Merge master into staging-next

2026-09-17 21:35:36 +00:00 · 2026-09-16 12:14:08 +00:00
parent 0f1fd70371 3257a290dd
commit 71bb675326
73 changed files with 547 additions and 459 deletions
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@@ -562,6 +562,29 @@ stdenv.mkDerivation (finalAttrs: {
 })
 ```

+##### `fetchYarnDeps` arguments {#javascript-fetchyarndeps}
+
+`fetchYarnDeps` accepts the following arguments:
+
+- `yarnLock`: Path to the `yarn.lock` file to fetch dependencies for.
+- `hash` (or `sha256`): The output hash of the offline cache.
+- `mirrorUrl`: Optional registry mirror URL used in place of the default yarn
+  registry (`https://registry.yarnpkg.com/`). When set, any resolved URL
+  pointing at the default registry is rewritten to use this mirror before
+  downloading. This is useful for pointing at a local or internal registry
+  mirror. Note that changing the mirror does not change the output hash, since
+  the downloaded contents are identical.
+
+```nix
+{
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = finalAttrs.src + "/yarn.lock";
+    mirrorUrl = "https://registry.npmmirror.com/";
+    hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+  };
+}
+```
+
 ##### `yarnConfigHook` arguments {#javascript-yarnconfighook}

 By default, `yarnConfigHook` relies upon the attribute `${yarnOfflineCache}` (or `${offlineCache}` if the former is not set) to find the location of the offline cache produced by `fetchYarnDeps`. To disable this phase, you can set `dontYarnInstallDeps = true` or override the `configurePhase`.
--- a/doc/redirects.json
+++ b/doc/redirects.json
@@ -3906,6 +3906,9 @@
  "javascript-yarn-v3-v4": [
    "index.html#javascript-yarn-v3-v4"
  ],
+  "javascript-fetchyarndeps": [
+    "index.html#javascript-fetchyarndeps"
+  ],
  "javascript-yarnconfighook": [
    "index.html#javascript-yarnconfighook"
  ],
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -893,7 +893,6 @@ in
        # Upstream config: https://github.com/systemd/systemd/blob/main/src/run/systemd-run0.in
        setLoginUid = true;
        pamMount = false;
-        startSession = true;
      };
    };

--- a/nixos/tests/redis.nix
+++ b/nixos/tests/redis.nix
@@ -4,12 +4,8 @@
  package,
  ...
 }:
-let
-  mkTestName =
-    pkg: "${pkg.pname}_${builtins.replaceStrings [ "." ] [ "" ] (lib.versions.majorMinor pkg.version)}";
-in
 {
-  name = mkTestName package;
+  name = package.pname;
  meta.maintainers = lib.teams.redis.members;

  nodes = {
--- a/pkgs/applications/graphics/gimp/default.nix
+++ b/pkgs/applications/graphics/gimp/default.nix
@@ -83,7 +83,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "gimp";
-  version = "3.2.4";
+  version = "3.2.6";

  outputs = [
    "out"
@@ -94,7 +94,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://download.gimp.org/gimp/v${lib.versions.majorMinor finalAttrs.version}/gimp-${finalAttrs.version}.tar.xz";
-    hash = "sha256-cxK8U+nG0tAFbKe5PxxrmHB5Rt2TT3FMIbh0bstgFYg=";
+    hash = "sha256-QLFekK0MDGMbdto8Rn6phH+lwk83QTrFtJKASGCijNg=";
  };

  patches = [
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -1,10 +1,10 @@
 {
  "chromium": {
-    "version": "153.0.8010.36",
+    "version": "153.0.8010.47",
    "chromedriver": {
-      "version": "153.0.8010.37",
-      "hash_darwin": "sha256-IMyEnUmK3slNB/QDZ+vtUyzHyU0AB+L6+BMbpCRluYA=",
-      "hash_darwin_aarch64": "sha256-cd1ZWatLQFIkPtCdVacrxFaFfj3rjG9qJ7kGlL3C6OA="
+      "version": "153.0.8010.48",
+      "hash_darwin": "sha256-/4yv3KWuvKNAro9oeK+PFsTOrg878yS11aDYSX5S890=",
+      "hash_darwin_aarch64": "sha256-5eO1WwJ8iQrXUjHb776Z1YahR/A8aCoX7JrJXQEcIQ8="
    },
    "deps": {
      "depot_tools": {
@@ -21,8 +21,8 @@
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "507c6ee3e2f3b2ca0e660547e5b9ea4820c67f4c",
-        "hash": "sha256-q29a3PWQ7wMG4/JL9EyCK7EaDCeG+4Q/ruemOvvgeZM=",
+        "rev": "73934a44f61e6b3878d1943064c141a5a820f5f7",
+        "hash": "sha256-D7Oqukze3CzYVWN9AQq9zN6HN2GcZ6b7ZSqhM5bjvUU=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@@ -92,8 +92,8 @@
      },
      "src/third_party/angle": {
        "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "fca5efdfeff5daf430bc4458375c8d6b7e457400",
-        "hash": "sha256-IoHQfdjZ6TV03VVzHZcxhPqGmNYNhKZrPG4BvQQfC7c="
+        "rev": "ed04c8113c6538f3e1264042da8cb4afd100369b",
+        "hash": "sha256-mZrVJ/P3tPoiSkGBH4fEjNAexLsjAzts8jjkCQZ4kOs="
      },
      "src/third_party/angle/third_party/glmark2/src": {
        "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -132,8 +132,8 @@
      },
      "src/third_party/dawn": {
        "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "225a7ba1bcb997d26de3e894e04fb341638e8c5a",
-        "hash": "sha256-/ic1j1gu2wl5wCLCESfEcsLAPU5Dmsx8oKFb6RhYzg4="
+        "rev": "28ffc61fc935c599677cff4dddfa4a12209ce500",
+        "hash": "sha256-6ySDyyQs/nfFF9AeoUY57GYDx7V8b0GQ17PCwQkzZVk="
      },
      "src/third_party/dawn/third_party/glfw3/src": {
        "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -632,8 +632,8 @@
      },
      "src/third_party/pthreadpool/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/pthreadpool.git",
-        "rev": "02460584c6092e527c8b89f7df4de143d70e801f",
-        "hash": "sha256-4EHJzZT+Gbhs8SkOhjSvDIPEqIQU93oJmtF3c/T+qjw="
+        "rev": "15a6644ba1c45f1acc16ac1e883efc3e56c6bed2",
+        "hash": "sha256-YJD9n8cxoqTrTQJHKuZFW2qnlNcNmh5rQlBpnlF46to="
      },
      "src/third_party/pyelftools": {
        "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git",
@@ -672,8 +672,8 @@
      },
      "src/third_party/skia": {
        "url": "https://skia.googlesource.com/skia.git",
-        "rev": "4f574af2444846ceca4d277a8095c5d4229d175f",
-        "hash": "sha256-HrpA4labNWXPWj/yiS9O8KjdQPwJOllmR5r66TwCjB0="
+        "rev": "fca11a08da7c1ed3777b40b31611961c85c63c43",
+        "hash": "sha256-iQNNgvRVUuyAcSVE+pNJWrWz0NJd/MZLxd9vbYztong="
      },
      "src/third_party/smhasher/src": {
        "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -842,8 +842,8 @@
      },
      "src/v8": {
        "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "f343157cebb388bfa416baccb5d35507e6fe8cc7",
-        "hash": "sha256-zSCyFQpDMNygmV6N4TajL8VB5+VRynrMPV/wAiWsJO4="
+        "rev": "6b96683d44174e78ff4e65cb274bad56dc108231",
+        "hash": "sha256-Oa1wzIbWVPX0x7adJVPUxQocK5gofG0vE56QTg0XKCs="
      },
      "src/agents/shared": {
        "url": "https://chromium.googlesource.com/chromium/agents.git",
@@ -853,7 +853,7 @@
    }
  },
  "ungoogled-chromium": {
-    "version": "153.0.8010.36",
+    "version": "153.0.8010.47",
    "deps": {
      "depot_tools": {
        "rev": "6411ed52842756261c66b6b8ece6b53ade2570f1",
@@ -865,16 +865,16 @@
        "hash": "sha256-qvQ13Ws2tb4i2Hdu34kBHivYPAn8w06zjLdQgK4BIJg="
      },
      "ungoogled-patches": {
-        "rev": "153.0.8010.36-1",
-        "hash": "sha256-JyvizS0oJC8J6VhtnpTKUGVbc31KCvTvwa4TmO+CHaY="
+        "rev": "153.0.8010.47-1",
+        "hash": "sha256-J/IiNmqJzL35TfiGbsqrXnI8lUizCWuxzVBHgo7cG80="
      },
      "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
    },
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "507c6ee3e2f3b2ca0e660547e5b9ea4820c67f4c",
-        "hash": "sha256-q29a3PWQ7wMG4/JL9EyCK7EaDCeG+4Q/ruemOvvgeZM=",
+        "rev": "73934a44f61e6b3878d1943064c141a5a820f5f7",
+        "hash": "sha256-D7Oqukze3CzYVWN9AQq9zN6HN2GcZ6b7ZSqhM5bjvUU=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@@ -944,8 +944,8 @@
      },
      "src/third_party/angle": {
        "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "fca5efdfeff5daf430bc4458375c8d6b7e457400",
-        "hash": "sha256-IoHQfdjZ6TV03VVzHZcxhPqGmNYNhKZrPG4BvQQfC7c="
+        "rev": "ed04c8113c6538f3e1264042da8cb4afd100369b",
+        "hash": "sha256-mZrVJ/P3tPoiSkGBH4fEjNAexLsjAzts8jjkCQZ4kOs="
      },
      "src/third_party/angle/third_party/glmark2/src": {
        "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -984,8 +984,8 @@
      },
      "src/third_party/dawn": {
        "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "225a7ba1bcb997d26de3e894e04fb341638e8c5a",
-        "hash": "sha256-/ic1j1gu2wl5wCLCESfEcsLAPU5Dmsx8oKFb6RhYzg4="
+        "rev": "28ffc61fc935c599677cff4dddfa4a12209ce500",
+        "hash": "sha256-6ySDyyQs/nfFF9AeoUY57GYDx7V8b0GQ17PCwQkzZVk="
      },
      "src/third_party/dawn/third_party/glfw3/src": {
        "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1484,8 +1484,8 @@
      },
      "src/third_party/pthreadpool/src": {
        "url": "https://chromium.googlesource.com/external/github.com/google/pthreadpool.git",
-        "rev": "02460584c6092e527c8b89f7df4de143d70e801f",
-        "hash": "sha256-4EHJzZT+Gbhs8SkOhjSvDIPEqIQU93oJmtF3c/T+qjw="
+        "rev": "15a6644ba1c45f1acc16ac1e883efc3e56c6bed2",
+        "hash": "sha256-YJD9n8cxoqTrTQJHKuZFW2qnlNcNmh5rQlBpnlF46to="
      },
      "src/third_party/pyelftools": {
        "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git",
@@ -1524,8 +1524,8 @@
      },
      "src/third_party/skia": {
        "url": "https://skia.googlesource.com/skia.git",
-        "rev": "4f574af2444846ceca4d277a8095c5d4229d175f",
-        "hash": "sha256-HrpA4labNWXPWj/yiS9O8KjdQPwJOllmR5r66TwCjB0="
+        "rev": "fca11a08da7c1ed3777b40b31611961c85c63c43",
+        "hash": "sha256-iQNNgvRVUuyAcSVE+pNJWrWz0NJd/MZLxd9vbYztong="
      },
      "src/third_party/smhasher/src": {
        "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1694,8 +1694,8 @@
      },
      "src/v8": {
        "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "f343157cebb388bfa416baccb5d35507e6fe8cc7",
-        "hash": "sha256-zSCyFQpDMNygmV6N4TajL8VB5+VRynrMPV/wAiWsJO4="
+        "rev": "6b96683d44174e78ff4e65cb274bad56dc108231",
+        "hash": "sha256-Oa1wzIbWVPX0x7adJVPUxQocK5gofG0vE56QTg0XKCs="
      },
      "src/agents/shared": {
        "url": "https://chromium.googlesource.com/chromium/agents.git",
--- a/pkgs/build-support/node/fetch-yarn-deps/default.nix
+++ b/pkgs/build-support/node/fetch-yarn-deps/default.nix
@@ -104,6 +104,7 @@ in
          src ? null,
          hash ? "",
          sha256 ? "",
+          mirrorUrl ? null,
          ...
