Merge master into staging-next

2026-10-02 13:00:23 +00:00 · 2026-09-21 18:10:54 +00:00
parent 5a11e87acc cfa7eea81f
commit 6713268fd8
89 changed files with 873 additions and 953 deletions
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -186,6 +186,8 @@

 - `luaPackages.lrexlib-pcre` has been removed as part of the process to fully migrate from the end-of-life PRCE library to PCRE2. `luaPackages.lrexlib-pcre2` and multiple other versions of lrexlib can be used instead.

+- `hostapd` was upgraded to version 2.12+, which moves move supported, basic, and beacon transmission rate configuration to be at BSS level instead of per-radio for all BSSs. Refer to the [upstream example config](https://git.w1.fi/cgit/hostap/plain/hostapd/hostapd.conf) for details.
+
 - `pnpm_10` was upgraded to version 10.34.1+, which introduced stricter integrity checks. If you encounter `ERR_PNPM_MISSING_TARBALL_INTEGRITY`, you can fall back to the older `pnpm_10_34_0`.

 - `buildMozillaMach` is now using `enable<feature>` and `with<dependency>`
--- a/nixos/modules/services/networking/libreswan.nix
+++ b/nixos/modules/services/networking/libreswan.nix
@@ -157,17 +157,8 @@ in
    // policyFiles;

    systemd.services.ipsec = {
-      description = "Internet Key Exchange (IKE) Protocol Daemon for IPsec";
      wantedBy = [ "multi-user.target" ];
      restartTriggers = [ configFile ] ++ lib.mapAttrsToList (n: v: v.source) policyFiles;
-      path = with pkgs; [
-        libreswan
-        iproute2
-        procps
-        nssTools
-        iptables
-        net-tools
-      ];
      preStart = lib.optionalString cfg.disableRedirects ''
        # Disable send/receive redirects
        echo 0 | tee /proc/sys/net/ipv4/conf/*/send_redirects
--- a/nixos/modules/services/networking/mullvad-vpn.nix
+++ b/nixos/modules/services/networking/mullvad-vpn.nix
@@ -65,50 +65,44 @@ in
    # Mullvad prefers systemd-resolved for setting up their DNS servers.
    services.resolved.enable = lib.mkDefault true;

-    # See https://github.com/mullvad/mullvadvpn-app/blob/2025.14/dist-assets/linux/mullvad-early-boot-blocking.service.
+    # See https://github.com/mullvad/mullvadvpn-app/blob/2026.05/dist-assets/linux/
    systemd.services = {
      mullvad-early-boot-blocking = mkIf cfg.enableEarlyBootBlocking {
        description = "Mullvad early boot network blocker";
        wantedBy = [ "mullvad-daemon.service" ];
        before = [
-          "basic.target"
+          "network-pre.target"
          "mullvad-daemon.service"
        ];
-        unitConfig = {
-          DefaultDependencies = "no";
-        };
+        after = [ "local-fs.target" ];
+        unitConfig.DefaultDependencies = "no";
        serviceConfig = {
          Type = "oneshot";
-          ExecStart = "${getExe' cfg.package "mullvad-daemon"} --initialize-early-boot-firewall";
+          ExecStart = "${getExe' cfg.package "mullvad-daemon"} -v --initialize-early-boot-firewall";
        };
      };

      mullvad-daemon = {
        description = "Mullvad VPN daemon";
        wantedBy = [ "multi-user.target" ];
-        wants = [
-          "network.target"
-          "network-online.target"
-        ];
+        before = [ "network-online.target" ];
        after = [
-          "network-online.target"
-          "NetworkManager.service"
-          "systemd-resolved.service"
+          "network.target"
        ]
        ++ optional cfg.enableEarlyBootBlocking "mullvad-early-boot-blocking.service";
-
+        startLimitBurst = 5;
+        startLimitIntervalSec = 20;
        path =
          # Necessary for certain obfuscation types (pre-v2026.4) and DAITA.
-          # TODO: Drop iproute2 once the dependency on the `ip` command is dropped upstream.
+          # TODO: Drop iproute2 once we update to 2026.06. (https://github.com/mullvad/mullvadvpn-app/pull/10794)
          singleton pkgs.iproute2
          # See https://github.com/NixOS/nixpkgs/issues/262681
          ++ optional config.networking.resolvconf.enable config.networking.resolvconf.package;
-        startLimitBurst = 5;
-        startLimitIntervalSec = 20;
        serviceConfig = {
-          ExecStart = "${getExe' cfg.package "mullvad-daemon"} -v --disable-stdout-timestamps";
+          ExecStart = "${getExe' cfg.package "mullvad-daemon"} -vv --disable-stdout-timestamps";
          Restart = "always";
          RestartSec = 1;
+          RestartKillSignal = "SIGUSR1";
        };
      };
    };
--- a/nixos/tests/libreswan-nat.nix
+++ b/nixos/tests/libreswan-nat.nix
@@ -125,6 +125,7 @@ in
        leftid=@server
        leftsubnet=::/0
        leftupdown=${pkgs.writeScript "updown" ''
+          PATH=${pkgs.iproute2}/bin
          # act as NDP proxy for VPN clients
          if test "$PLUTO_VERB" = up-client-v6; then
            ip neigh add proxy "$PLUTO_PEER_CLIENT_NET" dev eth2
--- a/pkgs/by-name/ac/acme-sh/package.nix
+++ b/pkgs/by-name/ac/acme-sh/package.nix
@@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "acme.sh";
-  version = "3.1.4";
+  version = "3.1.5";

  src = fetchFromGitHub {
    owner = "acmesh-official";
    repo = "acme.sh";
    tag = finalAttrs.version;
-    hash = "sha256-xw10M4C6bqnxLxPeXE9dbFP/ajkpO2SQUJp56CeYysk=";
+    hash = "sha256-wybDNQ0shmRPvYpBkMWZA0UQjh866+yFclqyMAlNeiE=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/al/all-the-package-names/package.nix
+++ b/pkgs/by-name/al/all-the-package-names/package.nix
@@ -7,16 +7,16 @@

 buildNpmPackage rec {
  pname = "all-the-package-names";
-  version = "2.0.2558";
+  version = "2.0.2568";

  src = fetchFromGitHub {
    owner = "nice-registry";
    repo = "all-the-package-names";
    tag = "v${version}";
-    hash = "sha256-Dvl4URH8h8dDGfOZQ9rHiris8nhOoEtA2mRCdu7aiwo=";
+    hash = "sha256-9Okp0Fli+MyVYqOQDg867ic/t+bOJr86MVIshntiy78=";
  };

-  npmDepsHash = "sha256-TkVVFdZ4h4hCMhXEXqHx2TwbdVZErTqdJqaTDHAc33w=";
+  npmDepsHash = "sha256-YOvzCKN2PqbyOgR5qhshI52/grQT2DStbdJgWBrVvsI=";

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/au/aurral/package.nix
+++ b/pkgs/by-name/au/aurral/package.nix
@@ -2,6 +2,7 @@
  lib,
  buildNpmPackage,
  fetchFromGitHub,
+  gitMinimal,
  nix-update-script,
  nodejs_26,
  sqlite,
@@ -12,6 +13,7 @@
  makeFontsConf,
  noto-fonts-color-emoji,
  dejavu_fonts,
+  nixosTests,
 }:

 buildNpmPackage (finalAttrs: {
@@ -33,11 +35,26 @@ buildNpmPackage (finalAttrs: {
    ./package.json.patch
  ];

+  # https://github.com/lklynet/aurral/pull/873
+  postPatch = ''
+    # Keep automatic ports above Fetch's highest blocked port (10080).
+    substituteInPlace .tests/helpers/backendTestHarness.js \
+      --replace-fail '4100 + Math.floor(Math.random() * 1000)' \
+      '11000 + Math.floor(Math.random() * 1000)'
+  '';
+
  npmDepsHash = "sha256-NVz5eqDDtMBKiTDl3aX0pHBYGTcYal8lmCf8mbKu31I=";

  nodejs = nodejs_26;

  env.VITE_APP_VERSION = finalAttrs.version;
+  env.LD_LIBRARY_PATH = lib.makeLibraryPath [ sqlite ];
+  env.FONTCONFIG_FILE = makeFontsConf {
+    fontDirectories = [
+      noto-fonts-color-emoji
+      dejavu_fonts
+    ];
+  };

  npmInstallFlags = [
    "--include=optional"
@@ -46,6 +63,22 @@ buildNpmPackage (finalAttrs: {

  npmBuildFlags = [ "--workspace=frontend" ];

+  doCheck = true;
+
+  nativeCheckInputs = [
+    ffmpeg
+    gitMinimal
+  ];
+
+  checkPhase = ''
+    runHook preCheck
+
+    npm test
+    npm run test:integration
+
+    runHook postCheck
+  '';
+
  npmPruneFlags = [
    "--workspace=backend"
    "--include=optional"
@@ -69,14 +102,7 @@ buildNpmPackage (finalAttrs: {
        yt-dlp
      ]
    }\''${PATH:+:}\$PATH
-    export FONTCONFIG_FILE=${
-      makeFontsConf {
-        fontDirectories = [
-          noto-fonts-color-emoji
-          dejavu_fonts
-        ];
-      }
-    }
+    export FONTCONFIG_FILE=${finalAttrs.env.FONTCONFIG_FILE}
    export APP_VERSION=${finalAttrs.version}
    export NODE_ENV=production
    case "\$1" in
@@ -97,7 +123,10 @@ buildNpmPackage (finalAttrs: {
    chmod +x $out/bin/aurral
  '';

-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    tests = nixosTests.aurral;
+    updateScript = nix-update-script { };
+  };

  meta = {
    description = "Aurral is the Lidarr companion for self-hosted music discovery";
--- a/pkgs/by-name/be/beads/package.nix
+++ b/pkgs/by-name/be/beads/package.nix
@@ -63,12 +63,35 @@ buildGoModule (finalAttrs: {
      ++ lib.optionals stdenv.hostPlatform.isDarwin [
        # Checks for /etc/passwd which isn't available in sandbox
        "TestCleanupMergeArtifacts_CommandInjectionPrevention"
+        # Test-harness hygiene: reaps leaked `dolt sql-server` processes by
+        # shelling out to `ps`, whose exec the Darwin build sandbox denies, so
+        # the sweep finds nothing and the fake server outlives the assertion.
+        # Nothing outside _test.go calls the swept code; `bd` is unaffected.
+        "TestRunTestsAndSweepReapsOrphanedServer"
+        # Both pin a proxied-server root at a literal /tmp path, so the workspace
+        # gate they open lands in the host /tmp that Darwin builds share (it is
+        # a sandbox-path, unlike the private /tmp a Linux build gets). The 0600
+        # lock files outlive the build and belong to whichever _nixbld user ran
+        # it, so the next build under a different user is denied.
+        "TestMigrateToProxiedServer_AlreadyProxiedRejectsBadSidecar"
+        "TestMigrateToProxiedServer_AlreadyProxiedRefusalsAreTyped"
      ];
    in
-    [ "-skip=^(${lib.concatStringsSep "|" skippedTests})$" ];
+    [
+      # cmd/bd is a ~1500-test, largely serial suite: most cases spawn a bd
+      # subprocess backed by an embedded Dolt instance, so Go's 10m default
+      # deadline expires mid-run and panics without naming a failing test.
+      # 25m matches upstream's own per-package deadline in scripts/test.sh.
+      "-timeout=25m"
+      "-skip=^(${lib.concatStringsSep "|" skippedTests})$"
+    ];

  preCheck = ''
-    export PATH="$out/bin:$PATH"
+    # Subprocess tests build their own bd binary (~45s each) unless pointed at
+    # a prebuilt one. $out is not populated until installPhase, so hand them
+    # the binary buildPhase just produced.
+    export BEADS_TEST_BD_BINARY="$GOPATH/bin/bd"
+    export PATH="$GOPATH/bin:$PATH"
  '';

  postInstall = ''
--- a/pkgs/by-name/bi/biome/package.nix
+++ b/pkgs/by-name/bi/biome/package.nix
@@ -11,16 +11,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "biome";
-  version = "2.5.13";
+  version = "2.5.14";

  src = fetchFromGitHub {
    owner = "biomejs";
    repo = "biome";
    rev = "@biomejs/biome@${finalAttrs.version}";
-    hash = "sha256-qER9QDFHGhf5U5BVk7QticJFQ+wFR9+LKweuP26VDOo=";
+    hash = "sha256-p9GwRdtD4gRXRP0Z313V5u3FlCrKV90Ikas31Nu4aiQ=";
  };

-  cargoHash = "sha256-658jnk9AaozW15EMuGVDXCOLxLevxYgfiDRJCKUBJkU=";
+  cargoHash = "sha256-YCB7EAGuEz5mZq4sTyLInTzPajtASZtHNULrA+D6t3Y=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/by-name/bi/bisq1/sources.nix
+++ b/pkgs/by-name/bi/bisq1/sources.nix
@@ -1,8 +1,8 @@
 # Generated by ./update.sh
 {
-  version = "1.10.7";
-  deb-hash = "sha256-PRjpIDiMMF3Av4/3sJnEkCUA0X+IDilrZjUIT275VOc=";
-  sig-hash = "sha256-+srbPApLbBUMYdwI3sWSFOYnQ7lAtBXYsHJvF2sheDM=";
+  version = "1.10.8";
+  deb-hash = "sha256-it03GDQ3Ja21QkwmxmSWNI/PgaW44NG0O0r0jEhjsfs=";
+  sig-hash = "sha256-LWqPSrdlmihLJKhE+2TXtfdDiUtdQL/d6NNbZ0ctlfw=";
  key-E222AA02-hash = "sha256-Ue/UmS6F440/ybEEIAR+pdPEIksAt6QSMN6G5TZVWzc=";
  key-4A133008-hash = "sha256-UijG3DkJNNTakVJd2wl30mDepa27n6R/Xxfl4sjt0sk=";
  key-387C8307-hash = "sha256-PrRYZLT0xv82dUscOBgQGKNf6zwzWUDhriAffZbNpmI=";
--- a/pkgs/by-name/ci/circumflex/package.nix
+++ b/pkgs/by-name/ci/circumflex/package.nix
@@ -37,7 +37,7 @@ buildGoModule (finalAttrs: {
  meta = {
    description = "Command line tool for browsing Hacker News in your terminal";
    homepage = "https://github.com/bensadeh/circumflex";
-    license = lib.licenses.agpl3Only;
+    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ mktip ];
    mainProgram = "clx";
  };
--- a/pkgs/by-name/cp/cppcheck/package.nix
+++ b/pkgs/by-name/cp/cppcheck/package.nix
@@ -21,7 +21,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cppcheck";
-  version = "2.21.1";
+  version = "2.22.0";

