From 223359f095860ab02a2f55168a9de309a4583743 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 1 Sep 2026 13:11:22 +0000
Subject: [PATCH 01/78] healthchecks: 4.3 -> 4.4

---
 pkgs/by-name/he/healthchecks/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/he/healthchecks/package.nix b/pkgs/by-name/he/healthchecks/package.nix
index 8cf1797fc2ff..3b0b0b8342e4 100644
--- a/pkgs/by-name/he/healthchecks/package.nix
+++ b/pkgs/by-name/he/healthchecks/package.nix
@@ -15,14 +15,14 @@ let
 in
 py.pkgs.buildPythonApplication rec {
   pname = "healthchecks";
-  version = "4.3";
+  version = "4.4";
   pyproject = false;
 
   src = fetchFromGitHub {
     owner = "healthchecks";
     repo = "healthchecks";
     tag = "v${version}";
-    sha256 = "sha256-8S7hIUFSr88jNEwGM4mSQAv+EdH/ynT9MvATabmtp5s=";
+    sha256 = "sha256-4TG6K52sY2Cqu8K+9Gg2Zh1lL0tWQY9B+jKdDf1Vg+0=";
   };
 
   propagatedBuildInputs = with py.pkgs; [

From fb7dff81d956c7f83fd39d42cfebcf9e5f2ae174 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 2 Sep 2026 01:10:59 +0000
Subject: [PATCH 02/78] butler: 15.30.0 -> 15.31.0

---
 pkgs/by-name/bu/butler/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/bu/butler/package.nix b/pkgs/by-name/bu/butler/package.nix
index 3d99441df643..91639876035d 100644
--- a/pkgs/by-name/bu/butler/package.nix
+++ b/pkgs/by-name/bu/butler/package.nix
@@ -7,20 +7,20 @@
 
 buildGoModule (finalAttrs: {
   pname = "butler";
-  version = "15.30.0";
+  version = "15.31.0";
 
   src = fetchFromGitHub {
     owner = "itchio";
     repo = "butler";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zq6ZmPNhRrp2MiDr6VElPMJGXEEkdK9ZjI0XUM0nED8=";
+    hash = "sha256-gH0aSS5VvKdBr9zD7CGHo3Qhs/MFkJWVMaG9m9yDPXw=";
   };
 
   buildInputs = [ brotli ];
 
   doCheck = false; # disabled because the tests don't work in a non-FHS compliant environment.
 
-  vendorHash = "sha256-kNc3twHNWgxJEVDte4GO6da8KrUmClaFZuip1bb1fMM=";
+  vendorHash = "sha256-4Uleff7XO9hs72/G+s8Ak1yaDLNpdHZa2GKx1aCtLZI=";
 
   meta = {
     description = "Command-line itch.io helper";

From 32fa963a5b191dbf9661025d8bd77caf52ff5108 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 2 Sep 2026 16:04:21 +0000
Subject: [PATCH 03/78] upx: 5.2.0 -> 5.2.1

---
 pkgs/by-name/up/upx/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/up/upx/package.nix b/pkgs/by-name/up/upx/package.nix
index b5d602ca9f83..747e1dee1626 100644
--- a/pkgs/by-name/up/upx/package.nix
+++ b/pkgs/by-name/up/upx/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "upx";
-  version = "5.2.0";
+  version = "5.2.1";
   src = fetchFromGitHub {
     owner = "upx";
     repo = "upx";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-6LTDz4gMak0V7KiZOeuQgm+RubKRp3zhF6T6SZzZ5Dk=";
+    hash = "sha256-Fy+BqntQcHLo5FGhWTP6gqe5OIGC6w7SMc+tlV+VqCM=";
   };
 
   nativeBuildInputs = [ cmake ];

From 45350ba529c8d52141289aebc9a72a8aa11d2b1a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 2 Sep 2026 21:20:20 +0000
Subject: [PATCH 04/78] cgif: 0.5.3 -> 0.5.4

---
 pkgs/by-name/cg/cgif/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/cg/cgif/package.nix b/pkgs/by-name/cg/cgif/package.nix
index 50b3e62f821b..5df187181bde 100644
--- a/pkgs/by-name/cg/cgif/package.nix
+++ b/pkgs/by-name/cg/cgif/package.nix
@@ -8,13 +8,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cgif";
-  version = "0.5.3";
+  version = "0.5.4";
 
   src = fetchFromGitHub {
     owner = "dloebl";
     repo = "cgif";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-sZan1SLY4HGoifgGOb+uo4/q4dtxZuWAYhMbvdl/Ap8=";
+    hash = "sha256-rWw7dlqS/NsrrtRfYfmnC6ubHJLie5301S9C0uognnw=";
   };
 
   nativeBuildInputs = [

From 253ac2bf54e768ed2ffd5a5e313803fbd4b76ac4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 3 Sep 2026 20:20:51 +0000
Subject: [PATCH 05/78] mommy: 1.8.0 -> 2.0.0

---
 pkgs/by-name/mo/mommy/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mo/mommy/package.nix b/pkgs/by-name/mo/mommy/package.nix
index 515207c75602..ddcb3be18d0c 100644
--- a/pkgs/by-name/mo/mommy/package.nix
+++ b/pkgs/by-name/mo/mommy/package.nix
@@ -23,13 +23,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mommy";
-  version = "1.8.0";
+  version = "2.0.0";
 
   src = fetchFromGitHub {
     owner = "FWDekker";
     repo = "mommy";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zuFiRzM3mDt5GIaRl9nCLH3YteJfKtV2R29JwIKygjY=";
+    hash = "sha256-BMIvKaFQvtZisM3tesyO+0Yhs7g81LaFMLSZRkAP0+g=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 85bf13d42069293db84d9fe4102a741ffbaa427c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Sep 2026 02:54:14 +0000
Subject: [PATCH 06/78] python3Packages.llama-index-embeddings-google-genai:
 0.5.1 -> 0.6.0

---
 .../llama-index-embeddings-google-genai/default.nix           | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/llama-index-embeddings-google-genai/default.nix b/pkgs/development/python-modules/llama-index-embeddings-google-genai/default.nix
index cd877082bc9a..a8589ea91c6e 100644
--- a/pkgs/development/python-modules/llama-index-embeddings-google-genai/default.nix
+++ b/pkgs/development/python-modules/llama-index-embeddings-google-genai/default.nix
@@ -9,13 +9,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "llama-index-embeddings-google-genai";
-  version = "0.5.1";
+  version = "0.6.0";
   pyproject = true;
 
   src = fetchPypi {
     pname = "llama_index_embeddings_google_genai";
     inherit (finalAttrs) version;
-    hash = "sha256-xA0J65uYGUnbWaNh0yJ0U8IumOnhjTXHK9Jklnvd2UQ=";
+    hash = "sha256-4bdMO4Kre6aLt6xpg0Wh84NleYfRyLwfTJPBHkx+5Zw=";
   };
 
   build-system = [ hatchling ];

From af290fe3a5f951d0f2226b15d0d509f4f7bdf9c4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Sep 2026 20:55:12 +0000
Subject: [PATCH 07/78] libwmf: 0.2.15 -> 0.2.16

---
 pkgs/by-name/li/libwmf/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libwmf/package.nix b/pkgs/by-name/li/libwmf/package.nix
index 4ca132dbddaf..1eb29a798197 100644
--- a/pkgs/by-name/li/libwmf/package.nix
+++ b/pkgs/by-name/li/libwmf/package.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libwmf";
-  version = "0.2.15";
+  version = "0.2.16";
 
   outputs = [
     "out"
@@ -27,7 +27,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "caolanm";
     repo = "libwmf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Bpxr04dQ6EjX1FBVF4KcbJQvUjsPK6L03xLIXG6F2FI=";
+    hash = "sha256-cQY0DFG+S35G7vblbBxWMTWFp8WqnpNSvjohQSLzijU=";
   };
 
   nativeBuildInputs = [

From 6958d1e37079be4b039da9c6be31bb0f9050aaa1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 6 Sep 2026 01:46:21 +0000
Subject: [PATCH 08/78] marp-cli: 4.5.0 -> 4.5.1

---
 pkgs/by-name/ma/marp-cli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ma/marp-cli/package.nix b/pkgs/by-name/ma/marp-cli/package.nix
index 274475187623..d00ca66fc5c7 100644
--- a/pkgs/by-name/ma/marp-cli/package.nix
+++ b/pkgs/by-name/ma/marp-cli/package.nix
@@ -7,16 +7,16 @@
 
 buildNpmPackage rec {
   pname = "marp-cli";
-  version = "4.5.0";
+  version = "4.5.1";
 
   src = fetchFromGitHub {
     owner = "marp-team";
     repo = "marp-cli";
     rev = "v${version}";
-    hash = "sha256-ZcidJIcZ3ZFsQFIGiY1sBeRE7GZkGPPQNHhRnti/EGY=";
+    hash = "sha256-MJALb8rH0xwFUa9KLq/zKuSJmbGum2aMFwx1AzDnCLA=";
   };
 
-  npmDepsHash = "sha256-qgEwuPGbepTpbkZj3Zp2Xd5TRJbXwukWO9LLriek9H4=";
+  npmDepsHash = "sha256-C9lssV3yOZJV3BHZ1MqDxFCT3PkYjjAyHTjQ/32ps3c=";
   npmPackFlags = [ "--ignore-scripts" ];
   makeCacheWritable = true;
 

From fb39234102252f07e8c76aebba7333b55560f0d5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 6 Sep 2026 02:40:51 +0000
Subject: [PATCH 09/78] tarantool: 3.8.0 -> 3.8.1

---
 pkgs/by-name/ta/tarantool/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ta/tarantool/package.nix b/pkgs/by-name/ta/tarantool/package.nix
index 62c4a46edc8f..7723148d1367 100644
--- a/pkgs/by-name/ta/tarantool/package.nix
+++ b/pkgs/by-name/ta/tarantool/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "tarantool";
-  version = "3.8.0";
+  version = "3.8.1";
 
   src = fetchFromGitHub {
     owner = "tarantool";
     repo = "tarantool";
     tag = finalAttrs.version;
-    hash = "sha256-X3Bqwt3HSFWr1klPtrIaE5jMAzFJO4mRcowWJCnqUac=";
+    hash = "sha256-ZdGbBOp34H+n0DHn+Ocbj2T5Kzta+mQSEhu7pRrQy64=";
     fetchSubmodules = true;
   };
 

From 37f0472f03f098cf3003af039c3ef155442d9aa1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 6 Sep 2026 03:48:47 +0000
Subject: [PATCH 10/78] python3Packages.pywbem: 1.9.0 -> 1.9.1

---
 pkgs/development/python-modules/pywbem/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pywbem/default.nix b/pkgs/development/python-modules/pywbem/default.nix
index 8c676f9a165f..ba250cd04715 100644
--- a/pkgs/development/python-modules/pywbem/default.nix
+++ b/pkgs/development/python-modules/pywbem/default.nix
@@ -26,12 +26,12 @@
 
 buildPythonPackage rec {
   pname = "pywbem";
-  version = "1.9.0";
+  version = "1.9.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-ZcH/lyzqLwF7BnlfR8CtdEL4Q0/2Q6VEBQwQcmcE9qs=";
+    hash = "sha256-tTfr6DfE/W8ifHXdGWF14QW5X66a3PGfeQRXujV1M0M=";
   };
 
   postPatch = ''

From 701074a0b301e2f1f1ad0fe154414a966b8435c6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 6 Sep 2026 04:27:45 +0000
Subject: [PATCH 11/78] entt: 3.16.0 -> 4.0.0

---
 pkgs/by-name/en/entt/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/en/entt/package.nix b/pkgs/by-name/en/entt/package.nix
index d41c37d20166..85738a164782 100644
--- a/pkgs/by-name/en/entt/package.nix
+++ b/pkgs/by-name/en/entt/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "entt";
-  version = "3.16.0";
+  version = "4.0.0";
 
   src = fetchFromGitHub {
     owner = "skypjack";
     repo = "entt";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-i4K7NigYPYAOsVLhtjQJFmm9LoWiTg39F8SIBRuv4Vg=";
+    hash = "sha256-+sIe2zn2uY/BHB+KIuJ5+1fa8qDjDnsnLBWk14WuUT0=";
   };
 
   nativeBuildInputs = [ cmake ];

From 43113bce5b927c58c6772bb0b14262fae4582b11 Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Sun, 13 Sep 2026 15:58:08 +0200
Subject: [PATCH 12/78] blastem: 0.6.2-unstable-2024-08-14 -> 1.0.0

---
 pkgs/by-name/bl/blastem/package.nix | 43 +++++++++++++++++------------
 1 file changed, 25 insertions(+), 18 deletions(-)

diff --git a/pkgs/by-name/bl/blastem/package.nix b/pkgs/by-name/bl/blastem/package.nix
index b58c6bb6101a..32abf6dd8f23 100644
--- a/pkgs/by-name/bl/blastem/package.nix
+++ b/pkgs/by-name/bl/blastem/package.nix
@@ -2,43 +2,48 @@
   lib,
   stdenv,
   fetchhg,
-  pkg-config,
+
   makeBinaryWrapper,
-  SDL2,
+  pkg-config,
+  python3,
+
   glew,
   gtk3,
+  SDL2,
+
   testers,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "blastem";
-  version = "0.6.2-unstable-2024-08-14";
+  version = "1.0.0";
 
   src = fetchhg {
     url = "https://www.retrodev.com/repos/blastem";
-    rev = "aa888682faa0";
-    hash = "sha256-0xw9O0o1pkJiXHyZer4nMJeLlRXS3Z4YYoLgfkrz3Yo=";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-Fs78GFmvndJz+Ngpzw3bRyL8IX8UUJBAbV3TcNbHJHA=";
   };
 
-  # will probably be fixed in https://github.com/NixOS/nixpkgs/pull/302481
-  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+  postPatch = ''
     substituteInPlace Makefile \
-        --replace-fail "-flto" ""
+      --replace-fail '/bin/echo' 'echo'
+    patchShebangs cpu_dsl.py
   '';
 
   nativeBuildInputs = [
-    pkg-config
     makeBinaryWrapper
+    pkg-config
+    python3
   ];
 
   buildInputs = [
     gtk3
-    SDL2
     glew
+    SDL2
   ];
 
   # Note: menu.bin cannot be generated yet, because it would
-  # need the `vasmm68k_mot` executable (part of vbcc for amigaos68k
+  # need the `vasmm68k_mot` executable (part of vbcc for amigaos68k)
   # Luckily, menu.bin doesn't need to be present for the emulator to function
 
   makeFlags = [ "HOST_ZLIB=1" ];
@@ -49,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
     runHook preInstall
 
     # not sure if any executable other than blastem is really needed here
-    install -Dm755 blastem dis zdis termhelper -t $out/share/blastem
+    install -Dm755 blastem dis zdis upddis sh2dis termhelper -t $out/share/blastem
     install -Dm644 gamecontrollerdb.txt default.cfg rom.db -t $out/share/blastem
     cp -r shaders $out/share/blastem/shaders
 
@@ -62,18 +67,20 @@ stdenv.mkDerivation (finalAttrs: {
   passthru.tests.version = testers.testVersion {
     package = finalAttrs.finalPackage;
     command = "blastem -v";
-    version = "0.6.3-pre"; # remove line when moving to a stable version
   };
 
   meta = {
-    description = "Fast and accurate Genesis emulator";
+    description = "Fast and accurate emulator for Sega's 16-bit and 8-bit consoles";
+    longDescription = ''
+      BlastEm is a free and Open Source emulator for Sega's 16-bit and 8-bit consoles.
+      It's fast enough for your old PC and accurate enough for the most demanding demos.
+      While BlastEm's primary focus is the Genesis (known as the Megadrive outside North America),
+      it also supports the Sega CD, 32X, Master System, Game Gear, SG-1000, SC-3000, Sega Pico and Yamaha Copera.
+    '';
     homepage = "https://www.retrodev.com/blastem/";
     license = lib.licenses.gpl3Plus;
     mainProgram = "blastem";
     maintainers = with lib.maintainers; [ tomasajt ];
-    platforms = [
-      "i686-linux"
-      "x86_64-linux"
-    ];
+    platforms = lib.platforms.linux ++ lib.platforms.darwin;
   };
 })

From 731b697c44b6305e8a62611d93759f0ecb2ece0d Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Sun, 20 Sep 2026 15:10:39 -0400
Subject: [PATCH 13/78] firestarter: remove `cudatoolkit`

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 pkgs/by-name/fi/firestarter/package.nix | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/fi/firestarter/package.nix b/pkgs/by-name/fi/firestarter/package.nix
index 4ee154b6c3a2..660b3239c365 100644
--- a/pkgs/by-name/fi/firestarter/package.nix
+++ b/pkgs/by-name/fi/firestarter/package.nix
@@ -9,13 +9,12 @@
   glibc,
   git,
   pkg-config,
-  cudaPackages ? { },
-  withCuda ? false,
+  config,
+  cudaPackages,
+  withCuda ? config.cudaSupport,
 }:
 
 let
-  inherit (cudaPackages) cudatoolkit;
-
   hwloc = stdenv.mkDerivation rec {
     pname = "hwloc";
     version = "2.2.0";
@@ -61,11 +60,14 @@ stdenv.mkDerivation rec {
   pname = "firestarter";
   version = "2.0";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "tud-zih-energy";
     repo = "FIRESTARTER";
     tag = "v${version}";
-    sha256 = "1ik6j1lw5nldj4i3lllrywqg54m9i2vxkxsb2zr4q0d2rfywhn23";
+    hash = "sha256-Q1jIvcuiAUzyF0v32beIqZLyMPeZUjoikY3awmmQZsY=";
     fetchSubmodules = true;
   };
 
@@ -83,6 +85,7 @@ stdenv.mkDerivation rec {
   ]
   ++ lib.optionals withCuda [
     addDriverRunpath
+    cudaPackages.cuda_nvcc
   ];
 
   buildInputs = [
@@ -92,14 +95,17 @@ stdenv.mkDerivation rec {
     if withCuda then
       [
         glibc_multi
-        cudatoolkit
+        cudaPackages.cuda_nvcc # crt/host_defines.h
+        cudaPackages.cuda_cudart
+        cudaPackages.libcublas
+        cudaPackages.libcurand
       ]
     else
       [ glibc.static ]
   );
 
   env = lib.optionalAttrs withCuda {
-    NIX_LDFLAGS = "-L${cudatoolkit}/lib/stubs";
+    NIX_LDFLAGS = "-L${lib.getOutput "stubs" cudaPackages.cuda_cudart}/lib/stubs";
   };
 
   cmakeFlags = [

From 907204db5bbe7279323bd3eb002c3a77b5658edb Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 23 Sep 2026 01:43:52 +0000
Subject: [PATCH 14/78] samplv1: 1.4.2 -> 1.5.0

---
 pkgs/by-name/sa/samplv1/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sa/samplv1/package.nix b/pkgs/by-name/sa/samplv1/package.nix
index 6d0af33b0830..592e973a5e1f 100644
--- a/pkgs/by-name/sa/samplv1/package.nix
+++ b/pkgs/by-name/sa/samplv1/package.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "samplv1";
-  version = "1.4.2";
+  version = "1.5.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/samplv1/samplv1-${finalAttrs.version}.tar.gz";
-    hash = "sha256-DAD8y9BhVyCxi7VPWLXKkcv6kxFQOOmTDB2ntJiG0Lw=";
+    hash = "sha256-EzmkDwxU6C8/ExQUQ3dWW2Tez8h/cg8Q+x6CWfnL5kw=";
   };
 
   nativeBuildInputs = [

From 33ea537fa5b91b5c99a5c8713083b712425889eb Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 26 Sep 2026 03:08:31 +0000
Subject: [PATCH 15/78] python3Packages.gdown: 6.2.0 -> 6.4.0

---
 pkgs/development/python-modules/gdown/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/gdown/default.nix b/pkgs/development/python-modules/gdown/default.nix
index 0aad3a559326..f7601969e3c7 100644
--- a/pkgs/development/python-modules/gdown/default.nix
+++ b/pkgs/development/python-modules/gdown/default.nix
@@ -16,12 +16,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "gdown";
-  version = "6.2.0";
+  version = "6.4.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-C78l03YSYiY6LZ1KbLJuvH4PIlrY8TSDIJmSUIvM3FQ=";
+    hash = "sha256-4MkBpNhHs91IL1VucWcm+/a6yhx7BGdX2UiyR+63yCI=";
   };
 
   build-system = [

From f29e3843f38028d695efc4ead002a92358160012 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 27 Sep 2026 12:30:54 +0000
Subject: [PATCH 16/78] ggml: 0.24.0 -> 0.25.3

---
 pkgs/by-name/gg/ggml/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gg/ggml/package.nix b/pkgs/by-name/gg/ggml/package.nix
index c4fe5307a53d..9131ca861f2e 100644
--- a/pkgs/by-name/gg/ggml/package.nix
+++ b/pkgs/by-name/gg/ggml/package.nix
@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ggml";
-  version = "0.24.0";
+  version = "0.25.3";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "ggml-org";
     repo = "ggml";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wSI0GnSFoMyBKuzIrelURzaIaSIS/eIAwG4etmy9XUo=";
+    hash = "sha256-u6HQNbSjuMeWsQOR7hMKJCj659KDp/Qps0KU38it54Q=";
   };
 
   # The cmake package does not handle absolute CMAKE_INSTALL_LIBDIR and CMAKE_INSTALL_INCLUDEDIR

From ca94f4ebd9e25b4e5f7ea429999b2b996e1c4242 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 27 Sep 2026 12:38:55 +0000
Subject: [PATCH 17/78] wcslib: 8.9 -> 8.10

---
 pkgs/by-name/wc/wcslib/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/wc/wcslib/package.nix b/pkgs/by-name/wc/wcslib/package.nix
index 9e03e267b488..0465eef912fb 100644
--- a/pkgs/by-name/wc/wcslib/package.nix
+++ b/pkgs/by-name/wc/wcslib/package.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wcslib";
-  version = "8.9";
+  version = "8.10";
 
   src = fetchurl {
     url = "ftp://ftp.atnf.csiro.au/pub/software/wcslib/wcslib-${finalAttrs.version}.tar.bz2";
-    hash = "sha256-gqwJzlCRsL8Gzsj1ze7B2r4dBrpd+3/yvbDBaASIgHs=";
+    hash = "sha256-s5TTMG2ppSQQ8FYTaRFJblmbXEjxz/LyIVY2lwd7vY0=";
   };
 
   # error: call to undeclared library function 'snprintf'

From 52f572529a74e05c272fb1256b5f64076781602f Mon Sep 17 00:00:00 2001
From: Dmitry Kalinkin <dmitry.kalinkin@gmail.com>
Date: Fri, 28 Aug 2026 15:24:05 -0400
Subject: [PATCH 18/78] python3Packages.snakemake: fix dependency list to match
 upstream pyproject.toml

Compared the runtime dependencies declared in package.nix against
snakemake's own pyproject.toml (checked at the matching v9.23.1 tag):

- Add missing dependencies that are actually imported: platformdirs
  (replaces the removed appdirs usage, code now imports
  `from platformdirs import AppDirs`), dpath, packaging and referencing.
- Remove unused dependencies that are not imported anywhere in the
  source: appdirs, datrie, reretry, stopit and toposort. Notably,
  stopit is currently marked broken on python3.14, which made the
  package fail to evaluate; removing this unused dependency fixes
  that.
- Relax the docutils version constraint via pythonRelaxDeps, since
  nixpkgs' docutils (0.23) is newer than upstream's pinned
  `<0.23,>=0.20` range, which otherwise fails pythonRuntimeDepsCheck.

Verified with `nix-build -A python3Packages.snakemake` and running
`snakemake --version`.

Assisted-by: Claude Sonnet 5 <noreply@anthropic.com>
---
 pkgs/by-name/sn/snakemake/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/sn/snakemake/package.nix b/pkgs/by-name/sn/snakemake/package.nix
index d3fd4a7a9acb..dbad1dead0c6 100644
--- a/pkgs/by-name/sn/snakemake/package.nix
+++ b/pkgs/by-name/sn/snakemake/package.nix
@@ -36,28 +36,30 @@ python3Packages.buildPythonApplication (finalAttrs: {
   build-system = with python3Packages; [ setuptools-scm ];
 
   pythonRelaxDeps = [
+    "docutils"
     "packaging"
     "sqlmodel"
   ];
   dependencies = with python3Packages; [
-    appdirs
     conda-inject
     configargparse
     connection-pool
-    datrie
     docutils
+    dpath
     gitpython
     humanfriendly
     immutables
     jinja2
     jsonschema
     nbformat
+    packaging
+    platformdirs
     psutil
     pulp
     pygments
     pyyaml
+    referencing
     requests
-    reretry
     smart-open
     snakemake-interface-common
     snakemake-interface-executor-plugins
@@ -66,11 +68,9 @@ python3Packages.buildPythonApplication (finalAttrs: {
     snakemake-interface-scheduler-plugins
     snakemake-interface-storage-plugins
     sqlmodel
-    stopit
     tabulate
     tenacity
     throttler
-    toposort
     wrapt
     yte
   ];

From cb5135226ed1b192f8b64c2bac23a484d4e70b7c Mon Sep 17 00:00:00 2001
From: Dmitry Kalinkin <dmitry.kalinkin@gmail.com>
Date: Fri, 28 Aug 2026 15:35:24 -0400
Subject: [PATCH 19/78] python3Packages.stopit: remove, unused and broken

No package in nixpkgs depends on stopit anymore (snakemake's
dependency on it was dropped in the previous commit since it isn't
actually imported by snakemake's source). It is also currently broken:
its meta.broken evaluates to true because
`lib.versionAtLeast setuptools.version "82"` (setuptools is 83.0.0),
so it wasn't buildable anyway. Add a throw alias pointing users to the
reason for removal, following the convention in python-aliases.nix.

Assisted-by: Claude Sonnet 5 <noreply@anthropic.com>
---
 .../python-modules/stopit/default.nix         | 42 ----------
 .../python-modules/stopit/import_lib.patch    | 81 -------------------
 pkgs/top-level/python-aliases.nix             |  1 +
 pkgs/top-level/python-packages.nix            |  2 -
 4 files changed, 1 insertion(+), 125 deletions(-)
 delete mode 100644 pkgs/development/python-modules/stopit/default.nix
 delete mode 100644 pkgs/development/python-modules/stopit/import_lib.patch

diff --git a/pkgs/development/python-modules/stopit/default.nix b/pkgs/development/python-modules/stopit/default.nix
deleted file mode 100644
index 70ed4c53cc49..000000000000
--- a/pkgs/development/python-modules/stopit/default.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchFromGitHub,
-  setuptools,
-
-}:
-
-buildPythonPackage (finalAttrs: {
-  pname = "stopit";
-  version = "1.1.2";
-  pyproject = true;
-  __structuredAttrs = true;
-
-  # tests are missing from the PyPi tarball
-  src = fetchFromGitHub {
-    owner = "glenfant";
-    repo = "stopit";
-    tag = finalAttrs.version;
-    hash = "sha256-uXJUA70JOGWT2NmS6S7fPrTWAJZ0mZ/hICahIUzjfbw=";
-  };
-
-  build-system = [
-    setuptools # for pkg_resources
-  ];
-
-  patches = [
-    # https://github.com/glenfant/stopit/pull/34
-    ./import_lib.patch
-  ];
-
-  pythonImportsCheck = [ "stopit" ];
-
-  meta = {
-    broken = lib.versionAtLeast setuptools.version "82";
-    description = "Raise asynchronous exceptions in other thread, control the timeout of blocks or callables with a context manager or a decorator";
-    homepage = "https://github.com/glenfant/stopit";
-    changelog = "https://github.com/glenfant/stopit/blob/${finalAttrs.version}/CHANGES.rst";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ veprbl ];
-  };
-})
diff --git a/pkgs/development/python-modules/stopit/import_lib.patch b/pkgs/development/python-modules/stopit/import_lib.patch
deleted file mode 100644
index 240e4b408e68..000000000000
--- a/pkgs/development/python-modules/stopit/import_lib.patch
+++ /dev/null
@@ -1,81 +0,0 @@
-From 9204d1de2ae294b878ed726c8278b28696a91f87 Mon Sep 17 00:00:00 2001
-From: Jonathan Kamens <jik@jik6.kamens.us>
-Date: Wed, 25 Sep 2024 15:52:03 -0400
-Subject: [PATCH 1/2] Use importlib instead of pkg_resources to determine
- package version
-
-`pkg_resources` is deprecated and no longer available for import by
-default as of Python 3.12.
----
- src/stopit/__init__.py | 22 ++++++++++++++--------
- 1 file changed, 14 insertions(+), 8 deletions(-)
-
-diff --git a/src/stopit/__init__.py b/src/stopit/__init__.py
-index 6ca0180..d2fb01e 100644
---- a/src/stopit/__init__.py
-+++ b/src/stopit/__init__.py
-@@ -7,19 +7,25 @@
- Public resources from ``stopit``
- """
- 
--import pkg_resources
-+try:
-+    from importlib.metadata import version
-+    __version__ = version(__name__)
-+except Exception:
-+    # pkg_resources is deprecated as of Python 3.12 and no longer available for
-+    # import by default.
-+    try:
-+        import pkg_resources
-+    except Exception:
-+        LOG.warning(
-+            "Could not get the package version from importlib or pkg_resources")
-+        __version__ = 'unknown'
-+    else:
-+        __version__ = pkg_resources.get_distribution(__name__).version
- 
- from .utils import LOG, TimeoutException
- from .threadstop import ThreadingTimeout, async_raise, threading_timeoutable
- from .signalstop import SignalTimeout, signal_timeoutable
- 
--# PEP 396 style version marker
--try:
--    __version__ = pkg_resources.get_distribution(__name__).version
--except:
--    LOG.warning("Could not get the package version from pkg_resources")
--    __version__ = 'unknown'
--
- __all__ = (
-     'ThreadingTimeout', 'async_raise', 'threading_timeoutable',
-     'SignalTimeout', 'signal_timeoutable'
-
-From a2f6bde8a29cd281577426800b186802c68dbd86 Mon Sep 17 00:00:00 2001
-From: Jonathan Kamens <jik@jik7>
-Date: Mon, 28 Jul 2025 09:13:25 -0400
-Subject: [PATCH 2/2] Import LOG before trying to use it
-
----
- src/stopit/__init__.py | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/src/stopit/__init__.py b/src/stopit/__init__.py
-index d2fb01e..bbf7068 100644
---- a/src/stopit/__init__.py
-+++ b/src/stopit/__init__.py
-@@ -7,6 +7,8 @@
- Public resources from ``stopit``
- """
- 
-+from .utils import LOG, TimeoutException
-+
- try:
-     from importlib.metadata import version
-     __version__ = version(__name__)
-@@ -22,7 +24,6 @@
-     else:
-         __version__ = pkg_resources.get_distribution(__name__).version
- 
--from .utils import LOG, TimeoutException
- from .threadstop import ThreadingTimeout, async_raise, threading_timeoutable
- from .signalstop import SignalTimeout, signal_timeoutable
- 
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 3c5c2369bcd8..b5f1c4b9bd1d 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -730,6 +730,7 @@ mapAliases {
   sqlalchemy_migrate = throw "'sqlalchemy_migrate' has been renamed to/replaced by 'sqlalchemy-migrate'"; # Converted to throw 2025-10-29
   steamship = throw "'steamship' has been removed because it is broken and unmaintained upstream"; # Added 2026-05-06
   stookalert = throw "'stookalert' has been removed because it is unmaintained upstream"; # Added 2026-08-04
+  stopit = throw "'stopit' has been removed because it is unused and broken"; # Added 2026-08-28
   strawberry-django = strawberry-graphql-django; # Added 2026-07-14
   subunit2sql = throw "subunit2sql has been removed because it has been marked as broken since at least November 2024."; # Added 2025-10-04
   subunit = python-subunit; # added 2026-06-21
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index d7085e093a0f..1817f0ecb08a 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -20059,8 +20059,6 @@ self: super: with self; {
 
   stop-words = callPackage ../development/python-modules/stop-words { };
 
-  stopit = callPackage ../development/python-modules/stopit { };
-
   storage3 = callPackage ../development/python-modules/storage3 { };
 
   stp = toPythonModule (pkgs.stp.override { python3 = self.python; });

From d98bfa9f972c01230f724383885f9094543fcf7d Mon Sep 17 00:00:00 2001
From: Dmitry Kalinkin <dmitry.kalinkin@gmail.com>
Date: Fri, 28 Aug 2026 15:37:26 -0400
Subject: [PATCH 20/78] python3Packages.snakemake-interface-storage-plugins:
 fix dependency list to match upstream pyproject.toml

Compared with upstream's pyproject.toml at the matching v4.4.1 tag
(https://github.com/snakemake/snakemake-interface-storage-plugins/blob/main/pyproject.toml):
humanfriendly, snakemake-interface-common, tenacity, throttler and
wrapt are declared and used, matching the current nix dependency list
exactly except for reretry, which is not listed upstream and is not
imported anywhere in the source (verified via grep on the v4.4.1
source tarball). Remove it.

reretry is still used by snakemake-storage-plugin-xrootd, so the
reretry package itself is left in place.

Verified with `nix-build -A python3Packages.snakemake-interface-storage-plugins`
and `nix-build -A python3Packages.snakemake` (its consumer).

Assisted-by: Claude Sonnet 5 <noreply@anthropic.com>
---
 .../snakemake-interface-storage-plugins/default.nix             | 2 --
 .../python-modules/snakemake-storage-plugin-fs/default.nix      | 2 ++
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/snakemake-interface-storage-plugins/default.nix b/pkgs/development/python-modules/snakemake-interface-storage-plugins/default.nix
index 8b3f8c5f94ea..51eecb1406c0 100644
--- a/pkgs/development/python-modules/snakemake-interface-storage-plugins/default.nix
+++ b/pkgs/development/python-modules/snakemake-interface-storage-plugins/default.nix
@@ -8,7 +8,6 @@
 
   # dependencies
   humanfriendly,
-  reretry,
   snakemake-interface-common,
   tenacity,
   throttler,
@@ -40,7 +39,6 @@ buildPythonPackage (finalAttrs: {
 
   dependencies = [
     humanfriendly
-    reretry
     snakemake-interface-common
     tenacity
     throttler
diff --git a/pkgs/development/python-modules/snakemake-storage-plugin-fs/default.nix b/pkgs/development/python-modules/snakemake-storage-plugin-fs/default.nix
index 96bcb3fc30fc..766cb526b4e1 100644
--- a/pkgs/development/python-modules/snakemake-storage-plugin-fs/default.nix
+++ b/pkgs/development/python-modules/snakemake-storage-plugin-fs/default.nix
@@ -9,6 +9,7 @@
   # dependencies
   snakemake-interface-common,
   snakemake-interface-storage-plugins,
+  reretry,
   sysrsync,
 
   # tests
@@ -35,6 +36,7 @@ buildPythonPackage (finalAttrs: {
   ];
 
   dependencies = [
+    reretry
     snakemake-interface-common
     snakemake-interface-storage-plugins
     sysrsync

From 18716b11031ccee7b0ecad72f3d1315f341885d4 Mon Sep 17 00:00:00 2001
From: Dmitry Kalinkin <dmitry.kalinkin@gmail.com>
Date: Fri, 28 Aug 2026 15:41:29 -0400
Subject: [PATCH 21/78] python3Packages.snakemake-interface-common: add missing
 packaging dependency

Compared against upstream's pyproject.toml at the matching v1.23.0 tag:
dependencies = ["argparse-dataclass>=2.0.0", "ConfigArgParse>=1.7", "packaging >=24.0,<26.0"]

The in-tree patch (relax-packaging-dependency.patch, from upstream PR
#89) only relaxes the version upper bound on packaging, it does not
remove it as a dependency. `packaging` is genuinely imported by
`snakemake_interface_common/__init__.py`, so add it to `dependencies`.

