From aa6e3ec6641cb82f073c9c764b6d3e8331c763c0 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Tue, 16 Jun 2026 11:29:50 +0800
Subject: [PATCH 01/57] luau: 0.720 -> 0.725

(cherry picked from commit 2188a9d0285554440566a9cb47883228f5323b5b)
---
 pkgs/by-name/lu/luau/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/lu/luau/package.nix b/pkgs/by-name/lu/luau/package.nix
index cc2b70ce687c..6d29fa4864c2 100644
--- a/pkgs/by-name/lu/luau/package.nix
+++ b/pkgs/by-name/lu/luau/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "luau";
-  version = "0.720";
+  version = "0.725";
 
   src = fetchFromGitHub {
     owner = "luau-lang";
     repo = "luau";
     tag = finalAttrs.version;
-    hash = "sha256-OF0Zsy1O+9rCcOlWRiBmoets7dAZES4Yy6X4QJ3ZdvQ=";
+    hash = "sha256-zRoB1psMrZRt8mLoaReyc0hvhRBPAotC1LmDNTYGLjA=";
   };
 
   nativeBuildInputs = [ cmake ];

From 35506e74a1e13eefeec21e80649e2ebb40e86194 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Fri, 24 Jul 2026 11:02:48 +0200
Subject: [PATCH 02/57] omxplayer: drop

part of #356387

Why would anyone use this?
- Old rpi 1 stuff
- Upstream is unmaintained since 2013
- The more maintained fork is deprecated since 2020 [1]
- uses pcre
- uses FFmpeg 1.1.3 from 2013
- only 2 non-treewide commits to the package since introduction, not a single update

[1] https://github.com/popcornmix/omxplayer#deprecation-warning

(cherry picked from commit e4f1329edeab869fb5fbd39203a3daa663606eaa)
---
 pkgs/by-name/om/omxplayer/package.nix | 111 --------------------------
 pkgs/top-level/aliases.nix            |   1 +
 2 files changed, 1 insertion(+), 111 deletions(-)
 delete mode 100644 pkgs/by-name/om/omxplayer/package.nix

diff --git a/pkgs/by-name/om/omxplayer/package.nix b/pkgs/by-name/om/omxplayer/package.nix
deleted file mode 100644
index e7291f65f169..000000000000
--- a/pkgs/by-name/om/omxplayer/package.nix
+++ /dev/null
@@ -1,111 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchurl,
-  raspberrypifw,
-  pcre,
-  boost,
-  freetype,
-  zlib,
-}:
-
-let
-  ffmpeg = stdenv.mkDerivation rec {
-    pname = "ffmpeg";
-    version = "1.1.3";
-
-    src = fetchurl {
-      url = "http://www.ffmpeg.org/releases/ffmpeg-${version}.tar.bz2";
-      sha256 = "03s1zsprz5p6gjgwwqcf7b6cvzwwid6l8k7bamx9i0f1iwkgdm0j";
-    };
-
-    configurePlatforms = [ ];
-    configureFlags = [
-      "--arch=${stdenv.hostPlatform.parsed.cpu.name}"
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isAarch32 [
-      # TODO be better with condition
-      "--cpu=arm1176jzf-s"
-    ]
-    ++ [
-      "--disable-muxers"
-      "--enable-muxer=spdif"
-      "--enable-muxer=adts"
-      "--disable-encoders"
-      "--enable-encoder=ac3"
-      "--enable-encoder=aac"
-      "--disable-decoder=mpeg_xvmc"
-      "--disable-devices"
-      "--disable-ffprobe"
-      "--disable-ffplay"
-      "--disable-ffserver"
-      "--disable-ffmpeg"
-      "--enable-shared"
-      "--disable-doc"
-      "--enable-postproc"
-      "--enable-gpl"
-      "--enable-protocol=http"
-      "--enable-pthreads"
-      "--disable-runtime-cpudetect"
-      "--enable-pic"
-      "--disable-armv5te"
-      "--disable-neon"
-      "--enable-armv6t2"
-      "--enable-armv6"
-      "--enable-hardcoded-tables"
-      "--disable-runtime-cpudetect"
-      "--disable-debug"
-      "--arch=${stdenv.hostPlatform.parsed.cpu.name}"
-      "--target_os=${stdenv.hostPlatform.parsed.kernel.name}"
-    ]
-    ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
-      "--cross-prefix=${stdenv.cc.targetPrefix}"
-      "--enable-cross-compile"
-    ];
-
-    enableParallelBuilding = true;
-
-    meta = {
-      homepage = "http://www.ffmpeg.org/";
-      description = "Complete, cross-platform solution to record, convert and stream audio and video";
-    };
-  };
-in
-stdenv.mkDerivation {
-  pname = "omxplayer";
-  version = "0-unstable-2013-03-28";
-
-  src = fetchFromGitHub {
-    owner = "huceke";
-    repo = "omxplayer";
-    rev = "fbee325dc20441138d04d8d2022ad85956302e97";
-    sha256 = "0fkvv8il7ffqxki2gp8cxa5shh6sz9jsy5vv3f4025g4gss6afkg";
-  };
-
-  postPatch = ''
-    sed -i 1d Makefile
-    export INCLUDES="-I${raspberrypifw}/include/interface/vcos/pthreads -I${raspberrypifw}/include/interface/vmcs_host/linux/"
-  '';
-
-  installPhase = ''
-    mkdir -p $out/bin
-    cp omxplayer.bin $out/bin
-  '';
-
-  buildInputs = [
-    raspberrypifw
-    ffmpeg
-    pcre
-    boost
-    freetype
-    zlib
-  ];
-
-  meta = {
-    homepage = "https://github.com/huceke/omxplayer";
-    description = "Commandline OMX player for the Raspberry Pi";
-    license = lib.licenses.gpl2Plus;
-    platforms = lib.platforms.arm;
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index f64f2c5e6001..863999d61013 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1596,6 +1596,7 @@ mapAliases {
   oil = throw "'oil' has been renamed to/replaced by 'oils-for-unix'"; # Converted to throw 2025-10-27
   olaris-server = throw "'olaris-server' has been removed as it failed to build since 2024"; # Added 2026-01-15
   olive-editor = throw "'olive-editor' has been removed as it is unmaintained upstream and broken"; # Added 2026-05-22
+  omxplayer = throw "'omxplayer' has been removed because it depends on a severely outdated upstream, a severely outdated FFmpeg, and the new upstream was deprecated since 2020. Please use 'vlc' instead."; # Added 2026-07-24
   oneDNN = onednn; # Added 2026-02-08
   oneDNN_2 = onednn_2; # Added 2026-02-08
   onevpl-intel-gpu = throw "'onevpl-intel-gpu' has been renamed to/replaced by 'vpl-gpu-rt'"; # Converted to throw 2025-10-27

From c6a44aa1f413659c5bb37789bb237eb7710bf9af Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 16 Jul 2026 05:14:05 +0000
Subject: [PATCH 03/57] containerd: 2.3.1 -> 2.3.3

(cherry picked from commit eb2872e23efca0116b50642a0a60a76c9981e397)
---
 pkgs/by-name/co/containerd/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/co/containerd/package.nix b/pkgs/by-name/co/containerd/package.nix
index d77c19eefd1c..b1f6e8627f76 100644
--- a/pkgs/by-name/co/containerd/package.nix
+++ b/pkgs/by-name/co/containerd/package.nix
@@ -16,7 +16,7 @@
 
 buildGoModule rec {
   pname = "containerd";
-  version = "2.3.1";
+  version = "2.3.3";
 
   outputs = [
     "out"
@@ -28,7 +28,7 @@ buildGoModule rec {
     owner = "containerd";
     repo = "containerd";
     tag = "v${version}";
-    hash = "sha256-BpKBrMluU5MmojJp/9Og5UrkUBLHav5qx6Re1SFhlhY=";
+    hash = "sha256-wa9Pixaq5RRrJucWibbBe4n6s53Pdj+mr5gLoFmDgLU=";
   };
 
   postPatch = ''

From 3af7d9151d46ed6efa3dad69ce8cc0acead855b1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 12 Jul 2026 19:54:16 +0000
Subject: [PATCH 04/57] percona-server: 8.4.8-8 -> 8.4.10-10

(cherry picked from commit 801318251c6ecaf2a3179c736398887f6a0e966f)
---
 pkgs/servers/sql/percona-server/8_4.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/percona-server/8_4.nix b/pkgs/servers/sql/percona-server/8_4.nix
index f85ce2bb5f99..694ac890215c 100644
--- a/pkgs/servers/sql/percona-server/8_4.nix
+++ b/pkgs/servers/sql/percona-server/8_4.nix
@@ -50,11 +50,11 @@ assert !(withJemalloc && withTcmalloc);
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "percona-server";
-  version = "8.4.8-8";
+  version = "8.4.10-10";
 
   src = fetchurl {
     url = "https://downloads.percona.com/downloads/Percona-Server-${lib.versions.majorMinor finalAttrs.version}/Percona-Server-${finalAttrs.version}/source/tarball/percona-server-${finalAttrs.version}.tar.gz";
-    hash = "sha256-jsGaovy3FNBrprC27R7cNofAZmTjqSK21U6wn6TEiBA=";
+    hash = "sha256-IjHeflYc3AMd6hNXDEYegXm14wjyt9hX3gIVtOQzauU=";
   };
 
   nativeBuildInputs = [

From 20226465fcb75ff1f06162457f456efc9ddd1a8b Mon Sep 17 00:00:00 2001
From: Bart Oostveen <bart@bartoostveen.nl>
Date: Fri, 10 Jul 2026 01:35:26 +0200
Subject: [PATCH 05/57] copyparty: 1.20.17 -> 1.20.18

Diff: https://github.com/9001/copyparty/compare/v1.20.17...v1.20.18
Changelog: https://github.com/9001/copyparty/releases/tag/v1.20.18
(cherry picked from commit 85f65988e8813c075a792f44182d9896620b13df)
---
 pkgs/by-name/co/copyparty/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/co/copyparty/package.nix b/pkgs/by-name/co/copyparty/package.nix
index 611827bb4723..0c30e8233d48 100644
--- a/pkgs/by-name/co/copyparty/package.nix
+++ b/pkgs/by-name/co/copyparty/package.nix
@@ -71,11 +71,11 @@ in
 
 python3Packages.buildPythonApplication rec {
   pname = "copyparty${nameSuffix}";
-  version = "1.20.17";
+  version = "1.20.18";
 
   src = fetchurl {
     url = "https://github.com/9001/copyparty/releases/download/v${version}/copyparty-${version}.tar.gz";
-    hash = "sha256-lJVTrv/qlCoN2r0+EtKKZD/qhi14kwuzbgrMxmxMlHU=";
+    hash = "sha256-6hNHouMLQmEoKsRgnJuER2ipJe7XF6yK8f+HqKMmUI4=";
   };
 
   pyproject = true;

From b215905338dfa4ddad7bdf793544a6ef6738752d Mon Sep 17 00:00:00 2001
From: Bart Oostveen <bart@bartoostveen.nl>
Date: Tue, 28 Jul 2026 00:46:37 +0200
Subject: [PATCH 06/57] copyparty: 1.20.18 -> 1.20.19

Diff: https://github.com/9001/copyparty/compare/v1.20.18...v1.20.19
Changelog: https://github.com/9001/copyparty/releases/tag/v1.20.19
Fixes: GHSA-phv8-wgjp-g4p9
(cherry picked from commit b58ac64f4211d2d3574e137d0f0fe0775ee95af8)
---
 pkgs/by-name/co/copyparty/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/co/copyparty/package.nix b/pkgs/by-name/co/copyparty/package.nix
index 0c30e8233d48..de361a6f91fd 100644
--- a/pkgs/by-name/co/copyparty/package.nix
+++ b/pkgs/by-name/co/copyparty/package.nix
@@ -71,11 +71,11 @@ in
 
 python3Packages.buildPythonApplication rec {
   pname = "copyparty${nameSuffix}";
-  version = "1.20.18";
+  version = "1.20.19";
 
   src = fetchurl {
     url = "https://github.com/9001/copyparty/releases/download/v${version}/copyparty-${version}.tar.gz";
-    hash = "sha256-6hNHouMLQmEoKsRgnJuER2ipJe7XF6yK8f+HqKMmUI4=";
+    hash = "sha256-g02X1jdXXLmy1TBSeQtlEvRisyQd/0ic9kFTnvYk/Ww=";
   };
 
   pyproject = true;

From c7a19fc67cbbe608239f5dfbad56d23aae0c3732 Mon Sep 17 00:00:00 2001
From: Talles Coelho <talles.hoc@gmail.com>
Date: Sat, 25 Jul 2026 14:39:18 -0300
Subject: [PATCH 07/57] maintainers: add tallesCoelho

(cherry picked from commit 7b093a6f3abe58ba190839e5ca4dc15d50e5dbbf)
---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 0a37795104cc..865b0d6464f1 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -27019,6 +27019,12 @@
     githubId = 51232929;
     name = "Taito Horiuchi";
   };
+  tallesCoelho = {
+    email = "talles.hoc@gmail.com";
+    github = "tallesCoelho";
+    githubId = 7442204;
+    name = "Talles Coelho";
+  };
   talyz = {
     email = "kim.lindberger@gmail.com";
     matrix = "@talyz:matrix.org";

From 546330e2834c028a94664e97087c6860d86ef3e6 Mon Sep 17 00:00:00 2001
From: Talles Coelho <talles.hoc@gmail.com>
Date: Sat, 25 Jul 2026 14:44:03 -0300
Subject: [PATCH 08/57] megasync: add tallesCoelho as maintainer

(cherry picked from commit 0fe3e26f74e2d959be9d822d3ff9dbab196aed11)
---
 pkgs/by-name/me/megasync/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/me/megasync/package.nix b/pkgs/by-name/me/megasync/package.nix
index d4cf351b2237..9f761360f255 100644
--- a/pkgs/by-name/me/megasync/package.nix
+++ b/pkgs/by-name/me/megasync/package.nix
@@ -152,7 +152,7 @@ stdenv.mkDerivation (finalAttrs: {
       "i686-linux"
       "x86_64-linux"
     ];
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ tallesCoelho ];
     mainProgram = "megasync";
   };
 })

From a0fe6684f1817ab559beec2d1daffa0905501f64 Mon Sep 17 00:00:00 2001
From: rewine <luhongxu@deepin.org>
Date: Thu, 16 Jul 2026 13:03:09 +0800
Subject: [PATCH 09/57] vivaldi: use bundled libffmpeg.so instead of nixpkgs
 ffmpeg

The NixOS-provided ffmpeg can have symbol mismatches with Vivaldi's
internal expectations, e.g.:

  symbol lookup error: vivaldi-bin: undefined symbol:
  av_dynamic_hdr_smpte2094_app5_to_t35

Remove ffmpeg from buildInputs and fix the rpath so that Vivaldi's
bundled libffmpeg.so (in opt/vivaldi/) is correctly found by the
dynamic linker, instead of the system one.

Fix: 542284
(cherry picked from commit 3ab68ce9e32e056c2107887e046128cf7bc480e0)
---
 pkgs/by-name/vi/vivaldi/package.nix | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/pkgs/by-name/vi/vivaldi/package.nix b/pkgs/by-name/vi/vivaldi/package.nix
index 66f5ac76805c..1e1a18fb1ef3 100644
--- a/pkgs/by-name/vi/vivaldi/package.nix
+++ b/pkgs/by-name/vi/vivaldi/package.nix
@@ -23,7 +23,6 @@
   dbus,
   cups,
   libexif,
-  ffmpeg,
   systemd,
   libva,
   libGL,
@@ -131,7 +130,6 @@ stdenv.mkDerivation rec {
     gtk3
     gdk-pixbuf
     libexif
-    ffmpeg
     systemd
     libva
     qt6.qtbase
@@ -163,7 +161,7 @@ stdenv.mkDerivation rec {
     + lib.optionalString (stdenv.hostPlatform.is64bit) (
       ":" + lib.makeSearchPathOutput "lib" "lib64" buildInputs
     )
-    + ":$out/opt/vivaldi/lib";
+    + ":$out/opt/vivaldi";
 
   buildPhase = ''
     runHook preBuild

From 2d72f6ac1d87a57fbbfc712b833428b88f0b14f5 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Sat, 25 Jul 2026 14:36:40 +0200
Subject: [PATCH 10/57] fcitx5-with-addons: avoid empty path segment in
 `LD_LIBRARY_PATH`

(cherry picked from commit eb0ce37186bbfcf6b31a49aefa979dc8a8cfd4c9)
---
 pkgs/tools/inputmethods/fcitx5/with-addons.nix | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/pkgs/tools/inputmethods/fcitx5/with-addons.nix b/pkgs/tools/inputmethods/fcitx5/with-addons.nix
index 2d3a2b107c92..7523f7c3b127 100644
--- a/pkgs/tools/inputmethods/fcitx5/with-addons.nix
+++ b/pkgs/tools/inputmethods/fcitx5/with-addons.nix
@@ -12,6 +12,9 @@
   addons ? [ ],
 }:
 
+let
+  extraLdLibraries = lib.flatten (map (x: x.extraLdLibraries or [ ]) addons);
+in
 symlinkJoin {
   name = "fcitx5-with-addons-${fcitx5.version}";
 
@@ -37,10 +40,11 @@ symlinkJoin {
       --set GDK_PIXBUF_MODULE_FILE "$GDK_PIXBUF_MODULE_FILE" \
       --prefix FCITX_ADDON_DIRS : "$out/lib/fcitx5" \
       --suffix XDG_DATA_DIRS : "$out/share" \
-      --suffix PATH : "$out/bin" \
-      --suffix LD_LIBRARY_PATH : "${
-        lib.makeLibraryPath (lib.flatten (map (x: x.extraLdLibraries or [ ]) addons))
-      }"
+      --suffix PATH : "$out/bin" ${
+        lib.optionalString (
+          extraLdLibraries != [ ]
+        ) ''--suffix LD_LIBRARY_PATH : "${lib.makeLibraryPath extraLdLibraries}"''
+      }
 
     ${lib.optionalString withConfigtool ''
       # Configtool call libexec/fcitx5-qt5-gui-wrapper for gui addons in FCITX_ADDON_DIRS

From dc47d588aa49c2a4fda918f3969133799c8319c1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 9 Jun 2026 15:13:11 +0000
Subject: [PATCH 11/57] fuse-overlayfs: 1.16 -> 1.17

(cherry picked from commit 9af850c21dfaf9c3e26e3f1d65eb0ee8a124b3b6)
---
 pkgs/by-name/fu/fuse-overlayfs/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fu/fuse-overlayfs/package.nix b/pkgs/by-name/fu/fuse-overlayfs/package.nix
index e089ea653761..f151dbfca6e5 100644
--- a/pkgs/by-name/fu/fuse-overlayfs/package.nix
+++ b/pkgs/by-name/fu/fuse-overlayfs/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fuse-overlayfs";
-  version = "1.16";
+  version = "1.17";
 
   src = fetchFromGitHub {
     owner = "containers";
     repo = "fuse-overlayfs";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-FwAv5PmiBz25PNH/IEIV6cHjhlE+1mDTrgvR2vN++ZY=";
+    hash = "sha256-oXSqyxe5+hsuFXKajuviqh2nKIz8Kw6rjLnb6XTF6GI=";
   };
 
   nativeBuildInputs = [

From 5b327f76aa593eac23a151746870fca58bbf8e15 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 18 Jul 2026 18:25:51 +0000
Subject: [PATCH 12/57] vivaldi: 8.1.4087.48 -> 8.1.4087.55

(cherry picked from commit 22e2b13770c1ef4d395d247c8c0efca799fe54af)
---
 pkgs/by-name/vi/vivaldi/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/vi/vivaldi/package.nix b/pkgs/by-name/vi/vivaldi/package.nix
index 66f5ac76805c..afd6e7264c71 100644
--- a/pkgs/by-name/vi/vivaldi/package.nix
+++ b/pkgs/by-name/vi/vivaldi/package.nix
@@ -67,7 +67,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vivaldi";
-  version = "8.1.4087.48";
+  version = "8.1.4087.55";
 
   suffix =
     {
@@ -80,8 +80,8 @@ stdenv.mkDerivation rec {
     url = "https://downloads.vivaldi.com/stable/vivaldi-stable_${version}-1_${suffix}.deb";
     hash =
       {
-        aarch64-linux = "sha256-T6mBi4FpHz2iGXeF91giTbuVp4KjFG1DUnPNpKEV06c=";
-        x86_64-linux = "sha256-/Bgh+Y6DHWe7al9vLsWWH1HM5JQGwv91KUxQ9TNkqjs=";
+        aarch64-linux = "sha256-cSDu1cjfCIkn0wWm6cWaBrfgGZH4+qs3JnXYx+JfC7k=";
+        x86_64-linux = "sha256-GicxDYZJxerEEDu08ZlyegLLZSknZtuRZrCUYT+Q1N0=";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };

From ee155a962ed5a3cea8073b235221e0d8cab9b85e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 27 Jul 2026 21:40:28 +0000
Subject: [PATCH 13/57] vivaldi: 8.1.4087.55 -> 8.1.4087.58

(cherry picked from commit 95592cab2e6ac2d1c59f0df04c01ccf69ff61580)
---
 pkgs/by-name/vi/vivaldi/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/vi/vivaldi/package.nix b/pkgs/by-name/vi/vivaldi/package.nix
index afd6e7264c71..6191d047f708 100644
--- a/pkgs/by-name/vi/vivaldi/package.nix
+++ b/pkgs/by-name/vi/vivaldi/package.nix
@@ -67,7 +67,7 @@
 
 stdenv.mkDerivation rec {
   pname = "vivaldi";
-  version = "8.1.4087.55";
+  version = "8.1.4087.58";
 
   suffix =
     {
@@ -80,8 +80,8 @@ stdenv.mkDerivation rec {
     url = "https://downloads.vivaldi.com/stable/vivaldi-stable_${version}-1_${suffix}.deb";
     hash =
       {
-        aarch64-linux = "sha256-cSDu1cjfCIkn0wWm6cWaBrfgGZH4+qs3JnXYx+JfC7k=";
-        x86_64-linux = "sha256-GicxDYZJxerEEDu08ZlyegLLZSknZtuRZrCUYT+Q1N0=";
+        aarch64-linux = "sha256-Yvs3HRbsrgTeYXAKrRliLArXtK96jnjjf7x/sdpwvig=";
+        x86_64-linux = "sha256-/2GdNvj9+O6LDfqJdjNNdNWJymNAtnpTnzznW/4jINE=";
       }
       .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
   };

From c7fcc9ac0ba771673d3dd3a21e94d96316a28c50 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 30 Jul 2026 16:35:04 +0000
Subject: [PATCH 14/57] thunderbird-esr-bin-unwrapped: 140.12.1esr ->
 153.0.1esr

(cherry picked from commit 10fe9f12a430770bfe53a1cdef2bd2115b36f7db)
---
 .../thunderbird-bin/release_esr_sources.nix   | 926 +++++-------------
 1 file changed, 265 insertions(+), 661 deletions(-)

