From 4a7536ac653c900cd6b89148af07601f9ee6accf Mon Sep 17 00:00:00 2001
From: "Burfeind, Jan-Niklas" <jan-niklas.burfeind@sennheiser.com>
Date: Thu, 12 Mar 2026 12:00:35 +0100
Subject: [PATCH 01/52] pdudaemon: init at 1.1.1

(cherry picked from commit e6aab575a608d139087b3971be1f6c4bc12c038a)
---
 pkgs/by-name/pd/pdudaemon/package.nix | 62 +++++++++++++++++++++++++++
 1 file changed, 62 insertions(+)
 create mode 100644 pkgs/by-name/pd/pdudaemon/package.nix

diff --git a/pkgs/by-name/pd/pdudaemon/package.nix b/pkgs/by-name/pd/pdudaemon/package.nix
new file mode 100644
index 000000000000..cae702356595
--- /dev/null
+++ b/pkgs/by-name/pd/pdudaemon/package.nix
@@ -0,0 +1,62 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3Packages,
+  nixosTests,
+}:
+
+python3Packages.buildPythonApplication rec {
+  pname = "pdudaemon";
+  version = "1.1.1";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "pdudaemon";
+    repo = "pdudaemon";
+    tag = version;
+    hash = "sha256-YjM1RmsdRfNyxCzK+PmSH8n7ZJ3qeIskTPxu2+EaupQ=";
+  };
+
+  build-system = with python3Packages; [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = with python3Packages; [
+    aiohttp
+    requests
+    pexpect
+    systemd-python
+    paramiko
+    pyserial
+    hidapi
+    pysnmp
+    pyasn1
+    pyusb
+    pymodbus
+  ];
+
+  nativeCheckInputs = with python3Packages; [
+    pytest-asyncio
+    pytest-mock
+    pytestCheckHook
+  ];
+
+  __structuredAttrs = true;
+
+  passthru.tests = {
+    inherit (nixosTests) pdudaemon;
+  };
+
+  meta = {
+    changelog = "https://github.com/pdudaemon/pdudaemon/releases/tag/${src.tag}";
+    description = "Python Daemon for controlling/sequentially executing commands to PDUs (Power Distribution Units)";
+    homepage = "https://github.com/pdudaemon/pdudaemon";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [
+      aiyion
+      emantor
+    ];
+    mainProgram = "pdudaemon";
+  };
+}

From 1270df7b528db9dc9ac2a0001468cbd6c7c338a1 Mon Sep 17 00:00:00 2001
From: "Burfeind, Jan-Niklas" <jan-niklas.burfeind@sennheiser.com>
Date: Thu, 12 Mar 2026 18:11:31 +0100
Subject: [PATCH 02/52] nixos/pdudaemon: init module

based on the example in share/ in the project repo.

(cherry picked from commit 9508002438eb2b843baa092127df693b6d05b6a8)
---
 nixos/modules/module-list.nix                 |   1 +
 nixos/modules/services/hardware/pdudaemon.nix | 146 ++++++++++++++++++
 nixos/tests/all-tests.nix                     |   1 +
 nixos/tests/pdudaemon.nix                     |  50 ++++++
 4 files changed, 198 insertions(+)
 create mode 100644 nixos/modules/services/hardware/pdudaemon.nix
 create mode 100644 nixos/tests/pdudaemon.nix

diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index c44ee5511b44..0b84f2aa79fa 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -676,6 +676,7 @@
   ./services/hardware/nvidia-optimus.nix
   ./services/hardware/openrgb.nix
   ./services/hardware/pcscd.nix
+  ./services/hardware/pdudaemon.nix
   ./services/hardware/pid-fan-controller.nix
   ./services/hardware/pommed.nix
   ./services/hardware/power-profiles-daemon.nix
diff --git a/nixos/modules/services/hardware/pdudaemon.nix b/nixos/modules/services/hardware/pdudaemon.nix
new file mode 100644
index 000000000000..3f400848436e
--- /dev/null
+++ b/nixos/modules/services/hardware/pdudaemon.nix
@@ -0,0 +1,146 @@
+{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.services.pdudaemon;
+  configFile = pkgs.writeText "pdudaemon.conf" (
+    lib.generators.toJSON { } {
+      daemon = {
+        hostname = cfg.bindAddress;
+        port = cfg.port;
+        logging_level = cfg.logLevel;
+        listener = cfg.listener;
+      };
+      pdus = cfg.pdus;
+    }
+  );
+in
+{
+  meta = {
+    maintainers = with lib.maintainers; [
+      aiyion
+      emantor
+    ];
+  };
+
+  options = {
+    services.pdudaemon = {
+      enable = lib.mkEnableOption "PDUDaemon";
+
+      package = lib.mkPackageOption pkgs "pdudaemon" { };
+
+      bindAddress = lib.mkOption {
+        default = "0.0.0.0";
+        type = lib.types.str;
+        description = "Bind address for the PDUDaemon.";
+      };
+
+      port = lib.mkOption {
+        default = 16421;
+        type = lib.types.port;
+        description = "Port to bind to.";
+      };
+
+      openFirewall = lib.mkOption {
+        default = false;
+        type = lib.types.bool;
+        description = ''
+          Whether to automatically open the PDUDaemon listen port in the firewall.
+        '';
+      };
+
+      listener = lib.mkOption {
+        default = "http";
+        type = lib.types.enum [
+          "http"
+          "tcp"
+        ];
+        description = "Which kind of listener to provide.";
+      };
+
+      logLevel = lib.mkOption {
+        default = "error";
+        type = lib.types.enum [
+          "debug"
+          "info"
+          "warning"
+          "error"
+        ];
+        description = "PDUDaemon log level.";
+      };
+
+      pdus = lib.mkOption {
+        type = with lib.types; attrsOf anything;
+        default = { };
+        description = ''
+          Structural pdus section of PDUDaemon's pdudaemon.conf.
+          Refer to <https://github.com/pdudaemon/pdudaemon/blob/main/share/pdudaemon.conf>
+          for more examples.
+        '';
+        example = lib.literalExpression ''
+          {
+            cbs350-poe-switch = {
+              driver = "snmpv1";
+              community = "private";
+              oid = ".1.3.6.1.2.1.105.1.1.1.3.1.*;
+              onsetting = 1;
+              offsetting = 2;
+            };
+            energenie = {
+              driver = "EG-PMS";
+              device = "aa:bb:cc:xx:yy";
+            };
+            local = {
+              driver = "localcmdline";
+            };
+          };
+        '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [ cfg.port ];
+
+    systemd.services.pdudaemon = {
+      after = [ "network-online.target" ];
+      description = "Control and Queueing daemon for PDUs";
+      serviceConfig = {
+        ExecStart = "${lib.getExe cfg.package} --conf ${configFile}";
+        Type = "simple";
+        DynamicUser = "yes";
+        StateDirectory = "pdudaemon";
+        ProtectHome = true;
+        Restart = "on-failure";
+        CapabilityBoundingSet = "";
+        PrivateDevices = true;
+        ProtectClock = true;
+        ProtectKernelLogs = true;
+        ProtectControlGroups = true;
+        ProtectKernelModules = true;
+        SystemCallArchitectures = "native";
+        MemoryDenyWriteExecute = true;
+        RestrictNamespaces = true;
+        ProtectHostname = true;
+        LockPersonality = true;
+        ProtectKernelTunables = true;
+        RestrictRealtime = true;
+        ProtectProc = "invisible";
+        ProcSubset = "pid";
+        PrivateUsers = true;
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+      };
+
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network-online.target" ];
+    };
+  };
+}
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index ca0976b3d8e3..583dc168981d 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1207,6 +1207,7 @@ in
   password-option-override-ordering = runTest ./password-option-override-ordering.nix;
   patroni = handleTestOn [ "x86_64-linux" ] ./patroni.nix { };
   pdns-recursor = runTest ./pdns-recursor.nix;
+  pdudaemon = runTest ./pdudaemon.nix;
   peerflix = runTest ./peerflix.nix;
   peering-manager = runTest ./web-apps/peering-manager.nix;
   peertube = handleTestOn [ "x86_64-linux" ] ./web-apps/peertube.nix { };
diff --git a/nixos/tests/pdudaemon.nix b/nixos/tests/pdudaemon.nix
new file mode 100644
index 000000000000..71fb798f886e
--- /dev/null
+++ b/nixos/tests/pdudaemon.nix
@@ -0,0 +1,50 @@
+{ pkgs, ... }:
+{
+  name = "PDUDaemon";
+  meta.maintainers = with pkgs.lib.maintainers; [
+    aiyion
+    emantor
+  ];
+
+  nodes.pdudaemonhost =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.curl ];
+      services.pdudaemon.enable = true;
+      services.pdudaemon.openFirewall = true;
+      services.pdudaemon.pdus = {
+        testpduhost = {
+          driver = "localcmdline";
+          cmd_on = "echo '%s on' >> /tmp/pdu";
+          cmd_off = "echo '%s off' >> /tmp/pdu";
+        };
+      };
+    };
+
+  nodes.clienthost =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.curl ];
+    };
+
+  testScript =
+    { nodes, ... }:
+    #python
+    ''
+      with subtest("Wait for pdudaemon startup"):
+          pdudaemonhost.start()
+          pdudaemonhost.wait_for_unit("pdudaemon.service")
+          pdudaemonhost.wait_for_open_port(16421)
+          print(pdudaemonhost.succeed("curl 'http://localhost:16421/power/control/on?hostname=testpduhost&port=1'"))
+
+      with subtest("Connect from client"):
+          clienthost.start()
+          clienthost.wait_until_succeeds("curl 'http://pdudaemonhost:16421/power/control/off?hostname=testpduhost&port=1'")
+
+      with subtest("Check systemd hardening does not degrade unnoticed"):
+          exact_threshold = 15
+          service_name = "pdudaemon"
+          pdudaemonhost.fail(f"systemd-analyze security {service_name}.service --threshold={exact_threshold-1}")
+          pdudaemonhost.succeed(f"systemd-analyze security {service_name}.service --threshold={exact_threshold}")
+    '';
+}

From 0b80d02bb877e373f27e640e8a360f881fd3a520 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Sun, 17 May 2026 18:49:52 +0200
Subject: [PATCH 03/52] mysql80: 8.0.45 -> 8.0.46

https://dev.mysql.com/doc/relnotes/mysql/8.0/en/news-8-0-46.html

Fixes CVE-2026-34270
Fixes CVE-2026-34271
Fixes CVE-2026-34276
Fixes CVE-2026-34308
Fixes CVE-2026-22009
Fixes CVE-2026-22017
Fixes CVE-2026-34303
Fixes CVE-2025-14017
Fixes CVE-2026-34318
Fixes CVE-2026-34317
Fixes CVE-2025-14017
Fixes CVE-2026-34318
Fixes CVE-2026-34317
Fixes CVE-2026-34319
Fixes CVE-2026-22004
Fixes CVE-2026-34304
Fixes CVE-2026-35236
Fixes CVE-2026-35237
Fixes CVE-2026-35238
Fixes CVE-2026-35239
Fixes CVE-2026-21998
Fixes CVE-2026-22005
Fixes CVE-2026-22002
Fixes CVE-2026-35240
Fixes CVE-2026-22015
Fixes CVE-2026-22001
Fixes CVE-2026-34293
Fixes CVE-2026-34267
Fixes CVE-2026-34278

https://www.oracle.com/security-alerts/cpuapr2026.html#AppendixMSQL

Not-cherry-picked-because: mysql80 has been dropped on unstable.
---
 pkgs/servers/sql/mysql/8.0.x.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/mysql/8.0.x.nix b/pkgs/servers/sql/mysql/8.0.x.nix
index 5c46c339cb15..6698faa7787c 100644
--- a/pkgs/servers/sql/mysql/8.0.x.nix
+++ b/pkgs/servers/sql/mysql/8.0.x.nix
@@ -30,11 +30,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mysql";
-  version = "8.0.45";
+  version = "8.0.46";
 
   src = fetchurl {
     url = "https://dev.mysql.com/get/Downloads/MySQL-${lib.versions.majorMinor finalAttrs.version}/mysql-${finalAttrs.version}.tar.gz";
-    hash = "sha256-tDXyLmWMj8k7gWmPo0uaVjJaMEs/Pf+H8n+2dMkKu8s=";
+    hash = "sha256-4NGpiuUYjGpO/tdMdP8oEV1LeRvJ1ZGnjhTSCt7Wc0Q=";
   };
 
   nativeBuildInputs = [

From 2f5f2e133e68df66009fbf8af2ad040fd7126d66 Mon Sep 17 00:00:00 2001
From: Johan Thomsen <write@ownrisk.dk>
Date: Thu, 15 Jan 2026 12:47:51 +0100
Subject: [PATCH 04/52] coredns: 1.13.2 -> 1.14.1

- go generate requires vendor deps to be present
- skip the plugin parse transport-test

(cherry picked from commit f885e0fe55be96b1770b22259fbf81b42e4457ba)
---
 pkgs/by-name/co/coredns/package.nix | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/co/coredns/package.nix b/pkgs/by-name/co/coredns/package.nix
index 982b34bd4550..2ce01637b83f 100644
--- a/pkgs/by-name/co/coredns/package.nix
+++ b/pkgs/by-name/co/coredns/package.nix
@@ -6,7 +6,7 @@
   installShellFiles,
   nixosTests,
   externalPlugins ? [ ],
-  vendorHash ? "sha256-bnNpJgy54wvTST1Jtfbd1ldLJrIzTW62TL7wyHeqz28=",
+  vendorHash ? "sha256-3cY4Nd2RX5OKnJaQ7StYDsyq27qE1VY4wGaY4wiDeFQ=",
 }:
 
 let
@@ -14,13 +14,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "coredns";
-  version = "1.13.2";
+  version = "1.14.1";
 
   src = fetchFromGitHub {
     owner = "coredns";
     repo = "coredns";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-9ggyFixdNy0t4UA8ZxU5oMUzA/8EB/k1jors4f8Q6YE=";
+    hash = "sha256-WcRX2BCWIQ8e0FYCIAzCdexz+Nl+/kKicQkhEw2AVMs=";
   };
 
   inherit vendorHash;
@@ -76,9 +76,9 @@ buildGoModule (finalAttrs: {
     }
     diff -u plugin.cfg.orig plugin.cfg || true
     for src in ${toString (attrsToSources externalPlugins)}; do go get $src; done
+    go mod vendor
     CC= GOOS= GOARCH= go generate
     go mod tidy
-    go mod vendor
   '';
 
   modInstallPhase = ''
@@ -106,6 +106,11 @@ buildGoModule (finalAttrs: {
     # it's a lint rather than a test of functionality, so it's safe to disable.
     substituteInPlace test/presubmit_test.go \
       --replace-fail "TestImportOrdering" "SkipImportOrdering"
+
+    substituteInPlace plugin/pkg/parse/transport_test.go \
+      --replace-fail \
+        "TestTransport" \
+        "SkipTransport"
   ''
   + lib.optionalString stdenv.hostPlatform.isDarwin ''
     # loopback interface is lo0 on macos

From a583e8f2cda2eba2e51bc8a87fefe1c5f07bae3e Mon Sep 17 00:00:00 2001
From: Johan Thomsen <write@ownrisk.dk>
Date: Fri, 23 Jan 2026 00:37:59 +0100
Subject: [PATCH 05/52] coredns: skip test cases that fail due to use of
 network

(cherry picked from commit f37cd7a9f97c39d9cf7f96c8bc0898ed22cc192c)
---
 pkgs/by-name/co/coredns/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/co/coredns/package.nix b/pkgs/by-name/co/coredns/package.nix
index 2ce01637b83f..dc4d4f26cefe 100644
--- a/pkgs/by-name/co/coredns/package.nix
+++ b/pkgs/by-name/co/coredns/package.nix
@@ -102,6 +102,12 @@ buildGoModule (finalAttrs: {
     substituteInPlace test/readme_test.go \
       --replace-fail "TestReadme" "SkipReadme"
 
+    substituteInPlace test/metrics_test.go \
+      --replace-fail "TestMetricsRewriteRequestSize" "SkipMetricsRewriteRequestSize"
+
+    substituteInPlace test/quic_test.go \
+      --replace-fail "TestQUICReloadDoesNotPanic" "SkipQUICReloadDoesNotPanic"
+
     # this test fails if any external plugins were imported.
     # it's a lint rather than a test of functionality, so it's safe to disable.
     substituteInPlace test/presubmit_test.go \

From 7fb249c2e5af4e9a7d21cfcb333e0f12b1aa87e1 Mon Sep 17 00:00:00 2001
From: Johan Thomsen <write@ownrisk.dk>
Date: Mon, 26 Jan 2026 10:39:09 +0100
Subject: [PATCH 06/52] coredns: fix externalPlugins by 'go mod vendor' after
 'go generate'

- also add a nixos test that covers the external plugins case

(cherry picked from commit cf5a2b6456f2e8c5f44e79d59aba25bd7f83f6a4)
---
 nixos/tests/all-tests.nix           |  1 +
 nixos/tests/coredns.nix             | 42 +++++++++++++++++++++++++++++
 pkgs/by-name/co/coredns/package.nix |  2 ++
 3 files changed, 45 insertions(+)
 create mode 100644 nixos/tests/coredns.nix