Also reviewed the remaining snakemake-interface-* packages against
their respective upstream pyproject.toml files at the matching tags;
their dependency lists already match upstream exactly:
- snakemake-interface-executor-plugins (v9.4.0): snakemake-interface-common, throttler, argparse-dataclass
- snakemake-interface-logger-plugins (v2.1.0): snakemake-interface-common
- snakemake-interface-report-plugins (v1.3.0): snakemake-interface-common
- snakemake-interface-scheduler-plugins (v2.0.2): snakemake-interface-common
- snakemake-interface-storage-plugins: fixed in a previous commit

Verified by building each snakemake-interface-* package plus their
consumer python3Packages.snakemake.

Assisted-by: Claude Sonnet 5 <noreply@anthropic.com>
---
 .../python-modules/snakemake-interface-common/default.nix       | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/pkgs/development/python-modules/snakemake-interface-common/default.nix b/pkgs/development/python-modules/snakemake-interface-common/default.nix
index 11eafb41897a..6d75761241a1 100644
--- a/pkgs/development/python-modules/snakemake-interface-common/default.nix
+++ b/pkgs/development/python-modules/snakemake-interface-common/default.nix
@@ -10,6 +10,7 @@
   # dependencies
   argparse-dataclass,
   configargparse,
+  packaging,
 
   # tests
   pytestCheckHook,
@@ -48,6 +49,7 @@ buildPythonPackage (finalAttrs: {
   dependencies = [
     argparse-dataclass
     configargparse
+    packaging
   ];
 
   pythonImportsCheck = [ "snakemake_interface_common" ];

From 61fb61cd303c4c8a3c6ac8e01fb564ec3bbe2f7c Mon Sep 17 00:00:00 2001
From: Dmitry Kalinkin <dmitry.kalinkin@gmail.com>
Date: Sun, 27 Sep 2026 19:10:04 -0400
Subject: [PATCH 22/78] python3Packages.xrootd: fix VERSION

Assisted-by: GLM 5.3 Flash <noreply@z.ai>
---
 pkgs/development/python-modules/xrootd/default.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/development/python-modules/xrootd/default.nix b/pkgs/development/python-modules/xrootd/default.nix
index 685b35a092c9..b05703719bd5 100644
--- a/pkgs/development/python-modules/xrootd/default.nix
+++ b/pkgs/development/python-modules/xrootd/default.nix
@@ -14,6 +14,16 @@ buildPythonPackage rec {
 
   sourceRoot = "${src.name}/python";
 
+  # The VERSION file exported from the upstream git repository contains an
+  # unexpanded `$Format:%(describe)$` placeholder, and there is no git
+  # repository available to `git describe`, so upstream's `get_version()`
+  # would fall back to a `5.9-rc<date>` development version and fail the
+  # pythonMetadataCheckPhase. Write the actual version instead.
+  postPatch = ''
+    rm VERSION
+    echo -n "${xrootd.version}" > VERSION
+  '';
+
   env.CMAKE_ARGS = lib.toString [
     (lib.cmakeFeature "XRootD_INCLUDE_DIR" "${lib.getDev xrootd}/include/xrootd;${src}/src")
   ];

From 738932478804e48eef5b82d4d4934c0e182ee960 Mon Sep 17 00:00:00 2001
From: Dmitry Kalinkin <dmitry.kalinkin@gmail.com>
Date: Sun, 27 Sep 2026 19:12:27 -0400
Subject: [PATCH 23/78] python3Packages.snakemake-storage-plugin-xrootd: fix
 checkPhase

Assisted-by: GLM 5.3 Flash <noreply@z.ai>
---
 .../snakemake-storage-plugin-xrootd/default.nix    | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/snakemake-storage-plugin-xrootd/default.nix b/pkgs/development/python-modules/snakemake-storage-plugin-xrootd/default.nix
index 75e11a4fdc05..37fa04bf8952 100644
--- a/pkgs/development/python-modules/snakemake-storage-plugin-xrootd/default.nix
+++ b/pkgs/development/python-modules/snakemake-storage-plugin-xrootd/default.nix
@@ -20,9 +20,17 @@
   snakemake,
 }:
 
+# xrootd only exports "/tmp" by default, but pytest's tmp_path is under
+# $TMPDIR, so stat and directory-listing requests on test files would be
+# rejected with "[3010] ... is disallowed" unless we export more.
+let
+  serverConfig = pkgs.writers.writeText "xrootd-test-server.cfg" ''
+    all.export /
+  '';
+in
 buildPythonPackage (finalAttrs: {
   pname = "snakemake-storage-plugin-xrootd";
-  version = "1.1.0";
+  version = "1.2.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -30,14 +38,14 @@ buildPythonPackage (finalAttrs: {
     owner = "snakemake";
     repo = "snakemake-storage-plugin-xrootd";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vL9JD9h0ywsKpUPoXhgg6b+vwi7kxK8CF3L6HnAEidE=";
+    hash = "sha256-r4FCGSMJD/PijfExaV1Ps4NaxWMsvlqyBYCt73ENiJQ=";
   };
 
   postPatch = ''
     substituteInPlace tests/tests.py \
       --replace-fail \
         'subprocess.Popen(["xrootd",' \
-        'subprocess.Popen(["${lib.getExe pkgs.xrootd}",'
+        'subprocess.Popen(["${lib.getExe pkgs.xrootd}", "-c", "${serverConfig}",'
   '';
 
   build-system = [

From 874e644f78951f4247d9ba85bee1bfe47335b43c Mon Sep 17 00:00:00 2001
From: Pratham Patel <prathampatel@thefossguy.com>
Date: Thu, 24 Sep 2026 01:38:15 +0530
Subject: [PATCH 24/78] python3Packages.bitsandbytes: fix missing
 `cudaPackages.cuda_crt` dependency

---
 .../python-modules/bitsandbytes/default.nix   | 27 ++++++++++---------
 1 file changed, 15 insertions(+), 12 deletions(-)

diff --git a/pkgs/development/python-modules/bitsandbytes/default.nix b/pkgs/development/python-modules/bitsandbytes/default.nix
index 3803a930476d..cdfe52f85815 100644
--- a/pkgs/development/python-modules/bitsandbytes/default.nix
+++ b/pkgs/development/python-modules/bitsandbytes/default.nix
@@ -40,18 +40,21 @@ let
 
   # NOTE: torchvision doesn't use cudnn; torch does!
   #   For this reason it is not included.
-  cuda-common-redist = with cudaPackages; [
-    (lib.getDev cccl) # <thrust/*>
-    (lib.getDev libcublas) # cublas_v2.h
-    (lib.getLib libcublas)
-    (lib.getInclude libcublas) # cublasLt.h
-    libcurand
-    libcusolver # cusolverDn.h
-    (lib.getDev libcusparse) # cusparse.h
-    (lib.getLib libcusparse) # cusparse.h
-    (lib.getInclude libcusparse) # cusparse.h
-    (lib.getDev cuda_cudart) # cuda_runtime.h cuda_runtime_api.h
-  ];
+  cuda-common-redist =
+    with cudaPackages;
+    [
+      (lib.getDev cccl) # <thrust/*>
+      (lib.getDev libcublas) # cublas_v2.h
+      (lib.getLib libcublas)
+      (lib.getInclude libcublas) # cublasLt.h
+      libcurand
+      libcusolver # cusolverDn.h
+      (lib.getDev libcusparse) # cusparse.h
+      (lib.getLib libcusparse) # cusparse.h
+      (lib.getInclude libcusparse) # cusparse.h
+      (lib.getDev cuda_cudart) # cuda_runtime.h cuda_runtime_api.h
+    ]
+    ++ lib.optionals cudaPackages.cuda_crt.meta.available [ cuda_crt ];
 
   cuda-native-redist = symlinkJoin {
     name = "cuda-native-redist-${cudaMajorMinorVersion}";

From 53368652a7ae6a7101994f9bbcdbdba2ee50d699 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 1 Oct 2026 04:17:43 +0000
Subject: [PATCH 25/78] pbm: 1.5.0 -> 1.5.1

---
 pkgs/by-name/pb/pbm/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pb/pbm/package.nix b/pkgs/by-name/pb/pbm/package.nix
index 55ae92949bd3..eea34423e351 100644
--- a/pkgs/by-name/pb/pbm/package.nix
+++ b/pkgs/by-name/pb/pbm/package.nix
@@ -2,9 +2,9 @@
 
 buildDotnetGlobalTool {
   pname = "pbm";
-  version = "1.5.0";
+  version = "1.5.1";
 
-  nugetHash = "sha256-MDsu9+EtgiDXPHKDMkbfzekPts064g39tbGJj9vSGMc=";
+  nugetHash = "sha256-8H4qT1BMvLf3CogaEUF3mYJIeChQZH+xeZsGUlkePBQ=";
 
   meta = {
     description = "CLI for managing Akka.NET applications and Akka.NET Clusters";

From e88be3fda3fb793e736ecdfc4335c9b57f794bf1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Thu, 1 Oct 2026 21:33:51 +0200
Subject: [PATCH 26/78] python3Packages.jupyter-server: disable some timing
 sensitive tests

---
 pkgs/development/python-modules/jupyter-server/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/python-modules/jupyter-server/default.nix b/pkgs/development/python-modules/jupyter-server/default.nix
index cfa5548cb5b6..68ed8b34f211 100644
--- a/pkgs/development/python-modules/jupyter-server/default.nix
+++ b/pkgs/development/python-modules/jupyter-server/default.nix
@@ -130,6 +130,9 @@ buildPythonPackage (finalAttrs: {
     # nbconvert failed: `relax_add_props` kwargs of validate has been
     # deprecated for security reasons, and will be removed soon.
     "tests/nbconvert/test_handlers.py"
+    # timing sensitive
+    "tests/services/contents/test_manager.py::test_created_timestamp"
+    "tests/services/kernels/test_connection.py::test_disconnect_resolves_orphaned_kernel_info_future"
   ];
 
   __darwinAllowLocalNetworking = true;

From 0e3848bb7a6efd61a61bd5f34af37276b89d9198 Mon Sep 17 00:00:00 2001
From: toonn <toonn@toonn.io>
Date: Tue, 24 Feb 2026 12:16:18 +0100
Subject: [PATCH 27/78] joypixels: Change back to distribution-specific
 licenses

The font has been updated, the licenses include the version, the general
license we switched to because the distribution-specific ones is now
outdated so we're switching back.

Also change to the plain text versions that are available because
they're smaller, simpler and potentially machine-readable.
---
 pkgs/by-name/jo/joypixels/package.nix | 37 +++++++++++++++++----------
 1 file changed, 24 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/jo/joypixels/package.nix b/pkgs/by-name/jo/joypixels/package.nix
index 00229fc6b659..caf74efdda80 100644
--- a/pkgs/by-name/jo/joypixels/package.nix
+++ b/pkgs/by-name/jo/joypixels/package.nix
@@ -23,20 +23,31 @@ let
       fontFile = "joypixels-android.ttf";
     };
 
-  joypixels-free-license = lib.licenses.mkLicense {
-    shortName = "JoyPixels-Free";
-    fullName = "JoyPixels Free License Agreement";
-    url = "https://cdn.joypixels.com/free-license.pdf";
-    free = false;
-  };
+  joypixels-free-license =
+    let
+      inherit (systemSpecific) systemTag;
+    in
+    lib.licenses.mkLicense {
+      shortName = "JoyPixels-Free";
+      fullName = "JoyPixels Free License Agreement";
+      url = "https://cdn.joypixels.com/distributions/${systemTag}/license/free-license.txt";
+      free = false;
+    };
 
-  joypixels-license-appendix = lib.licenses.mkLicense {
-    shortName = "JoyPixels-NixOS-Appendix";
-    fullName = "JoyPixels ${systemSpecific.capitalized} License Appendix";
-    url = "https://cdn.joypixels.com/distributions/${systemSpecific.systemTag}/appendix/joypixels-license-appendix.pdf";
-    free = false;
-    redistributable = true;
-  };
+  joypixels-license-appendix =
+    let
+      inherit (systemSpecific)
+        capitalized
+        systemTag
+        ;
+    in
+    lib.licenses.mkLicense {
+      shortName = "JoyPixels-NixOS-Appendix";
+      fullName = "JoyPixels ${capitalized} License Appendix";
+      url = "https://cdn.joypixels.com/distributions/${systemTag}/appendix/joypixels-license-appendix.txt";
+      free = false;
+      redistributable = true;
+    };
 
   throwLicense = throw ''
     Use of the JoyPixels font requires acceptance of the license.

From 29a9f533d0844c829bebc9c63442e8dc9a3bac51 Mon Sep 17 00:00:00 2001
From: toonn <toonn@toonn.io>
Date: Fri, 2 Oct 2026 13:54:47 +0200
Subject: [PATCH 28/78] joypixels: 9.0.0 -> 11.0.0

---
 pkgs/by-name/jo/joypixels/package.nix | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/jo/joypixels/package.nix b/pkgs/by-name/jo/joypixels/package.nix
index caf74efdda80..4630cbb39ff7 100644
--- a/pkgs/by-name/jo/joypixels/package.nix
+++ b/pkgs/by-name/jo/joypixels/package.nix
@@ -14,7 +14,7 @@ let
       darwin = rec {
         systemTag = "nix-darwin";
         capitalized = systemTag;
-        fontFile = "JoyPixels-SBIX.ttf";
+        fontFile = "joypixels-sbix.ttf";
       };
     }
     .${kernel.name} or {
@@ -78,7 +78,7 @@ in
 
 stdenv.mkDerivation rec {
   pname = "joypixels";
-  version = "9.0.0";
+  version = "11.0.0";
 
   src =
     assert !acceptLicense -> throwLicense;
@@ -88,9 +88,9 @@ stdenv.mkDerivation rec {
       url = "https://cdn.joypixels.com/distributions/${systemTag}/font/${version}/${fontFile}";
       sha256 =
         {
-          darwin = "sha256-muUxXzz8BePyPsiZocYvM0ebM1H+u84ysN5YUvsMLiU=";
+          darwin = "sha256-NDxhHgnHDenHict39V4W8mLJIqpmBfmDYfsRx7Es06s=";
         }
-        .${kernel.name} or "sha256-pmGsVgYSK/c5OlhOXhNlRBs/XppMXmsHcZeSmIkuED4=";
+        .${kernel.name} or "sha256-taHKy2rin1SE24BKnB8LZ662U8MO9HL5if3+mHQ38Io=";
     };
 
   dontUnpack = true;
@@ -106,10 +106,7 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Finest emoji you can use legally (formerly EmojiOne)";
     longDescription = ''
-      Updated for 2024! JoyPixels 9.0 includes 3,820 originally crafted icon
-      designs and is 100% Unicode 15.1 compatible. We offer the largest
-      selection of files ranging from png, svg, iconjar, and fonts (sprites
-      available upon request).
+      Updated for 2026! 3,991 originally-crafted emoji, Unicode 17 compatible.
     '';
     homepage = "https://www.joypixels.com/fonts";
     hydraPlatforms = [ ]; # Just a binary file download, nothing to cache.

From 23627ff1b89f18b4e1f406766bed4b5888c25127 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 2 Oct 2026 18:39:58 +0000
Subject: [PATCH 29/78] uv: 0.12.17 -> 0.12.22

---
 pkgs/by-name/uv/uv/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/uv/uv/package.nix b/pkgs/by-name/uv/uv/package.nix
index 1389fa027df6..640e72e67a57 100644
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@@ -18,17 +18,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "uv";
-  version = "0.12.17";
+  version = "0.12.22";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "astral-sh";
     repo = "uv";
     tag = finalAttrs.version;
-    hash = "sha256-e/AA9/Uou8c1usaVxGc/kzHSo5bzJOmupWOGk7L8+KI=";
+    hash = "sha256-lgGB9kO3+xnm1Tob+PflpiZRLW7a6Gvim3qVKc6JceY=";
   };
 
-  cargoHash = "sha256-6AKm5l3snX1gmN5uAp0N9NVFd0nPBdtHz8WwZiFoYPU=";
+  cargoHash = "sha256-IC7rbCcUf7U33pNGZRfHLeXAcTLIYJJ6iSj9LFcWIy4=";
 
   buildInputs = [
     rust-jemalloc-sys

From e456686a44484aa206e915fb28363b50c940bf62 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Sat, 3 Oct 2026 09:09:45 +0800
Subject: [PATCH 30/78] mint-l-icons: 1.8.3 -> 1.8.4

https://github.com/linuxmint/mint-l-icons/compare/ddb43425b35aaf15a8d5ba74059b5b72c2a383e2...0b22e7cc69f11e8472065cfc9309add51f403cfc
---
 pkgs/by-name/mi/mint-l-icons/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mi/mint-l-icons/package.nix b/pkgs/by-name/mi/mint-l-icons/package.nix
index f743c92c4bb4..64858409ae99 100644
--- a/pkgs/by-name/mi/mint-l-icons/package.nix
+++ b/pkgs/by-name/mi/mint-l-icons/package.nix
@@ -9,14 +9,14 @@
 
 stdenvNoCC.mkDerivation {
   pname = "mint-l-icons";
-  version = "1.8.3";
+  version = "1.8.4";
 
   src = fetchFromGitHub {
     owner = "linuxmint";
     repo = "mint-l-icons";
     # They don't really do tags, this is just a named commit.
-    rev = "ddb43425b35aaf15a8d5ba74059b5b72c2a383e2";
-    hash = "sha256-Vfhlor9RZpDc7zLs90hRreZco3uR/OmoH3QQvMg0kVk=";
+    rev = "0b22e7cc69f11e8472065cfc9309add51f403cfc";
+    hash = "sha256-AtCQMgSmeMV7rU6XaT42bD4DDfe5acVIxQ1JwKYQb8c=";
   };
 
   propagatedBuildInputs = [

From a364bddd4fb9ae3c3b3a62b610f60beb437c430a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 3 Oct 2026 08:37:42 +0000
Subject: [PATCH 31/78] spicetify-cli: 2.45.1 -> 2.45.3

---
 pkgs/by-name/sp/spicetify-cli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sp/spicetify-cli/package.nix b/pkgs/by-name/sp/spicetify-cli/package.nix
index af80feed4008..1f3a70e6b7c6 100644
--- a/pkgs/by-name/sp/spicetify-cli/package.nix
+++ b/pkgs/by-name/sp/spicetify-cli/package.nix
@@ -9,16 +9,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "spicetify-cli";
-  version = "2.45.1";
+  version = "2.45.3";
 
   src = fetchFromGitHub {
     owner = "spicetify";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Mu97p0HlvmEMkPV/VvHztJ1VqocxXoAXRtDKLGYd9mk=";
+    hash = "sha256-+EsZHr9cJDvSlYnwlmLjv0iT6s6gpMCd3+RKl0pUbFM=";
   };
 
-  vendorHash = "sha256-nrUaocs+so35MDxC6TkRSakYKWmhoysrvhE6fXRvYco=";
+  vendorHash = "sha256-1yoFdrSgKB1kWtt7wz/gzNvl+v8v9Z/Ab3Kegb/5Q7M=";
 
   postPatch = ''
     substituteInPlace src/preprocess/preprocess.go \

From 4d43d16e5d6184b7b8393d3c6c8e4782c070c1be Mon Sep 17 00:00:00 2001
From: Yifei Sun <ysun@hey.com>
Date: Thu, 1 Oct 2026 23:14:34 +0200
Subject: [PATCH 32/78] caddy: 2.11.4 -> 2.11.7

---
 pkgs/by-name/ca/caddy/package.nix      | 73 +++++++++++++++-----------
 pkgs/by-name/ca/caddy/plugins.nix      |  9 ++++
 pkgs/by-name/ca/caddy/plugins.test.nix |  2 +-
 3 files changed, 51 insertions(+), 33 deletions(-)

diff --git a/pkgs/by-name/ca/caddy/package.nix b/pkgs/by-name/ca/caddy/package.nix
index 0f544a4b22e9..23e44398b09f 100644
--- a/pkgs/by-name/ca/caddy/package.nix
+++ b/pkgs/by-name/ca/caddy/package.nix
@@ -1,37 +1,39 @@
 {
   lib,
-  buildGoModule,
+  stdenv,
+  buildPackages,
   callPackage,
+  buildGoModule,
   fetchFromGitHub,
+  installShellFiles,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
   testers,
   nixosTests,
-  caddy,
-  installShellFiles,
-  stdenv,
-  writableTmpDirAsHomeHook,
-  versionCheckHook,
+  nix-update-script,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "caddy";
-  version = "2.11.4";
+  version = "2.11.7";
 
   __structuredAttrs = true;
 
+  __darwinAllowLocalNetworking = true;
+
   src = fetchFromGitHub {
     owner = "caddyserver";
     repo = "caddy";
     tag = "v${finalAttrs.version}";
     # remember to update hashes for `dist` and `plugins` test!
-    hash = "sha256-wzk8KRZfDCbbjRlBwkoKAoMjOhV4xF3yuXUueqtl1xM=";
+    hash = "sha256-6+USPwF6LzDWUjrNRL2ncxSz5KmqJM0L/6o03Lh8YD8=";
   };
 
-  vendorHash = "sha256-2GwSM7EKN9GwN6kte7CekpXIJ0vzHhhsnrs3TC6vTW4=";
+  vendorHash = "sha256-kJOl5h9gSfEK6ROT/MYOkBUr6MhiNBlbZVZPqwNpbBk=";
 
   ldflags = [
     "-s"
-    "-w"
-    "-X github.com/caddyserver/caddy/v2.CustomVersion=${finalAttrs.version}"
+    "-X github.com/caddyserver/caddy/v2.CustomVersion=v${finalAttrs.version}"
   ];
 
   # matches upstream since v2.8.0
@@ -45,44 +47,51 @@ buildGoModule (finalAttrs: {
 
   nativeCheckInputs = [ writableTmpDirAsHomeHook ];
 
-  __darwinAllowLocalNetworking = true;
+  checkFlags = [ "-skip=^TestReverseProxySNIPlaceHolder$" ];
 
   postInstall = ''
     install -Dm644 ${finalAttrs.passthru.dist}/init/caddy.service ${finalAttrs.passthru.dist}/init/caddy-api.service -t $out/lib/systemd/system
 
-    substituteInPlace $out/lib/systemd/system/caddy.service \
-      --replace-fail "/usr/bin/caddy" "$out/bin/caddy"
-    substituteInPlace $out/lib/systemd/system/caddy-api.service \
+    substituteInPlace $out/lib/systemd/system/caddy.service $out/lib/systemd/system/caddy-api.service \
       --replace-fail "/usr/bin/caddy" "$out/bin/caddy"
   ''
-  + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-    # Generating man pages and completions fail on cross-compilation
-    # https://github.com/NixOS/nixpkgs/issues/308283
+  + lib.optionalString (stdenv.hostPlatform.emulatorAvailable buildPackages) (
+    let
+      emulator = stdenv.hostPlatform.emulator buildPackages;
+    in
+    ''
+      ${emulator} $out/bin/caddy manpage --directory manpages
+      installManPage manpages/*
 
-    $out/bin/caddy manpage --directory manpages
-    installManPage manpages/*
-
-    installShellCompletion --cmd caddy \
-      --bash <($out/bin/caddy completion bash) \
-      --fish <($out/bin/caddy completion fish) \
-      --zsh <($out/bin/caddy completion zsh)
-  '';
+      installShellCompletion --cmd caddy \
+        --bash <(${emulator} $out/bin/caddy completion bash) \
+        --fish <(${emulator} $out/bin/caddy completion fish) \
+        --zsh <(${emulator} $out/bin/caddy completion zsh)
+    ''
+  );
 
   doInstallCheck = true;
-  nativeInstallCheckInputs = [
-    writableTmpDirAsHomeHook
-    versionCheckHook
-  ];
   versionCheckKeepEnvironment = [ "HOME" ];
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
 
   passthru = {
-    withPlugins = callPackage ./plugins.nix { inherit caddy; };
+    withPlugins = callPackage ./plugins.nix { caddy = finalAttrs.finalPackage; };
 
     dist = fetchFromGitHub {
       owner = "caddyserver";
       repo = "dist";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-oRQfQH1GKjAjVMj+dZo1f1+HOaOdJIyEfod0iGLYcc8=";
+      hash = "sha256-KvdaqiX06I1ft+p67J1ISgP512SoZ4syDzfe888ZqGI=";
+    };
+
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--custom-dep"
+        "dist"
+      ];
     };
 
     tests = {
diff --git a/pkgs/by-name/ca/caddy/plugins.nix b/pkgs/by-name/ca/caddy/plugins.nix
index 2b0910f848ba..2dfb72c98028 100644
--- a/pkgs/by-name/ca/caddy/plugins.nix
+++ b/pkgs/by-name/ca/caddy/plugins.nix
@@ -63,6 +63,15 @@ caddy.overrideAttrs (
         git
       ];
       dontUnpack = true;
+
+      env.GOTOOLCHAIN = "local";
+
+      impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
+        "GIT_PROXY_COMMAND"
+        "SOCKS_SERVER"
+        "GOPROXY"
+      ];
+
       buildPhase =
         let
           withArgs = concatMapStrings (plugin: "--with ${plugin} ") pluginsSorted;
diff --git a/pkgs/by-name/ca/caddy/plugins.test.nix b/pkgs/by-name/ca/caddy/plugins.test.nix
index 7c223c860436..e34d19fa25b4 100644
--- a/pkgs/by-name/ca/caddy/plugins.test.nix
+++ b/pkgs/by-name/ca/caddy/plugins.test.nix
@@ -14,7 +14,7 @@
 
         package = pkgs.caddy.withPlugins {
           plugins = [ "github.com/caddyserver/replace-response@v0.0.0-20250618171559-80962887e4c6" ];
-          hash = "sha256-oj0IpspxslpNZbJFsexh0W2Sja19XRUsbShoCuY6qkQ=";
+          hash = "sha256-ZXv/2HW/tiUl9/1xmVjZHjCeuLZknVWN7hM20uJXPto=";
         };
 
         globalConfig = ''

From d8cd5d645718e99d2071b4ef3286b95d01d3f3aa Mon Sep 17 00:00:00 2001
From: Yifei Sun <ysun@hey.com>
Date: Thu, 1 Oct 2026 23:39:59 +0200
Subject: [PATCH 33/78] xcaddy: 0.4.6 -> 0.4.7

---
 pkgs/by-name/ca/caddy/plugins.test.nix        |  2 +-
 .../xc/xcaddy/inject_version_info.diff        | 16 --------------
 pkgs/by-name/xc/xcaddy/package.nix            | 22 +++++++++----------
 .../xc/xcaddy/use_tmpdir_on_darwin.diff       | 13 -----------
 4 files changed, 12 insertions(+), 41 deletions(-)
 delete mode 100644 pkgs/by-name/xc/xcaddy/inject_version_info.diff
 delete mode 100644 pkgs/by-name/xc/xcaddy/use_tmpdir_on_darwin.diff

diff --git a/pkgs/by-name/ca/caddy/plugins.test.nix b/pkgs/by-name/ca/caddy/plugins.test.nix
index e34d19fa25b4..70bb530a8480 100644
--- a/pkgs/by-name/ca/caddy/plugins.test.nix
+++ b/pkgs/by-name/ca/caddy/plugins.test.nix
@@ -14,7 +14,7 @@
 
         package = pkgs.caddy.withPlugins {
           plugins = [ "github.com/caddyserver/replace-response@v0.0.0-20250618171559-80962887e4c6" ];
-          hash = "sha256-ZXv/2HW/tiUl9/1xmVjZHjCeuLZknVWN7hM20uJXPto=";
+          hash = "sha256-RvnrhgktjwNkG/3/th2q/ec6g7fMfGn6qLlGcz2B4TI=";
         };
 
         globalConfig = ''
diff --git a/pkgs/by-name/xc/xcaddy/inject_version_info.diff b/pkgs/by-name/xc/xcaddy/inject_version_info.diff
deleted file mode 100644
index 4d87aa687878..000000000000
--- a/pkgs/by-name/xc/xcaddy/inject_version_info.diff
+++ /dev/null
@@ -1,16 +0,0 @@
-diff --git a/cmd/main.go b/cmd/main.go
-index ede7cd8..c553140 100644
---- a/cmd/main.go
-+++ b/cmd/main.go
-@@ -401,8 +401,11 @@ func splitWith(arg string) (module, version, replace string, err error) {
- 	return
- }
-
-+var customVersion string
-+
- // xcaddyVersion returns a detailed version string, if available.
- func xcaddyVersion() string {
-+	return customVersion
- 	mod := goModule()
- 	ver := mod.Version
- 	if mod.Sum != "" {
diff --git a/pkgs/by-name/xc/xcaddy/package.nix b/pkgs/by-name/xc/xcaddy/package.nix
index c73018fc6f83..ae92e2b86dab 100644
--- a/pkgs/by-name/xc/xcaddy/package.nix
+++ b/pkgs/by-name/xc/xcaddy/package.nix
@@ -2,33 +2,33 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  versionCheckHook,
 }:
 
 buildGoModule (finalAttrs: {
   pname = "xcaddy";
-  version = "0.4.6";
+  version = "0.4.7";
+
+  __structuredAttrs = true;
 
   subPackages = [ "cmd/xcaddy" ];
 
   src = fetchFromGitHub {
     owner = "caddyserver";
     repo = "xcaddy";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-SXCOKrGaTwcdrVhPenQGjdBaDl8/bUGmm1B3spk8eUA=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-q69Ey6gf/Uyui9x3nKkGFHiwTpMB0N3ix89JLgTsR1A=";
   };
 
-  patches = [
-    ./inject_version_info.diff
-    ./use_tmpdir_on_darwin.diff
-  ];
-
   ldflags = [
     "-s"
-    "-w"
-    "-X github.com/caddyserver/xcaddy/cmd.customVersion=v${finalAttrs.version}"
+    "-X github.com/caddyserver/xcaddy/cmd.CustomVersion=v${finalAttrs.version}"
   ];
 
-  vendorHash = "sha256-K5+Gj4Lqla6q9vx95BtCS67mZMWkMjgIHVYpBUdx/Wc=";
+  vendorHash = "sha256-bZs+2XrwVwfJdNLBZk6FPNi26ctVQ82ywesEU0o5Gkc=";
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
 
   meta = {
     homepage = "https://github.com/caddyserver/xcaddy";
diff --git a/pkgs/by-name/xc/xcaddy/use_tmpdir_on_darwin.diff b/pkgs/by-name/xc/xcaddy/use_tmpdir_on_darwin.diff
deleted file mode 100644
index 064d8feb5a05..000000000000
--- a/pkgs/by-name/xc/xcaddy/use_tmpdir_on_darwin.diff
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/builder.go b/builder.go
-index ed6c5ef..36e8055 100644
---- a/builder.go
-+++ b/builder.go
-@@ -200,7 +200,7 @@ func NewReplace(old, new string) Replace {
- // It is the caller's responsibility to remove the folder when finished.
- func newTempFolder() (string, error) {
- 	var parentDir string
--	if runtime.GOOS == "darwin" {
-+	if false && runtime.GOOS == "darwin" {
- 		// After upgrading to macOS High Sierra, Caddy builds mysteriously
- 		// started missing the embedded version information that -ldflags
- 		// was supposed to produce. But it only happened on macOS after

From 3cab97006ce4e4860a59961ebcd92b39034040a2 Mon Sep 17 00:00:00 2001
From: Yifei Sun <ysun@hey.com>
Date: Thu, 1 Oct 2026 23:40:52 +0200
Subject: [PATCH 34/78] xcaddy: add stepbrobd to maintainers

---
 pkgs/by-name/xc/xcaddy/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/xc/xcaddy/package.nix b/pkgs/by-name/xc/xcaddy/package.nix
index ae92e2b86dab..2bbe2ff01cec 100644
--- a/pkgs/by-name/xc/xcaddy/package.nix
+++ b/pkgs/by-name/xc/xcaddy/package.nix
@@ -35,5 +35,6 @@ buildGoModule (finalAttrs: {
     description = "Build Caddy with plugins";
     mainProgram = "xcaddy";
     license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.stepbrobd ];
   };
 })

From 840e6b84725cd4044b7d246e90ee0db47fe22a09 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 3 Oct 2026 12:46:09 +0000
Subject: [PATCH 35/78] xbyak: 7.42 -> 7.43

---
 pkgs/by-name/xb/xbyak/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/xb/xbyak/package.nix b/pkgs/by-name/xb/xbyak/package.nix
index 29bf13f167c4..d878585d5c1b 100644
--- a/pkgs/by-name/xb/xbyak/package.nix
+++ b/pkgs/by-name/xb/xbyak/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "xbyak";
-  version = "7.42";
+  version = "7.43";
 
   src = fetchFromGitHub {
     owner = "herumi";
     repo = "xbyak";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GwsHEjqUBExb4pIZ6Z6YWGka0Fx3Qby4YYG0Otm6OAw=";
+    hash = "sha256-y4RhUuKMJgcG+NaQxhUn+7v2pHo8wfsd/AYjJEUtXR4=";
   };
 
   nativeBuildInputs = [ cmake ];

From bbcc151aa79726c1fe126e9708f3525a9bb2a733 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 16 Sep 2026 12:06:56 +0000
Subject: [PATCH 36/78] hydra: 0-unstable-2026-03-16 -> 0-unstable-2026-09-09

Hydra's queue runner and evaluator have been rewritten in Rust and moved
into their own subprojects, so this package is now just the Perl web
application and its data files. The C++ toolchain along with libpqxx,
boost and prometheus-cpp are gone with them.

Nix dropped its Perl bindings in 2.35 and Hydra took over maintaining
them, so nix-perl is built here from the same source tree.

