From f5ac7ff9264396825156867c52ab22bd5d8c92d3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jos=C3=A9=20Luis=20Lafuente?= <jl@lafuente.dev>
Date: Wed, 17 Jun 2026 14:11:51 +0200
Subject: [PATCH 01/59] fetchYarnDeps: make registry URL configurable

---
 .../javascript.section.md                     | 23 ++++++++++
 doc/redirects.json                            |  3 ++
 .../node/fetch-yarn-deps/default.nix          |  6 ++-
 .../node/fetch-yarn-deps/index.js             | 45 +++++++++++++------
 .../node/fetch-yarn-deps/tests/default.nix    |  5 +++
 5 files changed, 67 insertions(+), 15 deletions(-)

diff --git a/doc/languages-frameworks/javascript.section.md b/doc/languages-frameworks/javascript.section.md
index 7bf9ad661b55..10d17618680b 100644
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@@ -580,6 +580,29 @@ stdenv.mkDerivation (finalAttrs: {
 })
 ```
 
+##### `fetchYarnDeps` arguments {#javascript-fetchyarndeps}
+
+`fetchYarnDeps` accepts the following arguments:
+
+- `yarnLock`: Path to the `yarn.lock` file to fetch dependencies for.
+- `hash` (or `sha256`): The output hash of the offline cache.
+- `mirrorUrl`: Optional registry mirror URL used in place of the default yarn
+  registry (`https://registry.yarnpkg.com/`). When set, any resolved URL
+  pointing at the default registry is rewritten to use this mirror before
+  downloading. This is useful for pointing at a local or internal registry
+  mirror. Note that changing the mirror does not change the output hash, since
+  the downloaded contents are identical.
+
+```nix
+{
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = finalAttrs.src + "/yarn.lock";
+    mirrorUrl = "https://registry.npmmirror.com/";
+    hash = "sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
+  };
+}
+```
+
 ##### `yarnConfigHook` arguments {#javascript-yarnconfighook}
 
 By default, `yarnConfigHook` relies upon the attribute `${yarnOfflineCache}` (or `${offlineCache}` if the former is not set) to find the location of the offline cache produced by `fetchYarnDeps`. To disable this phase, you can set `dontYarnInstallDeps = true` or override the `configurePhase`.
diff --git a/doc/redirects.json b/doc/redirects.json
index d21aa2dde8d0..5244290fe52c 100644
--- a/doc/redirects.json
+++ b/doc/redirects.json
@@ -3804,6 +3804,9 @@
   "javascript-yarn-v3-v4": [
     "index.html#javascript-yarn-v3-v4"
   ],
+  "javascript-fetchyarndeps": [
+    "index.html#javascript-fetchyarndeps"
+  ],
   "javascript-yarnconfighook": [
     "index.html#javascript-yarnconfighook"
   ],
diff --git a/pkgs/build-support/node/fetch-yarn-deps/default.nix b/pkgs/build-support/node/fetch-yarn-deps/default.nix
index 19b7eeaee7a5..1508130fc833 100644
--- a/pkgs/build-support/node/fetch-yarn-deps/default.nix
+++ b/pkgs/build-support/node/fetch-yarn-deps/default.nix
@@ -104,6 +104,7 @@ in
           src ? null,
           hash ? "",
           sha256 ? "",
+          mirrorUrl ? null,
           ...
         }@args:
         let
@@ -146,7 +147,9 @@ in
 
               yarnLock=''${yarnLock:=$PWD/yarn.lock}
               mkdir -p $out
-              (cd $out; prefetch-yarn-deps --verbose --builder $yarnLock)
+              (cd $out; prefetch-yarn-deps --verbose --builder $yarnLock ${
+                lib.optionalString (mirrorUrl != null) "--mirrorUrl ${lib.escapeShellArg mirrorUrl}"
+              })
 
               runHook postBuild
             '';
@@ -159,6 +162,7 @@ in
               "name"
               "hash"
               "sha256"
+              "mirrorUrl"
             ]
             ++ (lib.optional (src == null) "src")
           ))
diff --git a/pkgs/build-support/node/fetch-yarn-deps/index.js b/pkgs/build-support/node/fetch-yarn-deps/index.js
index 1799fbc71d68..4b0fca4d37b3 100755
--- a/pkgs/build-support/node/fetch-yarn-deps/index.js
+++ b/pkgs/build-support/node/fetch-yarn-deps/index.js
@@ -21,15 +21,27 @@ const exec = async (...args) => {
   return res
 }
 
-const downloadFileHttps = (fileName, url, expectedHash, verbose, hashType = 'sha1') => {
+const yarnRegistryUrl = 'https://registry.yarnpkg.com/';
+
+function ensureTrailingSlash(str) {
+  return str.endsWith('/') ? str : str + '/';
+}
+
+const downloadFileHttps = (fileName, url, expectedHash, verbose, hashType = 'sha1', mirrorRegistryUrl = null) => {
+
+  const registryUrl =
+    mirrorRegistryUrl && url.startsWith(yarnRegistryUrl)
+      ? url.replace(yarnRegistryUrl, ensureTrailingSlash(mirrorRegistryUrl))
+      : url;
+
   return new Promise((resolve, reject) => {
-    const get = (url, redirects = 0) => https.get(url, (res) => {
+    const get = (registryUrl, redirects = 0) => https.get(registryUrl, (res) => {
       if(redirects > 10) {
         reject('Too many redirects!');
         return;
       }
       if(res.statusCode === 301 || res.statusCode === 302) {
-        const location = new URL(res.headers.location, url);
+        const location = new URL(res.headers.location, registryUrl);
         if (verbose) console.log('following redirect to ' + location);
         return get(location, redirects + 1);
       }
@@ -41,13 +53,13 @@ const downloadFileHttps = (fileName, url, expectedHash, verbose, hashType = 'sha
         file.close()
         const h = hash.read()
         if (expectedHash === undefined){
-          console.log(`Warning: lockfile url ${url} doesn't end in "#<hash>" to validate against. Downloaded file had hash ${h}.`);
-        } else if (h != expectedHash) return reject(new Error(`hash mismatch, expected ${expectedHash}, got ${h} for ${url}`))
+          console.log(`Warning: lockfile url ${registryUrl} doesn't end in "#<hash>" to validate against. Downloaded file had hash ${h}.`);
+        } else if (h != expectedHash) return reject(new Error(`hash mismatch, expected ${expectedHash}, got ${h} for ${registryUrl}`))
         resolve()
       })
       res.on('error', e => reject(e))
     })
-    get(url)
+    get(registryUrl)
   })
 }
 
@@ -90,7 +102,7 @@ const isGitUrl = pattern => {
   return false
 }
 
-const downloadPkg = (pkg, verbose) => {
+const downloadPkg = (pkg, verbose, mirrorUrl = null) => {
   for (let marker of ['@file:', '@link:']) {
     const split = pkg.key.split(marker)
     if (split.length == 2) {
@@ -122,9 +134,9 @@ const downloadPkg = (pkg, verbose) => {
   } else if (url.startsWith('https://')) {
     if (typeof pkg.integrity === 'string' || pkg.integrity instanceof String) {
       const [ type, checksum ] = pkg.integrity.split('-')
-      return downloadFileHttps(fileName, url, Buffer.from(checksum, 'base64').toString('hex'), verbose, type)
+      return downloadFileHttps(fileName, url, Buffer.from(checksum, 'base64').toString('hex'), verbose, type, mirrorUrl)
     }
-    return downloadFileHttps(fileName, url, hash, verbose)
+    return downloadFileHttps(fileName, url, hash, verbose, 'sha1', mirrorUrl)
   } else if (url.startsWith('file:')) {
     console.warn(`ignoring unsupported file:path url "${url}"`)
   } else {
@@ -155,11 +167,11 @@ const uniqueBy = (arr, callback) => {
   return [...map.values()]
 }
 
-const prefetchYarnDeps = async (lockContents, verbose) => {
+const prefetchYarnDeps = async (lockContents, verbose, mirrorUrl) => {
   const lockData = lockfile.parse(lockContents)
   await performParallel(
     uniqueBy(Object.entries(lockData.object), ([_, value]) => value.resolved)
-    .map(([key, value]) => () => downloadPkg({ key, ...value }, verbose))
+    .map(([key, value]) => () => downloadPkg({ key, ...value }, verbose, mirrorUrl))
   )
   await fs.promises.writeFile('yarn.lock', lockContents)
   if (verbose) console.log('Done')
@@ -173,18 +185,23 @@ Options:
   -h --help         Show this help
   -v --verbose      Verbose output
   --builder         Only perform the download to current directory, then exit
+  --mirrorUrl <url> Use the given registry mirror URL in place of the default
+                    yarn registry (${yarnRegistryUrl})
 `)
   process.exit(1)
 }
 
 const main = async () => {
   const args = process.argv.slice(2)
-  let next, lockFile, verbose, isBuilder
+  let next, lockFile, verbose, isBuilder, mirrorUrl
   while (next = args.shift()) {
     if (next == '--builder') {
       isBuilder = true
     } else if (next == '--verbose' || next == '-v') {
       verbose = true
+    } else if (next == '--mirrorUrl') {
+      mirrorUrl = args.shift()
+      if (!mirrorUrl) showUsage()
     } else if (next == '--help' || next == '-h') {
       showUsage()
     } else if (!lockFile) {
@@ -201,13 +218,13 @@ const main = async () => {
   }
 
   if (isBuilder) {
-    await prefetchYarnDeps(lockContents, verbose)
+    await prefetchYarnDeps(lockContents, verbose, mirrorUrl)
   } else {
     const { stdout: tmpDir } = await exec('mktemp', [ '-d' ])
 
     try {
       process.chdir(tmpDir.trim())
-      await prefetchYarnDeps(lockContents, verbose)
+      await prefetchYarnDeps(lockContents, verbose, mirrorUrl)
       const { stdout: hash } = await exec('nix-hash', [ '--type', 'sha256', '--base32', tmpDir.trim() ])
       console.log(hash)
     } finally {
diff --git a/pkgs/build-support/node/fetch-yarn-deps/tests/default.nix b/pkgs/build-support/node/fetch-yarn-deps/tests/default.nix
index 2d563dac87dc..3f7b76ec4f84 100644
--- a/pkgs/build-support/node/fetch-yarn-deps/tests/default.nix
+++ b/pkgs/build-support/node/fetch-yarn-deps/tests/default.nix
@@ -9,6 +9,11 @@
     yarnLock = ./simple.lock;
     sha256 = "sha256-FRrt8BixleILmFB2ZV8RgPNLqgS+dlH5nWoPgeaaNQ8=";
   };
+  mirrorUrl = testers.invalidateFetcherByDrvHash fetchYarnDeps {
+    yarnLock = ./simple.lock;
+    mirrorUrl = "https://registry.npmjs.com/";
+    sha256 = "sha256-FRrt8BixleILmFB2ZV8RgPNLqgS+dlH5nWoPgeaaNQ8=";
+  };
   gitDep = testers.invalidateFetcherByDrvHash fetchYarnDeps {
     yarnLock = ./git.lock;
     sha256 = "sha256-f90IiEzHDiBdswWewRBHcJfqqpPipaMg8N0DVLq2e8Q=";

From 23f3cee192aedcffe35e3513df0191f5e0f97108 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 31 Jul 2026 06:15:33 +0000
Subject: [PATCH 02/59] goss: 0.4.9 -> 0.4.10

---
 pkgs/by-name/go/goss/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/go/goss/package.nix b/pkgs/by-name/go/goss/package.nix
index 5264b17d8603..5f4cbd5496b0 100644
--- a/pkgs/by-name/go/goss/package.nix
+++ b/pkgs/by-name/go/goss/package.nix
@@ -15,16 +15,16 @@
 
 buildGoModule rec {
   pname = "goss";
-  version = "0.4.9";
+  version = "0.4.10";
 
   src = fetchFromGitHub {
     owner = "goss-org";
     repo = "goss";
     tag = "v${version}";
-    hash = "sha256-GdkLasokpWegjK4kZzAskp1NGwcuMjrjjau75cEo8kg=";
+    hash = "sha256-4DCPPeTL2x6mMpcP/cdyQWpqehGWkk7MWM7P93WzwCA=";
   };
 
-  vendorHash = "sha256-Rf6Xt54y1BN2o90rDW0WvEm4H5pPfsZ786MXFjsAFaM=";
+  vendorHash = "sha256-NlOS5APp9R45QpYKwP673pmN7CR+Ufz8LxWyMkrVeq0=";
 
   env.CGO_ENABLED = 0;
 

From 928b7bc0fba80dbd62de938df21567ff560092db Mon Sep 17 00:00:00 2001
From: sollniss <sollniss@web.de>
Date: Thu, 3 Sep 2026 22:22:00 +0900
Subject: [PATCH 03/59] wrapGNUstepAppsHook: keep build-only inputs out of
 GNUstep.conf

gnustep-make's environment hook accumulates the NIX_GNUSTEP_* search paths
from every package in the build environment. Without strictDeps that also
covers the native build inputs, so the compiler wrapper, pkg-config and
patchelf ended up in the installed config file and became runtime
references of every package using this hook.

Restrict the generated config to this derivation's outputs and its runtime
dependencies, and stop writing NIX_GNUSTEP_SYSTEM_HEADERS, which only pulls
in -dev outputs: gnustep-base parses the key but never uses it in any
NSSearchPathForDirectoriesInDomains branch.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../wrapGNUstepAppsHook.sh                    | 52 +++++++++++++++----
 1 file changed, 42 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/wr/wrapGNUstepAppsHook/wrapGNUstepAppsHook.sh b/pkgs/by-name/wr/wrapGNUstepAppsHook/wrapGNUstepAppsHook.sh
index 8218ff1e7746..6c5dfbcaef26 100644
--- a/pkgs/by-name/wr/wrapGNUstepAppsHook/wrapGNUstepAppsHook.sh
+++ b/pkgs/by-name/wr/wrapGNUstepAppsHook/wrapGNUstepAppsHook.sh
@@ -4,6 +4,10 @@ if [[ -z "${__nix_wrapGNUstepAppsHook-}" ]]; then
     # Inherit arguments given in mkDerivation
     gnustepWrapperArgs=(${gnustepWrapperArgs-})
 
+    # NIX_GNUSTEP_SYSTEM_HEADERS is deliberately missing here: it only matters
+    # while compiling and gnustep-base ignores it at run time, so writing it
+    # into the installed config file would only pull the -dev outputs of every
+    # build input into the runtime closure.
     gnustepConfigVars+=(
         GNUSTEP_MAKEFILES
         NIX_GNUSTEP_SYSTEM_APPS
@@ -12,7 +16,6 @@ if [[ -z "${__nix_wrapGNUstepAppsHook-}" ]]; then
         NIX_GNUSTEP_SYSTEM_TOOLS
         NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS
         NIX_GNUSTEP_SYSTEM_LIBRARY
-        NIX_GNUSTEP_SYSTEM_HEADERS
         NIX_GNUSTEP_SYSTEM_LIBRARIES
         NIX_GNUSTEP_SYSTEM_DOC
         NIX_GNUSTEP_SYSTEM_DOC_MAN
@@ -38,30 +41,59 @@ if [[ -z "${__nix_wrapGNUstepAppsHook-}" ]]; then
             fi
         }
 
-        gsAddToIncludeSearchPath() {
-            local -n ref="$1"
+        # Without strictDeps, gnustep-make's environment hook also picks up
+        # native build inputs, so the NIX_GNUSTEP_* paths include the compiler
+        # wrapper and friends. Keeping those in the installed config file would
+        # make the whole toolchain a runtime dependency (~1.6 GB).
+        gsDropBuildOnlyPaths() {
+            local -n pathsRef="$1"
+            local -a kept=()
+            local entry prefix
+            local IFS=:
 
-            if [[ -d "$2" && "${ref-}" != *"$2"* ]]; then
-                if [[ "${ref-}" != "" ]]; then
-                    ref+=" "
-                fi
+            for entry in ${pathsRef-}; do
+                for prefix in "${gnustepRuntimePrefixes[@]}"; do
+                    if [[ "$entry" =~ ^"$prefix"(/|$) ]]; then
+                        kept+=("$entry")
+                        break
+                    fi
+                done
+            done
 
-                ref+="$2"
-            fi
+            pathsRef="${kept[*]}"
         }
 
+        gnustepRuntimePrefixes=()
+
+        for output in ${outputs:-out}; do
+            gnustepRuntimePrefixes+=("${!output}")
+        done
+
+        for pkg in \
+            ${pkgsHostHost+"${pkgsHostHost[@]}"} \
+            ${pkgsHostTarget+"${pkgsHostTarget[@]}"}
+        do
+            gnustepRuntimePrefixes+=("$pkg")
+        done
+
         gsAddToSearchPath NIX_GNUSTEP_SYSTEM_APPS "$out/lib/GNUstep/Applications"
         gsAddToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_APPS "$out/lib/GNUstep/Applications"
         gsAddToSearchPath NIX_GNUSTEP_SYSTEM_WEB_APPS "$out/lib/GNUstep/WebApplications"
         gsAddToSearchPath NIX_GNUSTEP_SYSTEM_TOOLS "$out/bin"
         gsAddToSearchPath NIX_GNUSTEP_SYSTEM_ADMIN_TOOLS "$out/sbin"
         gsAddToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARY "$out/lib/GNUstep"
-        gsAddToIncludeSearchPath NIX_GNUSTEP_SYSTEM_HEADERS "$out/include"
         gsAddToSearchPath NIX_GNUSTEP_SYSTEM_LIBRARIES "$out/lib"
         gsAddToSearchPath NIX_GNUSTEP_SYSTEM_DOC "$out/share/GNUstep/Documentation"
         gsAddToSearchPath NIX_GNUSTEP_SYSTEM_DOC_MAN "$out/share/man"
         gsAddToSearchPath NIX_GNUSTEP_SYSTEM_DOC_INFO "$out/share/info"
 
+        for var in "${gnustepConfigVars[@]}"; do
+            # GNUSTEP_MAKEFILES is a single path pointing at gnustep-make
+            # rather than a search path assembled from the build environment.
+            [[ "$var" == NIX_GNUSTEP_* ]] || continue
+            gsDropBuildOnlyPaths "$var"
+        done
+
         for var in "${gnustepConfigVars[@]}"; do
             if [[ -n "${!var-}" ]]; then
                 printf '%s="%s"\n' "$var" "${!var}"

From dd516856e6481a687fe9aaf049f051513d191be5 Mon Sep 17 00:00:00 2001
From: sollniss <sollniss@web.de>
Date: Thu, 3 Sep 2026 22:22:17 +0900
Subject: [PATCH 04/59] sope: don't embed the compile command line in installed
 binaries

general.make builds with -frecord-gcc-switches, which makes clang store the
full command line in a .GCC.command.line ELF section. strip -S does not
remove that section, so the store paths of clang, llvm and gcc stayed as
runtime references.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 pkgs/by-name/so/sope/package.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/by-name/so/sope/package.nix b/pkgs/by-name/so/sope/package.nix
index 652003a12876..e8765ddaa781 100644
--- a/pkgs/by-name/so/sope/package.nix
+++ b/pkgs/by-name/so/sope/package.nix
@@ -23,6 +23,14 @@ clangStdenv.mkDerivation rec {
     hash = "sha256-0G28qDXygDe/TJ2znNE+NVQry3bkqUO59jqtJm/t2S4=";
   };
 
+  postPatch = ''
+    # Don't record the compile command line in .GCC.command.line sections of
+    # the installed binaries: it embeds the store paths of the whole toolchain
+    # and turns clang, llvm and gcc into runtime dependencies.
+    substituteInPlace general.make \
+      --replace-fail ' $(call cc-option,-frecord-gcc-switches)' ""
+  '';
+
   nativeBuildInputs = lib.optional (libpq != null) libpq.pg_config;
   buildInputs = [
     gnustep-base

From 86922aed38d27988ccd43389690e797feff82661 Mon Sep 17 00:00:00 2001
From: sollniss <sollniss@web.de>
Date: Thu, 3 Sep 2026 22:22:18 +0900
Subject: [PATCH 05/59] sogo: don't embed the compile command line in installed
 binaries

Same .GCC.command.line issue as sope: -frecord-gcc-switches from
general.make kept clang, llvm, gcc and gnustep-base's dev output in the
runtime closure.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 pkgs/by-name/so/sogo/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/so/sogo/package.nix b/pkgs/by-name/so/sogo/package.nix
index 366371d0e079..82447f6f940d 100644
--- a/pkgs/by-name/so/sogo/package.nix
+++ b/pkgs/by-name/so/sogo/package.nix
@@ -58,6 +58,12 @@ clangStdenv.mkDerivation rec {
   patches = lib.optional enableActiveSync ./enable-activesync.patch;
 
   postPatch = ''
+    # Don't record the compile command line in .GCC.command.line sections of
+    # the installed binaries: it embeds the store paths of the whole toolchain
+    # and turns clang, llvm and gcc into runtime dependencies.
