash = "sha256-+WqqByn15UBcZzNqNNxt1NjTH6cCeCIpaCOeTFR1XB0=";
   };
 
-  cargoHash = "sha256-V5VCHMqvGU0m+xbDoQqEEgeBtX5H4A1Mc11SDTB3a1w=";
+  cargoHash = "sha256-AKkMx0FzNGPHPTja1Hll1+qvHtCzSUI44sGpU3OEkpc=";
 
   # disable update check
   buildNoDefaultFeatures = true;

From 585904820cb00e174dfdf2508655b198abcc0de1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Jul 2026 19:16:17 +0000
Subject: [PATCH 108/117] protols: 0.14.0 -> 0.14.1

---
 pkgs/by-name/pr/protols/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pr/protols/package.nix b/pkgs/by-name/pr/protols/package.nix
index 1fa282298bbc..20104d182582 100644
--- a/pkgs/by-name/pr/protols/package.nix
+++ b/pkgs/by-name/pr/protols/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "protols";
-  version = "0.14.0";
+  version = "0.14.1";
 
   src = fetchFromGitHub {
     owner = "coder3101";
     repo = "protols";
     tag = finalAttrs.version;
-    hash = "sha256-VB7Zs1Zo+hn+M4vhBmOZNod3Q9dbwcMNwRvTIIP+Gk4=";
+    hash = "sha256-DdSuEWIo0AbCCV3LPTBC2Ql1NSg2vgnCBNzOgFL8/B0=";
   };
 
-  cargoHash = "sha256-qfNWZmJYVKDKZ8/JIXtSWYnq4pZXmU7rXQDV117j/a0=";
+  cargoHash = "sha256-R7OgjUEx2Q0rWTIO1CIXS3ogeC9G/RoxvGQBL1Xh/8k=";
 
   env.FALLBACK_INCLUDE_PATH = "${protobuf}/include";
 

From fa813ababda04dbec78350475c4c14eec2e006c6 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Fri, 22 May 2026 00:25:27 +0200
Subject: [PATCH 109/117] rust-federation-tester: init at 0.5.2

---
 .../ru/rust-federation-tester/package.nix     | 66 +++++++++++++++++++
 1 file changed, 66 insertions(+)
 create mode 100644 pkgs/by-name/ru/rust-federation-tester/package.nix

diff --git a/pkgs/by-name/ru/rust-federation-tester/package.nix b/pkgs/by-name/ru/rust-federation-tester/package.nix
new file mode 100644
index 000000000000..d56faf639fd9
--- /dev/null
+++ b/pkgs/by-name/ru/rust-federation-tester/package.nix
@@ -0,0 +1,66 @@
+{
+  rustPlatform,
+  fetchFromGitHub,
+  lib,
+  nixosTests,
+  cacert,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "rust-federation-tester";
+  version = "0.5.2";
+
+  src = fetchFromGitHub {
+    owner = "MTRNord";
+    repo = "rust-federation-tester";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-KHRG+5AeK7h7k7LoTtcIjGmPYlVcV2ZwpJN8iDsBfHg=";
+  };
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  cargoHash = "sha256-nTcE8eqQO0CFdeH0jjT6m1fd4qhG7e/CDpdZHkBq9f8=";
+  cargoTestFlags = finalAttrs.cargoBuildFlags;
+  cargoBuildFlags = [
+    "-p"
+    "rust-federation-tester"
+    "-p"
+    "migration"
+  ];
+
+  nativeCheckInputs = [ cacert ];
+
+  checkFlags = map (test: "--skip=${test}") [
+    # Tests depending on network access
+    "test_generate_json_report_ipv4_only_server"
+    "test_generate_json_report_known_bad_servers"
+    "test_generate_json_report_known_good_servers"
+    "test_generate_json_report_valid_domain"
+    "test_generate_json_report_with_port"
+    "test_lookup_server_well_known_valid"
+    "test_matrix_fed_srv_resolution_4msc4040"
+    "test_matrix_srv_resolution_4s"
+    "test_step2_explicit_port"
+    "test_step3b_wellknown_explicit_port"
+    "test_step3c_wellknown_matrix_fed_srv"
+    "test_step3c_wellknown_matrix_srv"
+    "test_step3d_wellknown_default_port"
+    "test_step6_wellknown_fails_default_port"
+    "test_generate_report"
+    "test_concurrent_requests"
+  ];
+
+  passthru.tests = {
+    inherit (nixosTests) matrix-synapse;
+  };
+
+  meta = {
+    description = "Matrix-Federation-Tester in Rust";
+    homepage = "https://connectivity-tester.mtrnord.blog/";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ ma27 ];
+    platforms = lib.platforms.linux;
+    mainProgram = "rust-federation-tester";
+  };
+})

From 988d274a1cb5179ae45001fe31110f1946a6686a Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Fri, 22 May 2026 00:25:40 +0200
Subject: [PATCH 110/117] nixos/rust-federation-tester: init