Upstream pins Nix 2.35 again, which lets the nix-eval-jobs override go.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WXgarR6c1r5vvR3FSAUGjP
---
 pkgs/by-name/hy/hydra/nix-perl.nix |  74 ++++++++
 pkgs/by-name/hy/hydra/package.nix  | 268 +++++++++++++----------------
 2 files changed, 189 insertions(+), 153 deletions(-)
 create mode 100644 pkgs/by-name/hy/hydra/nix-perl.nix

diff --git a/pkgs/by-name/hy/hydra/nix-perl.nix b/pkgs/by-name/hy/hydra/nix-perl.nix
new file mode 100644
index 000000000000..37260bc71c80
--- /dev/null
+++ b/pkgs/by-name/hy/hydra/nix-perl.nix
@@ -0,0 +1,74 @@
+# Nix's Perl bindings. They were dropped from Nix itself in 2.35 and are now
+# maintained in the Hydra repository:
+# https://github.com/NixOS/hydra/commit/1dd13469091cd25656cfa0db4b8a353c1a2c26e7
+{
+  lib,
+  stdenv,
+  src,
+  meson,
+  ninja,
+  nix-store,
+  perl,
+  perlPackages,
+  pkg-config,
+}:
+perl.pkgs.toPerlModule (
+  stdenv.mkDerivation (finalAttrs: {
+    pname = "nix-perl";
+    inherit (nix-store) version;
+    inherit src;
+
+    __structuredAttrs = true;
+    strictDeps = true;
+
+    sourceRoot = "${finalAttrs.src.name}/subprojects/nix-perl";
+
+    nativeBuildInputs = [
+      meson
+      ninja
+      perl
+      pkg-config
+    ];
+
+    buildInputs = [
+      nix-store
+      # We compile against perl's CORE headers, which `#include <crypt.h>` from
+      # the `libxcrypt` perl propagates.
+      perl
+      perlPackages.DBDSQLite
+      perlPackages.DBI
+    ];
+
+    preConfigure = ''
+      echo ${finalAttrs.version} > .version
+    ''
+    # Upstream's `meson.build` compiles `Store.xs` against perl's `CORE` headers but without perl's
+    # own `ccflags`.
+    # Some of those (e.g. `-DNO_POSIX_2008_LOCALE` on Darwin) change the layout of
+    # `PerlInterpreter`, so the module then fails the XS handshake on load.
+    + ''
+      export NIX_CFLAGS_COMPILE+=" $(perl -MConfig -e 'print join " ", grep { /^-D/ } split " ", $Config{ccflags}')"
+    '';
+
+    mesonBuildType = "release";
+
+    mesonFlags = [
+      (lib.mesonEnable "tests" finalAttrs.finalPackage.doCheck)
+    ];
+
+    mesonCheckFlags = [ "--print-errorlogs" ];
+
+    doCheck = true;
+
+    nativeCheckInputs = [
+      perlPackages.Test2Harness
+    ];
+
+    meta = {
+      description = "Perl bindings for the Nix store, as maintained in the Hydra repository";
+      homepage = "https://github.com/NixOS/hydra";
+      license = lib.licenses.lgpl21Plus;
+      platforms = lib.platforms.unix;
+    };
+  })
+)
diff --git a/pkgs/by-name/hy/hydra/package.nix b/pkgs/by-name/hy/hydra/package.nix
index 6574c94923b3..ce297c9b7ea1 100644
--- a/pkgs/by-name/hy/hydra/package.nix
+++ b/pkgs/by-name/hy/hydra/package.nix
@@ -1,77 +1,72 @@
 {
   stdenv,
   lib,
+  callPackage,
+  fetchFromGitHub,
   nixVersions,
+  nix-eval-jobs,
+  nixosTests,
   perlPackages,
   buildEnv,
+  unstableGitUpdater,
+
   makeWrapper,
-  unzip,
-  pkg-config,
-  libpqxx,
-  top-git,
-  mercurial,
-  darcs,
-  subversion,
-  breezy,
-  openssl,
-  bzip2,
-  libxslt,
-  perl,
-  postgresql,
-  prometheus-cpp,
-  nukeReferences,
-  git,
-  nlohmann_json,
-  openssh,
-  openldap,
-  gnused,
-  coreutils,
-  findutils,
-  gzip,
-  xz,
-  gnutar,
-  rpm,
-  dpkg,
-  cdrkit,
-  pixz,
-  boost,
   mdbook,
-  foreman,
-  python3,
-  netcat,
-  cacert,
-  glibcLocales,
   meson,
   ninja,
-  nix-eval-jobs,
-  fetchFromGitHub,
-  nixosTests,
-  unstableGitUpdater,
+  nukeReferences,
+  unzip,
+
+  bzip2,
+  perl,
+  pixz,
+
+  coreutils,
+  findutils,
+  gnused,
+  gnutar,
+  gzip,
+  openssh,
+  xz,
+
+  breezy,
+  darcs,
+  gitMinimal,
+  mercurial,
+  subversion,
+  top-git,
+
+  cdrkit,
+  dpkg,
+  rpm,
 }:
 
 let
-  # Need these pins until we bump past https://github.com/NixOS/hydra/pull/1828
-  nix = nixVersions.nix_2_34;
-  nixEvalJobsVersion = "2.34.3";
-  nix-eval-jobs_2_34 =
-    (nix-eval-jobs.override {
-      nixComponents = nixVersions.nixComponents_2_34;
-    }).overrideAttrs
-      {
-        version = nixEvalJobsVersion;
-        src = fetchFromGitHub {
-          owner = "NixOS";
-          repo = "nix-eval-jobs";
-          tag = "v${nixEvalJobsVersion}";
-          hash = "sha256-YaVQAgBxWbUBFHXLBLzdUyVvuA/DDw80SEnn9iq0Veo=";
-        };
-      };
+  # Keep in sync with the nix input of https://github.com/NixOS/hydra/blob/master/flake.nix
+  nixComponents = nixVersions.nixComponents_2_35;
+
+  version = "0-unstable-2026-09-09";
+
+  src = fetchFromGitHub {
+    owner = "NixOS";
+    repo = "hydra";
+    rev = "1d1d8b1c6fdc08444a514f383b291228f19d72d8";
+    hash = "sha256-wbPw1mlCrZODGxWFSXkOjCtKRWYeZYcs/W24yay3tKM=";
+  };
+
+  nix-perl = callPackage ./nix-perl.nix {
+    inherit src;
+    inherit (nixComponents) nix-store;
+  };
 
   perlDeps = buildEnv {
     name = "hydra-perl-deps";
-    paths =
-      with perlPackages;
-      lib.closePropagation [
+    paths = lib.closePropagation (
+      [
+        gitMinimal
+        nix-perl
+      ]
+      ++ (with perlPackages; [
         AuthenSASL
         CatalystActionREST
         CatalystAuthenticationStoreDBIxClass
@@ -84,21 +79,20 @@ let
         CatalystPluginSessionStateCookie
         CatalystPluginSessionStoreFastMmap
         CatalystPluginStackTrace
-        CatalystRuntime
         CatalystTraitForRequestProxyBase
         CatalystViewDownload
         CatalystViewJSON
         CatalystViewTT
-        CatalystXScriptServerStarman
         CatalystXRoleApplicator
+        CatalystXScriptServerStarman
         CryptPassphrase
         CryptPassphraseArgon2
         CryptRandPasswd
+        DataDump
+        DateTime
         DBDPg
         DBDSQLite
         DBIxClassHelpers
-        DataDump
-        DateTime
         DigestSHA1
         EmailMIME
         EmailSender
@@ -122,11 +116,10 @@ let
         NumberBytesHuman
         PadWalker
         ParallelForkManager
-        PerlCriticCommunity
         PrometheusTinyShared
         ReadonlyX
-        SQLSplitStatement
         SetScalar
+        SQLSplitStatement
         Starman
         StringCompareConstantTime
         SysHostnameLong
@@ -136,140 +129,109 @@ let
         TestPostgreSQL
         TextDiff
         TextTable
-        UUID4Tiny
+        URIdb
+        UUIDURandom
         XMLSimple
         YAML
-        (nix.libs.nix-perl-bindings or nix.perl-bindings or null)
-        git
-      ];
+      ])
+    );
   };
-
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "hydra";
-  version = "0-unstable-2026-03-16";
+  inherit version src;
   # nixpkgs-update: no auto update
 
-  src = fetchFromGitHub {
-    owner = "NixOS";
-    repo = "hydra";
-    rev = "a40d42862da88cce78a27dd594e1484a034aac4d";
-    hash = "sha256-8pttLK/JQiUL6EXJfjBtBggiLw+769JdQGrpM7klXdg=";
-  };
+  sourceRoot = "${finalAttrs.src.name}/subprojects/hydra";
 
   outputs = [
     "out"
     "doc"
   ];
 
-  buildInputs = [
-    unzip
-    libpqxx
-    top-git
-    mercurial
-    darcs
-    subversion
-    breezy
-    openssl
-    bzip2
-    libxslt
-    nix
-    perlDeps
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    makeWrapper
+    mdbook
+    meson
+    ninja
+    nukeReferences
     perl
-    pixz
-    boost
-    nlohmann_json
-    prometheus-cpp
+    perlDeps
+    unzip
+  ];
+
+  buildInputs = [
+    perl
+    perlDeps
   ];
 
   hydraPath = lib.makeBinPath (
     [
-      subversion
-      openssh
-      nix
-      nix-eval-jobs_2_34
-      coreutils
-      findutils
-      pixz
-      gzip
-      bzip2
-      xz
-      gnutar
-      unzip
-      git
-      top-git
-      mercurial
-      darcs
-      gnused
       breezy
+      bzip2
+      coreutils
+      darcs
+      findutils
+      gitMinimal
+      gnused
+      gnutar
+      gzip
+      mercurial
+      nix-eval-jobs
+      nixComponents.nix-cli
+      openssh
+      pixz
+      subversion
+      top-git
+      unzip
+      xz
     ]
     ++ lib.optionals stdenv.hostPlatform.isLinux [
-      rpm
-      dpkg
       cdrkit
+      dpkg
+      rpm
     ]
   );
 
-  nativeBuildInputs = [
-    meson
-    ninja
-    makeWrapper
-    pkg-config
-    mdbook
-    nukeReferences
-  ];
-
-  nativeCheckInputs = [
-    cacert
-    foreman
-    glibcLocales
-    python3
-    netcat
-    nix-eval-jobs_2_34
-    openldap
-    postgresql
-  ];
-
-  env = {
-    OPENLDAP_ROOT = openldap;
-  };
-
-  shellHook = ''
-    PATH=$(pwd)/src/script:$(pwd)/src/hydra-queue-runner:$(pwd)/src/hydra-evaluator:$PATH
-    PERL5LIB=$(pwd)/src/lib:$PERL5LIB;
-  '';
-
   mesonBuildType = "release";
 
   postPatch = ''
     patchShebangs .
   '';
 
-  preCheck = ''
-    export LOGNAME=''${LOGNAME:-foo}
-    # set $HOME for bzr so it can create its trace file
-    export HOME=$(mktemp -d)
+  # Tests live in subprojects/hydra-tests and need PostgreSQL plus the Rust
+  # daemons. Covered by nixosTests.hydra instead.
+  doCheck = false;
+
+  # subprojects/hydra-manual is a separate meson project upstream.
+  postBuild = ''
+    mdbook build ../../hydra-manual -d "$NIX_BUILD_TOP/manual"
   '';
 
   postInstall = ''
-    mkdir -p $out/nix-support
+    mkdir -p $doc/share/doc/hydra $out/nix-support
+    cp -r $NIX_BUILD_TOP/manual/. $doc/share/doc/hydra
+    echo "doc manual $doc/share/doc/hydra" >> $out/nix-support/hydra-build-products
+
     for i in $out/bin/*; do
         read -n 4 chars < $i
         if [[ $chars =~ ELF ]]; then continue; fi
         wrapProgram $i \
             --prefix PERL5LIB ':' "$out/libexec/hydra/lib:${perlPackages.makePerlPath [ perlDeps ]}" \
-            --prefix PATH ':' $out/bin:$hydraPath \
+            --prefix PATH ':' "$out/bin:$hydraPath" \
             --set-default HYDRA_RELEASE ${finalAttrs.version} \
             --set HYDRA_HOME $out/libexec/hydra \
-            --set NIX_RELEASE ${nix.name or "unknown"} \
-            --set NIX_EVAL_JOBS_RELEASE ${nix-eval-jobs_2_34.name or "unknown"}
+            --set NIX_RELEASE ${nixComponents.nix-cli.name or "unknown"} \
+            --set NIX_EVAL_JOBS_RELEASE ${nix-eval-jobs.name or "unknown"}
     done
   '';
 
-  doCheck = true;
-
   passthru = {
-    inherit nix perlDeps;
+    inherit nix-perl perlDeps;
+    nix = nixComponents.nix-cli;
     tests = { inherit (nixosTests) hydra; };
     updateScript = unstableGitUpdater { };
   };
@@ -277,7 +239,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Nix-based continuous build system";
     homepage = "https://nixos.org/hydra";
-    license = lib.licenses.gpl3;
+    license = lib.licenses.gpl3Only;
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [
       conni2461

From a64e637ce75d789620636bc2bdae1565110aa0b1 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 16 Sep 2026 12:06:56 +0000
Subject: [PATCH 37/78] hydra-queue-runner: init at 0-unstable-2026-09-09

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WXgarR6c1r5vvR3FSAUGjP
---
 .../by-name/hy/hydra-queue-runner/package.nix | 53 +++++++++++++++++++
 1 file changed, 53 insertions(+)
 create mode 100644 pkgs/by-name/hy/hydra-queue-runner/package.nix

diff --git a/pkgs/by-name/hy/hydra-queue-runner/package.nix b/pkgs/by-name/hy/hydra-queue-runner/package.nix
new file mode 100644
index 000000000000..36fb68e20acd
--- /dev/null
+++ b/pkgs/by-name/hy/hydra-queue-runner/package.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  rustPlatform,
+  hydra,
+  pkg-config,
+  protobuf,
+  rust-jemalloc-sys,
+  nixosTests,
+  withOtel ? false,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "hydra-queue-runner";
+  inherit (hydra) version src;
+  __structuredAttrs = true;
+
+  cargoHash = "sha256-ULaL4B00O0ApZbBkv7GtLZWAoJI/ZNFPr+0FWsNp3OE=";
+
+  cargoBuildFlags = [
+    "--package"
+    "hydra-queue-runner"
+  ];
+
+  buildFeatures = lib.optional withOtel "otel";
+
+  nativeBuildInputs = [
+    pkg-config
+    protobuf
+  ];
+
+  buildInputs = [
+    protobuf
+    rust-jemalloc-sys
+  ];
+
+  # The unit tests spin up a PostgreSQL instance, which is not available in the sandbox.
+  doCheck = false;
+
+  passthru.tests = { inherit (nixosTests) hydra; };
+
+  meta = {
+    description = "Queue runner for the Nix-based continuous build system Hydra";
+    homepage = "https://github.com/NixOS/hydra";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "hydra-queue-runner";
+    maintainers = with lib.maintainers; [
+      conni2461
+      das_j
+      helsinki-Jo
+      mindavi
+    ];
+    platforms = lib.platforms.linux;
+  };
+})

From 49e3ad32894f6b0a299759b78f05f1169866b66d Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 16 Sep 2026 12:06:57 +0000
Subject: [PATCH 38/78] hydra-builder: init at 0-unstable-2026-09-09

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WXgarR6c1r5vvR3FSAUGjP
---
 pkgs/by-name/hy/hydra-builder/package.nix | 51 +++++++++++++++++++++++
 1 file changed, 51 insertions(+)
 create mode 100644 pkgs/by-name/hy/hydra-builder/package.nix

diff --git a/pkgs/by-name/hy/hydra-builder/package.nix b/pkgs/by-name/hy/hydra-builder/package.nix
new file mode 100644
index 000000000000..5a49a63a6ad8
--- /dev/null
+++ b/pkgs/by-name/hy/hydra-builder/package.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  rustPlatform,
+  hydra,
+  pkg-config,
+  protobuf,
+  rust-jemalloc-sys,
+  withOtel ? false,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "hydra-builder";
+  inherit (hydra) version src;
+  __structuredAttrs = true;
+
+  cargoHash = "sha256-ULaL4B00O0ApZbBkv7GtLZWAoJI/ZNFPr+0FWsNp3OE=";
+
+  cargoBuildFlags = [
+    "--package"
+    "hydra-builder"
+  ];
+
+  buildFeatures = lib.optional withOtel "otel";
+
+  nativeBuildInputs = [
+    pkg-config
+    protobuf
+  ];
+
+  buildInputs = [
+    protobuf
+    rust-jemalloc-sys
+  ];
+
+  # The unit tests spin up a PostgreSQL instance, which is not available in the
+  # sandbox.
+  doCheck = false;
+
+  meta = {
+    description = "Build agent for the Nix-based continuous build system Hydra";
+    homepage = "https://github.com/NixOS/hydra";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "hydra-builder";
+    maintainers = with lib.maintainers; [
+      conni2461
+      das_j
+      helsinki-Jo
+      mindavi
+    ];
+    platforms = lib.platforms.unix;
+  };
+})

From 65c8b9c33fa5396d804e53f7426170d6e42c5d7e Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 16 Sep 2026 12:06:57 +0000
Subject: [PATCH 39/78] hydra-evaluator: init at 0-unstable-2026-09-09

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WXgarR6c1r5vvR3FSAUGjP
---
 pkgs/by-name/hy/hydra-evaluator/package.nix | 51 +++++++++++++++++++++
 1 file changed, 51 insertions(+)
 create mode 100644 pkgs/by-name/hy/hydra-evaluator/package.nix

diff --git a/pkgs/by-name/hy/hydra-evaluator/package.nix b/pkgs/by-name/hy/hydra-evaluator/package.nix
new file mode 100644
index 000000000000..71d1d13e1c58
--- /dev/null
+++ b/pkgs/by-name/hy/hydra-evaluator/package.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  rustPlatform,
+  hydra,
+  pkg-config,
+  protobuf,
+  rust-jemalloc-sys,
+  nixosTests,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "hydra-evaluator";
+  inherit (hydra) version src;
+  __structuredAttrs = true;
+
+  cargoHash = "sha256-ULaL4B00O0ApZbBkv7GtLZWAoJI/ZNFPr+0FWsNp3OE=";
+
+  cargoBuildFlags = [
+    "--package"
+    "hydra-evaluator"
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+    protobuf
+  ];
+
+  buildInputs = [
+    protobuf
+    rust-jemalloc-sys
+  ];
+
+  # The unit tests spin up a PostgreSQL instance, which is not available in the
+  # sandbox.
+  doCheck = false;
+
+  passthru.tests = { inherit (nixosTests) hydra; };
+
+  meta = {
+    description = "Evaluator for the Nix-based continuous build system Hydra";
+    homepage = "https://github.com/NixOS/hydra";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "hydra-evaluator";
+    maintainers = with lib.maintainers; [
+      conni2461
+      das_j
+      helsinki-Jo
+      mindavi
+    ];
+    platforms = lib.platforms.linux;
+  };
+})

From 001347a0496adc7de00c471774749ea46160741d Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 16 Sep 2026 12:06:57 +0000
Subject: [PATCH 40/78] hydra-ws: init at 0-unstable-2026-09-09

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WXgarR6c1r5vvR3FSAUGjP
---
 pkgs/by-name/hy/hydra-ws/package.nix | 51 ++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)
 create mode 100644 pkgs/by-name/hy/hydra-ws/package.nix

diff --git a/pkgs/by-name/hy/hydra-ws/package.nix b/pkgs/by-name/hy/hydra-ws/package.nix
new file mode 100644
index 000000000000..ac09d264f660
--- /dev/null
+++ b/pkgs/by-name/hy/hydra-ws/package.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  hydra,
+  rustPlatform,
+  pkg-config,
+  protobuf,
+  rust-jemalloc-sys,
+  nixosTests,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "hydra-ws";
+  inherit (hydra) version src;
+  __structuredAttrs = true;
+
+  cargoHash = "sha256-ULaL4B00O0ApZbBkv7GtLZWAoJI/ZNFPr+0FWsNp3OE=";
+
+  cargoBuildFlags = [
+    "--package"
+    "hydra-ws"
+  ];
+
+  nativeBuildInputs = [
+    pkg-config
+    protobuf
+  ];
+
+  buildInputs = [
+    protobuf
+    rust-jemalloc-sys
+  ];
+
+  # The unit tests spin up a PostgreSQL instance, which is not available in the
+  # sandbox.
+  doCheck = false;
+
+  passthru.tests = { inherit (nixosTests) hydra; };
+
+  meta = {
+    description = "WebSocket server streaming build logs for the Hydra web interface";
+    homepage = "https://github.com/NixOS/hydra";
+    license = lib.licenses.gpl3Only;
+    mainProgram = "hydra-ws";
+    maintainers = with lib.maintainers; [
+      conni2461
+      das_j
+      helsinki-Jo
+      mindavi
+    ];
+    platforms = lib.platforms.linux;
+  };
+})

From f9c50c9e303c9ff37b7be31bb03dd91c2f470908 Mon Sep 17 00:00:00 2001
From: Raito Bezarius <masterancpp@gmail.com>
Date: Sat, 3 Oct 2026 15:26:47 +0200
Subject: [PATCH 41/78] treewide: use systemdLibs for mail, directory and
 service daemons

---
 pkgs/by-name/_3/_389-ds-base/package.nix     | 6 +++---
 pkgs/by-name/bi/biboumi/package.nix          | 4 ++--
 pkgs/by-name/co/corosync-qdevice/package.nix | 4 ++--
 pkgs/by-name/co/corosync/package.nix         | 4 ++--
 pkgs/by-name/do/dovecot/generic.nix          | 4 ++--
 pkgs/by-name/fr/freeipa/package.nix          | 4 ++--
 pkgs/by-name/jo/journaldriver/package.nix    | 4 ++--
 pkgs/by-name/kn/knxd/package.nix             | 6 +++---
 pkgs/by-name/kt/ktls-utils/package.nix       | 4 ++--
 pkgs/by-name/mo/mosquitto/package.nix        | 6 +++---
 pkgs/by-name/mp/mpd-notification/package.nix | 4 ++--
 pkgs/by-name/mp/mpd/package.nix              | 4 ++--
 pkgs/by-name/mp/mpdscribble/package.nix      | 4 ++--
 pkgs/by-name/op/openscap/package.nix         | 4 ++--
 pkgs/by-name/re/reframe/package.nix          | 4 ++--
 pkgs/by-name/ss/sssd/package.nix             | 4 ++--
 pkgs/by-name/ta/tang/package.nix             | 4 ++--
 pkgs/by-name/tg/tgt/package.nix              | 4 ++--
 pkgs/by-name/un/unscd/package.nix            | 4 ++--
 pkgs/by-name/uw/uwsgi/package.nix            | 6 +++---
 20 files changed, 44 insertions(+), 44 deletions(-)

diff --git a/pkgs/by-name/_3/_389-ds-base/package.nix b/pkgs/by-name/_3/_389-ds-base/package.nix
index d88cca3418c8..e2330427cda8 100644
--- a/pkgs/by-name/_3/_389-ds-base/package.nix
+++ b/pkgs/by-name/_3/_389-ds-base/package.nix
@@ -30,8 +30,8 @@
   rustPlatform,
   rustc,
   openssl,
-  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
-  systemd,
+  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
+  systemdLibs,
   zlib,
   rsync,
   withCockpit ? true,
@@ -90,7 +90,7 @@ stdenv.mkDerivation (finalAttrs: {
     openssl
     zlib
   ]
-  ++ lib.optional withSystemd systemd
+  ++ lib.optional withSystemd systemdLibs
   ++ lib.optional withOpenldap openldap
   ++ lib.optional withBdb db
   ++ lib.optional withNetSnmp net-snmp;
diff --git a/pkgs/by-name/bi/biboumi/package.nix b/pkgs/by-name/bi/biboumi/package.nix
index 5f6794d43965..f58d29853033 100644
--- a/pkgs/by-name/bi/biboumi/package.nix
+++ b/pkgs/by-name/bi/biboumi/package.nix
@@ -7,7 +7,7 @@
   expat,
   libiconv,
   botan3,
-  systemd,
+  systemdLibs,
   pkg-config,
   python3Packages,
   withIDN ? true,
@@ -44,7 +44,7 @@ stdenv.mkDerivation {
     libuuid
     expat
     libiconv
-    systemd
+    systemdLibs
     botan3
   ]
   ++ lib.optional withIDN libidn
diff --git a/pkgs/by-name/co/corosync-qdevice/package.nix b/pkgs/by-name/co/corosync-qdevice/package.nix
index 9989c7693c39..f8a5c5da87b2 100644
--- a/pkgs/by-name/co/corosync-qdevice/package.nix
+++ b/pkgs/by-name/co/corosync-qdevice/package.nix
@@ -8,7 +8,7 @@
   libqb,
   nss,
   nspr,
-  systemd,
+  systemdLibs,
   versionCheckHook,
 }:
 
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
     libqb
     nss
     nspr
-    systemd
+    systemdLibs
   ];
 
   configureFlags = [
diff --git a/pkgs/by-name/co/corosync/package.nix b/pkgs/by-name/co/corosync/package.nix
index 97427d6769fe..a83bb61cd856 100644
--- a/pkgs/by-name/co/corosync/package.nix
+++ b/pkgs/by-name/co/corosync/package.nix
@@ -9,7 +9,7 @@
   nss,
   nspr,
   libqb,
-  systemd,
+  systemdLibs,
   dbus,
   rdma-core,
   libstatgrab,
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
     nss
     nspr
     libqb
-    systemd.dev
+    systemdLibs.dev
   ]
   ++ optional enableDbus dbus
   ++ optional enableInfiniBandRdma rdma-core
diff --git a/pkgs/by-name/do/dovecot/generic.nix b/pkgs/by-name/do/dovecot/generic.nix
index 54e5665a6b29..9beeb953ff2b 100644
--- a/pkgs/by-name/do/dovecot/generic.nix
+++ b/pkgs/by-name/do/dovecot/generic.nix
@@ -13,7 +13,7 @@
   bison,
   perl,
   pkg-config,
-  systemd,
+  systemdLibs,
   openssl,
   bzip2,
   lz4,
@@ -103,7 +103,7 @@ stdenv.mkDerivation (finalAttrs: {
     xapian
   ]
   ++ lib.optionals (stdenv.hostPlatform.isLinux) [
-    systemd
+    systemdLibs
     pam
     libcap
     inotify-tools
diff --git a/pkgs/by-name/fr/freeipa/package.nix b/pkgs/by-name/fr/freeipa/package.nix
index 145942eec5c0..50a681ef8386 100644
--- a/pkgs/by-name/fr/freeipa/package.nix
+++ b/pkgs/by-name/fr/freeipa/package.nix
@@ -25,7 +25,7 @@
   libunistring,
   libverto,
   libpwquality,
-  systemd,
+  systemdLibs,
   python3Packages,
   bind,
   sssd,
@@ -111,7 +111,7 @@ stdenv.mkDerivation (finalAttrs: {
     samba
     libunistring
     libverto
-    systemd
+    systemdLibs
     bind
     libpwquality
     jansson
diff --git a/pkgs/by-name/jo/journaldriver/package.nix b/pkgs/by-name/jo/journaldriver/package.nix
index 1f6456840ced..c49f48ceeb4b 100644
--- a/pkgs/by-name/jo/journaldriver/package.nix
+++ b/pkgs/by-name/jo/journaldriver/package.nix
@@ -4,7 +4,7 @@
   rustPlatform,
   pkg-config,
   openssl,
-  systemd,
+  systemdLibs,
 }:
 
 rustPlatform.buildRustPackage {
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage {
 
   buildInputs = [
     openssl
-    systemd
+    systemdLibs
   ];
   nativeBuildInputs = [ pkg-config ];
 
diff --git a/pkgs/by-name/kn/knxd/package.nix b/pkgs/by-name/kn/knxd/package.nix
index a1ea965e4622..0cf316ab686d 100644
--- a/pkgs/by-name/kn/knxd/package.nix
+++ b/pkgs/by-name/kn/knxd/package.nix
@@ -10,8 +10,8 @@
   argp-standalone,
   fmt,
   libev,
-  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
-  systemd,
+  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
+  systemdLibs,
   withUsb ? stdenv.hostPlatform.isLinux,
   libusb1,
 }:
@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
     fmt
     libev
   ]
-  ++ lib.optional withSystemd systemd
+  ++ lib.optional withSystemd systemdLibs
   ++ lib.optional withUsb libusb1
   ++ lib.optional stdenv.hostPlatform.isDarwin argp-standalone;
 
diff --git a/pkgs/by-name/kt/ktls-utils/package.nix b/pkgs/by-name/kt/ktls-utils/package.nix
index 5c8a02a09236..285b596d6245 100644
--- a/pkgs/by-name/kt/ktls-utils/package.nix
+++ b/pkgs/by-name/kt/ktls-utils/package.nix
@@ -8,8 +8,8 @@
   keyutils,
   glib,
   libnl,
-  systemd,
-  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
+  systemdLibs,
+  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
   nix-update-script,
   nixosTests,
 }:
diff --git a/pkgs/by-name/mo/mosquitto/package.nix b/pkgs/by-name/mo/mosquitto/package.nix
index 56621743f089..7a570c24fba0 100644
--- a/pkgs/by-name/mo/mosquitto/package.nix
+++ b/pkgs/by-name/mo/mosquitto/package.nix
@@ -12,9 +12,9 @@
   libuv,
   libwebsockets,
   openssl,
-  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
+  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
   sqlite,
-  systemd,
+  systemdLibs,
   uthash,
   nixosTests,
 }:
@@ -77,7 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
     sqlite
     uthash
   ]
-  ++ lib.optional withSystemd systemd;
+  ++ lib.optional withSystemd systemdLibs;
 
   propagatedBuildInputs = [ cjson ];
 
diff --git a/pkgs/by-name/mp/mpd-notification/package.nix b/pkgs/by-name/mp/mpd-notification/package.nix
index 939d9bf99f21..8c7d75b14c08 100644
--- a/pkgs/by-name/mp/mpd-notification/package.nix
+++ b/pkgs/by-name/mp/mpd-notification/package.nix
@@ -9,7 +9,7 @@
   libnotify,
   libmpdclient,
   discount,
-  systemd,
+  systemdLibs,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
     ffmpeg
     libmpdclient
     discount
-    systemd
+    systemdLibs
   ];
 
   installPhase = ''
diff --git a/pkgs/by-name/mp/mpd/package.nix b/pkgs/by-name/mp/mpd/package.nix
index c53585681d61..b9a22a51fe53 100644
--- a/pkgs/by-name/mp/mpd/package.nix
+++ b/pkgs/by-name/mp/mpd/package.nix
@@ -6,7 +6,7 @@
   ninja,
   pkg-config,
   glib,
-  systemd,
+  systemdLibs,
   fmt,
   buildPackages,
   # Inputs
@@ -140,7 +140,7 @@ let
     pcre = [ pcre2 ];
     sqlite = [ sqlite ];
     syslog = [ ];
-    systemd = [ systemd ];
+    systemd = [ systemdLibs ];
     zeroconf = [
       avahi
       dbus
diff --git a/pkgs/by-name/mp/mpdscribble/package.nix b/pkgs/by-name/mp/mpdscribble/package.nix
index 1ec0d24c72d7..8d021cc4fe6a 100644
--- a/pkgs/by-name/mp/mpdscribble/package.nix
+++ b/pkgs/by-name/mp/mpdscribble/package.nix
@@ -9,7 +9,7 @@
   curl,
   libgcrypt,
   libmpdclient,
-  systemd,
+  systemdLibs,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
     boost
     libgcrypt
   ]
-  ++ lib.optional stdenv.hostPlatform.isLinux systemd;
+  ++ lib.optional stdenv.hostPlatform.isLinux systemdLibs;
 
   meta = {
     description = "MPD client which submits info about tracks being played to a scrobbler";
diff --git a/pkgs/by-name/op/openscap/package.nix b/pkgs/by-name/op/openscap/package.nix
index ed93ff9fcb87..71ddd49870d0 100644
--- a/pkgs/by-name/op/openscap/package.nix
+++ b/pkgs/by-name/op/openscap/package.nix
@@ -31,7 +31,7 @@
   system-sendmail,
   curl,
   procps,
-  systemd,
+  systemdLibs,
   perl,
   doxygen,
   pkg-config,
@@ -86,7 +86,7 @@ stdenv.mkDerivation (finalAttrs: {
       python3
       libgcrypt
       libxml2
-      systemd
+      systemdLibs
       haskellPackages.pthread
       graphviz
       system-sendmail
diff --git a/pkgs/by-name/re/reframe/package.nix b/pkgs/by-name/re/reframe/package.nix
index 7a540d83b56c..b5a5e2d8a1e6 100644
--- a/pkgs/by-name/re/reframe/package.nix
+++ b/pkgs/by-name/re/reframe/package.nix
@@ -6,7 +6,7 @@
   meson,
   ninja,
   cmake,
-  systemd,
+  systemdLibs,
   glib,
   gtk4,
   libdrm,
@@ -43,7 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    systemd
+    systemdLibs
     glib
     gtk4
     libdrm
diff --git a/pkgs/by-name/ss/sssd/package.nix b/pkgs/by-name/ss/sssd/package.nix
index 5ce5da5efd02..489f6eb38e45 100644
--- a/pkgs/by-name/ss/sssd/package.nix
+++ b/pkgs/by-name/ss/sssd/package.nix
@@ -40,7 +40,7 @@
   libxslt,
   libxml2,
   libuuid,
-  systemd,
+  systemdLibs,
   nspr,
   check,
   cmocka,
@@ -191,7 +191,7 @@ stdenv.mkDerivation (finalAttrs: {
     libxslt
     libxml2
     libuuid
-    systemd
+    systemdLibs
     nspr
     check
     cmocka
diff --git a/pkgs/by-name/ta/tang/package.nix b/pkgs/by-name/ta/tang/package.nix
index 97deec22126b..6b7980be892a 100644
--- a/pkgs/by-name/ta/tang/package.nix
+++ b/pkgs/by-name/ta/tang/package.nix
@@ -7,7 +7,7 @@
   jansson,
   jose,
   http-parser,
-  systemd,
+  systemdLibs,
   meson,
   ninja,
   makeWrapper,
@@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
     jansson
     jose
     http-parser
-    systemd
+    systemdLibs
   ];
 
   outputs = [
diff --git a/pkgs/by-name/tg/tgt/package.nix b/pkgs/by-name/tg/tgt/package.nix
index e78ffd04a1e6..4dda633a3e39 100644
--- a/pkgs/by-name/tg/tgt/package.nix
+++ b/pkgs/by-name/tg/tgt/package.nix
@@ -4,7 +4,7 @@
   fetchFromGitHub,
   libxslt,
   libaio,
-  systemd,
+  systemdLibs,
   perl,
   docbook_xsl,
   coreutils,
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    systemd
+    systemdLibs
     libaio
   ];
 
diff --git a/pkgs/by-name/un/unscd/package.nix b/pkgs/by-name/un/unscd/package.nix
index d0dc26fe72dd..205f0c695bd4 100644
--- a/pkgs/by-name/un/unscd/package.nix
+++ b/pkgs/by-name/un/unscd/package.nix
@@ -2,7 +2,7 @@
   fetchurl,
   fetchpatch,
   stdenv,
-  systemd,
+  systemdLibs,
   lib,
 }:
 
@@ -53,7 +53,7 @@ stdenv.mkDerivation rec {
     ./0001-adjust-socket-paths-for-nixos.patch
   ];
 
-  buildInputs = [ systemd ];
+  buildInputs = [ systemdLibs ];
 
   buildPhase = ''
     runHook preBuild
diff --git a/pkgs/by-name/uw/uwsgi/package.nix b/pkgs/by-name/uw/uwsgi/package.nix
index 0da10531d2ff..874fb024edc2 100644
--- a/pkgs/by-name/uw/uwsgi/package.nix
+++ b/pkgs/by-name/uw/uwsgi/package.nix
@@ -13,8 +13,8 @@
   plugins ? [ ],
   pam,
   withPAM ? stdenv.hostPlatform.isLinux,
-  systemd,
-  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemd,
+  systemdLibs,
+  withSystemd ? lib.meta.availableOn stdenv.hostPlatform systemdLibs,
   libcap,
   withCap ? stdenv.hostPlatform.isLinux,
   python3,
@@ -118,7 +118,7 @@ stdenv.mkDerivation (finalAttrs: {
     zlib
   ]
   ++ lib.optional withPAM pam
-  ++ lib.optional withSystemd systemd
+  ++ lib.optional withSystemd systemdLibs
   ++ lib.optional withCap libcap
   ++ lib.concatMap (x: x.inputs) needed;
 

From 17d006d0b884ca89f61c772e61c4047b6f87b492 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 16 Sep 2026 12:06:58 +0000
Subject: [PATCH 42/78] nixos/hydra: adapt to the Rust queue runner, evaluator
 and ws server
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The queue runner is a separate daemon now: it takes a TOML config, binds
gRPC and REST sockets, and build machines register themselves through
services.hydra-builder rather than being driven over SSH from
/etc/nix/machines.