        }@args:
        let
@@ -148,7 +149,9 @@ in

              yarnLock=''${yarnLock:=$PWD/yarn.lock}
              mkdir -p $out
-              (cd $out; prefetch-yarn-deps --verbose --builder $yarnLock)
+              (cd $out; prefetch-yarn-deps --verbose --builder $yarnLock ${
+                lib.optionalString (mirrorUrl != null) "--mirrorUrl ${lib.escapeShellArg mirrorUrl}"
+              })

              runHook postBuild
            '';
@@ -161,6 +164,7 @@ in
              "name"
              "hash"
              "sha256"
+              "mirrorUrl"
            ]
            ++ (lib.optional (src == null) "src")
          ))
--- a/pkgs/build-support/node/fetch-yarn-deps/index.js
+++ b/pkgs/build-support/node/fetch-yarn-deps/index.js
@@ -21,15 +21,27 @@ const exec = async (...args) => {
  return res
 }

-const downloadFileHttps = (fileName, url, expectedHash, verbose, hashType = 'sha1') => {
+const yarnRegistryUrl = 'https://registry.yarnpkg.com/';
+
+function ensureTrailingSlash(str) {
+  return str.endsWith('/') ? str : str + '/';
+}
+
+const downloadFileHttps = (fileName, url, expectedHash, verbose, hashType = 'sha1', mirrorRegistryUrl = null) => {
+
+  const registryUrl =
+    mirrorRegistryUrl && url.startsWith(yarnRegistryUrl)
+      ? url.replace(yarnRegistryUrl, ensureTrailingSlash(mirrorRegistryUrl))
+      : url;
+
  return new Promise((resolve, reject) => {
-    const get = (url, redirects = 0) => https.get(url, (res) => {
+    const get = (registryUrl, redirects = 0) => https.get(registryUrl, (res) => {
      if(redirects > 10) {
        reject('Too many redirects!');
        return;
      }
      if(res.statusCode === 301 || res.statusCode === 302) {
-        const location = new URL(res.headers.location, url);
+        const location = new URL(res.headers.location, registryUrl);
        if (verbose) console.log('following redirect to ' + location);
        return get(location, redirects + 1);
      }
@@ -41,13 +53,13 @@ const downloadFileHttps = (fileName, url, expectedHash, verbose, hashType = 'sha
        file.close()
        const h = hash.read()
        if (expectedHash === undefined){
-          console.log(`Warning: lockfile url ${url} doesn't end in "#<hash>" to validate against. Downloaded file had hash ${h}.`);
-        } else if (h != expectedHash) return reject(new Error(`hash mismatch, expected ${expectedHash}, got ${h} for ${url}`))
+          console.log(`Warning: lockfile url ${registryUrl} doesn't end in "#<hash>" to validate against. Downloaded file had hash ${h}.`);
+        } else if (h != expectedHash) return reject(new Error(`hash mismatch, expected ${expectedHash}, got ${h} for ${registryUrl}`))
        resolve()
      })
      res.on('error', e => reject(e))
    })
-    get(url)
+    get(registryUrl)
  })
 }

@@ -90,7 +102,7 @@ const isGitUrl = pattern => {
  return false
 }

-const downloadPkg = (pkg, verbose) => {
+const downloadPkg = (pkg, verbose, mirrorUrl = null) => {
  for (let marker of ['@file:', '@link:']) {
    const split = pkg.key.split(marker)
    if (split.length == 2) {
@@ -122,9 +134,9 @@ const downloadPkg = (pkg, verbose) => {
  } else if (url.startsWith('https://')) {
    if (typeof pkg.integrity === 'string' || pkg.integrity instanceof String) {
      const [ type, checksum ] = pkg.integrity.split('-')
-      return downloadFileHttps(fileName, url, Buffer.from(checksum, 'base64').toString('hex'), verbose, type)
+      return downloadFileHttps(fileName, url, Buffer.from(checksum, 'base64').toString('hex'), verbose, type, mirrorUrl)
    }
-    return downloadFileHttps(fileName, url, hash, verbose)
+    return downloadFileHttps(fileName, url, hash, verbose, 'sha1', mirrorUrl)
  } else if (url.startsWith('file:')) {
    console.warn(`ignoring unsupported file:path url "${url}"`)
  } else {
@@ -155,11 +167,11 @@ const uniqueBy = (arr, callback) => {
  return [...map.values()]
 }

-const prefetchYarnDeps = async (lockContents, verbose) => {
+const prefetchYarnDeps = async (lockContents, verbose, mirrorUrl) => {
  const lockData = lockfile.parse(lockContents)
  await performParallel(
    uniqueBy(Object.entries(lockData.object), ([_, value]) => value.resolved)
-    .map(([key, value]) => () => downloadPkg({ key, ...value }, verbose))
+    .map(([key, value]) => () => downloadPkg({ key, ...value }, verbose, mirrorUrl))
  )
  await fs.promises.writeFile('yarn.lock', lockContents)
  if (verbose) console.log('Done')
@@ -173,18 +185,23 @@ Options:
  -h --help         Show this help
  -v --verbose      Verbose output
  --builder         Only perform the download to current directory, then exit
+  --mirrorUrl <url> Use the given registry mirror URL in place of the default
+                    yarn registry (${yarnRegistryUrl})
 `)
  process.exit(1)
 }

 const main = async () => {
  const args = process.argv.slice(2)
-  let next, lockFile, verbose, isBuilder
+  let next, lockFile, verbose, isBuilder, mirrorUrl
  while (next = args.shift()) {
    if (next == '--builder') {
      isBuilder = true
    } else if (next == '--verbose' || next == '-v') {
      verbose = true
+    } else if (next == '--mirrorUrl') {
+      mirrorUrl = args.shift()
+      if (!mirrorUrl) showUsage()
    } else if (next == '--help' || next == '-h') {
      showUsage()
    } else if (!lockFile) {
@@ -201,13 +218,13 @@ const main = async () => {
  }

  if (isBuilder) {
-    await prefetchYarnDeps(lockContents, verbose)
+    await prefetchYarnDeps(lockContents, verbose, mirrorUrl)
  } else {
    const { stdout: tmpDir } = await exec('mktemp', [ '-d' ])

    try {
      process.chdir(tmpDir.trim())
-      await prefetchYarnDeps(lockContents, verbose)
+      await prefetchYarnDeps(lockContents, verbose, mirrorUrl)
      const { stdout: hash } = await exec('nix-hash', [ '--type', 'sha256', '--base32', tmpDir.trim() ])
      console.log(hash)
    } finally {
--- a/pkgs/build-support/node/fetch-yarn-deps/tests/default.nix
+++ b/pkgs/build-support/node/fetch-yarn-deps/tests/default.nix
@@ -9,6 +9,11 @@
    yarnLock = ./simple.lock;
    sha256 = "sha256-FRrt8BixleILmFB2ZV8RgPNLqgS+dlH5nWoPgeaaNQ8=";
  };
+  mirrorUrl = testers.invalidateFetcherByDrvHash fetchYarnDeps {
+    yarnLock = ./simple.lock;
+    mirrorUrl = "https://registry.npmjs.com/";
+    sha256 = "sha256-FRrt8BixleILmFB2ZV8RgPNLqgS+dlH5nWoPgeaaNQ8=";
+  };
  gitDep = testers.invalidateFetcherByDrvHash fetchYarnDeps {
    yarnLock = ./git.lock;
    sha256 = "sha256-f90IiEzHDiBdswWewRBHcJfqqpPipaMg8N0DVLq2e8Q=";
--- a/pkgs/by-name/bp/bpftrace/package.nix
+++ b/pkgs/by-name/bp/bpftrace/package.nix
@@ -23,13 +23,13 @@

 stdenv.mkDerivation rec {
  pname = "bpftrace";
-  version = "0.26.1";
+  version = "0.27.0";

  src = fetchFromGitHub {
    owner = "bpftrace";
    repo = "bpftrace";
    rev = "v${version}";
-    hash = "sha256-h3gFnQq48oM5uK07xrykOCSJxhr6dqcyVUDoIKIRREY=";
+    hash = "sha256-wYDSx2WngWS4Ucj82hLO0G46tiXhqskhMjmv7NuUVfw=";
  };

  buildInputs = with llvmPackages; [
--- a/pkgs/by-name/dd/ddccontrol-db/package.nix
+++ b/pkgs/by-name/dd/ddccontrol-db/package.nix
@@ -10,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ddccontrol-db";
-  version = "20260902";
+  version = "20260915";

  src = fetchFromGitHub {
    owner = "ddccontrol";
    repo = "ddccontrol-db";
    tag = finalAttrs.version;
-    sha256 = "sha256-Nu0SC9Qh4+wUzVCdo7m2z4pZH50FvCXehF3IiCoHXKM=";
+    sha256 = "sha256-n538zzL8lRln6eLCJDivwh90RO2RZ7lykEDLVKV3Sa0=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/de/delve/package.nix
+++ b/pkgs/by-name/de/delve/package.nix
@@ -9,13 +9,13 @@

 buildGoModule (finalAttrs: {
  pname = "delve";
-  version = "1.27.1";
+  version = "1.27.2";

  src = fetchFromGitHub {
    owner = "go-delve";
    repo = "delve";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-H91QnLyqywgoc3zdTaclzzUxVPagNnxLzKub2gnL25w=";
+    hash = "sha256-vq8RSqSoPmDT/l6izYdM0a6SVJyaIbZ8gsXbgkFPaOw=";
  };

  patches = [
--- a/pkgs/by-name/fa/fastly/package.nix
+++ b/pkgs/by-name/fa/fastly/package.nix
@@ -1,27 +1,23 @@
 {
  lib,
  stdenv,
+  buildGoModule,
  fetchFromGitHub,
  installShellFiles,
-  buildGoModule,
-  go,
  makeWrapper,
+  writableTmpDirAsHomeHook,
  viceroy,
 }:

 buildGoModule (finalAttrs: {
  pname = "fastly";
-  version = "16.0.0";
+  version = "16.1.0";

  src = fetchFromGitHub {
    owner = "fastly";
    repo = "cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-gVKlAbiznaRKwDpiyap4Q3mIhn/ZbnUIFwG3l01ZXQ8=";
-    # The git commit is part of the `fastly version` original output;
-    # leave that output the same in nixpkgs. Use the `.git` directory
-    # to retrieve the commit SHA, and remove the directory afterwards,
-    # since it is not needed after that.
+    hash = "sha256-xGp5Fa4ruHpc2YAAbrva0zurt4wxC6XRdSpMMQGEB7c=";
    leaveDotGit = true;
    postFetch = ''
      cd "$out"
@@ -30,39 +26,34 @@ buildGoModule (finalAttrs: {
    '';
  };

-  subPackages = [
-    "cmd/fastly"
-  ];
+  subPackages = [ "cmd/fastly" ];

-  vendorHash = "sha256-U2Ix8ZKGCDrWUJFFXJaL+1EBTbqblWp8slhruHhouIc=";
+  vendorHash = "sha256-JUYBaiAz91jv8QFrfjpHnY442+qK7T0VZJcC/rCGhD4=";

  nativeBuildInputs = [
    installShellFiles
    makeWrapper
+    writableTmpDirAsHomeHook
  ];

-  # Flags as provided by the build automation of the project:
-  #   https://github.com/fastly/cli/blob/7844f9f54d56f8326962112b5534e5c40e91bf09/.goreleaser.yml#L14-L18
-  ldflags = [
-    "-s"
-    "-w"
-    "-X github.com/fastly/cli/pkg/revision.AppVersion=v${finalAttrs.version}"
-    "-X github.com/fastly/cli/pkg/revision.Environment=release"
-    "-X github.com/fastly/cli/pkg/revision.GoHostOS=${go.GOHOSTOS}"
-    "-X github.com/fastly/cli/pkg/revision.GoHostArch=${go.GOHOSTARCH}"
-  ];
  preBuild = ''
-    cp ./.fastly/config.toml ./pkg/config/config.toml
    ldflags+=" -X github.com/fastly/cli/pkg/revision.GitCommit=$(cat COMMIT)"
  '';

+  ldflags = [
+    "-s"
+    "-X github.com/fastly/cli/pkg/revision.AppVersion=v${finalAttrs.version}"
+    "-X github.com/fastly/cli/pkg/revision.Environment=release"
+  ];
+
+  # must embed viceroy to prevent fetching binary release on `fastly compute serve` invocation
  preFixup = ''
-    wrapProgram $out/bin/fastly --prefix PATH : ${lib.makeBinPath [ viceroy ]} \
+    wrapProgram $out/bin/fastly \
+      --prefix PATH : ${lib.makeBinPath [ viceroy ]} \
      --set FASTLY_VICEROY_USE_PATH 1
  '';

  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-    export HOME="$(mktemp -d)"
    installShellCompletion --cmd fastly \
      --bash <($out/bin/fastly --completion-script-bash) \
      --zsh <($out/bin/fastly --completion-script-zsh)
@@ -75,6 +66,7 @@ buildGoModule (finalAttrs: {
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [
      ereslibre
+      stepbrobd
    ];
    mainProgram = "fastly";
  };
--- a/pkgs/by-name/fe/feishin/package.nix
+++ b/pkgs/by-name/fe/feishin/package.nix
@@ -8,7 +8,6 @@
  fetchPnpmDeps,
  pnpmConfigHook,
  pnpm_11,
-  nodejs-slim_latest,
  darwin,
  actool,
  copyDesktopItems,
@@ -20,18 +19,17 @@
 let
  electron = electron_43;

-  # Fix pnpm issue on darwin https://github.com/NixOS/nixpkgs/issues/525627
-  pnpm = pnpm_11.override { nodejs-slim = nodejs-slim_latest; };
+  pnpm = pnpm_11;
 in
 buildNpmPackage (finalAttrs: {
  pname = "feishin";
-  version = "1.15.1";
+  version = "1.17.0";

  src = fetchFromGitHub {
    owner = "jeffvli";
    repo = "feishin";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-2UKJBUZNUpUUZIG1JFXok7YJdzqt+Ge0ykHUm8BeNcw=";
+    hash = "sha256-1ZIw5XiN+2EhpHmdvN0HxgMSvn4QvN9B+ZJ3RlPXhLw=";
  };

  __structuredAttrs = true;
@@ -48,7 +46,7 @@ buildNpmPackage (finalAttrs: {
      src
      ;
    fetcherVersion = 4;