---
 nixos/modules/module-list.nix                 |   1 +
 .../matrix/rust-federation-tester.nix         | 153 ++++++++++++++++++
 2 files changed, 154 insertions(+)
 create mode 100644 nixos/modules/services/matrix/rust-federation-tester.nix

diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 9c52ee7c52a6..185b063dd037 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -821,6 +821,7 @@
   ./services/matrix/mautrix-whatsapp.nix
   ./services/matrix/mjolnir.nix
   ./services/matrix/pantalaimon.nix
+  ./services/matrix/rust-federation-tester.nix
   ./services/matrix/synapse-auto-compressor.nix
   ./services/matrix/synapse.nix
   ./services/matrix/tuwunel.nix
diff --git a/nixos/modules/services/matrix/rust-federation-tester.nix b/nixos/modules/services/matrix/rust-federation-tester.nix
new file mode 100644
index 000000000000..4b7a3420d2e0
--- /dev/null
+++ b/nixos/modules/services/matrix/rust-federation-tester.nix
@@ -0,0 +1,153 @@
+{
+  config,
+  lib,
+  pkgs,
+  utils,
+  ...
+}:
+
+let
+  cfg = config.services.rust-federation-tester;
+
+  configFile = "/run/rust-federation-tester/config.yaml";
+  commonServiceConfig = {
+    DynamicUser = true;
+    RuntimeDirectory = "rust-federation-tester";
+    RuntimeDirectoryPreserve = true;
+    StateDirectory = "rust-federation-tester";
+    User = "rust-federation-tester";
+    WorkingDirectory = "%t/rust-federation-tester";
+
+    # Hardening
+    UMask = "0077";
+    CapabilityBoundingSet = [ "" ];
+    DevicePolicy = "closed";
+    PrivateTmp = true;
+    ProtectHome = true;
+    ProtectSystem = "strict";
+    MemoryDenyWriteExecute = true;
+    NoNewPrivileges = true;
+    LockPersonality = true;
+    PrivateDevices = true;
+    PrivateMounts = true;
+    ProcSubset = "pid";
+    ProtectClock = true;
+    ProtectControlGroups = true;
+    ProtectHostname = true;
+    ProtectKernelLogs = true;
+    ProtectKernelModules = true;
+    ProtectKernelTunables = true;
+    ProtectProc = "invisible";
+    RemoveIPC = true;
+    RestrictAddressFamilies = [
+      "AF_INET"
+      "AF_INET6"
+      "AF_UNIX"
+    ];
+    RestrictNamespaces = true;
+    RestrictRealtime = true;
+    RestrictSUIDSGID = true;
+    SystemCallArchitectures = "native";
+    SystemCallFilter = [
+      "@system-service"
+    ];
+  };
+
+  secretsInjection = utils.genJqSecretsReplacement {
+    loadCredential = true;
+  } cfg.settings configFile;
+in
+{
+  options.services.rust-federation-tester = {
+    enable = lib.mkEnableOption "rust-federation-tester";
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = lib.types.json;
+        options = {
+          frontend_url = lib.mkOption {
+            type = lib.types.str;
+            example = "federation-tester.example.org";
+            description = ''
+              URL of the service's frontend.
+            '';
+          };
+
+          database_url = lib.mkOption {
+            type = lib.types.str;
+            default = "sqlite:///var/lib/rust-federation-tester/db?mode=rwc";
+            example = "postgres://localhost/db?currentSchema=schema";
+            description = ''
+              The database to store accounts and statistics.
+            '';
+          };
+
+          smtp = {
+            enabled = lib.mkEnableOption "mail delivery for configured alerts";
+          };
+
+          listen_addr = lib.mkOption {
+            type = lib.types.str;
+            default = "[::]:8080";
+            example = "unix:/run/rust-federation-tester/rust-federation-tester.sock";
+            description = ''
+              Address the API server should listen on.
+            '';
+          };
+        };
+      };
+
+      description = ''
+        Settings representing the values in {file}`config.yaml` of the service.
+
+        Refer to [`config.yaml.example`] for supported values.
+
+        [`config.yaml.example`]: https://github.com/MTRNord/rust-federation-tester/blob/main/config.yaml.example
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.sockets.rust-federation-tester = {
+      description = "Matrix-Federation-Tester in Rust socket";
+      wantedBy = [ "sockets.target" ];
+      listenStreams = [ (lib.removePrefix "unix:" cfg.settings.listen_addr) ];
+    };
+
+    systemd.services.rust-federation-tester-setup = {
+      description = "Matrix-Federation-Tester in Rust";
+      path = [ pkgs.rust-federation-tester ];
+
+      serviceConfig = lib.mkMerge [
+        commonServiceConfig
+        {
+          Type = "oneshot";
+          RemainAfterExit = true;
+          LoadCredential = secretsInjection.credentials;
+          ExecStart = "${pkgs.writeShellScript "rust-federation-tester-setup" ''
+            ${secretsInjection.script}
+
+            migration up
+          ''}";
+        }
+      ];
+    };
+
+    systemd.services.rust-federation-tester = {
+      description = "Matrix-Federation-Tester in Rust";
+      wantedBy = [ "multi-user.target" ];
+      documentation = [ "https://github.com/MTRNord/rust-federation-tester" ];
+      after = [ "rust-federation-tester-setup.service" ];
+      requires = [ "rust-federation-tester-setup.service" ];
+
+      serviceConfig = lib.mkMerge [
+        commonServiceConfig
+        {
+          ExecSearchPath = lib.makeBinPath [ pkgs.rust-federation-tester ];
+          ExecStart = "rust-federation-tester";
+          Restart = "on-failure";
+        }
+      ];
+    };
+  };
+}

From 923421ea3f8fd20b50b9df1295ce129511c87e23 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Tue, 22 Apr 2025 15:03:58 +0200
Subject: [PATCH 111/117] nixos/synapse: implement more advanced integration
 test

This is an attempt to make better assertions on federation and basic
functionality: so far we had a test that was essentially a
regression-test for email-based authentication.

