From 2494bec9e516c0c0a05af3c03d2f34a01aee81b7 Mon Sep 17 00:00:00 2001
From: Johan Herland <johan@herland.net>
Date: Fri, 17 Jul 2026 13:00:11 +0000
Subject: [PATCH 01/59] python3Packages.s3torchconnectorclient: init at 1.5.0

- Patch metrics-0.24.1 (vendored dep) to fix E0521 borrow-checker error
  under newer rustc; backport of the fix from metrics 0.24.2.
  See: https://github.com/rust-lang/rust/issues/141402
- Set PYO3_USE_ABI3_FORWARD_COMPATIBILITY=1 to allow building with
  Python 3.14 (pyo3-0.24.1 officially supports up to Python 3.13)
- Disable test_mountpoint_s3_client.py unit tests which require AWS
  credentials and a TLS trust store unavailable in the Nix sandbox

Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .../s3torchconnectorclient/default.nix        | 88 +++++++++++++++++++
 .../fix-metrics-0.24.1-E0521.patch            | 27 ++++++
 pkgs/top-level/python-packages.nix            |  2 +
 3 files changed, 117 insertions(+)
 create mode 100644 pkgs/development/python-modules/s3torchconnectorclient/default.nix
 create mode 100644 pkgs/development/python-modules/s3torchconnectorclient/fix-metrics-0.24.1-E0521.patch

diff --git a/pkgs/development/python-modules/s3torchconnectorclient/default.nix b/pkgs/development/python-modules/s3torchconnectorclient/default.nix
new file mode 100644
index 000000000000..2db84b4f68ba
--- /dev/null
+++ b/pkgs/development/python-modules/s3torchconnectorclient/default.nix
@@ -0,0 +1,88 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  boto3,
+  pytestCheckHook,
+  cmake,
+  hypothesis,
+  rustPackages,
+  setuptools-rust,
+  torch,
+}:
+
+let
+  inherit (rustPackages) rustPlatform rustc cargo;
+
+in
+buildPythonPackage rec {
+  pname = "s3torchconnectorclient";
+  version = "1.5.0";
+  format = "pyproject";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "awslabs";
+    repo = "s3-connector-for-pytorch";
+    rev = "v${version}";
+    hash = "sha256-ovy/VUWTYMQ3wbmLptqj6l+uVwl4Gbkt3OpPUPayuLI=";
+  };
+
+  sourceRoot = "${src.name}/s3torchconnectorclient";
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit src sourceRoot;
+    hash = "sha256-xYfBnyZM43FNxPnnP6a45ZLCCve/B3713RNmgG0LNBc=";
+  };
+
+  nativeBuildInputs = [
+    cargo
+    cmake
+    rustc
+    rustPlatform.cargoSetupHook
+    rustPlatform.bindgenHook
+    setuptools-rust
+  ];
+
+  # Patch metrics-0.24.1 to fix E0521 borrow-checker error under newer rustc.
+  # Backport of the fix from metrics 0.24.2. See: https://github.com/rust-lang/rust/issues/141402
+  postPatch = ''
+    patch -d $cargoDepsCopy/*/metrics-0.24.1 -p1 < ${./fix-metrics-0.24.1-E0521.patch}
+  '';
+
+  # cmake is needed/used by the rust toolchain, we don't want Nix to run it directly
+  dontUseCmakeConfigure = true;
+
+  env = {
+    CFLAGS = "-Wno-stringop-overflow -Wno-array-bounds -Wno-restrict";
+    # pyo3-0.24.1 declares support only up to Python 3.13; use stable ABI for forward compat
+    PYO3_USE_ABI3_FORWARD_COMPATIBILITY = "1";
+  };
+
+  dependencies = [
+    boto3
+    torch
+  ];
+
+  pythonImportsCheck = [ "s3torchconnectorclient" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    hypothesis
+  ];
+
+  disabledTestPaths = [
+    # integration tests access S3
+    "python/tst/integration/"
+    # unit tests for S3 client creation require AWS credentials + TLS trust store
+    "python/tst/unit/test_mountpoint_s3_client.py"
+  ];
+
+  meta = with lib; {
+    description = "Low-level S3 client for PyTorch data loading";
+    homepage = "https://github.com/awslabs/s3-connector-for-pytorch";
+    changelog = "https://github.com/awslabs/s3-connector-for-pytorch/releases/tag/v${version}";
+    license = licenses.bsd3;
+    maintainers = with maintainers; [ jherland ];
+  };
+}
diff --git a/pkgs/development/python-modules/s3torchconnectorclient/fix-metrics-0.24.1-E0521.patch b/pkgs/development/python-modules/s3torchconnectorclient/fix-metrics-0.24.1-E0521.patch
new file mode 100644
index 000000000000..390c1732b8e9
--- /dev/null
+++ b/pkgs/development/python-modules/s3torchconnectorclient/fix-metrics-0.24.1-E0521.patch
@@ -0,0 +1,27 @@
+--- a/src/recorder/mod.rs
++++ b/src/recorder/mod.rs
+@@ -139,11 +139,19 @@
+
+ impl<'a> LocalRecorderGuard<'a> {
+     /// Creates a new `LocalRecorderGuard` and sets the thread-local recorder.
+-    fn new(recorder: &'a dyn Recorder) -> Self {
+-        // SAFETY: While we take a lifetime-less pointer to the given reference, the reference we derive _from_ the
+-        // pointer is given the same lifetime of the reference used to construct the guard -- captured in the guard type
+-        // itself -- and so derived references never outlive the source reference.
+-        let recorder_ptr = unsafe { NonNull::new_unchecked(recorder as *const _ as *mut _) };
++    fn new(recorder: &'a (dyn Recorder + 'a)) -> Self {
++        // SAFETY: We extend `'a` to `'static` to satisfy the signature of `LOCAL_RECORDER`, which
++        // has an implied `'static` bound on `dyn Recorder`. We enforce that all usages of `LOCAL_RECORDER`
++        // are limited to `'a` as we mediate its access entirely through `LocalRecorderGuard<'a>`.
++        let recorder_ptr = unsafe {
++            std::mem::transmute::<*const (dyn Recorder + 'a), *mut (dyn Recorder + 'static)>(
++                recorder as &'a (dyn Recorder + 'a),
++            )
++        };
++        // SAFETY: While we take a lifetime-less pointer to the given reference, the reference we derive _from_ the
++        // pointer is given the same lifetime of the reference used to construct the guard -- captured in the guard type
++        // itself -- and so derived references never outlive the source reference.
++        let recorder_ptr = unsafe { NonNull::new_unchecked(recorder_ptr) };
+
+         let prev_recorder =
+             LOCAL_RECORDER.with(|local_recorder| local_recorder.replace(Some(recorder_ptr)));
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 115f30770f75..efd1a719db8a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -18049,6 +18049,8 @@ self: super: with self; {
 
   s3fs = callPackage ../development/python-modules/s3fs { };
 
+  s3torchconnectorclient = callPackage ../development/python-modules/s3torchconnectorclient { };
+
   s3transfer = callPackage ../development/python-modules/s3transfer { };
 
   sabctools = callPackage ../development/python-modules/sabctools { };

From 92b00f40a71ee41ab199e8a53af97391fda7b99e Mon Sep 17 00:00:00 2001
From: 4evy <git@evy.pink>
Date: Mon, 24 Aug 2026 02:30:00 +0300
Subject: [PATCH 02/59] gemini-cli: remove inactive maintainer

Last nixpkgs interaction for brantes (pedrobrantes) was on 2026-02-15:
https://github.com/NixOS/nixpkgs/pull/490825#pullrequestreview-3805606033
---
 pkgs/by-name/ge/gemini-cli/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/ge/gemini-cli/package.nix b/pkgs/by-name/ge/gemini-cli/package.nix
index 42b3bb668fab..25f08c9bc216 100644
--- a/pkgs/by-name/ge/gemini-cli/package.nix
+++ b/pkgs/by-name/ge/gemini-cli/package.nix
@@ -123,7 +123,6 @@ buildNpmPackage (finalAttrs: {
       ];
     };
     maintainers = with lib.maintainers; [
-      brantes
       xiaoxiangmoe
       _4evy
       caverav

From 4ea1de3cc38a8fa7a250fb386a5fc5bceb15587b Mon Sep 17 00:00:00 2001
From: kruziikrel13 <dev@michaelpetersen.io>
Date: Tue, 11 Aug 2026 13:05:44 +1000
Subject: [PATCH 03/59] grayjay: 17 -> 18

original authorship by paczek654321
---
 pkgs/by-name/gr/grayjay/package.nix | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gr/grayjay/package.nix b/pkgs/by-name/gr/grayjay/package.nix
index b769e9feb836..c3a24ae3ccd7 100644
--- a/pkgs/by-name/gr/grayjay/package.nix
+++ b/pkgs/by-name/gr/grayjay/package.nix
@@ -1,6 +1,7 @@
 {
   buildDotnetModule,
   fetchFromGitLab,
+  fetchurl,
   dotnetCorePackages,
   lib,
   ffmpeg,
@@ -44,21 +45,26 @@
   _experimental-update-script-combinators,
   grayjay-frontend,
   grayjay-libcurlshim,
+  unzip,
 }:
 let
-  version = "17";
+  version = "18";
   src = fetchFromGitLab {
     domain = "gitlab.futo.org";
     owner = "videostreaming";
     repo = "Grayjay.Desktop";
     tag = version;
-    hash = "sha256-/oeoLXKewjYkCO7naZNOzauWm1OYDKnsxXY9EkI7fTM=";
+    hash = "sha256-dhXUjj9x8v1bfHLPxNtcysj/eKeT3kkSeVuX6PKoykE=";
     fetchSubmodules = true;
     fetchLFS = true;
   };
   getLibrary =
     pkg: libnm:
     "${lib.getLib pkg}/lib/lib${libnm}${pkg.drvAttrs.stdenv.hostPlatform.extensions.sharedLibrary}";
+  justcefNative = fetchurl {
+    url = "https://static.grayjay.app/justcef/1/JustCefNative-linux-x64.zip";
+    hash = "sha256-LXOp+QZZcWBd8eP+BpK++AMBo9303+aIDEEYNVWekhE=";
+  };
 in
 buildDotnetModule (finalAttrs: {
   pname = "grayjay";
@@ -88,6 +94,7 @@ buildDotnetModule (finalAttrs: {
     autoPatchelfHook
     wrapGAppsHook3
     copyDesktopItems
+    unzip
   ];
 
   dontWrapGApps = true;
@@ -108,7 +115,7 @@ buildDotnetModule (finalAttrs: {
     "Grayjay.Engine/Grayjay.Engine/Grayjay.Engine.csproj"
     "Grayjay.Desktop.CEF/Grayjay.Desktop.CEF.csproj"
     "FUTO.MDNS/FUTO.MDNS/FUTO.MDNS.csproj"
-    "JustCef/DotCef.csproj"
+    "JustCef/JustCef.csproj"
   ];
 
   testProjectFile = [
@@ -134,6 +141,11 @@ buildDotnetModule (finalAttrs: {
   preBuild = ''
     rm -r Grayjay.ClientServer/wwwroot/web
     cp -r ${grayjay-frontend} Grayjay.ClientServer/wwwroot/web
+
+
+    mkdir -p JustCef/obj/justcef/net8.0/1/linux-x64
+    cp ${justcefNative} \
+      JustCef/obj/justcef/net8.0/1/linux-x64/JustCefNative-linux-x64.zip
   '';
 
   postInstall = ''

From 7dcbd2e62138399bfcc9707ad8edfed43a681e17 Mon Sep 17 00:00:00 2001
From: kruziikrel13 <dev@michaelpetersen.io>
Date: Tue, 25 Aug 2026 11:08:58 +1000
Subject: [PATCH 04/59] grayjay: merge with upstream

---
 pkgs/by-name/gr/grayjay/package.nix | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/gr/grayjay/package.nix b/pkgs/by-name/gr/grayjay/package.nix
index c3a24ae3ccd7..a868aee98004 100644
--- a/pkgs/by-name/gr/grayjay/package.nix
+++ b/pkgs/by-name/gr/grayjay/package.nix
@@ -58,13 +58,13 @@ let
     fetchSubmodules = true;
     fetchLFS = true;
   };
-  getLibrary =
-    pkg: libnm:
-    "${lib.getLib pkg}/lib/lib${libnm}${pkg.drvAttrs.stdenv.hostPlatform.extensions.sharedLibrary}";
   justcefNative = fetchurl {
     url = "https://static.grayjay.app/justcef/1/JustCefNative-linux-x64.zip";
     hash = "sha256-LXOp+QZZcWBd8eP+BpK++AMBo9303+aIDEEYNVWekhE=";
   };
+  getLibrary =
+    pkg: libnm:
+    "${lib.getLib pkg}/lib/lib${libnm}${pkg.drvAttrs.stdenv.hostPlatform.extensions.sharedLibrary}";
 in
 buildDotnetModule (finalAttrs: {
   pname = "grayjay";
@@ -142,7 +142,6 @@ buildDotnetModule (finalAttrs: {
     rm -r Grayjay.ClientServer/wwwroot/web
     cp -r ${grayjay-frontend} Grayjay.ClientServer/wwwroot/web
 
-
     mkdir -p JustCef/obj/justcef/net8.0/1/linux-x64
     cp ${justcefNative} \
       JustCef/obj/justcef/net8.0/1/linux-x64/JustCefNative-linux-x64.zip
@@ -160,8 +159,8 @@ buildDotnetModule (finalAttrs: {
     ln -s ${getLibrary libsodium "sodium"} $out/lib/grayjay/libsodium.so
     ln -s ${getLibrary sqlite "sqlite3"} $out/lib/grayjay/libe_sqlite3.so
 
-    # CEF is still vendored for now
-    chmod +x $out/lib/grayjay/cef/dotcefnative
+    # Explicitly fetched and copied over in preBuild
+    chmod +x $out/lib/grayjay/cef/justcefnative
 
     mkdir -p $out/share/icons/hicolor/scalable/apps
     ln -s $out/lib/grayjay/grayjay.png $out/share/icons/hicolor/scalable/apps/grayjay.png

From 7ce635af6f956c01841c001fccf9199b8ed26f19 Mon Sep 17 00:00:00 2001
From: Arnout Engelen <arnout@bzzt.net>
Date: Tue, 25 Aug 2026 18:19:39 +0200
Subject: [PATCH 05/59] doc: python: show how to select the interpreter version

instead of telling the user that it's possible but now how
---
 doc/languages-frameworks/python.section.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index 0a69d93bb745..099f933870cb 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -326,8 +326,8 @@ the packages with the version of the interpreter. Because this is irrelevant for
 applications, the prefix is omitted.
 