The evaluator and the new websocket log server likewise ship as their own
packages and read their own TOML files.

services.hydra.dbi is replaced by services.hydra.dbUrl: Hydra reads
HYDRA_DATABASE_URL now, a libpq URL, and HYDRA_DBI has been gone upstream
for a while, so the old option had stopped having any effect.

services.hydra.buildMachinesFiles is removed along with NIX_REMOTE_SYSTEMS,
which nothing upstream reads any more.

Co-Authored-By: Jörg Thalheim <joerg@thalheim.io>

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WXgarR6c1r5vvR3FSAUGjP
---
 .../manual/release-notes/rl-2611.section.md   |  11 +
 nixos/modules/module-list.nix                 |   1 +
 .../continuous-integration/hydra/builder.nix  | 305 ++++++++
 .../continuous-integration/hydra/default.nix  | 730 ++++++++++++++++--
 nixos/tests/hydra/common.nix                  |  14 +-
 nixos/tests/hydra/default.nix                 |  14 +-
 6 files changed, 1011 insertions(+), 64 deletions(-)
 create mode 100644 nixos/modules/services/continuous-integration/hydra/builder.nix

diff --git a/nixos/doc/manual/release-notes/rl-2611.section.md b/nixos/doc/manual/release-notes/rl-2611.section.md
index 01a6fca7eee8..293f3bee0829 100644
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -120,6 +120,8 @@
 
 - [rosec](https://github.com/jmylchreest/rosec), a secrets daemon implementing the freedesktop.org Secret Service API with modular backend providers. It can automatically unlock the user's vault on login via PAM. Available as [services.rosec](#opt-services.rosec.enable).
 
+- [Hydra builder](https://github.com/NixOS/hydra), the build agent for Hydra's queue runner. Available as [services.hydra-builder](#opt-services.hydra-builder.enable).
+
 - [NordVPN](https://github.com/NordSecurity/nordvpn-linux), a NordVPN client for linux. Available as [services.nordvpn](options.html#opt-services.nordvpn.enable).
 
 - [RNSD](https://reticulum.network/), the Reticulum Network Stack Daemon. It provides a secure and efficient way to communicate over the Reticulum Network. Available as [services.rnsd](#opt-services.rnsd.enable).
@@ -314,6 +316,15 @@
   make the required changes to your configuration and database, if needed,
   before you upgrade to NixOS 26.11.
 
+- `hydra` has been updated to the Rust queue runner/evaluator:
+  - `services.hydra.dbi` was replaced by [services.hydra.dbUrl](#opt-services.hydra.dbUrl), which takes a `postgres://` URL instead of a DBI string.
+  - `services.hydra.buildMachinesFiles` was removed. The queue runner no longer connects to build machines over SSH. Instead each build machine (including the Hydra host itself, if it should build) must enable [services.hydra-builder](#opt-services.hydra-builder.enable) and point it at [services.hydra.queueRunner.grpc](#opt-services.hydra.queueRunner.grpc.port).
+  - The queue runner, evaluator and the new `hydra-ws` log streaming service are configured via `services.hydra.queueRunner.settings`, [services.hydra.evaluatorSettings](#opt-services.hydra.evaluatorSettings) and `services.hydra.ws.settings` respectively, instead of `hydra.conf`.
+
+- NetBox was updated to `>= 4.6.8`. Have a look at the breaking changes
+  of the [4.6 release](https://github.com/netbox-community/netbox/releases/tag/v4.6.0),
+  make the required changes to your database, if needed, then upgrade by setting `services.netbox.package = pkgs.netbox_4_6;` in your configuration.
+
 - The COSMIC desktop module now enables by default `system76-power` and `system76-scheduler` following upstream recommended packages. The previous power managment service can be enabled back by setting `services.power-profiles-daemon.enable = true`.
 
 - The `programs.dms-shell.enableVPN`, `enableDynamicTheming`, `enableAudioWavelength`, and `enableCalendarEvents` options have been removed. `matugen` and `cava` are now included in the default DMS environment and can be excluded with `programs.dms-shell.excludePackages`. Networking and calendar backends are configured separately.
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index fef459fe7e89..c9fa0368e5de 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -535,6 +535,7 @@
   ./services/continuous-integration/gocd-agent/default.nix
   ./services/continuous-integration/gocd-server/default.nix
   ./services/continuous-integration/hercules-ci-agent/default.nix
+  ./services/continuous-integration/hydra/builder.nix
   ./services/continuous-integration/hydra/default.nix
   ./services/continuous-integration/jenkins/default.nix
   ./services/continuous-integration/jenkins/job-builder.nix
diff --git a/nixos/modules/services/continuous-integration/hydra/builder.nix b/nixos/modules/services/continuous-integration/hydra/builder.nix
new file mode 100644
index 000000000000..43720b5400cc
--- /dev/null
+++ b/nixos/modules/services/continuous-integration/hydra/builder.nix
@@ -0,0 +1,305 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.hydra-builder;
+
+  user = "hydra-builder";
+
+  format = pkgs.formats.toml { };
+in
+{
+  options.services.hydra-builder = {
+    enable = lib.mkEnableOption "the Hydra build agent, which connects to the queue runner over gRPC and executes builds";
+
+    package = lib.mkPackageOption pkgs "hydra-builder" { };
+
+    queueRunnerAddr = lib.mkOption {
+      type = lib.types.singleLineStr;
+      example = "http://hydra.example.org:50051";
+      description = ''
+        Address of the queue runner's gRPC endpoint, see
+        {option}`services.hydra.queueRunner.grpc`.
+      '';
+    };
+
+    settings = lib.mkOption {
+      description = ''
+        Builder settings, written to {file}`/etc/hydra/builder.toml`.
+      '';
+      default = { };
+      type = lib.types.submodule {
+        options = {
+          pingInterval = lib.mkOption {
+            type = lib.types.ints.positive;
+            default = 10;
+            description = "Interval in seconds at which pings are sent to the queue runner.";
+          };
+
+          speedFactor = lib.mkOption {
+            type = lib.types.oneOf [
+              lib.types.ints.positive
+              lib.types.float
+            ];
+            default = 1;
+            description = "Speed factor of this machine, relative to the other builders.";
+          };
+
+          maxJobs = lib.mkOption {
+            type = lib.types.ints.positive;
+            default = 4;
+            description = ''
+              Maximum number of concurrent jobs. Only honoured when the queue
+              runner's {option}`services.hydra.queueRunner.settings.machineFreeFn`
+              takes job limits into account.
+            '';
+          };
+
+          buildCores = lib.mkOption {
+            type = lib.types.ints.unsigned;
+            default = config.nix.settings.cores;
+            defaultText = lib.literalExpression "config.nix.settings.cores";
+            description = ''
+              Cores made available to each build (`NIX_BUILD_CORES`). 0 means
+              all available cores.
+            '';
+          };
+
+          buildDirAvailThreshold = lib.mkOption {
+            type = lib.types.float;
+            default = 10.0;
+            description = ''
+              Percentage of free space on the Nix build directory below which
+              jobs stop being scheduled on this machine.
+            '';
+          };
+
+          storeAvailThreshold = lib.mkOption {
+            type = lib.types.float;
+            default = 10.0;
+            description = ''
+              Percentage of free space on {file}`/nix/store` below which jobs
+              stop being scheduled on this machine.
+            '';
+          };
+
+          load1Threshold = lib.mkOption {
+            type = lib.types.float;
+            default = 8.0;
+            description = ''
+              Load1 above which jobs stop being scheduled on this machine. Only
+              used when PSI is unavailable.
+            '';
+          };
+
+          cpuPsiThreshold = lib.mkOption {
+            type = lib.types.float;
+            default = 75.0;
+            description = "CPU PSI over the last 10s above which jobs stop being scheduled on this machine.";
+          };
+
+          memPsiThreshold = lib.mkOption {
+            type = lib.types.float;
+            default = 80.0;
+            description = "Memory PSI over the last 10s above which jobs stop being scheduled on this machine.";
+          };
+
+          ioPsiThreshold = lib.mkOption {
+            type = lib.types.nullOr lib.types.float;
+            default = null;
+            description = ''
+              IO PSI over the last 10s above which jobs stop being scheduled on
+              this machine. `null` disables this check.
+            '';
+          };
+
+          systems = lib.mkOption {
+            type = lib.types.nullOr (lib.types.listOf lib.types.singleLineStr);
+            default = null;
+            example = [ "x86_64-linux" ];
+            description = ''
+              Systems this builder can build for. `null` reads `system` and
+              `extra-platforms` from Nix; an empty list advertises none.
+            '';
+          };
+
+          supportedFeatures = lib.mkOption {
+            type = lib.types.nullOr (lib.types.listOf lib.types.singleLineStr);
+            default = null;
+            example = [ "big-parallel" ];
+            description = ''
+              Features this builder supports. `null` reads `system-features`
+              from Nix; an empty list advertises none.
+            '';
+          };
+
+          mandatoryFeatures = lib.mkOption {
+            type = lib.types.listOf lib.types.singleLineStr;
+            default = [ ];
+            example = [ "FOD" ];
+            description = "Features a step must request to be scheduled on this builder.";
+          };
+
+          useSubstitutes = lib.mkOption {
+            type = lib.types.bool;
+            default = true;
+            description = "Whether the builder substitutes paths instead of fetching them from the queue runner.";
+          };
+        };
+      };
+    };
+
+    authorizationFile = lib.mkOption {
+      type = lib.types.nullOr lib.types.path;
+      default = null;
+      description = ''
+        Path to a file holding the authorization token, as an alternative to
+        {option}`mtls`. The token has to be listed in the queue runner's
+        {option}`services.hydra.queueRunner.settings.tokenPaths`.
+      '';
+    };
+
+    mtls = lib.mkOption {
+      default = null;
+      description = "mTLS material used to authenticate against the queue runner.";
+      type = lib.types.nullOr (
+        lib.types.submodule {
+          options = {
+            serverRootCaCertPath = lib.mkOption {
+              type = lib.types.path;
+              description = "Server root CA certificate path.";
+            };
+
+            clientCertPath = lib.mkOption {
+              type = lib.types.path;
+              description = "Client certificate path.";
+            };
+
+            clientKeyPath = lib.mkOption {
+              type = lib.types.path;
+              description = "Client key path.";
+            };
+
+            domainName = lib.mkOption {
+              type = lib.types.singleLineStr;
+              description = "Domain name the server certificate is validated against.";
+            };
+          };
+        }
+      );
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    systemd.services.hydra-builder = {
+      description = "Hydra build agent";
+      requires = [ "nix-daemon.socket" ];
+      after = [ "network.target" ];
+      wantedBy = [ "multi-user.target" ];
+      restartTriggers = [ config.environment.etc."hydra/builder.toml".source ];
+
+      environment = {
+        NIX_REMOTE = "daemon";
+        RUST_BACKTRACE = "1";
+        # nix-store wants $HOME for its cache dir.
+        HOME = "/run/hydra-builder";
+      };
+
+      path = [ config.nix.package ];
+
+      serviceConfig = {
+        Type = "notify";
+        Restart = "always";
+        RestartSec = "5s";
+
+        ExecStart = lib.escapeShellArgs (
+          [
+            (lib.getExe cfg.package)
+            "--gateway-endpoint"
+            cfg.queueRunnerAddr
+            "--config-path"
+            "/etc/hydra/builder.toml"
+          ]
+          ++ lib.optionals (cfg.authorizationFile != null) [
+            "--authorization-file"
+            cfg.authorizationFile
+          ]
+          ++ lib.optionals (cfg.mtls != null) [
+            "--server-root-ca-cert-path"
+            cfg.mtls.serverRootCaCertPath
+            "--client-cert-path"
+            cfg.mtls.clientCertPath
+            "--client-key-path"
+            cfg.mtls.clientKeyPath
+            "--domain-name"
+            cfg.mtls.domainName
+          ]
+        );
+
+        User = user;
+        Group = "hydra";
+
+        RuntimeDirectory = "hydra-builder";
+
+        ReadWritePaths = [
+          "/nix/var/nix/gcroots/"
+          "/nix/var/nix/daemon-socket/socket"
+        ];
+        ReadOnlyPaths = [ "/nix/" ];
+
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        UMask = "0077";
+      };
+    };
+
+    environment.etc."hydra/builder.toml".source = format.generate "builder.toml" (
+      lib.filterAttrsRecursive (_: v: v != null) cfg.settings
+    );
+
+    nix.settings.trusted-users = [ user ];
+
+    users = {
+      groups.hydra = { };
+      users.${user} = {
+        description = "Hydra build agent";
+        group = "hydra";
+        isSystemUser = true;
+      };
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [
+    conni2461
+    das_j
+    helsinki-Jo
+    mindavi
+  ];
+}
diff --git a/nixos/modules/services/continuous-integration/hydra/default.nix b/nixos/modules/services/continuous-integration/hydra/default.nix
index 76624d4bea7b..7485f134391b 100644
--- a/nixos/modules/services/continuous-integration/hydra/default.nix
+++ b/nixos/modules/services/continuous-integration/hydra/default.nix
@@ -7,21 +7,33 @@
 let
 
   cfg = config.services.hydra;
+  queueRunnerCfg = cfg.queueRunner;
+
+  toml = pkgs.formats.toml { };
 
   baseDir = "/var/lib/hydra";
 
   hydraConf = pkgs.writeScript "hydra.conf" cfg.extraConfig;
 
   hydraEnv = {
-    HYDRA_DBI = cfg.dbi;
+    HYDRA_DATABASE_URL = cfg.dbUrl;
     HYDRA_CONFIG = "${baseDir}/hydra.conf";
     HYDRA_DATA = "${baseDir}";
   };
 
+  # Appends `application_name` so queries can be attributed in pg_stat_activity.
+  # `%` is doubled because the value lands in systemd `Environment=`, where the
+  # percent-encoded socket path (`%2Frun%2Fpostgresql`) would be parsed as a
+  # specifier.
+  dbUrlWithAppName =
+    name:
+    lib.replaceStrings [ "%" ] [ "%%" ] (
+      cfg.dbUrl + (if lib.hasInfix "?" cfg.dbUrl then "&" else "?") + "application_name=${name}"
+    );
+
   env = {
     NIX_REMOTE = "daemon";
     PGPASSFILE = "${baseDir}/pgpass";
-    NIX_REMOTE_SYSTEMS = lib.concatStringsSep ":" cfg.buildMachinesFiles;
   }
   // lib.optionalAttrs (cfg.smtpHost != null) {
     EMAIL_SENDER_TRANSPORT = "SMTP";
@@ -40,9 +52,9 @@ let
     }
     // (lib.optionalAttrs cfg.debugServer { DBIC_TRACE = "1"; });
 
-  localDB = "dbi:Pg:dbname=hydra;user=hydra;";
+  localDbUrl = "postgres://hydra@%2Frun%2Fpostgresql:5432/hydra";
 
-  haveLocalDB = cfg.dbi == localDB;
+  haveLocalDB = cfg.dbUrl == localDbUrl;
 
   hydra-package =
     let
@@ -80,6 +92,16 @@ let
 in
 
 {
+  imports = [
+    (lib.mkRemovedOptionModule [ "services" "hydra" "dbi" ] ''
+      Use `services.hydra.dbUrl`, which takes a postgres:// URL instead of a DBI string.
+    '')
+    (lib.mkRemovedOptionModule [ "services" "hydra" "buildMachinesFiles" ] ''
+      The queue runner no longer reads Nix build machines files. Builders now
+      connect to it via gRPC, see `services.hydra-builder`.
+    '')
+  ];
+
   ###### interface
   options = {
 
@@ -93,22 +115,102 @@ in
         '';
       };
 
-      dbi = lib.mkOption {
+      dbUrl = lib.mkOption {
         type = lib.types.str;
-        default = localDB;
-        example = "dbi:Pg:dbname=hydra;host=postgres.example.org;user=foo;";
+        default = localDbUrl;
+        example = "postgres://foo@postgres.example.org:5432/hydra";
         description = ''
-          The DBI string for Hydra database connection.
+          `postgres://` URL of the Hydra database.
 
-          NOTE: Attempts to set `application_name` will be overridden by
-          `hydra-TYPE` (where TYPE is e.g. `evaluator`, `queue-runner`,
-          etc.) in all hydra services to more easily distinguish where
-          queries are coming from.
+          An `application_name` query parameter is appended per service
+          (e.g. `hydra-evaluator`), so do not set one here.
         '';
       };
 
       package = lib.mkPackageOption pkgs "hydra" { };
 
+      evaluatorPackage = lib.mkPackageOption pkgs "hydra-evaluator" { };
+
+      evaluatorSettings = lib.mkOption {
+        description = ''
+          Settings for the evaluator, written to
+          {file}`/etc/hydra/evaluator.toml`.
+        '';
+        default = { };
+        type = lib.types.submodule {
+          freeformType = toml.type;
+          options = {
+            max_concurrent_evals = lib.mkOption {
+              type = lib.types.ints.positive;
+              default = 4;
+              description = "How many jobsets to evaluate at once.";
+            };
+          };
+        };
+      };
+
+      ws = {
+        enable =
+          lib.mkEnableOption "the WebSocket server streaming live build logs to the web interface"
+          // {
+            default = true;
+            example = false;
+          };
+
+        package = lib.mkPackageOption pkgs "hydra-ws" { };
+
+        settings = lib.mkOption {
+          description = ''
+            Settings for the WebSocket server, written to
+            {file}`/etc/hydra/ws.toml`.
+          '';
+          default = { };
+          type = lib.types.submodule {
+            options = {
+              dbUrl = lib.mkOption {
+                type = lib.types.singleLineStr;
+                default = cfg.dbUrl;
+                defaultText = lib.literalExpression "config.services.hydra.dbUrl";
+                description = "PostgreSQL database URL.";
+              };
+
+              maxDbConnections = lib.mkOption {
+                type = lib.types.ints.positive;
+                default = 128;
+                description = "Maximum number of PostgreSQL connections.";
+              };
+
+              idleGrace = lib.mkOption {
+                type = lib.types.int;
+                default = 128;
+                description = "Idle grace period in seconds before a log tail is stopped.";
+              };
+
+              hydraDataDir = lib.mkOption {
+                type = lib.types.path;
+                default = baseDir;
+                defaultText = lib.literalExpression ''"${baseDir}"'';
+                description = "Hydra data directory.";
+              };
+            };
+          };
+        };
+
+        bind = {
+          address = lib.mkOption {
+            type = lib.types.singleLineStr;
+            default = "[::1]";
+            description = "Address the WebSocket listener binds to.";
+          };
+
+          port = lib.mkOption {
+            type = lib.types.port;
+            default = 9283;
+            description = "Port the WebSocket listener binds to.";
+          };
+        };
+      };
+
       hydraURL = lib.mkOption {
         type = lib.types.str;
         description = ''
@@ -223,17 +325,6 @@ in
         description = "Directory that holds Hydra garbage collector roots.";
       };
 
-      buildMachinesFiles = lib.mkOption {
-        type = lib.types.listOf lib.types.path;
-        default = lib.optional (config.nix.buildMachines != [ ]) "/etc/nix/machines";
-        defaultText = lib.literalExpression ''lib.optional (config.nix.buildMachines != []) "/etc/nix/machines"'';
-        example = [
-          "/etc/nix/machines"
-          "/var/lib/hydra/provisioner/machines"
-        ];
-        description = "List of files containing build machines.";
-      };
-
       useSubstitutes = lib.mkOption {
         type = lib.types.bool;
         default = false;
@@ -247,6 +338,324 @@ in
           are absolute trustworthy.
         '';
       };
+
+      queueRunner = {
+        package = lib.mkPackageOption pkgs "hydra-queue-runner" { };
+
+        settings = lib.mkOption {
+          description = ''
+            Reloadable settings for the queue runner, written to
+            {file}`/etc/hydra/queue-runner.toml`.
+          '';
+          default = { };
+          type = lib.types.submodule {
+            options = {
+              hydraDataDir = lib.mkOption {
+                type = lib.types.path;
+                default = baseDir;
+                defaultText = lib.literalExpression ''"${baseDir}"'';
+                description = "Hydra data directory.";
+              };
+
+              dbUrl = lib.mkOption {
+                type = lib.types.singleLineStr;
+                default = cfg.dbUrl;
+                defaultText = lib.literalExpression "config.services.hydra.dbUrl";
+                description = "PostgreSQL database URL.";
+              };
+
+              maxDbConnections = lib.mkOption {
+                type = lib.types.ints.positive;
+                default = 128;
+                description = "Maximum number of PostgreSQL connections.";
+              };
+
+              machineSortFn = lib.mkOption {
+                type = lib.types.enum [
+                  "SpeedFactorOnly"
+                  "CpuCoreCountWithSpeedFactor"
+                  "BogomipsWithSpeedFactor"
+                ];
+                default = "SpeedFactorOnly";
+                description = "Function used to sort machines.";
+              };
+
+              machineFreeFn = lib.mkOption {
+                type = lib.types.enum [
+                  "Dynamic"
+                  "DynamicWithMaxJobLimit"
+                  "Static"
+                ];
+                default = "Static";
+                description = ''Function used to determine "idle" machines.'';
+              };
+
+              stepSortFn = lib.mkOption {
+                type = lib.types.enum [
+                  "Legacy"
+                  "WithRdeps"
+                  "WithCriticalPath"
+                ];
+                default = "WithRdeps";
+                description = "Function used to sort steps.";
+              };
+
+              dispatchTriggerTimerInS = lib.mkOption {
+                type = lib.types.int;
+                default = 120;
+                description = ''
+                  Interval in seconds at which the dispatcher is triggered. A
+                  value <= 0 disables the timer, leaving the dispatcher to be
+                  triggered by queue changes only.
+                '';
+              };
+
+              queueTriggerTimerInS = lib.mkOption {
+                type = lib.types.int;
+                default = -1;
+                description = ''
+                  Interval in seconds at which the queue is triggered. A value
+                  <= 0 disables the timer, leaving the queue to be triggered by
+                  PostgreSQL notifications only.
+                '';
+              };
+
+              remoteStoreAddr = lib.mkOption {
+                type = lib.types.listOf lib.types.singleLineStr;
+                default = [ ];
+                description = "Remote store addresses.";
+              };
+
+              useSubstitutes = lib.mkOption {
+                type = lib.types.bool;
+                default = cfg.useSubstitutes;
+                defaultText = lib.literalExpression "config.services.hydra.useSubstitutes";
+                description = "Whether to substitute paths instead of building them.";
+              };
+
+              rootsDir = lib.mkOption {
+                type = lib.types.nullOr lib.types.path;
+                default = cfg.gcRootsDir;
+                defaultText = lib.literalExpression "config.services.hydra.gcRootsDir";
+                description = "Directory holding the garbage collector roots.";
+              };
+
+              maxRetries = lib.mkOption {
+                type = lib.types.ints.positive;
+                default = 5;
+                description = "Maximum number of retries for a build step.";
+              };
+
+              retryInterval = lib.mkOption {
+                type = lib.types.ints.positive;
+                default = 60;
+                description = "Interval in seconds after which a step may be retried.";
+              };
+
+              retryBackoff = lib.mkOption {
+                type = lib.types.float;
+                default = 3.0;
+                description = "Additional backoff on top of {option}`retryInterval`.";
+              };
+
+              maxUnsupportedTimeInS = lib.mkOption {
+                type = lib.types.ints.unsigned;
+                default = 120;
+                description = "Time in seconds after which unsupported steps are aborted.";
+              };
+
+              stopQueueRunAfterInS = lib.mkOption {
+                type = lib.types.int;
+                default = 60;
+                description = ''
+                  Seconds after which a queue run is interrupted early. A value
+                  <= 0 lets queue runs go on for as long as they need.
+                '';
+              };
+
+              maxConcurrentDownloads = lib.mkOption {
+                type = lib.types.ints.positive;
+                default = 5;
+                description = ''
+                  Maximum number of concurrent downloads per build. Raising this
+                  raises the queue runner's memory usage.
+                '';
+              };
+
+              concurrentUploadLimit = lib.mkOption {
+                type = lib.types.ints.positive;
+                default = 5;
+                description = "Maximum number of concurrent uploads to S3.";
+              };
+
+              tokenPaths = lib.mkOption {
+                type = lib.types.nullOr (lib.types.listOf lib.types.path);
+                default = null;
+                description = "Paths of the accepted authentication tokens.";
+              };
+
+              enableFodChecker = lib.mkOption {
+                type = lib.types.bool;
+                default = false;
+                description = ''
+                  Whether to enable the fixed-output derivation checker, which
+                  collects FODs in a separate queue and schedules them on
+                  machines advertising the mandatory `FOD` feature.
+                '';
+              };
+
+              usePresignedUploads = lib.mkOption {
+                type = lib.types.bool;
+                default = false;
+                description = ''
+                  Whether builders upload to S3 themselves instead of the queue
+                  runner. Requires an S3 remote store as well as substitution on
+                  the builders, see {option}`forcedSubstituters`.
+                '';
+              };
+
+              overflowStore = lib.mkOption {
+                default = null;
+                description = ''
+                  Overflow S3 store. Steps referenced only by the listed jobsets
+                  are uploaded there instead of to the default store.
+                '';
+                type = lib.types.nullOr (
+                  lib.types.submodule {
+                    options = {
+                      store = lib.mkOption {
+                        type = lib.types.singleLineStr;
+                        example = "s3://overflow?region=eu-west-1";
+                        description = "S3 store URI of the overflow bucket.";
+                      };
+
+                      jobsets = lib.mkOption {
+                        type = lib.types.listOf lib.types.singleLineStr;
+                        default = [ ];
+                        example = [ "nixpkgs:trunk" ];
+                        description = "Jobsets (`project:jobset`) whose exclusive steps go to the overflow store.";
+                      };
+                    };
+                  }
+                );
+              };
+
+              forcedSubstituters = lib.mkOption {
+                type = lib.types.listOf lib.types.singleLineStr;
+                default = [ ];
+                description = ''
+                  Substituters every builder is required to have. Builders that
+                  do not enable `useSubstitutes` with these substituters are
+                  rejected.
+                '';
+              };
+
+              maxOutputSize = lib.mkOption {
+                type = lib.types.ints.unsigned;
+                default = 0;
+                description = ''
+                  Per-output NAR size limit in bytes. Builds exceeding it fail
+                  with `NarSizeLimitExceeded`. 0 disables the check.
+                '';
+              };
+
+              maxSilentTime = lib.mkOption {
+                type = lib.types.ints.unsigned;
+                default = 3600;
+                description = ''
+                  Default maximum silent time in seconds for builds without
+                  `meta.maxSilent`. Also used as a floor for dependency-only
+                  steps.
+                '';
+              };
+
+              buildTimeout = lib.mkOption {
+                type = lib.types.ints.unsigned;
+                default = 36000;
+                description = ''
+                  Default build timeout in seconds for builds without
+                  `meta.timeout`. Also used as a floor for dependency-only
+                  steps.
+                '';
+              };
+
+              maxLogSize = lib.mkOption {
+                type = lib.types.ints.unsigned;
+                default = 64 * 1024 * 1024;
+                description = ''
+                  Maximum build log size in bytes before a build fails with
+                  `LogLimitExceeded`.
+                '';
+              };
+            };
+          };
+        };
+
+        grpc = {
+          address = lib.mkOption {
+            type = lib.types.singleLineStr;
+            default = "[::1]";
+            description = ''
+              Address the gRPC listener binds to. Must be reachable from
+              machines running {option}`services.hydra-builder`.
+            '';
+          };
+
+          port = lib.mkOption {
+            type = lib.types.port;
+            default = 50051;
+            description = "Port the gRPC listener binds to.";
+          };
+        };
+
+        rest = {
+          address = lib.mkOption {
+            type = lib.types.singleLineStr;
+            default = "[::1]";
+            description = "Address the REST listener binds to.";
+          };
+
+          port = lib.mkOption {
+            type = lib.types.port;
+            default = 8080;
+            description = "Port the REST listener binds to.";
+          };
+        };
+
+        mtls = lib.mkOption {
+          default = null;
+          description = "mTLS material used to authenticate builders.";
+          type = lib.types.nullOr (
+            lib.types.submodule {
+              options = {
+                serverCertPath = lib.mkOption {
+                  type = lib.types.path;
+                  description = "Server certificate path.";
+                };
+
+                serverKeyPath = lib.mkOption {
+                  type = lib.types.path;
+                  description = "Server key path.";
+                };
+
+                clientCaCertPath = lib.mkOption {
+                  type = lib.types.path;
+                  description = "Client CA certificate path.";
+                };
+              };
+            }
+          );
+        };
+
+        awsCredentialsFile = lib.mkOption {
+          type = lib.types.nullOr lib.types.path;
+          default = null;
+          description = ''
+            Path to an AWS credentials file, exported as
+            `AWS_SHARED_CREDENTIALS_FILE` to the queue runner.
+          '';
+        };
+      };
     };
 
   };
@@ -282,10 +691,16 @@ in
       description = "Hydra queue runner";
       group = "hydra";
       useDefaultShell = true;
-      home = "${baseDir}/queue-runner"; # really only to keep SSH happy
+      home = "${baseDir}/queue-runner";
       uid = config.ids.uids.hydra-queue-runner;
     };
 
+    users.users.hydra-ws = lib.mkIf cfg.ws.enable {
+      description = "Hydra WebSocket server";
+      group = "hydra";
+      isSystemUser = true;
+    };
+
     users.users.hydra-www = {
       description = "Hydra web server";
       group = "hydra";
@@ -303,6 +718,7 @@ in
       ''}
       gc_roots_dir = ${cfg.gcRootsDir}
       use-substitutes = ${if cfg.useSubstitutes then "1" else "0"}
+      queue_runner_endpoint = http://${queueRunnerCfg.rest.address}:${toString queueRunnerCfg.rest.port}
     '';
 
     environment.systemPackages = [ hydra-package ];
@@ -336,7 +752,7 @@ in
       requires = lib.optional haveLocalDB "postgresql.target";
       after = lib.optional haveLocalDB "postgresql.target";
       environment = env // {
-        HYDRA_DBI = "${env.HYDRA_DBI};application_name=hydra-init";
+        HYDRA_DATABASE_URL = dbUrlWithAppName "hydra-init";
       };
       path = [ pkgs.util-linux ];
       preStart = ''
@@ -404,7 +820,7 @@ in
         pkgs.bzip2
       ];
       environment = serverEnv // {
-        HYDRA_DBI = "${serverEnv.HYDRA_DBI};application_name=hydra-server";
+        HYDRA_DATABASE_URL = dbUrlWithAppName "hydra-server";
       };
       restartTriggers = [ hydraConf ];
       serviceConfig = {
@@ -420,38 +836,210 @@ in
     };
 
     systemd.services.hydra-queue-runner = {
+      description = "Hydra queue runner";
       wantedBy = [ "multi-user.target" ];
-      requires = [ "hydra-init.service" ];
+      requires = [
+        "hydra-init.service"
+        "nix-daemon.socket"
+        "hydra-queue-runner-rest.socket"
+        "hydra-queue-runner-grpc.socket"
+      ];
       after = [
         "hydra-init.service"
         "network.target"
       ];
-      path = [
-        config.nix.package
-        hydra-package
-        pkgs.bzip2
-        pkgs.hostname-debian
-        pkgs.openssh
-      ];
-      restartTriggers = [ hydraConf ];
-      environment = env // {
-        PGPASSFILE = "${baseDir}/pgpass-queue-runner"; # grrr
-        IN_SYSTEMD = "1"; # to get log severity levels
-        HYDRA_DBI = "${env.HYDRA_DBI};application_name=hydra-queue-runner";
+      reloadTriggers = [ config.environment.etc."hydra/queue-runner.toml".source ];
+
+      environment = {
+        NIX_REMOTE = "daemon";
+        RUST_BACKTRACE = "1";
+        # nix-store wants $HOME for its cache dir.
+        HOME = "/run/hydra-queue-runner";
+      }
+      // lib.optionalAttrs (queueRunnerCfg.awsCredentialsFile != null) {
+        AWS_SHARED_CREDENTIALS_FILE = queueRunnerCfg.awsCredentialsFile;
       };
+
       serviceConfig = {
-        ExecStart = "@${hydra-package}/bin/hydra-queue-runner hydra-queue-runner -v";
-        ExecStopPost = "${hydra-package}/bin/hydra-queue-runner --unlock";
-        User = "hydra-queue-runner";
+        Type = "notify";
         Restart = "always";
+        RestartSec = "5s";
         Slice = "system-hydra.slice";
 
-        # Ensure we can get core dumps.
-        LimitCORE = "infinity";
+        # One gRPC stream per builder plus DB pool. 1024 is easily exhausted.
+        LimitNOFILE = 65536;
+
+        ExecStart = lib.escapeShellArgs (
+          [
+            (lib.getExe queueRunnerCfg.package)
+            "--rest-bind"
+            "-"
+            "--grpc-bind"
+            "-"
+            "--config-path"
+            "/etc/hydra/queue-runner.toml"
+          ]
+          ++ lib.optionals (queueRunnerCfg.mtls != null) [
+            "--server-cert-path"
+            queueRunnerCfg.mtls.serverCertPath
+            "--server-key-path"
+            queueRunnerCfg.mtls.serverKeyPath
+            "--client-ca-cert-path"
+            queueRunnerCfg.mtls.clientCaCertPath
+          ]
+        );
+        ExecReload = "${pkgs.util-linux}/bin/kill -HUP $MAINPID";
+
+        User = "hydra-queue-runner";
+        Group = "hydra";
+
+        RuntimeDirectory = "hydra-queue-runner";
         WorkingDirectory = "${baseDir}/queue-runner";
+
+        # Created by hydra-init. StateDirectory= would chown ${baseDir}.
+        ReadWritePaths = [
+          "/nix/var/nix/gcroots/"
+          "/nix/var/nix/daemon-socket/socket"
+          "${baseDir}/build-logs/"
+          "${baseDir}/queue-runner/"
+        ]
+        ++ lib.optionals (lib.hasInfix "%2Frun%2Fpostgresql" queueRunnerCfg.settings.dbUrl) [
+          "/run/postgresql/.s.PGSQL.${toString config.services.postgresql.settings.port}"
+        ];
+        ReadOnlyPaths = [ "/nix/" ];
+
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        UMask = "0022";
       };
     };
 