diff --git a/pkgs/applications/networking/mailreaders/thunderbird-bin/release_esr_sources.nix b/pkgs/applications/networking/mailreaders/thunderbird-bin/release_esr_sources.nix
index 633d5c6bb451..f66bb27327d4 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird-bin/release_esr_sources.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird-bin/release_esr_sources.nix
@@ -1,1193 +1,797 @@
 {
-  version = "140.12.1esr";
+  version = "153.0.1esr";
   sources = [
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/af/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/af/thunderbird-153.0.1esr.tar.xz";
       locale = "af";
       arch = "linux-x86_64";
-      sha256 = "be9018fd65fea36f04564f34277e82700dd6f6ea1a08a2141d7e8b1fd18d7aaf";
+      sha256 = "c254b1df124a869d386635af99add326308fbc6fcb4fd6e1a78a1cf7b17cdf9c";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/ar/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/ar/thunderbird-153.0.1esr.tar.xz";
       locale = "ar";
       arch = "linux-x86_64";
-      sha256 = "79deb45cd4b928e501498a0367882a9b05ef986f636f6d4decaad3dbf4b89880";
+      sha256 = "f2675fb2b1a66bb21bc412216361adcdc44314bfa2439b4ba98d53431b379fb4";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/ast/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/ast/thunderbird-153.0.1esr.tar.xz";
       locale = "ast";
       arch = "linux-x86_64";
-      sha256 = "ecf4361deb934a3a81434b58c6835eeaf226a7265a58b198572a03641858675e";
+      sha256 = "bf98d5580b81b1db31d87d1ce5979d04ac520de563b1bb04b1263d99c9fad0db";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/be/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/be/thunderbird-153.0.1esr.tar.xz";
       locale = "be";
       arch = "linux-x86_64";
-      sha256 = "be21c4c898d1454573db61e7ee4b8428bb7656d5b9de839f43cc06bf18fc596c";
+      sha256 = "0afca657f2b8d558fa25150f8cb918ac0495f222e42493b01b2860f4331701ed";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/bg/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/bg/thunderbird-153.0.1esr.tar.xz";
       locale = "bg";
       arch = "linux-x86_64";
-      sha256 = "c14361f950b6fdacb576dcd1cfe751db826ff433cc7df7faa6463b654410a479";
+      sha256 = "91cf450c64d9735e0acd7d80600b16ab2f0ac1118ee83050d201c6df0f204901";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/br/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/br/thunderbird-153.0.1esr.tar.xz";
       locale = "br";
       arch = "linux-x86_64";
-      sha256 = "e049cefec62df1fa31eeb9cfb0959d07ca6a2ed61fbc1e4b19b392d974900769";
+      sha256 = "036b4b071ec103f70c5b457c3fd23b9848845d0039941a59f5743c84381beed8";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/ca/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/ca/thunderbird-153.0.1esr.tar.xz";
       locale = "ca";
       arch = "linux-x86_64";
-      sha256 = "6f4a3318fec4a757750e586a4a97370c8db4320cb3033aa251a8eed21d18aa48";
+      sha256 = "7c7abc74b3c2349e4fb4219eee95404b25e20e978f5eade4d370568a25ebe832";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/cak/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/cak/thunderbird-153.0.1esr.tar.xz";
       locale = "cak";
       arch = "linux-x86_64";
-      sha256 = "f42fa814fe765c1f99acb1747708f0f485847020de43a82c62e72e5834e2c3d7";
+      sha256 = "6dbb25230554ebd99a0fec62960f3d02c1f1b02c506a328b6be149b2ae43177e";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/cs/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/cs/thunderbird-153.0.1esr.tar.xz";
       locale = "cs";
       arch = "linux-x86_64";
-      sha256 = "57f774c07dfe8145b3cb0dbd95f65c7f8e97aef3123774f43a2608b5159b03f6";
+      sha256 = "f64a125b1ce30cdc75ff9ecb6de4c6ec0398fba79ceaa0b4adf614873bfe0a18";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/cy/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/cy/thunderbird-153.0.1esr.tar.xz";
       locale = "cy";
       arch = "linux-x86_64";
-      sha256 = "9cd18105b3ec4b7026e6eeb09610ebdc7e16e3f7d2f6af91b216a2356c97d6e6";
+      sha256 = "6120f453cc499b7b1390bcb255313ba92928175d6a7f94513c3541f645679ba3";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/da/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/da/thunderbird-153.0.1esr.tar.xz";
       locale = "da";
       arch = "linux-x86_64";
-      sha256 = "765ceeec2296798053febab1a1e32dbe142738db72b88945e619aa238713682f";
+      sha256 = "d9d27becc215bc3473c5e734a85ccf8b39327e7c87345ca44e8de44f3fbaf0f5";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/de/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/de/thunderbird-153.0.1esr.tar.xz";
       locale = "de";
       arch = "linux-x86_64";
-      sha256 = "15ba511fb57c09b50b061b4bb164e21391b70a875dd5d0ee3a26fba414326f07";
+      sha256 = "dca3b067e41975be3953daafe8c1a1efeafb4f5a7faf82607b5701d83d2ecc63";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/dsb/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/dsb/thunderbird-153.0.1esr.tar.xz";
       locale = "dsb";
       arch = "linux-x86_64";
-      sha256 = "dbf0bf70808da40282e32e1a75e0ed6f21af8fe47faf59888fcdd6be60a5f8b0";
+      sha256 = "dbdbbb02311f7b7d96c6fd0294164f135f8c685798697ffbe101ab088f71dc7a";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/el/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/el/thunderbird-153.0.1esr.tar.xz";
       locale = "el";
       arch = "linux-x86_64";
-      sha256 = "4a9c787562473045724653302b2de0bca5626571633246a373ae1b06e57ba904";
+      sha256 = "33355fbd0aa7ca081afae475faedf782944f852d570623c84cc174ff5e49c9d4";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/en-CA/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/en-CA/thunderbird-153.0.1esr.tar.xz";
       locale = "en-CA";
       arch = "linux-x86_64";
-      sha256 = "4514da1947cc1733e29b19c4130283415caf6271df1e670779001d2544fbaf35";
+      sha256 = "0dee081d54c2d1ee8452c0809085b158f416a36b2bbcfc07ee61c98bb2f55dfc";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/en-GB/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/en-GB/thunderbird-153.0.1esr.tar.xz";
       locale = "en-GB";
       arch = "linux-x86_64";
-      sha256 = "31a404d71ff2d3e6c6e0dfea7201cc5bb926fe22d0f57f2e6577384846c699ad";
+      sha256 = "4fb75e8bbe4fe2c16528807ef559d232f593b84719883fc88a4e80f2228bfbcf";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/en-US/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/en-US/thunderbird-153.0.1esr.tar.xz";
       locale = "en-US";
       arch = "linux-x86_64";
-      sha256 = "9219a4dce3e4fa5b70678df7841151264d27ebbfdd0da8fa3dcb1c42f39afc9d";
+      sha256 = "80803c07b6a001a4ba86c8856505ea5db1b36c3d6d16f218fad4f3e683658618";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/es-AR/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/es-AR/thunderbird-153.0.1esr.tar.xz";
       locale = "es-AR";
       arch = "linux-x86_64";
-      sha256 = "4f2e575099db2aae498212b1cff6ec9f400f13e620d36a708b7dae0b4d26d19d";
+      sha256 = "9b324705c4ba7e454f873cf7ee1ebdfe17fd41a23ea4ae2fbc278fa1aefabb26";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/es-ES/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/es-ES/thunderbird-153.0.1esr.tar.xz";
       locale = "es-ES";
       arch = "linux-x86_64";
-      sha256 = "4c1c55cba2a2a9bd0bac06e3de6c53bbbdf83ca762d3dc2df7b8d5e7fcafb44f";
+      sha256 = "b21af68ba24f5f67ccd13d0c7125c8e56b3e122875d4ad2746f0c99c9b42ebd1";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/es-MX/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/es-MX/thunderbird-153.0.1esr.tar.xz";
       locale = "es-MX";
       arch = "linux-x86_64";
-      sha256 = "33db312a8bcf41d818db437b322c10a93742457440ac89766fc54e2990185785";
+      sha256 = "04dd4a52fd994e588af3d5d09e9d03fa90af14df0cf8bcf0ea171b8591790d69";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/et/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/et/thunderbird-153.0.1esr.tar.xz";
       locale = "et";
       arch = "linux-x86_64";
-      sha256 = "890b21ffe3bc46cc16cbd568bd3c7c773688466b86508972c4bcf9ebd147c943";
+      sha256 = "739dea063f35565d0b148db9dc407b2d849831dc91b321b7ad8ccf988d16ddf8";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/eu/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/eu/thunderbird-153.0.1esr.tar.xz";
       locale = "eu";
       arch = "linux-x86_64";
-      sha256 = "5219c5671612d0d2a0caf687769a1f44509ccece02a160804d89c1dc462a3602";
+      sha256 = "436b6b3dbcd94a5581b036ae2d911ddb13199c9f2818c460352a23bd7fbc22d7";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/fi/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/fi/thunderbird-153.0.1esr.tar.xz";
       locale = "fi";
       arch = "linux-x86_64";
-      sha256 = "e95521bd64512ada8c370e3fe90c79bbf0b05e2b496dd199e1b041d6300ed657";
+      sha256 = "cced07d6d7affad4ae93a1473794d9b290e6b717aff74ea20f87fceb92957abd";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/fr/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/fr/thunderbird-153.0.1esr.tar.xz";
       locale = "fr";
       arch = "linux-x86_64";
-      sha256 = "2aa93022829facf005b19544247f5c12ff7cecc5f0794ec9526a95eeddf822ab";
+      sha256 = "90a4af6a26edf9b935271358cad880ed9b5aad5f49105b702eed8c940f0348bc";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/fy-NL/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/fy-NL/thunderbird-153.0.1esr.tar.xz";
       locale = "fy-NL";
       arch = "linux-x86_64";
-      sha256 = "5be868b0a147da456afcd3ddf77a298fb70772f7bc63440e4861e470e91a64d5";
+      sha256 = "565b2cffa8da04668209d58a644f4cdd3d65b58f83f784524654ece01990e298";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/ga-IE/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/ga-IE/thunderbird-153.0.1esr.tar.xz";
       locale = "ga-IE";
       arch = "linux-x86_64";
-      sha256 = "aa5c6b581f29e3075dfb648928c15a5adcecbf20933ebdff70e0849206e581c6";
+      sha256 = "f06c7076c5160df03a3416c0ba739fe0e7887e479975c4747c473d88d004b61d";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/gd/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/gd/thunderbird-153.0.1esr.tar.xz";
       locale = "gd";
       arch = "linux-x86_64";
-      sha256 = "16664961711bd9b9538747e107d429b1934ac1fe8310fd643febe7698324de93";
+      sha256 = "ace03818aa21e6b94f37516e5aae5f5433543c65e7737930dce4d4f841eb1eaa";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/gl/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/gl/thunderbird-153.0.1esr.tar.xz";
       locale = "gl";
       arch = "linux-x86_64";
-      sha256 = "6ff317dde8a319983a01f2b46466eebb8f2225eb2c88d5950f437616ebe84507";
+      sha256 = "968a7af793dcc009490c4044053260f41aa1528582b4f0369256c81382388c80";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/he/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/he/thunderbird-153.0.1esr.tar.xz";
       locale = "he";
       arch = "linux-x86_64";
-      sha256 = "e0bea2a1252ea3ea6529ea51059e732b03d45095ef3adc7ea7fdde36d83ad398";
+      sha256 = "3ae289767301055a2918058dc1ceab0dece45ba292bc8f891cecda32e423ed92";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/hr/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/hr/thunderbird-153.0.1esr.tar.xz";
       locale = "hr";
       arch = "linux-x86_64";
-      sha256 = "1d298936666fac71a516acb54278ffe7e8ac1b5d37139d275624c48a793f2ebe";
+      sha256 = "73c5dca14382aeb3dabacf1aa32d636e96dc63e601cbe23308e3b63c498b7d57";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/hsb/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/hsb/thunderbird-153.0.1esr.tar.xz";
       locale = "hsb";
       arch = "linux-x86_64";
-      sha256 = "a46bda6771c5d83aaec24439de21c33a97f01cfbb712dd7d111a4baf589209dd";
+      sha256 = "e9ff552f2ce30c832b27563ac1cec94bed6708efe1a1f0bb853777a5f99614cc";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/hu/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/hu/thunderbird-153.0.1esr.tar.xz";
       locale = "hu";
       arch = "linux-x86_64";
-      sha256 = "ebc0c1b12e90a53ae35652ccbe9181773a382fa02ecc29a74f29fca684f41362";
+      sha256 = "ae072529181ce8b2581207ea4f63ab54fb011269da9b0b2f9b793a6e49963b94";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/hy-AM/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/hy-AM/thunderbird-153.0.1esr.tar.xz";
       locale = "hy-AM";
       arch = "linux-x86_64";
-      sha256 = "0b54dc71db19e9d7e28402bee8b98c8d244fb8eac708621f0b5e168ec9662883";
+      sha256 = "33852d3c8da1c8980408fdf5b0e00e23e4470ee237fe5087f228d4c1d3f8d873";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/id/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/id/thunderbird-153.0.1esr.tar.xz";
       locale = "id";
       arch = "linux-x86_64";
-      sha256 = "94e241fbd784980ae83d8d7238e8e30602d405827be3609b89a0a67d031cc99e";
+      sha256 = "48b4c8444f3559e89a2afb64f2068a91b92214984a400eef194fd485a0cb7e79";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/is/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/is/thunderbird-153.0.1esr.tar.xz";
       locale = "is";
       arch = "linux-x86_64";
-      sha256 = "7c9fbe81d96274b8657a966ae7b093bc3e2a8f7e35ef256d175a6c2fc06d4d90";
+      sha256 = "b23ab3f78e2eba14a51898e652b4ca1bfba122c4c5a3085a3797a8c4c6cb4cc6";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/it/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/it/thunderbird-153.0.1esr.tar.xz";
       locale = "it";
       arch = "linux-x86_64";
-      sha256 = "17c912a8dbca2be4abfd29af189137e72b64213a2eaa2848a19fd5a1493f1635";
+      sha256 = "9eca88ab911bc92742f607fc088edc3f717fda3157b8909144a352d09cea657e";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/ja/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/ja/thunderbird-153.0.1esr.tar.xz";
       locale = "ja";
       arch = "linux-x86_64";
-      sha256 = "dab5b64a874c14f6f9b07224e93ac2cc35f4f787e7faf57eb6e04030d1041cbf";
+      sha256 = "5ad10204603bd4a97f8c1cfef5c9f7759ea25fd790f13b199885e101132b2536";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/ka/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/ka/thunderbird-153.0.1esr.tar.xz";
       locale = "ka";
       arch = "linux-x86_64";
-      sha256 = "115d44e3d91e5018d426c2dbd204cefa019bd671c65a7bac125bb27614e6a5db";
+      sha256 = "4521bad27945deac3ffa81b6e472d94c319a57e55652dadc39497564f84b063c";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/kab/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/kab/thunderbird-153.0.1esr.tar.xz";
       locale = "kab";
       arch = "linux-x86_64";
-      sha256 = "dd5168e203131682bf80b0e7dfbaa7e212dbd375cf886861412eca7a1d0db7bf";
+      sha256 = "7cc905a86beef02eb8bf93bca7db057f20f8da816197859e954f7cc7e09eb114";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/kk/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/kk/thunderbird-153.0.1esr.tar.xz";
       locale = "kk";
       arch = "linux-x86_64";
-      sha256 = "755d97a8987dd5bd8fdc5612ce687e162713670483b3c55e7b44c7dd042a91ae";
+      sha256 = "dc4560cea47c92ff727058236a16562be2605aaf6dc4cc7ca816b4617a9e1156";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/ko/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/ko/thunderbird-153.0.1esr.tar.xz";
       locale = "ko";
       arch = "linux-x86_64";
-      sha256 = "30687136cfa82e455667604e42f495e83a21ef90b19c865de4f7099013ff3cbf";
+      sha256 = "742ebc1f8303fc19c668a35048f36b14787d43389348b65d2e13918c079285a3";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/lt/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/lt/thunderbird-153.0.1esr.tar.xz";
       locale = "lt";
       arch = "linux-x86_64";
-      sha256 = "f087ff1203bc99e78ebd04ac80527f547ca13da3c63fecf379ab30e130c2a526";
+      sha256 = "b1cf553bbc0552f04b4e62a71b778445ee210326a1df4f37385d3567f21e302a";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/lv/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/lv/thunderbird-153.0.1esr.tar.xz";
       locale = "lv";
       arch = "linux-x86_64";
-      sha256 = "9fa7035fd9e39c727486d52ce5dc56bd17bf753758d5a5a693f7b33ee5736087";
+      sha256 = "9068a4630240b22a2e4959e8face13ea6f7de358b3ca3a71ad6df0d5a5844b89";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/ms/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/ms/thunderbird-153.0.1esr.tar.xz";
       locale = "ms";
       arch = "linux-x86_64";
-      sha256 = "7983e316aa18d324ba9fbca057d96ec0028575d126c32ae045176ddef811dbe4";
+      sha256 = "22cfde6f03067482d282643f9e52be077e10c34124d59f19327c9c306c68fff8";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/nb-NO/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/nb-NO/thunderbird-153.0.1esr.tar.xz";
       locale = "nb-NO";
       arch = "linux-x86_64";
-      sha256 = "d7921d8bf450eaa33646d3ae66c7645ccb88eb6486edee48134efec9759bd229";
+      sha256 = "dbf3568a88aab8435dbe73fd8e466b7360836f923479705091fbc662624361cd";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/nl/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/nl/thunderbird-153.0.1esr.tar.xz";
       locale = "nl";
       arch = "linux-x86_64";
-      sha256 = "5a55d46fb87a2737986c6cb28c35140063040dfa9a734025504c5e818d896840";
+      sha256 = "844befab9c2615b459cbea69c96cd9629a34f27ea6a28aef5e3c39d999f68bb6";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/nn-NO/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/nn-NO/thunderbird-153.0.1esr.tar.xz";
       locale = "nn-NO";
       arch = "linux-x86_64";
-      sha256 = "fe501181a77c26d9653dea39ad93fc1d822ad1759ce4d39942eea10b2b85366c";
+      sha256 = "60de0fa2e8e59cd27850a0cb97b0a4d1740b598ca766f9893655eae3517c179d";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/pa-IN/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/pa-IN/thunderbird-153.0.1esr.tar.xz";
       locale = "pa-IN";
       arch = "linux-x86_64";
-      sha256 = "c8a3393940e824e07c3754be6a923d94fe18520eeeeb687234ce5dca7150c0e7";
+      sha256 = "670bea9d165a825735ee5e71453942996f9a3e89ae7346c8a45d44936cca7751";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/pl/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/pl/thunderbird-153.0.1esr.tar.xz";
       locale = "pl";
       arch = "linux-x86_64";
-      sha256 = "a9491c647a326d167c4d48cd6ed12ae6dbeda56d74a327f52200c2a4be1160d3";
+      sha256 = "9cd62a8a4a78b7d8a8c7a86887c02a4162ad62704a26f3d22cf1ee693d0610bf";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/pt-BR/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/pt-BR/thunderbird-153.0.1esr.tar.xz";
       locale = "pt-BR";
       arch = "linux-x86_64";
-      sha256 = "1136d4946243d708dbc1c9da8e049d19c4e36c66f0c985820e37d78738ac7f6b";
+      sha256 = "001d34c6757a207bc07e24a0c55d3d747a0422fc890c19eaa2fb2230c4442760";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/pt-PT/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/pt-PT/thunderbird-153.0.1esr.tar.xz";
       locale = "pt-PT";
       arch = "linux-x86_64";
-      sha256 = "e23622710ac085886fd024e3190de0970aa51f9997ee58867f502f43b3cf631b";
+      sha256 = "96bf502e6c26dbae3408bd8a100820a461cbbed0054d62d3cd029922741ad47a";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/rm/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/rm/thunderbird-153.0.1esr.tar.xz";
       locale = "rm";
       arch = "linux-x86_64";
-      sha256 = "5d151b3715a3dd26bb38a2c5d8c10214c9f23bce42018009a9add87b8ed69e17";
+      sha256 = "f2a65d278e109b95e7d637a84fb4109c340c3899addfee56f7f2fed864002433";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/ro/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/ro/thunderbird-153.0.1esr.tar.xz";
       locale = "ro";
       arch = "linux-x86_64";
-      sha256 = "0b113061d80cbaf5cb535634ce373167d6a64cb1f3237d33633d2fea125f8e4d";
+      sha256 = "fa5266626341219183c98d69a47995dae6c2b59626150dc7fdb6887c96b8a7f6";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/ru/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/ru/thunderbird-153.0.1esr.tar.xz";
       locale = "ru";
       arch = "linux-x86_64";
-      sha256 = "7a39a7d6b459e27f321fdd38f39a95958c5032d3ecfcc051ac2ac44949d527c2";
+      sha256 = "c91855c40676f79d49fd0f04e19319307f1686f20a2526270839cd47e5d756b1";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/sk/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/sk/thunderbird-153.0.1esr.tar.xz";
       locale = "sk";
       arch = "linux-x86_64";
-      sha256 = "63d73b38596f78719f3223e9bb2943e1e984f415d82ce6a2c33587c8e1c49e43";
+      sha256 = "e44e7e3d72dd68a71d8fd4331464d1678e4c7bb39f03b4d1ccb57530bc7443fb";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/sl/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/sl/thunderbird-153.0.1esr.tar.xz";
       locale = "sl";
       arch = "linux-x86_64";
-      sha256 = "aceafcf6797834e8b4718b57124c0a1c4ef4457bf3e70e23ad5140c40ce2cf2d";
+      sha256 = "51d495d20e83604694af17af1b01d35efb200fa72adbdc1a47231560a46d94e2";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/sq/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/sq/thunderbird-153.0.1esr.tar.xz";
       locale = "sq";
       arch = "linux-x86_64";
-      sha256 = "2ee339035fe6d9507a8e52879ed56982ed534f7cae580fd7ae46656607626042";
+      sha256 = "7ac882b3a3512861d3eb453233b47cc67ff1400e7e19287a7b046abea2ad07b6";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/sr/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/sr/thunderbird-153.0.1esr.tar.xz";
       locale = "sr";
       arch = "linux-x86_64";
-      sha256 = "69bd23d5426be0eff640aa012a27375c1af0810dcdeeeab04760112bdad0a798";
+      sha256 = "8c0b53b481b41def0b483d619d1fbef8e0ae4c28440ab9adb3dcef4c42106771";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/sv-SE/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/sv-SE/thunderbird-153.0.1esr.tar.xz";
       locale = "sv-SE";
       arch = "linux-x86_64";
-      sha256 = "3860304e7c2690ce4596022744f2a4108f4e0850eea9c35fc5e5f3030119b403";
+      sha256 = "00f401fdf3264f96e4acc8b6fd28bbe10a487998852c47b131428d4d24b7fb0f";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/th/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/th/thunderbird-153.0.1esr.tar.xz";
       locale = "th";
       arch = "linux-x86_64";
-      sha256 = "165ac84909adc334bc47b8c9df7cd5450fee5c4d645da893b1f337d4c36dc0ce";
+      sha256 = "9988206d8b84d4d2a1be0e32acf68442ea752ad7fb47d4764a35f0d34c5f9b1e";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/tr/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/tr/thunderbird-153.0.1esr.tar.xz";
       locale = "tr";
       arch = "linux-x86_64";
-      sha256 = "03ec5cda6b9e65b5a0763e354d39ff96586a8d1013f217354b8c0b44634aac28";
+      sha256 = "d45736457b4622549e08cbd78793ea71716fc3803b16e394c5342092f959ff49";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/uk/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/uk/thunderbird-153.0.1esr.tar.xz";
       locale = "uk";
       arch = "linux-x86_64";
-      sha256 = "1fcfc649b3313e17d0a74a1ffef8ca05935632d7ae0efdd2c546555cd099cabc";
+      sha256 = "2dcc178b403ec301e3bc16cb6910e91880de225b68612adc2eb9e4a3aaf5147e";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/uz/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/uz/thunderbird-153.0.1esr.tar.xz";
       locale = "uz";
       arch = "linux-x86_64";
-      sha256 = "7385491cd07d147b598f8c95c0522b9d9eece19a3bb02b21112deeb419f78ede";
+      sha256 = "b845e9ee80471aa084ac4f4093151f74e714a10058de393509abec7ba8189d79";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/vi/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/vi/thunderbird-153.0.1esr.tar.xz";
       locale = "vi";
       arch = "linux-x86_64";
-      sha256 = "bddfaa6a2c41872e4b3a739163d1090e8173f08538dba53a5779087a58cde745";
+      sha256 = "72f317789a1457bf3a98d1659105553bba29abc37e044af12c4117c01d18da51";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/zh-CN/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/zh-CN/thunderbird-153.0.1esr.tar.xz";
       locale = "zh-CN";
       arch = "linux-x86_64";
-      sha256 = "d6a5a5ede7339f087c4ef4c246895be9e09200bbc7b4940d3d103c4c636d6aed";
+      sha256 = "9c0b723220b0faf35356c780d96d7691f23fa0b88b7a5dc9ccfba244076c050d";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-x86_64/zh-TW/thunderbird-140.12.1esr.tar.xz";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/linux-x86_64/zh-TW/thunderbird-153.0.1esr.tar.xz";
       locale = "zh-TW";
       arch = "linux-x86_64";
-      sha256 = "7bffdbc3af3158652c2a1ae7fc824d26b7d57daa5bb8d65ef2137eb33bd3a2eb";
+      sha256 = "edb40d7991f5abb116efc91ce5f4fd60cf6d9c2fcc803c129aac4da76f3079ff";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/af/thunderbird-140.12.1esr.tar.xz";
-      locale = "af";
-      arch = "linux-i686";
-      sha256 = "b520b52478ceab0508b3ba28b4ba22b2c2ee3e7e6d683bd30591191af35ebe48";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/ar/thunderbird-140.12.1esr.tar.xz";
-      locale = "ar";
-      arch = "linux-i686";
-      sha256 = "3251114ee3d1d01a51ab60d486c0251020986f87acec3e83ff19102c3d530b8b";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/ast/thunderbird-140.12.1esr.tar.xz";
-      locale = "ast";
-      arch = "linux-i686";
-      sha256 = "eabc7ae14de3b38dc7897b12214ac9a2564deaa3d98ef0893a704c6f5884478d";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/be/thunderbird-140.12.1esr.tar.xz";
-      locale = "be";
-      arch = "linux-i686";
-      sha256 = "0be307dc8bedbedae132ca4a3c72e0437f7b625badf607ab6509eb0cd32129c9";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/bg/thunderbird-140.12.1esr.tar.xz";
-      locale = "bg";
-      arch = "linux-i686";
-      sha256 = "5b9adf440bd069833843b02c00204971397b8a1e39a87b94da28e327d981fce7";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/br/thunderbird-140.12.1esr.tar.xz";
-      locale = "br";
-      arch = "linux-i686";
-      sha256 = "01b47cbc9deb1d16b89b0965bcad20d51c60cc4cf26821264b080d410bca51a3";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/ca/thunderbird-140.12.1esr.tar.xz";
-      locale = "ca";
-      arch = "linux-i686";
-      sha256 = "5badc5fbddda73bfbe828ee095d27cd1c5f49d8787a9e4821fd09c26fd9f8885";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/cak/thunderbird-140.12.1esr.tar.xz";
-      locale = "cak";
-      arch = "linux-i686";
-      sha256 = "4dccbba36bcd3f06e477e6d543e772e69a0635845d26d64f01a06010f858babc";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/cs/thunderbird-140.12.1esr.tar.xz";
-      locale = "cs";
-      arch = "linux-i686";
-      sha256 = "150838ded74553e561087eca0444ae6e9e46896540d91687431b5089ca83c37d";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/cy/thunderbird-140.12.1esr.tar.xz";
-      locale = "cy";
-      arch = "linux-i686";
-      sha256 = "f3e0a6c27e254772ca18c6937391186ce9126c57bec71dc71cd46e9dd9b17687";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/da/thunderbird-140.12.1esr.tar.xz";
-      locale = "da";
-      arch = "linux-i686";
-      sha256 = "f835517b095eb3e64f1cb84f7adce45a1af69d865ad26c563d926e97de3a2b44";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/de/thunderbird-140.12.1esr.tar.xz";
-      locale = "de";
-      arch = "linux-i686";
-      sha256 = "14c624a29ee80726352dca7101d6395e971a10ca9397d5a2b1c20cf106c61e64";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/dsb/thunderbird-140.12.1esr.tar.xz";
-      locale = "dsb";
-      arch = "linux-i686";
-      sha256 = "f9b99a02515378fcac4ce2cd2b65cfb647ef845750362a6d6a3ac61e98eba687";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/el/thunderbird-140.12.1esr.tar.xz";
-      locale = "el";
-      arch = "linux-i686";
-      sha256 = "3ed79ad13c821ad87c66376ce4f9283c19300added87a88d4d8735331ac44c7b";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/en-CA/thunderbird-140.12.1esr.tar.xz";
-      locale = "en-CA";
-      arch = "linux-i686";
-      sha256 = "698015ad0c3ef52a9abf38d20c5f4ab8f434f2450926a06a5c0840115121b4d1";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/en-GB/thunderbird-140.12.1esr.tar.xz";
-      locale = "en-GB";
-      arch = "linux-i686";
-      sha256 = "1ac015e0f4bd8848bb95b6c2201b8167abbfc45421d800348a488ba0f3119edf";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/en-US/thunderbird-140.12.1esr.tar.xz";
-      locale = "en-US";
-      arch = "linux-i686";
-      sha256 = "a21ca02982f3d88b03039b699bba90a77e0a7cbdeddfd51bed5e6a7ac29876e1";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/es-AR/thunderbird-140.12.1esr.tar.xz";
-      locale = "es-AR";
-      arch = "linux-i686";
-      sha256 = "9781223342677c21b3b806df269a911e18954bab50df3829c67bf8d542f38953";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/es-ES/thunderbird-140.12.1esr.tar.xz";
-      locale = "es-ES";
-      arch = "linux-i686";
-      sha256 = "5aa5a3540b03a3ab3a7b7394467ce1985563ba8f51e92c449d5c82a14c3fa3f6";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/es-MX/thunderbird-140.12.1esr.tar.xz";
-      locale = "es-MX";
-      arch = "linux-i686";
-      sha256 = "92b2b8bd6cd999376709cdaf196a76041cd5a26e789fb9b2ffe3e712183555c5";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/et/thunderbird-140.12.1esr.tar.xz";
-      locale = "et";
-      arch = "linux-i686";
-      sha256 = "7886929abd458a1d1b734a205bed81d94993409ced11f031a5a53d546ec8765c";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/eu/thunderbird-140.12.1esr.tar.xz";
-      locale = "eu";
-      arch = "linux-i686";
-      sha256 = "cca8aff9c6273d4145ec746d4b1cbfbca78bde4b663d0afc35ad8fa1b8576b4d";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/fi/thunderbird-140.12.1esr.tar.xz";
-      locale = "fi";
-      arch = "linux-i686";
-      sha256 = "7c1f5997171892e340f92c4de01f3f609b2f6a7c0a5189350823f39e6e7948f3";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/fr/thunderbird-140.12.1esr.tar.xz";
-      locale = "fr";
-      arch = "linux-i686";
-      sha256 = "5cbcd9928838c44896a903d4a42fb06be0ad12175da8c972a40cdaf14ea2a3a9";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/fy-NL/thunderbird-140.12.1esr.tar.xz";
-      locale = "fy-NL";
-      arch = "linux-i686";
-      sha256 = "7b3e22f7974d1a802e2445a04b1138b32560cf84425ae1c4d728dbfe333680d5";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/ga-IE/thunderbird-140.12.1esr.tar.xz";
-      locale = "ga-IE";
-      arch = "linux-i686";
-      sha256 = "87d459dd414167e12f97caa0d927b71e2a234d0ed12707978e1969b5aec03c3d";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/gd/thunderbird-140.12.1esr.tar.xz";
-      locale = "gd";
-      arch = "linux-i686";
-      sha256 = "83c6e9c09917d70484b86dc4b318449f5e92677e93266792ad72a4681fe4e206";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/gl/thunderbird-140.12.1esr.tar.xz";
-      locale = "gl";
-      arch = "linux-i686";
-      sha256 = "f64dd91c64096cc6e06a455f952e41577511522caa939f08cce80d206a15508f";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/he/thunderbird-140.12.1esr.tar.xz";
-      locale = "he";
-      arch = "linux-i686";
-      sha256 = "146089027ae517144c2f51576b1802f6a13f6fd9a58f451d61d09c70ec63429c";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/hr/thunderbird-140.12.1esr.tar.xz";
-      locale = "hr";
-      arch = "linux-i686";
-      sha256 = "a4ebb133d33be440bbafc4f3b87e0c5bc30c53834b8e990edcdf49766bfeb99a";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/hsb/thunderbird-140.12.1esr.tar.xz";
-      locale = "hsb";
-      arch = "linux-i686";