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index ca0976b3d8e3..355bb610f951 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -405,6 +405,7 @@ in
   containers-tmpfs = runTest ./containers-tmpfs.nix;
   containers-unified-hierarchy = runTest ./containers-unified-hierarchy.nix;
   convos = runTest ./convos.nix;
+  coredns = runTest ./coredns.nix;
   corerad = runTest ./corerad.nix;
   corteza = runTest ./corteza.nix;
   cosmic = runTest {
diff --git a/nixos/tests/coredns.nix b/nixos/tests/coredns.nix
new file mode 100644
index 000000000000..7f0c8dc8da3a
--- /dev/null
+++ b/nixos/tests/coredns.nix
@@ -0,0 +1,42 @@
+{ pkgs, ... }:
+{
+  name = "coredns";
+  meta = with pkgs.lib.maintainers; {
+    maintainers = [ johanot ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      environment.systemPackages = [ pkgs.dnsutils ];
+      services.coredns = {
+        enable = true;
+        config = ''
+          .:10053 {
+                ipecho {
+                  domain test.nixos.org
+                  ttl 2629800
+                }
+              }
+        '';
+        package = pkgs.coredns.override {
+          externalPlugins = [
+            {
+              name = "ipecho";
+              repo = "github.com/Eun/coredns-ipecho";
+              version = "224170ebca45cc59c6b071d280a18f42d1ff130c";
+              position = "start-of-file";
+            }
+          ];
+          vendorHash = "sha256-dNxHpXkiqz7B/JhZdxfZluIHFVXILlSm3XtB+v/EoMY=";
+        };
+      };
+    };
+
+  testScript = ''
+    machine.start()
+    machine.wait_for_unit("coredns.service")
+    machine.wait_for_open_port(10053)
+    machine.succeed("dig @127.0.0.1 -p 10053 127.0.0.2.test.nixos.org A +short | grep 127.0.0.2")
+  '';
+}
diff --git a/pkgs/by-name/co/coredns/package.nix b/pkgs/by-name/co/coredns/package.nix
index dc4d4f26cefe..cd3626c21d2e 100644
--- a/pkgs/by-name/co/coredns/package.nix
+++ b/pkgs/by-name/co/coredns/package.nix
@@ -78,6 +78,7 @@ buildGoModule (finalAttrs: {
     for src in ${toString (attrsToSources externalPlugins)}; do go get $src; done
     go mod vendor
     CC= GOOS= GOARCH= go generate
+    go mod vendor
     go mod tidy
   '';
 
@@ -134,6 +135,7 @@ buildGoModule (finalAttrs: {
   '';
 
   passthru.tests = {
+    coredns-external-plugins = nixosTests.coredns;
     kubernetes-single-node = nixosTests.kubernetes.dns-single-node;
     kubernetes-multi-node = nixosTests.kubernetes.dns-multi-node;
   };

From 01bbbb86b34543982c271e7b3f0b9534e0d911c9 Mon Sep 17 00:00:00 2001
From: LukaDev <hi@lukadev.me>
Date: Mon, 16 Feb 2026 01:15:01 +0100
Subject: [PATCH 07/52] coredns: fix externalPlugins

(cherry picked from commit 5c7798fe3057f3d94b6c12b425af736a0e3e1733)
---
 pkgs/by-name/co/coredns/package.nix | 107 ++++++++++++++--------------
 1 file changed, 54 insertions(+), 53 deletions(-)

diff --git a/pkgs/by-name/co/coredns/package.nix b/pkgs/by-name/co/coredns/package.nix
index cd3626c21d2e..3404096c5e4e 100644
--- a/pkgs/by-name/co/coredns/package.nix
+++ b/pkgs/by-name/co/coredns/package.nix
@@ -32,60 +32,61 @@ buildGoModule (finalAttrs: {
     "man"
   ];
 
-  # Override the go-modules fetcher derivation to fetch plugins
-  modBuildPhase = ''
-    cp plugin.cfg plugin.cfg.orig
-    ${
-      (lib.concatMapStringsSep "\n" (
-        plugin:
-        let
-          position = plugin.position or "end-of-file";
-          formatPlugin = { name, repo, ... }: "${name}:${repo}";
-        in
-        if position == "end-of-file" then
-          "echo '${formatPlugin plugin}' >> plugin.cfg"
-        else if position == "start-of-file" then
-          "sed -i '1i ${formatPlugin plugin}' plugin.cfg"
-        else if lib.hasAttrByPath [ "before" ] position then
-          ''
-            if ! grep -q '^${position.before}:' plugin.cfg; then
-              echo 'Failed to insert ${plugin.name} before ${position.before} in plugin.cfg: ${position.before} is not in plugin.cfg'
-              exit 1
-            fi
-            sed -i '/^${position.before}:/i ${formatPlugin plugin}' plugin.cfg
-          ''
-        else if lib.hasAttrByPath [ "after" ] position then
-          ''
-            if ! grep -q '^${position.after}:' plugin.cfg; then
-              echo 'Failed to insert ${plugin.name} after ${position.after} in plugin.cfg: ${position.after} is not in plugin.cfg'
-              exit 1
-            fi
-            sed -i '/^${position.after}:/a ${formatPlugin plugin}' plugin.cfg
-          ''
-        else
-          throw ''
-            Unsupported position value in externalPlugin:
-              ${builtins.toJSON plugin}.
-            Valid values for position attr are:
-              - position = "end-of-file" (the default)
-              - position = "start-of-file"
-              - position.before = "{other plugin}"
-              - position.after = "{other plugin}"
-          ''
-      ) externalPlugins)
-    }
-    diff -u plugin.cfg.orig plugin.cfg || true
-    for src in ${toString (attrsToSources externalPlugins)}; do go get $src; done
-    go mod vendor
-    CC= GOOS= GOARCH= go generate
-    go mod vendor
-    go mod tidy
-  '';
+  overrideModAttrs = {
+    # Add plugins before vendoring the modules.
+    preBuild = ''
+      cp plugin.cfg plugin.cfg.orig
+      ${
+        (lib.concatMapStringsSep "\n" (
+          plugin:
+          let
+            position = plugin.position or "end-of-file";
+            formatPlugin = { name, repo, ... }: "${name}:${repo}";
+          in
+          if position == "end-of-file" then
+            "echo '${formatPlugin plugin}' >> plugin.cfg"
+          else if position == "start-of-file" then
+            "sed -i '1i ${formatPlugin plugin}' plugin.cfg"
+          else if lib.hasAttrByPath [ "before" ] position then
+            ''
+              if ! grep -q '^${position.before}:' plugin.cfg; then
+                echo 'Failed to insert ${plugin.name} before ${position.before} in plugin.cfg: ${position.before} is not in plugin.cfg'
+                exit 1
+              fi
+              sed -i '/^${position.before}:/i ${formatPlugin plugin}' plugin.cfg
+            ''
+          else if lib.hasAttrByPath [ "after" ] position then
+            ''
+              if ! grep -q '^${position.after}:' plugin.cfg; then
+                echo 'Failed to insert ${plugin.name} after ${position.after} in plugin.cfg: ${position.after} is not in plugin.cfg'
+                exit 1
+              fi
+              sed -i '/^${position.after}:/a ${formatPlugin plugin}' plugin.cfg
+            ''
+          else
+            throw ''
+              Unsupported position value in externalPlugin:
+                ${builtins.toJSON plugin}.
+              Valid values for position attr are:
+                - position = "end-of-file" (the default)
+                - position = "start-of-file"
+                - position.before = "{other plugin}"
+                - position.after = "{other plugin}"
+            ''
+        ) externalPlugins)
+      }
+      diff -u plugin.cfg.orig plugin.cfg || true
+      for src in ${toString (attrsToSources externalPlugins)}; do go get $src; done
+      GOFLAGS=''${GOFLAGS//-mod=vendor/} CC= GOOS= GOARCH= go generate
+      go mod tidy
+    '';
 
-  modInstallPhase = ''
-    mv -t vendor go.mod go.sum plugin.cfg
-    cp -r --reflink=auto vendor "$out"
-  '';
+    # Move the modified `go.mod`, `go.sum`, and `plugin.cfg` files into the
+    # vendor directory so we can retrieve them later in the `preBuild` hook.
+    postBuild = ''
+      mv -t vendor go.mod go.sum plugin.cfg
+    '';
+  };
 
   preBuild = ''
     chmod -R u+w vendor

From 1b3233fed8e3b90cd935dfaad200a1660c248dd3 Mon Sep 17 00:00:00 2001
From: dish <pyrox@pyrox.dev>
Date: Sun, 8 Mar 2026 12:50:46 -0400
Subject: [PATCH 08/52] coredns: 1.14.1 -> 1.14.2

(cherry picked from commit a80c6030e49dd1d0a7c9d8ba583401708a7ad9ea)
---
 pkgs/by-name/co/coredns/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/co/coredns/package.nix b/pkgs/by-name/co/coredns/package.nix
index 3404096c5e4e..8fa46e05caa9 100644
--- a/pkgs/by-name/co/coredns/package.nix
+++ b/pkgs/by-name/co/coredns/package.nix
@@ -6,7 +6,7 @@
   installShellFiles,
   nixosTests,
   externalPlugins ? [ ],
-  vendorHash ? "sha256-3cY4Nd2RX5OKnJaQ7StYDsyq27qE1VY4wGaY4wiDeFQ=",
+  vendorHash ? "sha256-qodzzBee+4NeZ+XifMknFPayBcWDmbyYq1R6Xhuras0=",
 }:
 
 let
@@ -14,13 +14,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "coredns";
-  version = "1.14.1";
+  version = "1.14.2";
 
   src = fetchFromGitHub {
     owner = "coredns";
     repo = "coredns";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WcRX2BCWIQ8e0FYCIAzCdexz+Nl+/kKicQkhEw2AVMs=";
+    hash = "sha256-c0xXZnc0muXViPqMCJsD8TTGMbVCOKE49ElAHEPnKlw=";
   };
 
   inherit vendorHash;

From 0c62b6197786f76e809218c6c4c3514707dfac33 Mon Sep 17 00:00:00 2001
From: dish <pyrox@pyrox.dev>
Date: Sun, 8 Mar 2026 12:57:23 -0400
Subject: [PATCH 09/52] nixos/coredns: update vendorHash

Must be updated every time CoreDNS is updated

(cherry picked from commit 676f0cc40c830b93fca9b013f7d90365d365ec0c)
---
 nixos/tests/coredns.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/tests/coredns.nix b/nixos/tests/coredns.nix
index 7f0c8dc8da3a..9be6e79c2048 100644
--- a/nixos/tests/coredns.nix
+++ b/nixos/tests/coredns.nix
@@ -28,7 +28,7 @@
               position = "start-of-file";
             }
           ];
-          vendorHash = "sha256-dNxHpXkiqz7B/JhZdxfZluIHFVXILlSm3XtB+v/EoMY=";
+          vendorHash = "sha256-MGgFbglyW/1CMhT1b83ETH70gRkz89s/Gp4seR2g7xI=";
         };
       };
     };

From e4daa0d7be238d3214faa3d9f8979982d80459e3 Mon Sep 17 00:00:00 2001
From: Johan Thomsen <write@ownrisk.dk>
Date: Thu, 7 May 2026 23:09:49 +0200
Subject: [PATCH 10/52] coredns: 1.14.2 -> 1.14.3

(cherry picked from commit c8031835375819f9aee536875dbbb30b761d92aa)
---
 nixos/tests/coredns.nix             | 2 +-
 pkgs/by-name/co/coredns/package.nix | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/nixos/tests/coredns.nix b/nixos/tests/coredns.nix
index 9be6e79c2048..6ee6572d57c8 100644
--- a/nixos/tests/coredns.nix
+++ b/nixos/tests/coredns.nix
@@ -28,7 +28,7 @@
               position = "start-of-file";
             }
           ];
-          vendorHash = "sha256-MGgFbglyW/1CMhT1b83ETH70gRkz89s/Gp4seR2g7xI=";
+          vendorHash = "sha256-66WNU+t/frHfbxexYdiXzgXKLxPyLnN6JuKnlG/kSQY=";
         };
       };
     };
diff --git a/pkgs/by-name/co/coredns/package.nix b/pkgs/by-name/co/coredns/package.nix
index 8fa46e05caa9..189ab608471b 100644
--- a/pkgs/by-name/co/coredns/package.nix
+++ b/pkgs/by-name/co/coredns/package.nix
@@ -6,7 +6,7 @@
   installShellFiles,
   nixosTests,
   externalPlugins ? [ ],
-  vendorHash ? "sha256-qodzzBee+4NeZ+XifMknFPayBcWDmbyYq1R6Xhuras0=",
+  vendorHash ? "sha256-9LLTgIjOOMvYx4nhy+6X9bEBvqlKeTx//39q+YWXeHw=",
 }:
 
 let
@@ -14,13 +14,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "coredns";
-  version = "1.14.2";
+  version = "1.14.3";
 
   src = fetchFromGitHub {
     owner = "coredns";
     repo = "coredns";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-c0xXZnc0muXViPqMCJsD8TTGMbVCOKE49ElAHEPnKlw=";
+    hash = "sha256-Uk4oWsUxaGdLQzX5JywYzi7pmQHGo06uQdLeOkP4U/s";
   };
 
   inherit vendorHash;

From bc24af9845e9a66e2420f3c39b3f0f8d315be400 Mon Sep 17 00:00:00 2001
From: teutat3s <10206665+teutat3s@users.noreply.github.com>
Date: Fri, 22 May 2026 17:06:18 +0200
Subject: [PATCH 11/52] docker_28: mark as vulnerable

docker 28.x is no longer maintained since November 2025[1].

[1] https://github.com/moby/moby/commit/941805303910a3749ed8fa9669d078015f6f268c
---
 pkgs/applications/virtualization/docker/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index a44705f5e0d8..4af5a07326b3 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -430,6 +430,9 @@ in
       containerdHash = "sha256-vz7RFJkFkMk2gp7bIMx1kbkDFUMS9s0iH0VoyD9A21s=";
       tiniRev = "369448a167e8b3da4ca5bca0b3307500c3371828";
       tiniHash = "sha256-jCBNfoJAjmcTJBx08kHs+FmbaU82CbQcf0IVjd56Nuw=";
+      knownVulnerabilities = [
+        "docker_28 has been unmaintained since November 2025, use docker_29 or newer instead"
+      ];
     };
 
   docker_29 =

From 0e1896634a888a3e69e737b9fc740082eec6d23b Mon Sep 17 00:00:00 2001
From: teutat3s <10206665+teutat3s@users.noreply.github.com>
Date: Sat, 23 May 2026 12:27:10 +0200
Subject: [PATCH 12/52] nixosTests.docker: use docker_29

---
 nixos/tests/docker.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/tests/docker.nix b/nixos/tests/docker.nix
index eb92d6e21b91..834b77649110 100644
--- a/nixos/tests/docker.nix
+++ b/nixos/tests/docker.nix
@@ -15,7 +15,7 @@
       {
         virtualisation.docker.enable = true;
         virtualisation.docker.autoPrune.enable = true;
-        virtualisation.docker.package = pkgs.docker;
+        virtualisation.docker.package = pkgs.docker_29;
 
         users.users = {
           noprivs = {
@@ -48,7 +48,7 @@
     docker.succeed("docker stop sleeping")
 
     # Must match version 4 times to ensure client and server git commits and versions are correct
-    docker.succeed('[ $(docker version | grep ${pkgs.docker.version} | wc -l) = "4" ]')
+    docker.succeed('[ $(docker version | grep ${pkgs.docker_29.version} | wc -l) = "4" ]')
     docker.succeed("systemctl restart systemd-sysctl")
     docker.succeed("grep 1 /proc/sys/net/ipv4/conf/all/forwarding")
     docker.succeed("grep 1 /proc/sys/net/ipv4/conf/default/forwarding")

From 15fec05bfd8f1a790505d4875c5035520236bb24 Mon Sep 17 00:00:00 2001
From: Yureka <yureka@cyberchaos.dev>
Date: Wed, 27 May 2026 15:30:59 +0200
Subject: [PATCH 13/52] fastnetmon-advanced: 2.0.372 -> 2.0.380

https://github.com/FastNetMon/fastnetmon-advanced-releases/releases/tag/v2.0.380

Fixes:
CVE-2026-48691, CVE-2026-48690, CVE-2026-48688, CVE-2026-48683,
CVE-2026-48684, CVE-2026-48689, CVE-2026-48686

(cherry picked from commit f9f9f1be278c24fb5f9da662cbb9cdb134e19b53)
---
 pkgs/by-name/fa/fastnetmon-advanced/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fa/fastnetmon-advanced/package.nix b/pkgs/by-name/fa/fastnetmon-advanced/package.nix
index 851c19015a20..dc9c0d6a195a 100644
--- a/pkgs/by-name/fa/fastnetmon-advanced/package.nix
+++ b/pkgs/by-name/fa/fastnetmon-advanced/package.nix
@@ -9,11 +9,11 @@
 
 stdenv.mkDerivation rec {
   pname = "fastnetmon-advanced";
-  version = "2.0.372";
+  version = "2.0.380";
 
   src = fetchurl {
-    url = "https://repo.fastnetmon.com/fastnetmon_ubuntu_jammy/pool/fastnetmon/f/fastnetmon/fastnetmon_${version}_amd64.deb";
-    hash = "sha256-FwYAbTBkk+AciDVxTIimswsB0M3gbzKX+03PD0fLMsY=";
+    url = "https://repo.fastnetmon.com/fastnetmon_ubuntu_noble/pool/fastnetmon/f/fastnetmon/fastnetmon_${version}_amd64.deb";
+    hash = "sha256-4hCrDaFat0kEbyzKg6nHdV+LlqCBYYJEojyvXyPYKD0=";
   };
 
   nativeBuildInputs = [

From 78071a3fbcc235e937603e2a20f766f9d0a62e7d Mon Sep 17 00:00:00 2001
From: Yureka <yureka@cyberchaos.dev>
Date: Wed, 27 May 2026 16:16:46 +0200
Subject: [PATCH 14/52] nixos/fastnetmon: always define global hostgroup