-    hash = "sha256-9uG0AxIBAmuIPywg3p9fFCXmRvM9zDLhWfluSLRnUXY=";
+    hash = "sha256-ltpz4e5Vv2vxt/93M4+vHUFJZjwTRwb2zrwvl1Lqjo8=";
  };

  env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
@@ -65,7 +63,7 @@ buildNpmPackage (finalAttrs: {
  postPatch = ''
    # release/app dependencies are installed on preConfigure
    substituteInPlace package.json \
-      --replace-fail '"postinstall": "electron-builder install-app-deps",' ""
+      --replace-fail '"postinstall": "install-electron && electron-builder install-app-deps",' ""
  '';

  postBuild = lib.optionalString (!webVersion) ''
--- a/pkgs/by-name/go/goss/package.nix
+++ b/pkgs/by-name/go/goss/package.nix
@@ -15,16 +15,16 @@

 buildGoModule rec {
  pname = "goss";
-  version = "0.4.9";
+  version = "0.4.10";

  src = fetchFromGitHub {
    owner = "goss-org";
    repo = "goss";
    tag = "v${version}";
-    hash = "sha256-GdkLasokpWegjK4kZzAskp1NGwcuMjrjjau75cEo8kg=";
+    hash = "sha256-4DCPPeTL2x6mMpcP/cdyQWpqehGWkk7MWM7P93WzwCA=";
  };

-  vendorHash = "sha256-Rf6Xt54y1BN2o90rDW0WvEm4H5pPfsZ786MXFjsAFaM=";
+  vendorHash = "sha256-NlOS5APp9R45QpYKwP673pmN7CR+Ufz8LxWyMkrVeq0=";

  env.CGO_ENABLED = 0;

--- a/pkgs/by-name/gp/gpu-screen-recorder-ui/package.nix
+++ b/pkgs/by-name/gp/gpu-screen-recorder-ui/package.nix
@@ -34,12 +34,12 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gpu-screen-recorder-ui";
-  version = "1.13.7";
+  version = "1.13.9";

  src = fetchgit {
    url = "https://repo.dec05eba.com/gpu-screen-recorder-ui";
    tag = finalAttrs.version;
-    hash = "sha256-liBdZDHI32ElTTsHAZekYKFgZY1eP7rz4u7tM4pkpZ4=";
+    hash = "sha256-f4jTv3IS73NWStg1af20pGKlqwIN9K9ZyLjKUX9Tp3s=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/im/immich/package.nix
+++ b/pkgs/by-name/im/immich/package.nix
@@ -109,13 +109,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "immich";
-  version = "3.2.1";
+  version = "3.2.2";

  src = fetchFromGitHub {
    owner = "immich-app";
    repo = "immich";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ufdMwERs1h+m2usMHztZicRXpI20BM+2PeOLBArXw1Y=";
+    hash = "sha256-napG+EMZbbbeq7R8FtnuDsDwdpxItkwTVWztnw07DfA=";
  };

  pnpmDeps = fetchPnpmDeps {
--- a/pkgs/by-name/it/itgmania/themes/itg3encore.nix
+++ b/pkgs/by-name/it/itgmania/themes/itg3encore.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "itg3encore";
-  version = "0-unstable-2026-08-10";
+  version = "0-unstable-2026-09-14";

  src = fetchFromGitHub {
    owner = "DarkBahamut162";
    repo = "itg3encore";
-    rev = "5427331ee20e496092680400481165c503d2123e";
-    hash = "sha256-Hvqxhpdqxo32uXkuFGUqlNk8517ughE0mGBs1L9PsHY=";
+    rev = "e5177b5829c4ef521c3552f55f9080a3561d6216";
+    hash = "sha256-cnGfEBTJYEqDNCmR8Wcbetm2qhhgMCh1LpzXBKKXdvA=";
  };

  postInstall = ''
--- a/pkgs/by-name/jo/joplin-desktop/missing-hashes.json
+++ b/pkgs/by-name/jo/joplin-desktop/missing-hashes.json
@@ -1,55 +1,55 @@
 {
-  "@esbuild/aix-ppc64@npm:0.27.2": "9c18cc2e4a03339a55013aac05b4a3fc4b77e75715dc252d034aa3d43b754abc053a7601b95e31249f4b6e69b68db2f5e6cb04b0ed619f825f2f70daff1a78d7",
+  "@esbuild/aix-ppc64@npm:0.27.5": "48203e49df4995ab8ead9e8def96381931901db904cd174e5cdc9d034f70431276e8ed93305a13c22390041e6933ec19624435f6f7c34f8a767d5979c3c6e145",
  "@esbuild/aix-ppc64@npm:0.27.7": "848d1a798fb9ea6aa902c9138aaf6b45d889df39a1ff737300ea9968af3afee1000f611bc00187f5bda096d300fb25f4f883c57a2dc7296e40295f2470aa57b3",
-  "@esbuild/android-arm64@npm:0.27.2": "a318fc9ffcdad7fda8bb521af8b17f73d93d9a94b4cca9301fbf72cf3f5a6e945edd589a47388de70f3e9582655dcf5b5bb928a11e306368fae4a9106d5143d2",
+  "@esbuild/android-arm64@npm:0.27.5": "6cfcae790d0cec7a9bd29f539d05ad5a5715815177bb62231a95c3a8b2fb651b099e3eef76c6c0f174be83864b0a1b244474c071df36c028e407c2325015fa01",
  "@esbuild/android-arm64@npm:0.27.7": "21a57ee237e1503d92c2f818c1dbf7d6f772b100fd0dfa95ea0d24be718c0c6952e915ad1f47bcc3496bb807a0a254d35d6baadc48531b684d2236f57023f1e6",
-  "@esbuild/android-arm@npm:0.27.2": "01114275e096b9177ad2496730087ee081d6e65a75bc087457b527c5baac5a8ccb362435f45232532bf6f97de95e1790dbce127d55abd5e4152c7214682bf4d3",
+  "@esbuild/android-arm@npm:0.27.5": "4f856f7e508393c7e722e444b26a60f093ed4dfd11def0cbae13034e60dca6b356c302430a9230644f4ae2fd4e5a9ae620a4b69fa98a12062190195af2e57ec1",
  "@esbuild/android-arm@npm:0.27.7": "46a246245a024680c8b5051425fc724c846b7d36ac952cd312e71194bae07fd712aa6fa8ddd7fa648a18d665eb0bcfaf111726af7b676465cb181dff7e6a0848",
-  "@esbuild/android-x64@npm:0.27.2": "e92c5b6919081a14c8882f1167cf90b4e4bba745ad6e9a23428f85a1cd5e79dfa3f1d2fc943686b237e4cd09fac52ad3b3791deab6a0419ee10859284d3834aa",
+  "@esbuild/android-x64@npm:0.27.5": "116456a795deccd12917aa61599c5f0278b2399c7c936dd92b667a53f45f695ac316c61b1b3929c1dde177cee447b2cd5c6b16283aaec1fc80d317ef414a0442",
  "@esbuild/android-x64@npm:0.27.7": "95c858fe95b716aabcb71a0dab9162d46859c0deb713189730ce6c2a2bc27efed2341b2d27aacc092dee7544df7b25035a12d65f30481b5b03a8358707e1a6f3",
-  "@esbuild/darwin-arm64@npm:0.27.2": "5e99db5037167bad4a095fc445b94a2ce02357870ed58b79e13ae6bc09b5cb33d7e03f925492df940f9e0ad685a889f02beec1431d8fbf4c7ced55b2f48f5659",
+  "@esbuild/darwin-arm64@npm:0.27.5": "09b3f3f85eb4cdc3f00582b360be6f904b27d62f390f25815e6a27843bdfd9f087372ddb0718c1010078b34e96df68d115ce562891121684dc28fedcc22cdac5",
  "@esbuild/darwin-arm64@npm:0.27.7": "281897d55b71e222394f08ee519999f673778c26ac78e4dacc67262e449b9284e852dccac8d6293fd611e0a37d0c798f2ea18c65573ed251d5e04dcb01121f0d",
-  "@esbuild/darwin-x64@npm:0.27.2": "87f2fbc4cf11724ef805b17cbdc7b0a9498332bc4b61d55e110ecc3b09bc488b88c0bd140ea48924e9c97a2063cf7e440fef13dd56e415c46799619d61086910",
+  "@esbuild/darwin-x64@npm:0.27.5": "0a81d707bbc05a2b2f6ffc3e21f1596a7346c737b13cf789b59d7e86cb4d355ee6389f7ba2965da142ff40913dce986d5f2a8dfa6c940e704a017f418d9d7384",
  "@esbuild/darwin-x64@npm:0.27.7": "a6c320cda3c7c176d678c00367823259b7efc0f8638393bd0e45b4f950af15be887558c82e2d74ed9fb492a4b04f36afc1c3a3b9774aeaaa08fbf96aac6e3524",
-  "@esbuild/freebsd-arm64@npm:0.27.2": "1ffa23243b913e377a5b09fd97ad9f089be3695aafdd893b60bb7f9be479256d8b7546f0bc96c4e61133fe7aeeaf95a8e941e82a65d99008ff82c99bdec85eee",
+  "@esbuild/freebsd-arm64@npm:0.27.5": "fc705c9f299bef59a584f78a1ac8e686b3598639d8ad565170db7704d116665bfd7b0760c2d5901e363f972133a77e92bcf3ace16726b61540582a09c82ff284",
  "@esbuild/freebsd-arm64@npm:0.27.7": "8b546929340ebb3daf5b47ca24db6d6fdcf3c14a733c41ddd8ae960834a5aa60b22b341049aef39badfdfaad0081a8706d085ba892e2b23163d1d1ff52ca1dc3",
-  "@esbuild/freebsd-x64@npm:0.27.2": "44f744b289cf9e115b0adfac1905818d756dfced14213bf144d9016d96f67575ef2a55526f76e29ee775fcfec7274ba3a5e6833f35ed79a4592d3f5eac278267",
+  "@esbuild/freebsd-x64@npm:0.27.5": "bacab4f9d3e13eb9a2b0ad1403fb0a6d66d7bdd50e9209dff5c8d0d9151ad3dd64f6a709530858f1143ab30f89d508e3f29782219a23d258e455ed2dee360136",
  "@esbuild/freebsd-x64@npm:0.27.7": "5a4c0ccbde7fe7a6de14c8789d1f20f4cadc7980e531b090b137774b56f360ba3c50f5612f01980ab9071ae50e1bb007f44c1b04b68fd84ba07113472081e021",
-  "@esbuild/linux-arm64@npm:0.27.2": "2b037d74eaff4e9b5a6076760ede873320707636a3495939687cdd0c2c7150883111273bc0a8663fa305c42f439f4748b5ad7f15a1a1ea9fa7db575d9faf2d1b",
+  "@esbuild/linux-arm64@npm:0.27.5": "4acfebf0f43e9dadb2a29cf336562e711961c23fbb6f3fec754f8a2848a0c63022b58cdc95c667fe6f5dc7cf55824cf6bcc49f96b53f29e72da0bc97102b472a",
  "@esbuild/linux-arm64@npm:0.27.7": "741871bea9ce0a136367707cc509254fef167c5bf968706de6bff7db96ee7c672f02231cb69965e17ca0aedbd99d533275f5a695a3069cb3df0a9d2cd877847f",
-  "@esbuild/linux-arm@npm:0.27.2": "28cfc3a9ca11fc899649e7a706fb4b2ee57999bd92e86c23726b3ed0f832732411dd0aa3e2bcdb4105759f83bc4e5adc98dc195aaafce736c910db4e43694702",
+  "@esbuild/linux-arm@npm:0.27.5": "107786c947b02b6e7aca4f9ff3af8c14fe461f614f9c298d63b9474703ca7798d3650d52b6041412308eef46dc7215f56b4155391f9feb5b15b64718204f0009",
  "@esbuild/linux-arm@npm:0.27.7": "c2ee4ae5f6e13f8e882da4a369cc5d672ae8bf7613e35e22b54df3999e0d5aaef6d704c7dcbc473708eaeee202dd8e892c37e791bbc50a509b23ae845d18b689",
-  "@esbuild/linux-ia32@npm:0.27.2": "ac6cc92b9be2ec6d9d483c53fc973e6381765b784a2e1b71fa93ea0cf976344c2e3e0bfda0140b0829b3ec4304d9b886692b2891e68c17d2121066d06e67f0ac",
+  "@esbuild/linux-ia32@npm:0.27.5": "51c5322b4a834c3c8bc66d9503a8e2dfda4090aed848a533718773cece1b3a92fc10ab532bba81af1ce7eb7b3c244ef6aed2b59d480f32cf987d222e7c05950a",
  "@esbuild/linux-ia32@npm:0.27.7": "0933a68b0bdee3dd0fcd99da92c0472deb6d6225c454b88a3609e1b1ea7648b36f6b83be8a8cf41edc1f0d666b76006e270a66c7520050d278d7d73df171e86b",
-  "@esbuild/linux-loong64@npm:0.27.2": "625f5b6c2218a3acb2cff8f7f02a53ca89d13925f8932260ddad01595c6907beda4a79e4b767b1101f5971049f88d3ec6ab29cf565b4d61d9b0d7277e2cb578d",
+  "@esbuild/linux-loong64@npm:0.27.5": "92a0c8bfdf3214a485161184669adaa7dbd1d08fafb3bba50fd6dbd88b9a2e9c12705056e243e96a4eca3e8f0cdd65e5271261cb7f51429fd77d5dbc9fe49cbc",
  "@esbuild/linux-loong64@npm:0.27.7": "9609e94b603a8a68bcd60325626d0bd35cce37e75994729d4ea264fa865db201da64c3216004656d94b1edeb8587150b1c47a1eef8ee1af9dc0d3cd6baa5ab2a",
-  "@esbuild/linux-mips64el@npm:0.27.2": "0c62692cb3a297b37212dfde52a861861843a716f6b3bdb73da49ba249a4c001b989ea61dc4540c430fac59ce2f8fc45035cdfac80172c5ddaf1b9df8471aecf",
+  "@esbuild/linux-mips64el@npm:0.27.5": "57326d2100e7a1be73c63a2827b981c926489fb86ce0482030b8a9049fc8086a8a229b98d83d34b4a9e459756e38ac9d453c2facd0e706b83dd8a08105a77445",
  "@esbuild/linux-mips64el@npm:0.27.7": "74ac0fe0b857b926af9057d5fa9634fc4b0b61a6fcd9c13cc2917e0e66638e2f724b8fd82024f97d524ff54ae17d0a52a0569078639aa9907f5287514aa046b1",
-  "@esbuild/linux-ppc64@npm:0.27.2": "b804d2dd0a6a85fe1c731828c725731a55ab120d2cc16941d560b2e9af5c2ec51586914ce26a84a326a9d46fa61eb8bb1f843953fe29ddd43b3f3099c491b5ff",
+  "@esbuild/linux-ppc64@npm:0.27.5": "d2e2b8b14ef6443ed23354ed45eaa0c176cddea25a4d84ac2a6dc76d7ce48de7928daecc3535f5cf4670b1ffbc562c43255e919ecc3f7c8c26f43b9b9d60e534",
  "@esbuild/linux-ppc64@npm:0.27.7": "7d75e59ad798631b7b7f77471fc9f545e0e6d2959a52d57b77e92d4aba81c5c57dea558d22539edc6aca92ac72112f93381e163b996df193cb5c9a1da4b4230d",
-  "@esbuild/linux-riscv64@npm:0.27.2": "03e67e7207a83801363e3637f9a35fb6224ed4dc23bbf6eca41904fc42f5a6806e1e591666bf48dbf62eba97d41ff4355413b14dcb2339007b22c693374c49f6",
+  "@esbuild/linux-riscv64@npm:0.27.5": "a943c97a6d031041cad40196be6f8112dbd7a642411bf7b24942de95f4c2caae31ca11b3e4724f1898f2b9f2e5a5c106636eea50eddc7db7cfbec8f443560798",
  "@esbuild/linux-riscv64@npm:0.27.7": "6dca2a182f59d43057ef40b93788dfb265c3b9fff4738aa613d87c7c709d9c308f18c282b7cfc2a1c770fa4db78d3529dc50b8a9f30e415661d993b021b2cdcb",
-  "@esbuild/linux-s390x@npm:0.27.2": "eb24b9c0a4a1492e4ff34a87933f6a3b348739c12f864b408144efdf949871c1fbb02a1cca741bfa11fd08aebe585d046fd3311b462ce4c795e3064ba3912469",
+  "@esbuild/linux-s390x@npm:0.27.5": "068865bc73484b97f1bcce6eca0195b30e8ce03dafdc6da7283b289023728f1cc7d0cbf5387fa6b89b072ddf8f9776b8cceb2981d2ebe3f2ea5e84ae8a77c448",
  "@esbuild/linux-s390x@npm:0.27.7": "870de4b9ff155cf5cf2ccd7b3587a6b4170550a31b621ea11dc134cd48af95f4a30f4ce868d249967eade6b3dd66e7a0af0d542c6fbba0dbc473fd0f5d3299b0",
-  "@esbuild/linux-x64@npm:0.27.2": "ed1542f203329521fb1f308696c76ba59ed4a4616a24e21bf4820685362bba209d5c44c2f4e66c88dc7b7399df9ace625454d4829ee529d076ccaf61566e11cf",
+  "@esbuild/linux-x64@npm:0.27.5": "6eb9d11d25e632607370d30d8fbc40c4357f6be293aeb33e6cd3fe73c18203b37f24b6e52d0939a499839fddcf9920b16862a3b923e425b99bacf9b80e787c5e",
  "@esbuild/linux-x64@npm:0.27.7": "47fce66247eda2d4721c1e615f7169eb7bf6e4b6105eab7271391ce933e7d350d3d4a581b3b8a61573f70b6663268eb514e624875dc514dc56dec3a37cf7cbe3",
-  "@esbuild/netbsd-arm64@npm:0.27.2": "576dd082047077b9cc41fbeffd728821a4f3b80969c1d2d6c274301122c6de2050f484fd4e946777527b8a15bd2a5ac54f85ca7ab95ea72b5345177e6a888687",