This change adds the following things:

* uses matrix-federation-tester to verify that federation is set up
  properly.

* uses matrix-commander (a CLI client) to test basic operations
  (sending/receiving messages, invites).

* merge basic synapse test & worker test: one of the federating servers
  uses postgresql and a single federation worker, the other one no
  workers and sqlite.

Co-authored-by: Emily <git@emilylange.de>
---
 nixos/tests/all-tests.nix                     |   1 -
 nixos/tests/matrix/synapse-workers.nix        |  53 --
 nixos/tests/matrix/synapse.nix                | 464 +++++++++++++-----
 .../ma/matrix-synapse-unwrapped/package.nix   |   2 +-
 4 files changed, 329 insertions(+), 191 deletions(-)
 delete mode 100644 nixos/tests/matrix/synapse-workers.nix

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 5e7a1a12a29c..f09c4b473b53 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1005,7 +1005,6 @@ in
   matrix-conduit = runTest ./matrix/conduit.nix;
   matrix-continuwuity = runTest ./matrix/continuwuity.nix;
   matrix-synapse = runTest ./matrix/synapse.nix;
-  matrix-synapse-workers = runTest ./matrix/synapse-workers.nix;
   matrix-tuwunel = runTest ./matrix/tuwunel.nix;
   matter-server = runTest ./matter-server.nix;
   matterjs-server = runTest ./matterjs-server.nix;
diff --git a/nixos/tests/matrix/synapse-workers.nix b/nixos/tests/matrix/synapse-workers.nix
deleted file mode 100644
index 949658caac47..000000000000
--- a/nixos/tests/matrix/synapse-workers.nix
+++ /dev/null
@@ -1,53 +0,0 @@
-{ pkgs, ... }:
-{
-  name = "matrix-synapse-workers";
-  meta = {
-    inherit (pkgs.matrix-synapse.meta) maintainers;
-  };
-
-  nodes = {
-    homeserver =
-      {
-        pkgs,
-        nodes,
-        ...
-      }:
-      {
-        services.postgresql = {
-          enable = true;
-          initialScript = pkgs.writeText "synapse-init.sql" ''
-            CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
-            CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
-            TEMPLATE template0
-            LC_COLLATE = "C"
-            LC_CTYPE = "C";
-          '';
-        };
-
-        services.matrix-synapse = {
-          enable = true;
-          settings = {
-            database = {
-              name = "psycopg2";
-              args.password = "synapse";
-            };
-            enable_registration = true;
-            enable_registration_without_verification = true;
-
-            federation_sender_instances = [ "federation_sender" ];
-          };
-          configureRedisLocally = true;
-          workers = {
-            "federation_sender" = { };
-          };
-        };
-      };
-  };
-
-  testScript = ''
-    start_all()
-
-    homeserver.wait_for_unit("matrix-synapse.service");
-    homeserver.wait_for_unit("matrix-synapse-worker-federation_sender.service");
-  '';
-}
diff --git a/nixos/tests/matrix/synapse.nix b/nixos/tests/matrix/synapse.nix
index 7827705ffe21..961c0506ed9d 100644
--- a/nixos/tests/matrix/synapse.nix
+++ b/nixos/tests/matrix/synapse.nix
@@ -1,101 +1,194 @@
 { pkgs, ... }:
 let
-
   ca_key = mailerCerts.ca.key;
   ca_pem = mailerCerts.ca.cert;
 
-  bundle =
-    pkgs.runCommand "bundle"
+  aliceName = "alice";
+  alicePassword = "alicealice";
+  aliceEmail = "alice@example.com";
+
+  bobName = "bob";
+  bobPassword = "hunter2";
+
+  mkBundle =
+    domain:
+    pkgs.runCommand "bundle-${domain}"
       {
         nativeBuildInputs = [ pkgs.minica ];
       }
       ''
         minica -ca-cert ${ca_pem} -ca-key ${ca_key} \
-          -domains localhost
-        install -Dm444 -t $out localhost/{key,cert}.pem
+          -domains ${domain}
+        install -Dm444 -t $out ${domain}/{key,cert}.pem
       '';
 
   mailerCerts = import ../common/acme/server/snakeoil-certs.nix;
   mailerDomain = mailerCerts.domain;
   registrationSharedSecret = "unsecure123";
-  testUser = "alice";
-  testPassword = "alicealice";
-  testEmail = "alice@example.com";
 