Fixes nixosTests.fastnetmon-advanced with fastnetmon-advanced 2.0.376+

(cherry picked from commit 334db00fa1026540be8e2d9186966638bf7bbc42)
---
 nixos/modules/services/networking/fastnetmon-advanced.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/nixos/modules/services/networking/fastnetmon-advanced.nix b/nixos/modules/services/networking/fastnetmon-advanced.nix
index c57b5a6b6600..08e024d8fe6b 100644
--- a/nixos/modules/services/networking/fastnetmon-advanced.nix
+++ b/nixos/modules/services/networking/fastnetmon-advanced.nix
@@ -207,6 +207,10 @@ in
           AmbientCapabilities = "cap_net_bind_service";
         };
       };
+
+      services.fastnetmon-advanced.hostgroups = {
+        global = { };
+      };
     })
 
     (lib.mkIf (cfg.enable && cfg.enableAdvancedTrafficPersistence) {

From d5f7e7ee98ff9be1461dacce000087ff90049503 Mon Sep 17 00:00:00 2001
From: Yureka <yureka@cyberchaos.dev>
Date: Wed, 27 May 2026 16:34:03 +0200
Subject: [PATCH 15/52] nixos/tests/fastnetmon-advanced: adjust gobgp peer up
 message

(cherry picked from commit 0020162e2e5cb75e563895c3c56377d79cf8cb89)
---
 nixos/tests/fastnetmon-advanced.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/tests/fastnetmon-advanced.nix b/nixos/tests/fastnetmon-advanced.nix
index 99ef0513b1b4..a4e60a4eff31 100644
--- a/nixos/tests/fastnetmon-advanced.nix
+++ b/nixos/tests/fastnetmon-advanced.nix
@@ -62,7 +62,7 @@
       bird.wait_for_unit("bird.service")
 
       fnm.wait_until_succeeds('journalctl -eu fastnetmon.service | grep "BGP daemon restarted correctly"')
-      fnm.wait_until_succeeds("journalctl -eu gobgp.service | grep BGP_FSM_OPENCONFIRM")
+      fnm.wait_until_succeeds('journalctl -eu gobgp.service | grep "Peer Up"')
       bird.wait_until_succeeds("birdc show protocol fnm | grep Estab")
       fnm.wait_until_succeeds('journalctl -eu fastnetmon.service | grep "API server listening"')
       fnm.succeed("fcli set blackhole 172.23.42.123")

From 25ad439d4ea0ac6892253c35b12ecf9129db2017 Mon Sep 17 00:00:00 2001
From: Bad3r <25513724+Bad3r@users.noreply.github.com>
Date: Fri, 8 May 2026 21:42:21 +0300
Subject: [PATCH 16/52] nomachine-client: 9.4.14 -> 9.5.7

The 9.4.14 tarball is no longer hosted at download.nomachine.com; the
old URL now redirects to the vendor homepage and breaks fetchurl. Bump
to the current upstream release. Both x86_64 and i686 release tarballs
use build suffix _2.

Hashes recomputed via nix-prefetch-url against
https://download.nomachine.com/download/9.5/Linux/.

(cherry picked from commit 0f906ee9b43802e9c40053e5af8240faac534aa3)
---
 pkgs/by-name/no/nomachine-client/package.nix | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/no/nomachine-client/package.nix b/pkgs/by-name/no/nomachine-client/package.nix
index 8ee51201e3ce..0f9a0f6653e9 100644
--- a/pkgs/by-name/no/nomachine-client/package.nix
+++ b/pkgs/by-name/no/nomachine-client/package.nix
@@ -9,10 +9,10 @@
   libpulseaudio,
 }:
 let
-  versionMajor = "9.4";
-  versionMinor = "14";
-  versionBuild_x86_64 = "1";
-  versionBuild_i686 = "1";
+  versionMajor = "9.5";
+  versionMinor = "7";
+  versionBuild_x86_64 = "2";
+  versionBuild_i686 = "2";
 in
 stdenv.mkDerivation rec {
   pname = "nomachine-client";
@@ -22,12 +22,12 @@ stdenv.mkDerivation rec {
     if stdenv.hostPlatform.system == "x86_64-linux" then
       fetchurl {
         url = "https://download.nomachine.com/download/${versionMajor}/Linux/nomachine_${version}_${versionBuild_x86_64}_x86_64.tar.gz";
-        sha256 = "sha256-tLL8l/UgTiVzGs+mwJeRUlVA8lH72JVogBOEpaSr2AY=";
+        sha256 = "sha256-8f4ZL3Ko5VunojXLvTS9P3oB+ZVCSYIA0GIjM8VpUO4=";
       }
     else if stdenv.hostPlatform.system == "i686-linux" then
       fetchurl {
         url = "https://download.nomachine.com/download/${versionMajor}/Linux/nomachine_${version}_${versionBuild_i686}_i686.tar.gz";
-        sha256 = "sha256-pPvg8MCrpCsQiiglRxHHl9wVyndI9JTluX/mwah3wwQ=";
+        sha256 = "sha256-Yr0bw7PW34Nga8vj3TxdFFyDiVVnHJ6lBdNskOyQ8m8=";
       }
     else
       throw "NoMachine client is not supported on ${stdenv.hostPlatform.system}";

From 353c77491286edb3e00cb47c0c99194a494b2ca5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Thu, 28 May 2026 15:59:42 -0700
Subject: [PATCH 17/52] python3Packages.authlib: 1.6.11 -> 1.6.12

Diff: https://github.com/lepture/authlib/compare/v1.6.11...v1.6.12

Changelog: https://github.com/lepture/authlib/blob/v1.6.12/docs/changelog.rst
---
 pkgs/development/python-modules/authlib/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/authlib/default.nix b/pkgs/development/python-modules/authlib/default.nix
index c93ad3bf79e7..d47829f4f65f 100644
--- a/pkgs/development/python-modules/authlib/default.nix
+++ b/pkgs/development/python-modules/authlib/default.nix
@@ -20,7 +20,7 @@
 
 buildPythonPackage rec {
   pname = "authlib";
-  version = "1.6.11";
+  version = "1.6.12";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -29,7 +29,7 @@ buildPythonPackage rec {
     owner = "lepture";
     repo = "authlib";
     tag = "v${version}";
-    hash = "sha256-GZemNZavmGSFoCocpIHM0RMiR+phCxyQsV8I91azvR0=";
+    hash = "sha256-HLUv9HdVS5RM2TVIN7Vg6hP/X3iYy9LH7Uj1G+ueAW4=";
   };
 
   build-system = [ setuptools ];

From 168bfc10467813857931967a2050c7641d900f62 Mon Sep 17 00:00:00 2001
From: Lyna <git@blooym.dev>
Date: Sat, 11 Apr 2026 20:32:40 +0100
Subject: [PATCH 18/52] wivrn: wrap server with adb for wired functionality

(cherry picked from commit c1b7cc0456ef1b7a162c279fa0a15dec3bc3a436)
---
 pkgs/by-name/wi/wivrn/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/wi/wivrn/package.nix b/pkgs/by-name/wi/wivrn/package.nix
index ac7eb2e8fcfa..7c4967bbd185 100644
--- a/pkgs/by-name/wi/wivrn/package.nix
+++ b/pkgs/by-name/wi/wivrn/package.nix
@@ -6,6 +6,7 @@
   fetchFromGitLab,
   applyPatches,
   autoAddDriverRunpath,
+  android-tools,
   avahi,
   boost,
   cli11,
@@ -108,6 +109,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
+    android-tools
     eigen
     freetype
     glm
@@ -187,7 +189,8 @@ stdenv.mkDerivation (finalAttrs: {
         ]
       }
     wrapQtApp "$out/bin/wivrn-dashboard" \
-      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ vulkan-loader ]}
+      --prefix LD_LIBRARY_PATH : ${lib.makeLibraryPath [ vulkan-loader ]} \
+      --prefix PATH : ${lib.makeBinPath [ android-tools ]}
   '';
 
   desktopItems = lib.optionals (!clientLibOnly) [

From e4417221ade74900c09a222176405a6431f082fd Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Tue, 26 May 2026 14:29:47 +0200
Subject: [PATCH 19/52] putty: 0.83 -> 0.84

changelog: https://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html
(cherry picked from commit 4ea6010b3917da57fd88d22a58404ad960ea0657)
---
 pkgs/applications/networking/remote/putty/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/remote/putty/default.nix b/pkgs/applications/networking/remote/putty/default.nix
index 69f3360e1750..911390ee599c 100644
--- a/pkgs/applications/networking/remote/putty/default.nix
+++ b/pkgs/applications/networking/remote/putty/default.nix
@@ -12,7 +12,7 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "0.83";
+  version = "0.84";
   pname = "putty";
 
   src = fetchurl {
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
       "https://the.earth.li/~sgtatham/putty/${version}/${pname}-${version}.tar.gz"
       "ftp://ftp.wayne.edu/putty/putty-website-mirror/${version}/${pname}-${version}.tar.gz"
     ];
-    hash = "sha256-cYd3wT1j0N/5H+AxYrwqBbTfyLCCdjTNYLUc79/2McY=";
+    hash = "sha256-BgV4Yq4Zjx29IZ0MdJMIDVn2BhlLtQVsVJ40KqAbaf4=";
   };
 
   nativeBuildInputs = [

From 28bb283f0ca7468d98ca10197ec39e200274bb4e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 15 Dec 2025 19:30:06 +0000
Subject: [PATCH 20/52] rabbitmq-server: 4.2.1 -> 4.2.2

(cherry picked from commit 8b7c2c79a8da4a29d56dee7c86a2381c0b251755)
---
 pkgs/by-name/ra/rabbitmq-server/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ra/rabbitmq-server/package.nix b/pkgs/by-name/ra/rabbitmq-server/package.nix
index 5ae8cd54b76f..e5cb7e1d13b3 100644
--- a/pkgs/by-name/ra/rabbitmq-server/package.nix
+++ b/pkgs/by-name/ra/rabbitmq-server/package.nix
@@ -43,12 +43,12 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rabbitmq-server";
-  version = "4.2.1";
+  version = "4.2.2";
 
   # when updating, consider bumping elixir version in all-packages.nix
   src = fetchurl {
     url = "https://github.com/rabbitmq/rabbitmq-server/releases/download/v${finalAttrs.version}/${finalAttrs.pname}-${finalAttrs.version}.tar.xz";
-    hash = "sha256-loZsktSiUexsQQsMxDL4WVdtVsoXp3mEllNzkwglPgM=";
+    hash = "sha256-jLsBn3TxlFZYNYLkOtCdWvzf/SY1RqYwfJObbhXeyVI=";
   };
 
   nativeBuildInputs = [

From c49b47e88b95b6015a92fa03df1dfc56b75eb652 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 2 May 2026 00:18:48 +0000
Subject: [PATCH 21/52] distribution: 3.1.0 -> 3.1.1

(cherry picked from commit e3f2d1a6abbacdd79dc475c11475d7026a7fc37e)
---
 pkgs/by-name/di/distribution/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/di/distribution/package.nix b/pkgs/by-name/di/distribution/package.nix
index 551c2e1284ae..fa4d6c2db891 100644
--- a/pkgs/by-name/di/distribution/package.nix
+++ b/pkgs/by-name/di/distribution/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "distribution";
-  version = "3.1.0";
+  version = "3.1.1";
 
   src = fetchFromGitHub {
     owner = "distribution";
     repo = "distribution";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-r0J1zsj4Qioe8+dByqzOgJypW+A06P2uIjetPu7w+24=";
+    hash = "sha256-KsN3QW71VwGrgrhOmwzzmTm/54+ZaTFj5kNgbta1FmI=";
   };
 
   vendorHash = null;

From db84109f4c4b6d0c99bd9e1db65dca60dc1335d5 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Fri, 29 May 2026 12:25:16 +0200
Subject: [PATCH 22/52] haproxy: 3.2.9 -> 3.2.19

Fixes https://github.com/NixOS/nixpkgs/issues/510202 / CVE-2026-33555

https://www.haproxy.org/download/3.2/src/CHANGELOG

Not-cherry-picked-because: unstable is on the 3.3.x branch
---
 pkgs/by-name/ha/haproxy/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ha/haproxy/package.nix b/pkgs/by-name/ha/haproxy/package.nix
index ad0e4f3f9728..bad234ce9348 100644
--- a/pkgs/by-name/ha/haproxy/package.nix
+++ b/pkgs/by-name/ha/haproxy/package.nix
@@ -39,11 +39,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "haproxy";
-  version = "3.2.9";
+  version = "3.2.19";
 
   src = fetchurl {
     url = "https://www.haproxy.org/download/${lib.versions.majorMinor finalAttrs.version}/src/haproxy-${finalAttrs.version}.tar.gz";
-    hash = "sha256-5mDRQbKQGfTRmHhbCDTMPpyW787rgHwv/y/JNb0zVMI=";
+    hash = "sha256-sI671X9XUBLkpetbdychUx+6z2kT/9M08CgXNqGteLY=";
   };
 
   buildInputs = [

From 1a0997010cdc9dcab759b0e5eb2567814bd3ab38 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 22 Jan 2026 08:21:41 +0000
Subject: [PATCH 23/52] rabbitmq-server: 4.2.2 -> 4.2.3

(cherry picked from commit a400e16a717dfb9fc32b86eba4ce1da8d732a4ed)
---
 pkgs/by-name/ra/rabbitmq-server/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ra/rabbitmq-server/package.nix b/pkgs/by-name/ra/rabbitmq-server/package.nix
index e5cb7e1d13b3..bebbcfa61ec6 100644
--- a/pkgs/by-name/ra/rabbitmq-server/package.nix
+++ b/pkgs/by-name/ra/rabbitmq-server/package.nix
@@ -43,12 +43,12 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rabbitmq-server";
-  version = "4.2.2";
+  version = "4.2.3";
 
   # when updating, consider bumping elixir version in all-packages.nix
   src = fetchurl {
     url = "https://github.com/rabbitmq/rabbitmq-server/releases/download/v${finalAttrs.version}/${finalAttrs.pname}-${finalAttrs.version}.tar.xz";
-    hash = "sha256-jLsBn3TxlFZYNYLkOtCdWvzf/SY1RqYwfJObbhXeyVI=";
+    hash = "sha256-R1PtbkZs0aaJYUN8vZnJHG9Z+2SPOIRiaFOTz703LcA=";
   };
 
   nativeBuildInputs = [

From 51fe9dbe193fd5ca1c31da902715c3edb5c7d672 Mon Sep 17 00:00:00 2001
From: Aliaksandr <grubian2@gmail.com>
Date: Sat, 31 Jan 2026 19:39:15 +0200
Subject: [PATCH 24/52] rabbitmq-server: move overrides to package.nix

(cherry picked from commit 0b78ec0f7b52d70bd0f9cf766fdd35993d6e7d6f)
---
 pkgs/by-name/ra/rabbitmq-server/package.nix | 5 ++++-
 pkgs/top-level/all-packages.nix             | 4 ----
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/ra/rabbitmq-server/package.nix b/pkgs/by-name/ra/rabbitmq-server/package.nix
index bebbcfa61ec6..3873771025ce 100644
--- a/pkgs/by-name/ra/rabbitmq-server/package.nix
+++ b/pkgs/by-name/ra/rabbitmq-server/package.nix
@@ -1,6 +1,7 @@
 {
   lib,
-  beamPackages,
+  beam27Packages,
+  elixir_1_18,
   stdenv,
   fetchurl,
   python3,
@@ -39,6 +40,8 @@ let
       systemd # for systemd unit activation check
     ]
   );
+
+  beamPackages = beam27Packages.extend (self: super: { elixir = elixir_1_18; });
 in
 
 stdenv.mkDerivation (finalAttrs: {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 94d9832346d3..a7fa1982fa54 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9669,10 +9669,6 @@ with pkgs;
 
   qremotecontrol-server = libsForQt5.callPackage ../servers/misc/qremotecontrol-server { };
 
-  rabbitmq-server = callPackage ../by-name/ra/rabbitmq-server/package.nix {
-    beamPackages = beam27Packages.extend (self: super: { elixir = elixir_1_18; });
-  };
-
   rethinkdb = callPackage ../servers/nosql/rethinkdb {
     stdenv = clangStdenv;
     libtool = cctools;

From 478e9b24d1bf9baf9dd74216769a2693be8237af Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 17 Feb 2026 02:14:11 +0000
Subject: [PATCH 25/52] rabbitmq-server: 4.2.3 -> 4.2.4