-      sha256 = "ad15e52932683f5408eea7749abd3745787b1d603afd283c8b380bcf5a313e4e";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/hu/thunderbird-140.12.1esr.tar.xz";
-      locale = "hu";
-      arch = "linux-i686";
-      sha256 = "562f1b5e58b7912b2c72a9dc72e14d4bf13f702a3aadae3a72cf697e9ee2eb19";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/hy-AM/thunderbird-140.12.1esr.tar.xz";
-      locale = "hy-AM";
-      arch = "linux-i686";
-      sha256 = "0dc244101322a521e28598fad1cbd93ebdd0d2165a1d7fe126fc293b9c95ad92";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/id/thunderbird-140.12.1esr.tar.xz";
-      locale = "id";
-      arch = "linux-i686";
-      sha256 = "f6494040521b1aff5aa3be06167856a0d8ce699e6cb37a892cdfaa0070da4419";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/is/thunderbird-140.12.1esr.tar.xz";
-      locale = "is";
-      arch = "linux-i686";
-      sha256 = "e1597ef6a1313ee50f09f6fdd049c6f360d029c08ef23ce8b29925d82402365a";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/it/thunderbird-140.12.1esr.tar.xz";
-      locale = "it";
-      arch = "linux-i686";
-      sha256 = "8e98a32d07b24259d51b3bf3752f3b85848403b1f59c57f51536330d0567471f";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/ja/thunderbird-140.12.1esr.tar.xz";
-      locale = "ja";
-      arch = "linux-i686";
-      sha256 = "ef83364088cee448f1a4e3b24661a78f615f51e8dad920b483e3234d4cd8f1b4";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/ka/thunderbird-140.12.1esr.tar.xz";
-      locale = "ka";
-      arch = "linux-i686";
-      sha256 = "3be9730bf6abe81eccb7d830b535ec5148b53cf2c1263aa400a2d2ecabcf7b38";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/kab/thunderbird-140.12.1esr.tar.xz";
-      locale = "kab";
-      arch = "linux-i686";
-      sha256 = "84c9602022538c9dd109b70ef61041fe7418b772c35639f0bfb0fba8467c17b0";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/kk/thunderbird-140.12.1esr.tar.xz";
-      locale = "kk";
-      arch = "linux-i686";
-      sha256 = "888ed5bbe5e873bdd12b0688d5c3be8f4121dc4fdd8021e91e18512fd6ae597c";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/ko/thunderbird-140.12.1esr.tar.xz";
-      locale = "ko";
-      arch = "linux-i686";
-      sha256 = "11016f84ca55fdf8ba66895ec43c5c7c4ce45d36c1c8d877cf36a579c2a94e73";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/lt/thunderbird-140.12.1esr.tar.xz";
-      locale = "lt";
-      arch = "linux-i686";
-      sha256 = "95a570c146e17c523d30194740f94a08cda05ba63d653865269af90bc953b89d";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/lv/thunderbird-140.12.1esr.tar.xz";
-      locale = "lv";
-      arch = "linux-i686";
-      sha256 = "629ae06a9940b3bab1163ade2329adc3126ea41f4bfa1312e1e36786ce87e0a2";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/ms/thunderbird-140.12.1esr.tar.xz";
-      locale = "ms";
-      arch = "linux-i686";
-      sha256 = "1f692dbe750aaf4f05f95632352bc67c6da69488b632ef89641f74829af1c173";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/nb-NO/thunderbird-140.12.1esr.tar.xz";
-      locale = "nb-NO";
-      arch = "linux-i686";
-      sha256 = "a481cbbc9888681e9b49c121b2ca94300fd427665b976b0ae124b6dbbb4d8987";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/nl/thunderbird-140.12.1esr.tar.xz";
-      locale = "nl";
-      arch = "linux-i686";
-      sha256 = "a04d5ee21a69490b5ec0529704ec4f4f7db301f4a66bd15083ac945cbd549dfd";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/nn-NO/thunderbird-140.12.1esr.tar.xz";
-      locale = "nn-NO";
-      arch = "linux-i686";
-      sha256 = "df72af0af915afb82253c85de7984ef29574b44cd179cd23f54ac59558768542";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/pa-IN/thunderbird-140.12.1esr.tar.xz";
-      locale = "pa-IN";
-      arch = "linux-i686";
-      sha256 = "5a15e3a2362e53f3e9e1bf1ac9383e3bc120d5348894f8c6383af684345e2da1";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/pl/thunderbird-140.12.1esr.tar.xz";
-      locale = "pl";
-      arch = "linux-i686";
-      sha256 = "e4bda61c36cf9427f8086c6c84199c0599bac72008982a4ac2da89a26cffe8c6";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/pt-BR/thunderbird-140.12.1esr.tar.xz";
-      locale = "pt-BR";
-      arch = "linux-i686";
-      sha256 = "55ae0e5c95927befdf768469648dd1e60cbabc6fee17b19726e249a491dd43db";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/pt-PT/thunderbird-140.12.1esr.tar.xz";
-      locale = "pt-PT";
-      arch = "linux-i686";
-      sha256 = "e7c26ade8ecc4b3e6917cb795f68945066feaa0079d5ccf0d50ce1edb770b5a9";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/rm/thunderbird-140.12.1esr.tar.xz";
-      locale = "rm";
-      arch = "linux-i686";
-      sha256 = "c77e809f87f7d13a3567952673f2d0b4c37dbac7cb95212500c693847cd6b41a";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/ro/thunderbird-140.12.1esr.tar.xz";
-      locale = "ro";
-      arch = "linux-i686";
-      sha256 = "c6062ca4e6626dc448e47362a5ed29de48e1d2ebb439d77d28d9478a2c0b4949";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/ru/thunderbird-140.12.1esr.tar.xz";
-      locale = "ru";
-      arch = "linux-i686";
-      sha256 = "91c801faf58e6fc5794ca084b70bda15fa504d7b23b8a2b7a8db7bf75275ce65";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/sk/thunderbird-140.12.1esr.tar.xz";
-      locale = "sk";
-      arch = "linux-i686";
-      sha256 = "72b93a682e47e2e246890ea6971ddc46ee586153549d70cc66b7f603a82c3227";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/sl/thunderbird-140.12.1esr.tar.xz";
-      locale = "sl";
-      arch = "linux-i686";
-      sha256 = "4f442bd3a070de0a640527aa077ce480c1b18f16353425baf7efd179d19425c2";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/sq/thunderbird-140.12.1esr.tar.xz";
-      locale = "sq";
-      arch = "linux-i686";
-      sha256 = "23fde29af4fbba7e20a01923b1abe259d296a74871a4ef370c0624a4a28f3a0f";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/sr/thunderbird-140.12.1esr.tar.xz";
-      locale = "sr";
-      arch = "linux-i686";
-      sha256 = "445c0654200decad0fdaf7612d9d24c20de827e19054bc619cb5cb65a28b06b8";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/sv-SE/thunderbird-140.12.1esr.tar.xz";
-      locale = "sv-SE";
-      arch = "linux-i686";
-      sha256 = "04c8955cbd2cf75e2ec0d95abcd594e5a4de5a43f5387e4f37079254c3f61335";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/th/thunderbird-140.12.1esr.tar.xz";
-      locale = "th";
-      arch = "linux-i686";
-      sha256 = "c63fda92f76c6c4c921adfbf06822297665c981cd501b29ec332eb5794816942";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/tr/thunderbird-140.12.1esr.tar.xz";
-      locale = "tr";
-      arch = "linux-i686";
-      sha256 = "d4adaf76dfd82ce79ce77fff7b039471f5d308228efa7bddcc13b37f9b680060";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/uk/thunderbird-140.12.1esr.tar.xz";
-      locale = "uk";
-      arch = "linux-i686";
-      sha256 = "280cd0d5a55af237fab2f2682a006b7f1e988fdaf02b9a44cda96f55658b6229";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/uz/thunderbird-140.12.1esr.tar.xz";
-      locale = "uz";
-      arch = "linux-i686";
-      sha256 = "492146aa92ced6882a6a55a4780c28f88bae944fa074a3aa1a5859cfd9fa58ec";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/vi/thunderbird-140.12.1esr.tar.xz";
-      locale = "vi";
-      arch = "linux-i686";
-      sha256 = "9236344e5284f7fa5b04daef9d2dc0ba09ce21498aa4f2b8ecf35957f23d068f";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/zh-CN/thunderbird-140.12.1esr.tar.xz";
-      locale = "zh-CN";
-      arch = "linux-i686";
-      sha256 = "9cb9de006d389c13fd00fb0cf9df69139ff18c0b4ece994a2d4b0072f29ea770";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/linux-i686/zh-TW/thunderbird-140.12.1esr.tar.xz";
-      locale = "zh-TW";
-      arch = "linux-i686";
-      sha256 = "92456256948e38efdde5ea801d0c373f0592707d1bb1178b2f1adbb60ae64213";
-    }
-    {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/af/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/af/Thunderbird%20153.0.1esr.dmg";
       locale = "af";
       arch = "mac";
-      sha256 = "0fef87105a73ba05dfdf6be92d472d4d5c982481506697a7d2a0add172842a8d";
+      sha256 = "549a5597a8025a61b2416f685a0a4cd5df70c189b712b532bb882057e2a2f64f";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/ar/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/ar/Thunderbird%20153.0.1esr.dmg";
       locale = "ar";
       arch = "mac";
-      sha256 = "28f6c9eab299bc3694d2ef7ae6138889fdae6ed7b7de78c6a9aada87fe4f38a6";
+      sha256 = "7428806d51f8de57f2639dd47f6651ce07eee899499045b9fb3174d1e4a36ca5";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/ast/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/ast/Thunderbird%20153.0.1esr.dmg";
       locale = "ast";
       arch = "mac";
-      sha256 = "63869bd4c720fd47ef289b217c5db2bce68518efe0f8345d1e3a44df51e8bc17";
+      sha256 = "3240ab85e8c6fa1b08f64264f79443e6d7bb1a94821635cb812dbf0a85facb0f";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/be/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/be/Thunderbird%20153.0.1esr.dmg";
       locale = "be";
       arch = "mac";
-      sha256 = "a5bcf4f3fee19b0b6c841669a83476759b75c0c7084fd01c0f2c45f84310a566";
+      sha256 = "1ff12040b0ddf14b7f1841c68a75ea0c8c0c28c380cb72911694bafbb603882a";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/bg/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/bg/Thunderbird%20153.0.1esr.dmg";
       locale = "bg";
       arch = "mac";
-      sha256 = "4b211c162a1ec29de5ad8d106c0a629600113c778491126c5897aad5228b0eff";
+      sha256 = "891be572593281f8b184217509f613c814de946900d1ff94ec23a3effeb9682c";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/br/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/br/Thunderbird%20153.0.1esr.dmg";
       locale = "br";
       arch = "mac";
-      sha256 = "65985864e75f7d8d994070c8708d4ef8dfd3a00cd6dbd977a4fa30cad7e1cb57";
+      sha256 = "69b8a5facb9aa9ae850653f346ccf2904463120e4708fa41c50a39827d6d395d";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/ca/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/ca/Thunderbird%20153.0.1esr.dmg";
       locale = "ca";
       arch = "mac";
-      sha256 = "bebe335a26e384ee788885bb8b737b68b4fb8d6edad0c165425d9609079bca41";
+      sha256 = "ab2359f70e651c0c1b4d064c2ccc6da10abae426f107d1038612d5708dd9c4f9";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/cak/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/cak/Thunderbird%20153.0.1esr.dmg";
       locale = "cak";
       arch = "mac";
-      sha256 = "e94d4fe036361140e747c46ce55166603356f5d46bac4746e14a9363c1519f2f";
+      sha256 = "37214ff560dfca37c2741998004c519cad4df08e93b4915898ef62027f5994a1";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/cs/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/cs/Thunderbird%20153.0.1esr.dmg";
       locale = "cs";
       arch = "mac";
-      sha256 = "248cdafa7e62f4b49f914bdc6b5ee69643b754f68d86cd88018d7618e47d70b8";
+      sha256 = "89e107e0d7f389c63417c03531f90ad3154878384bdd2c1268ce0be16b35dbec";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/cy/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/cy/Thunderbird%20153.0.1esr.dmg";
       locale = "cy";
       arch = "mac";
-      sha256 = "dea95b3c3658ca476f48add5c9bcf89cee784d8076bfd951364168c519b8a7a7";
+      sha256 = "0b08c74675e0bafadec6a9ea3580d306e4e0d12d01d7cfcb3e7a49fa394c53c7";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/da/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/da/Thunderbird%20153.0.1esr.dmg";
       locale = "da";
       arch = "mac";
-      sha256 = "976a52ff8776cd75a90a8e3b3ac00026c96ba041f4e76a5de889d010851d4261";
+      sha256 = "8ad5bfe50edf56877a26f94676b7d562afb2236ad322cc4498bdda30a68d8c38";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/de/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/de/Thunderbird%20153.0.1esr.dmg";
       locale = "de";
       arch = "mac";
-      sha256 = "6fcb167da688ba52bce4477c62c8fe07c67f14718fadcd3719fd49bff63f8c80";
+      sha256 = "2ad3b84a0d3209cb0cba79e55f81eabd72b326e19a80350186b5eea2296e7a40";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/dsb/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/dsb/Thunderbird%20153.0.1esr.dmg";
       locale = "dsb";
       arch = "mac";
-      sha256 = "f3ac9ff7d9d24ffd6b267adda98af7944ad259a40600c4bd02d77097c551373e";
+      sha256 = "f50a54410a80eca47b2e1dd0f610aa04a40d38e12ec1d13bf2a5bc9a0b0905a3";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/el/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/el/Thunderbird%20153.0.1esr.dmg";
       locale = "el";
       arch = "mac";
-      sha256 = "481796c07b5d469746f9833e0cd5e8e3bfe1cf91216d6e4809b3e3d976f6a942";
+      sha256 = "93c7f61021510a986ae4a062280002ab41e73c5d0ead4e9521f38bb8e2635e1a";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/en-CA/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/en-CA/Thunderbird%20153.0.1esr.dmg";
       locale = "en-CA";
       arch = "mac";
-      sha256 = "6f004764e0139d8ff51ac098d572c5a68351d144d203fa68b797490daa72c9cc";
+      sha256 = "9af58b7072a95d33ed0ad0b004c743d1fcec52cd52cf6e108c1759937070f36c";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/en-GB/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/en-GB/Thunderbird%20153.0.1esr.dmg";
       locale = "en-GB";
       arch = "mac";
-      sha256 = "a814bbb9e61deeb5395b11c1dba1f7202dfd4813319f5011d8f99bcd203c941e";
+      sha256 = "35458235b5383fa83778600276edae699b3fe89e290bd8db3fdf8b8dfaa2912e";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/en-US/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/en-US/Thunderbird%20153.0.1esr.dmg";
       locale = "en-US";
       arch = "mac";
-      sha256 = "a7545590281d0d75bfcf107c5b281e45b5a09d64229ebfce33592c423b581006";
+      sha256 = "56773d41a4ccdea3a489b5bbcdbfe2251b09fc8813a5b1e54c4bd24e90f46a4a";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/es-AR/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/es-AR/Thunderbird%20153.0.1esr.dmg";
       locale = "es-AR";
       arch = "mac";
-      sha256 = "0c36eeff28151332752f6144bba01d9dc5955fa31776824080b920cf474880d7";
+      sha256 = "a975333433bc1ebf73d4ab5913931343f9ce850b66ff74e496293624147471a2";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/es-ES/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/es-ES/Thunderbird%20153.0.1esr.dmg";
       locale = "es-ES";
       arch = "mac";
-      sha256 = "f4d7bde33c2502435d4e9ab95fc82ce9b1a46f17697bb14b7fd64f51d1fd3d11";
+      sha256 = "2d2a43bcfba7bd493e42e73efb7ca3c3f1659a65106082845542eec686eca5c4";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/es-MX/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/es-MX/Thunderbird%20153.0.1esr.dmg";
       locale = "es-MX";
       arch = "mac";
-      sha256 = "8b7d7252754f16e811e9ef1fc9aae774eb37ef1442dd9676ec8b4e70abd3f39f";
+      sha256 = "0f31f9aeb79f89295e6b8171be6fec58f9b8d97c7182836e2ba6734e12930d80";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/et/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/et/Thunderbird%20153.0.1esr.dmg";
       locale = "et";
       arch = "mac";
-      sha256 = "b330eb3fe10cd519f80676baa6936697efb9b9d095f7a166180cc36e6d7ee949";
+      sha256 = "b5a76c452737e22d61da7de348a0ca758a5dedc9529cd7b5359d2230ded58958";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/eu/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/eu/Thunderbird%20153.0.1esr.dmg";
       locale = "eu";
       arch = "mac";
-      sha256 = "cfb69e8ebce5203178f0bb3a900849dff0f0444d72a16458b68c2e465f7c1217";
+      sha256 = "7b29e18b0e41e4b773d99d937052a730c4b69e83a471d42c5cbb8fcc8d436b3a";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/fi/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/fi/Thunderbird%20153.0.1esr.dmg";
       locale = "fi";
       arch = "mac";
-      sha256 = "2dacdc3c560f643d7fc967f306f53a872a7cc7558f2a3073ca85ff19a71bd347";
+      sha256 = "de6206d8651a36a60cabb1d7b78965089dcd4b7db90d8cad4d5ba28cdf7ac771";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/fr/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/fr/Thunderbird%20153.0.1esr.dmg";
       locale = "fr";
       arch = "mac";
-      sha256 = "3d5369d321de23abeb62ad1993342d6d6d71f2da56d0d2ab98011c46ac884876";
+      sha256 = "afd0f310a5d14e64bf1da2a1cc4b39a241ad5100c1d225c4e3cff5f2cf252e65";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/fy-NL/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/fy-NL/Thunderbird%20153.0.1esr.dmg";
       locale = "fy-NL";
       arch = "mac";
-      sha256 = "020f9670a519155d05e772a20eaf35ef4aca8075cacd19873f1be23c84d49eaa";
+      sha256 = "3ef0b39ec84d648f08a05029c17bf76f8c4f7fe44c596bb3e3342b5e7f8963b6";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/ga-IE/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/ga-IE/Thunderbird%20153.0.1esr.dmg";
       locale = "ga-IE";
       arch = "mac";
-      sha256 = "d7724a80711c879d559c167088fe41aa1e6531ea38757d1aaae4fe3d043b2796";
+      sha256 = "dbb3a77479c959d4f135ab988bb2c89362617febf6cc786d978dbff54aec6ebe";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/gd/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/gd/Thunderbird%20153.0.1esr.dmg";
       locale = "gd";
       arch = "mac";
-      sha256 = "b6022adc6fc36979a66f8d74bd6e0476673882d6ac60ef0b22d2e59cefffefb3";
+      sha256 = "96e621d1c07918fd27544c60ee383cd48ddad4e2e5b768f5499d65bc2026779c";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/gl/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/gl/Thunderbird%20153.0.1esr.dmg";
       locale = "gl";
       arch = "mac";
-      sha256 = "9b9878870596d85f78d511e37d4df4cf504bc61f1dcd5cf184989401b525f9a6";
+      sha256 = "201d26707ab952c31a969da76b21af1495f83aa430bb707690d831dee37b9545";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/he/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/he/Thunderbird%20153.0.1esr.dmg";
       locale = "he";
       arch = "mac";
-      sha256 = "f83d4794e193d00d14bc41b27e955372b9a2af3d6172520ea34433a0a0d20372";
+      sha256 = "ba59ca920123adfc42580fd53622b5a7221d4b46bf763931e939a49d1ba67dca";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/hr/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/hr/Thunderbird%20153.0.1esr.dmg";
       locale = "hr";
       arch = "mac";
-      sha256 = "8ccaffcfe95a610c00760bb4998be5ad8024bf2805f06d4bcd029ddfccaac0f9";
+      sha256 = "46ddc1459c9bdd3f70c270314a9d540bae94585403b267ab5f3bb341fb90f490";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/hsb/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/hsb/Thunderbird%20153.0.1esr.dmg";
       locale = "hsb";
       arch = "mac";
-      sha256 = "69bd5f6eaa17c39817680fd9813043a383b564715bcbfdf85342f27d684de10e";
+      sha256 = "c01e306f751826fd17d162c2e197f0d06098e8472a071ba032df90121cf54968";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/hu/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/hu/Thunderbird%20153.0.1esr.dmg";
       locale = "hu";
       arch = "mac";
-      sha256 = "406c258b687c966f1c9bf0d28ff5a47f7cf2716fb20d99a88b512da12b6fc2a7";
+      sha256 = "4d550c5d2c461e5882b943dcb333ea8279a8b33f3a348dd7948f5d20a4c542e2";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/hy-AM/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/hy-AM/Thunderbird%20153.0.1esr.dmg";
       locale = "hy-AM";
       arch = "mac";
-      sha256 = "182d1415b28855c5524aa6cab0fbd59d5bcb29f0464f5f06b70fff042e0256bd";
+      sha256 = "b02662feb1e8dd6ddb3390933f1e1aa141e584c12736546389e3e92a21fa460d";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/id/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/id/Thunderbird%20153.0.1esr.dmg";
       locale = "id";
       arch = "mac";
-      sha256 = "94f5a03cffe7cb69d998fac6a24a448ea60b1fd22e75cd085eebb6abcf674916";
+      sha256 = "80d72d91005dce1ea10f48cfc94f6533facfc4bd34999906c49e02e2faf734bb";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/is/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/is/Thunderbird%20153.0.1esr.dmg";
       locale = "is";
       arch = "mac";
-      sha256 = "a6d3624410ac4186f669f7b7115b180ae547fd4c94b508e2cf78b655167fd4dc";
+      sha256 = "da0e30379923a6279855387c46c4553b3ce065a3c537d80a2b73869bd69cdecf";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/it/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/it/Thunderbird%20153.0.1esr.dmg";
       locale = "it";
       arch = "mac";
-      sha256 = "592e9b1bf6ccaf7aa7c380e494910b95dd3975c06b9c069e41b319d744fb5184";
+      sha256 = "7a7fd8403d9b032f8be604464a7eeb0c0b8708be8f6c6192cd478be4c4da2164";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/ja-JP-mac/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/ja-JP-mac/Thunderbird%20153.0.1esr.dmg";
       locale = "ja-JP-mac";
       arch = "mac";
-      sha256 = "fbe32356a00e8d5feb31387bce6e8345d9cfbf4e598646496fa84e0616717e4a";
+      sha256 = "08918f2819bd4de3a99287169729dbd157bb05e1a54538c5c7c3e7e4ba45988d";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/ka/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/ka/Thunderbird%20153.0.1esr.dmg";
       locale = "ka";
       arch = "mac";
-      sha256 = "260e84ba60f95110adef65b12e8e4f3af0b119e3d56c4610fea9f5015158e5d7";
+      sha256 = "1606ea3e455498167d4e8e45833d757d06643ff21d8f4e34004486bdf550f1ce";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/kab/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/kab/Thunderbird%20153.0.1esr.dmg";
       locale = "kab";
       arch = "mac";
-      sha256 = "fb4fd0e9652a1417b415d4df450e670753f915a05b32de6418e64e61cfd9a84f";
+      sha256 = "65012a2df74c31bd5dfbb58635a8479a3b88352df36e769e1e0ee167ecf90158";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/kk/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/kk/Thunderbird%20153.0.1esr.dmg";
       locale = "kk";
       arch = "mac";
-      sha256 = "41f4d663cc28831c7f33d364e18bc50ea4895dd1edbb4e71750ca42c5554f546";
+      sha256 = "d72ce90f64a82dabe72b3273607aead6d9e8a14e10dd002164a200589ef8c69c";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/ko/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/ko/Thunderbird%20153.0.1esr.dmg";
       locale = "ko";
       arch = "mac";
-      sha256 = "8788bf49e1d6b94dfd582510fabfb6db11f3d7b1d70a41f3116600f6f7244fe4";
+      sha256 = "1e07ff089ae037287ac075433d76da8ce4ac5974a2fb368b6398f5705aed8222";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/lt/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/lt/Thunderbird%20153.0.1esr.dmg";
       locale = "lt";
       arch = "mac";
-      sha256 = "d3202d63ae54f07a911d8d96bdb3a6cca4c798b31e6478a4d7be39246a614fee";
+      sha256 = "1d386090853a3092da9352cd0c6768c6c845b70cd242ecbe56be630ba2d36751";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/lv/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/lv/Thunderbird%20153.0.1esr.dmg";
       locale = "lv";
       arch = "mac";
-      sha256 = "89947413ee7e30f81d794aedd4f553fc84d25ed52556b48daa93b959cd2d4d80";
+      sha256 = "99e272ea04306b1527b063f17f8c659e89a24145b6cbbf576de5f8a11f2e57b2";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/ms/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/ms/Thunderbird%20153.0.1esr.dmg";
       locale = "ms";
       arch = "mac";
-      sha256 = "d9fb626dd801eb542717767276fa8ab50615134d3c8fa6a6249a97a8b0a4d530";
+      sha256 = "e1d4085a92be62866c5bdc694b603845ee2f3ebbb683c5f5a5e46c44b5a60835";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/nb-NO/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/nb-NO/Thunderbird%20153.0.1esr.dmg";
       locale = "nb-NO";
       arch = "mac";
-      sha256 = "361a10aeb578c2d00b4af934890b9d19fa6673308a3d8373d567944849980a27";
+      sha256 = "e354e72817b83588be11c2d7bfad8a4d4907ea1b6beea5c55bbe13e942939ff8";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/nl/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/nl/Thunderbird%20153.0.1esr.dmg";
       locale = "nl";
       arch = "mac";
-      sha256 = "bae2ec71f7164d27bf51895026f61c5bfc5726e841df2407164b96ac6aa9d6ee";
+      sha256 = "a8af603810428f968eb19b9e8c3e65ab77d7ac308daa2540798d878a1a7670d8";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/nn-NO/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/nn-NO/Thunderbird%20153.0.1esr.dmg";
       locale = "nn-NO";
       arch = "mac";
-      sha256 = "ad720bc0279ebe05dae45b4504fe3b59a5cb26cade9fb0552e7563b92424c9ae";
+      sha256 = "9942008e688eefeef674355865eb54d146ae7131adf55bcaeb478908a0bfa4fc";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/pa-IN/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/pa-IN/Thunderbird%20153.0.1esr.dmg";
       locale = "pa-IN";
       arch = "mac";
-      sha256 = "4864c13e90c6002412f52a4ad4edf68f34ea595bfbdf73ae58d84445d243805e";
+      sha256 = "5076d32671135252f4b14cde05bed3803727019478d1f5f2a3ba6fcc38b6fc16";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/pl/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/pl/Thunderbird%20153.0.1esr.dmg";
       locale = "pl";
       arch = "mac";
-      sha256 = "5132c04421c86392a2b20f92a25c0f40760b106cededa99a32779b1376b2f3aa";
+      sha256 = "67f3d0da068d3fc6ca3543502ff8af4dc081c8bf7012262dcdc24673e7524fb7";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/pt-BR/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/pt-BR/Thunderbird%20153.0.1esr.dmg";
       locale = "pt-BR";
       arch = "mac";
-      sha256 = "044b80f53e19945a95905cb14397038cb9031c8e87cd0c821f289cd72d94c6c7";
+      sha256 = "e251fd4a50940cfbc62bfe9ac948910020c11c92c9fc7891c631e059f7da367f";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/pt-PT/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/pt-PT/Thunderbird%20153.0.1esr.dmg";
       locale = "pt-PT";
       arch = "mac";
-      sha256 = "98898d9bef060de7f1d015ba41cb6d18970c621c6164ac2eae2fed5a1f5d0339";
+      sha256 = "b48ad6bb09f8e0dc38d7bf3a6d33a63f83bf101b9de6c8ab33268ba34bebb8bb";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/rm/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/rm/Thunderbird%20153.0.1esr.dmg";
       locale = "rm";
       arch = "mac";
-      sha256 = "3f36fee7c1133c5b0e88c9653a1a1e4c6885dbd3e08656571ab11522092b443f";
+      sha256 = "8243f3d92ec6f39dc3ee58acc9729e1d6b3481ceeb8c40383a95ac0cd6eae370";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/ro/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/ro/Thunderbird%20153.0.1esr.dmg";
       locale = "ro";
       arch = "mac";
-      sha256 = "7a92082eea4fd402b6268f9afd0edd1e628538a934c0043128622282ad4e2acd";
+      sha256 = "31f0aad850f1442f308f179cc1cd7a0e82659b7f3057d0d1e63edf9499e2e251";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/ru/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/ru/Thunderbird%20153.0.1esr.dmg";
       locale = "ru";
       arch = "mac";
-      sha256 = "23e1ca559b2b38d001704b5e4a412186a09f822c1f6da7e05f6c809ca79f908f";
+      sha256 = "6e011940c252971f26d34e0f5c0e2156b198ea956d08210d900b09b78e1188a8";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/sk/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/sk/Thunderbird%20153.0.1esr.dmg";
       locale = "sk";
       arch = "mac";
-      sha256 = "e22c2f92dd219666bb93279cd99b3c488e6a5ccc090b6c5f9a5d5dc53d0e8d7c";
+      sha256 = "d525ff0cd9508a3fd1bae097ec6a2a155caef436899234b62cde59d37523a360";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/sl/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/sl/Thunderbird%20153.0.1esr.dmg";
       locale = "sl";
       arch = "mac";
-      sha256 = "7229fdbe391154c0a5d2282f61c3e11d7fc226230a13552b4d4df1cb25cbc0e3";
+      sha256 = "360aa1caf8a72897301fe45845bccd7f50a5f68621b519d29ab4b82cbe847a46";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/sq/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/sq/Thunderbird%20153.0.1esr.dmg";
       locale = "sq";
       arch = "mac";
-      sha256 = "4fd15f38178e96fad7192587e557165bcafbe6b303ee0a5b46c48357e92348f3";
+      sha256 = "dc18ea14c87f4b2141fc1efe650d658c11df432a2e3097e2b866a815a717f5a3";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/sr/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/sr/Thunderbird%20153.0.1esr.dmg";
       locale = "sr";
       arch = "mac";
-      sha256 = "c7ae5528e9dc77069eccf1194273c1e47f784884a0c463e10b20c2bec4f2d614";
+      sha256 = "64de5c202a20dc5648c8b89c23c585e4c1b05d81e8f5271ab114c192a30aec08";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/sv-SE/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/sv-SE/Thunderbird%20153.0.1esr.dmg";
       locale = "sv-SE";
       arch = "mac";
-      sha256 = "deb300d744da7c1ab6a64993b1f468ff6b9be32e8911569631b623a037208420";
+      sha256 = "43f172130773f6312f31afa36c2346f757c5d21f423f98fd8d009291e5d6d343";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/th/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/th/Thunderbird%20153.0.1esr.dmg";
       locale = "th";
       arch = "mac";
-      sha256 = "7554039b6255191f1c270dd5c3d9582cc9d0c2c4d904adf1260da99b6d6e413e";
+      sha256 = "7c7432759d49ae93a91b7a49e25c0b942f835fc1a668ad11c5ab36f3112cd5c6";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/tr/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/tr/Thunderbird%20153.0.1esr.dmg";
       locale = "tr";
       arch = "mac";
-      sha256 = "18fa954a199e7b6d4520741f09e7549f33a0cd96111f8cc4228eb79a634af116";
+      sha256 = "9c4bc42f5bff5ad8364b1c036e0e4fed1ba65b09e1454f768b8ab96ae28d659b";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/uk/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/uk/Thunderbird%20153.0.1esr.dmg";
       locale = "uk";
       arch = "mac";
-      sha256 = "ce9fe5b139dc104f300e834eca6d091832af90152537ff11729353e1314d05fb";
+      sha256 = "f2237a4a33109033af9a1f9cd1a1c06369641e486d59e09b98c274e0f7406446";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/uz/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/uz/Thunderbird%20153.0.1esr.dmg";
       locale = "uz";
       arch = "mac";
-      sha256 = "1417676c77fff78b411e532eddb17fc22f7c2eb92fa3a996de9135bdca4cd30b";
+      sha256 = "f72b86b3afe3f556d2b61c8f6f0624bd6752955bc938b50bb50eb011b434da4e";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/vi/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/vi/Thunderbird%20153.0.1esr.dmg";
       locale = "vi";
       arch = "mac";
-      sha256 = "b2711b07f3db0980744c4576e95d5ad10846710e95dd1b75352eafc2b1052491";
+      sha256 = "2df54f057ed1999b3f829df99d62dfe96333445a7595642b15409d2c6aa28510";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/zh-CN/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/zh-CN/Thunderbird%20153.0.1esr.dmg";
       locale = "zh-CN";
       arch = "mac";
-      sha256 = "a29458425d6fc8bd85307629ebcb841fa38d8e47a8dc419c38db1ad047663493";
+      sha256 = "fcbb1160f7be5e5d589e16372fa08070636091ea0b64dc4155e0a05d042c7b3e";
     }
     {
-      url = "https://archive.mozilla.org/pub/thunderbird/releases/140.12.1esr/mac/zh-TW/Thunderbird%20140.12.1esr.dmg";
+      url = "https://archive.mozilla.org/pub/thunderbird/releases/153.0.1esr/mac/zh-TW/Thunderbird%20153.0.1esr.dmg";
       locale = "zh-TW";
       arch = "mac";
-      sha256 = "10154c8457e2e1fb74355485b8d9afd251d134a7c189fca2886564b223683a1b";
+      sha256 = "50614bd2cb852ac97a9515472cb36bde9879ea69b70844a65996844741a109a7";
     }
   ];
 }

