Merge master into staging-next

2026-10-04 14:00:04 +00:00 · 2026-10-04 13:56:13 +00:00
parent 7ee131c487 2872e79c7b
commit 73fd3e295d
114 changed files with 4101 additions and 2032 deletions
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -120,6 +120,8 @@

 - [rosec](https://github.com/jmylchreest/rosec), a secrets daemon implementing the freedesktop.org Secret Service API with modular backend providers. It can automatically unlock the user's vault on login via PAM. Available as [services.rosec](#opt-services.rosec.enable).

+- [Hydra builder](https://github.com/NixOS/hydra), the build agent for Hydra's queue runner. Available as [services.hydra-builder](#opt-services.hydra-builder.enable).
+
 - [NordVPN](https://github.com/NordSecurity/nordvpn-linux), a NordVPN client for linux. Available as [services.nordvpn](options.html#opt-services.nordvpn.enable).

 - [RNSD](https://reticulum.network/), the Reticulum Network Stack Daemon. It provides a secure and efficient way to communicate over the Reticulum Network. Available as [services.rnsd](#opt-services.rnsd.enable).
@@ -314,6 +316,15 @@
  make the required changes to your configuration and database, if needed,
  before you upgrade to NixOS 26.11.

+- `hydra` has been updated to the Rust queue runner/evaluator:
+  - `services.hydra.dbi` was replaced by [services.hydra.dbUrl](#opt-services.hydra.dbUrl), which takes a `postgres://` URL instead of a DBI string.
+  - `services.hydra.buildMachinesFiles` was removed. The queue runner no longer connects to build machines over SSH. Instead each build machine (including the Hydra host itself, if it should build) must enable [services.hydra-builder](#opt-services.hydra-builder.enable) and point it at [services.hydra.queueRunner.grpc](#opt-services.hydra.queueRunner.grpc.port).
+  - The queue runner, evaluator and the new `hydra-ws` log streaming service are configured via `services.hydra.queueRunner.settings`, [services.hydra.evaluatorSettings](#opt-services.hydra.evaluatorSettings) and `services.hydra.ws.settings` respectively, instead of `hydra.conf`.
+
+- NetBox was updated to `>= 4.6.8`. Have a look at the breaking changes
+  of the [4.6 release](https://github.com/netbox-community/netbox/releases/tag/v4.6.0),
+  make the required changes to your database, if needed, then upgrade by setting `services.netbox.package = pkgs.netbox_4_6;` in your configuration.
+
 - The COSMIC desktop module now enables by default `system76-power` and `system76-scheduler` following upstream recommended packages. The previous power managment service can be enabled back by setting `services.power-profiles-daemon.enable = true`.

 - The `programs.dms-shell.enableVPN`, `enableDynamicTheming`, `enableAudioWavelength`, and `enableCalendarEvents` options have been removed. `matugen` and `cava` are now included in the default DMS environment and can be excluded with `programs.dms-shell.excludePackages`. Networking and calendar backends are configured separately.
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -535,6 +535,7 @@
  ./services/continuous-integration/gocd-agent/default.nix
  ./services/continuous-integration/gocd-server/default.nix
  ./services/continuous-integration/hercules-ci-agent/default.nix
+  ./services/continuous-integration/hydra/builder.nix
  ./services/continuous-integration/hydra/default.nix
  ./services/continuous-integration/jenkins/default.nix
  ./services/continuous-integration/jenkins/job-builder.nix
--- a/nixos/modules/services/continuous-integration/hydra/builder.nix
+++ b/nixos/modules/services/continuous-integration/hydra/builder.nix
@@ -0,0 +1,305 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.hydra-builder;
+
+  user = "hydra-builder";
+
+  format = pkgs.formats.toml { };
+in
+{
+  options.services.hydra-builder = {
+    enable = lib.mkEnableOption "the Hydra build agent, which connects to the queue runner over gRPC and executes builds";
+
+    package = lib.mkPackageOption pkgs "hydra-builder" { };
+
+    queueRunnerAddr = lib.mkOption {
+      type = lib.types.singleLineStr;
+      example = "http://hydra.example.org:50051";
+      description = ''
+        Address of the queue runner's gRPC endpoint, see
+        {option}`services.hydra.queueRunner.grpc`.
+      '';
+    };
+
+    settings = lib.mkOption {
+      description = ''
+        Builder settings, written to {file}`/etc/hydra/builder.toml`.
+      '';
+      default = { };
+      type = lib.types.submodule {
+        options = {
+          pingInterval = lib.mkOption {
+            type = lib.types.ints.positive;
+            default = 10;
+            description = "Interval in seconds at which pings are sent to the queue runner.";
+          };
+
+          speedFactor = lib.mkOption {
+            type = lib.types.oneOf [
+              lib.types.ints.positive
+              lib.types.float
+            ];
+            default = 1;
+            description = "Speed factor of this machine, relative to the other builders.";
+          };
+
+          maxJobs = lib.mkOption {
+            type = lib.types.ints.positive;
+            default = 4;
+            description = ''
+              Maximum number of concurrent jobs. Only honoured when the queue
+              runner's {option}`services.hydra.queueRunner.settings.machineFreeFn`
+              takes job limits into account.
+            '';
+          };
+
+          buildCores = lib.mkOption {
+            type = lib.types.ints.unsigned;
+            default = config.nix.settings.cores;
+            defaultText = lib.literalExpression "config.nix.settings.cores";
+            description = ''
+              Cores made available to each build (`NIX_BUILD_CORES`). 0 means
+              all available cores.
+            '';
+          };
+
+          buildDirAvailThreshold = lib.mkOption {
+            type = lib.types.float;
+            default = 10.0;
+            description = ''
+              Percentage of free space on the Nix build directory below which
+              jobs stop being scheduled on this machine.
+            '';
+          };
+
+          storeAvailThreshold = lib.mkOption {
+            type = lib.types.float;
+            default = 10.0;
+            description = ''
+              Percentage of free space on {file}`/nix/store` below which jobs
+              stop being scheduled on this machine.
+            '';
+          };
+
+          load1Threshold = lib.mkOption {
+            type = lib.types.float;
+            default = 8.0;
+            description = ''
+              Load1 above which jobs stop being scheduled on this machine. Only
+              used when PSI is unavailable.
+            '';
+          };
+
+          cpuPsiThreshold = lib.mkOption {
+            type = lib.types.float;
+            default = 75.0;
+            description = "CPU PSI over the last 10s above which jobs stop being scheduled on this machine.";
+          };
+
+          memPsiThreshold = lib.mkOption {
+            type = lib.types.float;
+            default = 80.0;
+            description = "Memory PSI over the last 10s above which jobs stop being scheduled on this machine.";
+          };
+
+          ioPsiThreshold = lib.mkOption {
+            type = lib.types.nullOr lib.types.float;
+            default = null;
+            description = ''
+              IO PSI over the last 10s above which jobs stop being scheduled on
+              this machine. `null` disables this check.
+            '';
+          };
+
+          systems = lib.mkOption {
+            type = lib.types.nullOr (lib.types.listOf lib.types.singleLineStr);
+            default = null;
+            example = [ "x86_64-linux" ];
+            description = ''
+              Systems this builder can build for. `null` reads `system` and
+              `extra-platforms` from Nix; an empty list advertises none.
+            '';
+          };
+
+          supportedFeatures = lib.mkOption {
+            type = lib.types.nullOr (lib.types.listOf lib.types.singleLineStr);
+            default = null;
+            example = [ "big-parallel" ];
+            description = ''
+              Features this builder supports. `null` reads `system-features`
+              from Nix; an empty list advertises none.
+            '';
+          };
+
+          mandatoryFeatures = lib.mkOption {
+            type = lib.types.listOf lib.types.singleLineStr;
+            default = [ ];
+            example = [ "FOD" ];
+            description = "Features a step must request to be scheduled on this builder.";
+          };
+
+          useSubstitutes = lib.mkOption {
+            type = lib.types.bool;
+            default = true;
+            description = "Whether the builder substitutes paths instead of fetching them from the queue runner.";
+          };
+        };
+      };
+    };
+
+    authorizationFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      description = ''
+        Path to a file holding the authorization token, as an alternative to
+        {option}`mtls`. The token has to be listed in the queue runner's
+        {option}`services.hydra.queueRunner.settings.tokenPaths`.
+      '';
+    };
+
+    mtls = lib.mkOption {
+      default = null;
+      description = "mTLS material used to authenticate against the queue runner.";
+      type = lib.types.nullOr (
+        lib.types.submodule {
+          options = {
+            serverRootCaCertPath = lib.mkOption {
+              type = lib.types.path;
+              description = "Server root CA certificate path.";
+            };
+
+            clientCertPath = lib.mkOption {
+              type = lib.types.path;
+              description = "Client certificate path.";
+            };
+
+            clientKeyPath = lib.mkOption {
+              type = lib.types.path;
+              description = "Client key path.";
+            };
+
+            domainName = lib.mkOption {
+              type = lib.types.singleLineStr;
+              description = "Domain name the server certificate is validated against.";
+            };
+          };
+        }
+      );
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.hydra-builder = {
+      description = "Hydra build agent";
+      requires = [ "nix-daemon.socket" ];
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      restartTriggers = [ config.environment.etc."hydra/builder.toml".source ];
+
+      environment = {
+        NIX_REMOTE = "daemon";
+        RUST_BACKTRACE = "1";
+        # nix-store wants $HOME for its cache dir.
+        HOME = "/run/hydra-builder";
+      };
+
+      path = [ config.nix.package ];
+
+      serviceConfig = {
+        Type = "notify";
+        Restart = "always";
+        RestartSec = "5s";
+
+        ExecStart = lib.escapeShellArgs (
+          [
+            (lib.getExe cfg.package)
+            "--gateway-endpoint"
+            cfg.queueRunnerAddr
+            "--config-path"
+            "/etc/hydra/builder.toml"
+          ]
+          ++ lib.optionals (cfg.authorizationFile != null) [
+            "--authorization-file"
+            cfg.authorizationFile
+          ]
+          ++ lib.optionals (cfg.mtls != null) [
+            "--server-root-ca-cert-path"
+            cfg.mtls.serverRootCaCertPath
+            "--client-cert-path"
+            cfg.mtls.clientCertPath
+            "--client-key-path"
+            cfg.mtls.clientKeyPath
+            "--domain-name"
+            cfg.mtls.domainName
+          ]
+        );
+
+        User = user;
+        Group = "hydra";
+
+        RuntimeDirectory = "hydra-builder";
+
+        ReadWritePaths = [
+          "/nix/var/nix/gcroots/"
+          "/nix/var/nix/daemon-socket/socket"
+        ];
+        ReadOnlyPaths = [ "/nix/" ];
+
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        UMask = "0077";
+      };
+    };
+
+    environment.etc."hydra/builder.toml".source = format.generate "builder.toml" (
+      lib.filterAttrsRecursive (_: v: v != null) cfg.settings
+    );
+
+    nix.settings.trusted-users = [ user ];
+
+    users = {
+      groups.hydra = { };
+      users.${user} = {
+        description = "Hydra build agent";
+        group = "hydra";
+        isSystemUser = true;
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [
+    conni2461
+    das_j
+    helsinki-Jo
+    mindavi
+  ];
+}
--- a/nixos/modules/services/continuous-integration/hydra/default.nix
+++ b/nixos/modules/services/continuous-integration/hydra/default.nix
@@ -7,21 +7,33 @@
 let

  cfg = config.services.hydra;
+  queueRunnerCfg = cfg.queueRunner;
+
+  toml = pkgs.formats.toml { };

  baseDir = "/var/lib/hydra";

  hydraConf = pkgs.writeScript "hydra.conf" cfg.extraConfig;

  hydraEnv = {
-    HYDRA_DBI = cfg.dbi;
+    HYDRA_DATABASE_URL = cfg.dbUrl;
    HYDRA_CONFIG = "${baseDir}/hydra.conf";
    HYDRA_DATA = "${baseDir}";
  };

+  # Appends `application_name` so queries can be attributed in pg_stat_activity.
+  # `%` is doubled because the value lands in systemd `Environment=`, where the
+  # percent-encoded socket path (`%2Frun%2Fpostgresql`) would be parsed as a
+  # specifier.
+  dbUrlWithAppName =
+    name:
+    lib.replaceStrings [ "%" ] [ "%%" ] (
+      cfg.dbUrl + (if lib.hasInfix "?" cfg.dbUrl then "&" else "?") + "application_name=${name}"
+    );
+
  env = {
    NIX_REMOTE = "daemon";
    PGPASSFILE = "${baseDir}/pgpass";
-    NIX_REMOTE_SYSTEMS = lib.concatStringsSep ":" cfg.buildMachinesFiles;
  }
  // lib.optionalAttrs (cfg.smtpHost != null) {
    EMAIL_SENDER_TRANSPORT = "SMTP";
@@ -40,9 +52,9 @@ let
    }
    // (lib.optionalAttrs cfg.debugServer { DBIC_TRACE = "1"; });

-  localDB = "dbi:Pg:dbname=hydra;user=hydra;";
+  localDbUrl = "postgres://hydra@%2Frun%2Fpostgresql:5432/hydra";

-  haveLocalDB = cfg.dbi == localDB;
+  haveLocalDB = cfg.dbUrl == localDbUrl;

  hydra-package =
    let
@@ -80,6 +92,16 @@ let
 in

 {
+  imports = [
+    (lib.mkRemovedOptionModule [ "services" "hydra" "dbi" ] ''
+      Use `services.hydra.dbUrl`, which takes a postgres:// URL instead of a DBI string.
+    '')
+    (lib.mkRemovedOptionModule [ "services" "hydra" "buildMachinesFiles" ] ''
+      The queue runner no longer reads Nix build machines files. Builders now
+      connect to it via gRPC, see `services.hydra-builder`.
+    '')
+  ];
+
  ###### interface
  options = {

@@ -93,22 +115,102 @@ in
        '';
      };

-      dbi = lib.mkOption {
+      dbUrl = lib.mkOption {
        type = lib.types.str;
-        default = localDB;
-        example = "dbi:Pg:dbname=hydra;host=postgres.example.org;user=foo;";
+        default = localDbUrl;
+        example = "postgres://foo@postgres.example.org:5432/hydra";
        description = ''
-          The DBI string for Hydra database connection.
+          `postgres://` URL of the Hydra database.

-          NOTE: Attempts to set `application_name` will be overridden by
-          `hydra-TYPE` (where TYPE is e.g. `evaluator`, `queue-runner`,
-          etc.) in all hydra services to more easily distinguish where
-          queries are coming from.
+          An `application_name` query parameter is appended per service
+          (e.g. `hydra-evaluator`), so do not set one here.
        '';
      };

      package = lib.mkPackageOption pkgs "hydra" { };

+      evaluatorPackage = lib.mkPackageOption pkgs "hydra-evaluator" { };
+
+      evaluatorSettings = lib.mkOption {
+        description = ''
+          Settings for the evaluator, written to
+          {file}`/etc/hydra/evaluator.toml`.
+        '';
+        default = { };
+        type = lib.types.submodule {
+          freeformType = toml.type;
+          options = {
+            max_concurrent_evals = lib.mkOption {
+              type = lib.types.ints.positive;
+              default = 4;
+              description = "How many jobsets to evaluate at once.";
+            };
+          };
+        };
+      };
+
+      ws = {
+        enable =
+          lib.mkEnableOption "the WebSocket server streaming live build logs to the web interface"
+          // {
+            default = true;
+            example = false;
+          };
+
+        package = lib.mkPackageOption pkgs "hydra-ws" { };
+
+        settings = lib.mkOption {
+          description = ''
+            Settings for the WebSocket server, written to
+            {file}`/etc/hydra/ws.toml`.
+          '';
+          default = { };
+          type = lib.types.submodule {
+            options = {
+              dbUrl = lib.mkOption {
+                type = lib.types.singleLineStr;
+                default = cfg.dbUrl;
+                defaultText = lib.literalExpression "config.services.hydra.dbUrl";
+                description = "PostgreSQL database URL.";
+              };
+
+              maxDbConnections = lib.mkOption {
+                type = lib.types.ints.positive;
+                default = 128;
+                description = "Maximum number of PostgreSQL connections.";
+              };
+
+              idleGrace = lib.mkOption {
+                type = lib.types.int;
+                default = 128;
+                description = "Idle grace period in seconds before a log tail is stopped.";
+              };
+
+              hydraDataDir = lib.mkOption {
+                type = lib.types.path;
+                default = baseDir;
+                defaultText = lib.literalExpression ''"${baseDir}"'';
+                description = "Hydra data directory.";
+              };
+            };
+          };
+        };
+
+        bind = {
+          address = lib.mkOption {
+            type = lib.types.singleLineStr;
+            default = "[::1]";
+            description = "Address the WebSocket listener binds to.";
+          };
+
+          port = lib.mkOption {
+            type = lib.types.port;
+            default = 9283;
+            description = "Port the WebSocket listener binds to.";
+          };
+        };
+      };
+
      hydraURL = lib.mkOption {
        type = lib.types.str;
        description = ''
@@ -223,17 +325,6 @@ in
        description = "Directory that holds Hydra garbage collector roots.";
      };

-      buildMachinesFiles = lib.mkOption {
-        type = lib.types.listOf lib.types.path;
-        default = lib.optional (config.nix.buildMachines != [ ]) "/etc/nix/machines";
-        defaultText = lib.literalExpression ''lib.optional (config.nix.buildMachines != []) "/etc/nix/machines"'';
-        example = [
-          "/etc/nix/machines"
-          "/var/lib/hydra/provisioner/machines"
-        ];
-        description = "List of files containing build machines.";
-      };
-
      useSubstitutes = lib.mkOption {
        type = lib.types.bool;
        default = false;
@@ -247,6 +338,324 @@ in
          are absolute trustworthy.
        '';
      };
+
+      queueRunner = {
+        package = lib.mkPackageOption pkgs "hydra-queue-runner" { };
+
+        settings = lib.mkOption {
+          description = ''
+            Reloadable settings for the queue runner, written to
+            {file}`/etc/hydra/queue-runner.toml`.
+          '';
+          default = { };
+          type = lib.types.submodule {
+            options = {
+              hydraDataDir = lib.mkOption {
+                type = lib.types.path;
+                default = baseDir;
+                defaultText = lib.literalExpression ''"${baseDir}"'';
+                description = "Hydra data directory.";
+              };
+
+              dbUrl = lib.mkOption {
+                type = lib.types.singleLineStr;
+                default = cfg.dbUrl;
+                defaultText = lib.literalExpression "config.services.hydra.dbUrl";
+                description = "PostgreSQL database URL.";
+              };
+
+              maxDbConnections = lib.mkOption {
+                type = lib.types.ints.positive;
+                default = 128;
+                description = "Maximum number of PostgreSQL connections.";
+              };
+
+              machineSortFn = lib.mkOption {
+                type = lib.types.enum [
+                  "SpeedFactorOnly"
+                  "CpuCoreCountWithSpeedFactor"
+                  "BogomipsWithSpeedFactor"
+                ];
+                default = "SpeedFactorOnly";
+                description = "Function used to sort machines.";
+              };
+
+              machineFreeFn = lib.mkOption {
+                type = lib.types.enum [
+                  "Dynamic"
+                  "DynamicWithMaxJobLimit"
+                  "Static"
+                ];
+                default = "Static";
+                description = ''Function used to determine "idle" machines.'';
+              };
+
+              stepSortFn = lib.mkOption {
+                type = lib.types.enum [
+                  "Legacy"
+                  "WithRdeps"
+                  "WithCriticalPath"
+                ];
+                default = "WithRdeps";
+                description = "Function used to sort steps.";
+              };
+
+              dispatchTriggerTimerInS = lib.mkOption {
+                type = lib.types.int;
+                default = 120;
+                description = ''
+                  Interval in seconds at which the dispatcher is triggered. A
+                  value <= 0 disables the timer, leaving the dispatcher to be
+                  triggered by queue changes only.
+                '';
+              };
+
+              queueTriggerTimerInS = lib.mkOption {
+                type = lib.types.int;
+                default = -1;
+                description = ''
+                  Interval in seconds at which the queue is triggered. A value
+                  <= 0 disables the timer, leaving the queue to be triggered by
+                  PostgreSQL notifications only.
+                '';
+              };
+
+              remoteStoreAddr = lib.mkOption {
+                type = lib.types.listOf lib.types.singleLineStr;
+                default = [ ];
+                description = "Remote store addresses.";
+              };
+
+              useSubstitutes = lib.mkOption {
+                type = lib.types.bool;
+                default = cfg.useSubstitutes;
+                defaultText = lib.literalExpression "config.services.hydra.useSubstitutes";
+                description = "Whether to substitute paths instead of building them.";
+              };
+
+              rootsDir = lib.mkOption {
+                type = lib.types.nullOr lib.types.path;
+                default = cfg.gcRootsDir;
+                defaultText = lib.literalExpression "config.services.hydra.gcRootsDir";
+                description = "Directory holding the garbage collector roots.";
+              };
+
+              maxRetries = lib.mkOption {
+                type = lib.types.ints.positive;
+                default = 5;
+                description = "Maximum number of retries for a build step.";
+              };
+
+              retryInterval = lib.mkOption {
+                type = lib.types.ints.positive;
+                default = 60;
+                description = "Interval in seconds after which a step may be retried.";
+              };
+
+              retryBackoff = lib.mkOption {
+                type = lib.types.float;
+                default = 3.0;
+                description = "Additional backoff on top of {option}`retryInterval`.";
+              };
+
+              maxUnsupportedTimeInS = lib.mkOption {
+                type = lib.types.ints.unsigned;
+                default = 120;
+                description = "Time in seconds after which unsupported steps are aborted.";
+              };
+
+              stopQueueRunAfterInS = lib.mkOption {
+                type = lib.types.int;
+                default = 60;
+                description = ''
+                  Seconds after which a queue run is interrupted early. A value
+                  <= 0 lets queue runs go on for as long as they need.
+                '';
+              };
+
+              maxConcurrentDownloads = lib.mkOption {
+                type = lib.types.ints.positive;
+                default = 5;
+                description = ''
+                  Maximum number of concurrent downloads per build. Raising this
+                  raises the queue runner's memory usage.
+                '';
+              };
+
+              concurrentUploadLimit = lib.mkOption {
+                type = lib.types.ints.positive;
+                default = 5;
+                description = "Maximum number of concurrent uploads to S3.";
+              };
+
+              tokenPaths = lib.mkOption {
+                type = lib.types.nullOr (lib.types.listOf lib.types.path);
+                default = null;
+                description = "Paths of the accepted authentication tokens.";
+              };
+
+              enableFodChecker = lib.mkOption {
+                type = lib.types.bool;
+                default = false;
+                description = ''
+                  Whether to enable the fixed-output derivation checker, which
+                  collects FODs in a separate queue and schedules them on
+                  machines advertising the mandatory `FOD` feature.
+                '';
+              };
+
+              usePresignedUploads = lib.mkOption {
+                type = lib.types.bool;
+                default = false;
+                description = ''
+                  Whether builders upload to S3 themselves instead of the queue
+                  runner. Requires an S3 remote store as well as substitution on
+                  the builders, see {option}`forcedSubstituters`.
+                '';
+              };
+
+              overflowStore = lib.mkOption {
+                default = null;
+                description = ''
+                  Overflow S3 store. Steps referenced only by the listed jobsets
+                  are uploaded there instead of to the default store.
+                '';
+                type = lib.types.nullOr (
+                  lib.types.submodule {
+                    options = {
+                      store = lib.mkOption {
+                        type = lib.types.singleLineStr;
+                        example = "s3://overflow?region=eu-west-1";
+                        description = "S3 store URI of the overflow bucket.";
+                      };
+
+                      jobsets = lib.mkOption {
+                        type = lib.types.listOf lib.types.singleLineStr;
+                        default = [ ];
+                        example = [ "nixpkgs:trunk" ];
+                        description = "Jobsets (`project:jobset`) whose exclusive steps go to the overflow store.";
+                      };
+                    };
+                  }
+                );
+              };
+
+              forcedSubstituters = lib.mkOption {
+                type = lib.types.listOf lib.types.singleLineStr;
+                default = [ ];
+                description = ''
+                  Substituters every builder is required to have. Builders that
+                  do not enable `useSubstitutes` with these substituters are
+                  rejected.
+                '';
+              };
+
+              maxOutputSize = lib.mkOption {
+                type = lib.types.ints.unsigned;
+                default = 0;
+                description = ''
+                  Per-output NAR size limit in bytes. Builds exceeding it fail
+                  with `NarSizeLimitExceeded`. 0 disables the check.
+                '';
+              };
+
+              maxSilentTime = lib.mkOption {
+                type = lib.types.ints.unsigned;
+                default = 3600;
+                description = ''
+                  Default maximum silent time in seconds for builds without
+                  `meta.maxSilent`. Also used as a floor for dependency-only
+                  steps.
+                '';
+              };
+
+              buildTimeout = lib.mkOption {
+                type = lib.types.ints.unsigned;
+                default = 36000;
+                description = ''
+                  Default build timeout in seconds for builds without
+                  `meta.timeout`. Also used as a floor for dependency-only
+                  steps.
+                '';
+              };
+
+              maxLogSize = lib.mkOption {
+                type = lib.types.ints.unsigned;
+                default = 64 * 1024 * 1024;
+                description = ''
+                  Maximum build log size in bytes before a build fails with
+                  `LogLimitExceeded`.
+                '';
+              };
+            };
+          };
+        };
+
+        grpc = {
+          address = lib.mkOption {
+            type = lib.types.singleLineStr;
+            default = "[::1]";
+            description = ''
+              Address the gRPC listener binds to. Must be reachable from
+              machines running {option}`services.hydra-builder`.
+            '';
+          };
+
+          port = lib.mkOption {
+            type = lib.types.port;
+            default = 50051;
+            description = "Port the gRPC listener binds to.";
+          };
+        };
+
+        rest = {
+          address = lib.mkOption {
+            type = lib.types.singleLineStr;
+            default = "[::1]";
+            description = "Address the REST listener binds to.";
+          };
+
+          port = lib.mkOption {
+            type = lib.types.port;
+            default = 8080;
+            description = "Port the REST listener binds to.";
+          };
+        };
+
+        mtls = lib.mkOption {
+          default = null;
+          description = "mTLS material used to authenticate builders.";
+          type = lib.types.nullOr (
+            lib.types.submodule {
+              options = {
+                serverCertPath = lib.mkOption {
+                  type = lib.types.path;
+                  description = "Server certificate path.";
+                };
+
+                serverKeyPath = lib.mkOption {
+                  type = lib.types.path;
+                  description = "Server key path.";
+                };
+
+                clientCaCertPath = lib.mkOption {
+                  type = lib.types.path;
+                  description = "Client CA certificate path.";
+                };
+              };
+            }
+          );
+        };
+
+        awsCredentialsFile = lib.mkOption {
+          type = lib.types.nullOr lib.types.path;
+          default = null;
+          description = ''
+            Path to an AWS credentials file, exported as
+            `AWS_SHARED_CREDENTIALS_FILE` to the queue runner.
+          '';
+        };
+      };
    };

  };
@@ -282,10 +691,16 @@ in
      description = "Hydra queue runner";
      group = "hydra";
      useDefaultShell = true;
-      home = "${baseDir}/queue-runner"; # really only to keep SSH happy
+      home = "${baseDir}/queue-runner";
      uid = config.ids.uids.hydra-queue-runner;
    };

+    users.users.hydra-ws = lib.mkIf cfg.ws.enable {
+      description = "Hydra WebSocket server";
+      group = "hydra";
+      isSystemUser = true;
+    };
+
    users.users.hydra-www = {
      description = "Hydra web server";
      group = "hydra";
@@ -303,6 +718,7 @@ in
      ''}
      gc_roots_dir = ${cfg.gcRootsDir}
      use-substitutes = ${if cfg.useSubstitutes then "1" else "0"}
+      queue_runner_endpoint = http://${queueRunnerCfg.rest.address}:${toString queueRunnerCfg.rest.port}
    '';

    environment.systemPackages = [ hydra-package ];
@@ -336,7 +752,7 @@ in
      requires = lib.optional haveLocalDB "postgresql.target";
      after = lib.optional haveLocalDB "postgresql.target";
      environment = env // {
-        HYDRA_DBI = "${env.HYDRA_DBI};application_name=hydra-init";
+        HYDRA_DATABASE_URL = dbUrlWithAppName "hydra-init";
      };
      path = [ pkgs.util-linux ];
      preStart = ''
@@ -404,7 +820,7 @@ in
        pkgs.bzip2
      ];
      environment = serverEnv // {
-        HYDRA_DBI = "${serverEnv.HYDRA_DBI};application_name=hydra-server";
+        HYDRA_DATABASE_URL = dbUrlWithAppName "hydra-server";
      };
      restartTriggers = [ hydraConf ];
      serviceConfig = {
@@ -420,38 +836,210 @@ in
    };

    systemd.services.hydra-queue-runner = {
+      description = "Hydra queue runner";
      wantedBy = [ "multi-user.target" ];
-      requires = [ "hydra-init.service" ];
+      requires = [
+        "hydra-init.service"
+        "nix-daemon.socket"
+        "hydra-queue-runner-rest.socket"
+        "hydra-queue-runner-grpc.socket"
+      ];
      after = [
        "hydra-init.service"
        "network.target"
      ];
-      path = [
-        config.nix.package
-        hydra-package
-        pkgs.bzip2
-        pkgs.hostname-debian
-        pkgs.openssh
-      ];
-      restartTriggers = [ hydraConf ];
-      environment = env // {
-        PGPASSFILE = "${baseDir}/pgpass-queue-runner"; # grrr
-        IN_SYSTEMD = "1"; # to get log severity levels
-        HYDRA_DBI = "${env.HYDRA_DBI};application_name=hydra-queue-runner";
+      reloadTriggers = [ config.environment.etc."hydra/queue-runner.toml".source ];
+
+      environment = {
+        NIX_REMOTE = "daemon";
+        RUST_BACKTRACE = "1";
+        # nix-store wants $HOME for its cache dir.
+        HOME = "/run/hydra-queue-runner";
+      }
+      // lib.optionalAttrs (queueRunnerCfg.awsCredentialsFile != null) {
+        AWS_SHARED_CREDENTIALS_FILE = queueRunnerCfg.awsCredentialsFile;
      };
+
      serviceConfig = {
-        ExecStart = "@${hydra-package}/bin/hydra-queue-runner hydra-queue-runner -v";
-        ExecStopPost = "${hydra-package}/bin/hydra-queue-runner --unlock";
-        User = "hydra-queue-runner";
+        Type = "notify";
        Restart = "always";
+        RestartSec = "5s";
        Slice = "system-hydra.slice";