  outputs = [
    "out"
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "cppcheck-opensource";
    repo = "cppcheck";
    tag = finalAttrs.version;
-    hash = "sha256-kpolGzSk+1lY8EXFciAimhUlv7we3bMbu2/Y0DlO4YU=";
+    hash = "sha256-HbrNBDxo3/b4h6BeBD9gohI4PB4xeosy9Y0Y3uB4J2g=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/dn/dnote/package.nix
+++ b/pkgs/by-name/dn/dnote/package.nix
@@ -128,9 +128,6 @@ buildGoModule rec {
    changelog = "https://github.com/dnote/dnote/blob/cli-v${version}/CHANGELOG.md";
    platforms = lib.platforms.unix;
    maintainers = with lib.maintainers; [ bot-wxt1221 ];
-    license = with lib.licenses; [
-      gpl3Only
-      agpl3Only
-    ];
+    license = lib.licenses.asl20;
  };
 }
--- a/pkgs/by-name/dn/dnstwist/package.nix
+++ b/pkgs/by-name/dn/dnstwist/package.nix
@@ -40,7 +40,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    description = "Domain name permutation engine for detecting homograph phishing attacks";
    homepage = "https://github.com/elceef/dnstwist";
    changelog = "https://github.com/elceef/dnstwist/releases/tag/${finalAttrs.version}";
-    license = lib.licenses.gpl3Only;
+    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ fab ];
    mainProgram = "dnstwist";
  };
--- a/pkgs/by-name/dw/dwl/package.nix
+++ b/pkgs/by-name/dw/dwl/package.nix
@@ -14,7 +14,7 @@
  wayland,
  wayland-protocols,
  wayland-scanner,
-  wlroots_0_19,
+  wlroots_0_20,
  writeText,
  libxcb-wm,
  xwayland,
@@ -39,13 +39,13 @@
 assert withCustomConfigH -> (configH != null);
 stdenv.mkDerivation (finalAttrs: {
  pname = "dwl";
-  version = "0.8";
+  version = "0.9";

  src = fetchFromCodeberg {
    owner = "dwl";
    repo = "dwl";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-J76L5ZOCYgfcY08wH5cSLG+UdgDrv50lQyEnJNqDkXI=";
+    hash = "sha256-PYBOi/A9n1611XBEaZW9PolSfjwe1KWoI2VbVrS2s0Q=";
  };

  nativeBuildInputs = [
@@ -61,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
    pixman
    wayland
    wayland-protocols
-    wlroots_0_19
+    wlroots_0_20
  ]
  ++ lib.optionals enableXWayland [
    libx11
@@ -126,7 +126,7 @@ stdenv.mkDerivation (finalAttrs: {
      - Tied to as few external dependencies as possible
    '';
    license = lib.licenses.gpl3Only;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ evanwporter ];
    inherit (wayland.meta) platforms;
    mainProgram = "dwl";
  };
--- a/pkgs/by-name/eg/egoboo/egoboo-fix-build.patch
+++ b/pkgs/by-name/eg/egoboo/egoboo-fix-build.patch
@@ -0,0 +1,68 @@
+--- a/src/game/game.c
+++ b/src/game/game.c
+@@ -2052,8 +2052,8 @@
+         if (( CAM_TURN_GOOD == PCamera->turn_mode && 1 == local_numlpla ) ||
+             !control_is_pressed( INPUT_DEVICE_KEYBOARD, CONTROL_CAMERA ) )
+         {
+-            joy_pos.x = ( control_is_pressed( INPUT_DEVICE_KEYBOARD,  CONTROL_RIGHT ) - control_is_pressed( INPUT_DEVICE_KEYBOARD,  CONTROL_LEFT ) );
+-            joy_pos.y = ( control_is_pressed( INPUT_DEVICE_KEYBOARD,  CONTROL_DOWN ) - control_is_pressed( INPUT_DEVICE_KEYBOARD,  CONTROL_UP ) );
+            joy_pos.x = ( (int)control_is_pressed( INPUT_DEVICE_KEYBOARD,  CONTROL_RIGHT ) - (int)control_is_pressed( INPUT_DEVICE_KEYBOARD,  CONTROL_LEFT ) );
+            joy_pos.y = ( (int)control_is_pressed( INPUT_DEVICE_KEYBOARD,  CONTROL_DOWN ) - (int)control_is_pressed( INPUT_DEVICE_KEYBOARD,  CONTROL_UP ) );
+ 
+             if ( CAM_TURN_GOOD == PCamera->turn_mode &&
+                  1 == local_numlpla )  joy_pos.x = 0;
+--- a/src/enet/Makefile
+++ b/src/enet/Makefile
+@@ -4,7 +4,7 @@
+ ENET_SRCLST	:= host.c list.c memory.c packet.c peer.c protocol.c unix.c
+ ENET_OBJLST	:= $(ENET_SRCLST:.c=.o)
+ 
+-CC      := gcc
+CC      := cc
+ OPT     := -Os
+ INC     := -Iinclude
+ CFLAGS  := $(OPT) $(INC)
+--- a/src/game/platform/file_linux.c
+++ b/src/game/platform/file_linux.c
+@@ -34,6 +34,7 @@
+ #include <sys/types.h>
+ #include <sys/stat.h>
+ #include <sys/dir.h>
+#include <limits.h>
+ #include "egoboo_mem.h"
+ 
+ //--------------------------------------------------------------------------------------------
+@@ -74,9 +75,9 @@
+     // so that the program will compile and install just like any other
+     // .rpm or .deb package.
+ 
+-    strncpy( linux_configPath, PREFIX "/etc/egoboo-2.x",         SDL_arraysize( linux_configPath ) );
+-    strncpy( linux_binaryPath, PREFIX "/games/",                  SDL_arraysize( linux_binaryPath ) );
+-    strncpy( linux_dataPath,   PREFIX "/share/games/egoboo-2.x", SDL_arraysize( linux_dataPath ) );
+    strncpy( linux_configPath, PREFIX "/share/egoboo",         SDL_arraysize( linux_configPath ) );
+    strncpy( linux_binaryPath, PREFIX "/bin/",                  SDL_arraysize( linux_binaryPath ) );
+    strncpy( linux_dataPath,   PREFIX "/share/egoboo", SDL_arraysize( linux_dataPath ) );
+ #else
+     // these are read-only directories
+     strncpy( linux_configPath, "/etc/egoboo-2.x/",         SDL_arraysize( linux_configPath ) );
+--- a/src/game/file_formats/id_md2.c
+++ b/src/game/file_formats/id_md2.c
+@@ -24,7 +24,7 @@
+ #include "id_md2.h"
+ #include "egoboo_vfs.h"
+ 
+-#include <malloc.h>
+#include <stdlib.h>
+ 
+ //--------------------------------------------------------------------------------------------
+ //--------------------------------------------------------------------------------------------
+--- a/src/game/system.h
+++ b/src/game/system.h
+@@ -24,6 +24,7 @@
+ /// use a higher performance timer than SDL provides on Windows machines.
+ 
+ #include <stdlib.h>
+#include <stdarg.h>
+ 
+ //--------------------------------------------------------------------------------------------
+ //--------------------------------------------------------------------------------------------
--- a/pkgs/by-name/eg/egoboo/egoboo-fix-darwin.patch
+++ b/pkgs/by-name/eg/egoboo/egoboo-fix-darwin.patch
@@ -0,0 +1,69 @@
+--- a/src/game/Makefile
+++ b/src/game/Makefile
+@@ -16,7 +16,7 @@
+ 	script_functions.c server.c sound.c texture.c ui.c egoboo.c physics.c\
+ 	egoboo_process.c ChrList.c EncList.c PrtList.c egoboo_object.c
+ 
+-EGO_PLATFORM    := platform/file_linux.c platform/sys_linux.c
+EGO_PLATFORM    := platform/file_linux.c platform/sys_mac.c
+ EGO_FILE_FORMAT := $(wildcard ./file_formats/*.c)
+ EGO_EXTENSIONS  := $(wildcard ./extensions/*.c)
+ 
+@@ -32,17 +32,17 @@
+ #---------------------
+ # the compiler options
+ 
+-CC      := gcc
+CC      := cc
+ INC     := -I. -I.. -I../enet/include ${SDLCONF_I} -I./extensions -I./file_formats -I./platform
+-LDFLAGS := ${SDLCONF_L} -L../enet/lib -lSDL_ttf -lSDL_mixer -lGL -lGLU -lSDL_image -lphysfs -lenet
+LDFLAGS := ${SDLCONF_L} -L../enet/lib -lSDL_ttf -lSDL_mixer -framework OpenGL -lSDL_image -lphysfs -lenet
+ 
+ # use different options if the environmental variable PREFIX is defined
+ ifdef ($(PREFIX),"")
+ 	OPT := -Os -Wall
+ else
+ 	OPT := -Os -Wall -DPREFIX=\"${PREFIX}\" -D_NIX_PREFIX
+ endif
+
+ CFLAGS  := ${OPT} ${INC}
+ 
+ #------------------------------------
+--- a/src/game/platform/sys_mac.c
+++ b/src/game/platform/sys_mac.c
+@@ -21,7 +21,7 @@
+ /// @brief Implementation of mac system-dependent functions
+ /// @details
+ 
+-#include "System.h"
+#include "system.h"
+ 
+ #include "file_common.h" /* for NULL */
+ #include <sys/time.h>
+--- a/src/OSX/Info.plist
+++ b/src/OSX/Info.plist
+@@ -5,7 +5,7 @@
+ 	<key>CFBundleDevelopmentRegion</key>
+ 	<string>English</string>
+ 	<key>CFBundleExecutable</key>
+-	<string>${EXECUTABLE_NAME}</string>
+	<string>egoboo</string>
+ 	<key>CFBundleIconFile</key>
+ 	<string>skull</string>
+ 	<key>CFBundleIdentifier</key>
+@@ -13,13 +13,13 @@
+ 	<key>CFBundleInfoDictionaryVersion</key>
+ 	<string>6.0</string>
+ 	<key>CFBundleName</key>
+-	<string>${PRODUCT_NAME}</string>
+	<string>Egoboo</string>
+ 	<key>CFBundlePackageType</key>
+ 	<string>APPL</string>
+ 	<key>CFBundleSignature</key>
+ 	<string>????</string>
+ 	<key>CFBundleVersion</key>
+-	<string>2.6.7 beta</string>
+	<string>2.8.1</string>
+ 	<key>NSMainNibFile</key>
+ 	<string>SDLMain</string>
+ 	<key>NSPrincipalClass</key>
--- a/pkgs/by-name/eg/egoboo/egoboo-fix-physfs.patch
+++ b/pkgs/by-name/eg/egoboo/egoboo-fix-physfs.patch
@@ -0,0 +1,24 @@
+--- a/src/game/egoboo_vfs.c
+++ b/src/game/egoboo_vfs.c
+@@ -1251,7 +1251,9 @@
+     }
+     else if ( vfs_physfs == pfile->type )
+     {
+-        retval = PHYSFS_readSLE64( pfile->ptr.p, val );
+        PHYSFS_sint64 itmp;
+        retval = PHYSFS_readSLE64( pfile->ptr.p, &itmp );
+        if ( retval ) *val = (Sint64)itmp;
+ 
+         error = ( 0 == retval );
+     }
+@@ -1283,7 +1285,9 @@
+     }
+     else if ( vfs_physfs == pfile->type )
+     {
+-        retval = PHYSFS_readULE64( pfile->ptr.p, val );
+        PHYSFS_uint64 itmp;
+        retval = PHYSFS_readULE64( pfile->ptr.p, &itmp );
+        if ( retval ) *val = (Uint64)itmp;
+ 
+         error = ( 0 == retval );
+     }
--- a/pkgs/by-name/eg/egoboo/package.nix
+++ b/pkgs/by-name/eg/egoboo/package.nix
@@ -8,77 +8,88 @@
  SDL_mixer,
  SDL_image,
  SDL_ttf,
+  physfs,
 }:

 stdenv.mkDerivation (finalAttrs: {
-  # pf5234 (a developer?) at freenode #egoboo told me that I better use 2.7.3 until
-  # they fix more, because it even has at least one bugs less than 2.7.4.
-  # 2.8.0 does not start properly on linux
-  # They just starting making that 2.8.0 work on linux.
  pname = "egoboo";
-  version = "2.7.3";
+  version = "2.8.1";
+
+  __structuredAttrs = true;

  src = fetchurl {
    url = "mirror://sourceforge/egoboo/egoboo-${finalAttrs.version}.tar.gz";
-    sha256 = "18cjgp9kakrsa90jcb4cl8hhh9k57mi5d1sy5ijjpd3p7zl647hd";
+    hash = "sha256-omlBh9KKeq30yjubemxtzTuwPsjxRUNcdEu3evtfTCY=";
  };

-  buildPhase = ''
-    cd source
-    make -C enet all
-    # The target 'all' has trouble
-    make -C game -f Makefile.unix egoboo
-  '';
+  patches = [
+    ./egoboo-fix-build.patch
+    ./egoboo-fix-physfs.patch
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    ./egoboo-fix-darwin.patch
+  ];

-  # The user will need to have all the files in '.' to run egoboo, with
-  # writeable controls.txt and setup.txt
-  installPhase = ''
-    mkdir -p $out/share/egoboo-${finalAttrs.version}
-    cp -v game/egoboo $out/share/egoboo-${finalAttrs.version}
-    cd ..
-    cp -v -Rd controls.txt setup.txt players modules basicdat $out/share/egoboo-${finalAttrs.version}
-  '';
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    SDL
+  ];

  buildInputs = [
-    libGLU
-    libGL
    SDL
    SDL_mixer
    SDL_image
    SDL_ttf
+    physfs
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    libGLU
+    libGL
  ];

-  /*
-    This big commented thing may be needed for versions 2.8.0 or beyond
-    I keep it here for future updates.
-
-    # Some files have to go to $HOME, but we put them in the 'shared'.
-    patchPhase = ''
-      sed -i -e 's,''${HOME}/.''${PROJ_NAME},''${PREFIX}/share/games/''${PROJ_NAME},g' Makefile
-    '';
-
-    preBuild = ''
-      makeFlags=PREFIX=$out
-    '';
-  */
-
  env = {
-    # Workaround build failure on -fno-common toolchains like upstream
-    # gcc-10. Otherwise build fails as:
-    #   ld: mad.o:(.bss+0x233800): multiple definition of `tile_dict'; camera.o:(.bss+0x140): first defined here
    NIX_CFLAGS_COMPILE = "-fcommon";
-
-    NIX_LDFLAGS = "-lm";
+    NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isLinux "-lm";
  };