+    substituteInPlace general.make \
+      --replace-fail ' $(call cc-option,-frecord-gcc-switches)' ""
+
     # Exclude NIX_ variables
     sed -i 's/grep GNUSTEP_/grep ^GNUSTEP_/g' configure
 

From bff137ddc7b813c57d1d4cb764aab92aae9d5c00 Mon Sep 17 00:00:00 2001
From: whoomee <git@miglix.eu>
Date: Fri, 4 Sep 2026 23:09:53 +0200
Subject: [PATCH 06/59] prometheus: use nix-update-script

---
 pkgs/by-name/pr/prometheus/package.nix | 19 ++++--
 pkgs/by-name/pr/prometheus/source.nix  |  6 --
 pkgs/by-name/pr/prometheus/update.sh   | 88 --------------------------
 3 files changed, 12 insertions(+), 101 deletions(-)
 delete mode 100644 pkgs/by-name/pr/prometheus/source.nix
 delete mode 100755 pkgs/by-name/pr/prometheus/update.sh

diff --git a/pkgs/by-name/pr/prometheus/package.nix b/pkgs/by-name/pr/prometheus/package.nix
index e015a7ba9c2a..0bbebfb81ba6 100644
--- a/pkgs/by-name/pr/prometheus/package.nix
+++ b/pkgs/by-name/pr/prometheus/package.nix
@@ -1,6 +1,7 @@
 {
   stdenv,
   lib,
+  nix-update-script,
   go,
   buildGoModule,
   nodejs,
@@ -37,9 +38,7 @@
 }:
 
 let
-  source = import ./source.nix;
-
-  inherit (source) version vendorHash;
+  version = "3.14.0";
 
   pname = "prometheus";
 
@@ -47,7 +46,7 @@ let
     owner = "prometheus";
     repo = "prometheus";
     tag = "v${version}";
-    hash = source.hash;
+    hash = "sha256-7PSfh+KWUpmL3BZ7INa1DOZ/ysaXXdWG9n/F+H0cGYo=";
   };
 
   assets = stdenv.mkDerivation (finalAssetsAttrs: {
@@ -66,7 +65,7 @@ let
       inherit (finalAssetsAttrs) pname version src;
       pnpm = pnpm_11;
       fetcherVersion = 4;
-      hash = source.pnpmDepsHash;
+      hash = "sha256-lmKUkeDdinb6WlnZSx3FnBlF/ACgUmvSMpYo84tRdCw=";
     };
 
     nativeBuildInputs = [
@@ -111,10 +110,11 @@ buildGoModule (finalAttrs: {
   inherit
     pname
     version
-    vendorHash
     src
     ;
 
+  vendorHash = "sha256-sCgxO2/w3Bi6Ncs/Q+JVZVtQC448FEx3llYxe/UxWEE=";
+
   proxyVendor = true;
 
   outputs = [
@@ -234,7 +234,12 @@ buildGoModule (finalAttrs: {
   passthru = {
     inherit assets;
     tests = { inherit (nixosTests) prometheus; };
-    updateScript = ./update.sh;
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--subpackage"
+        "assets"
+      ];
+    };
   };
 
   meta = {
diff --git a/pkgs/by-name/pr/prometheus/source.nix b/pkgs/by-name/pr/prometheus/source.nix
deleted file mode 100644
index 32703128ddba..000000000000
--- a/pkgs/by-name/pr/prometheus/source.nix
+++ /dev/null
@@ -1,6 +0,0 @@
-{
-  version = "3.14.0";
-  hash = "sha256-7PSfh+KWUpmL3BZ7INa1DOZ/ysaXXdWG9n/F+H0cGYo=";
-  pnpmDepsHash = "sha256-lmKUkeDdinb6WlnZSx3FnBlF/ACgUmvSMpYo84tRdCw=";
-  vendorHash = "sha256-sCgxO2/w3Bi6Ncs/Q+JVZVtQC448FEx3llYxe/UxWEE=";
-}
diff --git a/pkgs/by-name/pr/prometheus/update.sh b/pkgs/by-name/pr/prometheus/update.sh
deleted file mode 100755
index 489a092aac61..000000000000
--- a/pkgs/by-name/pr/prometheus/update.sh
+++ /dev/null
@@ -1,88 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p nix coreutils curl jq nix-prefetch-git
-
-set -euo pipefail
-
-OWNER=prometheus
-REPO=prometheus
-
-# Current version.
-LATEST_NIXPKGS_VERSION=$(nix eval --raw .#prometheus.version 2>/dev/null)
-UPDATE_NIX_OLD_VERSION=${UPDATE_NIX_OLD_VERSION:-$LATEST_NIXPKGS_VERSION}
-
-TARGET_TAG="$(curl -L -s ${GITHUB_TOKEN:+-u ":${GITHUB_TOKEN}"} "https://api.github.com/repos/$OWNER/$REPO/releases/latest" | jq -r '.tag_name')"
-TARGET_VERSION="$(echo "$TARGET_TAG" | sed -e 's/^v//')"
-
-if [[ "$UPDATE_NIX_OLD_VERSION" == "$TARGET_VERSION" ]]; then
-    # prometheus is up-to-date
-    if [[ -n "$UPDATE_NIX_ATTR_PATH" ]]; then
-        echo "[{}]";
-    fi
-
-    exit 0
-fi
-
-FAKE_HASH="sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=";
-
-extractHash() {
-    attr="${1?attr missing}"
-    result="$(nix-build -A "$attr" 2>&1 | tail -n3 | grep 'got:' | cut -d: -f2- | xargs echo || true)"
-    [ -z "$result" ] && { echo "$FAKE_HASH"; } || { echo "$result"; }
-}
-
-TMP=$(mktemp -d)
-trap 'rm -rf "$TMP"' EXIT
-
-NIXPKGS_PROMETHEUS_PATH=$(cd $(dirname ${BASH_SOURCE[0]}); pwd -P)/
-SOURCE_NIX="$NIXPKGS_PROMETHEUS_PATH/source.nix"
-
-PREFETCH_JSON=$TMP/prefetch.json
-nix-prefetch-git --rev "$TARGET_TAG" --url "https://github.com/$OWNER/$REPO" > "$PREFETCH_JSON"
-PREFETCH_HASH="$(jq '.hash' -r < "$PREFETCH_JSON")"
-
-cat > "$SOURCE_NIX" <<-EOF
-{
-  version = "$TARGET_VERSION";
-  hash = "$PREFETCH_HASH";
-  pnpmDepsHash = "$FAKE_HASH";
-  vendorHash = "$FAKE_HASH";
-}
-EOF
-
-# Resolve pnpm hash first: the Go integration pulls in the assets, so a fake
-# pnpmDepsHash makes that stage fail.
-PNPM_DEPS_HASH=$(extractHash prometheus.assets.pnpmDeps)
-
-cat > "$SOURCE_NIX" <<-EOF
-{
-  version = "$TARGET_VERSION";
-  hash = "$PREFETCH_HASH";
-  pnpmDepsHash = "$PNPM_DEPS_HASH";
-  vendorHash = "$FAKE_HASH";
-}
-EOF
-
-# Now do the Go module fetch.
-VENDOR_HASH=$(extractHash prometheus.goModules)
-
-cat > "$SOURCE_NIX" <<-EOF
-{
-  version = "$TARGET_VERSION";
-  hash = "$PREFETCH_HASH";
-  pnpmDepsHash = "$PNPM_DEPS_HASH";
-  vendorHash = "$VENDOR_HASH";
-}
-EOF
-
-if [[ -z "$UPDATE_NIX_ATTR_PATH" ]]; then
-    exit 0
-fi
-
-cat <<-EOF
-[{
-  "attrPath": "$UPDATE_NIX_ATTR_PATH",
-  "oldVersion": "$UPDATE_NIX_OLD_VERSION",
-  "newVersion": "$TARGET_VERSION",
-  "files": ["$SOURCE_NIX"]
-}]
-EOF

From 467d52896947cb37996f4fe14f297328f448c68a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 11 Sep 2026 00:52:29 +0000
Subject: [PATCH 07/59] gimp: 3.2.4 -> 3.2.6

---
 pkgs/applications/graphics/gimp/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/graphics/gimp/default.nix b/pkgs/applications/graphics/gimp/default.nix
index 4a0ef5e72bb8..621c465883c1 100644
--- a/pkgs/applications/graphics/gimp/default.nix
+++ b/pkgs/applications/graphics/gimp/default.nix
@@ -83,7 +83,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gimp";
-  version = "3.2.4";
+  version = "3.2.6";
 
   outputs = [
     "out"
@@ -94,7 +94,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://download.gimp.org/gimp/v${lib.versions.majorMinor finalAttrs.version}/gimp-${finalAttrs.version}.tar.xz";
-    hash = "sha256-cxK8U+nG0tAFbKe5PxxrmHB5Rt2TT3FMIbh0bstgFYg=";
+    hash = "sha256-QLFekK0MDGMbdto8Rn6phH+lwk83QTrFtJKASGCijNg=";
   };
 
   patches = [

From d3b8be81a8fcaebaea0f4bd98698102f7fea545f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 11 Sep 2026 00:54:34 +0000
Subject: [PATCH 08/59] linuxPackages.bpftrace: 0.26.1 -> 0.27.0

---
 pkgs/by-name/bp/bpftrace/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/bp/bpftrace/package.nix b/pkgs/by-name/bp/bpftrace/package.nix
index 431991c2e6ae..5ffb0bd331a4 100644
--- a/pkgs/by-name/bp/bpftrace/package.nix
+++ b/pkgs/by-name/bp/bpftrace/package.nix
@@ -23,13 +23,13 @@
 
 stdenv.mkDerivation rec {
   pname = "bpftrace";
-  version = "0.26.1";
+  version = "0.27.0";
 
   src = fetchFromGitHub {
     owner = "bpftrace";
     repo = "bpftrace";
     rev = "v${version}";
-    hash = "sha256-h3gFnQq48oM5uK07xrykOCSJxhr6dqcyVUDoIKIRREY=";
+    hash = "sha256-wYDSx2WngWS4Ucj82hLO0G46tiXhqskhMjmv7NuUVfw=";
   };
 
   buildInputs = with llvmPackages; [

From d7c40e83efd148f83413d9e6ed4abd674d95a857 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 11 Sep 2026 11:50:36 +0000
Subject: [PATCH 09/59] ocamlPackages.bstr: 0.0.4 -> 0.1.1

---
 pkgs/development/ocaml-modules/bstr/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/ocaml-modules/bstr/default.nix b/pkgs/development/ocaml-modules/bstr/default.nix
index 9ec7bb335456..bc87bea2b38a 100644
--- a/pkgs/development/ocaml-modules/bstr/default.nix
+++ b/pkgs/development/ocaml-modules/bstr/default.nix
@@ -6,13 +6,13 @@
 
 buildDunePackage (finalAttrs: {
   pname = "bstr";
-  version = "0.0.4";
+  version = "0.1.1";
 
   minimalOCamlVersion = "4.13";
 
   src = fetchurl {
     url = "https://github.com/robur-coop/bstr/releases/download/v${finalAttrs.version}/bstr-${finalAttrs.version}.tbz";
-    hash = "sha256-ZAg28VstVVvfI2b213g5JuEVmK1+lFV7Fnx4WyVfSFY=";
+    hash = "sha256-5lfP/aVpELFLmMdt1uA4LqS8XQFn6IORq6kxlrAW7uA=";
   };
 
   meta = {

From 50ba83bd2de73fb0dbb3b946eb14fbeaccaeded3 Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Sun, 13 Sep 2026 14:12:29 +0700
Subject: [PATCH 10/59] nixosTests.redis: drop version suffix from test name

---
 nixos/tests/redis.nix | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/nixos/tests/redis.nix b/nixos/tests/redis.nix
index f0f0e790b731..c0903f3837ff 100644
--- a/nixos/tests/redis.nix
+++ b/nixos/tests/redis.nix
@@ -4,12 +4,8 @@
   package,
   ...
 }:
-let
-  mkTestName =
-    pkg: "${pkg.pname}_${builtins.replaceStrings [ "." ] [ "" ] (lib.versions.majorMinor pkg.version)}";
-in
 {
-  name = mkTestName package;
+  name = package.pname;
   meta.maintainers = lib.teams.redis.members;
 
   nodes = {

From 405a54987e365d47bd23a89d1b0947c94b9673d2 Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Sun, 13 Sep 2026 14:12:30 +0700
Subject: [PATCH 11/59] valkey: rename passthru test attribute to valkey

---
 pkgs/by-name/va/valkey/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/va/valkey/package.nix b/pkgs/by-name/va/valkey/package.nix
index 2ebe9558beb6..b6cfce9139d4 100644
--- a/pkgs/by-name/va/valkey/package.nix
+++ b/pkgs/by-name/va/valkey/package.nix
@@ -112,7 +112,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   passthru = {
     tests = {
-      redis = nixosTests.valkey;
+      valkey = nixosTests.valkey;
       unitTests = finalAttrs.finalPackage.overrideAttrs { doCheck = true; };
       valkey-python = python3Packages.valkey;
     };

From 8b9a673c1c8d62d8363d7dd7d7691f92ede3c3fb Mon Sep 17 00:00:00 2001
From: BeLeap <beleap@beleap.dev>
Date: Sun, 13 Sep 2026 22:34:31 +0900
Subject: [PATCH 12/59] joplin-desktop: 3.6.16 -> 3.7.18

Update release data with update.py.

Assisted-by: pi 0.85.1 (openai-codex model)
---
 .../jo/joplin-desktop/missing-hashes.json     | 61 ++++++++++---------
 .../jo/joplin-desktop/release-data.json       |  6 +-
 2 files changed, 35 insertions(+), 32 deletions(-)

diff --git a/pkgs/by-name/jo/joplin-desktop/missing-hashes.json b/pkgs/by-name/jo/joplin-desktop/missing-hashes.json
index 2206616fac77..785664d75360 100644
--- a/pkgs/by-name/jo/joplin-desktop/missing-hashes.json
+++ b/pkgs/by-name/jo/joplin-desktop/missing-hashes.json
@@ -1,55 +1,55 @@
 {
-  "@esbuild/aix-ppc64@npm:0.27.2": "9c18cc2e4a03339a55013aac05b4a3fc4b77e75715dc252d034aa3d43b754abc053a7601b95e31249f4b6e69b68db2f5e6cb04b0ed619f825f2f70daff1a78d7",
+  "@esbuild/aix-ppc64@npm:0.27.5": "48203e49df4995ab8ead9e8def96381931901db904cd174e5cdc9d034f70431276e8ed93305a13c22390041e6933ec19624435f6f7c34f8a767d5979c3c6e145",
   "@esbuild/aix-ppc64@npm:0.27.7": "848d1a798fb9ea6aa902c9138aaf6b45d889df39a1ff737300ea9968af3afee1000f611bc00187f5bda096d300fb25f4f883c57a2dc7296e40295f2470aa57b3",
-  "@esbuild/android-arm64@npm:0.27.2": "a318fc9ffcdad7fda8bb521af8b17f73d93d9a94b4cca9301fbf72cf3f5a6e945edd589a47388de70f3e9582655dcf5b5bb928a11e306368fae4a9106d5143d2",
+  "@esbuild/android-arm64@npm:0.27.5": "6cfcae790d0cec7a9bd29f539d05ad5a5715815177bb62231a95c3a8b2fb651b099e3eef76c6c0f174be83864b0a1b244474c071df36c028e407c2325015fa01",
   "@esbuild/android-arm64@npm:0.27.7": "21a57ee237e1503d92c2f818c1dbf7d6f772b100fd0dfa95ea0d24be718c0c6952e915ad1f47bcc3496bb807a0a254d35d6baadc48531b684d2236f57023f1e6",
-  "@esbuild/android-arm@npm:0.27.2": "01114275e096b9177ad2496730087ee081d6e65a75bc087457b527c5baac5a8ccb362435f45232532bf6f97de95e1790dbce127d55abd5e4152c7214682bf4d3",
+  "@esbuild/android-arm@npm:0.27.5": "4f856f7e508393c7e722e444b26a60f093ed4dfd11def0cbae13034e60dca6b356c302430a9230644f4ae2fd4e5a9ae620a4b69fa98a12062190195af2e57ec1",
   "@esbuild/android-arm@npm:0.27.7": "46a246245a024680c8b5051425fc724c846b7d36ac952cd312e71194bae07fd712aa6fa8ddd7fa648a18d665eb0bcfaf111726af7b676465cb181dff7e6a0848",
-  "@esbuild/android-x64@npm:0.27.2": "e92c5b6919081a14c8882f1167cf90b4e4bba745ad6e9a23428f85a1cd5e79dfa3f1d2fc943686b237e4cd09fac52ad3b3791deab6a0419ee10859284d3834aa",
+  "@esbuild/android-x64@npm:0.27.5": "116456a795deccd12917aa61599c5f0278b2399c7c936dd92b667a53f45f695ac316c61b1b3929c1dde177cee447b2cd5c6b16283aaec1fc80d317ef414a0442",
   "@esbuild/android-x64@npm:0.27.7": "95c858fe95b716aabcb71a0dab9162d46859c0deb713189730ce6c2a2bc27efed2341b2d27aacc092dee7544df7b25035a12d65f30481b5b03a8358707e1a6f3",
-  "@esbuild/darwin-arm64@npm:0.27.2": "5e99db5037167bad4a095fc445b94a2ce02357870ed58b79e13ae6bc09b5cb33d7e03f925492df940f9e0ad685a889f02beec1431d8fbf4c7ced55b2f48f5659",
+  "@esbuild/darwin-arm64@npm:0.27.5": "09b3f3f85eb4cdc3f00582b360be6f904b27d62f390f25815e6a27843bdfd9f087372ddb0718c1010078b34e96df68d115ce562891121684dc28fedcc22cdac5",
   "@esbuild/darwin-arm64@npm:0.27.7": "281897d55b71e222394f08ee519999f673778c26ac78e4dacc67262e449b9284e852dccac8d6293fd611e0a37d0c798f2ea18c65573ed251d5e04dcb01121f0d",
-  "@esbuild/darwin-x64@npm:0.27.2": "87f2fbc4cf11724ef805b17cbdc7b0a9498332bc4b61d55e110ecc3b09bc488b88c0bd140ea48924e9c97a2063cf7e440fef13dd56e415c46799619d61086910",
+  "@esbuild/darwin-x64@npm:0.27.5": "0a81d707bbc05a2b2f6ffc3e21f1596a7346c737b13cf789b59d7e86cb4d355ee6389f7ba2965da142ff40913dce986d5f2a8dfa6c940e704a017f418d9d7384",
   "@esbuild/darwin-x64@npm:0.27.7": "a6c320cda3c7c176d678c00367823259b7efc0f8638393bd0e45b4f950af15be887558c82e2d74ed9fb492a4b04f36afc1c3a3b9774aeaaa08fbf96aac6e3524",
-  "@esbuild/freebsd-arm64@npm:0.27.2": "1ffa23243b913e377a5b09fd97ad9f089be3695aafdd893b60bb7f9be479256d8b7546f0bc96c4e61133fe7aeeaf95a8e941e82a65d99008ff82c99bdec85eee",
+  "@esbuild/freebsd-arm64@npm:0.27.5": "fc705c9f299bef59a584f78a1ac8e686b3598639d8ad565170db7704d116665bfd7b0760c2d5901e363f972133a77e92bcf3ace16726b61540582a09c82ff284",
   "@esbuild/freebsd-arm64@npm:0.27.7": "8b546929340ebb3daf5b47ca24db6d6fdcf3c14a733c41ddd8ae960834a5aa60b22b341049aef39badfdfaad0081a8706d085ba892e2b23163d1d1ff52ca1dc3",
-  "@esbuild/freebsd-x64@npm:0.27.2": "44f744b289cf9e115b0adfac1905818d756dfced14213bf144d9016d96f67575ef2a55526f76e29ee775fcfec7274ba3a5e6833f35ed79a4592d3f5eac278267",