+    systemd.sockets.hydra-queue-runner-rest = {
+      description = "Hydra queue runner REST socket";
+      wantedBy = [ "sockets.target" ];
+      socketConfig = {
+        ListenStream = "${queueRunnerCfg.rest.address}:${toString queueRunnerCfg.rest.port}";
+        FileDescriptorName = "rest";
+        Service = "hydra-queue-runner.service";
+      };
+    };
+
+    systemd.sockets.hydra-queue-runner-grpc = {
+      description = "Hydra queue runner gRPC socket";
+      wantedBy = [ "sockets.target" ];
+      socketConfig = {
+        ListenStream = "${queueRunnerCfg.grpc.address}:${toString queueRunnerCfg.grpc.port}";
+        FileDescriptorName = "grpc";
+        Service = "hydra-queue-runner.service";
+      };
+    };
+
+    environment.etc."hydra/queue-runner.toml".source = toml.generate "queue-runner.toml" (
+      lib.filterAttrsRecursive (_: v: v != null) queueRunnerCfg.settings
+    );
+
+    systemd.services.hydra-ws = lib.mkIf cfg.ws.enable {
+      description = "Hydra WebSocket server";
+      wantedBy = [ "multi-user.target" ];
+      requires = [ "hydra-ws.socket" ];
+      after = [
+        "hydra-init.service"
+        "network.target"
+      ];
+      reloadTriggers = [ config.environment.etc."hydra/ws.toml".source ];
+
+      serviceConfig = {
+        Type = "notify";
+        Restart = "always";
+        RestartSec = "5s";
+        Slice = "system-hydra.slice";
+
+        ExecStart = lib.escapeShellArgs [
+          (lib.getExe cfg.ws.package)
+          "--bind"
+          "-"
+          "--config-path"
+          "/etc/hydra/ws.toml"
+        ];
+
+        User = "hydra-ws";
+        Group = "hydra";
+
+        RuntimeDirectory = "hydra-ws";
+
+        ReadOnlyPaths = [ "${baseDir}/build-logs/" ];
+        ReadWritePaths = lib.optionals (lib.hasInfix "%2Frun%2Fpostgresql" cfg.ws.settings.dbUrl) [
+          "/run/postgresql/.s.PGSQL.${toString config.services.postgresql.settings.port}"
+        ];
+
+        CapabilityBoundingSet = "";
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        NoNewPrivileges = true;
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        PrivateUsers = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHome = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProtectSystem = "strict";
+        RemoveIPC = true;
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        RestrictSUIDSGID = true;
+        SystemCallArchitectures = "native";
+        SystemCallFilter = [
+          "@system-service"
+          "~@privileged"
+          "~@resources"
+        ];
+        UMask = "0022";
+      };
+    };
+
+    systemd.sockets.hydra-ws = lib.mkIf cfg.ws.enable {
+      description = "Hydra WebSocket socket";
+      wantedBy = [ "sockets.target" ];
+      socketConfig = {
+        ListenStream = "${cfg.ws.bind.address}:${toString cfg.ws.bind.port}";
+        FileDescriptorName = "ws";
+        Service = "hydra-ws.service";
+      };
+    };
+
+    environment.etc."hydra/ws.toml" = lib.mkIf cfg.ws.enable {
+      source = toml.generate "ws.toml" (lib.filterAttrsRecursive (_: v: v != null) cfg.ws.settings);
+    };
+
     systemd.services.hydra-evaluator = {
       wantedBy = [ "multi-user.target" ];
       requires = [ "hydra-init.service" ];
@@ -461,17 +1049,31 @@ in
         "network.target"
         "network-online.target"
       ];
-      path = with pkgs; [
-        hostname-debian
-        hydra-package
-        jq
+      path = [
+        pkgs.hostname-debian
+        pkgs.jq
+        hydra-package # hydra-eval-jobset
+      ];
+      restartTriggers = [
+        hydraConf
+        config.environment.etc."hydra/evaluator.toml".source
       ];
-      restartTriggers = [ hydraConf ];
       environment = env // {
-        HYDRA_DBI = "${env.HYDRA_DBI};application_name=hydra-evaluator";
+        HYDRA_DATABASE_URL = dbUrlWithAppName "hydra-evaluator";
       };
       serviceConfig = {
-        ExecStart = "@${hydra-package}/bin/hydra-evaluator hydra-evaluator";
+        ExecStart = lib.escapeShellArgs [
+          "@${lib.getExe cfg.evaluatorPackage}"
+          "hydra-evaluator"
+          "--config-path"
+          "/etc/hydra/evaluator.toml"
+        ];
+        ExecStopPost = lib.escapeShellArgs [
+          (lib.getExe cfg.evaluatorPackage)
+          "--config-path"
+          "/etc/hydra/evaluator.toml"
+          "--unlock"
+        ];
         User = "hydra";
         Restart = "always";
         WorkingDirectory = baseDir;
@@ -479,11 +1081,14 @@ in
       };
     };
 
+    environment.etc."hydra/evaluator.toml".source =
+      toml.generate "evaluator.toml" cfg.evaluatorSettings;
+
     systemd.services.hydra-update-gc-roots = {
       requires = [ "hydra-init.service" ];
       after = [ "hydra-init.service" ];
       environment = env // {
-        HYDRA_DBI = "${env.HYDRA_DBI};application_name=hydra-update-gc-roots";
+        HYDRA_DATABASE_URL = dbUrlWithAppName "hydra-update-gc-roots";
       };
       serviceConfig = {
         ExecStart = "@${hydra-package}/bin/hydra-update-gc-roots hydra-update-gc-roots";
@@ -497,7 +1102,7 @@ in
       wantedBy = [ "multi-user.target" ];
       after = [ "hydra-init.service" ];
       environment = env // {
-        HYDRA_DBI = "${env.HYDRA_DBI};application_name=hydra-send-stats";
+        HYDRA_DATABASE_URL = dbUrlWithAppName "hydra-send-stats";
       };
       serviceConfig = {
         ExecStart = "@${hydra-package}/bin/hydra-send-stats hydra-send-stats";
@@ -514,7 +1119,7 @@ in
       path = [ pkgs.zstd ];
       environment = env // {
         PGPASSFILE = "${baseDir}/pgpass-queue-runner";
-        HYDRA_DBI = "${env.HYDRA_DBI};application_name=hydra-notify";
+        HYDRA_DATABASE_URL = dbUrlWithAppName "hydra-notify";
       };
       serviceConfig = {
         ExecStart = "@${hydra-package}/bin/hydra-notify hydra-notify";
@@ -567,12 +1172,17 @@ in
 
     services.postgresql.enable = lib.mkIf haveLocalDB true;
 
-    services.postgresql.identMap = lib.optionalString haveLocalDB ''
-      hydra hydra hydra
-      hydra hydra-queue-runner hydra
-      hydra hydra-www hydra
-      hydra root hydra
-    '';
+    services.postgresql.identMap = lib.optionalString haveLocalDB (
+      ''
+        hydra hydra hydra
+        hydra hydra-queue-runner hydra
+        hydra hydra-www hydra
+        hydra root hydra
+      ''
+      + lib.optionalString cfg.ws.enable ''
+        hydra hydra-ws hydra
+      ''
+    );
 
     services.postgresql.authentication = lib.optionalString haveLocalDB ''
       local all hydra peer map=hydra
diff --git a/nixos/tests/hydra/common.nix b/nixos/tests/hydra/common.nix
index 60c7143acc29..b1d84d37c1ec 100644
--- a/nixos/tests/hydra/common.nix
+++ b/nixos/tests/hydra/common.nix
@@ -1,6 +1,6 @@
 {
   baseConfig =
-    { pkgs, ... }:
+    { config, pkgs, ... }:
     let
       trivialJob = pkgs.writeTextDir "trivial.nix" ''
         { trivial = derivation {
@@ -39,9 +39,19 @@
         hydraURL = "example.com";
         notificationSender = "example@example.com";
         extraConfig = ''
-          email_notification = 1
+          <email_notifications>
+            build = 1
+          </email_notifications>
         '';
       };
+
+      # Local build agent so that queued builds actually get executed.
+      services.hydra-builder = {
+        enable = true;
+        queueRunnerAddr = "http://[::1]:${toString config.services.hydra.queueRunner.grpc.port}";
+      };
+      systemd.services.hydra-builder.after = [ "hydra-queue-runner.service" ];
+
       services.postfix.enable = true;
       nix.settings.substituters = [ ];
       nix.enable = true; # disabled by default. See all-tests.nix / tag(no-nix-by-default)
diff --git a/nixos/tests/hydra/default.nix b/nixos/tests/hydra/default.nix
index 91913102bd98..66f43ca2b338 100644
--- a/nixos/tests/hydra/default.nix
+++ b/nixos/tests/hydra/default.nix
@@ -21,9 +21,12 @@ in
     machine.wait_for_unit("postgresql.target")
     # test whether the actual hydra daemons are running
     machine.wait_for_unit("hydra-init.service")
-    machine.require_unit_state("hydra-queue-runner.service")
+    machine.wait_for_unit("hydra-queue-runner.service")
     machine.require_unit_state("hydra-evaluator.service")
     machine.require_unit_state("hydra-notify.service")
+    machine.wait_for_open_port(50051)
+    machine.wait_for_unit("hydra-builder.service")
+    machine.wait_for_unit("hydra-ws.service")
 
     machine.succeed("hydra-create-user admin --role admin --password admin")
 
@@ -37,8 +40,15 @@ in
         'curl -L -s http://localhost:3000/build/1 -H "Accept: application/json" |  jq .buildstatus | xargs test 0 -eq'
     )
 
+    # The web interface reads the machine list from the queue runner's REST
+    # endpoint, which it only knows about through `queue_runner_endpoint` in
+    # hydra.conf.
     machine.wait_until_succeeds(
-        'journalctl -eu hydra-notify.service -o cat | grep -q "sending mail notification to hydra@localhost"'
+        'curl -L -s http://localhost:3000/machines -H "Accept: application/json" | jq -e "length > 0"'
+    )
+
+    machine.wait_until_succeeds(
+        'journalctl -eu hydra-notify.service -o cat | grep -q "sending mail notification for changed build status to hydra@localhost"'
     )
   '';
 }

From 6b8e907be23a3656c19fe90108781419754d0d69 Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Sat, 3 Oct 2026 12:17:58 +0200
Subject: [PATCH 43/78] tt-umd: 0.9.6 -> 0.9.12

---
 pkgs/by-name/tt/tt-umd/fix-targets.patch      | 35 -------------------
 ...shared-yaml-cpp-into-baremetal-tests.patch | 24 +++++++++++++
 pkgs/by-name/tt/tt-umd/package.nix            |  9 ++---
 3 files changed, 29 insertions(+), 39 deletions(-)
 delete mode 100644 pkgs/by-name/tt/tt-umd/fix-targets.patch
 create mode 100644 pkgs/by-name/tt/tt-umd/link-shared-yaml-cpp-into-baremetal-tests.patch

diff --git a/pkgs/by-name/tt/tt-umd/fix-targets.patch b/pkgs/by-name/tt/tt-umd/fix-targets.patch
deleted file mode 100644
index df35f4d8a650..000000000000
--- a/pkgs/by-name/tt/tt-umd/fix-targets.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-diff --git a/third_party/CMakeLists.txt b/third_party/CMakeLists.txt
-index 96d71990..1db71f88 100644
---- a/third_party/CMakeLists.txt
-+++ b/third_party/CMakeLists.txt
-@@ -43,6 +43,7 @@ CPMAddPackage(
-         "YAML_CPP_BUILD_TESTS OFF"
-         "YAML_CPP_BUILD_TOOLS OFF"
-         "YAML_BUILD_SHARED_LIBS OFF"
-+    FIND_PACKAGE_ARGUMENTS GLOBAL
- )
- 
- if(yaml-cpp_ADDED)
-@@ -146,7 +147,13 @@ CPMAddPackage(
- ####################################################################################################################
- # tt-logger
- ####################################################################################################################
--CPMAddPackage(NAME tt-logger GITHUB_REPOSITORY tenstorrent/tt-logger VERSION 1.1.8 SYSTEM YES)
-+CPMAddPackage(
-+    NAME tt-logger
-+    GITHUB_REPOSITORY tenstorrent/tt-logger
-+    VERSION 1.1.8
-+    SYSTEM YES
-+    FIND_PACKAGE_ARGUMENTS GLOBAL
-+)
- 
- ####################################################################################################################
- # cxxopts
-@@ -159,6 +166,7 @@ CPMAddPackage(
-     SYSTEM YES
-     OPTIONS
-         "CMAKE_MESSAGE_LOG_LEVEL NOTICE"
-+    FIND_PACKAGE_ARGUMENTS GLOBAL
- )
- 
- ####################################################################################################################
diff --git a/pkgs/by-name/tt/tt-umd/link-shared-yaml-cpp-into-baremetal-tests.patch b/pkgs/by-name/tt/tt-umd/link-shared-yaml-cpp-into-baremetal-tests.patch
new file mode 100644
index 000000000000..7061cce25b50
--- /dev/null
+++ b/pkgs/by-name/tt/tt-umd/link-shared-yaml-cpp-into-baremetal-tests.patch
@@ -0,0 +1,24 @@
+From da577871393fe65710d2040944e5610507e11dfd Mon Sep 17 00:00:00 2001
+From: liberodark <liberodark@gmail.com>
+Date: Sat, 3 Oct 2026 12:39:45 +0200
+Subject: [PATCH] Link a shared yaml-cpp into baremetal_tests
+
+---
+ tests/baremetal/CMakeLists.txt | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/tests/baremetal/CMakeLists.txt b/tests/baremetal/CMakeLists.txt
+index 0971048ecaca13ae2438ca4905dc0d2ccf8ddaa5..6d417739360305c8467b581931cb830d3553b155 100644
+--- a/tests/baremetal/CMakeLists.txt
++++ b/tests/baremetal/CMakeLists.txt
+@@ -33,6 +33,10 @@ target_link_libraries(baremetal_tests PRIVATE test_common)
+ # the library would place a second copy of it in this binary beside the one already inside
+ # libtt-umd.so, which ASan reports as an ODR violation on YAML::Exception's typeinfo.
+ target_include_directories(baremetal_tests PRIVATE $<TARGET_PROPERTY:yaml-cpp::yaml-cpp,INTERFACE_INCLUDE_DIRECTORIES>)
++get_target_property(YAML_CPP_TYPE yaml-cpp::yaml-cpp TYPE)
++if(YAML_CPP_TYPE STREQUAL "SHARED_LIBRARY")
++    target_link_libraries(baremetal_tests PRIVATE yaml-cpp::yaml-cpp)
++endif()
+ if(TT_UMD_BUILD_EMULE)
+     target_sources(baremetal_tests PRIVATE test_sw_emule_chip.cpp)
+     target_link_libraries(baremetal_tests PRIVATE tt-emule::headers)
diff --git a/pkgs/by-name/tt/tt-umd/package.nix b/pkgs/by-name/tt/tt-umd/package.nix
index 23b2e44c2cf8..09370f83a208 100644
--- a/pkgs/by-name/tt/tt-umd/package.nix
+++ b/pkgs/by-name/tt/tt-umd/package.nix
@@ -18,7 +18,7 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "tt-umd";
-  version = "0.9.6";
+  version = "0.9.12";
   __structuredAttrs = true;
   strictDeps = true;
 
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "tenstorrent";
     repo = "tt-umd";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3IrgsKRaJP/rEXiMvi2LnzS9n2+Giu5d05RohzRgPw4=";
+    hash = "sha256-lhcNZuCV8n3ebbUU1MveZXR49qaybmOiSTLpitG96/s=";
   };
 
   cpm = fetchurl {
@@ -40,8 +40,8 @@ stdenv.mkDerivation (finalAttrs: {
   };
 
   patches = [
-    # https://github.com/tenstorrent/tt-umd/pull/2187
-    ./fix-targets.patch
+    # https://github.com/tenstorrent/tt-umd/pull/3593
+    ./link-shared-yaml-cpp-into-baremetal-tests.patch
   ];
 
   postPatch = ''
@@ -82,6 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "TT_UMD_BUILD_TESTS" finalAttrs.finalPackage.doCheck)
     (lib.cmakeBool "TT_UMD_BUILD_STATIC" stdenv.hostPlatform.isStatic)
     (lib.cmakeBool "TT_UMD_BUILD_PYTHON" true)
+    (lib.cmakeBool "CMAKE_COMPILE_WARNING_AS_ERROR" false)
     (lib.cmakeFeature "nanobind_DIR" "${python3.pkgs.nanobind}/${python3.sitePackages}/nanobind/cmake")
   ];
 

From 508b820bdc40d2c8262e2a0b45f15858f412635e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Na=C3=AFm=20Camille=20Favier?= <n@monade.li>
Date: Sat, 3 Oct 2026 14:56:49 +0200
Subject: [PATCH 44/78] kitty: make libraries available at runtime

Kitty loads certain libraries dynamically via dlopen, so we need to make
sure it finds them.

`libxi` in particular is required for the `pixel_scroll` feature to work.
---
 pkgs/by-name/ki/kitty/package.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/ki/kitty/package.nix b/pkgs/by-name/ki/kitty/package.nix
index bbcf968e2eaf..8a57d88ec989 100644
--- a/pkgs/by-name/ki/kitty/package.nix
+++ b/pkgs/by-name/ki/kitty/package.nix
@@ -151,6 +151,15 @@ buildPythonApplication rec {
     })
   ];
 
+  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
+    substituteInPlace glfw/x11_init.c \
+      --replace-fail 'libXi.so.6'       '${lib.getLib libxi}/lib/libXi.so.6' \
+      --replace-fail 'libXrandr.so.2'   '${lib.getLib libxrandr}/lib/libXrandr.so.2' \
+      --replace-fail 'libXcursor.so.1'  '${lib.getLib libxcursor}/lib/libXcursor.so.1' \
+      --replace-fail 'libXinerama.so.1' '${lib.getLib libxinerama}/lib/libXinerama.so.1' \
+      --replace-fail 'libXext.so.6'     '${lib.getLib libxext}/lib/libXext.so.6'
+  '';
+
   hardeningDisable = [
     # causes redefinition of _FORTIFY_SOURCE
     "fortify3"

From 590458b01038eab49dcc6f2a775b81bc67a4669d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 3 Oct 2026 19:40:25 +0000
Subject: [PATCH 45/78] pdfjs: 6.3.289 -> 6.4.299

---
 pkgs/by-name/pd/pdfjs/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pd/pdfjs/package.nix b/pkgs/by-name/pd/pdfjs/package.nix
index ac8be4748b4a..e65518609a90 100644
--- a/pkgs/by-name/pd/pdfjs/package.nix
+++ b/pkgs/by-name/pd/pdfjs/package.nix
@@ -6,14 +6,14 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "pdfjs";
-  version = "6.3.289";
+  version = "6.4.299";
 
   strictDeps = true;
   __structuredAttrs = true;
 
   src = fetchzip {
     url = "https://github.com/mozilla/pdf.js/releases/download/v${finalAttrs.version}/pdfjs-${finalAttrs.version}-dist.zip";
-    hash = "sha256-v8LoUEOgG8t1Al4vpKrXZ3D4HEDXd4bqRUFqUbN63qk=";
+    hash = "sha256-UHMYW6fHRL7by4sP7NXE5NuTKtmUPfInK6KunbnP88w=";
     stripRoot = false;
   };
 

From 481d934264615be75bcd3e949eda0c0ba8687b75 Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Mon, 28 Sep 2026 02:02:56 -0400
Subject: [PATCH 46/78] python3Packages.pycuda: remove cudatoolkit

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 .../python-modules/pycuda/default.nix         | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/pycuda/default.nix b/pkgs/development/python-modules/pycuda/default.nix
index c2a3c43c9289..d05b24b45ba7 100644
--- a/pkgs/development/python-modules/pycuda/default.nix
+++ b/pkgs/development/python-modules/pycuda/default.nix
@@ -15,11 +15,21 @@
   python,
   mkDerivation,
   lib,
+  symlinkJoin,
 }:
 let
   compyte = import ./compyte.nix { inherit mkDerivation fetchFromGitHub; };
 
-  inherit (cudaPackages) cudatoolkit;
+  cudaRoot = symlinkJoin {
+    name = "pycuda-cuda-root";
+    paths = with cudaPackages; [
+      cuda_cudart
+      cuda_nvcc
+      (lib.getInclude cuda_profiler_api)
+      (lib.getInclude libcurand)
+      (lib.getLib libcurand)
+    ];
+  };
 in
 buildPythonPackage rec {
   pname = "pycuda";
@@ -36,7 +46,7 @@ buildPythonPackage rec {
                           --boost-lib-dir=${boost}/lib \
                           --no-use-shipped-boost \
                           --boost-python-libname=boost_python${major python.version}${minor python.version} \
-                          --cuda-root=${cudatoolkit}
+                          --cuda-root=${cudaRoot}
   '';
 
   postInstall = ''
@@ -66,7 +76,10 @@ buildPythonPackage rec {
     decorator
     appdirs
     six
-    cudatoolkit
+    cudaPackages.cuda_cudart
+    cudaPackages.cuda_nvcc
+    (lib.getInclude cudaPackages.cuda_profiler_api)
+    cudaPackages.libcurand
     compyte
     python
     mako

From a9058c08f4e43db5dc6fad7fe49b238d963c6acd Mon Sep 17 00:00:00 2001
From: coolcuber <rpgeorg@clemson.edu>
Date: Sat, 26 Sep 2026 19:27:54 -0400
Subject: [PATCH 47/78] models-dev: fix version

---
 pkgs/by-name/mo/models-dev/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/mo/models-dev/package.nix b/pkgs/by-name/mo/models-dev/package.nix
index 14674bc91f38..abc25b097da8 100644
--- a/pkgs/by-name/mo/models-dev/package.nix
+++ b/pkgs/by-name/mo/models-dev/package.nix
@@ -60,7 +60,7 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "models-dev";
-  version = "sdk-v0.0.5-unstable-2026-10-02";
+  version = "0.0.5-unstable-2026-10-02";
 
   __structuredAttrs = true;
   strictDeps = true;

From f393260b36bcf3c3637454e2d060375099b6ec9d Mon Sep 17 00:00:00 2001
From: Thiago Kenji Okada <thiagokokada@gmail.com>
Date: Sat, 3 Oct 2026 22:37:29 +0100
Subject: [PATCH 48/78] nixos-rebuild-ng: replace assert_has_calls with plain
 pytest asserts

`assert_has_calls` allows missing calls for the mock to not be declared.
To workaround this we also asserted the `call_count`, but this was not
enough and we ended up missing some mock assertions.

This PR replaces any `assert_has_calls` with a plain pytest `assert`,
that ensures both the number of calls and the actual calls. This way we
won't miss calls in the mocks anymore.

The only remaining usages of `assert_has_calls` is cases where we need
to use `any_order=True`, that is difficult to replace correctly with a
plain `assert`.
---
 .../nixos-rebuild-ng/src/tests/test_main.py   | 2058 ++++++++---------
 .../ni/nixos-rebuild-ng/src/tests/test_nix.py |  215 +-
 .../src/tests/test_services.py                |   16 +-
 3 files changed, 1122 insertions(+), 1167 deletions(-)

diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
index c8f70d9cf1e1..91c3bf93c729 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_main.py
@@ -236,89 +236,86 @@ def test_execute_nix_boot(mock_run: Mock, tmp_path: Path) -> None:
 
     nr.execute(["nixos-rebuild", "boot", "--no-flake", "-vvv", "--no-reexec"])
 
-    assert mock_run.call_count == 9
-    mock_run.assert_has_calls(
-        [
-            call(
-                ["nix-instantiate", "--find-file", "nixos-system"],
-                capture_output=True,
-                check=False,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                ["nix-instantiate", "--find-file", "nixpkgs", "-vvv"],
-                capture_output=True,
-                check=False,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                ["git", "-C", nixpkgs_path, "rev-parse", "--short", "HEAD"],
-                check=False,
-                capture_output=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                ["git", "-C", nixpkgs_path, "diff", "--quiet"],
-                check=False,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "nix-build",
-                    "<nixos-system>",
-                    "--attr",
-                    "config.system.build.toplevel",
-                    "--no-out-link",
-                    "-vvv",
-                ],
-                check=True,
-                stdout=PIPE,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "nix-env",
-                    "-p",
-                    Path("/nix/var/nix/profiles/system"),
-                    "--set",
-                    config_path,
-                ],
-                check=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                ["test", "-d", "/run/systemd/system"],
-                check=False,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                ["systemd-run", "--version"],
-                check=True,
-                capture_output=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    *nr.nix.SWITCH_TO_CONFIGURATION_CMD_PREFIX,
-                    "--wait",
-                    "--verbose",
-                    "--output=cat",
-                    config_path / "bin/switch-to-configuration",
-                    "boot",
-                ],
-                check=True,
-                stdout=ANY,
-                **(
-                    DEFAULT_RUN_KWARGS
-                    | {
-                        "env": {
-                            "NIXOS_INSTALL_BOOTLOADER": "0",
-                        }
+    assert mock_run.mock_calls == [
+        call(
+            ["nix-instantiate", "--find-file", "nixos-system"],
+            capture_output=True,
+            check=False,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            ["nix-instantiate", "--find-file", "nixpkgs", "-vvv"],
+            capture_output=True,
+            check=False,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            ["git", "-C", nixpkgs_path, "rev-parse", "--short", "HEAD"],
+            check=False,
+            capture_output=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            ["git", "-C", nixpkgs_path, "diff", "--quiet"],
+            check=False,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix-build",
+                "<nixos-system>",
+                "--attr",
+                "config.system.build.toplevel",
+                "--no-out-link",
+                "-vvv",
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix-env",
+                "-p",
+                Path("/nix/var/nix/profiles/system"),
+                "--set",
+                config_path,
+            ],
+            check=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            ["test", "-d", "/run/systemd/system"],
+            check=False,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            ["systemd-run", "--version"],
+            check=True,
+            capture_output=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                *nr.nix.SWITCH_TO_CONFIGURATION_CMD_PREFIX,
+                "--wait",
+                "--verbose",
+                "--output=cat",
+                config_path / "bin/switch-to-configuration",
+                "boot",
+            ],
+            check=True,
+            stdout=ANY,
+            **(
+                DEFAULT_RUN_KWARGS
+                | {
+                    "env": {
+                        "NIXOS_INSTALL_BOOTLOADER": "0",
                     }
-                ),
+                }
             ),
-        ]
-    )
+        ),
+    ]
 
 
 # https://github.com/NixOS/nixpkgs/issues/437872
@@ -343,31 +340,28 @@ def test_execute_nix_build(mock_run: Mock, tmp_path: Path) -> None:
         ]
     )
 
-    assert mock_run.call_count == 2
-    mock_run.assert_has_calls(
-        [
-            call(
-                ["nix-instantiate", "--find-file", "nixos-system"],
-                check=False,
-                capture_output=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "nix",
-                    "--extra-experimental-features",
-                    "nix-command flakes",
-                    "build",
-                    "--print-out-paths",
-                    '/path/to/config#nixosConfigurations."hostname".config.system.build.toplevel',
-                    "--no-link",
-                ],
-                check=True,
-                stdout=PIPE,
-                **DEFAULT_RUN_KWARGS,
-            ),
-        ]
-    )
+    assert mock_run.mock_calls == [
+        call(
+            ["nix-instantiate", "--find-file", "nixos-system"],
+            check=False,
+            capture_output=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix",
+                "--extra-experimental-features",
+                "nix-command flakes",
+                "build",
+                "--print-out-paths",
+                '/path/to/config#nixosConfigurations."hostname".config.system.build.toplevel',
+                "--no-link",
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+    ]
 
 
 @patch.dict(os.environ, {}, clear=True)
@@ -399,32 +393,29 @@ def test_execute_nix_build_vm(mock_run: Mock, tmp_path: Path) -> None:
         ]
     )
 
-    assert mock_run.call_count == 2
-    mock_run.assert_has_calls(
-        [
-            call(
-                ["nix-instantiate", "--find-file", "nixos-system"],
-                check=False,
-                capture_output=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "nix-build",
-                    "<nixpkgs/nixos>",
-                    "--attr",
-                    "config.system.build.vm",
-                    "--include",
-                    "nixos-config=./configuration.nix",
-                    "--include",
-                    "nixpkgs=$HOME/.nix-defexpr/channels/pinned_nixpkgs",
-                ],
-                check=True,
-                stdout=PIPE,
-                **DEFAULT_RUN_KWARGS,
-            ),
-        ]
-    )
+    assert mock_run.mock_calls == [
+        call(
+            ["nix-instantiate", "--find-file", "nixos-system"],
+            check=False,
+            capture_output=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix-build",
+                "<nixpkgs/nixos>",
+                "--attr",
+                "config.system.build.vm",
+                "--include",
+                "nixos-config=./configuration.nix",
+                "--include",
+                "nixpkgs=$HOME/.nix-defexpr/channels/pinned_nixpkgs",
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+    ]
 
 
 @patch.dict(os.environ, {}, clear=True)
@@ -456,28 +447,25 @@ def test_execute_nix_build_vm_with_bootloader_and_specialisation(
         ]
     )
 
-    assert mock_run.call_count == 2
-    mock_run.assert_has_calls(
-        [
-            call(
-                ["nix-instantiate", "--find-file", "nixos-system"],
-                check=False,
-                capture_output=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "nix-build",
-                    "<nixpkgs/nixos>",
-                    "--attr",
-                    "config.specialisation.custom-specialisation.configuration.system.build.vmWithBootLoader",
-                ],
-                check=True,
-                stdout=PIPE,
-                **DEFAULT_RUN_KWARGS,
-            ),
-        ]
-    )
+    assert mock_run.mock_calls == [
+        call(
+            ["nix-instantiate", "--find-file", "nixos-system"],
+            check=False,
+            capture_output=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix-build",
+                "<nixpkgs/nixos>",
+                "--attr",
+                "config.specialisation.custom-specialisation.configuration.system.build.vmWithBootLoader",
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+    ]
 
 
 @patch.dict(os.environ, {}, clear=True)
@@ -513,58 +501,55 @@ def test_execute_nix_build_image_flake(mock_run: Mock, tmp_path: Path) -> None:
         ]
     )
 
-    assert mock_run.call_count == 4
-    mock_run.assert_has_calls(
-        [
-            call(
-                ["nix-instantiate", "--find-file", "nixos-system"],
-                check=False,
-                capture_output=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "nix",
-                    "--extra-experimental-features",
-                    "nix-command flakes",
-                    "eval",
-                    "--json",
-                    '/path/to/config#nixosConfigurations."hostname".config.system.build.images',
-                    "--apply",
-                    "builtins.attrNames",
-                ],
-                check=True,
-                stdout=PIPE,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "nix",
-                    "--extra-experimental-features",
-                    "nix-command flakes",
-                    "build",
-                    "--print-out-paths",
-                    '/path/to/config#nixosConfigurations."hostname".config.system.build.images.azure',
-                ],
-                check=True,
-                stdout=PIPE,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "nix",
-                    "--extra-experimental-features",
-                    "nix-command flakes",
-                    "eval",
-                    "--json",
-                    '/path/to/config#nixosConfigurations."hostname".config.system.build.images.azure.passthru.filePath',
-                ],
-                check=True,
-                stdout=PIPE,
-                **DEFAULT_RUN_KWARGS,
-            ),
-        ]
-    )
+    assert mock_run.mock_calls == [
+        call(
+            ["nix-instantiate", "--find-file", "nixos-system"],
+            check=False,
+            capture_output=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix",
+                "--extra-experimental-features",
+                "nix-command flakes",
+                "eval",
+                "--json",
+                '/path/to/config#nixosConfigurations."hostname".config.system.build.images',
+                "--apply",
+                "builtins.attrNames",
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix",
+                "--extra-experimental-features",
+                "nix-command flakes",
+                "build",
+                "--print-out-paths",
+                '/path/to/config#nixosConfigurations."hostname".config.system.build.images.azure',
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix",
+                "--extra-experimental-features",
+                "nix-command flakes",
+                "eval",
+                "--json",
+                '/path/to/config#nixosConfigurations."hostname".config.system.build.images.azure.passthru.filePath',
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+    ]
 
 
 @patch.dict(
@@ -606,73 +591,70 @@ def test_execute_nix_switch_flake(mock_run: Mock, tmp_path: Path) -> None:
         ]
     )
 
-    assert mock_run.call_count == 6
-    mock_run.assert_has_calls(
-        [
-            call(
-                ["nix-instantiate", "--find-file", "nixos-system"],
-                check=False,
-                capture_output=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "nix",
-                    "--extra-experimental-features",
-                    "nix-command flakes",
-                    "build",
-                    "--print-out-paths",
-                    '/path/to/config#nixosConfigurations."hostname".config.system.build.toplevel',
-                    "--no-link",
-                    "-v",
-                    "--option",
-                    "narinfo-cache-negative-ttl",
-                    "1200",
-                ],
-                check=True,
-                stdout=PIPE,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "sudo",
-                    "nix-env",
-                    "-p",
-                    Path("/nix/var/nix/profiles/system"),
-                    "--set",
-                    config_path,
-                ],
-                check=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                ["test", "-d", "/run/systemd/system"],
-                check=False,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                ["systemd-run", "--version"],
-                check=True,
-                capture_output=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "sudo",
-                    "env",
-                    "-i",
-                    "NIXOS_INSTALL_BOOTLOADER=1",
-                    *nr.nix.SWITCH_TO_CONFIGURATION_CMD_PREFIX,
-                    "--pipe",
-                    config_path / "bin/switch-to-configuration",
-                    "switch",
-                ],
-                check=True,
-                stdout=ANY,
-                **DEFAULT_RUN_KWARGS,
-            ),
-        ]
-    )
+    assert mock_run.mock_calls == [
+        call(
+            ["nix-instantiate", "--find-file", "nixos-system"],
+            check=False,
+            capture_output=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix",
+                "--extra-experimental-features",
+                "nix-command flakes",
+                "build",
+                "--print-out-paths",
+                '/path/to/config#nixosConfigurations."hostname".config.system.build.toplevel',
+                "--no-link",
+                "-v",
+                "--option",
+                "narinfo-cache-negative-ttl",
+                "1200",
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "sudo",
+                "nix-env",
+                "-p",
+                Path("/nix/var/nix/profiles/system"),
+                "--set",
+                config_path,
+            ],
+            check=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            ["test", "-d", "/run/systemd/system"],
+            check=False,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            ["systemd-run", "--version"],
+            check=True,
+            capture_output=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "sudo",
+                "env",
+                "-i",
+                "NIXOS_INSTALL_BOOTLOADER=1",
+                *nr.nix.SWITCH_TO_CONFIGURATION_CMD_PREFIX,
+                "--pipe",
+                config_path / "bin/switch-to-configuration",
+                "switch",
+            ],
+            check=True,
+            stdout=ANY,
+            **DEFAULT_RUN_KWARGS,
+        ),
+    ]
 
 
 @patch.dict(
@@ -734,234 +716,231 @@ def test_execute_nix_switch_build_target_host_custom_profile(
         ]
     )
 