+  buildPhase = ''
+    runHook preBuild
+    make -C src PREFIX=$out
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 src/game/egoboo-2.x $out/bin/egoboo
+
+    mkdir -p $out/share/egoboo
+    cp -r controls.txt setup.txt basicdat modules \
+      $out/share/egoboo/
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    mkdir -p $out/Applications/Egoboo.app/Contents/{MacOS,Resources}
+
+    install -Dm755 src/game/egoboo-2.x \
+      $out/Applications/Egoboo.app/Contents/MacOS/egoboo
+
+    install -Dm644 src/OSX/Info.plist \
+      $out/Applications/Egoboo.app/Contents/Info.plist
+
+    install -Dm644 src/OSX/skull.icns \
+      $out/Applications/Egoboo.app/Contents/Resources/skull.icns
+  ''
+  + ''
+    runHook postInstall
+  '';
+
  meta = {
    description = "3D dungeon crawling adventure";
-
    homepage = "https://egoboo.sourceforge.net/";
    license = lib.licenses.gpl2Plus;
-
-    # I take it out of hydra as it does not work as well as I'd like
-    # maintainers = [ ];
-    # platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ iedame ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
+    mainProgram = "egoboo";
  };
 })
--- a/pkgs/by-name/fc/fceux/0001-cmake-fix-qt6-build-on-linux.patch
+++ b/pkgs/by-name/fc/fceux/0001-cmake-fix-qt6-build-on-linux.patch
@@ -1,37 +0,0 @@
-From 3635c26d6d5ec08b197c4903ed46a3221e574899 Mon Sep 17 00:00:00 2001
-From: Lukas Sabota <lukas@lwsabota.com>
-Date: Sun, 19 Apr 2026 13:05:51 -0400
-Subject: [PATCH] cmake: fix qt6 build on linux
-
---
- src/CMakeLists.txt | 7 +++++--
- 1 file changed, 5 insertions(+), 2 deletions(-)
-
-diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
-index 7a432669..16386a70 100644
--- a/src/CMakeLists.txt
-+++ b/src/CMakeLists.txt
-@@ -47,8 +47,6 @@ if ( ${QT} EQUAL 6 )
- 	find_package( Qt6 COMPONENTS Help QUIET)
- 	find_package( Qt6 COMPONENTS Qml)
- 	find_package( Qt6 COMPONENTS UiTools)
-	add_definitions( ${Qt6Widgets_DEFINITIONS} ${Qt6Qml_DEFINITIONS} ${Qt6Network_DEFINITIONS} ${Qt6Help_DEFINITIONS} ${Qt6OpenGLWidgets_DEFINITIONS} )
-	# add_definitions(${Qt6UiTools_DEFINITIONS}) # Leave ${Qt6UiTools_DEFINITIONS} out as this is causing a build error
- 	include_directories( ${Qt6Widgets_INCLUDE_DIRS} ${Qt6Qml_INCLUDE_DIRS} ${Qt6UiTools_INCLUDE_DIRS} ${Qt6Network_INCLUDE_DIRS} ${Qt6Help_INCLUDE_DIRS} ${Qt6OpenGLWidgets_INCLUDE_DIRS} )
- 
- 	if (${Qt6Help_FOUND})
-@@ -757,6 +755,11 @@ target_link_libraries( ${APP_NAME}
-  	${SYS_LIBS}
- )
- 
-+if(NOT MSVC)
-+	# Add minizip subdirectory so #include<unzip.h> works without the "minizip" subdirectory in the directive
-+	target_include_directories(${APP_NAME} PRIVATE ${MINIZIP_INCLUDE_DIRS}/minizip)
-+endif()
-+
- if (WIN32)
- 	#   target_link_libraries( ${APP_NAME} wsock32 ws2_32 )
- 
-- 
-2.51.2
-
--- a/pkgs/by-name/fc/fceux/package.nix
+++ b/pkgs/by-name/fc/fceux/package.nix
@@ -31,20 +31,15 @@ assert lib.elem ___qtVersion [
 ];
 stdenv.mkDerivation (finalAttrs: {
  pname = "fceux";
-  version = "2.6.6-unstable-2026-04-13";
+  version = "2.6.6-unstable-2026-05-30";

  src = fetchFromGitHub {
    owner = "TASEmulators";
    repo = "fceux";
-    rev = "1e1168db6662ce86848460b5d078e17c6dc6e2ce";
-    hash = "sha256-FHNMDvEMgKnZjpm0DEN2rj0aI3T244zfcS+NEYWytaU=";
+    rev = "a62b868e9247c4aafd66f597cdfa8d2609704087";
+    hash = "sha256-nwlBRlIMUoLJO4T6Grle2AJYTpHt+as/cBMBegsL748=";
  };

-  patches = [
-    # https://github.com/TASEmulators/fceux/pull/834
-    ./0001-cmake-fix-qt6-build-on-linux.patch
-  ];
-
  nativeBuildInputs = [
    cmake
    pkg-config
@@ -63,6 +58,8 @@ stdenv.mkDerivation (finalAttrs: {
    x264
  ];

+  cmakeFlags = [ "-DGLVND=1" ];
+
  strictDeps = true;

  postInstall = ''
--- a/pkgs/by-name/fz/fzf-make/package.nix
+++ b/pkgs/by-name/fz/fzf-make/package.nix
@@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "fzf-make";
-  version = "0.73.0";
+  version = "0.74.0";

  src = fetchFromGitHub {
    owner = "kyu08";
    repo = "fzf-make";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-v3AmcLFnPZb6zJ1Gx5R2vNPtPHQzb8gyVlMj76rvO1s=";
+    hash = "sha256-+3vSHqWxFerO1q9Rjl3mvXW7HHOKpHNZr/73N4XmDzI=";
  };

-  cargoHash = "sha256-rcBJIBmGT27OA0MUh2fTf+wQO+7tabL2vpG8eJw5lhA=";
+  cargoHash = "sha256-KmXtupth9yB3QMKU2QUUSXwzd+/Ec/Po3BEvMFvCWEs=";

  nativeBuildInputs = [ makeBinaryWrapper ];

--- a/pkgs/by-name/ga/gajim/package.nix
+++ b/pkgs/by-name/ga/gajim/package.nix
@@ -45,7 +45,6 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
  version = "2.6.0";

  src = fetchFromGitLab {
-    domain = "dev.gajim.org";
    owner = "gajim";
    repo = "gajim";
    tag = finalAttrs.version;
@@ -131,7 +130,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    homepage = "http://gajim.org/";
    description = "XMPP chat client";
    longDescription = "Gajim aims to be an easy to use and fully-featured XMPP client. Just chat with your friends or family, easily share pictures and thoughts or discuss the news with your groups.";
-    changelog = "https://dev.gajim.org/gajim/gajim/-/blob/${finalAttrs.version}/ChangeLog";
+    changelog = "https://gitlab.com/gajim/gajim/-/blob/${finalAttrs.version}/ChangeLog";
    license = lib.licenses.gpl3Plus;
    maintainers = with lib.maintainers; [
      raskin
--- a/pkgs/by-name/ga/gamescope/package.nix
+++ b/pkgs/by-name/ga/gamescope/package.nix
@@ -63,14 +63,14 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "gamescope";
-  version = "3.16.28";
+  version = "3.16.29";

  src = fetchFromGitHub {
    owner = "ValveSoftware";
    repo = "gamescope";
    tag = finalAttrs.version;
    fetchSubmodules = true;
-    hash = "sha256-6B9Vbr21EHDOVCx27TZk3ruJPqoovEQ1JYtd8F6Siv4=";
+    hash = "sha256-HffYFSUfvh6zD3qxSPZNCS504RU6qJiX3ysv26OilNE=";
  };

  patches = [
--- a/pkgs/by-name/go/goldboot/package.nix
+++ b/pkgs/by-name/go/goldboot/package.nix
@@ -49,7 +49,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    description = "Immutable infrastructure for the desktop";
    homepage = "https://github.com/fossable/goldboot";
    changelog = "https://github.com/fossable/goldboot/releases/tag/goldboot-v${finalAttrs.version}";
-    license = lib.licenses.agpl3Plus;
+    license = lib.licenses.unlicense;
    platforms = lib.platforms.unix;
    maintainers = with lib.maintainers; [ cilki ];
  };
--- a/pkgs/by-name/go/goldilocks/package.nix
+++ b/pkgs/by-name/go/goldilocks/package.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "goldilocks";
+  version = "4.15.1";
+
+  src = fetchFromGitHub {
+    owner = "FairwindsOps";
+    repo = "goldilocks";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ubfhj9pYSFpfWkYO1LkA+sW8wwh/dDgQnH91GhKMwKA=";
+  };
+
+  vendorHash = "sha256-dtVNxumYkzWihfI42R7LuXLGtELg5EnxH9FUMCL4u/4=";
+
+  __structuredAttrs = true;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${finalAttrs.version}"
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "version";
+
+  meta = {
+    description = "Get your resource requests \"Just Right\"";
+    longDescription = ''
+      Goldilocks is a utility that can help you identify a starting point for
+      resource requests and limits. By using the Kubernetes
+      VerticalPodAutoscaler in recommendation mode, it gives you a dashboard
+      with suggested resource requests and limits for each workload, so you can
+      set them "just right".
+    '';
+    homepage = "https://goldilocks.docs.fairwinds.com/";
+    changelog = "https://github.com/FairwindsOps/goldilocks/blob/v${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ ELHart05 ];
+    mainProgram = "goldilocks";
+  };
+})
--- a/pkgs/by-name/ho/hostapd/package.nix
+++ b/pkgs/by-name/ho/hostapd/package.nix
@@ -11,11 +11,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "hostapd";
-  version = "2.11";
+  version = "2.12";

  src = fetchurl {
    url = "https://w1.fi/releases/hostapd-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-Kz+stjL9T2XjL0v4Kna0tyxQH5laT2LjMCGf567RdHo=";
+    sha256 = "sha256-9DUCVhwoukerd+GOGpc9BzYcaMyLFBeOYZvVeWtw6r0=";
  };

  nativeBuildInputs = [ pkg-config ];
@@ -39,6 +39,9 @@ stdenv.mkDerivation (finalAttrs: {
    "man"
  ];

+  strictDeps = true;
+  enableParallelBuilding = true;
+
  # Based on hostapd's defconfig. Only differences are tracked.
  extraConfig = ''
    # Use epoll(7) instead of select(2) on linux
--- a/pkgs/by-name/hy/hyprlax/package.nix
+++ b/pkgs/by-name/hy/hyprlax/package.nix
@@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "hyprlax";
-  version = "2.2.6";
+  version = "2.2.7";

  src = fetchFromGitHub {
    owner = "sandwichfarm";
    repo = "hyprlax";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-IfkukFP93EbJu9zBmqgJ98AeAWqCZjH3+dA2Q/1YZOw=";
+    hash = "sha256-CkhHGPfYqGTPSFFzhOoIQCGi31wK7u+MYpWqeq55RJQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/je/jetbrains-toolbox/package.nix
+++ b/pkgs/by-name/je/jetbrains-toolbox/package.nix
@@ -10,7 +10,7 @@

 let
  pname = "jetbrains-toolbox";
-  version = "3.7.2.87231";
+  version = "3.8.1.88030";

  updateScript = ./update.sh;

@@ -57,9 +57,9 @@ let
        aarch64 = "-arm64";
      };
      hash = selectSystem {
-        x86_64-linux = "sha256-zAFofzeVP8VCCk7sZzSa0Jc8YGa4ksgwhY0UNxMUP9E=";
-        aarch64-linux = "sha256-tpOC62foC/0wTGglulJuM+2XQizpfh/nGLaNx2wY3bQ=";
-        aarch64-darwin = "sha256-y/BPXhe67IP21hcIOeiBpn3D0wIX3AeZLsFeRAWomuQ=";
+        x86_64-linux = "sha256-OsuSgC22E2hurQCEnev8GA8hQWLaxg6hclPYHm8crWc=";
+        aarch64-linux = "sha256-Ut6gmKh5mSTe+s4RFCVamv606sOJ5WBMfwHAvYBbc6I=";
+        aarch64-darwin = "sha256-Lwe3gWiRNHbNrk6hwfp0uwdaS8twxZioXeCZeFpunHM=";
      };
    in
    selectKernel {
--- a/pkgs/by-name/ka/kalign/package.nix
+++ b/pkgs/by-name/ka/kalign/package.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
    mainProgram = "kalign";
    homepage = "https://github.com/TimoLassmann/kalign";
    changelog = "https://github.com/TimoLassmann/kalign/releases/tag/v${finalAttrs.version}";
-    license = lib.licenses.gpl3Plus;
+    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ natsukium ];
    platforms = lib.platforms.unix;
  };
--- a/pkgs/by-name/la/landrun/package.nix
+++ b/pkgs/by-name/la/landrun/package.nix
@@ -102,7 +102,7 @@ buildGoModule (finalAttrs: {
    '';
    homepage = "https://github.com/Zouuup/landrun";
    changelog = "https://github.com/Zouuup/landrun/releases/tag/${finalAttrs.src.tag}";
-    license = lib.licenses.gpl2Only;
+    license = lib.licenses.mit;
    maintainers = [
      lib.maintainers.fliegendewurst
      lib.maintainers.bpeetz
--- a/pkgs/by-name/li/libreswan/package.nix
+++ b/pkgs/by-name/li/libreswan/package.nix
@@ -23,7 +23,7 @@
  coreutils,
  gnused,
  gawk,
-  nss,
+  nss_latest,
  which,
  python3,
  libselinux,
@@ -44,18 +44,18 @@ let
    coreutils
    gnused
    gawk
-    nss.tools
+    nss_latest.tools
    which
  ];
 in

 stdenv.mkDerivation rec {
  pname = "libreswan";
-  version = "5.3.2";
+  version = "5.4";

  src = fetchurl {
    url = "https://download.libreswan.org/libreswan-${version}.tar.gz";
-    hash = "sha256-+5GK+gu5K9BDDB2oYe+AaIZNJdchMN8MYweh+dp2EIg=";
+    hash = "sha256-0mNAz2JTFsyRJ+BbOSIUokoQiJ9PHZlAwupkurcQqFU=";
  };

  strictDeps = true;
@@ -83,7 +83,7 @@ stdenv.mkDerivation rec {
    libxcrypt
    curl
    nspr
-    nss
+    nss_latest
    ldns
    # needed to patch shebangs
    python3
@@ -95,6 +95,14 @@ stdenv.mkDerivation rec {
    # Replace wget with curl to save a dependency
    substituteInPlace programs/letsencrypt/letsencrypt.in \
      --replace-fail 'wget -q -P' '${curl}/bin/curl -s --remote-name-all --output-dir'
+
+    # Replace /bin/sh with runtimeShell for purity
+    substituteInPlace programs/pluto/extract.c \
+      --replace-fail '/bin/sh' '${runtimeShell}'
+
+    # Fix pluto running with empty PATH
+    substituteInPlace include/pluto_constants.h \
+      --replace-fail 'ipsec _updown' "$out/bin/ipsec _updown"
  '';

  makeFlags = [
@@ -102,6 +110,7 @@ stdenv.mkDerivation rec {
    "INITSYSTEM=systemd"
    "SYSTEMUNITDIR=$(out)/etc/systemd/system/"
    "TMPFILESDIR=$(out)/lib/tmpfiles.d/"
+    "SHELL_BINARY=${runtimeShell}"
    "LINUX_VARIANT=nixos"
    "DEFAULT_DNSSEC_ROOTKEY_FILE=${dns-root-data}/root.key"
    # Fix invalid XML files with libxml 2.14
@@ -123,7 +132,12 @@ stdenv.mkDerivation rec {
  postFixup = ''
    # Add a PATH to the main "ipsec" script
    sed -e '0,/^$/{s||export PATH=${binPath}:$PATH|}' \
-        -i $out/bin/ipsec
+        -i "$out/bin/ipsec"
+
+    # Add a PATH to all pluto hooks
+    hooks=$(find "$out/libexec" -type f -exec grep -qI . {} \; -print)
+    sed -e '0,/^$/{s||export PATH=${binPath}:${placeholder "out"}/bin:$PATH|}' \
+        -i $hooks
  '';

  passthru.tests = { inherit (nixosTests) libreswan libreswan-nat; };
--- a/pkgs/by-name/li/libretroPackages/cores/jaxe.nix
+++ b/pkgs/by-name/li/libretroPackages/cores/jaxe.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "jaxe";
-  version = "0-unstable-2026-04-02";
+  version = "0-unstable-2026-07-24";

  src = fetchFromGitHub {
    owner = "kurtjd";
    repo = "jaxe";
-    rev = "581befc5d7273abc20ea1b137744f414aa70592c";
-    hash = "sha256-jJPg4qRxraz9wycAiWNgwXXZMF2qG8hQv7Bfexkwyqs=";
+    rev = "c767afd785e01a15bcd575a2d93b737add82b675";
+    hash = "sha256-qkoYVzAFiMACHt9Zx2qfNhUig6DEovyXZ2jE/GLo+ro=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/li/libretroPackages/cores/ppsspp.nix
+++ b/pkgs/by-name/li/libretroPackages/cores/ppsspp.nix
@@ -13,13 +13,13 @@
 }:
 mkLibretroCore {
  core = "ppsspp";
-  version = "0-unstable-2026-09-01";
+  version = "0-unstable-2026-09-12";