+  "@esbuild/freebsd-x64@npm:0.27.5": "bacab4f9d3e13eb9a2b0ad1403fb0a6d66d7bdd50e9209dff5c8d0d9151ad3dd64f6a709530858f1143ab30f89d508e3f29782219a23d258e455ed2dee360136",
   "@esbuild/freebsd-x64@npm:0.27.7": "5a4c0ccbde7fe7a6de14c8789d1f20f4cadc7980e531b090b137774b56f360ba3c50f5612f01980ab9071ae50e1bb007f44c1b04b68fd84ba07113472081e021",
-  "@esbuild/linux-arm64@npm:0.27.2": "2b037d74eaff4e9b5a6076760ede873320707636a3495939687cdd0c2c7150883111273bc0a8663fa305c42f439f4748b5ad7f15a1a1ea9fa7db575d9faf2d1b",
+  "@esbuild/linux-arm64@npm:0.27.5": "4acfebf0f43e9dadb2a29cf336562e711961c23fbb6f3fec754f8a2848a0c63022b58cdc95c667fe6f5dc7cf55824cf6bcc49f96b53f29e72da0bc97102b472a",
   "@esbuild/linux-arm64@npm:0.27.7": "741871bea9ce0a136367707cc509254fef167c5bf968706de6bff7db96ee7c672f02231cb69965e17ca0aedbd99d533275f5a695a3069cb3df0a9d2cd877847f",
-  "@esbuild/linux-arm@npm:0.27.2": "28cfc3a9ca11fc899649e7a706fb4b2ee57999bd92e86c23726b3ed0f832732411dd0aa3e2bcdb4105759f83bc4e5adc98dc195aaafce736c910db4e43694702",
+  "@esbuild/linux-arm@npm:0.27.5": "107786c947b02b6e7aca4f9ff3af8c14fe461f614f9c298d63b9474703ca7798d3650d52b6041412308eef46dc7215f56b4155391f9feb5b15b64718204f0009",
   "@esbuild/linux-arm@npm:0.27.7": "c2ee4ae5f6e13f8e882da4a369cc5d672ae8bf7613e35e22b54df3999e0d5aaef6d704c7dcbc473708eaeee202dd8e892c37e791bbc50a509b23ae845d18b689",
-  "@esbuild/linux-ia32@npm:0.27.2": "ac6cc92b9be2ec6d9d483c53fc973e6381765b784a2e1b71fa93ea0cf976344c2e3e0bfda0140b0829b3ec4304d9b886692b2891e68c17d2121066d06e67f0ac",
+  "@esbuild/linux-ia32@npm:0.27.5": "51c5322b4a834c3c8bc66d9503a8e2dfda4090aed848a533718773cece1b3a92fc10ab532bba81af1ce7eb7b3c244ef6aed2b59d480f32cf987d222e7c05950a",
   "@esbuild/linux-ia32@npm:0.27.7": "0933a68b0bdee3dd0fcd99da92c0472deb6d6225c454b88a3609e1b1ea7648b36f6b83be8a8cf41edc1f0d666b76006e270a66c7520050d278d7d73df171e86b",
-  "@esbuild/linux-loong64@npm:0.27.2": "625f5b6c2218a3acb2cff8f7f02a53ca89d13925f8932260ddad01595c6907beda4a79e4b767b1101f5971049f88d3ec6ab29cf565b4d61d9b0d7277e2cb578d",
+  "@esbuild/linux-loong64@npm:0.27.5": "92a0c8bfdf3214a485161184669adaa7dbd1d08fafb3bba50fd6dbd88b9a2e9c12705056e243e96a4eca3e8f0cdd65e5271261cb7f51429fd77d5dbc9fe49cbc",
   "@esbuild/linux-loong64@npm:0.27.7": "9609e94b603a8a68bcd60325626d0bd35cce37e75994729d4ea264fa865db201da64c3216004656d94b1edeb8587150b1c47a1eef8ee1af9dc0d3cd6baa5ab2a",
-  "@esbuild/linux-mips64el@npm:0.27.2": "0c62692cb3a297b37212dfde52a861861843a716f6b3bdb73da49ba249a4c001b989ea61dc4540c430fac59ce2f8fc45035cdfac80172c5ddaf1b9df8471aecf",
+  "@esbuild/linux-mips64el@npm:0.27.5": "57326d2100e7a1be73c63a2827b981c926489fb86ce0482030b8a9049fc8086a8a229b98d83d34b4a9e459756e38ac9d453c2facd0e706b83dd8a08105a77445",
   "@esbuild/linux-mips64el@npm:0.27.7": "74ac0fe0b857b926af9057d5fa9634fc4b0b61a6fcd9c13cc2917e0e66638e2f724b8fd82024f97d524ff54ae17d0a52a0569078639aa9907f5287514aa046b1",
-  "@esbuild/linux-ppc64@npm:0.27.2": "b804d2dd0a6a85fe1c731828c725731a55ab120d2cc16941d560b2e9af5c2ec51586914ce26a84a326a9d46fa61eb8bb1f843953fe29ddd43b3f3099c491b5ff",
+  "@esbuild/linux-ppc64@npm:0.27.5": "d2e2b8b14ef6443ed23354ed45eaa0c176cddea25a4d84ac2a6dc76d7ce48de7928daecc3535f5cf4670b1ffbc562c43255e919ecc3f7c8c26f43b9b9d60e534",
   "@esbuild/linux-ppc64@npm:0.27.7": "7d75e59ad798631b7b7f77471fc9f545e0e6d2959a52d57b77e92d4aba81c5c57dea558d22539edc6aca92ac72112f93381e163b996df193cb5c9a1da4b4230d",
-  "@esbuild/linux-riscv64@npm:0.27.2": "03e67e7207a83801363e3637f9a35fb6224ed4dc23bbf6eca41904fc42f5a6806e1e591666bf48dbf62eba97d41ff4355413b14dcb2339007b22c693374c49f6",
+  "@esbuild/linux-riscv64@npm:0.27.5": "a943c97a6d031041cad40196be6f8112dbd7a642411bf7b24942de95f4c2caae31ca11b3e4724f1898f2b9f2e5a5c106636eea50eddc7db7cfbec8f443560798",
   "@esbuild/linux-riscv64@npm:0.27.7": "6dca2a182f59d43057ef40b93788dfb265c3b9fff4738aa613d87c7c709d9c308f18c282b7cfc2a1c770fa4db78d3529dc50b8a9f30e415661d993b021b2cdcb",
-  "@esbuild/linux-s390x@npm:0.27.2": "eb24b9c0a4a1492e4ff34a87933f6a3b348739c12f864b408144efdf949871c1fbb02a1cca741bfa11fd08aebe585d046fd3311b462ce4c795e3064ba3912469",
+  "@esbuild/linux-s390x@npm:0.27.5": "068865bc73484b97f1bcce6eca0195b30e8ce03dafdc6da7283b289023728f1cc7d0cbf5387fa6b89b072ddf8f9776b8cceb2981d2ebe3f2ea5e84ae8a77c448",
   "@esbuild/linux-s390x@npm:0.27.7": "870de4b9ff155cf5cf2ccd7b3587a6b4170550a31b621ea11dc134cd48af95f4a30f4ce868d249967eade6b3dd66e7a0af0d542c6fbba0dbc473fd0f5d3299b0",
-  "@esbuild/linux-x64@npm:0.27.2": "ed1542f203329521fb1f308696c76ba59ed4a4616a24e21bf4820685362bba209d5c44c2f4e66c88dc7b7399df9ace625454d4829ee529d076ccaf61566e11cf",
+  "@esbuild/linux-x64@npm:0.27.5": "6eb9d11d25e632607370d30d8fbc40c4357f6be293aeb33e6cd3fe73c18203b37f24b6e52d0939a499839fddcf9920b16862a3b923e425b99bacf9b80e787c5e",
   "@esbuild/linux-x64@npm:0.27.7": "47fce66247eda2d4721c1e615f7169eb7bf6e4b6105eab7271391ce933e7d350d3d4a581b3b8a61573f70b6663268eb514e624875dc514dc56dec3a37cf7cbe3",
-  "@esbuild/netbsd-arm64@npm:0.27.2": "576dd082047077b9cc41fbeffd728821a4f3b80969c1d2d6c274301122c6de2050f484fd4e946777527b8a15bd2a5ac54f85ca7ab95ea72b5345177e6a888687",
+  "@esbuild/netbsd-arm64@npm:0.27.5": "d43426863ae1f6bd37478a30c84bdabbbafda3b2ab537a6f5051006ba13231e6842ba49a3f61a2dd30736048369660e134f028c6b2bef156c81a78dadeaf280e",
   "@esbuild/netbsd-arm64@npm:0.27.7": "bbe0d0529fb73fd38c2cf9ebc1d1dcd5a2586b263cc4f6300d37008955f45310e842d63153e361a4447d4ca0f0a0691d62013fe60b09e4e0cd53f428ef2266f3",
-  "@esbuild/netbsd-x64@npm:0.27.2": "f8994af3e2ff3c9a91e874e58698b66e6f8d4e72dbc0aaf749b74a79420954146ed053359b0a4c213918582cee187d8a371737a33cfb93e624b4d091e5a6c240",
+  "@esbuild/netbsd-x64@npm:0.27.5": "b54f975bfc05f44a21884022a87367ceec3775cfc81d155bb2183ac5b9f51397589e10654eecc87ff9adee749a574e4ff724cb064907b2328e39ddb390760707",
   "@esbuild/netbsd-x64@npm:0.27.7": "246ed4df55788aacd2d9146f51ea7fcf4715e73d32ca1b0fcb42c316fdbf21d8de03bb304205dc707942442899529e834466894faa0aa3fa40454f5622648fc6",
-  "@esbuild/openbsd-arm64@npm:0.27.2": "f710da24beeb747ef3a11b9d99085a14f5c929f942fd9d9a05b7806d5ff1b85631bfa506eb7a6aed9fd01ec99bf91f24736f9f0e0eb6b7c0019fe0dddd2e615c",
+  "@esbuild/openbsd-arm64@npm:0.27.5": "dce25568a9642e9cacc9d4ae5a8c07dcb5bd2c7aee5f31259334074d30a380cdec2b3654b15978f3b64965d7622bda51dd203ab774f9a499e3b55425eaf926e3",
   "@esbuild/openbsd-arm64@npm:0.27.7": "d99927053a0f8be5158da8ecde7e8a08dd0ea580ca93f006971730979681e3738f83ada4d6564a57cdd6f412e40e5a750a92f424807aa12f97c2ead52617ad41",
-  "@esbuild/openbsd-x64@npm:0.27.2": "62670fbe1f609c5362df7b45968ded512a0860e2ad8a4715a89993abfa2f9f08a28f1294c7857d80e6d3f713639a71d291c06a961b331de67ad350032d1b8e96",
+  "@esbuild/openbsd-x64@npm:0.27.5": "fa51a43619b0da031f3b2eb6ece65d9cd6a69b9e3f03693463ed9878b04764478990dd3047591b6e2880375ada9eca8db20aca0df238afee1ad3b664f7adec65",
   "@esbuild/openbsd-x64@npm:0.27.7": "1480ff755c727d056e5f37e1d2be83d36b137c9f3595911aaf1659160c2cbfea846bded0557017aaefd79a0322be5e381b168ebff3eec4af684198835504b051",
-  "@esbuild/openharmony-arm64@npm:0.27.2": "e279efdc18301add96ea791ba9ef117cae05346688cd521fd225a60ad166add4bc995af985058e3b6ab9e65a7c49a79108a294d6aa26a1d1685ad0db194e2c56",
+  "@esbuild/openharmony-arm64@npm:0.27.5": "4c6ccc2c466158bb635918ecf530c14cbe536c2afeaa3e8e0c8b61f80875134573705b96a1854b07238df5b0e0eb1ad26b424d7a4b56b73b8813fdaec553e1a0",
   "@esbuild/openharmony-arm64@npm:0.27.7": "6aa1fd102bdfa99b3c27f558f6b5d493b47f34260cc10967c47d44b86018a307377e0c70ef51b8886c592f2a0057710a8ad7781716b0eb059d0b0657b4f7ddec",
-  "@esbuild/sunos-x64@npm:0.27.2": "7234302321d36576b5a9f027915417cddc195a67b19cdfb50e69c337ee0dd63a88be6b72d7ef299cd569d1af62e54774303d52d3d6b5e5858db975241ae467d6",
+  "@esbuild/sunos-x64@npm:0.27.5": "e53d864a1e9f0b598461df53163dd837f1bbaba2f3590934b34bae132efb2c658d6f9b036d4e9a6f2b8327cb9b3ab99d7a8244009a856dd1063868d6989d204d",
   "@esbuild/sunos-x64@npm:0.27.7": "66bff01f90a97b989c6e6fbe6f8df77a0e5b40b57b8c4d8e6c407635546eb05553de570cd4e0d4624a5a6be8a61d7e9c6e7d8bc238f8f5773a4231361c0e8745",
-  "@esbuild/win32-arm64@npm:0.27.2": "36620fddf79da3e8e527ef8331436929fa7a0b23c9b591af8f8573d80ed9c4ef45b24c6fa0abbb01d187dec497efa6c9d9d397d575afc1f28477e9ca16a48d73",
+  "@esbuild/win32-arm64@npm:0.27.5": "cff774ddb4107461f5e48da9664a1813ad6234921cb51739a3915d2822e6429276f40f0edadb52f816a63143ded7e77b84b38416f1c98e7b80a8c8a6ae031363",
   "@esbuild/win32-arm64@npm:0.27.7": "eb7008345c82bbd4be30bb27ae4e17346cb5014801e9d50058984e7c5e4cb509d6eae82db3c04aab16b72d3829908b32151117222c107962fe3fb0e317e55951",
-  "@esbuild/win32-ia32@npm:0.27.2": "96e8c1fa0ec2b5529ead2ba703e5da7644c138b2f9b6e285c05513f0455e99b2b0dcf399f01779fb384e22810e82f892491e44402772c62d3fe094b025bbdc0f",
+  "@esbuild/win32-ia32@npm:0.27.5": "ae399419b6457492c53f2829f135285e87ca3bfde1bd11f780baa890b881b96659b0c7344d7e86c9e417531190e19f38a91f47ee1b238be5b5ce794957eac4b8",
   "@esbuild/win32-ia32@npm:0.27.7": "b6a44b5b6bf670cbe86de063335f03faa308d5b3eabbca1f5078bba9674ea42d3d6ad9fb9601fb0c7abba65d4b4a467f20473aedb856c9544c20166c75538029",
-  "@esbuild/win32-x64@npm:0.27.2": "1ed08bebd916c16003f3784276ae683ab41d34951a0c272f6e072b8067a2b4bacd6f6f75a8dcea375b8545e15891d305425cf7c8dd31f7deab56ef22cde4a1e2",
+  "@esbuild/win32-x64@npm:0.27.5": "37a9f52ea621a0366ca72c4fca89e9a5e2734dbadeb46eaff89d1d81f09147db4ac4afd7905b5d8fde8e99bb4b28db52ec27b043d355711d97080b34393d75f8",
   "@esbuild/win32-x64@npm:0.27.7": "4b91237b01e7e1a5083d2df524bb2ddb13da334197681fd33ad05975c073ccc901ea6b9395453276557608e5858cc032ed12807cc156c29f4ce7d2c63e04d5a0",
   "@img/sharp-darwin-arm64@npm:0.34.3": "952e9e9c34291502e7c21258d2874539a3953a5da8df52c8e2c459f673a76179eddd48c3b7563773db7bb36b2b241d781b98a667fac4b30c1f49c1cc9fdf9b7f",
   "@img/sharp-darwin-arm64@npm:0.34.5": "0f872f02a49c87c1c844c9715a1c1e4449fab30c85711d948767d41ea1eba1cc7be8268b582d95513e66cff090ab520e4104dcf30cc6f598ee429b40e890eeec",
@@ -122,8 +122,6 @@
   "@rollup/rollup-win32-arm64-msvc@npm:4.2.0": "ff71a301051b237a32e14cb2b18117c72c5ab4524120184500e098fea028385806567fa55e4879c19f80d747774e3b8d913e0b4560abc8fe4881b392fda6ed79",
   "@rollup/rollup-win32-ia32-msvc@npm:4.2.0": "dd65d454384b6020b87f5f943121dd9d02e5bfbae2ec124a23f0a2034df02549c0ae4fb27558efda6668bab94b121c5463c4845431f2c1c9416a719176e1dd82",
   "@rollup/rollup-win32-x64-msvc@npm:4.2.0": "13cba2a14f7864986f3331c327a137ad95cf366411c0b6d3f66593bb6ea04d0058e12bd0a09fde72bbfb8660a554f0b66d90754e21add3c99d899e2bd7dfe1d1",
-  "dmg-license@npm:1.0.11": "36c0a7b030801b91216affa9b2bb00caa345b2327f298accb2263a80a0320ca305f90b99da68007d187c830c543410d58a0a2bbc229e8d169b0e1d1652ff42aa",
-  "iconv-corefoundation@npm:1.1.7": "0189733ef51a9f481379202cb1919f2677efc44aa014ba662a6fd99e47993e350eab0ff724ed18cda8011c9b78c4702b2d374f732955f1def3fd2a14a29d25c0",
   "lightningcss-android-arm64@npm:1.30.2": "823d5aa547e473e18832b47b575313dcfd9146697d53481c79b10dbbe45c62a7352f4da77f836b0c0e6a233545bb3456bece543f39e7d8ee6ef75b4d345af2fd",
   "lightningcss-darwin-arm64@npm:1.30.2": "23fd135ab0a081aec174a835b15218c5ad9ed4486823a1b8ddd8ca1795876e032201385cf6e3acd548a235d5f527e19ad213ca1c5fa0ef31d333d43d4f67fee8",
   "lightningcss-darwin-x64@npm:1.30.2": "4151c2744332798bcc83dea10c8da81a18c7dbc2d12c53a95149d7a5d24409b32f80eb42dd5933f109fe4c5715e25cfe6df3d21158191fdd682a99cc62f28b93",
@@ -134,5 +132,10 @@
   "lightningcss-linux-x64-gnu@npm:1.30.2": "bc4959398f65fc60df2a2a011c2381029d9f92ed7a2a1930393bbef5515d3f18bd2885a4063f48031435595c22ddd10923c5e2ecbf53d086b18a3b65e10cfd47",
   "lightningcss-linux-x64-musl@npm:1.30.2": "2db0a94df42f23a051bac68ad0d4322f45bc0f47290810cbb012fc2292c42201ff1eae5ec0f83178da6f232ab4cc24a2fcaaf46b0867861966d9823610e352ac",
   "lightningcss-win32-arm64-msvc@npm:1.30.2": "307a014ddc51c6773be0b63db3ce3a09ff32c9093bd2e365689de0a07a45288a310154397f5dd6dfd6a5de726ebd4dec597482dd1bd4bfeeb65f5bff09d52ea0",
-  "lightningcss-win32-x64-msvc@npm:1.30.2": "4c1b0406dad571a9754bf45becfd38af9d43eee94c93d8df881f862bc2597f72dc91dec0788aa67261cca79732c75afcd777e8786984a9e98d0d1fb66ced1a05"
+  "lightningcss-win32-x64-msvc@npm:1.30.2": "4c1b0406dad571a9754bf45becfd38af9d43eee94c93d8df881f862bc2597f72dc91dec0788aa67261cca79732c75afcd777e8786984a9e98d0d1fb66ced1a05",
+  "sqlite-vec-darwin-arm64@npm:0.1.9": "e1ad40eda22dd3a601565a1fcbc4d36e83560d4670dbef59639010a89fd3612697d2d5e2221d28a5044a6c461352ad83cc0595bb7e2b42594b9e76860f8a8291",
+  "sqlite-vec-darwin-x64@npm:0.1.9": "71760fc97b4d1d15f503a378abfa4ad390192f5fd1009161261339f6a377a9f47f857ae2ee993e5b7e8ab1e49f168fd86976f23b4cf4da9a7ea9850709dd51ec",
+  "sqlite-vec-linux-arm64@npm:0.1.9": "45b7e0ae0dc42acafc8e24b1f9f85b107b418cb7bc20a4f28ccb4abdacc45763fb417dd18c615c8aa76328da3b6bdd1d9e130baa97b446d62cf736da2ffa6010",
+  "sqlite-vec-linux-x64@npm:0.1.9": "6608e83f4d0a838fa20589d055c00e67f4aa0f086212922efd0e1f64571d1e3f3014a765327f722ee11b2dbdcd618a7932e06fcdd5ebf15c57b8e157d95585c8",
+  "sqlite-vec-windows-x64@npm:0.1.9": "8e2751b45cb93d8f896bf6e02b5676f75d7a68fdc199564401bd46ec2ddb81cce13f3ef96cfac15e14e5033eb96c322cb1fe21952b83aeb2abb54b769e43a426"
 }
diff --git a/pkgs/by-name/jo/joplin-desktop/release-data.json b/pkgs/by-name/jo/joplin-desktop/release-data.json
index cc2e899f0202..ac469f854ccf 100644
--- a/pkgs/by-name/jo/joplin-desktop/release-data.json
+++ b/pkgs/by-name/jo/joplin-desktop/release-data.json
@@ -1,6 +1,6 @@
 {
-  "version": "3.6.16",
-  "hash": "sha256-0W6xNcEMXIs8XsoY6NqSud9D5fEmc5GKFC8Uo6CEtec=",
+  "version": "3.7.18",
+  "hash": "sha256-12ZRoEutQsNJlrPypNrsffeIj+2ekqB/s6HN9ks/+rU=",
   "plugins": {
     "io.github.jackgruber.backup": {
       "name": "joplin-plugin-backup",
@@ -9,5 +9,5 @@
       "npmDepsHash": "sha256-xZJ0Oir1A6sLe0ztIyBu39Yy3D6sNrVaciOYG0k85l0="
     }
   },
-  "deps_hash": "sha256-ejg0u9Dy3iaBusH248IbtJNpvd/zADyPJ9CplIK1A/w="
+  "deps_hash": "sha256-W5hXh1i1rTe4OkhTvHPpDQgPSvRqTZ/GsJnHXE2D/2Y="
 }

From 3767c91f9a81640ed626d20719f4f174c7bb251c Mon Sep 17 00:00:00 2001
From: BeLeap <beleap@beleap.dev>
Date: Sun, 13 Sep 2026 22:34:57 +0900
Subject: [PATCH 13/59] joplin-desktop: remove obsolete postFetch workaround

The upstream Yarn lockfile no longer needs the metadata version workaround.