(cherry picked from commit ec0d467e95331b1f2068c825c691b59ba34c9f58)
---
 pkgs/by-name/ra/rabbitmq-server/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ra/rabbitmq-server/package.nix b/pkgs/by-name/ra/rabbitmq-server/package.nix
index 3873771025ce..aa72ebd211ed 100644
--- a/pkgs/by-name/ra/rabbitmq-server/package.nix
+++ b/pkgs/by-name/ra/rabbitmq-server/package.nix
@@ -46,12 +46,12 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "rabbitmq-server";
-  version = "4.2.3";
+  version = "4.2.4";
 
   # when updating, consider bumping elixir version in all-packages.nix
   src = fetchurl {
     url = "https://github.com/rabbitmq/rabbitmq-server/releases/download/v${finalAttrs.version}/${finalAttrs.pname}-${finalAttrs.version}.tar.xz";
-    hash = "sha256-R1PtbkZs0aaJYUN8vZnJHG9Z+2SPOIRiaFOTz703LcA=";
+    hash = "sha256-XIBsD1xmRF4me4byAtiDqInmQ4y5dxKSezc2tZuapLU=";
   };
 
   nativeBuildInputs = [

From 61ce030aac65645a649c9c8221b97482a8f09064 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 29 May 2026 06:30:30 +0000
Subject: [PATCH 26/52] alire: 2.1.0 -> 2.1.1

(cherry picked from commit d5255d6a012c271be03d05ad19c1da54a1b31c38)
---
 pkgs/by-name/al/alire/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/al/alire/package.nix b/pkgs/by-name/al/alire/package.nix
index eab812c63c9f..19311fab482b 100644
--- a/pkgs/by-name/al/alire/package.nix
+++ b/pkgs/by-name/al/alire/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "alire";
-  version = "2.1.0";
+  version = "2.1.1";
 
   src = fetchFromGitHub {
     owner = "alire-project";
     repo = "alire";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DfzCQu9xOe9JgX6RTrYOGTIS6EcPimLnd5pfXMtfRss=";
+    hash = "sha256-YOUFTKbqbFfdYNWcGCvtFCDCW2tH8E3YuRQrV522Px4=";
 
     fetchSubmodules = true;
   };

From 291a247dec849a5c35c4e15d23bc72e346b3e9ce Mon Sep 17 00:00:00 2001
From: Andranik <tednaaa@gmail.com>
Date: Thu, 15 Jan 2026 14:33:46 +0400
Subject: [PATCH 27/52] zed-editor: 0.218.6 -> 0.219.4

(cherry picked from commit 8cb4e25877138411e61dc99d9e223346ce89aef1)
---
 pkgs/by-name/ze/zed-editor/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 570e11426837..9c7e6c16f23c 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -106,7 +106,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.218.6";
+  version = "0.219.4";
 
   outputs = [
     "out"
@@ -119,7 +119,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fNwJWC48DqUECadQ12p+iCHR7pIueFFdu6QRdomJ6/o=";
+    hash = "sha256-x0N+xGoWNQOXI/b6hityYy6ZbcAPTrzGKMbgCxDcHhM=";
   };
 
   postPatch = ''
@@ -139,7 +139,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm -r $out/git/*/candle-book/
   '';
 
-  cargoHash = "sha256-+8L4BaR7J+j7ytQ7JM8XbuAYDKzq8Hv3oKQFnN0TdK0=";
+  cargoHash = "sha256-adHfP57EpqCOo8HSpuG1JTV6qNljz282PYgR32cCuxE=";
 
   nativeBuildInputs = [
     cmake

From 440cdc801bdc361e487ce6b77dc253b23c017857 Mon Sep 17 00:00:00 2001
From: Vikingnope <aidsch0605@outlook.com>
Date: Thu, 22 Jan 2026 18:45:33 +0100
Subject: [PATCH 28/52] zed-editor: 0.219.4 -> 0.220.3

(cherry picked from commit 052182ca89e110ba7c9819f9ade61217d1f864f1)
---
 pkgs/by-name/ze/zed-editor/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 9c7e6c16f23c..287f267197c3 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -106,7 +106,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.219.4";
+  version = "0.220.3";
 
   outputs = [
     "out"
@@ -119,7 +119,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-x0N+xGoWNQOXI/b6hityYy6ZbcAPTrzGKMbgCxDcHhM=";
+    hash = "sha256-BxGNgJxwX7qY4chi5xaJ8RZnmo80v+9QeZOPTUpsHBc=";
   };
 
   postPatch = ''
@@ -139,7 +139,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm -r $out/git/*/candle-book/
   '';
 
-  cargoHash = "sha256-adHfP57EpqCOo8HSpuG1JTV6qNljz282PYgR32cCuxE=";
+  cargoHash = "sha256-pjHJkvdZn5JoL9LSdnmpov8/mGZQKzM5lC4u7MZEsQ4=";
 
   nativeBuildInputs = [
     cmake

From d6912e493c72b64f3ae01c16131b43fad64ae450 Mon Sep 17 00:00:00 2001
From: Vikingnope <aidsch0605@outlook.com>
Date: Sun, 25 Jan 2026 20:16:38 +0100
Subject: [PATCH 29/52] zed-editor: 0.220.3 -> 0.220.6

(cherry picked from commit 07c27d1b753acd6051728d931d79f6e01dbb97b4)
---
 pkgs/by-name/ze/zed-editor/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 287f267197c3..784a040ea890 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -106,7 +106,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.220.3";
+  version = "0.220.6";
 
   outputs = [
     "out"
@@ -119,7 +119,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BxGNgJxwX7qY4chi5xaJ8RZnmo80v+9QeZOPTUpsHBc=";
+    hash = "sha256-jwSh2QkQpShDvTurJPPvt4khGaNQmoVbJyiLcccp2PU=";
   };
 
   postPatch = ''
@@ -139,7 +139,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm -r $out/git/*/candle-book/
   '';
 
-  cargoHash = "sha256-pjHJkvdZn5JoL9LSdnmpov8/mGZQKzM5lC4u7MZEsQ4=";
+  cargoHash = "sha256-KWsxxAPz1BoO/fKiRG6cpXB8IBGC+n4ZdommcTauXdQ=";
 
   nativeBuildInputs = [
     cmake

From 6ff2707e67c7c484292eb070ddfdd68901ada70f Mon Sep 17 00:00:00 2001
From: Vikingnope <aidsch0605@outlook.com>
Date: Wed, 28 Jan 2026 18:42:51 +0100
Subject: [PATCH 30/52] zed-editor: 0.220.6 -> 0.221.4

(cherry picked from commit 36776f75026507d9eb2d03b5ddcd18bfdbf03cd9)
---
 pkgs/by-name/ze/zed-editor/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 784a040ea890..47e69f61f647 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -106,7 +106,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.220.6";
+  version = "0.221.4";
 
   outputs = [
     "out"
@@ -119,7 +119,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jwSh2QkQpShDvTurJPPvt4khGaNQmoVbJyiLcccp2PU=";
+    hash = "sha256-Uiwfs80eCjbd/rnXkOmv85NY05XeY9Qu0vf8I+cDElo=";
   };
 
   postPatch = ''
@@ -139,7 +139,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm -r $out/git/*/candle-book/
   '';
 
-  cargoHash = "sha256-KWsxxAPz1BoO/fKiRG6cpXB8IBGC+n4ZdommcTauXdQ=";
+  cargoHash = "sha256-kwV6tejCUwkFLdBCClm/AOxTieSUXnE/dP2UERlLv7U=";
 
   nativeBuildInputs = [
     cmake

From 3b2fcb84404f68a6a2fa96ed5866ff3ccddf6e30 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 30 Jan 2026 18:39:06 +0000
Subject: [PATCH 31/52] zed-editor: 0.221.4 -> 0.221.5

(cherry picked from commit f9caedf52c801cee232d372279725b741ce18552)
---
 pkgs/by-name/ze/zed-editor/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 47e69f61f647..2ac0e583f325 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -106,7 +106,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.221.4";
+  version = "0.221.5";
 
   outputs = [
     "out"
@@ -119,7 +119,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Uiwfs80eCjbd/rnXkOmv85NY05XeY9Qu0vf8I+cDElo=";
+    hash = "sha256-1q0nwNsPbckGivm9MAXvGX8/SC0ioQVEB93W7Zpobcs=";
   };
 
   postPatch = ''
@@ -139,7 +139,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm -r $out/git/*/candle-book/
   '';
 
-  cargoHash = "sha256-kwV6tejCUwkFLdBCClm/AOxTieSUXnE/dP2UERlLv7U=";
+  cargoHash = "sha256-vmG90W+MNUZ+3IiLltr5ok7h6fP7WfS7gwy3LloIAIw=";
 
   nativeBuildInputs = [
     cmake

From 421f2b6fd68057fd9b3f0ccde395ac92d2f1b457 Mon Sep 17 00:00:00 2001
From: Jingles <45833444+Jingles52@users.noreply.github.com>
Date: Sun, 8 Feb 2026 08:48:04 -0700
Subject: [PATCH 32/52] zed-editor: fix remote binary name

(cherry picked from commit 1d647e7aaf541358b2297b1fcac9d9819009d48e)
---
 pkgs/by-name/ze/zed-editor/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 2ac0e583f325..216feb57ae59 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -49,6 +49,7 @@
 assert withGLES -> stdenv.hostPlatform.isLinux;
 
 let
+  channel = "stable";
   executableName = "zeditor";
   # Based on vscode.fhs
   # Zed allows for users to download and use extensions
@@ -285,7 +286,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     )
   ''
   + lib.optionalString buildRemoteServer ''
-    install -Dm755 $release_target/remote_server $remote_server/bin/zed-remote-server-stable-$version
+    install -Dm755 $release_target/remote_server $remote_server/bin/zed-remote-server-${channel}-$version+${channel}
   ''
   + ''
     runHook postInstall
@@ -320,7 +321,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     tests = {
       remoteServerVersion = testers.testVersion {
         package = finalAttrs.finalPackage.remote_server;
-        command = "zed-remote-server-stable-${finalAttrs.version} version";
+        command = "zed-remote-server-${channel}-${finalAttrs.version}+${channel} version";
       };
     }
     // lib.optionalAttrs stdenv.hostPlatform.isLinux {

From 3231d004056966f37c01ed82ce83e50931cbab92 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Tue, 10 Feb 2026 09:32:16 +0000
Subject: [PATCH 33/52] zed-editor: factorize remote-server executable name

(cherry picked from commit b9ef190acb9ee86f6a5bed0b6793285d23d600a3)
---
 pkgs/by-name/ze/zed-editor/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 216feb57ae59..8cea285c48a9 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -229,6 +229,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   useNextest = true;
 
+  remoteServerExecutableName = "zed-remote-server-${channel}-${finalAttrs.version}+${channel}";
   installPhase = ''
     runHook preInstall
 
@@ -286,7 +287,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     )
   ''
   + lib.optionalString buildRemoteServer ''
-    install -Dm755 $release_target/remote_server $remote_server/bin/zed-remote-server-${channel}-$version+${channel}
+    install -Dm755 $release_target/remote_server $remote_server/bin/${finalAttrs.remoteServerExecutableName}
   ''
   + ''
     runHook postInstall
@@ -321,7 +322,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     tests = {
       remoteServerVersion = testers.testVersion {
         package = finalAttrs.finalPackage.remote_server;
-        command = "zed-remote-server-${channel}-${finalAttrs.version}+${channel} version";
+        command = "${finalAttrs.remoteServerExecutableName} version";
       };
     }
     // lib.optionalAttrs stdenv.hostPlatform.isLinux {

From 1a210cb13569bcd7f9e54e92155760db8057232d Mon Sep 17 00:00:00 2001
From: Niklas Korz <niklas@niklaskorz.de>
Date: Fri, 13 Feb 2026 21:24:33 +0100
Subject: [PATCH 34/52] zed-editor: 0.221.5 -> 0.223.3

Changelogs:

- https://github.com/zed-industries/zed/releases/tag/v0.222.2
- https://github.com/zed-industries/zed/releases/tag/v0.222.3
- https://github.com/zed-industries/zed/releases/tag/v0.222.4
- https://github.com/zed-industries/zed/releases/tag/v0.222.5
- https://github.com/zed-industries/zed/releases/tag/v0.223.2
- https://github.com/zed-industries/zed/releases/tag/v0.223.3

(cherry picked from commit a0cc538a36e5c1c60249302c5ad927e1b7b33a0e)
---
 pkgs/by-name/ze/zed-editor/package.nix | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 8cea285c48a9..0a3e2eeee953 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -107,7 +107,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.221.5";
+  version = "0.223.3";
 
   outputs = [
     "out"
@@ -120,7 +120,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1q0nwNsPbckGivm9MAXvGX8/SC0ioQVEB93W7Zpobcs=";
+    hash = "sha256-BxSvMbZ5RrVxCmqIvpzgUCcFMmDQsYufDCz0igkwLkk=";
   };
 
   postPatch = ''
@@ -140,7 +140,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm -r $out/git/*/candle-book/
   '';
 
-  cargoHash = "sha256-vmG90W+MNUZ+3IiLltr5ok7h6fP7WfS7gwy3LloIAIw=";
+  cargoHash = "sha256-cGobyrF3upHZy2m1eDHibZzTkgdN5rUYXLV0zu6F6tk=";
 
   nativeBuildInputs = [
     cmake
@@ -194,6 +194,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # proprietary Metal shader compiler.
   buildFeatures = lib.optionals stdenv.hostPlatform.isDarwin [ "gpui/runtime_shaders" ];
 
+  # Some crates define extra types or enum values in test configuration which then lead
+  # to type checking errors in other crates unless this feature is enabled.
+  checkFeatures = [ "visual-tests" ];
+
   env = {
     ALLOW_MISSING_LICENSES = true;
     ZSTD_SYS_USE_PKG_CONFIG = true;

From 7264508d49ff1a05ba957e07852220fba9283ca8 Mon Sep 17 00:00:00 2001
From: Thomas FitzGerald <tomrfitz@gmail.com>
Date: Mon, 16 Feb 2026 04:04:27 -0500
Subject: [PATCH 35/52] zed-editor: fix darwin build by appending buildFeatures
 to checkFeatures

For the same reason runtime_shaders is passed to buildFeatures, it must also be
passed to checkFeatures to avoid fallback to proprietary Metal shaders not
available in Nix sandbox.

Co-authored-by: Niklas Korz <niklas@niklaskorz.de>
(cherry picked from commit 4a37c33e290eb3ad133d65738b874f728ba60776)
---
 pkgs/by-name/ze/zed-editor/package.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 0a3e2eeee953..c2fdad011bbf 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -196,7 +196,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   # Some crates define extra types or enum values in test configuration which then lead
   # to type checking errors in other crates unless this feature is enabled.
-  checkFeatures = [ "visual-tests" ];
+  # gpui/runtime_shaders is required on darwin for the same reason as buildFeatures above:
+  # without it, build.rs invokes the proprietary Metal shader compiler.
+  checkFeatures = [
+    "visual-tests"
+  ]
+  ++ finalAttrs.buildFeatures;
 
   env = {
     ALLOW_MISSING_LICENSES = true;

From 5e00562ac312e0a1e55457b132eadcd63b0b569b Mon Sep 17 00:00:00 2001
From: Vikingnope <aidsch0605@outlook.com>
Date: Wed, 18 Feb 2026 20:40:48 +0100
Subject: [PATCH 36/52] zed-editor: 0.223.3 -> 0.224.5

(cherry picked from commit a4aad19fcc3d70f0b045dc9c3d6a0332730ce3ee)
---
 pkgs/by-name/ze/zed-editor/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index c2fdad011bbf..950f0cd27a11 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -107,7 +107,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.223.3";
+  version = "0.224.5";
 
   outputs = [
     "out"
@@ -120,7 +120,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-BxSvMbZ5RrVxCmqIvpzgUCcFMmDQsYufDCz0igkwLkk=";
+    hash = "sha256-GXvvj9jFayUDQxnxlDiQqJMTWcy4V8dMKlNNwfHkdb0=";
   };
 
   postPatch = ''
@@ -140,7 +140,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm -r $out/git/*/candle-book/
   '';
 
-  cargoHash = "sha256-cGobyrF3upHZy2m1eDHibZzTkgdN5rUYXLV0zu6F6tk=";
+  cargoHash = "sha256-bROXswYAFuI7aRVoRvO3HhXIPfV19Is/SNtfhIiJ50Y=";
 
   nativeBuildInputs = [
     cmake

From 3da513231ee210305b3213ab0835d7341d434d3d Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Thu, 19 Feb 2026 13:55:09 +0800
Subject: [PATCH 37/52] zed-editor: 0.224.5 -> 0.224.6

(cherry picked from commit 6dab0e18be0dd05e71658ba4d27cfd75be599768)
---
 pkgs/by-name/ze/zed-editor/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 950f0cd27a11..d9518670c40d 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -107,7 +107,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.224.5";
+  version = "0.224.6";
 
   outputs = [
     "out"
@@ -120,7 +120,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GXvvj9jFayUDQxnxlDiQqJMTWcy4V8dMKlNNwfHkdb0=";
+    hash = "sha256-GbTWkD+JVYr+jem9MBQ4bTtPDogIU1XfQy2RmsnY9uI=";
   };
 
   postPatch = ''
@@ -140,7 +140,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm -r $out/git/*/candle-book/
   '';
 