-  listeners = [
+  anonHash = "hunter2hunter2hunter2";
+  anonHashF = pkgs.writeText "hash" anonHash;
+
+  mkHomeserverBase =
+    domain: nodes:
+    let
+      bundle = mkBundle domain;
+    in
+    { lib, ... }:
     {
-      port = 8448;
-      bind_addresses = [
-        "127.0.0.1"
-        "::1"
+      security.pki.certificateFiles = [
+        mailerCerts.ca.cert
       ];
-      type = "http";
-      tls = true;
-      x_forwarded = false;
-      resources = [
-        {
-          names = [
-            "client"
-          ];
-          compress = true;
-        }
-        {
-          names = [
-            "federation"
-          ];
-          compress = false;
-        }
-      ];
-    }
-  ];
 
+      networking = {
+        hostName = lib.head (lib.strings.splitString "." domain);
+        domain = lib.last (lib.strings.splitString "." domain);
+        firewall.allowedTCPPorts = [
+          80
+          443
+          8448
+        ];
+      };
+
+      services.nginx = {
+        enable = true;
+        virtualHosts."${domain}" = {
+          sslCertificate = "${bundle}/cert.pem";
+          sslCertificateKey = "${bundle}/key.pem";
+          addSSL = true;
+          locations."/.well-known/matrix/server".extraConfig = ''
+            default_type application/json;
+            return 200 '${
+              builtins.toJSON {
+                "m.server" = "${domain}:8448";
+              }
+            }';
+          '';
+        };
+      };
+    };
+
+  mkSynapseConfig =
+    domain: primaryIP:
+    let
+      bundle = mkBundle domain;
+    in
+    {
+      enable = true;
+      settings = {
+        # We're in a test environment with local machines, so
+        # we actually _want_ to use RFC1918 addresses.
+        ip_range_blacklist = [ ];
+
+        trusted_key_servers = [
+          { server_name = "hs1.test"; }
+          { server_name = "hs2.test"; }
+        ];
+
+        registration_shared_secret = registrationSharedSecret;
+        public_baseurl = "https://${domain}";
+        tls_certificate_path = "${bundle}/cert.pem";
+        tls_private_key_path = "${bundle}/key.pem";
+        listeners = [
+          # Using a local listener, otherwise matrix-synapse-register_new_matrix_user will
+          # fail because it'll try to connect to the first bind address, but via TLS resulting
+          # in a signature verification failure.
+          {
+            port = 8008;
+            type = "http";
+            tls = false;
+            resources = [
+              {
+                names = [ "client" ];
+                compress = true;
+              }
+            ];
+            bind_addresses = [ "::1" ];
+          }
+          {
+            port = 8448;
+            bind_addresses = [
+              primaryIP
+            ];
+            type = "http";
+            tls = true;
+            x_forwarded = false;
+            resources = [
+              {
+                names = [
+                  "client"
+                ];
+                compress = true;
+              }
+              {
+                names = [
+                  "federation"
+                ];
+                compress = false;
+              }
+            ];
+          }
+        ];
+      };
+    };
 in
 {
-
   name = "matrix-synapse";
   meta = {
     inherit (pkgs.matrix-synapse.meta) maintainers;
   };
 
   nodes = {
-    # Since 0.33.0, matrix-synapse doesn't allow underscores in server names
-    serverpostgres =
+    synapse-with-workers =
       {
+        lib,
+        config,
         pkgs,
         nodes,
-        config,
         ...
       }:
-      let
-        mailserverIP = nodes.mailserver.networking.primaryIPAddress;
-      in
       {
-        services.matrix-synapse = {
-          enable = true;
-          settings = {
-            inherit listeners;
-            database = {
-              name = "psycopg2";
-              args.password = "synapse";
+        imports = [
+          (mkHomeserverBase "hs1.test" nodes)
+        ];
+
+        services.matrix-synapse = lib.mkMerge [
+          (mkSynapseConfig "hs1.test" config.networking.primaryIPAddress)
+          {
+            settings = {
+              server_name = "hs1.test";
+              email = {
+                smtp_host = mailerDomain;
+                smtp_port = 25;
+                require_transport_security = true;
+                notif_from = "matrix <matrix@${mailerDomain}>";
+                app_name = "Matrix";
+              };
+              listeners = [
+                {
+                  path = "/run/matrix-synapse/main_replication.sock";
+                  type = "http";
+                  resources = [
+                    {
+                      names = [ "replication" ];
+                      compress = false;
+                    }
+                  ];
+                }
+              ];
+              database = {
+                name = "psycopg2";
+                args.password = "synapse";
+              };
+              federation_sender_instances = [ "federation_sender" ];
             };
-            redis = {
-              enabled = true;
-              host = "localhost";
-              port = config.services.redis.servers.matrix-synapse.port;
+            configureRedisLocally = true;
+            workers = {
+              "federation_sender" = { };
             };
-            tls_certificate_path = "${bundle}/cert.pem";
-            tls_private_key_path = "${bundle}/key.pem";
-            registration_shared_secret = registrationSharedSecret;
-            public_baseurl = "https://example.com";
-            email = {
-              smtp_host = mailerDomain;
-              smtp_port = 25;
-              require_transport_security = true;
-              notif_from = "matrix <matrix@${mailerDomain}>";
-              app_name = "Matrix";
-            };
-          };
-        };
+          }
+        ];
+
         services.postgresql = {
           enable = true;
 