+  "@esbuild/netbsd-arm64@npm:0.27.5": "d43426863ae1f6bd37478a30c84bdabbbafda3b2ab537a6f5051006ba13231e6842ba49a3f61a2dd30736048369660e134f028c6b2bef156c81a78dadeaf280e",
  "@esbuild/netbsd-arm64@npm:0.27.7": "bbe0d0529fb73fd38c2cf9ebc1d1dcd5a2586b263cc4f6300d37008955f45310e842d63153e361a4447d4ca0f0a0691d62013fe60b09e4e0cd53f428ef2266f3",
-  "@esbuild/netbsd-x64@npm:0.27.2": "f8994af3e2ff3c9a91e874e58698b66e6f8d4e72dbc0aaf749b74a79420954146ed053359b0a4c213918582cee187d8a371737a33cfb93e624b4d091e5a6c240",
+  "@esbuild/netbsd-x64@npm:0.27.5": "b54f975bfc05f44a21884022a87367ceec3775cfc81d155bb2183ac5b9f51397589e10654eecc87ff9adee749a574e4ff724cb064907b2328e39ddb390760707",
  "@esbuild/netbsd-x64@npm:0.27.7": "246ed4df55788aacd2d9146f51ea7fcf4715e73d32ca1b0fcb42c316fdbf21d8de03bb304205dc707942442899529e834466894faa0aa3fa40454f5622648fc6",
-  "@esbuild/openbsd-arm64@npm:0.27.2": "f710da24beeb747ef3a11b9d99085a14f5c929f942fd9d9a05b7806d5ff1b85631bfa506eb7a6aed9fd01ec99bf91f24736f9f0e0eb6b7c0019fe0dddd2e615c",
+  "@esbuild/openbsd-arm64@npm:0.27.5": "dce25568a9642e9cacc9d4ae5a8c07dcb5bd2c7aee5f31259334074d30a380cdec2b3654b15978f3b64965d7622bda51dd203ab774f9a499e3b55425eaf926e3",
  "@esbuild/openbsd-arm64@npm:0.27.7": "d99927053a0f8be5158da8ecde7e8a08dd0ea580ca93f006971730979681e3738f83ada4d6564a57cdd6f412e40e5a750a92f424807aa12f97c2ead52617ad41",
-  "@esbuild/openbsd-x64@npm:0.27.2": "62670fbe1f609c5362df7b45968ded512a0860e2ad8a4715a89993abfa2f9f08a28f1294c7857d80e6d3f713639a71d291c06a961b331de67ad350032d1b8e96",
+  "@esbuild/openbsd-x64@npm:0.27.5": "fa51a43619b0da031f3b2eb6ece65d9cd6a69b9e3f03693463ed9878b04764478990dd3047591b6e2880375ada9eca8db20aca0df238afee1ad3b664f7adec65",
  "@esbuild/openbsd-x64@npm:0.27.7": "1480ff755c727d056e5f37e1d2be83d36b137c9f3595911aaf1659160c2cbfea846bded0557017aaefd79a0322be5e381b168ebff3eec4af684198835504b051",
-  "@esbuild/openharmony-arm64@npm:0.27.2": "e279efdc18301add96ea791ba9ef117cae05346688cd521fd225a60ad166add4bc995af985058e3b6ab9e65a7c49a79108a294d6aa26a1d1685ad0db194e2c56",
+  "@esbuild/openharmony-arm64@npm:0.27.5": "4c6ccc2c466158bb635918ecf530c14cbe536c2afeaa3e8e0c8b61f80875134573705b96a1854b07238df5b0e0eb1ad26b424d7a4b56b73b8813fdaec553e1a0",
  "@esbuild/openharmony-arm64@npm:0.27.7": "6aa1fd102bdfa99b3c27f558f6b5d493b47f34260cc10967c47d44b86018a307377e0c70ef51b8886c592f2a0057710a8ad7781716b0eb059d0b0657b4f7ddec",
-  "@esbuild/sunos-x64@npm:0.27.2": "7234302321d36576b5a9f027915417cddc195a67b19cdfb50e69c337ee0dd63a88be6b72d7ef299cd569d1af62e54774303d52d3d6b5e5858db975241ae467d6",
+  "@esbuild/sunos-x64@npm:0.27.5": "e53d864a1e9f0b598461df53163dd837f1bbaba2f3590934b34bae132efb2c658d6f9b036d4e9a6f2b8327cb9b3ab99d7a8244009a856dd1063868d6989d204d",
  "@esbuild/sunos-x64@npm:0.27.7": "66bff01f90a97b989c6e6fbe6f8df77a0e5b40b57b8c4d8e6c407635546eb05553de570cd4e0d4624a5a6be8a61d7e9c6e7d8bc238f8f5773a4231361c0e8745",
-  "@esbuild/win32-arm64@npm:0.27.2": "36620fddf79da3e8e527ef8331436929fa7a0b23c9b591af8f8573d80ed9c4ef45b24c6fa0abbb01d187dec497efa6c9d9d397d575afc1f28477e9ca16a48d73",
+  "@esbuild/win32-arm64@npm:0.27.5": "cff774ddb4107461f5e48da9664a1813ad6234921cb51739a3915d2822e6429276f40f0edadb52f816a63143ded7e77b84b38416f1c98e7b80a8c8a6ae031363",
  "@esbuild/win32-arm64@npm:0.27.7": "eb7008345c82bbd4be30bb27ae4e17346cb5014801e9d50058984e7c5e4cb509d6eae82db3c04aab16b72d3829908b32151117222c107962fe3fb0e317e55951",
-  "@esbuild/win32-ia32@npm:0.27.2": "96e8c1fa0ec2b5529ead2ba703e5da7644c138b2f9b6e285c05513f0455e99b2b0dcf399f01779fb384e22810e82f892491e44402772c62d3fe094b025bbdc0f",
+  "@esbuild/win32-ia32@npm:0.27.5": "ae399419b6457492c53f2829f135285e87ca3bfde1bd11f780baa890b881b96659b0c7344d7e86c9e417531190e19f38a91f47ee1b238be5b5ce794957eac4b8",
  "@esbuild/win32-ia32@npm:0.27.7": "b6a44b5b6bf670cbe86de063335f03faa308d5b3eabbca1f5078bba9674ea42d3d6ad9fb9601fb0c7abba65d4b4a467f20473aedb856c9544c20166c75538029",
-  "@esbuild/win32-x64@npm:0.27.2": "1ed08bebd916c16003f3784276ae683ab41d34951a0c272f6e072b8067a2b4bacd6f6f75a8dcea375b8545e15891d305425cf7c8dd31f7deab56ef22cde4a1e2",
+  "@esbuild/win32-x64@npm:0.27.5": "37a9f52ea621a0366ca72c4fca89e9a5e2734dbadeb46eaff89d1d81f09147db4ac4afd7905b5d8fde8e99bb4b28db52ec27b043d355711d97080b34393d75f8",
  "@esbuild/win32-x64@npm:0.27.7": "4b91237b01e7e1a5083d2df524bb2ddb13da334197681fd33ad05975c073ccc901ea6b9395453276557608e5858cc032ed12807cc156c29f4ce7d2c63e04d5a0",
  "@img/sharp-darwin-arm64@npm:0.34.3": "952e9e9c34291502e7c21258d2874539a3953a5da8df52c8e2c459f673a76179eddd48c3b7563773db7bb36b2b241d781b98a667fac4b30c1f49c1cc9fdf9b7f",
  "@img/sharp-darwin-arm64@npm:0.34.5": "0f872f02a49c87c1c844c9715a1c1e4449fab30c85711d948767d41ea1eba1cc7be8268b582d95513e66cff090ab520e4104dcf30cc6f598ee429b40e890eeec",
@@ -122,8 +122,6 @@
  "@rollup/rollup-win32-arm64-msvc@npm:4.2.0": "ff71a301051b237a32e14cb2b18117c72c5ab4524120184500e098fea028385806567fa55e4879c19f80d747774e3b8d913e0b4560abc8fe4881b392fda6ed79",
  "@rollup/rollup-win32-ia32-msvc@npm:4.2.0": "dd65d454384b6020b87f5f943121dd9d02e5bfbae2ec124a23f0a2034df02549c0ae4fb27558efda6668bab94b121c5463c4845431f2c1c9416a719176e1dd82",
  "@rollup/rollup-win32-x64-msvc@npm:4.2.0": "13cba2a14f7864986f3331c327a137ad95cf366411c0b6d3f66593bb6ea04d0058e12bd0a09fde72bbfb8660a554f0b66d90754e21add3c99d899e2bd7dfe1d1",
-  "dmg-license@npm:1.0.11": "36c0a7b030801b91216affa9b2bb00caa345b2327f298accb2263a80a0320ca305f90b99da68007d187c830c543410d58a0a2bbc229e8d169b0e1d1652ff42aa",
-  "iconv-corefoundation@npm:1.1.7": "0189733ef51a9f481379202cb1919f2677efc44aa014ba662a6fd99e47993e350eab0ff724ed18cda8011c9b78c4702b2d374f732955f1def3fd2a14a29d25c0",
  "lightningcss-android-arm64@npm:1.30.2": "823d5aa547e473e18832b47b575313dcfd9146697d53481c79b10dbbe45c62a7352f4da77f836b0c0e6a233545bb3456bece543f39e7d8ee6ef75b4d345af2fd",
  "lightningcss-darwin-arm64@npm:1.30.2": "23fd135ab0a081aec174a835b15218c5ad9ed4486823a1b8ddd8ca1795876e032201385cf6e3acd548a235d5f527e19ad213ca1c5fa0ef31d333d43d4f67fee8",
  "lightningcss-darwin-x64@npm:1.30.2": "4151c2744332798bcc83dea10c8da81a18c7dbc2d12c53a95149d7a5d24409b32f80eb42dd5933f109fe4c5715e25cfe6df3d21158191fdd682a99cc62f28b93",
@@ -134,5 +132,10 @@
  "lightningcss-linux-x64-gnu@npm:1.30.2": "bc4959398f65fc60df2a2a011c2381029d9f92ed7a2a1930393bbef5515d3f18bd2885a4063f48031435595c22ddd10923c5e2ecbf53d086b18a3b65e10cfd47",
  "lightningcss-linux-x64-musl@npm:1.30.2": "2db0a94df42f23a051bac68ad0d4322f45bc0f47290810cbb012fc2292c42201ff1eae5ec0f83178da6f232ab4cc24a2fcaaf46b0867861966d9823610e352ac",
  "lightningcss-win32-arm64-msvc@npm:1.30.2": "307a014ddc51c6773be0b63db3ce3a09ff32c9093bd2e365689de0a07a45288a310154397f5dd6dfd6a5de726ebd4dec597482dd1bd4bfeeb65f5bff09d52ea0",
-  "lightningcss-win32-x64-msvc@npm:1.30.2": "4c1b0406dad571a9754bf45becfd38af9d43eee94c93d8df881f862bc2597f72dc91dec0788aa67261cca79732c75afcd777e8786984a9e98d0d1fb66ced1a05"
+  "lightningcss-win32-x64-msvc@npm:1.30.2": "4c1b0406dad571a9754bf45becfd38af9d43eee94c93d8df881f862bc2597f72dc91dec0788aa67261cca79732c75afcd777e8786984a9e98d0d1fb66ced1a05",
+  "sqlite-vec-darwin-arm64@npm:0.1.9": "e1ad40eda22dd3a601565a1fcbc4d36e83560d4670dbef59639010a89fd3612697d2d5e2221d28a5044a6c461352ad83cc0595bb7e2b42594b9e76860f8a8291",
+  "sqlite-vec-darwin-x64@npm:0.1.9": "71760fc97b4d1d15f503a378abfa4ad390192f5fd1009161261339f6a377a9f47f857ae2ee993e5b7e8ab1e49f168fd86976f23b4cf4da9a7ea9850709dd51ec",
+  "sqlite-vec-linux-arm64@npm:0.1.9": "45b7e0ae0dc42acafc8e24b1f9f85b107b418cb7bc20a4f28ccb4abdacc45763fb417dd18c615c8aa76328da3b6bdd1d9e130baa97b446d62cf736da2ffa6010",
+  "sqlite-vec-linux-x64@npm:0.1.9": "6608e83f4d0a838fa20589d055c00e67f4aa0f086212922efd0e1f64571d1e3f3014a765327f722ee11b2dbdcd618a7932e06fcdd5ebf15c57b8e157d95585c8",
+  "sqlite-vec-windows-x64@npm:0.1.9": "8e2751b45cb93d8f896bf6e02b5676f75d7a68fdc199564401bd46ec2ddb81cce13f3ef96cfac15e14e5033eb96c322cb1fe21952b83aeb2abb54b769e43a426"
 }
--- a/pkgs/by-name/jo/joplin-desktop/package.nix
+++ b/pkgs/by-name/jo/joplin-desktop/package.nix
@@ -44,10 +44,6 @@ stdenv.mkDerivation (finalAttrs: {
    postFetch = ''
      # there's a file with a weird name that causes a hash mismatch on darwin
      rm $out/packages/app-cli/tests/support/photo*
-
-      # Remove after upstream updates to Yarn 4.14
-      # https://github.com/laurent22/joplin/blob/dev/package.json#L103
-      sed -i '/__metadata/{n;s/version: 8$/version: 9/;}' $out/yarn.lock
    '';
    inherit (releaseData) hash;
  };
@@ -105,9 +101,15 @@ stdenv.mkDerivation (finalAttrs: {
    # before we can patchShebangs additional paths (see buildPhase).
    # https://github.com/NixOS/nixpkgs/blob/3cd051861c41df675cee20153bfd7befee120a98/pkgs/by-name/ya/yarn-berry/fetcher/yarn-berry-config-hook.sh#L83
    YARN_ENABLE_SCRIPTS = 0;
+
+    # Use nixpkgs' patched offline Yarn instead of Joplin's vendored Yarn.
+    YARN_IGNORE_PATH = 1;
  };

  postPatch = ''
+    # Nixpkgs provides Electron; don't run Joplin's networked Electron installer.
+    sed -i "/^[[:space:]]*'installElectron',$/d" packages/app-desktop/gulpfile.ts
+
    # Don't automatically build everything
    sed -i '/postinstall/d' package.json
    # Don't install onenote-converter subpackage deps
--- a/pkgs/by-name/jo/joplin-desktop/release-data.json
+++ b/pkgs/by-name/jo/joplin-desktop/release-data.json
@@ -1,6 +1,6 @@
 {
-  "version": "3.6.16",
-  "hash": "sha256-0W6xNcEMXIs8XsoY6NqSud9D5fEmc5GKFC8Uo6CEtec=",
+  "version": "3.7.18",
+  "hash": "sha256-12ZRoEutQsNJlrPypNrsffeIj+2ekqB/s6HN9ks/+rU=",
  "plugins": {
    "io.github.jackgruber.backup": {
      "name": "joplin-plugin-backup",
@@ -9,5 +9,5 @@
      "npmDepsHash": "sha256-xZJ0Oir1A6sLe0ztIyBu39Yy3D6sNrVaciOYG0k85l0="
    }
  },
-  "deps_hash": "sha256-ejg0u9Dy3iaBusH248IbtJNpvd/zADyPJ9CplIK1A/w="
+  "deps_hash": "sha256-W5hXh1i1rTe4OkhTvHPpDQgPSvRqTZ/GsJnHXE2D/2Y="
 }
--- a/pkgs/by-name/li/libcs50/package.nix
+++ b/pkgs/by-name/li/libcs50/package.nix
@@ -7,13 +7,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libcs50";
-  version = "11.0.3";
+  version = "11.0.4";

  src = fetchFromGitHub {
    owner = "cs50";
    repo = "libcs50";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-G6QayPGR4lkeFuUYsFszekLAzzpA3hhIRmqt/OB0cdY=";
+    hash = "sha256-guITfJoNEiQAjfKiDKltWoP8VcLsyeEuzU4odhpwyUI=";
  };

  installPhase = ''
--- a/pkgs/by-name/li/libigl/package.nix
+++ b/pkgs/by-name/li/libigl/package.nix
@@ -6,13 +6,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "libigl";
-  version = "2.6.3";
+  version = "2.6.4";

  src = fetchFromGitHub {
    owner = "libigl";
    repo = "libigl";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-uef7aTF2U3iPVAWDGRIsH0YV0l/w8VxtYFPYVkuC1dI=";
+    hash = "sha256-/+wE3ZgqHWdLMaZZE/j7unrx10nd6sh9+JF5P0HB8i4=";
  };

  # We could also properly use CMake, but we would have to heavily patch it
--- a/pkgs/by-name/li/libmirage/package.nix
+++ b/pkgs/by-name/li/libmirage/package.nix
@@ -27,11 +27,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libmirage";
-  version = "3.3.2";
+  version = "3.3.3";

  src = fetchurl {
    url = "mirror://sourceforge/cdemu/libmirage-${finalAttrs.version}.tar.xz";
-    hash = "sha256-wMAzJpEue1QnDllWheFk3ZX+8pSkYw13s+GU0G/AOfs=";
+    hash = "sha256-tICwgjCyJVr0DDrIY0TAx3/JloZgFOBaadVVTpA11ls=";
  };

  env = {
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -48,8 +48,8 @@
 let
  # Upstream reads these from git, which the release tarball does not ship.
  # They are purely informational: `llama-server --version`, `/props`, and the web UI.
-  buildNumber = "10809";
-  buildCommit = "5266f24";
+  buildNumber = "10964";
+  buildCommit = "b29c606";