-        # Ensure we can get core dumps.
-        LimitCORE = "infinity";
+        # One gRPC stream per builder plus DB pool. 1024 is easily exhausted.
+        LimitNOFILE = 65536;
+
+        ExecStart = lib.escapeShellArgs (
+          [
+            (lib.getExe queueRunnerCfg.package)
+            "--rest-bind"
+            "-"
+            "--grpc-bind"
+            "-"
+            "--config-path"
+            "/etc/hydra/queue-runner.toml"
+          ]
+          ++ lib.optionals (queueRunnerCfg.mtls != null) [
+            "--server-cert-path"
+            queueRunnerCfg.mtls.serverCertPath
+            "--server-key-path"
+            queueRunnerCfg.mtls.serverKeyPath
+            "--client-ca-cert-path"
+            queueRunnerCfg.mtls.clientCaCertPath
+          ]
+        );
+        ExecReload = "${pkgs.util-linux}/bin/kill -HUP $MAINPID";
+
+        User = "hydra-queue-runner";
+        Group = "hydra";
+
+        RuntimeDirectory = "hydra-queue-runner";
        WorkingDirectory = "${baseDir}/queue-runner";
+
+        # Created by hydra-init. StateDirectory= would chown ${baseDir}.
+        ReadWritePaths = [
+          "/nix/var/nix/gcroots/"
+          "/nix/var/nix/daemon-socket/socket"
+          "${baseDir}/build-logs/"
+          "${baseDir}/queue-runner/"
+        ]
+        ++ lib.optionals (lib.hasInfix "%2Frun%2Fpostgresql" queueRunnerCfg.settings.dbUrl) [
+          "/run/postgresql/.s.PGSQL.${toString config.services.postgresql.settings.port}"
+        ];
+        ReadOnlyPaths = [ "/nix/" ];
+
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        UMask = "0022";
      };
    };

+    systemd.sockets.hydra-queue-runner-rest = {
+      description = "Hydra queue runner REST socket";
+      wantedBy = [ "sockets.target" ];
+      socketConfig = {
+        ListenStream = "${queueRunnerCfg.rest.address}:${toString queueRunnerCfg.rest.port}";
+        FileDescriptorName = "rest";
+        Service = "hydra-queue-runner.service";
+      };
+    };
+
+    systemd.sockets.hydra-queue-runner-grpc = {
+      description = "Hydra queue runner gRPC socket";
+      wantedBy = [ "sockets.target" ];
+      socketConfig = {
+        ListenStream = "${queueRunnerCfg.grpc.address}:${toString queueRunnerCfg.grpc.port}";
+        FileDescriptorName = "grpc";
+        Service = "hydra-queue-runner.service";
+      };
+    };
+
+    environment.etc."hydra/queue-runner.toml".source = toml.generate "queue-runner.toml" (
+      lib.filterAttrsRecursive (_: v: v != null) queueRunnerCfg.settings
+    );
+
+    systemd.services.hydra-ws = lib.mkIf cfg.ws.enable {
+      description = "Hydra WebSocket server";
+      wantedBy = [ "multi-user.target" ];
+      requires = [ "hydra-ws.socket" ];
+      after = [
+        "hydra-init.service"
+        "network.target"
+      ];
+      reloadTriggers = [ config.environment.etc."hydra/ws.toml".source ];
+
+      serviceConfig = {
+        Type = "notify";
+        Restart = "always";
+        RestartSec = "5s";
+        Slice = "system-hydra.slice";
+
+        ExecStart = lib.escapeShellArgs [
+          (lib.getExe cfg.ws.package)
+          "--bind"
+          "-"
+          "--config-path"
+          "/etc/hydra/ws.toml"
+        ];
+
+        User = "hydra-ws";
+        Group = "hydra";
+
+        RuntimeDirectory = "hydra-ws";
+
+        ReadOnlyPaths = [ "${baseDir}/build-logs/" ];
+        ReadWritePaths = lib.optionals (lib.hasInfix "%2Frun%2Fpostgresql" cfg.ws.settings.dbUrl) [
+          "/run/postgresql/.s.PGSQL.${toString config.services.postgresql.settings.port}"
+        ];
+
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        UMask = "0022";
+      };
+    };
+
+    systemd.sockets.hydra-ws = lib.mkIf cfg.ws.enable {
+      description = "Hydra WebSocket socket";
+      wantedBy = [ "sockets.target" ];
+      socketConfig = {
+        ListenStream = "${cfg.ws.bind.address}:${toString cfg.ws.bind.port}";
+        FileDescriptorName = "ws";
+        Service = "hydra-ws.service";
+      };
+    };
+
+    environment.etc."hydra/ws.toml" = lib.mkIf cfg.ws.enable {
+      source = toml.generate "ws.toml" (lib.filterAttrsRecursive (_: v: v != null) cfg.ws.settings);
+    };
+
    systemd.services.hydra-evaluator = {
      wantedBy = [ "multi-user.target" ];
      requires = [ "hydra-init.service" ];
@@ -461,17 +1049,31 @@ in
        "network.target"
        "network-online.target"
      ];
-      path = with pkgs; [
-        hostname-debian
-        hydra-package
-        jq
+      path = [
+        pkgs.hostname-debian
+        pkgs.jq
+        hydra-package # hydra-eval-jobset
+      ];
+      restartTriggers = [
+        hydraConf
+        config.environment.etc."hydra/evaluator.toml".source
      ];
-      restartTriggers = [ hydraConf ];
      environment = env // {
-        HYDRA_DBI = "${env.HYDRA_DBI};application_name=hydra-evaluator";
+        HYDRA_DATABASE_URL = dbUrlWithAppName "hydra-evaluator";
      };
      serviceConfig = {
-        ExecStart = "@${hydra-package}/bin/hydra-evaluator hydra-evaluator";
+        ExecStart = lib.escapeShellArgs [
+          "@${lib.getExe cfg.evaluatorPackage}"
+          "hydra-evaluator"
+          "--config-path"
+          "/etc/hydra/evaluator.toml"
+        ];
+        ExecStopPost = lib.escapeShellArgs [
+          (lib.getExe cfg.evaluatorPackage)
+          "--config-path"
+          "/etc/hydra/evaluator.toml"
+          "--unlock"
+        ];
        User = "hydra";
        Restart = "always";
        WorkingDirectory = baseDir;
@@ -479,11 +1081,14 @@ in
      };
    };

+    environment.etc."hydra/evaluator.toml".source =
+      toml.generate "evaluator.toml" cfg.evaluatorSettings;
+
    systemd.services.hydra-update-gc-roots = {
      requires = [ "hydra-init.service" ];
      after = [ "hydra-init.service" ];
      environment = env // {
-        HYDRA_DBI = "${env.HYDRA_DBI};application_name=hydra-update-gc-roots";
+        HYDRA_DATABASE_URL = dbUrlWithAppName "hydra-update-gc-roots";
      };
      serviceConfig = {
        ExecStart = "@${hydra-package}/bin/hydra-update-gc-roots hydra-update-gc-roots";
@@ -497,7 +1102,7 @@ in
      wantedBy = [ "multi-user.target" ];
      after = [ "hydra-init.service" ];
      environment = env // {
-        HYDRA_DBI = "${env.HYDRA_DBI};application_name=hydra-send-stats";
+        HYDRA_DATABASE_URL = dbUrlWithAppName "hydra-send-stats";
      };
      serviceConfig = {
        ExecStart = "@${hydra-package}/bin/hydra-send-stats hydra-send-stats";
@@ -514,7 +1119,7 @@ in
      path = [ pkgs.zstd ];
      environment = env // {
        PGPASSFILE = "${baseDir}/pgpass-queue-runner";
-        HYDRA_DBI = "${env.HYDRA_DBI};application_name=hydra-notify";
+        HYDRA_DATABASE_URL = dbUrlWithAppName "hydra-notify";
      };
      serviceConfig = {
        ExecStart = "@${hydra-package}/bin/hydra-notify hydra-notify";
@@ -567,12 +1172,17 @@ in

    services.postgresql.enable = lib.mkIf haveLocalDB true;

-    services.postgresql.identMap = lib.optionalString haveLocalDB ''
-      hydra hydra hydra
-      hydra hydra-queue-runner hydra
-      hydra hydra-www hydra
-      hydra root hydra
-    '';
+    services.postgresql.identMap = lib.optionalString haveLocalDB (
+      ''
+        hydra hydra hydra
+        hydra hydra-queue-runner hydra
+        hydra hydra-www hydra
+        hydra root hydra
+      ''
+      + lib.optionalString cfg.ws.enable ''
+        hydra hydra-ws hydra
+      ''
+    );

    services.postgresql.authentication = lib.optionalString haveLocalDB ''
      local all hydra peer map=hydra
--- a/nixos/tests/hydra/common.nix
+++ b/nixos/tests/hydra/common.nix
@@ -1,6 +1,6 @@
 {
  baseConfig =
-    { pkgs, ... }:
+    { config, pkgs, ... }:
    let
      trivialJob = pkgs.writeTextDir "trivial.nix" ''
        { trivial = derivation {
@@ -39,9 +39,19 @@
        hydraURL = "example.com";
        notificationSender = "example@example.com";
        extraConfig = ''
-          email_notification = 1
+          <email_notifications>
+            build = 1
+          </email_notifications>
        '';
      };
+
+      # Local build agent so that queued builds actually get executed.
+      services.hydra-builder = {
+        enable = true;
+        queueRunnerAddr = "http://[::1]:${toString config.services.hydra.queueRunner.grpc.port}";
+      };
+      systemd.services.hydra-builder.after = [ "hydra-queue-runner.service" ];
+
      services.postfix.enable = true;
      nix.settings.substituters = [ ];
      nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
--- a/nixos/tests/hydra/default.nix
+++ b/nixos/tests/hydra/default.nix
@@ -21,9 +21,12 @@ in
    machine.wait_for_unit("postgresql.target")
    # test whether the actual hydra daemons are running
    machine.wait_for_unit("hydra-init.service")
-    machine.require_unit_state("hydra-queue-runner.service")
+    machine.wait_for_unit("hydra-queue-runner.service")
    machine.require_unit_state("hydra-evaluator.service")
    machine.require_unit_state("hydra-notify.service")
+    machine.wait_for_open_port(50051)
+    machine.wait_for_unit("hydra-builder.service")
+    machine.wait_for_unit("hydra-ws.service")

    machine.succeed("hydra-create-user admin --role admin --password admin")

@@ -37,8 +40,15 @@ in
        'curl -L -s http://localhost:3000/build/1 -H "Accept: application/json" |  jq .buildstatus | xargs test 0 -eq'
    )

+    # The web interface reads the machine list from the queue runner's REST
+    # endpoint, which it only knows about through `queue_runner_endpoint` in
+    # hydra.conf.
    machine.wait_until_succeeds(
-        'journalctl -eu hydra-notify.service -o cat | grep -q "sending mail notification to hydra@localhost"'
+        'curl -L -s http://localhost:3000/machines -H "Accept: application/json" | jq -e "length > 0"'
+    )
+
+    machine.wait_until_succeeds(
+        'journalctl -eu hydra-notify.service -o cat | grep -q "sending mail notification for changed build status to hydra@localhost"'
    )
  '';
 }
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -2323,6 +2323,20 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  carderne-pi-nvim = buildVimPlugin {
+    pname = "carderne-pi-nvim";
+    version = "0.2.5";
+    src = fetchFromGitHub {
+      owner = "carderne";
+      repo = "pi-nvim";
+      tag = "v0.2.5";
+      hash = "sha256-1ZpHYfpgdezwM5go5KAPhjPeKDIgKgmVSCVGgbPv63o=";
+    };
+    meta.homepage = "https://github.com/carderne/pi-nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
  catppuccin-nvim = buildVimPlugin {
    pname = "catppuccin-nvim";
    version = "2.0.0";
@@ -3567,6 +3581,20 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  code-helper-nvim = buildVimPlugin {
+    pname = "code-helper-nvim";
+    version = "0-unstable-2026-10-04";
+    src = fetchFromGitHub {
+      owner = "sergioia-dev";
+      repo = "code-helper-nvim";
+      rev = "318856be95cafd863c7a1983a1b7381c6454b906";
+      hash = "sha256-OHrZiroVLJEmUKIzuw8l59Ql3Xmv8rImrqtGof9DiUM=";
+    };
+    meta.homepage = "https://github.com/sergioia-dev/code-helper-nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
  codecompanion-history-nvim = buildVimPlugin {
    pname = "codecompanion-history.nvim";
    version = "0-unstable-2026-01-22";
@@ -4450,6 +4478,20 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  dadbod-grip-nvim = buildVimPlugin {
+    pname = "dadbod-grip.nvim";
+    version = "3.11.0";
+    src = fetchFromGitHub {
+      owner = "joryeugene";
+      repo = "dadbod-grip.nvim";
+      tag = "v3.11.0";
+      hash = "sha256-iy3J41D1X0u7pTqSSgvBL5ATQeilon2VRDHFxzFAEqs=";
+    };
+    meta.homepage = "https://github.com/joryeugene/dadbod-grip.nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
  dailies-nvim = buildVimPlugin {
    pname = "dailies.nvim";
    version = "0-unstable-2025-04-21";
@@ -18360,6 +18402,20 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  toggable-term-nvim = buildVimPlugin {
+    pname = "toggable-term-nvim";
+    version = "0-unstable-2026-10-04";
+    src = fetchFromGitHub {
+      owner = "sergioia-dev";
+      repo = "toggable-term-nvim";
+      rev = "c61ddbcad7484b1306d643bd2a41699fbf0239d6";
+      hash = "sha256-ellFepBoskQ6iIV5lU7OSSyD7StOHsUgQFRoG+wbNDE=";
+    };
+    meta.homepage = "https://github.com/sergioia-dev/toggable-term-nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
  toggleterm-nvim = buildVimPlugin {
    pname = "toggleterm.nvim";
    version = "2.13.1-unstable-2025-03-09";
--- a/pkgs/applications/editors/vim/plugins/non-generated/hermes-nvim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/hermes-nvim/default.nix
@@ -8,17 +8,20 @@
  curl,
  cacert,
  jq,
+  nix,
+  gnugrep,
+  gnused,
  common-updater-scripts,
  nix-prefetch-scripts,
  pkg-config,
 }:

 let
-  version = "0.12.1";
+  version = "0.14.0";

  src = fetchzip {
    url = "https://github.com/Ruddickmg/hermes.nvim/archive/refs/tags/v${version}.tar.gz";
-    hash = "sha256-chPhu7e3LG28DAzkJRWEIG5tVnKXrF+ctc23ZwQc8o0=";
+    hash = "sha256-YUe+Mg1StwcxpcIcWr9T/32nkH921UranMM0bE+7lu8=";
  };

  dejavuFont = fetchzip {
@@ -57,7 +60,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  inherit version src;
  __structuredAttrs = true;

-  cargoHash = "sha256-cKMurBrYpCv0F6AvAKycsCFbY1tl35WNgyBwh5T3oao=";
+  cargoHash = "sha256-X1YI0iT3/5hncU0M5qJY+12nO6Et4B/xqwvjaq8AV1Q=";

  cargoBuildFeatures = [ "with-icons" ];

@@ -86,7 +89,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    inherit agentSvgs dejavuFont;

    tests.basic =
-      runCommand "hermes-nvim-test-basic" { nativeBuildInputs = [ finalAttrs.finalPackage ]; }
+      runCommand "hermes-nvim-test-basic"
+        {
+          nativeBuildInputs = [ finalAttrs.finalPackage ];
+        }
        ''
          test -f "${finalAttrs.finalPackage}/lua/hermes/init.lua"
          test -f "${finalAttrs.finalPackage}/plugin/hermes.lua"
@@ -101,6 +107,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
        lib.makeBinPath [
          curl
          jq
+          nix
+          gnugrep
+          gnused
          common-updater-scripts
          nix-prefetch-scripts
        ]
@@ -112,6 +121,25 @@ rustPlatform.buildRustPackage (finalAttrs: {
      fi
      update-source-version "vimPlugins.hermes-nvim" "$NEW_VERSION" --ignore-same-version

+      PKG_FILE="pkgs/applications/editors/vim/plugins/non-generated/hermes-nvim/default.nix"
+
+      NEW_CARGO_HASH=$(
+        nix-build --no-out-link -E '
+          let
+            pkgs = import ./. {};
+            pkg = pkgs.vimPlugins.hermes-nvim;
+          in pkg.cargoDeps.overrideAttrs (old: {
+            vendorStaging = old.vendorStaging.overrideAttrs (_: {
+              outputHash = "";
+              outputHashAlgo = "sha256";
+            });
+          })
+        ' 2>&1 | grep -oP 'got:\s+\K\S+'
+      ) || true
+      if [[ -n "$NEW_CARGO_HASH" ]]; then
+        sed -i "s|cargoHash = \"sha256-[^\"]*\";|cargoHash = \"$NEW_CARGO_HASH\";|" "$PKG_FILE"
+      fi
+
      NEW_SVG_HASH=$(
        nix-build --no-out-link -E '
          let
@@ -121,11 +149,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
            outputHash = "";
            outputHashAlgo = "sha256";
          })
-        ' 2>&1 | grep -oP 'got: \K.*'
+        ' 2>&1 | grep -oP 'got:\s+\K\S+'
      ) || true
      if [[ -n "$NEW_SVG_HASH" ]]; then
-        sed -i "s|outputHash = \"[^\"]*\";|outputHash = \"$NEW_SVG_HASH\";|" \
-          "pkgs/applications/editors/vim/plugins/non-generated/hermes-nvim/default.nix"
+        sed -i "s|outputHash = \"sha256-[^\"]*\";|outputHash = \"$NEW_SVG_HASH\";|" "$PKG_FILE"
      fi
    '';
  };
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -1167,6 +1167,15 @@ assertNoAdditions {
    };
  });

+  dadbod-grip-nvim = super.dadbod-grip-nvim.overrideAttrs {
+    # Optional pickers: these adapters probe for telescope/snacks with pcall and
+    # fall back to the built-in picker when the dependency is absent.
+    checkInputs = with self; [
+      snacks-nvim
+      telescope-nvim
+    ];
+  };
+
  dailies-nvim = super.dailies-nvim.overrideAttrs {
    runtimeDeps = [
      dailies
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -164,6 +164,7 @@ https://github.com/kwkarlwang/bufresize.nvim/,,
 https://github.com/bullets-vim/bullets.vim/,,
 https://github.com/itchyny/calendar.vim/,,
 https://github.com/bkad/camelcasemotion/,,
+https://github.com/carderne/pi-nvim/,,carderne-pi-nvim
 https://github.com/catppuccin/nvim/,,catppuccin-nvim
 https://github.com/catppuccin/vim/,,catppuccin-vim
 https://github.com/tyru/caw.vim/,,
@@ -253,6 +254,7 @@ https://github.com/iamcco/coc-tailwindcss/,,
 https://github.com/neoclide/coc.nvim/,release,
 https://github.com/ahf/cocci-syntax/,,
 https://github.com/manicmaniac/coconut.vim/,,
+https://github.com/sergioia-dev/code-helper-nvim/,,
 https://github.com/ravitemer/codecompanion-history.nvim/,,
 https://github.com/franco-ruggeri/codecompanion-lualine.nvim/,,
 https://github.com/franco-ruggeri/codecompanion-spinner.nvim/,,
@@ -316,6 +318,7 @@ https://github.com/gbprod/cutlass.nvim/,,
 https://github.com/scottmckendry/cyberdream.nvim/,,
 https://github.com/ghillb/cybu.nvim/,,
 https://github.com/d2lang/d2-vim/,,
+https://github.com/joryeugene/dadbod-grip.nvim/,,
 https://github.com/JachymPutta/dailies.nvim/,,
 https://github.com/Koalhack/darcubox-nvim/,,
 https://github.com/ptdewey/darkearth-nvim/,,
@@ -1309,6 +1312,7 @@ https://github.com/aserowy/tmux.nvim/,,
 https://github.com/edkolev/tmuxline.vim/,,
 https://github.com/folke/todo-comments.nvim/,,
 https://github.com/freitass/todo.txt-vim/,,
+https://github.com/sergioia-dev/toggable-term-nvim/,,
 https://github.com/akinsho/toggleterm.nvim/,,
 https://github.com/tiagovla/tokyodark.nvim/,,
 https://github.com/folke/tokyonight.nvim/,,
--- a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
@@ -21,22 +21,22 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
      sources = {
        "x86_64-linux" = {
          arch = "linux-x64";
-          hash = "sha256-TY0MaNfh/Iv0K/AYy0frD71US0NFpgk7k2yrClTeXTc=";
+          hash = "sha256-dUWGAI6AtFbMToKDAUxiEzsPspfka6kitMJ9+l1moz0=";
        };
        "aarch64-linux" = {
          arch = "linux-arm64";
-          hash = "sha256-BGEyoZX6WARlrPevsunwrX5C9YvhTTURuzRi9A/c594=";
+          hash = "sha256-y/z/tqieh+mdrUXfq7wqgRXndvdmKQ5ocsEwhFN/N3c=";
        };
        "aarch64-darwin" = {
          arch = "darwin-arm64";
-          hash = "sha256-QTEgBlSjb/Y8eYBl9HQVgZCyeDIXZR5gzEizv/JxVN0=";
+          hash = "sha256-fzywaeVkfUKgVDEnsKn3jIuKFOoiyT1Gpy332cn7ZfA=";
        };
      };
    in
    {
      name = "claude-code";
      publisher = "anthropic";
-      version = "2.1.287";
+      version = "2.1.289";
    }
    // sources.${stdenvNoCC.hostPlatform.system}
      or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
--- a/pkgs/by-name/_3/_389-ds-base/package.nix
+++ b/pkgs/by-name/_3/_389-ds-base/package.nix
@@ -30,8 +30,8 @@
  rustPlatform,
  rustc,
  openssl,
-  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
-  systemd,
+  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
+  systemdLibs,
  zlib,
  rsync,
  withCockpit ? true,
@@ -90,7 +90,7 @@ stdenv.mkDerivation (finalAttrs: {
    openssl
    zlib
  ]
-  ++ lib.optional withSystemd systemd
+  ++ lib.optional withSystemd systemdLibs
  ++ lib.optional withOpenldap openldap
  ++ lib.optional withBdb db
  ++ lib.optional withNetSnmp net-snmp;
--- a/pkgs/by-name/bi/biboumi/package.nix
+++ b/pkgs/by-name/bi/biboumi/package.nix
@@ -7,7 +7,7 @@
  expat,
  libiconv,
  botan3,
-  systemd,
+  systemdLibs,
  pkg-config,
  python3Packages,
  withIDN ? true,
@@ -44,7 +44,7 @@ stdenv.mkDerivation {
    libuuid
    expat
    libiconv
-    systemd
+    systemdLibs
    botan3
  ]
  ++ lib.optional withIDN libidn
--- a/pkgs/by-name/bl/blastem/package.nix
+++ b/pkgs/by-name/bl/blastem/package.nix
@@ -2,43 +2,48 @@
  lib,
  stdenv,
  fetchhg,
-  pkg-config,
+
  makeBinaryWrapper,
-  SDL2,
+  pkg-config,
+  python3,
+
  glew,
  gtk3,
+  SDL2,
+
  testers,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "blastem";
-  version = "0.6.2-unstable-2024-08-14";
+  version = "1.0.0";

  src = fetchhg {
    url = "https://www.retrodev.com/repos/blastem";
-    rev = "aa888682faa0";
-    hash = "sha256-0xw9O0o1pkJiXHyZer4nMJeLlRXS3Z4YYoLgfkrz3Yo=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-Fs78GFmvndJz+Ngpzw3bRyL8IX8UUJBAbV3TcNbHJHA=";
  };

-  # will probably be fixed in https://github.com/NixOS/nixpkgs/pull/302481
-  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+  postPatch = ''
    substituteInPlace Makefile \
-        --replace-fail "-flto" ""
+      --replace-fail '/bin/echo' 'echo'
+    patchShebangs cpu_dsl.py
  '';

  nativeBuildInputs = [
-    pkg-config
    makeBinaryWrapper
+    pkg-config
+    python3
  ];

  buildInputs = [
    gtk3
-    SDL2
    glew
+    SDL2
  ];

  # Note: menu.bin cannot be generated yet, because it would
-  # need the `vasmm68k_mot` executable (part of vbcc for amigaos68k
+  # need the `vasmm68k_mot` executable (part of vbcc for amigaos68k)
  # Luckily, menu.bin doesn't need to be present for the emulator to function

  makeFlags = [ "HOST_ZLIB=1" ];
@@ -49,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
    runHook preInstall

    # not sure if any executable other than blastem is really needed here
-    install -Dm755 blastem dis zdis termhelper -t $out/share/blastem
+    install -Dm755 blastem dis zdis upddis sh2dis termhelper -t $out/share/blastem
    install -Dm644 gamecontrollerdb.txt default.cfg rom.db -t $out/share/blastem
    cp -r shaders $out/share/blastem/shaders

@@ -62,18 +67,20 @@ stdenv.mkDerivation (finalAttrs: {
  passthru.tests.version = testers.testVersion {
    package = finalAttrs.finalPackage;
    command = "blastem -v";
-    version = "0.6.3-pre"; # remove line when moving to a stable version
  };

  meta = {
-    description = "Fast and accurate Genesis emulator";
+    description = "Fast and accurate emulator for Sega's 16-bit and 8-bit consoles";
+    longDescription = ''
+      BlastEm is a free and Open Source emulator for Sega's 16-bit and 8-bit consoles.
+      It's fast enough for your old PC and accurate enough for the most demanding demos.
+      While BlastEm's primary focus is the Genesis (known as the Megadrive outside North America),
+      it also supports the Sega CD, 32X, Master System, Game Gear, SG-1000, SC-3000, Sega Pico and Yamaha Copera.
+    '';
    homepage = "https://www.retrodev.com/blastem/";
    license = lib.licenses.gpl3Plus;
    mainProgram = "blastem";
    maintainers = with lib.maintainers; [ tomasajt ];
-    platforms = [
-      "i686-linux"
-      "x86_64-linux"
-    ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
  };
 })
--- a/pkgs/by-name/bu/butler/package.nix
+++ b/pkgs/by-name/bu/butler/package.nix
@@ -7,20 +7,20 @@

 buildGoModule (finalAttrs: {
  pname = "butler";
-  version = "15.30.0";
+  version = "15.31.0";

  src = fetchFromGitHub {
    owner = "itchio";
    repo = "butler";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-zq6ZmPNhRrp2MiDr6VElPMJGXEEkdK9ZjI0XUM0nED8=";
+    hash = "sha256-gH0aSS5VvKdBr9zD7CGHo3Qhs/MFkJWVMaG9m9yDPXw=";
  };

  buildInputs = [ brotli ];

  doCheck = false; # disabled because the tests don't work in a non-FHS compliant environment.