From 5db6978ee28c1c5696fef0a1a3f45ec2b8a28a6b Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Tue, 28 Jul 2026 23:08:59 -0400
Subject: [PATCH 15/57] warpgate: add updateScript

(cherry picked from commit 9bd53b9b2cfa61d641af07671053c1ade78de4f8)
---
 pkgs/by-name/wa/warpgate/package.nix | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/wa/warpgate/package.nix b/pkgs/by-name/wa/warpgate/package.nix
index d16ef319149d..a6d9608cdd83 100644
--- a/pkgs/by-name/wa/warpgate/package.nix
+++ b/pkgs/by-name/wa/warpgate/package.nix
@@ -7,6 +7,7 @@
   buildNpmPackage,
   openapi-generator-cli,
   nixosTests,
+  nix-update-script,
 }:
 rustPlatform.buildRustPackage (
   finalAttrs:
@@ -67,8 +68,14 @@ rustPlatform.buildRustPackage (
     # skip check, project included tests require python stuff and docker
     doCheck = false;
 
-    passthru.tests = {
-      inherit (nixosTests) warpgate;
+    passthru = {
+      inherit warpgate-web;
+      tests = {
+        inherit (nixosTests) warpgate;
+      };
+      updateScript = nix-update-script {
+        extraArgs = [ "--subpackage=warpgate-web" ];
+      };
     };
 
     meta = {

From cb6cf43fc7841c9962239eb2e3a5462e84f93ba3 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Tue, 28 Jul 2026 23:25:38 -0400
Subject: [PATCH 16/57] warpgate: 0.23.4 -> 0.26.1

Major changes:
https://github.com/warp-tech/warpgate/releases/tag/v0.24.0
https://github.com/warp-tech/warpgate/releases/tag/v0.25.0
https://github.com/warp-tech/warpgate/releases/tag/v0.26.0

Security releases:
https://github.com/warp-tech/warpgate/releases/tag/v0.25.5
https://github.com/warp-tech/warpgate/releases/tag/v0.25.6

(cherry picked from commit 2bf96755ad2b847656b84002b560b6577501c52a)
---
 .../wa/warpgate/hardcode-version.patch        | 10 +++++++--
 pkgs/by-name/wa/warpgate/package.nix          |  8 +++----
 .../warpgate/remove-nightly-rustflags.patch   | 21 ++++++++++++-------
 3 files changed, 25 insertions(+), 14 deletions(-)

diff --git a/pkgs/by-name/wa/warpgate/hardcode-version.patch b/pkgs/by-name/wa/warpgate/hardcode-version.patch
index 8adadc7971dc..359c7bd04c10 100644
--- a/pkgs/by-name/wa/warpgate/hardcode-version.patch
+++ b/pkgs/by-name/wa/warpgate/hardcode-version.patch
@@ -2,12 +2,18 @@ diff --git a/warpgate-common/src/version.rs b/warpgate-common/src/version.rs
 index 0e7985a..62c2b67 100644
 --- a/warpgate-common/src/version.rs
 +++ b/warpgate-common/src/version.rs
-@@ -1,8 +1,3 @@
+@@ -1,14 +1,3 @@
 -use git_version::git_version;
 -
  pub const fn warpgate_version() -> &'static str {
 -    git_version!(
--        args = ["--tags", "--always", "--dirty=-modified"],
+-        args = [
+-            "--tags",
+-            "--always",
+-            "--dirty=-modified",
+-            "--match",
+-            "v[0-9]*"
+-        ],
 -        fallback = "unknown"
 -    )
 +    "v@version@"
diff --git a/pkgs/by-name/wa/warpgate/package.nix b/pkgs/by-name/wa/warpgate/package.nix
index a6d9608cdd83..c4b7f235f543 100644
--- a/pkgs/by-name/wa/warpgate/package.nix
+++ b/pkgs/by-name/wa/warpgate/package.nix
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage (
 
       patches = [ ./web-ui-package-json.patch ];
 
-      npmDepsHash = "sha256-JW3nibMIETj5PQcaNRS5UVZgguSvGd9Bw8uGD3kb5uM=";
+      npmDepsHash = "sha256-McQI5EmTfrbdcWnYRsoRHjhZphrZVaV/fN9i9MX8XF0=";
 
       nativeBuildInputs = [ openapi-generator-cli ];
 
@@ -36,16 +36,16 @@ rustPlatform.buildRustPackage (
   in
   {
     pname = "warpgate";
-    version = "0.23.4";
+    version = "0.26.1";
 
     src = fetchFromGitHub {
       owner = "warp-tech";
       repo = "warpgate";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-/IhnDBQq7Ed5vaGiCHNTcE7Uu9b9VrBN1ipCd2Tai1o=";
+      hash = "sha256-1Dg7bzhBQNe+u90Tw+kcmVaxV5IK0/t505HZr18qP5I=";
     };
 
-    cargoHash = "sha256-PRR+bzvmWcWUVdV1HqDqD08SwvDCvGXMvkIVoFEnaQI=";
+    cargoHash = "sha256-A5rRLrqlAZV/3ID8F+wUO8OP3Ocivg7vYrNDiMqRKik=";
 
     patches = [
       (replaceVars ./hardcode-version.patch { inherit (finalAttrs) version; })
diff --git a/pkgs/by-name/wa/warpgate/remove-nightly-rustflags.patch b/pkgs/by-name/wa/warpgate/remove-nightly-rustflags.patch
index 8046dce16f9e..caa2ceba247d 100644
--- a/pkgs/by-name/wa/warpgate/remove-nightly-rustflags.patch
+++ b/pkgs/by-name/wa/warpgate/remove-nightly-rustflags.patch
@@ -2,25 +2,30 @@ diff --git a/Cargo.toml b/Cargo.toml
 index 0e92acb..d187ebc 100644
 --- a/Cargo.toml
 +++ b/Cargo.toml
-@@ -100,21 +100,3 @@ strip = "debuginfo"
+@@ -1,5 +1,3 @@
+-cargo-features = ["profile-rustflags"]
+-
+ [workspace]
+ members = [
+     "warpgate",
+@@ -160,20 +158,2 @@
  [profile.coverage]
  inherits = "dev"
- # rustflags = ["-Cinstrument-coverage"]
 -
 -[profile.dev.package.aws-sdk-ec2]
--rustflags = ["-Zhint-mostly-unused"]
+-hint-mostly-unused = true
 -
 -[profile.release.package.aws-sdk-ec2]
--rustflags = ["-Zhint-mostly-unused"]
+-hint-mostly-unused = true
 -
 -[profile.dev.package.aws-sdk-rds]
--rustflags = ["-Zhint-mostly-unused"]
+-hint-mostly-unused = true
 -
 -[profile.release.package.aws-sdk-rds]
--rustflags = ["-Zhint-mostly-unused"]
+-hint-mostly-unused = true
 -
 -[profile.dev.package.aws-sdk-eks]
--rustflags = ["-Zhint-mostly-unused"]
+-hint-mostly-unused = true
 -
 -[profile.release.package.aws-sdk-eks]
--rustflags = ["-Zhint-mostly-unused"]
+-hint-mostly-unused = true

From 2379374bb1452c9f316ecbd17aa0cfd2ec961b62 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Tue, 28 Jul 2026 23:43:54 -0400
Subject: [PATCH 17/57] warpgate: add changelog

(cherry picked from commit 5c39657284dc5ca5c38ab8504a98cddf6998b3e6)
---
 pkgs/by-name/wa/warpgate/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/wa/warpgate/package.nix b/pkgs/by-name/wa/warpgate/package.nix
index c4b7f235f543..0dd6e82729d5 100644
--- a/pkgs/by-name/wa/warpgate/package.nix
+++ b/pkgs/by-name/wa/warpgate/package.nix
@@ -81,6 +81,7 @@ rustPlatform.buildRustPackage (
     meta = {
       description = "Smart SSH, HTTPS, MySQL and Postgres bastion that requires no additional client-side software";
       homepage = "https://warpgate.null.page";
+      changelog = "https://github.com/warp-tech/warpgate/releases/tag/v${finalAttrs.version}";
       license = lib.licenses.asl20;
       platforms = lib.platforms.linux ++ lib.platforms.darwin;
       mainProgram = "warpgate";

From ef85698897523d3e30085b8e6f74843bcb924c15 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Tue, 28 Jul 2026 23:44:12 -0400
Subject: [PATCH 18/57] warpgate: cleanup

(cherry picked from commit fea0fb660bf2029c6ca748bfc9ffd3520423ba7d)
---
 pkgs/by-name/wa/warpgate/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/wa/warpgate/package.nix b/pkgs/by-name/wa/warpgate/package.nix
index 0dd6e82729d5..e9136ea3cdfc 100644
--- a/pkgs/by-name/wa/warpgate/package.nix
+++ b/pkgs/by-name/wa/warpgate/package.nix
@@ -1,7 +1,6 @@
 {
   lib,
   replaceVars,
-  fetchurl,
   fetchFromGitHub,
   rustPlatform,
   buildNpmPackage,

From 71549fb3008905bf00132e3c92809e2863b54839 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Le=C3=B3n=20Bohn?= <bohn@lics.rwth-aachen.de>
Date: Fri, 24 Jul 2026 22:42:17 +0200
Subject: [PATCH 19/57] python3Package.paho-mqtt: backport fix for flaky tests

During testing, MQTT clients are spawned as subprocesses and then
stopped via SIGINT. Whether or not the SIGINT signal arrives before or
after the client has completed the initial setup and reached its
`loop_forever()` or `wait_for_keyboard_input()` call is
timing-dependent. This limitaiton is known by the upstream developers
(as witnessed by the comment in the custom implementation of
`wait_for_keyboard_interrupt`). As a consequence, people are getting
failures during teardown for different tests depending on the machine as
the timing is slightly different, see #542586.

This has been fixed upstream in eclipse-paho/paho.mqtt.python#934 by
introducing a signaling mechanism. This PR backports the fix.

Assited-by: Claude Sonnet 5
(cherry picked from commit 8fb237ffd2da92f4eb36ea950120cc2dd110c951)
---
 .../python-modules/paho-mqtt/default.nix      |   5 +
 .../fix-flaky-tests-backport-934.patch        | 184 ++++++++++++++++++
 2 files changed, 189 insertions(+)
 create mode 100644 pkgs/development/python-modules/paho-mqtt/fix-flaky-tests-backport-934.patch

diff --git a/pkgs/development/python-modules/paho-mqtt/default.nix b/pkgs/development/python-modules/paho-mqtt/default.nix
index 1d71451e962b..8f4cf1eff91b 100644
--- a/pkgs/development/python-modules/paho-mqtt/default.nix
+++ b/pkgs/development/python-modules/paho-mqtt/default.nix
@@ -36,6 +36,11 @@ buildPythonPackage rec {
       url = "https://github.com/eclipse-paho/paho.mqtt.python/pull/931.diff";
       hash = "sha256-A7rWwpR4PnCi77F1VqsQKHBxHNrdeHgmVM6BGMeUpjs=";
     })
+    # backports an upstream fix for flaky tests as repoted here:
+    # https://github.com/NixOS/nixpkgs/issues/542586
+    # the fix has already landed in master of paho-mqtt:
+    # https://github.com/eclipse-paho/paho.mqtt.python/pull/934
+    ./fix-flaky-tests-backport-934.patch
   ];
 
   build-system = [
diff --git a/pkgs/development/python-modules/paho-mqtt/fix-flaky-tests-backport-934.patch b/pkgs/development/python-modules/paho-mqtt/fix-flaky-tests-backport-934.patch
new file mode 100644
index 000000000000..dd7511d61c56
--- /dev/null
+++ b/pkgs/development/python-modules/paho-mqtt/fix-flaky-tests-backport-934.patch
@@ -0,0 +1,184 @@
+diff --git a/tests/lib/conftest.py b/tests/lib/conftest.py
+index 98bbebe..5999085 100644
+--- a/tests/lib/conftest.py
++++ b/tests/lib/conftest.py
+@@ -2,6 +2,7 @@ import os
+ import signal
+ import subprocess
+ import sys
++import time
+ 
+ import pytest
+ 
+@@ -45,7 +46,29 @@ def alpn_ssl_server_socket(monkeypatch, ssl_certs_path):
+     yield from _yield_server(monkeypatch, create_server_socket_ssl(path=ssl_certs_path, alpn_protocols=["paho-test-protocol"]))
+ 
+ 
+-def stop_process(proc: subprocess.Popen) -> None:
++def terminate_process(proc: subprocess.Popen) -> None:
++    proc.terminate()
++    try:
++        # At least on Unix, terminate() isn't an unconditional kill, process
++        # could ignore/handle it.
++        proc.wait(1)
++    except subprocess.TimeoutExpired:
++        # So use kill which is unstoppable on Unix
++        proc.kill()
++        proc.wait(1)  # If here we timeout, there is nothing more to do.
++
++
++def stop_process(proc: subprocess.Popen, ready_file) -> None:
++    deadline = time.monotonic() + 5
++    while proc.poll() is None and not ready_file.exists():
++        if time.monotonic() >= deadline:
++            terminate_process(proc)
++            raise RuntimeError("Client did not become ready to stop")
++        time.sleep(0.01)
++
++    if proc.poll() is not None:
++        return
++
+     if sys.platform == "win32":
+         proc.send_signal(signal.CTRL_C_EVENT)
+     else:
+@@ -53,17 +76,19 @@ def stop_process(proc: subprocess.Popen) -> None:
+     try:
+         proc.wait(5)
+     except subprocess.TimeoutExpired:
+-        proc.terminate()
++        terminate_process(proc)
+ 
+ 
+ @pytest.fixture()
+-def start_client(request: pytest.FixtureRequest, ssl_certs_path):
++def start_client(request: pytest.FixtureRequest, ssl_certs_path, tmp_path):
+     def starter(name: str, expected_returncode: int = 0) -> None:
+         client_path = clients_path / name
+         if not client_path.exists():
+             raise FileNotFoundError(client_path)
++        ready_file = tmp_path / f"{name}.ready"
+         env = dict(
+             os.environ,
++            PAHO_TEST_READY_FILE=str(ready_file),
+             PAHO_SSL_PATH=str(ssl_certs_path),
+             PYTHONPATH=f"{tests_path}{os.pathsep}{os.environ.get('PYTHONPATH', '')}",
+         )
+@@ -74,7 +99,7 @@ def start_client(request: pytest.FixtureRequest, ssl_certs_path):
+         ], env=env)
+ 
+         def fin():
+-            stop_process(proc)
++            stop_process(proc, ready_file)
+             if proc.returncode != expected_returncode:
+                 raise RuntimeError(f"Client {name} exited with code {proc.returncode}, expected {expected_returncode}")
+ 
+diff --git a/tests/paho_test.py b/tests/paho_test.py
+index 3df996e..188ceef 100644
+--- a/tests/paho_test.py
++++ b/tests/paho_test.py
+@@ -402,6 +402,11 @@ def pack_remaining_length(remaining_length):
+         if remaining_length == 0:
+             return s
+ 
++def signal_client_ready():
++    ready_file = os.environ.get("PAHO_TEST_READY_FILE")
++    if ready_file is not None:
++        with open(ready_file, "w"):
++            pass
+ 
+ def loop_until_keyboard_interrupt(mqttc):
+     """
+@@ -413,6 +418,7 @@ def loop_until_keyboard_interrupt(mqttc):
+     and stop the client gracefully.
+     """
+     try:
++        signal_client_ready()
+         while True:
+             mqttc.loop()
+     except KeyboardInterrupt:
+@@ -431,6 +437,7 @@ def wait_for_keyboard_interrupt():
+     """
+     yield  # If we get a KeyboardInterrupt during the block, it's too soon!
+     try:
++        signal_client_ready()
+         while True:
+             time.sleep(0.1)
+     except KeyboardInterrupt:
+diff --git a/tests/test_client.py b/tests/test_client.py
+index 09e4606..86652ca 100644
+--- a/tests/test_client.py
++++ b/tests/test_client.py
+@@ -864,19 +864,19 @@ class TestCompatibility:
+             disconnect_packet = paho_test.gen_disconnect()
+             fake_broker.expect_packet("disconnect", disconnect_packet)
+ 
+-            assert callback_called == [
+-                "on_connect",
+-                "on_subscribe",
+-                "on_publish",
+-                "on_message",
+-                "on_unsubscribe",
+-                "on_disconnect",
+-            ]
+-
+         finally:
+             mqttc.disconnect()
+             mqttc.loop_stop()
+ 
++        assert callback_called == [
++            "on_connect",
++            "on_subscribe",
++            "on_publish",
++            "on_message",
++            "on_unsubscribe",
++            "on_disconnect",
++        ]
++
+         packet_in = fake_broker.receive_packet(1)
+         assert not packet_in  # Check connection is closed
+ 
+@@ -1004,18 +1004,18 @@ class TestCompatibility:
+             disconnect_packet = paho_test.gen_disconnect()
+             fake_broker.expect_packet("disconnect", disconnect_packet)
+ 
+-            assert callback_called == [
+-                "on_connect",
+-                "on_subscribe",
+-                "on_publish",
+-                "on_message",
+-                "on_unsubscribe",
+-                "on_disconnect",
+-            ]
+-
+         finally:
+             mqttc.disconnect()
+             mqttc.loop_stop()
+ 
++        assert callback_called == [
++            "on_connect",
++            "on_subscribe",
++            "on_publish",
++            "on_message",
++            "on_unsubscribe",
++            "on_disconnect",
++        ]
++
+         packet_in = fake_broker.receive_packet(1)
+         assert not packet_in  # Check connection is closed
+diff --git a/tests/testsupport/broker.py b/tests/testsupport/broker.py
+index e08cf73..a587599 100644
+--- a/tests/testsupport/broker.py
++++ b/tests/testsupport/broker.py
+@@ -59,8 +59,10 @@ class FakeBroker:
+         if self._conn is None:
+             raise ValueError('Connection is not open')
+ 
+-        packet_in = self._conn.recv(num_bytes)
+-        return packet_in
++        try:
++            return self._conn.recv(num_bytes)
++        except ConnectionResetError:
++            return b""
+ 
+     def send_packet(self, packet_out):
+         if self._conn is None:

From b17bb7d10488acdd296d3871816e759d88d54104 Mon Sep 17 00:00:00 2001
From: Felix Singer <felixsinger@posteo.net>
Date: Fri, 31 Jul 2026 20:09:35 +0200
Subject: [PATCH 20/57] [release-26.05] redmine: Update rails to 7.2.3.2

Fixes CVE-2026-66066.