  # It's necessary to consistently use backendStdenv when building with CUDA support,
  # otherwise we get libstdc++ errors downstream.
@@ -87,7 +87,7 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
  pname = "llama-cpp";
-  version = "0.4.0";
+  version = "0.4.1";

  __structuredAttrs = true;
  strictDeps = true;
@@ -101,7 +101,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
    owner = "ggml-org";
    repo = "llama.cpp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-WImZjO3U9EXZUNP/FMpxo8PaTjQW8X2SBTfGwwFlZIM=";
+    hash = "sha256-qu/K1RdJMzOxWr+qnHorpMB4650uctBHW/Og+4oDVLM=";
  };

  patches = [ ];
--- a/pkgs/by-name/me/meilisearch/package.nix
+++ b/pkgs/by-name/me/meilisearch/package.nix
@@ -8,18 +8,18 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "meilisearch";
-  version = "1.53.1";
+  version = "1.53.2";

  src = fetchFromGitHub {
    owner = "meilisearch";
    repo = "meilisearch";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-MQ3W8Y4ewJZA+ciBGKjGuV90ae4RaMJS+PIjCGGOV7A=";
+    hash = "sha256-bbVuB8brplUAqKrmTBah4HKbmshv0n5Hn2v9hUnY62c=";
  };

  cargoBuildFlags = [ "--package=meilisearch" ];

-  cargoHash = "sha256-Rovn1xw3Bg7J+FeIMHQP2BW5IpDyCORud8VXIU8UpqI=";
+  cargoHash = "sha256-ojRJPL3EHyGmWHcX5SLv11fkP1pUNKrYkd82GEC4zKE=";

  # Default features include mini dashboard which downloads something from the internet.
  buildNoDefaultFeatures = true;
--- a/pkgs/by-name/mp/mpd-mpris/package.nix
+++ b/pkgs/by-name/mp/mpd-mpris/package.nix
@@ -2,31 +2,23 @@
  lib,
  buildGoModule,
  fetchFromGitHub,
-  fetchpatch,
 }:

 buildGoModule (finalAttrs: {
  pname = "mpd-mpris";
-  version = "0.4.3";
+  version = "0.4.4";

  src = fetchFromGitHub {
    owner = "natsukagami";
    repo = "mpd-mpris";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-w8OH34JW++OYLpNIHfQvc45dFyU/wVWVa+vEwWb8VqU=";
+    hash = "sha256-EOZiOFBe5j1WsrJLj8++QsgNUZR44M6ae40KKl2Qac8=";
  };

  vendorHash = "sha256-ugJEw02jSsfObljDaup31zoQlf2HvwDRUljD7lp7Ys4=";

  subPackages = [ "cmd/mpd-mpris" ];

-  patches = [
-    (fetchpatch {
-      url = "https://github.com/natsukagami/mpd-mpris/commit/1591f15548aed0f9741d723f24fb505cb24fafe8.patch";
-      hash = "sha256-6ZqR4woKiIjwLxyafmidTM8eBXtvBzKNXZvtS1+KKKI=";
-    })
-  ];
-
  postPatch = ''
    substituteInPlace services/mpd-mpris.service --replace-fail "ExecStart=" "ExecStart=$out/bin/"
  '';
--- a/pkgs/by-name/mu/munge/package.nix
+++ b/pkgs/by-name/mu/munge/package.nix
@@ -3,7 +3,7 @@
  stdenv,
  fetchFromGitHub,
  autoreconfHook,
-  libgcrypt,
+  openssl,
  zlib,
  bzip2,
  nixosTests,
@@ -28,11 +28,10 @@ stdenv.mkDerivation (finalAttrs: {

  nativeBuildInputs = [
    autoreconfHook
-    libgcrypt # provides libgcrypt.m4
  ];

  buildInputs = [
-    libgcrypt
+    openssl
    zlib
    bzip2
  ];
@@ -50,8 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
    "--with-pkgconfigdir=${placeholder "out"}/lib/pkgconfig"
    "--with-systemdunitdir=${placeholder "out"}/lib/systemd/system"

-    # Cross-compilation hacks
-    "--with-libgcrypt-prefix=${lib.getDev libgcrypt}"
+    "--with-crypto-lib=openssl"
    # workaround for cross compilation: https://github.com/dun/munge/issues/103
    "ac_cv_file__dev_spx=no"
    "x_ac_cv_check_fifo_recvfd=no"
--- a/pkgs/by-name/ne/neowall/package.nix
+++ b/pkgs/by-name/ne/neowall/package.nix
@@ -18,13 +18,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "neowall";
-  version = "0.6.1";
+  version = "0.7.1";

  src = fetchFromGitHub {
    owner = "1ay1";
    repo = "neowall";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-JzLp6/mJrYRq28XAIccsOxrG/RTDfWIojmmp1oQmiwI=";
+    hash = "sha256-yxEC5PlTRg4U7M8I7/2jL48Qw/CX3F2phz6zxL6xfYU=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ne/networkmanager/package.nix
+++ b/pkgs/by-name/ne/networkmanager/package.nix
@@ -48,7 +48,6 @@
  ethtool,
  iptables,
  kmod,
-  libgcrypt,
  libndp,
  modemmanager,
  mobile-broadband-provider-info,
@@ -231,7 +230,6 @@ stdenv.mkDerivation (finalAttrs: {

  propagatedBuildInputs = [
    gnutls
-    libgcrypt
  ];

  nativeInstallCheckInputs = [ udevCheckHook ];
--- a/pkgs/by-name/pl/playwright-mcp/package.nix
+++ b/pkgs/by-name/pl/playwright-mcp/package.nix
@@ -9,16 +9,16 @@
 buildNpmPackage rec {
  pname = "playwright-mcp";
  # nixpkgs-update: no auto update
-  version = "0.0.78";
+  version = "0.0.80";

  src = fetchFromGitHub {
    owner = "Microsoft";
    repo = "playwright-mcp";
    tag = "v${version}";
-    hash = "sha256-k5dhHABKZqph3RzFcJjD+/RcMB+lZZ0UiS6eNGyAEtE=";
+    hash = "sha256-pIePGuIxBaHqvP6QVLzGSef0uarYE+X/rs3LWZEU22U=";
  };

-  npmDepsHash = "sha256-Oe0jtvxKyQMQ6uSwBQoGisvv4n0lR6EcyElzh9GHZac=";
+  npmDepsHash = "sha256-3T4XNZSUL5sbcHmWfn9Dfigu635FACVEZ/EHSKYu1+8=";

  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/by-name/pl/plezy/aarch64-linux.patch
+++ b/pkgs/by-name/pl/plezy/aarch64-linux.patch
@@ -1,35 +1,17 @@
 diff --git a/lib/theme/mono_theme.dart b/lib/theme/mono_theme.dart
-index 5b87737c..3873fe84 100644
+index f750336..7790e50 100644
 --- a/lib/theme/mono_theme.dart
 +++ b/lib/theme/mono_theme.dart
-@@ -61,7 +61,7 @@ ThemeData _buildMonoTheme({required bool dark, required bool oled, required Targ
- 
-   final base = ThemeData(
-     platform: platform,
-    useMaterial3: true,
-+    useMaterial3: true, fontFamily: 'NotoSans',
-     brightness: isDark ? Brightness.dark : Brightness.light,
-     colorScheme: ColorScheme(
-       brightness: isDark ? Brightness.dark : Brightness.light,
-@@ -108,7 +108,7 @@ ThemeData _buildMonoTheme({required bool dark, required bool oled, required Targ
+@@ -112,7 +112,11 @@ ThemeData _buildMonoTheme({required bool dark, required bool oled, required Targ
       titleTextStyle: TextStyle(color: c.text, fontSize: 18, fontWeight: .w700, letterSpacing: -0.2),
     ),
     textTheme: Typography.englishLike2021
 -        .apply(bodyColor: c.text, displayColor: c.text)
-+        .apply(fontFamily: 'NotoSans', bodyColor: c.text, displayColor: c.text)
+        .apply(
+          fontFamilyFallback: const ['Go Noto Current', 'Go Noto Current Hangul'],
+          bodyColor: c.text,
+          displayColor: c.text,
+        )
         .copyWith(
           displayLarge: const TextStyle(fontWeight: .w700, letterSpacing: -0.5),
           titleMedium: const TextStyle(fontWeight: .w600),
-diff --git a/pubspec.yaml b/pubspec.yaml
-index 68f20256..419cc1d6 100644
--- a/pubspec.yaml
-+++ b/pubspec.yaml
-@@ -152,3 +152,8 @@ flutter:
-     - assets/shaders/anime4k/
-     - assets/player_icons/
-     - assets/rating_icons/
-+
-+  fonts:
-+    - family: NotoSans
-+      fonts:
-+        - asset: assets/fonts/NotoSans.ttc
--- a/pkgs/by-name/pl/plezy/git-hashes.json
+++ b/pkgs/by-name/pl/plezy/git-hashes.json
@@ -3,7 +3,7 @@
  "auto_updater_macos": "sha256-787cMkeT2BlfwVcy4y46XkWioNqLKJgQ/CCxQvERa+A=",
  "auto_updater_platform_interface": "sha256-787cMkeT2BlfwVcy4y46XkWioNqLKJgQ/CCxQvERa+A=",
  "auto_updater_windows": "sha256-787cMkeT2BlfwVcy4y46XkWioNqLKJgQ/CCxQvERa+A=",
-  "background_downloader": "sha256-x1Z+Nlyvy+cc1EdRUikqZMDjVKdGHe7FOH2Yx9K0zhE=",
+  "background_downloader": "sha256-ebNPYQVvMHX0lExBt3V+9k8cVtGFTSNPG457GH/+iVo=",
  "connectivity_plus": "sha256-sVUG5/6GF0Eu47BgUCkgbGi8w1ip5o0yQS00NnNjAGs=",
  "os_media_controls": "sha256-cNNTqIVJy9Yo7IrBAbIQFngOCT6ccWnOHVti7B/5jsQ="
 }
--- a/pkgs/by-name/pl/plezy/package.nix
+++ b/pkgs/by-name/pl/plezy/package.nix
@@ -2,7 +2,7 @@
  lib,
  stdenv,
  stdenvNoCC,
-  flutter344,
+  flutter347,
  fetchFromGitHub,
  fetchurl,
  pkg-config,
@@ -21,17 +21,16 @@
  _7zz,
  makeBinaryWrapper,
  runCommand,
-  noto-fonts-cjk-sans ? null,
 }:
 let
  pname = "plezy";
-  version = "2.19.1";
+  version = "2.20.0";

  src = fetchFromGitHub {
    owner = "edde746";
    repo = "plezy";
    tag = version;
-    hash = "sha256-vafKdaMUR6O3QzsPbMc/cW4cPmKxe9nDEe7bfIvfVFA=";
+    hash = "sha256-q0oGOAHco7wWS8P2sUdplZS/Rvlh4a1/MVfRbrETQ/0=";
  };

  simdutf = fetchurl {
@@ -48,6 +47,7 @@ let
  meta = {
    description = "Modern cross-platform Emby, Plex & Jellyfin client built with Flutter";
    homepage = "https://github.com/edde746/plezy";
+    changelog = "https://github.com/edde746/plezy/releases/tag/${version}";
    mainProgram = "plezy";
    license = lib.licenses.gpl3Only;
    maintainers = with lib.maintainers; [
@@ -63,7 +63,7 @@ let
    );
  };

-  linux = flutter344.buildFlutterApplication rec {
+  linux = flutter347.buildFlutterApplication rec {
    inherit pname version src;

    pubspecLock = lib.importJSON ./pubspec.lock.json;
@@ -101,11 +101,6 @@ let
      substituteInPlace linux/CMakeLists.txt \
        --replace-fail "URL https://github.com/simdutf/simdutf/releases/download/v6.4.2/singleheader.zip" \
                       "URL file://${simdutf}"
-    ''
-    + lib.optionalString (stdenv.hostPlatform.system == "aarch64-linux") ''
-      # Opt-in workaround for invisible text on aarch64-linux systems. Text was invisible; bundling the font as a Dart asset fixed it,
-      # unknown why.