  src = fetchFromGitHub {
    owner = "hrydgard";
    repo = "ppsspp";
-    rev = "a39983225d061697bfd4efae4ea1d43b65dc95b8";
-    hash = "sha256-NzD3Sxs4utRTKxw5H478AtZxkOgOs+dKU/H/Gvx5M0s=";
+    rev = "70bab7f25cea1097f25a63c33a337d36e49c720f";
+    hash = "sha256-SqdLAD3tKTPptDdkpaZGk1R+yXj3crkcpqhDBop6FB8=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/li/libretroPackages/cores/snes9x.nix
+++ b/pkgs/by-name/li/libretroPackages/cores/snes9x.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "snes9x";
-  version = "0-unstable-2026-09-04";
+  version = "0-unstable-2026-09-20";

  src = fetchFromGitHub {
    owner = "snes9xgit";
    repo = "snes9x";
-    rev = "7a8878f1306f65594c30b7d86dee41d972c2e495";
-    hash = "sha256-DB4FeJa8XiqClxRCw6J3U1d0qJVtYmQ8wnLdRRPLc2w=";
+    rev = "cf2b0e5d1759a0dd143949db238e377d146b83ff";
+    hash = "sha256-K43/8IeLZZ84XazeFeD9EnjqtSlv9rk2/6lMSqh9YMI=";
  };

  makefile = "Makefile";
--- a/pkgs/by-name/li/libunity/package.nix
+++ b/pkgs/by-name/li/libunity/package.nix
@@ -16,7 +16,7 @@

 stdenv.mkDerivation {
  pname = "libunity";
-  version = "unstable-2021-02-01";
+  version = "7.1.4-unstable-2021-02-01";

  outputs = [
    "out"
--- a/pkgs/by-name/ma/marp-cli/package.nix
+++ b/pkgs/by-name/ma/marp-cli/package.nix
@@ -7,16 +7,16 @@

 buildNpmPackage rec {
  pname = "marp-cli";
-  version = "4.5.0";
+  version = "4.5.1";

  src = fetchFromGitHub {
    owner = "marp-team";
    repo = "marp-cli";
    rev = "v${version}";
-    hash = "sha256-ZcidJIcZ3ZFsQFIGiY1sBeRE7GZkGPPQNHhRnti/EGY=";
+    hash = "sha256-MJALb8rH0xwFUa9KLq/zKuSJmbGum2aMFwx1AzDnCLA=";
  };

-  npmDepsHash = "sha256-qgEwuPGbepTpbkZj3Zp2Xd5TRJbXwukWO9LLriek9H4=";
+  npmDepsHash = "sha256-C9lssV3yOZJV3BHZ1MqDxFCT3PkYjjAyHTjQ/32ps3c=";
  npmPackFlags = [ "--ignore-scripts" ];
  makeCacheWritable = true;

--- a/pkgs/by-name/md/mdbook-graphviz/package.nix
+++ b/pkgs/by-name/md/mdbook-graphviz/package.nix
@@ -3,24 +3,30 @@
  fetchFromGitHub,
  rustPlatform,
  graphviz,
+  versionCheckHook,
+  nix-update-script,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "mdbook-graphviz";
-  version = "0.2.1";
+  version = "0.3.1";

  src = fetchFromGitHub {
    owner = "dylanowen";
    repo = "mdbook-graphviz";
    # Upstream has rewritten tags before:
    # https://github.com/dylanowen/mdbook-graphviz/issues/180
-    rev = "6e368ad745934fb9e10f224cfc0dc15d4f6fa114";
-    hash = "sha256-f02SOyU5REm+uP4/vB/1yG9M0Vg8ShF2hj5NKuh0jLU=";
+    rev = "36abbdff3d1f67128d81ff86336fe31619663abe";
+    hash = "sha256-uqNgP1rRgP6NecReqpinsg7u01gNDpIxX2qag8IyklY=";
  };

-  cargoHash = "sha256-A1pFifxshWynwA88iLTMOm21NKCH8fHl5nFiV4wEG8A=";
+  cargoHash = "sha256-OBCECv9ZN9xjkOestZbjCXNAA/hAl2u0AtfqxA+cV78=";

  nativeCheckInputs = [ graphviz ];
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  updateScript = nix-update-script { };

  meta = {
    description = "Preprocessor for mdbook, rendering Graphviz graphs to HTML at build time";
--- a/pkgs/by-name/mi/mindustry/deps.json
+++ b/pkgs/by-name/mi/mindustry/deps.json
@@ -7,14 +7,19 @@
   "module": "sha256-4OnGk4UsPE50E7Q9V9suDCsm0RF0SWFNKJoPSPU9r2c=",
   "pom": "sha256-UukU923dR7GWImrL4fdRbVD/rIci4YvxFNTdSZ35NP4="
  },
-  "Anuken#steamworks4j/da41c05b7a2a44c8625ca0ba7d6ca1a2e73f621a": {
-   "jar": "sha256-+8oDVVVbQSpioDAUXKm+vqe3YutsioD4eON7bp9JW0k=",
-   "pom": "sha256-F0jV/Pn+62IzshAyMgSj/kWaAcs98nH+iFEH4m0D8q0="
+  "Anuken#steamworks4j/185e76cfe630a6f0e1dd7b9bf57be41f6064a1f2": {
+   "jar": "sha256-u7DndjefpYoMZHGXyCEQ6SiCJHOxGhNdbbqysEi1G3E=",
+   "pom": "sha256-dAL3zB4KXhq2D0Mzkq7R9Ug9T17niuDIw2Km8ehzD3k="
  },
-  "Anuken/steamworks4j#build/da41c05b7a2a44c8625ca0ba7d6ca1a2e73f621a": {
-   "jar": "sha256-aUW6wELo6ixScFyjAAACxDsv1pc5Qy22JAxxHfu99ns=",
-   "module": "sha256-G4us5o9uhVf5uovjADWvn4uzac+lqhNaPIlQgLai2eg=",
-   "pom": "sha256-gqPxOnpZeJXAWsPvVZr5ja/aoMgxY/3Fp0zHNBuvh5I="
+  "Anuken/steamworks4j#build/185e76cfe630a6f0e1dd7b9bf57be41f6064a1f2": {
+   "jar": "sha256-uhqEu6uMWkqluaI0OmqapaHEdUDpNFvrySK220dgIbM=",
+   "module": "sha256-4PJLhuGy9BsqFXngQ3k2GrbRkrfSVRJkOFGptzodumI=",
+   "pom": "sha256-fRij0V1R7rsszmkBsrMUXvRGVBSgCiL5W9waDn5wXq4="
+  },
+  "Anuken/steamworks4j#server/185e76cfe630a6f0e1dd7b9bf57be41f6064a1f2": {
+   "jar": "sha256-el/H21OQGvL+6BIrKLoyUnFs3rL+Le3gf0yBPHYQTCQ=",
+   "module": "sha256-1v/ce/WcEA8YsOsEnianBhrS9wkVyCLYExa4gj8IawY=",
+   "pom": "sha256-mD//pNi+WFVq5CJzcF8MLEzGULfC+3h1XZ0Y3YgMIAU="
  }
 },
 "https://plugins.gradle.org/m2": {
--- a/pkgs/by-name/mi/mindustry/package.nix
+++ b/pkgs/by-name/mi/mindustry/package.nix
@@ -38,7 +38,7 @@

 let
  pname = "mindustry";
-  version = "160.4";
+  version = "160.5";
  buildVersion = makeBuildVersion version;

  jdk = jdk17;
@@ -48,14 +48,14 @@ let
    owner = "Anuken";
    repo = "Mindustry";
    tag = "v${version}";
-    hash = "sha256-gWAsYavRkRfdJ89IHrbK89Jwp/Whvu2FnswlJBb1rfQ=";
+    hash = "sha256-mXcRjGdge3gdAS4+iQRymj7CClcCqcKHCY/LOX6aM90=";
  };
  Arc = fetchFromGitHub {
    name = "Arc-source";
    owner = "Anuken";
    repo = "Arc";
    tag = "v${version}";
-    hash = "sha256-V4j0VNwcc1C5xaWiE1cPEKLah+ba3ahPANPEVi43cCE=";
+    hash = "sha256-eddeIEpI8EEKeZgUq/vzsFN6hMgCQZILxL18yNXynoU=";
  };
  soloud = fetchFromGitHub {
    owner = "Anuken";
--- a/pkgs/by-name/mu/mullvad-vpn/package.nix
+++ b/pkgs/by-name/mu/mullvad-vpn/package.nix
@@ -18,7 +18,7 @@ buildNpmPackage (finalAttrs: {
  inherit (mullvad) src version;

  nodejs = nodejs_22;
-  npmDepsHash = "sha256-9IfPNfo3MJ7Ipvvlqm76iTh1d1RYFJfVZiKlh5ia8TM=";
+  npmDepsHash = "sha256-CKhPOV0Nd/YoTXqbTQOFrKp3QUacrTJ/B+oEkuFMWsM=";

  __structuredAttrs = true;
  strictDeps = true;
--- a/pkgs/by-name/mu/mullvad/package.nix
+++ b/pkgs/by-name/mu/mullvad/package.nix
@@ -17,7 +17,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "mullvad";
-  version = "2026.4";
+  version = "2026.5";

  __structuredAttrs = true;
  strictDeps = true;
@@ -27,10 +27,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    repo = "mullvadvpn-app";
    tag = finalAttrs.version;
    fetchSubmodules = true;
-    hash = "sha256-JEGxRNhPo4O7QJD2t1dMlmy/yo7y7TEpNz6EkpPb2U0=";
+    hash = "sha256-ZhXOzoAPIftwvdMskwC0kbwfjPTK3b+0pP9ZI/rNn4E=";
  };

-  cargoHash = "sha256-OZOoH6dgC9xU6l+2lt5m4+Pi4vWUumEK68v9S2o4IB4=";
+  cargoHash = "sha256-qOBCfswWGwP7pWvd0ZAKTX7kYSJTMeJ5z1jHYjHyWZs=";

  cargoBuildFlags =
    let
--- a/pkgs/by-name/mu/multimon-ng/package.nix
+++ b/pkgs/by-name/mu/multimon-ng/package.nix
@@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "multimon-ng";
-  version = "1.6.0";
+  version = "1.6.1";

  src = fetchFromGitHub {
    owner = "EliasOenal";
    repo = "multimon-ng";
    rev = finalAttrs.version;
-    sha256 = "sha256-elDyVU95rNt0b698qmzmkiD4JG2Jt5+gMW31BlQO7Vo=";
+    sha256 = "sha256-FxX01+bFcca+wvnilOV4xJx1bSV9lxy83EhpwWhi/Cs=";
  };

  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
--- a/pkgs/by-name/ni/nix-graph/package.nix
+++ b/pkgs/by-name/ni/nix-graph/package.nix
@@ -6,14 +6,14 @@

 buildGoModule (finalAttrs: {
  pname = "nix-graph";
-  version = "0.0.6";
+  version = "0.1.1";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "AlexAntonik";
    repo = "nix-graph";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-YyXtVTBExTTOMv1eqYlhzbAhPqkdHKqO3f7y9C/Sq9k=";
+    hash = "sha256-gXeZzGAZeUh9F4tLZ4wKrJbEuY6XrqWfgnmpYyE0C00=";
  };