@@ -113,20 +206,6 @@ in
           '';
         };
 
-        services.redis.servers.matrix-synapse = {
-          enable = true;
-          port = 6380;
-        };
-
-        networking.extraHosts = ''
-          ${mailserverIP} ${mailerDomain}
-        '';
-
-        security.pki.certificateFiles = [
-          mailerCerts.ca.cert
-          ca_pem
-        ];
-
         environment.systemPackages =
           let
             sendTestMailStarttls = pkgs.writeScriptBin "send-testmail-starttls" ''
@@ -140,7 +219,7 @@ in
                 smtp.ehlo()
                 smtp.starttls(context=ctx)
                 smtp.ehlo()
-                smtp.sendmail('matrix@${mailerDomain}', '${testEmail}', 'Subject: Test STARTTLS\n\nTest data.')
+                smtp.sendmail('matrix@${mailerDomain}', '${aliceEmail}', 'Subject: Test STARTTLS\n\nTest data.')
                 smtp.quit()
             '';
 
@@ -149,16 +228,14 @@ in
                 # adding the email through the API is quite complicated as it involves more than one step and some
                 # client-side calculation
                 insertEmailForAlice = pkgs.writeText "alice-email.sql" ''
-                  INSERT INTO user_threepids (user_id, medium, address, validated_at, added_at) VALUES ('${testUser}@serverpostgres', 'email', '${testEmail}', '1629149927271', '1629149927270');
+                  INSERT INTO user_threepids (user_id, medium, address, validated_at, added_at) VALUES ('${aliceName}@serverpostgres', 'email', '${aliceEmail}', '1629149927271', '1629149927270');
                 '';
               in
               pkgs.writeScriptBin "obtain-token-and-register-email" ''
                 #!${pkgs.runtimeShell}
-                set -o errexit
-                set -o pipefail
-                set -o nounset
+                set -euxo pipefail
                 su postgres -c "psql -d matrix-synapse -f ${insertEmailForAlice}"
-                curl --fail -XPOST 'https://localhost:8448/_matrix/client/r0/account/password/email/requestToken' -d '{"email":"${testEmail}","client_secret":"foobar","send_attempt":1}' -v
+                curl --fail -XPOST 'https://hs1.test:8448/_matrix/client/r0/account/password/email/requestToken' -d '{"email":"${aliceEmail}","client_secret":"foobar","send_attempt":1}' -v
               '';
           in
           [
@@ -168,74 +245,189 @@ in
           ];
       };
 
-    # test mail delivery
-    mailserver = args: {
-      security.pki.certificateFiles = [
-        mailerCerts.ca.cert
-      ];
+    mailserver =
+      { lib, ... }:
+      {
+        security.pki.certificateFiles = [
+          mailerCerts.ca.cert
+        ];
 
-      networking.firewall.enable = false;
+        networking = {
+          hostName = lib.head (lib.strings.splitString "." mailerDomain);
+          domain = lib.last (lib.strings.splitString "." mailerDomain);
+          firewall.enable = false;
+        };
 
-      services.postfix = {
-        enable = true;
-        enableSubmission = true;
+        services.postfix = {
+          enable = true;
+          enableSubmission = true;
 
-        # blackhole transport
-        transport = "example.com discard:silently";
+          # blackhole transport
+          transport = "example.com discard:silently";
 
-        settings.main = {
-          myhostname = "${mailerDomain}";
-          # open relay for subnet
-          mynetworks_style = "subnet";
-          debug_peer_level = "10";
-          smtpd_relay_restrictions = [
-            "permit_mynetworks"
-            "reject_unauth_destination"
-          ];
+          settings.main = {
+            myhostname = "${mailerDomain}";
+            # open relay for subnet
+            mynetworks_style = "subnet";
+            debug_peer_level = "10";
+            smtpd_relay_restrictions = [
+              "permit_mynetworks"
+              "reject_unauth_destination"
+            ];
 
-          # disable obsolete protocols, something old versions of twisted are still using
-          smtpd_tls_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
-          smtpd_tls_mandatory_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
-          smtpd_tls_chain_files = [
-            "${mailerCerts.${mailerDomain}.key}"
-            "${mailerCerts.${mailerDomain}.cert}"
-          ];
+            # disable obsolete protocols, something old versions of twisted are still using
+            smtpd_tls_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
+            smtpd_tls_mandatory_protocols = "TLSv1.3, TLSv1.2, !TLSv1.1, !TLSv1, !SSLv2, !SSLv3";
+            smtpd_tls_chain_files = [
+              "${mailerCerts.${mailerDomain}.key}"
+              "${mailerCerts.${mailerDomain}.cert}"
+            ];
+          };
         };
       };
-    };
 