-      install -Dm644 ${noto-fonts-cjk-sans}/share/fonts/opentype/noto-cjk/NotoSansCJK-VF.otf.ttc assets/fonts/NotoSans.ttc
    '';

    desktopItems = [
@@ -143,7 +138,7 @@ let

    src = fetchurl {
      url = "https://github.com/edde746/plezy/releases/download/${version}/plezy-macos.dmg";
-      hash = "sha256-fT/9DvzPTbX68GPo7MA+iX7jDQjp+jsAfRJ8Y8vxh+I=";
+      hash = "sha256-cQ5lGdhnWnfVUI6fqx8pk5zgdaQrZbZxD5mSwVpTbmM=";
    };

    nativeBuildInputs = [
--- a/pkgs/by-name/pl/plezy/pubspec.lock.json
+++ b/pkgs/by-name/pl/plezy/pubspec.lock.json
@@ -50,6 +50,16 @@
      "source": "hosted",
      "version": "2.0.3"
    },
+    "archive": {
+      "dependency": "direct dev",
+      "description": {
+        "name": "archive",
+        "sha256": "ace891da0862b0e4cabbb064ee3fd87b2728b898949fdb366d83fe98342c9f19",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "4.2.0"
+    },
    "args": {
      "dependency": "transitive",
      "description": {
@@ -118,8 +128,8 @@
      "dependency": "direct main",
      "description": {
        "path": ".",
-        "ref": "12ef3ff758709e3ceab8eccd6d43e0dea1c68ca1",
-        "resolved-ref": "12ef3ff758709e3ceab8eccd6d43e0dea1c68ca1",
+        "ref": "c52103f4a2d683c22ce3b8b8661da610644bfef1",
+        "resolved-ref": "c52103f4a2d683c22ce3b8b8661da610644bfef1",
        "url": "https://github.com/edde746/background_downloader"
      },
      "source": "git",
@@ -307,7 +317,7 @@
      "version": "7.2.0"
    },
    "connectivity_plus_platform_interface": {
-      "dependency": "transitive",
+      "dependency": "direct dev",
      "description": {
        "name": "connectivity_plus_platform_interface",
        "sha256": "3c09627c536d22fd24691a905cdd8b14520de69da52c7a97499c8be5284a32ed",
@@ -610,16 +620,6 @@
      "source": "hosted",
      "version": "2.1.3"
    },
-    "globbing": {
-      "dependency": "transitive",
-      "description": {
-        "name": "globbing",
-        "sha256": "4f89cfaf6fa74c9c1740a96259da06bd45411ede56744e28017cc534a12b6e2d",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "1.0.0"
-    },
    "graphs": {
      "dependency": "transitive",
      "description": {
@@ -690,16 +690,6 @@
      "source": "hosted",
      "version": "4.1.2"
    },
-    "injector": {
-      "dependency": "transitive",
-      "description": {
-        "name": "injector",
-        "sha256": "ed389bed5b48a699d5b9561c985023d0d5cc88dd5ff2237aadcce5a5ab433e4e",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "3.0.0"
-    },
    "intl": {
      "dependency": "direct main",
      "description": {
@@ -1091,6 +1081,16 @@
      "source": "hosted",
      "version": "1.5.2"
    },
+    "posix": {
+      "dependency": "transitive",
+      "description": {
+        "name": "posix",
+        "sha256": "bc1bad54ad2b735816e31f8d4600cfde6c7839975085ddfbca48b6c9f7c4044e",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "6.5.2"
+    },
    "process": {
      "dependency": "transitive",
      "description": {
@@ -1101,16 +1101,6 @@
      "source": "hosted",
      "version": "5.0.5"
    },
-    "properties": {
-      "dependency": "transitive",
-      "description": {
-        "name": "properties",
-        "sha256": "333f427dd4ed07bdbe8c75b9ff864a1e70b5d7a8426a2e8bdd457b65ae5ac598",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "2.1.1"
-    },
    "provider": {
      "dependency": "direct main",
      "description": {
@@ -1280,16 +1270,6 @@
      "source": "hosted",
      "version": "9.25.0"
    },
-    "sentry_dart_plugin": {
-      "dependency": "direct dev",
-      "description": {
-        "name": "sentry_dart_plugin",
-        "sha256": "da9c1d0b3c87a251bfc36301f16af090a88c2d59128fe9a6f908f5ac20340c97",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "3.4.0"
-    },
    "sentry_flutter": {
      "dependency": "direct main",
      "description": {
@@ -1534,16 +1514,6 @@
      "source": "hosted",
      "version": "2.2.0"
    },
-    "system_info2": {
-      "dependency": "transitive",
-      "description": {
-        "name": "system_info2",
-        "sha256": "b937736ecfa63c45b10dde1ceb6bb30e5c0c340e14c441df024150679d65ac43",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "4.1.0"
-    },
    "term_glyph": {
      "dependency": "transitive",
      "description": {
--- a/pkgs/by-name/pr/prometheus/package.nix
+++ b/pkgs/by-name/pr/prometheus/package.nix
@@ -1,6 +1,7 @@
 {
  stdenv,
  lib,
+  nix-update-script,
  go,
  buildGoModule,
  nodejs,
@@ -37,9 +38,7 @@
 }:

 let
-  source = import ./source.nix;
-
-  inherit (source) version vendorHash;
+  version = "3.14.0";

  pname = "prometheus";

@@ -47,7 +46,7 @@ let
    owner = "prometheus";
    repo = "prometheus";
    tag = "v${version}";
-    hash = source.hash;
+    hash = "sha256-7PSfh+KWUpmL3BZ7INa1DOZ/ysaXXdWG9n/F+H0cGYo=";
  };

  assets = stdenv.mkDerivation (finalAssetsAttrs: {
@@ -66,7 +65,7 @@ let
      inherit (finalAssetsAttrs) pname version src;
      pnpm = pnpm_11;
      fetcherVersion = 4;
-      hash = source.pnpmDepsHash;
+      hash = "sha256-lmKUkeDdinb6WlnZSx3FnBlF/ACgUmvSMpYo84tRdCw=";
    };

    nativeBuildInputs = [
@@ -111,10 +110,11 @@ buildGoModule (finalAttrs: {
  inherit
    pname
    version
-    vendorHash
    src
    ;

+  vendorHash = "sha256-sCgxO2/w3Bi6Ncs/Q+JVZVtQC448FEx3llYxe/UxWEE=";
+
  proxyVendor = true;

  outputs = [
@@ -234,7 +234,12 @@ buildGoModule (finalAttrs: {
  passthru = {
    inherit assets;
    tests = { inherit (nixosTests) prometheus; };
-    updateScript = ./update.sh;
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--subpackage"
+        "assets"
+      ];
+    };
  };

  meta = {
--- a/pkgs/by-name/pr/prometheus/source.nix
+++ b/pkgs/by-name/pr/prometheus/source.nix
@@ -1,6 +0,0 @@
-{
-  version = "3.14.0";
-  hash = "sha256-7PSfh+KWUpmL3BZ7INa1DOZ/ysaXXdWG9n/F+H0cGYo=";
-  pnpmDepsHash = "sha256-lmKUkeDdinb6WlnZSx3FnBlF/ACgUmvSMpYo84tRdCw=";
-  vendorHash = "sha256-sCgxO2/w3Bi6Ncs/Q+JVZVtQC448FEx3llYxe/UxWEE=";
-}
--- a/pkgs/by-name/pr/prometheus/update.sh
+++ b/pkgs/by-name/pr/prometheus/update.sh
@@ -1,88 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p nix coreutils curl jq nix-prefetch-git
-
-set -euo pipefail
-
-OWNER=prometheus
-REPO=prometheus
-
-# Current version.
-LATEST_NIXPKGS_VERSION=$(nix eval --raw .#prometheus.version 2>/dev/null)
-UPDATE_NIX_OLD_VERSION=${UPDATE_NIX_OLD_VERSION:-$LATEST_NIXPKGS_VERSION}
-
-TARGET_TAG="$(curl -L -s ${GITHUB_TOKEN:+-u ":${GITHUB_TOKEN}"} "https://api.github.com/repos/$OWNER/$REPO/releases/latest" | jq -r '.tag_name')"
-TARGET_VERSION="$(echo "$TARGET_TAG" | sed -e 's/^v//')"
-
-if [[ "$UPDATE_NIX_OLD_VERSION" == "$TARGET_VERSION" ]]; then
-    # prometheus is up-to-date
-    if [[ -n "$UPDATE_NIX_ATTR_PATH" ]]; then
-        echo "[{}]";
-    fi
-
-    exit 0
-fi
-
-FAKE_HASH="sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
-
-extractHash() {
-    attr="${1?attr missing}"
-    result="$(nix-build -A "$attr" 2>&1 | tail -n3 | grep 'got:' | cut -d: -f2- | xargs echo || true)"
-    [ -z "$result" ] && { echo "$FAKE_HASH"; } || { echo "$result"; }
-}
-
-TMP=$(mktemp -d)
-trap 'rm -rf "$TMP"' EXIT
-
-NIXPKGS_PROMETHEUS_PATH=$(cd $(dirname ${BASH_SOURCE[0]}); pwd -P)/
-SOURCE_NIX="$NIXPKGS_PROMETHEUS_PATH/source.nix"
-
-PREFETCH_JSON=$TMP/prefetch.json
-nix-prefetch-git --rev "$TARGET_TAG" --url "https://github.com/$OWNER/$REPO" > "$PREFETCH_JSON"
-PREFETCH_HASH="$(jq '.hash' -r < "$PREFETCH_JSON")"
-
-cat > "$SOURCE_NIX" <<-EOF
-{
-  version = "$TARGET_VERSION";
-  hash = "$PREFETCH_HASH";
-  pnpmDepsHash = "$FAKE_HASH";
-  vendorHash = "$FAKE_HASH";
-}
-EOF
-
-# Resolve pnpm hash first: the Go integration pulls in the assets, so a fake
-# pnpmDepsHash makes that stage fail.
-PNPM_DEPS_HASH=$(extractHash prometheus.assets.pnpmDeps)
-
-cat > "$SOURCE_NIX" <<-EOF
-{
-  version = "$TARGET_VERSION";
-  hash = "$PREFETCH_HASH";
-  pnpmDepsHash = "$PNPM_DEPS_HASH";
-  vendorHash = "$FAKE_HASH";
-}
-EOF
-
-# Now do the Go module fetch.
-VENDOR_HASH=$(extractHash prometheus.goModules)
-
-cat > "$SOURCE_NIX" <<-EOF
-{
-  version = "$TARGET_VERSION";
-  hash = "$PREFETCH_HASH";
-  pnpmDepsHash = "$PNPM_DEPS_HASH";
-  vendorHash = "$VENDOR_HASH";
-}
-EOF
-
-if [[ -z "$UPDATE_NIX_ATTR_PATH" ]]; then
-    exit 0
-fi
-
-cat <<-EOF
-[{
-  "attrPath": "$UPDATE_NIX_ATTR_PATH",
-  "oldVersion": "$UPDATE_NIX_OLD_VERSION",
-  "newVersion": "$TARGET_VERSION",
-  "files": ["$SOURCE_NIX"]
-}]
-EOF
--- a/pkgs/by-name/sa/sandbox-runtime/package.nix
+++ b/pkgs/by-name/sa/sandbox-runtime/package.nix
@@ -17,7 +17,7 @@

 buildNpmPackage (finalAttrs: {
  pname = "sandbox-runtime";
-  version = "0.0.75";
+  version = "0.0.76";

  __structuredAttrs = true;

@@ -25,7 +25,7 @@ buildNpmPackage (finalAttrs: {
    owner = "anthropic-experimental";
    repo = "sandbox-runtime";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-TfxVceVav2zw2L6D1hbQWOzVQZ4v/hZLollKysqZnKQ=";
+    hash = "sha256-NXr4OuTsHl8oD8oyzwlNuDoZOy2zNh6tWEr7q4KYKwI=";
  };

  postPatch =
@@ -37,7 +37,7 @@ buildNpmPackage (finalAttrs: {

  strictDeps = true;

-  npmDepsHash = "sha256-I7ebBTyRMBLmKE5wB8VEvKlB3Tjx2rbaKLFdMt0wbmg=";
+  npmDepsHash = "sha256-r49lP4aD7kAG7azGH3MAvXnVu2LwlpyToDMmErzdunw=";

  postFixup =
    let
--- a/pkgs/by-name/sc/scalingo/package.nix
+++ b/pkgs/by-name/sc/scalingo/package.nix
@@ -7,13 +7,13 @@

 buildGoModule rec {
  pname = "scalingo";
-  version = "1.48.0";
+  version = "1.49.0";

  src = fetchFromGitHub {
    owner = "scalingo";
    repo = "cli";
    rev = version;
-    hash = "sha256-vwTgr9zzRo4/o3D9p/jcmwKskmjClj4sfd8zalK7PDg=";
+    hash = "sha256-U3OG0rmZMN/uTeXSA7A7pdG6PYR65h836rSYAsRp6yQ=";
  };

  vendorHash = null;
--- a/pkgs/by-name/se/september/package.nix
+++ b/pkgs/by-name/se/september/package.nix
@@ -9,17 +9,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "september";
-  version = "0.4.1";
+  version = "0.5.0";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "gemrest";
    repo = "september";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-45xxiz93UhCCJFr3s0+Sgl4LMrUvRbMums1ZNngA1AY=";
+    hash = "sha256-g50hWDuf5TgzI8vfQAAkNYZs6UTIve7IX+fNTWzxu4w=";
  };

-  cargoHash = "sha256-rpMnRx4/LdsVjAteY2LFm2j94XjneZ5E6c+pgZXOOr8=";
+  cargoHash = "sha256-tOoiIKeG/b1l/TpTD1K1ZRhVDcWxNILhKqLpJp7QIec=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/sh/shelter/package.nix
+++ b/pkgs/by-name/sh/shelter/package.nix
@@ -10,12 +10,12 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "shelter";
-  version = "0-unstable-2026-08-14";
+  version = "0-unstable-2026-09-06";
  src = fetchFromGitHub {
    owner = "uwu";
    repo = "shelter";
-    rev = "d7cc2ce46e94c0dbbd28af741cb2f0c09d1b77fc";
-    hash = "sha256-HFfggRZHVtkxvphllcYsbKa+CaifvUfb8tkhv7awrF4=";
+    rev = "ee10d4ecb2fd62fb86ebfdbd37a4e28df9e72f11";
+    hash = "sha256-Ew6RUhIS2gRuCNkbNCNtlmtYSGtjBR4h+UebuDVWhmk=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/si/sigtop/package.nix
+++ b/pkgs/by-name/si/sigtop/package.nix
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "sigtop";
-  version = "0.24.1";
+  version = "0.26.0";

  src = fetchFromGitHub {
    owner = "tbvdm";
    repo = "sigtop";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-zGDH3qdRI5yzcqEDH9sBg/7842qafCnf2Mc1W35iXY4=";
+    sha256 = "sha256-ZI4GuXWeLuEIKEQtsv6nugsfIc/Dlj2JYoVVmAr2O28=";
  };

-  vendorHash = "sha256-6pNBYziJvJ1MMjzcbIjPFAUTW6ZrCNmtYzzAS/ANtEw=";
+  vendorHash = "sha256-NyZTLut10DBNlBYIXjRB9zL98ZZ/A6hu0ypsu3GjHq8=";

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ libsecret ];
--- a/pkgs/by-name/so/sogo/package.nix
+++ b/pkgs/by-name/so/sogo/package.nix
@@ -58,6 +58,12 @@ clangStdenv.mkDerivation rec {
  patches = lib.optional enableActiveSync ./enable-activesync.patch;

  postPatch = ''
+    # Don't record the compile command line in .GCC.command.line sections of
+    # the installed binaries: it embeds the store paths of the whole toolchain
+    # and turns clang, llvm and gcc into runtime dependencies.
+    substituteInPlace general.make \
+      --replace-fail ' $(call cc-option,-frecord-gcc-switches)' ""
+
    # Exclude NIX_ variables
    sed -i 's/grep GNUSTEP_/grep ^GNUSTEP_/g' configure

--- a/pkgs/by-name/so/sope/package.nix
+++ b/pkgs/by-name/so/sope/package.nix
@@ -23,6 +23,14 @@ clangStdenv.mkDerivation rec {
    hash = "sha256-0G28qDXygDe/TJ2znNE+NVQry3bkqUO59jqtJm/t2S4=";
  };

+  postPatch = ''
+    # Don't record the compile command line in .GCC.command.line sections of
+    # the installed binaries: it embeds the store paths of the whole toolchain
+    # and turns clang, llvm and gcc into runtime dependencies.