-  vendorHash = "sha256-kNc3twHNWgxJEVDte4GO6da8KrUmClaFZuip1bb1fMM=";
+  vendorHash = "sha256-4Uleff7XO9hs72/G+s8Ak1yaDLNpdHZa2GKx1aCtLZI=";

  meta = {
    description = "Command-line itch.io helper";
--- a/pkgs/by-name/ca/caddy/package.nix
+++ b/pkgs/by-name/ca/caddy/package.nix
@@ -1,37 +1,39 @@
 {
  lib,
-  buildGoModule,
+  stdenv,
+  buildPackages,
  callPackage,
+  buildGoModule,
  fetchFromGitHub,
+  installShellFiles,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
  testers,
  nixosTests,
-  caddy,
-  installShellFiles,
-  stdenv,
-  writableTmpDirAsHomeHook,
-  versionCheckHook,
+  nix-update-script,
 }:

 buildGoModule (finalAttrs: {
  pname = "caddy";
-  version = "2.11.4";
+  version = "2.11.7";

  __structuredAttrs = true;

+  __darwinAllowLocalNetworking = true;
+
  src = fetchFromGitHub {
    owner = "caddyserver";
    repo = "caddy";
    tag = "v${finalAttrs.version}";
    # remember to update hashes for `dist` and `plugins` test!
-    hash = "sha256-wzk8KRZfDCbbjRlBwkoKAoMjOhV4xF3yuXUueqtl1xM=";
+    hash = "sha256-6+USPwF6LzDWUjrNRL2ncxSz5KmqJM0L/6o03Lh8YD8=";
  };

-  vendorHash = "sha256-2GwSM7EKN9GwN6kte7CekpXIJ0vzHhhsnrs3TC6vTW4=";
+  vendorHash = "sha256-kJOl5h9gSfEK6ROT/MYOkBUr6MhiNBlbZVZPqwNpbBk=";

  ldflags = [
    "-s"
-    "-w"
-    "-X github.com/caddyserver/caddy/v2.CustomVersion=${finalAttrs.version}"
+    "-X github.com/caddyserver/caddy/v2.CustomVersion=v${finalAttrs.version}"
  ];

  # matches upstream since v2.8.0
@@ -45,44 +47,51 @@ buildGoModule (finalAttrs: {

  nativeCheckInputs = [ writableTmpDirAsHomeHook ];

-  __darwinAllowLocalNetworking = true;
+  checkFlags = [ "-skip=^TestReverseProxySNIPlaceHolder$" ];

  postInstall = ''
    install -Dm644 ${finalAttrs.passthru.dist}/init/caddy.service ${finalAttrs.passthru.dist}/init/caddy-api.service -t $out/lib/systemd/system

-    substituteInPlace $out/lib/systemd/system/caddy.service \
-      --replace-fail "/usr/bin/caddy" "$out/bin/caddy"
-    substituteInPlace $out/lib/systemd/system/caddy-api.service \
+    substituteInPlace $out/lib/systemd/system/caddy.service $out/lib/systemd/system/caddy-api.service \
      --replace-fail "/usr/bin/caddy" "$out/bin/caddy"
  ''
-  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-    # Generating man pages and completions fail on cross-compilation
-    # https://github.com/NixOS/nixpkgs/issues/308283
+  + lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) (
+    let
+      emulator = stdenv.hostPlatform.emulator buildPackages;
+    in
+    ''
+      ${emulator} $out/bin/caddy manpage --directory manpages
+      installManPage manpages/*

-    $out/bin/caddy manpage --directory manpages
-    installManPage manpages/*
-
-    installShellCompletion --cmd caddy \
-      --bash <($out/bin/caddy completion bash) \
-      --fish <($out/bin/caddy completion fish) \
-      --zsh <($out/bin/caddy completion zsh)
-  '';
+      installShellCompletion --cmd caddy \
+        --bash <(${emulator} $out/bin/caddy completion bash) \
+        --fish <(${emulator} $out/bin/caddy completion fish) \
+        --zsh <(${emulator} $out/bin/caddy completion zsh)
+    ''
+  );

  doInstallCheck = true;
-  nativeInstallCheckInputs = [
-    writableTmpDirAsHomeHook
-    versionCheckHook
-  ];
  versionCheckKeepEnvironment = [ "HOME" ];
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];

  passthru = {
-    withPlugins = callPackage ./plugins.nix { inherit caddy; };
+    withPlugins = callPackage ./plugins.nix { caddy = finalAttrs.finalPackage; };

    dist = fetchFromGitHub {
      owner = "caddyserver";
      repo = "dist";
      tag = "v${finalAttrs.version}";
-      hash = "sha256-oRQfQH1GKjAjVMj+dZo1f1+HOaOdJIyEfod0iGLYcc8=";
+      hash = "sha256-KvdaqiX06I1ft+p67J1ISgP512SoZ4syDzfe888ZqGI=";
+    };
+
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--custom-dep"
+        "dist"
+      ];
    };

    tests = {
--- a/pkgs/by-name/ca/caddy/plugins.nix
+++ b/pkgs/by-name/ca/caddy/plugins.nix
@@ -63,6 +63,15 @@ caddy.overrideAttrs (
        git
      ];
      dontUnpack = true;
+
+      env.GOTOOLCHAIN = "local";
+
+      impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
+        "GIT_PROXY_COMMAND"
+        "SOCKS_SERVER"
+        "GOPROXY"
+      ];
+
      buildPhase =
        let
          withArgs = concatMapStrings (plugin: "--with ${plugin} ") pluginsSorted;
--- a/pkgs/by-name/ca/caddy/plugins.test.nix
+++ b/pkgs/by-name/ca/caddy/plugins.test.nix
@@ -14,7 +14,7 @@

        package = pkgs.caddy.withPlugins {
          plugins = [ "github.com/caddyserver/replace-response@v0.0.0-20250618171559-80962887e4c6" ];
-          hash = "sha256-oj0IpspxslpNZbJFsexh0W2Sja19XRUsbShoCuY6qkQ=";
+          hash = "sha256-RvnrhgktjwNkG/3/th2q/ec6g7fMfGn6qLlGcz2B4TI=";
        };

        globalConfig = ''
--- a/pkgs/by-name/cg/cgif/package.nix
+++ b/pkgs/by-name/cg/cgif/package.nix
@@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cgif";
-  version = "0.5.3";
+  version = "0.5.4";

  src = fetchFromGitHub {
    owner = "dloebl";
    repo = "cgif";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-sZan1SLY4HGoifgGOb+uo4/q4dtxZuWAYhMbvdl/Ap8=";
+    hash = "sha256-rWw7dlqS/NsrrtRfYfmnC6ubHJLie5301S9C0uognnw=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/cl/claude-code/manifest.zst.json
+++ b/pkgs/by-name/cl/claude-code/manifest.zst.json
@@ -1,63 +1,61 @@
 {
-  "version": "2.1.287",
+  "version": "2.1.289",
  "manifestSignatureEnforcement": "flag",
-  "commit": "3c446a1b98aceb99a6cdee0f84a8bea42f4a8937",
-  "modsCommit": "6160717d8994f236ab381cf534fc1cde5347c12f",
-  "buildDate": "2026-10-01T16:27:39Z",
+  "commit": "736d26eef42d1e3017e07e6d5bd0970b8c3a068f",
+  "modsCommit": "52c76441cae91f6891e4712306bffb057ff6fec5",
+  "buildDate": "2026-10-03T19:39:42Z",
  "platforms": {
    "darwin-arm64": {
      "binary": "claude.zst",
-      "checksum": "2701dac04e02acbea7d7584fc35e04adddf6f24021d321e3ba7eb95994edcf96",
-      "size": 75949326,
+      "checksum": "44404b386c30be106533bbd260b689d22cedb6956a6ae70118ba96a32711a82b",
+      "size": 76604429,
      "bundle": {
-        "checksum": "8939dd3a906fd909614c651595ba3636e5620cb1aafcf99d3d5ecd9b6b86c693",
-        "size": 75962691
+        "checksum": "ee67e3f1ea60471c9e78f7c4b1cf30be832862afeec0b80805207d3eee140046",
+        "size": 76620437
      }
    },
    "darwin-x64": {
      "binary": "claude.zst",
-      "checksum": "e4c6177a49a726d1a65dadf2fb08cdde0232a37a60017668246ab9246fcf11ad",
-      "size": 80136583,
+      "checksum": "104d246d33eecb9750b26eecae258ec81bb02cf8cda8ccd6cbc2d00f6664d176",
+      "size": 80786935,
      "bundle": {
-        "checksum": "dc23e02cbacb6762d4033998e76e182459e7a539ea698eebe267207563def62d",
-        "size": 80141664
+        "checksum": "1a416eb22c68a7a35ad50a28a6eaa56227ddb50ea661786ffb67677b134894ac",
+        "size": 80788940
      }
    },
    "linux-arm64": {
      "binary": "claude.zst",
-      "checksum": "f95d466d03381abe9effcbcfe8408704262eb8861af3a1fc20b8e0563c1f770b",
-      "size": 85057873
+      "checksum": "9bae454cf4f886a2c7833746a9253d877b65c24c4c4403689a573bc47bf4b35a",
+      "size": 85691403
    },
    "linux-x64": {
      "binary": "claude.zst",
-      "checksum": "add364007462fe694a95aa68c78bdf7a71b1ddf687f80dda603f58cc80cde574",
-      "size": 85795355
+      "checksum": "66f72a868a42ca10e5462ab78a88fd9f5576486f59b32a0afc5910ab4b73b765",
+      "size": 86429541
    },
    "linux-arm64-musl": {
      "binary": "claude.zst",
-      "checksum": "b277e35a54c5c3f891791276b1b5ca8959ab89c45e2123906f26c3b0c489c80a",
-      "size": 83460752
+      "checksum": "84f9baadb049624c58165510498427269ce0c07b31d597ac21c370808c359549",
+      "size": 84096543
    },
    "linux-x64-musl": {
      "binary": "claude.zst",
-      "checksum": "43f30b92560d69d1942dc7e9e4772a9c24f99cda2d71a1dc46b6033398d47a01",
-      "size": 84231480
+      "checksum": "4ef0cfc150a4c8cf82bd4a726828980aae965e6db8084d00191befab9234f123",
+      "size": 84854125
    },
    "win32-x64": {
      "binary": "claude.exe.zst",
-      "checksum": "0d03949c88db791ddee203b61c1cfbd69bf84214facc17dcfcd0c0987f6c27de",
-      "size": 88089498
+      "checksum": "e1f0154146bb2618ea9943fa25778362182f8f1bf6c65f8dfd1a68a9a1d2b897",
+      "size": 88725729
    },
    "win32-arm64": {
      "binary": "claude.exe.zst",
-      "checksum": "bd8a2ec0abb532aea9e4f6a70177193cd7e06e4f4803d63fe75ac15442160dca",
-      "size": 84412071
+      "checksum": "2ddfd5eeaff95051dc32e0b03e441f97fc10af43747402194fa7793e21827348",
+      "size": 85047493
    }
  },
  "sdkCompat": {
    "testedWrapperVersions": [
-      "0.3.247",
-      "0.3.248",
      "0.3.250",
      "0.3.251",
      "0.3.252",
--- a/pkgs/by-name/co/corosync-qdevice/package.nix
+++ b/pkgs/by-name/co/corosync-qdevice/package.nix
@@ -8,7 +8,7 @@
  libqb,
  nss,
  nspr,
-  systemd,
+  systemdLibs,
  versionCheckHook,
 }:

@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
    libqb
    nss
    nspr
-    systemd
+    systemdLibs
  ];

  configureFlags = [
--- a/pkgs/by-name/co/corosync/package.nix
+++ b/pkgs/by-name/co/corosync/package.nix
@@ -9,7 +9,7 @@
  nss,
  nspr,
  libqb,
-  systemd,
+  systemdLibs,
  dbus,
  rdma-core,
  libstatgrab,
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
    nss
    nspr
    libqb
-    systemd.dev
+    systemdLibs.dev
  ]
  ++ optional enableDbus dbus
  ++ optional enableInfiniBandRdma rdma-core
--- a/pkgs/by-name/cr/croc/package.nix
+++ b/pkgs/by-name/cr/croc/package.nix
@@ -11,16 +11,16 @@

 buildGo127Module (finalAttrs: {
  pname = "croc";
-  version = "11.5.3";
+  version = "11.5.4";

  src = fetchFromGitHub {
    owner = "schollz";
    repo = "croc";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-Q+1KK+HA3SC9Kl7YV+ZfIMLUJMu+wjnIknRqn+l6cdM=";
+    hash = "sha256-QF++O86FqyTE/s0BiFhFts80/DCXPU1xAqeTMtviE2E=";
  };

-  vendorHash = "sha256-6B7KZd0Y/RvV9q9U8kHFnKqkDX7uA1tCW2vaFnfeQZ0=";
+  vendorHash = "sha256-eiuycihsdYZqdobRsMlryyQOhOeDIUAyM7cUavTPv+o=";

  subPackages = [ "." ];

--- a/pkgs/by-name/do/dovecot/generic.nix
+++ b/pkgs/by-name/do/dovecot/generic.nix
@@ -13,7 +13,7 @@
  bison,
  perl,
  pkg-config,
-  systemd,
+  systemdLibs,
  openssl,
  bzip2,
  lz4,
@@ -103,7 +103,7 @@ stdenv.mkDerivation (finalAttrs: {
    xapian
  ]
  ++ lib.optionals (stdenv.hostPlatform.isLinux) [
-    systemd
+    systemdLibs
    pam
    libcap
    inotify-tools
--- a/pkgs/by-name/en/entt/package.nix
+++ b/pkgs/by-name/en/entt/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "entt";
-  version = "3.16.0";
+  version = "4.0.0";

  src = fetchFromGitHub {
    owner = "skypjack";
    repo = "entt";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-i4K7NigYPYAOsVLhtjQJFmm9LoWiTg39F8SIBRuv4Vg=";
+    hash = "sha256-+sIe2zn2uY/BHB+KIuJ5+1fa8qDjDnsnLBWk14WuUT0=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/fi/firestarter/package.nix
+++ b/pkgs/by-name/fi/firestarter/package.nix
@@ -9,20 +9,24 @@
  glibc,
  git,
  pkg-config,
-  cudaPackages ? { },
-  withCuda ? false,
+  installShellFiles,
+  config,
+  cudaPackages,
+  versionCheckHook,
+  withCuda ? config.cudaSupport,
 }:

 let
-  inherit (cudaPackages) cudatoolkit;
-
-  hwloc = stdenv.mkDerivation rec {
+  hwloc = stdenv.mkDerivation (finalAttrs: {
    pname = "hwloc";
    version = "2.2.0";

+    strictDeps = true;
+    __structuredAttrs = true;
+
    src = fetchzip {
-      url = "https://download.open-mpi.org/release/hwloc/v${lib.versions.majorMinor version}/hwloc-${version}.tar.gz";
-      sha256 = "1ibw14h9ppg8z3mmkwys8vp699n85kymdz20smjd2iq9b67y80b6";
+      url = "https://download.open-mpi.org/release/hwloc/v${lib.versions.majorMinor finalAttrs.version}/hwloc-${finalAttrs.version}.tar.gz";
+      hash = "sha256-ZgHkj1kJR9Fk1UD8Vv0syKZk7kba81nr+OjdmyAJfMU=";
    };

    configureFlags = [
@@ -54,35 +58,50 @@ let
      "doc"
      "man"
    ];
-  };
+  });

 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "firestarter";
  version = "2.0";

+  strictDeps = true;
+  __structuredAttrs = true;
+
  src = fetchFromGitHub {
    owner = "tud-zih-energy";
    repo = "FIRESTARTER";
-    tag = "v${version}";
-    sha256 = "1ik6j1lw5nldj4i3lllrywqg54m9i2vxkxsb2zr4q0d2rfywhn23";
+    tag = "v${finalAttrs.version}";
    fetchSubmodules = true;
+    hash = "sha256-Q1jIvcuiAUzyF0v32beIqZLyMPeZUjoikY3awmmQZsY=";
  };

  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail \
+        'set(_FIRESTARTER_VERSION_STRING "unknown")' \
+        'set(_FIRESTARTER_VERSION_STRING "v${finalAttrs.version}")'
+
    substituteInPlace lib/nitro/CMakeLists.txt \
-      --replace-fail 'cmake_minimum_required(VERSION 3.2)' 'cmake_minimum_required(VERSION 3.10)'
+      --replace-fail \
+        'cmake_minimum_required(VERSION 3.2)' \
+        'cmake_minimum_required(VERSION 3.10)'
+
    substituteInPlace lib/json/CMakeLists.txt \
-      --replace-fail 'cmake_minimum_required(VERSION 3.1)' 'cmake_minimum_required(VERSION 3.10)'
+      --replace-fail \
+        'cmake_minimum_required(VERSION 3.1)' \
+        'cmake_minimum_required(VERSION 3.10)'
  '';

  nativeBuildInputs = [
    cmake
    git
    pkg-config
+    installShellFiles
  ]
  ++ lib.optionals withCuda [
    addDriverRunpath
+    cudaPackages.cuda_nvcc
  ];

  buildInputs = [
@@ -92,32 +111,37 @@ stdenv.mkDerivation rec {
    if withCuda then
      [
        glibc_multi
-        cudatoolkit
+        cudaPackages.cuda_nvcc # crt/host_defines.h
+        cudaPackages.cuda_cudart
+        cudaPackages.libcublas
+        cudaPackages.libcurand
      ]
    else
      [ glibc.static ]
  );

  env = lib.optionalAttrs withCuda {
-    NIX_LDFLAGS = "-L${cudatoolkit}/lib/stubs";
+    NIX_LDFLAGS = "-L${lib.getOutput "stubs" cudaPackages.cuda_cudart}/lib/stubs";
  };

  cmakeFlags = [
-    "-DFIRESTARTER_BUILD_HWLOC=OFF"
-    "-DCMAKE_C_COMPILER_WORKS=1"
-    "-DCMAKE_CXX_COMPILER_WORKS=1"
+    (lib.cmakeBool "FIRESTARTER_BUILD_HWLOC" false)
+    (lib.cmakeFeature "CMAKE_C_COMPILER_WORKS" "1")
+    (lib.cmakeFeature "CMAKE_CXX_COMPILER_WORKS" "1")
  ]
  ++ lib.optionals withCuda [
-    "-DFIRESTARTER_BUILD_TYPE=FIRESTARTER_CUDA"
+    (lib.cmakeFeature "FIRESTARTER_BUILD_TYPE" "FIRESTARTER_CUDA")
  ];

  installPhase = ''
    runHook preInstall
-    mkdir -p $out/bin
-    cp src/FIRESTARTER${lib.optionalString withCuda "_CUDA"} $out/bin/
+    installBin src/FIRESTARTER${lib.optionalString withCuda "_CUDA"}
    runHook postInstall
  '';

+  doInstallCheck = !withCuda; # tries to access GPU
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
  postFixup = lib.optionalString withCuda ''
    addDriverRunpath $out/bin/FIRESTARTER_CUDA
  '';
@@ -132,6 +156,6 @@ stdenv.mkDerivation rec {
      marenz
    ];
    license = lib.licenses.gpl3;
-    mainProgram = "FIRESTARTER";
+    mainProgram = "FIRESTARTER${lib.optionalString withCuda "_CUDA"}";
  };
-}
+})
--- a/pkgs/by-name/fr/free5gc-upf/package.nix
+++ b/pkgs/by-name/fr/free5gc-upf/package.nix
@@ -7,17 +7,17 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "free5gc-upf";
-  version = "1.2.12";
+  version = "1.2.13";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "free5gc";
    repo = "go-upf";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-MfQbHVEqnoFzUL5FPIE6dQSJxQD7PAZSbAgy/skHs+8=";
+    hash = "sha256-KWJCESbgfggAWMI76U2EhSjvwF+nHwI+ItEo9nPRVzU=";
  };

-  vendorHash = "sha256-VPm0Z67Sm/liIofVm1bI3/HU+lwYtwkg6zMRdZFZTZ8=";
+  vendorHash = "sha256-sdeFBWZDzkk28ycoIsVoZNUC2OH1Zv7C/1DqYdCtLyo=";

  ldflags = [
    "-X github.com/free5gc/util/version.VERSION=v${finalAttrs.version}"
--- a/pkgs/by-name/fr/freeipa/package.nix
+++ b/pkgs/by-name/fr/freeipa/package.nix
@@ -25,7 +25,7 @@
  libunistring,
  libverto,
  libpwquality,
-  systemd,
+  systemdLibs,
  python3Packages,
  bind,
  sssd,
@@ -111,7 +111,7 @@ stdenv.mkDerivation (finalAttrs: {
    samba
    libunistring
    libverto
-    systemd
+    systemdLibs
    bind
    libpwquality
    jansson
--- a/pkgs/by-name/gg/ggml/package.nix
+++ b/pkgs/by-name/gg/ggml/package.nix
@@ -7,7 +7,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ggml";
-  version = "0.24.0";
+  version = "0.25.3";

  __structuredAttrs = true;
  strictDeps = true;
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "ggml-org";
    repo = "ggml";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-wSI0GnSFoMyBKuzIrelURzaIaSIS/eIAwG4etmy9XUo=";
+    hash = "sha256-u6HQNbSjuMeWsQOR7hMKJCj659KDp/Qps0KU38it54Q=";
  };

  # The cmake package does not handle absolute CMAKE_INSTALL_LIBDIR and CMAKE_INSTALL_INCLUDEDIR
--- a/pkgs/by-name/ha/havn/package.nix
+++ b/pkgs/by-name/ha/havn/package.nix
@@ -8,7 +8,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "havn";
-  version = "0.3.9";
+  version = "0.3.10";

  __structuredAttrs = true;

@@ -16,10 +16,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "mrjackwills";
    repo = "havn";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-G+aUTzlpUfVTkoftp1igCPeKaQpbS4CyydoitcLzxjk=";
+    hash = "sha256-CABTI2UilR4b0vQdWaiXJK8sRNVK1dV1d+2qckVcWSo=";
  };

-  cargoHash = "sha256-G4DNr69FKiLI3vrEX3AMPn3DdWzPbxA7t2vw3bJtW94=";
+  cargoHash = "sha256-qw/+eN27SxPrg0ma3Lj04BDh/XWFPQk0f4hL5a9IzIE=";

  nativeInstallCheckInputs = [ versionCheckHook ];

--- a/pkgs/by-name/he/healthchecks/package.nix
+++ b/pkgs/by-name/he/healthchecks/package.nix
@@ -15,14 +15,14 @@ let
 in
 py.pkgs.buildPythonApplication rec {
  pname = "healthchecks";
-  version = "4.3";
+  version = "4.4";
  pyproject = false;

  src = fetchFromGitHub {
    owner = "healthchecks";
    repo = "healthchecks";
    tag = "v${version}";
-    sha256 = "sha256-8S7hIUFSr88jNEwGM4mSQAv+EdH/ynT9MvATabmtp5s=";
+    sha256 = "sha256-4TG6K52sY2Cqu8K+9Gg2Zh1lL0tWQY9B+jKdDf1Vg+0=";
  };

  propagatedBuildInputs = with py.pkgs; [
--- a/pkgs/by-name/hy/hydra-builder/package.nix
+++ b/pkgs/by-name/hy/hydra-builder/package.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  rustPlatform,
+  hydra,
+  pkg-config,
+  protobuf,
+  rust-jemalloc-sys,
+  withOtel ? false,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "hydra-builder";
+  inherit (hydra) version src;
+  __structuredAttrs = true;
+
+  cargoHash = "sha256-ULaL4B00O0ApZbBkv7GtLZWAoJI/ZNFPr+0FWsNp3OE=";
+
+  cargoBuildFlags = [
+    "--package"
+    "hydra-builder"
+  ];
+
+  buildFeatures = lib.optional withOtel "otel";
+
+  nativeBuildInputs = [
+    pkg-config
+    protobuf
+  ];
+
+  buildInputs = [
+    protobuf
+    rust-jemalloc-sys
+  ];
+
+  # The unit tests spin up a PostgreSQL instance, which is not available in the
+  # sandbox.
+  doCheck = false;
+
+  meta = {
+    description = "Build agent for the Nix-based continuous build system Hydra";
+    homepage = "https://github.com/NixOS/hydra";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "hydra-builder";
+    maintainers = with lib.maintainers; [
+      conni2461
+      das_j
+      helsinki-Jo
+      mindavi
+    ];
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/by-name/hy/hydra-evaluator/package.nix
+++ b/pkgs/by-name/hy/hydra-evaluator/package.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  rustPlatform,
+  hydra,
+  pkg-config,
+  protobuf,
+  rust-jemalloc-sys,
+  nixosTests,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "hydra-evaluator";
+  inherit (hydra) version src;
+  __structuredAttrs = true;
+
+  cargoHash = "sha256-ULaL4B00O0ApZbBkv7GtLZWAoJI/ZNFPr+0FWsNp3OE=";
+
+  cargoBuildFlags = [
+    "--package"
+    "hydra-evaluator"
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+    protobuf
+  ];
+
+  buildInputs = [
+    protobuf
+    rust-jemalloc-sys
+  ];
+
+  # The unit tests spin up a PostgreSQL instance, which is not available in the
+  # sandbox.
+  doCheck = false;
+
+  passthru.tests = { inherit (nixosTests) hydra; };
+
+  meta = {
+    description = "Evaluator for the Nix-based continuous build system Hydra";
+    homepage = "https://github.com/NixOS/hydra";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "hydra-evaluator";
+    maintainers = with lib.maintainers; [
+      conni2461
+      das_j
+      helsinki-Jo
+      mindavi
+    ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/hy/hydra-queue-runner/package.nix
+++ b/pkgs/by-name/hy/hydra-queue-runner/package.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  rustPlatform,
+  hydra,
+  pkg-config,
+  protobuf,
+  rust-jemalloc-sys,
+  nixosTests,
+  withOtel ? false,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "hydra-queue-runner";
+  inherit (hydra) version src;
+  __structuredAttrs = true;
+
+  cargoHash = "sha256-ULaL4B00O0ApZbBkv7GtLZWAoJI/ZNFPr+0FWsNp3OE=";
+
+  cargoBuildFlags = [
+    "--package"
+    "hydra-queue-runner"
+  ];
+
+  buildFeatures = lib.optional withOtel "otel";
+
+  nativeBuildInputs = [
+    pkg-config
+    protobuf
+  ];
+
+  buildInputs = [
+    protobuf
+    rust-jemalloc-sys
+  ];
+
+  # The unit tests spin up a PostgreSQL instance, which is not available in the sandbox.
+  doCheck = false;
+
+  passthru.tests = { inherit (nixosTests) hydra; };
+
+  meta = {
+    description = "Queue runner for the Nix-based continuous build system Hydra";
+    homepage = "https://github.com/NixOS/hydra";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "hydra-queue-runner";
+    maintainers = with lib.maintainers; [
+      conni2461
+      das_j
+      helsinki-Jo
+      mindavi
+    ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/hy/hydra-ws/package.nix
+++ b/pkgs/by-name/hy/hydra-ws/package.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  hydra,
+  rustPlatform,
+  pkg-config,
+  protobuf,
+  rust-jemalloc-sys,
+  nixosTests,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "hydra-ws";
+  inherit (hydra) version src;
+  __structuredAttrs = true;
+
+  cargoHash = "sha256-ULaL4B00O0ApZbBkv7GtLZWAoJI/ZNFPr+0FWsNp3OE=";
+
+  cargoBuildFlags = [
+    "--package"
+    "hydra-ws"
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+    protobuf
+  ];
+
+  buildInputs = [
+    protobuf
+    rust-jemalloc-sys
+  ];
+
+  # The unit tests spin up a PostgreSQL instance, which is not available in the
+  # sandbox.
+  doCheck = false;
+
+  passthru.tests = { inherit (nixosTests) hydra; };
+
+  meta = {
+    description = "WebSocket server streaming build logs for the Hydra web interface";
+    homepage = "https://github.com/NixOS/hydra";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "hydra-ws";
+    maintainers = with lib.maintainers; [
+      conni2461
+      das_j
+      helsinki-Jo
+      mindavi
+    ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/hy/hydra/nix-perl.nix
+++ b/pkgs/by-name/hy/hydra/nix-perl.nix
@@ -0,0 +1,74 @@
+# Nix's Perl bindings. They were dropped from Nix itself in 2.35 and are now
+# maintained in the Hydra repository:
+# https://github.com/NixOS/hydra/commit/1dd13469091cd25656cfa0db4b8a353c1a2c26e7
+{
+  lib,
+  stdenv,
+  src,
+  meson,
+  ninja,
+  nix-store,
+  perl,
+  perlPackages,
+  pkg-config,
+}:
+perl.pkgs.toPerlModule (
+  stdenv.mkDerivation (finalAttrs: {
+    pname = "nix-perl";
+    inherit (nix-store) version;
+    inherit src;
+
+    __structuredAttrs = true;
+    strictDeps = true;
+
+    sourceRoot = "${finalAttrs.src.name}/subprojects/nix-perl";
+
+    nativeBuildInputs = [
+      meson
+      ninja
+      perl
+      pkg-config
+    ];
+
+    buildInputs = [
+      nix-store
+      # We compile against perl's CORE headers, which `#include <crypt.h>` from
+      # the `libxcrypt` perl propagates.
+      perl
+      perlPackages.DBDSQLite
+      perlPackages.DBI
+    ];
+
+    preConfigure = ''
+      echo ${finalAttrs.version} > .version
+    ''
+    # Upstream's `meson.build` compiles `Store.xs` against perl's `CORE` headers but without perl's
+    # own `ccflags`.
+    # Some of those (e.g. `-DNO_POSIX_2008_LOCALE` on Darwin) change the layout of
+    # `PerlInterpreter`, so the module then fails the XS handshake on load.
+    + ''
+      export NIX_CFLAGS_COMPILE+=" $(perl -MConfig -e 'print join " ", grep { /^-D/ } split " ", $Config{ccflags}')"
+    '';
+
+    mesonBuildType = "release";
+
+    mesonFlags = [
+      (lib.mesonEnable "tests" finalAttrs.finalPackage.doCheck)
+    ];
+
+    mesonCheckFlags = [ "--print-errorlogs" ];
+
+    doCheck = true;
+
+    nativeCheckInputs = [
+      perlPackages.Test2Harness
+    ];
+
+    meta = {
+      description = "Perl bindings for the Nix store, as maintained in the Hydra repository";
+      homepage = "https://github.com/NixOS/hydra";
+      license = lib.licenses.lgpl21Plus;
+      platforms = lib.platforms.unix;
+    };
+  })
+)
--- a/pkgs/by-name/hy/hydra/package.nix
+++ b/pkgs/by-name/hy/hydra/package.nix
@@ -1,77 +1,72 @@
 {
  stdenv,
  lib,
+  callPackage,
+  fetchFromGitHub,
  nixVersions,
+  nix-eval-jobs,
+  nixosTests,
  perlPackages,
  buildEnv,
+  unstableGitUpdater,
+
  makeWrapper,
-  unzip,
-  pkg-config,
-  libpqxx,
-  top-git,
-  mercurial,
-  darcs,
-  subversion,
-  breezy,
-  openssl,
-  bzip2,
-  libxslt,
-  perl,
-  postgresql,
-  prometheus-cpp,
-  nukeReferences,
-  git,
-  nlohmann_json,
-  openssh,
-  openldap,
-  gnused,
-  coreutils,
-  findutils,
-  gzip,
-  xz,
-  gnutar,
-  rpm,
-  dpkg,
-  cdrkit,
-  pixz,
-  boost,
  mdbook,
-  foreman,
-  python3,
-  netcat,
-  cacert,
-  glibcLocales,
  meson,
  ninja,
-  nix-eval-jobs,
-  fetchFromGitHub,
-  nixosTests,
-  unstableGitUpdater,
+  nukeReferences,
+  unzip,
+
+  bzip2,
+  perl,
+  pixz,
+
+  coreutils,
+  findutils,
+  gnused,
+  gnutar,
+  gzip,
+  openssh,
+  xz,
+
+  breezy,
+  darcs,
+  gitMinimal,
+  mercurial,
+  subversion,
+  top-git,
+
+  cdrkit,
+  dpkg,
+  rpm,
 }:

 let
-  # Need these pins until we bump past https://github.com/NixOS/hydra/pull/1828
-  nix = nixVersions.nix_2_34;
-  nixEvalJobsVersion = "2.34.3";
-  nix-eval-jobs_2_34 =
-    (nix-eval-jobs.override {
-      nixComponents = nixVersions.nixComponents_2_34;
-    }).overrideAttrs
-      {
-        version = nixEvalJobsVersion;
-        src = fetchFromGitHub {
-          owner = "NixOS";
-          repo = "nix-eval-jobs";
-          tag = "v${nixEvalJobsVersion}";
-          hash = "sha256-YaVQAgBxWbUBFHXLBLzdUyVvuA/DDw80SEnn9iq0Veo=";
-        };
-      };
+  # Keep in sync with the nix input of https://github.com/NixOS/hydra/blob/master/flake.nix
+  nixComponents = nixVersions.nixComponents_2_35;
+
+  version = "0-unstable-2026-09-09";
+
+  src = fetchFromGitHub {
+    owner = "NixOS";
+    repo = "hydra";
+    rev = "1d1d8b1c6fdc08444a514f383b291228f19d72d8";
+    hash = "sha256-wbPw1mlCrZODGxWFSXkOjCtKRWYeZYcs/W24yay3tKM=";
+  };
+
+  nix-perl = callPackage ./nix-perl.nix {
+    inherit src;
+    inherit (nixComponents) nix-store;
+  };

  perlDeps = buildEnv {
    name = "hydra-perl-deps";
-    paths =
-      with perlPackages;
-      lib.closePropagation [
+    paths = lib.closePropagation (
+      [
+        gitMinimal
+        nix-perl
+      ]
+      ++ (with perlPackages; [
        AuthenSASL
        CatalystActionREST
        CatalystAuthenticationStoreDBIxClass
@@ -84,21 +79,20 @@ let
        CatalystPluginSessionStateCookie
        CatalystPluginSessionStoreFastMmap
        CatalystPluginStackTrace
-        CatalystRuntime
        CatalystTraitForRequestProxyBase
        CatalystViewDownload
        CatalystViewJSON
        CatalystViewTT
-        CatalystXScriptServerStarman
        CatalystXRoleApplicator
+        CatalystXScriptServerStarman
        CryptPassphrase
        CryptPassphraseArgon2
        CryptRandPasswd
+        DataDump
+        DateTime
        DBDPg
        DBDSQLite
        DBIxClassHelpers
-        DataDump
-        DateTime
        DigestSHA1
        EmailMIME
        EmailSender
@@ -122,11 +116,10 @@ let
        NumberBytesHuman
        PadWalker
        ParallelForkManager
-        PerlCriticCommunity
        PrometheusTinyShared
        ReadonlyX
-        SQLSplitStatement
        SetScalar
+        SQLSplitStatement
        Starman
        StringCompareConstantTime
        SysHostnameLong
@@ -136,140 +129,109 @@ let
        TestPostgreSQL
        TextDiff
        TextTable
-        UUID4Tiny
+        URIdb
+        UUIDURandom
        XMLSimple
        YAML
-        (nix.libs.nix-perl-bindings or nix.perl-bindings or null)
-        git
-      ];
+      ])
+    );
  };
-
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "hydra";
-  version = "0-unstable-2026-03-16";
+  inherit version src;
  # nixpkgs-update: no auto update