 When packaging a Python application with [`buildPythonApplication`](#buildpythonapplication-function), it should be
-called with `callPackage` and passed `python3` or `python3Packages` (possibly
-specifying an interpreter version), like this:
+called with `callPackage` and passed `python3` or `python3Packages` (or possibly
+specifying an interpreter version such as `python313Packages`), like this:
 
 ```nix
 {

From 64836fa25148778609f0c4e613331934b0366e3d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 26 Aug 2026 03:57:51 +0000
Subject: [PATCH 06/59] ejsonkms: 0.3.3 -> 0.3.4

---
 pkgs/by-name/ej/ejsonkms/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ej/ejsonkms/package.nix b/pkgs/by-name/ej/ejsonkms/package.nix
index 7254ce48fe99..2602659d8a3b 100644
--- a/pkgs/by-name/ej/ejsonkms/package.nix
+++ b/pkgs/by-name/ej/ejsonkms/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "ejsonkms";
-  version = "0.3.3";
+  version = "0.3.4";
 
   src = fetchFromGitHub {
     owner = "envato";
     repo = "ejsonkms";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-PoFRKnh9XMXOPn2kj9UCzO0ahom+c4bSvxszNQ941L0=";
+    hash = "sha256-uvTIyc3z8rpculfmiV8ojQ5K70R5cwP7IQPrM5teSQQ=";
   };
 
-  vendorHash = "sha256-GHLS5fQo65vS0uEo0xTC9oiznmwW27wvu7TYl0BjqR4=";
+  vendorHash = "sha256-RXzZ+5CqVBcGAYB/IiPG8Mu4fUAgE0xr1UUVMqWTwEw=";
 
   ldflags = [
     "-X main.version=v${finalAttrs.version}"

From 4e9afd8fa7f8b9bc7128630d76623bd4e103d48c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jo=C3=A3o=20Santos=20Reis?= <joao.reis@tweag.io>
Date: Thu, 3 Sep 2026 09:37:07 +0100
Subject: [PATCH 07/59] python3Packages.asynch: init at 0.4.0
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: José Luis Lafuente <jl@lafuente.dev>
Co-authored-by: João Santos Reis <joao.reis@tweag.io>
---
 .../python-modules/asynch/default.nix         | 72 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 74 insertions(+)
 create mode 100644 pkgs/development/python-modules/asynch/default.nix

diff --git a/pkgs/development/python-modules/asynch/default.nix b/pkgs/development/python-modules/asynch/default.nix
new file mode 100644
index 000000000000..47da889e7410
--- /dev/null
+++ b/pkgs/development/python-modules/asynch/default.nix
@@ -0,0 +1,72 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pythonOlder,
+  poetry-core,
+  setuptools,
+  cython,
+  ciso8601,
+  tzdata,
+  lz4,
+  tzlocal,
+  zstd,
+  clickhouse-cityhash,
+  stdenv,
+  nix-update-script,
+  nixosTests,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "asynch";
+  version = "0.4.0";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "long2ice";
+    repo = "asynch";
+    tag = "v${finalAttrs.version}";
+    sha256 = "sha256-iLhhk7EiNHMVzxlw7HWjS00GwZ8cRXPz3jih1edWde4=";
+  };
+
+  disabled = pythonOlder "3.11";
+
+  build-system = [
+    poetry-core
+    setuptools
+    cython
+  ];
+
+  dependencies = [
+    ciso8601
+    tzlocal
+  ]
+  ++ lib.optionals (stdenv.hostPlatform.isWindows) [
+    tzdata
+  ];
+
+  optional-dependencies = {
+    compression = [
+      clickhouse-cityhash
+      lz4
+    ]
+    ++ lib.optionals (pythonOlder "3.14") [
+      zstd
+    ];
+  };
+
+  pythonImportsCheck = [
+    "asynch"
+  ];
+
+  meta = {
+    description = "Asyncio driver for ClickHouse with native TCP support";
+    homepage = "https://github.com/long2ice/asynch";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      jlesquembre
+      joaosreis
+    ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 81b1bd4dac5a..931702ec6e5e 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -1224,6 +1224,8 @@ self: super: with self; {
 
   asyncer = callPackage ../development/python-modules/asyncer { };
 
+  asynch = callPackage ../development/python-modules/asynch { };
+
   asyncinotify = callPackage ../development/python-modules/asyncinotify { };
 
   asyncio-dgram = callPackage ../development/python-modules/asyncio-dgram { };

From 64f1825814e7370239b9e470774ec526ed5c352d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jo=C3=A3o=20Santos=20Reis?= <joao.reis@tweag.io>
Date: Thu, 3 Sep 2026 09:37:38 +0100
Subject: [PATCH 08/59] nixosTests: add asynch test

---
 nixos/tests/all-tests.nix                     |  1 +
 nixos/tests/asynch.nix                        | 37 +++++++++++++++++++
 .../python-modules/asynch/default.nix         |  7 ++++
 3 files changed, 45 insertions(+)
 create mode 100644 nixos/tests/asynch.nix

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 1b57744633bd..5c2406290251 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -233,6 +233,7 @@ in
   aria2 = runTest ./aria2.nix;
   armagetronad = runTest ./armagetronad.nix;
   artalk = runTest ./artalk.nix;
+  asynch = runTest ./asynch.nix;
   atd = runTest ./atd.nix;
   atop = import ./atop.nix { inherit pkgs runTest; };
   atticd = runTest ./atticd.nix;
diff --git a/nixos/tests/asynch.nix b/nixos/tests/asynch.nix
new file mode 100644
index 000000000000..10a6a6fa690e
--- /dev/null
+++ b/nixos/tests/asynch.nix
@@ -0,0 +1,37 @@
+{ lib, pkgs, ... }:
+let
+  pythonEnv = pkgs.python3.withPackages (p: [
+    p.asynch
+    p.pytest
+    p.pytest-asyncio
+    p.pytest-random-order
+    p.pytest-mock
+    p.pytest-xdist
+  ]);
+in
+{
+  name = "asynch";
+  meta.maintainers = [ lib.maintainers.joaosreis ];
+
+  nodes.machine =
+    { ... }:
+    {
+      environment.systemPackages = [ pythonEnv ];
+
+      services.clickhouse.enable = true;
+    };
+
+  testScript = ''
+    start_all()
+
+    machine.wait_for_unit("multi-user.target")
+
+    machine.succeed("mkdir -p /build/source")
+
+    machine.succeed("cp ${pkgs.python3Packages.asynch.src}/pyproject.toml /build/source && cp -r ${pkgs.python3Packages.asynch.src}/tests /build/source/tests")
+
+    machine.wait_for_unit("clickhouse.service")
+
+    machine.succeed("cd /build/source && systemd-cat -t asynch-test ${pythonEnv.interpreter} -m pytest");
+  '';
+}
diff --git a/pkgs/development/python-modules/asynch/default.nix b/pkgs/development/python-modules/asynch/default.nix
index 47da889e7410..bcf7eda66130 100644
--- a/pkgs/development/python-modules/asynch/default.nix
+++ b/pkgs/development/python-modules/asynch/default.nix
@@ -60,6 +60,13 @@ buildPythonPackage (finalAttrs: {
     "asynch"
   ];
 
+  passthru = {
+    updateScript = nix-update-script { };
+    tests = {
+      inherit (nixosTests) asynch;
+    };
+  };
+
   meta = {
     description = "Asyncio driver for ClickHouse with native TCP support";
     homepage = "https://github.com/long2ice/asynch";

From f0833b4942c135f9eadb614e98a16dcf49bef5af Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Wed, 18 Feb 2026 09:35:53 +0100
Subject: [PATCH 09/59] greenlight: init at 3.8.2.4

---
 pkgs/by-name/gr/greenlight/Gemfile.lock       |  583 ++++
 .../greenlight/expose_rails_dev_configs.patch |   17 +
 pkgs/by-name/gr/greenlight/gemset.nix         | 2838 +++++++++++++++++
 pkgs/by-name/gr/greenlight/package.nix        |  119 +
 pkgs/by-name/gr/greenlight/update.sh          |   20 +
 5 files changed, 3577 insertions(+)
 create mode 100644 pkgs/by-name/gr/greenlight/Gemfile.lock
 create mode 100644 pkgs/by-name/gr/greenlight/expose_rails_dev_configs.patch
 create mode 100644 pkgs/by-name/gr/greenlight/gemset.nix
 create mode 100644 pkgs/by-name/gr/greenlight/package.nix
 create mode 100755 pkgs/by-name/gr/greenlight/update.sh

diff --git a/pkgs/by-name/gr/greenlight/Gemfile.lock b/pkgs/by-name/gr/greenlight/Gemfile.lock
new file mode 100644
index 000000000000..29d3bb56fd48
--- /dev/null
+++ b/pkgs/by-name/gr/greenlight/Gemfile.lock
@@ -0,0 +1,583 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    actioncable (7.2.3.1)
+      actionpack (= 7.2.3.1)
+      activesupport (= 7.2.3.1)
+      nio4r (~> 2.0)
+      websocket-driver (>= 0.6.1)
+      zeitwerk (~> 2.6)
+    actionmailbox (7.2.3.1)
+      actionpack (= 7.2.3.1)
+      activejob (= 7.2.3.1)
+      activerecord (= 7.2.3.1)
+      activestorage (= 7.2.3.1)
+      activesupport (= 7.2.3.1)
+      mail (>= 2.8.0)
+    actionmailer (7.2.3.1)
+      actionpack (= 7.2.3.1)
+      actionview (= 7.2.3.1)
+      activejob (= 7.2.3.1)
+      activesupport (= 7.2.3.1)
+      mail (>= 2.8.0)
+      rails-dom-testing (~> 2.2)
+    actionpack (7.2.3.1)
+      actionview (= 7.2.3.1)
+      activesupport (= 7.2.3.1)
+      cgi
+      nokogiri (>= 1.8.5)
+      racc
+      rack (>= 2.2.4, < 3.3)
+      rack-session (>= 1.0.1)
+      rack-test (>= 0.6.3)
+      rails-dom-testing (~> 2.2)
+      rails-html-sanitizer (~> 1.6)
+      useragent (~> 0.16)
+    actiontext (7.2.3.1)
+      actionpack (= 7.2.3.1)
+      activerecord (= 7.2.3.1)
+      activestorage (= 7.2.3.1)
+      activesupport (= 7.2.3.1)
+      globalid (>= 0.6.0)
+      nokogiri (>= 1.8.5)
+    actionview (7.2.3.1)
+      activesupport (= 7.2.3.1)
+      builder (~> 3.1)
+      cgi
+      erubi (~> 1.11)
+      rails-dom-testing (~> 2.2)
+      rails-html-sanitizer (~> 1.6)
+    active_model_serializers (0.10.15)
+      actionpack (>= 4.1)
+      activemodel (>= 4.1)
+      case_transform (>= 0.2)
+      jsonapi-renderer (>= 0.1.1.beta1, < 0.3)
+    active_storage_validations (3.0.2)
+      activejob (>= 6.1.4)
+      activemodel (>= 6.1.4)
+      activestorage (>= 6.1.4)
+      activesupport (>= 6.1.4)
+      marcel (>= 1.0.3)
+    activejob (7.2.3.1)
+      activesupport (= 7.2.3.1)
+      globalid (>= 0.3.6)
+    activemodel (7.2.3.1)
+      activesupport (= 7.2.3.1)
+    activerecord (7.2.3.1)
+      activemodel (= 7.2.3.1)
+      activesupport (= 7.2.3.1)
+      timeout (>= 0.4.0)
+    activestorage (7.2.3.1)
+      actionpack (= 7.2.3.1)
+      activejob (= 7.2.3.1)
+      activerecord (= 7.2.3.1)
+      activesupport (= 7.2.3.1)
+      marcel (~> 1.0)
+    activesupport (7.2.3.1)
+      base64
+      benchmark (>= 0.3)
+      bigdecimal
+      concurrent-ruby (~> 1.0, >= 1.3.1)
+      connection_pool (>= 2.2.5)
+      drb
+      i18n (>= 1.6, < 2)
+      logger (>= 1.4.2)
+      minitest (>= 5.1, < 6)
+      securerandom (>= 0.3)
+      tzinfo (~> 2.0, >= 2.0.5)
+    addressable (2.9.0)
+      public_suffix (>= 2.0.2, < 8.0)
+    aes_key_wrap (1.1.0)
+    ast (2.4.3)
+    attr_required (1.0.2)
+    aws-eventstream (1.4.0)
+    aws-partitions (1.1196.0)
+    aws-sdk-core (3.240.0)
+      aws-eventstream (~> 1, >= 1.3.0)
+      aws-partitions (~> 1, >= 1.992.0)
+      aws-sigv4 (~> 1.9)
+      base64
+      bigdecimal
+      jmespath (~> 1, >= 1.6.1)
+      logger
+    aws-sdk-kms (1.118.0)
+      aws-sdk-core (~> 3, >= 3.239.1)
+      aws-sigv4 (~> 1.5)
+    aws-sdk-s3 (1.208.0)
+      aws-sdk-core (~> 3, >= 3.234.0)
+      aws-sdk-kms (~> 1)
+      aws-sigv4 (~> 1.5)
+    aws-sigv4 (1.12.1)
+      aws-eventstream (~> 1, >= 1.0.2)
+    base64 (0.3.0)
+    bcrypt (3.1.22)
+    benchmark (0.5.0)
+    bigbluebutton-api-ruby (2.0.0)
+      base64 (>= 0.1.0)
+      xml-simple (~> 1.1)
+    bigdecimal (4.1.1)
+    bindata (2.5.1)
+    bindex (0.8.1)
+    bootsnap (1.16.0)
+      msgpack (~> 1.2)
+    builder (3.3.0)
+    capybara (3.40.0)
+      addressable
+      matrix
+      mini_mime (>= 0.1.3)
+      nokogiri (~> 1.11)
+      rack (>= 1.6.0)
+      rack-test (>= 0.6.3)
+      regexp_parser (>= 1.5, < 3.0)
+      xpath (~> 3.2)
+    case_transform (0.2)
+      activesupport
+    cgi (0.5.1)
+    clamby (1.6.10)
+    concurrent-ruby (1.3.7)
+    connection_pool (2.5.5)
+    crack (1.0.0)
+      bigdecimal
+      rexml
+    crass (1.0.6)
+    cssbundling-rails (1.4.3)
+      railties (>= 6.0.0)
+    data_migrate (11.3.1)
+      activerecord (>= 6.1)
+      railties (>= 6.1)
+    date (3.5.1)
+    debug (1.11.0)
+      irb (~> 1.10)
+      reline (>= 0.3.8)
+    declarative (0.0.20)
+    diff-lcs (1.6.2)
+    digest-crc (0.7.0)
+      rake (>= 12.0.0, < 14.0.0)
+    dotenv (3.2.0)
+    dotenv-rails (3.2.0)
+      dotenv (= 3.2.0)
+      railties (>= 6.1)
+    drb (2.2.3)
+    email_validator (2.2.4)
+      activemodel
+    erb (6.0.1.1)
+    erubi (1.13.1)
+    factory_bot (6.5.6)
+      activesupport (>= 6.1.0)
+    factory_bot_rails (6.5.1)
+      factory_bot (~> 6.5)
+      railties (>= 6.1.0)
+    faker (3.1.1)
+      i18n (>= 1.8.11, < 2)
+    faraday (2.14.3)
+      faraday-net_http (>= 2.0, < 3.5)
+      json
+      logger
+    faraday-follow_redirects (0.4.0)
+      faraday (>= 1, < 3)
+    faraday-net_http (3.4.4)
+      net-http (~> 0.5)
+    ffi (1.17.2)
+    globalid (1.3.0)
+      activesupport (>= 6.1)
+    google-apis-core (1.0.2)
+      addressable (~> 2.8, >= 2.8.7)
+      faraday (~> 2.13)
+      faraday-follow_redirects (~> 0.3)
+      googleauth (~> 1.14)
+      mini_mime (~> 1.1)
+      representable (~> 3.0)
+      retriable (~> 3.1)
+    google-apis-iamcredentials_v1 (0.26.0)
+      google-apis-core (>= 0.15.0, < 2.a)
+    google-apis-storage_v1 (0.60.0)
+      google-apis-core (>= 0.15.0, < 2.a)
+    google-cloud-core (1.8.0)
+      google-cloud-env (>= 1.0, < 3.a)
+      google-cloud-errors (~> 1.0)
+    google-cloud-env (2.3.1)
+      base64 (~> 0.2)
+      faraday (>= 1.0, < 3.a)
+    google-cloud-errors (1.5.0)
+    google-cloud-storage (1.58.0)
+      addressable (~> 2.8)
+      digest-crc (~> 0.4)
+      google-apis-core (>= 0.18, < 2)
+      google-apis-iamcredentials_v1 (~> 0.18)
+      google-apis-storage_v1 (>= 0.42)
+      google-cloud-core (~> 1.6)
+      googleauth (~> 1.9)
+      mini_mime (~> 1.0)
+    google-logging-utils (0.2.0)
+    googleauth (1.16.1)
+      faraday (>= 1.0, < 3.a)
+      google-cloud-env (~> 2.2)
+      google-logging-utils (~> 0.1)
+      jwt (>= 1.4, < 4.0)
+      multi_json (~> 1.11)
+      os (>= 0.9, < 2.0)
+      signet (>= 0.16, < 2.a)
+    hashdiff (1.1.2)
+    hashie (5.0.0)
+    hcaptcha (7.1.0)
+      json
+    i18n (1.14.8)
+      concurrent-ruby (~> 1.0)
+    i18n-language-mapping (0.1.3.1)
+    image_processing (1.12.2)
+      mini_magick (>= 4.9.5, < 5)
+      ruby-vips (>= 2.0.17, < 3)
+    io-console (0.8.1)
+    irb (1.15.3)
+      pp (>= 0.6.0)
+      rdoc (>= 4.0.0)
+      reline (>= 0.4.2)
+    jbuilder (2.13.0)
+      actionview (>= 5.0.0)
+      activesupport (>= 5.0.0)
+    jmespath (1.6.2)
+    jsbundling-rails (1.3.1)
+      railties (>= 6.0.0)
+    json (2.19.9)
+    json-jwt (1.17.0)
+      activesupport (>= 4.2)
+      aes_key_wrap
+      base64
+      bindata
+      faraday (~> 2.0)
+      faraday-follow_redirects
+    jsonapi-renderer (0.2.2)
+    jwt (3.2.0)
+      base64
+    language_server-protocol (3.17.0.5)
+    lint_roller (1.1.0)
+    logger (1.7.0)
+    lograge (0.14.0)
+      actionpack (>= 4)
+      activesupport (>= 4)
+      railties (>= 4)
+      request_store (~> 1.0)
+    loofah (2.25.1)
+      crass (~> 1.0.2)
+      nokogiri (>= 1.12.0)
+    mail (2.9.0)
+      logger
+      mini_mime (>= 0.1.1)
+      net-imap
+      net-pop
+      net-smtp
+    marcel (1.1.0)
+    matrix (0.4.3)
+    mini_magick (4.12.0)
+    mini_mime (1.1.5)
+    mini_portile2 (2.8.9)
+    minitest (5.27.0)
+    msgpack (1.6.0)
+    multi_json (1.19.1)
+    net-http (0.9.1)
+      uri (>= 0.11.1)
+    net-imap (0.5.15)
+      date
+      net-protocol
+    net-pop (0.1.2)
+      net-protocol
+    net-protocol (0.2.2)
+      timeout
+    net-smtp (0.5.1)
+      net-protocol
+    nio4r (2.7.5)
+    nkf (0.2.0)
+    nokogiri (1.19.4)
+      mini_portile2 (~> 2.8.2)
+      racc (~> 1.4)
+    omniauth (2.1.4)
+      hashie (>= 3.4.6)
+      logger
+      rack (>= 2.2.3)
+      rack-protection
+    omniauth-rails_csrf_protection (2.0.0)
+      actionpack (>= 4.2)
+      omniauth (~> 2.0)
+    omniauth_openid_connect (0.8.0)
+      omniauth (>= 1.9, < 3)
+      openid_connect (~> 2.2)
+    openid_connect (2.3.1)
+      activemodel
+      attr_required (>= 1.0.0)
+      email_validator
+      faraday (~> 2.0)
+      faraday-follow_redirects
+      json-jwt (>= 1.16)
+      mail
+      rack-oauth2 (~> 2.2)
+      swd (~> 2.0)
+      tzinfo
+      validate_url
+      webfinger (~> 2.0)
+    os (1.1.4)
+    pagy (6.0.4)
+    parallel (1.27.0)
+    parser (3.3.10.0)
+      ast (~> 2.4.1)
+      racc
+    pg (1.4.5)
+    pp (0.6.3)
+      prettyprint
+    prettyprint (0.2.0)
+    prism (1.6.0)
+    psych (5.2.6)
+      date
+      stringio
+    public_suffix (7.0.5)
+    puma (7.2.1)
+      nio4r (~> 2.0)
+    racc (1.8.1)
+    rack (3.2.6)
+    rack-oauth2 (2.3.0)
+      activesupport
+      attr_required
+      faraday (~> 2.0)
+      faraday-follow_redirects
+      json-jwt (>= 1.11.0)
+      rack (>= 2.1.0)
+    rack-protection (4.2.1)
+      base64 (>= 0.1.0)
+      logger (>= 1.6.0)
+      rack (>= 3.0.0, < 4)
+    rack-session (2.1.2)
+      base64 (>= 0.1.0)
+      rack (>= 3.0.0)
+    rack-test (2.2.0)
+      rack (>= 1.3)
+    rackup (2.2.1)
+      rack (>= 3)
+    rails (7.2.3.1)
+      actioncable (= 7.2.3.1)
+      actionmailbox (= 7.2.3.1)
+      actionmailer (= 7.2.3.1)
+      actionpack (= 7.2.3.1)
+      actiontext (= 7.2.3.1)
+      actionview (= 7.2.3.1)
+      activejob (= 7.2.3.1)
+      activemodel (= 7.2.3.1)
+      activerecord (= 7.2.3.1)
+      activestorage (= 7.2.3.1)
+      activesupport (= 7.2.3.1)
+      bundler (>= 1.15.0)
+      railties (= 7.2.3.1)
+    rails-dom-testing (2.3.0)
+      activesupport (>= 5.0.0)
+      minitest
+      nokogiri (>= 1.6)
+    rails-html-sanitizer (1.7.0)
+      loofah (~> 2.25)
+      nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
+    railties (7.2.3.1)
+      actionpack (= 7.2.3.1)
+      activesupport (= 7.2.3.1)
+      cgi
+      irb (~> 1.13)
+      rackup (>= 1.0.0)
+      rake (>= 12.2)
+      thor (~> 1.0, >= 1.2.2)
+      tsort (>= 0.2)
+      zeitwerk (~> 2.6)
+    rainbow (3.1.1)
+    rake (13.3.1)
+    rdoc (6.16.1)
+      erb
+      psych (>= 4.0.0)
+      tsort
+    redis (4.8.0)
+    regexp_parser (2.11.3)
+    reline (0.6.3)
+      io-console (~> 0.5)
+    remote_syslog_logger (1.0.4)
+      syslog_protocol
+    representable (3.2.0)
+      declarative (< 0.1.0)
+      trailblazer-option (>= 0.1.1, < 0.2.0)
+      uber (< 0.2.0)
+    request_store (1.5.1)
+      rack (>= 1.4)
+    retriable (3.1.2)
+    rexml (3.4.4)
+    rspec-core (3.13.6)
+      rspec-support (~> 3.13.0)
+    rspec-expectations (3.13.5)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.13.0)
+    rspec-mocks (3.13.7)
+      diff-lcs (>= 1.2.0, < 2.0)
+      rspec-support (~> 3.13.0)
+    rspec-rails (7.1.1)
+      actionpack (>= 7.0)
+      activesupport (>= 7.0)
+      railties (>= 7.0)
+      rspec-core (~> 3.13)
+      rspec-expectations (~> 3.13)
+      rspec-mocks (~> 3.13)
+      rspec-support (~> 3.13)
+    rspec-support (3.13.6)
+    rubocop (1.81.7)
+      json (~> 2.3)
+      language_server-protocol (~> 3.17.0.2)
+      lint_roller (~> 1.1.0)
+      parallel (~> 1.10)
+      parser (>= 3.3.0.2)
+      rainbow (>= 2.2.2, < 4.0)
+      regexp_parser (>= 2.9.3, < 3.0)
+      rubocop-ast (>= 1.47.1, < 2.0)
+      ruby-progressbar (~> 1.7)
+      unicode-display_width (>= 2.4.0, < 4.0)
+    rubocop-ast (1.48.0)
+      parser (>= 3.3.7.2)
+      prism (~> 1.4)
+    rubocop-capybara (2.19.0)
+      rubocop (~> 1.41)
+    rubocop-factory_bot (2.24.0)
+      rubocop (~> 1.33)
+    rubocop-performance (1.16.0)
+      rubocop (>= 1.7.0, < 2.0)
+      rubocop-ast (>= 0.4.0)
+    rubocop-rails (2.34.2)
+      activesupport (>= 4.2.0)
+      lint_roller (~> 1.1)
+      rack (>= 1.1)
+      rubocop (>= 1.75.0, < 2.0)
+      rubocop-ast (>= 1.44.0, < 2.0)
+    rubocop-rspec (2.9.0)
+      rubocop (~> 1.19)
+    ruby-progressbar (1.13.0)
+    ruby-vips (2.1.4)
+      ffi (~> 1.12)
+    rubyzip (2.4.1)
+    securerandom (0.4.1)
+    selenium-webdriver (4.8.0)
+      rexml (~> 3.2, >= 3.2.5)
+      rubyzip (>= 1.2.2, < 3.0)
+      websocket (~> 1.0)
+    shoulda-matchers (5.3.0)
+      activesupport (>= 5.2.0)
+    signet (0.21.0)
+      addressable (~> 2.8)
+      faraday (>= 0.17.5, < 3.a)
+      jwt (>= 1.5, < 4.0)
+      multi_json (~> 1.10)
+    sprockets (4.2.2)
+      concurrent-ruby (~> 1.0)
+      logger
+      rack (>= 2.2.4, < 4)
+    sprockets-rails (3.5.2)
+      actionpack (>= 6.1)
+      activesupport (>= 6.1)
+      sprockets (>= 3.0.0)
+    stringio (3.1.9)
+    swd (2.0.3)
+      activesupport (>= 3)
+      attr_required (>= 0.0.5)
+      faraday (~> 2.0)
+      faraday-follow_redirects
+    syslog_protocol (0.9.2)
+    thor (1.4.0)
+    timeout (0.6.1)
+    trailblazer-option (0.1.2)
+    tsort (0.2.0)
+    tzinfo (2.0.6)
+      concurrent-ruby (~> 1.0)
+    uber (0.1.0)
+    unicode-display_width (3.2.0)
+      unicode-emoji (~> 4.1)
+    unicode-emoji (4.1.0)
+    uri (1.1.1)
+    useragent (0.16.11)
+    validate_url (1.0.15)
+      activemodel (>= 3.0.0)
+      public_suffix
+    web-console (4.2.1)
+      actionview (>= 6.0.0)
+      activemodel (>= 6.0.0)
+      bindex (>= 0.4.0)
+      railties (>= 6.0.0)
+    webdrivers (5.2.0)
+      nokogiri (~> 1.6)
+      rubyzip (>= 1.3.0)
+      selenium-webdriver (~> 4.0)
+    webfinger (2.1.3)
+      activesupport
+      faraday (~> 2.0)
+      faraday-follow_redirects
+    webmock (3.24.0)
+      addressable (>= 2.8.0)
+      crack (>= 0.3.2)
+      hashdiff (>= 0.4.0, < 2.0.0)
+    websocket (1.2.9)
+    websocket-driver (0.8.1)
+      base64
+      websocket-extensions (>= 0.1.0)
+    websocket-extensions (0.1.5)
+    xml-simple (1.1.9)
+      rexml
+    xpath (3.2.0)
+      nokogiri (~> 1.8)
+    zeitwerk (2.7.3)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  active_model_serializers (>= 0.10.15)
+  active_storage_validations (>= 1.4.0)
+  aws-sdk-s3
+  bcrypt (~> 3.1.22)
+  bigbluebutton-api-ruby (= 2.0.0)
+  bootsnap
+  capybara (>= 3.39.0)
+  clamby (~> 1.6.10)
+  connection_pool (~> 2.4)
+  cssbundling-rails (>= 1.4.0)
+  data_migrate (>= 11.3.0)
+  debug
+  dotenv-rails (>= 3.0.0)
+  factory_bot (>= 6.4.1)
+  factory_bot_rails (>= 6.4.4)
+  faker
+  google-cloud-storage (~> 1.45, >= 1.45.0)
+  hcaptcha
+  i18n-language-mapping
+  image_processing (~> 1.2)
+  jbuilder (>= 2.12)
+  jsbundling-rails (>= 1.3.0)
+  jwt
+  lograge (~> 0.14.0)
+  mini_magick (>= 4.9.5)
+  nkf (~> 0.2.0)
+  omniauth (~> 2.1.3)
+  omniauth-rails_csrf_protection (~> 2.0.0)
+  omniauth_openid_connect (>= 0.8.0)
+  pagy (~> 6.0, >= 6.0.0)
+  pg
+  puma (~> 7.2)
+  rails (~> 7.2.3)
+  redis (~> 4.8.0)
+  remote_syslog_logger
+  rspec-rails (~> 7.1, >= 7.1.1)
+  rubocop (~> 1.26)
+  rubocop-capybara (~> 2.19.0)
+  rubocop-factory_bot (~> 2.24.0)
+  rubocop-performance (~> 1.13)
+  rubocop-rails (~> 2.21, >= 2.21.0)
+  rubocop-rspec (~> 2.9.0)
+  selenium-webdriver
+  shoulda-matchers (~> 5.0)
+  sprockets-rails (>= 3.5.1)
+  tzinfo-data
+  web-console (>= 4.2.1)
+  webdrivers
+  webmock (>= 3.23.1)
+
+RUBY VERSION
+   ruby 3.3.10p183
+
+BUNDLED WITH
+   2.5.22
diff --git a/pkgs/by-name/gr/greenlight/expose_rails_dev_configs.patch b/pkgs/by-name/gr/greenlight/expose_rails_dev_configs.patch
new file mode 100644
index 000000000000..8e5caf2400b6
--- /dev/null
+++ b/pkgs/by-name/gr/greenlight/expose_rails_dev_configs.patch
@@ -0,0 +1,17 @@
+diff --git a/config/environments/development.rb b/config/environments/development.rb
+index c0cba740..a4a3f4d1 100644
+--- a/config/environments/development.rb
++++ b/config/environments/development.rb
+@@ -117,6 +117,12 @@ Rails.application.configure do
+   # Suppress logger output for asset requests.
+   config.assets.quiet = true
+ 
++  # Do not dump schema after migrations.
++  config.active_record.dump_schema_after_migration = Rails.env.development? && ENV["RAILS_DUMP_SCHEMA"] != "false"
++
++  # Ensure requests are considered secure if they come through a reverse proxy with the correct headers
++  config.action_controller.forgery_protection_origin_check = ENV['FORGERY_ORIGIN_CHECK'] != 'false'
++
+   # Raises error for missing translations.
+   # config.i18n.raise_on_missing_translations = true
+ 
diff --git a/pkgs/by-name/gr/greenlight/gemset.nix b/pkgs/by-name/gr/greenlight/gemset.nix
new file mode 100644
index 000000000000..65701b33e950
--- /dev/null
+++ b/pkgs/by-name/gr/greenlight/gemset.nix
@@ -0,0 +1,2838 @@
+{
+  actioncable = {
+    dependencies = [
+      "actionpack"
+      "activesupport"
+      "nio4r"
+      "websocket-driver"
+      "zeitwerk"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0g5kbrqvhwlliyrzd2bhc3kdiqm58df0x3w716bs0ygwyjil1gyk";
+      type = "gem";
+    };
+    version = "7.2.3.1";
+  };
+  actionmailbox = {
+    dependencies = [
+      "actionpack"
+      "activejob"
+      "activerecord"
+      "activestorage"
+      "activesupport"
+      "mail"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0hf59r6sk0qb5va0ga549rbadcb5n1a2ry8nlkszzcksr6039rx4";
+      type = "gem";
+    };
+    version = "7.2.3.1";
+  };
+  actionmailer = {
+    dependencies = [
+      "actionpack"
+      "actionview"
+      "activejob"
+      "activesupport"
+      "mail"
+      "rails-dom-testing"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0rq4aan18y6gwziabnj1q1486349k1v1i5m7ysv206pqqpavcy7m";
+      type = "gem";
+    };
+    version = "7.2.3.1";
+  };
+  actionpack = {
+    dependencies = [
+      "actionview"
+      "activesupport"
+      "cgi"
+      "nokogiri"
+      "racc"
+      "rack"
+      "rack-session"
+      "rack-test"
+      "rails-dom-testing"
+      "rails-html-sanitizer"
+      "useragent"
+    ];
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1jp4w493wvfh9246wxk7g00m1a3vmzkvs0rznq62fwvjjdzzwsmn";
+      type = "gem";
+    };
+    version = "7.2.3.1";
+  };
+  actiontext = {
+    dependencies = [
+      "actionpack"
+      "activerecord"
+      "activestorage"
+      "activesupport"
+      "globalid"
+      "nokogiri"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1qs350j3zm7sd6xxn61d93mv3lx1ravbjqja12c7nd7a0zs1h52v";
+      type = "gem";
+    };
+    version = "7.2.3.1";
+  };
+  actionview = {
+    dependencies = [
+      "activesupport"
+      "builder"
+      "cgi"
+      "erubi"
+      "rails-dom-testing"
+      "rails-html-sanitizer"
+    ];
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0z7zy6ibfpsdj9jbdm54bx3ws4dszcq7qa564jn645rr8dlbh6fy";
+      type = "gem";
+    };
+    version = "7.2.3.1";
+  };
+  active_model_serializers = {
+    dependencies = [
+      "actionpack"
+      "activemodel"
+      "case_transform"
+      "jsonapi-renderer"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0k0cig5ic38vfd7iba3rv3h7hs2lmycqp0wx4w286kmbhch5n9q8";
+      type = "gem";
+    };
+    version = "0.10.15";
+  };