+    substituteInPlace general.make \
+      --replace-fail ' $(call cc-option,-frecord-gcc-switches)' ""
+  '';
+
  nativeBuildInputs = lib.optional (libpq != null) libpq.pg_config;
  buildInputs = [
    gnustep-base
--- a/pkgs/by-name/ta/tabbyapi/package.nix
+++ b/pkgs/by-name/ta/tabbyapi/package.nix
@@ -7,14 +7,14 @@
 }:
 python3Packages.buildPythonApplication {
  pname = "tabbyapi";
-  version = "0-unstable-2026-09-07";
+  version = "0-unstable-2026-09-14";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "theroyallab";
    repo = "tabbyAPI";
-    rev = "92198cca1aa48f83121027f5b9058c24d7c2d894";
-    hash = "sha256-IQDsfTnIcaVmxk58Q8StEPS4O7LQwPVie6b04BWoeeQ=";
+    rev = "53da7919d4e45c63f4acbcbbc00cbe0f60a1ce65";
+    hash = "sha256-oKVxMoyMWZCuwLbsimTXO05Hdsw/2u2SVeYSFm1XsFg=";
  };

  build-system = with python3Packages; [
--- a/pkgs/by-name/to/todoist-cli/package.nix
+++ b/pkgs/by-name/to/todoist-cli/package.nix
@@ -7,16 +7,16 @@
 }:
 buildNpmPackage rec {
  pname = "todoist-cli";
-  version = "5.2.1";
+  version = "5.3.6";

  src = fetchFromGitHub {
    owner = "Doist";
    repo = "todoist-cli";
    rev = "v${version}";
-    sha256 = "sha256-RYk1MSL15dt8aTeRxNPcVNYXnaDRURiITfMEBqR4DIA=";
+    sha256 = "sha256-x1zoHqNXWCwv2wQS56H3Z5DUxWTXFbcaYlupOvm/lfs=";
  };

-  npmDepsHash = "sha256-JDFKNVm8G/s4fVsXjKzh0DWmqXDbTJ7huv3LO5mq+rU=";
+  npmDepsHash = "sha256-ll3UnmbJrvzv6F5LvhJRMkyA3FRxaiJvVCwk0Wy81Ks=";

  doCheck = true;

--- a/pkgs/by-name/tu/tuicr/package.nix
+++ b/pkgs/by-name/tu/tuicr/package.nix
@@ -9,7 +9,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "tuicr";
-  version = "0.25.0";
+  version = "0.26.0";

  __structuredAttrs = true;

@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "agavra";
    repo = "tuicr";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-nbjvSRrbJ4LQrn8l0FJ8R5PNpq7gcQR8m78agL59zqs=";
+    hash = "sha256-eu6+jDsCHLWPqMTSWTgtTr9bFiYYAAPFWfR+5dGgefE=";
  };

-  cargoHash = "sha256-9L1G0O5kE9EOFAQ092R/C9/SC48K0YcD5D2WjEvkeK0=";
+  cargoHash = "sha256-WrWoTPgdUNF0xQ/Q0GbPGwcOMP5i3clBmyeHcFMsNso=";

  strictDeps = true;

--- a/pkgs/by-name/us/usbvfiod/package.nix
+++ b/pkgs/by-name/us/usbvfiod/package.nix
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "usbvfiod";
-  version = "0.2.0";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "cyberus-technology";
    repo = "usbvfiod";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-gus0Bdsd0zUuhsAQ4I1Z/BphKOjAlmbpqND6W+6cNbg=";
+    hash = "sha256-gYKWmUaB7c5netQjR7qHKuBq82X3J+o4gQCsB/3cq50=";
  };

-  cargoHash = "sha256-7RTaWi93WJV2HEVyljSzRVG+eCwo6+Ywq4Y+ng1UMww=";
+  cargoHash = "sha256-B4iyADjXjX7VdGaTIdCKUalwJt6vMVnqqUCyLsu5wUI=";

  nativeInstallCheckInputs = [
    versionCheckHook
--- a/pkgs/by-name/va/vacuum-go/package.nix
+++ b/pkgs/by-name/va/vacuum-go/package.nix
@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "vacuum-go";
-  version = "0.30.3";
+  version = "0.30.6";

  src = fetchFromGitHub {
    owner = "daveshanley";
    repo = "vacuum";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-FIKkT3u2/9O9mosM6myFs5WvYa6WC7T4O/CcGuIdbDQ=";
+    hash = "sha256-27ZGWy9lblCAlvodpmgyhHaS2uHP5gpM8SDh44agdZ8=";
  };

-  vendorHash = "sha256-IX80z+3IpgZPqdklJzTZyOlLDM6Qbw8y1Q344r5TYpc=";
+  vendorHash = "sha256-0fKjscF77MubYr+AhvWAk8Oh0OQP948vGW8zbwAS1xw=";

  env.CGO_ENABLED = 0;
  ldflags = [
--- a/pkgs/by-name/va/valkey/package.nix
+++ b/pkgs/by-name/va/valkey/package.nix
@@ -112,7 +112,7 @@ stdenv.mkDerivation (finalAttrs: {

  passthru = {
    tests = {
-      redis = nixosTests.valkey;
+      valkey = nixosTests.valkey;
      unitTests = finalAttrs.finalPackage.overrideAttrs { doCheck = true; };
      valkey-python = python3Packages.valkey;
    };
--- a/pkgs/by-name/ve/verifpal/package.nix
+++ b/pkgs/by-name/ve/verifpal/package.nix
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "verifpal";
-  version = "0.80.1";
+  version = "1.4.10";

  src = fetchFromGitHub {
    owner = "symbolicsoft";
    repo = "verifpal";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-C5k9vXd91m7AZWqSCTw4qxD3onuq/1bMhlIia9XW2II=";
+    hash = "sha256-Cg8qaOGAGRYPacbv4WswcEkQrNRSh5xtO5y6gsUW3x8=";
  };

-  cargoHash = "sha256-7qfKG7iUcoKOcyFfDgaCDiXF3eAOO/wGJgu7XocSXZU=";
+  cargoHash = "sha256-c5cnkZD5XPpYab0JOF8L5h7U5GbvHBzLXH1jq4b5Y1w=";

  meta = {
    homepage = "https://verifpal.com/";
--- a/pkgs/by-name/wa/wakapi/package.nix
+++ b/pkgs/by-name/wa/wakapi/package.nix
@@ -6,7 +6,7 @@
  nix-update-script,
 }:
 let
-  version = "2.17.6";
+  version = "2.18.0";
 in
 buildGoLatestModule {
  pname = "wakapi";
@@ -16,10 +16,10 @@ buildGoLatestModule {
    owner = "muety";
    repo = "wakapi";
    tag = version;
-    hash = "sha256-fKCfjLh/nf6rRqxdGPWfEY9EDh+5sXSKkvzgq7D4ocE=";
+    hash = "sha256-OjspvyjD+3SQdJwkfdDRYUWY1Ryqtwr6DqrLESlqcDo=";
  };

-  vendorHash = "sha256-eyldhpDU5fT7tHdsQZ4qUrPlu1QSYaXX8FgksvAXiOw=";
+  vendorHash = "sha256-4hmBS/9E7YfsYpjcC7sP0MatCVPR55s9Ac/9YEe2FK8=";

  # Not a go module required by the project, contains development utilities
  excludedPackages = [ "scripts" ];
--- a/pkgs/by-name/wa/wasm-language-tools/package.nix
+++ b/pkgs/by-name/wa/wasm-language-tools/package.nix
@@ -2,6 +2,7 @@
  lib,
  rustPlatform,
  fetchFromGitHub,
+  fetchpatch,
  versionCheckHook,
  _experimental-update-script-combinators,
  nix-update-script,
@@ -19,6 +20,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
    hash = "sha256-XyVWNhVDo190/hnKj6A5dDYnlO9/WI0GYJIrkyfUkTw=";
  };

+  patches = [
+    # Fix test for Rust 1.98: https://github.com/rust-lang/rust/pull/155527
+    (fetchpatch {
+      name = "update-snapshot-for-rust-1.98.patch";
+      url = "https://github.com/g-plane/wasm-language-tools/commit/d7cabdba9fa90ec74a461dcc6b470288184d6c86.patch";
+      hash = "sha256-dPPMebvNVVtFTURsxGGHTwZ6SM3CDMlZucENzwOO6/4=";
+    })
+  ];
+
  cargoHash = "sha256-VoApXHdD8SF8ZqnDVynxunjVoZ5WKai2Xzw0UYy7hSg=";

  nativeInstallCheckInputs = [ versionCheckHook ];
--- a/pkgs/by-name/we/wealthfolio-server/package.nix
+++ b/pkgs/by-name/we/wealthfolio-server/package.nix
@@ -54,18 +54,18 @@ rustPlatform.buildRustPackage (
    __structuredAttrs = true;

    pname = "wealthfolio-server";
-    version = "3.7.0";
+    version = "3.8.0";

    src = fetchFromGitHub {
      owner = "wealthfolio";
      repo = "wealthfolio";
      tag = "v${finalAttrs.version}";
-      hash = "sha256-GsI2TrPXEiHKUnUxNNmYf2EveWlg5PJBGh5TYILK0yc=";
+      hash = "sha256-5CqLHnwBzqA+yf/sQM2ie3xuO+5aM5EDA0bhZ6r1VIM=";
    };

    cargoRoot = ".";
    buildAndTestSubdir = "apps/server";
-    cargoHash = "sha256-vnmhaAoF3O5N+y3HpYZz+2j/WU1HAA5uyKtxLCJBqA4=";
+    cargoHash = "sha256-PFMmpQhQubMzomvLWMJZrriH9emwEzO/rTFCovzFt6w=";

    nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/by-name/wr/wrapGNUstepAppsHook/wrapGNUstepAppsHook.sh
+++ b/pkgs/by-name/wr/wrapGNUstepAppsHook/wrapGNUstepAppsHook.sh
@@ -4,6 +4,10 @@ if [[ -z "${__nix_wrapGNUstepAppsHook-}" ]]; then
    # Inherit arguments given in mkDerivation
    gnustepWrapperArgs=(${gnustepWrapperArgs-})

+    # NIX_GNUSTEP_SYSTEM_HEADERS is deliberately missing here: it only matters
+    # while compiling and gnustep-base ignores it at run time, so writing it
+    # into the installed config file would only pull the -dev outputs of every
+    # build input into the runtime closure.
    gnustepConfigVars+=(
        GNUSTEP_MAKEFILES
        NIX_GNUSTEP_SYSTEM_APPS
@@ -12,7 +16,6 @@ if [[ -z "${__nix_wrapGNUstepAppsHook-}" ]]; then
        NIX_GNUSTEP_SYSTEM_TOOLS
        NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS
        NIX_GNUSTEP_SYSTEM_LIBRARY
-        NIX_GNUSTEP_SYSTEM_HEADERS
        NIX_GNUSTEP_SYSTEM_LIBRARIES
        NIX_GNUSTEP_SYSTEM_DOC
        NIX_GNUSTEP_SYSTEM_DOC_MAN
@@ -38,30 +41,59 @@ if [[ -z "${__nix_wrapGNUstepAppsHook-}" ]]; then
            fi
        }

-        gsAddToIncludeSearchPath() {
-            local -n ref="$1"
+        # Without strictDeps, gnustep-make's environment hook also picks up
+        # native build inputs, so the NIX_GNUSTEP_* paths include the compiler
+        # wrapper and friends. Keeping those in the installed config file would
+        # make the whole toolchain a runtime dependency (~1.6 GB).
+        gsDropBuildOnlyPaths() {
+            local -n pathsRef="$1"
+            local -a kept=()
+            local entry prefix
+            local IFS=:

-            if [[ -d "$2" && "${ref-}" != *"$2"* ]]; then
-                if [[ "${ref-}" != "" ]]; then
-                    ref+=" "
-                fi
+            for entry in ${pathsRef-}; do
+                for prefix in "${gnustepRuntimePrefixes[@]}"; do
+                    if [[ "$entry" =~ ^"$prefix"(/|$) ]]; then
+                        kept+=("$entry")
+                        break
+                    fi
+                done
+            done

-                ref+="$2"
-            fi
+            pathsRef="${kept[*]}"
        }

+        gnustepRuntimePrefixes=()
+
+        for output in ${outputs:-out}; do
+            gnustepRuntimePrefixes+=("${!output}")
+        done
+
+        for pkg in \
+            ${pkgsHostHost+"${pkgsHostHost[@]}"} \
+            ${pkgsHostTarget+"${pkgsHostTarget[@]}"}
+        do
+            gnustepRuntimePrefixes+=("$pkg")
+        done
+
        gsAddToSearchPath NIX_GNUSTEP_SYSTEM_APPS "$out/lib/GNUstep/Applications"
        gsAddToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_APPS "$out/lib/GNUstep/Applications"
        gsAddToSearchPath NIX_GNUSTEP_SYSTEM_WEB_APPS "$out/lib/GNUstep/WebApplications"
        gsAddToSearchPath NIX_GNUSTEP_SYSTEM_TOOLS "$out/bin"
        gsAddToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS "$out/sbin"
        gsAddToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARY "$out/lib/GNUstep"
-        gsAddToIncludeSearchPath NIX_GNUSTEP_SYSTEM_HEADERS "$out/include"
        gsAddToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARIES "$out/lib"
        gsAddToSearchPath NIX_GNUSTEP_SYSTEM_DOC "$out/share/GNUstep/Documentation"
        gsAddToSearchPath NIX_GNUSTEP_SYSTEM_DOC_MAN "$out/share/man"
        gsAddToSearchPath NIX_GNUSTEP_SYSTEM_DOC_INFO "$out/share/info"

+        for var in "${gnustepConfigVars[@]}"; do
+            # GNUSTEP_MAKEFILES is a single path pointing at gnustep-make
+            # rather than a search path assembled from the build environment.
+            [[ "$var" == NIX_GNUSTEP_* ]] || continue
+            gsDropBuildOnlyPaths "$var"
+        done
+
        for var in "${gnustepConfigVars[@]}"; do
            if [[ -n "${!var-}" ]]; then
                printf '%s="%s"\n' "$var" "${!var}"
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -411,8 +411,8 @@ in
  };

  ruby_4_0 = generic {
-    version = rubyVersion "4" "0" "6" "";
-    hash = "sha256-g30pno993yvjGiKaen4BnTVJeYJRF5iayzsysam+Jio=";
+    version = rubyVersion "4" "0" "7" "";
+    hash = "sha256-kRrOIPkNBoyg5N2m0OTw+B5S5S8t1PQATHIeJTQS6C0=";
    cargoHash = "sha256-z7NwWc4TaR042hNx0xgRkh/BQEpEJtE53cfrN0qNiE0=";
  };

--- a/pkgs/development/ocaml-modules/bstr/default.nix
+++ b/pkgs/development/ocaml-modules/bstr/default.nix
@@ -6,13 +6,13 @@

 buildDunePackage (finalAttrs: {
  pname = "bstr";
-  version = "0.0.4";
+  version = "0.1.1";

  minimalOCamlVersion = "4.13";

  src = fetchurl {
    url = "https://github.com/robur-coop/bstr/releases/download/v${finalAttrs.version}/bstr-${finalAttrs.version}.tbz";
-    hash = "sha256-ZAg28VstVVvfI2b213g5JuEVmK1+lFV7Fnx4WyVfSFY=";
+    hash = "sha256-5lfP/aVpELFLmMdt1uA4LqS8XQFn6IORq6kxlrAW7uA=";
  };

  meta = {
--- a/pkgs/development/ocaml-modules/httpcats/default.nix
+++ b/pkgs/development/ocaml-modules/httpcats/default.nix
@@ -18,11 +18,11 @@

 buildDunePackage (finalAttrs: {
  pname = "httpcats";
-  version = "0.3.1";
+  version = "0.3.2";

  src = fetchurl {
    url = "https://github.com/robur-coop/httpcats/releases/download/v${finalAttrs.version}/httpcats-${finalAttrs.version}.tbz";
-    hash = "sha256-5BymoyJS5JykTnSee0HhSKzbHkb8j6COuY7tZtGDGh0=";
+    hash = "sha256-n0InZn+7jaDbf3WaMACdh3DPMfkfewmkcXQAVfR81rg=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/python-modules/dspy/default.nix
+++ b/pkgs/development/python-modules/dspy/default.nix
@@ -0,0 +1,125 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  anyio,
+  asyncer,
+  cachetools,
+  cloudpickle,
+  datamodel-code-generator,
+  diskcache,
+  gepa,
+  json-repair,
+  litellm,
+  mcp,
+  numpy,
+  openai,
+  orjson,
+  pillow,
+  pydantic,
+  pyprojectVersionPatchHook,
+  pytestCheckHook,
+  pytest-asyncio,
+  regex,
+  requests,
+  tenacity,
+  tqdm,
+  typeguard,
+  xxhash,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "dspy";
+  version = "3.2.1";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "stanfordnlp";
+    repo = "dspy";
+    tag = finalAttrs.version;
+    hash = "sha256-xquV+FyDfejm1SCWYfuiezIkyutmm/1zOvd5X+oElrM=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  nativeBuildInputs = [
+    pyprojectVersionPatchHook
+  ];
+
+  dependencies = [
+    anyio
+    asyncer
+    cachetools
+    cloudpickle
+    diskcache
+    gepa
+    json-repair
+    litellm
+    mcp
+    numpy
+    openai
+    orjson
+    pydantic
+    regex
+    requests
+    tenacity
+    tqdm
+    typeguard
+    xxhash
+  ];
+
+  pythonRelaxDeps = [
+    "asyncer"
+    "gepa"
+    "litellm"
+    "typeguard"
+  ];
+
+  # optuna is an optional dependency that dspy can use but doesn't require at import time
+  pythonRemoveDeps = [ "optuna" ];
+
+  # Prevent litellm from trying to fetch the remote model cost map at import
+  # time, which fails in environments without direct internet access.