Assisted-by: pi 0.85.1 (openai-codex model)
---
 pkgs/by-name/jo/joplin-desktop/package.nix | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/pkgs/by-name/jo/joplin-desktop/package.nix b/pkgs/by-name/jo/joplin-desktop/package.nix
index b003c063c6b2..2e016c1a4083 100644
--- a/pkgs/by-name/jo/joplin-desktop/package.nix
+++ b/pkgs/by-name/jo/joplin-desktop/package.nix
@@ -44,10 +44,6 @@ stdenv.mkDerivation (finalAttrs: {
     postFetch = ''
       # there's a file with a weird name that causes a hash mismatch on darwin
       rm $out/packages/app-cli/tests/support/photo*
-
-      # Remove after upstream updates to Yarn 4.14
-      # https://github.com/laurent22/joplin/blob/dev/package.json#L103
-      sed -i '/__metadata/{n;s/version: 8$/version: 9/;}' $out/yarn.lock
     '';
     inherit (releaseData) hash;
   };

From 29d2812b7e28ca93dd829624d85fc13805d73cf9 Mon Sep 17 00:00:00 2001
From: BeLeap <beleap@beleap.dev>
Date: Sun, 13 Sep 2026 22:35:23 +0900
Subject: [PATCH 14/59] joplin-desktop: use nixpkgs Yarn and skip Electron
 installer

Use the patched offline Yarn and avoid Joplin\u2019s networked Electron installer.

Assisted-by: pi 0.85.1 (openai-codex model)
---
 pkgs/by-name/jo/joplin-desktop/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/jo/joplin-desktop/package.nix b/pkgs/by-name/jo/joplin-desktop/package.nix
index 2e016c1a4083..86c3c59344d5 100644
--- a/pkgs/by-name/jo/joplin-desktop/package.nix
+++ b/pkgs/by-name/jo/joplin-desktop/package.nix
@@ -101,9 +101,15 @@ stdenv.mkDerivation (finalAttrs: {
     # before we can patchShebangs additional paths (see buildPhase).
     # https://github.com/NixOS/nixpkgs/blob/3cd051861c41df675cee20153bfd7befee120a98/pkgs/by-name/ya/yarn-berry/fetcher/yarn-berry-config-hook.sh#L83
     YARN_ENABLE_SCRIPTS = 0;
+
+    # Use nixpkgs' patched offline Yarn instead of Joplin's vendored Yarn.
+    YARN_IGNORE_PATH = 1;
   };
 
   postPatch = ''
+    # Nixpkgs provides Electron; don't run Joplin's networked Electron installer.
+    sed -i "/^[[:space:]]*'installElectron',$/d" packages/app-desktop/gulpfile.ts
+
     # Don't automatically build everything
     sed -i '/postinstall/d' package.json
     # Don't install onenote-converter subpackage deps

From dd065049af951d2d5d57aa7ff744241a542cc4b9 Mon Sep 17 00:00:00 2001
From: Sam Estep <sam@samestep.com>
Date: Sun, 13 Sep 2026 12:28:09 -0400
Subject: [PATCH 15/59] wasm-language-tools: fix build for Rust 1.98

Assisted-by: Claude:fable-5.1
---
 pkgs/by-name/wa/wasm-language-tools/package.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/by-name/wa/wasm-language-tools/package.nix b/pkgs/by-name/wa/wasm-language-tools/package.nix
index 245393150028..906691552167 100644
--- a/pkgs/by-name/wa/wasm-language-tools/package.nix
+++ b/pkgs/by-name/wa/wasm-language-tools/package.nix
@@ -2,6 +2,7 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  fetchpatch,
   versionCheckHook,
   _experimental-update-script-combinators,
   nix-update-script,
@@ -19,6 +20,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
     hash = "sha256-XyVWNhVDo190/hnKj6A5dDYnlO9/WI0GYJIrkyfUkTw=";
   };
 
+  patches = [
+    # Fix test for Rust 1.98: https://github.com/rust-lang/rust/pull/155527
+    (fetchpatch {
+      name = "update-snapshot-for-rust-1.98.patch";
+      url = "https://github.com/g-plane/wasm-language-tools/commit/d7cabdba9fa90ec74a461dcc6b470288184d6c86.patch";
+      hash = "sha256-dPPMebvNVVtFTURsxGGHTwZ6SM3CDMlZucENzwOO6/4=";
+    })
+  ];
+
   cargoHash = "sha256-VoApXHdD8SF8ZqnDVynxunjVoZ5WKai2Xzw0UYy7hSg=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];

From 574feb33c5a0b41d2eeb1735bbea2c836bcae0ac Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 14 Sep 2026 06:52:51 +0000
Subject: [PATCH 16/59] libmirage: 3.3.2 -> 3.3.3

---
 pkgs/by-name/li/libmirage/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libmirage/package.nix b/pkgs/by-name/li/libmirage/package.nix
index 107ad7a7418e..d220aa0b6716 100644
--- a/pkgs/by-name/li/libmirage/package.nix
+++ b/pkgs/by-name/li/libmirage/package.nix
@@ -27,11 +27,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libmirage";
-  version = "3.3.2";
+  version = "3.3.3";
 
   src = fetchurl {
     url = "mirror://sourceforge/cdemu/libmirage-${finalAttrs.version}.tar.xz";
-    hash = "sha256-wMAzJpEue1QnDllWheFk3ZX+8pSkYw13s+GU0G/AOfs=";
+    hash = "sha256-tICwgjCyJVr0DDrIY0TAx3/JloZgFOBaadVVTpA11ls=";
   };
 
   env = {

From 435e9b05fe92605d994f331bf695751210dc1730 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 14 Sep 2026 20:29:32 +0000
Subject: [PATCH 17/59] itgmaniaPackages.itg3encore: 0-unstable-2026-08-10 ->
 0-unstable-2026-09-14

---
 pkgs/by-name/it/itgmania/themes/itg3encore.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/it/itgmania/themes/itg3encore.nix b/pkgs/by-name/it/itgmania/themes/itg3encore.nix
index dfbc030ce362..23245de80291 100644
--- a/pkgs/by-name/it/itgmania/themes/itg3encore.nix
+++ b/pkgs/by-name/it/itgmania/themes/itg3encore.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "itg3encore";
-  version = "0-unstable-2026-08-10";
+  version = "0-unstable-2026-09-14";
 
   src = fetchFromGitHub {
     owner = "DarkBahamut162";
     repo = "itg3encore";
-    rev = "5427331ee20e496092680400481165c503d2123e";
-    hash = "sha256-Hvqxhpdqxo32uXkuFGUqlNk8517ughE0mGBs1L9PsHY=";
+    rev = "e5177b5829c4ef521c3552f55f9080a3561d6216";
+    hash = "sha256-cnGfEBTJYEqDNCmR8Wcbetm2qhhgMCh1LpzXBKKXdvA=";
   };
 
   postInstall = ''

From 9deac56d4e1310d0ea8be5eeb6b58ff0f50c839e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 14 Sep 2026 20:32:50 +0000
Subject: [PATCH 18/59] verifpal: 0.80.1 -> 1.4.10

---
 pkgs/by-name/ve/verifpal/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ve/verifpal/package.nix b/pkgs/by-name/ve/verifpal/package.nix
index 1afcfa1fed91..7b38cde0f324 100644
--- a/pkgs/by-name/ve/verifpal/package.nix
+++ b/pkgs/by-name/ve/verifpal/package.nix
@@ -6,16 +6,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "verifpal";
-  version = "0.80.1";
+  version = "1.4.10";
 
   src = fetchFromGitHub {
     owner = "symbolicsoft";
     repo = "verifpal";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-C5k9vXd91m7AZWqSCTw4qxD3onuq/1bMhlIia9XW2II=";
+    hash = "sha256-Cg8qaOGAGRYPacbv4WswcEkQrNRSh5xtO5y6gsUW3x8=";
   };
 
-  cargoHash = "sha256-7qfKG7iUcoKOcyFfDgaCDiXF3eAOO/wGJgu7XocSXZU=";
+  cargoHash = "sha256-c5cnkZD5XPpYab0JOF8L5h7U5GbvHBzLXH1jq4b5Y1w=";
 
   meta = {
     homepage = "https://verifpal.com/";

From 588b7f927a51848e0119ec2a5b43830d98d97082 Mon Sep 17 00:00:00 2001
From: mfukuba <12195032+mfukuba@users.noreply.github.com>
Date: Tue, 15 Sep 2026 10:07:28 +0900
Subject: [PATCH 19/59] ruby_4_0: 4.0.6 -> 4.0.7

https://github.com/ruby/ruby/releases/tag/v4.0.7
---
 pkgs/development/interpreters/ruby/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 87565c7fb650..4d8406f5f113 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -411,8 +411,8 @@ in
   };
 
   ruby_4_0 = generic {
-    version = rubyVersion "4" "0" "6" "";
-    hash = "sha256-g30pno993yvjGiKaen4BnTVJeYJRF5iayzsysam+Jio=";
+    version = rubyVersion "4" "0" "7" "";
+    hash = "sha256-kRrOIPkNBoyg5N2m0OTw+B5S5S8t1PQATHIeJTQS6C0=";
     cargoHash = "sha256-z7NwWc4TaR042hNx0xgRkh/BQEpEJtE53cfrN0qNiE0=";
   };
 

From c78a4b54290ffa3e9f9b0a9881cf9b068b1afc5e Mon Sep 17 00:00:00 2001
From: Yifei Sun <ysun@hey.com>
Date: Mon, 14 Sep 2026 16:54:37 +0200
Subject: [PATCH 20/59] fastly: 16.0.0 -> 16.1.0

Changelog: https://github.com/fastly/cli/blob/v16.1.0/CHANGELOG.md
---
 pkgs/by-name/fa/fastly/package.nix | 42 ++++++++++++------------------
 1 file changed, 17 insertions(+), 25 deletions(-)

diff --git a/pkgs/by-name/fa/fastly/package.nix b/pkgs/by-name/fa/fastly/package.nix
index 695152522029..a810aca0e5e2 100644
--- a/pkgs/by-name/fa/fastly/package.nix
+++ b/pkgs/by-name/fa/fastly/package.nix
@@ -1,27 +1,23 @@
 {
   lib,
   stdenv,
+  buildGoModule,
   fetchFromGitHub,
   installShellFiles,
-  buildGoModule,
-  go,
   makeWrapper,
+  writableTmpDirAsHomeHook,
   viceroy,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "fastly";
-  version = "16.0.0";
+  version = "16.1.0";
 
   src = fetchFromGitHub {
     owner = "fastly";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gVKlAbiznaRKwDpiyap4Q3mIhn/ZbnUIFwG3l01ZXQ8=";
-    # The git commit is part of the `fastly version` original output;
-    # leave that output the same in nixpkgs. Use the `.git` directory
-    # to retrieve the commit SHA, and remove the directory afterwards,
-    # since it is not needed after that.
+    hash = "sha256-xGp5Fa4ruHpc2YAAbrva0zurt4wxC6XRdSpMMQGEB7c=";
     leaveDotGit = true;
     postFetch = ''
       cd "$out"
@@ -30,39 +26,34 @@ buildGoModule (finalAttrs: {
     '';
   };
 
-  subPackages = [
-    "cmd/fastly"
-  ];
+  subPackages = [ "cmd/fastly" ];
 
-  vendorHash = "sha256-U2Ix8ZKGCDrWUJFFXJaL+1EBTbqblWp8slhruHhouIc=";
+  vendorHash = "sha256-JUYBaiAz91jv8QFrfjpHnY442+qK7T0VZJcC/rCGhD4=";
 
   nativeBuildInputs = [
     installShellFiles
     makeWrapper
+    writableTmpDirAsHomeHook
   ];
 
-  # Flags as provided by the build automation of the project:
-  #   https://github.com/fastly/cli/blob/7844f9f54d56f8326962112b5534e5c40e91bf09/.goreleaser.yml#L14-L18
-  ldflags = [
-    "-s"
-    "-w"
-    "-X github.com/fastly/cli/pkg/revision.AppVersion=v${finalAttrs.version}"
-    "-X github.com/fastly/cli/pkg/revision.Environment=release"
-    "-X github.com/fastly/cli/pkg/revision.GoHostOS=${go.GOHOSTOS}"
-    "-X github.com/fastly/cli/pkg/revision.GoHostArch=${go.GOHOSTARCH}"
-  ];
   preBuild = ''
-    cp ./.fastly/config.toml ./pkg/config/config.toml
     ldflags+=" -X github.com/fastly/cli/pkg/revision.GitCommit=$(cat COMMIT)"
   '';
 
+  ldflags = [
+    "-s"
+    "-X github.com/fastly/cli/pkg/revision.AppVersion=v${finalAttrs.version}"
+    "-X github.com/fastly/cli/pkg/revision.Environment=release"
+  ];
+
+  # must embed viceroy to prevent fetching binary release on `fastly compute serve` invocation
   preFixup = ''
-    wrapProgram $out/bin/fastly --prefix PATH : ${lib.makeBinPath [ viceroy ]} \
+    wrapProgram $out/bin/fastly \
+      --prefix PATH : ${lib.makeBinPath [ viceroy ]} \
       --set FASTLY_VICEROY_USE_PATH 1
   '';
 
   postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-    export HOME="$(mktemp -d)"
     installShellCompletion --cmd fastly \
       --bash <($out/bin/fastly --completion-script-bash) \
       --zsh <($out/bin/fastly --completion-script-zsh)
@@ -75,6 +66,7 @@ buildGoModule (finalAttrs: {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       ereslibre
+      stepbrobd
     ];
     mainProgram = "fastly";
   };

From 5c7097d108c626b1866208fba429482f86bf2f4f Mon Sep 17 00:00:00 2001
From: BatteredBunny <ayes2022@protonmail.com>
Date: Mon, 14 Sep 2026 21:02:06 +0300
Subject: [PATCH 21/59] python3Packages.exllamav3: 1.4.8 -> 1.5.0

---
 .../python-modules/exllamav3/default.nix      | 24 +++++++++++++------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/exllamav3/default.nix b/pkgs/development/python-modules/exllamav3/default.nix
index 6ec0b3169923..59301c5686e0 100644
--- a/pkgs/development/python-modules/exllamav3/default.nix
+++ b/pkgs/development/python-modules/exllamav3/default.nix
@@ -22,18 +22,28 @@
   typing-extensions,
 }:
 let
-  newerThanTuring = lib.filter (version: lib.versionOlder "7.9" version) torch.cudaCapabilities;
+  # https://github.com/turboderp-org/exllamav3/blob/master/.github/workflows/build.yml#L55
+  # https://github.com/turboderp-org/exllamav3/issues/44
+  # Using unsupported platforms the build will fail
+  cudaCapabilities = lib.intersectLists torch.cudaCapabilities [
+    "8.0"
+    "8.6"
+    "8.9"
+    "9.0"
+    "10.0"
+    "12.0"
+  ];
 in
 buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
   pname = "exllamav3";
-  version = "1.4.8";
+  version = "1.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "turboderp-org";
     repo = "exllamav3";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CnbJR5rsHzNEeQBJLdD7LGrrTgy+GKpvop1R4uY4d8U=";
+    hash = "sha256-gW6A2nWx3lumnJz7r7vxQyC1qM9Agqdr0DiL68yJvAI=";
   };
 
   pythonRelaxDeps = [
@@ -57,7 +67,7 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
   ];
 
   dependencies = [
-    flash-linear-attention
+    flash-linear-attention # Upstream vendors it instead
     llguidance
     marisa-trie
     numpy
@@ -73,9 +83,9 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
 
   env = lib.optionalAttrs torch.cudaSupport {
     CUDA_HOME = lib.getDev cudaPackages.cuda_nvcc;
-    # exllamav3 only supports turing or newer GPUs
-    # https://github.com/turboderp-org/exllamav3/issues/44
-    TORCH_CUDA_ARCH_LIST = lib.concatStringsSep ";" newerThanTuring;
+    TORCH_CUDA_ARCH_LIST = lib.concatStringsSep ";" (
+      cudaCapabilities ++ [ "${lib.last cudaCapabilities}+PTX" ]
+    );
   };
 
   pythonImportsCheck = [ "exllamav3" ];

From 6be6cc9ccfba4fb83d2ce2e9bee280117a06ef0a Mon Sep 17 00:00:00 2001
From: BatteredBunny <ayes2022@protonmail.com>
Date: Mon, 14 Sep 2026 21:02:26 +0300
Subject: [PATCH 22/59] tabbyapi: 0-unstable-2026-09-07 ->
 0-unstable-2026-09-14

---
 pkgs/by-name/ta/tabbyapi/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ta/tabbyapi/package.nix b/pkgs/by-name/ta/tabbyapi/package.nix
index 74fcf6722359..58a6e39e1a23 100644
--- a/pkgs/by-name/ta/tabbyapi/package.nix
+++ b/pkgs/by-name/ta/tabbyapi/package.nix
@@ -7,14 +7,14 @@
 }:
 python3Packages.buildPythonApplication {
   pname = "tabbyapi";
-  version = "0-unstable-2026-09-07";
+  version = "0-unstable-2026-09-14";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "theroyallab";
     repo = "tabbyAPI";
-    rev = "92198cca1aa48f83121027f5b9058c24d7c2d894";
-    hash = "sha256-IQDsfTnIcaVmxk58Q8StEPS4O7LQwPVie6b04BWoeeQ=";
+    rev = "53da7919d4e45c63f4acbcbbc00cbe0f60a1ce65";
+    hash = "sha256-oKVxMoyMWZCuwLbsimTXO05Hdsw/2u2SVeYSFm1XsFg=";
   };
 
   build-system = with python3Packages; [

From f302f038e18197322dd02877e1d02d36f3d1cd20 Mon Sep 17 00:00:00 2001
From: BatteredBunny <ayes2022@protonmail.com>
Date: Mon, 14 Sep 2026 20:50:08 +0300
Subject: [PATCH 23/59] feishin: 1.15.1 -> 1.17.0

---
 pkgs/by-name/fe/feishin/package.nix | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/fe/feishin/package.nix b/pkgs/by-name/fe/feishin/package.nix
index 094111c60555..07763edfe439 100644
--- a/pkgs/by-name/fe/feishin/package.nix
+++ b/pkgs/by-name/fe/feishin/package.nix
@@ -8,7 +8,6 @@
   fetchPnpmDeps,
   pnpmConfigHook,
   pnpm_11,
-  nodejs-slim_latest,
   darwin,
   actool,
   copyDesktopItems,
@@ -20,18 +19,17 @@
 let
   electron = electron_43;
 
-  # Fix pnpm issue on darwin https://github.com/NixOS/nixpkgs/issues/525627
-  pnpm = pnpm_11.override { nodejs-slim = nodejs-slim_latest; };
+  pnpm = pnpm_11;
 in
 buildNpmPackage (finalAttrs: {
   pname = "feishin";
-  version = "1.15.1";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "jeffvli";
     repo = "feishin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2UKJBUZNUpUUZIG1JFXok7YJdzqt+Ge0ykHUm8BeNcw=";
+    hash = "sha256-1ZIw5XiN+2EhpHmdvN0HxgMSvn4QvN9B+ZJ3RlPXhLw=";
   };
 
   __structuredAttrs = true;
@@ -48,7 +46,7 @@ buildNpmPackage (finalAttrs: {
       src
       ;
     fetcherVersion = 4;
-    hash = "sha256-9uG0AxIBAmuIPywg3p9fFCXmRvM9zDLhWfluSLRnUXY=";
+    hash = "sha256-ltpz4e5Vv2vxt/93M4+vHUFJZjwTRwb2zrwvl1Lqjo8=";
   };
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
@@ -65,7 +63,7 @@ buildNpmPackage (finalAttrs: {
   postPatch = ''
     # release/app dependencies are installed on preConfigure
     substituteInPlace package.json \
-      --replace-fail '"postinstall": "electron-builder install-app-deps",' ""
+      --replace-fail '"postinstall": "install-electron && electron-builder install-app-deps",' ""
   '';
 
   postBuild = lib.optionalString (!webVersion) ''

From 88efbce838dc07e82b9be164b45ade6d53194b3e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Sep 2026 15:16:28 +0000
Subject: [PATCH 24/59] ddccontrol-db: 20260902 -> 20260915

---
 pkgs/by-name/dd/ddccontrol-db/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/dd/ddccontrol-db/package.nix b/pkgs/by-name/dd/ddccontrol-db/package.nix
index 533ee7a9d072..7732d4107214 100644
--- a/pkgs/by-name/dd/ddccontrol-db/package.nix
+++ b/pkgs/by-name/dd/ddccontrol-db/package.nix
@@ -10,13 +10,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ddccontrol-db";
-  version = "20260902";
+  version = "20260915";
 
   src = fetchFromGitHub {
     owner = "ddccontrol";
     repo = "ddccontrol-db";
     tag = finalAttrs.version;
-    sha256 = "sha256-Nu0SC9Qh4+wUzVCdo7m2z4pZH50FvCXehF3IiCoHXKM=";
+    sha256 = "sha256-n538zzL8lRln6eLCJDivwh90RO2RZ7lykEDLVKV3Sa0=";
   };
 
   nativeBuildInputs = [

From 146cf8edd78e41fce79375c392250b9b79babe96 Mon Sep 17 00:00:00 2001
From: Johan Herland <johan@herland.net>
Date: Tue, 15 Sep 2026 15:21:52 +0000
Subject: [PATCH 25/59] python3Packages.gepa: fix up versioning

---
 pkgs/development/python-modules/gepa/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/gepa/default.nix b/pkgs/development/python-modules/gepa/default.nix
index c81c06a0ee70..c1fb3cbf8783 100644
--- a/pkgs/development/python-modules/gepa/default.nix
+++ b/pkgs/development/python-modules/gepa/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  pyprojectVersionPatchHook,
   setuptools,
 }:
 
@@ -20,6 +21,10 @@ buildPythonPackage (finalAttrs: {
 
   build-system = [ setuptools ];
 
+  nativeBuildInputs = [
+    pyprojectVersionPatchHook
+  ];
+
   pythonImportsCheck = [ "gepa" ];
 
   # test suite requires network access

From 2feca18139559303da5fa622b0fb6da9ae3e2233 Mon Sep 17 00:00:00 2001
From: Johan Herland <johan@herland.net>
Date: Tue, 15 Sep 2026 15:22:16 +0000
Subject: [PATCH 26/59] python3Packages.dspy: init at 3.2.1

---
 .../python-modules/dspy/default.nix           | 125 ++++++++++++++++++
 pkgs/top-level/python-packages.nix            |   2 +
 2 files changed, 127 insertions(+)
 create mode 100644 pkgs/development/python-modules/dspy/default.nix

diff --git a/pkgs/development/python-modules/dspy/default.nix b/pkgs/development/python-modules/dspy/default.nix
new file mode 100644
index 000000000000..e04f6f711db6
--- /dev/null
+++ b/pkgs/development/python-modules/dspy/default.nix
@@ -0,0 +1,125 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  anyio,
+  asyncer,
+  cachetools,
+  cloudpickle,
+  datamodel-code-generator,
+  diskcache,
+  gepa,
+  json-repair,
+  litellm,
+  mcp,
+  numpy,
+  openai,
+  orjson,
+  pillow,
+  pydantic,
+  pyprojectVersionPatchHook,
+  pytestCheckHook,
+  pytest-asyncio,
+  regex,
+  requests,
+  tenacity,
+  tqdm,
+  typeguard,
+  xxhash,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "dspy";
+  version = "3.2.1";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "stanfordnlp";
+    repo = "dspy";
+    tag = finalAttrs.version;
+    hash = "sha256-xquV+FyDfejm1SCWYfuiezIkyutmm/1zOvd5X+oElrM=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  nativeBuildInputs = [
+    pyprojectVersionPatchHook
+  ];
+
+  dependencies = [
+    anyio
+    asyncer
+    cachetools
+    cloudpickle
+    diskcache
+    gepa
+    json-repair
+    litellm
+    mcp
+    numpy
+    openai
+    orjson
+    pydantic
+    regex
+    requests
+    tenacity
+    tqdm
+    typeguard
+    xxhash
+  ];
+
+  pythonRelaxDeps = [
+    "asyncer"
+    "gepa"
+    "litellm"
+    "typeguard"
+  ];
+
+  # optuna is an optional dependency that dspy can use but doesn't require at import time
+  pythonRemoveDeps = [ "optuna" ];
+
+  # Prevent litellm from trying to fetch the remote model cost map at import
+  # time, which fails in environments without direct internet access.