Signed-off-by: Felix Singer <felixsinger@posteo.net>
Not-cherry-picked-because: master branch has different major version
---
 pkgs/by-name/re/redmine/Gemfile      |   2 +-
 pkgs/by-name/re/redmine/Gemfile.lock | 188 ++++++++++----------
 pkgs/by-name/re/redmine/gemset.nix   | 246 ++++++++++++++-------------
 pkgs/by-name/re/redmine/package.nix  |   9 +
 4 files changed, 236 insertions(+), 209 deletions(-)

diff --git a/pkgs/by-name/re/redmine/Gemfile b/pkgs/by-name/re/redmine/Gemfile
index cf30bf9e288f..2bcbce833573 100644
--- a/pkgs/by-name/re/redmine/Gemfile
+++ b/pkgs/by-name/re/redmine/Gemfile
@@ -2,7 +2,7 @@ source 'https://rubygems.org'
 
 ruby '>= 3.2.0', '< 3.5.0'
 
-gem 'rails', '7.2.3.1'
+gem 'rails', '7.2.3.2'
 gem 'rouge', '~> 4.5'
 gem 'mini_mime', '~> 1.1.0'
 gem "actionpack-xml_parser"
diff --git a/pkgs/by-name/re/redmine/Gemfile.lock b/pkgs/by-name/re/redmine/Gemfile.lock
index 5a4881050674..1c045f2c6fb1 100644
--- a/pkgs/by-name/re/redmine/Gemfile.lock
+++ b/pkgs/by-name/re/redmine/Gemfile.lock
@@ -1,29 +1,29 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    actioncable (7.2.3.1)
-      actionpack (= 7.2.3.1)
-      activesupport (= 7.2.3.1)
+    actioncable (7.2.3.2)
+      actionpack (= 7.2.3.2)
+      activesupport (= 7.2.3.2)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
       zeitwerk (~> 2.6)
-    actionmailbox (7.2.3.1)
-      actionpack (= 7.2.3.1)
-      activejob (= 7.2.3.1)
-      activerecord (= 7.2.3.1)
-      activestorage (= 7.2.3.1)
-      activesupport (= 7.2.3.1)
+    actionmailbox (7.2.3.2)
+      actionpack (= 7.2.3.2)
+      activejob (= 7.2.3.2)
+      activerecord (= 7.2.3.2)
+      activestorage (= 7.2.3.2)
+      activesupport (= 7.2.3.2)
       mail (>= 2.8.0)
-    actionmailer (7.2.3.1)
-      actionpack (= 7.2.3.1)
-      actionview (= 7.2.3.1)
-      activejob (= 7.2.3.1)
-      activesupport (= 7.2.3.1)
+    actionmailer (7.2.3.2)
+      actionpack (= 7.2.3.2)
+      actionview (= 7.2.3.2)
+      activejob (= 7.2.3.2)
+      activesupport (= 7.2.3.2)
       mail (>= 2.8.0)
       rails-dom-testing (~> 2.2)
-    actionpack (7.2.3.1)
-      actionview (= 7.2.3.1)
-      activesupport (= 7.2.3.1)
+    actionpack (7.2.3.2)
+      actionview (= 7.2.3.2)
+      activesupport (= 7.2.3.2)
       cgi
       nokogiri (>= 1.8.5)
       racc
@@ -36,36 +36,36 @@ GEM
     actionpack-xml_parser (2.0.1)
       actionpack (>= 5.0)
       railties (>= 5.0)
-    actiontext (7.2.3.1)
-      actionpack (= 7.2.3.1)
-      activerecord (= 7.2.3.1)
-      activestorage (= 7.2.3.1)
-      activesupport (= 7.2.3.1)
+    actiontext (7.2.3.2)
+      actionpack (= 7.2.3.2)
+      activerecord (= 7.2.3.2)
+      activestorage (= 7.2.3.2)
+      activesupport (= 7.2.3.2)
       globalid (>= 0.6.0)
       nokogiri (>= 1.8.5)
-    actionview (7.2.3.1)
-      activesupport (= 7.2.3.1)
+    actionview (7.2.3.2)
+      activesupport (= 7.2.3.2)
       builder (~> 3.1)
       cgi
       erubi (~> 1.11)
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
-    activejob (7.2.3.1)
-      activesupport (= 7.2.3.1)
+    activejob (7.2.3.2)
+      activesupport (= 7.2.3.2)
       globalid (>= 0.3.6)
-    activemodel (7.2.3.1)
-      activesupport (= 7.2.3.1)
-    activerecord (7.2.3.1)
-      activemodel (= 7.2.3.1)
-      activesupport (= 7.2.3.1)
+    activemodel (7.2.3.2)
+      activesupport (= 7.2.3.2)
+    activerecord (7.2.3.2)
+      activemodel (= 7.2.3.2)
+      activesupport (= 7.2.3.2)
       timeout (>= 0.4.0)
-    activestorage (7.2.3.1)
-      actionpack (= 7.2.3.1)
-      activejob (= 7.2.3.1)
-      activerecord (= 7.2.3.1)
-      activesupport (= 7.2.3.1)
+    activestorage (7.2.3.2)
+      actionpack (= 7.2.3.2)
+      activejob (= 7.2.3.2)
+      activerecord (= 7.2.3.2)
+      activesupport (= 7.2.3.2)
       marcel (~> 1.0)
-    activesupport (7.2.3.1)
+    activesupport (7.2.3.2)
       base64
       benchmark (>= 0.3)
       bigdecimal
@@ -79,9 +79,11 @@ GEM
       tzinfo (~> 2.0, >= 2.0.5)
     addressable (2.9.0)
       public_suffix (>= 2.0.2, < 8.0)
+    anonymous_loader (0.1.3)
+      version_gem (~> 1.1, >= 1.1.14)
     ast (2.4.3)
-    auth-sanitizer (0.2.1)
-      version_gem (~> 1.1, >= 1.1.10)
+    auth-sanitizer (0.2.3)
+      version_gem (~> 1.1, >= 1.1.14)
     base64 (0.3.0)
     bcrypt (3.1.22)
     benchmark (0.5.0)
@@ -104,16 +106,17 @@ GEM
       rack-test (>= 0.6.3)
       regexp_parser (>= 1.5, < 3.0)
       xpath (~> 3.2)
-    cgi (0.5.1)
+    cgi (0.5.2)
     chunky_png (1.4.0)
     commonmarker (2.3.2)
       rb_sys (~> 0.9)
-    concurrent-ruby (1.3.7)
+    concurrent-ruby (1.3.8)
     connection_pool (3.0.2)
-    crass (1.0.6)
-    css_parser (2.2.0)
+    crass (1.0.7)
+    css_parser (3.0.0)
       addressable
-    csv (3.3.5)
+      ssrf_filter (~> 1.5)
+    csv (3.3.6)
     date (3.5.1)
     debug (1.11.1)
       irb (~> 1.10)
@@ -125,7 +128,7 @@ GEM
     doorkeeper-i18n (5.2.9)
       doorkeeper (>= 5.2)
     drb (2.2.3)
-    erb (6.0.4)
+    erb (6.0.6)
     erubi (1.13.1)
     faraday (2.14.3)
       faraday-net_http (>= 2.0, < 3.5)
@@ -134,7 +137,7 @@ GEM
     faraday-net_http (3.4.4)
       net-http (~> 0.5)
     ffi (1.17.4)
-    globalid (1.3.0)
+    globalid (1.4.0)
       activesupport (>= 6.1)
     hashie (5.1.0)
       logger
@@ -157,17 +160,17 @@ GEM
       prism (>= 1.3.0)
       rdoc (>= 4.0.0)
       reline (>= 0.4.2)
-    json (2.19.9)
+    json (2.21.2)
     jwt (3.2.0)
       base64
-    language_server-protocol (3.17.0.5)
+    language_server-protocol (3.17.0.6)
     lint_roller (1.1.0)
     listen (3.10.0)
       logger
       rb-fsevent (~> 0.10, >= 0.10.3)
       rb-inotify (~> 0.9, >= 0.9.10)
     logger (1.7.0)
-    loofah (2.25.1)
+    loofah (2.25.2)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
     mail (2.8.1)
@@ -180,7 +183,7 @@ GEM
     mime-types (3.7.0)
       logger
       mime-types-data (~> 3.2025, >= 3.2025.0507)
-    mime-types-data (3.2026.0414)
+    mime-types-data (3.2026.0701)
     mini_magick (5.2.0)
       benchmark
       logger
@@ -207,24 +210,25 @@ GEM
       net-protocol
     netrc (0.11.0)
     nio4r (2.7.5)
-    nokogiri (1.19.3)
+    nokogiri (1.19.4)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
-    oauth2 (2.0.23)
-      auth-sanitizer (~> 0.2, >= 0.2.1)
+    oauth2 (2.0.25)
+      anonymous_loader (~> 0.1, >= 0.1.3)
+      auth-sanitizer (~> 0.2, >= 0.2.3)
       faraday (>= 0.17.3, < 4.0)
       jwt (>= 1.0, < 4.0)
       logger (~> 1.2)
       multi_xml (~> 0.5)
       rack (>= 1.2, < 4)
-      snaky_hash (~> 2.0, >= 2.0.6)
-      version_gem (~> 1.1, >= 1.1.11)
+      snaky_hash (~> 2.0, >= 2.0.7)
+      version_gem (~> 1.1, >= 1.1.14)
     parallel (1.28.0)
-    parser (3.3.11.1)
+    parser (3.3.12.0)
       ast (~> 2.4.1)
       racc
     pg (1.5.9)
-    pp (0.6.3)
+    pp (0.6.4)
       prettyprint
     prettyprint (0.2.0)
     prism (1.9.0)
@@ -233,9 +237,6 @@ GEM
       activesupport (>= 7.0.0)
       rack
       railties (>= 7.0.0)
-    psych (5.4.0)
-      date
-      stringio
     public_suffix (7.0.5)
     puma (8.0.2)
       nio4r (~> 2.0)
@@ -248,30 +249,30 @@ GEM
       rack (>= 1.3)
     rackup (2.3.1)
       rack (>= 3)
-    rails (7.2.3.1)
-      actioncable (= 7.2.3.1)
-      actionmailbox (= 7.2.3.1)
-      actionmailer (= 7.2.3.1)
-      actionpack (= 7.2.3.1)
-      actiontext (= 7.2.3.1)
-      actionview (= 7.2.3.1)
-      activejob (= 7.2.3.1)
-      activemodel (= 7.2.3.1)
-      activerecord (= 7.2.3.1)
-      activestorage (= 7.2.3.1)
-      activesupport (= 7.2.3.1)
+    rails (7.2.3.2)
+      actioncable (= 7.2.3.2)
+      actionmailbox (= 7.2.3.2)
+      actionmailer (= 7.2.3.2)
+      actionpack (= 7.2.3.2)
+      actiontext (= 7.2.3.2)
+      actionview (= 7.2.3.2)
+      activejob (= 7.2.3.2)
+      activemodel (= 7.2.3.2)
+      activerecord (= 7.2.3.2)
+      activestorage (= 7.2.3.2)
+      activesupport (= 7.2.3.2)
       bundler (>= 1.15.0)
-      railties (= 7.2.3.1)
+      railties (= 7.2.3.2)
     rails-dom-testing (2.3.0)
       activesupport (>= 5.0.0)
       minitest
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.7.0)
-      loofah (~> 2.25)
+    rails-html-sanitizer (1.7.1)
+      loofah (~> 2.25, >= 2.25.2)
       nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
-    railties (7.2.3.1)
-      actionpack (= 7.2.3.1)
-      activesupport (= 7.2.3.1)
+    railties (7.2.3.2)
+      actionpack (= 7.2.3.2)
+      activesupport (= 7.2.3.2)
       cgi
       irb (~> 1.13)
       rackup (>= 1.0.0)
@@ -291,9 +292,14 @@ GEM
       htmlentities
       rbpdf-font (~> 1.19.0)
     rbpdf-font (1.19.1)
-    rdoc (7.2.0)
+    rbs (4.1.1)
+      logger
+      prism (>= 1.6.0)
+      tsort
+    rdoc (8.0.0)
       erb
-      psych (>= 4.0.0)
+      prism (>= 1.6.0)
+      rbs (>= 4.0.0)
       tsort
     regexp_parser (2.12.0)
     reline (0.6.3)
@@ -306,8 +312,8 @@ GEM
       mime-types (>= 1.16, < 4.0)
       netrc (~> 0.8)
     rexml (3.4.4)
-    roadie (5.3.0)
-      css_parser (>= 1.4, < 3.0)
+    roadie (5.3.1)
+      css_parser (>= 1.4, < 4.0)
       nokogiri (~> 1.15)
     roadie-rails (3.3.0)
       railties (>= 5.1, < 8.1)
@@ -329,7 +335,7 @@ GEM
       rubocop-ast (>= 1.45.1, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.49.1)
+    rubocop-ast (1.50.0)
       parser (>= 3.3.7.2)
       prism (~> 1.7)
     rubocop-performance (1.25.0)
@@ -349,7 +355,7 @@ GEM
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
     securerandom (0.4.1)
-    selenium-webdriver (4.45.0)
+    selenium-webdriver (4.46.0)
       base64 (~> 0.2)
       logger (~> 1.4)
       rexml (~> 3.2, >= 3.2.5)
@@ -361,14 +367,14 @@ GEM
       simplecov_json_formatter (~> 0.1)
     simplecov-html (0.13.2)
     simplecov_json_formatter (0.1.4)
-    snaky_hash (2.0.6)
+    snaky_hash (2.0.7)
       hashie (>= 0.1.0, < 6)
-      version_gem (>= 1.1.8, < 3)
+      version_gem (~> 1.1, >= 1.1.14)
     sqlite3 (2.5.0)
       mini_portile2 (~> 2.8.0)
+    ssrf_filter (1.5.0)
     stimulus-rails (1.3.4)
       railties (>= 6.0.0)
-    stringio (3.2.0)
     svg_optimizer (0.3.0)
       nokogiri
     svg_sprite (1.0.3)
@@ -387,10 +393,10 @@ GEM
     uniform_notifier (1.18.0)
     uri (1.1.1)
     useragent (0.16.11)
-    version_gem (1.1.12)
+    version_gem (1.1.14)
     webrick (1.9.2)
     websocket (1.2.11)
-    websocket-driver (0.8.1)
+    websocket-driver (0.8.2)
       base64
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)
@@ -399,7 +405,7 @@ GEM
       zeitwerk (>= 2.7)
     xpath (3.2.0)
       nokogiri (~> 1.8)
-    yard (0.9.44)
+    yard (0.9.45)
     zeitwerk (2.8.2)
 
 PLATFORMS
@@ -439,7 +445,7 @@ DEPENDENCIES
   propshaft (~> 1.1.0)
   puma
   rack (>= 3.1.3)
-  rails (= 7.2.3.1)
+  rails (= 7.2.3.2)
   rails-dom-testing (>= 2.3.0)
   rbpdf (~> 1.21.4)
   requestjs-rails (~> 0.0.13)
diff --git a/pkgs/by-name/re/redmine/gemset.nix b/pkgs/by-name/re/redmine/gemset.nix
index b8b1c5989d7e..a95f5806cddc 100644
--- a/pkgs/by-name/re/redmine/gemset.nix
+++ b/pkgs/by-name/re/redmine/gemset.nix
@@ -11,10 +11,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0g5kbrqvhwlliyrzd2bhc3kdiqm58df0x3w716bs0ygwyjil1gyk";
+      sha256 = "0mvb7hkrbg1nrb0xy347f1wb2vlf61kc3gs3yi2swawl34axkzq4";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "7.2.3.2";
   };
   actionmailbox = {
     dependencies = [
@@ -29,10 +29,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0hf59r6sk0qb5va0ga549rbadcb5n1a2ry8nlkszzcksr6039rx4";
+      sha256 = "19ccdmx2l8rdz698686n7yzlkwlry4qaiqacw68w6c5nqnc6x7yi";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "7.2.3.2";
   };
   actionmailer = {
     dependencies = [
@@ -47,10 +47,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0rq4aan18y6gwziabnj1q1486349k1v1i5m7ysv206pqqpavcy7m";
+      sha256 = "0ndpcw5q3hyxwkncg6wf37qlzyn8qcvd4q19inrcsrr8hwkc79j5";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "7.2.3.2";
   };
   actionpack = {
     dependencies = [
@@ -70,10 +70,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1jp4w493wvfh9246wxk7g00m1a3vmzkvs0rznq62fwvjjdzzwsmn";
+      sha256 = "0av5562qr6f7lddlr4ipycp2qk54q8pl3caa0vp7690gvz2b3yy1";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "7.2.3.2";
   };
   actionpack-xml_parser = {
     dependencies = [
@@ -102,10 +102,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1qs350j3zm7sd6xxn61d93mv3lx1ravbjqja12c7nd7a0zs1h52v";
+      sha256 = "1c7h6fyyi8q1kqgclcdr55vrm28v7swriam9ara6m5xb0wm7xaqr";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "7.2.3.2";
   };
   actionview = {
     dependencies = [
@@ -120,10 +120,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0z7zy6ibfpsdj9jbdm54bx3ws4dszcq7qa564jn645rr8dlbh6fy";
+      sha256 = "00fw5sqg71zjw5bgk5l620l05aj07kbl6clzz8fjg4qc0ikdkgs2";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "7.2.3.2";
   };
   activejob = {
     dependencies = [
@@ -134,10 +134,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1n3fiwm1x3dxwj36n9pspd2bgffyw28ys9yd36hjvf3iwdy25i0b";
+      sha256 = "0fm9fghq86z09xdrsdqq1z8bbasxsb8w1f2c1hzq44c9i5qa0gxq";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "7.2.3.2";
   };
   activemodel = {
     dependencies = [ "activesupport" ];
@@ -145,10 +145,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1l60a6mqx1wgp15ki1cp68djci0czgrikpydii5bd877hndqdq9r";
+      sha256 = "09v987j1jy4821s06cpm3h50ldybv89k0ll70grn05fxv1yccxrp";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "7.2.3.2";
   };
   activerecord = {
     dependencies = [
@@ -160,10 +160,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0pd0f1hy6rvyanmrklqir33xq0jb2my4jajz7hc38nysfpi175dq";
+      sha256 = "1iw5f93c6rq080xphy4776lamc4iahibjbhjxlj0v0jzgsx28bg6";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "7.2.3.2";
   };
   activestorage = {
     dependencies = [
@@ -177,10 +177,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1azzbpfp726yigwzmj8g2jji149wisnwrgb86zix6mk25sj4w8hb";
+      sha256 = "1z6v9rz1lvqdn2x28vbcbyq6m1gvzqwvkp9apramal433frb8g46";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "7.2.3.2";
   };
   activesupport = {
     dependencies = [
@@ -204,10 +204,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0d6bhg9cim83g8cypjd7cms45ng4p9ga69v26i3vp823d98yvsqi";
+      sha256 = "04ikxwixhpnv2dih9hy3af45qgra7kz0fd70miw6s248vl8hvjfx";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "7.2.3.2";
   };
   addressable = {
     dependencies = [ "public_suffix" ];
@@ -223,6 +223,20 @@
     };
     version = "2.9.0";
   };
+  anonymous_loader = {
+    dependencies = [ "version_gem" ];
+    groups = [
+      "default"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0mfb8kf2a4qmam6jvlrsb38zqh9gk3y1vhbx8iaxji4i8gi1hjh8";
+      type = "gem";
+    };
+    version = "0.1.3";
+  };
   ast = {
     groups = [
       "default"
@@ -245,10 +259,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0xy5gjb12kv6zjn4zyd16yfv4bygd02ykbr6cz10d6sqyw0wyzci";
+      sha256 = "0g1yjdchydvk44v4303rjhb5sfb73nzbrvipnr5cdr7v5k4sl46v";
       type = "gem";
     };
-    version = "0.2.1";
+    version = "0.2.3";
   };
   base64 = {
     groups = [
@@ -377,10 +391,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1s8qdw1nfh3njd47q154njlfyc2llcgi4ik13vz39adqd7yclgz9";
+      sha256 = "1fzqwshg1xzbdm97havskfp6wifsgbjii00dzba0y6bih4lk1jk1";
       type = "gem";
     };
-    version = "0.5.1";
+    version = "0.5.2";
   };
   chunky_png = {
     groups = [ "default" ];
@@ -412,10 +426,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1c2i64xsd35vijnb50rxb70g508s0x674xi0qpyyb8jy7bncl4j4";
+      sha256 = "1qfi2ns3zwkgq616fc127xiqhan7g7m7gqpwriwcr34nds1vxwdj";
       type = "gem";
     };
-    version = "1.3.7";
+    version = "1.3.8";
   };
   connection_pool = {
     groups = [
@@ -436,38 +450,37 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0pfl5c0pyqaparxaqxi6s4gfl21bdldwiawrc0aknyvflli60lfw";
+      sha256 = "15djj19ynz3sbw54fsf8n7y3sha8a333f2mgvjfwhr46jhcqg1ll";
       type = "gem";
     };
-    version = "1.0.6";
+    version = "1.0.7";
   };
   css_parser = {
-    dependencies = [ "addressable" ];
+    dependencies = [
+      "addressable"
+      "ssrf_filter"
+    ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "09b3zwmx95jhdp3da6qx9w0d6s2yfpxjjip55wpwny5wsx3v5l93";
+      sha256 = "119q8j23xyb9pifka1n6jjrw04099zpwwdajh5pd10fm7wlfkw7a";
       type = "gem";
     };
-    version = "2.2.0";
+    version = "3.0.0";
   };
   csv = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0gz7r2kazwwwyrwi95hbnhy54kwkfac5swh2gy5p5vw36fn38lbf";
+      sha256 = "0mj4kq4wwpc7c8ll52q30hsir1jrcd5kq7yb8lyz0rksa1z1x9mb";
       type = "gem";
     };
-    version = "3.3.5";
+    version = "3.3.6";
   };
   date = {
-    groups = [
-      "default"
-      "development"
-      "test"
-    ];
+    groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
@@ -564,10 +577,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1ncmbdjf2bwmk0jf5cxywns9zbxyfiy4h4p3pzi7yddyjhv81qrq";
+      sha256 = "1raacipbb5m0176w05m3n21ip91w7i0cb5zjqhkz2nqgf234kcm9";
       type = "gem";
     };
-    version = "6.0.4";
+    version = "6.0.6";
   };
   erubi = {
     groups = [ "default" ];
@@ -647,10 +660,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "04gzhqvsm4z4l12r9dkac9a75ah45w186ydhl0i4andldsnkkih5";
+      sha256 = "09zl0rkskfq0cwfrk9ypjvflvzanfg3xbhh1slaa1myry7xi4zq3";
       type = "gem";
     };
-    version = "1.3.0";
+    version = "1.4.0";
   };
   hashie = {
     dependencies = [ "logger" ];
@@ -789,10 +802,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "16mp8vzgxa8nsa81np042za453j8b0ihpjkf666s7byxrnvjb44v";
+      sha256 = "0shwgjqbj856mb6m9kgkpy08nhym2gdvc2yaprlimfmky9y3n78z";
       type = "gem";
     };
-    version = "2.19.9";
+    version = "2.21.2";
   };
   jwt = {
     dependencies = [ "base64" ];
@@ -816,10 +829,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1k0311vah76kg5m6zr7wmkwyk5p2f9d9hyckjpn3xgr83ajkj7px";
+      sha256 = "1w5p8c2145lmqzr25bxh4ikzjm6k8y1k5lriqqdpw9pq730w1wjy";
       type = "gem";
     };
-    version = "3.17.0.5";
+    version = "3.17.0.6";
   };
   lint_roller = {
     groups = [
@@ -873,10 +886,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "011fdngxzr1p9dq2hxqz7qq1glj2g44xnhaadjqlf48cplywfdnl";
+      sha256 = "062r891hxis58j5q735kk9sj5srxx0rv813f8m95bilsjm3gf1r0";
       type = "gem";
     };
-    version = "2.25.1";
+    version = "2.25.2";
   };
   mail = {
     dependencies = [
@@ -942,10 +955,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1k28j6ww8rf43r5i8278jvm2cq3pnzsvqm7yqpb4p93kadjlq726";
+      sha256 = "03vkd9g09jnxsp8mdacvjbplrrqfl5l26n50kd4kdn49zghi326d";
       type = "gem";
     };
-    version = "3.2026.0414";
+    version = "3.2026.0701";
   };
   mini_magick = {
     dependencies = [
@@ -1148,13 +1161,14 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1s30b7h7qpyim30m8060xs415mbr3ci7i5hdg09chh1aqfx2qcbq";
+      sha256 = "1d9safb4dly6qmc2g06444l0zifby52yy6j1a5fa1g4j3ihm3jah";
       type = "gem";
     };
-    version = "1.19.3";
+    version = "1.19.4";
   };
   oauth2 = {
     dependencies = [
+      "anonymous_loader"
       "auth-sanitizer"
       "faraday"
       "jwt"
@@ -1168,10 +1182,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0k428i1mlk6g7c054iks86g2h4h2p1y0mg2l3g6w84gd9l8604g6";
+      sha256 = "1b42dax3qwm1zbz86c9zcii7v45vi6c3rp083dyadjn2jcpnlwrg";
       type = "gem";
     };
-    version = "2.0.23";
+    version = "2.0.25";
   };
   parallel = {
     groups = [
@@ -1198,10 +1212,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0m2xqvn1la62hji1mn04y59giikww95p2hs0r4y2rrz3mdxcwyni";
+      sha256 = "0a4q5h2hcihk79dbr20scgkm56l79qp7fsvfvkxlv8nmapvxg9i1";
       type = "gem";
     };
-    version = "3.3.11.1";
+    version = "3.3.12.0";
   };
   pg = {
     groups = [ "default" ];
@@ -1223,10 +1237,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1xlxmg86k5kifci1xvlmgw56x88dmqf04zfzn7zcr4qb8ladal99";
+      sha256 = "0w5mha75hs8gdj75g8vl0sxpyp8rzvwq8a4jcmi4ah8cf370zjyz";
       type = "gem";
     };
-    version = "0.6.3";
+    version = "0.6.4";
   };
   prettyprint = {
     groups = [
@@ -1272,24 +1286,6 @@
     };
     version = "1.1.0";
   };
-  psych = {
-    dependencies = [
-      "date"
-      "stringio"
-    ];
-    groups = [
-      "default"
-      "development"
-      "test"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1dx5bc3s1mb1i53np4cdkypg7ccygnvagr3hglyndbqilrljvxql";
-      type = "gem";
-    };
-    version = "5.4.0";
-  };
   public_suffix = {
     groups = [
       "default"
@@ -1399,10 +1395,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "155skqkjrckvzj1qy37lrnafrillc47qhf3l80g3zvw100ba1h4n";
+      sha256 = "0g0iq4i93h24fzccp55aggg9agv1myi57y8ljpvv01chkxkr14i7";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "7.2.3.2";
   };
   rails-dom-testing = {
     dependencies = [
@@ -1428,10 +1424,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "128y5g3fyi8fds41jasrr4va1jrs7hcamzklk1523k7rxb64bc98";
+      sha256 = "1hi25xz5ijz3kjx4vsiywqbq05mlkas7di8pwc3p6mhyn34sg5z7";
       type = "gem";
     };
-    version = "1.7.0";
+    version = "1.7.1";
   };
   railties = {
     dependencies = [
@@ -1449,10 +1445,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0np1m8xqb4wbzwpg66yjnqjban0di92lbjzcrgnwwhq2w4z3k8xf";
+      sha256 = "17n2zx2ryjqq8a95pzin7v4k92b49ancy6cn2ddzia80rkgwc9pn";
       type = "gem";
     };
-    version = "7.2.3.1";
+    version = "7.2.3.2";
   };
   rainbow = {
     groups = [
@@ -1549,10 +1545,10 @@
     };
     version = "1.19.1";
   };
-  rdoc = {
+  rbs = {
     dependencies = [
-      "erb"
-      "psych"
+      "logger"
+      "prism"
       "tsort"
     ];
     groups = [
@@ -1563,10 +1559,30 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "14iiyb4yi1chdzrynrk74xbhmikml3ixgdayjma3p700singfl46";
+      sha256 = "17ibc9hx9v6f30fphmvy4ph63djja54msr2pcfax672xz7r1iw8v";
       type = "gem";
     };
-    version = "7.2.0";
+    version = "4.1.1";
+  };
+  rdoc = {
+    dependencies = [
+      "erb"
+      "prism"
+      "rbs"
+      "tsort"
+    ];
+    groups = [
+      "default"
+      "development"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0sf4909q2mr9z0rpygv94z12b0yamg07gz8cba2mi5k3m448rgq3";
+      type = "gem";
+    };
+    version = "8.0.0";
   };
   regexp_parser = {
     groups = [
@@ -1645,10 +1661,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1jlzxlq52qbsacxkz4gny988j2pcip73ydp1fg9s1q98ra4h6554";
+      sha256 = "1h8w5kv6l9lrqzd4d3ja05zp3fa3plf36hdkhdaq1g2zy66nlnk6";
       type = "gem";
     };
-    version = "5.3.0";
+    version = "5.3.1";
   };
   roadie-rails = {
     dependencies = [
@@ -1742,10 +1758,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0dahfpnzz63hyqxa03x8rypnrxzwyvh4i5a8ri34bzpnf3pg64j4";
+      sha256 = "1nw84xk6vc2ls8sxqvyhxs2agh4l0jrws85d4bi3x0501lq8ijmr";
       type = "gem";
     };
-    version = "1.49.1";
+    version = "1.50.0";
   };
   rubocop-performance = {
     dependencies = [
@@ -1858,10 +1874,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1lg22fmcalwnzgnanswn5g7vc24wmancnvbyf1ynzb46vyj6bb7c";
+      sha256 = "0mzrk5dk8sx5z9xwfr2sf7rmvzp9n3f4rcghkms43h7ag5pzlv6b";
       type = "gem";
     };
-    version = "4.45.0";
+    version = "4.46.0";
   };
   simplecov = {
     dependencies = [
@@ -1916,10 +1932,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0jk50mjq69065ygdhkhbmxp9k2c7knizhp022ysq5xfyikjclqrn";
+      sha256 = "0kfbrd4sgajhnjwhqpk1mb4h10whfx2h5kb0i3j35yd3280cf0kx";
       type = "gem";
     };
-    version = "2.0.6";
+    version = "2.0.7";
   };
   sqlite3 = {
     dependencies = [ "mini_portile2" ];
@@ -1932,6 +1948,16 @@
     };
     version = "2.5.0";
   };
+  ssrf_filter = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1xlpb8y555frl82cx4q2i922mps36mmn0ajk21kpy3bks6wwsgg0";
+      type = "gem";
+    };
+    version = "1.5.0";
+  };
   stimulus-rails = {
     dependencies = [ "railties" ];
     groups = [ "default" ];
@@ -1943,20 +1969,6 @@
     };
     version = "1.3.4";
   };
-  stringio = {
-    groups = [
-      "default"
-      "development"
-      "test"
-    ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1q92y9627yisykyscv0bdsrrgyaajc2qr56dwlzx7ysgigjv4z63";
-      type = "gem";
-    };
-    version = "3.2.0";
-  };
   svg_optimizer = {
     dependencies = [ "nokogiri" ];
     groups = [
@@ -2120,10 +2132,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0gfv1qxfn202xffasw2mrrrf2jkdp6hsps0177k9fyc0fwb6k3xp";
+      sha256 = "04snz16b89rwmqjw6v7j8jwfqb2f8jrim631fl30cva1x73hcwvb";
       type = "gem";
     };
-    version = "1.1.12";
+    version = "1.1.14";
   };
   webrick = {
     groups = [ "default" ];
@@ -2157,10 +2169,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "15idgibqpdaj97f734drx8a7k1jcc8wvxlk2nbafac72ihikicjs";
+      sha256 = "0ij19k6034x0c4hw0ywa7wnk5s912r8aq0hhjss10d5z36q5dicp";
       type = "gem";
     };
-    version = "0.8.1";
+    version = "0.8.2";
   };
   websocket-extensions = {
     groups = [ "default" ];
@@ -2205,10 +2217,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0a3zi3v7qjm7lm4yp9z2sm959533k543sc4z0ixqik8wcfdpw27b";
+      sha256 = "0lfwngmsz3xq9k9la9890cqpm4vk3rda4171yzms7f3w7x4i3qjj";
       type = "gem";
     };
-    version = "0.9.44";
+    version = "0.9.45";
   };
   zeitwerk = {
     groups = [ "default" ];
diff --git a/pkgs/by-name/re/redmine/package.nix b/pkgs/by-name/re/redmine/package.nix
index aacda5507597..46eddf61225f 100644
--- a/pkgs/by-name/re/redmine/package.nix
+++ b/pkgs/by-name/re/redmine/package.nix
@@ -3,6 +3,7 @@
   lib,
   stdenvNoCC,
   fetchurl,
+  fetchpatch,
   bundlerEnv,
   ruby_3_4,
   makeWrapper,
@@ -72,6 +73,14 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     hash = "sha256-YdswCMf9GKOvxVntZW/Tj9+N+CIKxpWYsxkJUYMZC3o=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "update_rails_7_2_3_2.patch";
+      url = "https://github.com/redmine/redmine/commit/4817525723f7bd900f12ce8c16f05326c25cbadf.patch";
+      hash = "sha256-UYmaDnVNpuO0nZuuDHLecBd9rFkDq2jTCCX4Rm0xsB8=";
+    })
+  ];
+
   nativeBuildInputs = [ makeWrapper ];
   buildInputs = [
     rubyEnv