+  postPatch = ''
+    sed -i '1i import os; os.environ.setdefault("LITELLM_LOCAL_MODEL_COST_MAP", "true")' dspy/__init__.py
+  '';
+
+  pythonImportsCheck = [ "dspy" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-asyncio
+    datamodel-code-generator
+    pillow
+  ];
+
+  # skip tests that need network access
+  disabledTestPaths = [
+    "tests/signatures/test_adapter_image.py"
+  ];
+
+  # These tests start a litellm proxy server subprocess, which isn't available
+  # in the nix build sandbox (upstream skips them on Python 3.14 for the same reason).
+  disabledTests = [
+    "test_chat_lms_can_be_queried"
+    "test_dspy_cache"
+    "test_lm_calls_support_callables"
+    "test_lm_calls_support_pydantic_models"
+    "test_responses_api_tool_calls"
+    "test_streamify_yields_expected_response_chunks"
+    "test_streaming_response_yields_expected_response_chunks"
+    "test_text_lms_can_be_queried"
+  ];
+
+  meta = {
+    description = "Programming — not prompting — language models";
+    homepage = "https://github.com/stanfordnlp/dspy";
+    changelog = "https://github.com/stanfordnlp/dspy/releases/tag/${finalAttrs.version}";
+    maintainers = with lib.maintainers; [ jherland ];
+    license = lib.licenses.mit;
+  };
+})
--- a/pkgs/development/python-modules/exllamav3/default.nix
+++ b/pkgs/development/python-modules/exllamav3/default.nix
@@ -22,18 +22,28 @@
  typing-extensions,
 }:
 let
-  newerThanTuring = lib.filter (version: lib.versionOlder "7.9" version) torch.cudaCapabilities;
+  # https://github.com/turboderp-org/exllamav3/blob/master/.github/workflows/build.yml#L55
+  # https://github.com/turboderp-org/exllamav3/issues/44
+  # Using unsupported platforms the build will fail
+  cudaCapabilities = lib.intersectLists torch.cudaCapabilities [
+    "8.0"
+    "8.6"
+    "8.9"
+    "9.0"
+    "10.0"
+    "12.0"
+  ];
 in
 buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
  pname = "exllamav3";
-  version = "1.4.8";
+  version = "1.5.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "turboderp-org";
    repo = "exllamav3";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-CnbJR5rsHzNEeQBJLdD7LGrrTgy+GKpvop1R4uY4d8U=";
+    hash = "sha256-gW6A2nWx3lumnJz7r7vxQyC1qM9Agqdr0DiL68yJvAI=";
  };

  pythonRelaxDeps = [
@@ -57,7 +67,7 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
  ];

  dependencies = [
-    flash-linear-attention
+    flash-linear-attention # Upstream vendors it instead
    llguidance
    marisa-trie
    numpy
@@ -73,9 +83,9 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {

  env = lib.optionalAttrs torch.cudaSupport {
    CUDA_HOME = lib.getDev cudaPackages.cuda_nvcc;
-    # exllamav3 only supports turing or newer GPUs
-    # https://github.com/turboderp-org/exllamav3/issues/44
-    TORCH_CUDA_ARCH_LIST = lib.concatStringsSep ";" newerThanTuring;
+    TORCH_CUDA_ARCH_LIST = lib.concatStringsSep ";" (
+      cudaCapabilities ++ [ "${lib.last cudaCapabilities}+PTX" ]
+    );
  };

  pythonImportsCheck = [ "exllamav3" ];
--- a/pkgs/development/python-modules/gepa/default.nix
+++ b/pkgs/development/python-modules/gepa/default.nix
@@ -2,6 +2,7 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+  pyprojectVersionPatchHook,
  setuptools,
 }:

@@ -20,6 +21,10 @@ buildPythonPackage (finalAttrs: {

  build-system = [ setuptools ];

+  nativeBuildInputs = [
+    pyprojectVersionPatchHook
+  ];
+
  pythonImportsCheck = [ "gepa" ];

  # test suite requires network access
--- a/pkgs/development/python-modules/onnxscript/default.nix
+++ b/pkgs/development/python-modules/onnxscript/default.nix
@@ -31,7 +31,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "onnxscript";
-  version = "0.7.1";
+  version = "0.7.2";
  pyproject = true;
  __structuredAttrs = true;

@@ -39,7 +39,7 @@ buildPythonPackage (finalAttrs: {
    owner = "microsoft";
    repo = "onnxscript";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-l6Nsnbg7LG/0Z9y1EX5BPP3sFdY/EZwRFFHOrP4mwdw=";
+    hash = "sha256-Fd7nQ4KZECgUUfLrCo54NiUVcx1IdhGfUdYWXEo7D8o=";
  };

  env = {
--- a/pkgs/development/python-modules/playwright/default.nix
+++ b/pkgs/development/python-modules/playwright/default.nix
@@ -31,14 +31,14 @@ in
 buildPythonPackage (finalAttrs: {
  pname = "playwright";
  # run ./pkgs/development/web/playwright/update.sh to update
-  version = "1.62.0";
+  version = "1.63.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "microsoft";
    repo = "playwright-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-E9silyNQtFEPShimuEbWXvg5fgf+vqaiDez+Ri0jDTw=";
+    hash = "sha256-RwIn+0EcHnStjORVFmT7gp4bGjl+qer1FgtI3+aPF2w=";
  };

  patches = [
--- a/pkgs/development/web/playwright/browser-downloads.nix
+++ b/pkgs/development/web/playwright/browser-downloads.nix
@@ -20,13 +20,13 @@ in
 {
  chromium = {
    x86_64-linux = mk (cftUrl "linux64/chrome-linux64.zip") true;
-    aarch64-linux = mk (registryUrl "chromium" "chromium-linux-arm64.zip") true;
+    aarch64-linux = mk (cftUrl "linux-arm64/chrome-linux-arm64.zip") true;
    aarch64-darwin = mk (cftUrl "mac-arm64/chrome-mac-arm64.zip") false;
  };

  "chromium-headless-shell" = {
    x86_64-linux = mk (cftUrl "linux64/chrome-headless-shell-linux64.zip") false;
-    aarch64-linux = mk (registryUrl "chromium" "chromium-headless-shell-linux-arm64.zip") false;
+    aarch64-linux = mk (cftUrl "linux-arm64/chrome-headless-shell-linux-arm64.zip") false;
    aarch64-darwin = mk (cftUrl "mac-arm64/chrome-headless-shell-mac-arm64.zip") false;
  };

--- a/pkgs/development/web/playwright/browsers.json
+++ b/pkgs/development/web/playwright/browsers.json
@@ -2,23 +2,23 @@
  "comment": "This file is kept up to date via update.sh",
  "browsers": {
    "chromium": {
-      "revision": "1234",
-      "browserVersion": "151.0.7922.34",
+      "revision": "1243",
+      "browserVersion": "153.0.8010.12",
      "title": "Chrome for Testing"
    },
    "chromium-headless-shell": {
-      "revision": "1234",
-      "browserVersion": "151.0.7922.34",
+      "revision": "1243",
+      "browserVersion": "153.0.8010.12",
      "title": "Chrome Headless Shell"
    },
    "firefox": {
-      "revision": "1538",
-      "browserVersion": "153.0",
+      "revision": "1543",
+      "browserVersion": "155.0",
      "title": "Firefox"
    },
    "webkit": {
-      "revision": "2336",
-      "browserVersion": "26.5",
+      "revision": "2359",
+      "browserVersion": "26.6",
      "title": "WebKit"
    },
    "ffmpeg": {
--- a/pkgs/development/web/playwright/chromium-headless-shell.nix
+++ b/pkgs/development/web/playwright/chromium-headless-shell.nix
@@ -36,8 +36,8 @@ let
      inherit (download) url stripRoot;
      hash =
        {
-          x86_64-linux = "sha256-2w0Ul3tpzrVkfGHIbQGwEsCRmVUUy3OAShGhuoH6Rmw=";
-          aarch64-linux = "sha256-DoZf+pKXW0Oj2e8vtGDDSViJ0SX8PkYE1Q0LJs53IWg=";
+          x86_64-linux = "sha256-GLqqZOwtnJig+ZCIT8FYsIxZGSFTmRwLbqNXeSOdJXA=";
+          aarch64-linux = "sha256-7DSqFxtk8Jf4/ktoW1MmH5vHs5LEp7jNvglYRoKXBm4=";
        }
        .${system} or throwSystem;
    };
@@ -72,7 +72,7 @@ let
    inherit (download) url stripRoot;
    hash =
      {
-        aarch64-darwin = "sha256-5VQESywHZKhqc7Fhq/jqNF+yXl90F3+i9nPzBHyJV8k=";
+        aarch64-darwin = "sha256-Elbpy5UDVndRzWRi8Nb391AhAAYl55PJ/3Fxz/RI/4I=";
      }
      .${system} or throwSystem;
  };
--- a/pkgs/development/web/playwright/chromium.nix
+++ b/pkgs/development/web/playwright/chromium.nix
@@ -49,11 +49,11 @@ let

  # Playwright expects different directory names for different architectures:
  # - linux-x64 expects: chrome-linux64
-  # - linux-arm64 expects: chrome-linux
+  # - linux-arm64 expects: chrome-linux-arm64
  chromeDir =
    {
      x86_64-linux = "chrome-linux64";
-      aarch64-linux = "chrome-linux";
+      aarch64-linux = "chrome-linux-arm64";
    }
    .${system} or throwSystem;

@@ -63,8 +63,8 @@ let
      inherit (download) url stripRoot;
      hash =
        {
-          x86_64-linux = "sha256-3/o8ZFVeL/YDuO+aax+qcm6xv77AX6Vl6meP+S05cTk=";
-          aarch64-linux = "sha256-53xm/L3QYH22AZ8K/5cKg1gLewKv7s3lTDmXlHw4KDg=";
+          x86_64-linux = "sha256-ORdMu1e4Peolr8rdfvzgeaFhC8RgBipaOsAm7e3ZeqE=";
+          aarch64-linux = "sha256-AWXksACJGsDisnp9dAUcukDf/ruMCRCX9kZNNnE0R8Q=";
        }
        .${system} or throwSystem;
    };
@@ -130,7 +130,7 @@ let
    inherit (download) url stripRoot;
    hash =
      {
-        aarch64-darwin = "sha256-ugo4gRST53YA1uaLXfwnFhFdouShtUAGFnf2ZKbg5jI=";
+        aarch64-darwin = "sha256-Zm7aHjwXL0kbucBiNoWxBM6rFdY0UmVIwcr/f8V31G8=";
      }
      .${system} or throwSystem;
  };
--- a/pkgs/development/web/playwright/driver.nix
+++ b/pkgs/development/web/playwright/driver.nix
@@ -19,13 +19,13 @@ let
  throwSystem = throw "Unsupported system: ${system}";
  browsersJSON = (lib.importJSON ./browsers.json).browsers;

-  version = "1.62.1";
+  version = "1.63.0";

  src = fetchFromGitHub {
    owner = "Microsoft";
    repo = "playwright";
    rev = "v${version}";
-    hash = "sha256-3gLXo9bd2qXCy8MYMbnYU6AXIWrqoitqMBPMF4g07nY=";
+    hash = "sha256-W5x48pV5OlOzL65JQ3OJf2gL6T/FLAYJO2SwCb7IzOY=";
  };

  playwright = buildNpmPackage {
@@ -33,7 +33,7 @@ let
    inherit version src;

    sourceRoot = "${src.name}"; # update.sh depends on sourceRoot presence
-    npmDepsHash = "sha256-iebe0sP3VMdk1vBFDkwM1L4x2VrHPZF/NbjMeU5diWM=";
+    npmDepsHash = "sha256-6unp+NT6BHEaLE9XJ6tv49N/0yY4pJ5dyvSqmE9O3SQ=";

    nativeBuildInputs = [
      cacert
--- a/pkgs/development/web/playwright/firefox.nix
+++ b/pkgs/development/web/playwright/firefox.nix
@@ -19,8 +19,8 @@ let
      inherit (download) url stripRoot;
      hash =
        {
-          x86_64-linux = "sha256-GmjRWhlSv7by3PFtrKgo6EBmHigmp55HwG8iA/Ykq88=";
-          aarch64-linux = "sha256-7vxVe82NxebzoSSoSFg9qNxKOqlT7EOwCxQVavkDoMM=";
+          x86_64-linux = "sha256-FyUUBrffHSh28C3BfYgHRJzTbAixRXN0QoZ3tbtdbYU=";
+          aarch64-linux = "sha256-vkK7bYqf5FiYoHcNmSjXYy7i5rsSLNpx9w+KL7MY0uo=";
        }
        .${system} or throwSystem;
    };
@@ -42,7 +42,7 @@ let
    inherit (download) url stripRoot;
    hash =
      {
-        aarch64-darwin = "sha256-E7/Kbvjg1dcWwSe/07hMR+W6NR0JHoAPxp1e+SncQYs=";
+        aarch64-darwin = "sha256-mFCMrL5PMX5C0Ob/tKKfbZfZJwF5QDM0rhS7v/P3IUw=";
      }
      .${system} or throwSystem;
  };
--- a/pkgs/development/web/playwright/webkit.nix
+++ b/pkgs/development/web/playwright/webkit.nix
@@ -32,6 +32,7 @@
  libgcrypt,
  libgpg-error,
  libjpeg8,
+  libmanette,
  libopus,
  libpng,
  libsoup_3,
@@ -129,8 +130,8 @@ let
      inherit (download) url stripRoot;
      hash =
        {
-          x86_64-linux = "sha256-w/avBW8CAiGd9WzddVGLymLLG23OzY/Bm7Dhw9JVQOA=";
-          aarch64-linux = "sha256-KUVT67b11IljTNpzCcEy+O5CW5UuqyVi6QFdQ87lVLA=";
+          x86_64-linux = "sha256-My6nSOMD2NfPGUmOJKZgWpkjktEsj+P+CPeVmKy1VAQ=";
+          aarch64-linux = "sha256-5CCcWiZN1lVoiiSEO1OvxLcuKhSOIQrD5GH1TYr7XIY=";
        }
        .${system} or throwSystem;
    };
@@ -167,6 +168,7 @@ let
      libgcrypt
      libgpg-error
      libjpeg8
+      libmanette
      libopus
      libpng
      libsoup_3
@@ -204,7 +206,7 @@ let
    inherit (download) url stripRoot;
    hash =
      {
-        aarch64-darwin = "sha256-ARcl9y1PD+rzxUipixxGvsII2ah8vsDozAUHI0dSgA8=";
+        aarch64-darwin = "sha256-EjI0TdmQfB2qT2bBtbJFpsa+bplkJ5YyyVxNoOgsnZc=";
      }
      .${system} or throwSystem;
  };
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -1522,8 +1522,8 @@ let
            ACPI_HOTPLUG_CPU = yes;
            ACPI_HOTPLUG_MEMORY = yes;
            MEMORY_HOTPLUG = yes;
-            MEMORY_HOTPLUG_DEFAULT_ONLINE = whenOlder "6.14" yes;
-            MHP_DEFAULT_ONLINE_TYPE_ONLINE_AUTO = whenAtLeast "6.14" yes;
+            MEMORY_HOTPLUG_DEFAULT_ONLINE = whenOlder "6.12" yes;
+            MHP_DEFAULT_ONLINE_TYPE_ONLINE_AUTO = whenAtLeast "6.12" yes;
            MEMORY_HOTREMOVE = lib.mkIf (
              with stdenv.hostPlatform;
              isLoongArch64
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5258,6 +5258,8 @@ self: super: with self; {

  dsnap = callPackage ../development/python-modules/dsnap { };

+  dspy = callPackage ../development/python-modules/dspy { };
+
  dt8852 = callPackage ../development/python-modules/dt8852 { };

  dtfabric = callPackage ../development/python-modules/dtfabric { };