-  cargoHash = "sha256-bROXswYAFuI7aRVoRvO3HhXIPfV19Is/SNtfhIiJ50Y=";
+  cargoHash = "sha256-FTbxMJrub0l0hL8zisD2Ov9JXIRwZjOuTkzjmrImOd4=";
 
   nativeBuildInputs = [
     cmake

From b1c8fb0bf7c1163054c5236029ddda3fc9176300 Mon Sep 17 00:00:00 2001
From: Vikingnope <aidsch0605@outlook.com>
Date: Fri, 20 Feb 2026 09:48:54 +0100
Subject: [PATCH 38/52] zed-editor: 0.224.6 -> 0.224.8

(cherry picked from commit 5603a078f15e9aef588aa25fecf7904a6084945b)
---
 pkgs/by-name/ze/zed-editor/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index d9518670c40d..52e535165327 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -107,7 +107,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.224.6";
+  version = "0.224.8";
 
   outputs = [
     "out"
@@ -120,7 +120,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GbTWkD+JVYr+jem9MBQ4bTtPDogIU1XfQy2RmsnY9uI=";
+    hash = "sha256-rY2g35gRtuQ9si9GYPjmq3boPsTkTD0OZET6dmR597A=";
   };
 
   postPatch = ''
@@ -140,7 +140,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm -r $out/git/*/candle-book/
   '';
 
-  cargoHash = "sha256-FTbxMJrub0l0hL8zisD2Ov9JXIRwZjOuTkzjmrImOd4=";
+  cargoHash = "sha256-eJwvUtZobIRXKJOyERczTRQzDR7ml3uqgWMd+vXStQE=";
 
   nativeBuildInputs = [
     cmake

From 7ac7ef494eface1777f1055388b1e8e5b3b04696 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 21 Feb 2026 08:54:17 +0000
Subject: [PATCH 39/52] zed-editor: 0.224.8 -> 0.224.11

(cherry picked from commit e4bf2a3807d74a0634fdc17de7622ce1be9c8cee)
---
 pkgs/by-name/ze/zed-editor/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 52e535165327..5b7b6a72ec72 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -107,7 +107,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.224.8";
+  version = "0.224.11";
 
   outputs = [
     "out"
@@ -120,7 +120,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rY2g35gRtuQ9si9GYPjmq3boPsTkTD0OZET6dmR597A=";
+    hash = "sha256-VOPAypHlcr7nY3/wk4ec/Ltv+DUf/v4rHDa5oCsg0aE=";
   };
 
   postPatch = ''
@@ -140,7 +140,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm -r $out/git/*/candle-book/
   '';
 
-  cargoHash = "sha256-eJwvUtZobIRXKJOyERczTRQzDR7ml3uqgWMd+vXStQE=";
+  cargoHash = "sha256-V61uZEl6LG/xckOajcWugf/K+mJR8Bn9WjqxvvwBbfw=";
 
   nativeBuildInputs = [
     cmake

From bde5f284aab04ff1649f169d71a562dd216c9fef Mon Sep 17 00:00:00 2001
From: Niklas Korz <niklas@niklaskorz.de>
Date: Tue, 3 Mar 2026 08:23:17 +0100
Subject: [PATCH 40/52] zed-editor: 0.224.11 -> 0.225.12

Changelogs:

- https://github.com/zed-industries/zed/releases/tag/v0.225.12
- https://github.com/zed-industries/zed/releases/tag/v0.225.10
- https://github.com/zed-industries/zed/releases/tag/v0.225.9

The `zed::tests::test_window_edit_state_restoring_enabled` test had been
disabled before we switched to cargo-nextest, but is now failing again
for unknown reasons.

(cherry picked from commit ee8328f6aad36f39e149cf39a55b6b56d57aed2b)
---
 pkgs/by-name/ze/zed-editor/package.nix | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 5b7b6a72ec72..2cae358bd699 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -107,7 +107,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.224.11";
+  version = "0.225.12";
 
   outputs = [
     "out"
@@ -120,7 +120,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VOPAypHlcr7nY3/wk4ec/Ltv+DUf/v4rHDa5oCsg0aE=";
+    hash = "sha256-rVJ+NNsnhoXr6y2j2VFrXQVrgbXQY/a6l2Khs36SvDU=";
   };
 
   postPatch = ''
@@ -140,7 +140,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm -r $out/git/*/candle-book/
   '';
 
-  cargoHash = "sha256-V61uZEl6LG/xckOajcWugf/K+mJR8Bn9WjqxvvwBbfw=";
+  cargoHash = "sha256-i6BZPAKCgomWA/c923/tB9uWtXGr5VXIqmGCYtUUBLM=";
 
   nativeBuildInputs = [
     cmake
@@ -203,6 +203,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ]
   ++ finalAttrs.buildFeatures;
 
+  # cargo-nextest does not support the `=` syntax for parameters, so all test skips must be defined
+  # as two separate arguments
+  checkFlags = lib.optionals stdenv.hostPlatform.isLinux [
+    # Fails on Linux since v0.225, possibly related to https://github.com/zed-industries/zed/pull/48800
+    "--skip"
+    "zed::tests::test_window_edit_state_restoring_enabled"
+  ];
+
   env = {
     ALLOW_MISSING_LICENSES = true;
     ZSTD_SYS_USE_PKG_CONFIG = true;

From d241506fb8bb237f101863858717aba3a52f3b5d Mon Sep 17 00:00:00 2001
From: Aiden Schembri <aidsch0605@outlook.com>
Date: Wed, 4 Mar 2026 08:06:18 +0100
Subject: [PATCH 41/52] zed-editor: 0.225.12 -> 0.225.13

(cherry picked from commit 93652bcff27b6a060a461d39578af6640c74cbe0)
---
 pkgs/by-name/ze/zed-editor/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 2cae358bd699..583d9531bb37 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -107,7 +107,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.225.12";
+  version = "0.225.13";
 
   outputs = [
     "out"
@@ -120,7 +120,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rVJ+NNsnhoXr6y2j2VFrXQVrgbXQY/a6l2Khs36SvDU=";
+    hash = "sha256-ozuycL8dnBtgyYYjsz9C+CDtZQzbXWWZVOkxbOs7hho=";
   };
 
   postPatch = ''
@@ -140,7 +140,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm -r $out/git/*/candle-book/
   '';
 
-  cargoHash = "sha256-i6BZPAKCgomWA/c923/tB9uWtXGr5VXIqmGCYtUUBLM=";
+  cargoHash = "sha256-G5U0APQNNEe2qpshqX4QpQGbqIAHllatbbsaVAhDoG0=";
 
   nativeBuildInputs = [
     cmake

From dcd47467d812f38533e79d5f6673cdbdbd8216b1 Mon Sep 17 00:00:00 2001
From: Aiden Schembri <aidsch0605@outlook.com>
Date: Wed, 4 Mar 2026 19:26:52 +0100
Subject: [PATCH 42/52] zed-editor: 0.225.13 -> 0.226.4

(cherry picked from commit 2c9d900c6e33deb81cebb85e83e23d26fbce3198)
---
 pkgs/by-name/ze/zed-editor/package.nix | 18 +++++-------------
 1 file changed, 5 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 583d9531bb37..23af33e55910 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -107,7 +107,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.225.13";
+  version = "0.226.4";
 
   outputs = [
     "out"
@@ -120,7 +120,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ozuycL8dnBtgyYYjsz9C+CDtZQzbXWWZVOkxbOs7hho=";
+    hash = "sha256-vF/vvEJKl1mUcF6TMif5G9rQPjt+2RWImWy1f7RxgfE=";
   };
 
   postPatch = ''
@@ -140,7 +140,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm -r $out/git/*/candle-book/
   '';
 
-  cargoHash = "sha256-G5U0APQNNEe2qpshqX4QpQGbqIAHllatbbsaVAhDoG0=";
+  cargoHash = "sha256-IH/FEC52VudtXsSHiju6T7H9E2kblJ0RyiUoQR391cc=";
 
   nativeBuildInputs = [
     cmake
@@ -192,25 +192,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   # Required on darwin because we don't have access to the
   # proprietary Metal shader compiler.
-  buildFeatures = lib.optionals stdenv.hostPlatform.isDarwin [ "gpui/runtime_shaders" ];
+  buildFeatures = lib.optionals stdenv.hostPlatform.isDarwin [ "gpui_platform/runtime_shaders" ];
 
   # Some crates define extra types or enum values in test configuration which then lead
   # to type checking errors in other crates unless this feature is enabled.
-  # gpui/runtime_shaders is required on darwin for the same reason as buildFeatures above:
+  # gpui_platform/runtime_shaders is required on darwin for the same reason as buildFeatures above:
   # without it, build.rs invokes the proprietary Metal shader compiler.
   checkFeatures = [
     "visual-tests"
   ]
   ++ finalAttrs.buildFeatures;
 
-  # cargo-nextest does not support the `=` syntax for parameters, so all test skips must be defined
-  # as two separate arguments
-  checkFlags = lib.optionals stdenv.hostPlatform.isLinux [
-    # Fails on Linux since v0.225, possibly related to https://github.com/zed-industries/zed/pull/48800
-    "--skip"
-    "zed::tests::test_window_edit_state_restoring_enabled"
-  ];
-
   env = {
     ALLOW_MISSING_LICENSES = true;
     ZSTD_SYS_USE_PKG_CONFIG = true;

From d405a4bc77fd22c3fc624a366a19eb9e9e331df3 Mon Sep 17 00:00:00 2001
From: Aiden Schembri <aidsch0605@outlook.com>
Date: Fri, 6 Mar 2026 15:11:39 +0100
Subject: [PATCH 43/52] zed-editor: 0.226.4 -> 0.226.5

(cherry picked from commit ca1657b2f5977aad6514ca183ca670af453dbe0e)
---
 pkgs/by-name/ze/zed-editor/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 23af33e55910..a1695d3a0e75 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -107,7 +107,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.226.4";
+  version = "0.226.5";
 
   outputs = [
     "out"
@@ -120,7 +120,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vF/vvEJKl1mUcF6TMif5G9rQPjt+2RWImWy1f7RxgfE=";
+    hash = "sha256-ZfYwlHTWirUb2RjEIQyonIHMneCi7ZGD2kPYOfe5HiI=";
   };
 
   postPatch = ''
@@ -140,7 +140,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm -r $out/git/*/candle-book/
   '';
 
-  cargoHash = "sha256-IH/FEC52VudtXsSHiju6T7H9E2kblJ0RyiUoQR391cc=";
+  cargoHash = "sha256-kdGHSNfvB/GUQ/7iqzXcCF4sbyaMiLYq+/zogg9N/aU=";
 
   nativeBuildInputs = [
     cmake

From 5ed65836ec4205afe3c3aec8d7814aed3910d839 Mon Sep 17 00:00:00 2001
From: Niklas Korz <niklas@niklaskorz.de>
Date: Sun, 22 Mar 2026 18:38:06 +0100
Subject: [PATCH 44/52] zed-editor: 0.226.5 -> 0.228.0

Changelogs:

- https://github.com/zed-industries/zed/releases/tag/v0.228.0
- https://github.com/zed-industries/zed/releases/tag/v0.227.1

Co-Authored-By: Aiden Schembri <aidsch0605@outlook.com>
(cherry picked from commit 048cd370e88a865e9907bf51153d2f2ef854d866)
---
 pkgs/by-name/ze/zed-editor/package.nix | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index a1695d3a0e75..f9808b782bc4 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -15,6 +15,7 @@
   sqlite,
   zlib,
   zstd,
+  glib,
   alsa-lib,
   libxkbcommon,
   wayland,
@@ -107,7 +108,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.226.5";
+  version = "0.228.0";
 
   outputs = [
     "out"
@@ -120,7 +121,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ZfYwlHTWirUb2RjEIQyonIHMneCi7ZGD2kPYOfe5HiI=";
+    hash = "sha256-oQ3cW4cFBkyrO4elTXB3Etek6ilL0XkB45z/tuPwTJs=";
   };
 
   postPatch = ''
@@ -132,6 +133,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     # newer versions work just as well.
     substituteInPlace script/generate-licenses \
       --replace-fail '$CARGO_ABOUT_VERSION' '${cargo-about.version}'
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
+    # webrtc-sys expects glib headers to be in the sysroot, so we have to point it in the right direction
+    substituteInPlace $cargoDepsCopy/webrtc-sys-*/build.rs \
+      --replace-fail 'builder.include(&glib_path);' 'builder.include("${lib.getInclude glib}/include/glib-2.0");' \
+      --replace-fail 'builder.include(&glib_path_config);' 'builder.include("${lib.getLib glib}/lib/glib-2.0/include");'
   '';
 
   # remove package that has a broken Cargo.toml
@@ -140,7 +147,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm -r $out/git/*/candle-book/
   '';
 
-  cargoHash = "sha256-kdGHSNfvB/GUQ/7iqzXcCF4sbyaMiLYq+/zogg9N/aU=";
+  cargoHash = "sha256-K4lxI11fEuLYBWy6Z+o0MmtJFJYawwS4UUq0Jgue2hE=";
 
   nativeBuildInputs = [
     cmake
@@ -168,6 +175,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     zstd
   ]
   ++ lib.optionals stdenv.hostPlatform.isLinux [
+    glib
     alsa-lib
     libxkbcommon
     wayland

From 1fdb9d7afe958cbe2b6e51ac661ab0eeb6abe44a Mon Sep 17 00:00:00 2001
From: Aiden Schembri <aidsch0605@outlook.com>
Date: Wed, 25 Mar 2026 17:47:34 +0100
Subject: [PATCH 45/52] zed-editor: 0.228.0 -> 0.229.0

(cherry picked from commit 6ea6b5881567ead0d610cdd60014d937220b5bbd)
---
 pkgs/by-name/ze/zed-editor/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index f9808b782bc4..7b115422f4f3 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -108,7 +108,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.228.0";
+  version = "0.229.0";
 
   outputs = [
     "out"
@@ -121,7 +121,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oQ3cW4cFBkyrO4elTXB3Etek6ilL0XkB45z/tuPwTJs=";
+    hash = "sha256-ZO4HzzzTb5rlBbzVCpE14DEzLkE3a7v2IKdyzlCTpaA=";
   };
 
   postPatch = ''
@@ -147,7 +147,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     rm -r $out/git/*/candle-book/
   '';
 
-  cargoHash = "sha256-K4lxI11fEuLYBWy6Z+o0MmtJFJYawwS4UUq0Jgue2hE=";
+  cargoHash = "sha256-Q7sjd5u1jPIK6WogCByaXAVU7D6jcev1oRmfQ7y39i4=";
 
   nativeBuildInputs = [
     cmake

From 0ed5630715e66332c024afa86516799af8444180 Mon Sep 17 00:00:00 2001
From: Niklas Korz <niklas@niklaskorz.de>
Date: Fri, 29 May 2026 15:01:04 +0200
Subject: [PATCH 46/52] zed-editor: build with Rust 1.94

Required by recent Zed versions.