-  src = fetchFromGitHub {
-    owner = "NixOS";
-    repo = "hydra";
-    rev = "a40d42862da88cce78a27dd594e1484a034aac4d";
-    hash = "sha256-8pttLK/JQiUL6EXJfjBtBggiLw+769JdQGrpM7klXdg=";
-  };
+  sourceRoot = "${finalAttrs.src.name}/subprojects/hydra";

  outputs = [
    "out"
    "doc"
  ];

-  buildInputs = [
-    unzip
-    libpqxx
-    top-git
-    mercurial
-    darcs
-    subversion
-    breezy
-    openssl
-    bzip2
-    libxslt
-    nix
-    perlDeps
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    makeWrapper
+    mdbook
+    meson
+    ninja
+    nukeReferences
    perl
-    pixz
-    boost
-    nlohmann_json
-    prometheus-cpp
+    perlDeps
+    unzip
+  ];
+
+  buildInputs = [
+    perl
+    perlDeps
  ];

  hydraPath = lib.makeBinPath (
    [
-      subversion
-      openssh
-      nix
-      nix-eval-jobs_2_34
-      coreutils
-      findutils
-      pixz
-      gzip
-      bzip2
-      xz
-      gnutar
-      unzip
-      git
-      top-git
-      mercurial
-      darcs
-      gnused
      breezy
+      bzip2
+      coreutils
+      darcs
+      findutils
+      gitMinimal
+      gnused
+      gnutar
+      gzip
+      mercurial
+      nix-eval-jobs
+      nixComponents.nix-cli
+      openssh
+      pixz
+      subversion
+      top-git
+      unzip
+      xz
    ]
    ++ lib.optionals stdenv.hostPlatform.isLinux [
-      rpm
-      dpkg
      cdrkit
+      dpkg
+      rpm
    ]
  );

-  nativeBuildInputs = [
-    meson
-    ninja
-    makeWrapper
-    pkg-config
-    mdbook
-    nukeReferences
-  ];
-
-  nativeCheckInputs = [
-    cacert
-    foreman
-    glibcLocales
-    python3
-    netcat
-    nix-eval-jobs_2_34
-    openldap
-    postgresql
-  ];
-
-  env = {
-    OPENLDAP_ROOT = openldap;
-  };
-
-  shellHook = ''
-    PATH=$(pwd)/src/script:$(pwd)/src/hydra-queue-runner:$(pwd)/src/hydra-evaluator:$PATH
-    PERL5LIB=$(pwd)/src/lib:$PERL5LIB;
-  '';
-
  mesonBuildType = "release";

  postPatch = ''
    patchShebangs .
  '';

-  preCheck = ''
-    export LOGNAME=''${LOGNAME:-foo}
-    # set $HOME for bzr so it can create its trace file
-    export HOME=$(mktemp -d)
+  # Tests live in subprojects/hydra-tests and need PostgreSQL plus the Rust
+  # daemons. Covered by nixosTests.hydra instead.
+  doCheck = false;
+
+  # subprojects/hydra-manual is a separate meson project upstream.
+  postBuild = ''
+    mdbook build ../../hydra-manual -d "$NIX_BUILD_TOP/manual"
  '';

  postInstall = ''
-    mkdir -p $out/nix-support
+    mkdir -p $doc/share/doc/hydra $out/nix-support
+    cp -r $NIX_BUILD_TOP/manual/. $doc/share/doc/hydra
+    echo "doc manual $doc/share/doc/hydra" >> $out/nix-support/hydra-build-products
+
    for i in $out/bin/*; do
        read -n 4 chars < $i
        if [[ $chars =~ ELF ]]; then continue; fi
        wrapProgram $i \
            --prefix PERL5LIB ':' "$out/libexec/hydra/lib:${perlPackages.makePerlPath [ perlDeps ]}" \
-            --prefix PATH ':' $out/bin:$hydraPath \
+            --prefix PATH ':' "$out/bin:$hydraPath" \
            --set-default HYDRA_RELEASE ${finalAttrs.version} \
            --set HYDRA_HOME $out/libexec/hydra \
-            --set NIX_RELEASE ${nix.name or "unknown"} \
-            --set NIX_EVAL_JOBS_RELEASE ${nix-eval-jobs_2_34.name or "unknown"}
+            --set NIX_RELEASE ${nixComponents.nix-cli.name or "unknown"} \
+            --set NIX_EVAL_JOBS_RELEASE ${nix-eval-jobs.name or "unknown"}
    done
  '';

-  doCheck = true;
-
  passthru = {
-    inherit nix perlDeps;
+    inherit nix-perl perlDeps;
+    nix = nixComponents.nix-cli;
    tests = { inherit (nixosTests) hydra; };
    updateScript = unstableGitUpdater { };
  };
@@ -277,7 +239,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    description = "Nix-based continuous build system";
    homepage = "https://nixos.org/hydra";
-    license = lib.licenses.gpl3;
+    license = lib.licenses.gpl3Only;
    platforms = lib.platforms.linux;
    maintainers = with lib.maintainers; [
      conni2461
--- a/pkgs/by-name/jo/journaldriver/package.nix
+++ b/pkgs/by-name/jo/journaldriver/package.nix
@@ -4,7 +4,7 @@
  rustPlatform,
  pkg-config,
  openssl,
-  systemd,
+  systemdLibs,
 }:

 rustPlatform.buildRustPackage {
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage {

  buildInputs = [
    openssl
-    systemd
+    systemdLibs
  ];
  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/by-name/jo/joypixels/package.nix
+++ b/pkgs/by-name/jo/joypixels/package.nix
@@ -14,7 +14,7 @@ let
      darwin = rec {
        systemTag = "nix-darwin";
        capitalized = systemTag;
-        fontFile = "JoyPixels-SBIX.ttf";
+        fontFile = "joypixels-sbix.ttf";
      };
    }
    .${kernel.name} or {
@@ -23,20 +23,31 @@ let
      fontFile = "joypixels-android.ttf";
    };

-  joypixels-free-license = lib.licenses.mkLicense {
-    shortName = "JoyPixels-Free";
-    fullName = "JoyPixels Free License Agreement";
-    url = "https://cdn.joypixels.com/free-license.pdf";
-    free = false;
-  };
+  joypixels-free-license =
+    let
+      inherit (systemSpecific) systemTag;
+    in
+    lib.licenses.mkLicense {
+      shortName = "JoyPixels-Free";
+      fullName = "JoyPixels Free License Agreement";
+      url = "https://cdn.joypixels.com/distributions/${systemTag}/license/free-license.txt";
+      free = false;
+    };

-  joypixels-license-appendix = lib.licenses.mkLicense {
-    shortName = "JoyPixels-NixOS-Appendix";
-    fullName = "JoyPixels ${systemSpecific.capitalized} License Appendix";
-    url = "https://cdn.joypixels.com/distributions/${systemSpecific.systemTag}/appendix/joypixels-license-appendix.pdf";
-    free = false;
-    redistributable = true;
-  };
+  joypixels-license-appendix =
+    let
+      inherit (systemSpecific)
+        capitalized
+        systemTag
+        ;
+    in
+    lib.licenses.mkLicense {
+      shortName = "JoyPixels-NixOS-Appendix";
+      fullName = "JoyPixels ${capitalized} License Appendix";
+      url = "https://cdn.joypixels.com/distributions/${systemTag}/appendix/joypixels-license-appendix.txt";
+      free = false;
+      redistributable = true;
+    };

  throwLicense = throw ''
    Use of the JoyPixels font requires acceptance of the license.
@@ -67,7 +78,7 @@ in

 stdenv.mkDerivation rec {
  pname = "joypixels";
-  version = "9.0.0";
+  version = "11.0.0";

  src =
    assert !acceptLicense -> throwLicense;
@@ -77,9 +88,9 @@ stdenv.mkDerivation rec {
      url = "https://cdn.joypixels.com/distributions/${systemTag}/font/${version}/${fontFile}";
      sha256 =
        {
-          darwin = "sha256-muUxXzz8BePyPsiZocYvM0ebM1H+u84ysN5YUvsMLiU=";
+          darwin = "sha256-NDxhHgnHDenHict39V4W8mLJIqpmBfmDYfsRx7Es06s=";
        }
-        .${kernel.name} or "sha256-pmGsVgYSK/c5OlhOXhNlRBs/XppMXmsHcZeSmIkuED4=";
+        .${kernel.name} or "sha256-taHKy2rin1SE24BKnB8LZ662U8MO9HL5if3+mHQ38Io=";
    };

  dontUnpack = true;
@@ -95,10 +106,7 @@ stdenv.mkDerivation rec {
  meta = {
    description = "Finest emoji you can use legally (formerly EmojiOne)";
    longDescription = ''
-      Updated for 2024! JoyPixels 9.0 includes 3,820 originally crafted icon
-      designs and is 100% Unicode 15.1 compatible. We offer the largest
-      selection of files ranging from png, svg, iconjar, and fonts (sprites
-      available upon request).
+      Updated for 2026! 3,991 originally-crafted emoji, Unicode 17 compatible.
    '';
    homepage = "https://www.joypixels.com/fonts";
    hydraPlatforms = [ ]; # Just a binary file download, nothing to cache.
--- a/pkgs/by-name/ki/kitty/package.nix
+++ b/pkgs/by-name/ki/kitty/package.nix
@@ -151,6 +151,15 @@ buildPythonApplication rec {
    })
  ];

+  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
+    substituteInPlace glfw/x11_init.c \
+      --replace-fail 'libXi.so.6'       '${lib.getLib libxi}/lib/libXi.so.6' \
+      --replace-fail 'libXrandr.so.2'   '${lib.getLib libxrandr}/lib/libXrandr.so.2' \
+      --replace-fail 'libXcursor.so.1'  '${lib.getLib libxcursor}/lib/libXcursor.so.1' \
+      --replace-fail 'libXinerama.so.1' '${lib.getLib libxinerama}/lib/libXinerama.so.1' \
+      --replace-fail 'libXext.so.6'     '${lib.getLib libxext}/lib/libXext.so.6'
+  '';
+
  hardeningDisable = [
    # causes redefinition of _FORTIFY_SOURCE
    "fortify3"
--- a/pkgs/by-name/kn/knxd/package.nix
+++ b/pkgs/by-name/kn/knxd/package.nix
@@ -10,8 +10,8 @@
  argp-standalone,
  fmt,
  libev,
-  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
-  systemd,
+  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
+  systemdLibs,
  withUsb ? stdenv.hostPlatform.isLinux,
  libusb1,
 }:
@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
    fmt
    libev
  ]
-  ++ lib.optional withSystemd systemd
+  ++ lib.optional withSystemd systemdLibs
  ++ lib.optional withUsb libusb1
  ++ lib.optional stdenv.hostPlatform.isDarwin argp-standalone;

--- a/pkgs/by-name/kt/ktls-utils/package.nix
+++ b/pkgs/by-name/kt/ktls-utils/package.nix
@@ -8,8 +8,8 @@
  keyutils,
  glib,
  libnl,
-  systemd,
-  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
+  systemdLibs,
+  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
  nix-update-script,
  nixosTests,
 }:
--- a/pkgs/by-name/li/libwmf/package.nix
+++ b/pkgs/by-name/li/libwmf/package.nix
@@ -16,7 +16,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libwmf";
-  version = "0.2.15";
+  version = "0.2.16";

  outputs = [
    "out"
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "caolanm";
    repo = "libwmf";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Bpxr04dQ6EjX1FBVF4KcbJQvUjsPK6L03xLIXG6F2FI=";
+    hash = "sha256-cQY0DFG+S35G7vblbBxWMTWFp8WqnpNSvjohQSLzijU=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/li/lightgbm/package.nix
+++ b/pkgs/by-name/li/lightgbm/package.nix
@@ -49,6 +49,9 @@ stdenv.mkDerivation (finalAttrs: {
  pname = lib.optionalString rLibrary "r-" + "lightgbm";
  version = "4.6.0";

+  strictDeps = true;
+  __structuredAttrs = true;
+
  src = fetchFromGitHub {
    owner = "lightgbm-org";
    repo = "lightgbm";
@@ -95,6 +98,7 @@ stdenv.mkDerivation (finalAttrs: {
  nativeBuildInputs = [
    cmake
  ]
+  ++ lib.optionals cudaSupport [ cudaPackages.cuda_nvcc ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.openmp ]
  ++ lib.optionals openclSupport [
    opencl-headers
@@ -110,7 +114,7 @@ stdenv.mkDerivation (finalAttrs: {
    pandoc
  ];

-  buildInputs = [ gtest ] ++ lib.optional cudaSupport cudaPackages.cudatoolkit;
+  buildInputs = [ gtest ] ++ lib.optionals cudaSupport [ cudaPackages.cuda_cudart ];

  propagatedBuildInputs = lib.optionals rLibrary [
    rPackages.data_table
@@ -128,6 +132,9 @@ stdenv.mkDerivation (finalAttrs: {
    ++ lib.optionals cudaSupport [
      (lib.cmakeBool "USE_CUDA" true)
      (lib.cmakeFeature "CMAKE_CXX_COMPILER" (lib.getExe cudaPackages.backendStdenv.cc))
+      (lib.cmakeFeature "CMAKE_CUDA_STANDARD" "14")
+      (lib.cmakeFeature "CMAKE_CUDA_ARCHITECTURES" cudaPackages.flags.cmakeCudaArchitecturesString)
+      (lib.cmakeBool "CMAKE_CUDA_RESOLVE_DEVICE_SYMBOLS" true)
    ]
    ++ lib.optionals openclSupport [
      (lib.cmakeBool "USE_GPU" true)
--- a/pkgs/by-name/mi/mint-l-icons/package.nix
+++ b/pkgs/by-name/mi/mint-l-icons/package.nix
@@ -9,14 +9,14 @@

 stdenvNoCC.mkDerivation {
  pname = "mint-l-icons";
-  version = "1.8.3";
+  version = "1.8.4";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = "mint-l-icons";
    # They don't really do tags, this is just a named commit.
-    rev = "ddb43425b35aaf15a8d5ba74059b5b72c2a383e2";
-    hash = "sha256-Vfhlor9RZpDc7zLs90hRreZco3uR/OmoH3QQvMg0kVk=";
+    rev = "0b22e7cc69f11e8472065cfc9309add51f403cfc";
+    hash = "sha256-AtCQMgSmeMV7rU6XaT42bD4DDfe5acVIxQ1JwKYQb8c=";
  };

  propagatedBuildInputs = [
--- a/pkgs/by-name/mo/models-dev/package.nix
+++ b/pkgs/by-name/mo/models-dev/package.nix
@@ -60,7 +60,7 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "models-dev";
-  version = "sdk-v0.0.5-unstable-2026-10-02";
+  version = "0.0.5-unstable-2026-10-02";

  __structuredAttrs = true;
  strictDeps = true;
--- a/pkgs/by-name/mo/mommy/package.nix
+++ b/pkgs/by-name/mo/mommy/package.nix
@@ -23,13 +23,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "mommy";
-  version = "1.8.0";
+  version = "2.0.0";

  src = fetchFromGitHub {
    owner = "FWDekker";
    repo = "mommy";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-zuFiRzM3mDt5GIaRl9nCLH3YteJfKtV2R29JwIKygjY=";
+    hash = "sha256-BMIvKaFQvtZisM3tesyO+0Yhs7g81LaFMLSZRkAP0+g=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/mo/mosquitto/package.nix
+++ b/pkgs/by-name/mo/mosquitto/package.nix
@@ -12,9 +12,9 @@
  libuv,
  libwebsockets,
  openssl,
-  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
+  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
  sqlite,
-  systemd,
+  systemdLibs,
  uthash,
  nixosTests,
 }:
@@ -77,7 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
    sqlite
    uthash
  ]
-  ++ lib.optional withSystemd systemd;
+  ++ lib.optional withSystemd systemdLibs;

  propagatedBuildInputs = [ cjson ];

--- a/pkgs/by-name/mp/mpd-notification/package.nix
+++ b/pkgs/by-name/mp/mpd-notification/package.nix
@@ -9,7 +9,7 @@
  libnotify,
  libmpdclient,
  discount,
-  systemd,
+  systemdLibs,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
    ffmpeg
    libmpdclient
    discount
-    systemd
+    systemdLibs
  ];

  installPhase = ''
--- a/pkgs/by-name/mp/mpd/package.nix
+++ b/pkgs/by-name/mp/mpd/package.nix
@@ -6,7 +6,7 @@
  ninja,
  pkg-config,
  glib,
-  systemd,
+  systemdLibs,
  fmt,
  buildPackages,
  # Inputs
@@ -140,7 +140,7 @@ let
    pcre = [ pcre2 ];
    sqlite = [ sqlite ];
    syslog = [ ];
-    systemd = [ systemd ];
+    systemd = [ systemdLibs ];
    zeroconf = [
      avahi
      dbus
--- a/pkgs/by-name/mp/mpdscribble/package.nix
+++ b/pkgs/by-name/mp/mpdscribble/package.nix
@@ -9,7 +9,7 @@
  curl,
  libgcrypt,
  libmpdclient,
-  systemd,
+  systemdLibs,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
    boost
    libgcrypt
  ]
-  ++ lib.optional stdenv.hostPlatform.isLinux systemd;
+  ++ lib.optional stdenv.hostPlatform.isLinux systemdLibs;

  meta = {
    description = "MPD client which submits info about tracks being played to a scrobbler";
--- a/pkgs/by-name/mu/multimon-ng/package.nix
+++ b/pkgs/by-name/mu/multimon-ng/package.nix
@@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "multimon-ng";
-  version = "1.6.1";
+  version = "1.6.2";

  src = fetchFromGitHub {
    owner = "EliasOenal";
    repo = "multimon-ng";
    rev = finalAttrs.version;
-    sha256 = "sha256-FxX01+bFcca+wvnilOV4xJx1bSV9lxy83EhpwWhi/Cs=";
+    sha256 = "sha256-OHl9y1Pk/8N4IwKYuiikHoW2sfLWU4G4uyozxHxB0WY=";
  };

  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
@@ -116,57 +116,55 @@ def test_build_remote(
        copy_flags={"copy": True},
    ) == Path("/path/to/config")

-    mock_run.assert_has_calls(
-        [
-            call(
-                [
-                    "nix-instantiate",
-                    "<nixpkgs/nixos>",
-                    "--attr",
-                    "preAttr.config.system.build.toplevel",
-                    "--add-root",
-                    n.tmpdir.TMPDIR_PATH / "00000000000000000000000000000001",
-                    "--inst",
-                ],
-                stdout=PIPE,
-            ),
-            call(
-                [
-                    "nix-copy-closure",
-                    "--copy",
-                    "--to",
-                    "user@host",
-                    Path("/path/to/file"),
-                ],
-                append_local_env={
-                    "NIX_SSHOPTS": " ".join(["--ssh opts", *p.SSH_DEFAULT_OPTS]),
-                },
-            ),
-            call(
-                ["mktemp", "-d", "-t", "nixos-rebuild.XXXXX"],
-                remote=build_host,
-                stdout=PIPE,
-            ),
-            call(
-                [
-                    "nix-store",
-                    "--realise",
-                    Path("/path/to/file"),
-                    "--add-root",
-                    Path("/tmp/tmpdir/00000000000000000000000000000002"),
-                    "--realise",
-                ],
-                remote=build_host,
-                stdout=PIPE,
-            ),
-            call(
-                ["readlink", "-f", "/tmp/tmpdir/config"],
-                remote=build_host,
-                stdout=PIPE,
-            ),
-            call(["rm", "-rf", Path("/tmp/tmpdir")], remote=build_host, check=False),
-        ]
-    )
+    assert mock_run.mock_calls == [
+        call(
+            [
+                "nix-instantiate",
+                "<nixpkgs/nixos>",
+                "--attr",
+                "preAttr.config.system.build.toplevel",
+                "--add-root",
+                n.tmpdir.TMPDIR_PATH / "00000000000000000000000000000001",
+                "--inst",
+            ],
+            stdout=PIPE,
+        ),
+        call(
+            [
+                "nix-copy-closure",
+                "--copy",
+                "--to",
+                "user@host",
+                Path("/path/to/file"),
+            ],
+            append_local_env={
+                "NIX_SSHOPTS": " ".join(["--ssh opts", *p.SSH_DEFAULT_OPTS]),
+            },
+        ),
+        call(
+            ["mktemp", "-d", "-t", "nixos-rebuild.XXXXX"],
+            remote=build_host,
+            stdout=PIPE,
+        ),
+        call(
+            [
+                "nix-store",
+                "--realise",
+                Path("/path/to/file"),
+                "--add-root",
+                Path("/tmp/tmpdir/00000000000000000000000000000002"),
+                "--realise",
+            ],
+            remote=build_host,
+            stdout=PIPE,
+        ),
+        call(
+            ["readlink", "-f", "/tmp/tmpdir/config"],
+            remote=build_host,
+            stdout=PIPE,
+        ),
+        call(["rm", "-rf", Path("/tmp/tmpdir")], remote=build_host, check=False),
+    ]


@patch(
@@ -192,47 +190,45 @@ def test_build_remote_flake(
        copy_flags={"copy": True},
        flake_build_flags={"build": True},
    ) == Path("/path/to/file")
-    mock_run.assert_has_calls(
-        [
-            call(
-                [
-                    "nix",
-                    "--extra-experimental-features",
-                    "nix-command flakes",
-                    "eval",
-                    "--raw",
-                    '/flake.nix#nixosConfigurations."hostname".config.system.build.toplevel.drvPath',
-                    "--flake",
-                ],
-                stdout=PIPE,
-            ),
-            call(
-                [
-                    "nix-copy-closure",
-                    "--copy",
-                    "--to",
-                    "user@host",
-                    Path("/path/to/file"),
-                ],
-                append_local_env={
-                    "NIX_SSHOPTS": " ".join(["--ssh opts", *p.SSH_DEFAULT_OPTS]),
-                },
-            ),
-            call(
-                [
-                    "nix",
-                    "--extra-experimental-features",
-                    "nix-command flakes",
-                    "build",
-                    "/path/to/file^*",
-                    "--print-out-paths",
-                    "--build",
-                ],
-                remote=build_host,
-                stdout=PIPE,
-            ),
-        ]
-    )
+    assert mock_run.mock_calls == [
+        call(
+            [
+                "nix",
+                "--extra-experimental-features",
+                "nix-command flakes",
+                "eval",
+                "--raw",
+                '/flake.nix#nixosConfigurations."hostname".config.system.build.toplevel.drvPath',
+                "--flake",
+            ],
+            stdout=PIPE,
+        ),
+        call(
+            [
+                "nix-copy-closure",
+                "--copy",
+                "--to",
+                "user@host",
+                Path("/path/to/file"),
+            ],
+            append_local_env={
+                "NIX_SSHOPTS": " ".join(["--ssh opts", *p.SSH_DEFAULT_OPTS]),
+            },
+        ),
+        call(
+            [
+                "nix",
+                "--extra-experimental-features",
+                "nix-command flakes",
+                "build",
+                "/path/to/file^*",
+                "--print-out-paths",
+                "--build",
+            ],
+            remote=build_host,
+            stdout=PIPE,
+        ),
+    ]


 def test_copy_closure(monkeypatch: MonkeyPatch) -> None:
@@ -465,7 +461,7 @@ def test_get_nixpkgs_rev(tmpdir: Path) -> None:
        ],
    ) as mock_run:
        assert n.get_nixpkgs_rev(tmpdir) == ".git.0f7c82403fd6"
-        mock_run.assert_has_calls(expected_calls)
+        assert mock_run.mock_calls == expected_calls

    with patch(
        get_qualified_name(n.run_wrapper, n),
@@ -476,7 +472,7 @@ def test_get_nixpkgs_rev(tmpdir: Path) -> None:
        ],
    ) as mock_run:
        assert n.get_nixpkgs_rev(tmpdir) == ".git.0f7c82403fd6M"
-        mock_run.assert_has_calls(expected_calls)
+        assert mock_run.mock_calls == expected_calls


 def test_get_generations(tmp_path: Path) -> None:
@@ -821,20 +817,23 @@ def test_set_profile(mock_run: Mock) -> None:
        elevate=e.NO_ELEVATOR,
    )

-    mock_run.assert_has_calls(
-        [
-            call(
-                ["mkdir", "-p", profile_path.parent],
-                remote=target_host,
-                elevate=e.NO_ELEVATOR,
-            ),
-            call(
-                ["nix-env", "-p", profile_path, "--set", config_path],
-                remote=target_host,
-                elevate=e.NO_ELEVATOR,
-            ),
-        ]
-    )
+    assert mock_run.mock_calls == [
+        call(
+            ["test", "-f", Path("/path/to/config/nixos-version")],
+            remote=m.Remote(host="user@localhost", opts=[], store_type="ssh"),
+            check=False,
+        ),
+        call(
+            ["mkdir", "-p", profile_path.parent],
+            remote=target_host,
+            elevate=e.NO_ELEVATOR,
+        ),
+        call(
+            ["nix-env", "-p", profile_path, "--set", config_path],
+            remote=target_host,
+            elevate=e.NO_ELEVATOR,
+        ),
+    ]

    mock_run.reset_mock()
    mock_run.return_value = CompletedProcess([], 1)
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_services.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_services.py
@@ -77,15 +77,13 @@ def test_reexec(
    mock_build.return_value = Path("/path")

    s.reexec(argv, args, grouped_nix_args)
-    mock_build.assert_has_calls(
-        [
-            call(
-                s.NIXOS_REBUILD_ATTR,
-                n.models.BuildAttr(ANY, ANY),
-                {"build": True, "no_out_link": True},
-            )
-        ]
-    )
+    assert mock_build.mock_calls == [
+        call(
+            s.NIXOS_REBUILD_ATTR,
+            n.models.BuildAttr(ANY, ANY),
+            {"build": True, "no_out_link": True},
+        )
+    ]
    # do not exec if there is no new version
    mock_execve.assert_not_called()