-    assert mock_run.call_count == 14
-    mock_run.assert_has_calls(
-        [
-            call(
-                ["nix-instantiate", "--find-file", "nixos-system"],
-                check=False,
-                capture_output=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "nix-instantiate",
-                    "--find-file",
-                    "nixpkgs",
-                    "--include",
-                    "nixos-config=./configuration.nix",
-                    "--include",
-                    "nixpkgs=$HOME/.nix-defexpr/channels/pinned_nixpkgs",
-                ],
-                check=False,
-                capture_output=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "nix-instantiate",
-                    "<nixpkgs/nixos>",
-                    "--attr",
-                    "config.system.build.toplevel",
-                    "--add-root",
-                    nr.tmpdir.TMPDIR_PATH / "00000000000000000000000000000000",
-                    "--include",
-                    "nixos-config=./configuration.nix",
-                    "--include",
-                    "nixpkgs=$HOME/.nix-defexpr/channels/pinned_nixpkgs",
-                ],
-                check=True,
-                stdout=PIPE,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                ["nix-copy-closure", "--to", "user@build-host", config_path],
-                check=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "ssh",
-                    *nr.process.SSH_DEFAULT_OPTS,
-                    "user@build-host",
-                    "--",
-                    "/bin/sh",
-                    "-c",
-                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
-                    "sh",
-                    "mktemp",
-                    "-d",
-                    "-t",
-                    "nixos-rebuild.XXXXX",
-                ],
-                check=True,
-                stdout=PIPE,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "ssh",
-                    *nr.process.SSH_DEFAULT_OPTS,
-                    "user@build-host",
-                    "--",
-                    "/bin/sh",
-                    "-c",
-                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
-                    "sh",
-                    "nix-store",
-                    "--realise",
-                    str(config_path),
-                    "--add-root",
-                    "/tmp/tmpdir/00000000000000000000000000000000",
-                ],
-                check=True,
-                stdout=PIPE,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "ssh",
-                    *nr.process.SSH_DEFAULT_OPTS,
-                    "user@build-host",
-                    "--",
-                    "/bin/sh",
-                    "-c",
-                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
-                    "sh",
-                    "readlink",
-                    "-f",
-                    "/tmp/tmpdir/config",
-                ],
-                check=True,
-                stdout=PIPE,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "ssh",
-                    *nr.process.SSH_DEFAULT_OPTS,
-                    "user@build-host",
-                    "--",
-                    "/bin/sh",
-                    "-c",
-                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
-                    "sh",
-                    "rm",
-                    "-rf",
-                    "/tmp/tmpdir",
-                ],
-                check=False,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "nix",
-                    "--extra-experimental-features",
-                    "nix-command flakes",
-                    "copy",
-                    "--from",
-                    "ssh://user@build-host",
-                    "--to",
-                    "ssh://user@target-host",
-                    config_path,
-                ],
-                check=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "ssh",
-                    *nr.process.SSH_DEFAULT_OPTS,
-                    "user@target-host",
-                    "--",
-                    "sudo",
-                    "/bin/sh",
-                    "-c",
-                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
-                    "sh",
-                    "mkdir",
-                    "-p",
-                    "/nix/var/nix/profiles/system-profiles",
-                ],
-                check=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "ssh",
-                    *nr.process.SSH_DEFAULT_OPTS,
-                    "user@target-host",
-                    "--",
-                    "sudo",
-                    "/bin/sh",
-                    "-c",
-                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
-                    "sh",
-                    "nix-env",
-                    "-p",
-                    "/nix/var/nix/profiles/system-profiles/custom-profile",
-                    "--set",
-                    str(config_path),
-                ],
-                check=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "ssh",
-                    *nr.process.SSH_DEFAULT_OPTS,
-                    "user@target-host",
-                    "--",
-                    "/bin/sh",
-                    "-c",
-                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
-                    "sh",
-                    "test",
-                    "-d",
-                    "/run/systemd/system",
-                ],
-                check=False,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "ssh",
-                    *nr.process.SSH_DEFAULT_OPTS,
-                    "user@target-host",
-                    "--",
-                    "/bin/sh",
-                    "-c",
-                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
-                    "sh",
-                    "systemd-run",
-                    "--version",
-                ],
-                check=True,
-                capture_output=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "ssh",
-                    *nr.process.SSH_DEFAULT_OPTS,
-                    "user@target-host",
-                    "--",
-                    "sudo",
-                    "/bin/sh",
-                    "-c",
-                    """'exec /usr/bin/env -i PATH="${PATH-}" LOCALE_ARCHIVE="${LOCALE_ARCHIVE-}" NIXOS_NO_CHECK="${NIXOS_NO_CHECK-}" NIXOS_INSTALL_BOOTLOADER=0 "$@"'""",
-                    "sh",
-                    *nr.nix.SWITCH_TO_CONFIGURATION_CMD_PREFIX,
-                    "--pipe",
-                    str(config_path / "bin/switch-to-configuration"),
-                    "switch",
-                ],
-                check=True,
-                stdout=ANY,
-                **DEFAULT_RUN_KWARGS,
-            ),
-        ]
-    )
+    assert mock_run.mock_calls == [
+        call(
+            ["nix-instantiate", "--find-file", "nixos-system"],
+            check=False,
+            capture_output=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix-instantiate",
+                "--find-file",
+                "nixpkgs",
+                "--include",
+                "nixos-config=./configuration.nix",
+                "--include",
+                "nixpkgs=$HOME/.nix-defexpr/channels/pinned_nixpkgs",
+            ],
+            check=False,
+            capture_output=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix-instantiate",
+                "<nixpkgs/nixos>",
+                "--attr",
+                "config.system.build.toplevel",
+                "--add-root",
+                nr.tmpdir.TMPDIR_PATH / "00000000000000000000000000000000",
+                "--include",
+                "nixos-config=./configuration.nix",
+                "--include",
+                "nixpkgs=$HOME/.nix-defexpr/channels/pinned_nixpkgs",
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            ["nix-copy-closure", "--to", "user@build-host", config_path],
+            check=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "ssh",
+                *nr.process.SSH_DEFAULT_OPTS,
+                "user@build-host",
+                "--",
+                "/bin/sh",
+                "-c",
+                """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
+                "sh",
+                "mktemp",
+                "-d",
+                "-t",
+                "nixos-rebuild.XXXXX",
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "ssh",
+                *nr.process.SSH_DEFAULT_OPTS,
+                "user@build-host",
+                "--",
+                "/bin/sh",
+                "-c",
+                """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
+                "sh",
+                "nix-store",
+                "--realise",
+                str(config_path),
+                "--add-root",
+                "/tmp/tmpdir/00000000000000000000000000000000",
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "ssh",
+                *nr.process.SSH_DEFAULT_OPTS,
+                "user@build-host",
+                "--",
+                "/bin/sh",
+                "-c",
+                """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
+                "sh",
+                "readlink",
+                "-f",
+                "/tmp/tmpdir/config",
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "ssh",
+                *nr.process.SSH_DEFAULT_OPTS,
+                "user@build-host",
+                "--",
+                "/bin/sh",
+                "-c",
+                """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
+                "sh",
+                "rm",
+                "-rf",
+                "/tmp/tmpdir",
+            ],
+            check=False,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix",
+                "--extra-experimental-features",
+                "nix-command flakes",
+                "copy",
+                "--from",
+                "ssh://user@build-host",
+                "--to",
+                "ssh://user@target-host",
+                config_path,
+            ],
+            check=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "ssh",
+                *nr.process.SSH_DEFAULT_OPTS,
+                "user@target-host",
+                "--",
+                "sudo",
+                "/bin/sh",
+                "-c",
+                """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
+                "sh",
+                "mkdir",
+                "-p",
+                "/nix/var/nix/profiles/system-profiles",
+            ],
+            check=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "ssh",
+                *nr.process.SSH_DEFAULT_OPTS,
+                "user@target-host",
+                "--",
+                "sudo",
+                "/bin/sh",
+                "-c",
+                """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
+                "sh",
+                "nix-env",
+                "-p",
+                "/nix/var/nix/profiles/system-profiles/custom-profile",
+                "--set",
+                str(config_path),
+            ],
+            check=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "ssh",
+                *nr.process.SSH_DEFAULT_OPTS,
+                "user@target-host",
+                "--",
+                "/bin/sh",
+                "-c",
+                """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
+                "sh",
+                "test",
+                "-d",
+                "/run/systemd/system",
+            ],
+            check=False,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "ssh",
+                *nr.process.SSH_DEFAULT_OPTS,
+                "user@target-host",
+                "--",
+                "/bin/sh",
+                "-c",
+                """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
+                "sh",
+                "systemd-run",
+                "--version",
+            ],
+            check=True,
+            capture_output=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "ssh",
+                *nr.process.SSH_DEFAULT_OPTS,
+                "user@target-host",
+                "--",
+                "sudo",
+                "/bin/sh",
+                "-c",
+                """'exec /usr/bin/env -i PATH="${PATH-}" LOCALE_ARCHIVE="${LOCALE_ARCHIVE-}" NIXOS_NO_CHECK="${NIXOS_NO_CHECK-}" NIXOS_INSTALL_BOOTLOADER=0 "$@"'""",
+                "sh",
+                *nr.nix.SWITCH_TO_CONFIGURATION_CMD_PREFIX,
+                "--pipe",
+                str(config_path / "bin/switch-to-configuration"),
+                "switch",
+            ],
+            check=True,
+            stdout=ANY,
+            **DEFAULT_RUN_KWARGS,
+        ),
+    ]
 
 
 @patch.dict(
@@ -1004,110 +983,107 @@ def test_execute_nix_switch_flake_target_host(
         ]
     )
 
-    assert mock_run.call_count == 7
-    mock_run.assert_has_calls(
-        [
-            call(
-                ["nix-instantiate", "--find-file", "nixos-system"],
-                check=False,
-                capture_output=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "nix",
-                    "--extra-experimental-features",
-                    "nix-command flakes",
-                    "build",
-                    "--print-out-paths",
-                    '/path/to/config#nixosConfigurations."hostname".config.system.build.toplevel',
-                    "--no-link",
-                ],
-                check=True,
-                stdout=PIPE,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                ["nix-copy-closure", "--to", "user@localhost", config_path],
-                check=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "ssh",
-                    *nr.process.SSH_DEFAULT_OPTS,
-                    "user@localhost",
-                    "--",
-                    "sudo",
-                    "/bin/sh",
-                    "-c",
-                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
-                    "sh",
-                    "nix-env",
-                    "-p",
-                    "/nix/var/nix/profiles/system",
-                    "--set",
-                    str(config_path),
-                ],
-                check=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "ssh",
-                    *nr.process.SSH_DEFAULT_OPTS,
-                    "user@localhost",
-                    "--",
-                    "/bin/sh",
-                    "-c",
-                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
-                    "sh",
-                    "test",
-                    "-d",
-                    "/run/systemd/system",
-                ],
-                check=False,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "ssh",
-                    *nr.process.SSH_DEFAULT_OPTS,
-                    "user@localhost",
-                    "--",
-                    "/bin/sh",
-                    "-c",
-                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
-                    "sh",
-                    "systemd-run",
-                    "--version",
-                ],
-                check=True,
-                capture_output=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "ssh",
-                    *nr.process.SSH_DEFAULT_OPTS,
-                    "user@localhost",
-                    "--",
-                    "sudo",
-                    "/bin/sh",
-                    "-c",
-                    """'exec /usr/bin/env -i PATH="${PATH-}" LOCALE_ARCHIVE="${LOCALE_ARCHIVE-}" NIXOS_NO_CHECK="${NIXOS_NO_CHECK-}" NIXOS_INSTALL_BOOTLOADER=0 "$@"'""",
-                    "sh",
-                    *nr.nix.SWITCH_TO_CONFIGURATION_CMD_PREFIX,
-                    "--pipe",
-                    str(config_path / "bin/switch-to-configuration"),
-                    "switch",
-                ],
-                check=True,
-                stdout=ANY,
-                **DEFAULT_RUN_KWARGS,
-            ),
-        ]
-    )
+    assert mock_run.mock_calls == [
+        call(
+            ["nix-instantiate", "--find-file", "nixos-system"],
+            check=False,
+            capture_output=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix",
+                "--extra-experimental-features",
+                "nix-command flakes",
+                "build",
+                "--print-out-paths",
+                '/path/to/config#nixosConfigurations."hostname".config.system.build.toplevel',
+                "--no-link",
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            ["nix-copy-closure", "--to", "user@localhost", config_path],
+            check=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "ssh",
+                *nr.process.SSH_DEFAULT_OPTS,
+                "user@localhost",
+                "--",
+                "sudo",
+                "/bin/sh",
+                "-c",
+                """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
+                "sh",
+                "nix-env",
+                "-p",
+                "/nix/var/nix/profiles/system",
+                "--set",
+                str(config_path),
+            ],
+            check=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "ssh",
+                *nr.process.SSH_DEFAULT_OPTS,
+                "user@localhost",
+                "--",
+                "/bin/sh",
+                "-c",
+                """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
+                "sh",
+                "test",
+                "-d",
+                "/run/systemd/system",
+            ],
+            check=False,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "ssh",
+                *nr.process.SSH_DEFAULT_OPTS,
+                "user@localhost",
+                "--",
+                "/bin/sh",
+                "-c",
+                """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
+                "sh",
+                "systemd-run",
+                "--version",
+            ],
+            check=True,
+            capture_output=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "ssh",
+                *nr.process.SSH_DEFAULT_OPTS,
+                "user@localhost",
+                "--",
+                "sudo",
+                "/bin/sh",
+                "-c",
+                """'exec /usr/bin/env -i PATH="${PATH-}" LOCALE_ARCHIVE="${LOCALE_ARCHIVE-}" NIXOS_NO_CHECK="${NIXOS_NO_CHECK-}" NIXOS_INSTALL_BOOTLOADER=0 "$@"'""",
+                "sh",
+                *nr.nix.SWITCH_TO_CONFIGURATION_CMD_PREFIX,
+                "--pipe",
+                str(config_path / "bin/switch-to-configuration"),
+                "switch",
+            ],
+            check=True,
+            stdout=ANY,
+            **DEFAULT_RUN_KWARGS,
+        ),
+    ]
 
 
 @patch.dict(
@@ -1151,100 +1127,97 @@ def test_execute_nix_switch_flake_build_host(
         ]
     )
 
-    assert mock_run.call_count == 9
-    mock_run.assert_has_calls(
-        [
-            call(
-                ["nix-instantiate", "--find-file", "nixos-system"],
-                check=False,
-                capture_output=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "nix",
-                    "--extra-experimental-features",
-                    "nix-command flakes",
-                    "eval",
-                    "--raw",
-                    '/path/to/config#nixosConfigurations."hostname".config.system.build.toplevel.drvPath',
-                ],
-                check=True,
-                stdout=PIPE,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                ["nix-copy-closure", "--to", "user@localhost", config_path],
-                check=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "ssh",
-                    *nr.process.SSH_DEFAULT_OPTS,
-                    "user@localhost",
-                    "--",
-                    "/bin/sh",
-                    "-c",
-                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
-                    "sh",
-                    "nix",
-                    "--extra-experimental-features",
-                    "'nix-command flakes'",
-                    "build",
-                    f"'{config_path}^*'",
-                    "--print-out-paths",
-                    "--no-link",
-                ],
-                check=True,
-                stdout=PIPE,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "nix-copy-closure",
-                    "--from",
-                    "user@localhost",
-                    config_path,
-                ],
-                check=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "nix-env",
-                    "-p",
-                    Path("/nix/var/nix/profiles/system"),
-                    "--set",
-                    config_path,
-                ],
-                check=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                ["test", "-d", "/run/systemd/system"],
-                check=False,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                ["systemd-run", "--version"],
-                check=True,
-                capture_output=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    *nr.nix.SWITCH_TO_CONFIGURATION_CMD_PREFIX,
-                    "--pipe",
-                    config_path / "bin/switch-to-configuration",
-                    "switch",
-                ],
-                check=True,
-                stdout=ANY,
-                **DEFAULT_RUN_KWARGS,
-            ),
-        ]
-    )
+    assert mock_run.mock_calls == [
+        call(
+            ["nix-instantiate", "--find-file", "nixos-system"],
+            check=False,
+            capture_output=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix",
+                "--extra-experimental-features",
+                "nix-command flakes",
+                "eval",
+                "--raw",
+                '/path/to/config#nixosConfigurations."hostname".config.system.build.toplevel.drvPath',
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            ["nix-copy-closure", "--to", "user@localhost", config_path],
+            check=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "ssh",
+                *nr.process.SSH_DEFAULT_OPTS,
+                "user@localhost",
+                "--",
+                "/bin/sh",
+                "-c",
+                """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
+                "sh",
+                "nix",
+                "--extra-experimental-features",
+                "'nix-command flakes'",
+                "build",
+                f"'{config_path}^*'",
+                "--print-out-paths",
+                "--no-link",
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix-copy-closure",
+                "--from",
+                "user@localhost",
+                config_path,
+            ],
+            check=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix-env",
+                "-p",
+                Path("/nix/var/nix/profiles/system"),
+                "--set",
+                config_path,
+            ],
+            check=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            ["test", "-d", "/run/systemd/system"],
+            check=False,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            ["systemd-run", "--version"],
+            check=True,
+            capture_output=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                *nr.nix.SWITCH_TO_CONFIGURATION_CMD_PREFIX,
+                "--pipe",
+                config_path / "bin/switch-to-configuration",
+                "switch",
+            ],
+            check=True,
+            stdout=ANY,
+            **DEFAULT_RUN_KWARGS,
+        ),
+    ]
 
 
 @patch("subprocess.run", autospec=True)
@@ -1277,60 +1250,57 @@ def test_execute_switch_rollback(mock_run: Mock, tmp_path: Path) -> None:
         ]
     )
 
-    assert mock_run.call_count == 6
-    mock_run.assert_has_calls(
-        [
-            call(
-                ["nix-instantiate", "--find-file", "nixos-system"],
-                capture_output=True,
-                check=False,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                ["nix-instantiate", "--find-file", "nixpkgs"],
-                check=False,
-                capture_output=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "git",
-                    "-C",
-                    nixpkgs_path,
-                    "rev-parse",
-                    "--short",
-                    "HEAD",
-                ],
-                check=False,
-                capture_output=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "nix-env",
-                    "--rollback",
-                    "-p",
-                    Path("/nix/var/nix/profiles/system"),
-                ],
-                check=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                ["test", "-d", "/run/systemd/system"],
-                check=False,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    Path("/nix/var/nix/profiles/system/bin/switch-to-configuration"),
-                    "switch",
-                ],
-                check=True,
-                stdout=ANY,
-                **DEFAULT_RUN_KWARGS,
-            ),
-        ]
-    )
+    assert mock_run.mock_calls == [
+        call(
+            ["nix-instantiate", "--find-file", "nixos-system"],
+            capture_output=True,
+            check=False,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            ["nix-instantiate", "--find-file", "nixpkgs"],
+            check=False,
+            capture_output=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "git",
+                "-C",
+                nixpkgs_path,
+                "rev-parse",
+                "--short",
+                "HEAD",
+            ],
+            check=False,
+            capture_output=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix-env",
+                "--rollback",
+                "-p",
+                Path("/nix/var/nix/profiles/system"),
+            ],
+            check=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            ["test", "-d", "/run/systemd/system"],
+            check=False,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                Path("/nix/var/nix/profiles/system/bin/switch-to-configuration"),
+                "switch",
+            ],
+            check=True,
+            stdout=ANY,
+            **DEFAULT_RUN_KWARGS,
+        ),
+    ]
 
 
 @patch("subprocess.run", autospec=True)
@@ -1346,28 +1316,25 @@ def test_execute_build(mock_run: Mock, tmp_path: Path) -> None:
 
     nr.execute(["nixos-rebuild", "build", "--no-flake", "--no-reexec"])
 
-    assert mock_run.call_count == 2
-    mock_run.assert_has_calls(
-        [
-            call(
-                ["nix-instantiate", "--find-file", "nixos-system"],
-                capture_output=True,
-                check=False,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "nix-build",
-                    "<nixpkgs/nixos>",
-                    "--attr",
-                    "config.system.build.toplevel",
-                ],
-                check=True,
-                stdout=PIPE,
-                **DEFAULT_RUN_KWARGS,
-            ),
-        ]
-    )
+    assert mock_run.mock_calls == [
+        call(
+            ["nix-instantiate", "--find-file", "nixos-system"],
+            capture_output=True,
+            check=False,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix-build",
+                "<nixpkgs/nixos>",
+                "--attr",
+                "config.system.build.toplevel",
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+    ]
 
 
 @patch("subprocess.run", autospec=True)
@@ -1397,57 +1364,54 @@ def test_execute_build_dry_run_build_and_target_remote(
         ]
     )
 
-    assert mock_run.call_count == 4
-    mock_run.assert_has_calls(
-        [
-            call(
-                ["nix-instantiate", "--find-file", "nixos-system"],
-                capture_output=True,
-                check=False,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "nix",
-                    "--extra-experimental-features",
-                    "nix-command flakes",
-                    "eval",
-                    "--raw",
-                    '/path/to/config#nixosConfigurations."hostname".config.system.build.toplevel.drvPath',
-                ],
-                check=True,
-                stdout=PIPE,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                ["nix-copy-closure", "--to", "user@build-host", config_path],
-                check=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "ssh",
-                    *nr.process.SSH_DEFAULT_OPTS,
-                    "user@build-host",
-                    "--",
-                    "/bin/sh",
-                    "-c",
-                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
-                    "sh",
-                    "nix",
-                    "--extra-experimental-features",
-                    "'nix-command flakes'",
-                    "build",
-                    f"'{config_path}^*'",
-                    "--print-out-paths",
-                    "--dry-run",
-                ],
-                check=True,
-                stdout=PIPE,
-                **DEFAULT_RUN_KWARGS,
-            ),
-        ]
-    )
+    assert mock_run.mock_calls == [
+        call(
+            ["nix-instantiate", "--find-file", "nixos-system"],
+            capture_output=True,
+            check=False,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix",
+                "--extra-experimental-features",
+                "nix-command flakes",
+                "eval",
+                "--raw",
+                '/path/to/config#nixosConfigurations."hostname".config.system.build.toplevel.drvPath',
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            ["nix-copy-closure", "--to", "user@build-host", config_path],
+            check=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "ssh",
+                *nr.process.SSH_DEFAULT_OPTS,
+                "user@build-host",
+                "--",
+                "/bin/sh",
+                "-c",
+                """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
+                "sh",
+                "nix",
+                "--extra-experimental-features",
+                "'nix-command flakes'",
+                "build",
+                f"'{config_path}^*'",
+                "--print-out-paths",
+                "--dry-run",
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+    ]
 
 
 @patch("subprocess.run", autospec=True)
@@ -1469,42 +1433,39 @@ def test_execute_test_flake(mock_run: Mock, tmp_path: Path) -> None:
         ["nixos-rebuild", "test", "--flake", "github:user/repo#hostname", "--no-reexec"]
     )
 
-    assert mock_run.call_count == 4
-    mock_run.assert_has_calls(
-        [
-            call(
-                ["nix-instantiate", "--find-file", "nixos-system"],
-                capture_output=True,
-                check=False,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "nix",
-                    "--extra-experimental-features",
-                    "nix-command flakes",
-                    "build",
-                    "--print-out-paths",
-                    'github:user/repo#nixosConfigurations."hostname".config.system.build.toplevel',
-                    "--no-link",
-                ],
-                check=True,
-                stdout=PIPE,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                ["test", "-d", "/run/systemd/system"],
-                check=False,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [config_path / "bin/switch-to-configuration", "test"],
-                check=True,
-                stdout=ANY,
-                **DEFAULT_RUN_KWARGS,
-            ),
-        ]
-    )
+    assert mock_run.mock_calls == [
+        call(
+            ["nix-instantiate", "--find-file", "nixos-system"],
+            capture_output=True,
+            check=False,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix",
+                "--extra-experimental-features",
+                "nix-command flakes",
+                "build",
+                "--print-out-paths",
+                'github:user/repo#nixosConfigurations."hostname".config.system.build.toplevel',
+                "--no-link",
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            ["test", "-d", "/run/systemd/system"],
+            check=False,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [config_path / "bin/switch-to-configuration", "test"],
+            check=True,
+            stdout=ANY,
+            **DEFAULT_RUN_KWARGS,
+        ),
+    ]
 
 
 @patch("subprocess.run", autospec=True)
@@ -1539,38 +1500,41 @@ def test_execute_test_rollback(
         ["nixos-rebuild", "test", "--rollback", "--profile-name", "foo", "--no-reexec"]
     )
 
-    assert mock_run.call_count == 4
-    mock_run.assert_has_calls(
-        [
-            call(
-                [
-                    "nix-env",
-                    "-p",
-                    Path("/nix/var/nix/profiles/system-profiles/foo"),
-                    "--list-generations",
-                ],
-                check=True,
-                stdout=PIPE,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                ["test", "-d", "/run/systemd/system"],
-                check=False,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    Path(
-                        "/nix/var/nix/profiles/system-profiles/foo-2083-link/bin/switch-to-configuration"
-                    ),
-                    "test",
-                ],
-                check=True,
-                stdout=ANY,
-                **DEFAULT_RUN_KWARGS,
-            ),
-        ]
-    )
+    assert mock_run.mock_calls == [
+        call(
+            ["nix-instantiate", "--find-file", "nixos-system"],
+            check=False,
+            capture_output=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix-env",
+                "-p",
+                Path("/nix/var/nix/profiles/system-profiles/foo"),
+                "--list-generations",
+            ],
+            check=True,
+            stdout=PIPE,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            ["test", "-d", "/run/systemd/system"],
+            check=False,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                Path(
+                    "/nix/var/nix/profiles/system-profiles/foo-2083-link/bin/switch-to-configuration"
+                ),
+                "test",
+            ],
+            check=True,
+            stdout=ANY,
+            **DEFAULT_RUN_KWARGS,
+        ),
+    ]
 
 
 @patch.dict(
@@ -1596,57 +1560,54 @@ def test_execute_switch_store_path(mock_run: Mock, tmp_path: Path) -> None:
     )
 
     # --store-path skips build and write_version_suffix, so only activation calls
-    assert mock_run.call_count == 5
-    mock_run.assert_has_calls(
-        [
-            call(
-                ["nix-instantiate", "--find-file", "nixos-system"],
-                capture_output=True,
-                check=False,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "nix-env",
-                    "-p",
-                    Path("/nix/var/nix/profiles/system"),
-                    "--set",
-                    config_path,
-                ],
-                check=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                ["test", "-d", "/run/systemd/system"],
-                check=False,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                ["systemd-run", "--version"],
-                check=True,
-                capture_output=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    *nr.nix.SWITCH_TO_CONFIGURATION_CMD_PREFIX,
-                    "--pipe",
-                    config_path / "bin/switch-to-configuration",
-                    "switch",
-                ],
-                check=True,
-                stdout=ANY,
-                **(
-                    DEFAULT_RUN_KWARGS
-                    | {
-                        "env": {
-                            "NIXOS_INSTALL_BOOTLOADER": "0",
-                        }
+    assert mock_run.mock_calls == [
+        call(
+            ["nix-instantiate", "--find-file", "nixos-system"],
+            capture_output=True,
+            check=False,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "nix-env",
+                "-p",
+                Path("/nix/var/nix/profiles/system"),
+                "--set",
+                config_path,
+            ],
+            check=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            ["test", "-d", "/run/systemd/system"],
+            check=False,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            ["systemd-run", "--version"],
+            check=True,
+            capture_output=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                *nr.nix.SWITCH_TO_CONFIGURATION_CMD_PREFIX,
+                "--pipe",
+                config_path / "bin/switch-to-configuration",
+                "switch",
+            ],
+            check=True,
+            stdout=ANY,
+            **(
+                DEFAULT_RUN_KWARGS
+                | {
+                    "env": {
+                        "NIXOS_INSTALL_BOOTLOADER": "0",
                     }
-                ),
+                }
             ),
-        ]
-    )
+        ),
+    ]
 
 
 @patch.dict(os.environ, {}, clear=True)
@@ -1676,110 +1637,107 @@ def test_execute_switch_store_path_target_host(
     )
 
     # --store-path skips build and write_version_suffix, so only copy/activation calls
-    assert mock_run.call_count == 7
-    mock_run.assert_has_calls(
-        [
-            call(
-                ["nix-instantiate", "--find-file", "nixos-system"],
-                check=False,
-                capture_output=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                ["nix-copy-closure", "--to", "user@remote-host", config_path],
-                check=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "ssh",
-                    *nr.process.SSH_DEFAULT_OPTS,
-                    "user@remote-host",
-                    "--",
-                    "/bin/sh",
-                    "-c",
-                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
-                    "sh",
-                    "test",
-                    "-f",
-                    str(config_path / "nixos-version"),
-                ],
-                check=False,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "ssh",
-                    *nr.process.SSH_DEFAULT_OPTS,
-                    "user@remote-host",
-                    "--",
-                    "sudo",
-                    "/bin/sh",
-                    "-c",
-                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
-                    "sh",
-                    "nix-env",
-                    "-p",
-                    "/nix/var/nix/profiles/system",
-                    "--set",
-                    str(config_path),
-                ],
-                check=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "ssh",
-                    *nr.process.SSH_DEFAULT_OPTS,
-                    "user@remote-host",
-                    "--",
-                    "/bin/sh",
-                    "-c",
-                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
-                    "sh",
-                    "test",
-                    "-d",
-                    "/run/systemd/system",
-                ],
-                check=False,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "ssh",
-                    *nr.process.SSH_DEFAULT_OPTS,
-                    "user@remote-host",
-                    "--",
-                    "/bin/sh",
-                    "-c",
-                    """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
-                    "sh",
-                    "systemd-run",
-                    "--version",
-                ],
-                check=True,
-                capture_output=True,
-                **DEFAULT_RUN_KWARGS,
-            ),
-            call(
-                [
-                    "ssh",
-                    *nr.process.SSH_DEFAULT_OPTS,
-                    "user@remote-host",
-                    "--",
-                    "sudo",
-                    "/bin/sh",
-                    "-c",
-                    """'exec /usr/bin/env -i PATH="${PATH-}" LOCALE_ARCHIVE="${LOCALE_ARCHIVE-}" NIXOS_NO_CHECK="${NIXOS_NO_CHECK-}" NIXOS_INSTALL_BOOTLOADER=0 "$@"'""",
-                    "sh",
-                    *nr.nix.SWITCH_TO_CONFIGURATION_CMD_PREFIX,
-                    "--pipe",
-                    str(config_path / "bin/switch-to-configuration"),
-                    "switch",
-                ],
-                check=True,
-                stdout=ANY,
-                **DEFAULT_RUN_KWARGS,
-            ),
-        ]
-    )
+    assert mock_run.mock_calls == [
+        call(
+            ["nix-instantiate", "--find-file", "nixos-system"],
+            check=False,
+            capture_output=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            ["nix-copy-closure", "--to", "user@remote-host", config_path],
+            check=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "ssh",
+                *nr.process.SSH_DEFAULT_OPTS,
+                "user@remote-host",
+                "--",
+                "/bin/sh",
+                "-c",
+                """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
+                "sh",
+                "test",
+                "-f",
+                str(config_path / "nixos-version"),
+            ],
+            check=False,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "ssh",
+                *nr.process.SSH_DEFAULT_OPTS,
+                "user@remote-host",
+                "--",
+                "sudo",
+                "/bin/sh",
+                "-c",
+                """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
+                "sh",
+                "nix-env",
+                "-p",
+                "/nix/var/nix/profiles/system",
+                "--set",
+                str(config_path),
+            ],
+            check=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "ssh",
+                *nr.process.SSH_DEFAULT_OPTS,
+                "user@remote-host",
+                "--",
+                "/bin/sh",
+                "-c",
+                """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
+                "sh",
+                "test",
+                "-d",
+                "/run/systemd/system",
+            ],
+            check=False,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "ssh",
+                *nr.process.SSH_DEFAULT_OPTS,
+                "user@remote-host",
+                "--",
+                "/bin/sh",
+                "-c",
+                """'exec /usr/bin/env -i PATH="${PATH-}" "$@"'""",
+                "sh",
+                "systemd-run",
+                "--version",
+            ],
+            check=True,
+            capture_output=True,
+            **DEFAULT_RUN_KWARGS,
+        ),
+        call(
+            [
+                "ssh",
+                *nr.process.SSH_DEFAULT_OPTS,
+                "user@remote-host",
+                "--",
+                "sudo",
+                "/bin/sh",
+                "-c",
+                """'exec /usr/bin/env -i PATH="${PATH-}" LOCALE_ARCHIVE="${LOCALE_ARCHIVE-}" NIXOS_NO_CHECK="${NIXOS_NO_CHECK-}" NIXOS_INSTALL_BOOTLOADER=0 "$@"'""",
+                "sh",
+                *nr.nix.SWITCH_TO_CONFIGURATION_CMD_PREFIX,
+                "--pipe",
+                str(config_path / "bin/switch-to-configuration"),
+                "switch",
+            ],
+            check=True,
+            stdout=ANY,
+            **DEFAULT_RUN_KWARGS,
+        ),
+    ]
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
index fb6d2fcdcb69..fcad913e1b68 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_nix.py
@@ -116,57 +116,55 @@ def test_build_remote(
         copy_flags={"copy": True},
     ) == Path("/path/to/config")
 
-    mock_run.assert_has_calls(
-        [
-            call(
-                [
-                    "nix-instantiate",
-                    "<nixpkgs/nixos>",
-                    "--attr",
-                    "preAttr.config.system.build.toplevel",
-                    "--add-root",
-                    n.tmpdir.TMPDIR_PATH / "00000000000000000000000000000001",
-                    "--inst",
-                ],
-                stdout=PIPE,
-            ),
-            call(
-                [
-                    "nix-copy-closure",
-                    "--copy",
-                    "--to",
-                    "user@host",
-                    Path("/path/to/file"),
-                ],
-                append_local_env={
-                    "NIX_SSHOPTS": " ".join(["--ssh opts", *p.SSH_DEFAULT_OPTS]),
-                },
-            ),
-            call(
-                ["mktemp", "-d", "-t", "nixos-rebuild.XXXXX"],
-                remote=build_host,
-                stdout=PIPE,
-            ),
-            call(
-                [
-                    "nix-store",
-                    "--realise",
-                    Path("/path/to/file"),
-                    "--add-root",
-                    Path("/tmp/tmpdir/00000000000000000000000000000002"),
-                    "--realise",
-                ],
-                remote=build_host,
-                stdout=PIPE,
-            ),
-            call(
-                ["readlink", "-f", "/tmp/tmpdir/config"],
-                remote=build_host,
-                stdout=PIPE,
-            ),
-            call(["rm", "-rf", Path("/tmp/tmpdir")], remote=build_host, check=False),
-        ]
-    )
+    assert mock_run.mock_calls == [
+        call(
+            [
+                "nix-instantiate",
+                "<nixpkgs/nixos>",
+                "--attr",
+                "preAttr.config.system.build.toplevel",
+                "--add-root",
+                n.tmpdir.TMPDIR_PATH / "00000000000000000000000000000001",
+                "--inst",
+            ],
+            stdout=PIPE,
+        ),
+        call(
+            [
+                "nix-copy-closure",
+                "--copy",
+                "--to",
+                "user@host",
+                Path("/path/to/file"),
+            ],
+            append_local_env={
+                "NIX_SSHOPTS": " ".join(["--ssh opts", *p.SSH_DEFAULT_OPTS]),
+            },
+        ),
+        call(
+            ["mktemp", "-d", "-t", "nixos-rebuild.XXXXX"],
+            remote=build_host,
+            stdout=PIPE,
+        ),
+        call(
+            [
+                "nix-store",
+                "--realise",
+                Path("/path/to/file"),
+                "--add-root",
+                Path("/tmp/tmpdir/00000000000000000000000000000002"),
+                "--realise",
+            ],
+            remote=build_host,
+            stdout=PIPE,
+        ),
+        call(
+            ["readlink", "-f", "/tmp/tmpdir/config"],
+            remote=build_host,
+            stdout=PIPE,
+        ),
+        call(["rm", "-rf", Path("/tmp/tmpdir")], remote=build_host, check=False),
+    ]
 