+  active_storage_validations = {
+    dependencies = [
+      "activejob"
+      "activemodel"
+      "activestorage"
+      "activesupport"
+      "marcel"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0yzi57ss7mqi8vfw87dsdqlbpgx3sqisivplf9ylqglj5hjaqxs2";
+      type = "gem";
+    };
+    version = "3.0.2";
+  };
+  activejob = {
+    dependencies = [
+      "activesupport"
+      "globalid"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1n3fiwm1x3dxwj36n9pspd2bgffyw28ys9yd36hjvf3iwdy25i0b";
+      type = "gem";
+    };
+    version = "7.2.3.1";
+  };
+  activemodel = {
+    dependencies = [ "activesupport" ];
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1l60a6mqx1wgp15ki1cp68djci0czgrikpydii5bd877hndqdq9r";
+      type = "gem";
+    };
+    version = "7.2.3.1";
+  };
+  activerecord = {
+    dependencies = [
+      "activemodel"
+      "activesupport"
+      "timeout"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0pd0f1hy6rvyanmrklqir33xq0jb2my4jajz7hc38nysfpi175dq";
+      type = "gem";
+    };
+    version = "7.2.3.1";
+  };
+  activestorage = {
+    dependencies = [
+      "actionpack"
+      "activejob"
+      "activerecord"
+      "activesupport"
+      "marcel"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1azzbpfp726yigwzmj8g2jji149wisnwrgb86zix6mk25sj4w8hb";
+      type = "gem";
+    };
+    version = "7.2.3.1";
+  };
+  activesupport = {
+    dependencies = [
+      "base64"
+      "benchmark"
+      "bigdecimal"
+      "concurrent-ruby"
+      "connection_pool"
+      "drb"
+      "i18n"
+      "logger"
+      "minitest"
+      "securerandom"
+      "tzinfo"
+    ];
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0d6bhg9cim83g8cypjd7cms45ng4p9ga69v26i3vp823d98yvsqi";
+      type = "gem";
+    };
+    version = "7.2.3.1";
+  };
+  addressable = {
+    dependencies = [ "public_suffix" ];
+    groups = [
+      "default"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1by7h2lwziiblizpd5yx87jsq8ppdhzvwf08ga34wzqgcv1nmpvz";
+      type = "gem";
+    };
+    version = "2.9.0";
+  };
+  aes_key_wrap = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "19bn0y70qm6mfj4y1m0j3s8ggh6dvxwrwrj5vfamhdrpddsz8ddr";
+      type = "gem";
+    };
+    version = "1.1.0";
+  };
+  ast = {
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "10yknjyn0728gjn6b5syynvrvrwm66bhssbxq8mkhshxghaiailm";
+      type = "gem";
+    };
+    version = "2.4.3";
+  };
+  attr_required = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "16fbwr6nmsn97n0a6k1nwbpyz08zpinhd6g7196lz1syndbgrszh";
+      type = "gem";
+    };
+    version = "1.0.2";
+  };
+  aws-eventstream = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0fqqdqg15rgwgz3mn4pj91agd20csk9gbrhi103d20328dfghsqi";
+      type = "gem";
+    };
+    version = "1.4.0";
+  };
+  aws-partitions = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0r2mqf3mi41nfa3pqm6c7gbrvd6fydvsnnfakyzqbxwq29zwyqhs";
+      type = "gem";
+    };
+    version = "1.1196.0";
+  };
+  aws-sdk-core = {
+    dependencies = [
+      "aws-eventstream"
+      "aws-partitions"
+      "aws-sigv4"
+      "base64"
+      "bigdecimal"
+      "jmespath"
+      "logger"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "17hqin6ngvlhhb414pxlq8q95j0fndljcblp09kzbajwaa83idl6";
+      type = "gem";
+    };
+    version = "3.240.0";
+  };
+  aws-sdk-kms = {
+    dependencies = [
+      "aws-sdk-core"
+      "aws-sigv4"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1gbgf7xgg2hrrc51g3mpf0isba801w0r0z45mjnh45agdmcm3iy9";
+      type = "gem";
+    };
+    version = "1.118.0";
+  };
+  aws-sdk-s3 = {
+    dependencies = [
+      "aws-sdk-core"
+      "aws-sdk-kms"
+      "aws-sigv4"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0vbxg6hy0j2b931llwc0jxg1q27grbs31zdhzwjy9fki05817kiz";
+      type = "gem";
+    };
+    version = "1.208.0";
+  };
+  aws-sigv4 = {
+    dependencies = [ "aws-eventstream" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "003ch8qzh3mppsxch83ns0jra8d222ahxs96p9cdrl0grfazywv9";
+      type = "gem";
+    };
+    version = "1.12.1";
+  };
+  base64 = {
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0yx9yn47a8lkfcjmigk79fykxvr80r4m1i35q82sxzynpbm7lcr7";
+      type = "gem";
+    };
+    version = "0.3.0";
+  };
+  bcrypt = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0clhya4p8lhjj7hp31inp321wgzb0b5wbwppmya5sw1dikl7400z";
+      type = "gem";
+    };
+    version = "3.1.22";
+  };
+  benchmark = {
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0v1337j39w1z7x9zs4q7ag0nfv4vs4xlsjx2la0wpv8s6hig2pa6";
+      type = "gem";
+    };
+    version = "0.5.0";
+  };
+  bigbluebutton-api-ruby = {
+    dependencies = [
+      "base64"
+      "xml-simple"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0iwklxlsl0bxdn7dc9inx7nhi6n5dmk0safbh2s1v03dh2v5w55l";
+      type = "gem";
+    };
+    version = "2.0.0";
+  };
+  bigdecimal = {
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1jjlh2zkxdl4jm2xslmrmpgr3wqgxkd0qsrir01m590xjsmyy28w";
+      type = "gem";
+    };
+    version = "4.1.1";
+  };
+  bindata = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0n4ymlgik3xcg94h52dzmh583ss40rl3sn0kni63v56sq8g6l62k";
+      type = "gem";
+    };
+    version = "2.5.1";
+  };
+  bindex = {
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0zmirr3m02p52bzq4xgksq4pn8j641rx5d4czk68pv9rqnfwq7kv";
+      type = "gem";
+    };
+    version = "0.8.1";
+  };
+  bootsnap = {
+    dependencies = [ "msgpack" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1vcg52gwl64xhhal6kwk1pc01y1klzdlnv1awyk89kb91z010x7q";
+      type = "gem";
+    };
+    version = "1.16.0";
+  };
+  builder = {
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0pw3r2lyagsxkm71bf44v5b74f7l9r7di22brbyji9fwz791hya9";
+      type = "gem";
+    };
+    version = "3.3.0";
+  };
+  capybara = {
+    dependencies = [
+      "addressable"
+      "matrix"
+      "mini_mime"
+      "nokogiri"
+      "rack"
+      "rack-test"
+      "regexp_parser"
+      "xpath"
+    ];
+    groups = [ "test" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1vxfah83j6zpw3v5hic0j70h519nvmix2hbszmjwm8cfawhagns2";
+      type = "gem";
+    };
+    version = "3.40.0";
+  };
+  case_transform = {
+    dependencies = [ "activesupport" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0fzyws6spn5arqf6q604dh9mrj84a36k5hsc8z7jgcpfvhc49bg2";
+      type = "gem";
+    };
+    version = "0.2";
+  };
+  cgi = {
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1s8qdw1nfh3njd47q154njlfyc2llcgi4ik13vz39adqd7yclgz9";
+      type = "gem";
+    };
+    version = "0.5.1";
+  };
+  clamby = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0ic994a40clll23i99fdp4aikhd4c6hhzr9m32wahnzv38i0hk1r";
+      type = "gem";
+    };
+    version = "1.6.10";
+  };
+  concurrent-ruby = {
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1c2i64xsd35vijnb50rxb70g508s0x674xi0qpyyb8jy7bncl4j4";
+      type = "gem";
+    };
+    version = "1.3.7";
+  };
+  connection_pool = {
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1b8nlxr5z843ii7hfk6igpr5acw3k2ih9yjrgkyz2gbmallgjkz5";
+      type = "gem";
+    };
+    version = "2.5.5";
+  };
+  crack = {
+    dependencies = [
+      "bigdecimal"
+      "rexml"
+    ];
+    groups = [
+      "default"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0jaa7is4fw1cxigm8vlyhg05bw4nqy4f91zjqxk7pp4c8bdyyfn8";
+      type = "gem";
+    };
+    version = "1.0.0";
+  };
+  crass = {
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0pfl5c0pyqaparxaqxi6s4gfl21bdldwiawrc0aknyvflli60lfw";
+      type = "gem";
+    };
+    version = "1.0.6";
+  };
+  cssbundling-rails = {
+    dependencies = [ "railties" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0hbfji8lddlvsk9x70s5xvafl3w31v6mm5wjrn7rrb14gmdcvbjk";
+      type = "gem";
+    };
+    version = "1.4.3";
+  };
+  data_migrate = {
+    dependencies = [
+      "activerecord"
+      "railties"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1ywg2qvpf1yxfbcdwmw2pl274i4bicjc4gsz6gaq5r0mklcb5f8q";
+      type = "gem";
+    };
+    version = "11.3.1";
+  };
+  date = {
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [
+      {
+        engine = "maglev";
+      }
+      {
+        engine = "mingw";
+      }
+      {
+        engine = "mingw";
+      }
+      {
+        engine = "ruby";
+      }
+    ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1h0db8r2v5llxdbzkzyllkfniqw9gm092qn7cbaib73v9lw0c3bm";
+      type = "gem";
+    };
+    version = "3.5.1";
+  };
+  debug = {
+    dependencies = [
+      "irb"
+      "reline"
+    ];
+    groups = [
+      "development"
+      "test"
+    ];
+    platforms = [
+      {
+        engine = "maglev";
+      }
+      {
+        engine = "mingw";
+      }
+      {
+        engine = "mingw";
+      }
+      {
+        engine = "ruby";
+      }
+    ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1wmfy5n5v2rzpr5vz698sqfj1gl596bxrqw44sahq4x0rxjdn98l";
+      type = "gem";
+    };
+    version = "1.11.0";
+  };
+  declarative = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1yczgnqrbls7shrg63y88g7wand2yp9h6sf56c9bdcksn5nds8c0";
+      type = "gem";
+    };
+    version = "0.0.20";
+  };
+  diff-lcs = {
+    groups = [
+      "default"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0qlrj2qyysc9avzlr4zs1py3x684hqm61n4czrsk1pyllz5x5q4s";
+      type = "gem";
+    };
+    version = "1.6.2";
+  };
+  digest-crc = {
+    dependencies = [ "rake" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "01wcsyhaadss4zzvqh12kvbq3hmkl5y4fck7pr608hd24qxc5bb4";
+      type = "gem";
+    };
+    version = "0.7.0";
+  };
+  dotenv = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "17b1zr9kih0i3wb7h4yq9i8vi6hjfq07857j437a8z7a44qvhxg3";
+      type = "gem";
+    };
+    version = "3.2.0";
+  };
+  dotenv-rails = {
+    dependencies = [
+      "dotenv"
+      "railties"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1axy0frn3xn3jf1gdafx5rzz843551q1ckwcbp4zy8m69dajazk5";
+      type = "gem";
+    };
+    version = "3.2.0";
+  };
+  drb = {
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0wrkl7yiix268s2md1h6wh91311w95ikd8fy8m5gx589npyxc00b";
+      type = "gem";
+    };
+    version = "2.2.3";
+  };
+  email_validator = {
+    dependencies = [ "activemodel" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0106y8xakq6frv2xc68zz76q2l2cqvhfjc7ji69yyypcbc4kicjs";
+      type = "gem";
+    };
+    version = "2.2.4";
+  };
+  erb = {
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [
+      {
+        engine = "maglev";
+      }
+      {
+        engine = "mingw";
+      }
+      {
+        engine = "mingw";
+      }
+      {
+        engine = "ruby";
+      }
+    ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1faq0y37pmxiqz3illx82hmyl7jmzjprwxn5cx3akaaj0r35flyf";
+      type = "gem";
+    };
+    version = "6.0.1.1";
+  };
+  erubi = {
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1naaxsqkv5b3vklab5sbb9sdpszrjzlfsbqpy7ncbnw510xi10m0";
+      type = "gem";
+    };
+    version = "1.13.1";
+  };
+  factory_bot = {
+    dependencies = [ "activesupport" ];
+    groups = [ "test" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0xz02xlnfhj418g51w06asfpcjccf7b66dx6ly3c1k2d45rv7ghj";
+      type = "gem";
+    };
+    version = "6.5.6";
+  };
+  factory_bot_rails = {
+    dependencies = [
+      "factory_bot"
+      "railties"
+    ];
+    groups = [ "test" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0s3dpi8x754bwv4mlasdal8ffiahi4b4ajpccnkaipp4x98lik6k";
+      type = "gem";
+    };
+    version = "6.5.1";
+  };
+  faker = {
+    dependencies = [ "i18n" ];
+    groups = [ "test" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1b8772jybi0vxzbcs5zw17k40z661c8adn2rd6vqqr7ay71bzl09";
+      type = "gem";
+    };
+    version = "3.1.1";
+  };
+  faraday = {
+    dependencies = [
+      "faraday-net_http"
+      "json"
+      "logger"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0y7j6yzv07zggic6g0p2v1ivnvkzsbqjnfdl4215qqb6cxz290hq";
+      type = "gem";
+    };
+    version = "2.14.3";
+  };
+  faraday-follow_redirects = {
+    dependencies = [ "faraday" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1nfmmnmqgbxci7dlca0qnwxn8j29yv7v8wm26m0f4l0kmcc13ynk";
+      type = "gem";
+    };
+    version = "0.4.0";
+  };
+  faraday-net_http = {
+    dependencies = [ "net-http" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "125m3qri52vwh5v9dhq0dkqxf8629cxrf99yyc01pva72wasyy0f";
+      type = "gem";
+    };
+    version = "3.4.4";
+  };
+  ffi = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "19kdyjg3kv7x0ad4xsd4swy5izsbb1vl1rpb6qqcqisr5s23awi9";
+      type = "gem";
+    };
+    version = "1.17.2";
+  };
+  globalid = {
+    dependencies = [ "activesupport" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "04gzhqvsm4z4l12r9dkac9a75ah45w186ydhl0i4andldsnkkih5";
+      type = "gem";
+    };
+    version = "1.3.0";
+  };
+  google-apis-core = {
+    dependencies = [
+      "addressable"
+      "faraday"
+      "faraday-follow_redirects"
+      "googleauth"
+      "mini_mime"
+      "representable"
+      "retriable"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0a961x3jq0wskwgb8ym83viza05bcvsqiny8gg6dc0n9mnm7jids";
+      type = "gem";
+    };
+    version = "1.0.2";
+  };
+  google-apis-iamcredentials_v1 = {
+    dependencies = [ "google-apis-core" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "18s8kshls6amld400434xgmgssn2y9fpqnz9ahjxzkfnl480mxrz";
+      type = "gem";
+    };
+    version = "0.26.0";
+  };
+  google-apis-storage_v1 = {
+    dependencies = [ "google-apis-core" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0yinfpzcrb3pgddla99rslvqzd5isimbbb8n5a628i432avi29dd";
+      type = "gem";
+    };
+    version = "0.60.0";
+  };
+  google-cloud-core = {
+    dependencies = [
+      "google-cloud-env"
+      "google-cloud-errors"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1kw10897ardky1chwwsb8milygzcdi8qlqlhcnqwmkw9y75yswp5";
+      type = "gem";
+    };
+    version = "1.8.0";
+  };
+  google-cloud-env = {
+    dependencies = [
+      "base64"
+      "faraday"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1rvqj6n6qhjmjy0lynpmga7ly48s7dk36i6nj4jqrrvvn8gc1ahg";
+      type = "gem";
+    };
+    version = "2.3.1";
+  };
+  google-cloud-errors = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0jvv9w8s4dqc4ncfa6c6qpdypz2wj8dmgpjd44jq2qhhij5y4sxm";
+      type = "gem";
+    };
+    version = "1.5.0";
+  };
+  google-cloud-storage = {
+    dependencies = [
+      "addressable"
+      "digest-crc"
+      "google-apis-core"
+      "google-apis-iamcredentials_v1"
+      "google-apis-storage_v1"
+      "google-cloud-core"
+      "googleauth"
+      "mini_mime"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1zfzix33r060ch1ms2g7m7zzjhgrp43d67fy3sg1dbvmkixc1v8v";
+      type = "gem";
+    };
+    version = "1.58.0";
+  };
+  google-logging-utils = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0yyzlgy9hx104xhrbl51ana0dl3m5p5989j4lcjsizssxas64m37";
+      type = "gem";
+    };
+    version = "0.2.0";
+  };
+  googleauth = {
+    dependencies = [
+      "faraday"
+      "google-cloud-env"
+      "google-logging-utils"
+      "jwt"
+      "multi_json"
+      "os"
+      "signet"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "173h8r5dzhn4dvq2idx59jaybkhd02dr7333qshc3n2mkp76nxrn";
+      type = "gem";
+    };
+    version = "1.16.1";
+  };
+  hashdiff = {
+    groups = [
+      "default"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0xqsnx25lm1wwgchvrl5xla5zzk3d6gbkdfj062cwggdsvgfwc1c";
+      type = "gem";
+    };
+    version = "1.1.2";
+  };
+  hashie = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1nh3arcrbz1rc1cr59qm53sdhqm137b258y8rcb4cvd3y98lwv4x";
+      type = "gem";
+    };
+    version = "5.0.0";
+  };
+  hcaptcha = {
+    dependencies = [ "json" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0fh6391zlv2ikvzqj2gymb70k1avk1j9da8bzgw0scsz2wqq98m2";
+      type = "gem";
+    };
+    version = "7.1.0";
+  };
+  i18n = {
+    dependencies = [ "concurrent-ruby" ];
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1994i044vdmzzkyr76g8rpl1fq1532wf0sb21xg5r1ilj5iphmr8";
+      type = "gem";
+    };
+    version = "1.14.8";
+  };
+  i18n-language-mapping = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0p1pidcl80iyqavbrlczh8dccpzgb489nbm40mxq2n5qjm07ysbx";
+      type = "gem";
+    };
+    version = "0.1.3.1";
+  };
+  image_processing = {
+    dependencies = [
+      "mini_magick"
+      "ruby-vips"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1f32dzj77p9mfp4q95930vfkp80psf88phjc46jhf9ncl72ykffk";
+      type = "gem";
+    };
+    version = "1.12.2";
+  };
+  io-console = {
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [
+      {
+        engine = "maglev";
+      }
+      {
+        engine = "mingw";
+      }
+      {
+        engine = "mingw";
+      }
+      {
+        engine = "ruby";
+      }
+    ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1jszj95hazqqpnrjjzr326nn1j32xmsc9xvd97mbcrrgdc54858y";
+      type = "gem";
+    };
+    version = "0.8.1";
+  };
+  irb = {
+    dependencies = [
+      "pp"
+      "rdoc"
+      "reline"
+    ];
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [
+      {
+        engine = "maglev";
+      }
+      {
+        engine = "mingw";
+      }
+      {
+        engine = "mingw";
+      }
+      {
+        engine = "ruby";
+      }
+    ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1aja320qnimlnfc80wf2i2x8i99kl5sdzfacsfzzfzzs3vzysja3";
+      type = "gem";
+    };
+    version = "1.15.3";
+  };
+  jbuilder = {
+    dependencies = [
+      "actionview"
+      "activesupport"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1mi7s8kida8rg754bzgiik2mpdwx55x7wxd9ny0sm0803j5a603j";
+      type = "gem";
+    };
+    version = "2.13.0";
+  };
+  jmespath = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1cdw9vw2qly7q7r41s7phnac264rbsdqgj4l0h4nqgbjb157g393";
+      type = "gem";
+    };
+    version = "1.6.2";
+  };
+  jsbundling-rails = {
+    dependencies = [ "railties" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1jn2n5i9qdw6iybb4f6gqkr7k61rafzdh8m0anzlqs8w0mnkz80g";
+      type = "gem";
+    };
+    version = "1.3.1";
+  };
+  json = {
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "16mp8vzgxa8nsa81np042za453j8b0ihpjkf666s7byxrnvjb44v";
+      type = "gem";
+    };
+    version = "2.19.9";
+  };
+  json-jwt = {
+    dependencies = [
+      "activesupport"
+      "aes_key_wrap"
+      "base64"
+      "bindata"
+      "faraday"
+      "faraday-follow_redirects"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1k64mp59jlbqd5hyy46pf93s3yl1xdngfy8i8flq2hn5nhk91ybg";
+      type = "gem";
+    };
+    version = "1.17.0";
+  };
+  jsonapi-renderer = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0ys4drd0k9rw5ixf8n8fx8v0pjh792w4myh0cpdspd317l1lpi5m";
+      type = "gem";
+    };
+    version = "0.2.2";
+  };
+  jwt = {
+    dependencies = [ "base64" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1mqps8z4ly74hpksfajcfamqk1wb79biy187pn10knmi6zzb26al";
+      type = "gem";
+    };
+    version = "3.2.0";
+  };
+  language_server-protocol = {
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1k0311vah76kg5m6zr7wmkwyk5p2f9d9hyckjpn3xgr83ajkj7px";
+      type = "gem";
+    };
+    version = "3.17.0.5";
+  };
+  lint_roller = {
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "11yc0d84hsnlvx8cpk4cbj6a4dz9pk0r1k29p0n1fz9acddq831c";
+      type = "gem";
+    };
+    version = "1.1.0";
+  };
+  logger = {
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "00q2zznygpbls8asz5knjvvj2brr3ghmqxgr83xnrdj4rk3xwvhr";
+      type = "gem";
+    };
+    version = "1.7.0";
+  };
+  lograge = {
+    dependencies = [
+      "actionpack"
+      "activesupport"
+      "railties"
+      "request_store"
+    ];
+    groups = [ "production" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1qcsvh9k4c0cp6agqm9a8m4x2gg7vifryqr7yxkg2x9ph9silds2";
+      type = "gem";
+    };
+    version = "0.14.0";
+  };
+  loofah = {
+    dependencies = [
+      "crass"
+      "nokogiri"
+    ];
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "011fdngxzr1p9dq2hxqz7qq1glj2g44xnhaadjqlf48cplywfdnl";
+      type = "gem";
+    };
+    version = "2.25.1";
+  };
+  mail = {
+    dependencies = [
+      "logger"
+      "mini_mime"
+      "net-imap"
+      "net-pop"
+      "net-smtp"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0ha9sgkfqna62c1basc17dkx91yk7ppgjq32k4nhrikirlz6g9kg";
+      type = "gem";
+    };
+    version = "2.9.0";
+  };
+  marcel = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1vhb1sbzlq42k2pzd9v0w5ws4kjx184y8h4d63296bn57jiwzkzx";
+      type = "gem";
+    };
+    version = "1.1.0";
+  };
+  matrix = {
+    groups = [
+      "default"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0nscas3a4mmrp1rc07cdjlbbpb2rydkindmbj3v3z5y1viyspmd0";
+      type = "gem";
+    };
+    version = "0.4.3";
+  };
+  mini_magick = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0slh78f9z6n0l1i2km7m48yz7l4fjrk88sj1f4mh1wb39sl2yc37";
+      type = "gem";
+    };
+    version = "4.12.0";
+  };
+  mini_mime = {
+    groups = [
+      "default"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1vycif7pjzkr29mfk4dlqv3disc5dn0va04lkwajlpr1wkibg0c6";
+      type = "gem";
+    };
+    version = "1.1.5";
+  };
+  mini_portile2 = {
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "12f2830x7pq3kj0v8nz0zjvaw02sv01bqs1zwdrc04704kwcgmqc";
+      type = "gem";
+    };
+    version = "2.8.9";
+  };
+  minitest = {
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1mbpz92ml19rcxxfjrj91gmkif9khb1xpzyw38f81rvglgw1ffrd";
+      type = "gem";
+    };
+    version = "5.27.0";
+  };
+  msgpack = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1q03pb0vq8388s431nbxabsfxnch6p304c8vnjlk0zzpcv713yr3";
+      type = "gem";
+    };
+    version = "1.6.0";
+  };
+  multi_json = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1drisvysgvnjlz49a0qcbs294id6mvj3i8iik5rvym68ybwfzvvs";
+      type = "gem";
+    };
+    version = "1.19.1";
+  };
+  net-http = {
+    dependencies = [ "uri" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "15k96fj6qwbaiv6g52l538ass95ds1qwgynqdridz29yqrkhpfi5";
+      type = "gem";
+    };
+    version = "0.9.1";
+  };
+  net-imap = {
+    dependencies = [
+      "date"
+      "net-protocol"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0506bhwr62szwcagcvxayhwz0d20k5ax1sh742va3mjnnkqcfkgn";
+      type = "gem";
+    };
+    version = "0.5.15";
+  };
+  net-pop = {
+    dependencies = [ "net-protocol" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1wyz41jd4zpjn0v1xsf9j778qx1vfrl24yc20cpmph8k42c4x2w4";
+      type = "gem";
+    };
+    version = "0.1.2";
+  };
+  net-protocol = {
+    dependencies = [ "timeout" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1a32l4x73hz200cm587bc29q8q9az278syw3x6fkc9d1lv5y0wxa";
+      type = "gem";
+    };
+    version = "0.2.2";
+  };
+  net-smtp = {
+    dependencies = [ "net-protocol" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0dh7nzjp0fiaqq1jz90nv4nxhc2w359d7c199gmzq965cfps15pd";
+      type = "gem";
+    };
+    version = "0.5.1";
+  };
+  nio4r = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "18fwy5yqnvgixq3cn0h63lm8jaxsjjxkmj8rhiv8wpzv9271d43c";
+      type = "gem";
+    };
+    version = "2.7.5";
+  };
+  nkf = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "09piyp2pd74klb9wcn0zw4mb5l0k9wzwppxggxi1yi95l2ym3hgv";
+      type = "gem";
+    };
+    version = "0.2.0";
+  };
+  nokogiri = {
+    dependencies = [
+      "mini_portile2"
+      "racc"
+    ];
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1d9safb4dly6qmc2g06444l0zifby52yy6j1a5fa1g4j3ihm3jah";
+      type = "gem";
+    };
+    version = "1.19.4";
+  };
+  omniauth = {
+    dependencies = [
+      "hashie"
+      "logger"
+      "rack"
+      "rack-protection"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0g3n12k5npmmgai2cs3snimy6r7h0bvalhjxv0fjxlphjq25p822";
+      type = "gem";
+    };
+    version = "2.1.4";
+  };
+  omniauth-rails_csrf_protection = {
+    dependencies = [
+      "actionpack"
+      "omniauth"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0cdr13881iq087bq30xg7k9hr1i6ffl8sjf63fyj3f712qvy90xx";
+      type = "gem";
+    };
+    version = "2.0.0";
+  };
+  omniauth_openid_connect = {
+    dependencies = [
+      "omniauth"
+      "openid_connect"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "099xg7s6450wlfzs77mbdx78g3dp0glx5q6f44i78akf7283hbqz";
+      type = "gem";
+    };
+    version = "0.8.0";
+  };
+  openid_connect = {
+    dependencies = [
+      "activemodel"
+      "attr_required"
+      "email_validator"
+      "faraday"
+      "faraday-follow_redirects"
+      "json-jwt"
+      "mail"
+      "rack-oauth2"
+      "swd"
+      "tzinfo"
+      "validate_url"
+      "webfinger"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "10i13cn40jiiw8lslkv7bj1isinnwbmzlk6msgiph3gqry08702x";
+      type = "gem";
+    };
+    version = "2.3.1";
+  };
+  os = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0gwd20smyhxbm687vdikfh1gpi96h8qb1x28s2pdcysf6dm6v0ap";
+      type = "gem";
+    };
+    version = "1.1.4";
+  };
+  pagy = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "06vk6hcp8jfijksf0rfmr47la87raw19mr9gmsp3a112nhi75pvz";
+      type = "gem";
+    };
+    version = "6.0.4";
+  };
+  parallel = {
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0c719bfgcszqvk9z47w2p8j2wkz5y35k48ywwas5yxbbh3hm3haa";
+      type = "gem";
+    };
+    version = "1.27.0";
+  };
+  parser = {
+    dependencies = [
+      "ast"
+      "racc"
+    ];
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1mmb59323ldv6vxfmy98azgsla9k3di3fasvpb28hnn5bkx8fdff";
+      type = "gem";
+    };
+    version = "3.3.10.0";
+  };
+  pg = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1wd6nl81nbdwck04hccsm7wf23ghpi8yddd9j4rbwyvyj0sbsff1";
+      type = "gem";
+    };
+    version = "1.4.5";
+  };
+  pp = {
+    dependencies = [ "prettyprint" ];
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [
+      {
+        engine = "maglev";
+      }
+      {
+        engine = "mingw";
+      }
+      {
+        engine = "mingw";
+      }
+      {
+        engine = "ruby";
+      }
+    ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1xlxmg86k5kifci1xvlmgw56x88dmqf04zfzn7zcr4qb8ladal99";
+      type = "gem";
+    };
+    version = "0.6.3";
+  };
+  prettyprint = {