Not-cherry-picked-because: master defaults to Rust 1.95
---
 pkgs/by-name/ze/zed-editor/package.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 7b115422f4f3..20a196349fa7 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  rustPlatform,
+  rustPackages_1_94,
   fetchFromGitHub,
   cmake,
   copyDesktopItems,
@@ -50,6 +50,7 @@
 assert withGLES -> stdenv.hostPlatform.isLinux;
 
 let
+  inherit (rustPackages_1_94) rustPlatform;
   channel = "stable";
   executableName = "zeditor";
   # Based on vscode.fhs

From 811855cc81456586e69f484b9eb96fd0446695bb Mon Sep 17 00:00:00 2001
From: Josh Robson Chase <josh@robsonchase.com>
Date: Fri, 20 Mar 2026 13:01:43 -0400
Subject: [PATCH 47/52] livekit-libwebrtc: 125-unstable-2025-07-25 ->
 137-unstable-2026-03-12, enable x11 and pipewire

(cherry picked from commit 6a6b02f3c1bf9a7e135a26698e507f0cae1f805f)
---
 .../0001-shared-libraries.patch               |  16 +-
 .../livekit-libwebrtc/chromium-129-rust.patch |  21 +++
 .../li/livekit-libwebrtc/libwebrtc.version    |  22 +++
 .../livekit-libwebrtc/mkSystemLibraries.nix   |   4 +-
 pkgs/by-name/li/livekit-libwebrtc/package.nix |  94 ++++++++--
 .../li/livekit-libwebrtc/pipewire-1.5.patch   |  35 ++++
 .../by-name/li/livekit-libwebrtc/sources.json | 174 ++++++++++--------
 7 files changed, 258 insertions(+), 108 deletions(-)
 create mode 100644 pkgs/by-name/li/livekit-libwebrtc/chromium-129-rust.patch
 create mode 100644 pkgs/by-name/li/livekit-libwebrtc/libwebrtc.version
 create mode 100644 pkgs/by-name/li/livekit-libwebrtc/pipewire-1.5.patch

diff --git a/pkgs/by-name/li/livekit-libwebrtc/0001-shared-libraries.patch b/pkgs/by-name/li/livekit-libwebrtc/0001-shared-libraries.patch
index 1baf8dd63081..2a7fcf0cbdd5 100644
--- a/pkgs/by-name/li/livekit-libwebrtc/0001-shared-libraries.patch
+++ b/pkgs/by-name/li/livekit-libwebrtc/0001-shared-libraries.patch
@@ -1,15 +1,17 @@
-diff --git a/BUILD.gn b/BUILD.gn
-index d5289b8..598bbbc 100644
 --- a/BUILD.gn
 +++ b/BUILD.gn
-@@ -138,8 +138,8 @@ config("library_impl_config") {
+@@ -143,8 +143,12 @@
  # target_defaults and direct_dependent_settings.
  config("common_inherited_config") {
-   defines = []
+   defines = [ "PROTOBUF_ENABLE_DEBUG_LOGGING_MAY_LEAK_PII=0" ]
 -  cflags = []
 -  ldflags = []
 +  cflags = [ "-fvisibility=default" ]
 +  ldflags = [ "-lavutil", "-lavformat", "-lavcodec" ]
- 
-   if (rtc_dlog_always_on) {
-     defines += [ "DLOG_ALWAYS_ON" ]
++
++  if (is_linux) {
++    ldflags += [ "-Wl,--version-script=" + rebase_path("//libwebrtc.version", root_build_dir) ]
++  }
+
+   if (rtc_objc_prefix != "") {
+     defines += [ "RTC_OBJC_TYPE_PREFIX=${rtc_objc_prefix}" ]
diff --git a/pkgs/by-name/li/livekit-libwebrtc/chromium-129-rust.patch b/pkgs/by-name/li/livekit-libwebrtc/chromium-129-rust.patch
new file mode 100644
index 000000000000..1fe0c7f87324
--- /dev/null
+++ b/pkgs/by-name/li/livekit-libwebrtc/chromium-129-rust.patch
@@ -0,0 +1,21 @@
+diff --git a/build/config/compiler/BUILD.gn b/build/config/compiler/BUILD.gn
+index 45086d6838cac..81132ad8ecb31 100644
+--- a/build/config/compiler/BUILD.gn
++++ b/build/config/compiler/BUILD.gn
+@@ -1727,16 +1727,6 @@ config("runtime_library") {
+     configs += [ "//build/config/c++:runtime_library" ]
+   }
+ 
+-  # Rust and C++ both provide intrinsics for LLVM to call for math operations. We
+-  # want to use the C++ intrinsics, not the ones in the Rust compiler_builtins
+-  # library. The Rust symbols are marked as weak, so that they can be replaced by
+-  # the C++ symbols. This config ensures the C++ symbols exist and are strong in
+-  # order to cause that replacement to occur by explicitly linking in clang's
+-  # compiler-rt library.
+-  if (is_clang && !is_nacl && !is_cronet_build) {
+-    configs += [ "//build/config/clang:compiler_builtins" ]
+-  }
+-
+   # TODO(crbug.com/40570904): Come up with a better name for is POSIX + Fuchsia
+   # configuration.
+   if (is_posix || is_fuchsia) {
diff --git a/pkgs/by-name/li/livekit-libwebrtc/libwebrtc.version b/pkgs/by-name/li/livekit-libwebrtc/libwebrtc.version
new file mode 100644
index 000000000000..abf9d5b9df61
--- /dev/null
+++ b/pkgs/by-name/li/livekit-libwebrtc/libwebrtc.version
@@ -0,0 +1,22 @@
+/* Linker version script for libwebrtc.so (Linux only).
+ *
+ * When libwebrtc.so is built with rtc_use_pipewire=true and
+ * -fvisibility=default, PipeWire lazy-load trampoline stubs (pw_*, spa_*)
+ * are exported as weak symbols. If the PipeWire ALSA plugin
+ * (libasound_module_pcm_pipewire.so) is later dlopen'd by libasound,
+ * the dynamic linker may resolve the plugin's pw_* references through
+ * libwebrtc.so's broken trampolines instead of the real libpipewire.so,
+ * causing a SIGSEGV (NULL function pointer dereference).
+ *
+ * This script hides only those third-party symbol namespaces while
+ * keeping every WebRTC / BoringSSL / internal symbol exported (which
+ * the Rust webrtc-sys bindings require).
+ */
+{
+  global:
+    *;
+
+  local:
+    pw_*;
+    spa_*;
+};
diff --git a/pkgs/by-name/li/livekit-libwebrtc/mkSystemLibraries.nix b/pkgs/by-name/li/livekit-libwebrtc/mkSystemLibraries.nix
index 4293798faf90..d2a3e1772b72 100644
--- a/pkgs/by-name/li/livekit-libwebrtc/mkSystemLibraries.nix
+++ b/pkgs/by-name/li/livekit-libwebrtc/mkSystemLibraries.nix
@@ -10,7 +10,7 @@
   libxml2,
   libxslt,
   minizip,
-  ffmpeg_6,
+  ffmpeg_8,
 }:
 {
   "brotli" = {
@@ -58,7 +58,7 @@
     path = "third_party/zlib/BUILD.gn";
   };
   "ffmpeg" = {
-    package = ffmpeg_6;
+    package = ffmpeg_8;
     path = "third_party/ffmpeg/BUILD.gn";
   };
 }
diff --git a/pkgs/by-name/li/livekit-libwebrtc/package.nix b/pkgs/by-name/li/livekit-libwebrtc/package.nix
index d993b4a2c092..7ea48483a9df 100644
--- a/pkgs/by-name/li/livekit-libwebrtc/package.nix
+++ b/pkgs/by-name/li/livekit-libwebrtc/package.nix
@@ -9,7 +9,6 @@
   xcbuild,
   python3,
   ninja,
-  darwinMinVersionHook,
   git,
   cpio,
   pkg-config,
@@ -28,7 +27,19 @@
   libxml2,
   libxslt,
   minizip,
-  ffmpeg_6,
+  ffmpeg_8,
+  libepoxy,
+  libgbm,
+  libGL,
+  libxcomposite,
+  libxdamage,
+  libxext,
+  libxfixes,
+  libxrandr,
+  libxtst,
+  pipewire,
+  libx11,
+  libxi,
 }:
 let
   platformMap = {
@@ -63,13 +74,13 @@ let
       libxml2
       libxslt
       minizip
-      ffmpeg_6
+      ffmpeg_8
       ;
   };
 in
 stdenv.mkDerivation {
   pname = "livekit-libwebrtc";
-  version = "125-unstable-2025-07-25";
+  version = "137-unstable-2026-03-12";
 
   gclientDeps = gclient2nix.importGclientDeps ./sources.json;
   sourceRoot = "src";
@@ -77,30 +88,45 @@ stdenv.mkDerivation {
   patches = [
     # Adds missing dependencies to generated LICENSE
     (fetchpatch {
-      url = "https://raw.githubusercontent.com/livekit/rust-sdks/b41861c7b71762d5d85b3de07ae67ffcae7c3fa2/webrtc-sys/libwebrtc/patches/add_licenses.patch";
+      url = "https://raw.githubusercontent.com/livekit/rust-sdks/a4343fe9d88fcc96f8e88959c90d509abbd0307b/webrtc-sys/libwebrtc/patches/add_licenses.patch";
       hash = "sha256-9A4KyRW1K3eoQxsTbPX0vOnj66TCs2Fxjpsu5wO8mGI=";
     })
     # Fixes the certificate chain, required for Let's Encrypt certs
     (fetchpatch {
-      url = "https://raw.githubusercontent.com/livekit/rust-sdks/b41861c7b71762d5d85b3de07ae67ffcae7c3fa2/webrtc-sys/libwebrtc/patches/ssl_verify_callback_with_native_handle.patch";
-      hash = "sha256-/gneuCac4VGJCWCjJZlgLKFOTV+x7Lc5KVFnNIKenwM=";
+      url = "https://raw.githubusercontent.com/livekit/rust-sdks/a4343fe9d88fcc96f8e88959c90d509abbd0307b/webrtc-sys/libwebrtc/patches/ssl_verify_callback_with_native_handle.patch";
+      hash = "sha256-RBvRcJzoKItpEbqpe07YZe1D1ZVGS12EnDSISldGy+0=";
     })
     # Adds dependencies and features required by livekit
     (fetchpatch {
-      url = "https://raw.githubusercontent.com/livekit/rust-sdks/b41861c7b71762d5d85b3de07ae67ffcae7c3fa2/webrtc-sys/libwebrtc/patches/add_deps.patch";
-      hash = "sha256-EMNYcTcBYh51Tt96+HP43ND11qGKClfx3xIPQmIBSo0=";
+      url = "https://raw.githubusercontent.com/livekit/rust-sdks/a4343fe9d88fcc96f8e88959c90d509abbd0307b/webrtc-sys/libwebrtc/patches/add_deps.patch";
+      hash = "sha256-DwRtGdU5sppmiFsVuyhJoVCQrRl5JFmZJfxgUPhYXBg=";
     })
-    # Fixes "error: no matching member function for call to 'emplace'"
+    # Fix gcc-related errors
     (fetchpatch {
-      url = "https://raw.githubusercontent.com/zed-industries/livekit-rust-sdks/5f04705ac3f356350ae31534ffbc476abc9ea83d/webrtc-sys/libwebrtc/patches/abseil_use_optional.patch";
-      hash = "sha256-FOwlwOqgv5IEBCMogPACbXXxdNhGzpYcVfsolcwA7qU=";
-
-      extraPrefix = "third_party/";
+      url = "https://raw.githubusercontent.com/livekit/rust-sdks/a4343fe9d88fcc96f8e88959c90d509abbd0307b/webrtc-sys/libwebrtc/patches/force_gcc.patch";
+      hash = "sha256-1d73Pi1HkbunjYvp1NskUNE4xXbCmnh++rC6NrCJHbY=";
       stripLen = 1;
+      extraPrefix = "build/";
     })
-    # Required for dynamically linking to ffmpeg libraries and exposing symbols
+    # fix a gcc-related dav1d compile option
+    (fetchpatch {
+      url = "https://raw.githubusercontent.com/livekit/rust-sdks/a4343fe9d88fcc96f8e88959c90d509abbd0307b/webrtc-sys/libwebrtc/patches/david_disable_gun_source_macro.patch";
+      hash = "sha256-RCZpeeSQHaxkL3dY2oFFXDjYeU0KHw7idQFONGge8+0=";
+      stripLen = 1;
+      extraPrefix = "third_party/";
+    })
+    # Required for dynamically linking to ffmpeg libraries, exposing symbols,
+    # and hiding PipeWire symbols via version script (Linux only) to prevent
+    # SIGSEGV when ALSA's PipeWire plugin is loaded.
     ./0001-shared-libraries.patch
-  ];
+    # Borrow a patch from chromium to prevent a build failure due to missing libclang libraries
+    ./chromium-129-rust.patch
+  ]
+  ++ (lib.optionals stdenv.hostPlatform.isLinux [
+    # Fix a broken build with pipewire 1.5+
+    # From https://github.com/Thaodan/tg_owt/commit/960b6b30a9c7e9e4451031c30f362fd01d2ce7c1
+    ./pipewire-1.5.patch
+  ]);
 
   postPatch = ''
     substituteInPlace .gn \
@@ -131,13 +157,24 @@ stdenv.mkDerivation {
           -delete
       fi
     done
+
+    # Trick the update_rust.py script into thinking we have *this specific* rust available.
+    # It isn't actually needed for the libwebrtc build, but GN will fail if it isn't there.
+    mkdir -p third_party/rust-toolchain
+    (python3 tools/rust/update_rust.py --print-package-version || true) \
+      | head -n 1 \
+      | sed 's/.* expected Rust version is \([^ ]*\) .*/rustc 1.0 1234 (\1 chromium)/' \
+      > third_party/rust-toolchain/VERSION
   ''
   + lib.optionalString stdenv.hostPlatform.isLinux ''
+    mkdir -p buildtools/linux64
     ln -sf ${lib.getExe gn} buildtools/linux64/gn
+    cp ${./libwebrtc.version} libwebrtc.version
     substituteInPlace build/toolchain/linux/BUILD.gn \
       --replace 'toolprefix = "aarch64-linux-gnu-"' 'toolprefix = ""'
   ''
   + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    mkdir -p buildtools/mac
     ln -sf ${lib.getExe gn} buildtools/mac/gn
     chmod +x build/toolchain/apple/linker_driver.py
     patchShebangs build/toolchain/apple/linker_driver.py
@@ -174,6 +211,18 @@ stdenv.mkDerivation {
     glib
     alsa-lib
     pulseaudio
+    libepoxy
+    libgbm
+    libGL
+    libxcomposite
+    libxdamage
+    libxext
+    libxfixes
+    libxrandr
+    libxtst
+    pipewire
+    libx11
+    libxi
   ]);
 
   preConfigure = ''
@@ -200,16 +249,19 @@ stdenv.mkDerivation {
     "is_component_build=true"
     "enable_stripping=true"
     "rtc_use_h264=true"
+    "rtc_use_h265=true"
     "use_custom_libcxx=false"
     "use_rtti=true"
   ]
   ++ (lib.optionals stdenv.hostPlatform.isLinux [
-    "use_goma=false"
-    "rtc_use_pipewire=false"
+    "rtc_use_pipewire=true"
     "symbol_level=0"
     "enable_iterator_debugging=false"
-    "rtc_use_x11=false"
+    "rtc_use_x11=true"
     "use_sysroot=false"
+    "use_custom_libcxx_for_host=false"
+    "use_libcxx_modules=false"
+    "use_llvm_libatomic=false"
     "is_clang=false"
   ])
   ++ (lib.optionals stdenv.hostPlatform.isDarwin [
@@ -233,6 +285,7 @@ stdenv.mkDerivation {
     "pc:peer_connection"
     "sdk:videocapture_objc"
     "sdk:mac_framework_objc"
+    "desktop_capture_objc"
   ];
 
   postBuild =
@@ -251,10 +304,11 @@ stdenv.mkDerivation {
     mkdir -p $out/lib
     mkdir -p $dev/include
 
-    install -m0644 obj/webrtc.ninja args.gn LICENSE.md $dev
+    install -m0644 obj/webrtc.ninja obj/modules/desktop_capture/desktop_capture.ninja args.gn LICENSE.md $dev
 