-    serversqlite = args: {
-      services.matrix-synapse = {
-        enable = true;
-        settings = {
-          inherit listeners;
-          database.name = "sqlite3";
-          tls_certificate_path = "${bundle}/cert.pem";
-          tls_private_key_path = "${bundle}/key.pem";
+    synapse-minimal =
+      {
+        nodes,
+        config,
+        lib,
+        ...
+      }:
+      {
+        imports = [
+          (mkHomeserverBase "hs2.test" nodes)
+        ];
+
+        services.matrix-synapse = lib.mkMerge [
+          (mkSynapseConfig "hs2.test" config.networking.primaryIPAddress)
+          {
+            settings = {
+              database.name = "sqlite3";
+              server_name = "hs2.test";
+            };
+          }
+        ];
+      };
+
+    client =
+      { pkgs, ... }:
+      {
+        environment.systemPackages = [
+          # `pkgs.olm` is cached on c.n.o, even if this test isn't built due
+          # to it being allow-listed in `pkgs/top-level/release.nix`.
+          (import pkgs.path {
+            config = pkgs.config // {
+              permittedInsecurePackages = [ "olm-3.2.16" ];
+            };
+          }).matrix-commander
+          pkgs.jq
+        ];
+
+        security.pki.certificateFiles = [ mailerCerts.ca.cert ];
+
+        users.users = {
+          alice.isNormalUser = true;
+          bob.isNormalUser = true;
+        };
+
+        networking.useNetworkd = true;
+        services.rust-federation-tester = {
+          enable = true;
+          settings = {
+            listen_addr = "unix:/run/rust-federation-tester/rust-federation-tester.sock";
+            frontend_url = "http://localhost:8080";
+            database_url = "sqlite:///var/lib/rust-federation-tester/db?mode=rwc";
+            magic_token_secret = "foobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobarfoobar";
+            statistics = {
+              enabled = true;
+              prometheus_enabled = true;
+              anonymization_salt._secret = "${anonHashF}";
+              raw_retention_days = 30;
+            };
+          };
         };
       };
-    };
   };
 
   testScript = ''
+    import json
+    from pprint import pprint
+
     start_all()
-    mailserver.wait_for_unit("postfix.service")
-    serverpostgres.succeed("send-testmail-starttls")
-    serverpostgres.wait_for_unit("matrix-synapse.service")
-    serverpostgres.wait_until_succeeds(
-        "curl --fail -L --cacert ${ca_pem} https://localhost:8448/"
-    )
-    serverpostgres.wait_until_succeeds(
+
+    synapse_with_workers.wait_for_unit("multi-user.target")
+    synapse_minimal.wait_for_unit("multi-user.target")
+    mailserver.wait_for_unit("multi-user.target")
+
+    synapse_with_workers.wait_until_succeeds(
         "journalctl -u matrix-synapse.service | grep -q 'Connected to redis'"
     )
-    serverpostgres.require_unit_state("postgresql.target")
-    serverpostgres.succeed("REQUESTS_CA_BUNDLE=${ca_pem} register_new_matrix_user -u ${testUser} -p ${testPassword} -a -k ${registrationSharedSecret} https://localhost:8448/")
-    serverpostgres.succeed("obtain-token-and-register-email")
-    serversqlite.wait_for_unit("matrix-synapse.service")
-    serversqlite.wait_until_succeeds(
-        "curl --fail -L --cacert ${ca_pem} https://localhost:8448/"
-    )
-    serversqlite.succeed("[ -e /var/lib/matrix-synapse/homeserver.db ]")
-  '';
+    synapse_with_workers.wait_for_unit("matrix-synapse-worker-federation_sender.service");
 