From e158351eed78d108701080d95941e7e0bef2e76a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?W=C3=B6lfchen?= <w-lfchen@posteo.net>
Date: Thu, 30 Jul 2026 19:45:56 +0200
Subject: [PATCH 21/57] obsidian: 1.12.7 -> 1.13.4

(cherry picked from commit 1f47dbe6f893d44adc238304fef440bee1d2343f)
---
 pkgs/by-name/ob/obsidian/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ob/obsidian/package.nix b/pkgs/by-name/ob/obsidian/package.nix
index ba5471ecedf0..155cec03b9e6 100644
--- a/pkgs/by-name/ob/obsidian/package.nix
+++ b/pkgs/by-name/ob/obsidian/package.nix
@@ -14,7 +14,7 @@
 }:
 let
   pname = "obsidian";
-  version = "1.12.7";
+  version = "1.13.4";
   appname = "Obsidian";
   meta = {
     description = "Powerful knowledge base that works on top of a local folder of plain text Markdown files";
@@ -41,17 +41,17 @@ let
   srcs = rec {
     x86_64-linux = fetchurl {
       url = "https://github.com/obsidianmd/obsidian-releases/releases/download/v${version}/obsidian-${version}.tar.gz";
-      hash = "sha256-/L4IsRHZwf2wm5wIlSsG4cgpxiFj66JYTEtOyFm+B50=";
+      hash = "sha256-66wkn5SbaJSBn7tLxWV+yIkvAGzv7ZVdNKbB/+Ji8Ws=";
     };
 
     aarch64-linux = fetchurl {
       url = "https://github.com/obsidianmd/obsidian-releases/releases/download/v${version}/obsidian-${version}-arm64.tar.gz";
-      hash = "sha256-a8hye/27bXMdWvmgb1HW3nBhxoyQjIrotDqe03miAmA=";
+      hash = "sha256-4tRNJjab0DXhrVj2MRMHP7eRtS9MJsziLO1jtJKnE24=";
     };
 
     x86_64-darwin = fetchurl {
       url = "https://github.com/obsidianmd/obsidian-releases/releases/download/v${version}/Obsidian-${version}.dmg";
-      hash = "sha256-O4XBO0zlVRLobhcKfNKklOLbaVrIiMBgHhU8uFt3iBs=";
+      hash = "sha256-6EuVlaul5QIhyX5D0+P0N0Fu379MSoTDeUYecPhU148=";
     };
 
     aarch64-darwin = x86_64-darwin;

From ae9e3fcd91265c0bdf28c318534e0f1fab83d76f Mon Sep 17 00:00:00 2001
From: Pascal Dietrich <cameo007@mintux.de>
Date: Thu, 16 Jul 2026 18:49:51 +0200
Subject: [PATCH 22/57] flatpak-builder: fix building with svg icons

(cherry picked from commit 449b91edfb1d63815dd825f356a94cb3dc446817)
---
 pkgs/development/tools/flatpak-builder/default.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/development/tools/flatpak-builder/default.nix b/pkgs/development/tools/flatpak-builder/default.nix
index 6699ce4d33d6..420f02811b3f 100644
--- a/pkgs/development/tools/flatpak-builder/default.nix
+++ b/pkgs/development/tools/flatpak-builder/default.nix
@@ -14,6 +14,9 @@
   xmlto,
   meson,
   ninja,
+  gnome,
+  librsvg,
+  makeWrapper,
 
   acl,
   appstream,
@@ -42,6 +45,11 @@
   attr,
 }:
 
+let
+  gdkPixbufLoadersCache = gnome._gdkPixbufCacheBuilder_DO_NOT_USE {
+    extraLoaders = [ librsvg ];
+  };
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "flatpak-builder";
   version = "1.4.4";
@@ -95,6 +103,7 @@ stdenv.mkDerivation (finalAttrs: {
     libxslt
     pkg-config
     xmlto
+    makeWrapper
   ];
 
   buildInputs = [
@@ -132,6 +141,7 @@ stdenv.mkDerivation (finalAttrs: {
       for file in ${installed_testdir}/{test-builder.sh,test-builder-python.sh,test-builder-deprecated.sh}; do
         patchShebangs $file
       done
+      wrapProgram $out/bin/flatpak-builder --set GDK_PIXBUF_MODULE_FILE ${gdkPixbufLoadersCache}
     '';
 
   passthru = {

From a440bcce6334599ff6d0a232ac35d956a88d0ffd Mon Sep 17 00:00:00 2001
From: lavecat <lirus12345.lave@gmail.com>
Date: Mon, 27 Jul 2026 12:34:06 +0200
Subject: [PATCH 23/57] mumble: 1.5.901 -> 1.5.915

(cherry picked from commit 62f7b06986f43d87a8a6e2e6d5b6c44b70c437ff)
---
 pkgs/applications/networking/mumble/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/mumble/default.nix b/pkgs/applications/networking/mumble/default.nix
index 604b5582985e..4b35a7438f79 100644
--- a/pkgs/applications/networking/mumble/default.nix
+++ b/pkgs/applications/networking/mumble/default.nix
@@ -218,14 +218,14 @@ let
     } source;
 
   source = rec {
-    version = "1.5.901";
+    version = "1.5.915";
 
     # Needs submodules
     src = fetchFromGitHub {
       owner = "mumble-voip";
       repo = "mumble";
       tag = "v${version}";
-      hash = "sha256-UBJH7EwfWvInuSD6ZALOKeVnWdfh/rmq8GVLG5URjOQ=";
+      hash = "sha256-pbO+V8p/vqn+jIFWvcHOKhpr1Nv0nXaHG9lFiMRTntM=";
       fetchSubmodules = true;
     };
   };

From 52c120aeca3277e79aa6cf76599a3715a460f002 Mon Sep 17 00:00:00 2001
From: Benjamin Levy <7348004+io12@users.noreply.github.com>
Date: Thu, 16 Jul 2026 07:19:08 -0400
Subject: [PATCH 24/57] mbedtls: fix cross build

(cherry picked from commit 4f116ee1e497d1b2f09195a75739ac974a66d8e6)
---
 pkgs/by-name/mb/mbedtls/generic.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/mb/mbedtls/generic.nix b/pkgs/by-name/mb/mbedtls/generic.nix
index fb3e445249a6..b74fe03e288e 100644
--- a/pkgs/by-name/mb/mbedtls/generic.nix
+++ b/pkgs/by-name/mb/mbedtls/generic.nix
@@ -5,6 +5,7 @@
   hash,
   patches ? [ ],
   fetchFromGitHub,
+  buildPackages,
 
   cmake,
   ninja,
@@ -87,6 +88,10 @@ stdenv.mkDerivation rec {
     "-DCMAKE_C_FLAGS=-fzero-init-padding-bits=unions"
   ];
 
+  env = lib.optionalAttrs (stdenv.buildPlatform != stdenv.hostPlatform) {
+    HOSTCC = lib.getExe buildPackages.stdenv.cc;
+  };
+
   doCheck = true;
 
   # Parallel checking causes test failures

From d8788af256e6494567b405aa4555db9ad2badf62 Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Mon, 27 Jul 2026 23:57:26 -0400
Subject: [PATCH 25/57] audiobookshelf: 2.35.1 -> 2.36.0

Changelog: https://github.com/advplyr/audiobookshelf/releases/tag/v2.36.0
(cherry picked from commit a1f194fce9c84a102232dbebaaa6e6c7a0f27ea0)
---
 pkgs/by-name/au/audiobookshelf/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/au/audiobookshelf/package.nix b/pkgs/by-name/au/audiobookshelf/package.nix
index f3d438f9e441..d3ca939b161a 100644
--- a/pkgs/by-name/au/audiobookshelf/package.nix
+++ b/pkgs/by-name/au/audiobookshelf/package.nix
@@ -15,10 +15,10 @@
 
 let
   source = {
-    version = "2.35.1";
-    hash = "sha256-31cKSjSTJyUetjCSOCDY2wnTFV+Z52LcvGrh7Emc0cM=";
-    npmDepsHash = "sha256-wmbzbMQHrbHcL9JSpPXpc+vjjj5LTNN8e6Ug3ZRQ7mo=";
-    clientNpmDepsHash = "sha256-wJdCvUVLZzCY3iW/Q7QVuRu96s49TehnuQNqbImbe0g=";
+    version = "2.36.0";
+    hash = "sha256-oohjRiKARpIyoPFEXR24nlKK4xBBEHUMVTaq/i6NfV8=";
+    npmDepsHash = "sha256-uDIL9PxbFUa3MwLoPomTfq1A/R1ewDIv+EFWml/8uy8=";
+    clientNpmDepsHash = "sha256-0xqqpls8FLuXngjjdwjoNLpq9dSixWouROviTjsFCbU=";
   };
 
   src = fetchFromGitHub {

From ce0410faf3df90534b3d844073217b645d7105c9 Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Sat, 1 Aug 2026 20:28:37 -0400
Subject: [PATCH 26/57] ci/github-script/get-pr-commit-details: output file
 list for merge commits

Fixes a bug that was originally found by Claude and reported to the NixOS
security team by Anthropic as a security issue.

Previously, the file list was never output for merge commits.

This could have allowed someone who buried an edit to a file that shouldn't be
edited manually in a merge commit to not trigger the check.

It isn't a security issue, though, because the manual-file-edits check is not
a security boundary (just a friendly reminder to committers).

Anthropic report ID: ANT-2026-223Q3FSE

(cherry picked from commit e7804286db15fd0b296b58e64ed3f181a03f4b44)
---
 ci/github-script/get-pr-commit-details.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/ci/github-script/get-pr-commit-details.js b/ci/github-script/get-pr-commit-details.js
index b268e7cf6202..5841bb8177eb 100644
--- a/ci/github-script/get-pr-commit-details.js
+++ b/ci/github-script/get-pr-commit-details.js
@@ -84,6 +84,7 @@ async function getCommitDetailsForPR({ core, pr, repoPath }) {
             'log',
             '--format=%s\t%aN\t%aE\t%cN\t%cE',
             '--name-only',
+            '-m',
             '-1',
             sha,
           ],

From 939d0f3039a001dd0d21e3574c38a78f93ee1032 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 2 Aug 2026 05:20:56 +0200
Subject: [PATCH 27/57] kanidm_1_10: 1.10.4 -> 1.10.5

https://github.com/kanidm/kanidm/releases/tag/v1.10.5
https://github.com/kanidm/kanidm/security/advisories/GHSA-2pm5-6m23-h692

Fixes: GHSA-2pm5-6m23-h692
(cherry picked from commit 1bb58b274f3d0067bb462b1fb42e8c844f0b4712)
---
 pkgs/servers/kanidm/1_10.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/kanidm/1_10.nix b/pkgs/servers/kanidm/1_10.nix
index 079ef35443be..543296dd86f3 100644
--- a/pkgs/servers/kanidm/1_10.nix
+++ b/pkgs/servers/kanidm/1_10.nix
@@ -1,5 +1,5 @@
 import ./generic.nix {
-  version = "1.10.4";
-  hash = "sha256-+PutvVt7mqnZN+/vr0FwstB8JPuO3kJ4TSmX2Sx8WvA=";
-  cargoHash = "sha256-rfANfheiQnHEcbBODRW0nrPrlPdWQx3S7NmSQ50q010=";
+  version = "1.10.5";
+  hash = "sha256-mNdG5iPtnhwvy9PABaRPV6KQfvD+/ZKH2hC6Hfo0y48=";
+  cargoHash = "sha256-UE/jZaX/mEJUHBqsk2o0rBcocpoFg5XWAmVk4smm5mc=";
 }

From 644a3c1adada32b9eb57a999d7251a9733bcc99c Mon Sep 17 00:00:00 2001
From: kataokatsuki <kataokatsuki@users.noreply.github.com>
Date: Mon, 27 Jul 2026 12:09:10 +0900
Subject: [PATCH 28/57] nodejs: fix cross-compilation

configureScript interpolates python.interpreter, which resolves to the
hostPlatform interpreter. When cross-compiling, that binary cannot be executed
on the build platform:

  /nix/store/...-python3-aarch64-unknown-linux-musl-3.13.14/bin/python3.13:
  cannot execute binary file: Exec format error

python is also listed in nativeBuildInputs, where splicing substitutes the
buildPackages variant. The previous python.executable was a bare basename, so
it resolved to that build-platform interpreter through PATH.

Use python.pythonOnBuildForHost.interpreter, which refers to the same
derivation that nativeBuildInputs puts on PATH. For native builds the value is
unchanged.

(cherry picked from commit a976d21b1bff4f1a00550b41c3c6eac110644907)
---
 pkgs/development/web/nodejs/nodejs.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index 2b8d3d51efaa..3eac6698f68c 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -348,7 +348,7 @@ let
 
       dontDisableStatic = true;
 
-      configureScript = "${python.interpreter} configure.py";
+      configureScript = "${python.pythonOnBuildForHost.interpreter} configure.py";
 
       # In order to support unsupported cross configurations, we copy some intermediate executables
       # from a native build and replace all the build-system tools with a script which simply touches

From b20a059b80657429b9cad8d0d5bb06b6f1a0c491 Mon Sep 17 00:00:00 2001
From: Tom Herbers <mail@tomherbers.de>
Date: Fri, 31 Jul 2026 09:06:14 +0200
Subject: [PATCH 29/57] bird2: 2.19.1 -> 2.19.2

Diff: https://gitlab.nic.cz/labs/bird/-/compare/v2.19.1...v2.19.2

Changelog: https://gitlab.nic.cz/labs/bird/-/blob/v2.19.2/NEWS
(cherry picked from commit 1d1ea4a077a5dd0684d656246bf50e4a78e182c2)
---
 pkgs/by-name/bi/bird2/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/bi/bird2/package.nix b/pkgs/by-name/bi/bird2/package.nix
index f369d84034c3..0cc747099316 100644
--- a/pkgs/by-name/bi/bird2/package.nix
+++ b/pkgs/by-name/bi/bird2/package.nix
@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bird";
-  version = "2.19.1";
+  version = "2.19.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.nic.cz";
     owner = "labs";
     repo = "bird";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8D83U9IgNQ0HDWk2WSQsRsy82bDmjkgectkCOXy2RyI=";
+    hash = "sha256-5C7hVUWy5QOD2r0Qcu2b2j+xxRek8NsYoWgeRm2Exis=";
   };
 
   nativeBuildInputs = [

From ec862f18a0295f72fc0a111635c9aa08163ccb58 Mon Sep 17 00:00:00 2001
From: Tom Herbers <mail@tomherbers.de>
Date: Fri, 31 Jul 2026 09:06:14 +0200
Subject: [PATCH 30/57] bird3: 3.3.1 -> 3.3.2

Diff: https://gitlab.nic.cz/labs/bird/-/compare/v3.3.1...v3.3.2

Changelog: https://gitlab.nic.cz/labs/bird/-/blob/v3.3.2/NEWS
(cherry picked from commit fb7525623abc2d0fb366ac1302995a17c4442719)
---
 pkgs/by-name/bi/bird3/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/bi/bird3/package.nix b/pkgs/by-name/bi/bird3/package.nix
index 4ca4633c9efd..9f84375e3648 100644
--- a/pkgs/by-name/bi/bird3/package.nix
+++ b/pkgs/by-name/bi/bird3/package.nix
@@ -12,14 +12,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "bird";
-  version = "3.3.1";
+  version = "3.3.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.nic.cz";
     owner = "labs";
     repo = "bird";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-aJo6Ut/ULBDGoekSXgN1WvmFmonTzNA3TES1FHqCiOM=";
+    hash = "sha256-qrzi8uYZiohpIRosdPQXxnDu6fP3V9i8PPo8BV8XTZI=";
   };
 
   nativeBuildInputs = [

From 8bb66529dd3f94080b16a4cab6bae988d60ebf3b Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sat, 1 Aug 2026 00:57:42 +0200
Subject: [PATCH 31/57] php82: 8.2.32 -> 8.2.33

ChangeLog: https://www.php.net/ChangeLog-8.php#8.2.33
(cherry picked from commit 9773f194efe10d861c6542834774644bcb76bd87)
---
 pkgs/development/interpreters/php/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/php/default.nix b/pkgs/development/interpreters/php/default.nix
index cf28c8a48e0b..9bf0d8761376 100644
--- a/pkgs/development/interpreters/php/default.nix
+++ b/pkgs/development/interpreters/php/default.nix
@@ -69,8 +69,8 @@ let
 in
 {
   php82 = mkPhp {
-    version = "8.2.32";
-    hash = "sha256-jyHpiMpN1eFN2fuImIRIeENWbkhygAJ8Tvq2yTGIotE=";
+    version = "8.2.33";
+    hash = "sha256-U2Lyp6DnFoznIv6gBIsaHSjg98wmXEF99nDGVnBpUBg=";
   };
   php83 = mkPhp {
     version = "8.3.32";

From 17c9d3e8038d5ea54ae48b83cebf9269ec748109 Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sat, 1 Aug 2026 00:58:41 +0200
Subject: [PATCH 32/57] php83: 8.3.32 -> 8.3.33

ChangeLog: https://www.php.net/ChangeLog-8.php#8.3.33
(cherry picked from commit cdf784fede52ed08784de29b5476e4b997032b3d)
---
 pkgs/development/interpreters/php/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/php/default.nix b/pkgs/development/interpreters/php/default.nix
index 9bf0d8761376..07d60a3142b2 100644
--- a/pkgs/development/interpreters/php/default.nix
+++ b/pkgs/development/interpreters/php/default.nix
@@ -73,8 +73,8 @@ in
     hash = "sha256-U2Lyp6DnFoznIv6gBIsaHSjg98wmXEF99nDGVnBpUBg=";
   };
   php83 = mkPhp {
-    version = "8.3.32";
-    hash = "sha256-93fKJGYZZvlLMfaEDNrUN88wUBU324uHKxt6HCRLjQI=";
+    version = "8.3.33";
+    hash = "sha256-+cn00M12ksbj2jY81MpyqCakmuGPXtQwtvyue8KIHhg=";
   };
   php84 = mkPhp {
     version = "8.4.23";

From a61a28c52f28ff3e7d125f1ead3ef21447572bbc Mon Sep 17 00:00:00 2001
From: Maximilian Bosch <maximilian@mbosch.me>
Date: Sat, 1 Aug 2026 00:59:11 +0200
Subject: [PATCH 33/57] php84: 8.4.23 -> 8.4.24

ChangeLog: https://www.php.net/ChangeLog-8.php#8.4.24
(cherry picked from commit 48830883bbb39302c0bb9f579259ae46850d01b2)
---
 pkgs/development/interpreters/php/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/php/default.nix b/pkgs/development/interpreters/php/default.nix
index 07d60a3142b2..28d68b002166 100644
--- a/pkgs/development/interpreters/php/default.nix
+++ b/pkgs/development/interpreters/php/default.nix
@@ -77,8 +77,8 @@ in
     hash = "sha256-+cn00M12ksbj2jY81MpyqCakmuGPXtQwtvyue8KIHhg=";
   };
   php84 = mkPhp {
-    version = "8.4.23";
-    hash = "sha256-wULAY7EM/2jQcnZuP/v7NlSgibk4ZosIMDVkN+6V4Po=";
+    version = "8.4.24";
+    hash = "sha256-KGiQRHWIUQ3xEO3p6c4J8etPmFZjC0f9xA7OcOIDc88=";
   };
   php85 = mkPhp {
     version = "8.5.9";

From f59cbc3cba018d64cfbcd262c200ea14c074876f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 2 Aug 2026 04:13:46 +0000
Subject: [PATCH 34/57] protoc-gen-grpc-java: 1.83.0 -> 1.83.1

(cherry picked from commit feada5b8ffb64704f719021d81dc727786575f3d)
---
 pkgs/by-name/pr/protoc-gen-grpc-java/data.nix | 20 +++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix b/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix
index c5138c78a579..57a89ebec642 100644
--- a/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix
+++ b/pkgs/by-name/pr/protoc-gen-grpc-java/data.nix
@@ -1,14 +1,14 @@
 {
-  version = "1.83.0";
+  version = "1.83.1";
   hashes = {
-    linux-aarch_64 = "sha256-Nwnk4Upg8VZCVbR/bpJDct/wI6GGaTICK+Sh711ZVEM=";
-    linux-ppcle_64 = "sha256-xUwugnrRQQqEkupYFh7SPtqtNmXmNCjAE+msHskmPXY=";
-    linux-s390_64 = "sha256-hj+QMaSxtX+hs6G5qCxf7ON2bDvpEGovt9iuVFwsXAQ=";
-    linux-x86_32 = "sha256-qJ034I7Im1pEn5u6W16y662y4+d7ZpB9EQtd7hkSCG4=";
-    linux-x86_64 = "sha256-oZrnSqTLA+HQEmlWKsYWXsMqhIp769AyrqmguVaXGLo=";
-    osx-aarch_64 = "sha256-w+3q+DtvfVzsqm9PfeMq6WyUn0jJorp0NngnH6HQh3I=";
-    osx-x86_64 = "sha256-w+3q+DtvfVzsqm9PfeMq6WyUn0jJorp0NngnH6HQh3I=";
-    windows-x86_32 = "sha256-fwDjhD8Jhy7M7qPSc8vJSUA8H/OhWeOyV/69uuZX+9Y=";
-    windows-x86_64 = "sha256-MER2cr8kaMO3zVTLujYr4jPX8jcbBqbHf9/Fxb0CbJY=";
+    linux-aarch_64 = "sha256-WvVUQ2m9hVcRGr++0hRTu2+oZ78yol8v/l9yNm5wXO8=";
+    linux-ppcle_64 = "sha256-X3+mYub01d3mwGZ6aNRfXSxfjNE2Tw1+xETUc/jC9Oc=";
+    linux-s390_64 = "sha256-CgdF8/0GCb/P8sUCMCdxByqHeD86PN6P4V1q9SbPLPs=";
+    linux-x86_32 = "sha256-N8xukQz+zPnnTi8RaELXjiP/PoT+ZBemSjvoXjp49R8=";
+    linux-x86_64 = "sha256-20BE54OR1aI0ORQ8gUfwe6WHdnVYe01I87aPvuOJNYk=";
+    osx-aarch_64 = "sha256-Ny4TslywWOpuOrbLVLoUWNXSu+HP3NN7xX6CuHJlbiE=";
+    osx-x86_64 = "sha256-Ny4TslywWOpuOrbLVLoUWNXSu+HP3NN7xX6CuHJlbiE=";
+    windows-x86_32 = "sha256-DdroVwr0NVeFGrM0JxnqfRJFXx1j3DVhGrEzTyJ6++8=";
+    windows-x86_64 = "sha256-9GVLC44frt+Jf0q811TFJQy0iv4H1ZXlbvyftHhzbHM=";
   };
 }

From 9a35d5091dbde558f92ea9f3853f979a28b16447 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Sun, 2 Aug 2026 05:24:15 -0700
Subject: [PATCH 35/57] nixos/limine: don't read all of /nix/store during
 installation

The installer being placed directly at (e.g.)
/nix/store/272h8d4df6by64ycl3s01bixrcaq5a9a-limine-install.py causes
Python to search the script's directory for imports if -P is not added,
so add -P to avoid Python automatically adding /nix/store to the script's
sys.path.

From the python manpage:

> -P: Don't automatically prepend a potentially unsafe path to sys.path
> such as the current directory, the script's directory or an empty string.
> See also the PYTHONSAFEPATH environment variable.