--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -111,12 +111,12 @@ let
  # vendored in-tree. Pre-stage the pin (tracks upstream's
  # `LLAMA_CPP_VERSION` file) so the FetchContent step uses our copy
  # instead of trying to clone over the network in the sandbox.
-  llamaCppVersion = "b11081";
+  llamaCppVersion = "b11232";
  llamaCppSrc = fetchFromGitHub {
    owner = "ggml-org";
    repo = "llama.cpp";
    tag = llamaCppVersion;
-    hash = "sha256-yI/oNTMzOO9Cu0xVp0YYbbgvlwTggJAPJMooDfVnMvU=";
+    hash = "sha256-2+yobqi5pOI8FyMK2StFIWAOLR2JgQGh/7gX6o4k8JU=";
  };

  wrapperOptions = [
@@ -152,13 +152,13 @@ let
 in
 goBuild (finalAttrs: {
  pname = "ollama";
-  version = "0.34.4";
+  version = "0.35.1";

  src = fetchFromGitHub {
    owner = "ollama";
    repo = "ollama";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Wg1lVSJjN67TSIX75Xp/QyiuCW+HirpdJZIm92J0j6o=";
+    hash = "sha256-5qJyJhqL/Zhfq2s/Z3x5Sq0GFgBai812cQkgNq82nm4=";
  };

  vendorHash = "sha256-45FfI47tNHBPYOBLRrwuhADCUtkjAhlFrExlEy9piMI=";
--- a/pkgs/by-name/op/openscap/package.nix
+++ b/pkgs/by-name/op/openscap/package.nix
@@ -31,7 +31,7 @@
  system-sendmail,
  curl,
  procps,
-  systemd,
+  systemdLibs,
  perl,
  doxygen,
  pkg-config,
@@ -86,7 +86,7 @@ stdenv.mkDerivation (finalAttrs: {
      python3
      libgcrypt
      libxml2
-      systemd
+      systemdLibs
      haskellPackages.pthread
      graphviz
      system-sendmail
--- a/pkgs/by-name/pb/pbm/package.nix
+++ b/pkgs/by-name/pb/pbm/package.nix
@@ -2,9 +2,9 @@

 buildDotnetGlobalTool {
  pname = "pbm";
-  version = "1.5.0";
+  version = "1.5.1";

-  nugetHash = "sha256-MDsu9+EtgiDXPHKDMkbfzekPts064g39tbGJj9vSGMc=";
+  nugetHash = "sha256-8H4qT1BMvLf3CogaEUF3mYJIeChQZH+xeZsGUlkePBQ=";

  meta = {
    description = "CLI for managing Akka.NET applications and Akka.NET Clusters";
--- a/pkgs/by-name/pd/pdfjs/package.nix
+++ b/pkgs/by-name/pd/pdfjs/package.nix
@@ -6,14 +6,14 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "pdfjs";
-  version = "6.3.289";
+  version = "6.4.299";

  strictDeps = true;
  __structuredAttrs = true;

  src = fetchzip {
    url = "https://github.com/mozilla/pdf.js/releases/download/v${finalAttrs.version}/pdfjs-${finalAttrs.version}-dist.zip";
-    hash = "sha256-v8LoUEOgG8t1Al4vpKrXZ3D4HEDXd4bqRUFqUbN63qk=";
+    hash = "sha256-UHMYW6fHRL7by4sP7NXE5NuTKtmUPfInK6KunbnP88w=";
    stripRoot = false;
  };

--- a/pkgs/by-name/pi/pi-coding-agent/package.nix
+++ b/pkgs/by-name/pi/pi-coding-agent/package.nix
@@ -13,16 +13,16 @@
 }:
 buildNpmPackage (finalAttrs: {
  pname = "pi-coding-agent";
-  version = "1.0.0";
+  version = "1.0.2";

  src = fetchFromGitHub {
    owner = "earendil-works";
    repo = "pi";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-CGznIVHXG6gr2F8vzHcR/v4P9xJgZHeMTt/CJ/kB78o=";
+    hash = "sha256-DjWJE7KcCdNF/M3RrO76rKCSd6oFLo2dX9wFT0nwEXk=";
  };

-  npmDepsHash = "sha256-ndEvWdB6sa5nNNtabk2OMZKUFG9x3op185deZHxFnXk=";
+  npmDepsHash = "sha256-gW0JO84SrPl3PDUu7eBzOKaNGSif23J1xY1tpS/oVhQ=";

  # The provider model catalog (packages/ai/src/providers/data/) is generated by
  # a network fetch (models.dev plus provider APIs) and is gitignored upstream,
@@ -31,7 +31,7 @@ buildNpmPackage (finalAttrs: {
  # under dist/providers/data/. Bump this hash alongside version.
  modelData = fetchurl {
    url = "https://registry.npmjs.org/@earendil-works/pi-ai/-/pi-ai-${finalAttrs.version}.tgz";
-    hash = "sha256-85uZwpuFmPF1sQhA5dKoGYPnwM5crk19+DoQB0R9LCs=";
+    hash = "sha256-isjl+r1l4PDsuFOLYhGCSFn1mXWUAF16A+H3CzhDihc=";
  };

  preConfigure = ''
--- a/pkgs/by-name/re/reframe/package.nix
+++ b/pkgs/by-name/re/reframe/package.nix
@@ -6,7 +6,7 @@
  meson,
  ninja,
  cmake,
-  systemd,
+  systemdLibs,
  glib,
  gtk4,
  libdrm,
@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  buildInputs = [
-    systemd
+    systemdLibs
    glib
    gtk4
    libdrm
--- a/pkgs/by-name/re/remnote/package.nix
+++ b/pkgs/by-name/re/remnote/package.nix
@@ -8,11 +8,11 @@

 appimageTools.wrapType2 (finalAttrs: {
  pname = "remnote";
-  version = "1.28.28";
+  version = "1.28.37";

  src = fetchurl {
    url = "https://download2.remnote.io/remnote-desktop2/RemNote-${finalAttrs.version}.AppImage";
-    hash = "sha256-YUnIWxtMg7zJjJVkhkp+MPKnQ0uUOSZC2tmQ7JjXcaI=";
+    hash = "sha256-K972+NFq5qmgeu8+kF5v1TOrP+wg+zHjgnmlveiJyyk=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/sa/samplv1/package.nix
+++ b/pkgs/by-name/sa/samplv1/package.nix
@@ -15,11 +15,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "samplv1";
-  version = "1.4.2";
+  version = "1.5.0";

  src = fetchurl {
    url = "mirror://sourceforge/samplv1/samplv1-${finalAttrs.version}.tar.gz";
-    hash = "sha256-DAD8y9BhVyCxi7VPWLXKkcv6kxFQOOmTDB2ntJiG0Lw=";
+    hash = "sha256-EzmkDwxU6C8/ExQUQ3dWW2Tez8h/cg8Q+x6CWfnL5kw=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/sn/snakemake/package.nix
+++ b/pkgs/by-name/sn/snakemake/package.nix
@@ -36,28 +36,30 @@ python3Packages.buildPythonApplication (finalAttrs: {
  build-system = with python3Packages; [ setuptools-scm ];

  pythonRelaxDeps = [
+    "docutils"
    "packaging"
    "sqlmodel"
  ];
  dependencies = with python3Packages; [
-    appdirs
    conda-inject
    configargparse
    connection-pool
-    datrie
    docutils
+    dpath
    gitpython
    humanfriendly
    immutables
    jinja2
    jsonschema
    nbformat
+    packaging
+    platformdirs
    psutil
    pulp
    pygments
    pyyaml
+    referencing
    requests
-    reretry
    smart-open
    snakemake-interface-common
    snakemake-interface-executor-plugins
@@ -66,11 +68,9 @@ python3Packages.buildPythonApplication (finalAttrs: {
    snakemake-interface-scheduler-plugins
    snakemake-interface-storage-plugins
    sqlmodel
-    stopit
    tabulate
    tenacity
    throttler
-    toposort
    wrapt
    yte
  ];
--- a/pkgs/by-name/sp/spicetify-cli/package.nix
+++ b/pkgs/by-name/sp/spicetify-cli/package.nix
@@ -9,16 +9,16 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "spicetify-cli";
-  version = "2.45.1";
+  version = "2.45.3";

  src = fetchFromGitHub {
    owner = "spicetify";
    repo = "cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Mu97p0HlvmEMkPV/VvHztJ1VqocxXoAXRtDKLGYd9mk=";
+    hash = "sha256-+EsZHr9cJDvSlYnwlmLjv0iT6s6gpMCd3+RKl0pUbFM=";
  };

-  vendorHash = "sha256-nrUaocs+so35MDxC6TkRSakYKWmhoysrvhE6fXRvYco=";
+  vendorHash = "sha256-1yoFdrSgKB1kWtt7wz/gzNvl+v8v9Z/Ab3Kegb/5Q7M=";

  postPatch = ''
    substituteInPlace src/preprocess/preprocess.go \
--- a/pkgs/by-name/ss/sssd/package.nix
+++ b/pkgs/by-name/ss/sssd/package.nix
@@ -40,7 +40,7 @@
  libxslt,
  libxml2,
  libuuid,
-  systemd,
+  systemdLibs,
  nspr,
  check,
  cmocka,
@@ -191,7 +191,7 @@ stdenv.mkDerivation (finalAttrs: {
    libxslt
    libxml2
    libuuid
-    systemd
+    systemdLibs
    nspr
    check
    cmocka
--- a/pkgs/by-name/sw/swaymux/package.nix
+++ b/pkgs/by-name/sw/swaymux/package.nix
@@ -5,9 +5,10 @@
  nlohmann_json,
  qt6,
  stdenv,
+  nix-update-script,
 }:
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.1";
+  version = "1.1.1";
  pname = "swaymux";

  src = fetchFromGitea {
@@ -15,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
    domain = "git.grimmauld.de";
    owner = "Grimmauld";
    repo = "swaymux";
-    hash = "sha256-OMJ9wKNuvD1Z9KV7Bp7aIA5gWbBl9PmTdGcGegE0vqM=";
+    hash = "sha256-pe0YrhRJdy/3GePzM1RD1vQ0fGisImNHKzGMFeYQN88=";
  };

  buildInputs = [
@@ -30,6 +31,8 @@ stdenv.mkDerivation (finalAttrs: {

  doCheck = true;

+  passthru.updateScript = nix-update-script { };
+
  meta = {
    changelog = "https://git.grimmauld.de/Grimmauld/swaymux/commits/branch/main";
    description = "Program to quickly navigate sway";
--- a/pkgs/by-name/ta/tang/package.nix
+++ b/pkgs/by-name/ta/tang/package.nix
@@ -7,7 +7,7 @@
  jansson,
  jose,
  http-parser,
-  systemd,
+  systemdLibs,
  meson,
  ninja,
  makeWrapper,
@@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
    jansson
    jose
    http-parser
-    systemd
+    systemdLibs
  ];

  outputs = [
--- a/pkgs/by-name/ta/tarantool/package.nix
+++ b/pkgs/by-name/ta/tarantool/package.nix
@@ -17,13 +17,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "tarantool";
-  version = "3.8.0";
+  version = "3.8.1";

  src = fetchFromGitHub {
    owner = "tarantool";
    repo = "tarantool";
    tag = finalAttrs.version;
-    hash = "sha256-X3Bqwt3HSFWr1klPtrIaE5jMAzFJO4mRcowWJCnqUac=";
+    hash = "sha256-ZdGbBOp34H+n0DHn+Ocbj2T5Kzta+mQSEhu7pRrQy64=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/tg/tgt/package.nix
+++ b/pkgs/by-name/tg/tgt/package.nix
@@ -4,7 +4,7 @@
  fetchFromGitHub,
  libxslt,
  libaio,
-  systemd,
+  systemdLibs,
  perl,
  docbook_xsl,
  coreutils,
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  buildInputs = [
-    systemd
+    systemdLibs
    libaio
  ];

--- a/pkgs/by-name/th/thunderbird-mcp/package-lock.json
+++ b/pkgs/by-name/th/thunderbird-mcp/package-lock.json
@@ -1,12 +1,12 @@
 {
  "name": "thunderbird-mcp",
-  "version": "0.9.1",
+  "version": "0.9.2",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "thunderbird-mcp",
-      "version": "0.9.1",
+      "version": "0.9.2",
      "license": "MIT",
      "bin": {
        "thunderbird-mcp": "mcp-bridge.cjs"
@@ -22,10 +22,34 @@
        "node": ">=18.0.0"
      }
    },
+    "node_modules/@cacheable/memory": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@cacheable/memory/-/memory-2.2.0.tgz",
+      "integrity": "sha512-CTLKqLItRCEixEAewD3/j9DB3/o96gpTPD4eJ1v+DGOlxZRZncRQkGYqqnAGCscYd6RNeXfGeiuCphsPtqyIfQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@cacheable/utils": "^2.5.0",
+        "@keyv/bigmap": "^1.3.1",
+        "hookified": "^1.15.1",
+        "keyv": "^5.6.0"
+      }
+    },
+    "node_modules/@cacheable/utils": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/@cacheable/utils/-/utils-2.5.0.tgz",
+      "integrity": "sha512-buipgOVDkkPXNR5+xBpDw7Zk2n1EvU7qBJCNUcL7rhQ//kfpOXPAvQ511Os0vpLYJ1pZnvudNytkQt2hst3wqA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "hashery": "^1.5.1",
+        "keyv": "^5.6.0"
+      }
+    },
    "node_modules/@eslint-community/eslint-utils": {
-      "version": "4.9.1",
-      "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.9.1.tgz",
-      "integrity": "sha512-phrYmNiYppR7znFEdqgfWHXR6NCkZEK7hwWDHZUjit/2/U0r6XvkDl0SYnoM51Hq7FhCGdLDT6zxCCOY1hexsQ==",
+      "version": "4.10.1",
+      "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.10.1.tgz",
+      "integrity": "sha512-cuadcxVFE8sDK6iWJbs8Sn0av2Nrh2QSGQhVlBW9AaAHqHwjWsZHT8LJ4hFGPh7ASBV2deFdM7H/DPjulmh8rg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -80,9 +104,9 @@
      }
    },
    "node_modules/@eslint/config-helpers": {
-      "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.6.0.tgz",
-      "integrity": "sha512-ii6Bw9jJ2zi2cWA2Z+9/QZ/+3DX6kwaV5Q986D/CdP3Lap3w/pgQZ373FV7byY/i7L4IRH/G43I5dz1ClsCbpA==",
+      "version": "0.7.0",
+      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.7.0.tgz",
+      "integrity": "sha512-DObd/KKUsU+FaFv4PLxSRenpXfQWmPXXP3pPZ6/K1PCrMu2vQpMDMuQe/BqYeoLcz8ro0bVDF1RxOJgfVEdhUw==",
      "dev": true,
      "license": "Apache-2.0",
      "dependencies": {
@@ -137,9 +161,9 @@
      }
    },
    "node_modules/@eslint/plugin-kit": {
-      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/@eslint/plugin-kit/-/plugin-kit-0.7.2.tgz",
-      "integrity": "sha512-+CNAzxglkrpNf/kKywqQfk74QjtceuOE7Qm+AF8miRvPF/wmmK5+OJOgVh3AVTT3RP2mH3+FOaxlE5v72owk0A==",
+      "version": "0.7.3",
+      "resolved": "https://registry.npmjs.org/@eslint/plugin-kit/-/plugin-kit-0.7.3.tgz",
+      "integrity": "sha512-IkO+/KEUvwbVpiURZg+P7zF74z5Jxe0UgJxVni+RtoHQ6IZieXaO02kmadomap/q+l6bc/jdPGGqTjhuZnuz1Q==",
      "dev": true,
      "license": "Apache-2.0",
      "dependencies": {
@@ -216,6 +240,30 @@
        "url": "https://github.com/sponsors/nzakas"
      }
    },
+    "node_modules/@keyv/bigmap": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/@keyv/bigmap/-/bigmap-1.3.1.tgz",
+      "integrity": "sha512-WbzE9sdmQtKy8vrNPa9BRnwZh5UF4s1KTmSK0KUVLo3eff5BlQNNWDnFOouNpKfPKDnms9xynJjsMYjMaT/aFQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "hashery": "^1.4.0",
+        "hookified": "^1.15.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      },
+      "peerDependencies": {
+        "keyv": "^5.6.0"
+      }
+    },
+    "node_modules/@keyv/serialize": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@keyv/serialize/-/serialize-1.1.1.tgz",
+      "integrity": "sha512-dXn3FZhPv0US+7dtJsIi2R+c7qWYiReoEh5zUntWCf4oSpMNib8FDhSoed6m3QyZdx5hK7iLFkYk3rNxwt8vTA==",
+      "dev": true,
+      "license": "MIT"
+    },
    "node_modules/@types/esrecurse": {
      "version": "4.3.1",
      "resolved": "https://registry.npmjs.org/@types/esrecurse/-/esrecurse-4.3.1.tgz",
@@ -238,9 +286,9 @@
      "license": "MIT"
    },
    "node_modules/acorn": {
-      "version": "8.17.0",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.17.0.tgz",
-      "integrity": "sha512-xRQbDb9BnwDafYNn6Vwl839DYVjqXYb1XVGtWAZ1kcDc6iwAL4hg3B1dZlRiuENFeO2H53gFG3in621AdERVAg==",
+      "version": "8.18.0",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.18.0.tgz",
+      "integrity": "sha512-lGq+9yr1/GuAWaVYIHRjvvySG5/4VfKIvC8EWxStPdcDh/Ka7FG3twP6v4d5BkravUilhIAsG4Qj83t02LWUPQ==",
      "dev": true,
      "license": "MIT",
      "bin": {
@@ -277,6 +325,13 @@
        "url": "https://github.com/sponsors/epoberezkin"
      }
    },
+    "node_modules/argparse": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
+      "dev": true,
+      "license": "Python-2.0"
+    },
    "node_modules/balanced-match": {
      "version": "4.0.4",
      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
@@ -288,16 +343,30 @@
      }
    },
    "node_modules/brace-expansion": {
-      "version": "5.0.7",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
-      "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
+      "version": "5.0.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
+      "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "balanced-match": "^4.0.2"
      },
      "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/cacheable": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/cacheable/-/cacheable-2.5.0.tgz",
+      "integrity": "sha512-60cyAOytib/OzBw1JNSoSV/boK1AtHryDIjvVBk7XbN4ugfkM3+Sry7fEjNgPMGgOjuaZPAp8ruZ0Cxafwyq9g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@cacheable/memory": "^2.2.0",
+        "@cacheable/utils": "^2.5.0",
+        "hookified": "^1.15.0",
+        "keyv": "^5.6.0",
+        "qified": "^0.10.1"
      }
    },
    "node_modules/cross-spawn": {
@@ -341,9 +410,9 @@
      "license": "MIT"
    },
    "node_modules/enhanced-resolve": {
-      "version": "5.24.2",
-      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.24.2.tgz",
-      "integrity": "sha512-rpsZEGT1jFuve6QlpyRp9ckQ+kN61hvF9BzCPyMdaKTm8UJce96KBn3sorXOFXlzjPrs3Vc4T1NsSroZ3PxlFw==",
+      "version": "5.26.0",
+      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.26.0.tgz",
+      "integrity": "sha512-9vhedylFonb2YGogzUKX6+Ja72gOJbN1QHAqdrvqLwhdl/QWbKopzoUC9EbQNVsAns/bx/4uyqalrQAoy1IByw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -368,9 +437,9 @@
      }
    },
    "node_modules/eslint": {
-      "version": "10.7.0",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.7.0.tgz",
-      "integrity": "sha512-GVTD7s1vdIl6UYvAfriOPeY1Df8LIZjfofLvHwde+erDHGGuHyuM6xoxRxmHiebhYuD2p1vN4wWh0XzPARSGDQ==",
+      "version": "10.12.0",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.12.0.tgz",
+      "integrity": "sha512-npHjrHb2o4ehH3mE+YuxABR+0gyb0aVWCIolgJDArwCiHEIsonBm3ZKjel5b0U5+a+MbEvIyRCGCzD3eKKK2NA==",
      "dev": true,
      "license": "MIT",
      "workspaces": [
@@ -380,9 +449,9 @@
        "@eslint-community/eslint-utils": "^4.8.0",
        "@eslint-community/regexpp": "^4.12.2",
        "@eslint/config-array": "^0.23.5",
-        "@eslint/config-helpers": "^0.6.0",
+        "@eslint/config-helpers": "^0.7.0",
        "@eslint/core": "^1.2.1",
-        "@eslint/plugin-kit": "^0.7.2",
+        "@eslint/plugin-kit": "^0.7.3",
        "@humanfs/node": "^0.16.6",
        "@humanwhocodes/module-importer": "^1.0.1",
        "@humanwhocodes/retry": "^0.4.2",
@@ -397,14 +466,14 @@
        "esquery": "^1.7.0",
        "esutils": "^2.0.2",
        "fast-deep-equal": "^3.1.3",
-        "file-entry-cache": "^8.0.0",
+        "file-entry-cache": "11.1.5 || >11.1.6 <12",
        "find-up": "^5.0.0",
        "glob-parent": "^6.0.2",
        "ignore": "^5.2.0",
        "imurmurhash": "^0.1.4",
        "is-glob": "^4.0.0",
        "json-stable-stringify-without-jsonify": "^1.0.1",
-        "minimatch": "^10.2.4",
+        "minimatch": "^10.2.5",
        "natural-compare": "^1.4.0",
        "optionator": "^0.9.3"
      },
@@ -465,9 +534,9 @@
      }
    },
    "node_modules/eslint-plugin-n": {
-      "version": "18.2.2",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-n/-/eslint-plugin-n-18.2.2.tgz",
-      "integrity": "sha512-gOO0lIqwEjZ750kv9/SptCWArUoAZXJoBr0vYWTO2dCBxctHUXlBIigiC8xuxxr/NKqgIT6Ehz1xRcilj8a5cA==",
+      "version": "18.4.1",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-n/-/eslint-plugin-n-18.4.1.tgz",
+      "integrity": "sha512-2sBReWOvCbzgkPri9M5SFmD5EbIwZLa1xz6B5RZsrI19WSFKpyx1sOMr+pdk8puCiXuEgCbErEHy1PuaUrc/4w==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -478,6 +547,7 @@
        "globals": "^15.11.0",
        "globrex": "^0.1.2",
        "ignore": "^5.3.2",
+        "js-yaml": "^5.4.1",
        "semver": "^7.6.3"
      },
      "engines": {
@@ -650,16 +720,13 @@
      "license": "MIT"
    },
    "node_modules/file-entry-cache": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-8.0.0.tgz",
-      "integrity": "sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==",
+      "version": "11.1.5",
+      "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-11.1.5.tgz",
+      "integrity": "sha512-+PFTHITI08JIGhnNpGNI8T8inUpgZfk3GNEqfT9R2zZV2iFXg3CvqzSl/uEhs7TSGujYRELEANyDvS8Fj7+S7Q==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "flat-cache": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=16.0.0"
+        "flat-cache": "^6.1.23"
      }
    },
    "node_modules/find-up": {
@@ -680,30 +747,28 @@
      }
    },
    "node_modules/flat-cache": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-4.0.1.tgz",
-      "integrity": "sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==",
+      "version": "6.1.23",
+      "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-6.1.23.tgz",
+      "integrity": "sha512-f++BY9pTk+983xK1FLzlLpmM0i0z+jHmx3QESGkURMXujQZz1k5wzwX6hjnQ8goaD0B+sYnDK1yZ6MTyZfUaqA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "flatted": "^3.2.9",
-        "keyv": "^4.5.4"
-      },
-      "engines": {
-        "node": ">=16"
+        "cacheable": "^2.5.0",
+        "flatted": "^3.4.2",
+        "hookified": "^1.15.0"
      }
    },
    "node_modules/flatted": {
-      "version": "3.4.2",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.2.tgz",
-      "integrity": "sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==",
+      "version": "3.4.4",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.4.tgz",
+      "integrity": "sha512-5+ybhBZANEJxaH3X5evAFatUxLfEHSr7n6kYJ+1Qd0mUqr4eu9gIf6GDbWHf8RJijHrjjO8G+la14SlL2SeS1Q==",
      "dev": true,
      "license": "ISC"
    },
    "node_modules/get-tsconfig": {
-      "version": "4.14.0",
-      "resolved": "https://registry.npmjs.org/get-tsconfig/-/get-tsconfig-4.14.0.tgz",
-      "integrity": "sha512-yTb+8DXzDREzgvYmh6s9vHsSVCHeC0G3PI5bEXNBHtmshPnO+S5O7qgLEOn0I5QvMy6kpZN8K1NKGyilLb93wA==",
+      "version": "4.14.3",
+      "resolved": "https://registry.npmjs.org/get-tsconfig/-/get-tsconfig-4.14.3.tgz",
+      "integrity": "sha512-++QEw4DIY7WGoukz+/+A/8dGYPT9l9yIadnmSgZ8Rjr3YVSVDipQSO9CdnJo9ePqFqUUqh+wk9uIaoiAwsiPkA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -727,9 +792,9 @@
      }
    },
    "node_modules/globals": {
-      "version": "17.7.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-17.7.0.tgz",
-      "integrity": "sha512-Czmyns5dUsq4seFBR/Kdydhmo8y9kC79hiSkPn0YcGtNnYWnrgt0vjrSjx9tspoDGWm2CMarffRuLjM4xUz8xg==",
+      "version": "17.13.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-17.13.0.tgz",
+      "integrity": "sha512-RwMTC61u7hrG3ZJMkZQOK4JLJrKS8QtoTii63EmWvFXHqycY9FObBJQCbsLxSO8kjKhWE5kV1GC+Vb1g3RI0Zg==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -753,6 +818,26 @@
      "dev": true,
      "license": "ISC"
    },
+    "node_modules/hashery": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/hashery/-/hashery-1.5.1.tgz",
+      "integrity": "sha512-iZyKG96/JwPz1N55vj2Ie2vXbhu440zfUfJvSwEqEbeLluk7NnapfGqa7LH0mOsnDxTF85Mx8/dyR6HfqcbmbQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "hookified": "^1.15.0"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/hookified": {
+      "version": "1.15.1",
+      "resolved": "https://registry.npmjs.org/hookified/-/hookified-1.15.1.tgz",
+      "integrity": "sha512-MvG/clsADq1GPM2KGo2nyfaWVyn9naPiXrqIe4jYjXNZQt238kWyOGrsyc/DmRAQ+Re6yeo6yX/yoNCG5KAEVg==",
+      "dev": true,
+      "license": "MIT"
+    },
    "node_modules/ignore": {
      "version": "5.3.2",
      "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
@@ -803,12 +888,28 @@
      "dev": true,
      "license": "ISC"
    },
-    "node_modules/json-buffer": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.1.tgz",
-      "integrity": "sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==",
+    "node_modules/js-yaml": {
+      "version": "5.4.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.2.tgz",
+      "integrity": "sha512-m+aqu+LwO1O6sIopafj8HUVl5aawITwZQe/yHpMCKjaWBaA/d07B/QdMb3529REftiU+RMMHL3Vlsw3hON7vWg==",
      "dev": true,
-      "license": "MIT"
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "argparse": "^2.0.1"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.mjs"
+      }
    },
    "node_modules/json-schema-traverse": {
      "version": "0.4.1",
@@ -825,13 +926,13 @@
      "license": "MIT"
    },
    "node_modules/keyv": {
-      "version": "4.5.4",
-      "resolved": "https://registry.npmjs.org/keyv/-/keyv-4.5.4.tgz",
-      "integrity": "sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==",
+      "version": "5.6.0",
+      "resolved": "https://registry.npmjs.org/keyv/-/keyv-5.6.0.tgz",
+      "integrity": "sha512-CYDD3SOtsHtyXeEORYRx2qBtpDJFjRTGXUtmNEMGyzYOKj1TE3tycdlho7kA1Ufx9OYWZzg52QFBGALTirzDSw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "json-buffer": "3.0.1"
+        "@keyv/serialize": "^1.1.1"
      }
    },
    "node_modules/levn": {
@@ -865,13 +966,13 @@
      }
    },
    "node_modules/minimatch": {
-      "version": "10.2.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
-      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
+      "version": "10.2.6",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
+      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
      "dev": true,
      "license": "BlueOak-1.0.0",
      "dependencies": {
-        "brace-expansion": "^5.0.5"
+        "brace-expansion": "^5.0.8"
      },
      "engines": {
        "node": "18 || 20 || >=22"
@@ -984,6 +1085,26 @@
        "node": ">=6"
      }
    },
+    "node_modules/qified": {
+      "version": "0.10.1",
+      "resolved": "https://registry.npmjs.org/qified/-/qified-0.10.1.tgz",
+      "integrity": "sha512-+Owyggi9IxT1ePKGafcI87ubSmxol6smwJ+RAHDQlx9+9cPwFWDiKFFCPuWhr9ignlGpZ9vDQLw67N4dcTVFEA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "hookified": "^2.1.1"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/qified/node_modules/hookified": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/hookified/-/hookified-2.2.0.tgz",
+      "integrity": "sha512-p/LgFzRN5FeoD3DLS6bkUapeye6E4SI6yJs6KetENd18S+FBthqYq2amJUWpt5z0EQwwHemidjY5OqJGEKm5uA==",
+      "dev": true,
+      "license": "MIT"
+    },
    "node_modules/resolve-pkg-maps": {
      "version": "1.0.0",
      "resolved": "https://registry.npmjs.org/resolve-pkg-maps/-/resolve-pkg-maps-1.0.0.tgz",
--- a/pkgs/by-name/th/thunderbird-mcp/package.nix
+++ b/pkgs/by-name/th/thunderbird-mcp/package.nix
@@ -7,13 +7,13 @@

 buildNpmPackage (finalAttrs: {
  pname = "thunderbird-mcp";
-  version = "0.9.1";
+  version = "0.9.2";

  src = fetchFromGitHub {
    owner = "TKasperczyk";
    repo = "thunderbird-mcp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-uN/xvN+bbtFTWMd2Kko/d07FXna5e7jdfZPX8vAwfa4=";
+    hash = "sha256-OH8uAy9ka2ao/7UF2Bi4dfhOa0IZz+z2Bm6MpfBF1Gk=";
  };

  postPatch = ''
@@ -23,7 +23,7 @@ buildNpmPackage (finalAttrs: {
  forceEmptyCache = true;
  dontNpmBuild = true;