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [
+      {
+        engine = "maglev";
+      }
+      {
+        engine = "mingw";
+      }
+      {
+        engine = "mingw";
+      }
+      {
+        engine = "ruby";
+      }
+    ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "14zicq3plqi217w6xahv7b8f7aj5kpxv1j1w98344ix9h5ay3j9b";
+      type = "gem";
+    };
+    version = "0.2.0";
+  };
+  prism = {
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0sqwckzzpj1mmmjnqcvqmq6adlxbhkf5ij3b6ir4i33ih4d2ih5z";
+      type = "gem";
+    };
+    version = "1.6.0";
+  };
+  psych = {
+    dependencies = [
+      "date"
+      "stringio"
+    ];
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [
+      {
+        engine = "maglev";
+      }
+      {
+        engine = "mingw";
+      }
+      {
+        engine = "mingw";
+      }
+      {
+        engine = "ruby";
+      }
+    ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0vii1xc7x81hicdbp7dlllhmbw5w3jy20shj696n0vfbbnm2hhw1";
+      type = "gem";
+    };
+    version = "5.2.6";
+  };
+  public_suffix = {
+    groups = [
+      "default"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "08znfv30pxmdkjyihvbjqbvv874dj3nybmmyscl958dy3f7v12qs";
+      type = "gem";
+    };
+    version = "7.0.5";
+  };
+  puma = {
+    dependencies = [ "nio4r" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1c0l2jb2d75zdw7diqhh6sciwlxcwfacshp107af0cnmmff0xgyp";
+      type = "gem";
+    };
+    version = "7.2.1";
+  };
+  racc = {
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0byn0c9nkahsl93y9ln5bysq4j31q8xkf2ws42swighxd4lnjzsa";
+      type = "gem";
+    };
+    version = "1.8.1";
+  };
+  rack = {
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1hhjy9gcp52dzij05gmidqac8g28ski5xm67prwmdqmjfcgqxmsy";
+      type = "gem";
+    };
+    version = "3.2.6";
+  };
+  rack-oauth2 = {
+    dependencies = [
+      "activesupport"
+      "attr_required"
+      "faraday"
+      "faraday-follow_redirects"
+      "json-jwt"
+      "rack"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0cn6a9v8nry9fx4zrzp1xakfp2n5xv5075j90q56m20k7zvjrq23";
+      type = "gem";
+    };
+    version = "2.3.0";
+  };
+  rack-protection = {
+    dependencies = [
+      "base64"
+      "logger"
+      "rack"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1b4bamcbpk29i7jvly3i7ayfj69yc1g03gm4s7jgamccvx12hvng";
+      type = "gem";
+    };
+    version = "4.2.1";
+  };
+  rack-session = {
+    dependencies = [
+      "base64"
+      "rack"
+    ];
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1s7zcxlmg88a6dam4aqbgk9xkpy6dkdfqmmcszkkliy3q3w38m2r";
+      type = "gem";
+    };
+    version = "2.1.2";
+  };
+  rack-test = {
+    dependencies = [ "rack" ];
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0qy4ylhcfdn65a5mz2hly7g9vl0g13p5a0rmm6sc0sih5ilkcnh0";
+      type = "gem";
+    };
+    version = "2.2.0";
+  };
+  rackup = {
+    dependencies = [ "rack" ];
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "13brkq5xkj6lcdxj3f0k7v28hgrqhqxjlhd4y2vlicy5slgijdzp";
+      type = "gem";
+    };
+    version = "2.2.1";
+  };
+  rails = {
+    dependencies = [
+      "actioncable"
+      "actionmailbox"
+      "actionmailer"
+      "actionpack"
+      "actiontext"
+      "actionview"
+      "activejob"
+      "activemodel"
+      "activerecord"
+      "activestorage"
+      "activesupport"
+      "railties"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "155skqkjrckvzj1qy37lrnafrillc47qhf3l80g3zvw100ba1h4n";
+      type = "gem";
+    };
+    version = "7.2.3.1";
+  };
+  rails-dom-testing = {
+    dependencies = [
+      "activesupport"
+      "minitest"
+      "nokogiri"
+    ];
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "07awj8bp7jib54d0khqw391ryw8nphvqgw4bb12cl4drlx9pkk4a";
+      type = "gem";
+    };
+    version = "2.3.0";
+  };
+  rails-html-sanitizer = {
+    dependencies = [
+      "loofah"
+      "nokogiri"
+    ];
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "128y5g3fyi8fds41jasrr4va1jrs7hcamzklk1523k7rxb64bc98";
+      type = "gem";
+    };
+    version = "1.7.0";
+  };
+  railties = {
+    dependencies = [
+      "actionpack"
+      "activesupport"
+      "cgi"
+      "irb"
+      "rackup"
+      "rake"
+      "thor"
+      "tsort"
+      "zeitwerk"
+    ];
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0np1m8xqb4wbzwpg66yjnqjban0di92lbjzcrgnwwhq2w4z3k8xf";
+      type = "gem";
+    };
+    version = "7.2.3.1";
+  };
+  rainbow = {
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0smwg4mii0fm38pyb5fddbmrdpifwv22zv3d3px2xx497am93503";
+      type = "gem";
+    };
+    version = "3.1.1";
+  };
+  rake = {
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "175iisqb211n0qbfyqd8jz2g01q6xj038zjf4q0nm8k6kz88k7lc";
+      type = "gem";
+    };
+    version = "13.3.1";
+  };
+  rdoc = {
+    dependencies = [
+      "erb"
+      "psych"
+      "tsort"
+    ];
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [
+      {
+        engine = "maglev";
+      }
+      {
+        engine = "mingw";
+      }
+      {
+        engine = "mingw";
+      }
+      {
+        engine = "ruby";
+      }
+    ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0p4z1cs2zvkkvl0xiiy76ys1ipbhx0df15241jx7gnp61317qdbi";
+      type = "gem";
+    };
+    version = "6.16.1";
+  };
+  redis = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0i4a8hxxcxci3n8hhlm9a8wa7a9m58r6sjvh4749v7362i8cy010";
+      type = "gem";
+    };
+    version = "4.8.0";
+  };
+  regexp_parser = {
+    groups = [
+      "default"
+      "development"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "192mzi0wgwl024pwpbfa6c2a2xlvbh3mjd75a0sakdvkl60z64ya";
+      type = "gem";
+    };
+    version = "2.11.3";
+  };
+  reline = {
+    dependencies = [ "io-console" ];
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [
+      {
+        engine = "maglev";
+      }
+      {
+        engine = "mingw";
+      }
+      {
+        engine = "mingw";
+      }
+      {
+        engine = "ruby";
+      }
+    ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0d8q5c4nh2g9pp758kizh8sfrvngynrjlm0i1zn3cnsnfd4v160i";
+      type = "gem";
+    };
+    version = "0.6.3";
+  };
+  remote_syslog_logger = {
+    dependencies = [ "syslog_protocol" ];
+    groups = [ "production" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1g8h2rfw80ay5yqaj8wddagpagpznk403pxnw6wcxvazrwqcb9h2";
+      type = "gem";
+    };
+    version = "1.0.4";
+  };
+  representable = {
+    dependencies = [
+      "declarative"
+      "trailblazer-option"
+      "uber"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1kms3r6w6pnryysnaqqa9fsn0v73zx1ilds9d1c565n3xdzbyafc";
+      type = "gem";
+    };
+    version = "3.2.0";
+  };
+  request_store = {
+    dependencies = [ "rack" ];
+    groups = [
+      "default"
+      "production"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "13ppgmsbrqah08j06bybd3cddv6dml79yzyjn7r8j1src78h98h7";
+      type = "gem";
+    };
+    version = "1.5.1";
+  };
+  retriable = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1q48hqws2dy1vws9schc0kmina40gy7sn5qsndpsfqdslh65snha";
+      type = "gem";
+    };
+    version = "3.1.2";
+  };
+  rexml = {
+    groups = [
+      "default"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0hninnbvqd2pn40h863lbrn9p11gvdxp928izkag5ysx8b1s5q0r";
+      type = "gem";
+    };
+    version = "3.4.4";
+  };
+  rspec-core = {
+    dependencies = [ "rspec-support" ];
+    groups = [
+      "default"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0bcbh9yv6cs6pv299zs4bvalr8yxa51kcdd1pjl60yv625j3r0m8";
+      type = "gem";
+    };
+    version = "3.13.6";
+  };
+  rspec-expectations = {
+    dependencies = [
+      "diff-lcs"
+      "rspec-support"
+    ];
+    groups = [
+      "default"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0dl8npj0jfpy31bxi6syc7jymyd861q277sfr6jawq2hv6hx791k";
+      type = "gem";
+    };
+    version = "3.13.5";
+  };
+  rspec-mocks = {
+    dependencies = [
+      "diff-lcs"
+      "rspec-support"
+    ];
+    groups = [
+      "default"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "071bqrk2rblk3zq3jk1xxx0dr92y0szi5pxdm8waimxici706y89";
+      type = "gem";
+    };
+    version = "3.13.7";
+  };
+  rspec-rails = {
+    dependencies = [
+      "actionpack"
+      "activesupport"
+      "railties"
+      "rspec-core"
+      "rspec-expectations"
+      "rspec-mocks"
+      "rspec-support"
+    ];
+    groups = [ "test" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0cg3ay2jin7jv20carhx3icv3gnwka0hqcr15zcjy7i1xnmwqpg1";
+      type = "gem";
+    };
+    version = "7.1.1";
+  };
+  rspec-support = {
+    groups = [
+      "default"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1cmgz34hwj5s3jwxhyl8mszs24nci12ffbrmr5jb1si74iqf739f";
+      type = "gem";
+    };
+    version = "3.13.6";
+  };
+  rubocop = {
+    dependencies = [
+      "json"
+      "language_server-protocol"
+      "lint_roller"
+      "parallel"
+      "parser"
+      "rainbow"
+      "regexp_parser"
+      "rubocop-ast"
+      "ruby-progressbar"
+      "unicode-display_width"
+    ];
+    groups = [ "development" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "157hg99cq6ys670sw8xbggnvxc9yl50h1zhllki925kkihlwrdbg";
+      type = "gem";
+    };
+    version = "1.81.7";
+  };
+  rubocop-ast = {
+    dependencies = [
+      "parser"
+      "prism"
+    ];
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0xifbp09jfl1hdy9wwgq9dq2l7mf8y2ycm5d1zgcqvks7yzrppr2";
+      type = "gem";
+    };
+    version = "1.48.0";
+  };
+  rubocop-capybara = {
+    dependencies = [ "rubocop" ];
+    groups = [ "development" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1jwwi5a05947q9zsk6i599zxn657hdphbmmbbpx17qsv307rwcps";
+      type = "gem";
+    };
+    version = "2.19.0";
+  };
+  rubocop-factory_bot = {
+    dependencies = [ "rubocop" ];
+    groups = [ "development" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1y79flwjwlaslyhfpg84di9n756ir6bm52n964620xsj658d661h";
+      type = "gem";
+    };
+    version = "2.24.0";
+  };
+  rubocop-performance = {
+    dependencies = [
+      "rubocop"
+      "rubocop-ast"
+    ];
+    groups = [ "development" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1n7g0vg06ldjaq4f8c11c7yqy99zng1qdrkkk4kfziippy24yxnc";
+      type = "gem";
+    };
+    version = "1.16.0";
+  };
+  rubocop-rails = {
+    dependencies = [
+      "activesupport"
+      "lint_roller"
+      "rack"
+      "rubocop"
+      "rubocop-ast"
+    ];
+    groups = [ "development" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "08kf3nhhhxcwb9shb4bv7jxr1mjrs63fwpywppmgy9cbwip29zqh";
+      type = "gem";
+    };
+    version = "2.34.2";
+  };
+  rubocop-rspec = {
+    dependencies = [ "rubocop" ];
+    groups = [ "development" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "051gq9pz49iv4gq34d3n089iaa6cb418n2fhin6gd6fpysbi3nf6";
+      type = "gem";
+    };
+    version = "2.9.0";
+  };
+  ruby-progressbar = {
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0cwvyb7j47m7wihpfaq7rc47zwwx9k4v7iqd9s1xch5nm53rrz40";
+      type = "gem";
+    };
+    version = "1.13.0";
+  };
+  ruby-vips = {
+    dependencies = [ "ffi" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "19pzpx406rr9s3qk527rn9y3b76sjq5pi7y0xzqiy50q3k0hhg7g";
+      type = "gem";
+    };
+    version = "2.1.4";
+  };
+  rubyzip = {
+    groups = [
+      "default"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "05an0wz87vkmqwcwyh5rjiaavydfn5f4q1lixcsqkphzvj7chxw5";
+      type = "gem";
+    };
+    version = "2.4.1";
+  };
+  securerandom = {
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1cd0iriqfsf1z91qg271sm88xjnfd92b832z49p1nd542ka96lfc";
+      type = "gem";
+    };
+    version = "0.4.1";
+  };
+  selenium-webdriver = {
+    dependencies = [
+      "rexml"
+      "rubyzip"
+      "websocket"
+    ];
+    groups = [ "test" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1dkcyq2hfvf4wdj7q5cqqlka1dw6gz28dckxf4r17jmd53ymwg28";
+      type = "gem";
+    };
+    version = "4.8.0";
+  };
+  shoulda-matchers = {
+    dependencies = [ "activesupport" ];
+    groups = [ "test" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "11igjgh16dl5pwqizdmclzlzpv7mbmnh8fx7m9b5kfsjhwxqdfpn";
+      type = "gem";
+    };
+    version = "5.3.0";
+  };
+  signet = {
+    dependencies = [
+      "addressable"
+      "faraday"
+      "jwt"
+      "multi_json"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0nydm087m5c3j85gvzvz30w1qb9pl2lzpznw746jha29ybxyj5yn";
+      type = "gem";
+    };
+    version = "0.21.0";
+  };
+  sprockets = {
+    dependencies = [
+      "concurrent-ruby"
+      "logger"
+      "rack"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1car3fpzhn1l06x2zmanz2l4bj346mv3jcgpcd3p1262y54ml7kn";
+      type = "gem";
+    };
+    version = "4.2.2";
+  };
+  sprockets-rails = {
+    dependencies = [
+      "actionpack"
+      "activesupport"
+      "sprockets"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "17hiqkdpcjyyhlm997mgdcr45v35j5802m5a979i5jgqx5n8xs59";
+      type = "gem";
+    };
+    version = "3.5.2";
+  };
+  stringio = {
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [
+      {
+        engine = "maglev";
+      }
+      {
+        engine = "mingw";
+      }
+      {
+        engine = "mingw";
+      }
+      {
+        engine = "ruby";
+      }
+    ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "08aii379my5zvk0jb3nb50yx321pz7n5a9mwlfbangm7sc9sy4f1";
+      type = "gem";
+    };
+    version = "3.1.9";
+  };
+  swd = {
+    dependencies = [
+      "activesupport"
+      "attr_required"
+      "faraday"
+      "faraday-follow_redirects"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0m86fzmwgw0vc8p6fwvnsdbldpgbqdz9cbp2zj9z06bc4jjf5nsc";
+      type = "gem";
+    };
+    version = "2.0.3";
+  };
+  syslog_protocol = {
+    groups = [
+      "default"
+      "production"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1yb2cmbyj0zmb2yhkgnmghcngrkhcxs4g1svcmgfj90l2hs23nmc";
+      type = "gem";
+    };
+    version = "0.9.2";
+  };
+  thor = {
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0gcarlmpfbmqnjvwfz44gdjhcmm634di7plcx2zdgwdhrhifhqw7";
+      type = "gem";
+    };
+    version = "1.4.0";
+  };
+  timeout = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1jxcji88mh6xsqz0mfzwnxczpg7cyniph7wpavnavfz7lxl77xbq";
+      type = "gem";
+    };
+    version = "0.6.1";
+  };
+  trailblazer-option = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "18s48fndi2kfvrfzmq6rxvjfwad347548yby0341ixz1lhpg3r10";
+      type = "gem";
+    };
+    version = "0.1.2";
+  };
+  tsort = {
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [
+      {
+        engine = "maglev";
+      }
+      {
+        engine = "mingw";
+      }
+      {
+        engine = "mingw";
+      }
+      {
+        engine = "ruby";
+      }
+    ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "17q8h020dw73wjmql50lqw5ddsngg67jfw8ncjv476l5ys9sfl4n";
+      type = "gem";
+    };
+    version = "0.2.0";
+  };
+  tzinfo = {
+    dependencies = [ "concurrent-ruby" ];
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "16w2g84dzaf3z13gxyzlzbf748kylk5bdgg3n1ipvkvvqy685bwd";
+      type = "gem";
+    };
+    version = "2.0.6";
+  };
+  uber = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1p1mm7mngg40x05z52md3mbamkng0zpajbzqjjwmsyw0zw3v9vjv";
+      type = "gem";
+    };
+    version = "0.1.0";
+  };
+  unicode-display_width = {
+    dependencies = [ "unicode-emoji" ];
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0hiwhnqpq271xqari6mg996fgjps42sffm9cpk6ljn8sd2srdp8c";
+      type = "gem";
+    };
+    version = "3.2.0";
+  };
+  unicode-emoji = {
+    groups = [
+      "default"
+      "development"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1995yfjbvjlwrslq48gzzc9j0blkdzlbda9h90pjbm0yvzax55s9";
+      type = "gem";
+    };
+    version = "4.1.0";
+  };
+  uri = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1ijpbj7mdrq7rhpq2kb51yykhrs2s54wfs6sm9z3icgz4y6sb7rp";
+      type = "gem";
+    };
+    version = "1.1.1";
+  };
+  useragent = {
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0i1q2xdjam4d7gwwc35lfnz0wyyzvnca0zslcfxm9fabml9n83kh";
+      type = "gem";
+    };
+    version = "0.16.11";
+  };
+  validate_url = {
+    dependencies = [
+      "activemodel"
+      "public_suffix"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0lblym140w5n88ijyfgcvkxvpfj8m6z00rxxf2ckmmhk0x61dzkj";
+      type = "gem";
+    };
+    version = "1.0.15";
+  };
+  web-console = {
+    dependencies = [
+      "actionview"
+      "activemodel"
+      "bindex"
+      "railties"
+    ];
+    groups = [ "development" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "087y4byl2s3fg0nfhix4s0r25cv1wk7d2j8n5324waza21xg7g77";
+      type = "gem";
+    };
+    version = "4.2.1";
+  };
+  webdrivers = {
+    dependencies = [
+      "nokogiri"
+      "rubyzip"
+      "selenium-webdriver"
+    ];
+    groups = [ "test" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0nxk9719nyk7vsc15mz2hxc8whciihcs40skpn2rncnzsppbv1w3";
+      type = "gem";
+    };
+    version = "5.2.0";
+  };
+  webfinger = {
+    dependencies = [
+      "activesupport"
+      "faraday"
+      "faraday-follow_redirects"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0p39802sfnm62r4x5hai8vn6d1wqbxsxnmbynsk8rcvzwyym4yjn";
+      type = "gem";
+    };
+    version = "2.1.3";
+  };
+  webmock = {
+    dependencies = [
+      "addressable"
+      "crack"
+      "hashdiff"
+    ];
+    groups = [ "test" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "08kixkdp41dw39kqfxf2wp5m4z9b6fxg6yfa6xin0wy7dxzka0dy";
+      type = "gem";
+    };
+    version = "3.24.0";
+  };
+  websocket = {
+    groups = [
+      "default"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0dib6p55sl606qb4vpwrvj5wh881kk4aqn2zpfapf8ckx7g14jw8";
+      type = "gem";
+    };
+    version = "1.2.9";
+  };
+  websocket-driver = {
+    dependencies = [
+      "base64"
+      "websocket-extensions"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "15idgibqpdaj97f734drx8a7k1jcc8wvxlk2nbafac72ihikicjs";
+      type = "gem";
+    };
+    version = "0.8.1";
+  };
+  websocket-extensions = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0hc2g9qps8lmhibl5baa91b4qx8wqw872rgwagml78ydj8qacsqw";
+      type = "gem";
+    };
+    version = "0.1.5";
+  };
+  xml-simple = {
+    dependencies = [ "rexml" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0pb9plyl71mdbjr4kllfy53qx6g68ryxblmnq9dilvy837jk24fj";
+      type = "gem";
+    };
+    version = "1.1.9";
+  };
+  xpath = {
+    dependencies = [ "nokogiri" ];
+    groups = [
+      "default"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0bh8lk9hvlpn7vmi6h4hkcwjzvs2y0cmkk3yjjdr8fxvj6fsgzbd";
+      type = "gem";
+    };
+    version = "3.2.0";
+  };
+  zeitwerk = {
+    groups = [
+      "default"
+      "development"
+      "production"
+      "test"
+    ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "119ypabas886gd0n9kiid3q41w76gz60s8qmiak6pljpkd56ps5j";
+      type = "gem";
+    };
+    version = "2.7.3";
+  };
+}
diff --git a/pkgs/by-name/gr/greenlight/package.nix b/pkgs/by-name/gr/greenlight/package.nix
new file mode 100644
index 000000000000..f7f9609a6e04
--- /dev/null
+++ b/pkgs/by-name/gr/greenlight/package.nix
@@ -0,0 +1,119 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  bundlerEnv,
+  fetchNpmDeps,
+  nodejs_26,
+  npmHooks,
+  ruby_3_3,
+  makeWrapper,
+  which,
+  nixosTests,
+  nix-update-script,
+  _experimental-update-script-combinators,
+}:
+
+let
+  ruby = ruby_3_3;
+  nodejs = nodejs_26;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "greenlight";
+  version = "3.8.2.4";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "bigbluebutton";
+    repo = "greenlight";
+    tag = "release-${finalAttrs.version}";
+    hash = "sha256-GOgOEP6dx1E/rIe4HBR35TM294ad8ywcBXVea1xFOag=";
+  };
+
+  patches = [
+    # Expose further Rails development configurations as env vars
+    ./expose_rails_dev_configs.patch
+  ];
+
+  postPatch = ''
+    # jsbundling-rails dependency would executes yarn install but
+    # we'll stick with npm
+    rm -f yarn.lock
+
+    substituteInPlace "config/storage.yml" --replace-fail \
+      'root: <%= Rails.root.join("storage") %>' \
+      'root: "/var/lib/greenlight/storage"'
+
+    substituteInPlace "config/environments/development.rb" --replace-fail \
+      '  config.hosts = nil' \
+      '  config.hosts = nil; config.paths["log"] = ["/var/log/greenlight/development.log"]'
+  '';
+
+  nativeBuildInputs = [
+    makeWrapper
+    which
+    nodejs
+    npmHooks.npmConfigHook
+    finalAttrs.rubyEnv.wrappedRuby
+  ];
+
+  npmDeps = fetchNpmDeps {
+    inherit (finalAttrs) src;
+    hash = "sha256-aTDd6+mc3DIE5FiaPVjjorJ0r8RfodhEVCs3o2zHbZk=";
+  };
+
+  rubyEnv = bundlerEnv {
+    name = "greenlight-env-${finalAttrs.version}";
+    inherit ruby;
+    gemfile = "${finalAttrs.src}/Gemfile";
+    # Manually need to remove platform not supported by bundix
+    # See https://github.com/bigbluebutton/greenlight/pull/6317
+    lockfile = ./Gemfile.lock;
+    gemset = ./gemset.nix;
+    groups = [ "production" ];
+  };
+  makeCacheWritable = true;
+
+  buildPhase = ''
+    runHook preBuild
+
+    export BUNDLE_WITHOUT=development:test
+    export SECRET_KEY_BASE=1
+    bundle exec rails assets:precompile
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/greenlight $out/bin
+    cp -r app bin config config.ru db lib public vendor Gemfile Gemfile.lock Rakefile $out/share/greenlight/
+    ln -s $out/share/greenlight/lib $out/lib
+    ln -s $out/share/greenlight/bin $out/bin
+    ln -sf /tmp $out/share/greenlight/tmp
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    inherit (finalAttrs) rubyEnv;
+    tests = { inherit (nixosTests) greenlight; };
+    # run with: nix-shell ./maintainers/scripts/update.nix --argstr package greenlight
+    updateScript = _experimental-update-script-combinators.sequence [
+      (nix-update-script { })
+      ./update.sh
+    ];
+  };
+
+  meta = {
+    description = "End-user web interface for BigBlueButton server";
+    homepage = "https://github.com/bigbluebutton/greenlight";
+    platforms = lib.platforms.linux;
+    license = lib.licenses.lgpl3Only;
+    maintainers = [ lib.maintainers.onny ];
+    teams = [ lib.teams.ngi ];
+  };
+})
diff --git a/pkgs/by-name/gr/greenlight/update.sh b/pkgs/by-name/gr/greenlight/update.sh
new file mode 100755
index 000000000000..163488e6ba33
--- /dev/null
+++ b/pkgs/by-name/gr/greenlight/update.sh
@@ -0,0 +1,20 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p bundix ruby_3_3 nixfmt
+set -eu -o pipefail
+set -x
+dir="$(dirname "$(readlink -f "$0")")"
+
+# nix-update-script already bumped src.tag/hash before this runs.
+# Just regenerate the gem lockfiles for the current (already-updated) source.
+repo=$(mktemp -d /tmp/greenlight-update.XXX)
+rm -f "$dir/gemset.nix" "$dir/Gemfile.lock"
+greenlight_storepath=$(nix build --no-link --print-out-paths -f . greenlight.src)
+cp -r --no-preserve=mode,ownership "$greenlight_storepath/." "$repo/"
+
+# remove binary platform otherwise building will fail
+# see https://github.com/bigbluebutton/greenlight/pull/6317
+BUNDLE_GEMFILE="$repo/Gemfile" bundler lock --remove-platform x86_64-linux --lockfile="$repo/Gemfile.lock"
+bundix --lock --lockfile="$repo/Gemfile.lock" --gemfile="$repo/Gemfile" --gemset="$dir/gemset.nix"
+
+cp "$repo/Gemfile.lock" "$dir/"
+nixfmt "$dir/gemset.nix"

From 24673210d0041c767bcddd888ab6e1a94dd4355d Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Wed, 18 Feb 2026 09:47:00 +0100
Subject: [PATCH 10/59] nixos/greenlight: init

---
 .../manual/release-notes/rl-2611.section.md   |   2 +
 nixos/modules/module-list.nix                 |   1 +
 .../modules/services/web-apps/greenlight.nix  | 567 ++++++++++++++++++
 3 files changed, 570 insertions(+)
 create mode 100644 nixos/modules/services/web-apps/greenlight.nix

diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index fafd7c8af491..04c3da412b9c 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -78,6 +78,8 @@
 
 - [ioquake3](https://ioquake3.org), a open-source port of the 3D action shooter Quake 3 Arena. Available as [programs.ioquake3](#opt-programs.ioquake3.enable).
 
+- [Greenlight](https://github.com/bigbluebutton/greenlight), an end-user web interface for the virtual classroom software BigBlueButton. Available as [services.greenlight](#opt-services.greenlight.enable).
+
 - [Matrix Authentication Service](https://github.com/element-hq/matrix-authentication-service) is an OAuth2.0 and OpenID Connect provider for Matrix homeservers (such as Synapse). It replaces standard password authentication with modern OpenID Connect flows, and can delegate authentication to upstream OIDC providers. Available as [services.matrix-authentication-service](#opt-services.matrix-authentication-service.enable).
 
 - [stash-clipboard](https://github.com/NotAShelf/stash), a Wayland clipboard "manager" with fast persistent history and multi-media support. Available as [services.stash-clipboard](#opt-services.stash-clipboard.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index d981c49c7813..f6f7d02e82c9 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1710,6 +1710,7 @@
   ./services/web-apps/gotosocial.nix
   ./services/web-apps/goupile.nix
   ./services/web-apps/grav.nix
+  ./services/web-apps/greenlight.nix
   ./services/web-apps/grocy.nix
   ./services/web-apps/guacamole-client.nix
   ./services/web-apps/guacamole-server.nix
diff --git a/nixos/modules/services/web-apps/greenlight.nix b/nixos/modules/services/web-apps/greenlight.nix
new file mode 100644
index 000000000000..eeb6fc3fcc83
--- /dev/null
+++ b/nixos/modules/services/web-apps/greenlight.nix
@@ -0,0 +1,567 @@
+{
+  lib,
+  config,
+  pkgs,
+  options,
+  ...
+}:
+
+let
+
+  cfg = config.services.greenlight;
+  opt = options.services.greenlight;
+
+  dataDir = "/var/lib/greenlight";
+
+  listeningAddress = "${cfg.settings.BINDING}:${lib.toString cfg.settings.PORT}";
+
+  configEnv = lib.concatMapAttrs (
+    name: value:
+    lib.optionalAttrs (value != null) {
+      ${name} = if lib.isBool value then lib.boolToString value else toString value;
+    }
+  ) cfg.settings;
+  defaultSecretKeyBaseFile = "${dataDir}/secrets/secret-key-base";
+  needsGenCredentialsUnit = cfg.secretKeyBaseFile == null;
+  credentials = {