+    with subtest("register user with email confirmation"):
+        synapse_with_workers.succeed("send-testmail-starttls")
+        synapse_with_workers.succeed("REQUESTS_CA_BUNDLE=${mailerCerts.ca.cert} register_new_matrix_user -u ${aliceName} -p ${alicePassword} -a -k ${registrationSharedSecret} https://hs1.test:8448/")
+        synapse_with_workers.succeed("obtain-token-and-register-email")
+
+    with subtest("matrix-synapse-register_new_matrix_user"):
+        synapse_minimal.succeed("matrix-synapse-register_new_matrix_user -u ${bobName} -p ${bobPassword} --no-admin")
+        synapse_minimal.succeed("[ -e /var/lib/matrix-synapse/homeserver.db ]")
+
+    with subtest("Federation tester"):
+        expected_anonymization_hashes = {
+            "hs1.test": "0558582846d6e2d90612900d449871dfcbf9878ba78de4a8469d8aba2d9c037b",
+            "hs2.test": "d3d88c2033c03b74ec1e086e15c0251514de060de5e51cb381e896f892a5b0cd",
+        }
+
+        # /metrics are cached for up to 30 seconds
+        for n, domain in enumerate(["hs2.test", "hs1.test"], start=3):
+            result = json.loads(
+                client.succeed(
+                    f"curl --fail --unix-socket /run/rust-federation-tester/rust-federation-tester.sock 'http://localhost:8080/api/federation/report?server_name={domain}&stats_opt_in=true'"
+                )
+            )
+            pprint(result)
+            t.assertTrue(result["FederationOK"])
+            t.assertTrue(result["ConnectionReports"][f"192.168.1.{n}:8448"]["Checks"]["AllChecksOK"])
+            t.assertEqual(f"{domain}:8448", result["WellKnownResult"][f"192.168.1.{n}:443"]["m.server"])
+
+        client.sleep(30)
+        # /metrics are cached for up to 30 seconds
+        for domain in ["hs2.test", "hs1.test"]:
+            metrics = client.succeed("curl --unix-socket /run/rust-federation-tester/rust-federation-tester.sock http://localhost:8080/metrics --fail")
+            t.assertRegex(
+                metrics,
+                f'federation_request_total\\{{server=\\"{expected_anonymization_hashes[domain]}\\",result=\\"success\\",[^}}]+\\}} 1'
+            )
+
+    def run_as_alice(cmd):
+        return client.succeed(f"sudo -u alice matrix-commander -c /home/alice/credentials.json -s /home/alice/matrix {cmd}")
+
+    def run_as_bob(cmd):
+        return client.succeed(f"sudo -u bob matrix-commander -c /home/bob/credentials.json -s /home/bob/matrix {cmd}")
+
+    with subtest("Login"):
+        run_as_alice("--login password --homeserver https://hs1.test:8448 --user-login @${aliceName}:hs1.test --password ${alicePassword} --device commander --room-default '#welcome:hs1.test'")
+        run_as_bob("--login password --homeserver https://hs2.test:8448 --user-login @${bobName}:hs2.test --password ${bobPassword} --device commander --room-default '#welcome:hs1.test'")
+
+    with subtest("Create/Invite/Join"):
+        run_as_alice("--room-create '#welcome:hs1.test'")
+
+        run_as_alice("--room-invite '#welcome:hs1.test' -u @${bobName}:hs2.test")
+        run_as_bob("--listen once --room-invites 'list+join'")
+
+    with subtest("Send/receive messages"):
+        senders = {
+            "alice": ("hs1", run_as_alice),
+            "bob": ("hs2", run_as_bob),
+        }
+
+        for name, (hs, fn) in senders.items():
+            fn(f"-m 'hello, I am {name}'")
+            for _, run in senders.values():
+                msg_data = json.loads(run("--listen once --listen-self --output json"))
+                pprint(msg_data)
+                t.assertEqual(msg_data["source"]["content"]["body"], f"hello, I am {name}")
+                t.assertEqual(msg_data["source"]["sender"], f"@{name}:{hs}.test")
+  '';
 }
diff --git a/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix b/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
index c4cce0f2767e..58f90acb7b68 100644
--- a/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
+++ b/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
@@ -157,7 +157,7 @@ python3Packages.buildPythonApplication rec {
   '';
 
   passthru = {
-    tests = { inherit (nixosTests) matrix-synapse matrix-synapse-workers; };
+    tests = { inherit (nixosTests) matrix-synapse; };
     plugins = python3Packages.callPackage ./plugins { };
     inherit (python3Packages) python;
     updateScript = nix-update-script { };

From 0356ffdd23d25efd377525b54a1dd3179fad4c6a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Jul 2026 20:13:40 +0000
Subject: [PATCH 112/117] python3Packages.pycaption: 2.2.26 -> 2.2.28

---
 pkgs/development/python-modules/pycaption/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pycaption/default.nix b/pkgs/development/python-modules/pycaption/default.nix
index 36dc8ff169b9..0d0227addd27 100644
--- a/pkgs/development/python-modules/pycaption/default.nix
+++ b/pkgs/development/python-modules/pycaption/default.nix
@@ -13,14 +13,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pycaption";
-  version = "2.2.26";
+  version = "2.2.28";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pbs";
     repo = "pycaption";
     tag = finalAttrs.version;
-    hash = "sha256-6y8c/FT4POM1xKnH3+M4MkvCiysNqVLEb650G3F3NGw=";
+    hash = "sha256-BXDCjUqJVuVCehusrk5j4+yZTimnmOcHMWheWJJoJOo=";
   };
 
   build-system = [ setuptools ];

From a5e3ebaefd56aa0de33c63d3596458bb89189647 Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Sat, 11 Jul 2026 10:14:40 +0200
Subject: [PATCH 113/117] angle: add riscv64-linux support

---
 pkgs/by-name/an/angle/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/an/angle/package.nix b/pkgs/by-name/an/angle/package.nix
index 92913aa506a0..0d6a2329e6a9 100644
--- a/pkgs/by-name/an/angle/package.nix
+++ b/pkgs/by-name/an/angle/package.nix
@@ -27,6 +27,7 @@ let
   triplet = lib.getAttr arch {
     "x86_64" = "x86_64-unknown-linux-gnu";
     "aarch64" = "aarch64-unknown-linux-gnu";
+    "riscv64" = "riscv64-unknown-linux-gnu";
   };
 
   clang = symlinkJoin {
@@ -100,6 +101,10 @@ stdenv.mkDerivation (finalAttrs: {
     # On darwin during linking:
     # clang++: error: argument unused during compilation: '-stdlib=libc++'
     "treat_warnings_as_errors=false"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isRiscV64 [
+    # Force clang on riscv64 because default gcc toolchain is unavailable.
+    "is_clang=true"
   ];
 
   env.NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-headerpad_max_install_names";

From 6a5ce8a4126984dec7db42683072c8fbb76c8d9e Mon Sep 17 00:00:00 2001
From: "Peter H. Hoeg" <peter@hoeg.com>
Date: Tue, 30 Jun 2026 22:21:04 +0200
Subject: [PATCH 114/117] openmw: 0.50.0 -> 0.51.0