(cherry picked from commit 764a4ebdf25b051f3e937840e1c60526c9f0a0ea)
---
 nixos/modules/system/boot/loader/limine/limine-install.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/system/boot/loader/limine/limine-install.py b/nixos/modules/system/boot/loader/limine/limine-install.py
index 7b2e263e401e..4c9db91ad65d 100644
--- a/nixos/modules/system/boot/loader/limine/limine-install.py
+++ b/nixos/modules/system/boot/loader/limine/limine-install.py
@@ -1,4 +1,4 @@
-#!@python3@/bin/python3 -B
+#!@python3@/bin/python3 -BP
 
 from dataclasses import dataclass
 from typing import Any, Callable, Dict, List, Optional, Tuple

From b187044cafb9be619072b53e3671cd6850aeb96a Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 2 Aug 2026 15:49:28 +0200
Subject: [PATCH 36/57] zigbee2mqtt: 2.12.1 -> 2.13.0

https://github.com/Koenkk/zigbee2mqtt/releases/tag/2.13.0
(cherry picked from commit bdb1f1c194eaa65129ecd7b1fd5cfde7c9a4a832)
---
 pkgs/by-name/zi/zigbee2mqtt/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/zi/zigbee2mqtt/package.nix b/pkgs/by-name/zi/zigbee2mqtt/package.nix
index ddf527f7b93e..c73b8df14224 100644
--- a/pkgs/by-name/zi/zigbee2mqtt/package.nix
+++ b/pkgs/by-name/zi/zigbee2mqtt/package.nix
@@ -14,20 +14,20 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "zigbee2mqtt";
-  version = "2.12.1";
+  version = "2.13.0";
 
   src = fetchFromGitHub {
     owner = "Koenkk";
     repo = "zigbee2mqtt";
     tag = finalAttrs.version;
-    hash = "sha256-DTL27AcPmAI5XEEHb2S74LYWm4f6kUASsTmQeGftDzM=";
+    hash = "sha256-JSmJXjEF0dQ1sWyXvtLmN9gfAg3PjXWPOlb7xCxz8RI=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 4;
-    hash = "sha256-RI6tz8pyqYg/L6wSc0Rt5ZqHT8aktReyVjNgISPqKRQ=";
+    hash = "sha256-5S3VnPxR7P4dwXcFQSjNbTJ5KOWteb4ZBpTy7gtoY4I=";
   };
 
   nativeBuildInputs = [

From e2f8026940a0a865771f603bcbd5e782e48d4c47 Mon Sep 17 00:00:00 2001
From: Tom Herbers <mail@tomherbers.de>
Date: Sun, 2 Aug 2026 08:42:19 +0200
Subject: [PATCH 37/57] kanidm_1_11: init at 1.11.0

Changelog: https://github.com/kanidm/kanidm/releases/tag/v1.11.0
(cherry picked from commit c2d890f46320fd8ce5f6c84bb2b426c719a7ecb8)
---
 nixos/tests/kanidm-provisioning.nix           |   2 +-
 nixos/tests/kanidm.nix                        |   2 +-
 pkgs/servers/kanidm/1_10.nix                  |   1 +
 pkgs/servers/kanidm/1_11.nix                  |   5 +
 pkgs/servers/kanidm/generic.nix               |  13 +-
 .../1_11/oauth2-basic-secret-modify.patch     | 159 ++++++++++++++++++
 .../1_11/recover-account.patch                | 128 ++++++++++++++
 pkgs/top-level/all-packages.nix               |   6 +
 8 files changed, 312 insertions(+), 4 deletions(-)
 create mode 100644 pkgs/servers/kanidm/1_11.nix
 create mode 100644 pkgs/servers/kanidm/provision-patches/1_11/oauth2-basic-secret-modify.patch
 create mode 100644 pkgs/servers/kanidm/provision-patches/1_11/recover-account.patch

diff --git a/nixos/tests/kanidm-provisioning.nix b/nixos/tests/kanidm-provisioning.nix
index 133bd0d10cb2..78b0ff5ad05c 100644
--- a/nixos/tests/kanidm-provisioning.nix
+++ b/nixos/tests/kanidm-provisioning.nix
@@ -18,7 +18,7 @@ in
   name = "kanidm-provisioning-${kanidmPackage.version}";
   meta.maintainers = with pkgs.lib.maintainers; [ oddlama ];
 
-  _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidmWithSecretProvisioning_1_10;
+  _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidmWithSecretProvisioning_1_11;
 
   nodes.provision =
     { pkgs, lib, ... }:
diff --git a/nixos/tests/kanidm.nix b/nixos/tests/kanidm.nix
index 1d17d84908cf..3eaa6d0ab5bf 100644
--- a/nixos/tests/kanidm.nix
+++ b/nixos/tests/kanidm.nix
@@ -22,7 +22,7 @@ in
     oddlama
   ];
 
-  _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidm_1_10;
+  _module.args.kanidmPackage = pkgs.lib.mkDefault pkgs.kanidm_1_11;
 
   nodes.server =
     { pkgs, ... }:
diff --git a/pkgs/servers/kanidm/1_10.nix b/pkgs/servers/kanidm/1_10.nix
index 543296dd86f3..7601a72038eb 100644
--- a/pkgs/servers/kanidm/1_10.nix
+++ b/pkgs/servers/kanidm/1_10.nix
@@ -2,4 +2,5 @@ import ./generic.nix {
   version = "1.10.5";
   hash = "sha256-mNdG5iPtnhwvy9PABaRPV6KQfvD+/ZKH2hC6Hfo0y48=";
   cargoHash = "sha256-UE/jZaX/mEJUHBqsk2o0rBcocpoFg5XWAmVk4smm5mc=";
+  eolDate = "2026-08-31";
 }
diff --git a/pkgs/servers/kanidm/1_11.nix b/pkgs/servers/kanidm/1_11.nix
new file mode 100644
index 000000000000..c06b30750207
--- /dev/null
+++ b/pkgs/servers/kanidm/1_11.nix
@@ -0,0 +1,5 @@
+import ./generic.nix {
+  version = "1.11.0";
+  hash = "sha256-3dcJxJx8UFebW6WMdVTH6kfsNBed+55JFwHWVhZulOU=";
+  cargoHash = "sha256-qOs/uSs3iaiTGsqydpNbZ6KSLNE+k+5bM7k3ijRzNT0=";
+}
diff --git a/pkgs/servers/kanidm/generic.nix b/pkgs/servers/kanidm/generic.nix
index fcd8c3e543a9..9c5ee6266aa0 100644
--- a/pkgs/servers/kanidm/generic.nix
+++ b/pkgs/servers/kanidm/generic.nix
@@ -91,14 +91,23 @@ rustPlatform.buildRustPackage (finalAttrs: {
       // lib.optionalAttrs (lib.versionAtLeast finalAttrs.version "1.9") {
         server_migration_path = "/etc/kanidm/migrations.d";
       };
+      # lower required rust-version in Cargo.toml to allow backporting
+      rustVersion =
+        if lib.versionAtLeast finalAttrs.version "1.11" then
+          {
+            from = "1.96";
+            to = "1.95";
+          }
+        else
+          null;
     in
     ''
       cp ${format profile} libs/profiles/${finalAttrs.env.KANIDM_BUILD_PROFILE}.toml
       substituteInPlace libs/profiles/${finalAttrs.env.KANIDM_BUILD_PROFILE}.toml --replace-fail '@htmx_ui_pkg_path@' "$out/ui/hpkg"
     ''
-    + lib.optionalString (lib.versionAtLeast finalAttrs.version "1.9") ''
+    + lib.optionalString (rustVersion != null) ''
       substituteInPlace Cargo.toml \
-        --replace-fail 'rust-version = "1.93"' 'rust-version = "1.91"'
+        --replace-fail 'rust-version = "${rustVersion.from}"' 'rust-version = "${rustVersion.to}"'
     '';
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/kanidm/provision-patches/1_11/oauth2-basic-secret-modify.patch b/pkgs/servers/kanidm/provision-patches/1_11/oauth2-basic-secret-modify.patch
new file mode 100644
index 000000000000..5101273d30d1
--- /dev/null
+++ b/pkgs/servers/kanidm/provision-patches/1_11/oauth2-basic-secret-modify.patch
@@ -0,0 +1,159 @@
+From 5b97267c49def10f5a4b7bb372963261c0f4b08d Mon Sep 17 00:00:00 2001
+From: oddlama <oddlama@oddlama.org>
+Date: Fri, 1 May 2026 15:01:05 +0200
+Subject: [PATCH 1/2] oauth2 basic secret modify
+
+---
+ server/core/src/actors/v1_write.rs  | 42 +++++++++++++++++++++++++++++
+ server/core/src/https/v1.rs         |  6 ++++-
+ server/core/src/https/v1_oauth2.rs  | 29 ++++++++++++++++++++
+ server/lib/src/server/migrations.rs | 16 +++++++++++
+ 4 files changed, 92 insertions(+), 1 deletion(-)
+
+diff --git a/server/core/src/actors/v1_write.rs b/server/core/src/actors/v1_write.rs
+index 977292ae9..bf79c42a1 100644
+--- a/server/core/src/actors/v1_write.rs
++++ b/server/core/src/actors/v1_write.rs
+@@ -326,6 +326,48 @@ impl QueryServerWriteV1 {
+             .and_then(|_| idms_prox_write.commit().map(|_| ()))
+     }
+ 
++    #[instrument(
++        level = "info",
++        skip_all,
++        fields(uuid = ?eventid)
++    )]
++    pub async fn handle_oauth2_basic_secret_write(
++        &self,
++        client_auth_info: ClientAuthInfo,
++        filter: Filter<FilterInvalid>,
++        new_secret: String,
++        eventid: Uuid,
++    ) -> Result<(), OperationError> {
++        // Given a protoEntry, turn this into a modification set.
++        let ct = duration_from_epoch_now();
++        let mut idms_prox_write = self.idms.proxy_write(ct).await?;
++        let ident = idms_prox_write
++            .validate_client_auth_info_to_ident(client_auth_info, ct)
++            .map_err(|e| {
++                admin_error!(err = ?e, "Invalid identity");
++                e
++            })?;
++
++        let modlist = ModifyList::new_purge_and_set(
++            Attribute::OAuth2RsBasicSecret,
++            Value::SecretValue(new_secret),
++        );
++
++        let mdf =
++            ModifyEvent::from_internal_parts(ident, &modlist, &filter, &idms_prox_write.qs_write)
++                .map_err(|e| {
++                admin_error!(err = ?e, "Failed to begin modify during handle_oauth2_basic_secret_write");
++                e
++            })?;
++
++        trace!(?mdf, "Begin modify event");
++
++        idms_prox_write
++            .qs_write
++            .modify(&mdf)
++            .and_then(|_| idms_prox_write.commit())
++    }
++
+     #[instrument(
+         level = "info",
+         skip_all,
+diff --git a/server/core/src/https/v1.rs b/server/core/src/https/v1.rs
+index ba3ea2827..489ce0002 100644
+--- a/server/core/src/https/v1.rs
++++ b/server/core/src/https/v1.rs
+@@ -10,7 +10,7 @@ use axum::extract::{Path, State};
+ use axum::http::{HeaderMap, HeaderValue};
+ use axum::middleware::from_fn;
+ use axum::response::{IntoResponse, Response};
+-use axum::routing::{delete, get, post, put};
++use axum::routing::{delete, get, post, put, patch};
+ use axum::{Extension, Json, Router};
+ use axum_extra::extract::cookie::{Cookie, CookieJar, SameSite};
+ use compact_jwt::{Jwk, Jws, JwsSigner};
+@@ -3156,6 +3156,10 @@ pub(crate) fn route_setup(state: ServerState) -> Router<ServerState> {
+             "/v1/oauth2/{rs_name}/_basic_secret",
+             get(super::v1_oauth2::oauth2_id_get_basic_secret),
+         )
++        .route(
++            "/v1/oauth2/{rs_name}/_basic_secret",
++            patch(super::v1_oauth2::oauth2_id_patch_basic_secret),
++        )
+         .route(
+             "/v1/oauth2/{rs_name}/_scopemap/{group}",
+             post(super::v1_oauth2::oauth2_id_scopemap_post)
+diff --git a/server/core/src/https/v1_oauth2.rs b/server/core/src/https/v1_oauth2.rs
+index fdc3647b4..ed4709d27 100644
+--- a/server/core/src/https/v1_oauth2.rs
++++ b/server/core/src/https/v1_oauth2.rs
+@@ -149,6 +149,35 @@ pub(crate) async fn oauth2_id_get_basic_secret(
+         .map_err(WebError::from)
+ }
+ 
++#[utoipa::path(
++    patch,
++    path = "/v1/oauth2/{rs_name}/_basic_secret",
++    request_body=ProtoEntry,
++    responses(
++        DefaultApiResponse,
++    ),
++    security(("token_jwt" = [])),
++    tag = "v1/oauth2",
++    operation_id = "oauth2_id_patch_basic_secret"
++)]
++/// Overwrite the basic secret for a given OAuth2 Resource Server.
++#[instrument(level = "info", skip(state, new_secret))]
++pub(crate) async fn oauth2_id_patch_basic_secret(
++    State(state): State<ServerState>,
++    Extension(kopid): Extension<KOpId>,
++    VerifiedClientInformation(client_auth_info): VerifiedClientInformation,
++    Path(rs_name): Path<String>,
++    Json(new_secret): Json<String>,
++) -> Result<Json<()>, WebError> {
++    let filter = oauth2_id(&rs_name);
++    state
++        .qe_w_ref
++        .handle_oauth2_basic_secret_write(client_auth_info, filter, new_secret, kopid.eventid)
++        .await
++        .map(Json::from)
++        .map_err(WebError::from)
++}
++
+ #[utoipa::path(
+     patch,
+     path = "/v1/oauth2/{rs_name}",
+diff --git a/server/lib/src/server/migrations.rs b/server/lib/src/server/migrations.rs
+index b3effb95b..5c6a56d24 100644
+--- a/server/lib/src/server/migrations.rs
++++ b/server/lib/src/server/migrations.rs
+@@ -220,6 +220,22 @@ impl QueryServer {
+             reload_required = true;
+         };
+ 
++        // secret provisioning: allow idm_admin to modify OAuth2RsBasicSecret.
++        write_txn.internal_modify_uuid(
++            UUID_IDM_ACP_OAUTH2_MANAGE_V1,
++            &ModifyList::new_append(
++                Attribute::AcpCreateAttr,
++                Attribute::OAuth2RsBasicSecret.into(),
++            ),
++        )?;
++        write_txn.internal_modify_uuid(
++            UUID_IDM_ACP_OAUTH2_MANAGE_V1,
++            &ModifyList::new_append(
++                Attribute::AcpModifyPresentAttr,
++                Attribute::OAuth2RsBasicSecret.into(),
++            ),
++        )?;
++
+         // Execute whatever operations we have batched up and ready to go. This is needed
+         // to preserve ordering of the operations - if we reloaded after a remigrate then
+         // we would have skipped the patch level fix which needs to have occurred *first*.
+-- 
+2.53.0
+
diff --git a/pkgs/servers/kanidm/provision-patches/1_11/recover-account.patch b/pkgs/servers/kanidm/provision-patches/1_11/recover-account.patch
new file mode 100644
index 000000000000..a462c14d5d1c
--- /dev/null
+++ b/pkgs/servers/kanidm/provision-patches/1_11/recover-account.patch
@@ -0,0 +1,128 @@
+From e8cd69afcee9d8d37233fa998cf9d1fa124ae90d Mon Sep 17 00:00:00 2001
+From: oddlama <oddlama@oddlama.org>
+Date: Fri, 1 May 2026 15:01:14 +0200
+Subject: [PATCH 2/2] recover account
+
+---
+ server/core/src/actors/internal.rs |  5 +++--
+ server/core/src/admin.rs           |  6 +++---
+ server/daemon/src/main.rs          | 24 +++++++++++++++++++++++-
+ server/daemon/src/opt.rs           |  7 +++++++
+ 4 files changed, 36 insertions(+), 6 deletions(-)
+
+diff --git a/server/core/src/actors/internal.rs b/server/core/src/actors/internal.rs
+index deed7350d..f4e9e486a 100644
+--- a/server/core/src/actors/internal.rs
++++ b/server/core/src/actors/internal.rs
+@@ -189,17 +189,18 @@ impl QueryServerWriteV1 {
+ 
+     #[instrument(
+         level = "info",
+-        skip(self, eventid),
++        skip(self, password, eventid),
+         fields(uuid = ?eventid)
+     )]
+     pub(crate) async fn handle_admin_recover_account(
+         &self,
+         name: String,
++        password: Option<String>,
+         eventid: Uuid,
+     ) -> Result<String, OperationError> {
+         let ct = duration_from_epoch_now();
+         let mut idms_prox_write = self.idms.proxy_write(ct).await?;
+-        let pw = idms_prox_write.recover_account(name.as_str(), None)?;
++        let pw = idms_prox_write.recover_account(name.as_str(), password.as_deref())?;
+ 
+         idms_prox_write.commit().map(|()| pw)
+     }
+diff --git a/server/core/src/admin.rs b/server/core/src/admin.rs
+index 6a13dcaab..6b1070113 100644
+--- a/server/core/src/admin.rs
++++ b/server/core/src/admin.rs
+@@ -27,7 +27,7 @@ const REPL_CTRL_TIMEOUT: Duration = Duration::from_secs(15);
+ 
+ #[derive(Serialize, Deserialize, Debug)]
+ pub enum AdminTaskRequest {
+-    RecoverAccount { name: String },
++    RecoverAccount { name: String, password: Option<String> },
+     DisableAccount { name: String },
+     ShowReplicationCertificate,
+     ShowReplicationCertificateMetadata,
+@@ -416,8 +416,8 @@ async fn handle_client(
+ 
+         let resp = async {
+             match req {
+-                AdminTaskRequest::RecoverAccount { name } => {
+-                    match server_rw.handle_admin_recover_account(name, eventid).await {
++                AdminTaskRequest::RecoverAccount { name, password } => {
++                    match server_rw.handle_admin_recover_account(name, password, eventid).await {
+                         Ok(password) => AdminTaskResponse::RecoverAccount { password },
+                         Err(e) => {
+                             error!(err = ?e, "error during recover-account");
+diff --git a/server/daemon/src/main.rs b/server/daemon/src/main.rs
+index 13653a5cb..ae560f9ce 100644
+--- a/server/daemon/src/main.rs
++++ b/server/daemon/src/main.rs
+@@ -380,11 +380,32 @@ fn check_file_ownership(opt: &KanidmdParser) -> Result<(), ExitCode> {
+ 
+ async fn scripting_command(cmd: ScriptingCommand, config: Configuration) -> ExitCode {
+     match cmd {
+-        ScriptingCommand::RecoverAccount { name } => {
++        ScriptingCommand::RecoverAccount { name, from_environment } => {
++            let password = if from_environment {
++                match std::env::var("KANIDM_RECOVER_ACCOUNT_PASSWORD_FILE") {
++                    Ok(path) => match tokio::fs::read_to_string(&path).await {
++                        Ok(contents) => Some(contents),
++                        Err(e) => {
++                            error!("Failed to read password file '{}': {}", path, e);
++                            return ExitCode::FAILURE;
++                        }
++                    },
++                    Err(_) => match std::env::var("KANIDM_RECOVER_ACCOUNT_PASSWORD") {
++                        Ok(val) => Some(val),
++                        Err(_) => {
++                            error!("Neither KANIDM_RECOVER_ACCOUNT_PASSWORD_FILE nor KANIDM_RECOVER_ACCOUNT_PASSWORD was set");
++                            return ExitCode::FAILURE;
++                        }
++                    }
++                }
++            } else {
++                None
++            };
+             submit_admin_req_json(
+                 config.adminbindpath.as_str(),
+                 AdminTaskRequest::RecoverAccount {
+                     name: name.to_owned(),
++                    password,
+                 },
+             )
+             .await;
+@@ -1008,6 +1029,7 @@ async fn kanidm_main(config: Configuration, opt: KanidmdParser) -> ExitCode {
+                 config.adminbindpath.as_str(),
+                 AdminTaskRequest::RecoverAccount {
+                     name: name.to_owned(),
++                    password: None,
+                 },
+             )
+             .await;
+diff --git a/server/daemon/src/opt.rs b/server/daemon/src/opt.rs
+index 524ba3134..fa3d70f44 100644
+--- a/server/daemon/src/opt.rs
++++ b/server/daemon/src/opt.rs
+@@ -128,6 +128,13 @@ enum ScriptingCommand {
+         #[clap(value_parser)]
+         /// The account name to recover credentials for.
+         name: String,
++        /// Use a password given via an environment variable.
++        /// - `KANIDM_RECOVER_ACCOUNT_PASSWORD_FILE` takes precedence and reads the desired
++        ///    password from the given file
++        /// - `KANIDM_RECOVER_ACCOUNT_PASSWORD` directly takes a
++        ///    password - beware that this will leave the password in the environment
++        #[clap(long = "from-environment")]
++        from_environment: bool,
+     },
+     /// Backup
+     Backup {
+-- 
+2.53.0
+
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index e6af3ea3b481..863622227bc4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7748,17 +7748,23 @@ with pkgs;
       kanidm_1_10 = callPackage ../servers/kanidm/1_10.nix {
         kanidmWithSecretProvisioning = kanidmWithSecretProvisioning_1_10;
       };
+      kanidm_1_11 = callPackage ../servers/kanidm/1_11.nix {
+        kanidmWithSecretProvisioning = kanidmWithSecretProvisioning_1_11;
+      };
 
       kanidmWithSecretProvisioning_1_8 = kanidm_1_8.override { enableSecretProvisioning = true; };
       kanidmWithSecretProvisioning_1_9 = kanidm_1_9.override { enableSecretProvisioning = true; };
       kanidmWithSecretProvisioning_1_10 = kanidm_1_10.override { enableSecretProvisioning = true; };
+      kanidmWithSecretProvisioning_1_11 = kanidm_1_11.override { enableSecretProvisioning = true; };
     })
     kanidm_1_8
     kanidm_1_9
     kanidm_1_10
+    kanidm_1_11
     kanidmWithSecretProvisioning_1_8
     kanidmWithSecretProvisioning_1_9
     kanidmWithSecretProvisioning_1_10
+    kanidmWithSecretProvisioning_1_11
     ;
 
   lemmy-server = callPackage ../servers/web-apps/lemmy/server.nix { };

From f5741312d6da8d9849f1801db3913cb5dfde098e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 30 Jun 2026 12:31:26 +0000
Subject: [PATCH 38/57] panoply: 5.9.2 -> 5.10.0

(cherry picked from commit af79c4d45fd898c7ea013f4a0f29509952411b3f)
---
 pkgs/by-name/pa/panoply/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pa/panoply/package.nix b/pkgs/by-name/pa/panoply/package.nix
index 78e9e8030c27..060fff5c39c5 100644
--- a/pkgs/by-name/pa/panoply/package.nix
+++ b/pkgs/by-name/pa/panoply/package.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "panoply";
-  version = "5.9.2";
+  version = "5.10.0";
 
   src = fetchurl {
     url = "https://www.giss.nasa.gov/tools/panoply/download/PanoplyJ-${version}.tgz";
-    hash = "sha256-fPaPd/ZFblZXOwM2yHeXPIUv/bxGAHki9jbeG2HTckI=";
+    hash = "sha256-xPeBNjOY8BMs3zw0coUhYqaEcyYc9BtO2ETwDOv2H5Q=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 61a060108e0c1875b3df5b5b524a57cbfde2bba8 Mon Sep 17 00:00:00 2001
From: Gerhard Schwanzer <geri@sdf.org>
Date: Sun, 2 Aug 2026 08:33:42 +0200
Subject: [PATCH 39/57] lib60870: 2.3.6 -> 2.4.1

https://redirect.github.com/mz-automation/lib60870/releases/tag/v2.4.1

Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol)
(cherry picked from commit c321a2d68d2856cc46e98275d12b90052ac6c762)
---
 pkgs/by-name/li/lib60870/package.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/lib60870/package.nix b/pkgs/by-name/li/lib60870/package.nix
index 0878ce66cec0..953c0d10f406 100644
--- a/pkgs/by-name/li/lib60870/package.nix
+++ b/pkgs/by-name/li/lib60870/package.nix
@@ -9,20 +9,21 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lib60870";
-  version = "2.3.6";
+  version = "2.4.1";
 
   src = fetchFromGitHub {
     owner = "mz-automation";
     repo = "lib60870";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-9VqLl1pDmi8TauBA8uCyymzsYd3w4b5AKtqH7XW80N4=";
+    hash = "sha256-WXEe+G7ib9XNAZSsNl/RZcFHXpIbCMKNfPLnxZzz09E=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/lib60870-C";
 
   postPatch = ''
+    # Keep system mbedTLS support enabled without vendored mbedTLS sources.
     substituteInPlace CMakeLists.txt \
-      --replace-fail "cmake_minimum_required(VERSION 3.0)" "cmake_minimum_required(VERSION 3.10)"
+      --replace-fail "if(MBEDTLS_DIR)" "if(MBEDTLS_DIR OR WITH_MBEDTLS3)"
   ''
   + lib.optionalString stdenv.hostPlatform.isDarwin ''
     substituteInPlace src/CMakeLists.txt \

From dbd6ccb0175da77556187fadcf2d8354a4d50300 Mon Sep 17 00:00:00 2001
From: Gerhard Schwanzer <geri@sdf.org>
Date: Fri, 31 Jul 2026 07:56:01 +0200
Subject: [PATCH 40/57] tinyproxy: fix CVE-2026-54387, CVE-2026-54388 and
 CVE-2026-55202

Apply upstream fixes for ambiguous HTTP request framing and inconsistent stathost authentication and routing. No upstream release containing these fixes is available.

Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol)
(cherry picked from commit 4d53f69eb7681739a0811914d7f47addd6fac7ff)
---
 pkgs/by-name/ti/tinyproxy/package.nix | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ti/tinyproxy/package.nix b/pkgs/by-name/ti/tinyproxy/package.nix
index 035c3194b91e..bb07a0bf0a4d 100644
--- a/pkgs/by-name/ti/tinyproxy/package.nix
+++ b/pkgs/by-name/ti/tinyproxy/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch2,
+  fetchpatch,
   autoreconfHook,
   perl,
   nixosTests,
@@ -22,10 +22,26 @@ stdenv.mkDerivation (finalAttrs: {
 
   patches = [
     # Fix case-sensitive matching of "chunked" (CVE-2026-31842)
-    (fetchpatch2 {
+    (fetchpatch {
       name = "fix-chunked-case-sensitivity.patch";
       url = "https://github.com/tinyproxy/tinyproxy/commit/879bf844abffa0bf5fae6aff0c73179024dd9f98.patch";
-      hash = "sha256-Nav3nXyxdoM/tIvfyPJHEYEjAtrRrJlvkMXzsQCZan4=";
+      hash = "sha256-kU9Vqf2YtnKNJU4eQlau/ijtXkGPS/n+YSeficfu7JM=";
+    })
+    # Remove when updating to the first upstream release containing these fixes.
+    (fetchpatch {
+      name = "CVE-2026-54387.patch";
+      url = "https://github.com/tinyproxy/tinyproxy/commit/623bfc093df009296f0b85d40bc677ef9d5c09bb.patch";
+      hash = "sha256-BSnK3XkBFW43cnD937RKr7FJzQT90BxJkILXz/QPZo8=";
+    })
+    (fetchpatch {
+      name = "CVE-2026-54388.patch";
+      url = "https://github.com/tinyproxy/tinyproxy/commit/364cdb67e0ea00a8e4a7037e2693e0711e816adb.patch";
+      hash = "sha256-+Z/Rj/zNldfOPVzWUlFHa37LEfSh/PtXOaN8z++ONJQ=";
+    })
+    (fetchpatch {
+      name = "CVE-2026-55202.patch";
+      url = "https://github.com/tinyproxy/tinyproxy/commit/09312a185ae25cc486b4ff5987638a7917a48bce.patch";
+      hash = "sha256-kwYk5E95KQK42ebLV0nHB706VynDnjHB/5eENKO7Eaw=";
     })
   ];
 

From 34a96a2384f4a55196b948c56f2520683666459c Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sun, 2 Aug 2026 00:28:12 +0200
Subject: [PATCH 41/57] goaccess: 1.10.2 -> 1.11

Diff: https://github.com/allinurl/goaccess/compare/v1.10.2...v1.11

Changelog: https://github.com/allinurl/goaccess/raw/v1.11/ChangeLog
(cherry picked from commit 350b7cf07b06ec666d1ef2d889ee8f17aba14e45)
---
 pkgs/by-name/go/goaccess/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/go/goaccess/package.nix b/pkgs/by-name/go/goaccess/package.nix
index ad32acf68b3c..dc2ee4b52ccd 100644
--- a/pkgs/by-name/go/goaccess/package.nix
+++ b/pkgs/by-name/go/goaccess/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "goaccess";
-  version = "1.10.2";
+  version = "1.11";
 
   src = fetchFromGitHub {
     owner = "allinurl";
     repo = "goaccess";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-n0+Z3kkjMCjPN0Cb0R1QGSzzXH3S9kjDchy9ay6109s=";
+    hash = "sha256-9Z57T0MPs3ytwi32fMF67j8h7ml20cw4Hf+/DEg5AQY=";
   };
 
   nativeBuildInputs = [ autoreconfHook ];

From ec8fa55405f7e84ae810bf74a18bc4c880415a01 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 2 Aug 2026 12:45:34 +0000
Subject: [PATCH 42/57] panoply: 5.10.0 -> 5.10.1

(cherry picked from commit 205fb105e846a6182084052e3b42a3af7eb9a246)
---
 pkgs/by-name/pa/panoply/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pa/panoply/package.nix b/pkgs/by-name/pa/panoply/package.nix
index 060fff5c39c5..b795b3200c78 100644
--- a/pkgs/by-name/pa/panoply/package.nix
+++ b/pkgs/by-name/pa/panoply/package.nix
@@ -8,11 +8,11 @@
 
 stdenvNoCC.mkDerivation rec {
   pname = "panoply";
-  version = "5.10.0";
+  version = "5.10.1";
 
   src = fetchurl {
     url = "https://www.giss.nasa.gov/tools/panoply/download/PanoplyJ-${version}.tgz";
-    hash = "sha256-xPeBNjOY8BMs3zw0coUhYqaEcyYc9BtO2ETwDOv2H5Q=";
+    hash = "sha256-xSvzYD7Bk3SC0WUhQVKRhkCZTiB1vAATM7qSGw9U7Lo=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 16f7304c27a14c77e1505eedcb53e1e23c556040 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 1 Aug 2026 10:24:09 +0000
Subject: [PATCH 43/57] necesse-server: 1.2.0-23522718 -> 1.3.1-24494674

(cherry picked from commit 80a6477dd85030cc7664cdeb8957bc305b29543a)
---
 pkgs/by-name/ne/necesse-server/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ne/necesse-server/package.nix b/pkgs/by-name/ne/necesse-server/package.nix
index 88e7c558b6e1..ef6f85fcc8ac 100644
--- a/pkgs/by-name/ne/necesse-server/package.nix
+++ b/pkgs/by-name/ne/necesse-server/package.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "1.2.0-23522718";
+  version = "1.3.1-24494674";
   urlVersion = lib.replaceStrings [ "." ] [ "-" ] version;
 
 in
@@ -16,7 +16,7 @@ stdenvNoCC.mkDerivation {
 
   src = fetchzip {
     url = "https://necesse.pwn.sh/server/necesse-server-linux64-${urlVersion}.zip";
-    hash = "sha256-PIguTYULddLKj6PpoSvX3gNSvqrS7oRTOPuwoA0/XOc=";
+    hash = "sha256-A2mWnIIRGNfbxg7aZDwEk7QvuDUUpr2ARIddasTlvFM=";
   };
 
   # removing packaged jre since we use our own

From e63e3c448f10ebac24ed508e7878d5b10e4aa9f1 Mon Sep 17 00:00:00 2001
From: Gerhard Schwanzer <geri@sdf.org>
Date: Sun, 2 Aug 2026 14:43:29 +0200
Subject: [PATCH 44/57] perlPackages.DateManip: fix CVE-2026-60074 and
 CVE-2026-60075

Apply CPAN Security's complete fixes for rejecting non-ASCII numeric
date fields and bounding parser input before expensive regular
expressions run.

Move the existing date fallback substitution to postPatch so the
standard patch phase applies the security patches first.

Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol)
(cherry picked from commit 7e09d3726c5850ddb11930780212eb14776e704e)
---
 pkgs/top-level/perl-packages.nix | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 8f811f1f0c57..52a0619a0c00 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -8914,8 +8914,21 @@ with self;
       url = "mirror://cpan/authors/id/S/SB/SBECK/Date-Manip-6.98.tar.gz";
       hash = "sha256-rP2KYFGbpM0YHIpnqD1/ApxtmrTosCEtxH5B1iEP2kk=";
     };
+    # Remove when updating to the first release containing both CVE fixes.
+    patches = [
+      (fetchpatch {
+        name = "CVE-2026-60074.patch";
+        url = "https://security.metacpan.org/patches/D/Date-Manip/6.99/CVE-2026-60074-r1.patch";
+        hash = "sha256-leXFfzLyy0yBpBXgT3u3ZyFaIbsbJSFzVkdam9hb3+0=";
+      })
+      (fetchpatch {
+        name = "CVE-2026-60075.patch";
+        url = "https://security.metacpan.org/patches/D/Date-Manip/6.99/CVE-2026-60075-r1.patch";
+        hash = "sha256-vMsOrUhrfn8efKRzfJ+jaypOHER8MlUIob5u88n/TAw=";
+      })
+    ];
     # for some reason, parsing /etc/localtime does not work anymore - make sure that the fallback "/bin/date +%Z" will work
-    patchPhase = ''
+    postPatch = ''
       sed -i "s#/bin/date#${pkgs.coreutils}/bin/date#" lib/Date/Manip/TZ.pm
     '';
     doCheck = !stdenv.hostPlatform.isi686; # build freezes during tests on i686

From 57f9002c4d219a1ab2f2fa23e5af3b8f61401339 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C2=B7=F0=90=91=91=F0=90=91=B4=F0=90=91=95=F0=90=91=91?=
 =?UTF-8?q?=F0=90=91=A9=F0=90=91=A4?= <toastal@posteo.net>
Date: Sun, 26 Jul 2026 10:58:08 -0700
Subject: [PATCH 45/57] =?UTF-8?q?h2o:=202.3.0-rolling-2026-06-29=20?=
 =?UTF-8?q?=E2=86=92=202.3.0-rolling-2026-07-21?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

(cherry picked from commit f4f31d3197b1cd9650c76bc71ec255c0ff10fbe5)
---
 pkgs/by-name/h2/h2o/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/h2/h2o/package.nix b/pkgs/by-name/h2/h2o/package.nix
index 50191ac86634..43e8b2fdba73 100644
--- a/pkgs/by-name/h2/h2o/package.nix
+++ b/pkgs/by-name/h2/h2o/package.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "h2o";
-  version = "2.3.0-rolling-2026-06-29";
+  version = "2.3.0-rolling-2026-07-21";
 
   src = fetchFromGitHub {
     owner = "h2o";
     repo = "h2o";
-    rev = "edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1";
-    hash = "sha256-WQy+v4zpwzgbMxT43+Nd33+YPynyZIwqzVTaknqjCmE=";
+    rev = "3a5d2cb898bdb54795f060be7aba478912f65bb0";
+    hash = "sha256-2S3u7qeC2D/nY7nEvE6scUw9aktGbMg0u5f350LhHVo=";
   };
 
   outputs = [

From aafb117dc516e22f641e3aef27cb88c6580553ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C2=B7=F0=90=91=91=F0=90=91=B4=F0=90=91=95=F0=90=91=91?=
 =?UTF-8?q?=F0=90=91=A9=F0=90=91=A4?= <toastal@posteo.net>
Date: Sun, 26 Jul 2026 11:06:20 -0700
Subject: [PATCH 46/57] h2o: use cmake helpers from lib

(cherry picked from commit 1411f34b511d7d0c671141b2b6c0b2c8c0135850)
---
 pkgs/by-name/h2/h2o/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/h2/h2o/package.nix b/pkgs/by-name/h2/h2o/package.nix
index 43e8b2fdba73..6199daa9a934 100644
--- a/pkgs/by-name/h2/h2o/package.nix
+++ b/pkgs/by-name/h2/h2o/package.nix
@@ -71,9 +71,9 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional withZstandard zstd;
 
   cmakeFlags = [
-    "-DWITH_BROTLI=${if withBrotli then "ON" else "OFF"}"
-    "-DWITH_MRUBY=${if withMruby then "ON" else "OFF"}"
-    "-DWITH_ZSTD=${if withZstandard then "ON" else "OFF"}"
+    (lib.cmakeBool "WITH_BROTLI" withBrotli)
+    (lib.cmakeBool "WITH_MRUBY" withMruby)
+    (lib.cmakeBool "WITH_ZSTD" withZstandard)
   ];
 
   postInstall = ''

From 30e4f93f3899123dd2e558fb3b7c1daa4a2fb776 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C2=B7=F0=90=91=91=F0=90=91=B4=F0=90=91=95=F0=90=91=91?=
 =?UTF-8?q?=F0=90=91=A9=F0=90=91=A4?= <toastal@posteo.net>
Date: Fri, 31 Jul 2026 08:15:49 -0700
Subject: [PATCH 47/57] =?UTF-8?q?h2o:=202.3.0-rolling-2026-07-21=20?=
 =?UTF-8?q?=E2=86=92=202.3.0-rolling-2026-07-31?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

(cherry picked from commit 9dc345f4b69738f65ff92c632cd1979b2dc6c1be)
---
 pkgs/by-name/h2/h2o/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/h2/h2o/package.nix b/pkgs/by-name/h2/h2o/package.nix
index 6199daa9a934..7a5f1ccc7612 100644
--- a/pkgs/by-name/h2/h2o/package.nix
+++ b/pkgs/by-name/h2/h2o/package.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "h2o";
-  version = "2.3.0-rolling-2026-07-21";
+  version = "2.3.0-rolling-2026-07-31";
 
   src = fetchFromGitHub {
     owner = "h2o";
     repo = "h2o";
-    rev = "3a5d2cb898bdb54795f060be7aba478912f65bb0";
-    hash = "sha256-2S3u7qeC2D/nY7nEvE6scUw9aktGbMg0u5f350LhHVo=";
+    rev = "ba16320ad18c2bb2e28478ce9e37b9a57a5c98f6";
+    hash = "sha256-MmfypvlLJ3NeZ1Nyeyzo1mXxICllQPBwwseOo+rC1Ig=";
   };
 
   outputs = [

From 4cf468acf47540b7b9848031da17e3f613c50a35 Mon Sep 17 00:00:00 2001
From: Gerhard Schwanzer <geri@sdf.org>
Date: Sun, 26 Jul 2026 10:59:06 +0200
Subject: [PATCH 48/57] libvncserver: backport CVE-2026-32853 and
 CVE-2026-32854 fixes

Backport the complete upstream bounds checks for UltraZip decoding and malformed HTTP proxy requests.

https://github.com/LibVNC/libvncserver/security/advisories/GHSA-87q7-v983-qwcj
https://github.com/LibVNC/libvncserver/security/advisories/GHSA-xjp8-4qqv-5x4x

Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol)
(cherry picked from commit 2cd494ee4e0b6f0b4bb9e7f05df557a0ba06786d)
---
 pkgs/by-name/li/libvncserver/package.nix | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/pkgs/by-name/li/libvncserver/package.nix b/pkgs/by-name/li/libvncserver/package.nix
index 29ce2959e878..ed38724c0e67 100644
--- a/pkgs/by-name/li/libvncserver/package.nix
+++ b/pkgs/by-name/li/libvncserver/package.nix
@@ -41,6 +41,18 @@ stdenv.mkDerivation (finalAttrs: {
       url = "https://github.com/LibVNC/libvncserver/commit/e64fa928170f22a2e21b5bbd6d46c8f8e7dd7a96.patch";
       hash = "sha256-AAZ3H34+nLqQggb/sNSx2gIGK96m4zatHX3wpyjNLOA=";
     })
+
+    (fetchpatch {
+      name = "CVE-2026-32854.patch";
+      url = "https://github.com/LibVNC/libvncserver/commit/dc78dee51a7e270e537a541a17befdf2073f5314.patch";
+      hash = "sha256-CgVfvsrgZWnjIzu/0UegoAuCqO7WHhCDVvhH8Yk1cXo=";
+    })
+
+    (fetchpatch {
+      name = "CVE-2026-32853.patch";
+      url = "https://github.com/LibVNC/libvncserver/commit/009008e2f4d5a54dd71f422070df3af7b3dbc931.patch";
+      hash = "sha256-ZgpiIS7KoRzDmVLQ0J86wTFFykCBVMt6bZwJsFvIO74=";
+    })
   ];
 
   nativeBuildInputs = [

From d6fb3e88631c45422b4c5627262241857906cc4a Mon Sep 17 00:00:00 2001
From: Gerhard Schwanzer <geri@sdf.org>
Date: Sun, 26 Jul 2026 09:56:22 +0200
Subject: [PATCH 49/57] jirafeau: 4.4.0 -> 4.7.2

https://gitlab.com/jirafeau/Jirafeau/-/blob/4.7.2/CHANGELOG.md

Update to the continued official project namespace. This release contains the fix for CVE-2026-1466; extend the NixOS test with the vulnerable preview contract.

Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol)
(cherry picked from commit 44bfa48ab50ed97c09e4f674dcc755075c573a3f)
---
 nixos/modules/services/web-apps/jirafeau.nix |  2 +-
 nixos/tests/jirafeau.nix                     | 15 +++++++++++++++
 pkgs/by-name/ji/jirafeau/package.nix         |  8 ++++----
 3 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/nixos/modules/services/web-apps/jirafeau.nix b/nixos/modules/services/web-apps/jirafeau.nix
index c1accf047c10..3ebb9beab22e 100644
--- a/nixos/modules/services/web-apps/jirafeau.nix
+++ b/nixos/modules/services/web-apps/jirafeau.nix
@@ -52,7 +52,7 @@ in
       '';
       description =
         let
-          documentationLink = "https://gitlab.com/mojo42/Jirafeau/-/blob/${cfg.package.version}/lib/config.original.php";
+          documentationLink = "https://gitlab.com/jirafeau/Jirafeau/-/blob/${cfg.package.version}/lib/config.original.php";
         in
         ''
           Jirefeau configuration. Refer to <${documentationLink}> for supported
diff --git a/nixos/tests/jirafeau.nix b/nixos/tests/jirafeau.nix
index ebbd637a13ec..b723b1652c1a 100644
--- a/nixos/tests/jirafeau.nix
+++ b/nixos/tests/jirafeau.nix
@@ -18,5 +18,20 @@
     machine.wait_for_unit("nginx.service")
     machine.wait_for_open_port(80)
     machine.succeed("curl -sSfL http://localhost/ | grep 'Jirafeau'")
+
+    machine.succeed("printf '%s' '<svg xmlns=\"http://www.w3.org/2000/svg\"><script>alert(1)</script></svg>' > /tmp/preview.svg")
+    link = machine.succeed(
+        "curl --fail --silent --show-error "
+        "-F time=month -F 'file=@/tmp/preview.svg;type=image' "
+        "http://localhost/script.php"
+    ).splitlines()[0]
+    headers = machine.succeed(
+        f"curl --fail --silent --show-error --dump-header - "
+        f"--output /tmp/preview-response 'http://localhost/f.php?h={link}&p=1'"
+    )
+    header_lines = {line.lower() for line in headers.splitlines()}
+    assert "x-content-type-options: nosniff" in header_lines
+    assert "content-type: image" in header_lines
+    machine.succeed("cmp /tmp/preview.svg /tmp/preview-response")
   '';
 }
diff --git a/pkgs/by-name/ji/jirafeau/package.nix b/pkgs/by-name/ji/jirafeau/package.nix
index d590bc92c420..52a016b95774 100644
--- a/pkgs/by-name/ji/jirafeau/package.nix
+++ b/pkgs/by-name/ji/jirafeau/package.nix
@@ -14,13 +14,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "jirafeau";
-  version = "4.4.0";
+  version = "4.7.2";
 
   src = fetchFromGitLab {
-    owner = "mojo42";
+    owner = "jirafeau";
     repo = "Jirafeau";
     rev = finalAttrs.version;
-    hash = "sha256-jJ2r8XTtAzawTVo2A2pDwy7Z6KHeyBkgXXaCPY0w/rg=";
+    hash = "sha256-zCmSdlHkYQVQXBeVk8AUPoC0UBxz3hWIdM2tGmnLTrw=";
   };
 
   installPhase = ''
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Website permitting upload of a file in a simple way and giving a unique link to it";
     license = lib.licenses.agpl3Plus;
-    homepage = "https://gitlab.com/mojo42/Jirafeau";
+    homepage = "https://gitlab.com/jirafeau/Jirafeau";
     platforms = lib.platforms.all;
     maintainers = [ ];
   };

From a0c1c5b495b3c010abcf6ffd9a9edabe245468f5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 25 Jul 2026 20:33:36 +0000
Subject: [PATCH 50/57] gammu: 1.43.2 -> 1.43.3

(cherry picked from commit 83c10e57dcd85d88194ea9f3a96f37f19340e05a)
---
 pkgs/by-name/ga/gammu/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ga/gammu/package.nix b/pkgs/by-name/ga/gammu/package.nix
index 005e5237a58c..f2377b596b40 100644
--- a/pkgs/by-name/ga/gammu/package.nix
+++ b/pkgs/by-name/ga/gammu/package.nix
@@ -24,7 +24,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gammu";
-  version = "1.43.2";
+  version = "1.43.3";
 
   __structuredAttrs = true;
 
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "gammu";
     repo = "gammu";
     rev = finalAttrs.version;
-    sha256 = "sha256-+mZBELwFUEL4S3IUIIa83TaNIYQxjQE1TvWhXTcIfYc=";
+    sha256 = "sha256-qmpbAiu0aIjawdKTNClMa3yFSdakOlh/dY5gAY04K3M=";
   };
 
   patches = [

From c8187c1719f266c0d5074b79f7b18201efa8a0e0 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Thu, 30 Jul 2026 19:52:12 -0400
Subject: [PATCH 51/57] .github: avoid full checkout on backport

The backport action should work with a sparse tree, so materializing all
files is just wasteful.

Since total time allocated for backport jobs is just 3 mins, sometimes a
slow worktree checkout consumes a good chunk of it and pushes the job to
timeout, resulting in missed backport. See for example:

https://github.com/NixOS/nixpkgs/actions/runs/30587897004/job/91023481883
(cherry picked from commit 830255b283cd4ba6a4a81b74891cedc40763d7c1)
---
 .github/workflows/backport.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/backport.yml b/.github/workflows/backport.yml
index 5805401b08c7..ba5c06452664 100644
--- a/.github/workflows/backport.yml
+++ b/.github/workflows/backport.yml
@@ -39,6 +39,8 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          # Avoid materializing full nixpkgs tree
+          sparse-checkout: .
           token: ${{ steps.app-token.outputs.token }}
           persist-credentials: true
 

From 3b01c1148f9282efb36b5a43bdf13983b6b83320 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 7 Jun 2026 02:55:43 +0000
Subject: [PATCH 52/57] libks: 2.0.10 -> 2.0.11

(cherry picked from commit 1b959519828c390900b99d855b8e65a0d58d2975)
---
 pkgs/by-name/li/libks/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libks/package.nix b/pkgs/by-name/li/libks/package.nix
index f8df68f2f6aa..596135ce7112 100644
--- a/pkgs/by-name/li/libks/package.nix
+++ b/pkgs/by-name/li/libks/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libks";
-  version = "2.0.10";
+  version = "2.0.11";
 
   src = fetchFromGitHub {
     owner = "signalwire";
     repo = "libks";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oLf1ECSKa6KLTA8MO0le44eEDaLmPz/RHoLa8ZSwjWs=";
+    hash = "sha256-tPhGXDEAKgeODAcM6hu4GDU83A3Zi7sIMnTQkfCGlFc=";
   };
 
   patches = [

From d2cdd0b3b9e182bbe1829e3b404d396a98ee8413 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 15 Jul 2026 02:08:38 +0000
Subject: [PATCH 53/57] miniupnpd: 2.3.9 -> 2.3.10

(cherry picked from commit 21bd18d769409117dc732aa80934f7377759eba0)
---
 pkgs/by-name/mi/miniupnpd/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mi/miniupnpd/package.nix b/pkgs/by-name/mi/miniupnpd/package.nix
index 6f9b25a62681..866d90da10be 100644
--- a/pkgs/by-name/mi/miniupnpd/package.nix
+++ b/pkgs/by-name/mi/miniupnpd/package.nix
@@ -48,11 +48,11 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "miniupnpd";
-  version = "2.3.9";
+  version = "2.3.10";
 
   src = fetchurl {
     url = "https://miniupnp.tuxfamily.org/files/miniupnpd-${version}.tar.gz";
-    sha256 = "sha256-Zss8PWl6srs6YdPEhigWbWujKNfC2+uViY/fKjICr3s=";
+    sha256 = "sha256-+cNO02MvtgzSSN1Yl72YR5oQOnVoiwVsovBp5oqzKYc=";
   };
 
   buildInputs = [

From 950b4ae8f89c5bd66d6cb275cddda373c66c8c7f Mon Sep 17 00:00:00 2001
From: Anish Pallati <i@anish.land>
Date: Sun, 2 Aug 2026 14:45:58 -0400
Subject: [PATCH 54/57] dub-to-nix: fetch submodules for git dependencies

Signed-off-by: Anish Pallati <i@anish.land>
(cherry picked from commit 88ebc61b5fc4f32ea48f8ae55706708ae93d6801)
---
 pkgs/build-support/dlang/dub-to-nix/dub-to-nix.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/build-support/dlang/dub-to-nix/dub-to-nix.py b/pkgs/build-support/dlang/dub-to-nix/dub-to-nix.py
index 879acc5f4acb..78073aff504c 100755
--- a/pkgs/build-support/dlang/dub-to-nix/dub-to-nix.py
+++ b/pkgs/build-support/dlang/dub-to-nix/dub-to-nix.py
@@ -57,7 +57,7 @@ for pname in depsDict:
         repository = depDict["repository"]
         strippedRepo = repository[4:]
         eprint(f"Fetching {pname}@{version} ({strippedRepo})")
-        command = ["nix-prefetch-git", strippedRepo, version]
+        command = ["nix-prefetch-git", "--fetch-submodules", strippedRepo, version]
         rawRes = subprocess.run(command, check=True, text=True, stdout=subprocess.PIPE, stderr=subprocess.DEVNULL).stdout
         sha256 = json.loads(rawRes)["sha256"]
         lockedDepsDict[pname] = {"version": version, "repository": strippedRepo, "sha256": sha256}

From 746b46a678539980e16682f95ae7d24dfaba0b4b Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Sun, 2 Aug 2026 21:30:07 +0200
Subject: [PATCH 55/57] buildDubPackage: explicitly set fetchSubmodules

(cherry picked from commit e445b406e2e0ff47f6968708916eb98f7aea60a6)
---
 pkgs/build-support/dlang/builddubpackage/import-dub-lock.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/build-support/dlang/builddubpackage/import-dub-lock.nix b/pkgs/build-support/dlang/builddubpackage/import-dub-lock.nix
index 121d21df9d99..3c7c2279a0e3 100644
--- a/pkgs/build-support/dlang/builddubpackage/import-dub-lock.nix
+++ b/pkgs/build-support/dlang/builddubpackage/import-dub-lock.nix
@@ -41,6 +41,7 @@ let
       src = fetchgit {
         url = repository;
         rev = version;
+        fetchSubmodules = true; # this is the default, but let's be explicit
         inherit sha256;
       };
     };

From 13a1f0802e031a1f5df8471cb59503670a249ac1 Mon Sep 17 00:00:00 2001
From: Tom Herbers <mail@tomherbers.de>
Date: Sun, 2 Aug 2026 20:50:41 +0200
Subject: [PATCH 56/57] angie: mark as vulnerable due to insufficient
 maintainer attention

(cherry picked from commit d9473db7458c718e72161a86af639feb5712dec9)
---
 pkgs/servers/http/angie/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/servers/http/angie/default.nix b/pkgs/servers/http/angie/default.nix
index ee4dd5c50979..3bf1b6145e2e 100644
--- a/pkgs/servers/http/angie/default.nix
+++ b/pkgs/servers/http/angie/default.nix
@@ -43,5 +43,8 @@ callPackage ../nginx/generic.nix args rec {
     license = lib.licenses.bsd2;
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [ izorkin ];
+    knownVulnerabilities = [
+      "angie is insufficiently maintained in nixpkgs. Security updates are frequently delayed. Please consider stepping up as maintainer or switching to an alternative."
+    ];
   };
 }

From 8d3ec3762a29cf556a7dd80941bbedada8b240b2 Mon Sep 17 00:00:00 2001
From: lucasew <lucas59356@gmail.com>
Date: Sat, 1 Aug 2026 18:30:10 -0300
Subject: [PATCH 57/57] cockpit: scrub compiler and -dev store paths from
 runtime closure

C binaries embed store paths of gcc and *-dev inputs as strings
(include/comp_dir style). Nix treats those as runtime dependencies,
keeping the full compiler and header packages in the closure.

Remove the accidental references with remove-references-to and guard
with disallowedRequisites. Measured x86_64-linux closure drop:
~867M -> ~543M.

Assisted-by: Grok by xAI (Grok Build)
(cherry picked from commit e203149c41dbd686a2f94c1edd3bb821065222b2)
---
 pkgs/by-name/co/cockpit/package.nix | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/pkgs/by-name/co/cockpit/package.nix b/pkgs/by-name/co/cockpit/package.nix
index de274ca95dc2..a9cb60d51d3e 100644
--- a/pkgs/by-name/co/cockpit/package.nix
+++ b/pkgs/by-name/co/cockpit/package.nix
@@ -35,6 +35,7 @@
   pkg-config,
   polkit,
   python312Packages,
+  removeReferencesTo,
   sscg,
   systemd,
   udev,
@@ -78,6 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
     pam
     pkg-config
     python3Packages.setuptools
+    removeReferencesTo
     systemd
     xmlto
   ];
@@ -250,9 +252,34 @@ stdenv.mkDerivation (finalAttrs: {
       popd
     ''}
 
+    remove-references-to \
+      -t ${stdenv.cc.cc} \
+      -t ${lib.getDev stdenv.cc.libc} \
+      -t ${lib.getDev glib} \
+      -t ${lib.getDev json-glib} \
+      -t ${lib.getDev systemd} \
+      -t ${lib.getDev gnutls} \
+      -t ${lib.getDev krb5} \
+      "$out/lib/security/pam_ssh_add.so" \
+      "$out/libexec/cockpit-certificate-ensure" \
+      "$out/libexec/cockpit-session" \
+      "$out/libexec/cockpit-tls" \
+      "$out/libexec/cockpit-ws" \
+      "$out/libexec/cockpit-wsinstance-factory"
+
     runHook postFixup
   '';
 
+  disallowedRequisites = [
+    stdenv.cc.cc
+    (lib.getDev stdenv.cc.libc)
+    (lib.getDev glib)
+    (lib.getDev json-glib)
+    (lib.getDev systemd)
+    (lib.getDev gnutls)
+    (lib.getDev krb5)
+  ];
+
   nativeCheckInputs = [ python3Packages.pytestCheckHook ];
 
   checkInputs = [