 
 @patch(
@@ -192,47 +190,45 @@ def test_build_remote_flake(
         copy_flags={"copy": True},
         flake_build_flags={"build": True},
     ) == Path("/path/to/file")
-    mock_run.assert_has_calls(
-        [
-            call(
-                [
-                    "nix",
-                    "--extra-experimental-features",
-                    "nix-command flakes",
-                    "eval",
-                    "--raw",
-                    '/flake.nix#nixosConfigurations."hostname".config.system.build.toplevel.drvPath',
-                    "--flake",
-                ],
-                stdout=PIPE,
-            ),
-            call(
-                [
-                    "nix-copy-closure",
-                    "--copy",
-                    "--to",
-                    "user@host",
-                    Path("/path/to/file"),
-                ],
-                append_local_env={
-                    "NIX_SSHOPTS": " ".join(["--ssh opts", *p.SSH_DEFAULT_OPTS]),
-                },
-            ),
-            call(
-                [
-                    "nix",
-                    "--extra-experimental-features",
-                    "nix-command flakes",
-                    "build",
-                    "/path/to/file^*",
-                    "--print-out-paths",
-                    "--build",
-                ],
-                remote=build_host,
-                stdout=PIPE,
-            ),
-        ]
-    )
+    assert mock_run.mock_calls == [
+        call(
+            [
+                "nix",
+                "--extra-experimental-features",
+                "nix-command flakes",
+                "eval",
+                "--raw",
+                '/flake.nix#nixosConfigurations."hostname".config.system.build.toplevel.drvPath',
+                "--flake",
+            ],
+            stdout=PIPE,
+        ),
+        call(
+            [
+                "nix-copy-closure",
+                "--copy",
+                "--to",
+                "user@host",
+                Path("/path/to/file"),
+            ],
+            append_local_env={
+                "NIX_SSHOPTS": " ".join(["--ssh opts", *p.SSH_DEFAULT_OPTS]),
+            },
+        ),
+        call(
+            [
+                "nix",
+                "--extra-experimental-features",
+                "nix-command flakes",
+                "build",
+                "/path/to/file^*",
+                "--print-out-paths",
+                "--build",
+            ],
+            remote=build_host,
+            stdout=PIPE,
+        ),
+    ]
 
 
 def test_copy_closure(monkeypatch: MonkeyPatch) -> None:
@@ -465,7 +461,7 @@ def test_get_nixpkgs_rev(tmpdir: Path) -> None:
         ],
     ) as mock_run:
         assert n.get_nixpkgs_rev(tmpdir) == ".git.0f7c82403fd6"
-        mock_run.assert_has_calls(expected_calls)
+        assert mock_run.mock_calls == expected_calls
 
     with patch(
         get_qualified_name(n.run_wrapper, n),
@@ -476,7 +472,7 @@ def test_get_nixpkgs_rev(tmpdir: Path) -> None:
         ],
     ) as mock_run:
         assert n.get_nixpkgs_rev(tmpdir) == ".git.0f7c82403fd6M"
-        mock_run.assert_has_calls(expected_calls)
+        assert mock_run.mock_calls == expected_calls
 
 
 def test_get_generations(tmp_path: Path) -> None:
@@ -821,20 +817,23 @@ def test_set_profile(mock_run: Mock) -> None:
         elevate=e.NO_ELEVATOR,
     )
 
-    mock_run.assert_has_calls(
-        [
-            call(
-                ["mkdir", "-p", profile_path.parent],
-                remote=target_host,
-                elevate=e.NO_ELEVATOR,
-            ),
-            call(
-                ["nix-env", "-p", profile_path, "--set", config_path],
-                remote=target_host,
-                elevate=e.NO_ELEVATOR,
-            ),
-        ]
-    )
+    assert mock_run.mock_calls == [
+        call(
+            ["test", "-f", Path("/path/to/config/nixos-version")],
+            remote=m.Remote(host="user@localhost", opts=[], store_type="ssh"),
+            check=False,
+        ),
+        call(
+            ["mkdir", "-p", profile_path.parent],
+            remote=target_host,
+            elevate=e.NO_ELEVATOR,
+        ),
+        call(
+            ["nix-env", "-p", profile_path, "--set", config_path],
+            remote=target_host,
+            elevate=e.NO_ELEVATOR,
+        ),
+    ]
 
     mock_run.reset_mock()
     mock_run.return_value = CompletedProcess([], 1)
diff --git a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_services.py b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_services.py
index 60ba1de9351b..2d158da1be70 100644
--- a/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_services.py
+++ b/pkgs/by-name/ni/nixos-rebuild-ng/src/tests/test_services.py
@@ -77,15 +77,13 @@ def test_reexec(
     mock_build.return_value = Path("/path")
 
     s.reexec(argv, args, grouped_nix_args)
-    mock_build.assert_has_calls(
-        [
-            call(
-                s.NIXOS_REBUILD_ATTR,
-                n.models.BuildAttr(ANY, ANY),
-                {"build": True, "no_out_link": True},
-            )
-        ]
-    )
+    assert mock_build.mock_calls == [
+        call(
+            s.NIXOS_REBUILD_ATTR,
+            n.models.BuildAttr(ANY, ANY),
+            {"build": True, "no_out_link": True},
+        )
+    ]
     # do not exec if there is no new version
     mock_execve.assert_not_called()
 

From 7e1dca37105052626b80ab5d7a0cd47abbb7b864 Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Sat, 3 Oct 2026 15:07:37 +0200
Subject: [PATCH 49/78] tt-metal: 0.62.2 -> 0.79.0

---
 pkgs/by-name/tt/tt-metal/deps.nix             | 211 ++++--
 pkgs/by-name/tt/tt-metal/elfio-cstdint.patch  |  11 +
 pkgs/by-name/tt/tt-metal/package.nix          |  24 +-
 pkgs/by-name/tt/tt-metal/sfpi.nix             |  16 +-
 .../tt-metal/spsc-marker-decode-simde.patch   | 622 ++++++++++++++++++
 5 files changed, 811 insertions(+), 73 deletions(-)
 create mode 100644 pkgs/by-name/tt/tt-metal/elfio-cstdint.patch
 create mode 100644 pkgs/by-name/tt/tt-metal/spsc-marker-decode-simde.patch

diff --git a/pkgs/by-name/tt/tt-metal/deps.nix b/pkgs/by-name/tt/tt-metal/deps.nix
index e447c89c75ad..92addbafdf28 100644
--- a/pkgs/by-name/tt/tt-metal/deps.nix
+++ b/pkgs/by-name/tt/tt-metal/deps.nix
@@ -1,12 +1,39 @@
-{ fetchFromGitHub }:
 {
+  fetchFromGitHub,
+  applyPatches,
+  ttMetalSrc,
+}:
+{
+  # third_party/CMakeLists.txt
+  blake3 = applyPatches {
+    src = fetchFromGitHub {
+      owner = "BLAKE3-team";
+      repo = "BLAKE3";
+      tag = "1.8.4";
+      hash = "sha256-Xz0LH0YpUjDishvXsW6VNK8msFlPXg08wFoSfbgws0g=";
+    };
+    patches = [
+      "${ttMetalSrc}/third_party/blake3_install_dir.patch"
+    ];
+  };
+  protobuf = applyPatches {
+    src = fetchFromGitHub {
+      owner = "protocolbuffers";
+      repo = "protobuf";
+      tag = "v21.12";
+      hash = "sha256-VZQEFHq17UsTH5CZZOcJBKiScGV2xPJ/e6gkkVliRCU=";
+    };
+    patches = [
+      "${ttMetalSrc}/third_party/protobuf_noreturn.patch"
+    ];
+  };
   yaml-cpp = fetchFromGitHub {
     owner = "jbeder";
     repo = "yaml-cpp";
-    tag = "0.8.0";
-    hash = "sha256-J87oS6Az1/vNdyXu3L7KmUGWzU0IAkGrGMUUha+xDXI=";
+    rev = "2f86d13775d119edbb69af52e5f566fd65c6953b";
+    hash = "sha256-GtUTbEaRR3+GfVkt3t8EsqBHVffVKOl8urtQTaHozIo=";
   };
-  googletest = fetchFromGitHub {
+  gtest = fetchFromGitHub {
     owner = "google";
     repo = "googletest";
     tag = "v1.13.0";
@@ -18,29 +45,35 @@
     tag = "v1.2.6";
     hash = "sha256-qjy5KyAm7/WeCyxMu/5QrBVjDSJPs0q/ZPyQwXp0WLA=";
   };
-  fmt = fetchFromGitHub {
-    owner = "fmtlib";
-    repo = "fmt";
-    tag = "11.1.4";
-    hash = "sha256-sUbxlYi/Aupaox3JjWFqXIjcaQa0LFjclQAOleT+FRA=";
-  };
   enchantum = fetchFromGitHub {
     owner = "ZXShady";
     repo = "enchantum";
     rev = "8ca5b0eb7e7ebe0252e5bc6915083f1dd1b8294e";
     hash = "sha256-q2bbNAMpNJYedekEDtTQ2qI2+GPdkTsuxAHCBaAnuTA=";
   };
-  range-v3 = fetchFromGitHub {
-    owner = "ericniebler";
-    repo = "range-v3";
-    tag = "0.12.0";
-    hash = "sha256-bRSX91+ROqG1C3nB9HSQaKgLzOHEFy9mrD2WW3PRBWU=";
+  fmt = fetchFromGitHub {
+    owner = "fmtlib";
+    repo = "fmt";
+    tag = "11.1.4";
+    hash = "sha256-sUbxlYi/Aupaox3JjWFqXIjcaQa0LFjclQAOleT+FRA=";
   };
-  pybind11 = fetchFromGitHub {
-    owner = "pybind";
-    repo = "pybind11";
-    tag = "v2.13.6";
-    hash = "sha256-SNLdtrOjaC3lGHN9MAqTf51U9EzNKQLyTMNPe0GcdrU=";
+  range-v3 = applyPatches {
+    src = fetchFromGitHub {
+      owner = "ericniebler";
+      repo = "range-v3";
+      tag = "0.12.0";
+      hash = "sha256-bRSX91+ROqG1C3nB9HSQaKgLzOHEFy9mrD2WW3PRBWU=";
+    };
+    patches = [
+      "${ttMetalSrc}/third_party/range-v3.patch"
+    ];
+  };
+  nanobind = fetchFromGitHub {
+    owner = "wjakob";
+    repo = "nanobind";
+    rev = "86e5626728fc282637a6c338597120913dded1bb";
+    fetchSubmodules = true;
+    hash = "sha256-jAg/CotM361gc+5Ymsz8jP0ddLBzrFTxCkssJKFe0NY=";
   };
   nlohmann_json = fetchFromGitHub {
     owner = "nlohmann";
@@ -48,23 +81,38 @@
     tag = "v3.11.3";
     hash = "sha256-7F0Jon+1oWL7uqet5i1IgHX0fUw/+z0QwEcA3zs5xHg=";
   };
-  xtl = fetchFromGitHub {
-    owner = "xtensor-stack";
-    repo = "xtl";
-    tag = "0.8.0";
-    hash = "sha256-hhXM2fG3Yl4KeEJlOAcNPVLJjKy9vFlI63lhbmIAsT8=";
+  xtl = applyPatches {
+    src = fetchFromGitHub {
+      owner = "xtensor-stack";
+      repo = "xtl";
+      tag = "0.8.0";
+      hash = "sha256-hhXM2fG3Yl4KeEJlOAcNPVLJjKy9vFlI63lhbmIAsT8=";
+    };
+    patches = [
+      "${ttMetalSrc}/third_party/xtl.patch"
+    ];
   };
-  xtensor = fetchFromGitHub {
-    owner = "xtensor-stack";
-    repo = "xtensor";
-    tag = "0.26.0";
-    hash = "sha256-gAGLb5NPT4jiIpXONqY+kalxKCFKFXlNqbM79x1lTKE=";
+  xtensor = applyPatches {
+    src = fetchFromGitHub {
+      owner = "xtensor-stack";
+      repo = "xtensor";
+      tag = "0.26.0";
+      hash = "sha256-gAGLb5NPT4jiIpXONqY+kalxKCFKFXlNqbM79x1lTKE=";
+    };
+    patches = [
+      "${ttMetalSrc}/third_party/xtensor.patch"
+    ];
   };
-  xtensor-blas = fetchFromGitHub {
-    owner = "xtensor-stack";
-    repo = "xtensor-blas";
-    tag = "0.22.0";
-    hash = "sha256-Lg6MjJbZUCMqv4eSiZQrLfJy/86RWQ9P85UfeIQJ6bk=";
+  xtensor-blas = applyPatches {
+    src = fetchFromGitHub {
+      owner = "xtensor-stack";
+      repo = "xtensor-blas";
+      tag = "0.22.0";
+      hash = "sha256-Lg6MjJbZUCMqv4eSiZQrLfJy/86RWQ9P85UfeIQJ6bk=";
+    };
+    patches = [
+      "${ttMetalSrc}/third_party/xtensor-blas.patch"
+    ];
   };
   benchmark = fetchFromGitHub {
     owner = "google";
@@ -78,24 +126,18 @@
     tag = "v3.7.0";
     hash = "sha256-q2IYhG84hPIZhuogWf6ojDG9S9ZyuJz9s14kQyIc6t0=";
   };
+  flatbuffers = fetchFromGitHub {
+    owner = "google";
+    repo = "flatbuffers";
+    tag = "v24.3.25";
+    hash = "sha256-uE9CQnhzVgOweYLhWPn2hvzXHyBbFiFVESJ1AEM3BmA=";
+  };
   simd-everywhere = fetchFromGitHub {
     owner = "simd-everywhere";
     repo = "simde";
     tag = "v0.8.2";
     hash = "sha256-igjDHCpKXy6EbA9Mf6peL4OTVRPYTV0Y2jbgYQuWMT4=";
   };
-  msgpack = fetchFromGitHub {
-    owner = "msgpack";
-    repo = "msgpack-c";
-    tag = "cpp-6.1.0";
-    hash = "sha256-VqzFmm3MmMhWyooOsz1d9gwwbn/fnnxpkCFwqKR6los=";
-  };
-  tokenizers-cpp = fetchFromGitHub {
-    owner = "mlc-ai";
-    repo = "tokenizers-cpp";
-    rev = "55d53aa38dc8df7d9c8bd9ed50907e82ae83ce66";
-    hash = "sha256-CkW8S6LHHOY+tz3hHoWBzwGb3f25LFp41F/jH4pdKI4=";
-  };
   spdlog = fetchFromGitHub {
     owner = "gabime";
     repo = "spdlog";
@@ -105,26 +147,70 @@
   tt-logger = fetchFromGitHub {
     owner = "tenstorrent";
     repo = "tt-logger";
-    tag = "v1.1.5";
-    hash = "sha256-lw8L4pCAGObCkiuF/JFC9PmcQgwmJZOOo1cbaUMvo+I=";
+    tag = "v1.1.8";
+    hash = "sha256-cAQLxxwxRkRh1hwDVyDPOr3wsiC2DStUP0UMSiY0vHg=";
   };
+  cadical = applyPatches {
+    src = fetchFromGitHub {
+      owner = "arminbiere";
+      repo = "cadical";
+      tag = "rel-2.2.1";
+      hash = "sha256-dYRaw9DI63Nqz0IJkfQYU4y00KSfq1Xv0xZuL1G15CY=";
+    };
+    patches = [
+      "${ttMetalSrc}/third_party/cadical_vivify_include_tuple.patch"
+    ];
+  };
+  capnproto = applyPatches {
+    src = fetchFromGitHub {
+      owner = "capnproto";
+      repo = "capnproto";
+      rev = "d135c9ca5e15219eaf131dfce1a41afdbaea9aab";
+      hash = "sha256-aDcn4bLZGq8915/NPPQsN5Jv8FRWd8cAspkG3078psc=";
+    };
+    patches = [
+      "${ttMetalSrc}/third_party/capnproto_capture_this.patch"
+      "${ttMetalSrc}/third_party/capnproto_pthread.patch"
+    ];
+  };
+  ttexalens = fetchFromGitHub {
+    owner = "tenstorrent";
+    repo = "tt-exalens";
+    rev = "6f5720240b7254b25cb3d78aef81769fc12a30f9";
+    hash = "sha256-QX9fh4KPJEj4AQjDViPQgVW1JxOADWJk0SlASLJTUCY=";
+  };
+
+  # tt-exalens: cmake/native_elf.cmake
+  libdwarf = fetchFromGitHub {
+    owner = "davea42";
+    repo = "libdwarf-code";
+    tag = "v2.3.1";
+    hash = "sha256-azVCzQt9oA40YACa9PkdNt0D8vWRNHXXGoSFOYNJxgA=";
+  };
+  elfio = applyPatches {
+    src = fetchFromGitHub {
+      owner = "serge1";
+      repo = "ELFIO";
+      tag = "Release_3.12";
+      hash = "sha256-tDRBscs2L/3gYgLQvb1+8nNxqkr8v1xBkeDXuOqShX4=";
+    };
+    patches = [
+      ./elfio-cstdint.patch
+    ];
+  };
+
+  # tt_metal/third_party/umd/third_party/CMakeLists.txt
   nanomsg = fetchFromGitHub {
     owner = "nanomsg";
     repo = "nng";
     tag = "v1.8.0";
     hash = "sha256-E2uosZrmxO3fqwlLuu5e36P70iGj5xUlvhEb+1aSvOA=";
   };
-  flatbuffers = fetchFromGitHub {
-    owner = "google";
-    repo = "flatbuffers";
-    tag = "v24.3.25";
-    hash = "sha256-uE9CQnhzVgOweYLhWPn2hvzXHyBbFiFVESJ1AEM3BmA=";
-  };
   libuv = fetchFromGitHub {
     owner = "libuv";
     repo = "libuv";
-    tag = "v1.48.0";
-    hash = "sha256-U68BmIQNpmIy3prS7LkYl+wvDJQNikoeFiKh50yQFoA=";
+    tag = "v1.51.0";
+    hash = "sha256-ayTk3qkeeAjrGj5ab7wF7vpWI8XWS1EeKKUqzaD/LY0=";
   };
   cxxopts = fetchFromGitHub {
     owner = "jarro2783";
@@ -132,11 +218,10 @@
     rev = "dbf4c6a66816f6c3872b46cc6af119ad227e04e1";
     hash = "sha256-2Z8DT9ihlmbiqCi8gcNzW4C5AUh4xCrpCKrGbRYcreQ=";
   };
-  nanobind = fetchFromGitHub {
-    owner = "wjakob";
-    repo = "nanobind";
-    tag = "v2.7.0";
-    fetchSubmodules = true;
-    hash = "sha256-ex5svqDp9XJtiNCxu0249ORL6LbG679U6PvKQaWANmE=";
+  umd_asio = fetchFromGitHub {
+    owner = "chriskohlhoff";
+    repo = "asio";
+    tag = "asio-1-30-2";
+    hash = "sha256-g+ZPKBUhBGlgvce8uTkuR983unD2kbQKgoddko7x+fk=";
   };
 }
diff --git a/pkgs/by-name/tt/tt-metal/elfio-cstdint.patch b/pkgs/by-name/tt/tt-metal/elfio-cstdint.patch
new file mode 100644
index 000000000000..019878aa0563
--- /dev/null
+++ b/pkgs/by-name/tt/tt-metal/elfio-cstdint.patch
@@ -0,0 +1,11 @@
+--- a/elfio/elf_types.hpp
++++ b/elfio/elf_types.hpp
+@@ -23,6 +23,8 @@ THE SOFTWARE.
+ #ifndef ELFTYPES_H
+ #define ELFTYPES_H
+ 
++#include <cstdint>
++
+ #ifdef __cplusplus
+ namespace ELFIO {
+ #endif
diff --git a/pkgs/by-name/tt/tt-metal/package.nix b/pkgs/by-name/tt/tt-metal/package.nix
index 1647b5053f9f..4372e08d0058 100644
--- a/pkgs/by-name/tt/tt-metal/package.nix
+++ b/pkgs/by-name/tt/tt-metal/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchFromGitHub,
   fetchurl,
+  applyPatches,
   callPackage,
   pkg-config,
   cmake,
@@ -15,14 +16,14 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "tt-metal";
-  version = "0.62.2";
+  version = "0.79.0";
 
   src = fetchFromGitHub {
     owner = "tenstorrent";
     repo = "tt-metal";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-ZIUjZLifRVmpWpG8Ty+I+pwgpIf5r9gJkI8ULTau4OE=";
+    hash = "sha256-sA9ryiVDBF9yJUfQ2cQDvphEC0nVQx6X2F91s2BA8Qo=";
   };
 
   cpm = fetchurl {
@@ -32,6 +33,11 @@ stdenv.mkDerivation (finalAttrs: {
 
   sfpi = callPackage ./sfpi.nix { };
 
+  patches = [
+    # Remove in next release 0.80.0
+    ./spsc-marker-decode-simde.patch
+  ];
+
   postUnpack = ''
     mkdir -p "$sourceRoot/runtime"
     ln -s "$sfpi" "$sourceRoot/runtime/sfpi"
@@ -40,6 +46,10 @@ stdenv.mkDerivation (finalAttrs: {
   postPatch = ''
     cp $cpm cmake/CPM.cmake
     cp $cpm tt_metal/third_party/umd/cmake/CPM.cmake
+
+    patchShebangs tt_metal/sfpi-info.sh tt_metal/llrt/hal/codegen
+    substituteInPlace tt_metal/sfpi-info.sh \
+      --replace-fail 'sfpi_arch=$(uname -m)' $'sfpi_dist=debian\nsfpi_arch=$(uname -m)'
   '';
 
   cmakeFlags = [
@@ -47,6 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
     (lib.cmakeBool "CPM_USE_LOCAL_PACKAGES" true)
     (lib.cmakeFeature "VERSION_NUMERIC" finalAttrs.version)
     (lib.cmakeFeature "CMAKE_POLICY_VERSION_MINIMUM" "3.10")
+    (lib.cmakeBool "ENABLE_TRACY" false)
   ];
 
   preConfigure = ''
@@ -55,11 +66,16 @@ stdenv.mkDerivation (finalAttrs: {
       (name: src: "cp -r --no-preserve=ownership,mode ${src} build/_deps/${name}-src")
       (
         import ./deps.nix {
-          inherit fetchFromGitHub;
+          inherit fetchFromGitHub applyPatches;
+          ttMetalSrc = finalAttrs.src;
         }
       )
     }
     cp $cpm build/_deps/tt-logger-src/cmake/CPM.cmake
+
+    appendToVar cmakeFlags "-Dcadical_SOURCE_DIR=$PWD/build/_deps/cadical-src"
+    appendToVar cmakeFlags "-DCPM_umd_asio_SOURCE=$PWD/build/_deps/umd_asio-src"
+    appendToVar cmakeFlags "-DCPM_ELFIO_SOURCE=$PWD/build/_deps/elfio-src"
   '';
 
   # CMake install fails because "$out/include/tt-logger" tree does not exist.
@@ -87,6 +103,8 @@ stdenv.mkDerivation (finalAttrs: {
   # Fixes the parallel hook crashing in the fixupPhase with no error.
   noAuditTmpdir = true;
 
+  passthru.sfpi = finalAttrs.sfpi;
+
   meta = {
     description = "TT-NN operator library, and TT-Metalium low level kernel programming model";
     homepage = "https://github.com/tenstorrent/tt-metal";
diff --git a/pkgs/by-name/tt/tt-metal/sfpi.nix b/pkgs/by-name/tt/tt-metal/sfpi.nix
index d00f3c0c9179..af4c3c69cfba 100644
--- a/pkgs/by-name/tt/tt-metal/sfpi.nix
+++ b/pkgs/by-name/tt/tt-metal/sfpi.nix
@@ -5,13 +5,14 @@
   runCommand,
   autoPatchelfHook,
   ncurses,
-  isl_0_23,
   mpfr,
   libmpc,
   xz,
+  zstd,
+  expat,
 }:
 let
-  version = "7.1.0";
+  version = "7.78.0";
 in
 runCommand "sfpi-${version}"
   {
@@ -23,21 +24,22 @@ runCommand "sfpi-${version}"
 
     buildInputs = [
       ncurses
-      isl_0_23
       mpfr
       libmpc
       xz
+      zstd
+      expat
     ];
 