  vendorHash = null;
--- a/pkgs/by-name/no/notonoto-35/package.nix
+++ b/pkgs/by-name/no/notonoto-35/package.nix
@@ -1,64 +0,0 @@
-{
-  lib,
-  fetchFromGitHub,
-  stdenvNoCC,
-  fontforge,
-  python3,
-}:
-
-let
-  python3' = python3.withPackages (
-    ps: with ps; [
-      fonttools
-      ttfautohint-py
-    ]
-  );
-in
-
-stdenvNoCC.mkDerivation rec {
-  pname = "notonoto-35";
-  version = "0.0.3";
-
-  src = fetchFromGitHub {
-    owner = "yuru7";
-    repo = "NOTONOTO";
-    tag = "v${version}";
-    hash = "sha256-1dbx4yC8gL41OEAE/LNDyoDb4xhAwV5h8oRmdlPULUo=";
-  };
-
-  # ttfautohint: unrecognized option '--epoch'
-  postPatch = ''
-    substituteInPlace fonttools_script.py \
-      --replace-fail 'print("exec hinting", options_)' 'options_.pop("epoch", None)'
-  '';
-
-  nativeBuildInputs = [
-    fontforge
-    python3'
-  ];
-
-  buildPhase = ''
-    runHook preBuild
-
-    fontforge --script fontforge_script.py --35
-    python3 ./fonttools_script.py
-
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm444 build/*.ttf -t $out/share/fonts/truetype/notonoto-35
-
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "Programming font that combines Noto Sans Mono and Noto Sans JP";
-    homepage = "https://github.com/yuru7/NOTONOTO";
-    license = lib.licenses.ofl;
-    maintainers = with lib.maintainers; [ genga898 ];
-    platforms = lib.platforms.all;
-  };
-}
--- a/pkgs/by-name/no/notonoto-console/package.nix
+++ b/pkgs/by-name/no/notonoto-console/package.nix
@@ -1,64 +0,0 @@
-{
-  lib,
-  fetchFromGitHub,
-  stdenvNoCC,
-  fontforge,
-  python3,
-}:
-
-let
-  python3' = python3.withPackages (
-    ps: with ps; [
-      fonttools
-      ttfautohint-py
-    ]
-  );
-in
-
-stdenvNoCC.mkDerivation rec {
-  pname = "notonoto-console";
-  version = "0.0.3";
-
-  src = fetchFromGitHub {
-    owner = "yuru7";
-    repo = "NOTONOTO";
-    tag = "v${version}";
-    hash = "sha256-1dbx4yC8gL41OEAE/LNDyoDb4xhAwV5h8oRmdlPULUo=";
-  };
-
-  # ttfautohint: unrecognized option '--epoch'
-  postPatch = ''
-    substituteInPlace fonttools_script.py \
-      --replace-fail 'print("exec hinting", options_)' 'options_.pop("epoch", None)'
-  '';
-
-  nativeBuildInputs = [
-    fontforge
-    python3'
-  ];
-
-  buildPhase = ''
-    runHook preBuild
-
-    fontforge --script fontforge_script.py --console
-    python3 ./fonttools_script.py
-
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm444 build/*.ttf -t $out/share/fonts/truetype/notonoto-console
-
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "Programming font that combines Noto Sans Mono and Noto Sans JP";
-    homepage = "https://github.com/yuru7/NOTONOTO";
-    license = lib.licenses.ofl;
-    maintainers = with lib.maintainers; [ genga898 ];
-    platforms = lib.platforms.all;
-  };
-}
--- a/pkgs/by-name/no/notonoto-hs-35/package.nix
+++ b/pkgs/by-name/no/notonoto-hs-35/package.nix
@@ -1,64 +0,0 @@
-{
-  lib,
-  fetchFromGitHub,
-  stdenvNoCC,
-  fontforge,
-  python3,
-}:
-
-let
-  python3' = python3.withPackages (
-    ps: with ps; [
-      fonttools
-      ttfautohint-py
-    ]
-  );
-in
-
-stdenvNoCC.mkDerivation rec {
-  pname = "notonoto-hs-35";
-  version = "0.0.3";
-
-  src = fetchFromGitHub {
-    owner = "yuru7";
-    repo = "NOTONOTO";
-    tag = "v${version}";
-    hash = "sha256-1dbx4yC8gL41OEAE/LNDyoDb4xhAwV5h8oRmdlPULUo=";
-  };
-
-  # ttfautohint: unrecognized option '--epoch'
-  postPatch = ''
-    substituteInPlace fonttools_script.py \
-      --replace-fail 'print("exec hinting", options_)' 'options_.pop("epoch", None)'
-  '';
-
-  nativeBuildInputs = [
-    fontforge
-    python3'
-  ];
-
-  buildPhase = ''
-    runHook preBuild
-
-    fontforge --script fontforge_script.py --hidden-zenkaku-space --35
-    python3 ./fonttools_script.py
-
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm444 build/*.ttf -t $out/share/fonts/truetype/notonoto-hs-35
-
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "Programming font that combines Noto Sans Mono and Noto Sans JP";
-    homepage = "https://github.com/yuru7/NOTONOTO";
-    license = lib.licenses.ofl;
-    maintainers = with lib.maintainers; [ genga898 ];
-    platforms = lib.platforms.all;
-  };
-}
--- a/pkgs/by-name/no/notonoto-hs-console/package.nix
+++ b/pkgs/by-name/no/notonoto-hs-console/package.nix
@@ -1,64 +0,0 @@
-{
-  lib,
-  fetchFromGitHub,
-  stdenvNoCC,
-  fontforge,
-  python3,
-}:
-
-let
-  python3' = python3.withPackages (
-    ps: with ps; [
-      fonttools
-      ttfautohint-py
-    ]
-  );
-in
-
-stdenvNoCC.mkDerivation rec {
-  pname = "notonoto-hs-console";
-  version = "0.0.3";
-
-  src = fetchFromGitHub {
-    owner = "yuru7";
-    repo = "NOTONOTO";
-    tag = "v${version}";
-    hash = "sha256-1dbx4yC8gL41OEAE/LNDyoDb4xhAwV5h8oRmdlPULUo=";
-  };
-
-  # ttfautohint: unrecognized option '--epoch'
-  postPatch = ''
-    substituteInPlace fonttools_script.py \
-      --replace-fail 'print("exec hinting", options_)' 'options_.pop("epoch", None)'
-  '';
-
-  nativeBuildInputs = [
-    fontforge
-    python3'
-  ];
-
-  buildPhase = ''
-    runHook preBuild
-
-    fontforge --script fontforge_script.py --hidden-zenkaku-space --console
-    python3 ./fonttools_script.py
-
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm444 build/*.ttf -t $out/share/fonts/truetype/notonoto-hs-console
-
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "Programming font that combines Noto Sans Mono and Noto Sans JP";
-    homepage = "https://github.com/yuru7/NOTONOTO";
-    license = lib.licenses.ofl;
-    maintainers = with lib.maintainers; [ genga898 ];
-    platforms = lib.platforms.all;
-  };
-}
--- a/pkgs/by-name/no/notonoto-hs/package.nix
+++ b/pkgs/by-name/no/notonoto-hs/package.nix
@@ -1,64 +0,0 @@
-{
-  lib,
-  fetchFromGitHub,
-  stdenvNoCC,
-  fontforge,
-  python3,
-}:
-
-let
-  python3' = python3.withPackages (
-    ps: with ps; [
-      fonttools
-      ttfautohint-py
-    ]
-  );
-in
-
-stdenvNoCC.mkDerivation rec {
-  pname = "notonoto-hs";
-  version = "0.0.3";
-
-  src = fetchFromGitHub {
-    owner = "yuru7";
-    repo = "NOTONOTO";
-    tag = "v${version}";
-    hash = "sha256-1dbx4yC8gL41OEAE/LNDyoDb4xhAwV5h8oRmdlPULUo=";
-  };
-
-  # ttfautohint: unrecognized option '--epoch'
-  postPatch = ''
-    substituteInPlace fonttools_script.py \
-      --replace-fail 'print("exec hinting", options_)' 'options_.pop("epoch", None)'
-  '';
-
-  nativeBuildInputs = [
-    fontforge
-    python3'
-  ];
-
-  buildPhase = ''
-    runHook preBuild
-
-    fontforge --script fontforge_script.py --hidden-zenkaku-space
-    python3 ./fonttools_script.py
-
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm444 build/*.ttf -t $out/share/fonts/truetype/notonoto-hs
-
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "Programming font that combines Noto Sans Mono and Noto Sans JP";
-    homepage = "https://github.com/yuru7/NOTONOTO";
-    license = lib.licenses.ofl;
-    maintainers = with lib.maintainers; [ genga898 ];
-    platforms = lib.platforms.all;
-  };
-}
--- a/pkgs/by-name/no/notonoto/package.nix
+++ b/pkgs/by-name/no/notonoto/package.nix
@@ -4,6 +4,9 @@
  stdenvNoCC,
  fontforge,
  python3,
+  width35 ? false,
+  console ? false,
+  hideZenkakuSpace ? false,
 }:

 let
@@ -13,23 +16,33 @@ let
      ttfautohint-py
    ]
  );
+  fontforgeArgs =
+    lib.optional width35 "--35"
+    ++ lib.optional console "--console"
+    ++ lib.optional hideZenkakuSpace "--hidden-zenkaku-space";
 in

-stdenvNoCC.mkDerivation rec {
-  pname = "notonoto";
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname =
+    "notonoto"
+    + lib.optionalString hideZenkakuSpace "-hs"
+    + lib.optionalString width35 "-35"
+    + lib.optionalString console "-console";
  version = "0.0.3";

  src = fetchFromGitHub {
    owner = "yuru7";
    repo = "NOTONOTO";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-1dbx4yC8gL41OEAE/LNDyoDb4xhAwV5h8oRmdlPULUo=";
  };

  # ttfautohint: unrecognized option '--epoch'
  postPatch = ''
    substituteInPlace fonttools_script.py \
-      --replace-fail 'print("exec hinting", options_)' 'options_.pop("epoch", None)'
+      --replace-fail 'print("exec hinting", options_)' 'options_.pop("epoch", None)' \
+      --replace-fail 'fix_cmap_table(xml, style, variant)' \
+                     'pass  # FontTools >= 4.58.1 already preserves cmap format 14'
  '';

  nativeBuildInputs = [
@@ -40,7 +53,7 @@ stdenvNoCC.mkDerivation rec {
  buildPhase = ''
    runHook preBuild

-    fontforge --script fontforge_script.py
+    fontforge --script fontforge_script.py ${lib.escapeShellArgs fontforgeArgs}
    python3 ./fonttools_script.py

    runHook postBuild
@@ -49,7 +62,7 @@ stdenvNoCC.mkDerivation rec {
  installPhase = ''
    runHook preInstall

-    install -Dm444 build/*.ttf -t $out/share/fonts/truetype/notonoto
+    install -Dm444 build/*.ttf -t $out/share/fonts/truetype/${finalAttrs.pname}

    runHook postInstall
  '';
@@ -61,4 +74,4 @@ stdenvNoCC.mkDerivation rec {
    maintainers = with lib.maintainers; [ genga898 ];
    platforms = lib.platforms.all;
  };
-}
+})
--- a/pkgs/by-name/oc/ocm/package.nix
+++ b/pkgs/by-name/oc/ocm/package.nix
@@ -10,16 +10,16 @@

 buildGoModule (finalAttrs: {
  pname = "ocm";
-  version = "1.0.15";
+  version = "1.0.17";

  src = fetchFromGitHub {
    owner = "openshift-online";
    repo = "ocm-cli";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-/WSWifl5UH34d2/I/874ZTHzJwI0QyoXq5QGuz4dzZE=";
+    sha256 = "sha256-x/r6cdz2bdSwyO/ecUeHtdtXQUaXmpTUkAHIhIRAPlA=";
  };

-  vendorHash = "sha256-1+H2DoSsPqg6JXWLVFyQ4eBTU3EqySTA2fe9BBWbjMg=";
+  vendorHash = "sha256-l/9Baqskn5dnlT5Kdo+GCTKkaRQ55iIf3eCTPgR4foE=";

  # Strip the final binary.
  ldflags = [
--- a/pkgs/by-name/oc/octoprint/plugins.nix
+++ b/pkgs/by-name/oc/octoprint/plugins.nix
@@ -500,7 +500,7 @@ in
    meta = {
      description = "Simple plugin that add an emergency stop button on NavBar of OctoPrint";
      homepage = "https://github.com/Sebclem/OctoPrint-SimpleEmergencyStop";
-      license = lib.licenses.agpl3Only;
+      license = lib.licenses.mit;
      maintainers = with lib.maintainers; [ WhittlesJr ];
    };
  };
--- a/pkgs/by-name/pa/pam_tmpdir/package.nix
+++ b/pkgs/by-name/pa/pam_tmpdir/package.nix
@@ -8,19 +8,19 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "pam_tmpdir";
-  version = "0.09";
+  version = "0.11";

  src = fetchurl {
    url = "https://deb.debian.org/debian/pool/main/p/pam-tmpdir/pam-tmpdir_${finalAttrs.version}.tar.gz";
-    hash = "sha256-MXa1CY6alD83E/Q+MJmsv8NaImWd0pPJKZd/7nbe4J8=";
+    hash = "sha256-SuMOKSsQ68zJBhhFi+5hgt3nkus73mh8jMPZhmMkzfM=";
  };

  postPatch = ''
    substituteInPlace pam_tmpdir.c \
-      --replace /sbin/pam-tmpdir-helper $out/sbin/pam-tmpdir-helper
+      --replace-fail '/usr/libexec/pam-tmpdir/pam-tmpdir-helper' "$out/libexec/pam-tmpdir/pam-tmpdir-helper"

    # chmod/chown fails on files in /nix/store
-    sed -i -E -e '/^\s*(chmod|chown)/d' Makefile.{am,in}
+    sed -i -E -e '/^\s*(chmod|chown)/d' Makefile.am

    # the symlinks in m4 assume FHS
    rm -rf m4
--- a/pkgs/by-name/pa/par-lang/package.nix
+++ b/pkgs/by-name/pa/par-lang/package.nix
@@ -19,13 +19,13 @@

 rustPlatform.buildRustPackage {
  pname = "par-lang";
-  version = "0-unstable-2026-09-07";
+  version = "0-unstable-2026-09-20";

  src = fetchFromGitHub {
    owner = "par-team";
    repo = "par-lang";
-    rev = "cb119dd96389ff48c98d35cedb407d279fbc8b60";
-    hash = "sha256-7NcBebcXTviVxTGZURtKbROsiWqep93CoT/TNNUtWGw=";
+    rev = "dc0d3dfecd483b6df960d9d4a00676d0449be4cf";
+    hash = "sha256-7IoXCRuCyTuWBocd0xM33t8JySIoS7NaCnNdj9KWwI4=";
  };

  cargoHash = "sha256-wRgSLBFQKsv8mJL0mdwkcHJqMKhuVj0rcfqvm6JNlSM=";
--- a/pkgs/by-name/pi/pixinsight/default.nix
+++ b/pkgs/by-name/pi/pixinsight/default.nix
@@ -5,17 +5,16 @@
  bubblewrap,
  fakeroot,
  unixtools,
-  cudaSupport,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "pixinsight";
-  version = "1.9.4-20260621";
+  version = "1.9.5-20260917";

  src = requireFile {
-    name = "PI-linux-x64-${finalAttrs.version}-c.tar.xz";
+    name = "PI-linux-x64-gpu-${finalAttrs.version}-c.tar.xz";
    url = "http://pixinsight.com";
-    hash = "sha256-ITJq6q7rLBYe1+6jk2ZtpOSu5M5Z5bRzFPu06PPd7UI=";
+    hash = "sha256-Aykg4++BKHTXJcHLr6/QwrZjKF6WmMxC1zw0x8DDrbQ=";
  };

  nativeBuildInputs = [
@@ -59,12 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
        --install-mime-dir=$out/share/mime \
        --install-icons-dir=$out/share/icons/hicolor \
        --no-bin-launcher"
-  ''
-  + lib.optionalString cudaSupport ''
-    # Remove bundled libtensorflow-cpu files
-    rm -f $out/opt/PixInsight/bin/lib/libtensorflow*
-  ''
-  + ''
+
    runHook postInstall
  '';

--- a/pkgs/by-name/pi/pixinsight/libtensorflow-gpu.nix
+++ b/pkgs/by-name/pi/pixinsight/libtensorflow-gpu.nix
@@ -1,56 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  autoPatchelfHook,
-  cudaPackages,
-}:
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "libtensorflow-gpu";
-  version = "2.18.1";
-
-  src = fetchurl {
-    url = "https://storage.googleapis.com/tensorflow/versions/${finalAttrs.version}/${finalAttrs.pname}-linux-x86_64.tar.gz";
-    hash = "sha256-9k7DA53E/hh9zzMhX0D6BZOZWwOoiNEi/tdYHONIFeU=";
-  };
-
-  nativeBuildInputs = [
-    autoPatchelfHook
-  ];
-
-  buildInputs = with cudaPackages; [
-    cudatoolkit
-    cudnn
-  ];
-
-  sourceRoot = ".";
-
-  # Unpack tarball to subdir, preventing copying `env-vars` to $out in `installPhase`
-  preUnpack = ''
-    mkdir source
-    cd source
-  '';
-
-  dontPatch = true;
-  dontConfigure = true;
-  dontBuild = true;
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out
-    cp -pr --reflink=auto -- . $out
-
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "Computation using data flow graphs for scalable machine learning";
-    homepage = "http://tensorflow.org";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ kulczwoj ];
-    platforms = [ "x86_64-linux" ];
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-  };
-})
--- a/pkgs/by-name/pi/pixinsight/package.nix
+++ b/pkgs/by-name/pi/pixinsight/package.nix
@@ -2,7 +2,6 @@
  lib,
  callPackage,
  buildFHSEnv,
-  cudaPackages,
  config,
  cudaSupport ? config.cudaSupport,

@@ -28,16 +27,7 @@
 }:

 let
-  pixinsight = callPackage ./. { inherit cudaSupport; };
-
-  # For CUDA support (PixInsight ships with `libtensorflow-cpu`)
-  #
-  # PixInsight uses C API `libtensorflow`, which differs from library shipped
-  # with `tensorflow-bin`: in particular it contains `VERS_1.0` embedded.
-  # Variants from `tensorflow-bin` don't embed it and are rejected as
-  # incompatible, when PixInsight installs plugins to its internal runtime
-  # environment and loads their dependencies.
-  libtensorflow-gpu = callPackage ./libtensorflow-gpu.nix { };
+  pixinsight = callPackage ./. { };

  deployPath = "$HOME/.local/share/pixinsight";
  storePathFile = "${deployPath}/opt/PixInsight/.store-path";
@@ -103,13 +93,10 @@ buildFHSEnv {
      # libxcb-cursor # Bundled by PixInsight
    ])
    ++ lib.optionals cudaSupport (
+      with pkgs.cudaPackages;
      [
-        libtensorflow-gpu
-      ]
-      ++ (with pkgs.cudaPackages; [
        cudatoolkit
-        cudnn
-      ])
+      ]
    );

  extraInstallCommands = ''
@@ -152,16 +139,9 @@ buildFHSEnv {
      ''--ro-bind "${pixinsight}"/opt /opt''
    ];