-  npmDepsHash = "sha256-Dhm/6nJOGAFKUTmnWmDfnsLyYcDSVPvrWS4DlyOlBNk=";
+  npmDepsHash = "sha256-cngbvIIP7lgwuXhIM6CA7oNlg9ctj9I2AA3SMKxk54g=";

  doCheck = true;

--- a/pkgs/by-name/tt/tt-burnin/package.nix
+++ b/pkgs/by-name/tt/tt-burnin/package.nix
@@ -1,27 +1,30 @@
 {
  lib,
  fetchFromGitHub,
-  python3Packages,
+  python313Packages,
  versionCheckHook,
 }:
-python3Packages.buildPythonApplication (finalAttrs: {
+# jsons depends on typish, which is disabled on Python 3.14
+# TODO: switch back to python3Packages once typish supports Python 3.14
+python313Packages.buildPythonApplication (finalAttrs: {
  pname = "tt-burnin";
-  version = "0.4.0";
+  version = "0.4.4";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "tenstorrent";
    repo = "tt-burnin";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-NI32BerBCuMMulB2fsseeoWI50iklpNqMyTs4BArl2A=";
+    hash = "sha256-ZHc9qhOZE8fv/oj0bHGTyncZNT1mJtk1pFAPCRY4TtE=";
  };

-  build-system = with python3Packages; [
+  build-system = with python313Packages; [
    setuptools
    setuptools-scm
  ];

-  dependencies = with python3Packages; [
+  dependencies = with python313Packages; [
    pyluwen
    tt-tools-common
    jsons
--- a/pkgs/by-name/tt/tt-metal/deps.nix
+++ b/pkgs/by-name/tt/tt-metal/deps.nix
@@ -1,12 +1,39 @@
-{ fetchFromGitHub }:
 {
+  fetchFromGitHub,
+  applyPatches,
+  ttMetalSrc,
+}:
+{
+  # third_party/CMakeLists.txt
+  blake3 = applyPatches {
+    src = fetchFromGitHub {
+      owner = "BLAKE3-team";
+      repo = "BLAKE3";
+      tag = "1.8.4";
+      hash = "sha256-Xz0LH0YpUjDishvXsW6VNK8msFlPXg08wFoSfbgws0g=";
+    };
+    patches = [
+      "${ttMetalSrc}/third_party/blake3_install_dir.patch"
+    ];
+  };
+  protobuf = applyPatches {
+    src = fetchFromGitHub {
+      owner = "protocolbuffers";
+      repo = "protobuf";
+      tag = "v21.12";
+      hash = "sha256-VZQEFHq17UsTH5CZZOcJBKiScGV2xPJ/e6gkkVliRCU=";
+    };
+    patches = [
+      "${ttMetalSrc}/third_party/protobuf_noreturn.patch"
+    ];
+  };
  yaml-cpp = fetchFromGitHub {
    owner = "jbeder";
    repo = "yaml-cpp";
-    tag = "0.8.0";
-    hash = "sha256-J87oS6Az1/vNdyXu3L7KmUGWzU0IAkGrGMUUha+xDXI=";
+    rev = "2f86d13775d119edbb69af52e5f566fd65c6953b";
+    hash = "sha256-GtUTbEaRR3+GfVkt3t8EsqBHVffVKOl8urtQTaHozIo=";
  };
-  googletest = fetchFromGitHub {
+  gtest = fetchFromGitHub {
    owner = "google";
    repo = "googletest";
    tag = "v1.13.0";
@@ -18,29 +45,35 @@
    tag = "v1.2.6";
    hash = "sha256-qjy5KyAm7/WeCyxMu/5QrBVjDSJPs0q/ZPyQwXp0WLA=";
  };
-  fmt = fetchFromGitHub {
-    owner = "fmtlib";
-    repo = "fmt";
-    tag = "11.1.4";
-    hash = "sha256-sUbxlYi/Aupaox3JjWFqXIjcaQa0LFjclQAOleT+FRA=";
-  };
  enchantum = fetchFromGitHub {
    owner = "ZXShady";
    repo = "enchantum";
    rev = "8ca5b0eb7e7ebe0252e5bc6915083f1dd1b8294e";
    hash = "sha256-q2bbNAMpNJYedekEDtTQ2qI2+GPdkTsuxAHCBaAnuTA=";
  };
-  range-v3 = fetchFromGitHub {
-    owner = "ericniebler";
-    repo = "range-v3";
-    tag = "0.12.0";
-    hash = "sha256-bRSX91+ROqG1C3nB9HSQaKgLzOHEFy9mrD2WW3PRBWU=";
+  fmt = fetchFromGitHub {
+    owner = "fmtlib";
+    repo = "fmt";
+    tag = "11.1.4";
+    hash = "sha256-sUbxlYi/Aupaox3JjWFqXIjcaQa0LFjclQAOleT+FRA=";
  };
-  pybind11 = fetchFromGitHub {
-    owner = "pybind";
-    repo = "pybind11";
-    tag = "v2.13.6";
-    hash = "sha256-SNLdtrOjaC3lGHN9MAqTf51U9EzNKQLyTMNPe0GcdrU=";
+  range-v3 = applyPatches {
+    src = fetchFromGitHub {
+      owner = "ericniebler";
+      repo = "range-v3";
+      tag = "0.12.0";
+      hash = "sha256-bRSX91+ROqG1C3nB9HSQaKgLzOHEFy9mrD2WW3PRBWU=";
+    };
+    patches = [
+      "${ttMetalSrc}/third_party/range-v3.patch"
+    ];
+  };
+  nanobind = fetchFromGitHub {
+    owner = "wjakob";
+    repo = "nanobind";
+    rev = "86e5626728fc282637a6c338597120913dded1bb";
+    fetchSubmodules = true;
+    hash = "sha256-jAg/CotM361gc+5Ymsz8jP0ddLBzrFTxCkssJKFe0NY=";
  };
  nlohmann_json = fetchFromGitHub {
    owner = "nlohmann";
@@ -48,23 +81,38 @@
    tag = "v3.11.3";
    hash = "sha256-7F0Jon+1oWL7uqet5i1IgHX0fUw/+z0QwEcA3zs5xHg=";
  };
-  xtl = fetchFromGitHub {
-    owner = "xtensor-stack";
-    repo = "xtl";
-    tag = "0.8.0";
-    hash = "sha256-hhXM2fG3Yl4KeEJlOAcNPVLJjKy9vFlI63lhbmIAsT8=";
+  xtl = applyPatches {
+    src = fetchFromGitHub {
+      owner = "xtensor-stack";
+      repo = "xtl";
+      tag = "0.8.0";
+      hash = "sha256-hhXM2fG3Yl4KeEJlOAcNPVLJjKy9vFlI63lhbmIAsT8=";
+    };
+    patches = [
+      "${ttMetalSrc}/third_party/xtl.patch"
+    ];
  };
-  xtensor = fetchFromGitHub {
-    owner = "xtensor-stack";
-    repo = "xtensor";
-    tag = "0.26.0";
-    hash = "sha256-gAGLb5NPT4jiIpXONqY+kalxKCFKFXlNqbM79x1lTKE=";
+  xtensor = applyPatches {
+    src = fetchFromGitHub {
+      owner = "xtensor-stack";
+      repo = "xtensor";
+      tag = "0.26.0";
+      hash = "sha256-gAGLb5NPT4jiIpXONqY+kalxKCFKFXlNqbM79x1lTKE=";
+    };
+    patches = [
+      "${ttMetalSrc}/third_party/xtensor.patch"
+    ];
  };
-  xtensor-blas = fetchFromGitHub {
-    owner = "xtensor-stack";
-    repo = "xtensor-blas";
-    tag = "0.22.0";
-    hash = "sha256-Lg6MjJbZUCMqv4eSiZQrLfJy/86RWQ9P85UfeIQJ6bk=";
+  xtensor-blas = applyPatches {
+    src = fetchFromGitHub {
+      owner = "xtensor-stack";
+      repo = "xtensor-blas";
+      tag = "0.22.0";
+      hash = "sha256-Lg6MjJbZUCMqv4eSiZQrLfJy/86RWQ9P85UfeIQJ6bk=";
+    };
+    patches = [
+      "${ttMetalSrc}/third_party/xtensor-blas.patch"
+    ];
  };
  benchmark = fetchFromGitHub {
    owner = "google";
@@ -78,24 +126,18 @@
    tag = "v3.7.0";
    hash = "sha256-q2IYhG84hPIZhuogWf6ojDG9S9ZyuJz9s14kQyIc6t0=";
  };
+  flatbuffers = fetchFromGitHub {
+    owner = "google";
+    repo = "flatbuffers";
+    tag = "v24.3.25";
+    hash = "sha256-uE9CQnhzVgOweYLhWPn2hvzXHyBbFiFVESJ1AEM3BmA=";
+  };
  simd-everywhere = fetchFromGitHub {
    owner = "simd-everywhere";
    repo = "simde";
    tag = "v0.8.2";
    hash = "sha256-igjDHCpKXy6EbA9Mf6peL4OTVRPYTV0Y2jbgYQuWMT4=";
  };
-  msgpack = fetchFromGitHub {
-    owner = "msgpack";
-    repo = "msgpack-c";
-    tag = "cpp-6.1.0";
-    hash = "sha256-VqzFmm3MmMhWyooOsz1d9gwwbn/fnnxpkCFwqKR6los=";
-  };
-  tokenizers-cpp = fetchFromGitHub {
-    owner = "mlc-ai";
-    repo = "tokenizers-cpp";
-    rev = "55d53aa38dc8df7d9c8bd9ed50907e82ae83ce66";
-    hash = "sha256-CkW8S6LHHOY+tz3hHoWBzwGb3f25LFp41F/jH4pdKI4=";
-  };
  spdlog = fetchFromGitHub {
    owner = "gabime";
    repo = "spdlog";
@@ -105,26 +147,70 @@
  tt-logger = fetchFromGitHub {
    owner = "tenstorrent";
    repo = "tt-logger";
-    tag = "v1.1.5";
-    hash = "sha256-lw8L4pCAGObCkiuF/JFC9PmcQgwmJZOOo1cbaUMvo+I=";
+    tag = "v1.1.8";
+    hash = "sha256-cAQLxxwxRkRh1hwDVyDPOr3wsiC2DStUP0UMSiY0vHg=";
  };
+  cadical = applyPatches {
+    src = fetchFromGitHub {
+      owner = "arminbiere";
+      repo = "cadical";
+      tag = "rel-2.2.1";
+      hash = "sha256-dYRaw9DI63Nqz0IJkfQYU4y00KSfq1Xv0xZuL1G15CY=";
+    };
+    patches = [
+      "${ttMetalSrc}/third_party/cadical_vivify_include_tuple.patch"
+    ];
+  };
+  capnproto = applyPatches {
+    src = fetchFromGitHub {
+      owner = "capnproto";
+      repo = "capnproto";
+      rev = "d135c9ca5e15219eaf131dfce1a41afdbaea9aab";
+      hash = "sha256-aDcn4bLZGq8915/NPPQsN5Jv8FRWd8cAspkG3078psc=";
+    };
+    patches = [
+      "${ttMetalSrc}/third_party/capnproto_capture_this.patch"
+      "${ttMetalSrc}/third_party/capnproto_pthread.patch"
+    ];
+  };
+  ttexalens = fetchFromGitHub {
+    owner = "tenstorrent";
+    repo = "tt-exalens";
+    rev = "6f5720240b7254b25cb3d78aef81769fc12a30f9";
+    hash = "sha256-QX9fh4KPJEj4AQjDViPQgVW1JxOADWJk0SlASLJTUCY=";
+  };
+
+  # tt-exalens: cmake/native_elf.cmake
+  libdwarf = fetchFromGitHub {
+    owner = "davea42";
+    repo = "libdwarf-code";
+    tag = "v2.3.1";
+    hash = "sha256-azVCzQt9oA40YACa9PkdNt0D8vWRNHXXGoSFOYNJxgA=";
+  };
+  elfio = applyPatches {
+    src = fetchFromGitHub {
+      owner = "serge1";
+      repo = "ELFIO";
+      tag = "Release_3.12";
+      hash = "sha256-tDRBscs2L/3gYgLQvb1+8nNxqkr8v1xBkeDXuOqShX4=";
+    };
+    patches = [
+      ./elfio-cstdint.patch
+    ];
+  };
+
+  # tt_metal/third_party/umd/third_party/CMakeLists.txt
  nanomsg = fetchFromGitHub {
    owner = "nanomsg";
    repo = "nng";
    tag = "v1.8.0";
    hash = "sha256-E2uosZrmxO3fqwlLuu5e36P70iGj5xUlvhEb+1aSvOA=";
  };
-  flatbuffers = fetchFromGitHub {
-    owner = "google";
-    repo = "flatbuffers";
-    tag = "v24.3.25";
-    hash = "sha256-uE9CQnhzVgOweYLhWPn2hvzXHyBbFiFVESJ1AEM3BmA=";
-  };
  libuv = fetchFromGitHub {
    owner = "libuv";
    repo = "libuv";
-    tag = "v1.48.0";
-    hash = "sha256-U68BmIQNpmIy3prS7LkYl+wvDJQNikoeFiKh50yQFoA=";
+    tag = "v1.51.0";
+    hash = "sha256-ayTk3qkeeAjrGj5ab7wF7vpWI8XWS1EeKKUqzaD/LY0=";
  };
  cxxopts = fetchFromGitHub {
    owner = "jarro2783";
@@ -132,11 +218,10 @@
    rev = "dbf4c6a66816f6c3872b46cc6af119ad227e04e1";
    hash = "sha256-2Z8DT9ihlmbiqCi8gcNzW4C5AUh4xCrpCKrGbRYcreQ=";
  };
-  nanobind = fetchFromGitHub {
-    owner = "wjakob";
-    repo = "nanobind";
-    tag = "v2.7.0";
-    fetchSubmodules = true;
-    hash = "sha256-ex5svqDp9XJtiNCxu0249ORL6LbG679U6PvKQaWANmE=";
+  umd_asio = fetchFromGitHub {
+    owner = "chriskohlhoff";
+    repo = "asio";
+    tag = "asio-1-30-2";
+    hash = "sha256-g+ZPKBUhBGlgvce8uTkuR983unD2kbQKgoddko7x+fk=";
  };
 }
--- a/pkgs/by-name/tt/tt-metal/elfio-cstdint.patch
+++ b/pkgs/by-name/tt/tt-metal/elfio-cstdint.patch
@@ -0,0 +1,11 @@
+--- a/elfio/elf_types.hpp
+++ b/elfio/elf_types.hpp
+@@ -23,6 +23,8 @@ THE SOFTWARE.
+ #ifndef ELFTYPES_H
+ #define ELFTYPES_H
+ 
+#include <cstdint>
+
+ #ifdef __cplusplus
+ namespace ELFIO {
+ #endif
--- a/pkgs/by-name/tt/tt-metal/package.nix
+++ b/pkgs/by-name/tt/tt-metal/package.nix
@@ -3,6 +3,7 @@
  stdenv,
  fetchFromGitHub,
  fetchurl,
+  applyPatches,
  callPackage,
  pkg-config,
  cmake,
@@ -15,14 +16,14 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "tt-metal";
-  version = "0.62.2";
+  version = "0.79.0";

  src = fetchFromGitHub {
    owner = "tenstorrent";
    repo = "tt-metal";
    tag = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-ZIUjZLifRVmpWpG8Ty+I+pwgpIf5r9gJkI8ULTau4OE=";
+    hash = "sha256-sA9ryiVDBF9yJUfQ2cQDvphEC0nVQx6X2F91s2BA8Qo=";
  };

  cpm = fetchurl {
@@ -32,6 +33,11 @@ stdenv.mkDerivation (finalAttrs: {

  sfpi = callPackage ./sfpi.nix { };

+  patches = [
+    # Remove in next release 0.80.0
+    ./spsc-marker-decode-simde.patch
+  ];
+
  postUnpack = ''
    mkdir -p "$sourceRoot/runtime"
    ln -s "$sfpi" "$sourceRoot/runtime/sfpi"
@@ -40,6 +46,10 @@ stdenv.mkDerivation (finalAttrs: {
  postPatch = ''
    cp $cpm cmake/CPM.cmake
    cp $cpm tt_metal/third_party/umd/cmake/CPM.cmake
+
+    patchShebangs tt_metal/sfpi-info.sh tt_metal/llrt/hal/codegen
+    substituteInPlace tt_metal/sfpi-info.sh \
+      --replace-fail 'sfpi_arch=$(uname -m)' $'sfpi_dist=debian\nsfpi_arch=$(uname -m)'
  '';

  cmakeFlags = [
@@ -47,6 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.cmakeBool "CPM_USE_LOCAL_PACKAGES" true)
    (lib.cmakeFeature "VERSION_NUMERIC" finalAttrs.version)
    (lib.cmakeFeature "CMAKE_POLICY_VERSION_MINIMUM" "3.10")
+    (lib.cmakeBool "ENABLE_TRACY" false)
  ];

  preConfigure = ''
@@ -55,11 +66,16 @@ stdenv.mkDerivation (finalAttrs: {
      (name: src: "cp -r --no-preserve=ownership,mode ${src} build/_deps/${name}-src")
      (
        import ./deps.nix {
-          inherit fetchFromGitHub;
+          inherit fetchFromGitHub applyPatches;
+          ttMetalSrc = finalAttrs.src;
        }
      )
    }
    cp $cpm build/_deps/tt-logger-src/cmake/CPM.cmake
+
+    appendToVar cmakeFlags "-Dcadical_SOURCE_DIR=$PWD/build/_deps/cadical-src"
+    appendToVar cmakeFlags "-DCPM_umd_asio_SOURCE=$PWD/build/_deps/umd_asio-src"
+    appendToVar cmakeFlags "-DCPM_ELFIO_SOURCE=$PWD/build/_deps/elfio-src"
  '';

  # CMake install fails because "$out/include/tt-logger" tree does not exist.
@@ -87,6 +103,8 @@ stdenv.mkDerivation (finalAttrs: {
  # Fixes the parallel hook crashing in the fixupPhase with no error.
  noAuditTmpdir = true;

+  passthru.sfpi = finalAttrs.sfpi;
+
  meta = {
    description = "TT-NN operator library, and TT-Metalium low level kernel programming model";
    homepage = "https://github.com/tenstorrent/tt-metal";
--- a/pkgs/by-name/tt/tt-metal/sfpi.nix
+++ b/pkgs/by-name/tt/tt-metal/sfpi.nix
@@ -5,13 +5,14 @@
  runCommand,
  autoPatchelfHook,
  ncurses,
-  isl_0_23,
  mpfr,
  libmpc,
  xz,
+  zstd,
+  expat,
 }:
 let
-  version = "7.1.0";
+  version = "7.78.0";
 in
 runCommand "sfpi-${version}"
  {
@@ -23,21 +24,22 @@ runCommand "sfpi-${version}"

    buildInputs = [
      ncurses
-      isl_0_23
      mpfr
      libmpc
      xz
+      zstd
+      expat
    ];