+  postPatch = ''
+    sed -i '1i import os; os.environ.setdefault("LITELLM_LOCAL_MODEL_COST_MAP", "true")' dspy/__init__.py
+  '';
+
+  pythonImportsCheck = [ "dspy" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    pytest-asyncio
+    datamodel-code-generator
+    pillow
+  ];
+
+  # skip tests that need network access
+  disabledTestPaths = [
+    "tests/signatures/test_adapter_image.py"
+  ];
+
+  # These tests start a litellm proxy server subprocess, which isn't available
+  # in the nix build sandbox (upstream skips them on Python 3.14 for the same reason).
+  disabledTests = [
+    "test_chat_lms_can_be_queried"
+    "test_dspy_cache"
+    "test_lm_calls_support_callables"
+    "test_lm_calls_support_pydantic_models"
+    "test_responses_api_tool_calls"
+    "test_streamify_yields_expected_response_chunks"
+    "test_streaming_response_yields_expected_response_chunks"
+    "test_text_lms_can_be_queried"
+  ];
+
+  meta = {
+    description = "Programming — not prompting — language models";
+    homepage = "https://github.com/stanfordnlp/dspy";
+    changelog = "https://github.com/stanfordnlp/dspy/releases/tag/${finalAttrs.version}";
+    maintainers = with lib.maintainers; [ jherland ];
+    license = lib.licenses.mit;
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 442708a80e23..21639dd0bec1 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5258,6 +5258,8 @@ self: super: with self; {
 
   dsnap = callPackage ../development/python-modules/dsnap { };
 
+  dspy = callPackage ../development/python-modules/dspy { };
+
   dt8852 = callPackage ../development/python-modules/dt8852 { };
 
   dtfabric = callPackage ../development/python-modules/dtfabric { };

From 54f26e6ec55061fe209f8248d0420246b447fb89 Mon Sep 17 00:00:00 2001
From: BatteredBunny <ayes2022@protonmail.com>
Date: Tue, 15 Sep 2026 15:48:47 +0300
Subject: [PATCH 27/59] plezy: 2.19.1 -> 2.20.0

---
 pkgs/by-name/pl/plezy/aarch64-linux.patch | 32 +++-------
 pkgs/by-name/pl/plezy/git-hashes.json     |  2 +-
 pkgs/by-name/pl/plezy/package.nix         | 12 +---
 pkgs/by-name/pl/plezy/pubspec.lock.json   | 76 +++++++----------------
 4 files changed, 34 insertions(+), 88 deletions(-)

diff --git a/pkgs/by-name/pl/plezy/aarch64-linux.patch b/pkgs/by-name/pl/plezy/aarch64-linux.patch
index 1a6f1f72319d..5c5008a8abd6 100644
--- a/pkgs/by-name/pl/plezy/aarch64-linux.patch
+++ b/pkgs/by-name/pl/plezy/aarch64-linux.patch
@@ -1,35 +1,17 @@
 diff --git a/lib/theme/mono_theme.dart b/lib/theme/mono_theme.dart
-index 5b87737c..3873fe84 100644
+index f750336..7790e50 100644
 --- a/lib/theme/mono_theme.dart
 +++ b/lib/theme/mono_theme.dart
-@@ -61,7 +61,7 @@ ThemeData _buildMonoTheme({required bool dark, required bool oled, required Targ
- 
-   final base = ThemeData(
-     platform: platform,
--    useMaterial3: true,
-+    useMaterial3: true, fontFamily: 'NotoSans',
-     brightness: isDark ? Brightness.dark : Brightness.light,
-     colorScheme: ColorScheme(
-       brightness: isDark ? Brightness.dark : Brightness.light,
-@@ -108,7 +108,7 @@ ThemeData _buildMonoTheme({required bool dark, required bool oled, required Targ
+@@ -112,7 +112,11 @@ ThemeData _buildMonoTheme({required bool dark, required bool oled, required Targ
        titleTextStyle: TextStyle(color: c.text, fontSize: 18, fontWeight: .w700, letterSpacing: -0.2),
      ),
      textTheme: Typography.englishLike2021
 -        .apply(bodyColor: c.text, displayColor: c.text)
-+        .apply(fontFamily: 'NotoSans', bodyColor: c.text, displayColor: c.text)
++        .apply(
++          fontFamilyFallback: const ['Go Noto Current', 'Go Noto Current Hangul'],
++          bodyColor: c.text,
++          displayColor: c.text,
++        )
          .copyWith(
            displayLarge: const TextStyle(fontWeight: .w700, letterSpacing: -0.5),
            titleMedium: const TextStyle(fontWeight: .w600),
-diff --git a/pubspec.yaml b/pubspec.yaml
-index 68f20256..419cc1d6 100644
---- a/pubspec.yaml
-+++ b/pubspec.yaml
-@@ -152,3 +152,8 @@ flutter:
-     - assets/shaders/anime4k/
-     - assets/player_icons/
-     - assets/rating_icons/
-+
-+  fonts:
-+    - family: NotoSans
-+      fonts:
-+        - asset: assets/fonts/NotoSans.ttc
diff --git a/pkgs/by-name/pl/plezy/git-hashes.json b/pkgs/by-name/pl/plezy/git-hashes.json
index 16c1b15f1568..ca78d7fb3e95 100644
--- a/pkgs/by-name/pl/plezy/git-hashes.json
+++ b/pkgs/by-name/pl/plezy/git-hashes.json
@@ -3,7 +3,7 @@
   "auto_updater_macos": "sha256-787cMkeT2BlfwVcy4y46XkWioNqLKJgQ/CCxQvERa+A=",
   "auto_updater_platform_interface": "sha256-787cMkeT2BlfwVcy4y46XkWioNqLKJgQ/CCxQvERa+A=",
   "auto_updater_windows": "sha256-787cMkeT2BlfwVcy4y46XkWioNqLKJgQ/CCxQvERa+A=",
-  "background_downloader": "sha256-x1Z+Nlyvy+cc1EdRUikqZMDjVKdGHe7FOH2Yx9K0zhE=",
+  "background_downloader": "sha256-ebNPYQVvMHX0lExBt3V+9k8cVtGFTSNPG457GH/+iVo=",
   "connectivity_plus": "sha256-sVUG5/6GF0Eu47BgUCkgbGi8w1ip5o0yQS00NnNjAGs=",
   "os_media_controls": "sha256-cNNTqIVJy9Yo7IrBAbIQFngOCT6ccWnOHVti7B/5jsQ="
 }
diff --git a/pkgs/by-name/pl/plezy/package.nix b/pkgs/by-name/pl/plezy/package.nix
index b6eb1fb124d0..936b477e4300 100644
--- a/pkgs/by-name/pl/plezy/package.nix
+++ b/pkgs/by-name/pl/plezy/package.nix
@@ -21,17 +21,16 @@
   _7zz,
   makeBinaryWrapper,
   runCommand,
-  noto-fonts-cjk-sans ? null,
 }:
 let
   pname = "plezy";
-  version = "2.19.1";
+  version = "2.20.0";
 
   src = fetchFromGitHub {
     owner = "edde746";
     repo = "plezy";
     tag = version;
-    hash = "sha256-vafKdaMUR6O3QzsPbMc/cW4cPmKxe9nDEe7bfIvfVFA=";
+    hash = "sha256-q0oGOAHco7wWS8P2sUdplZS/Rvlh4a1/MVfRbrETQ/0=";
   };
 
   simdutf = fetchurl {
@@ -101,11 +100,6 @@ let
       substituteInPlace linux/CMakeLists.txt \
         --replace-fail "URL https://github.com/simdutf/simdutf/releases/download/v6.4.2/singleheader.zip" \
                        "URL file://${simdutf}"
-    ''
-    + lib.optionalString (stdenv.hostPlatform.system == "aarch64-linux") ''
-      # Opt-in workaround for invisible text on aarch64-linux systems. Text was invisible; bundling the font as a Dart asset fixed it,
-      # unknown why.
-      install -Dm644 ${noto-fonts-cjk-sans}/share/fonts/opentype/noto-cjk/NotoSansCJK-VF.otf.ttc assets/fonts/NotoSans.ttc
     '';
 
     desktopItems = [
@@ -143,7 +137,7 @@ let
 
     src = fetchurl {
       url = "https://github.com/edde746/plezy/releases/download/${version}/plezy-macos.dmg";
-      hash = "sha256-fT/9DvzPTbX68GPo7MA+iX7jDQjp+jsAfRJ8Y8vxh+I=";
+      hash = "sha256-cQ5lGdhnWnfVUI6fqx8pk5zgdaQrZbZxD5mSwVpTbmM=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/pl/plezy/pubspec.lock.json b/pkgs/by-name/pl/plezy/pubspec.lock.json
index 821d1a1b11e7..9f859c3f2f24 100644
--- a/pkgs/by-name/pl/plezy/pubspec.lock.json
+++ b/pkgs/by-name/pl/plezy/pubspec.lock.json
@@ -50,6 +50,16 @@
       "source": "hosted",
       "version": "2.0.3"
     },
+    "archive": {
+      "dependency": "direct dev",
+      "description": {
+        "name": "archive",
+        "sha256": "ace891da0862b0e4cabbb064ee3fd87b2728b898949fdb366d83fe98342c9f19",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "4.2.0"
+    },
     "args": {
       "dependency": "transitive",
       "description": {
@@ -118,8 +128,8 @@
       "dependency": "direct main",
       "description": {
         "path": ".",
-        "ref": "12ef3ff758709e3ceab8eccd6d43e0dea1c68ca1",
-        "resolved-ref": "12ef3ff758709e3ceab8eccd6d43e0dea1c68ca1",
+        "ref": "c52103f4a2d683c22ce3b8b8661da610644bfef1",
+        "resolved-ref": "c52103f4a2d683c22ce3b8b8661da610644bfef1",
         "url": "https://github.com/edde746/background_downloader"
       },
       "source": "git",
@@ -307,7 +317,7 @@
       "version": "7.2.0"
     },
     "connectivity_plus_platform_interface": {
-      "dependency": "transitive",
+      "dependency": "direct dev",
       "description": {
         "name": "connectivity_plus_platform_interface",
         "sha256": "3c09627c536d22fd24691a905cdd8b14520de69da52c7a97499c8be5284a32ed",
@@ -610,16 +620,6 @@
       "source": "hosted",
       "version": "2.1.3"
     },
-    "globbing": {
-      "dependency": "transitive",
-      "description": {
-        "name": "globbing",
-        "sha256": "4f89cfaf6fa74c9c1740a96259da06bd45411ede56744e28017cc534a12b6e2d",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "1.0.0"
-    },
     "graphs": {
       "dependency": "transitive",
       "description": {
@@ -690,16 +690,6 @@
       "source": "hosted",
       "version": "4.1.2"
     },
-    "injector": {
-      "dependency": "transitive",
-      "description": {
-        "name": "injector",
-        "sha256": "ed389bed5b48a699d5b9561c985023d0d5cc88dd5ff2237aadcce5a5ab433e4e",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "3.0.0"
-    },
     "intl": {
       "dependency": "direct main",
       "description": {
@@ -1091,6 +1081,16 @@
       "source": "hosted",
       "version": "1.5.2"
     },
+    "posix": {
+      "dependency": "transitive",
+      "description": {
+        "name": "posix",
+        "sha256": "bc1bad54ad2b735816e31f8d4600cfde6c7839975085ddfbca48b6c9f7c4044e",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "6.5.2"
+    },
     "process": {
       "dependency": "transitive",
       "description": {
@@ -1101,16 +1101,6 @@
       "source": "hosted",
       "version": "5.0.5"
     },
-    "properties": {
-      "dependency": "transitive",
-      "description": {
-        "name": "properties",
-        "sha256": "333f427dd4ed07bdbe8c75b9ff864a1e70b5d7a8426a2e8bdd457b65ae5ac598",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "2.1.1"
-    },
     "provider": {
       "dependency": "direct main",
       "description": {
@@ -1280,16 +1270,6 @@
       "source": "hosted",
       "version": "9.25.0"
     },
-    "sentry_dart_plugin": {
-      "dependency": "direct dev",
-      "description": {
-        "name": "sentry_dart_plugin",
-        "sha256": "da9c1d0b3c87a251bfc36301f16af090a88c2d59128fe9a6f908f5ac20340c97",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "3.4.0"
-    },
     "sentry_flutter": {
       "dependency": "direct main",
       "description": {
@@ -1534,16 +1514,6 @@
       "source": "hosted",
       "version": "2.2.0"
     },
-    "system_info2": {
-      "dependency": "transitive",
-      "description": {
-        "name": "system_info2",
-        "sha256": "b937736ecfa63c45b10dde1ceb6bb30e5c0c340e14c441df024150679d65ac43",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "4.1.0"
-    },
     "term_glyph": {
       "dependency": "transitive",
       "description": {

From 511d1e0bfbe78bdd02c842140a4dc374b7f40dd2 Mon Sep 17 00:00:00 2001
From: BatteredBunny <ayes2022@protonmail.com>
Date: Tue, 15 Sep 2026 15:52:33 +0300
Subject: [PATCH 28/59] plezy: clean up

---
 pkgs/by-name/pl/plezy/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pl/plezy/package.nix b/pkgs/by-name/pl/plezy/package.nix
index 936b477e4300..6c261b76738a 100644
--- a/pkgs/by-name/pl/plezy/package.nix
+++ b/pkgs/by-name/pl/plezy/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   stdenvNoCC,
-  flutter344,
+  flutter347,
   fetchFromGitHub,
   fetchurl,
   pkg-config,
@@ -47,6 +47,7 @@ let
   meta = {
     description = "Modern cross-platform Emby, Plex & Jellyfin client built with Flutter";
     homepage = "https://github.com/edde746/plezy";
+    changelog = "https://github.com/edde746/plezy/releases/tag/${version}";
     mainProgram = "plezy";
     license = lib.licenses.gpl3Only;
     maintainers = with lib.maintainers; [
@@ -62,7 +63,7 @@ let
     );
   };
 
-  linux = flutter344.buildFlutterApplication rec {
+  linux = flutter347.buildFlutterApplication rec {
     inherit pname version src;
 
     pubspecLock = lib.importJSON ./pubspec.lock.json;

From 16d284469fc9d9f3eae188daa47157283452d4da Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Tue, 15 Sep 2026 17:53:38 +0200
Subject: [PATCH 29/59] =?UTF-8?q?ocamlPackages.httpcats:=200.3.1=20?=
 =?UTF-8?q?=E2=86=92=200.3.2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/development/ocaml-modules/httpcats/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/ocaml-modules/httpcats/default.nix b/pkgs/development/ocaml-modules/httpcats/default.nix
index c25d75a3e446..27146ca900ea 100644
--- a/pkgs/development/ocaml-modules/httpcats/default.nix
+++ b/pkgs/development/ocaml-modules/httpcats/default.nix
@@ -18,11 +18,11 @@
 
 buildDunePackage (finalAttrs: {
   pname = "httpcats";
-  version = "0.3.1";
+  version = "0.3.2";
 
   src = fetchurl {
     url = "https://github.com/robur-coop/httpcats/releases/download/v${finalAttrs.version}/httpcats-${finalAttrs.version}.tbz";
-    hash = "sha256-5BymoyJS5JykTnSee0HhSKzbHkb8j6COuY7tZtGDGh0=";
+    hash = "sha256-n0InZn+7jaDbf3WaMACdh3DPMfkfewmkcXQAVfR81rg=";
   };
 
   propagatedBuildInputs = [

From fc2e63f6c94d451ed4e524bf9d345983ecca2ee8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Sep 2026 19:08:55 +0000
Subject: [PATCH 30/59] scalingo: 1.48.0 -> 1.49.0

---
 pkgs/by-name/sc/scalingo/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sc/scalingo/package.nix b/pkgs/by-name/sc/scalingo/package.nix
index c691a5c65243..214429945d94 100644
--- a/pkgs/by-name/sc/scalingo/package.nix
+++ b/pkgs/by-name/sc/scalingo/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "scalingo";
-  version = "1.48.0";
+  version = "1.49.0";
 
   src = fetchFromGitHub {
     owner = "scalingo";
     repo = "cli";
     rev = version;
-    hash = "sha256-vwTgr9zzRo4/o3D9p/jcmwKskmjClj4sfd8zalK7PDg=";
+    hash = "sha256-U3OG0rmZMN/uTeXSA7A7pdG6PYR65h836rSYAsRp6yQ=";
   };
 
   vendorHash = null;

From 0a923a21a2f31b327591b1126d6b092188b9cf21 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Sep 2026 19:54:41 +0000
Subject: [PATCH 31/59] libcs50: 11.0.3 -> 11.0.4

---
 pkgs/by-name/li/libcs50/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libcs50/package.nix b/pkgs/by-name/li/libcs50/package.nix
index a11949699d64..adc8e3cce00b 100644
--- a/pkgs/by-name/li/libcs50/package.nix
+++ b/pkgs/by-name/li/libcs50/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libcs50";
-  version = "11.0.3";
+  version = "11.0.4";
 
   src = fetchFromGitHub {
     owner = "cs50";
     repo = "libcs50";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-G6QayPGR4lkeFuUYsFszekLAzzpA3hhIRmqt/OB0cdY=";
+    hash = "sha256-guITfJoNEiQAjfKiDKltWoP8VcLsyeEuzU4odhpwyUI=";
   };
 
   installPhase = ''

From ed523f3d76f3be08e584b3801042cbae7b95977b Mon Sep 17 00:00:00 2001
From: Gliczy <gliczy.h@gmail.com>
Date: Tue, 15 Sep 2026 21:54:45 +0200
Subject: [PATCH 32/59] mpd-mpris: 0.4.3 -> 0.4.4

---
 pkgs/by-name/mp/mpd-mpris/package.nix | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/mp/mpd-mpris/package.nix b/pkgs/by-name/mp/mpd-mpris/package.nix
index edaabd5af9e7..abac75602421 100644
--- a/pkgs/by-name/mp/mpd-mpris/package.nix
+++ b/pkgs/by-name/mp/mpd-mpris/package.nix
@@ -2,31 +2,23 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
-  fetchpatch,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "mpd-mpris";
-  version = "0.4.3";
+  version = "0.4.4";
 
   src = fetchFromGitHub {
     owner = "natsukagami";
     repo = "mpd-mpris";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-w8OH34JW++OYLpNIHfQvc45dFyU/wVWVa+vEwWb8VqU=";
+    hash = "sha256-EOZiOFBe5j1WsrJLj8++QsgNUZR44M6ae40KKl2Qac8=";
   };
 
   vendorHash = "sha256-ugJEw02jSsfObljDaup31zoQlf2HvwDRUljD7lp7Ys4=";
 
   subPackages = [ "cmd/mpd-mpris" ];
 
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/natsukagami/mpd-mpris/commit/1591f15548aed0f9741d723f24fb505cb24fafe8.patch";
-      hash = "sha256-6ZqR4woKiIjwLxyafmidTM8eBXtvBzKNXZvtS1+KKKI=";
-    })
-  ];
-
   postPatch = ''
     substituteInPlace services/mpd-mpris.service --replace-fail "ExecStart=" "ExecStart=$out/bin/"
   '';

From a34147b364e176b232bbf912c677c245ff8029d9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Sep 2026 20:50:51 +0000