-  profile = lib.optionalString cudaSupport ''
-    export XLA_FLAGS=--xla_gpu_cuda_data_dir=${cudaPackages.cudatoolkit}
-  '';
-
  runScript = "/opt/PixInsight/bin/PixInsight.sh";

-  passthru = {
-    inherit libtensorflow-gpu;
-    unwrapped = pixinsight;
-  };
+  passthru.unwrapped = pixinsight;

  meta = {
    inherit (pixinsight.meta)
--- a/pkgs/by-name/py/pychess/package.nix
+++ b/pkgs/by-name/py/pychess/package.nix
@@ -13,14 +13,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "pychess";
-  version = "1.1.0";
+  version = "1.2.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "pychess";
    repo = "pychess";
    rev = finalAttrs.version;
-    hash = "sha256-MSz5RiPpmlySjljhDlkvXtO6t3UO58zx+uGsV9R6F1A=";
+    hash = "sha256-JnuXk9xYPTzcDTjdFDU5G+YFIgvA9unP8LZNAkpQwfY=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/qu/quiet/package.nix
+++ b/pkgs/by-name/qu/quiet/package.nix
@@ -13,7 +13,7 @@

 let
  pname = "quiet";
-  version = "7.0.1";
+  version = "9.0.2";

  meta = {
    description = "Private, p2p alternative to Slack and Discord built on Tor & IPFS";
@@ -37,9 +37,12 @@ let
  linux = appimageTools.wrapType2 {
    inherit pname version passthru;

+    # Quiet invokes pgrep and ps when managing its bundled Tor process. Without them, Tor startup fails with command not found.
+    extraPkgs = pkgs: [ pkgs.procps ];
+
    src = fetchurl {
      url = "https://github.com/TryQuiet/quiet/releases/download/@quiet/desktop@${version}/Quiet-${version}.AppImage";
-      hash = "sha256-B1K8/aTs68xs4+1KRzrteFfq7RcrbQubPcM+Mds3hN4=";
+      hash = "sha256-CRQoTc7BbsWeA+6+X5ZjPYHNT4dqd1xZb6b2P83kC90=";
    };

    meta = meta // {
@@ -51,8 +54,8 @@ let
    inherit pname version passthru;

    src = fetchurl {
-      url = "https://github.com/TryQuiet/quiet/releases/download/@quiet/desktop@${version}/Quiet-${version}.dmg";
-      hash = "sha256-QT6t2FSKNxS2c+PbqGlPxGvTpMV+CuNUi/7ccgZ2nAc=";
+      url = "https://github.com/TryQuiet/quiet/releases/download/@quiet/desktop@${version}/Quiet-${version}-arm64.dmg";
+      hash = "sha256-G4Hj3YTsVX5Q3x4RnpXI6FPovm9fKXrfaUsZJ5EEUl8=";
    };

    nativeBuildInputs = [
--- a/pkgs/by-name/st/stable-diffusion-cpp/package.nix
+++ b/pkgs/by-name/st/stable-diffusion-cpp/package.nix
@@ -41,7 +41,7 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
  pname = "stable-diffusion-cpp";
-  version = "master-849-d04e895";
+  version = "master-874-656a135";

  outputs = [
    "out"
@@ -52,7 +52,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
    owner = "leejet";
    repo = "stable-diffusion.cpp";
    tag = finalAttrs.version;
-    hash = "sha256-87tEPKu8xq611fa2/tXvWujl3dypniL+DVrczKP34Qs=";
+    hash = "sha256-sieaItMxOIjrILpdHRi5Q29la8gcvCAjdgNt6AuwjJ8=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/te/tea-dash/package.nix
+++ b/pkgs/by-name/te/tea-dash/package.nix
@@ -9,17 +9,17 @@

 buildGoModule (finalAttrs: {
  pname = "tea-dash";
-  version = "0.3.7";
+  version = "0.3.8";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "gbarany";
    repo = "tea-dash";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-SbbrPWL33PrD02S58c50Gk9xOiu/5pRuccK9vrKViqE=";
+    hash = "sha256-0MUzkbQzyp1TRZaHnCmIR+1MjBzmqBndaBmVTBMCPGI=";
  };

-  vendorHash = "sha256-pnZbFXZX34xUUUMCR8zSplbBnwdYfrPDRssHQDcBA6o=";
+  vendorHash = "sha256-CNty+TgwujfTguhwIXurtz2ILBnGYonVjgrJOtXO644=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/te/teams-for-linux/package.nix
+++ b/pkgs/by-name/te/teams-for-linux/package.nix
@@ -5,7 +5,7 @@
  fetchFromGitHub,
  alsa-utils,
  copyDesktopItems,
-  electron_42,
+  electron_43,
  libicns,
  makeDesktopItem,
  makeWrapper,
@@ -15,7 +15,7 @@
 }:

 let
-  electron = electron_42;
+  electron = electron_43;
 in
 buildNpmPackage rec {
  pname = "teams-for-linux";
--- a/pkgs/by-name/vi/vikunja-desktop/package.nix
+++ b/pkgs/by-name/vi/vikunja-desktop/package.nix
@@ -1,155 +1 @@
-{
-  lib,
-  stdenv,
-  makeWrapper,
-  makeDesktopItem,
-  copyDesktopItems,
-  darwin,
-  pnpm_10,
-  pnpmConfigHook,
-  nodejs,
-  perl,
-  electron,
-  nix-update-script,
-  fetchFromGitHub,
-  fetchPnpmDeps,
-  vikunja,
-}:
-
-let
-  executableName = "vikunja-desktop";
-  version = "2.6.0";
-  src = fetchFromGitHub {
-    owner = "go-vikunja";
-    repo = "vikunja";
-    rev = "v${version}";
-    hash = "sha256-Xh1ozUTOVqywk0i8xQWkG/bPRgPH9EABjRW8p4do1mE=";
-  };
-in
-stdenv.mkDerivation (finalAttrs: {
-  name = "vikunja-desktop-${version}";
-  pname = finalAttrs.name;
-  inherit version src;
-
-  sourceRoot = "${finalAttrs.src.name}/desktop";
-
-  pnpmDeps = fetchPnpmDeps {
-    inherit (finalAttrs)
-      pname
-      version
-      src
-      sourceRoot
-      ;
-    pnpm = pnpm_10;
-    fetcherVersion = 4;
-    hash = "sha256-RpME/0lU8i+D8erEkTfA0cXrEs8LRZvNdfU8e3X366Y=";
-  };
-
-  env = {
-    ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
-  };
-
-  nativeBuildInputs = [
-    makeWrapper
-    nodejs
-    perl
-    pnpm_10
-    pnpmConfigHook
-    vikunja.passthru.frontend
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isLinux [ copyDesktopItems ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    darwin.autoSignDarwinBinariesHook
-  ];
-
-  buildPhase = ''
-    runHook preBuild
-
-    sed -i "s/\$${version}/${version}/g" package.json
-    sed -i "s/\"version\": \".*\"/\"version\": \"${version}\"/" package.json
-    cp -r '${vikunja.passthru.frontend}' frontend
-    chmod -R u+w frontend
-
-    # Replicates step 2 of upstream's desktop/build.js: the desktop CSP is
-    # script-src 'self', which blocks the inline window.API_URL script in index.html.
-    perl -0pi -e 's|<script>(?:(?!</script>).)*?window\.API_URL(?:(?!</script>).)*?</script>|<script src="/api-url.js"></script>|s' frontend/index.html
-    echo "window.API_URL = '''" > frontend/api-url.js
-
-    electronDist="${electron.dist}"
-    ${lib.optionalString stdenv.hostPlatform.isDarwin ''
-      electronDist="$(mktemp -d)"
-      cp -R "${electron.dist}/." "$electronDist"
-      chmod -R u+w "$electronDist"
-      export CSC_IDENTITY_AUTO_DISCOVERY=false
-    ''}
-    pnpm run pack \
-      -c.electronDist="$electronDist" \
-      -c.electronVersion="${electron.version}" \
-      ${lib.optionalString stdenv.hostPlatform.isDarwin "-c.mac.identity=null"}
-
-    runHook postBuild
-  '';
-
-  doCheck = false;
-
-  installPhase = ''
-    runHook preInstall
-
-    ${lib.optionalString stdenv.hostPlatform.isLinux ''
-      mkdir -p "$out/share/lib/vikunja-desktop"
-      cp -r ./dist/*-unpacked/{locales,resources{,.pak}} "$out/share/lib/vikunja-desktop"
-      cp -r ./node_modules "$out/share/lib/vikunja-desktop/resources"
-
-      install -Dm644 "build/icon.png" "$out/share/icons/hicolor/256x256/apps/vikunja-desktop.png"
-
-      # use makeShellWrapper (instead of the makeBinaryWrapper provided by wrapGAppsHook3) for proper shell variable expansion
-      # see https://github.com/NixOS/nixpkgs/issues/172583
-      makeShellWrapper "${lib.getExe electron}" "$out/bin/vikunja-desktop" \
-        --add-flags "$out/share/lib/vikunja-desktop/resources/app.asar" \
-        "''${gappsWrapperArgs[@]}" \
-        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=UseOzonePlatform,WaylandWindowDecorations,WebRTCPipeWireCapturer}}" \
-        --set-default ELECTRON_IS_DEV 0 \
-        --inherit-argv0
-    ''}
-
-    ${lib.optionalString stdenv.hostPlatform.isDarwin ''
-      mkdir -p "$out/Applications" "$out/bin"
-      mv ./dist/mac*/*.app "$out/Applications"
-      makeWrapper \
-        "$out/Applications/Vikunja Desktop.app/Contents/MacOS/Vikunja Desktop" \
-        "$out/bin/vikunja-desktop"
-    ''}
-
-    runHook postInstall
-  '';
-
-  passthru.updateScript = nix-update-script { };
-
-  desktopItems = [
-    (makeDesktopItem {
-      name = "vikunja-desktop";
-      exec = "${executableName} %U";
-      icon = "vikunja-desktop";
-      terminal = false;
-      desktopName = "Vikunja Desktop";
-      genericName = "To-Do list app";
-      comment = finalAttrs.meta.description;
-      categories = [
-        "ProjectManagement"
-        "Office"
-      ];
-      mimeTypes = [
-        "x-scheme-handler/vikunja-desktop"
-      ];
-    })
-  ];
-
-  meta = {
-    description = "Desktop App of the Vikunja to-do list app";
-    homepage = "https://vikunja.io/";
-    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ kolaente ];
-    mainProgram = "vikunja-desktop";
-    inherit (electron.meta) platforms;
-  };
-})
+{ vikunja }: vikunja.passthru.desktop
--- a/pkgs/by-name/vi/vikunja/desktop.nix
+++ b/pkgs/by-name/vi/vikunja/desktop.nix
@@ -0,0 +1,146 @@
+{
+  frontend,
+  meta,
+  src,
+  version,
+
+  lib,
+  stdenv,
+  makeWrapper,
+  makeDesktopItem,
+  copyDesktopItems,
+  darwin,
+  pnpm_10,
+  pnpmConfigHook,
+  nodejs,
+  perl,
+  electron,
+  nix-update-script,
+  fetchPnpmDeps,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  name = "vikunja-desktop-${version}";
+  pname = finalAttrs.name;
+  inherit version src;
+
+  sourceRoot = "${finalAttrs.src.name}/desktop";
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      sourceRoot
+      ;
+    pnpm = pnpm_10;
+    fetcherVersion = 4;
+    hash = "sha256-RpME/0lU8i+D8erEkTfA0cXrEs8LRZvNdfU8e3X366Y=";
+  };
+
+  env = {
+    ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
+  };
+
+  nativeBuildInputs = [
+    makeWrapper
+    nodejs
+    perl
+    pnpm_10
+    pnpmConfigHook
+    frontend
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ copyDesktopItems ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    darwin.autoSignDarwinBinariesHook
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    sed -i "s/\$${version}/${version}/g" package.json
+    sed -i "s/\"version\": \".*\"/\"version\": \"${version}\"/" package.json
+    cp -r '${frontend}' frontend
+    chmod -R u+w frontend
+
+    # Replicates step 2 of upstream's desktop/build.js: the desktop CSP is
+    # script-src 'self', which blocks the inline window.API_URL script in index.html.
+    perl -0pi -e 's|<script>(?:(?!</script>).)*?window\.API_URL(?:(?!</script>).)*?</script>|<script src="/api-url.js"></script>|s' frontend/index.html
+    echo "window.API_URL = '''" > frontend/api-url.js
+
+    electronDist="${electron.dist}"
+    ${lib.optionalString stdenv.hostPlatform.isDarwin ''
+      electronDist="$(mktemp -d)"
+      cp -R "${electron.dist}/." "$electronDist"
+      chmod -R u+w "$electronDist"
+      export CSC_IDENTITY_AUTO_DISCOVERY=false
+    ''}
+    pnpm run pack \
+      -c.electronDist="$electronDist" \
+      -c.electronVersion="${electron.version}" \
+      ${lib.optionalString stdenv.hostPlatform.isDarwin "-c.mac.identity=null"}
+
+    runHook postBuild
+  '';
+
+  doCheck = false;
+
+  installPhase = ''
+    runHook preInstall
+
+    ${lib.optionalString stdenv.hostPlatform.isLinux ''
+      mkdir -p "$out/share/lib/vikunja-desktop"
+      cp -r ./dist/*-unpacked/{locales,resources{,.pak}} "$out/share/lib/vikunja-desktop"
+      cp -r ./node_modules "$out/share/lib/vikunja-desktop/resources"
+
+      install -Dm644 "build/icon.png" "$out/share/icons/hicolor/256x256/apps/vikunja-desktop.png"
+
+      # use makeShellWrapper (instead of the makeBinaryWrapper provided by wrapGAppsHook3) for proper shell variable expansion
+      # see https://github.com/NixOS/nixpkgs/issues/172583
+      makeShellWrapper "${lib.getExe electron}" "$out/bin/vikunja-desktop" \
+        --add-flags "$out/share/lib/vikunja-desktop/resources/app.asar" \
+        "''${gappsWrapperArgs[@]}" \
+        --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=UseOzonePlatform,WaylandWindowDecorations,WebRTCPipeWireCapturer}}" \
+        --set-default ELECTRON_IS_DEV 0 \
+        --inherit-argv0
+    ''}
+
+    ${lib.optionalString stdenv.hostPlatform.isDarwin ''
+      mkdir -p "$out/Applications" "$out/bin"
+      mv ./dist/mac*/*.app "$out/Applications"
+      makeWrapper \
+        "$out/Applications/Vikunja Desktop.app/Contents/MacOS/Vikunja Desktop" \
+        "$out/bin/vikunja-desktop"
+    ''}
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "vikunja-desktop";
+      exec = "vikunja-desktop %U";
+      icon = "vikunja-desktop";
+      terminal = false;
+      desktopName = "Vikunja Desktop";
+      genericName = "To-Do list app";
+      comment = finalAttrs.meta.description;
+      categories = [
+        "ProjectManagement"
+        "Office"
+      ];
+      mimeTypes = [
+        "x-scheme-handler/vikunja-desktop"
+      ];
+    })
+  ];
+
+  meta = meta // {
+    description = "Desktop App of the Vikunja to-do list app";
+    license = lib.licenses.gpl3Plus;
+    mainProgram = "vikunja-desktop";
+    inherit (electron.meta) platforms;
+  };
+})
--- a/pkgs/by-name/vi/vikunja/package.nix
+++ b/pkgs/by-name/vi/vikunja/package.nix
@@ -104,8 +104,14 @@ buildGoModule (finalAttrs: {
  '';

  passthru = {
-    # used by vikunja-desktop
-    inherit (finalAttrs) frontend;
+    desktop = callPackage ./desktop.nix {
+      inherit (finalAttrs)
+        src
+        version
+        meta
+        frontend
+        ;
+    };

    tests.vikunja = nixosTests.vikunja;