    src =
      {
        aarch64-linux = fetchurl {
-          url = "https://github.com/tenstorrent/sfpi/releases/download/v${version}/sfpi_${version}_aarch64.txz";
-          hash = "sha256-MzI159hiitk1iyeGfQaDOQZhqGjfafpCMz6zmM3HrYs=";
+          url = "https://github.com/tenstorrent/sfpi/releases/download/${version}/sfpi_${version}_aarch64_debian.txz";
+          hash = "sha256-ATcNRyNZ6c3DOb+s5k7ATpMafr6k3+DoZJYTgd0rdHI=";
        };
        x86_64-linux = fetchurl {
-          url = "https://github.com/tenstorrent/sfpi/releases/download/v${version}/sfpi_${version}_x86_64.txz";
-          hash = "sha256-rQfFveg1ht+jLfk3ZOJadX26+ODE3WW5E0/18eIl7RQ=";
+          url = "https://github.com/tenstorrent/sfpi/releases/download/${version}/sfpi_${version}_x86_64_debian.txz";
+          hash = "sha256-RkxkdZ5EG4Qda8BiFtvUcNeg8Yjg/6msjrsuQEzyRNs=";
        };
      }
      ."${stdenv.hostPlatform.system}" or (throw "SFPI does not support ${stdenv.hostPlatform.system}");
--- a/pkgs/by-name/tt/tt-metal/spsc-marker-decode-simde.patch
+++ b/pkgs/by-name/tt/tt-metal/spsc-marker-decode-simde.patch
@@ -0,0 +1,622 @@
+--- a/tt_metal/impl/streaming_profiler/spsc_marker_decode.hpp
+++ b/tt_metal/impl/streaming_profiler/spsc_marker_decode.hpp
+@@ -17,11 +17,8 @@
+ #include <span>
+ #include <vector>
+ 
+-#include <immintrin.h>
+-
+-#if !defined(__AVX2__)
+-#error "the streaming profiler decode is AVX2 code; build for x86-64-v3 or newer"
+-#endif
+// SIMDe uses native AVX2 where available and supported host instructions otherwise.
+#include <simde/x86/avx2.h>
+ 
+ #include "hostdev/streaming_profiler_common.h"
+ #include "spsc_packet.h"
+@@ -284,6 +281,7 @@
+ // false when there is none. The chain unrolls in table order. always_inline, like the handlers it takes: a handler
+ // left out of line captures the walk's locals by address and pushes them all out of registers.
+ template <bool (*Pred)(Kind), size_t I = 0, typename H>
+// NOLINTNEXTLINE(cppcoreguidelines-missing-std-forward) -- Reuse the callback as an lvalue through recursive calls.
+ __attribute__((always_inline)) inline bool spsc_for_format(uint32_t t, H&& handle) {
+     if constexpr (I == kFormats.size()) {
+         return false;
+@@ -299,6 +297,7 @@
+ }
+ // Runs handle.template operator()<F>() for every row whose kind Pred accepts, in table order.
+ template <bool (*Pred)(Kind), size_t I = 0, typename H>
+// NOLINTNEXTLINE(cppcoreguidelines-missing-std-forward) -- Reuse the callback as an lvalue through recursive calls.
+ __attribute__((always_inline)) inline void spsc_for_each_format(H&& handle) {
+     if constexpr (I < kFormats.size()) {
+         if constexpr (Pred(kFormats[I].kind)) {
+@@ -324,37 +323,38 @@
+ // Built at lane entry; a STICKY_TIMER re-blends only the th lanes, a STICKY_PROG only the prog lanes.
+ struct SpscLaneConsts {
+     uint64_t th_hi;
+-    __m256i tv, mv, coords_v;  // th << 32 / prog << 32 / the coordinates, per qword
+-    __m256i zone_half, zone_half64, point_half, point_half64;
+-    __m128i tail;
+    simde__m256i tv, mv, coords_v;  // th << 32 / prog << 32 / the coordinates, per qword
+    simde__m256i zone_half, zone_half64, point_half, point_half64;
+    simde__m128i tail;
+ };
+ inline void spsc_lane_consts_th(SpscLaneConsts& c, uint32_t th) {
+     c.th_hi = static_cast<uint64_t>(th) << 32;
+-    c.tv = _mm256_set1_epi64x(static_cast<long long>(c.th_hi));
+-    const __m256i thv = _mm256_set1_epi32(static_cast<int>(th));
+-    c.zone_half = _mm256_blend_epi32(c.zone_half, thv, 0x02);
+-    c.point_half = _mm256_blend_epi32(c.point_half, thv, 0x02);
+    c.tv = simde_mm256_set1_epi64x(static_cast<long long>(c.th_hi));
+    const simde__m256i thv = simde_mm256_set1_epi32(static_cast<int>(th));
+    c.zone_half = simde_mm256_blend_epi32(c.zone_half, thv, 0x02);
+    c.point_half = simde_mm256_blend_epi32(c.point_half, thv, 0x02);
+ }
+ inline void spsc_lane_consts_prog(SpscLaneConsts& c, uint32_t prog) {
+-    c.mv = _mm256_set1_epi64x(static_cast<long long>(static_cast<uint64_t>(prog) << 32));
+-    const __m256i pgv = _mm256_set1_epi32(static_cast<int>(prog));
+-    for (__m256i* h : {&c.zone_half, &c.zone_half64, &c.point_half, &c.point_half64}) {
+-        *h = _mm256_blend_epi32(*h, pgv, 0x20);
+    c.mv = simde_mm256_set1_epi64x(static_cast<long long>(static_cast<uint64_t>(prog) << 32));
+    const simde__m256i pgv = simde_mm256_set1_epi32(static_cast<int>(prog));
+    for (simde__m256i* h : {&c.zone_half, &c.zone_half64, &c.point_half, &c.point_half64}) {
+        *h = simde_mm256_blend_epi32(*h, pgv, 0x20);
+     }
+ }
+ inline void spsc_lane_consts(SpscLaneConsts& c, const SpscRecConsts& r, uint32_t th, uint32_t prog) {
+-    const __m256i half =
+-        _mm256_setr_epi32(0, 0, 0, 0, 0, 0, static_cast<int>(r.coords[0]), static_cast<int>(r.coords[1]));
+    const simde__m256i half =
+        simde_mm256_setr_epi32(0, 0, 0, 0, 0, 0, static_cast<int>(r.coords[0]), static_cast<int>(r.coords[1]));
+     c.zone_half = c.zone_half64 = c.point_half = c.point_half64 = half;
+-    c.coords_v = _mm256_set1_epi64x(static_cast<long long>(r.coords[0] | (static_cast<uint64_t>(r.coords[1]) << 32)));
+-    c.tail = _mm_loadu_si128(reinterpret_cast<const __m128i*>(r.tail));
+    c.coords_v =
+        simde_mm256_set1_epi64x(static_cast<long long>(r.coords[0] | (static_cast<uint64_t>(r.coords[1]) << 32)));
+    c.tail = simde_mm_loadu_si128(reinterpret_cast<const simde__m128i*>(r.tail));
+     spsc_lane_consts_th(c, th);
+     spsc_lane_consts_prog(c, prog);
+ }
+ // The constant half of an F record: its th lane is blended in only when the timestamp's high half comes from the
+ // lane's sticky.
+ template <PacketFormat F>
+-inline __m256i spsc_half(const SpscLaneConsts& c) {
+inline simde__m256i spsc_half(const SpscLaneConsts& c) {
+     if constexpr (F.kind == Kind::Zone) {
+         return F.has_ts_hi() ? c.zone_half64 : c.zone_half;
+     } else {
+@@ -363,33 +363,35 @@
+ }
+ 
+ // The vector constants the kernels share; all fold to immediates once inlined.
+-inline __m256i spsc_dw_type_mask() {
+-    return _mm256_set1_epi32(static_cast<int>((0xFFFFFFFFu >> PP_TYPE_SHIFT) << PP_TYPE_SHIFT));
+inline simde__m256i spsc_dw_type_mask() {
+    return simde_mm256_set1_epi32(static_cast<int>((0xFFFFFFFFu >> PP_TYPE_SHIFT) << PP_TYPE_SHIFT));
+}
+inline simde__m256i spsc_dw_type(uint32_t type) {
+    return simde_mm256_set1_epi32(static_cast<int>(type << PP_TYPE_SHIFT));
+ }
+-inline __m256i spsc_dw_type(uint32_t type) { return _mm256_set1_epi32(static_cast<int>(type << PP_TYPE_SHIFT)); }
+-inline __m256i spsc_qw_type_mask() {
+-    return _mm256_set1_epi64x(static_cast<long long>((0xFFFFFFFFull >> PP_TYPE_SHIFT) << PP_TYPE_SHIFT));
+inline simde__m256i spsc_qw_type_mask() {
+    return simde_mm256_set1_epi64x(static_cast<long long>((0xFFFFFFFFull >> PP_TYPE_SHIFT) << PP_TYPE_SHIFT));
+ }
+-inline __m256i spsc_qw_type(uint32_t type) {
+-    return _mm256_set1_epi64x(static_cast<long long>(static_cast<uint64_t>(type) << PP_TYPE_SHIFT));
+inline simde__m256i spsc_qw_type(uint32_t type) {
+    return simde_mm256_set1_epi64x(static_cast<long long>(static_cast<uint64_t>(type) << PP_TYPE_SHIFT));
+ }
+-inline __m256i spsc_lane_idx() { return _mm256_setr_epi32(0, 1, 2, 3, 4, 5, 6, 7); }
+-inline __m256i spsc_lane0() { return _mm256_setr_epi32(-1, 0, 0, 0, 0, 0, 0, 0); }
+inline simde__m256i spsc_lane_idx() { return simde_mm256_setr_epi32(0, 1, 2, 3, 4, 5, 6, 7); }
+inline simde__m256i spsc_lane0() { return simde_mm256_setr_epi32(-1, 0, 0, 0, 0, 0, 0, 0); }
+ 
+ // A 32 B load holds spsc_recs_per_load<F> whole F packets at word stride F.words; these are its lane constants.
+ template <PacketFormat F>
+ inline constexpr uint32_t spsc_recs_per_load = 8 / F.words;
+ // -1 at word `w` of each whole packet in the load.
+ template <PacketFormat F, uint8_t w>
+-inline __m256i spsc_lanes_at() {
+inline simde__m256i spsc_lanes_at() {
+     constexpr auto L = [](int k) { return (k % F.words == w && k / F.words < 8 / F.words) ? -1 : 0; };
+-    return _mm256_setr_epi32(L(0), L(1), L(2), L(3), L(4), L(5), L(6), L(7));
+    return simde_mm256_setr_epi32(L(0), L(1), L(2), L(3), L(4), L(5), L(6), L(7));
+ }
+ // Word 0 of each whole packet down to its 27-bit id, every other lane kept.
+ template <PacketFormat F>
+-inline __m256i spsc_w0_mask() {
+inline simde__m256i spsc_w0_mask() {
+     constexpr auto L = [](int k) { return (k % F.words == 0 && k / F.words < 8 / F.words) ? 0x07FFFFFF : -1; };
+-    return _mm256_setr_epi32(L(0), L(1), L(2), L(3), L(4), L(5), L(6), L(7));
+    return simde_mm256_setr_epi32(L(0), L(1), L(2), L(3), L(4), L(5), L(6), L(7));
+ }
+ // The lanes of a composed record that come from the constant half rather than the packet: the prog and coordinate
+ // lanes always, plus each field the format lacks.
+@@ -407,68 +409,72 @@
+ // {dur, 0, ...} leaves {start, dur, id | prog << 32, coords} with the borrow in the high half; the lane's tail
+ // follows.
+ template <PacketFormat F, uint32_t r>
+-inline __m256i spsc_compose(__m256i l, __m256i half, __m128i tail, uint8_t* o) {
+inline simde__m256i spsc_compose(simde__m256i l, simde__m256i half, simde__m128i tail, uint8_t* o) {
+     constexpr int b = static_cast<int>(r * F.words);
+     constexpr auto at = [](uint8_t f) { return f == kAbsent ? 0 : b + f; };
+-    const __m256i s = _mm256_blend_epi32(
+-        _mm256_permutevar8x32_epi32(
+-            l, _mm256_setr_epi32(at(F.ts_lo), at(F.ts_hi), at(F.dur_lo), at(F.dur_hi), b, 0, 0, 0)),
+    const simde__m256i s = simde_mm256_blend_epi32(
+        simde_mm256_permutevar8x32_epi32(
+            l, simde_mm256_setr_epi32(at(F.ts_lo), at(F.ts_hi), at(F.dur_lo), at(F.dur_hi), b, 0, 0, 0)),
+         half,
+         spsc_blend_s<F>());
+     if constexpr (F.has_dur()) {
+-        const __m256i d = _mm256_blend_epi32(
+-            _mm256_permutevar8x32_epi32(l, _mm256_setr_epi32(at(F.dur_lo), at(F.dur_hi), 0, 0, 0, 0, 0, 0)),
+-            _mm256_setzero_si256(),
+        const simde__m256i d = simde_mm256_blend_epi32(
+            simde_mm256_permutevar8x32_epi32(l, simde_mm256_setr_epi32(at(F.dur_lo), at(F.dur_hi), 0, 0, 0, 0, 0, 0)),
+            simde_mm256_setzero_si256(),
+             spsc_blend_d<F>());
+-        _mm256_storeu_si256(reinterpret_cast<__m256i*>(o), _mm256_sub_epi64(s, d));
+        simde_mm256_storeu_si256(reinterpret_cast<simde__m256i*>(o), simde_mm256_sub_epi64(s, d));
+     } else {
+-        _mm256_storeu_si256(reinterpret_cast<__m256i*>(o), s);
+        simde_mm256_storeu_si256(reinterpret_cast<simde__m256i*>(o), s);
+     }
+-    _mm_storeu_si128(reinterpret_cast<__m128i*>(o + 32), tail);
+    simde_mm_storeu_si128(reinterpret_cast<simde__m128i*>(o + 32), tail);
+     return s;
+ }
+ 
+ // Eight words from p with the lanes past `readable` zero; a count of zero or less loads nothing. A record's words
+ // are always in range, the load's tail may not be.
+-inline __m256i spsc_words(const uint32_t* p, int32_t readable) {
+inline simde__m256i spsc_words(const uint32_t* p, int32_t readable) {
+     if (readable >= 8) {
+-        return _mm256_loadu_si256(reinterpret_cast<const __m256i*>(p));
+        return simde_mm256_loadu_si256(reinterpret_cast<const simde__m256i*>(p));
+     }
+-    return _mm256_maskload_epi32(
+-        reinterpret_cast<const int*>(p), _mm256_cmpgt_epi32(_mm256_set1_epi32(readable), spsc_lane_idx()));
+    return simde_mm256_maskload_epi32(
+        reinterpret_cast<const int*>(p), simde_mm256_cmpgt_epi32(simde_mm256_set1_epi32(readable), spsc_lane_idx()));
+ }
+ // Four qword records from p, whole records only: a trailing odd word is never one, so its lane reads as zero.
+-inline __m256i spsc_qwords(const uint32_t* p, int32_t readable) {
+inline simde__m256i spsc_qwords(const uint32_t* p, int32_t readable) {
+     if (readable >= 8) {
+-        return _mm256_loadu_si256(reinterpret_cast<const __m256i*>(p));
+        return simde_mm256_loadu_si256(reinterpret_cast<const simde__m256i*>(p));
+     }
+-    return _mm256_maskload_epi64(
+-        reinterpret_cast<const long long*>(p),
+-        _mm256_cmpgt_epi64(_mm256_set1_epi64x(readable / 2), _mm256_setr_epi64x(0, 1, 2, 3)));
+    return simde_mm256_maskload_epi64(
+        reinterpret_cast<const int64_t*>(p),
+        simde_mm256_cmpgt_epi64(simde_mm256_set1_epi64x(readable / 2), simde_mm256_setr_epi64x(0, 1, 2, 3)));
+ }
+ // Records of the type in a quad's compare result, counted from lane 0 to the first miss. A full quad is one test;
+ // only a partial one extracts its mask.
+-inline uint32_t spsc_quad_count(__m256i c) {
+-    if (_mm256_testc_si256(c, _mm256_cmpeq_epi64(c, c))) {
+inline uint32_t spsc_quad_count(simde__m256i c) {
+    if (simde_mm256_testc_si256(c, simde_mm256_cmpeq_epi64(c, c))) {
+         return 4;
+     }
+-    return std::countr_zero(~static_cast<uint32_t>(_mm256_movemask_pd(_mm256_castsi256_pd(c))) & 0x1Fu);
+    return std::countr_zero(~static_cast<uint32_t>(simde_mm256_movemask_pd(simde_mm256_castsi256_pd(c))) & 0x1Fu);
+ }
+ // Four records from per-qword-lane halves: {a, b} is a record's first 16 bytes (start|ts, duration), {m, coords}
+ // its next 16 (id | prog << 32, the coordinates) and `tail` its last. Written whole; a partial quad's spare records
+ // land in the sink's slack.
+-inline void spsc_store_quad(uint8_t* o, __m256i a, __m256i b, __m256i m, __m256i coords, __m128i tail) {
+-    const __m256i ab_lo = _mm256_unpacklo_epi64(a, b);
+-    const __m256i ab_hi = _mm256_unpackhi_epi64(a, b);
+-    const __m256i mc_lo = _mm256_unpacklo_epi64(m, coords);
+-    const __m256i mc_hi = _mm256_unpackhi_epi64(m, coords);
+inline void spsc_store_quad(
+    uint8_t* o, simde__m256i a, simde__m256i b, simde__m256i m, simde__m256i coords, simde__m128i tail) {
+    const simde__m256i ab_lo = simde_mm256_unpacklo_epi64(a, b);
+    const simde__m256i ab_hi = simde_mm256_unpackhi_epi64(a, b);
+    const simde__m256i mc_lo = simde_mm256_unpacklo_epi64(m, coords);
+    const simde__m256i mc_hi = simde_mm256_unpackhi_epi64(m, coords);
+     constexpr uint32_t R = kSpscRecBytes;
+-    _mm256_storeu_si256(reinterpret_cast<__m256i*>(o), _mm256_permute2x128_si256(ab_lo, mc_lo, 0x20));
+-    _mm256_storeu_si256(reinterpret_cast<__m256i*>(o + R), _mm256_permute2x128_si256(ab_hi, mc_hi, 0x20));
+-    _mm256_storeu_si256(reinterpret_cast<__m256i*>(o + 2 * R), _mm256_permute2x128_si256(ab_lo, mc_lo, 0x31));
+-    _mm256_storeu_si256(reinterpret_cast<__m256i*>(o + 3 * R), _mm256_permute2x128_si256(ab_hi, mc_hi, 0x31));
+    simde_mm256_storeu_si256(reinterpret_cast<simde__m256i*>(o), simde_mm256_permute2x128_si256(ab_lo, mc_lo, 0x20));
+    simde_mm256_storeu_si256(
+        reinterpret_cast<simde__m256i*>(o + R), simde_mm256_permute2x128_si256(ab_hi, mc_hi, 0x20));
+    simde_mm256_storeu_si256(
+        reinterpret_cast<simde__m256i*>(o + 2 * R), simde_mm256_permute2x128_si256(ab_lo, mc_lo, 0x31));
+    simde_mm256_storeu_si256(
+        reinterpret_cast<simde__m256i*>(o + 3 * R), simde_mm256_permute2x128_si256(ab_hi, mc_hi, 0x31));
+     for (uint32_t k = 0; k < 4; k++) {
+-        _mm_storeu_si128(reinterpret_cast<__m128i*>(o + k * R + 32), tail);
+        simde_mm_storeu_si128(reinterpret_cast<simde__m128i*>(o + k * R + 32), tail);
+     }
+ }
+ 
+@@ -476,7 +482,7 @@
+ template <PacketFormat F>
+ inline SpscBlockResult spsc_one(const uint32_t* p, uint32_t readable, const SpscLaneConsts& c, uint8_t* dst) {
+     spsc_compose<F, 0>(
+-        _mm256_and_si256(spsc_words(p, static_cast<int32_t>(readable)), spsc_w0_mask<F>()),
+        simde_mm256_and_si256(spsc_words(p, static_cast<int32_t>(readable)), spsc_w0_mask<F>()),
+         spsc_half<F>(c),
+         c.tail,
+         dst);
+@@ -495,9 +501,9 @@
+ template <PacketFormat F>
+ inline bool spsc_run4(const uint32_t* p) {
+     static_assert(F.words == 2);
+-    const __m256i v = _mm256_loadu_si256(reinterpret_cast<const __m256i*>(p));
+-    const __m256i c = _mm256_cmpeq_epi64(_mm256_and_si256(v, spsc_qw_type_mask()), spsc_qw_type(F.type));
+-    return _mm256_testc_si256(c, _mm256_cmpeq_epi64(c, c));
+    const simde__m256i v = simde_mm256_loadu_si256(reinterpret_cast<const simde__m256i*>(p));
+    const simde__m256i c = simde_mm256_cmpeq_epi64(simde_mm256_and_si256(v, spsc_qw_type_mask()), spsc_qw_type(F.type));
+    return simde_mm256_testc_si256(c, simde_mm256_cmpeq_epi64(c, c));
+ }
+ 
+ // noinline on both block kernels: called once per run, and inlined into the walk they share its register file and
+@@ -521,45 +527,43 @@
+     constexpr uint32_t kBlockRecs = kLoads * R;
+     constexpr uint32_t kFullAvail = kBlockWords - kStride + 8;  // every load of the block whole
+     SpscBlockResult out{0, 0, 0, 0, 0};
+-    const __m256i type_mask = spsc_dw_type_mask();
+-    const __m256i ftype = spsc_dw_type(F.type);
+-    const __m256i lanes_w0 = spsc_lanes_at<F, 0>();
+-    const __m256i lane_0 = spsc_lane0();
+-    const __m256i lane_3 = _mm256_setr_epi32(0, 0, 0, -1, 0, 0, 0, 0);
+-    const __m256i w0_mask = spsc_w0_mask<F>();
+-    const __m256i ones = _mm256_set1_epi32(-1);
+-    const __m256i half = spsc_half<F>(c);
+-    const __m128i tail = c.tail;
+-    const __m256i z = _mm256_setzero_si256();
+    const simde__m256i type_mask = spsc_dw_type_mask();
+    const simde__m256i ftype = spsc_dw_type(F.type);
+    const simde__m256i lanes_w0 = spsc_lanes_at<F, 0>();
+    const simde__m256i lane_0 = spsc_lane0();
+    const simde__m256i lane_3 = simde_mm256_setr_epi32(0, 0, 0, -1, 0, 0, 0, 0);
+    const simde__m256i w0_mask = spsc_w0_mask<F>();
+    const simde__m256i ones = simde_mm256_set1_epi32(-1);
+    const simde__m256i half = spsc_half<F>(c);
+    const simde__m128i tail = c.tail;
+    const simde__m256i z = simde_mm256_setzero_si256();
+     const uint64_t th_hi = c.th_hi;
+     const uint32_t* const p0 = p;
+-    const __m256i stall = _mm256_set1_epi32(static_cast<int>(kSpscStallZoneId));
+-    __m256i prev = z, back = z, stall_hit = z, wrap_hit = z;
+    const simde__m256i stall = simde_mm256_set1_epi32(static_cast<int>(kSpscStallZoneId));
+    simde__m256i prev = z, back = z, stall_hit = z, wrap_hit = z;
+     uint32_t total = 0;
+     while (max_recs != 0 && avail >= W) {
+         // One load at a time, stopping at the first whose records are not all F: a lone record costs one load.
+-        __m256i v[kLoads];
+        simde__m256i v[kLoads];
+         uint32_t n = 0;
+         for (uint32_t i = 0; i < kLoads; i++) {
+             if (avail >= kFullAvail) {
+-                v[i] = _mm256_loadu_si256(reinterpret_cast<const __m256i*>(p + i * kStride));
+                v[i] = simde_mm256_loadu_si256(reinterpret_cast<const simde__m256i*>(p + i * kStride));
+             } else {
+-                const __m256i mk = _mm256_cmpgt_epi32(
+-                    _mm256_set1_epi32(static_cast<int>(avail) - static_cast<int>(i * kStride)), spsc_lane_idx());
+-                v[i] = _mm256_maskload_epi32(reinterpret_cast<const int*>(p + i * kStride), mk);
+                const simde__m256i mk = simde_mm256_cmpgt_epi32(
+                    simde_mm256_set1_epi32(static_cast<int>(avail) - static_cast<int>(i * kStride)), spsc_lane_idx());
+                v[i] = simde_mm256_maskload_epi32(reinterpret_cast<const int*>(p + i * kStride), mk);
+             }
+-            const __m256i cm = _mm256_cmpeq_epi32(_mm256_and_si256(v[i], type_mask), ftype);
+-            if (!_mm256_testc_si256(cm, lanes_w0)) {
+            const simde__m256i cm = simde_mm256_cmpeq_epi32(simde_mm256_and_si256(v[i], type_mask), ftype);
+            if (!simde_mm256_testc_si256(cm, lanes_w0)) {
+                 if constexpr (R == 2) {
+-                    n += _mm256_testc_si256(cm, lane_0) ? 1u : 0u;
+                    n += simde_mm256_testc_si256(cm, lane_0) ? 1u : 0u;
+                 }
+                 break;
+             }
+             n += R;
+         }
+-        if (n > max_recs) {
+-            n = max_recs;
+-        }
+        n = std::min(n, max_recs);
+         if (n == 0) {
+             break;
+         }
+@@ -567,36 +571,39 @@
+         // across loads and blocks. Lane 3 is the duration's high word when the format has one.
+         uint32_t i = 0;
+         for (; (i + 1) * R <= n; i++) {
+-            const __m256i l = _mm256_and_si256(v[i], w0_mask);
+            const simde__m256i l = simde_mm256_and_si256(v[i], w0_mask);
+             uint8_t* const o = dst + kSpscRecBytes * R * i;
+-            const __m256i s0 = spsc_compose<F, 0>(l, half, tail, o);
+            const simde__m256i s0 = spsc_compose<F, 0>(l, half, tail, o);
+             if constexpr (R == 2) {
+-                const __m256i s1 = spsc_compose<F, 1>(l, half, tail, o + kSpscRecBytes);
+-                back = _mm256_or_si256(back, _mm256_or_si256(_mm256_cmpgt_epi64(prev, s0), _mm256_cmpgt_epi64(s0, s1)));
+                const simde__m256i s1 = spsc_compose<F, 1>(l, half, tail, o + kSpscRecBytes);
+                back = simde_mm256_or_si256(
+                    back, simde_mm256_or_si256(simde_mm256_cmpgt_epi64(prev, s0), simde_mm256_cmpgt_epi64(s0, s1)));
+                 prev = s1;
+                 if constexpr (F.has_dur_hi()) {
+-                    wrap_hit = _mm256_or_si256(
+-                        wrap_hit, _mm256_or_si256(_mm256_cmpeq_epi32(s0, ones), _mm256_cmpeq_epi32(s1, ones)));
+                    wrap_hit = simde_mm256_or_si256(
+                        wrap_hit,
+                        simde_mm256_or_si256(simde_mm256_cmpeq_epi32(s0, ones), simde_mm256_cmpeq_epi32(s1, ones)));
+                 }
+             } else {
+-                back = _mm256_or_si256(back, _mm256_cmpgt_epi64(prev, s0));
+                back = simde_mm256_or_si256(back, simde_mm256_cmpgt_epi64(prev, s0));
+                 prev = s0;
+                 if constexpr (F.has_dur_hi()) {
+-                    wrap_hit = _mm256_or_si256(wrap_hit, _mm256_cmpeq_epi32(s0, ones));
+                    wrap_hit = simde_mm256_or_si256(wrap_hit, simde_mm256_cmpeq_epi32(s0, ones));
+                 }
+             }
+-            stall_hit = _mm256_or_si256(stall_hit, _mm256_cmpeq_epi32(l, stall));
+            stall_hit = simde_mm256_or_si256(stall_hit, simde_mm256_cmpeq_epi32(l, stall));
+         }
+         if constexpr (R == 2) {
+             if (2 * i < n) {  // an odd last record: the load's second record is not ours
+-                const __m256i l = _mm256_and_si256(v[i], w0_mask);
+-                const __m256i s0 = spsc_compose<F, 0>(l, half, tail, dst + kSpscRecBytes * 2 * i);
+-                back = _mm256_or_si256(back, _mm256_cmpgt_epi64(prev, s0));
+                const simde__m256i l = simde_mm256_and_si256(v[i], w0_mask);
+                const simde__m256i s0 = spsc_compose<F, 0>(l, half, tail, dst + kSpscRecBytes * 2 * i);
+                back = simde_mm256_or_si256(back, simde_mm256_cmpgt_epi64(prev, s0));
+                 prev = s0;
+                 if constexpr (F.has_dur_hi()) {
+-                    wrap_hit = _mm256_or_si256(wrap_hit, _mm256_cmpeq_epi32(s0, ones));
+                    wrap_hit = simde_mm256_or_si256(wrap_hit, simde_mm256_cmpeq_epi32(s0, ones));
+                 }
+-                stall_hit = _mm256_or_si256(stall_hit, _mm256_and_si256(_mm256_cmpeq_epi32(l, stall), lane_0));
+                stall_hit =
+                    simde_mm256_or_si256(stall_hit, simde_mm256_and_si256(simde_mm256_cmpeq_epi32(l, stall), lane_0));
+             }
+         }
+         total += n;
+@@ -612,11 +619,11 @@
+     if (total != 0) {
+         out.ts_last = spsc_ts_at<F>(p0, total - 1u, th_hi);
+     }
+-    out.regress = _mm256_testz_si256(back, lane_0) ? 0u : 1u;
+    out.regress = simde_mm256_testz_si256(back, lane_0) ? 0u : 1u;
+     if constexpr (F.has_dur_hi()) {
+-        out.wrapped = _mm256_testz_si256(wrap_hit, lane_3) ? 0u : 1u;
+        out.wrapped = simde_mm256_testz_si256(wrap_hit, lane_3) ? 0u : 1u;
+     }
+-    if (__builtin_expect(!_mm256_testz_si256(stall_hit, lanes_w0), 0)) {
+    if (__builtin_expect(!simde_mm256_testz_si256(stall_hit, lanes_w0), 0)) {
+         for (uint32_t k = 0; k < total; k++) {
+             out.stalls += (p0[W * k] & 0x07FFFFFFu) == kSpscStallZoneId ? 1u : 0u;
+         }
+@@ -638,49 +645,51 @@
+     constexpr bool kDelta = F.delta16;
+     static_assert(kDelta ? F.kind == Kind::Zone : (F.kind == Kind::Point && F.ts_lo == 1));
+     SpscBlockResult out{0, 0, 0, 0, 0};
+-    const __m256i type_mask = spsc_qw_type_mask();
+-    const __m256i ftype = spsc_qw_type(F.type);
+-    const __m256i z = _mm256_setzero_si256();
+-    const __m256i id_mask = _mm256_set1_epi64x(0x07FFFFFF);
+-    const __m256i dur_mask = _mm256_set1_epi64x(0xFFFF);
+-    const __m256i mv = c.mv, coords = c.coords_v;
+-    const __m128i tail = c.tail;
+    const simde__m256i type_mask = spsc_qw_type_mask();
+    const simde__m256i ftype = spsc_qw_type(F.type);
+    const simde__m256i z = simde_mm256_setzero_si256();
+    const simde__m256i id_mask = simde_mm256_set1_epi64x(0x07FFFFFF);
+    const simde__m256i dur_mask = simde_mm256_set1_epi64x(0xFFFF);
+    const simde__m256i mv = c.mv, coords = c.coords_v;
+    const simde__m128i tail = c.tail;
+     // The cursor rides as a broadcast vector: the next block's starts need it as one, and the block total is already
+     // a broadcast lane of the carry tree.
+-    __m256i cv = _mm256_set1_epi64x(static_cast<long long>(cursor));
+-    __m256i carry = z, back = z;
+    simde__m256i cv = simde_mm256_set1_epi64x(static_cast<long long>(cursor));
+    simde__m256i carry = z, back = z;
+     uint32_t total = 0;
+     while (max_recs != 0 && readable >= 2u) {
+-        __m256i v[4];
+        simde__m256i v[4];
+         if (readable >= 32u) {
+             for (int i = 0; i < 4; i++) {
+-                v[i] = _mm256_loadu_si256(reinterpret_cast<const __m256i*>(p + 8 * i));
+                v[i] = simde_mm256_loadu_si256(reinterpret_cast<const simde__m256i*>(p + 8 * i));
+             }
+         } else {
+             // Whole records only: a trailing odd word is never F, so its lane reads as zero and ends the scan.
+             const int recs = static_cast<int>(readable / 2u);
+             for (int i = 0; i < 4; i++) {
+-                const __m256i m = _mm256_cmpgt_epi64(_mm256_set1_epi64x(recs - 4 * i), _mm256_setr_epi64x(0, 1, 2, 3));
+-                v[i] = _mm256_maskload_epi64(reinterpret_cast<const long long*>(p + 8 * i), m);
+                const simde__m256i m =
+                    simde_mm256_cmpgt_epi64(simde_mm256_set1_epi64x(recs - 4 * i), simde_mm256_setr_epi64x(0, 1, 2, 3));
+                v[i] = simde_mm256_maskload_epi64(reinterpret_cast<const int64_t*>(p + 8 * i), m);
+             }
+         }
+         if constexpr (kDelta) {
+             // Both lines of the block four blocks ahead: the hardware prefetcher does not run far enough into
+             // DMA-landed memory (-6%); farther ahead evicts before use once the sink's output stream shares L1, and
+             // one line per block leaves every other line to the hardware.
+-            _mm_prefetch(reinterpret_cast<const char*>(p + 128), _MM_HINT_T0);
+-            _mm_prefetch(reinterpret_cast<const char*>(p + 144), _MM_HINT_T0);
+            simde_mm_prefetch(reinterpret_cast<const char*>(p + 128), SIMDE_MM_HINT_T0);
+            simde_mm_prefetch(reinterpret_cast<const char*>(p + 144), SIMDE_MM_HINT_T0);
+         }
+         uint32_t n = 0;
+-        for (int i = 0; i < 4; i++) {
+-            const __m256i cm = _mm256_cmpeq_epi64(_mm256_and_si256(v[i], type_mask), ftype);
+        for (const auto& value : v) {
+            const simde__m256i cm = simde_mm256_cmpeq_epi64(simde_mm256_and_si256(value, type_mask), ftype);
+             if constexpr (!kDelta) {
+                 // Timestamps as zero-extended qwords against the record before (`carry`: the previous load's
+                 // last); only F lanes count.
+-                const __m256i ts = _mm256_srli_epi64(v[i], 32);
+-                const __m256i before = _mm256_blend_epi32(_mm256_permute4x64_epi64(ts, 0x90), carry, 0x03);
+-                back = _mm256_or_si256(back, _mm256_and_si256(_mm256_cmpgt_epi64(before, ts), cm));
+-                carry = _mm256_permute4x64_epi64(ts, 0xFF);
+                const simde__m256i ts = simde_mm256_srli_epi64(value, 32);
+                const simde__m256i before =
+                    simde_mm256_blend_epi32(simde_mm256_permute4x64_epi64(ts, 0x90), carry, 0x03);
+                back = simde_mm256_or_si256(back, simde_mm256_and_si256(simde_mm256_cmpgt_epi64(before, ts), cm));
+                carry = simde_mm256_permute4x64_epi64(ts, 0xFF);
+             }
+             const uint32_t k = spsc_quad_count(cm);
+             n += k;
+@@ -688,37 +697,36 @@
+                 break;
+             }
+         }
+-        if (n > max_recs) {
+-            n = max_recs;
+-        }
+        n = std::min(n, max_recs);
+         if (n == 0) {
+             break;
+         }
+         // Inclusive prefix of the end deltas (each qword's top 16 bits) in record order: the four quads' in-lane
+         // prefixes are independent and their totals carry as a tree, so no dependency chain spans the block.
+-        __m256i pfx[4];
+        simde__m256i pfx[4];
+         if constexpr (kDelta) {
+             for (int i = 0; i < 4; i++) {
+-                __m256i d = _mm256_srli_epi64(v[i], 48);
+-                d = _mm256_add_epi64(d, _mm256_slli_si256(d, 8));
+-                pfx[i] = _mm256_add_epi64(d, _mm256_blend_epi32(_mm256_permute4x64_epi64(d, 0x55), z, 0x0F));
+-            }
+-            const __m256i c1 = _mm256_permute4x64_epi64(pfx[0], 0xFF);
+-            const __m256i c2 = _mm256_add_epi64(c1, _mm256_permute4x64_epi64(pfx[1], 0xFF));
+-            const __m256i c3 = _mm256_add_epi64(c2, _mm256_permute4x64_epi64(pfx[2], 0xFF));
+-            pfx[1] = _mm256_add_epi64(pfx[1], c1);
+-            pfx[2] = _mm256_add_epi64(pfx[2], c2);
+-            pfx[3] = _mm256_add_epi64(pfx[3], c3);
+                simde__m256i d = simde_mm256_srli_epi64(v[i], 48);
+                d = simde_mm256_add_epi64(d, simde_mm256_slli_si256(d, 8));
+                pfx[i] =
+                    simde_mm256_add_epi64(d, simde_mm256_blend_epi32(simde_mm256_permute4x64_epi64(d, 0x55), z, 0x0F));
+            }
+            const simde__m256i c1 = simde_mm256_permute4x64_epi64(pfx[0], 0xFF);
+            const simde__m256i c2 = simde_mm256_add_epi64(c1, simde_mm256_permute4x64_epi64(pfx[1], 0xFF));
+            const simde__m256i c3 = simde_mm256_add_epi64(c2, simde_mm256_permute4x64_epi64(pfx[2], 0xFF));
+            pfx[1] = simde_mm256_add_epi64(pfx[1], c1);
+            pfx[2] = simde_mm256_add_epi64(pfx[2], c2);
+            pfx[3] = simde_mm256_add_epi64(pfx[3], c3);
+         }
+         for (uint32_t i = 0; i < 4 && 4 * i < n; i++) {
+             if constexpr (kDelta) {
+-                const __m256i d64 = _mm256_and_si256(_mm256_srli_epi64(v[i], 32), dur_mask);
+-                const __m256i s64 = _mm256_sub_epi64(_mm256_add_epi64(cv, pfx[i]), d64);
+-                const __m256i m64 = _mm256_or_si256(_mm256_and_si256(v[i], id_mask), mv);
+                const simde__m256i d64 = simde_mm256_and_si256(simde_mm256_srli_epi64(v[i], 32), dur_mask);
+                const simde__m256i s64 = simde_mm256_sub_epi64(simde_mm256_add_epi64(cv, pfx[i]), d64);
+                const simde__m256i m64 = simde_mm256_or_si256(simde_mm256_and_si256(v[i], id_mask), mv);
+                 spsc_store_quad(dst + 4 * kSpscRecBytes * i, s64, d64, m64, coords, tail);
+             } else {
+-                const __m256i ts64 = _mm256_or_si256(_mm256_srli_epi64(v[i], 32), c.tv);
+-                const __m256i m64 = _mm256_or_si256(_mm256_and_si256(v[i], id_mask), mv);
+                const simde__m256i ts64 = simde_mm256_or_si256(simde_mm256_srli_epi64(v[i], 32), c.tv);
+                const simde__m256i m64 = simde_mm256_or_si256(simde_mm256_and_si256(v[i], id_mask), mv);
+                 spsc_store_quad(dst + 4 * kSpscRecBytes * i, ts64, z, m64, coords, tail);
+             }
+         }
+@@ -730,16 +738,17 @@
+                 // to hot stack.
+                 alignas(32) uint64_t arr[16];
+                 for (int i = 0; i < 4; i++) {
+-                    _mm256_store_si256(reinterpret_cast<__m256i*>(arr + 4 * i), pfx[i]);
+                    simde_mm256_store_si256(reinterpret_cast<simde__m256i*>(arr + 4 * i), pfx[i]);
+                 }
+-                out.ts_last = static_cast<uint64_t>(_mm_cvtsi128_si64(_mm256_castsi256_si128(cv))) + arr[n - 1];
+                out.ts_last =
+                    static_cast<uint64_t>(simde_mm_cvtsi128_si64(simde_mm256_castsi256_si128(cv))) + arr[n - 1];
+                 out.n = total;
+                 return out;  // the block ended on a non-F word or the emit budget
+             }
+-            cv = _mm256_add_epi64(cv, _mm256_permute4x64_epi64(pfx[3], 0xFF));
+            cv = simde_mm256_add_epi64(cv, simde_mm256_permute4x64_epi64(pfx[3], 0xFF));
+         } else {
+             // The carry for the next block is this block's last record, which the load loop may have run past.
+-            carry = _mm256_set1_epi64x(static_cast<long long>(p[2u * n - 1u]));
+            carry = simde_mm256_set1_epi64x(static_cast<long long>(p[2u * n - 1u]));
+             out.ts_last = c.th_hi | p[2u * n - 1u];
+             if (n < 16u) {
+                 break;
+@@ -752,10 +761,10 @@
+     out.n = total;
+     if constexpr (kDelta) {
+         if (total != 0) {
+-            out.ts_last = static_cast<uint64_t>(_mm_cvtsi128_si64(_mm256_castsi256_si128(cv)));
+            out.ts_last = static_cast<uint64_t>(simde_mm_cvtsi128_si64(simde_mm256_castsi256_si128(cv)));
+         }
+     } else {
+-        out.regress = _mm256_testz_si256(back, back) ? 0u : 1u;
+        out.regress = simde_mm256_testz_si256(back, back) ? 0u : 1u;
+     }
+     return out;
+ }
+@@ -783,37 +792,38 @@
+     constexpr int kPayload = kSpscDataFormat.words;
+     const uint32_t elems = (n + 1u) >> 1;
+     uint64_t* const pay = reinterpret_cast<uint64_t*>(dst + kSpscRecBytes);
+-    const __m256i lane_idx = spsc_lane_idx();
+    const simde__m256i lane_idx = spsc_lane_idx();
+     // The head and payload words 0-4 of the packet, the payload lanes zeroed past the count and past readable.
+     const uint32_t words = std::min(readable, static_cast<uint32_t>(kPayload) + n);
+-    const __m256i l = _mm256_maskload_epi32(
+-        reinterpret_cast<const int*>(p), _mm256_cmpgt_epi32(_mm256_set1_epi32(static_cast<int>(words)), lane_idx));
+-    const __m256i head = _mm256_blend_epi32(
+-        _mm256_blend_epi32(
+-            _mm256_permutevar8x32_epi32(
+-                _mm256_and_si256(l, _mm256_setr_epi32(0x07FFFFFF, -1, -1, -1, -1, -1, -1, -1)),
+-                _mm256_setr_epi32(kTs, 0, 0, 0, 0, 0, 0, 0)),
+    const simde__m256i l = simde_mm256_maskload_epi32(
+        reinterpret_cast<const int*>(p),
+        simde_mm256_cmpgt_epi32(simde_mm256_set1_epi32(static_cast<int>(words)), lane_idx));
+    const simde__m256i head = simde_mm256_blend_epi32(
+        simde_mm256_blend_epi32(
+            simde_mm256_permutevar8x32_epi32(
+                simde_mm256_and_si256(l, simde_mm256_setr_epi32(0x07FFFFFF, -1, -1, -1, -1, -1, -1, -1)),
+                simde_mm256_setr_epi32(kTs, 0, 0, 0, 0, 0, 0, 0)),
+             c.point_half,
+             0xEE),
+-        _mm256_set1_epi64x(static_cast<long long>(elems)),
+        simde_mm256_set1_epi64x(static_cast<long long>(elems)),
+         0x0C);
+-    _mm256_storeu_si256(reinterpret_cast<__m256i*>(dst), head);
+-    _mm_storeu_si128(reinterpret_cast<__m128i*>(dst + 32), c.tail);
+    simde_mm256_storeu_si256(reinterpret_cast<simde__m256i*>(dst), head);
+    simde_mm_storeu_si128(reinterpret_cast<simde__m128i*>(dst + 32), c.tail);
+     // Elements 0-1 from the packet's first four payload words, high word first.
+-    _mm256_storeu_si256(
+-        reinterpret_cast<__m256i*>(pay),
+-        _mm256_permutevar8x32_epi32(
+-            l, _mm256_setr_epi32(kPayload + 1, kPayload, kPayload + 3, kPayload + 2, 0, 0, 0, 0)));
+    simde_mm256_storeu_si256(
+        reinterpret_cast<simde__m256i*>(pay),
+        simde_mm256_permutevar8x32_epi32(
+            l, simde_mm256_setr_epi32(kPayload + 1, kPayload, kPayload + 3, kPayload + 2, 0, 0, 0, 0)));
+     if (__builtin_expect(n > 4u, 0)) {
+         const uint32_t pw = readable > static_cast<uint32_t>(kPayload) ? std::min(readable - kPayload, n) : 0u;
+         for (uint32_t k = 4; k < n; k += 8) {
+             const uint32_t left = std::min(n - k, pw > k ? pw - k : 0u);
+-            const __m256i pl = _mm256_maskload_epi32(
+            const simde__m256i pl = simde_mm256_maskload_epi32(
+                 reinterpret_cast<const int*>(p + kPayload + k),
+-                _mm256_cmpgt_epi32(_mm256_set1_epi32(static_cast<int>(left)), lane_idx));
+-            _mm256_storeu_si256(
+-                reinterpret_cast<__m256i*>(pay + k / 2),
+-                _mm256_permutevar8x32_epi32(pl, _mm256_setr_epi32(1, 0, 3, 2, 5, 4, 7, 6)));
+                simde_mm256_cmpgt_epi32(simde_mm256_set1_epi32(static_cast<int>(left)), lane_idx));
+            simde_mm256_storeu_si256(
+                reinterpret_cast<simde__m256i*>(pay + k / 2),
+                simde_mm256_permutevar8x32_epi32(pl, simde_mm256_setr_epi32(1, 0, 3, 2, 5, 4, 7, 6)));
+         }
+     }
+     return elems;
--- a/pkgs/by-name/tt/tt-smi/package.nix
+++ b/pkgs/by-name/tt/tt-smi/package.nix
@@ -36,7 +36,10 @@ python3Packages.buildPythonApplication (finalAttrs: {
    tt-umd
  ];