Co-authored-by: Keenan Weaver <keenanweaver@protonmail.com>
Signed-off-by: Fernando Rodrigues <alpha@sigmasquadron.net>
---
 pkgs/by-name/op/openmw/package.nix | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/op/openmw/package.nix b/pkgs/by-name/op/openmw/package.nix
index 4e723af9d831..db2eac9f4c96 100644
--- a/pkgs/by-name/op/openmw/package.nix
+++ b/pkgs/by-name/op/openmw/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitLab,
   fetchpatch,
+  nix-update-script,
 
   SDL2,
   boost,
@@ -35,7 +36,7 @@ assert lib.assertOneOf "GLPreference" GLPreference [
 ];
 stdenv.mkDerivation (finalAttrs: {
   pname = "openmw";
-  version = "0.50.0";
+  version = "0.51.0";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -82,7 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "OpenMW";
     repo = "openmw";
     tag = "openmw-${finalAttrs.version}";
-    hash = "sha256-mPwNyKKqPSZJtcIyx3IhLe3iHOpx6p4+l1wJZqyDMqg=";
+    hash = "sha256-D+2nEQRkAjmDvRoas9bYPmdygQYT3MAv46n73OonE0o=";
   };
 
   postPatch = ''
@@ -133,6 +134,15 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "OPENMW_OSX_DEPLOYMENT" isDarwin)
   ];
 
+  env.LANG = "C.UTF-8";
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "openmw-(.*)"
+    ];
+  };
+
   meta = {
     description = "Unofficial open source engine reimplementation of the game Morrowind";
     changelog = "https://gitlab.com/OpenMW/openmw/-/blob/${finalAttrs.src.tag}/CHANGELOG.md";

From d7a836cfa9d7047d25428f4f77baccb969d1a448 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sun, 12 Jul 2026 00:50:48 +0200
Subject: [PATCH 115/117] music-assistant-desktop: 0.5.5 -> 0.5.7

Diff: https://github.com/music-assistant/desktop-app/compare/0.5.5...0.5.7

Changelog: https://github.com/music-assistant/desktop-app/releases/tag/0.5.7
---
 pkgs/by-name/mu/music-assistant-desktop/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mu/music-assistant-desktop/package.nix b/pkgs/by-name/mu/music-assistant-desktop/package.nix
index 5054e829fa08..725fd160b963 100644
--- a/pkgs/by-name/mu/music-assistant-desktop/package.nix
+++ b/pkgs/by-name/mu/music-assistant-desktop/package.nix
@@ -32,13 +32,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "music-assistant-desktop";
-  version = "0.5.5";
+  version = "0.5.7";
 
   src = fetchFromGitHub {
     owner = "music-assistant";
     repo = "desktop-app";
     tag = finalAttrs.version;
-    hash = "sha256-q7aExLYYiox9voo1pX6o8D2wSoV39lNiUVxR61p2w7Q=";
+    hash = "sha256-KKyIYSSIC134t46H7YOFNCdj4M/VoBrX9jN5aX/kSlc=";
   };
 
   patches = [
@@ -58,7 +58,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoRoot = "src-tauri";
   buildAndTestSubdir = finalAttrs.cargoRoot;
 
-  cargoHash = "sha256-H17FmiWSHIi1vRmo1Zq/2rscvmJXoBy4lqEblGe/XNk=";
+  cargoHash = "sha256-AFn2m8eO+U86s6g2LlzBuAsJBesrm3Gncihf+zbPDeE=";
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";

From 1402b5012c2870f01b43b3a8a279eebeb001d857 Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Sat, 11 Jul 2026 13:36:53 -0400
Subject: [PATCH 116/117] workflows/{check,lint}: prevent git timeouts

---
 .github/workflows/check.yml | 4 ++--
 .github/workflows/lint.yml  | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 0965864220c6..da635f56c3c1 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -92,8 +92,8 @@ jobs:
     if: inputs.baseBranch && inputs.headBranch
     permissions:
       pull-requests: write
-    runs-on: ubuntu-slim
-    timeout-minutes: 3
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 8
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 3b743fe2e53a..b68b8738f13f 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -131,8 +131,8 @@ jobs:
     # Luckily there's no need to lint commit messages in the Merge Queue, because
     # changes to the target branch can't change commit messages on the base branch.
     if: ${{ github.event.pull_request.number }}
-    runs-on: ubuntu-slim
-    timeout-minutes: 5
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 8
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:

From 1e06f941dd0157b7f5554c65bf963f4075975f39 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 12 Jul 2026 01:55:50 +0200
Subject: [PATCH 117/117] xla: require big-parallel feature

With 68k objects to compile this build clogs small build slots for far
too long.
---
 pkgs/by-name/xl/xla/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/xl/xla/package.nix b/pkgs/by-name/xl/xla/package.nix
index 597a12a23400..af2dbedb57c7 100644
--- a/pkgs/by-name/xl/xla/package.nix
+++ b/pkgs/by-name/xl/xla/package.nix
@@ -235,6 +235,9 @@ in
       runHook postInstall
     '';
   };
+
+  requiredSystemFeatures = [ "big-parallel" ];
+
   meta = {
     description = "Machine learning compiler for GPUs, CPUs, and ML accelerators";
     homepage = "https://github.com/openxla/xla";