+    SECRET_KEY_BASE = lib.defaultTo defaultSecretKeyBaseFile cfg.secretKeyBaseFile;
+  }
+  // lib.optionalAttrs (cfg.database.passwordFile != null) {
+    DATABASE_PASSWORD = cfg.database.passwordFile;
+  };
+  loadCredentialsIntoEnv = lib.concatMapAttrsStringSep "\n" (
+    name: _: ''export ${name}="$(systemd-creds cat ${name})"''
+  ) credentials;
+  loadCredentials = lib.mapAttrsToList (name: path: "${name}:${path}") credentials;
+
+  isRedisUnixSocket = lib.hasPrefix "/" cfg.redis.host;
+  isDatabaseUnixSocket = lib.hasPrefix "/" cfg.database.host;
+  databaseUrl = "postgresql://${lib.strings.escapeURL cfg.database.user}:$DATABASE_PASSWORD@${lib.strings.escapeURL cfg.database.host}${
+    lib.optionalString (
+      !isDatabaseUnixSocket && cfg.database.port != null
+    ) ":${toString cfg.database.port}"
+  }/${lib.strings.escapeURL cfg.database.name}";
+
+  redisEnv =
+    if isRedisUnixSocket then
+      {
+        REDIS_URL = "unix://${cfg.redis.host}";
+      }
+    else
+      {
+        # Does not support passwords, but upstream does not provide an adequate env variable
+        # Perhaps patch or make a PR upstream in the future
+        REDIS_URL = "redis://${cfg.redis.host}:${toString cfg.redis.port}";
+      };
+
+  greenlight-rake = pkgs.writeShellApplication {
+    name = "greenlight-rake";
+
+    text =
+      let
+        command = pkgs.writeShellScript "greenlight-rake-unwrapped" ''
+          ${loadCredentialsIntoEnv}
+          export DATABASE_PASSWORD="''${DATABASE_PASSWORD:-}"
+          export DATABASE_URL="${databaseUrl}"
+          exec ${lib.getExe' cfg.package.rubyEnv "rake"} "$@"
+        '';
+        env' = lib.filterAttrs (_: value: value != null) configEnv;
+        supplementaryGroups = lib.optionalString (cfg.redis.createLocally && isRedisUnixSocket) (
+          lib.escapeShellArg "--property=SupplementaryGroups=${config.services.redis.servers.greenlight.group}"
+        );
+      in
+      ''
+        exec ${lib.getExe' config.systemd.package "systemd-run"} \
+          ${
+            lib.escapeShellArgs (map (credential: "--property=LoadCredential=${credential}") loadCredentials)
+          } \
+          ${
+            lib.escapeShellArgs (lib.mapAttrsToList (name: value: "--setenv=${name}=${toString value}") env')
+          } \
+          --uid=${lib.escapeShellArg cfg.user} \
+          --gid=${lib.escapeShellArg cfg.group} \
+          ${supplementaryGroups} \
+          --working-directory=${lib.escapeShellArg cfg.package}/share/greenlight \
+          --property=PrivateTmp=yes \
+          --pty \
+          --wait \
+          --collect \
+          --service-type=exec \
+          --quiet \
+          -- \
+          ${command} "$@"
+      '';
+  };
+
+  defaultServiceConfig = {
+    User = cfg.user;
+    Group = cfg.group;
+    WorkingDirectory = "${cfg.package}/share/greenlight";
+    StateDirectory = [
+      "greenlight"
+      "greenlight/secrets"
+      "greenlight/storage"
+    ];
+    StateDirectoryMode = "0700";
+    LogsDirectory = "greenlight";
+    # Service hardening
+    ReadWritePaths = [
+      dataDir
+      "/var/log/greenlight"
+    ];
+    CacheDirectory = "greenlight";
+    AmbientCapabilities = "";
+    CapabilityBoundingSet = "";
+    # ProtectClock adds DeviceAllow=char-rtc r
+    DeviceAllow = "";
+    DevicePolicy = "closed";
+    LockPersonality = true;
+    # Loosening setting, required by Ruby daemon
+    MemoryDenyWriteExecute = false;
+    NoNewPrivileges = true;
+    RemoveIPC = true;
+    PrivateDevices = true;
+    PrivateMounts = true;
+    PrivateTmp = true;
+    PrivateUsers = true;
+    ProtectClock = true;
+    ProtectHome = true;
+    ProtectHostname = true;
+    ProtectSystem = "strict";
+    ProtectControlGroups = true;
+    ProtectKernelLogs = true;
+    ProtectKernelModules = true;
+    ProtectKernelTunables = true;
+    ProtectProc = "invisible";
+    ProcSubset = "pid";
+    RestrictAddressFamilies = [
+      "AF_UNIX"
+      "AF_INET"
+      "AF_INET6"
+    ];
+    RestrictNamespaces = true;
+    RestrictRealtime = true;
+    RestrictSUIDSGID = true;
+    SystemCallArchitectures = "native";
+    SystemCallFilter = [
+      "@system-service"
+      # Loosening setting, required by Ruby daemon
+      #"~@privileged @setuid @keyring"
+    ];
+    UMask = "0077";
+
+    # ensure permissions to connect to the redis socket
+    SupplementaryGroups = lib.mkIf (cfg.redis.createLocally && isRedisUnixSocket) [
+      config.services.redis.servers.greenlight.group
+    ];
+  };
+
+in
+{
+  meta = {
+    buildDocsInSandbox = false;
+    maintainers = [ lib.maintainers.onny ];
+    teams = [ lib.teams.ngi ];
+  };
+
+  options.services.greenlight = {
+
+    enable = lib.mkEnableOption "Greenlight web interface for BigBlueButton";
+
+    package = lib.mkPackageOption pkgs "greenlight" { };
+
+    database = {
+      createLocally = lib.mkOption {
+        description = ''
+          Whether to configure a local PostgreSQL server and database for Greenlight.
+          The connection is performed via Unix sockets.
+        '';
+        type = lib.types.bool;
+        default = true;
+      };
+
+      host = lib.mkOption {
+        type = lib.types.str;
+        default = "/run/postgresql";
+        example = "127.0.0.1";
+        description = "Hostname or address of the postgresql server. If an absolute path is given here, it will be interpreted as a unix socket path.";
+      };
+
+      port = lib.mkOption {
+        type = lib.types.nullOr lib.types.port;
+        default = 5432;
+        description = "Port of the postgresql server.";
+      };
+
+      name = lib.mkOption {
+        type = lib.types.str;
+        default = "greenlight";
+        description = "The name of the Greenlight database.";
+      };
+
+      user = lib.mkOption {
+        type = lib.types.str;
+        default = "greenlight";
+        description = "The database user for Greenlight.";
+      };
+
+      passwordFile = lib.mkOption {
+        type = lib.types.nullOr lib.types.path;
+        default = null;
+        example = "/run/keys/greenlight-db-password";
+        description = ''
+          A file containing the password corresponding to {option}`${opt.database.user}`.
+        '';
+      };
+    };
+
+    redis = {
+      createLocally = lib.mkOption {
+        description = ''
+          Whether to configure a local Redis server for Greenlight.
+          The connection is performed via Unix sockets by default,
+          but that can be changed by configuring {option}`${opt.redis.host}` and {option}`${opt.redis.port}`.
+        '';
+        type = lib.types.bool;
+        default = true;
+      };
+
+      host = lib.mkOption {
+        description = "The redis host Greenlight will connect to.";
+        type = lib.types.str;
+        default =
+          if cfg.redis.createLocally then config.services.redis.servers.greenlight.unixSocket else null;
+        defaultText = lib.literalExpression "config.services.redis.servers.greenlight.unixSocket";
+      };
+
+      port = lib.mkOption {
+        description = "The port of the redis server Greenlight will connect to. Set to zero to disable TCP and use Unix sockets instead.";
+        type = lib.types.port;
+        default = 0;
+      };
+    };
+
+    configureNginx = lib.mkOption {
+      description = ''
+        Configure nginx as a reverse proxy for Greenlight.
+        Alternatively you can configure a reverse-proxy of your choice to serve specific
+        paths. Take a look at Greenlight's provided reverse proxy configurations at
+        `https://github.com/bigbluebutton/greenlight/blob/master/greenlight-v3.nginx`.
+      '';
+      type = lib.types.bool;
+      default = true;
+    };
+
+    user = lib.mkOption {
+      description = ''
+        User under which Greenlight runs. If it is set to "greenlight",
+        that user will be created, otherwise it should be set to the
+        name of a user created elsewhere.
+      '';
+      type = lib.types.str;
+      default = "greenlight";
+    };
+
+    group = lib.mkOption {
+      description = ''
+        Group under which Greenlight runs.
+      '';
+      type = lib.types.str;
+      default = "greenlight";
+    };
+
+    settings = lib.mkOption {
+      type = lib.types.submodule {
+        freeformType = lib.types.attrsOf (
+          lib.types.nullOr (
+            lib.types.oneOf [
+              lib.types.str
+              lib.types.bool
+              lib.types.int
+              lib.types.port
+              lib.types.path
+            ]
+          )
+        );
+        options = {
+          URL_HOST = lib.mkOption {
+            type = lib.types.str;
+            default = "localhost";
+            description = "Hostname to use";
+          };
+          PORT = lib.mkOption {
+            type = lib.types.port;
+            default = 6346;
+            description = "Port for the puma daemon to bind to.";
+          };
+          BINDING = lib.mkOption {
+            type = lib.types.str;
+            default = "127.0.0.1";
+            description = "Address for the puma daemon to bind to.";
+          };
+        };
+      };
+      default = { };
+      description = ''
+        Extra configuration options to append or override.
+        For available and default option values see
+        [upstream configuration file](https://github.com/bigbluebutton/greenlight/blob/master/sample.env).
+      '';
+    };
+
+    secretKeyBaseFile = lib.mkOption {
+      description = ''
+        Path to file containing the secret key base.
+        The content of the file will be sourced into {env}`SECRET_KEY_BASE` environment
+        variable. The secret has a minimum length requirement of 64 bytes.
+
+        One way to generate such a secret is to use `openssl rand -hex 64`.
+
+        This file is loaded using systemd credentials, and therefore does not need to be
+        owned by the greenlight user.
+
+        If this option is null, it will be created at ${defaultSecretKeyBaseFile}
+        with a new secret key base.
+      '';
+      default = null;
+      type = lib.types.nullOr lib.types.str;
+    };
+
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    assertions = [
+      {
+        assertion = !isRedisUnixSocket -> cfg.redis.port != 0;
+        message = ''
+          `services.greenlight.redis.port` needs to be configured if `services.greenlight.redis.host` is not a unix socket.
+        '';
+      }
+      {
+        assertion = !isDatabaseUnixSocket -> cfg.database.port != null;
+        message = ''
+          `services.greenlight.database.port` needs to be configured if `services.greenlight.database.host` is not a unix socket.
+        '';
+      }
+      {
+        assertion = cfg.database.passwordFile == null || !isDatabaseUnixSocket;
+        message = ''
+          `services.greenlight.database.passwordFile` has no effect when `services.greenlight.database.host`
+          is a unix socket, since local socket connections normally authenticate via peer/ident, not a password.
+          Either point `database.host` at a TCP address, or drop `passwordFile`.
+        '';
+      }
+      {
+        assertion = !(cfg.database.createLocally && cfg.database.passwordFile != null);
+        message = ''
+          `services.greenlight.database.passwordFile` is set, but `database.createLocally` is also enabled.
+          The PostgreSQL role created via `ensureUsers` has no password configured, so authentication would
+          fail. Either disable `database.createLocally` and use an external database, or configure the local
+          role's password yourself (e.g. via `services.postgresql.initialScript`) and keep it in sync with
+          `passwordFile`.
+        '';
+      }
+      {
+        assertion = cfg.database.createLocally && isDatabaseUnixSocket -> cfg.database.user == cfg.user;
+        message = ''
+          services.greenlight.database.user must equal services.greenlight.user when
+          services.greenlight.database.createLocally is true and services.greenlight.database.host
+          is a unix socket, since the local PostgreSQL connection authenticates via peer auth
+          (OS user must match the Postgres role name).
+        '';
+      }
+    ];
+
+    services.greenlight.settings = lib.mkMerge [
+      {
+        RAILS_ENV = lib.mkDefault "production";
+        RAILS_ROOT = "${cfg.package}/share/greenlight";
+        BUNDLE_WITHOUT = "development:test";
+        BUNDLE_USER_HOME = "/tmp/bundle"; # will use private tmp inside systemd unit
+      }
+      redisEnv
+    ];
+
+    systemd.services.greenlight-init-credentials = lib.mkIf needsGenCredentialsUnit {
+      script = ''
+        if ! test -f ${defaultSecretKeyBaseFile}; then
+          ${lib.getExe' cfg.package.rubyEnv "bundle"} exec rails secret > ${defaultSecretKeyBaseFile}
+        fi
+      '';
+      serviceConfig = {
+        Type = "oneshot";
+        SyslogIdentifier = "greenlight-init-dirs";
+      }
+      // defaultServiceConfig;
+      environment = configEnv;
+      after = [ "network.target" ];
+    };
+
+    systemd.services."greenlight-seeder" = {
+      script = ''
+        set -o pipefail -o nounset
+        shopt -s inherit_errexit
+        ${loadCredentialsIntoEnv}
+
+        export DATABASE_PASSWORD="''${DATABASE_PASSWORD:-}"
+        export DATABASE_URL="${databaseUrl}"
+
+        # Auto-migrate on first run or if the package has changed
+        versionFile="${dataDir}/src-version"
+        version=$(cat "$versionFile" 2>/dev/null || echo 0)
+
+        if [[ $version == 0 ]]; then
+          echo "Initialising database and running seed..."
+          DISABLE_DATABASE_ENVIRONMENT_CHECK=1 rails db:migrate db:migrate:with_data
+          echo ${cfg.package.version} > "$versionFile"
+        elif [[ $version != ${cfg.package.version} ]]; then
+          echo "Executing database migration and database seed..."
+          rails db:migrate db:migrate:with_data
+          echo ${cfg.package.version} > "$versionFile"
+        fi
+      '';
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        LoadCredential = loadCredentials;
+      }
+      // defaultServiceConfig;
+      path = [ cfg.package.rubyEnv ];
+      environment = configEnv;
+      wants = lib.optional cfg.database.createLocally "postgresql.target";
+      after = [
+        "network.target"
+      ]
+      ++ lib.optional cfg.database.createLocally "postgresql.target"
+      ++ lib.optional needsGenCredentialsUnit "greenlight-init-credentials.service"
+      ++ lib.optional cfg.redis.createLocally "redis-greenlight.service";
+      requires =
+        lib.optional needsGenCredentialsUnit "greenlight-init-credentials.service"
+        ++ lib.optional cfg.database.createLocally "postgresql.target"
+        ++ lib.optional cfg.redis.createLocally "redis-greenlight.service";
+    };
+
+    systemd.services."greenlight-web" = {
+      script = ''
+        ${loadCredentialsIntoEnv}
+
+        export DATABASE_PASSWORD="''${DATABASE_PASSWORD:-}"
+        export DATABASE_URL="${databaseUrl}"
+
+        ${lib.getExe' cfg.package.rubyEnv "bundle"} exec rails server -u puma
+      '';
+      serviceConfig = {
+        LoadCredential = loadCredentials;
+      }
+      // defaultServiceConfig;
+      environment = configEnv;
+      bindsTo = [ "greenlight-seeder.service" ];
+      after = [
+        "greenlight-seeder.service"
+      ]
+      ++ lib.optional needsGenCredentialsUnit "greenlight-init-credentials.service"
+      ++ lib.optional cfg.database.createLocally "postgresql.target"
+      ++ lib.optional cfg.redis.createLocally "redis-greenlight.service";
+      requires =
+        lib.optional needsGenCredentialsUnit "greenlight-init-credentials.service"
+        ++ lib.optional cfg.database.createLocally "postgresql.target"
+        ++ lib.optional cfg.redis.createLocally "redis-greenlight.service";
+      wantedBy = [ "multi-user.target" ];
+    };
+
+    services.redis.servers = lib.mkIf cfg.redis.createLocally {
+      greenlight = {
+        enable = true;
+        port = cfg.redis.port;
+        bind = lib.mkIf (!isRedisUnixSocket) cfg.redis.host;
+      };
+    };
+
+    services.postgresql = lib.mkIf cfg.database.createLocally {
+      enable = true;
+      ensureUsers = [
+        {
+          name = cfg.database.user;
+          ensureDBOwnership = true;
+        }
+      ];
+      ensureDatabases = [ cfg.database.name ];
+    };
+
+    services.nginx = lib.mkIf cfg.configureNginx {
+      enable = true;
+      # See https://github.com/bigbluebutton/greenlight/blob/master/greenlight-v3.nginx
+      virtualHosts."${cfg.settings.URL_HOST}" =
+        let
+          bbbProxyHeaders = ''
+            proxy_redirect off;
+            proxy_http_version 1.1;
+            proxy_set_header Host "${cfg.settings.URL_HOST}";
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+          '';
+        in
+        {
+          root = "${cfg.package}/share/greenlight/public";
+          locations."/" = {
+            tryFiles = "$uri @greenlight";
+          };
+          locations."@greenlight" = {
+            proxyPass = "http://${listeningAddress}";
+            extraConfig = bbbProxyHeaders;
+          };
+          locations."/cable" = {
+            proxyPass = "http://${listeningAddress}";
+            extraConfig = bbbProxyHeaders + ''
+              proxy_set_header Connection "upgrade";
+              proxy_set_header Upgrade $http_upgrade;
+            '';
+          };
+          locations."@bbb-fe" = {
+            proxyPass = "http://${listeningAddress}";
+            extraConfig = bbbProxyHeaders + ''
+              proxy_set_header Connection "";
+              proxy_buffer_size 128k;
+              proxy_buffers 4 256k;
+              proxy_busy_buffers_size 256k;
+            '';
+          };
+          locations."~ '/api/v1/rooms/\\w{3}-\\w{3}-\\w{3}-\\w{3}\\.json$'" = {
+            proxyPass = "http://${listeningAddress}";
+            extraConfig = bbbProxyHeaders + ''
+              proxy_set_header Connection "";
+              client_max_body_size 31m;
+            '';
+          };
+          locations."~ '/api/v1/users/\\w{8}-\\w{4}-\\w{4}-\\w{4}-\\w{12}\\.json$'" = {
+            proxyPass = "http://${listeningAddress}";
+            extraConfig = bbbProxyHeaders + ''
+              proxy_set_header Connection "";
+              client_max_body_size 4m;
+            '';
+          };
+          locations."~ /api/v1/admin/site_settings/BrandingImage\\.json$" = {
+            proxyPass = "http://${listeningAddress}";
+            extraConfig = bbbProxyHeaders + ''
+              proxy_set_header Connection "";
+              client_max_body_size 4m;
+            '';
+          };
+        };
+    };
+
+    users.users = lib.mkIf (cfg.user == "greenlight") {
+      greenlight = {
+        isSystemUser = true;
+        home = cfg.package;
+        inherit (cfg) group;
+      };
+    };
+    users.groups = lib.mkIf (cfg.group == "greenlight") { ${cfg.group} = { }; };
+
+    environment.systemPackages = [ greenlight-rake ];
+
+  };
+}

From 1f735e93754ec122e229258b6ba7f815c603e24f Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Thu, 19 Feb 2026 10:07:58 +0100
Subject: [PATCH 11/59] nixos/tests/greenlight: init

---
 nixos/tests/all-tests.nix  |  1 +
 nixos/tests/greenlight.nix | 56 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 57 insertions(+)
 create mode 100644 nixos/tests/greenlight.nix

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 647f548ba3d3..93e0377412a4 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -731,6 +731,7 @@ in
   graphite = runTest ./graphite.nix;
   grav = runTest ./web-apps/grav.nix;
   graylog = runTest ./graylog.nix;
+  greenlight = runTest ./greenlight.nix;
   greetd-no-shadow = runTest ./greetd-no-shadow.nix;
   grocy = runTest ./grocy.nix;
   grow-partition = runTest ./grow-partition.nix;
diff --git a/nixos/tests/greenlight.nix b/nixos/tests/greenlight.nix
new file mode 100644
index 000000000000..fcda63df21b0
--- /dev/null
+++ b/nixos/tests/greenlight.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  pkgs,
+  ...
+}:
+
+{
+  name = "greenlight";
+  meta = {
+    maintainers = [ lib.maintainers.onny ];
+    teams = [ lib.teams.ngi ];
+  };
+
+  nodes = {
+    greenlight = {
+      services.greenlight = {
+        enable = true;
+        # For local testing without SSL
+        settings = {
+          RAILS_ENV = "development";
+          RAILS_DUMP_SCHEMA = false;
+        };
+      };
+    };
+  };
+
+  testScript = ''
+    greenlight.start
+    greenlight.wait_for_unit("greenlight-web.service")
+    greenlight.wait_for_open_port(80)
+    greenlight.wait_for_open_port(6346)
+    greenlight.succeed("curl -sSfL http://greenlight:80 | grep 'BigBlueButton open source conferencing system'")
+
+    greenlight.succeed(
+        "greenlight-rake admin:create",
+    )
+
+    # grab session cookie + CSRF token
+    greenlight.succeed("curl -sS -c /tmp/cookies.txt http://localhost/ -o /tmp/page.html")
+    csrf_token = greenlight.succeed(
+        "grep -o 'name=\"csrf-token\" content=\"[^\"]*\"' /tmp/page.html "
+        "| sed 's/.*content=\"//;s/\"$//'"
+    ).strip()
+
+    # log in with default credentials
+    login_result = greenlight.succeed(
+        f"curl -sSf -c /tmp/cookies.txt -b /tmp/cookies.txt "
+        f"-X POST http://localhost/api/v1/sessions.json "
+        f"-H 'Content-Type: application/json' -H 'Accept: application/json' "
+        f"-H 'X-CSRF-Token: {csrf_token}' "
+        f"-d '{{\"session\":{{\"email\":\"admin@example.com\",\"password\":\"Administrator1!\"}}}}'"
+    )
+    assert '"signed_in":true' in login_result, f"login failed: {login_result}"
+  '';
+
+}

From 91e868295ced4d5ed133efde228f65868cc55e7c Mon Sep 17 00:00:00 2001
From: V3RM1N <mail@v3rm1n.dev>
Date: Thu, 20 Aug 2026 14:43:52 +0200
Subject: [PATCH 12/59] stoat-desktop: 1.4.2 -> 1.5.3

Upstream bumped electron and pnpm version, as well as adopting the
yauzl patch on their end
---
 .../by-name/st/stoat-desktop/bump-yauzl.patch | 123 ------------------
 pkgs/by-name/st/stoat-desktop/package.nix     |  24 ++--
 2 files changed, 9 insertions(+), 138 deletions(-)
 delete mode 100644 pkgs/by-name/st/stoat-desktop/bump-yauzl.patch

diff --git a/pkgs/by-name/st/stoat-desktop/bump-yauzl.patch b/pkgs/by-name/st/stoat-desktop/bump-yauzl.patch
deleted file mode 100644
index 01fcc933bd93..000000000000
--- a/pkgs/by-name/st/stoat-desktop/bump-yauzl.patch
+++ /dev/null
@@ -1,123 +0,0 @@
-diff --git a/package.json b/package.json
-index d0f7837..fbdcb92 100644
---- a/package.json
-+++ b/package.json
-@@ -55,5 +55,10 @@
-     "update-electron-app": "^3.1.1",
-     "utf-8-validate": "^6.0.5"
-   },
-+  "pnpm": {
-+    "overrides": {
-+      "yauzl": "^3.3.1"
-+    }
-+  },
-   "packageManager": "pnpm@10.18.1+sha512.77a884a165cbba2d8d1c19e3b4880eee6d2fcabd0d879121e282196b80042351d5eb3ca0935fa599da1dc51265cc68816ad2bddd2a2de5ea9fdf92adbec7cd34"
--}
-\ No newline at end of file
-+}
-diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
-index 9c7ff44..7e9007d 100644
---- a/pnpm-lock.yaml
-+++ b/pnpm-lock.yaml
-@@ -4,6 +4,9 @@ settings:
-   autoInstallPeers: true
-   excludeLinksFromLockfile: false
- 
-+overrides:
-+  yauzl: ^3.3.1
-+
- importers:
- 
-   .:
-@@ -1086,9 +1089,6 @@ packages:
-     resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==}
-     engines: {node: '>=8'}
- 
--  buffer-crc32@0.2.13:
--    resolution: {integrity: sha512-VO9Ht/+p3SN7SKWqcrgEzjGbRSJYTx+Q1pTQC0wrWqHx0vpJraQ6GtHx8tvcg1rlK1byhU5gccxgOgj7B0TDkQ==}
--
-   buffer-from@1.1.2:
-     resolution: {integrity: sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==}
- 
-@@ -1575,9 +1575,6 @@ packages:
-   fastq@1.19.1:
-     resolution: {integrity: sha512-GwLTyxkCXjXbxqIhTsMI2Nui8huMPtnxg7krajPJAjnEG/iiOS7i+zCtWGZR9G0NBKbXKh6X9m9UIsYX/N6vvQ==}
- 
--  fd-slicer@1.1.0:
--    resolution: {integrity: sha512-cE1qsB/VwyQozZ+q1dGxR8LBYNZeofhEdUNGSMbQD3Gw2lAzX9Zb3uIU6Ebc/Fmyjo9AWWfnn0AUCHqtevs/8g==}
--
-   figures@2.0.0:
-     resolution: {integrity: sha512-Oa2M9atig69ZkfwiApY8F2Yy+tzMbazyvqv21R0NsSC8floSOC09BbT1ITWAdoMGQvJ/aZnR1KMwdx9tvHnTNA==}
-     engines: {node: '>=4'}
-@@ -1722,7 +1719,7 @@ packages:
- 
-   glob@7.2.3:
-     resolution: {integrity: sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==}
--    deprecated: Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
-+    deprecated: Glob versions prior to v9 are no longer supported
- 
-   glob@8.1.0:
-     resolution: {integrity: sha512-r8hpEjiQEYlF2QU0df3dS+nxxSIreXQS1qRhMJM0Q5NDdR386C7jb7Hwwod8Fgiuex+k0GFjgft18yvxm5XoCQ==}
-@@ -2883,7 +2880,7 @@ packages:
-   tar@6.2.1:
-     resolution: {integrity: sha512-DZ4yORTwrbTj/7MZYq2w+/ZFdI6OZ/f9SFHR+71gIVUZhOQPHzVCLpvRnPgyaMpfWxxk/4ONva3GQSyNIKRv6A==}
-     engines: {node: '>=10'}
--    deprecated: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me
-+    deprecated: Old versions of tar are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exhorbitant rates) by contacting i@izs.me
- 
-   temp@0.9.4:
-     resolution: {integrity: sha512-yYrrsWnrXMcdsnu/7YMYAofM1ktpL5By7vZhf15CrXijWWrEYZks5AXBudalfSWJLlnen/QUJUB5aoB0kqZUGA==}
-@@ -3174,8 +3171,9 @@ packages:
-     resolution: {integrity: sha512-7dSzzRQ++CKnNI/krKnYRV7JKKPUXMEh61soaHKg9mrWEhzFWhFnxPxGl+69cD1Ou63C13NUPCnmIcrvqCuM6w==}
-     engines: {node: '>=12'}
- 
--  yauzl@2.10.0:
--    resolution: {integrity: sha512-p4a9I6X6nu6IhoGmBqAcbJy1mlC4j27vEPZX9F4L4/vZT3Lyq1VkFHw/V/PUcB9Buo+DG3iHkT0x3Qya58zc3g==}
-+  yauzl@3.4.0:
-+    resolution: {integrity: sha512-jIH9yLR9wqr0wOS0TpBvo/g/2UgZH5qePVbjgRliiF0BYvOZyaBknKsF+x9Iht0O6sqgnB93rCICdOZFecJuDw==}
-+    engines: {node: '>=12'}
- 
-   yocto-queue@0.1.0:
-     resolution: {integrity: sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==}
-@@ -4439,8 +4437,6 @@ snapshots:
-     dependencies:
-       fill-range: 7.1.1
- 
--  buffer-crc32@0.2.13: {}
--
-   buffer-from@1.1.2: {}
- 
-   buffer@5.7.1:
-@@ -5110,7 +5106,7 @@ snapshots:
-     dependencies:
-       debug: 4.4.3
-       get-stream: 5.2.0
--      yauzl: 2.10.0
-+      yauzl: 3.4.0
-     optionalDependencies:
-       '@types/yauzl': 2.10.3
-     transitivePeerDependencies:
-@@ -5136,10 +5132,6 @@ snapshots:
-     dependencies:
-       reusify: 1.1.0
- 
--  fd-slicer@1.1.0:
--    dependencies:
--      pend: 1.2.0
--
-   figures@2.0.0:
-     dependencies:
-       escape-string-regexp: 1.0.5
-@@ -6839,10 +6831,9 @@ snapshots:
-       y18n: 5.0.8
-       yargs-parser: 21.1.1
- 
--  yauzl@2.10.0:
-+  yauzl@3.4.0:
-     dependencies:
--      buffer-crc32: 0.2.13
--      fd-slicer: 1.1.0
-+      pend: 1.2.0
- 
-   yocto-queue@0.1.0: {}
- 
diff --git a/pkgs/by-name/st/stoat-desktop/package.nix b/pkgs/by-name/st/stoat-desktop/package.nix
index a82ec74c6766..294eecdda758 100644
--- a/pkgs/by-name/st/stoat-desktop/package.nix
+++ b/pkgs/by-name/st/stoat-desktop/package.nix
@@ -9,33 +9,28 @@
   makeWrapper,
   removeReferencesTo,
   copyDesktopItems,
-  pnpm_10,
+  pnpm_11,
   nodejs,
-  electron_42,
+  electron_43,
   zip,
   nix-update-script,
 }:
 let
-  electron = electron_42;
+  electron = electron_43;
   stdenv = stdenvNoCC;
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "stoat-desktop";
-  version = "1.4.2";
+  version = "1.5.3";
 
   src = fetchFromGitHub {
     owner = "stoatchat";
     repo = "for-desktop";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-Qfny57ZwSk19R4fnz+IQoEhbVG76yJhx06QPDpLM7fM=";
+    hash = "sha256-UKMuMtBTfiA31K2i1buCFOtL9lf9xbv6BXVD5m4TARo=";
   };
 
-  patches = [
-    # zip extraction fails on newer nodejs versions without this fix
-    ./bump-yauzl.patch
-  ];
-
   postPatch = ''
     # Disable auto-updates
     sed -i '/updateElectronApp([^)]*)/d' src/main.ts
@@ -51,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
     makeWrapper
     copyDesktopItems
     nodejs
-    pnpm_10
+    pnpm_11
     zip
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [
@@ -63,11 +58,10 @@ stdenv.mkDerivation (finalAttrs: {
       pname
       version
       src
-      patches
       ;
-    fetcherVersion = 3;
-    pnpm = pnpm_10;
-    hash = "sha256-0v+MHYFgnIN4FvzFkv5D3Bqc7538763yCIWu05XR+fA=";
+    fetcherVersion = 4;
+    pnpm = pnpm_11;
+    hash = "sha256-uiKTkXU0THzW46FiAfftqMWfrnFPCfgS/30ZuWmpHMI=";
   };
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";

From bfe08941c5e8e60054b1fe769fca3124e00ce773 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 12 Sep 2026 16:47:49 +0000
Subject: [PATCH 13/59] hk: 1.57.0 -> 1.58.1

---
 pkgs/by-name/hk/hk/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/hk/hk/package.nix b/pkgs/by-name/hk/hk/package.nix
index 8d8fe621294b..1a9cbd24d44a 100644
--- a/pkgs/by-name/hk/hk/package.nix
+++ b/pkgs/by-name/hk/hk/package.nix
@@ -15,7 +15,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "hk";
-  version = "1.57.0";
+  version = "1.58.1";
 
   __structuredAttrs = true;
 
@@ -23,10 +23,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "jdx";
     repo = "hk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-n2u//Gq0MTTAF02ed/ioINxSC/y0J0uC3M04fTudpi0=";
+    hash = "sha256-XSZy4dbKPDRkGc8BrVCz8H0STb64uJEoJBQ5lwiwsv4=";
   };
 
-  cargoHash = "sha256-UyJUIrnnqPAI9Li5DgPgKYFzn+hYW0yRMar+1nTi8eQ=";
+  cargoHash = "sha256-WQ/ICFoRuZBEXGaLbScnwBv4s6AhdtgoUSxoYwmQT0c=";
 
   nativeBuildInputs = [
     installShellFiles

From 95d846d364ceb63c1af0233f5b579cf10e7699f0 Mon Sep 17 00:00:00 2001
From: Lev <10231176+levtoji@users.noreply.github.com>
Date: Sat, 12 Sep 2026 19:04:39 +0200
Subject: [PATCH 14/59] nixos/jellyfin: fix qsv device path written to
 encoding.xml

The `hardwareAcceleration.type == "qsv"` branch wrote the configured
device path into an `<OpenclDevice>` XML element. Jellyfin's
EncodingOptions model (MediaBrowser.Model/Configuration/EncodingOptions.cs)
has no such property -- only `VaapiDevice` and `QsvDevice` exist for
device paths -- so the element is silently ignored on load and the
QSV device is never actually configured, even though
`hardwareAcceleration.device` is set.

Write `<QsvDevice>` instead, matching the `vaapi` branch's handling
of `<VaapiDevice>` right above it.

Add a `machineWithQsvTranscoding` node to the jellyfin NixOS test,
mirroring the existing vaapi coverage, asserting on
`/System/Configuration/encoding` that `QsvDevice` is actually set --
this would have caught the bug (the field was previously always
absent from the response). Ran the full updated test locally
(`nix build` on `pkgs.testers.runNixOSTest`); all subtests pass,
including the new one.

Assisted-by: Claude Code (Sonnet 5, claude-sonnet-5)
---
 nixos/modules/services/misc/jellyfin.nix |  2 +-
 nixos/tests/jellyfin.nix                 | 38 ++++++++++++++++++++++++
 2 files changed, 39 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/misc/jellyfin.nix b/nixos/modules/services/misc/jellyfin.nix
index 7a6c5dae8536..7859144c81ae 100644
--- a/nixos/modules/services/misc/jellyfin.nix
+++ b/nixos/modules/services/misc/jellyfin.nix
@@ -48,7 +48,7 @@ let
       ) "<VaapiDevice>${escapeXML cfg.hardwareAcceleration.device}</VaapiDevice>"}
       ${optionalString (
         cfg.hardwareAcceleration.type == "qsv" && cfg.hardwareAcceleration.device != null
-      ) "<OpenclDevice>${escapeXML cfg.hardwareAcceleration.device}</OpenclDevice>"}
+      ) "<QsvDevice>${escapeXML cfg.hardwareAcceleration.device}</QsvDevice>"}
       <EncodingThreadCount>${
         if cfg.transcoding.threadCount != null then toString cfg.transcoding.threadCount else "-1"
       }</EncodingThreadCount>
diff --git a/nixos/tests/jellyfin.nix b/nixos/tests/jellyfin.nix
index 28862828618d..3c89460ff18c 100644
--- a/nixos/tests/jellyfin.nix
+++ b/nixos/tests/jellyfin.nix
@@ -48,6 +48,19 @@
       virtualisation.diskSize = 3 * 1024;
     };
 
+    machineWithQsvTranscoding = {
+      services.jellyfin = {
+        enable = true;
+        hardwareAcceleration = {
+          enable = true;
+          type = "qsv";
+          device = "/dev/dri/renderD128";
+        };
+      };
+      environment.systemPackages = with pkgs; [ ffmpeg ];
+      virtualisation.diskSize = 3 * 1024;
+    };
+
     machineWithForceConfig = {
       services.jellyfin = {
         enable = true;
@@ -186,6 +199,31 @@
           assert "hevc" in decoding_codecs, f"hevc should be in HardwareDecodingCodecs, got {decoding_codecs}"
           assert "vp9" in decoding_codecs, f"vp9 should be in HardwareDecodingCodecs, got {decoding_codecs}"
 
+      # Regression test: the qsv branch used to write the device path to a
+      # nonexistent <OpenclDevice> XML element, which Jellyfin silently
+      # ignores, instead of <QsvDevice> (see MediaBrowser.Model/Configuration/
+      # EncodingOptions.cs upstream, which has no OpenclDevice property).
+      with subtest("QSV hardware acceleration configuration"):
+          wait_for_jellyfin(machineWithQsvTranscoding)
+
+          machineWithQsvTranscoding.succeed("systemctl show jellyfin.service --property=DeviceAllow | grep '/dev/dri/renderD128 rw'")
+
+          machineWithQsvTranscoding.wait_until_succeeds(api_get("/Startup/Configuration"))
+          machineWithQsvTranscoding.succeed(api_get("/Startup/FirstUser"))
+          machineWithQsvTranscoding.succeed(api_post("/Startup/Complete"))
+
+          qsv_auth_result = json.loads(machineWithQsvTranscoding.succeed(
+              api_post("/Users/AuthenticateByName", "${payloads.auth}")
+          ))
+          qsv_token = qsv_auth_result["AccessToken"]
+
+          qsv_config = json.loads(machineWithQsvTranscoding.succeed(
+              f"curl --fail 'http://localhost:8096/System/Configuration/encoding' -H 'Authorization:MediaBrowser Client=\"Test\", DeviceId=\"test\", Token={qsv_token}'"
+          ))
+
+          assert qsv_config.get("HardwareAccelerationType") == "qsv", f"Hardware acceleration type: expected 'qsv', got '{qsv_config.get('HardwareAccelerationType')}'"
+          assert qsv_config.get("QsvDevice") == "/dev/dri/renderD128", f"QSV device: expected '/dev/dri/renderD128', got '{qsv_config.get('QsvDevice')}'"
+
 
       with machine.nested("Wizard completes"):
           machine.wait_until_succeeds(api_get("/Startup/Configuration"))

From b10c7d0e31bd3b08b5bba30edb6a5d05ffbe704a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 13 Sep 2026 09:55:50 +0000
Subject: [PATCH 15/59] cursor-cli: 0-unstable-2026-08-31 ->
 0-unstable-2026-09-10

---
 pkgs/by-name/cu/cursor-cli/package.nix | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/cu/cursor-cli/package.nix b/pkgs/by-name/cu/cursor-cli/package.nix
index 3f92a6faae27..69ca70867d54 100644
--- a/pkgs/by-name/cu/cursor-cli/package.nix
+++ b/pkgs/by-name/cu/cursor-cli/package.nix
@@ -10,22 +10,22 @@ let
   inherit (stdenv) hostPlatform;
   sources = {
     x86_64-linux = fetchurl {
-      url = "https://downloads.cursor.com/lab/2026.08.31-4057e58/linux/x64/agent-cli-package.tar.gz";
-      hash = "sha256-fjBttXUCGamcAO1Rf+iyNdPFTkyl934v8WDMl85wd5g=";
+      url = "https://downloads.cursor.com/lab/2026.09.10-fd3934a/linux/x64/agent-cli-package.tar.gz";
+      hash = "sha256-J5l8g5GthTpacysYRduO+CqLpq+w94KcxzlGT4lm6W4=";
     };
     aarch64-linux = fetchurl {
-      url = "https://downloads.cursor.com/lab/2026.08.31-4057e58/linux/arm64/agent-cli-package.tar.gz";
-      hash = "sha256-z122tQR7MoDYpJRxz9Qb6x1eR1d0F3313yhRhXq2UUo=";
+      url = "https://downloads.cursor.com/lab/2026.09.10-fd3934a/linux/arm64/agent-cli-package.tar.gz";
+      hash = "sha256-4ElEOLAcN7w0hISR0fNHjvRpSUxWyvAg3hF5bRRttko=";
     };
     aarch64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/lab/2026.08.31-4057e58/darwin/arm64/agent-cli-package.tar.gz";
-      hash = "sha256-qUSDz1oWB7/hLLNCFr4Mj5WJnw9pj7heUAuijXMy+7A=";
+      url = "https://downloads.cursor.com/lab/2026.09.10-fd3934a/darwin/arm64/agent-cli-package.tar.gz";
+      hash = "sha256-rsCwGuBW3kigL+MV+/BYDrkTd3UtmTMHSZmIy+AoVCM=";
     };
   };
 in
 stdenv.mkDerivation {
   pname = "cursor-cli";
-  version = "0-unstable-2026-08-31";
+  version = "0-unstable-2026-09-10";
 
   src = sources.${hostPlatform.system};
 

From 076d27e632c1d724bc2a54319cbebe2d1553bbce Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 13 Sep 2026 17:19:05 +0000
Subject: [PATCH 16/59] neo4j: 2026.07.0 -> 2026.08.1

---
 pkgs/by-name/ne/neo4j/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ne/neo4j/package.nix b/pkgs/by-name/ne/neo4j/package.nix
index 38ca05837843..8f92a649b8e8 100644
--- a/pkgs/by-name/ne/neo4j/package.nix
+++ b/pkgs/by-name/ne/neo4j/package.nix
@@ -12,11 +12,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "neo4j";
-  version = "2026.07.0";
+  version = "2026.08.1";
 
   src = fetchurl {
     url = "https://neo4j.com/artifact.php?name=neo4j-community-${finalAttrs.version}-unix.tar.gz";
-    hash = "sha256-ANpBduUqBM+60704P34N/dfsBOtL0liPcRBVPxx5rgU=";
+    hash = "sha256-bkuxVaS9Aqinp+g6VqynDfHNXZD/TdlLVA8g9J8AAIQ=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From d9e29a1807c1da3f41086c1043e9f6fa33b51f22 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nicolas=20M=C3=A9meint?= <git@nicomem.com>
Date: Sun, 13 Sep 2026 10:46:50 +0200
Subject: [PATCH 17/59] nixosTests.authelia: Fix asserts always returning True

---
 nixos/tests/authelia.nix | 31 +++++++++++++++++++++++++------
 1 file changed, 25 insertions(+), 6 deletions(-)

diff --git a/nixos/tests/authelia.nix b/nixos/tests/authelia.nix
index 256c92cd706e..685ae5965347 100644
--- a/nixos/tests/authelia.nix
+++ b/nixos/tests/authelia.nix
@@ -151,6 +151,8 @@
   };
 
   testScript = ''
+    from datetime import timedelta
+
     start_all()
 
     authelia.wait_for_unit("simplehttp.service")
@@ -159,14 +161,28 @@
     authelia.wait_for_open_port(443)
     authelia.wait_for_unit("multi-user.target")
 
+    # FIXME: Authelia currently does not notify systemd of its readiness.
+    # Set the service with Type=notify and remove this when the following PR is merged
+    # and available in a release: https://github.com/authelia/authelia/pull/12772
+    authelia.wait_until_succeeds(
+      "curl --insecure -sSf -H Host:auth.example.com https://authelia:443/",
+      timeout=timedelta(seconds=10)
+    )
+
     with subtest("Check for authelia"):
       # expect the login page
-      assert "Login - Authelia", "could not reach authelia" in \
-        authelia.succeed("curl --insecure -sSf -H Host:auth.example.com https://authelia:443/")
+      t.assertIn(
+        "<noscript>You need to enable JavaScript to run this app.</noscript>",
+        authelia.succeed("curl --insecure -sSf -H Host:auth.example.com https://authelia:443/"),
+        "Login - Authelia"
+      )
 
     with subtest("Check contacting basic http server via traefik with https works"):
-      assert "hello", "could not reach raw static site" in \
-        authelia.succeed("curl --insecure -sSf -H Host:static.example.com https://authelia:443/")
+      t.assertIn(
+        "hello",
+        authelia.succeed("curl --insecure -sSf -H Host:static.example.com https://authelia:443/"),
+        "could not reach raw static site"
+      )
 
     with subtest("Test traefik and authelia"):
       with subtest("No details fail"):
@@ -175,7 +191,10 @@
         authelia.fail("curl --insecure -sSf -u 'bob:wordpass' -H Host:static-basic-auth.example.com https://authelia:443/")
         authelia.fail("curl --insecure -sSf -u 'alice:password' -H Host:static-basic-auth.example.com https://authelia:443/")
       with subtest("Correct details pass"):
-        assert "hello", "could not reach authed static site with valid credentials" in \
-          authelia.succeed("curl --insecure -sSf -u 'bob:password' -H Host:static-basic-auth.example.com https://authelia:443/")
+        t.assertIn(
+          "hello",
+          authelia.succeed("curl --insecure -sSf -u 'bob:password' -H Host:static-basic-auth.example.com https://authelia:443/"),
+          "could not reach authed static site with valid credentials"
+        )
   '';
 }

From 8726296a6c095a1b7c65e495a6a4a365bc8025ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nicolas=20M=C3=A9meint?= <git@nicomem.com>
Date: Sun, 13 Sep 2026 09:51:37 +0200
Subject: [PATCH 18/59] authelia: 4.39.22 -> 4.39.27

---
 pkgs/by-name/au/authelia/package.nix | 4 ++--
 pkgs/by-name/au/authelia/sources.nix | 8 ++++----
 pkgs/by-name/au/authelia/web.nix     | 4 ++--
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/au/authelia/package.nix b/pkgs/by-name/au/authelia/package.nix
index 1f2ae3f8ea85..a4f95f0a5729 100644
--- a/pkgs/by-name/au/authelia/package.nix
+++ b/pkgs/by-name/au/authelia/package.nix
@@ -4,7 +4,7 @@
   nodejs,
   fetchPnpmDeps,
   pnpmConfigHook,
-  pnpm_11,
+  pnpm_12,
   fetchFromGitHub,
   buildGo127Module,
   installShellFiles,
@@ -15,7 +15,7 @@
       nodejs
       fetchPnpmDeps
       pnpmConfigHook
-      pnpm_11
+      pnpm_12
       fetchFromGitHub
       ;
   },
diff --git a/pkgs/by-name/au/authelia/sources.nix b/pkgs/by-name/au/authelia/sources.nix
index 5f08fe65c925..43e0fc76746f 100644
--- a/pkgs/by-name/au/authelia/sources.nix
+++ b/pkgs/by-name/au/authelia/sources.nix
@@ -1,14 +1,14 @@
 { fetchFromGitHub }:
 rec {
   pname = "authelia";
-  version = "4.39.22";
+  version = "4.39.27";
 
   src = fetchFromGitHub {
     owner = "authelia";
     repo = "authelia";
     rev = "v${version}";
-    hash = "sha256-6mKS+U0Leac2vcHRTMIAKfqr78NQUCMBiW76z4H/STw=";
+    hash = "sha256-lN8KH3JvL1s1q6crlHzGt43v278VUpvuUF+IVfW5m60=";
   };
-  vendorHash = "sha256-8ftsYIEMkoM3emW0d6E3cOv3hUQDLZcSBDEy8NvwNcY=";
-  pnpmDepsHash = "sha256-ngHVlFIQuUY+D54CDZ7FIlu13UjGr3zcdTvKryntVhQ=";
+  vendorHash = "sha256-Bi3cAkcVP1ZWFBuy0RfpqW7yqyV5DxSsa6gmtfLgxEA=";
+  pnpmDepsHash = "sha256-uX7+TtZSiVheK7JoZ3mhX2/vcddPezgQ0vY22NF7gNI=";
 }
diff --git a/pkgs/by-name/au/authelia/web.nix b/pkgs/by-name/au/authelia/web.nix
index 0cb4a5747a5d..f09aba596180 100644
--- a/pkgs/by-name/au/authelia/web.nix
+++ b/pkgs/by-name/au/authelia/web.nix
@@ -3,12 +3,12 @@
   nodejs,
   fetchPnpmDeps,
   pnpmConfigHook,
-  pnpm_11,
+  pnpm_12,
   fetchFromGitHub,
 }:
 
 let
-  pnpm = pnpm_11;
+  pnpm = pnpm_12;
 
   inherit (import ./sources.nix { inherit fetchFromGitHub; })
     pname

From 50a0e86db969d3dd94a0bf011368156386387275 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 17 Sep 2026 02:36:36 +0000
Subject: [PATCH 19/59] tcl8Packages.tclreadline: 2.4.1 -> 2.5.0

---
 .../tcl-modules/by-name/tc/tclreadline/package.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tcl-modules/by-name/tc/tclreadline/package.nix b/pkgs/development/tcl-modules/by-name/tc/tclreadline/package.nix
index d07982633eb7..38b604101c7e 100644
--- a/pkgs/development/tcl-modules/by-name/tc/tclreadline/package.nix
+++ b/pkgs/development/tcl-modules/by-name/tc/tclreadline/package.nix
@@ -12,13 +12,13 @@
 
 mkTclDerivation (finalAttrs: {
   pname = "tclreadline";
-  version = "2.4.1";
+  version = "2.5.0";
 
   src = fetchFromGitHub {
     owner = "flightaware";
     repo = "tclreadline";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6FIQJsAm28jPIfNG+7xsMlCJSLw9JStOVzDemw2P+EI=";
+    hash = "sha256-7b+d1fBENfTCdyeHSGAnPPAKf2DMiQbxDLXDvhGYQm4=";
   };
 
   nativeBuildInputs = [

From 7657773d5745ebb459607f6fe175db28373df064 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Tue, 8 Sep 2026 13:13:48 +0200
Subject: [PATCH 20/59] nixos/nixos-containers: fix flake container eval

See https://github.com/NixOS/nixpkgs/commit/4c9db6cedbb2db0d454c1434f9e65f27259240f6#r199475394
---
 nixos/modules/virtualisation/nixos-containers.nix | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/virtualisation/nixos-containers.nix b/nixos/modules/virtualisation/nixos-containers.nix
index 0aee55ccef64..b5469188e81d 100644
--- a/nixos/modules/virtualisation/nixos-containers.nix
+++ b/nixos/modules/virtualisation/nixos-containers.nix
@@ -997,14 +997,21 @@ in
       assertions =
         let
           mapper =
-            name: cfg:
+            name:
+            { cfg, opt }:
             optional (cfg.networkNamespace != null && (cfg.privateNetwork || cfg.interfaces != [ ]))
               "containers.${name}.networkNamespace is mutally exclusive to containers.${name}.privateNetwork and containers.${name}.interfaces."
             ++
-              optional (cfg.config.nix.enable && cfg.config.nix.daemon.enable && !config.nix.daemon.enable)
+              optional
+                (
+                  opt.config.isDefined
+                  && cfg.config.nix.enable
+                  && cfg.config.nix.daemon.enable
+                  && !config.nix.daemon.enable
+                )
                 "${options.containers}.${strings.escapeNixIdentifier name} requires a Nix daemon but the host does not provided it, as option ${options.nix.daemon.enable} is disabled";
         in
-        mkMerge (mapAttrsToList mapper config.containers);
+        mkMerge (lib.attrValues (lib.modules.mapAttrsOfSubmodule mapper options.containers));
     }
 
     (mkIf (config.boot.enableContainers) (

From 960f040ac70aae39735bec1f1494a58ddc8f6b6a Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Tue, 8 Sep 2026 14:37:54 +0200
Subject: [PATCH 21/59] nixos/nixos-containers: report assertions correctly

It used to report

    error: expected a set but found a string: "<the actual message>"
---
 nixos/modules/virtualisation/nixos-containers.nix | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/virtualisation/nixos-containers.nix b/nixos/modules/virtualisation/nixos-containers.nix
index b5469188e81d..28ad44da2145 100644
--- a/nixos/modules/virtualisation/nixos-containers.nix
+++ b/nixos/modules/virtualisation/nixos-containers.nix
@@ -1011,7 +1011,14 @@ in
                 )
                 "${options.containers}.${strings.escapeNixIdentifier name} requires a Nix daemon but the host does not provided it, as option ${options.nix.daemon.enable} is disabled";
         in
-        mkMerge (lib.attrValues (lib.modules.mapAttrsOfSubmodule mapper options.containers));
+        (lib.concatMap
+          # This could be done in mapper but causes a reformat
+          (map (msg: {
+            assertion = false;
+            message = msg;
+          }))
+          (lib.attrValues (lib.modules.mapAttrsOfSubmodule mapper options.containers))
+        );
     }
 
     (mkIf (config.boot.enableContainers) (

From dea68e7db0420852f148ef78478ae9ac2d13cbf0 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Tue, 8 Sep 2026 13:55:10 +0200
Subject: [PATCH 22/59] nixos/nixos-containers: assert flake container needs
 nix on host

---
 nixos/modules/virtualisation/nixos-containers.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/nixos/modules/virtualisation/nixos-containers.nix b/nixos/modules/virtualisation/nixos-containers.nix
index 28ad44da2145..9d63f863f906 100644
--- a/nixos/modules/virtualisation/nixos-containers.nix
+++ b/nixos/modules/virtualisation/nixos-containers.nix
@@ -1001,6 +1001,9 @@ in
             { cfg, opt }:
             optional (cfg.networkNamespace != null && (cfg.privateNetwork || cfg.interfaces != [ ]))
               "containers.${name}.networkNamespace is mutally exclusive to containers.${name}.privateNetwork and containers.${name}.interfaces."
+            ++
+              optional (cfg.flake != null && !config.nix.enable)
+                "${options.containers}.${strings.escapeNixIdentifier name}.flake is defined, so the container is built with nix on the host, but ${options.nix.enable} is disabled"
             ++
               optional
                 (

From bf78e69f9e5d1656b0f76e3593025939afe14774 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Tue, 8 Sep 2026 13:56:38 +0200
Subject: [PATCH 23/59] nixos/nixos-containers: fix typo

Pre-existing, so separate commit.
---
 nixos/modules/virtualisation/nixos-containers.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/virtualisation/nixos-containers.nix b/nixos/modules/virtualisation/nixos-containers.nix
index 9d63f863f906..0d63e3d87f64 100644
--- a/nixos/modules/virtualisation/nixos-containers.nix
+++ b/nixos/modules/virtualisation/nixos-containers.nix
@@ -1012,7 +1012,7 @@ in
                   && cfg.config.nix.daemon.enable
                   && !config.nix.daemon.enable
                 )
-                "${options.containers}.${strings.escapeNixIdentifier name} requires a Nix daemon but the host does not provided it, as option ${options.nix.daemon.enable} is disabled";
+                "${options.containers}.${strings.escapeNixIdentifier name} requires a Nix daemon but the host does not provide it, as option ${options.nix.daemon.enable} is disabled";
         in
         (lib.concatMap
           # This could be done in mapper but causes a reformat

From e9292bf5a6ed7f955fc6c69225f992f890228ad8 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Tue, 8 Sep 2026 14:11:36 +0200
Subject: [PATCH 24/59] nixos/tests/containers-imperative-no-daemon: init

---
 nixos/tests/all-tests.nix                     |  1 +
 .../tests/containers-imperative-no-daemon.nix | 17 ++++++++++
 nixos/tests/containers-imperative.nix         | 32 +++++++++++++++----
 3 files changed, 44 insertions(+), 6 deletions(-)
 create mode 100644 nixos/tests/containers-imperative-no-daemon.nix

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 7935904ddb11..c06783aefafb 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -470,6 +470,7 @@ in
   containers-gateway = runTest ./containers-gateway.nix;
   containers-hosts = runTest ./containers-hosts.nix;
   containers-imperative = runTest ./containers-imperative.nix;
+  containers-imperative-no-daemon = runTest ./containers-imperative-no-daemon.nix;
   containers-ip = runTest ./containers-ip.nix;
   containers-ipv6-slaac = runTest ./containers-ipv6-slaac.nix;
   containers-macvlans = runTest ./containers-macvlans.nix;
diff --git a/nixos/tests/containers-imperative-no-daemon.nix b/nixos/tests/containers-imperative-no-daemon.nix
new file mode 100644
index 000000000000..d7432b72a53a
--- /dev/null
+++ b/nixos/tests/containers-imperative-no-daemon.nix
@@ -0,0 +1,17 @@
+{ lib, ... }: {
+  imports = [ ./containers-imperative.nix ];
+  name = lib.mkForce "containers-imperative-no-daemon";
+  test-nix-in-container = false;
+  nodes.machine =
+    { config, ... }:
+    {
+      nix.daemon.enable = false;
+      assertions = [
+        # no mkForce trickery
+        {
+          assertion = !config.nix.daemon.enable;
+          message = "test failed: nix.daemon.enable has override";
+        }
+      ];
+    };
+}
diff --git a/nixos/tests/containers-imperative.nix b/nixos/tests/containers-imperative.nix
index 67f6b1f7043b..c3943f8ef8d9 100644
--- a/nixos/tests/containers-imperative.nix
+++ b/nixos/tests/containers-imperative.nix
@@ -1,4 +1,9 @@
-{ pkgs, lib, ... }:
+test@{
+  config,
+  pkgs,
+  lib,
+  ...
+}:
 {
   name = "containers-imperative";
   meta = {
@@ -6,6 +11,19 @@
       aszlig
     ];
   };
+  imports = [
+    {
+      options.test-nix-in-container = lib.mkOption {
+        type = lib.types.bool;
+        description = ''
+          Whether to test nix inside the container.
+          We also run this test without daemon, in which case that won't work.
+          Activated by `./containers-imperative-no-daemon.nix`.
+        '';
+        default = true;
+      };
+    }
+  ];
 
   nodes.machine =
     {
@@ -131,11 +149,13 @@
       with subtest("Execute commands via the root shell"):
           assert "Linux" in machine.succeed(f"nixos-container run {id1} -- uname")
 
-      with subtest("Execute a nix command via the root shell. (regression test for #40355)"):
-          machine.succeed(
-              f"nixos-container run {id1} -- nix-instantiate -E "
-              + '\'derivation { name = "empty"; builder = "false"; system = "false"; }\' '
-          )
+      ${lib.optionalString test.config.test-nix-in-container ''
+        with subtest("Execute a nix command via the root shell. (regression test for #40355)"):
+            machine.succeed(
+                f"nixos-container run {id1} -- nix-instantiate -E "
+                + '\'derivation { name = "empty"; builder = "false"; system = "false"; }\' '
+            )
+      ''}
 
       with subtest("Stop and start (regression test for #4989)"):
           machine.succeed(f"nixos-container stop {id1}")

From a9d3cf39fa64144982d6a2c66c93b885f45577f0 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Tue, 8 Sep 2026 14:36:34 +0200
Subject: [PATCH 25/59] nixos/nixos-containers: report host nix options
 accurately

---
 .../virtualisation/nixos-containers.nix       | 24 ++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/virtualisation/nixos-containers.nix b/nixos/modules/virtualisation/nixos-containers.nix
index 0d63e3d87f64..f044b7036c26 100644
--- a/nixos/modules/virtualisation/nixos-containers.nix
+++ b/nixos/modules/virtualisation/nixos-containers.nix