Subject: [PATCH 33/59] wealthfolio-server: 3.7.0 -> 3.8.0

---
 pkgs/by-name/we/wealthfolio-server/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/we/wealthfolio-server/package.nix b/pkgs/by-name/we/wealthfolio-server/package.nix
index 919513cfb6d6..406c0cc7f896 100644
--- a/pkgs/by-name/we/wealthfolio-server/package.nix
+++ b/pkgs/by-name/we/wealthfolio-server/package.nix
@@ -54,18 +54,18 @@ rustPlatform.buildRustPackage (
     __structuredAttrs = true;
 
     pname = "wealthfolio-server";
-    version = "3.7.0";
+    version = "3.8.0";
 
     src = fetchFromGitHub {
       owner = "wealthfolio";
       repo = "wealthfolio";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-GsI2TrPXEiHKUnUxNNmYf2EveWlg5PJBGh5TYILK0yc=";
+      hash = "sha256-5CqLHnwBzqA+yf/sQM2ie3xuO+5aM5EDA0bhZ6r1VIM=";
     };
 
     cargoRoot = ".";
     buildAndTestSubdir = "apps/server";
-    cargoHash = "sha256-vnmhaAoF3O5N+y3HpYZz+2j/WU1HAA5uyKtxLCJBqA4=";
+    cargoHash = "sha256-PFMmpQhQubMzomvLWMJZrriH9emwEzO/rTFCovzFt6w=";
 
     nativeBuildInputs = [ makeWrapper ];
 

From d2c12646d0fbfdbe917f35f42da9b131ce5471ee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 15 Sep 2026 13:57:00 -0700
Subject: [PATCH 34/59] immich: 3.2.1 -> 3.2.2

Diff: https://github.com/immich-app/immich/compare/v3.2.1...v3.2.2

Changelog: https://github.com/immich-app/immich/releases/tag/v3.2.2
---
 pkgs/by-name/im/immich/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/im/immich/package.nix b/pkgs/by-name/im/immich/package.nix
index a01db75e815d..ff0c14592a5a 100644
--- a/pkgs/by-name/im/immich/package.nix
+++ b/pkgs/by-name/im/immich/package.nix
@@ -109,13 +109,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "immich";
-  version = "3.2.1";
+  version = "3.2.2";
 
   src = fetchFromGitHub {
     owner = "immich-app";
     repo = "immich";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ufdMwERs1h+m2usMHztZicRXpI20BM+2PeOLBArXw1Y=";
+    hash = "sha256-napG+EMZbbbeq7R8FtnuDsDwdpxItkwTVWztnw07DfA=";
   };
 
   pnpmDeps = fetchPnpmDeps {

From 37e4c5dee5ef9042ce225d1800a0e7808a8aeece Mon Sep 17 00:00:00 2001
From: emilylange <git@emilylange.de>
Date: Tue, 15 Sep 2026 23:30:36 +0200
Subject: [PATCH 35/59] chromium,chromedriver: 153.0.8010.36 -> 153.0.8010.47

https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html

This update includes 42 security fixes.

CVEs:
CVE-2026-91726 CVE-2026-91721 CVE-2026-91749 CVE-2026-91724
CVE-2026-91728 CVE-2026-91734 CVE-2026-91727 CVE-2026-91743
CVE-2026-91744 CVE-2026-91712 CVE-2026-91748 CVE-2026-91720
CVE-2026-91731 CVE-2026-91747 CVE-2026-91733 CVE-2026-91741
CVE-2026-91709 CVE-2026-91717 CVE-2026-91735 CVE-2026-91708
CVE-2026-91736 CVE-2026-91740 CVE-2026-91710 CVE-2026-91718
CVE-2026-91716 CVE-2026-91746 CVE-2026-91729 CVE-2026-91737
CVE-2026-91711 CVE-2026-91715 CVE-2026-91745 CVE-2026-91723
CVE-2026-91732 CVE-2026-91742 CVE-2026-91714 CVE-2026-91725
CVE-2026-91739 CVE-2026-91713 CVE-2026-91738 CVE-2026-91730
CVE-2026-91722 CVE-2026-91719
---
 .../networking/browsers/chromium/info.json    | 32 +++++++++----------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index 2cb44de16b16..4884943dedfe 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -1,10 +1,10 @@
 {
   "chromium": {
-    "version": "153.0.8010.36",
+    "version": "153.0.8010.47",
     "chromedriver": {
-      "version": "153.0.8010.37",
-      "hash_darwin": "sha256-IMyEnUmK3slNB/QDZ+vtUyzHyU0AB+L6+BMbpCRluYA=",
-      "hash_darwin_aarch64": "sha256-cd1ZWatLQFIkPtCdVacrxFaFfj3rjG9qJ7kGlL3C6OA="
+      "version": "153.0.8010.48",
+      "hash_darwin": "sha256-/4yv3KWuvKNAro9oeK+PFsTOrg878yS11aDYSX5S890=",
+      "hash_darwin_aarch64": "sha256-5eO1WwJ8iQrXUjHb776Z1YahR/A8aCoX7JrJXQEcIQ8="
     },
     "deps": {
       "depot_tools": {
@@ -21,8 +21,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "507c6ee3e2f3b2ca0e660547e5b9ea4820c67f4c",
-        "hash": "sha256-q29a3PWQ7wMG4/JL9EyCK7EaDCeG+4Q/ruemOvvgeZM=",
+        "rev": "73934a44f61e6b3878d1943064c141a5a820f5f7",
+        "hash": "sha256-D7Oqukze3CzYVWN9AQq9zN6HN2GcZ6b7ZSqhM5bjvUU=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -92,8 +92,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "fca5efdfeff5daf430bc4458375c8d6b7e457400",
-        "hash": "sha256-IoHQfdjZ6TV03VVzHZcxhPqGmNYNhKZrPG4BvQQfC7c="
+        "rev": "ed04c8113c6538f3e1264042da8cb4afd100369b",
+        "hash": "sha256-mZrVJ/P3tPoiSkGBH4fEjNAexLsjAzts8jjkCQZ4kOs="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -132,8 +132,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "225a7ba1bcb997d26de3e894e04fb341638e8c5a",
-        "hash": "sha256-/ic1j1gu2wl5wCLCESfEcsLAPU5Dmsx8oKFb6RhYzg4="
+        "rev": "28ffc61fc935c599677cff4dddfa4a12209ce500",
+        "hash": "sha256-6ySDyyQs/nfFF9AeoUY57GYDx7V8b0GQ17PCwQkzZVk="
       },
       "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -632,8 +632,8 @@
       },
       "src/third_party/pthreadpool/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/pthreadpool.git",
-        "rev": "02460584c6092e527c8b89f7df4de143d70e801f",
-        "hash": "sha256-4EHJzZT+Gbhs8SkOhjSvDIPEqIQU93oJmtF3c/T+qjw="
+        "rev": "15a6644ba1c45f1acc16ac1e883efc3e56c6bed2",
+        "hash": "sha256-YJD9n8cxoqTrTQJHKuZFW2qnlNcNmh5rQlBpnlF46to="
       },
       "src/third_party/pyelftools": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git",
@@ -672,8 +672,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "4f574af2444846ceca4d277a8095c5d4229d175f",
-        "hash": "sha256-HrpA4labNWXPWj/yiS9O8KjdQPwJOllmR5r66TwCjB0="
+        "rev": "fca11a08da7c1ed3777b40b31611961c85c63c43",
+        "hash": "sha256-iQNNgvRVUuyAcSVE+pNJWrWz0NJd/MZLxd9vbYztong="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -842,8 +842,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "f343157cebb388bfa416baccb5d35507e6fe8cc7",
-        "hash": "sha256-zSCyFQpDMNygmV6N4TajL8VB5+VRynrMPV/wAiWsJO4="
+        "rev": "6b96683d44174e78ff4e65cb274bad56dc108231",
+        "hash": "sha256-Oa1wzIbWVPX0x7adJVPUxQocK5gofG0vE56QTg0XKCs="
       },
       "src/agents/shared": {
         "url": "https://chromium.googlesource.com/chromium/agents.git",

From 6dc4fd392217a9802cfcf8a5deb717ec5520f9ca Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Wed, 16 Sep 2026 07:36:44 +1000
Subject: [PATCH 36/59] linux/common-config: fix MEMORY_HOTPLUG_DEFAULT_ONLINE
 on 6.12

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/mm/Kconfig?id=f7c7d3cc8417f8579b5a90e3f6319703951070c2

> Existing users of CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE=y should use
> CONFIG_MHP_DEFAULT_ONLINE_TYPE_ONLINE_AUTO.

was backported in https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.110
---
 pkgs/os-specific/linux/kernel/common-config.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index bf7ba4373479..c8bb15d53607 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -1522,8 +1522,8 @@ let
             ACPI_HOTPLUG_CPU = yes;
             ACPI_HOTPLUG_MEMORY = yes;
             MEMORY_HOTPLUG = yes;
-            MEMORY_HOTPLUG_DEFAULT_ONLINE = whenOlder "6.14" yes;
-            MHP_DEFAULT_ONLINE_TYPE_ONLINE_AUTO = whenAtLeast "6.14" yes;
+            MEMORY_HOTPLUG_DEFAULT_ONLINE = whenOlder "6.12" yes;
+            MHP_DEFAULT_ONLINE_TYPE_ONLINE_AUTO = whenAtLeast "6.12" yes;
             MEMORY_HOTREMOVE = lib.mkIf (
               with stdenv.hostPlatform;
               isLoongArch64

From 885ed3ec18a9ef2706abe0be3fd3b0becd6294e7 Mon Sep 17 00:00:00 2001
From: emilylange <git@emilylange.de>
Date: Wed, 16 Sep 2026 02:05:39 +0200
Subject: [PATCH 37/59] ungoogled-chromium: 153.0.8010.36-1 -> 153.0.8010.47-1

https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html

This update includes 42 security fixes.

CVEs:
CVE-2026-91726 CVE-2026-91721 CVE-2026-91749 CVE-2026-91724
CVE-2026-91728 CVE-2026-91734 CVE-2026-91727 CVE-2026-91743
CVE-2026-91744 CVE-2026-91712 CVE-2026-91748 CVE-2026-91720
CVE-2026-91731 CVE-2026-91747 CVE-2026-91733 CVE-2026-91741
CVE-2026-91709 CVE-2026-91717 CVE-2026-91735 CVE-2026-91708
CVE-2026-91736 CVE-2026-91740 CVE-2026-91710 CVE-2026-91718
CVE-2026-91716 CVE-2026-91746 CVE-2026-91729 CVE-2026-91737
CVE-2026-91711 CVE-2026-91715 CVE-2026-91745 CVE-2026-91723
CVE-2026-91732 CVE-2026-91742 CVE-2026-91714 CVE-2026-91725
CVE-2026-91739 CVE-2026-91713 CVE-2026-91738 CVE-2026-91730
CVE-2026-91722 CVE-2026-91719
---
 .../networking/browsers/chromium/info.json    | 30 +++++++++----------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index 4884943dedfe..3641623861a7 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -853,7 +853,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "153.0.8010.36",
+    "version": "153.0.8010.47",
     "deps": {
       "depot_tools": {
         "rev": "6411ed52842756261c66b6b8ece6b53ade2570f1",
@@ -865,16 +865,16 @@
         "hash": "sha256-qvQ13Ws2tb4i2Hdu34kBHivYPAn8w06zjLdQgK4BIJg="
       },
       "ungoogled-patches": {
-        "rev": "153.0.8010.36-1",
-        "hash": "sha256-JyvizS0oJC8J6VhtnpTKUGVbc31KCvTvwa4TmO+CHaY="
+        "rev": "153.0.8010.47-1",
+        "hash": "sha256-J/IiNmqJzL35TfiGbsqrXnI8lUizCWuxzVBHgo7cG80="
       },
       "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "507c6ee3e2f3b2ca0e660547e5b9ea4820c67f4c",
-        "hash": "sha256-q29a3PWQ7wMG4/JL9EyCK7EaDCeG+4Q/ruemOvvgeZM=",
+        "rev": "73934a44f61e6b3878d1943064c141a5a820f5f7",
+        "hash": "sha256-D7Oqukze3CzYVWN9AQq9zN6HN2GcZ6b7ZSqhM5bjvUU=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -944,8 +944,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "fca5efdfeff5daf430bc4458375c8d6b7e457400",
-        "hash": "sha256-IoHQfdjZ6TV03VVzHZcxhPqGmNYNhKZrPG4BvQQfC7c="
+        "rev": "ed04c8113c6538f3e1264042da8cb4afd100369b",
+        "hash": "sha256-mZrVJ/P3tPoiSkGBH4fEjNAexLsjAzts8jjkCQZ4kOs="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -984,8 +984,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "225a7ba1bcb997d26de3e894e04fb341638e8c5a",
-        "hash": "sha256-/ic1j1gu2wl5wCLCESfEcsLAPU5Dmsx8oKFb6RhYzg4="
+        "rev": "28ffc61fc935c599677cff4dddfa4a12209ce500",
+        "hash": "sha256-6ySDyyQs/nfFF9AeoUY57GYDx7V8b0GQ17PCwQkzZVk="
       },
       "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1484,8 +1484,8 @@
       },
       "src/third_party/pthreadpool/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/pthreadpool.git",
-        "rev": "02460584c6092e527c8b89f7df4de143d70e801f",
-        "hash": "sha256-4EHJzZT+Gbhs8SkOhjSvDIPEqIQU93oJmtF3c/T+qjw="
+        "rev": "15a6644ba1c45f1acc16ac1e883efc3e56c6bed2",
+        "hash": "sha256-YJD9n8cxoqTrTQJHKuZFW2qnlNcNmh5rQlBpnlF46to="
       },
       "src/third_party/pyelftools": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git",
@@ -1524,8 +1524,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "4f574af2444846ceca4d277a8095c5d4229d175f",
-        "hash": "sha256-HrpA4labNWXPWj/yiS9O8KjdQPwJOllmR5r66TwCjB0="
+        "rev": "fca11a08da7c1ed3777b40b31611961c85c63c43",
+        "hash": "sha256-iQNNgvRVUuyAcSVE+pNJWrWz0NJd/MZLxd9vbYztong="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1694,8 +1694,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "f343157cebb388bfa416baccb5d35507e6fe8cc7",
-        "hash": "sha256-zSCyFQpDMNygmV6N4TajL8VB5+VRynrMPV/wAiWsJO4="
+        "rev": "6b96683d44174e78ff4e65cb274bad56dc108231",
+        "hash": "sha256-Oa1wzIbWVPX0x7adJVPUxQocK5gofG0vE56QTg0XKCs="
       },
       "src/agents/shared": {
         "url": "https://chromium.googlesource.com/chromium/agents.git",

From 2821dc30db8524220b11b8b966824b6ade43340d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Sep 2026 02:53:49 +0000
Subject: [PATCH 38/59] todoist-cli: 5.2.1 -> 5.3.6

---
 pkgs/by-name/to/todoist-cli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/to/todoist-cli/package.nix b/pkgs/by-name/to/todoist-cli/package.nix
index 2ac2726523d0..460bca685547 100644
--- a/pkgs/by-name/to/todoist-cli/package.nix
+++ b/pkgs/by-name/to/todoist-cli/package.nix
@@ -7,16 +7,16 @@
 }:
 buildNpmPackage rec {
   pname = "todoist-cli";
-  version = "5.2.1";
+  version = "5.3.6";
 
   src = fetchFromGitHub {
     owner = "Doist";
     repo = "todoist-cli";
     rev = "v${version}";
-    sha256 = "sha256-RYk1MSL15dt8aTeRxNPcVNYXnaDRURiITfMEBqR4DIA=";
+    sha256 = "sha256-x1zoHqNXWCwv2wQS56H3Z5DUxWTXFbcaYlupOvm/lfs=";
   };
 
-  npmDepsHash = "sha256-JDFKNVm8G/s4fVsXjKzh0DWmqXDbTJ7huv3LO5mq+rU=";
+  npmDepsHash = "sha256-ll3UnmbJrvzv6F5LvhJRMkyA3FRxaiJvVCwk0Wy81Ks=";
 
   doCheck = true;
 

From 475d4aa27ed08f5013aace642f440d1f8a3ae0ad Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Sep 2026 03:13:27 +0000
Subject: [PATCH 39/59] libigl: 2.6.3 -> 2.6.4

---
 pkgs/by-name/li/libigl/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libigl/package.nix b/pkgs/by-name/li/libigl/package.nix
index 1462f2bc03ea..fb9268f6c404 100644
--- a/pkgs/by-name/li/libigl/package.nix
+++ b/pkgs/by-name/li/libigl/package.nix
@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "libigl";
-  version = "2.6.3";
+  version = "2.6.4";
 
   src = fetchFromGitHub {
     owner = "libigl";
     repo = "libigl";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uef7aTF2U3iPVAWDGRIsH0YV0l/w8VxtYFPYVkuC1dI=";
+    hash = "sha256-/+wE3ZgqHWdLMaZZE/j7unrx10nd6sh9+JF5P0HB8i4=";
   };
 
   # We could also properly use CMake, but we would have to heavily patch it

From 4f0ae3f517111024ebaedd4cd85535772466c379 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Sep 2026 03:15:58 +0000
Subject: [PATCH 40/59] usbvfiod: 0.2.0 -> 0.3.0

---
 pkgs/by-name/us/usbvfiod/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/us/usbvfiod/package.nix b/pkgs/by-name/us/usbvfiod/package.nix
index 5547c1948b70..706b04da98aa 100644
--- a/pkgs/by-name/us/usbvfiod/package.nix
+++ b/pkgs/by-name/us/usbvfiod/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "usbvfiod";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "cyberus-technology";
     repo = "usbvfiod";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-gus0Bdsd0zUuhsAQ4I1Z/BphKOjAlmbpqND6W+6cNbg=";
+    hash = "sha256-gYKWmUaB7c5netQjR7qHKuBq82X3J+o4gQCsB/3cq50=";
   };
 
-  cargoHash = "sha256-7RTaWi93WJV2HEVyljSzRVG+eCwo6+Ywq4Y+ng1UMww=";
+  cargoHash = "sha256-B4iyADjXjX7VdGaTIdCKUalwJt6vMVnqqUCyLsu5wUI=";
 
   nativeInstallCheckInputs = [
     versionCheckHook

From 683349bb6b287b81b58c459c1e66e22fde9b40f1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Sep 2026 04:10:55 +0000
Subject: [PATCH 41/59] vacuum-go: 0.30.3 -> 0.30.6

---
 pkgs/by-name/va/vacuum-go/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/va/vacuum-go/package.nix b/pkgs/by-name/va/vacuum-go/package.nix
index b579053d6ceb..ecb33bd37cc4 100644
--- a/pkgs/by-name/va/vacuum-go/package.nix
+++ b/pkgs/by-name/va/vacuum-go/package.nix
@@ -7,16 +7,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "vacuum-go";
-  version = "0.30.3";
+  version = "0.30.6";
 
   src = fetchFromGitHub {
     owner = "daveshanley";
     repo = "vacuum";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-FIKkT3u2/9O9mosM6myFs5WvYa6WC7T4O/CcGuIdbDQ=";
+    hash = "sha256-27ZGWy9lblCAlvodpmgyhHaS2uHP5gpM8SDh44agdZ8=";
   };
 
-  vendorHash = "sha256-IX80z+3IpgZPqdklJzTZyOlLDM6Qbw8y1Q344r5TYpc=";
+  vendorHash = "sha256-0fKjscF77MubYr+AhvWAk8Oh0OQP948vGW8zbwAS1xw=";
 
   env.CGO_ENABLED = 0;
   ldflags = [

From 4bc69b57b6fcb77304813077672217c4f677232f Mon Sep 17 00:00:00 2001
From: Konstantin Alekseev <konstantin@kotify.com>
Date: Tue, 15 Sep 2026 22:18:11 +0300
Subject: [PATCH 42/59] playwright: 1.62.1 -> 1.63.0

https://github.com/microsoft/playwright/releases/tag/v1.63.0

Use Chrome for Testing downloads for ARM64 Linux Chromium and its
headless shell. Refresh their hashes and install Chromium under the
directory expected by the updated driver.