     pushd ../..
     find . -name "*.h" -print | cpio -pd $dev/include
+    find . -name "*.inc" -print | cpio -pd $dev/include
     popd
   ''
   + lib.optionalString stdenv.hostPlatform.isLinux ''
diff --git a/pkgs/by-name/li/livekit-libwebrtc/pipewire-1.5.patch b/pkgs/by-name/li/livekit-libwebrtc/pipewire-1.5.patch
new file mode 100644
index 000000000000..c338050e9b46
--- /dev/null
+++ b/pkgs/by-name/li/livekit-libwebrtc/pipewire-1.5.patch
@@ -0,0 +1,35 @@
+From 960b6b30a9c7e9e4451031c30f362fd01d2ce7c1 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B6rn=20Kettunen?= <bjorn.kettunen@thaodan.de>
+Date: Fri, 28 Nov 2025 19:41:02 +0200
+Subject: [PATCH] Fix building with Pipewire 1.5.81 and later. Resolves #167
+
+---
+ .../desktop_capture/linux/wayland/shared_screencast_stream.cc   | 2 ++
+ modules/video_capture/linux/pipewire_session.cc             | 1 +
+ 2 files changed, 3 insertions(+)
+
+diff --git a/modules/desktop_capture/linux/wayland/shared_screencast_stream.cc b/modules/desktop_capture/linux/wayland/shared_screencast_stream.cc
+index 71ea4d9f5..7ef1a030e 100644
+--- a/modules/desktop_capture/linux/wayland/shared_screencast_stream.cc
++++ b/modules/desktop_capture/linux/wayland/shared_screencast_stream.cc
+@@ -13,6 +13,8 @@
+ #include <fcntl.h>
+ #include <libdrm/drm_fourcc.h>
+ #include <pipewire/pipewire.h>
++#include <spa/pod/parser.h>
++#include <spa/pod/iter.h>
+ #include <spa/param/video/format-utils.h>
+ #include <sys/mman.h>
+ 
+diff --git a/modules/video_capture/linux/pipewire_session.cc b/modules/video_capture/linux/pipewire_session.cc
+index d2d8eeaf8..c16d511ba 100644
+--- a/modules/video_capture/linux/pipewire_session.cc
++++ b/modules/video_capture/linux/pipewire_session.cc
+@@ -15,6 +15,7 @@
+ #include <spa/param/format.h>
+ #include <spa/param/video/raw.h>
+ #include <spa/pod/parser.h>
++#include <spa/pod/iter.h>
+ 
+ #include "common_video/libyuv/include/webrtc_libyuv.h"
+ #include "modules/video_capture/device_info_impl.h"
\ No newline at end of file
diff --git a/pkgs/by-name/li/livekit-libwebrtc/sources.json b/pkgs/by-name/li/livekit-libwebrtc/sources.json
index 9f9f522a85b2..da0dfb24aab3 100644
--- a/pkgs/by-name/li/livekit-libwebrtc/sources.json
+++ b/pkgs/by-name/li/livekit-libwebrtc/sources.json
@@ -1,74 +1,74 @@
 {
     "src": {
         "args": {
-            "hash": "sha256-zSWjPxcrvLpi+zaJ+GReG3YsjPKqxBdkKfe8Gj/O0dA=",
+            "hash": "sha256-KVbw0ikSo1fkLT63zo5/GIBwUDB8QRcxubhP7pYD5vA=",
             "owner": "webrtc-sdk",
             "repo": "webrtc",
-            "rev": "db3ba7af86dd6d48174ed35387d11c0794f1a21b"
+            "rev": "a4bd28d99eb9ed3bc8e41ce7b9ce7254ee7308bd"
         },
         "fetcher": "fetchFromGitHub"
     },
     "src/base": {
         "args": {
-            "hash": "sha256-Hw0cXws+0M2UcvcnJZGkUtH28ZEDfxNl0e8ngWlAZnA=",
-            "rev": "738cf0c976fd3d07c5f1853f050594c5295300d8",
+            "hash": "sha256-MTG+pjMPY6/dqeEUy+xJVxPuICETtV98S+h/lFwGItg=",
+            "rev": "86c814633cf284bc8057a539bc722e2a672afe2f",
             "url": "https://chromium.googlesource.com/chromium/src/base"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/build": {
         "args": {
-            "hash": "sha256-mPjb7/TTJ7/oatBdIRGhSsacjbyu5ZilUgyplAtji1s=",
+            "hash": "sha256-qFZ12YFX4qxFEHU+VWOG+HDYYPXodgGz+iJ7WEc7cD8=",
             "owner": "webrtc-sdk",
             "repo": "build",
-            "rev": "6978bac6466311e4bee4c7a9fd395faa939e0fcd"
+            "rev": "01021e6c12636951a6b4e5342e16b2101b352367"
         },
         "fetcher": "fetchFromGitHub"
     },
     "src/buildtools": {
         "args": {
-            "hash": "sha256-OS9k7sDzAVH+NU9P4ilKJavkiov/1qq1fG5AWq9kH/Y=",
-            "rev": "5eb927f0a922dfacf10cfa84ee76f39dcf2a7311",
+            "hash": "sha256-YWtmMKL1ydueNJ4XM/Pq+8OpqIFe5A6/vYyfZTv7/EI=",
+            "rev": "0f32cb9025766951122d4ed19aba87a94ded3f43",
             "url": "https://chromium.googlesource.com/chromium/src/buildtools"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/testing": {
         "args": {
-            "hash": "sha256-VisK7NDR/xDC3OM7LD9Gyo58rs1GE37i7QRYC/Kk12k=",
-            "rev": "d6e731571c33f30e5dc46f54c69e6d432566e55c",
+            "hash": "sha256-s65cABkyMo+FkAmilS67qM3VnrT7iYZg9scycrXzxyE=",
+            "rev": "a89c37d36bf80c05963727e28b9916835ae88d3a",
             "url": "https://chromium.googlesource.com/chromium/src/testing"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party": {
         "args": {
-            "hash": "sha256-TdB8qMcmXO3xgYyJkHHwn/8tVg1pFMlrNABpQQ80bOY=",
-            "rev": "f36c4b6e56aaa94606c87fa0c3f7cbdbb5c70546",
+            "hash": "sha256-q+xVOFlpC0vnLMSF9Z6ZRL7mb/cu8jBpsWjDNFFgiKM=",
+            "rev": "8062e0e102496ff14a8c58b586f014527424953d",
             "url": "https://chromium.googlesource.com/chromium/src/third_party"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/boringssl/src": {
         "args": {
-            "hash": "sha256-Ln6rnbn2hwszst24E/6EpP2C3Scoppe7wvVKFtxuPjQ=",
-            "rev": "12391e648d3c6f04a718721568cc89208b780654",
+            "hash": "sha256-5Efqc8pLs4ZskXQGpFdTb5cw//v3+DR285m/DsrWSWA=",
+            "rev": "34492c89a8e381e0e856a686cc71b1eb5bd728db",
             "url": "https://boringssl.googlesource.com/boringssl.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/breakpad/breakpad": {
         "args": {
-            "hash": "sha256-qAIXZ1jZous0Un0jVkOQ66nA2525NziV3Lbso2/+Z1Y=",
-            "rev": "76788faa4ef163081f82273bfca7fae8a734b971",
+            "hash": "sha256-0ynZuxIqBIpNkfD3Y9XdPFQr7HeQcsUO3lhnqvH+k8c=",
+            "rev": "232a723f5096ab02d53d87931efa485fa77d3b03",
             "url": "https://chromium.googlesource.com/breakpad/breakpad.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/catapult": {
         "args": {
-            "hash": "sha256-uqtyxO7Ge3egBsYmwcRGiV1lqm4iYVHrqYfDz7r6Byo=",
-            "rev": "88367fd8c736a2601fc183920c9ffe9ac2ec32ac",
+            "hash": "sha256-FIJZE1Qu1MLZA4qxB68k1NjhgSbFTjf57YF85JicVZw=",
+            "rev": "000f47cfa393d7f9557025a252862e2a61a60d44",
             "url": "https://chromium.googlesource.com/catapult.git"
         },
         "fetcher": "fetchFromGitiles"
@@ -83,8 +83,8 @@
     },
     "src/third_party/clang-format/script": {
         "args": {
-            "hash": "sha256-whD8isX2ZhLrFzdxHhFP1S/sZDRgyrzLFaVd7OEFqYo=",
-            "rev": "3c0acd2d4e73dd911309d9e970ba09d58bf23a62",
+            "hash": "sha256-d9uweklBffiuCWEb03ti1eFLnMac2qRtvggzXY1n/RU=",
+            "rev": "37f6e68a107df43b7d7e044fd36a13cbae3413f2",
             "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/clang/tools/clang-format.git"
         },
         "fetcher": "fetchFromGitiles"
@@ -97,42 +97,50 @@
         },
         "fetcher": "fetchFromGitiles"
     },
+    "src/third_party/compiler-rt/src": {
+        "args": {
+            "hash": "sha256-yo7BFGgwJNScsXwnCAu8gFBdZVS8/HJplzUk2e73mVg=",
+            "rev": "57213f125d03209892fed26189feb3b736e96735",
+            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
     "src/third_party/crc32c/src": {
         "args": {
-            "hash": "sha256-urg0bmnfMfHagLPELp4WrNCz1gBZ6DFOWpDue1KsMtc=",
-            "rev": "fa5ade41ee480003d9c5af6f43567ba22e4e17e6",
+            "hash": "sha256-KBraGaO5LmmPP+p8RuDogGldbTWdNDK+WzF4Q09keuE=",
+            "rev": "d3d60ac6e0f16780bcfcc825385e1d338801a558",
             "url": "https://chromium.googlesource.com/external/github.com/google/crc32c.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/dav1d/libdav1d": {
         "args": {
-            "hash": "sha256-AA2bcrsW1xFspyl5TqYUJeAwKM06rWTNtXr/uMVIJmw=",
-            "rev": "006ca01d387ac6652825d6cce1a57b2de67dbf8d",
+            "hash": "sha256-+DY4p41VuAlx7NvOfXjWzgEhvtpebjkjbFwSYOzSjv4=",
+            "rev": "8d956180934f16244bdb58b39175824775125e55",
             "url": "https://chromium.googlesource.com/external/github.com/videolan/dav1d.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/depot_tools": {
         "args": {
-            "hash": "sha256-RguGUaIpxtxrY+LksFmeNbZuitZpB6O9HJc1c4TMXeQ=",
-            "rev": "495b23b39aaba2ca3b55dd27cadc523f1cb17ee6",
+            "hash": "sha256-DWQyYtpAAGiryeGJzIWlUwY5yn4cNwXY957vlPDUNak=",
+            "rev": "fa8fc854e1766b86f10c9a15902cf3cc23adaac2",
             "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/ffmpeg": {
         "args": {
-            "hash": "sha256-6+Sc5DsPaKW68PSUS4jlpzRXjPhEN7LFQATVVL9Xhfo=",
-            "rev": "901248a373cbbe7af68fb92faf3be7d4f679150d",
+            "hash": "sha256-hNzQZQxaa2Wtl7GWWF852cFmmXy4pc15Pp0d59TTfnI=",
+            "rev": "01f23648c6b84de6c0f717fa4e1816f53b9ee72e",
             "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/flatbuffers/src": {
         "args": {
-            "hash": "sha256-LecJwLDG6szZZ/UOCFD+MDqH3NKawn0sdEwgnMt8wMM=",
-            "rev": "bcb9ef187628fe07514e57756d05e6a6296f7dc5",
+            "hash": "sha256-tbc45o0MbMvK5XqRUJt5Eg8BU6+TJqlmwFgQhHq6wRM=",
+            "rev": "8db59321d9f02cdffa30126654059c7d02f70c32",
             "url": "https://chromium.googlesource.com/external/github.com/google/flatbuffers.git"
         },
         "fetcher": "fetchFromGitiles"
@@ -147,40 +155,40 @@
     },
     "src/third_party/freetype/src": {
         "args": {
-            "hash": "sha256-XBHWUw28bsCpwUXb+faE36DRdujuKiWoJ+dEmUk07s4=",
-            "rev": "b3a6a20a805366e0bc7044d1402d04c53f9c1660",
+            "hash": "sha256-Vlin6Z+QisUyj6R+TclVOm8x6673YhUIWob9Ih6gzC8=",
+            "rev": "1da283b8ae6d6b94f34a5c4b8c1227adc9dbb1d8",
             "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/fuzztest/src": {
         "args": {
-            "hash": "sha256-8w4yIW15VamdjevMO27NYuf+GFu5AvHSooDZH0PbS6s=",
-            "rev": "65354bf09a2479945b4683c42948695d4f2f7c07",
+            "hash": "sha256-L2QG0pUmGjGdtdlivxYfxSqO9YaVHpIT6lvJwBMTxMw=",
+            "rev": "b10387fdbbca18192f85eaa5323a59f44bf9c468",
             "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/google_benchmark/src": {
         "args": {
-            "hash": "sha256-gztnxui9Fe/FTieMjdvfJjWHjkImtlsHn6fM1FruyME=",
-            "rev": "344117638c8ff7e239044fd0fa7085839fc03021",
+            "hash": "sha256-cH8s1gP6kCcojAAfTt5iQCVqiAaSooNk4BdaILujM3w=",
+            "rev": "761305ec3b33abf30e08d50eb829e19a802581cc",
             "url": "https://chromium.googlesource.com/external/github.com/google/benchmark.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/googletest/src": {
         "args": {
-            "hash": "sha256-JCIJrjN/hH6oAgvJRuv3aJA+z6Qe7yefyRbAhP5bZDc=",
-            "rev": "5197b1a8e6a1ef9f214f4aa537b0be17cbf91946",
+            "hash": "sha256-QT9PQ9bF+eCPfRLkcHpH4jc0UZfGPc98fHf8QDV5bZg=",
+            "rev": "cd430b47a54841ec45d64d2377d7cabaf0eba610",
             "url": "https://chromium.googlesource.com/external/github.com/google/googletest.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/grpc/src": {
         "args": {
-            "hash": "sha256-64JEVCx/PCM0dvv7kAQvSjLc0QbRAZVBDzwD/FAV6T8=",
-            "rev": "822dab21d9995c5cf942476b35ca12a1aa9d2737",
+            "hash": "sha256-xivmP36VCSbiMAV3PDUjzCrF+AJzFXJdMe5e2q9yW/k=",
+            "rev": "957c9f95224b1e1318c0ecb98d0e7584ea5ccff2",
             "url": "https://chromium.googlesource.com/external/github.com/grpc/grpc.git"
         },
         "fetcher": "fetchFromGitiles"
@@ -195,24 +203,24 @@
     },
     "src/third_party/harfbuzz-ng/src": {
         "args": {
-            "hash": "sha256-VAan6P8PHSq8RsGE4YbI/wCfFAhzl3nJMt0cQBYi5Ls=",
-            "rev": "155015f4bec434ecc2f94621665844218f05ce51",
+            "hash": "sha256-lNnCtgIegUy4DLhYaGZXcEaFw83KWAHoKpz69AEsWp4=",
+            "rev": "9f83bbbe64654b45ba5bb06927ff36c2e7588495",
             "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/icu": {
         "args": {
-            "hash": "sha256-frsmwYMiFixEULsE91x5+p98DvkyC0s0fNupqjoRnvg=",
-            "rev": "364118a1d9da24bb5b770ac3d762ac144d6da5a4",
+            "hash": "sha256-eGI/6wk6IOUPvX7pRTm4VJk1CqkkxalTu84L36i/D6k=",
+            "rev": "4c8cc4b365a505ce35be1e0bd488476c5f79805d",
             "url": "https://chromium.googlesource.com/chromium/deps/icu.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/instrumented_libs": {
         "args": {
-            "hash": "sha256-SGEB74fK9e0WWT77ZNISE9fVlXGGPvZMBUsQ3XD+DsA=",
-            "rev": "0172d67d98df2d30bd2241959d0e9569ada25abe",
+            "hash": "sha256-8kokdsnn5jD9KgM/6g0NuITBbKkGXWEM4BMr1nCrfdU=",
+            "rev": "69015643b3f68dbd438c010439c59adc52cac808",
             "url": "https://chromium.googlesource.com/chromium/third_party/instrumented_libraries.git"
         },
         "fetcher": "fetchFromGitiles"
@@ -227,128 +235,136 @@
     },
     "src/third_party/libFuzzer/src": {
         "args": {
-            "hash": "sha256-T0dO+1A0r6kLFoleMkY8heu80biPntCpvA6YfqA7b+E=",
-            "rev": "758bd21f103a501b362b1ca46fa8fcb692eaa303",
+            "hash": "sha256-Lb+HczYax0T7qvC0/Nwhc5l2szQTUYDouWRMD/Qz7sA=",
+            "rev": "e31b99917861f891308269c36a32363b120126bb",
             "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt/lib/fuzzer.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/libaom/source/libaom": {
         "args": {
-            "hash": "sha256-0tLfbfYyCnG89DHNIoYoiitN9pFFcuX/Nymp3Q5xhBg=",
-            "rev": "eefd5585a0c4c204fcf7d30065f8c2ca35c38a82",
+            "hash": "sha256-ngVZ+xK0b+jKUmawteQ7VFAQzoebX4jqZ3hP9pW+Q0Q=",
+            "rev": "a23a4799ec2d7dd6e436c7b64a34553773014ed7",
             "url": "https://aomedia.googlesource.com/aom.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/libc++/src": {
         "args": {
-            "hash": "sha256-ocJqlENHw19VpkFxKwHneGw3aNh56nt+/JeopxLj2M8=",
-            "rev": "e3b94d0e5b86883fd77696bf10dc33ba250ba99b",
+            "hash": "sha256-lqeuVUgeAKm1pxo+w1vyUbBkBXBzLCQ+Lfu44neKLPo=",
+            "rev": "917609c669e43edc850eeb192a342434a54e1dfd",
             "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/libc++abi/src": {
         "args": {
-            "hash": "sha256-qBupfCAnSNpvqcwFycQEi5v6TBAH5LdQI5YcLeQD2y8=",
-            "rev": "932d253fedb390a08b17ec3a92469a4553934a6a",
+            "hash": "sha256-X9cAbyd8ZPSwqOGhPYwIZ6b9E3tVwAuAYZKMgbZQxgk=",
+            "rev": "f2a7f2987f9dcdf8b04c2d8cd4dcb186641a7c3e",
             "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/libjpeg_turbo": {
         "args": {
-            "hash": "sha256-+t75ZAdOXc7Nd1/8zEQLX+enZb8upqIQuR6qzb9z7Cg=",
-            "rev": "9b894306ec3b28cea46e84c32b56773a98c483da",
+            "hash": "sha256-Ig+tmprZDvlf/M72/DTar2pbxat9ZElgSqdXdoM0lPs=",
+            "rev": "e14cbfaa85529d47f9f55b0f104a579c1061f9ad",
             "url": "https://chromium.googlesource.com/chromium/deps/libjpeg_turbo.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/libsrtp": {
         "args": {
-            "hash": "sha256-XOPiDAOHpWyCiXI+fi1CAie0Zaj4v14m9Kc8+jbzpUY=",
-            "rev": "7a7e64c8b5a632f55929cb3bb7d3e6fb48c3205a",
+            "hash": "sha256-bkG1+ss+1a2rCHGwZjhvf5UaNVbPPZJt9HZSIPBKGwM=",
+            "rev": "a52756acb1c5e133089c798736dd171567df11f5",
             "url": "https://chromium.googlesource.com/chromium/deps/libsrtp.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/libunwind/src": {
         "args": {
-            "hash": "sha256-/4/Trextb4F9UMDVrg4uG9QZl6S0H9FiwnL+2S5+ZpE=",
-            "rev": "419b03c0b8f20d6da9ddcb0d661a94a97cdd7dad",
+            "hash": "sha256-XdFKn+cGOxA0fHkVMG9UAhCmpML44ocoyHB7XnumX7o=",
+            "rev": "81e2cb40a70de2b6978e6d8658891ded9a77f7e3",
             "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/libvpx/source/libvpx": {
         "args": {
-            "hash": "sha256-JbeUgX8Dx8GkQ79ElZHK8gYI3/4o6NrTV+HpblwLvIE=",
-            "rev": "8762f5efb2917765316a198e6713f0bc93b07c9b",
+            "hash": "sha256-NIGpzP6elcPScHJlZmnPHJdmXsuHcbuELT0C4Ha5PcA=",
+            "rev": "ff1d193f4b9dfa9b2ced51efbb6ec7a69e58e88c",
             "url": "https://chromium.googlesource.com/webm/libvpx.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/libyuv": {
         "args": {
-            "hash": "sha256-hD5B9fPNwf8M98iS/PYeUJgJxtBvvf2BrrlnBNYXSg0=",
-            "rev": "a6a2ec654b1be1166b376476a7555c89eca0c275",
+            "hash": "sha256-b/EYCWBQvsNoGhea31DPBKpG8eouf0OBi5TgdHDHs9A=",
+            "rev": "1e40e34573c3861480d107cd4a4ce290df79951f",
             "url": "https://chromium.googlesource.com/libyuv/libyuv.git"
         },
         "fetcher": "fetchFromGitiles"
     },
+    "src/third_party/llvm-libc/src": {
+        "args": {
+            "hash": "sha256-yNNx3gOGafMNvZ+aebDKHVj6QM8g0zt0d69PWlWLkyk=",
+            "rev": "912274164f0877ca917c06e8484ad3be1784833a",
+            "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git"
+        },
+        "fetcher": "fetchFromGitiles"
+    },
     "src/third_party/lss": {
         "args": {
-            "hash": "sha256-hE8uZf9Fst66qJkoVYChiB8G41ie+k9M4X0W+5JUSdw=",
-            "rev": "ce877209e11aa69dcfffbd53ef90ea1d07136521",
+            "hash": "sha256-rhp4EcZYdgSfu9cqn+zxxGx6v2IW8uX8V+iA0UfZhFY=",
+            "rev": "ed31caa60f20a4f6569883b2d752ef7522de51e0",
             "url": "https://chromium.googlesource.com/linux-syscall-support.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/nasm": {
         "args": {
-            "hash": "sha256-SiRXHsUlWXtH6dbDjDjqNAm105ibEB3jOfNtQAM4CaY=",
-            "rev": "f477acb1049f5e043904b87b825c5915084a9a29",
+            "hash": "sha256-neYrS4kQ76ihUh22Q3uPR67Ld8+yerA922YSZU1KxJs=",
+            "rev": "9f916e90e6fc34ec302573f6ce147e43e33d68ca",
             "url": "https://chromium.googlesource.com/chromium/deps/nasm.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/openh264/src": {
         "args": {
-            "hash": "sha256-J7Eqe2QevZh1xfap19W8AVCcwfRu7ztknnbKFJUAH1c=",
-            "rev": "09a4f3ec842a8932341b195c5b01e141c8a16eb7",
+            "hash": "sha256-tf0lnxATCkoq+xRti6gK6J47HwioAYWnpEsLGSA5Xdg=",
+            "rev": "652bdb7719f30b52b08e506645a7322ff1b2cc6f",
             "url": "https://chromium.googlesource.com/external/github.com/cisco/openh264"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/perfetto": {
         "args": {
-            "hash": "sha256-fS0P/0Bqn9EreCPRC65Lw7/zcpMquo7RDf6dmbMDa74=",
-            "rev": "0e424063dbfd4e7400aa3b77b5c00b84893aee7b",
-            "url": "https://android.googlesource.com/platform/external/perfetto.git"
+            "hash": "sha256-I0qiAh3VliVop+3S2/tP6VwCAJOk0Vu7xy8vHJZ1w2A=",
+            "rev": "a54dd38d60593129ae56d400f1a72860670abea4",
+            "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/protobuf-javascript/src": {
         "args": {
-            "hash": "sha256-TmP6xftUVTD7yML7UEM/DB8bcsL5RFlKPyCpcboD86U=",
-            "rev": "e34549db516f8712f678fcd4bc411613b5cc5295",
+            "hash": "sha256-zq86SrDASl6aYPFPijRZp03hJqXUFz2Al/KkiNq7i0M=",
+            "rev": "eb785a9363664a402b6336dfe96aad27fb33ffa8",
             "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/third_party/re2/src": {
         "args": {
-            "hash": "sha256-FA9wAZwqLx7oCPf+qeqZ7hhpJ9J2DSMXZAWllHIX/qY=",
-            "rev": "b84e3ff189980a33d4a0c6fa1201aa0b3b8bab4a",
+            "hash": "sha256-f/k2rloV2Nwb0KuJGUX4SijFxAx69EXcsXOG4vo+Kis=",
+            "rev": "c84a140c93352cdabbfb547c531be34515b12228",
             "url": "https://chromium.googlesource.com/external/github.com/google/re2.git"
         },
         "fetcher": "fetchFromGitiles"
     },
     "src/tools": {
         "args": {
-            "hash": "sha256-19oGSveaPv8X+/hsevUe4fFtLASC3HfPtbnw3TWpYQk=",
-            "rev": "0d6482e40fe26f738a0acf6ebb0f797358538b48",
+            "hash": "sha256-kZFZl8SC9nZIIOVtNl/5H4huw6BCBsBkJVJ4gaUmly4=",
+            "rev": "ffcbc837bbb14d80d09147c2af5302ff6bd4bd69",
             "url": "https://chromium.googlesource.com/chromium/src/tools"
         },
         "fetcher": "fetchFromGitiles"