@@ -996,6 +996,24 @@ in
 
       assertions =
         let
+          # Host Nix config info
+          inherit
+            (rec {
+              disabledOpts = filter (x: !x.value) [
+                options.nix.enable
+                options.nix.daemon.enable
+              ];
+              hostNixSocketEnabled = disabledOpts == [ ];
+              hostNixSocketIsDisabled =
+                if lib.length disabledOpts == 1 then
+                  "host option ${lib.head disabledOpts} is disabled"
+                else
+                  "host options ${lib.concatStringsSep " and " disabledOpts} are disabled";
+            })
+            hostNixSocketEnabled
+            hostNixSocketIsDisabled
+            ;
+
           mapper =
             name:
             { cfg, opt }:
@@ -1007,12 +1025,12 @@ in
             ++
               optional
                 (
-                  opt.config.isDefined
+                  !hostNixSocketEnabled
+                  && opt.config.isDefined
                   && cfg.config.nix.enable
                   && cfg.config.nix.daemon.enable
-                  && !config.nix.daemon.enable
                 )
-                "${options.containers}.${strings.escapeNixIdentifier name} requires a Nix daemon but the host does not provide it, as option ${options.nix.daemon.enable} is disabled";
+                "${options.containers}.${strings.escapeNixIdentifier name} requires a Nix daemon but the host does not provide it, as ${hostNixSocketIsDisabled}";
         in
         (lib.concatMap
           # This could be done in mapper but causes a reformat

From b3f4821490c183ef3fd3d1cc6f7d3611646077e0 Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Thu, 10 Sep 2026 15:58:52 +0200
Subject: [PATCH 26/59] nixos/tests/containers-eval: init + improve error
 messages

---
 .../virtualisation/nixos-containers.nix       |  3 +-
 nixos/tests/all-tests.nix                     |  1 +
 nixos/tests/containers-eval.nix               | 81 +++++++++++++++++++
 3 files changed, 84 insertions(+), 1 deletion(-)
 create mode 100644 nixos/tests/containers-eval.nix

diff --git a/nixos/modules/virtualisation/nixos-containers.nix b/nixos/modules/virtualisation/nixos-containers.nix
index f044b7036c26..e8d3f26feee2 100644
--- a/nixos/modules/virtualisation/nixos-containers.nix
+++ b/nixos/modules/virtualisation/nixos-containers.nix
@@ -1014,6 +1014,7 @@ in
             hostNixSocketIsDisabled
             ;
 
+          # Tested in: nixos/tests/containers-eval.nix
           mapper =
             name:
             { cfg, opt }:
@@ -1030,7 +1031,7 @@ in
                   && cfg.config.nix.enable
                   && cfg.config.nix.daemon.enable
                 )
-                "${options.containers}.${strings.escapeNixIdentifier name} requires a Nix daemon but the host does not provide it, as ${hostNixSocketIsDisabled}";
+                "${options.containers}.${strings.escapeNixIdentifier name} has nix.daemon.enable = true, but the host does not provide a nix daemon socket, as ${hostNixSocketIsDisabled}. Disable nix.daemon.enable in the container, or enable the daemon on the host.";
         in
         (lib.concatMap
           # This could be done in mapper but causes a reformat
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index c06783aefafb..25f0dd5eca01 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -466,6 +466,7 @@ in
   containers-bridge = runTest ./containers-bridge.nix;
   containers-custom-pkgs = runTest ./containers-custom-pkgs.nix;
   containers-ephemeral = runTest ./containers-ephemeral.nix;
+  containers-eval = import ./containers-eval.nix { inherit pkgs; };
   containers-extra_veth = runTest ./containers-extra_veth.nix;
   containers-gateway = runTest ./containers-gateway.nix;
   containers-hosts = runTest ./containers-hosts.nix;
diff --git a/nixos/tests/containers-eval.nix b/nixos/tests/containers-eval.nix
new file mode 100644
index 000000000000..d7dfe0693aef
--- /dev/null
+++ b/nixos/tests/containers-eval.nix
@@ -0,0 +1,81 @@
+# Given a Nixpkgs, `assert` relevant properties of NixOS container evaluation
+# that aren't exercised by the test framework, such as checking the `assertions`,
+# which makes `toplevel` invalid.
+#
+# Run tests with:
+#   nix-build -A nixosTests.containers-eval
+{
+  pkgs,
+  lib ? pkgs.lib,
+}:
+
+let
+  inherit (lib) concatMap optionals;
+
+  test = rec {
+    nixos =
+      m:
+      pkgs.nixos {
+        imports = [ m ];
+        boot.loader.grub.enable = false;
+        fileSystems."/".device = "bogus";
+        fileSystems."/".fsType = "bogusfs";
+        system.stateVersion = lib.trivial.release;
+      };
+
+    # we'd rather have all messages ready for display than show thunks and length mismatch
+    deepSeqId = a: builtins.deepSeq a a;
+
+    assertionMessages =
+      configuration:
+      deepSeqId (
+        concatMap (ass: optionals (!ass.assertion) [ ass.message ]) configuration.config.assertions
+      );
+
+    flakeContainerOnHostWithoutNix = nixos {
+      nix.enable = false;
+      containers.foo.flake = "github:NixOS/fake-repo";
+
+      # - Does not need nix for startup like flake.
+      # - We can't know whether it needs a socket, so we just let this pass.
+      # So via_path should eval without assertions.
+      containers.via_path.path = "/nix/var/nix/profiles/per-container/foo";
+    };
+
+    flakeContainerOnHostWithoutNixDaemon = nixos {
+      nix.daemon.enable = false;
+
+      # This should eval fine. The host needs nix, but we can't know now whether
+      # the specified container needs a nix daemon socket.
+      containers.foo.flake = "github:NixOS/fake-repo";
+
+      # This container does not disable its daemon socket, so this could be a
+      # problem and we should report it.
+      containers.bar.config = {
+      };
+    };
+
+    conflictingNetwork = nixos {
+      containers.foo.networkNamespace = "/foons";
+      containers.foo.interfaces = [ "veth67" ];
+      containers.foo.config = { };
+    };
+
+    result =
+      assert
+        assertionMessages flakeContainerOnHostWithoutNix == [
+          "containers.foo.flake is defined, so the container is built with nix on the host, but nix.enable is disabled"
+        ];
+      assert
+        assertionMessages flakeContainerOnHostWithoutNixDaemon == [
+          "containers.bar has nix.daemon.enable = true, but the host does not provide a nix daemon socket, as host option nix.daemon.enable is disabled. Disable nix.daemon.enable in the container, or enable the daemon on the host."
+        ];
+      assert
+        assertionMessages conflictingNetwork == [
+          "containers.foo.networkNamespace is mutally exclusive to containers.foo.privateNetwork and containers.foo.interfaces."
+        ];
+
+      pkgs.emptyFile // { details = test; };
+  };
+in
+test.result

From 7703ef01b322e089f0a9e43f6268035d34824131 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 19 Sep 2026 03:26:59 +0000
Subject: [PATCH 27/59] unused_deps: 8.5.1 -> 10.0.1

---
 pkgs/by-name/ba/bazel-buildtools/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ba/bazel-buildtools/package.nix b/pkgs/by-name/ba/bazel-buildtools/package.nix
index 5078b9aafe7d..5f21063d6508 100644
--- a/pkgs/by-name/ba/bazel-buildtools/package.nix
+++ b/pkgs/by-name/ba/bazel-buildtools/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "bazel-buildtools";
-  version = "8.5.1";
+  version = "10.0.1";
 
   src = fetchFromGitHub {
     owner = "bazelbuild";
     repo = "buildtools";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ykfdajj9KpP9+j0uePYCRf7TDpb1GbGAiR6bI++jslg=";
+    hash = "sha256-SX/QeVsAn3yqovmjAo6NDFyfetNpRxb/C72zqWwCbaE=";
   };
 
-  vendorHash = "sha256-sYZ7ogQY0dWOwJMvLljOjaKeYGYdLrF5AnetregdlYY=";
+  vendorHash = "sha256-bUvWtQ0DCdAQRETyPJ6gp4qlaPowlpO5l3GHFaEcH94=";
 
   preBuild = ''
     rm -r warn/docs

From da67fd6f4597ac2fc0e8e18b28bd184a028fa2c2 Mon Sep 17 00:00:00 2001
From: airRnot1106 <62370527+airRnot1106@users.noreply.github.com>
Date: Sat, 19 Sep 2026 17:34:17 +0900
Subject: [PATCH 28/59] textlint-rule-preset-ai-words-ja: init at 1.2.1

---
 .../package.nix                               | 74 +++++++++++++++++++
 .../textlint-rule-preset-ai-words-ja/test.md  |  1 +
 pkgs/by-name/te/textlint/package.nix          |  2 +
 3 files changed, 77 insertions(+)
 create mode 100644 pkgs/by-name/te/textlint-rule-preset-ai-words-ja/package.nix
 create mode 100644 pkgs/by-name/te/textlint-rule-preset-ai-words-ja/test.md

diff --git a/pkgs/by-name/te/textlint-rule-preset-ai-words-ja/package.nix b/pkgs/by-name/te/textlint-rule-preset-ai-words-ja/package.nix
new file mode 100644
index 000000000000..2b35e5c439cb
--- /dev/null
+++ b/pkgs/by-name/te/textlint-rule-preset-ai-words-ja/package.nix
@@ -0,0 +1,74 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  fetchPnpmDeps,
+  pnpmConfigHook,
+  pnpm_10,
+  nodejs,
+  textlint,
+  textlint-rule-preset-ai-words-ja,
+  nix-update-script,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "textlint-rule-preset-ai-words-ja";
+  version = "1.2.1";
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "p1ass";
+    repo = "textlint-rule-preset-ai-words-ja";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-0QgNPVyheFdPLCLq6JJy5AFIJ5txr1TOvzJ2VFC2C0I=";
+  };
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs) pname version src;
+    pnpm = pnpm_10;
+    fetcherVersion = 4;
+    hash = "sha256-azyV6f7aha1dS0bTTNU5rwzKxRpYaARNVDVJKbMA2sM=";
+  };
+
+  nativeBuildInputs = [
+    nodejs
+    pnpmConfigHook
+    pnpm_10
+  ];
+
+  buildPhase = ''
+    runHook preBuild
+
+    pnpm build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    pnpm install --offline --frozen-lockfile --ignore-scripts --prod
+    mkdir -p $out/lib/node_modules/textlint-rule-preset-ai-words-ja
+    cp -r lib node_modules package.json $out/lib/node_modules/textlint-rule-preset-ai-words-ja
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    tests = textlint.testPackages {
+      rule = textlint-rule-preset-ai-words-ja;
+      testFile = ./test.md;
+    };
+    updateScript = nix-update-script { };
+  };
+
+  meta = {
+    description = "Textlint preset that detects words and phrases commonly found in AI-generated Japanese";
+    homepage = "https://github.com/p1ass/textlint-rule-preset-ai-words-ja";
+    changelog = "https://github.com/p1ass/textlint-rule-preset-ai-words-ja/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ airrnot ];
+    platforms = textlint.meta.platforms;
+  };
+})
diff --git a/pkgs/by-name/te/textlint-rule-preset-ai-words-ja/test.md b/pkgs/by-name/te/textlint-rule-preset-ai-words-ja/test.md
new file mode 100644
index 000000000000..b1a82d2e59a0
--- /dev/null
+++ b/pkgs/by-name/te/textlint-rule-preset-ai-words-ja/test.md
@@ -0,0 +1 @@
+変更した瞬間、静かに壊れます。
diff --git a/pkgs/by-name/te/textlint/package.nix b/pkgs/by-name/te/textlint/package.nix
index 5d18f749d5b4..5978ed07c317 100644
--- a/pkgs/by-name/te/textlint/package.nix
+++ b/pkgs/by-name/te/textlint/package.nix
@@ -19,6 +19,7 @@
   textlint-rule-max-comma,
   textlint-rule-no-start-duplicated-conjunction,
   textlint-rule-period-in-list-item,
+  textlint-rule-preset-ai-words-ja,
   textlint-rule-preset-ja-spacing,
   textlint-rule-preset-ja-technical-writing,
   textlint-rule-prh,
@@ -157,6 +158,7 @@ stdenv.mkDerivation (finalAttrs: {
         textlint-rule-max-comma
         textlint-rule-no-start-duplicated-conjunction
         textlint-rule-period-in-list-item
+        textlint-rule-preset-ai-words-ja
         textlint-rule-preset-ja-spacing
         textlint-rule-preset-ja-technical-writing
         textlint-rule-prh

From 59ee8b5c166a1cd4007322ceec1d4a6ba5159d11 Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@eurofusion.eu>
Date: Sat, 19 Sep 2026 17:09:11 +0200
Subject: [PATCH 29/59] libebml: 1.4.5 -> 1.4.7

---
 pkgs/by-name/li/libebml/package.nix | 15 ++++-----------
 1 file changed, 4 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/li/libebml/package.nix b/pkgs/by-name/li/libebml/package.nix
index 9bf2b689cea7..f4ef5edf6771 100644
--- a/pkgs/by-name/li/libebml/package.nix
+++ b/pkgs/by-name/li/libebml/package.nix
@@ -2,33 +2,26 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
   pkg-config,
+  utf8cpp,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libebml";
-  version = "1.4.5";
+  version = "1.4.7";
 
   src = fetchFromGitHub {
     owner = "Matroska-Org";
     repo = "libebml";
     rev = "release-${finalAttrs.version}";
-    sha256 = "sha256-PIVBePTWceMgiENdaL9lvXIL/RQIrtg7l0OG2tO0SU8=";
+    sha256 = "sha256-myXqGGFfL+CuaOwwNuSZC4+fgqcQNRzhWN0jrY3k5r8=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "libebml-fix-cmake-4.patch";
-      url = "https://github.com/Matroska-Org/libebml/commit/6725c5f0169981cb0bd2ee124fbf0d8ca30b762d.patch";
-      hash = "sha256-q62EWnJmQzBtra1xL0N7rC4RARJZQ/HAVyorzvB7XFY=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     pkg-config
+    utf8cpp
   ];
 
   cmakeFlags = [

From aa9befac202c2c92aa133627b867607c57dea836 Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@eurofusion.eu>
Date: Sat, 19 Sep 2026 17:10:00 +0200
Subject: [PATCH 30/59] libmatroska: 1.7.1 -> 1.7.2

---
 pkgs/by-name/li/libmatroska/package.nix | 13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/li/libmatroska/package.nix b/pkgs/by-name/li/libmatroska/package.nix
index e37c23943ba0..64cc00998e20 100644
--- a/pkgs/by-name/li/libmatroska/package.nix
+++ b/pkgs/by-name/li/libmatroska/package.nix
@@ -2,7 +2,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch,
   cmake,
   libebml,
   nix-update-script,
@@ -14,7 +13,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libmatroska";
-  version = "1.7.1";
+  version = "1.7.2";
 
   outputs = [
     "dev"
@@ -25,17 +24,9 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "Matroska-Org";
     repo = "libmatroska";
     rev = "release-${finalAttrs.version}";
-    hash = "sha256-hfu3Q1lIyMlWFWUM2Pu70Hie0rlQmua7Kq8kSIWnfHE=";
+    hash = "sha256-FedoJxUsRgKQn41PZGBaeF0O29PVQEOK20LsNMK3xHo=";
   };
 
-  patches = [
-    (fetchpatch {
-      name = "libmatroska-fix-cmake-4.patch";
-      url = "https://github.com/Matroska-Org/libmatroska/commit/dc80e194e93e6f0e25c8ad3e015d83aca2a99e10.patch";
-      hash = "sha256-2dKRJ6z5rOrLJ5agvXQ6k8TPi5rTMA3H1wCO2F5tBbc=";
-    })
-  ];
-
   nativeBuildInputs = [
     cmake
     pkg-config

From 8d4b64a98432ed80562a7b1224d9189145a9156c Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@eurofusion.eu>
Date: Sat, 19 Sep 2026 17:12:03 +0200
Subject: [PATCH 31/59] mkvtoolnix: 100.0 -> 102.0

---
 pkgs/by-name/mk/mkvtoolnix/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mk/mkvtoolnix/package.nix b/pkgs/by-name/mk/mkvtoolnix/package.nix
index 2419af49df28..ff549c688a38 100644
--- a/pkgs/by-name/mk/mkvtoolnix/package.nix
+++ b/pkgs/by-name/mk/mkvtoolnix/package.nix
@@ -49,13 +49,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mkvtoolnix";
-  version = "100.0";
+  version = "102.0";
 
   src = fetchFromCodeberg {
     owner = "mbunkus";
     repo = "mkvtoolnix";
     tag = "release-${finalAttrs.version}";
-    hash = "sha256-85mL3/x7SoTgOxU/YCFh58vcGzHLG3qPbbG4MD5dB9o=";
+    hash = "sha256-YsenzSOMwh+jDOgdYHQhiicdHEHIGzd3UqPyecdgJaI=";
   };
 
   passthru = {

From 57ae1f98397f32fed6f1ca37bdb20524f3dae176 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 20 Sep 2026 02:15:35 +0000
Subject: [PATCH 32/59] wails: 2.15.0 -> 2.16.0

---
 pkgs/by-name/wa/wails/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/wa/wails/package.nix b/pkgs/by-name/wa/wails/package.nix
index a18846079998..f27183644ecf 100644
--- a/pkgs/by-name/wa/wails/package.nix
+++ b/pkgs/by-name/wa/wails/package.nix
@@ -16,13 +16,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "wails";
-  version = "2.15.0";
+  version = "2.16.0";
 
   src = fetchFromGitHub {
     owner = "wailsapp";
     repo = "wails";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/0GJ0RVBxuPTUqSuoZ8pLi1E2dR9n1n3aPlUKjpFVJw=";
+    hash = "sha256-TackU0WXVP2yoVUVnXCnLiXfBjlqNUKzvwlkBDrCo5Y=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/v2";

From a6dabffc3b688235a03c338c6d1c24c34108f2fb Mon Sep 17 00:00:00 2001
From: Rafael Ieda <git@ieda.me>
Date: Sun, 20 Sep 2026 03:49:52 -0300
Subject: [PATCH 33/59] sct: mark as broken on aarch64-linux (last successful
 Hydra build 2022)

---
 pkgs/by-name/sc/sct/package.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/by-name/sc/sct/package.nix b/pkgs/by-name/sc/sct/package.nix
index 1006f73c571c..2b0075c53fee 100644
--- a/pkgs/by-name/sc/sct/package.nix
+++ b/pkgs/by-name/sc/sct/package.nix
@@ -29,6 +29,8 @@ stdenv.mkDerivation {
   makeFlags = [ "PREFIX=$(out)" ];
 
   meta = {
+    # last successful hydra build on aarch64-linux was in 2022
+    broken = stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch64;
     homepage = "https://www.umaxx.net/";
     description = "Minimal utility to set display colour temperature";
     maintainers = with lib.maintainers; [

From e4ed37d9059fe0c3a503d38e4a9d2c613d36a9d4 Mon Sep 17 00:00:00 2001
From: pancaek <20342389+pancaek@users.noreply.github.com>
Date: Sun, 20 Sep 2026 14:29:42 -0700
Subject: [PATCH 34/59] pinta: fix support for webp images

---
 pkgs/by-name/pi/pinta/package.nix | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/pkgs/by-name/pi/pinta/package.nix b/pkgs/by-name/pi/pinta/package.nix
index 220c12f0c8e3..a81372e9c1d3 100644
--- a/pkgs/by-name/pi/pinta/package.nix
+++ b/pkgs/by-name/pi/pinta/package.nix
@@ -11,6 +11,8 @@
   pango,
   intltool,
   wrapGAppsHook4,
+  webp-pixbuf-loader,
+  gnome,
   nix-update-script,
 
   # Darwin transitive deps
@@ -84,6 +86,17 @@ buildDotnetModule rec {
     intltool-merge -d po/ xdg/com.github.PintaProject.Pinta.desktop.in xdg/com.github.PintaProject.Pinta.desktop
   '';
 
+  postInstall = ''
+    # In postInstall to run before gappsWrapperArgsHook.
+    export GDK_PIXBUF_MODULE_FILE="${
+      gnome._gdkPixbufCacheBuilder_DO_NOT_USE {
+        extraLoaders = [
+          webp-pixbuf-loader
+        ];
+      }
+    }"
+  '';
+
   postFixup = ''
     # Two-step rename needed on macOS: 'Pinta' is the same as 'pinta' on case-insensitive filesystems.
     mv "$out/bin/Pinta" "$out/bin/pinta_tmp"

From efce9d8f619bc9a8ca68641f387834531dfe44af Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 20 Sep 2026 22:36:51 +0000
Subject: [PATCH 35/59] gotify-server: 3.1.0 -> 3.1.1

---
 pkgs/by-name/go/gotify-server/package.nix | 4 ++--
 pkgs/by-name/go/gotify-server/ui.nix      | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/go/gotify-server/package.nix b/pkgs/by-name/go/gotify-server/package.nix
index 39f7f8487c71..9e5eab0cebbf 100644
--- a/pkgs/by-name/go/gotify-server/package.nix
+++ b/pkgs/by-name/go/gotify-server/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "gotify-server";
-  version = "3.1.0";
+  version = "3.1.1";
 
   src = fetchFromGitHub {
     owner = "gotify";
     repo = "server";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-s3oU6mEvhbguLHcLUaavDlR44EX7sDnd0SxrtbMCeyI=";
+    hash = "sha256-x3LbIrw+co2sY+VQAT/0Q6oQd1i17d3z2bGdH8wVg70=";
   };
 
   vendorHash = "sha256-ERRPIRZFhJN+QKEwBbZVUKTaTOLrlC+cb8yQNGHgMxg=";
diff --git a/pkgs/by-name/go/gotify-server/ui.nix b/pkgs/by-name/go/gotify-server/ui.nix
index ed6d2218210f..7e59806a5192 100644
--- a/pkgs/by-name/go/gotify-server/ui.nix
+++ b/pkgs/by-name/go/gotify-server/ui.nix
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-PUO8HWTjtZfzWtLkDa827HoRx0LBxxO11My3mhito+I=";
+    hash = "sha256-zyPNIrTw5YUOZnuYuD1UTw7Pjy8nDWQwbH5IZXICF0I=";
   };
 
   nativeBuildInputs = [

From c2fd1e94a51a8aab642a85156bc3275062eff7bf Mon Sep 17 00:00:00 2001
From: Linus Heckemann <git@sphalerite.org>
Date: Fri, 5 Dec 2025 13:12:30 +0100
Subject: [PATCH 36/59] nixos/gitlab: make backup service oneshot

This means that the service won't be considered started until the main
process has exited, which allows configuring other services to start
only after the backup has completed.
---
 nixos/modules/services/misc/gitlab/default.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/modules/services/misc/gitlab/default.nix b/nixos/modules/services/misc/gitlab/default.nix
index c5bb1d6d56b4..804c80cf88dc 100644
--- a/nixos/modules/services/misc/gitlab/default.nix
+++ b/nixos/modules/services/misc/gitlab/default.nix
@@ -1800,6 +1800,8 @@ in
         Group = cfg.group;
         Slice = "system-gitlab.slice";
         ExecStart = "${gitlab-rake}/bin/gitlab-rake gitlab:backup:create";
+        Type = "oneshot";
+        RemainAfterExit = true;
       };
     };
 

From cb109283b8a5592c38d791308c91f8838a959395 Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Mon, 21 Sep 2026 15:44:56 +0200
Subject: [PATCH 37/59] libre: 4.10.0 -> 4.11.0

---
 pkgs/by-name/li/libre/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libre/package.nix b/pkgs/by-name/li/libre/package.nix
index e9028bb823be..b5d1d81e4255 100644
--- a/pkgs/by-name/li/libre/package.nix
+++ b/pkgs/by-name/li/libre/package.nix
@@ -8,13 +8,13 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "4.10.0";
+  version = "4.11.0";
   pname = "libre";
   src = fetchFromGitHub {
     owner = "baresip";
     repo = "re";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-1EI7Tjp5pwinP65vG+59jyHRXbNOBCP3vnRyC7zHUh4=";
+    sha256 = "sha256-cG7etDjpWdOhZ2dUhkXxlKpDpEoUG/7z8KkQXgSSVbw=";
   };
 
   buildInputs = [

From 0c9a4e4780632942fb0837bda322a39d0e2e46ab Mon Sep 17 00:00:00 2001
From: rnhmjoj <rnhmjoj@inventati.org>
Date: Mon, 21 Sep 2026 15:45:51 +0200
Subject: [PATCH 38/59] baresip: 4.10.0 -> 4.11.0

---
 pkgs/by-name/ba/baresip/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ba/baresip/package.nix b/pkgs/by-name/ba/baresip/package.nix
index 99a3fa7c2f06..6fac4a55cda5 100644
--- a/pkgs/by-name/ba/baresip/package.nix
+++ b/pkgs/by-name/ba/baresip/package.nix
@@ -31,14 +31,14 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "4.10.0";
+  version = "4.11.0";
   pname = "baresip";
 
   src = fetchFromGitHub {
     owner = "baresip";
     repo = "baresip";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-EUnMcRvSvQoCgVmDVPjtfeppUiheVU2xD49D9hZbGb4=";
+    hash = "sha256-GMR1XteY8IjbebRzD4FxCRqbrwP3kPbV8oW/+L85eLs=";
   };
 
   patches = [

From 179fb3603e2c735f8e0b834317fd037f5a869c45 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Mon, 21 Sep 2026 13:53:32 +0000
Subject: [PATCH 39/59] tokenspeed-triton-llvm: 23.0.0-unstable-2026-04-08 ->
 24.0.0-unstable-2026-08-03

---
 pkgs/by-name/to/tokenspeed-triton-llvm/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/to/tokenspeed-triton-llvm/package.nix b/pkgs/by-name/to/tokenspeed-triton-llvm/package.nix
index 568542fccfe3..87132a6c939b 100644
--- a/pkgs/by-name/to/tokenspeed-triton-llvm/package.nix
+++ b/pkgs/by-name/to/tokenspeed-triton-llvm/package.nix
@@ -38,16 +38,16 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "tokenspeed-triton-llvm";
-  version = "23.0.0-unstable-2026-04-08"; # See cmake/Modules/LLVMVersion.cmake
+  version = "24.0.0-unstable-2026-08-03"; # See cmake/Modules/LLVMVersion.cmake
   __structuredAttrs = true;
   strictDeps = true;
 
-  # See https://github.com/lightseekorg/triton/blob/v3.7.10.post20260531/cmake/llvm-info.json
+  # See https://github.com/lightseekorg/triton/blob/v3.8.10.post20260920/cmake/llvm-info.json
   src = fetchFromGitHub {
     owner = "llvm";
     repo = "llvm-project";
-    rev = "87717bf9f81f7b29466c5d9a30a3453bdfc93941";
-    hash = "sha256-8+Q19pOgovZgpN0it5TDrrQfXZFGiIRoP0Ha5dLQJp0=";
+    rev = "b010a18d2b648cab83c83967ff26b8fde11acdc6";
+    hash = "sha256-stgOKrTcZo6eq/oOkIRo89t/lIJ2ADFzh7XHuNdxeJs=";
   };
 
   nativeBuildInputs = [

From 112e0cf6d3ae87c4fbe3f41ddd6beab0b6f3095a Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Mon, 21 Sep 2026 13:53:34 +0000
Subject: [PATCH 40/59] python3Packages.tokenspeed-triton: 3.7.10.post20260531
 -> 3.8.10.post20260920

Diff: https://github.com/lightseekorg/triton/compare/v3.7.10.post20260531...v3.8.10.post20260920
---
 .../tokenspeed-triton/default.nix             | 28 +++++++------------
 1 file changed, 10 insertions(+), 18 deletions(-)

diff --git a/pkgs/development/python-modules/tokenspeed-triton/default.nix b/pkgs/development/python-modules/tokenspeed-triton/default.nix
index 25c767a3bea0..90de9eda745c 100644
--- a/pkgs/development/python-modules/tokenspeed-triton/default.nix
+++ b/pkgs/development/python-modules/tokenspeed-triton/default.nix
@@ -20,7 +20,7 @@
 }:
 buildPythonPackage (finalAttrs: {
   pname = "tokenspeed-triton";
-  version = "3.7.10.post20260531";
+  version = "3.8.10.post20260920";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -28,7 +28,7 @@ buildPythonPackage (finalAttrs: {
     owner = "lightseekorg";
     repo = "triton";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xsV63z2NtB5BM0rF0J+cnMH2RYzoWkpsSXHQI2nIEdQ=";
+    hash = "sha256-IsPm9yrtTTAzjsrFAfZOLSthCHi8akUemv2jZI6SuVM=";
   };
 
   postPatch = ''
@@ -40,20 +40,6 @@ buildPythonPackage (finalAttrs: {
     substituteInPlace pyproject.toml \
       --replace-fail "cmake>=3.20,<4.0" "cmake>=3.20" \
       --replace-fail "nanobind==2.10.2" "nanobind>=2.10.2"
-  ''
-
-  # nanobind >= 2.13 also requires the `Python::Interpreter`
-  # target, which upstream's `find_package(Python3)` ->
-  # `find_package(Python)` bridge misses:
-  # https://github.com/wjakob/nanobind/commit/706131bef6771ad3634b1d772f029f65b7ea8bd2
-  + ''
-    substituteInPlace CMakeLists.txt \
-      --replace-fail \
-        'if(NOT TARGET Python::Module)' \
-        'if(NOT TARGET Python::Interpreter)
-      add_executable(Python::Interpreter ALIAS Python3::Interpreter)
-    endif()
-    if(NOT TARGET Python::Module)'
   '';
 
   build-system = [
@@ -69,7 +55,7 @@ buildPythonPackage (finalAttrs: {
     writableTmpDirAsHomeHook
   ];
 
-  # https://github.com/lightseekorg/triton/blob/v3.7.10.post20260531/.github/workflows/wheels.yml#L109-L117
+  # https://github.com/lightseekorg/triton/blob/v3.8.10.post20260920/.github/workflows/wheels.yml#L110-L118
   env = {
     TRITON_OFFLINE_BUILD = true;
     TRITON_BUILD_RELEASE = true;
@@ -77,7 +63,13 @@ buildPythonPackage (finalAttrs: {
     TRITON_STABLE_ABI = pythonAtLeast "3.12";
     LLVM_SYSPATH = tokenspeed-triton-llvm;
     JSON_SYSPATH = nlohmann_json;
-    NIX_CFLAGS_COMPILE = "-Wno-stringop-overflow";