Assisted-by: OpenAI Codex (GPT-6)
---
 pkgs/by-name/pl/playwright-mcp/package.nix       |  6 +++---
 .../python-modules/playwright/default.nix        |  4 ++--
 .../web/playwright/browser-downloads.nix         |  4 ++--
 pkgs/development/web/playwright/browsers.json    | 16 ++++++++--------
 .../web/playwright/chromium-headless-shell.nix   |  6 +++---
 pkgs/development/web/playwright/chromium.nix     | 10 +++++-----
 pkgs/development/web/playwright/driver.nix       |  6 +++---
 pkgs/development/web/playwright/firefox.nix      |  6 +++---
 pkgs/development/web/playwright/webkit.nix       |  6 +++---
 9 files changed, 32 insertions(+), 32 deletions(-)

diff --git a/pkgs/by-name/pl/playwright-mcp/package.nix b/pkgs/by-name/pl/playwright-mcp/package.nix
index 7d2772508e9f..f573d0ab6ced 100644
--- a/pkgs/by-name/pl/playwright-mcp/package.nix
+++ b/pkgs/by-name/pl/playwright-mcp/package.nix
@@ -9,16 +9,16 @@
 buildNpmPackage rec {
   pname = "playwright-mcp";
   # nixpkgs-update: no auto update
-  version = "0.0.78";
+  version = "0.0.80";
 
   src = fetchFromGitHub {
     owner = "Microsoft";
     repo = "playwright-mcp";
     tag = "v${version}";
-    hash = "sha256-k5dhHABKZqph3RzFcJjD+/RcMB+lZZ0UiS6eNGyAEtE=";
+    hash = "sha256-pIePGuIxBaHqvP6QVLzGSef0uarYE+X/rs3LWZEU22U=";
   };
 
-  npmDepsHash = "sha256-Oe0jtvxKyQMQ6uSwBQoGisvv4n0lR6EcyElzh9GHZac=";
+  npmDepsHash = "sha256-3T4XNZSUL5sbcHmWfn9Dfigu635FACVEZ/EHSKYu1+8=";
 
   nativeBuildInputs = [ makeWrapper ];
 
diff --git a/pkgs/development/python-modules/playwright/default.nix b/pkgs/development/python-modules/playwright/default.nix
index 190aa583217b..2852bfe76ed7 100644
--- a/pkgs/development/python-modules/playwright/default.nix
+++ b/pkgs/development/python-modules/playwright/default.nix
@@ -31,14 +31,14 @@ in
 buildPythonPackage (finalAttrs: {
   pname = "playwright";
   # run ./pkgs/development/web/playwright/update.sh to update
-  version = "1.62.0";
+  version = "1.63.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "microsoft";
     repo = "playwright-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-E9silyNQtFEPShimuEbWXvg5fgf+vqaiDez+Ri0jDTw=";
+    hash = "sha256-DHMX7RaySqfy2Xi+Rw4nUg9pYrpxIksjq1JhWfknOaI=";
   };
 
   patches = [
diff --git a/pkgs/development/web/playwright/browser-downloads.nix b/pkgs/development/web/playwright/browser-downloads.nix
index 280734257919..cd59ec38e19b 100644
--- a/pkgs/development/web/playwright/browser-downloads.nix
+++ b/pkgs/development/web/playwright/browser-downloads.nix
@@ -20,13 +20,13 @@ in
 {
   chromium = {
     x86_64-linux = mk (cftUrl "linux64/chrome-linux64.zip") true;
-    aarch64-linux = mk (registryUrl "chromium" "chromium-linux-arm64.zip") true;
+    aarch64-linux = mk (cftUrl "linux-arm64/chrome-linux-arm64.zip") true;
     aarch64-darwin = mk (cftUrl "mac-arm64/chrome-mac-arm64.zip") false;
   };
 
   "chromium-headless-shell" = {
     x86_64-linux = mk (cftUrl "linux64/chrome-headless-shell-linux64.zip") false;
-    aarch64-linux = mk (registryUrl "chromium" "chromium-headless-shell-linux-arm64.zip") false;
+    aarch64-linux = mk (cftUrl "linux-arm64/chrome-headless-shell-linux-arm64.zip") false;
     aarch64-darwin = mk (cftUrl "mac-arm64/chrome-headless-shell-mac-arm64.zip") false;
   };
 
diff --git a/pkgs/development/web/playwright/browsers.json b/pkgs/development/web/playwright/browsers.json
index 6020af73b788..3ebae73640c5 100644
--- a/pkgs/development/web/playwright/browsers.json
+++ b/pkgs/development/web/playwright/browsers.json
@@ -2,23 +2,23 @@
   "comment": "This file is kept up to date via update.sh",
   "browsers": {
     "chromium": {
-      "revision": "1234",
-      "browserVersion": "151.0.7922.34",
+      "revision": "1243",
+      "browserVersion": "153.0.8010.12",
       "title": "Chrome for Testing"
     },
     "chromium-headless-shell": {
-      "revision": "1234",
-      "browserVersion": "151.0.7922.34",
+      "revision": "1243",
+      "browserVersion": "153.0.8010.12",
       "title": "Chrome Headless Shell"
     },
     "firefox": {
-      "revision": "1538",
-      "browserVersion": "153.0",
+      "revision": "1543",
+      "browserVersion": "155.0",
       "title": "Firefox"
     },
     "webkit": {
-      "revision": "2336",
-      "browserVersion": "26.5",
+      "revision": "2359",
+      "browserVersion": "26.6",
       "title": "WebKit"
     },
     "ffmpeg": {
diff --git a/pkgs/development/web/playwright/chromium-headless-shell.nix b/pkgs/development/web/playwright/chromium-headless-shell.nix
index ee808412ea22..babc6a82a1e4 100644
--- a/pkgs/development/web/playwright/chromium-headless-shell.nix
+++ b/pkgs/development/web/playwright/chromium-headless-shell.nix
@@ -36,8 +36,8 @@ let
       inherit (download) url stripRoot;
       hash =
         {
-          x86_64-linux = "sha256-2w0Ul3tpzrVkfGHIbQGwEsCRmVUUy3OAShGhuoH6Rmw=";
-          aarch64-linux = "sha256-DoZf+pKXW0Oj2e8vtGDDSViJ0SX8PkYE1Q0LJs53IWg=";
+          x86_64-linux = "sha256-GLqqZOwtnJig+ZCIT8FYsIxZGSFTmRwLbqNXeSOdJXA=";
+          aarch64-linux = "sha256-7DSqFxtk8Jf4/ktoW1MmH5vHs5LEp7jNvglYRoKXBm4=";
         }
         .${system} or throwSystem;
     };
@@ -72,7 +72,7 @@ let
     inherit (download) url stripRoot;
     hash =
       {
-        aarch64-darwin = "sha256-5VQESywHZKhqc7Fhq/jqNF+yXl90F3+i9nPzBHyJV8k=";
+        aarch64-darwin = "sha256-Elbpy5UDVndRzWRi8Nb391AhAAYl55PJ/3Fxz/RI/4I=";
       }
       .${system} or throwSystem;
   };
diff --git a/pkgs/development/web/playwright/chromium.nix b/pkgs/development/web/playwright/chromium.nix
index e58ea513f333..6094d16444fd 100644
--- a/pkgs/development/web/playwright/chromium.nix
+++ b/pkgs/development/web/playwright/chromium.nix
@@ -49,11 +49,11 @@ let
 
   # Playwright expects different directory names for different architectures:
   # - linux-x64 expects: chrome-linux64
-  # - linux-arm64 expects: chrome-linux
+  # - linux-arm64 expects: chrome-linux-arm64
   chromeDir =
     {
       x86_64-linux = "chrome-linux64";
-      aarch64-linux = "chrome-linux";
+      aarch64-linux = "chrome-linux-arm64";
     }
     .${system} or throwSystem;
 
@@ -63,8 +63,8 @@ let
       inherit (download) url stripRoot;
       hash =
         {
-          x86_64-linux = "sha256-3/o8ZFVeL/YDuO+aax+qcm6xv77AX6Vl6meP+S05cTk=";
-          aarch64-linux = "sha256-53xm/L3QYH22AZ8K/5cKg1gLewKv7s3lTDmXlHw4KDg=";
+          x86_64-linux = "sha256-ORdMu1e4Peolr8rdfvzgeaFhC8RgBipaOsAm7e3ZeqE=";
+          aarch64-linux = "sha256-AWXksACJGsDisnp9dAUcukDf/ruMCRCX9kZNNnE0R8Q=";
         }
         .${system} or throwSystem;
     };
@@ -130,7 +130,7 @@ let
     inherit (download) url stripRoot;
     hash =
       {
-        aarch64-darwin = "sha256-ugo4gRST53YA1uaLXfwnFhFdouShtUAGFnf2ZKbg5jI=";
+        aarch64-darwin = "sha256-Zm7aHjwXL0kbucBiNoWxBM6rFdY0UmVIwcr/f8V31G8=";
       }
       .${system} or throwSystem;
   };
diff --git a/pkgs/development/web/playwright/driver.nix b/pkgs/development/web/playwright/driver.nix
index 9bb571405e4f..d34b2b915139 100644
--- a/pkgs/development/web/playwright/driver.nix
+++ b/pkgs/development/web/playwright/driver.nix
@@ -19,13 +19,13 @@ let
   throwSystem = throw "Unsupported system: ${system}";
   browsersJSON = (lib.importJSON ./browsers.json).browsers;
 
-  version = "1.62.1";
+  version = "1.63.0";
 
   src = fetchFromGitHub {
     owner = "Microsoft";
     repo = "playwright";
     rev = "v${version}";
-    hash = "sha256-3gLXo9bd2qXCy8MYMbnYU6AXIWrqoitqMBPMF4g07nY=";
+    hash = "sha256-W5x48pV5OlOzL65JQ3OJf2gL6T/FLAYJO2SwCb7IzOY=";
   };
 
   playwright = buildNpmPackage {
@@ -33,7 +33,7 @@ let
     inherit version src;
 
     sourceRoot = "${src.name}"; # update.sh depends on sourceRoot presence
-    npmDepsHash = "sha256-iebe0sP3VMdk1vBFDkwM1L4x2VrHPZF/NbjMeU5diWM=";
+    npmDepsHash = "sha256-6unp+NT6BHEaLE9XJ6tv49N/0yY4pJ5dyvSqmE9O3SQ=";
 
     nativeBuildInputs = [
       cacert
diff --git a/pkgs/development/web/playwright/firefox.nix b/pkgs/development/web/playwright/firefox.nix
index cd0345e00928..f5e4235421fc 100644
--- a/pkgs/development/web/playwright/firefox.nix
+++ b/pkgs/development/web/playwright/firefox.nix
@@ -19,8 +19,8 @@ let
       inherit (download) url stripRoot;
       hash =
         {
-          x86_64-linux = "sha256-GmjRWhlSv7by3PFtrKgo6EBmHigmp55HwG8iA/Ykq88=";
-          aarch64-linux = "sha256-7vxVe82NxebzoSSoSFg9qNxKOqlT7EOwCxQVavkDoMM=";
+          x86_64-linux = "sha256-FyUUBrffHSh28C3BfYgHRJzTbAixRXN0QoZ3tbtdbYU=";
+          aarch64-linux = "sha256-vkK7bYqf5FiYoHcNmSjXYy7i5rsSLNpx9w+KL7MY0uo=";
         }
         .${system} or throwSystem;
     };
@@ -42,7 +42,7 @@ let
     inherit (download) url stripRoot;
     hash =
       {
-        aarch64-darwin = "sha256-E7/Kbvjg1dcWwSe/07hMR+W6NR0JHoAPxp1e+SncQYs=";
+        aarch64-darwin = "sha256-mFCMrL5PMX5C0Ob/tKKfbZfZJwF5QDM0rhS7v/P3IUw=";
       }
       .${system} or throwSystem;
   };
diff --git a/pkgs/development/web/playwright/webkit.nix b/pkgs/development/web/playwright/webkit.nix
index 2554ebf47329..e6f843aa9257 100644
--- a/pkgs/development/web/playwright/webkit.nix
+++ b/pkgs/development/web/playwright/webkit.nix
@@ -129,8 +129,8 @@ let
       inherit (download) url stripRoot;
       hash =
         {
-          x86_64-linux = "sha256-w/avBW8CAiGd9WzddVGLymLLG23OzY/Bm7Dhw9JVQOA=";
-          aarch64-linux = "sha256-KUVT67b11IljTNpzCcEy+O5CW5UuqyVi6QFdQ87lVLA=";
+          x86_64-linux = "sha256-My6nSOMD2NfPGUmOJKZgWpkjktEsj+P+CPeVmKy1VAQ=";
+          aarch64-linux = "sha256-5CCcWiZN1lVoiiSEO1OvxLcuKhSOIQrD5GH1TYr7XIY=";
         }
         .${system} or throwSystem;
     };
@@ -204,7 +204,7 @@ let
     inherit (download) url stripRoot;
     hash =
       {
-        aarch64-darwin = "sha256-ARcl9y1PD+rzxUipixxGvsII2ah8vsDozAUHI0dSgA8=";
+        aarch64-darwin = "sha256-EjI0TdmQfB2qT2bBtbJFpsa+bplkJ5YyyVxNoOgsnZc=";
       }
       .${system} or throwSystem;
   };

From b14808e380edc4039569a2545f55dc0f965dc5bb Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Sep 2026 05:52:51 +0000
Subject: [PATCH 43/59] gpu-screen-recorder-ui: 1.13.7 -> 1.13.9

---
 pkgs/by-name/gp/gpu-screen-recorder-ui/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gp/gpu-screen-recorder-ui/package.nix b/pkgs/by-name/gp/gpu-screen-recorder-ui/package.nix
index 522156ddeb69..10db980b5c71 100644
--- a/pkgs/by-name/gp/gpu-screen-recorder-ui/package.nix
+++ b/pkgs/by-name/gp/gpu-screen-recorder-ui/package.nix
@@ -34,12 +34,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gpu-screen-recorder-ui";
-  version = "1.13.7";
+  version = "1.13.9";
 
   src = fetchgit {
     url = "https://repo.dec05eba.com/gpu-screen-recorder-ui";
     tag = finalAttrs.version;
-    hash = "sha256-liBdZDHI32ElTTsHAZekYKFgZY1eP7rz4u7tM4pkpZ4=";
+    hash = "sha256-f4jTv3IS73NWStg1af20pGKlqwIN9K9ZyLjKUX9Tp3s=";
   };
 
   nativeBuildInputs = [

From b0fd55f5415f45d447227c3950129e84117ea02a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Sep 2026 05:54:52 +0000
Subject: [PATCH 44/59] sigtop: 0.24.1 -> 0.26.0

---
 pkgs/by-name/si/sigtop/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/si/sigtop/package.nix b/pkgs/by-name/si/sigtop/package.nix
index b27676cb7d35..bed1b7ae1dfd 100644
--- a/pkgs/by-name/si/sigtop/package.nix
+++ b/pkgs/by-name/si/sigtop/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "sigtop";
-  version = "0.24.1";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "tbvdm";
     repo = "sigtop";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-zGDH3qdRI5yzcqEDH9sBg/7842qafCnf2Mc1W35iXY4=";
+    sha256 = "sha256-ZI4GuXWeLuEIKEQtsv6nugsfIc/Dlj2JYoVVmAr2O28=";
   };
 
-  vendorHash = "sha256-6pNBYziJvJ1MMjzcbIjPFAUTW6ZrCNmtYzzAS/ANtEw=";
+  vendorHash = "sha256-NyZTLut10DBNlBYIXjRB9zL98ZZ/A6hu0ypsu3GjHq8=";
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [ libsecret ];

From 5eaa2ec5783e0a93fa03ce674e7ca4375969e8ed Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Sep 2026 05:56:37 +0000
Subject: [PATCH 45/59] september: 0.4.1 -> 0.5.0

---
 pkgs/by-name/se/september/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/se/september/package.nix b/pkgs/by-name/se/september/package.nix
index 0ba2ffa37479..221dcf460804 100644
--- a/pkgs/by-name/se/september/package.nix
+++ b/pkgs/by-name/se/september/package.nix
@@ -9,17 +9,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "september";
-  version = "0.4.1";
+  version = "0.5.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "gemrest";
     repo = "september";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-45xxiz93UhCCJFr3s0+Sgl4LMrUvRbMums1ZNngA1AY=";
+    hash = "sha256-g50hWDuf5TgzI8vfQAAkNYZs6UTIve7IX+fNTWzxu4w=";
   };
 
-  cargoHash = "sha256-rpMnRx4/LdsVjAteY2LFm2j94XjneZ5E6c+pgZXOOr8=";
+  cargoHash = "sha256-tOoiIKeG/b1l/TpTD1K1ZRhVDcWxNILhKqLpJp7QIec=";
 
   nativeBuildInputs = [
     pkg-config

From 59f7251ce34d8263ad94aba2317463033e1ef404 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Sep 2026 06:12:52 +0000
Subject: [PATCH 46/59] delve: 1.27.1 -> 1.27.2

---
 pkgs/by-name/de/delve/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/de/delve/package.nix b/pkgs/by-name/de/delve/package.nix
index 0dcbf731887a..b9ab97687229 100644
--- a/pkgs/by-name/de/delve/package.nix
+++ b/pkgs/by-name/de/delve/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "delve";
-  version = "1.27.1";
+  version = "1.27.2";
 
   src = fetchFromGitHub {
     owner = "go-delve";
     repo = "delve";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-H91QnLyqywgoc3zdTaclzzUxVPagNnxLzKub2gnL25w=";
+    hash = "sha256-vq8RSqSoPmDT/l6izYdM0a6SVJyaIbZ8gsXbgkFPaOw=";
   };
 
   patches = [

From 9674fa3245a648eeee802a99f0e2784c09bc3860 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Sep 2026 06:12:59 +0000
Subject: [PATCH 47/59] python3Packages.onnxscript: 0.7.1 -> 0.7.2

---
 pkgs/development/python-modules/onnxscript/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/onnxscript/default.nix b/pkgs/development/python-modules/onnxscript/default.nix
index a0a376381c44..b668e25244e6 100644
--- a/pkgs/development/python-modules/onnxscript/default.nix
+++ b/pkgs/development/python-modules/onnxscript/default.nix
@@ -31,7 +31,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "onnxscript";
-  version = "0.7.1";
+  version = "0.7.2";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -39,7 +39,7 @@ buildPythonPackage (finalAttrs: {
     owner = "microsoft";
     repo = "onnxscript";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-l6Nsnbg7LG/0Z9y1EX5BPP3sFdY/EZwRFFHOrP4mwdw=";
+    hash = "sha256-Fd7nQ4KZECgUUfLrCo54NiUVcx1IdhGfUdYWXEo7D8o=";
   };
 
   env = {

From e4631497b87302a9baeca50ebe2959d2bc74c8c9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Sep 2026 06:27:13 +0000
Subject: [PATCH 48/59] wakapi: 2.17.6 -> 2.18.0

---
 pkgs/by-name/wa/wakapi/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/wa/wakapi/package.nix b/pkgs/by-name/wa/wakapi/package.nix
index e7a4cddf8580..f37ca868e9f4 100644
--- a/pkgs/by-name/wa/wakapi/package.nix
+++ b/pkgs/by-name/wa/wakapi/package.nix
@@ -6,7 +6,7 @@
   nix-update-script,
 }:
 let
-  version = "2.17.6";
+  version = "2.18.0";
 in
 buildGoLatestModule {
   pname = "wakapi";
@@ -16,10 +16,10 @@ buildGoLatestModule {
     owner = "muety";
     repo = "wakapi";
     tag = version;
-    hash = "sha256-fKCfjLh/nf6rRqxdGPWfEY9EDh+5sXSKkvzgq7D4ocE=";
+    hash = "sha256-OjspvyjD+3SQdJwkfdDRYUWY1Ryqtwr6DqrLESlqcDo=";
   };
 
-  vendorHash = "sha256-eyldhpDU5fT7tHdsQZ4qUrPlu1QSYaXX8FgksvAXiOw=";
+  vendorHash = "sha256-4hmBS/9E7YfsYpjcC7sP0MatCVPR55s9Ac/9YEe2FK8=";
 
   # Not a go module required by the project, contains development utilities
   excludedPackages = [ "scripts" ];

From ed6c49013dab50b88198d8cf0254a9417b538949 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 16 Sep 2026 07:10:02 +0000
Subject: [PATCH 49/59] tuicr: 0.25.0 -> 0.26.0

Diff: https://github.com/agavra/tuicr/compare/v0.25.0...v0.26.0

Changelog: https://github.com/agavra/tuicr/blob/v0.26.0/CHANGELOG.md
---
 pkgs/by-name/tu/tuicr/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/tu/tuicr/package.nix b/pkgs/by-name/tu/tuicr/package.nix
index 1ca9b6bb95c9..8e50cd89d3dd 100644
--- a/pkgs/by-name/tu/tuicr/package.nix
+++ b/pkgs/by-name/tu/tuicr/package.nix
@@ -9,7 +9,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tuicr";
-  version = "0.25.0";
+  version = "0.26.0";
 
   __structuredAttrs = true;
 
@@ -17,10 +17,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "agavra";
     repo = "tuicr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nbjvSRrbJ4LQrn8l0FJ8R5PNpq7gcQR8m78agL59zqs=";
+    hash = "sha256-eu6+jDsCHLWPqMTSWTgtTr9bFiYYAAPFWfR+5dGgefE=";
   };
 
-  cargoHash = "sha256-9L1G0O5kE9EOFAQ092R/C9/SC48K0YcD5D2WjEvkeK0=";
+  cargoHash = "sha256-WrWoTPgdUNF0xQ/Q0GbPGwcOMP5i3clBmyeHcFMsNso=";
 
   strictDeps = true;
 

From b3fe620f98f5326370cb04f93b693bf85fa54b66 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Wed, 16 Sep 2026 09:10:28 +0200
Subject: [PATCH 50/59] Revert "nixos/systemd: enable startSession for run0"

This reverts commit 0ac20b8d029f5c33f8a0dbc0e121a996233b38ab.