From 73835e7043095749c8244ecf672e4aaa4aa723c2 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Thu, 28 May 2026 03:35:36 +0200
Subject: [PATCH 48/52] buildMozillaMach: establish MOZ_PKG_FORMAT forward
 compat

Lowercae `tar` will throw a KeyError in future mach versions.

(cherry picked from commit cb9090f062a98ceb6279658ce5c93e1fa7efb7b2)
---
 pkgs/build-support/build-mozilla-mach/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/build-support/build-mozilla-mach/default.nix b/pkgs/build-support/build-mozilla-mach/default.nix
index ed1ee3fc08d6..060b064f59ec 100644
--- a/pkgs/build-support/build-mozilla-mach/default.nix
+++ b/pkgs/build-support/build-mozilla-mach/default.nix
@@ -640,7 +640,7 @@ buildStdenv.mkDerivation {
 
   profilingPhase = lib.optionalString pgoSupport ''
     # Avoid compressing the instrumented build with high levels of compression
-    export MOZ_PKG_FORMAT=tar
+    export MOZ_PKG_FORMAT=TAR
 
     # Package up Firefox for profiling
     ./mach package

From a42ac8173ba232c7c4bc902449283061f13bf480 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Tue, 12 May 2026 21:40:10 +0200
Subject: [PATCH 49/52] librewolf-bin-unwrapped: 150.0.2-1 -> 151.0.1-2

diff: https://codeberg.org/librewolf/source/compare/150.0.2-1...151.0.1-2

mfsa: https://www.mozilla.org/en-US/security/advisories/mfsa2026-45/
(cherry picked from commit 7c359e5b5107147b34fcbc66d9c71fd42dafbe71)
---
 pkgs/by-name/li/librewolf-bin-unwrapped/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix b/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
index 059f7eb950ef..58ebc17ce230 100644
--- a/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
+++ b/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
@@ -36,7 +36,7 @@ let
 
   pname = "librewolf-bin-unwrapped";
 
-  version = "150.0.2-1";
+  version = "151.0.1-2";
 in
 
 stdenv.mkDerivation {
@@ -46,8 +46,8 @@ stdenv.mkDerivation {
     url = "https://codeberg.org/api/packages/librewolf/generic/librewolf/${version}/librewolf-${version}-${arch}-package.tar.xz";
     hash =
       {
-        x86_64-linux = "sha256-KMpSMcLJ/wkySo2gbiECJfH2/hcxdTSLXwKcZLMkvhk=";
-        aarch64-linux = "sha256-Dxs7eRN6nj3e/6pQ3z0d27tnTtD6CefhUxPZGwTVL+Y=";
+        x86_64-linux = "sha256-YqFUKUK4GoP2JAIa3aJqz/iAAmD8hh5UqVzbm4jjvm8=";
+        aarch64-linux = "sha256-TIJEiffEa7X51RGmntCAR7NLP51qcJ08aTvKxVAYNsY=";
       }
       .${stdenv.hostPlatform.system} or throwSystem;
   };

From 27479a8fb23c2791e6532df74883af986b75fd4a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 29 May 2026 17:56:04 +0000
Subject: [PATCH 50/52] librewolf-unwrapped: 151.0.1 -> 151.0.2

(cherry picked from commit ce872a603b0a841f465974325046d213a64a3967)
---
 pkgs/by-name/li/librewolf-unwrapped/src.json | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/li/librewolf-unwrapped/src.json b/pkgs/by-name/li/librewolf-unwrapped/src.json
index afde3b780190..95aac1a7ef29 100644
--- a/pkgs/by-name/li/librewolf-unwrapped/src.json
+++ b/pkgs/by-name/li/librewolf-unwrapped/src.json
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "151.0.1-2",
+  "packageVersion": "151.0.2-1",
   "source": {
-    "rev": "151.0.1-2",
-    "hash": "sha256-6C048VV6NECGTcdGla4qIa88z677ZTjORf5FM0a4xMM="
+    "rev": "151.0.2-1",
+    "hash": "sha256-Iq6Jf8Cw2AgkI5zehV5TJQBFHCGANtj4e13cy+ANoTo="
   },
   "firefox": {
-    "version": "151.0.1",
-    "hash": "sha512-hJKhu5VrODcxU5OL0YsOGOOkrQ0qvCAXtF4CvCdoyPRo1cBjKaMkhaA6Z7ucIhAuar/x5zCAx3dkc11DDcdydw=="
+    "version": "151.0.2",
+    "hash": "sha512-hzCJU+01SieZqaRb5AAzv5/42A+iIPA0qs+9bnVHFpAdQWTDf6VgMsZZslkRZgPguitWbB82UaucwINdUCzXOQ=="
   }
 }

From 4b311a8f130231c5f74d4579a6c8fe95f1bf2c59 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Thu, 28 May 2026 09:38:19 +1000
Subject: [PATCH 51/52] linux: add stable staging-nixos workflow

stable counterpart to https://github.com/NixOS/nixpkgs/commit/d28cc2a2f5922960861a0c3d08b7ef05cbd47694

(cherry picked from commit 10056dd40d9aed2d3c7ecbe1a728cae9fb36ac6a)
---
 .github/workflows/periodic-merge-24h.yml |  4 ++++
 CONTRIBUTING.md                          |  3 ++-
 ci/github-script/check-target-branch.js  | 16 +++++++---------
 doc/packages/linux.section.md            |  7 +++----
 4 files changed, 16 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/periodic-merge-24h.yml b/.github/workflows/periodic-merge-24h.yml
index 34282fb2c8f9..3aac3ccf8b73 100644
--- a/.github/workflows/periodic-merge-24h.yml
+++ b/.github/workflows/periodic-merge-24h.yml
@@ -35,10 +35,14 @@ jobs:
             into: staging-next-25.11
           - from: staging-next-25.11
             into: staging-25.11
+          - from: release-25.11
+            into: staging-nixos-25.11
           - from: release-26.05
             into: staging-next-26.05
           - from: staging-next-26.05
             into: staging-26.05
+          - from: release-26.05
+            into: staging-nixos-26.05
           - name: merge-base(master,staging) → haskell-updates
             from: master staging
             into: haskell-updates
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index d86cafd010fb..27bffb4c069d 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -443,6 +443,7 @@ The staging workflow is used for all stable branches with corresponding names:
 - `master`/`release-YY.MM`
 - `staging`/`staging-YY.MM`
 - `staging-next`/`staging-next-YY.MM`
+- `staging-nixos`/`staging-nixos-YY.MM`
 
 [^1]: Except changes that cause no more rebuilds than kernel updates
 
@@ -506,7 +507,7 @@ These PRs go to `staging-nixos`, see [the next section for more context](#change
 Changes causing a rebuild of all NixOS tests get a special [`10.rebuild-nixos-tests`](https://github.com/NixOS/nixpkgs/issues?q=state%3Aopen%20label%3A10.rebuild-nixos-tests) label.
 These changes pose a significant impact on the build infrastructure.
 
-Hence, these PRs should either target a `staging`-branch or `staging-nixos`, provided one of following conditions applies:
+Hence, these PRs should either target a `staging`-branch or `staging-nixos`-branch, provided one of following conditions applies:
 
 * The label `10.rebuild-nixos-tests` is set, or
 * The PR is a change affecting the Linux kernel.
diff --git a/ci/github-script/check-target-branch.js b/ci/github-script/check-target-branch.js
index cdb2670aeac0..590df54676ce 100644
--- a/ci/github-script/check-target-branch.js
+++ b/ci/github-script/check-target-branch.js
@@ -101,9 +101,8 @@ async function checkTargetBranch({ github, context, core, dry }) {
   const rebuildsAllTests =
     changed.attrdiff.changed.includes('nixosTests.simple')
 
-  // https://github.com/NixOS/nixpkgs/pull/481205#issuecomment-3790123921
-  // These should go to staging-nixos instead of master,
-  // but release-xx.xx (not staging-xx.xx) when backported
+  // https://github.com/NixOS/nixpkgs/pull/521157
+  // These should go to master and release-xx.xx when backported
   let isExemptKernelUpdate = false
   if (prInfo.changed_files === 1) {
     const changedFiles = (
@@ -114,11 +113,8 @@ async function checkTargetBranch({ github, context, core, dry }) {
     ).data
     isExemptKernelUpdate =
       changedFiles.length === 1 &&
-      (changedFiles[0].filename ===
-        'pkgs/os-specific/linux/kernel/xanmod-kernels.nix' ||
-        (base.startsWith('release-') &&
-          changedFiles[0].filename ===
-            'pkgs/os-specific/linux/kernel/kernels-org.json'))
+      changedFiles[0].filename ===
+        'pkgs/os-specific/linux/kernel/xanmod-kernels.nix'
   }
 
   // https://github.com/NixOS/nixpkgs/pull/483194#issuecomment-3793393218
@@ -163,8 +159,10 @@ async function checkTargetBranch({ github, context, core, dry }) {
       branchText = '(probably either `staging-nixos` or `staging`)'
     } else if (base === 'master') {
       branchText = '(probably `staging-nixos`)'
+    } else if (maxRebuildCount >= 500) {
+      branchText = `(probably either \`staging-nixos-${split(base).version}\` or \`staging-${split(base).version}\`)`
     } else {
-      branchText = `(probably \`staging-${split(base).version}\`)`
+      branchText = `(probably \`staging-nixos-${split(base).version}\`)`
     }
     const body = [
       `The PR's base branch is set to \`${base}\`, but this PR rebuilds all NixOS tests.`,
diff --git a/doc/packages/linux.section.md b/doc/packages/linux.section.md
index 9722b22fd2f5..f7dd3ea6986d 100644
--- a/doc/packages/linux.section.md
+++ b/doc/packages/linux.section.md
@@ -119,11 +119,10 @@ $ pkgs/os-specific/linux/kernel/update.sh
 The change gets submitted like this:
 
 * File a PR against `staging-nixos`.
-  * Add a `backport release-XX.XX` label for an automated backport.
-    We don't expect many other changes on that branch to require a backport, hence there's no such branch for stable.
+  * Add a `backport staging-nixos-XX.XX` label for an automated backport.
     By using an additional PR, we get the automatic backport against stable without manual cherry-picks.
-* Merge into `staging-nixos`.
-* File as PR from `staging-nixos` against `master`.
+* Merge into `staging-nixos` or `staging-nixos-XX.XX`.
+* File as PR from `staging-nixos` against `master` or `staging-nixos-XX.XX` against `release-xx.xx`.
 * When all status checks are green, merge.
 
 ### Add a new (major) version of the Linux kernel {#sec-linux-add-new-kernel-version}

From 3d9e72408732a55abc5116e3e86f724ec4cf3f53 Mon Sep 17 00:00:00 2001
From: Chris Moultrie <821688+tebriel@users.noreply.github.com>
Date: Tue, 26 May 2026 16:46:23 -0400
Subject: [PATCH 52/52] forgejo-runner: 12.10.1 -> 12.10.2

changelog: https://code.forgejo.org/forgejo/runner/releases/tag/v12.10.2
(cherry picked from commit da7842f1a7007aa63a24f07df44976e713bd8810)
---
 pkgs/by-name/fo/forgejo-runner/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fo/forgejo-runner/package.nix b/pkgs/by-name/fo/forgejo-runner/package.nix
index 4f85ec25dc13..cb1b754ca7de 100644
--- a/pkgs/by-name/fo/forgejo-runner/package.nix
+++ b/pkgs/by-name/fo/forgejo-runner/package.nix
@@ -52,17 +52,17 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "forgejo-runner";
-  version = "12.10.1";
+  version = "12.10.2";
 
   src = fetchFromGitea {
     domain = "code.forgejo.org";
     owner = "forgejo";
     repo = "runner";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-OBMduRaGSVPojSAr6DKPbAdUyuw1MSCpipRv+EA5OGw=";
+    hash = "sha256-Uo+x02HgpfOY+KXug7cmnW4d85AlX6wqz+nYGF/JrHk=";
   };
 
-  vendorHash = "sha256-V9dEHNp80oS7NfsGIlKgFyHD1PmMm2bCqydVADpphuA=";
+  vendorHash = "sha256-0gOftkxkBPziU0Tm8lIiD72rXcMMY5M57G9/Bt/mneI=";
 
   nativeBuildInputs = [ makeWrapper ];