+    # Skip building the AMD codegen library, which requires its own pinned LLVM (cmake/amd-llvm-info.json).
+    # It is only dlopen'ed at runtime by the AMD backend.
+    TRITON_AMD_CODEGEN_PATH = "/dev/null";
+    NIX_CFLAGS_COMPILE = toString [
+      "-Wno-stringop-overflow"
+      "-Wno-free-nonheap-object"
+    ];
   };
 
   buildInputs = [

From 9eead31dff91f77aab172c9a6f11809942221527 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Mon, 21 Sep 2026 13:53:36 +0000
Subject: [PATCH 41/59] python3Packages.tokenspeed-triton-bin:
 3.7.10.post20260531 -> 3.8.10.post20260920

---
 .../python-modules/tokenspeed-triton/bin.nix       | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/tokenspeed-triton/bin.nix b/pkgs/development/python-modules/tokenspeed-triton/bin.nix
index 6b7b834a98de..e08a754480d9 100644
--- a/pkgs/development/python-modules/tokenspeed-triton/bin.nix
+++ b/pkgs/development/python-modules/tokenspeed-triton/bin.nix
@@ -22,20 +22,20 @@ let
 
   hashes = {
     aarch64-linux = {
-      cp310 = "sha256-rRex0Y8vvOsLsJO+gxeZNkRF+iT/79IWQ5ShvwZJm3Y=";
-      cp311 = "sha256-Ds3Y1+o63Z19ckG4NcgMEthCZSvWsg3NhNsYojXhYIQ=";
-      abi3 = "sha256-Fs0KP8HP/rRYp+A+hohxT0n98LWhCL/KmZ9GWXw/qrs=";
+      cp310 = "sha256-fkYRq6wkAavw4BwOHOt8aybu+IfRLLvrD5oU6JFTHlw=";
+      cp311 = "sha256-tGfvQ4M7eOqfndLnC842WevPx6N1HjTzHI/+4g0S1+U=";
+      abi3 = "sha256-KZ9Ygd4Go0SNjk9L/s32/58UiWk7rxYwPehBa6gsFtY=";
     };
     x86_64-linux = {
-      cp310 = "sha256-GGrclq8qFWW1Z27JIvYSZdf+u5pK6KK/5ioTigYMJ7Y=";
-      cp311 = "sha256-Ur4JbdxSJcbyNF4NCQrStWRmqFu+uGbMEaIOD+Pd4b8=";
-      abi3 = "sha256-uQrEHn8VkzeXVF/xqegDqdi+tMqbpw9tQang/CZIT1w=";
+      cp310 = "sha256-vHTyzQZDGs5gt3dkBSaA3QGK5rDFpC0NPWk9dOTRmVw=";
+      cp311 = "sha256-9qMpxrtZSfKxTUdJ1ulwWUwxvTUniPtc7sjkmxffWbw=";
+      abi3 = "sha256-616ubE09sR4TtwWMibV+B1+n35BdQxac/bBm4WGIZCE=";
     };
   };
 in
 buildPythonPackage (finalAttrs: {
   pname = "tokenspeed-triton";
-  version = "3.7.10.post20260531";
+  version = "3.8.10.post20260920";
   pyproject = false;
   __structuredAttrs = true;
 

From 634002291b4d217e5d8135f9d4deb3ec821931c2 Mon Sep 17 00:00:00 2001
From: "nixpkgs-ci[bot]" <190413589+nixpkgs-ci[bot]@users.noreply.github.com>
Date: Mon, 21 Sep 2026 19:46:52 +0000
Subject: [PATCH 42/59] maintainers/github-teams.json: Automated sync

---
 maintainers/github-teams.json | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/maintainers/github-teams.json b/maintainers/github-teams.json
index 3d330dcbb5f2..3c39dcdf6157 100644
--- a/maintainers/github-teams.json
+++ b/maintainers/github-teams.json
@@ -435,8 +435,7 @@
     "maintainers": {
       "Aleksanaa": 42209822,
       "Hythera": 87016780,
-      "getchoo": 48872998,
-      "michaelgrahamevans": 5932424
+      "getchoo": 48872998
     },
     "members": {},
     "name": "GNOME Circle"

From 8fc4142119a8063db22a2aaae5ce7923d9405da1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 21 Sep 2026 20:11:01 +0000
Subject: [PATCH 43/59] chromium-hsts-preload-list: 155.0.8053.3 ->
 156.0.8068.1

---
 pkgs/by-name/ch/chromium-hsts-preload-list/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ch/chromium-hsts-preload-list/package.nix b/pkgs/by-name/ch/chromium-hsts-preload-list/package.nix
index 86672afb90e3..7bee1c0be809 100644
--- a/pkgs/by-name/ch/chromium-hsts-preload-list/package.nix
+++ b/pkgs/by-name/ch/chromium-hsts-preload-list/package.nix
@@ -6,11 +6,11 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "chromium-hsts-preload-list";
-  version = "155.0.8053.3";
+  version = "156.0.8068.1";
 
   src = fetchurl {
     url = "https://raw.github.com/chromium/chromium/${finalAttrs.version}/net/http/transport_security_state_static.json";
-    hash = "sha256-GIC2O/GOHi7MpYKiLYlmiLHwh1nzvdCHcUSb3fC18I4=";
+    hash = "sha256-IqKm5y6lcbqA7EeP2pDGX8+tVLHSs/gBUAi8PIuIydY=";
   };
 
   dontUnpack = true;

From 4de87030df8d3e618be3115de766d91087c79d35 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Mon, 21 Sep 2026 13:53:37 +0000
Subject: [PATCH 44/59] python3Packages.tokenspeed-mla: 0.1.5 -> 0.2.10

Diff: https://github.com/lightseekorg/tokenspeed/compare/a39b3854dfd9b08a410028dbe5260eda08ef6b63...bf2e923bb422bbc3777fec11ad6b388d2576fde1
---
 .../python-modules/tokenspeed-mla/default.nix          | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/tokenspeed-mla/default.nix b/pkgs/development/python-modules/tokenspeed-mla/default.nix
index 4813cd099604..d22127a0da2d 100644
--- a/pkgs/development/python-modules/tokenspeed-mla/default.nix
+++ b/pkgs/development/python-modules/tokenspeed-mla/default.nix
@@ -14,15 +14,16 @@
 }:
 buildPythonPackage (finalAttrs: {
   pname = "tokenspeed-mla";
-  version = "0.1.5";
+  version = "0.2.10";
   pyproject = true;
   __structuredAttrs = true;
 
+  # No git tags. Using the commits named 'Update tokenspeed-mla to XXX'
   src = fetchFromGitHub {
     owner = "lightseekorg";
     repo = "tokenspeed";
-    rev = "a39b3854dfd9b08a410028dbe5260eda08ef6b63";
-    hash = "sha256-rl+cpZabmK24nMcam5Ud4GqnpLA3TqpVRznlX6lz6Xs=";
+    rev = "bf2e923bb422bbc3777fec11ad6b388d2576fde1";
+    hash = "sha256-UmcM+lALQoTbbbbp4D3woo5vsNICbY9m/MS3wjdyJeE=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/tokenspeed-mla";
@@ -31,6 +32,9 @@ buildPythonPackage (finalAttrs: {
     setuptools
   ];
 
+  pythonRelaxDeps = [
+    "apache-tvm-ffi"
+  ];
   dependencies = [
     apache-tvm-ffi
     nvidia-cutlass-dsl

From fbfd0dd72db68d56bf50876eaeaf0a78473f245d Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Mon, 21 Sep 2026 13:53:39 +0000
Subject: [PATCH 45/59] python3Packages.tokenspeed-mla-bin: 0.1.5 -> 0.2.10

---
 .../python-modules/tokenspeed-mla/bin.nix     | 42 +++----------------
 1 file changed, 5 insertions(+), 37 deletions(-)

diff --git a/pkgs/development/python-modules/tokenspeed-mla/bin.nix b/pkgs/development/python-modules/tokenspeed-mla/bin.nix
index 35c76430fbd8..d995e52b5d3c 100644
--- a/pkgs/development/python-modules/tokenspeed-mla/bin.nix
+++ b/pkgs/development/python-modules/tokenspeed-mla/bin.nix
@@ -2,34 +2,17 @@
   lib,
   buildPythonPackage,
   fetchPypi,
-  python,
-  stdenv,
-
-  # nativeBuildInputs
-  autoPatchelfHook,
-  pypaInstallHook,
-  pythonRuntimeDepsCheckHook,
-  wheelUnpackHook,
 
   # dependencies
   apache-tvm-ffi,
   nvidia-cutlass-dsl,
-  nvidia-cutlass-dsl-libs-base,
   tokenspeed-triton,
   torch,
 }:
-let
-  inherit (stdenv.hostPlatform) system;
-
-  hashes = {
-    aarch64-linux = "sha256-rD4rFrvtQXuICjBOkFfmzj3DaGRC4RHGX5EV4x/3T34=";
-    x86_64-linux = "sha256-1gW6k7nZT4Luj1LOLWaAs91AHBmPi0XCL11loqaCHqQ=";
-  };
-in
 buildPythonPackage (finalAttrs: {
   pname = "tokenspeed-mla";
-  version = "0.1.5";
-  pyproject = false;
+  version = "0.2.10";
+  format = "wheel";
   __structuredAttrs = true;
 
   src = fetchPypi {
@@ -38,18 +21,12 @@ buildPythonPackage (finalAttrs: {
     inherit (finalAttrs) version;
     dist = "py3";
     python = "py3";
-    abi = "none";
-    platform = "manylinux_2_28_${stdenv.hostPlatform.uname.processor}";
-    hash = hashes.${system} or (throw "Unsupported system: ${system}");
+    hash = "sha256-o5dwtxhoLiNVF0O2iizjb1FArCNR/oZBI0PMS0KqV9E=";
   };
 
-  nativeBuildInputs = [
-    autoPatchelfHook
-    pypaInstallHook
-    pythonRuntimeDepsCheckHook
-    wheelUnpackHook
+  pythonRelaxDeps = [
+    "apache-tvm-ffi"
   ];
-
   dependencies = [
     apache-tvm-ffi
     nvidia-cutlass-dsl
@@ -57,13 +34,6 @@ buildPythonPackage (finalAttrs: {
     torch
   ];
 
-  preFixup = ''
-    # libtvm_ffi.so
-    addAutoPatchelfSearchPath "${apache-tvm-ffi}/${python.sitePackages}/tvm_ffi/lib"
-    # libcute_dsl_runtime.so
-    addAutoPatchelfSearchPath "${nvidia-cutlass-dsl-libs-base}/${python.sitePackages}/nvidia_cutlass_dsl"/cu*/lib
-  '';
-
   pythonImportsCheck = [ "tokenspeed_mla" ];
 
   meta = {
@@ -71,9 +41,7 @@ buildPythonPackage (finalAttrs: {
     homepage = "https://github.com/lightseekorg/tokenspeed/tree/main/tokenspeed-mla";
     downloadPage = "https://pypi.org/project/tokenspeed-mla/#files";
     license = lib.licenses.mit;
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     maintainers = with lib.maintainers; [ prince213 ];
-    platforms = lib.attrNames hashes;
     broken = !torch.cudaSupport;
   };
 })

From f7344b9ef23456d2101e633c3311aa8eda83e387 Mon Sep 17 00:00:00 2001
From: Bart Brouns <bart@magnetophon.nl>
Date: Sun, 20 Sep 2026 22:28:39 +0200
Subject: [PATCH 46/59] zlequalizer: 1.2.2 -> 1.4.0

---
 pkgs/by-name/zl/zlequalizer/package.nix | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/zl/zlequalizer/package.nix b/pkgs/by-name/zl/zlequalizer/package.nix
index 147a0e1f5634..6935ddf0e1e2 100644
--- a/pkgs/by-name/zl/zlequalizer/package.nix
+++ b/pkgs/by-name/zl/zlequalizer/package.nix
@@ -21,6 +21,7 @@
   libGL,
   libxcursor,
   libxext,
+  libxi,
   libxinerama,
   libxrandr,
   libepoxy,
@@ -44,7 +45,7 @@ assert lib.assertOneOf "simdTarget" simdTarget [
 ];
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "zlequalizer";
-  version = "1.2.2";
+  version = "1.4.0";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -53,7 +54,7 @@ clangStdenv.mkDerivation (finalAttrs: {
     owner = "ZL-Audio";
     repo = "ZLEqualizer";
     tag = finalAttrs.version;
-    hash = "sha256-fIcplXdRKtCqWBm2Vw/Nm8dVDOpKnsejo2irv1xehvk=";
+    hash = "sha256-Q1eyWLt+AIz0DZmytBpgKJ/NHcwenYPIIQF6gQzP78M=";
     fetchSubmodules = true;
   };
 
@@ -78,6 +79,7 @@ clangStdenv.mkDerivation (finalAttrs: {
     libGL
     libxcursor
     libxext
+    libxi
     libxinerama
     libxrandr
     libepoxy
@@ -87,9 +89,15 @@ clangStdenv.mkDerivation (finalAttrs: {
 
   env = lib.optionalAttrs clangStdenv.hostPlatform.isLinux {
     # JUCE dlopen's these at runtime, crashes without them
+    # -lXi is essential: JUCE requests the unversioned
+    # "libXi.so", which no host has already loaded, and when that dlopen fails
+    # JUCE still believes XInput2 is present (the stub for the missing
+    # XIQueryVersion returns 0, which equals Success), so it discards all core
+    # pointer events and the GUI stops responding to the mouse entirely.
     NIX_LDFLAGS = toString [
       "-lX11"
       "-lXext"
+      "-lXi"
       "-lXcursor"
       "-lXinerama"
       "-lXrandr"

From 37d4e2095d6b23dd79d03ec3139b18bdb9c06754 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 21 Sep 2026 22:14:52 +0000
Subject: [PATCH 47/59] mergiraf: 0.19.0 -> 0.19.1

---
 pkgs/by-name/me/mergiraf/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/me/mergiraf/package.nix b/pkgs/by-name/me/mergiraf/package.nix
index 374b3ee897c0..98334b93765f 100644
--- a/pkgs/by-name/me/mergiraf/package.nix
+++ b/pkgs/by-name/me/mergiraf/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "mergiraf";
-  version = "0.19.0";
+  version = "0.19.1";
 
   src = fetchFromCodeberg {
     owner = "mergiraf";
     repo = "mergiraf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-eBq7xNuV0Z6DVdgaKVgk07WmGEgu7k14hkvVWwtplOo=";
+    hash = "sha256-belYegVxLLrXr3h+n1qjmF14+rJoadkXoNwL+S/2jZE=";
   };
 
-  cargoHash = "sha256-dxTR5mvov5FvnkIZalDMnl99BH8sBx6EsqJyGRMiPfQ=";
+  cargoHash = "sha256-DioS90ecNOEryE7zVddu3ov2S3ylTRtLxe+Zmw2hkmM=";
 
   nativeCheckInputs = [
     git

From 8b2692138104c0479b6dbe8e6acab23ee5891d62 Mon Sep 17 00:00:00 2001
From: Thierry Delafontaine <delafthi@pm.me>
Date: Tue, 22 Sep 2026 01:57:33 +0000
Subject: [PATCH 48/59] proton-pass-cli: 2.3.3 -> 2.4.1

---
 pkgs/by-name/pr/proton-pass-cli/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/pr/proton-pass-cli/package.nix b/pkgs/by-name/pr/proton-pass-cli/package.nix
index f39fae72d43e..edbb85ef9a08 100644
--- a/pkgs/by-name/pr/proton-pass-cli/package.nix
+++ b/pkgs/by-name/pr/proton-pass-cli/package.nix
@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "proton-pass-cli";
-  version = "2.3.3";
+  version = "2.4.1";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -57,15 +57,15 @@ stdenv.mkDerivation (finalAttrs: {
     sources = {
       "aarch64-darwin" = fetchurl {
         url = "https://proton.me/download/pass-cli/${finalAttrs.version}/pass-cli-macos-aarch64";
-        hash = "sha256-MoFYesnFCuLxYEunXp0dObbeuyIbZabMVvZNYm7ePbw=";
+        hash = "sha256-Sx+OqpLUTM3d0rb3Fsjz4O04jLKHCAWbu8hhcPw5U5w=";
       };
       "aarch64-linux" = fetchurl {
         url = "https://proton.me/download/pass-cli/${finalAttrs.version}/pass-cli-linux-aarch64";
-        hash = "sha256-nD6F4Q07tjH/43fwY9mWucyaVF0wlxvO31kQ4W0DVCs=";
+        hash = "sha256-ZVo/bG6/hrC8Z8yy4JmgkBo63xP4zAdNlliGv+cEA/o=";
       };
       "x86_64-linux" = fetchurl {
         url = "https://proton.me/download/pass-cli/${finalAttrs.version}/pass-cli-linux-x86_64";
-        hash = "sha256-tbSaiz/Qr4gwwMGXnyjqDJDM7Oc/WQI6i8qCRdS2jak=";
+        hash = "sha256-9BiEMEZuCj1mi1Z5GotDAWLLIM6xCP7U/b/P530wgOY=";
       };
     };
     updateScript = writeShellScript "update-proton-pass-cli" ''

From 0b6b780f62340aadaf6e39a4f6912231cb122d9e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 22 Sep 2026 04:49:31 +0000
Subject: [PATCH 49/59] go-enum: 0.9.4 -> 0.9.5

---
 pkgs/by-name/go/go-enum/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/go/go-enum/package.nix b/pkgs/by-name/go/go-enum/package.nix
index 85478039dc05..5d422b4e9e90 100644
--- a/pkgs/by-name/go/go-enum/package.nix
+++ b/pkgs/by-name/go/go-enum/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "go-enum";
-  version = "0.9.4";
+  version = "0.9.5";
 
   src = fetchFromGitHub {
     owner = "abice";
     repo = "go-enum";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fFMTnbQ6RUGxvANHveB1YrXlppgUVTJIRB4v1sV3GH8=";
+    hash = "sha256-pEBx5292R8X06TLpv8kboNafiEfq9NWXvUoVVVQ0DVg=";
   };
 
-  vendorHash = "sha256-hGfwb0GZCxc3EQWvxs7/fNVEVGGQE2I0B+MMaH7ecPM=";
+  vendorHash = "sha256-NK4IeOmpzioo7c9PrncgwhCsIyt31sMnkv7qjuJbREo=";
 
   __structuredAttrs = true;
 

From edb4d3b3067d4165167715ace07b74381e43e7ba Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 22 Sep 2026 05:30:34 +0000
Subject: [PATCH 50/59] terraform-providers.ibm-cloud_ibm: 2.6.1 -> 2.6.2

---
 .../networking/cluster/terraform-providers/providers.json     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index a8e637981303..4749fac6959d 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -742,11 +742,11 @@
     "vendorHash": null
   },
   "ibm-cloud_ibm": {
-    "hash": "sha256-pTwgU5uf44MHAMOZ/vEWp4rKv6tfVca7U6B0dQRsjCc=",
+    "hash": "sha256-pY89jjLeGTRmF9IGRckr3HmMXvXrzdGNWqmXI2bMoxU=",
     "homepage": "https://registry.terraform.io/providers/IBM-Cloud/ibm",
     "owner": "IBM-Cloud",
     "repo": "terraform-provider-ibm",
-    "rev": "v2.6.1",
+    "rev": "v2.6.2",
     "spdx": "MPL-2.0",
     "vendorHash": "sha256-+M87BX2FBbqL1AGCIE9uk5E6ySjYLIIxc+E5GYYDODo="
   },

From 437ce1342d8b8bb90f25901994c38939a13165c2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 22 Sep 2026 06:26:58 +0000
Subject: [PATCH 51/59] asdf-vm: 0.20.0 -> 0.20.1

---
 pkgs/by-name/as/asdf-vm/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/as/asdf-vm/package.nix b/pkgs/by-name/as/asdf-vm/package.nix
index 25c6b0934e4c..0bdfeb862743 100644
--- a/pkgs/by-name/as/asdf-vm/package.nix
+++ b/pkgs/by-name/as/asdf-vm/package.nix
@@ -8,18 +8,18 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "asdf-vm";
-  version = "0.20.0";
+  version = "0.20.1";
 
   src = fetchFromGitHub {
     owner = "asdf-vm";
     repo = "asdf";
 
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qq1HJidVBqHyfk2OZ439fnkJKRq1xglqOrF3GVvWeXY=";
+    hash = "sha256-UbD8z5jIZTLfQLEruprLqJx4eoTJi4fFCMWUvIPDjOs=";
 
   };
 
-  vendorHash = "sha256-Rv5p63opBTlyRlRDisgYX5fVJFny1clDn7b/zumV83M=";
+  vendorHash = "sha256-ompvvNzfJetcKCRueJxXALiN0rOQwSiytTHJcVXFEOo=";
 
   nativeBuildInputs = [
     makeWrapper

From 9058dfbeb8b23543ba9cf65ae375083bb7bc7a6c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 22 Sep 2026 08:07:01 +0000
Subject: [PATCH 52/59] nvidia-mig-parted: 0.15.0 -> 0.15.1

---
 pkgs/by-name/nv/nvidia-mig-parted/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/nv/nvidia-mig-parted/package.nix b/pkgs/by-name/nv/nvidia-mig-parted/package.nix
index c46a8587405f..9b88d0d1bd96 100644
--- a/pkgs/by-name/nv/nvidia-mig-parted/package.nix
+++ b/pkgs/by-name/nv/nvidia-mig-parted/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "nvidia-mig-parted";
-  version = "0.15.0";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "NVIDIA";
     repo = "mig-parted";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IIMSLaHhLtA0Tf07a+DE52zIBlQnuGawlj0Z1wTivRs=";
+    hash = "sha256-ApqGjg5ARehMB9lP3Gv4i1j/f3p53Vd1ZNuwDznhIqw=";
   };
 
   vendorHash = null;

From ae792ecd554a38c081e3de1b95e3a8ff433dc0bf Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 22 Sep 2026 08:22:56 +0000
Subject: [PATCH 53/59] phpstan: 2.2.13 -> 2.2.14

---
 pkgs/by-name/ph/phpstan/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ph/phpstan/package.nix b/pkgs/by-name/ph/phpstan/package.nix
index 883e8458a584..96174ac95e32 100644
--- a/pkgs/by-name/ph/phpstan/package.nix
+++ b/pkgs/by-name/ph/phpstan/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "phpstan";
-  version = "2.2.13";
+  version = "2.2.14";
 
   src = fetchFromGitHub {
     owner = "phpstan";
     repo = "phpstan";
     tag = finalAttrs.version;
-    hash = "sha256-saY4OzbbN0VfyCJeGghlK3vFVEhAbKq+HJeplcG5Lm4=";
+    hash = "sha256-cxDHp8jN0aA0OQuDOpttIzFlp4JmUfKdxBxAPO9y/AM=";
   };
 
   nativeBuildInputs = [

From 62696c6b6ec4e38fc400d4aec69353a8989bdb7a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 22 Sep 2026 08:37:00 +0000
Subject: [PATCH 54/59] sqlitecpp: 3.3.3 -> 3.4.0

---
 pkgs/by-name/sq/sqlitecpp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sq/sqlitecpp/package.nix b/pkgs/by-name/sq/sqlitecpp/package.nix
index d571eabf5609..b872f224f829 100644
--- a/pkgs/by-name/sq/sqlitecpp/package.nix
+++ b/pkgs/by-name/sq/sqlitecpp/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "sqlitecpp";
-  version = "3.3.3";
+  version = "3.4.0";
 
   src = fetchFromGitHub {
     owner = "SRombauts";
     repo = "sqlitecpp";
     rev = finalAttrs.version;
-    hash = "sha256-RSNJGfvIvNfk+/Awzh06tDi/TA5Wc35X8ya0X5mP9IE=";
+    hash = "sha256-lmXvh2z+6QLLUapsHouBuAxgBQwbC5XKq80sza6CaUI=";
   };
 
   nativeBuildInputs = [

From c01fafd5bd387e6998c78a9616b6dd5f3d735f3d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 22 Sep 2026 08:38:24 +0000
Subject: [PATCH 55/59] intel-llvm: 7.1.0 -> 7.1.1

---
 pkgs/by-name/in/intel-llvm/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/in/intel-llvm/package.nix b/pkgs/by-name/in/intel-llvm/package.nix
index cfbf5d932b9e..babdca5d404e 100644
--- a/pkgs/by-name/in/intel-llvm/package.nix
+++ b/pkgs/by-name/in/intel-llvm/package.nix
@@ -49,19 +49,19 @@ let
 
     llvmMajorVersion = "22";
 
-    version = "7.1.0";
+    version = "7.1.1";
 
     src = fetchFromGitHub {
       owner = "intel";
       repo = "llvm";
       tag = "v${self.version}";
-      hash = "sha256-dz/3oOzumEBq3FQgsPoxMLv4rxnw09orpbuc7kyvn6s=";
+      hash = "sha256-XVfLWx7lsjS1m+w/T2x0kGg2k51r7jCmKX2ZcR2aAHg=";
     };
 
     # The commit date of the release tag above, kept in sync by `updateScript`.
     # If you override src, you'll probably also want to override this,
     # as some packages check for this date to decide what features the compiler supports.
-    commitDate = "20260831";
+    commitDate = "20260915";
 
     vc-intrinsics-src = fetchFromGitHub {
       owner = "intel";

From 94e9f12128ba5d61c2f4f599fd30ed83724dd612 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 22 Sep 2026 08:48:42 +0000
Subject: [PATCH 56/59] tektoncd-cli: 0.46.0 -> 0.46.1

---
 pkgs/by-name/te/tektoncd-cli/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/te/tektoncd-cli/package.nix b/pkgs/by-name/te/tektoncd-cli/package.nix
index 1b5359ca6ccc..c0ebf1cf41cb 100644
--- a/pkgs/by-name/te/tektoncd-cli/package.nix
+++ b/pkgs/by-name/te/tektoncd-cli/package.nix
@@ -14,13 +14,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "tektoncd-cli";
-  version = "0.46.0";
+  version = "0.46.1";
 
   src = fetchFromGitHub {
     owner = "tektoncd";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    sha256 = "sha256-BEYwvGi/Mt/DkHRR2TU42ItLC57CVKnb7ZBy3TKBoZs=";
+    sha256 = "sha256-YZN6Oprt9Rjg5EBRmaQR/N5wc4oVaK4Tr9Tx4d+UemY=";
   };
 
   vendorHash = null;

From 910f638a1b54c5ef55c1e0c1e8563cadbc5bcfe2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 22 Sep 2026 09:16:29 +0000
Subject: [PATCH 57/59] python3Packages.cookidoo-api: 0.18.3 -> 0.18.4

---
 pkgs/development/python-modules/cookidoo-api/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/cookidoo-api/default.nix b/pkgs/development/python-modules/cookidoo-api/default.nix
index 9d9de1ebbdcd..578a94ddcd0d 100644
--- a/pkgs/development/python-modules/cookidoo-api/default.nix
+++ b/pkgs/development/python-modules/cookidoo-api/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "cookidoo-api";
-  version = "0.18.3";
+  version = "0.18.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "miaucl";
     repo = "cookidoo-api";
     tag = finalAttrs.version;
-    hash = "sha256-mMMtapn5LLdGyVhU7jdaKm/ulC3YUoRhM32xgsIQiqU=";
+    hash = "sha256-YZdJ5myaVS+Hcj5LpsHwpoAyTEY2KRgczzJdIp9Nuck=";
   };
 
   build-system = [ setuptools ];

From f1b00de6c1bd1a19bdaf28bc2cde5be0716b6b16 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Tue, 22 Sep 2026 11:10:22 +0200
Subject: [PATCH 58/59] nodejs_26: 26.9.0 -> 26.10.0

---
 pkgs/development/web/nodejs/nodejs.nix | 5 +----
 pkgs/development/web/nodejs/v26.nix    | 4 ++--
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index 7390e3e0221f..a82a5e540eb5 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -550,6 +550,7 @@ let
             # Those are annoyingly flaky, but not enough to be marked as such upstream.
             ++ lib.optional (majorVersion == "22") "test-child-process-stdout-flush-exit"
             ++ lib.optional (majorVersion == "22" && stdenv.hostPlatform.isRiscV64) "test-worker-messaging"
+            ++ lib.optional (majorVersion == "26" && !stdenv.buildPlatform.isDarwin) "test-net-boundsocket"
             ++ lib.optional (
               majorVersion == "22" && stdenv.buildPlatform.isDarwin
             ) "test/sequential/test-http-server-request-timeouts-mixed.js"
@@ -559,10 +560,6 @@ let
             # patch does not apply
             ++ lib.optional (!lib.versionAtLeast version "24") "test-tls-junk-server"
             ++ lib.optional (majorVersion == "22") "test-tls-alert-handling"
-            # https://github.com/NixOS/nixpkgs/issues/564449
-            ++ lib.optional (
-              majorVersion == "26" && !stdenv.buildPlatform.isDarwin
-            ) "test-fs-cp-async-file-modes"
           )
         }"
       ];
diff --git a/pkgs/development/web/nodejs/v26.nix b/pkgs/development/web/nodejs/v26.nix
index e204d6b3e4b6..7035607ca7fc 100644
--- a/pkgs/development/web/nodejs/v26.nix
+++ b/pkgs/development/web/nodejs/v26.nix
@@ -23,8 +23,8 @@ let
       [ ];
 in
 buildNodejs {
-  version = "26.9.0";
-  sha256 = "47b970d88511b429e587b740fa733176909d2a2005a29662f01b05205f58468b";
+  version = "26.10.0";
+  sha256 = "7b3a546d33cb7e15a43bdd7a57e0be5d5fd5ffc553e6e4c120033e66f0ba20c5";
   patches =
     (lib.optional (!(stdenv.hostPlatform.emulatorAvailable buildPackages)) (fetchpatch2 {
       url = "https://raw.githubusercontent.com/buildroot/buildroot/2f0c31bffdb59fb224387e35134a6d5e09a81d57/package/nodejs/nodejs-src/0003-include-obj-name-in-shared-intermediate.patch";

From 03196233e9c4fc8448bb71ba54c8c7a26041caff Mon Sep 17 00:00:00 2001
From: Alexander Sieg <alex@xanderio.de>
Date: Tue, 22 Sep 2026 11:28:48 +0200
Subject: [PATCH 59/59] dependency-track: 4.14.2 -> 4.14.4

---
 pkgs/by-name/de/dependency-track/package.nix | 24 +++++++-------------
 1 file changed, 8 insertions(+), 16 deletions(-)

diff --git a/pkgs/by-name/de/dependency-track/package.nix b/pkgs/by-name/de/dependency-track/package.nix
index 9c30cb651b6b..82ed9197bad8 100644
--- a/pkgs/by-name/de/dependency-track/package.nix
+++ b/pkgs/by-name/de/dependency-track/package.nix
@@ -2,7 +2,6 @@
   lib,
   buildNpmPackage,
   fetchFromGitHub,
-  fetchpatch2,
   jre_headless,
   protobuf_30,
   xmlstarlet,
@@ -13,7 +12,7 @@
   nixosTests,
 }:
 let
-  version = "4.14.2";
+  version = "4.14.4";
 
   frontend = buildNpmPackage {
     pname = "dependency-track-frontend";
@@ -23,7 +22,7 @@ let
       owner = "DependencyTrack";
       repo = "frontend";
       tag = version;
-      hash = "sha256-/MH1YjEJdRjYjenkzOcp7oytudsJcinPbc9OAGFnI/Q=";
+      hash = "sha256-Zt6KBqR3CstS/RqqJAVJaGkgpzf835UcblrE/8gzUWE=";
     };
 
     installPhase = ''
@@ -31,14 +30,7 @@ let
       cp -R ./dist $out/
     '';
 
-    patches = [
-      (fetchpatch2 {
-        url = "https://github.com/DependencyTrack/frontend/pull/1575.patch?full_index=1";
-        hash = "sha256-Wo+6yXa/8jB/pph0DTNsFz6lK3sedvro+7yvLSKes9c=";
-      })
-    ];
-
-    npmDepsHash = "sha256-md+PGEC1/Kl2MQhhYldSErcsDSefbPvwVDsw0Yklq1E=";
+    npmDepsHash = "sha256-NQY3bg3cwyIt/ing8RBOFNd3+02hzVwYcj0RXi350xk=";
     forceGitDeps = true;
     makeCacheWritable = true;
 
@@ -55,7 +47,7 @@ maven.buildMavenPackage rec {
     owner = "DependencyTrack";
     repo = "dependency-track";
     tag = version;
-    hash = "sha256-9EPjIm2VOmt1FEiPoJtwNHoKZcewO0kJgBSc9fnUXeI=";
+    hash = "sha256-tHtM5xqD7EG3CyZtaL6qsHEAa+5AstcIYRes+hIFyKk=";
   };
 
   postPatch = ''
@@ -88,15 +80,15 @@ maven.buildMavenPackage rec {
   '';
 
   mvnJdk = jre_headless;
-  mvnHash = "sha256-pshUDIPPGGGzxg5WJXC3mjnqGXn8HVowFCb2l5f6zjA=";
+  mvnHash = "sha256-903EuablhywF/2N8k8ISHOnSyZrSJ1LKC9Lx4USO0z8=";
   manualMvnArtifacts = [
     "com.coderplus.maven.plugins:copy-rename-maven-plugin:1.0.1"
     # added to saticfy protobuf compiler plugin dependency resolving
     "jakarta.el:jakarta.el-api:5.0.1"
     "com.fasterxml.jackson.module:jackson-module-jakarta-xmlbind-annotations:2.19.1"
-    "com.fasterxml.jackson.dataformat:jackson-dataformat-xml:2.21.0"
-    "com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.18.3"
-    "com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.21.2"
+    "com.fasterxml.jackson.dataformat:jackson-dataformat-xml:2.22.2"
+    "com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:2.18.4"
+    "com.fasterxml.jackson.datatype:jackson-datatype-jsr310:2.22.1"
     "io.micrometer:micrometer-core:1.16.0"
     "io.micrometer:micrometer-observation:1.16.0"
   ];