---
 nixos/modules/system/boot/systemd.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/nixos/modules/system/boot/systemd.nix b/nixos/modules/system/boot/systemd.nix
index 1065a8b15387..acfb213b98e0 100644
--- a/nixos/modules/system/boot/systemd.nix
+++ b/nixos/modules/system/boot/systemd.nix
@@ -893,7 +893,6 @@ in
         # Upstream config: https://github.com/systemd/systemd/blob/main/src/run/systemd-run0.in
         setLoginUid = true;
         pamMount = false;
-        startSession = true;
       };
     };
 

From 85c466a7dc5440447fe3ebb52aeb193ac85f5365 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Sep 2026 07:40:22 +0000
Subject: [PATCH 51/59] sandbox-runtime: 0.0.75 -> 0.0.76

---
 pkgs/by-name/sa/sandbox-runtime/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sa/sandbox-runtime/package.nix b/pkgs/by-name/sa/sandbox-runtime/package.nix
index 7123e070cd3c..3b3989def24d 100644
--- a/pkgs/by-name/sa/sandbox-runtime/package.nix
+++ b/pkgs/by-name/sa/sandbox-runtime/package.nix
@@ -17,7 +17,7 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "sandbox-runtime";
-  version = "0.0.75";
+  version = "0.0.76";
 
   __structuredAttrs = true;
 
@@ -25,7 +25,7 @@ buildNpmPackage (finalAttrs: {
     owner = "anthropic-experimental";
     repo = "sandbox-runtime";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TfxVceVav2zw2L6D1hbQWOzVQZ4v/hZLollKysqZnKQ=";
+    hash = "sha256-NXr4OuTsHl8oD8oyzwlNuDoZOy2zNh6tWEr7q4KYKwI=";
   };
 
   postPatch =
@@ -37,7 +37,7 @@ buildNpmPackage (finalAttrs: {
 
   strictDeps = true;
 
-  npmDepsHash = "sha256-I7ebBTyRMBLmKE5wB8VEvKlB3Tjx2rbaKLFdMt0wbmg=";
+  npmDepsHash = "sha256-r49lP4aD7kAG7azGH3MAvXnVu2LwlpyToDMmErzdunw=";
 
   postFixup =
     let

From 369737df4010f21cab261f108e52d10145849386 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Sep 2026 08:05:12 +0000
Subject: [PATCH 52/59] meilisearch: 1.53.1 -> 1.53.2

---
 pkgs/by-name/me/meilisearch/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/me/meilisearch/package.nix b/pkgs/by-name/me/meilisearch/package.nix
index 3d5460bfea88..274dad368412 100644
--- a/pkgs/by-name/me/meilisearch/package.nix
+++ b/pkgs/by-name/me/meilisearch/package.nix
@@ -8,18 +8,18 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "meilisearch";
-  version = "1.53.1";
+  version = "1.53.2";
 
   src = fetchFromGitHub {
     owner = "meilisearch";
     repo = "meilisearch";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MQ3W8Y4ewJZA+ciBGKjGuV90ae4RaMJS+PIjCGGOV7A=";
+    hash = "sha256-bbVuB8brplUAqKrmTBah4HKbmshv0n5Hn2v9hUnY62c=";
   };
 
   cargoBuildFlags = [ "--package=meilisearch" ];
 
-  cargoHash = "sha256-Rovn1xw3Bg7J+FeIMHQP2BW5IpDyCORud8VXIU8UpqI=";
+  cargoHash = "sha256-ojRJPL3EHyGmWHcX5SLv11fkP1pUNKrYkd82GEC4zKE=";
 
   # Default features include mini dashboard which downloads something from the internet.
   buildNoDefaultFeatures = true;

From 85d8611633ce769d9028c4fc61a84aaf9958f9c6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Sep 2026 08:18:02 +0000
Subject: [PATCH 53/59] llama-cpp-vulkan: 0.4.0 -> 0.4.1

---
 pkgs/by-name/ll/llama-cpp/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ll/llama-cpp/package.nix b/pkgs/by-name/ll/llama-cpp/package.nix
index bc3729b62053..a2af6b5e8025 100644
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -48,8 +48,8 @@
 let
   # Upstream reads these from git, which the release tarball does not ship.
   # They are purely informational: `llama-server --version`, `/props`, and the web UI.
-  buildNumber = "10809";
-  buildCommit = "5266f24";
+  buildNumber = "10964";
+  buildCommit = "b29c606";
 
   # It's necessary to consistently use backendStdenv when building with CUDA support,
   # otherwise we get libstdc++ errors downstream.
@@ -87,7 +87,7 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
   pname = "llama-cpp";
-  version = "0.4.0";
+  version = "0.4.1";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -101,7 +101,7 @@ effectiveStdenv.mkDerivation (finalAttrs: {
     owner = "ggml-org";
     repo = "llama.cpp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-WImZjO3U9EXZUNP/FMpxo8PaTjQW8X2SBTfGwwFlZIM=";
+    hash = "sha256-qu/K1RdJMzOxWr+qnHorpMB4650uctBHW/Og+4oDVLM=";
   };
 
   patches = [ ];

From 318e2a9e8f4b2f461fd2190670a6e6524d5533df Mon Sep 17 00:00:00 2001
From: Guilhem Saurel <guilhem.saurel@laas.fr>
Date: Wed, 16 Sep 2026 10:53:54 +0200
Subject: [PATCH 54/59] python3Packages.playwright: fix hash

fix:
```
$ nix build .#python314Packages.playwright
error: hash mismatch in fixed-output derivation '/nix/store/mkj5lwh2vqrjgdz2r77mia974dvfdagk-source.drv':
         specified: sha256-DHMX7RaySqfy2Xi+Rw4nUg9pYrpxIksjq1JhWfknOaI=
            got:    sha256-RwIn+0EcHnStjORVFmT7gp4bGjl+qer1FgtI3+aPF2w=
error: Cannot build '/nix/store/wfsyrwyi6sqs3c8z9nf9zhnwa755yg5k-python3.14-playwright-1.63.0.drv'.
       Reason: 1 dependency failed.
       Output paths:
         /nix/store/2jm6fr6xc99jbihl8b47qilypq7n2qj8-python3.14-playwright-1.63.0
         /nix/store/8zcrf5qzlvaid7v8yxwimw2h5kygcjcg-python3.14-playwright-1.63.0-dist
```
---
 pkgs/development/python-modules/playwright/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/playwright/default.nix b/pkgs/development/python-modules/playwright/default.nix
index 2852bfe76ed7..0090ec74c96c 100644
--- a/pkgs/development/python-modules/playwright/default.nix
+++ b/pkgs/development/python-modules/playwright/default.nix
@@ -38,7 +38,7 @@ buildPythonPackage (finalAttrs: {
     owner = "microsoft";
     repo = "playwright-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-DHMX7RaySqfy2Xi+Rw4nUg9pYrpxIksjq1JhWfknOaI=";
+    hash = "sha256-RwIn+0EcHnStjORVFmT7gp4bGjl+qer1FgtI3+aPF2w=";
   };
 
   patches = [

From 67bf9043b15f21bb8d3379c58c47741b05db922f Mon Sep 17 00:00:00 2001
From: Guilhem Saurel <guilhem.saurel@laas.fr>
Date: Wed, 16 Sep 2026 10:54:50 +0200
Subject: [PATCH 55/59] playwright-webkit: add missing libmanette

fix:
```
playwright-webkit> setting RPATH to: /nix/store/q5vyb8dni0fv6a9fh65ifm4galvi51k2-playwright-webkit/minibrowser-wpe/lib:/nix/store/sv8pf8cqmgrgh7jl2n9ww3knslxnfz33-libevent-2.1.13/lib:/nix/store/f9yy4q7dkvpw3i508nf510h9s240f3pf-libopus-1.6.1/lib:/nix/store/85v143gw8jcqjg04gxb38c4han2z7myb-freetype-2.14.3/lib:/nix/store/hrxf1fxrp7qwxrlv5k4aqxlwlam952aa-fontconfig-2.18.3-lib/lib:/nix/store/ixb298xx205dwm4n39kc93njl898wa62-libepoxy-1.5.10/lib:/nix/store/9wh3vnl7plpk052nczlzyh3v7zb3jhkw-libwebp-1.6.0/lib:/nix/store/pzky0fzxs3iy95lf14ffybxg973nv933-expat-2.8.4/lib:/nix/store/0a1k64ih9k5ribbjs07bgmzhb43djnr0-harfbuzz-13.2.1/lib:/nix/store/nms9avlwlsidnq1yiqs53ls4h9v7bmys-libjpeg-turbo-3.1.4.1/lib:/nix/store/pdm9fz4pc70pwhgzj88wilg3pzsyk7q1-libpng-apng-1.6.58/lib:/nix/store/lw86vj9kfwgvlivg3p8qg2nibpmhmsl9-zlib-1.3.2/lib:/nix/store/7mf69bavdjazjvbhflj0s40d2a6mk5wb-glib-2.88.3/lib:/nix/store/kvg90amxwq1gpm6yhhwykiiq9n97dnrl-libsoup-3.6.6/lib:/nix/store/yxnhmna7iyk0gb83q90315dcv1ixcnxd-gstreamer-1.28.6/lib:/nix/store/604gsr59rj7dzd0nrhp143rpvf7gyiaz-gcc-15.3.0-lib/lib:/nix/store/wkiqjb44n5k0fwhmc523dvflspd47q3b-gcc-15.3.0-libgcc/lib
playwright-webkit> auto-patchelf: 1 dependencies could not be satisfied
playwright-webkit> error: auto-patchelf could not satisfy dependency libmanette-0.2.so.0 wanted by /nix/store/q5vyb8dni0fv6a9fh65ifm4galvi51k2-playwright-webkit/minibrowser-wpe/lib/libWPEWebKit-2.0.so.1.12.0
playwright-webkit> auto-patchelf failed to find all the required dependencies.
playwright-webkit> Add the missing dependencies to --libs or use `--ignore-missing="foo.so.1 bar.so etc.so"`.
```
---
 pkgs/development/web/playwright/webkit.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/web/playwright/webkit.nix b/pkgs/development/web/playwright/webkit.nix
index e6f843aa9257..a6d8f093c2f7 100644
--- a/pkgs/development/web/playwright/webkit.nix
+++ b/pkgs/development/web/playwright/webkit.nix
@@ -32,6 +32,7 @@
   libgcrypt,
   libgpg-error,
   libjpeg8,
+  libmanette,
   libopus,
   libpng,
   libsoup_3,
@@ -167,6 +168,7 @@ let
       libgcrypt
       libgpg-error
       libjpeg8
+      libmanette
       libopus
       libpng
       libsoup_3

From 375374b719851dbd710377d84c2a77483f4e18be Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Sep 2026 09:06:36 +0000
Subject: [PATCH 56/59] neowall: 0.6.1 -> 0.7.1

---
 pkgs/by-name/ne/neowall/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ne/neowall/package.nix b/pkgs/by-name/ne/neowall/package.nix
index e4d713dd8948..73921d16ef44 100644
--- a/pkgs/by-name/ne/neowall/package.nix
+++ b/pkgs/by-name/ne/neowall/package.nix
@@ -18,13 +18,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "neowall";
-  version = "0.6.1";
+  version = "0.7.1";
 
   src = fetchFromGitHub {
     owner = "1ay1";
     repo = "neowall";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JzLp6/mJrYRq28XAIccsOxrG/RTDfWIojmmp1oQmiwI=";
+    hash = "sha256-yxEC5PlTRg4U7M8I7/2jL48Qw/CX3F2phz6zxL6xfYU=";
   };
 
   nativeBuildInputs = [

From 397345d386406b6c5fcfab830766566eec5a939f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Sep 2026 09:54:37 +0000
Subject: [PATCH 57/59] shelter: 0-unstable-2026-08-14 -> 0-unstable-2026-09-06

---
 pkgs/by-name/sh/shelter/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sh/shelter/package.nix b/pkgs/by-name/sh/shelter/package.nix
index 0d118d895c8b..9133a9a0642e 100644
--- a/pkgs/by-name/sh/shelter/package.nix
+++ b/pkgs/by-name/sh/shelter/package.nix
@@ -10,12 +10,12 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "shelter";
-  version = "0-unstable-2026-08-14";
+  version = "0-unstable-2026-09-06";
   src = fetchFromGitHub {
     owner = "uwu";
     repo = "shelter";
-    rev = "d7cc2ce46e94c0dbbd28af741cb2f0c09d1b77fc";
-    hash = "sha256-HFfggRZHVtkxvphllcYsbKa+CaifvUfb8tkhv7awrF4=";
+    rev = "ee10d4ecb2fd62fb86ebfdbd37a4e28df9e72f11";
+    hash = "sha256-Ew6RUhIS2gRuCNkbNCNtlmtYSGtjBR4h+UebuDVWhmk=";
   };
 
   nativeBuildInputs = [

From 5c8de9484d1afa2d10cc91a216faaba2f9950c9d Mon Sep 17 00:00:00 2001
From: Letgamer <alexstephan005@protonmail.com>
Date: Wed, 16 Sep 2026 11:01:40 +0200
Subject: [PATCH 58/59] networkmanager: drop libgcrypt

---
 pkgs/by-name/ne/networkmanager/package.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/by-name/ne/networkmanager/package.nix b/pkgs/by-name/ne/networkmanager/package.nix
index d9f5329e9e50..43d811da50bb 100644
--- a/pkgs/by-name/ne/networkmanager/package.nix
+++ b/pkgs/by-name/ne/networkmanager/package.nix
@@ -48,7 +48,6 @@
   ethtool,
   iptables,
   kmod,
-  libgcrypt,
   libndp,
   modemmanager,
   mobile-broadband-provider-info,
@@ -231,7 +230,6 @@ stdenv.mkDerivation (finalAttrs: {
 
   propagatedBuildInputs = [
     gnutls
-    libgcrypt
   ];
 
   nativeInstallCheckInputs = [ udevCheckHook ];

From 1217001b63ee3861a98fb00acdd40e07cb7d9580 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=A4=9C=E5=9D=82=E9=9B=85?=
 <23130178+ShadowRZ@users.noreply.github.com>
Date: Wed, 16 Sep 2026 18:04:18 +0800
Subject: [PATCH 59/59] munge: use openssl instead of libgcrypt

---
 pkgs/by-name/mu/munge/package.nix | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/mu/munge/package.nix b/pkgs/by-name/mu/munge/package.nix
index 7fc62723aa80..e9cbe3925848 100644
--- a/pkgs/by-name/mu/munge/package.nix
+++ b/pkgs/by-name/mu/munge/package.nix
@@ -3,7 +3,7 @@
   stdenv,
   fetchFromGitHub,
   autoreconfHook,
-  libgcrypt,
+  openssl,
   zlib,
   bzip2,
   nixosTests,
@@ -28,11 +28,10 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [
     autoreconfHook
-    libgcrypt # provides libgcrypt.m4
   ];
 
   buildInputs = [
-    libgcrypt
+    openssl
     zlib
     bzip2
   ];
@@ -50,8 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
     "--with-pkgconfigdir=${placeholder "out"}/lib/pkgconfig"
     "--with-systemdunitdir=${placeholder "out"}/lib/systemd/system"
 
-    # Cross-compilation hacks
-    "--with-libgcrypt-prefix=${lib.getDev libgcrypt}"
+    "--with-crypto-lib=openssl"
     # workaround for cross compilation: https://github.com/dun/munge/issues/103
     "ac_cv_file__dev_spx=no"
     "x_ac_cv_check_fifo_recvfd=no"