@@ -115,6 +121,8 @@ buildGoModule (finalAttrs: {
        "frontend"
        "--subpackage"
        "veans"
+        "--subpackage"
+        "desktop"
      ];
    };
  };
--- a/pkgs/by-name/wl/wlvncc/package.nix
+++ b/pkgs/by-name/wl/wlvncc/package.nix
@@ -67,7 +67,10 @@ stdenv.mkDerivation {
  meta = {
    description = "Wayland Native VNC Client";
    homepage = "https://github.com/any1/wlvncc";
-    license = lib.licenses.gpl2Only;
+    license = with lib.licenses; [
+      isc
+      gpl2Only
+    ];
    maintainers = with lib.maintainers; [ teutat3s ];
    platforms = lib.platforms.linux;
    mainProgram = "wlvncc";
--- a/pkgs/by-name/wp/wpa_supplicant/multiple-configs.patch
+++ b/pkgs/by-name/wp/wpa_supplicant/multiple-configs.patch
@@ -1,4 +1,4 @@
-commit ca4bcfbd9d2233c90080b9ad400bf576db221781
+commit d88fba577e027c9849b39af57038b6dc8a0db6c2
 Author: rnhmjoj <rnhmjoj@inventati.org>
 Date:   Sat Sep 13 13:54:00 2025 +0200

@@ -24,10 +24,10 @@ index df538e332..71195d0d3 100644
       </varlistentry>
 
 diff --git a/wpa_supplicant/main.c b/wpa_supplicant/main.c
-index 9229eb51f..ff877f3b9 100644
+index 4874bcf11..418a7c29b 100644
 --- a/wpa_supplicant/main.c
 +++ b/wpa_supplicant/main.c
-@@ -76,7 +76,7 @@ static void usage(void)
+@@ -79,7 +79,7 @@ static void usage(void)
 	       "  -G = global ctrl_interface group\n"
 	       "  -h = show this help text\n"
 	       "  -i = interface name\n"
@@ -36,7 +36,7 @@ index 9229eb51f..ff877f3b9 100644
 	       "  -K = include keys (passwords, etc.) in debug output\n"
 	       "  -L = show license (BSD)\n"
 #ifdef CONFIG_P2P
-@@ -183,7 +183,8 @@ int main(int argc, char *argv[])
+@@ -194,7 +194,8 @@ int main(int argc, char *argv[])
 {
 	int c, i;
 	struct wpa_interface *ifaces, *iface;
@@ -46,7 +46,7 @@ index 9229eb51f..ff877f3b9 100644
 	struct wpa_params params;
 	struct wpa_global *global;
 
-@@ -253,7 +254,15 @@ int main(int argc, char *argv[])
+@@ -264,7 +265,15 @@ int main(int argc, char *argv[])
 			iface->ifname = optarg;
 			break;
 		case 'I':
@@ -64,10 +64,10 @@ index 9229eb51f..ff877f3b9 100644
 		case 'K':
 			params.wpa_debug_show_keys++;
 diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
-index d45002fd9..af5836ef5 100644
+index d872c1e31..dc2a998be 100644
 --- a/wpa_supplicant/wpa_supplicant.c
 +++ b/wpa_supplicant/wpa_supplicant.c
-@@ -675,8 +675,10 @@ static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
+@@ -665,8 +665,10 @@ static void wpa_supplicant_cleanup(struct wpa_supplicant *wpa_s)
 	os_free(wpa_s->confname);
 	wpa_s->confname = NULL;
 
@@ -80,7 +80,7 @@ index d45002fd9..af5836ef5 100644
 
 	os_free(wpa_s->last_con_fail_realm);
 	wpa_s->last_con_fail_realm = NULL;
-@@ -1404,6 +1406,7 @@ int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
+@@ -1428,6 +1430,7 @@ int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
 	struct wpa_config *conf;
 	int reconf_ctrl;
 	int old_ap_scan;
@@ -88,19 +88,20 @@ index d45002fd9..af5836ef5 100644
 
 	if (wpa_s->confname == NULL)
 		return -1;
-@@ -1413,12 +1416,14 @@ int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
+@@ -1438,13 +1441,14 @@ int wpa_supplicant_reload_configuration(struct wpa_supplicant *wpa_s)
 			"file '%s' - exiting", wpa_s->confname);
 		return -1;
 	}
 -	if (wpa_s->confanother &&
-	    !wpa_config_read(wpa_s->confanother, conf, true)) {
+-	    !wpa_config_read(wpa_s->confanother, conf, true,
+-			     wpa_s->global->params.show_details)) {
 -		wpa_msg(wpa_s, MSG_ERROR,
 -			"Failed to parse the configuration file '%s' - exiting",
 -			wpa_s->confanother);
 -		return -1;
-+
 +	for (i = 0; wpa_s->confanother[i] != NULL; i++) {
-+		if (!wpa_config_read(wpa_s->confanother[i], conf, true)) {
+		if (!wpa_config_read(wpa_s->confanother[i], conf, true,
+				wpa_s->global->params.show_details)) {
 +			wpa_msg(wpa_s, MSG_ERROR,
 +				"Failed to parse the configuration file '%s' - exiting",
 +				wpa_s->confanother[i]);
@@ -109,35 +110,36 @@ index d45002fd9..af5836ef5 100644
 	}
 
 	conf->changed_parameters = (unsigned int) -1;
-@@ -7658,13 +7663,16 @@ static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
+@@ -7906,14 +7910,16 @@ static int wpa_supplicant_init_iface(struct wpa_supplicant *wpa_s,
 				   "configuration '%s'.", wpa_s->confname);
 			return -1;
 		}
 -		wpa_s->confanother = os_rel2abs_path(iface->confanother);
 -		if (wpa_s->confanother &&
-		    !wpa_config_read(wpa_s->confanother, wpa_s->conf, true)) {
+-		    !wpa_config_read(wpa_s->confanother, wpa_s->conf, true,
+-				     wpa_s->global->params.show_details)) {
 -			wpa_printf(MSG_ERROR,
 -				   "Failed to read or parse configuration '%s'.",
 -				   wpa_s->confanother);
 -			return -1;
-+
 +		for (int i = 0; iface->confanother[i] != NULL; i++) {
 +			wpa_s->confanother[i] = os_rel2abs_path(iface->confanother[i]);
 +			if (wpa_s->confanother[i] &&
-+					!wpa_config_read(wpa_s->confanother[i], wpa_s->conf, true)) {
+				!wpa_config_read(wpa_s->confanother[i], wpa_s->conf, true,
+					wpa_s->global->params.show_details)) {
 +				wpa_printf(MSG_ERROR,
-+						 "Failed to read or parse configuration '%s'.",
-+						 wpa_s->confanother[i]);
+					"Failed to read or parse configuration '%s'.",
+					wpa_s->confanother[i]);
 +				return -1;
 +			}
 		}
 
 		/*
 diff --git a/wpa_supplicant/wpa_supplicant_i.h b/wpa_supplicant/wpa_supplicant_i.h
-index 2f77413d5..84c009e78 100644
+index cd763693f..919be6334 100644
 --- a/wpa_supplicant/wpa_supplicant_i.h
 +++ b/wpa_supplicant/wpa_supplicant_i.h
-@@ -66,12 +66,12 @@ struct wpa_interface {
+@@ -67,12 +67,12 @@ struct wpa_interface {
 	const char *confname;
 
 	/**
@@ -152,7 +154,7 @@ index 2f77413d5..84c009e78 100644
 
 	/**
 	 * ctrl_interface - Control interface parameter
-@@ -713,7 +713,7 @@ struct wpa_supplicant {
+@@ -779,7 +779,7 @@ struct wpa_supplicant {
 	char bridge_ifname[16];
 
 	char *confname;
--- a/pkgs/by-name/wp/wpa_supplicant/package.nix
+++ b/pkgs/by-name/wp/wpa_supplicant/package.nix
@@ -2,7 +2,6 @@
  lib,
  stdenv,
  fetchurl,
-  fetchpatch,
  openssl,
  pkg-config,
  libnl,
@@ -18,37 +17,24 @@
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "2.11";
+  version = "2.12";

  pname = "wpa_supplicant";

  src = fetchurl {
    url = "https://w1.fi/releases/wpa_supplicant-${finalAttrs.version}.tar.gz";
-    hash = "sha256-kS6gb3TjCo42+7aAZNbN/yGNjVkdsPxddd7myBrH/Ao=";
+    hash = "sha256-COI5N+FtAVXlXKsrUfUfvhDYChqpHE4VRCZFBZtzfvY=";
  };

  patches = [
-    (fetchpatch {
-      name = "revert-change-breaking-auth-broadcom.patch";
-      url = "https://w1.fi/cgit/hostap/patch/?id=41638606054a09867fe3f9a2b5523aa4678cbfa5";
-      hash = "sha256-X6mBbj7BkW66aYeSCiI3JKBJv10etLQxaTRfRgwsFmM=";
-      revert = true;
-    })
-    (fetchpatch {
-      name = "suppress-ctrl-event-signal-change.patch";
-      url = "https://w1.fi/cgit/hostap/patch/?id=c330b5820eefa8e703dbce7278c2a62d9c69166a";
-      hash = "sha256-5ti5OzgnZUFznjU8YH8Cfktrj4YBzsbbrEbNvec+ppQ=";
-    })
-    (fetchpatch {
-      name = "ensure-full-key-match";
-      url = "https://git.w1.fi/cgit/hostap/patch/?id=1ce37105da371c8b9cf3f349f78f5aac77d40836";
-      hash = "sha256-leCk0oexNBZyVK5Q5gR4ZcgWxa0/xt/aU+DssTa0UwE=";
-    })
-    ./unsurprising-ext-password.patch
    ./multiple-configs.patch
  ]
  ++ lib.optional unprivileged ./unprivileged-daemon.patch;

+  strictDeps = true;
+  __structuredAttrs = true;
+  enableParallelBuilding = true;
+
  # TODO: Patch epoll so that the dbus actually responds
  # TODO: Figure out how to get privsep working, currently getting SIGBUS
  extraConfig = ''
--- a/pkgs/by-name/wp/wpa_supplicant/unsurprising-ext-password.patch
+++ b/pkgs/by-name/wp/wpa_supplicant/unsurprising-ext-password.patch
@@ -1,66 +0,0 @@
-From e5ac0dd1af48e085bb824082ef3b64afba673ded Mon Sep 17 00:00:00 2001
-From: rnhmjoj <rnhmjoj@inventati.org>
-Date: Wed, 18 Sep 2024 13:43:44 +0200
-Subject: [PATCH] ext_password_file: do not use wpa_config_get_line
-To: hostap@lists.infradead.org
-
-The file-based backed of the ext_password framework uses
-`wpa_config_get_line` to read the passwords line-by-line from a file.
-This function is meant to parse a single line from the
-wpa_supplicant.conf file, so it handles whitespace, quotes and other
-characters specially.
-
-Its behavior, however, it's not compatible with the rest of the
-ext_password framework implementation. For example, if a passphrase
-contains a `#` character it must be quoted to prevent parsing the
-remaining characters as an inline comment, but the code handling the
-external password in `wpa_supplicant_get_psk` does not handle quotes.
-The result is that either it will hash the enclosing quotes, producing a
-wrong PSK, or if the passphrase is long enough, fail the length check.
-As a consequence, some passphrases are impossible to input correctly.
-
-To solve this and other issues, this patch changes the behaviour of the
-`ext_password_file_get` function (which was not documented in details,
-at least w.r.t. special characters) to simply treat all characters
-literally: including trailing whitespaces (except CR and LF), `#` for
-inline comments, etc. Empty lines and full-line comments are still
-supported.
-
-Signed-off-by: Michele Guerini Rocco <rnhmjoj@inventati.org>
---
- src/utils/ext_password_file.c | 12 ++++++++++--
- 1 file changed, 10 insertions(+), 2 deletions(-)
-
-diff --git a/src/utils/ext_password_file.c b/src/utils/ext_password_file.c
-index 4bb0095f3..f631ff15c 100644
--- a/src/utils/ext_password_file.c
-+++ b/src/utils/ext_password_file.c
-@@ -9,7 +9,6 @@
- #include "includes.h"
- 
- #include "utils/common.h"
-#include "utils/config.h"
- #include "ext_password_i.h"
- 
- 
-@@ -97,7 +96,16 @@ static struct wpabuf * ext_password_file_get(void *ctx, const char *name)
- 
- 	wpa_printf(MSG_DEBUG, "EXT PW FILE: get(%s)", name);
- 
-	while (wpa_config_get_line(buf, sizeof(buf), f, &line, &pos)) {
-+	while ((pos = fgets(buf, sizeof(buf), f))) {
-+		line++;
-+
-+		/* Strip newline characters */
-+		pos[strcspn(pos, "\r\n")] = 0;
-+
-+		/* Skip comments and empty lines */
-+		if (*pos == '#' || *pos == '\0')
-+		  continue;
-+
- 		char *sep = os_strchr(pos, '=');
- 
- 		if (!sep) {
-- 
-2.44.1
-
--- a/pkgs/by-name/wp/wpa_supplicant_gui/package.nix
+++ b/pkgs/by-name/wp/wpa_supplicant_gui/package.nix
@@ -1,7 +1,7 @@
 {
  lib,
  stdenv,
-  qt5,
+  qt6,
  inkscape,
  imagemagick,
  wpa_supplicant,
@@ -12,16 +12,20 @@ stdenv.mkDerivation {
  inherit (wpa_supplicant) version src patches;

  buildInputs = [
-    qt5.qtbase
+    qt6.qtbase
  ];

  nativeBuildInputs = [
-    qt5.qmake
+    qt6.qmake
    inkscape
    imagemagick
-    qt5.wrapQtAppsHook
+    qt6.wrapQtAppsHook
  ];

+  strictDeps = true;
+  __structuredAttrs = true;
+  enableParallelBuilding = true;
+
  postPatch = ''
    cd wpa_supplicant/wpa_gui-qt4
  '';
--- a/pkgs/by-name/xk/xkb-switch-i3/package.nix
+++ b/pkgs/by-name/xk/xkb-switch-i3/package.nix
@@ -53,7 +53,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    description = "Switch your X keyboard layouts from the command line(i3 edition)";
    homepage = "https://github.com/Zebradil/xkb-switch-i3";
-    license = lib.licenses.gpl3Plus;
+    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ ewok ];
    platforms = lib.platforms.linux;
    mainProgram = "xkb-switch";
--- a/pkgs/development/interpreters/tcl/8.6.nix
+++ b/pkgs/development/interpreters/tcl/8.6.nix
@@ -2,6 +2,8 @@
  callPackage,
  fetchurl,
  fetchpatch,
+  lib,
+  stdenv,
  ...
 }@args:

@@ -44,5 +46,10 @@ callPackage ./generic.nix (
      # Backport of upstream check-in `fd06472ef41e1d73`; see the patch.
      ./8.6-windows-disable-tzdata.patch
    ];
+
+    extraPatch = lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
+      substituteInPlace unix/configure unix/configure.in \
+        --replace-fail '`uname -s`' '${stdenv.hostPlatform.uname.system}'
+    '';
  }
 )
--- a/pkgs/development/interpreters/tcl/9.0.nix
+++ b/pkgs/development/interpreters/tcl/9.0.nix
@@ -2,6 +2,8 @@
  callPackage,
  fetchpatch,
  fetchzip,
+  lib,
+  stdenv,
  ...
 }@args:

@@ -34,5 +36,10 @@ callPackage ./generic.nix (
        hash = "sha256-jEyT8GI8ZXNzL9OTX1z58fX8qlcixGwNlhFqxMiMga8=";
      })
    ];
+
+    extraPatch = lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
+      substituteInPlace unix/configure unix/configure.ac \
+        --replace-fail '`uname -s`' '${stdenv.hostPlatform.uname.system}'
+    '';
  }
 )
--- a/pkgs/development/interpreters/tcl/generic.nix
+++ b/pkgs/development/interpreters/tcl/generic.nix
@@ -40,10 +40,6 @@ stdenv.mkDerivation (finalAttrs: {
      --replace-fail "/usr/lib/zoneinfo" "" \
      --replace-fail "/usr/local/etc/zoneinfo" ""
  ''
-  + lib.optionalString (stdenv.buildPlatform != stdenv.hostPlatform) ''
-    substituteInPlace unix/configure unix/configure.in \
-      --replace-fail '`uname -s`' '${stdenv.hostPlatform.uname.system}'
-  ''
  # A shared Cygwin build tries to configure the windows build system
  # to separately build these DLLs so it can load them later. That's
  # not gonna work for us --- in Nixpkgs this would need to be a
--- a/pkgs/development/libraries/gobject-introspection/wrappers/g-ir-scanner.sh
+++ b/pkgs/development/libraries/gobject-introspection/wrappers/g-ir-scanner.sh
@@ -4,4 +4,5 @@
 exec @dev@/bin/.g-ir-scanner-wrapped \
    --use-binary-wrapper=@emulatorwrapper@ \
    --use-ldd-wrapper=@dev@/bin/g-ir-scanner-lddwrapper \
+    --lib-dirs-envvar=GIR_EXTRA_LIBS_PATH \
    "$@"
--- a/pkgs/development/python-modules/apache-tvm-ffi/default.nix
+++ b/pkgs/development/python-modules/apache-tvm-ffi/default.nix
@@ -22,7 +22,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "apache-tvm-ffi";
-  version = "0.1.13-post3";
+  version = "0.1.14-post0";
  pyproject = true;
  __structuredAttrs = true;

@@ -31,7 +31,7 @@ buildPythonPackage (finalAttrs: {
    repo = "tvm-ffi";
    tag = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-AN7AqBl62T8DqnRt7KRvGjqo/c0SJ66QZrCQQ5yicHw=";
+    hash = "sha256-hIbVt5rPlCTT6BuIXlaEj8Ln6f27NlmtWqEWwx9AvnA=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/btrsync/default.nix
+++ b/pkgs/development/python-modules/btrsync/default.nix
@@ -9,14 +9,14 @@

 buildPythonPackage rec {
  pname = "btrsync";
-  version = "0.3";
+  version = "0.3.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "andreittr";
    repo = "btrsync";
    tag = "v${version}";
-    hash = "sha256-1LpHO70Yli9VG1UeqPZWM2qUMUbSbdgNP/r7FhUY/h4=";
+    hash = "sha256-FTN2YOGoaGwUww6HWuZbZdrERdDSPAgIzGrTfHL/9NU=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/cleanvision/default.nix
+++ b/pkgs/development/python-modules/cleanvision/default.nix
@@ -83,7 +83,7 @@ buildPythonPackage (finalAttrs: {
    description = "Automatically find issues in image datasets and practice data-centric computer vision";
    homepage = "https://github.com/cleanlab/cleanvision";
    changelog = "https://github.com/cleanlab/cleanvision/releases/tag/${finalAttrs.src.tag}";
-    license = lib.licenses.agpl3Only;
+    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ GaetanLepage ];
  };
 })
--- a/pkgs/development/python-modules/elevenlabs/default.nix
+++ b/pkgs/development/python-modules/elevenlabs/default.nix
@@ -14,14 +14,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "elevenlabs";
-  version = "2.67.0";
+  version = "2.68.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "elevenlabs";
    repo = "elevenlabs-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-hi+sK+O+7KkFxgjRiNt43oiaN7fNtNLcVRcf5udko5E=";
+    hash = "sha256-OHXk9pdQpTZkI+6gl8jn6UkUMDMlLv/XVtpnCbXkUEc=";
  };

  build-system = [ poetry-core ];
--- a/pkgs/development/python-modules/findimports/default.nix
+++ b/pkgs/development/python-modules/findimports/default.nix
@@ -28,10 +28,7 @@ buildPythonPackage rec {
    description = "Module for the analysis of Python import statements";
    homepage = "https://github.com/mgedmin/findimports";
    changelog = "https://github.com/mgedmin/findimports/blob/${src.tag}/CHANGES.rst";
-    license = with lib.licenses; [
-      gpl2Only # or
-      gpl3Only
-    ];
+    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ fab ];
    mainProgram = "findimports";
  };
--- a/pkgs/development/python-modules/hmmlearn/default.nix
+++ b/pkgs/development/python-modules/hmmlearn/default.nix
@@ -4,33 +4,44 @@
  buildPythonPackage,
  numpy,
  scikit-learn,
+  scipy,
  pybind11,
+  setuptools,
  setuptools-scm,
  cython,
  pytestCheckHook,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "hmmlearn";
  version = "0.3.3";
-  format = "setuptools";
+  pyproject = true;

  src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
    hash = "sha256-HTxdxMUlfgwjjcH+U4dwC4y5h+q4CO2z4Mc4KfHMROw=";
  };

-  buildInputs = [
+  build-system = [
+    setuptools
    setuptools-scm
    cython
    pybind11
  ];

-  propagatedBuildInputs = [
+  dependencies = [
    numpy
    scikit-learn
+    scipy
  ];

+  postPatch = ''
+    substituteInPlace src/hmmlearn/utils.py \
+      --replace-fail \
+        'a_sum.shape = shape' \
+        'a_sum = np.reshape(a_sum, shape, copy=False)'
+  '';
+
  nativeCheckInputs = [ pytestCheckHook ];

  pythonImportsCheck = [ "hmmlearn" ];
@@ -46,4 +57,4 @@ buildPythonPackage rec {
    license = lib.licenses.bsd3;
    maintainers = [ ];
  };
-}
+})
--- a/pkgs/development/python-modules/nbxmpp/default.nix
+++ b/pkgs/development/python-modules/nbxmpp/default.nix
@@ -20,7 +20,6 @@ buildPythonPackage (finalAttrs: {
  pyproject = true;

  src = fetchFromGitLab {
-    domain = "dev.gajim.org";
    owner = "gajim";
    repo = "python-nbxmpp";
    tag = finalAttrs.version;
@@ -49,8 +48,8 @@ buildPythonPackage (finalAttrs: {
  pythonImportsCheck = [ "nbxmpp" ];

  meta = {
-    homepage = "https://dev.gajim.org/gajim/python-nbxmpp";
-    changelog = "https://dev.gajim.org/gajim/python-nbxmpp/-/blob/${finalAttrs.src.tag}/ChangeLog";
+    homepage = "https://gitlab.com/gajim/python-nbxmpp";
+    changelog = "https://gitlab.com/gajim/python-nbxmpp/-/blob/${finalAttrs.src.tag}/ChangeLog";
    description = "Non-blocking Jabber/XMPP module";
    license = lib.licenses.gpl3Plus;
    maintainers = with lib.maintainers; [ haansn08 ];
--- a/pkgs/development/python-modules/omemo-dr/default.nix
+++ b/pkgs/development/python-modules/omemo-dr/default.nix
@@ -14,7 +14,6 @@ buildPythonPackage rec {
  pyproject = true;

  src = fetchFromGitLab {
-    domain = "dev.gajim.org";
    owner = "gajim";
    repo = "omemo-dr";
    tag = "v${version}";
@@ -34,9 +33,9 @@ buildPythonPackage rec {

  meta = {
    description = "OMEMO Double Ratchet";
-    homepage = "https://dev.gajim.org/gajim/omemo-dr/";
-    changelog = "https://dev.gajim.org/gajim/omemo-dr/-/blob/v${version}/CHANGELOG.md";
+    homepage = "https://gitlab.com/gajim/omemo-dr/";
+    changelog = "https://gitlab.com/gajim/omemo-dr/-/blob/v${version}/CHANGELOG.md";
    license = lib.licenses.gpl3Only;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ haansn08 ];
  };
 }
--- a/pkgs/development/python-modules/specialized-turbo/default.nix
+++ b/pkgs/development/python-modules/specialized-turbo/default.nix
@@ -12,14 +12,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "specialized-turbo";
-  version = "0.8.3";
+  version = "0.8.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "JamieMagee";
    repo = "specialized-turbo";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-y2T44Az+nDHntwkulPQGYChpG72HoLqWdz6Dr3gJYpE=";
+    hash = "sha256-kyYjIF1TaIV8PtRWhQlXYLO2AzI/utT0ZE7NCXDhhj0=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/rocq-modules/interval/default.nix
+++ b/pkgs/development/rocq-modules/interval/default.nix
@@ -23,6 +23,7 @@ mkCoqDerivation rec {
    in
    with lib.versions;
    lib.switch coq.coq-version [
+      (case (range "8.13" "9.3") "4.11.5")
      (case (range "8.13" "9.1") "4.11.3")
      (case (range "8.13" "9.0") "4.11.2")
      (case (range "8.13" "8.20") "4.11.1")
@@ -35,6 +36,7 @@ mkCoqDerivation rec {
      (case (range "8.7" "8.11") "3.4.2")
      (case (range "8.5" "8.6") "3.3.0")
    ] null;
+  release."4.11.5".hash = "sha256-TSSNS/0asrC3O2rMwhaF81m7BkJ1ouJ1uQeP4f5N1v8=";
  release."4.11.3".hash = "sha256-Cwovc3ln7ZEEDgMEh+pSUYqD/rtwFk4ED2hTRdy9YRg";
  release."4.11.2".hash = "sha256-ouhjHtlxcqt06+Pt+UZAzwp83bVYPh3N+8jnsVvapSU=";
  release."4.11.1".hash = "sha256-QWZvU468rOhK796xCCEawW6rhCRTPnE0iLll9ynKflo=";
--- a/pkgs/development/rocq-modules/mathcomp-infotheo/default.nix
+++ b/pkgs/development/rocq-modules/mathcomp-infotheo/default.nix
@@ -33,6 +33,7 @@
    lib.switch
      [ coq.coq-version mathcomp-analysis.version ]
      [
+        (case (range "9.1" "9.2") (isGe "1.18") "0.9.8")
        (case (range "9.0" "9.1") (isGe "1.12") "0.9.7")
        (case (range "8.20" "9.1") (isGe "1.12") "0.9.6")
        (case (range "8.20" "8.20") (range "1.12" "1.13") "0.9.4")
@@ -48,6 +49,7 @@
        (case (range "8.15" "8.16") (range "0.5.4" "0.6.5") "0.5.1")
      ]
      null;
+  release."0.9.8".hash = "sha256-yo+r8RC02a8r3nDpFe5mO+q1qTrdHXKPMDxyFCf+A1k=";
  release."0.9.7".hash = "sha256-cmkBh2vw02R/UivGqaEpg89LMGR/i5Q14IEZDhjFA+Y=";
  release."0.9.6".hash = "sha256-7gwtqTzMMEhUDz2XdxamAqjSdST0HrbWJHQ/YTDRR5E=";
  release."0.9.4".hash = "sha256-btHOBNMdXvlG2jxC04+4qmIjeyuaqtyugm2Ruj3lQr8=";
--- a/pkgs/servers/home-assistant/custom-components/anker_solix_official/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/anker_solix_official/package.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  buildHomeAssistantComponent,
+  fetchFromGitHub,
+  pymodbus,
+  pyyaml,
+  pytest-asyncio,
+  pytest-cov-stub,
+  pytest-homeassistant-custom-component,
+  pytestCheckHook,
+}:
+
+buildHomeAssistantComponent (finalAttrs: {
+  owner = "anker-charging";
+  domain = "anker_solix_official";
+  version = "1.5.0";
+
+  src = fetchFromGitHub {
+    owner = "anker-charging";
+    repo = "ha-anker-solix-official";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-zYjC4z+IMUgOfwmpWAqmmUyMDeS9IqchNAtg4EPo1wQ=";
+  };
+
+  dependencies = [
+    pymodbus
+    pyyaml
+  ];
+
+  nativeCheckInputs = [
+    pytest-asyncio
+    pytest-cov-stub
+    pytest-homeassistant-custom-component
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # https://github.com/anker-charging/ha-anker-solix-official/issues/115
+    "test_uses_new_api_when_available_with_both_required_args"
+    "test_falls_back_to_deprecated_api_when_new_api_absent"
+    # pytest_homeassistant_custom_component.plugins.HASocketBlockedError: A test tried to use socket.socket.
+    "test_creates_client_lazily_when_none"
+  ];
+
+  meta = {
+    description = "Official Home Assistant integration for Anker Solix devices via local Modbus TCP";
+    homepage = "https://github.com/anker-charging/ha-anker-solix-official";
+    changelog = "https://github.com/anker-charging/ha-anker-solix-official/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ hexa ];
+  };
+})
--- a/pkgs/servers/home-assistant/custom-components/solis_modbus/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/solis_modbus/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  buildHomeAssistantComponent,
+  fetchFromGitHub,
+  pymodbus,
+  pytestCheckHook,
+  pytest-homeassistant-custom-component,
+}:
+
+buildHomeAssistantComponent (finalAttrs: {
+  owner = "Pho3niX90";
+  domain = "solis_modbus";
+  version = "4.2.6";
+
+  src = fetchFromGitHub {
+    owner = "Pho3niX90";
+    repo = "solis_modbus";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-M8ECmFdujnlSVVWckdTEwDAWFFl9yzbTIqK9hMxClpk=";
+  };
+
+  dependencies = [
+    pymodbus
+  ];
+
+  nativeCheckInputs = [
+    pytest-homeassistant-custom-component
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "Home Assistant integration for Solis inverters";
+    homepage = "https://github.com/Pho3niX90/solis_modbus";
+    changelog = "https://github.com/Pho3niX90/solis_modbus/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ hexa ];
+  };
+})
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8133,6 +8133,28 @@ with pkgs;
    '';
  };

+  notonoto-35 = notonoto.override {
+    width35 = true;
+  };
+
+  notonoto-console = notonoto.override {
+    console = true;
+  };
+
+  notonoto-hs = notonoto.override {
+    hideZenkakuSpace = true;
+  };
+
+  notonoto-hs-35 = notonoto.override {
+    width35 = true;
+    hideZenkakuSpace = true;
+  };
+
+  notonoto-hs-console = notonoto.override {
+    console = true;
+    hideZenkakuSpace = true;
+  };
+
  openmoji-color = callPackage ../data/fonts/openmoji { fontFormats = [ "glyf_colr_0" ]; };

  openmoji-black = callPackage ../data/fonts/openmoji { fontFormats = [ "glyf" ]; };