-  pythonRelaxDeps = [ "tt-umd" ];
+  pythonRelaxDeps = [
+    "tt-umd"
+    "pyluwen"
+  ];

  nativeCheckInputs = [ versionCheckHook ];

--- a/pkgs/by-name/tt/tt-umd/fix-targets.patch
+++ b/pkgs/by-name/tt/tt-umd/fix-targets.patch
@@ -1,35 +0,0 @@
-diff --git a/third_party/CMakeLists.txt b/third_party/CMakeLists.txt
-index 96d71990..1db71f88 100644
--- a/third_party/CMakeLists.txt
-+++ b/third_party/CMakeLists.txt
-@@ -43,6 +43,7 @@ CPMAddPackage(
-         "YAML_CPP_BUILD_TESTS OFF"
-         "YAML_CPP_BUILD_TOOLS OFF"
-         "YAML_BUILD_SHARED_LIBS OFF"
-+    FIND_PACKAGE_ARGUMENTS GLOBAL
- )
- 
- if(yaml-cpp_ADDED)
-@@ -146,7 +147,13 @@ CPMAddPackage(
- ####################################################################################################################
- # tt-logger
- ####################################################################################################################
-CPMAddPackage(NAME tt-logger GITHUB_REPOSITORY tenstorrent/tt-logger VERSION 1.1.8 SYSTEM YES)
-+CPMAddPackage(
-+    NAME tt-logger
-+    GITHUB_REPOSITORY tenstorrent/tt-logger
-+    VERSION 1.1.8
-+    SYSTEM YES
-+    FIND_PACKAGE_ARGUMENTS GLOBAL
-+)
- 
- ####################################################################################################################
- # cxxopts
-@@ -159,6 +166,7 @@ CPMAddPackage(
-     SYSTEM YES
-     OPTIONS
-         "CMAKE_MESSAGE_LOG_LEVEL NOTICE"
-+    FIND_PACKAGE_ARGUMENTS GLOBAL
- )
- 
- ####################################################################################################################
--- a/pkgs/by-name/tt/tt-umd/link-shared-yaml-cpp-into-baremetal-tests.patch
+++ b/pkgs/by-name/tt/tt-umd/link-shared-yaml-cpp-into-baremetal-tests.patch
@@ -0,0 +1,24 @@
+From da577871393fe65710d2040944e5610507e11dfd Mon Sep 17 00:00:00 2001
+From: liberodark <liberodark@gmail.com>
+Date: Sat, 3 Oct 2026 12:39:45 +0200
+Subject: [PATCH] Link a shared yaml-cpp into baremetal_tests
+
+---
+ tests/baremetal/CMakeLists.txt | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/tests/baremetal/CMakeLists.txt b/tests/baremetal/CMakeLists.txt
+index 0971048ecaca13ae2438ca4905dc0d2ccf8ddaa5..6d417739360305c8467b581931cb830d3553b155 100644
+--- a/tests/baremetal/CMakeLists.txt
+++ b/tests/baremetal/CMakeLists.txt
+@@ -33,6 +33,10 @@ target_link_libraries(baremetal_tests PRIVATE test_common)
+ # the library would place a second copy of it in this binary beside the one already inside
+ # libtt-umd.so, which ASan reports as an ODR violation on YAML::Exception's typeinfo.
+ target_include_directories(baremetal_tests PRIVATE $<TARGET_PROPERTY:yaml-cpp::yaml-cpp,INTERFACE_INCLUDE_DIRECTORIES>)
+get_target_property(YAML_CPP_TYPE yaml-cpp::yaml-cpp TYPE)
+if(YAML_CPP_TYPE STREQUAL "SHARED_LIBRARY")
+    target_link_libraries(baremetal_tests PRIVATE yaml-cpp::yaml-cpp)
+endif()
+ if(TT_UMD_BUILD_EMULE)
+     target_sources(baremetal_tests PRIVATE test_sw_emule_chip.cpp)
+     target_link_libraries(baremetal_tests PRIVATE tt-emule::headers)
--- a/pkgs/by-name/tt/tt-umd/package.nix
+++ b/pkgs/by-name/tt/tt-umd/package.nix
@@ -18,7 +18,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "tt-umd";
-  version = "0.9.6";
+  version = "0.9.12";
  __structuredAttrs = true;
  strictDeps = true;

@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "tenstorrent";
    repo = "tt-umd";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-3IrgsKRaJP/rEXiMvi2LnzS9n2+Giu5d05RohzRgPw4=";
+    hash = "sha256-lhcNZuCV8n3ebbUU1MveZXR49qaybmOiSTLpitG96/s=";
  };

  cpm = fetchurl {
@@ -40,8 +40,8 @@ stdenv.mkDerivation (finalAttrs: {
  };

  patches = [
-    # https://github.com/tenstorrent/tt-umd/pull/2187
-    ./fix-targets.patch
+    # https://github.com/tenstorrent/tt-umd/pull/3593
+    ./link-shared-yaml-cpp-into-baremetal-tests.patch
  ];

  postPatch = ''
@@ -82,6 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.cmakeBool "TT_UMD_BUILD_TESTS" finalAttrs.finalPackage.doCheck)
    (lib.cmakeBool "TT_UMD_BUILD_STATIC" stdenv.hostPlatform.isStatic)
    (lib.cmakeBool "TT_UMD_BUILD_PYTHON" true)
+    (lib.cmakeBool "CMAKE_COMPILE_WARNING_AS_ERROR" false)
    (lib.cmakeFeature "nanobind_DIR" "${python3.pkgs.nanobind}/${python3.sitePackages}/nanobind/cmake")
  ];

--- a/pkgs/by-name/un/unscd/package.nix
+++ b/pkgs/by-name/un/unscd/package.nix
@@ -2,7 +2,7 @@
  fetchurl,
  fetchpatch,
  stdenv,
-  systemd,
+  systemdLibs,
  lib,
 }:

@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
    ./0001-adjust-socket-paths-for-nixos.patch
  ];

-  buildInputs = [ systemd ];
+  buildInputs = [ systemdLibs ];

  buildPhase = ''
    runHook preBuild
--- a/pkgs/by-name/up/upx/package.nix
+++ b/pkgs/by-name/up/upx/package.nix
@@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "upx";
-  version = "5.2.0";
+  version = "5.2.1";
  src = fetchFromGitHub {
    owner = "upx";
    repo = "upx";
    tag = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-6LTDz4gMak0V7KiZOeuQgm+RubKRp3zhF6T6SZzZ5Dk=";
+    hash = "sha256-Fy+BqntQcHLo5FGhWTP6gqe5OIGC6w7SMc+tlV+VqCM=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@@ -18,17 +18,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "uv";
-  version = "0.12.17";
+  version = "0.12.22";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "astral-sh";
    repo = "uv";
    tag = finalAttrs.version;
-    hash = "sha256-e/AA9/Uou8c1usaVxGc/kzHSo5bzJOmupWOGk7L8+KI=";
+    hash = "sha256-lgGB9kO3+xnm1Tob+PflpiZRLW7a6Gvim3qVKc6JceY=";
  };

-  cargoHash = "sha256-6AKm5l3snX1gmN5uAp0N9NVFd0nPBdtHz8WwZiFoYPU=";
+  cargoHash = "sha256-IC7rbCcUf7U33pNGZRfHLeXAcTLIYJJ6iSj9LFcWIy4=";

  buildInputs = [
    rust-jemalloc-sys
--- a/pkgs/by-name/uw/uwsgi/package.nix
+++ b/pkgs/by-name/uw/uwsgi/package.nix
@@ -13,8 +13,8 @@
  plugins ? [ ],
  pam,
  withPAM ? stdenv.hostPlatform.isLinux,
-  systemd,
-  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
+  systemdLibs,
+  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
  libcap,
  withCap ? stdenv.hostPlatform.isLinux,
  python3,
@@ -118,7 +118,7 @@ stdenv.mkDerivation (finalAttrs: {
    zlib
  ]
  ++ lib.optional withPAM pam
-  ++ lib.optional withSystemd systemd
+  ++ lib.optional withSystemd systemdLibs
  ++ lib.optional withCap libcap
  ++ lib.concatMap (x: x.inputs) needed;

--- a/pkgs/by-name/wc/wcslib/package.nix
+++ b/pkgs/by-name/wc/wcslib/package.nix
@@ -7,11 +7,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "wcslib";
-  version = "8.9";
+  version = "8.10";

  src = fetchurl {
    url = "ftp://ftp.atnf.csiro.au/pub/software/wcslib/wcslib-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-gqwJzlCRsL8Gzsj1ze7B2r4dBrpd+3/yvbDBaASIgHs=";
+    hash = "sha256-s5TTMG2ppSQQ8FYTaRFJblmbXEjxz/LyIVY2lwd7vY0=";
  };

  # error: call to undeclared library function 'snprintf'
--- a/pkgs/by-name/xb/xbyak/package.nix
+++ b/pkgs/by-name/xb/xbyak/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "xbyak";
-  version = "7.42";
+  version = "7.43";

  src = fetchFromGitHub {
    owner = "herumi";
    repo = "xbyak";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-GwsHEjqUBExb4pIZ6Z6YWGka0Fx3Qby4YYG0Otm6OAw=";
+    hash = "sha256-y4RhUuKMJgcG+NaQxhUn+7v2pHo8wfsd/AYjJEUtXR4=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/xc/xcaddy/inject_version_info.diff
+++ b/pkgs/by-name/xc/xcaddy/inject_version_info.diff
@@ -1,16 +0,0 @@
-diff --git a/cmd/main.go b/cmd/main.go
-index ede7cd8..c553140 100644
--- a/cmd/main.go
-+++ b/cmd/main.go
-@@ -401,8 +401,11 @@ func splitWith(arg string) (module, version, replace string, err error) {
- 	return
- }
-
-+var customVersion string
-+
- // xcaddyVersion returns a detailed version string, if available.
- func xcaddyVersion() string {
-+	return customVersion
- 	mod := goModule()
- 	ver := mod.Version
- 	if mod.Sum != "" {
--- a/pkgs/by-name/xc/xcaddy/package.nix
+++ b/pkgs/by-name/xc/xcaddy/package.nix
@@ -2,38 +2,39 @@
  lib,
  buildGoModule,
  fetchFromGitHub,
+  versionCheckHook,
 }:

 buildGoModule (finalAttrs: {
  pname = "xcaddy";
-  version = "0.4.6";
+  version = "0.4.7";
+
+  __structuredAttrs = true;

  subPackages = [ "cmd/xcaddy" ];

  src = fetchFromGitHub {
    owner = "caddyserver";
    repo = "xcaddy";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-SXCOKrGaTwcdrVhPenQGjdBaDl8/bUGmm1B3spk8eUA=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-q69Ey6gf/Uyui9x3nKkGFHiwTpMB0N3ix89JLgTsR1A=";
  };

-  patches = [
-    ./inject_version_info.diff
-    ./use_tmpdir_on_darwin.diff
-  ];
-
  ldflags = [
    "-s"
-    "-w"
-    "-X github.com/caddyserver/xcaddy/cmd.customVersion=v${finalAttrs.version}"
+    "-X github.com/caddyserver/xcaddy/cmd.CustomVersion=v${finalAttrs.version}"
  ];

-  vendorHash = "sha256-K5+Gj4Lqla6q9vx95BtCS67mZMWkMjgIHVYpBUdx/Wc=";
+  vendorHash = "sha256-bZs+2XrwVwfJdNLBZk6FPNi26ctVQ82ywesEU0o5Gkc=";
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];

  meta = {
    homepage = "https://github.com/caddyserver/xcaddy";
    description = "Build Caddy with plugins";
    mainProgram = "xcaddy";
    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.stepbrobd ];
  };
 })
--- a/pkgs/by-name/xc/xcaddy/use_tmpdir_on_darwin.diff
+++ b/pkgs/by-name/xc/xcaddy/use_tmpdir_on_darwin.diff
@@ -1,13 +0,0 @@
-diff --git a/builder.go b/builder.go
-index ed6c5ef..36e8055 100644
--- a/builder.go
-+++ b/builder.go
-@@ -200,7 +200,7 @@ func NewReplace(old, new string) Replace {
- // It is the caller's responsibility to remove the folder when finished.
- func newTempFolder() (string, error) {
- 	var parentDir string
-	if runtime.GOOS == "darwin" {
-+	if false && runtime.GOOS == "darwin" {
- 		// After upgrading to macOS High Sierra, Caddy builds mysteriously
- 		// started missing the embedded version information that -ldflags
- 		// was supposed to produce. But it only happened on macOS after
--- a/pkgs/by-name/xd/xdg-desktop-portal-generic/package.nix
+++ b/pkgs/by-name/xd/xdg-desktop-portal-generic/package.nix
@@ -11,13 +11,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "xdg-desktop-portal-generic";
-  version = "0.9.0";
+  version = "1.0.0";

  src = fetchFromGitHub {
    owner = "lamco-admin";
    repo = "xdg-desktop-portal-generic";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-gwTEIW/1qaT+uDI1zJQIndM01FmQcYHDYWR98+jT0uI=";
+    hash = "sha256-YuwIaPA2E1QtSVz4mwteDEaZEBwaUoYLdfArGsJqHn0=";
  };

  __structuredAttrs = true;
@@ -31,7 +31,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      --replace-fail '/usr/libexec/' '${placeholder "out"}/libexec/'
  '';

-  cargoHash = "sha256-6fD4Bxkx5W3CqB6m8+QlTFZJ7l+wC17VpLhLNr4ZjIw=";
+  cargoHash = "sha256-EVmHmeoh1THLRrqn3v1WjvHNxBFopdCz3n5C4eOBrNg=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/development/python-modules/altcha/default.nix
+++ b/pkgs/development/python-modules/altcha/default.nix
@@ -8,14 +8,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "altcha";
-  version = "2.1.0";
+  version = "2.2.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "altcha-org";
    repo = "altcha-lib-py";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-GPHmyt+5a/sGVt2ZwsWON1xkwNhYcmb3PShILiOhaoM=";
+    hash = "sha256-Lg28eGXVTwt8L/3fUZw/9Gn5BObM30YtJdLEaDt56Gc=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/bitsandbytes/default.nix
+++ b/pkgs/development/python-modules/bitsandbytes/default.nix
@@ -40,18 +40,21 @@ let

  # NOTE: torchvision doesn't use cudnn; torch does!
  #   For this reason it is not included.
-  cuda-common-redist = with cudaPackages; [
-    (lib.getDev cccl) # <thrust/*>
-    (lib.getDev libcublas) # cublas_v2.h
-    (lib.getLib libcublas)
-    (lib.getInclude libcublas) # cublasLt.h
-    libcurand
-    libcusolver # cusolverDn.h
-    (lib.getDev libcusparse) # cusparse.h
-    (lib.getLib libcusparse) # cusparse.h
-    (lib.getInclude libcusparse) # cusparse.h
-    (lib.getDev cuda_cudart) # cuda_runtime.h cuda_runtime_api.h
-  ];
+  cuda-common-redist =
+    with cudaPackages;
+    [
+      (lib.getDev cccl) # <thrust/*>
+      (lib.getDev libcublas) # cublas_v2.h
+      (lib.getLib libcublas)
+      (lib.getInclude libcublas) # cublasLt.h
+      libcurand
+      libcusolver # cusolverDn.h
+      (lib.getDev libcusparse) # cusparse.h
+      (lib.getLib libcusparse) # cusparse.h
+      (lib.getInclude libcusparse) # cusparse.h
+      (lib.getDev cuda_cudart) # cuda_runtime.h cuda_runtime_api.h
+    ]
+    ++ lib.optionals cudaPackages.cuda_crt.meta.available [ cuda_crt ];

  cuda-native-redist = symlinkJoin {
    name = "cuda-native-redist-${cudaMajorMinorVersion}";
--- a/pkgs/development/python-modules/gdown/default.nix
+++ b/pkgs/development/python-modules/gdown/default.nix
@@ -16,12 +16,12 @@

 buildPythonPackage (finalAttrs: {
  pname = "gdown";
-  version = "6.2.0";
+  version = "6.4.0";
  pyproject = true;

  src = fetchPypi {
    inherit (finalAttrs) pname version;
-    hash = "sha256-C78l03YSYiY6LZ1KbLJuvH4PIlrY8TSDIJmSUIvM3FQ=";
+    hash = "sha256-4MkBpNhHs91IL1VucWcm+/a6yhx7BGdX2UiyR+63yCI=";
  };

  build-system = [
--- a/pkgs/development/python-modules/gpuctypes/default.nix
+++ b/pkgs/development/python-modules/gpuctypes/default.nix
@@ -20,15 +20,16 @@
 assert testCudaRuntime -> cudaSupport;
 assert testRocmRuntime -> rocmSupport;

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "gpuctypes";
  version = "0.3.0";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    repo = "gpuctypes";
    owner = "tinygrad";
-    tag = version;
+    tag = finalAttrs.version;
    hash = "sha256-xUMvMBK1UhZaMZfik0Ia6+siyZGpCkBV+LTnQvzt/rw=";
  };

@@ -43,22 +44,29 @@ buildPythonPackage rec {
    })
  ];

-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];

  postPatch = ''
    substituteInPlace gpuctypes/opencl.py \
-      --replace "ctypes.util.find_library('OpenCL')" "'${ocl-icd}/lib/libOpenCL.so'"
+      --replace-fail \
+        "ctypes.util.find_library('OpenCL')" \
+        "'${lib.getLib ocl-icd}/lib/libOpenCL.so'"
  ''
  # hipGetDevicePropertiesR0600 is a symbol from rocm-6. We are currently at rocm-5.
  # We are not sure that this works. Remove when rocm gets updated to version 6.
  + lib.optionalString rocmSupport ''
    substituteInPlace gpuctypes/hip.py \
-      --replace "/opt/rocm/lib/libamdhip64.so" "${rocmPackages.clr}/lib/libamdhip64.so" \
-      --replace "/opt/rocm/lib/libhiprtc.so" "${rocmPackages.clr}/lib/libhiprtc.so" \
-      --replace "hipGetDevicePropertiesR0600" "hipGetDeviceProperties"
+      --replace-fail \
+        "/opt/rocm/lib/libamdhip64.so" \
+        "${lib.getLib rocmPackages.clr}/lib/libamdhip64.so" \
+      --replace-fail \
+        "hipGetDevicePropertiesR0600" \
+        "hipGetDeviceProperties"

    substituteInPlace gpuctypes/comgr.py \
-      --replace "/opt/rocm/lib/libamd_comgr.so" "${rocmPackages.rocm-comgr}/lib/libamd_comgr.so"
+      --replace-fail \
+        "/opt/rocm/lib/libamd_comgr.so" \
+        "${lib.getLib rocmPackages.rocm-comgr}/lib/libamd_comgr.so"
  '';

  pythonImportsCheck = [ "gpuctypes" ];
@@ -112,6 +120,7 @@ buildPythonPackage rec {
  meta = {
    description = "Ctypes wrappers for HIP, CUDA, and OpenCL";
    homepage = "https://github.com/tinygrad/gpuctypes";
+    changelog = "https://github.com/tinygrad/gpuctypes/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [
      GaetanLepage
@@ -119,4 +128,4 @@ buildPythonPackage rec {
      wozeparrot
    ];
  };
-}
+})
--- a/pkgs/development/python-modules/jupyter-server/default.nix
+++ b/pkgs/development/python-modules/jupyter-server/default.nix
@@ -130,6 +130,9 @@ buildPythonPackage (finalAttrs: {
    # nbconvert failed: `relax_add_props` kwargs of validate has been
    # deprecated for security reasons, and will be removed soon.
    "tests/nbconvert/test_handlers.py"
+    # timing sensitive
+    "tests/services/contents/test_manager.py::test_created_timestamp"
+    "tests/services/kernels/test_connection.py::test_disconnect_resolves_orphaned_kernel_info_future"
  ];

  __darwinAllowLocalNetworking = true;
--- a/pkgs/development/python-modules/llama-index-embeddings-google-genai/default.nix
+++ b/pkgs/development/python-modules/llama-index-embeddings-google-genai/default.nix
@@ -9,13 +9,13 @@

 buildPythonPackage (finalAttrs: {
  pname = "llama-index-embeddings-google-genai";
-  version = "0.5.1";
+  version = "0.6.0";
  pyproject = true;

  src = fetchPypi {
    pname = "llama_index_embeddings_google_genai";
    inherit (finalAttrs) version;
-    hash = "sha256-xA0J65uYGUnbWaNh0yJ0U8IumOnhjTXHK9Jklnvd2UQ=";
+    hash = "sha256-4bdMO4Kre6aLt6xpg0Wh84NleYfRyLwfTJPBHkx+5Zw=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/pycuda/default.nix
+++ b/pkgs/development/python-modules/pycuda/default.nix
@@ -15,11 +15,21 @@
  python,
  mkDerivation,
  lib,
+  symlinkJoin,
 }:
 let
  compyte = import ./compyte.nix { inherit mkDerivation fetchFromGitHub; };

-  inherit (cudaPackages) cudatoolkit;
+  cudaRoot = symlinkJoin {
+    name = "pycuda-cuda-root";
+    paths = with cudaPackages; [
+      cuda_cudart
+      cuda_nvcc
+      (lib.getInclude cuda_profiler_api)
+      (lib.getInclude libcurand)
+      (lib.getLib libcurand)
+    ];
+  };
 in
 buildPythonPackage rec {
  pname = "pycuda";
@@ -36,7 +46,7 @@ buildPythonPackage rec {
                          --boost-lib-dir=${boost}/lib \
                          --no-use-shipped-boost \
                          --boost-python-libname=boost_python${major python.version}${minor python.version} \
-                          --cuda-root=${cudatoolkit}
+                          --cuda-root=${cudaRoot}
  '';

  postInstall = ''
@@ -66,7 +76,10 @@ buildPythonPackage rec {
    decorator
    appdirs
    six
-    cudatoolkit
+    cudaPackages.cuda_cudart
+    cudaPackages.cuda_nvcc
+    (lib.getInclude cudaPackages.cuda_profiler_api)
+    cudaPackages.libcurand
    compyte
    python
    mako
--- a/pkgs/development/python-modules/pyluwen/default.nix
+++ b/pkgs/development/python-modules/pyluwen/default.nix
@@ -9,7 +9,7 @@
 }:
 buildPythonPackage (finalAttrs: {
  pname = "pyluwen";
-  version = "0.9.0";
+  version = "0.10.0";
  pyproject = true;
  __structuredAttrs = true;

@@ -17,12 +17,12 @@ buildPythonPackage (finalAttrs: {
    owner = "tenstorrent";
    repo = "luwen";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-pc/7G9YxBTg2uYn47ONxI7zsfdK3Ex4zndLASRtDQyk=";
+    hash = "sha256-J0SvCBsDi3GMvnwqgqGMUDvrSO+baznDhsfuvF44Ens=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-2ibAZnfv++eyCB57F0uD7XFJ3MP9SnAApOn6uelo3Po=";
+    hash = "sha256-vEuVxBGIJAyc8POy3EPTzTK5g5SE3QDZcnTnAb3b5k0=";
  };

  sourceRoot = "${finalAttrs.src.name}/bind/pyluwen";
--- a/Show More
+++ b/Show More