     src =
       {
         aarch64-linux = fetchurl {
-          url = "https://github.com/tenstorrent/sfpi/releases/download/v${version}/sfpi_${version}_aarch64.txz";
-          hash = "sha256-MzI159hiitk1iyeGfQaDOQZhqGjfafpCMz6zmM3HrYs=";
+          url = "https://github.com/tenstorrent/sfpi/releases/download/${version}/sfpi_${version}_aarch64_debian.txz";
+          hash = "sha256-ATcNRyNZ6c3DOb+s5k7ATpMafr6k3+DoZJYTgd0rdHI=";
         };
         x86_64-linux = fetchurl {
-          url = "https://github.com/tenstorrent/sfpi/releases/download/v${version}/sfpi_${version}_x86_64.txz";
-          hash = "sha256-rQfFveg1ht+jLfk3ZOJadX26+ODE3WW5E0/18eIl7RQ=";
+          url = "https://github.com/tenstorrent/sfpi/releases/download/${version}/sfpi_${version}_x86_64_debian.txz";
+          hash = "sha256-RkxkdZ5EG4Qda8BiFtvUcNeg8Yjg/6msjrsuQEzyRNs=";
         };
       }
       ."${stdenv.hostPlatform.system}" or (throw "SFPI does not support ${stdenv.hostPlatform.system}");
diff --git a/pkgs/by-name/tt/tt-metal/spsc-marker-decode-simde.patch b/pkgs/by-name/tt/tt-metal/spsc-marker-decode-simde.patch
new file mode 100644
index 000000000000..5cb24fe1c837
--- /dev/null
+++ b/pkgs/by-name/tt/tt-metal/spsc-marker-decode-simde.patch
@@ -0,0 +1,622 @@
+--- a/tt_metal/impl/streaming_profiler/spsc_marker_decode.hpp
++++ b/tt_metal/impl/streaming_profiler/spsc_marker_decode.hpp
+@@ -17,11 +17,8 @@
+ #include <span>
+ #include <vector>
+ 
+-#include <immintrin.h>
+-
+-#if !defined(__AVX2__)
+-#error "the streaming profiler decode is AVX2 code; build for x86-64-v3 or newer"
+-#endif
++// SIMDe uses native AVX2 where available and supported host instructions otherwise.
++#include <simde/x86/avx2.h>
+ 
+ #include "hostdev/streaming_profiler_common.h"
+ #include "spsc_packet.h"
+@@ -284,6 +281,7 @@
+ // false when there is none. The chain unrolls in table order. always_inline, like the handlers it takes: a handler
+ // left out of line captures the walk's locals by address and pushes them all out of registers.
+ template <bool (*Pred)(Kind), size_t I = 0, typename H>
++// NOLINTNEXTLINE(cppcoreguidelines-missing-std-forward) -- Reuse the callback as an lvalue through recursive calls.
+ __attribute__((always_inline)) inline bool spsc_for_format(uint32_t t, H&& handle) {
+     if constexpr (I == kFormats.size()) {
+         return false;
+@@ -299,6 +297,7 @@
+ }
+ // Runs handle.template operator()<F>() for every row whose kind Pred accepts, in table order.
+ template <bool (*Pred)(Kind), size_t I = 0, typename H>
++// NOLINTNEXTLINE(cppcoreguidelines-missing-std-forward) -- Reuse the callback as an lvalue through recursive calls.
+ __attribute__((always_inline)) inline void spsc_for_each_format(H&& handle) {
+     if constexpr (I < kFormats.size()) {
+         if constexpr (Pred(kFormats[I].kind)) {
+@@ -324,37 +323,38 @@
+ // Built at lane entry; a STICKY_TIMER re-blends only the th lanes, a STICKY_PROG only the prog lanes.
+ struct SpscLaneConsts {
+     uint64_t th_hi;
+-    __m256i tv, mv, coords_v;  // th << 32 / prog << 32 / the coordinates, per qword
+-    __m256i zone_half, zone_half64, point_half, point_half64;
+-    __m128i tail;
++    simde__m256i tv, mv, coords_v;  // th << 32 / prog << 32 / the coordinates, per qword
++    simde__m256i zone_half, zone_half64, point_half, point_half64;
++    simde__m128i tail;
+ };
+ inline void spsc_lane_consts_th(SpscLaneConsts& c, uint32_t th) {
+     c.th_hi = static_cast<uint64_t>(th) << 32;
+-    c.tv = _mm256_set1_epi64x(static_cast<long long>(c.th_hi));
+-    const __m256i thv = _mm256_set1_epi32(static_cast<int>(th));
+-    c.zone_half = _mm256_blend_epi32(c.zone_half, thv, 0x02);
+-    c.point_half = _mm256_blend_epi32(c.point_half, thv, 0x02);
++    c.tv = simde_mm256_set1_epi64x(static_cast<long long>(c.th_hi));
++    const simde__m256i thv = simde_mm256_set1_epi32(static_cast<int>(th));
++    c.zone_half = simde_mm256_blend_epi32(c.zone_half, thv, 0x02);
++    c.point_half = simde_mm256_blend_epi32(c.point_half, thv, 0x02);
+ }
+ inline void spsc_lane_consts_prog(SpscLaneConsts& c, uint32_t prog) {
+-    c.mv = _mm256_set1_epi64x(static_cast<long long>(static_cast<uint64_t>(prog) << 32));
+-    const __m256i pgv = _mm256_set1_epi32(static_cast<int>(prog));
+-    for (__m256i* h : {&c.zone_half, &c.zone_half64, &c.point_half, &c.point_half64}) {
+-        *h = _mm256_blend_epi32(*h, pgv, 0x20);
++    c.mv = simde_mm256_set1_epi64x(static_cast<long long>(static_cast<uint64_t>(prog) << 32));
++    const simde__m256i pgv = simde_mm256_set1_epi32(static_cast<int>(prog));
++    for (simde__m256i* h : {&c.zone_half, &c.zone_half64, &c.point_half, &c.point_half64}) {
++        *h = simde_mm256_blend_epi32(*h, pgv, 0x20);
+     }
+ }
+ inline void spsc_lane_consts(SpscLaneConsts& c, const SpscRecConsts& r, uint32_t th, uint32_t prog) {
+-    const __m256i half =
+-        _mm256_setr_epi32(0, 0, 0, 0, 0, 0, static_cast<int>(r.coords[0]), static_cast<int>(r.coords[1]));
++    const simde__m256i half =
++        simde_mm256_setr_epi32(0, 0, 0, 0, 0, 0, static_cast<int>(r.coords[0]), static_cast<int>(r.coords[1]));
+     c.zone_half = c.zone_half64 = c.point_half = c.point_half64 = half;
+-    c.coords_v = _mm256_set1_epi64x(static_cast<long long>(r.coords[0] | (static_cast<uint64_t>(r.coords[1]) << 32)));
+-    c.tail = _mm_loadu_si128(reinterpret_cast<const __m128i*>(r.tail));
++    c.coords_v =
++        simde_mm256_set1_epi64x(static_cast<long long>(r.coords[0] | (static_cast<uint64_t>(r.coords[1]) << 32)));
++    c.tail = simde_mm_loadu_si128(reinterpret_cast<const simde__m128i*>(r.tail));
+     spsc_lane_consts_th(c, th);
+     spsc_lane_consts_prog(c, prog);
+ }
+ // The constant half of an F record: its th lane is blended in only when the timestamp's high half comes from the
+ // lane's sticky.
+ template <PacketFormat F>
+-inline __m256i spsc_half(const SpscLaneConsts& c) {
++inline simde__m256i spsc_half(const SpscLaneConsts& c) {
+     if constexpr (F.kind == Kind::Zone) {
+         return F.has_ts_hi() ? c.zone_half64 : c.zone_half;
+     } else {
+@@ -363,33 +363,35 @@
+ }
+ 
+ // The vector constants the kernels share; all fold to immediates once inlined.
+-inline __m256i spsc_dw_type_mask() {
+-    return _mm256_set1_epi32(static_cast<int>((0xFFFFFFFFu >> PP_TYPE_SHIFT) << PP_TYPE_SHIFT));
++inline simde__m256i spsc_dw_type_mask() {
++    return simde_mm256_set1_epi32(static_cast<int>((0xFFFFFFFFu >> PP_TYPE_SHIFT) << PP_TYPE_SHIFT));
++}
++inline simde__m256i spsc_dw_type(uint32_t type) {
++    return simde_mm256_set1_epi32(static_cast<int>(type << PP_TYPE_SHIFT));
+ }
+-inline __m256i spsc_dw_type(uint32_t type) { return _mm256_set1_epi32(static_cast<int>(type << PP_TYPE_SHIFT)); }
+-inline __m256i spsc_qw_type_mask() {
+-    return _mm256_set1_epi64x(static_cast<long long>((0xFFFFFFFFull >> PP_TYPE_SHIFT) << PP_TYPE_SHIFT));
++inline simde__m256i spsc_qw_type_mask() {
++    return simde_mm256_set1_epi64x(static_cast<long long>((0xFFFFFFFFull >> PP_TYPE_SHIFT) << PP_TYPE_SHIFT));
+ }
+-inline __m256i spsc_qw_type(uint32_t type) {
+-    return _mm256_set1_epi64x(static_cast<long long>(static_cast<uint64_t>(type) << PP_TYPE_SHIFT));
++inline simde__m256i spsc_qw_type(uint32_t type) {
++    return simde_mm256_set1_epi64x(static_cast<long long>(static_cast<uint64_t>(type) << PP_TYPE_SHIFT));
+ }
+-inline __m256i spsc_lane_idx() { return _mm256_setr_epi32(0, 1, 2, 3, 4, 5, 6, 7); }
+-inline __m256i spsc_lane0() { return _mm256_setr_epi32(-1, 0, 0, 0, 0, 0, 0, 0); }
++inline simde__m256i spsc_lane_idx() { return simde_mm256_setr_epi32(0, 1, 2, 3, 4, 5, 6, 7); }
++inline simde__m256i spsc_lane0() { return simde_mm256_setr_epi32(-1, 0, 0, 0, 0, 0, 0, 0); }
+ 
+ // A 32 B load holds spsc_recs_per_load<F> whole F packets at word stride F.words; these are its lane constants.
+ template <PacketFormat F>
+ inline constexpr uint32_t spsc_recs_per_load = 8 / F.words;
+ // -1 at word `w` of each whole packet in the load.
+ template <PacketFormat F, uint8_t w>
+-inline __m256i spsc_lanes_at() {
++inline simde__m256i spsc_lanes_at() {
+     constexpr auto L = [](int k) { return (k % F.words == w && k / F.words < 8 / F.words) ? -1 : 0; };
+-    return _mm256_setr_epi32(L(0), L(1), L(2), L(3), L(4), L(5), L(6), L(7));
++    return simde_mm256_setr_epi32(L(0), L(1), L(2), L(3), L(4), L(5), L(6), L(7));
+ }
+ // Word 0 of each whole packet down to its 27-bit id, every other lane kept.
+ template <PacketFormat F>
+-inline __m256i spsc_w0_mask() {
++inline simde__m256i spsc_w0_mask() {
+     constexpr auto L = [](int k) { return (k % F.words == 0 && k / F.words < 8 / F.words) ? 0x07FFFFFF : -1; };
+-    return _mm256_setr_epi32(L(0), L(1), L(2), L(3), L(4), L(5), L(6), L(7));
++    return simde_mm256_setr_epi32(L(0), L(1), L(2), L(3), L(4), L(5), L(6), L(7));
+ }
+ // The lanes of a composed record that come from the constant half rather than the packet: the prog and coordinate
+ // lanes always, plus each field the format lacks.
+@@ -407,68 +409,72 @@
+ // {dur, 0, ...} leaves {start, dur, id | prog << 32, coords} with the borrow in the high half; the lane's tail
+ // follows.
+ template <PacketFormat F, uint32_t r>
+-inline __m256i spsc_compose(__m256i l, __m256i half, __m128i tail, uint8_t* o) {
++inline simde__m256i spsc_compose(simde__m256i l, simde__m256i half, simde__m128i tail, uint8_t* o) {
+     constexpr int b = static_cast<int>(r * F.words);
+     constexpr auto at = [](uint8_t f) { return f == kAbsent ? 0 : b + f; };
+-    const __m256i s = _mm256_blend_epi32(
+-        _mm256_permutevar8x32_epi32(
+-            l, _mm256_setr_epi32(at(F.ts_lo), at(F.ts_hi), at(F.dur_lo), at(F.dur_hi), b, 0, 0, 0)),
++    const simde__m256i s = simde_mm256_blend_epi32(
++        simde_mm256_permutevar8x32_epi32(
++            l, simde_mm256_setr_epi32(at(F.ts_lo), at(F.ts_hi), at(F.dur_lo), at(F.dur_hi), b, 0, 0, 0)),
+         half,
+         spsc_blend_s<F>());
+     if constexpr (F.has_dur()) {
+-        const __m256i d = _mm256_blend_epi32(
+-            _mm256_permutevar8x32_epi32(l, _mm256_setr_epi32(at(F.dur_lo), at(F.dur_hi), 0, 0, 0, 0, 0, 0)),
+-            _mm256_setzero_si256(),
++        const simde__m256i d = simde_mm256_blend_epi32(
++            simde_mm256_permutevar8x32_epi32(l, simde_mm256_setr_epi32(at(F.dur_lo), at(F.dur_hi), 0, 0, 0, 0, 0, 0)),
++            simde_mm256_setzero_si256(),
+             spsc_blend_d<F>());
+-        _mm256_storeu_si256(reinterpret_cast<__m256i*>(o), _mm256_sub_epi64(s, d));
++        simde_mm256_storeu_si256(reinterpret_cast<simde__m256i*>(o), simde_mm256_sub_epi64(s, d));
+     } else {
+-        _mm256_storeu_si256(reinterpret_cast<__m256i*>(o), s);
++        simde_mm256_storeu_si256(reinterpret_cast<simde__m256i*>(o), s);
+     }
+-    _mm_storeu_si128(reinterpret_cast<__m128i*>(o + 32), tail);
++    simde_mm_storeu_si128(reinterpret_cast<simde__m128i*>(o + 32), tail);
+     return s;
+ }
+ 
+ // Eight words from p with the lanes past `readable` zero; a count of zero or less loads nothing. A record's words
+ // are always in range, the load's tail may not be.
+-inline __m256i spsc_words(const uint32_t* p, int32_t readable) {
++inline simde__m256i spsc_words(const uint32_t* p, int32_t readable) {
+     if (readable >= 8) {
+-        return _mm256_loadu_si256(reinterpret_cast<const __m256i*>(p));
++        return simde_mm256_loadu_si256(reinterpret_cast<const simde__m256i*>(p));
+     }
+-    return _mm256_maskload_epi32(
+-        reinterpret_cast<const int*>(p), _mm256_cmpgt_epi32(_mm256_set1_epi32(readable), spsc_lane_idx()));
++    return simde_mm256_maskload_epi32(
++        reinterpret_cast<const int*>(p), simde_mm256_cmpgt_epi32(simde_mm256_set1_epi32(readable), spsc_lane_idx()));
+ }
+ // Four qword records from p, whole records only: a trailing odd word is never one, so its lane reads as zero.
+-inline __m256i spsc_qwords(const uint32_t* p, int32_t readable) {
++inline simde__m256i spsc_qwords(const uint32_t* p, int32_t readable) {
+     if (readable >= 8) {
+-        return _mm256_loadu_si256(reinterpret_cast<const __m256i*>(p));
++        return simde_mm256_loadu_si256(reinterpret_cast<const simde__m256i*>(p));
+     }
+-    return _mm256_maskload_epi64(
+-        reinterpret_cast<const long long*>(p),
+-        _mm256_cmpgt_epi64(_mm256_set1_epi64x(readable / 2), _mm256_setr_epi64x(0, 1, 2, 3)));
++    return simde_mm256_maskload_epi64(
++        reinterpret_cast<const int64_t*>(p),
++        simde_mm256_cmpgt_epi64(simde_mm256_set1_epi64x(readable / 2), simde_mm256_setr_epi64x(0, 1, 2, 3)));
+ }
+ // Records of the type in a quad's compare result, counted from lane 0 to the first miss. A full quad is one test;
+ // only a partial one extracts its mask.
+-inline uint32_t spsc_quad_count(__m256i c) {
+-    if (_mm256_testc_si256(c, _mm256_cmpeq_epi64(c, c))) {
++inline uint32_t spsc_quad_count(simde__m256i c) {
++    if (simde_mm256_testc_si256(c, simde_mm256_cmpeq_epi64(c, c))) {
+         return 4;
+     }
+-    return std::countr_zero(~static_cast<uint32_t>(_mm256_movemask_pd(_mm256_castsi256_pd(c))) & 0x1Fu);
++    return std::countr_zero(~static_cast<uint32_t>(simde_mm256_movemask_pd(simde_mm256_castsi256_pd(c))) & 0x1Fu);
+ }
+ // Four records from per-qword-lane halves: {a, b} is a record's first 16 bytes (start|ts, duration), {m, coords}
+ // its next 16 (id | prog << 32, the coordinates) and `tail` its last. Written whole; a partial quad's spare records
+ // land in the sink's slack.
+-inline void spsc_store_quad(uint8_t* o, __m256i a, __m256i b, __m256i m, __m256i coords, __m128i tail) {
+-    const __m256i ab_lo = _mm256_unpacklo_epi64(a, b);
+-    const __m256i ab_hi = _mm256_unpackhi_epi64(a, b);
+-    const __m256i mc_lo = _mm256_unpacklo_epi64(m, coords);
+-    const __m256i mc_hi = _mm256_unpackhi_epi64(m, coords);
++inline void spsc_store_quad(
++    uint8_t* o, simde__m256i a, simde__m256i b, simde__m256i m, simde__m256i coords, simde__m128i tail) {
++    const simde__m256i ab_lo = simde_mm256_unpacklo_epi64(a, b);
++    const simde__m256i ab_hi = simde_mm256_unpackhi_epi64(a, b);
++    const simde__m256i mc_lo = simde_mm256_unpacklo_epi64(m, coords);
++    const simde__m256i mc_hi = simde_mm256_unpackhi_epi64(m, coords);
+     constexpr uint32_t R = kSpscRecBytes;
+-    _mm256_storeu_si256(reinterpret_cast<__m256i*>(o), _mm256_permute2x128_si256(ab_lo, mc_lo, 0x20));
+-    _mm256_storeu_si256(reinterpret_cast<__m256i*>(o + R), _mm256_permute2x128_si256(ab_hi, mc_hi, 0x20));
+-    _mm256_storeu_si256(reinterpret_cast<__m256i*>(o + 2 * R), _mm256_permute2x128_si256(ab_lo, mc_lo, 0x31));
+-    _mm256_storeu_si256(reinterpret_cast<__m256i*>(o + 3 * R), _mm256_permute2x128_si256(ab_hi, mc_hi, 0x31));
++    simde_mm256_storeu_si256(reinterpret_cast<simde__m256i*>(o), simde_mm256_permute2x128_si256(ab_lo, mc_lo, 0x20));
++    simde_mm256_storeu_si256(
++        reinterpret_cast<simde__m256i*>(o + R), simde_mm256_permute2x128_si256(ab_hi, mc_hi, 0x20));
++    simde_mm256_storeu_si256(
++        reinterpret_cast<simde__m256i*>(o + 2 * R), simde_mm256_permute2x128_si256(ab_lo, mc_lo, 0x31));
++    simde_mm256_storeu_si256(
++        reinterpret_cast<simde__m256i*>(o + 3 * R), simde_mm256_permute2x128_si256(ab_hi, mc_hi, 0x31));
+     for (uint32_t k = 0; k < 4; k++) {
+-        _mm_storeu_si128(reinterpret_cast<__m128i*>(o + k * R + 32), tail);
++        simde_mm_storeu_si128(reinterpret_cast<simde__m128i*>(o + k * R + 32), tail);
+     }
+ }
+ 
+@@ -476,7 +482,7 @@
+ template <PacketFormat F>
+ inline SpscBlockResult spsc_one(const uint32_t* p, uint32_t readable, const SpscLaneConsts& c, uint8_t* dst) {
+     spsc_compose<F, 0>(
+-        _mm256_and_si256(spsc_words(p, static_cast<int32_t>(readable)), spsc_w0_mask<F>()),
++        simde_mm256_and_si256(spsc_words(p, static_cast<int32_t>(readable)), spsc_w0_mask<F>()),
+         spsc_half<F>(c),
+         c.tail,
+         dst);
+@@ -495,9 +501,9 @@
+ template <PacketFormat F>
+ inline bool spsc_run4(const uint32_t* p) {
+     static_assert(F.words == 2);
+-    const __m256i v = _mm256_loadu_si256(reinterpret_cast<const __m256i*>(p));
+-    const __m256i c = _mm256_cmpeq_epi64(_mm256_and_si256(v, spsc_qw_type_mask()), spsc_qw_type(F.type));
+-    return _mm256_testc_si256(c, _mm256_cmpeq_epi64(c, c));
++    const simde__m256i v = simde_mm256_loadu_si256(reinterpret_cast<const simde__m256i*>(p));
++    const simde__m256i c = simde_mm256_cmpeq_epi64(simde_mm256_and_si256(v, spsc_qw_type_mask()), spsc_qw_type(F.type));
++    return simde_mm256_testc_si256(c, simde_mm256_cmpeq_epi64(c, c));
+ }
+ 
+ // noinline on both block kernels: called once per run, and inlined into the walk they share its register file and
+@@ -521,45 +527,43 @@
+     constexpr uint32_t kBlockRecs = kLoads * R;
+     constexpr uint32_t kFullAvail = kBlockWords - kStride + 8;  // every load of the block whole
+     SpscBlockResult out{0, 0, 0, 0, 0};
+-    const __m256i type_mask = spsc_dw_type_mask();
+-    const __m256i ftype = spsc_dw_type(F.type);
+-    const __m256i lanes_w0 = spsc_lanes_at<F, 0>();
+-    const __m256i lane_0 = spsc_lane0();
+-    const __m256i lane_3 = _mm256_setr_epi32(0, 0, 0, -1, 0, 0, 0, 0);
+-    const __m256i w0_mask = spsc_w0_mask<F>();
+-    const __m256i ones = _mm256_set1_epi32(-1);
+-    const __m256i half = spsc_half<F>(c);
+-    const __m128i tail = c.tail;
+-    const __m256i z = _mm256_setzero_si256();
++    const simde__m256i type_mask = spsc_dw_type_mask();
++    const simde__m256i ftype = spsc_dw_type(F.type);
++    const simde__m256i lanes_w0 = spsc_lanes_at<F, 0>();
++    const simde__m256i lane_0 = spsc_lane0();
++    const simde__m256i lane_3 = simde_mm256_setr_epi32(0, 0, 0, -1, 0, 0, 0, 0);
++    const simde__m256i w0_mask = spsc_w0_mask<F>();
++    const simde__m256i ones = simde_mm256_set1_epi32(-1);
++    const simde__m256i half = spsc_half<F>(c);
++    const simde__m128i tail = c.tail;
++    const simde__m256i z = simde_mm256_setzero_si256();
+     const uint64_t th_hi = c.th_hi;
+     const uint32_t* const p0 = p;
+-    const __m256i stall = _mm256_set1_epi32(static_cast<int>(kSpscStallZoneId));
+-    __m256i prev = z, back = z, stall_hit = z, wrap_hit = z;
++    const simde__m256i stall = simde_mm256_set1_epi32(static_cast<int>(kSpscStallZoneId));
++    simde__m256i prev = z, back = z, stall_hit = z, wrap_hit = z;
+     uint32_t total = 0;
+     while (max_recs != 0 && avail >= W) {
+         // One load at a time, stopping at the first whose records are not all F: a lone record costs one load.
+-        __m256i v[kLoads];
++        simde__m256i v[kLoads];
+         uint32_t n = 0;
+         for (uint32_t i = 0; i < kLoads; i++) {
+             if (avail >= kFullAvail) {
+-                v[i] = _mm256_loadu_si256(reinterpret_cast<const __m256i*>(p + i * kStride));
++                v[i] = simde_mm256_loadu_si256(reinterpret_cast<const simde__m256i*>(p + i * kStride));
+             } else {
+-                const __m256i mk = _mm256_cmpgt_epi32(
+-                    _mm256_set1_epi32(static_cast<int>(avail) - static_cast<int>(i * kStride)), spsc_lane_idx());
+-                v[i] = _mm256_maskload_epi32(reinterpret_cast<const int*>(p + i * kStride), mk);
++                const simde__m256i mk = simde_mm256_cmpgt_epi32(
++                    simde_mm256_set1_epi32(static_cast<int>(avail) - static_cast<int>(i * kStride)), spsc_lane_idx());
++                v[i] = simde_mm256_maskload_epi32(reinterpret_cast<const int*>(p + i * kStride), mk);
+             }
+-            const __m256i cm = _mm256_cmpeq_epi32(_mm256_and_si256(v[i], type_mask), ftype);
+-            if (!_mm256_testc_si256(cm, lanes_w0)) {
++            const simde__m256i cm = simde_mm256_cmpeq_epi32(simde_mm256_and_si256(v[i], type_mask), ftype);
++            if (!simde_mm256_testc_si256(cm, lanes_w0)) {
+                 if constexpr (R == 2) {
+-                    n += _mm256_testc_si256(cm, lane_0) ? 1u : 0u;
++                    n += simde_mm256_testc_si256(cm, lane_0) ? 1u : 0u;
+                 }
+                 break;
+             }
+             n += R;
+         }
+-        if (n > max_recs) {
+-            n = max_recs;
+-        }
++        n = std::min(n, max_recs);
+         if (n == 0) {
+             break;
+         }
+@@ -567,36 +571,39 @@
+         // across loads and blocks. Lane 3 is the duration's high word when the format has one.
+         uint32_t i = 0;
+         for (; (i + 1) * R <= n; i++) {
+-            const __m256i l = _mm256_and_si256(v[i], w0_mask);
++            const simde__m256i l = simde_mm256_and_si256(v[i], w0_mask);
+             uint8_t* const o = dst + kSpscRecBytes * R * i;
+-            const __m256i s0 = spsc_compose<F, 0>(l, half, tail, o);
++            const simde__m256i s0 = spsc_compose<F, 0>(l, half, tail, o);
+             if constexpr (R == 2) {
+-                const __m256i s1 = spsc_compose<F, 1>(l, half, tail, o + kSpscRecBytes);
+-                back = _mm256_or_si256(back, _mm256_or_si256(_mm256_cmpgt_epi64(prev, s0), _mm256_cmpgt_epi64(s0, s1)));
++                const simde__m256i s1 = spsc_compose<F, 1>(l, half, tail, o + kSpscRecBytes);
++                back = simde_mm256_or_si256(
++                    back, simde_mm256_or_si256(simde_mm256_cmpgt_epi64(prev, s0), simde_mm256_cmpgt_epi64(s0, s1)));
+                 prev = s1;
+                 if constexpr (F.has_dur_hi()) {
+-                    wrap_hit = _mm256_or_si256(
+-                        wrap_hit, _mm256_or_si256(_mm256_cmpeq_epi32(s0, ones), _mm256_cmpeq_epi32(s1, ones)));
++                    wrap_hit = simde_mm256_or_si256(
++                        wrap_hit,
++                        simde_mm256_or_si256(simde_mm256_cmpeq_epi32(s0, ones), simde_mm256_cmpeq_epi32(s1, ones)));
+                 }
+             } else {
+-                back = _mm256_or_si256(back, _mm256_cmpgt_epi64(prev, s0));
++                back = simde_mm256_or_si256(back, simde_mm256_cmpgt_epi64(prev, s0));
+                 prev = s0;
+                 if constexpr (F.has_dur_hi()) {
+-                    wrap_hit = _mm256_or_si256(wrap_hit, _mm256_cmpeq_epi32(s0, ones));
++                    wrap_hit = simde_mm256_or_si256(wrap_hit, simde_mm256_cmpeq_epi32(s0, ones));
+                 }
+             }
+-            stall_hit = _mm256_or_si256(stall_hit, _mm256_cmpeq_epi32(l, stall));
++            stall_hit = simde_mm256_or_si256(stall_hit, simde_mm256_cmpeq_epi32(l, stall));
+         }
+         if constexpr (R == 2) {
+             if (2 * i < n) {  // an odd last record: the load's second record is not ours
+-                const __m256i l = _mm256_and_si256(v[i], w0_mask);
+-                const __m256i s0 = spsc_compose<F, 0>(l, half, tail, dst + kSpscRecBytes * 2 * i);
+-                back = _mm256_or_si256(back, _mm256_cmpgt_epi64(prev, s0));
++                const simde__m256i l = simde_mm256_and_si256(v[i], w0_mask);
++                const simde__m256i s0 = spsc_compose<F, 0>(l, half, tail, dst + kSpscRecBytes * 2 * i);
++                back = simde_mm256_or_si256(back, simde_mm256_cmpgt_epi64(prev, s0));
+                 prev = s0;
+                 if constexpr (F.has_dur_hi()) {
+-                    wrap_hit = _mm256_or_si256(wrap_hit, _mm256_cmpeq_epi32(s0, ones));
++                    wrap_hit = simde_mm256_or_si256(wrap_hit, simde_mm256_cmpeq_epi32(s0, ones));
+                 }
+-                stall_hit = _mm256_or_si256(stall_hit, _mm256_and_si256(_mm256_cmpeq_epi32(l, stall), lane_0));
++                stall_hit =
++                    simde_mm256_or_si256(stall_hit, simde_mm256_and_si256(simde_mm256_cmpeq_epi32(l, stall), lane_0));
+             }
+         }
+         total += n;
+@@ -612,11 +619,11 @@
+     if (total != 0) {
+         out.ts_last = spsc_ts_at<F>(p0, total - 1u, th_hi);
+     }
+-    out.regress = _mm256_testz_si256(back, lane_0) ? 0u : 1u;
++    out.regress = simde_mm256_testz_si256(back, lane_0) ? 0u : 1u;
+     if constexpr (F.has_dur_hi()) {
+-        out.wrapped = _mm256_testz_si256(wrap_hit, lane_3) ? 0u : 1u;
++        out.wrapped = simde_mm256_testz_si256(wrap_hit, lane_3) ? 0u : 1u;
+     }
+-    if (__builtin_expect(!_mm256_testz_si256(stall_hit, lanes_w0), 0)) {
++    if (__builtin_expect(!simde_mm256_testz_si256(stall_hit, lanes_w0), 0)) {
+         for (uint32_t k = 0; k < total; k++) {
+             out.stalls += (p0[W * k] & 0x07FFFFFFu) == kSpscStallZoneId ? 1u : 0u;
+         }
+@@ -638,49 +645,51 @@
+     constexpr bool kDelta = F.delta16;
+     static_assert(kDelta ? F.kind == Kind::Zone : (F.kind == Kind::Point && F.ts_lo == 1));
+     SpscBlockResult out{0, 0, 0, 0, 0};
+-    const __m256i type_mask = spsc_qw_type_mask();
+-    const __m256i ftype = spsc_qw_type(F.type);
+-    const __m256i z = _mm256_setzero_si256();
+-    const __m256i id_mask = _mm256_set1_epi64x(0x07FFFFFF);
+-    const __m256i dur_mask = _mm256_set1_epi64x(0xFFFF);
+-    const __m256i mv = c.mv, coords = c.coords_v;
+-    const __m128i tail = c.tail;
++    const simde__m256i type_mask = spsc_qw_type_mask();
++    const simde__m256i ftype = spsc_qw_type(F.type);
++    const simde__m256i z = simde_mm256_setzero_si256();
++    const simde__m256i id_mask = simde_mm256_set1_epi64x(0x07FFFFFF);
++    const simde__m256i dur_mask = simde_mm256_set1_epi64x(0xFFFF);
++    const simde__m256i mv = c.mv, coords = c.coords_v;
++    const simde__m128i tail = c.tail;
+     // The cursor rides as a broadcast vector: the next block's starts need it as one, and the block total is already
+     // a broadcast lane of the carry tree.
+-    __m256i cv = _mm256_set1_epi64x(static_cast<long long>(cursor));
+-    __m256i carry = z, back = z;
++    simde__m256i cv = simde_mm256_set1_epi64x(static_cast<long long>(cursor));
++    simde__m256i carry = z, back = z;
+     uint32_t total = 0;
+     while (max_recs != 0 && readable >= 2u) {
+-        __m256i v[4];
++        simde__m256i v[4];
+         if (readable >= 32u) {
+             for (int i = 0; i < 4; i++) {
+-                v[i] = _mm256_loadu_si256(reinterpret_cast<const __m256i*>(p + 8 * i));
++                v[i] = simde_mm256_loadu_si256(reinterpret_cast<const simde__m256i*>(p + 8 * i));
+             }
+         } else {
+             // Whole records only: a trailing odd word is never F, so its lane reads as zero and ends the scan.
+             const int recs = static_cast<int>(readable / 2u);
+             for (int i = 0; i < 4; i++) {
+-                const __m256i m = _mm256_cmpgt_epi64(_mm256_set1_epi64x(recs - 4 * i), _mm256_setr_epi64x(0, 1, 2, 3));
+-                v[i] = _mm256_maskload_epi64(reinterpret_cast<const long long*>(p + 8 * i), m);
++                const simde__m256i m =
++                    simde_mm256_cmpgt_epi64(simde_mm256_set1_epi64x(recs - 4 * i), simde_mm256_setr_epi64x(0, 1, 2, 3));
++                v[i] = simde_mm256_maskload_epi64(reinterpret_cast<const int64_t*>(p + 8 * i), m);
+             }
+         }
+         if constexpr (kDelta) {
+             // Both lines of the block four blocks ahead: the hardware prefetcher does not run far enough into
+             // DMA-landed memory (-6%); farther ahead evicts before use once the sink's output stream shares L1, and
+             // one line per block leaves every other line to the hardware.
+-            _mm_prefetch(reinterpret_cast<const char*>(p + 128), _MM_HINT_T0);
+-            _mm_prefetch(reinterpret_cast<const char*>(p + 144), _MM_HINT_T0);
++            simde_mm_prefetch(reinterpret_cast<const char*>(p + 128), SIMDE_MM_HINT_T0);
++            simde_mm_prefetch(reinterpret_cast<const char*>(p + 144), SIMDE_MM_HINT_T0);
+         }
+         uint32_t n = 0;
+-        for (int i = 0; i < 4; i++) {
+-            const __m256i cm = _mm256_cmpeq_epi64(_mm256_and_si256(v[i], type_mask), ftype);
++        for (const auto& value : v) {
++            const simde__m256i cm = simde_mm256_cmpeq_epi64(simde_mm256_and_si256(value, type_mask), ftype);
+             if constexpr (!kDelta) {
+                 // Timestamps as zero-extended qwords against the record before (`carry`: the previous load's
+                 // last); only F lanes count.
+-                const __m256i ts = _mm256_srli_epi64(v[i], 32);
+-                const __m256i before = _mm256_blend_epi32(_mm256_permute4x64_epi64(ts, 0x90), carry, 0x03);
+-                back = _mm256_or_si256(back, _mm256_and_si256(_mm256_cmpgt_epi64(before, ts), cm));
+-                carry = _mm256_permute4x64_epi64(ts, 0xFF);
++                const simde__m256i ts = simde_mm256_srli_epi64(value, 32);
++                const simde__m256i before =
++                    simde_mm256_blend_epi32(simde_mm256_permute4x64_epi64(ts, 0x90), carry, 0x03);
++                back = simde_mm256_or_si256(back, simde_mm256_and_si256(simde_mm256_cmpgt_epi64(before, ts), cm));
++                carry = simde_mm256_permute4x64_epi64(ts, 0xFF);
+             }
+             const uint32_t k = spsc_quad_count(cm);
+             n += k;
+@@ -688,37 +697,36 @@
+                 break;
+             }
+         }
+-        if (n > max_recs) {
+-            n = max_recs;
+-        }
++        n = std::min(n, max_recs);
+         if (n == 0) {
+             break;
+         }
+         // Inclusive prefix of the end deltas (each qword's top 16 bits) in record order: the four quads' in-lane
+         // prefixes are independent and their totals carry as a tree, so no dependency chain spans the block.
+-        __m256i pfx[4];
++        simde__m256i pfx[4];
+         if constexpr (kDelta) {
+             for (int i = 0; i < 4; i++) {
+-                __m256i d = _mm256_srli_epi64(v[i], 48);
+-                d = _mm256_add_epi64(d, _mm256_slli_si256(d, 8));
+-                pfx[i] = _mm256_add_epi64(d, _mm256_blend_epi32(_mm256_permute4x64_epi64(d, 0x55), z, 0x0F));
+-            }
+-            const __m256i c1 = _mm256_permute4x64_epi64(pfx[0], 0xFF);
+-            const __m256i c2 = _mm256_add_epi64(c1, _mm256_permute4x64_epi64(pfx[1], 0xFF));
+-            const __m256i c3 = _mm256_add_epi64(c2, _mm256_permute4x64_epi64(pfx[2], 0xFF));
+-            pfx[1] = _mm256_add_epi64(pfx[1], c1);
+-            pfx[2] = _mm256_add_epi64(pfx[2], c2);
+-            pfx[3] = _mm256_add_epi64(pfx[3], c3);
++                simde__m256i d = simde_mm256_srli_epi64(v[i], 48);
++                d = simde_mm256_add_epi64(d, simde_mm256_slli_si256(d, 8));
++                pfx[i] =
++                    simde_mm256_add_epi64(d, simde_mm256_blend_epi32(simde_mm256_permute4x64_epi64(d, 0x55), z, 0x0F));
++            }
++            const simde__m256i c1 = simde_mm256_permute4x64_epi64(pfx[0], 0xFF);
++            const simde__m256i c2 = simde_mm256_add_epi64(c1, simde_mm256_permute4x64_epi64(pfx[1], 0xFF));
++            const simde__m256i c3 = simde_mm256_add_epi64(c2, simde_mm256_permute4x64_epi64(pfx[2], 0xFF));
++            pfx[1] = simde_mm256_add_epi64(pfx[1], c1);
++            pfx[2] = simde_mm256_add_epi64(pfx[2], c2);
++            pfx[3] = simde_mm256_add_epi64(pfx[3], c3);
+         }
+         for (uint32_t i = 0; i < 4 && 4 * i < n; i++) {
+             if constexpr (kDelta) {
+-                const __m256i d64 = _mm256_and_si256(_mm256_srli_epi64(v[i], 32), dur_mask);
+-                const __m256i s64 = _mm256_sub_epi64(_mm256_add_epi64(cv, pfx[i]), d64);
+-                const __m256i m64 = _mm256_or_si256(_mm256_and_si256(v[i], id_mask), mv);
++                const simde__m256i d64 = simde_mm256_and_si256(simde_mm256_srli_epi64(v[i], 32), dur_mask);
++                const simde__m256i s64 = simde_mm256_sub_epi64(simde_mm256_add_epi64(cv, pfx[i]), d64);
++                const simde__m256i m64 = simde_mm256_or_si256(simde_mm256_and_si256(v[i], id_mask), mv);
+                 spsc_store_quad(dst + 4 * kSpscRecBytes * i, s64, d64, m64, coords, tail);
+             } else {
+-                const __m256i ts64 = _mm256_or_si256(_mm256_srli_epi64(v[i], 32), c.tv);
+-                const __m256i m64 = _mm256_or_si256(_mm256_and_si256(v[i], id_mask), mv);
++                const simde__m256i ts64 = simde_mm256_or_si256(simde_mm256_srli_epi64(v[i], 32), c.tv);
++                const simde__m256i m64 = simde_mm256_or_si256(simde_mm256_and_si256(v[i], id_mask), mv);
+                 spsc_store_quad(dst + 4 * kSpscRecBytes * i, ts64, z, m64, coords, tail);
+             }
+         }
+@@ -730,16 +738,17 @@
+                 // to hot stack.
+                 alignas(32) uint64_t arr[16];
+                 for (int i = 0; i < 4; i++) {
+-                    _mm256_store_si256(reinterpret_cast<__m256i*>(arr + 4 * i), pfx[i]);
++                    simde_mm256_store_si256(reinterpret_cast<simde__m256i*>(arr + 4 * i), pfx[i]);
+                 }
+-                out.ts_last = static_cast<uint64_t>(_mm_cvtsi128_si64(_mm256_castsi256_si128(cv))) + arr[n - 1];
++                out.ts_last =
++                    static_cast<uint64_t>(simde_mm_cvtsi128_si64(simde_mm256_castsi256_si128(cv))) + arr[n - 1];
+                 out.n = total;
+                 return out;  // the block ended on a non-F word or the emit budget
+             }
+-            cv = _mm256_add_epi64(cv, _mm256_permute4x64_epi64(pfx[3], 0xFF));
++            cv = simde_mm256_add_epi64(cv, simde_mm256_permute4x64_epi64(pfx[3], 0xFF));
+         } else {
+             // The carry for the next block is this block's last record, which the load loop may have run past.
+-            carry = _mm256_set1_epi64x(static_cast<long long>(p[2u * n - 1u]));
++            carry = simde_mm256_set1_epi64x(static_cast<long long>(p[2u * n - 1u]));
+             out.ts_last = c.th_hi | p[2u * n - 1u];
+             if (n < 16u) {
+                 break;
+@@ -752,10 +761,10 @@
+     out.n = total;
+     if constexpr (kDelta) {
+         if (total != 0) {
+-            out.ts_last = static_cast<uint64_t>(_mm_cvtsi128_si64(_mm256_castsi256_si128(cv)));
++            out.ts_last = static_cast<uint64_t>(simde_mm_cvtsi128_si64(simde_mm256_castsi256_si128(cv)));
+         }
+     } else {
+-        out.regress = _mm256_testz_si256(back, back) ? 0u : 1u;
++        out.regress = simde_mm256_testz_si256(back, back) ? 0u : 1u;
+     }
+     return out;
+ }
+@@ -783,37 +792,38 @@
+     constexpr int kPayload = kSpscDataFormat.words;
+     const uint32_t elems = (n + 1u) >> 1;
+     uint64_t* const pay = reinterpret_cast<uint64_t*>(dst + kSpscRecBytes);
+-    const __m256i lane_idx = spsc_lane_idx();
++    const simde__m256i lane_idx = spsc_lane_idx();
+     // The head and payload words 0-4 of the packet, the payload lanes zeroed past the count and past readable.
+     const uint32_t words = std::min(readable, static_cast<uint32_t>(kPayload) + n);
+-    const __m256i l = _mm256_maskload_epi32(
+-        reinterpret_cast<const int*>(p), _mm256_cmpgt_epi32(_mm256_set1_epi32(static_cast<int>(words)), lane_idx));
+-    const __m256i head = _mm256_blend_epi32(
+-        _mm256_blend_epi32(
+-            _mm256_permutevar8x32_epi32(
+-                _mm256_and_si256(l, _mm256_setr_epi32(0x07FFFFFF, -1, -1, -1, -1, -1, -1, -1)),
+-                _mm256_setr_epi32(kTs, 0, 0, 0, 0, 0, 0, 0)),
++    const simde__m256i l = simde_mm256_maskload_epi32(
++        reinterpret_cast<const int*>(p),
++        simde_mm256_cmpgt_epi32(simde_mm256_set1_epi32(static_cast<int>(words)), lane_idx));
++    const simde__m256i head = simde_mm256_blend_epi32(
++        simde_mm256_blend_epi32(
++            simde_mm256_permutevar8x32_epi32(
++                simde_mm256_and_si256(l, simde_mm256_setr_epi32(0x07FFFFFF, -1, -1, -1, -1, -1, -1, -1)),
++                simde_mm256_setr_epi32(kTs, 0, 0, 0, 0, 0, 0, 0)),
+             c.point_half,
+             0xEE),
+-        _mm256_set1_epi64x(static_cast<long long>(elems)),
++        simde_mm256_set1_epi64x(static_cast<long long>(elems)),
+         0x0C);
+-    _mm256_storeu_si256(reinterpret_cast<__m256i*>(dst), head);
+-    _mm_storeu_si128(reinterpret_cast<__m128i*>(dst + 32), c.tail);
++    simde_mm256_storeu_si256(reinterpret_cast<simde__m256i*>(dst), head);
++    simde_mm_storeu_si128(reinterpret_cast<simde__m128i*>(dst + 32), c.tail);
+     // Elements 0-1 from the packet's first four payload words, high word first.
+-    _mm256_storeu_si256(
+-        reinterpret_cast<__m256i*>(pay),
+-        _mm256_permutevar8x32_epi32(
+-            l, _mm256_setr_epi32(kPayload + 1, kPayload, kPayload + 3, kPayload + 2, 0, 0, 0, 0)));
++    simde_mm256_storeu_si256(
++        reinterpret_cast<simde__m256i*>(pay),
++        simde_mm256_permutevar8x32_epi32(
++            l, simde_mm256_setr_epi32(kPayload + 1, kPayload, kPayload + 3, kPayload + 2, 0, 0, 0, 0)));
+     if (__builtin_expect(n > 4u, 0)) {
+         const uint32_t pw = readable > static_cast<uint32_t>(kPayload) ? std::min(readable - kPayload, n) : 0u;
+         for (uint32_t k = 4; k < n; k += 8) {
+             const uint32_t left = std::min(n - k, pw > k ? pw - k : 0u);
+-            const __m256i pl = _mm256_maskload_epi32(
++            const simde__m256i pl = simde_mm256_maskload_epi32(
+                 reinterpret_cast<const int*>(p + kPayload + k),
+-                _mm256_cmpgt_epi32(_mm256_set1_epi32(static_cast<int>(left)), lane_idx));
+-            _mm256_storeu_si256(
+-                reinterpret_cast<__m256i*>(pay + k / 2),
+-                _mm256_permutevar8x32_epi32(pl, _mm256_setr_epi32(1, 0, 3, 2, 5, 4, 7, 6)));
++                simde_mm256_cmpgt_epi32(simde_mm256_set1_epi32(static_cast<int>(left)), lane_idx));
++            simde_mm256_storeu_si256(
++                reinterpret_cast<simde__m256i*>(pay + k / 2),
++                simde_mm256_permutevar8x32_epi32(pl, simde_mm256_setr_epi32(1, 0, 3, 2, 5, 4, 7, 6)));
+         }
+     }
+     return elems;

From 82305a1ae45c4d652c02be76ef06c4efe12f5873 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Sun, 4 Oct 2026 00:30:10 +0200
Subject: [PATCH 50/78] ollama: 0.34.4 -> 0.35.1

Changelog: https://github.com/ollama/ollama/releases/tag/v0.35.0
Changelog: https://github.com/ollama/ollama/releases/tag/v0.35.1
Diff: https://github.com/ollama/ollama/compare/v0.34.4...v0.35.1
---
 pkgs/by-name/ol/ollama/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ol/ollama/package.nix b/pkgs/by-name/ol/ollama/package.nix
index 5b69b5e67bdf..3884ff685e18 100644
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -111,12 +111,12 @@ let
   # vendored in-tree. Pre-stage the pin (tracks upstream's
   # `LLAMA_CPP_VERSION` file) so the FetchContent step uses our copy
   # instead of trying to clone over the network in the sandbox.
-  llamaCppVersion = "b11081";
+  llamaCppVersion = "b11232";
   llamaCppSrc = fetchFromGitHub {
     owner = "ggml-org";
     repo = "llama.cpp";
     tag = llamaCppVersion;
-    hash = "sha256-yI/oNTMzOO9Cu0xVp0YYbbgvlwTggJAPJMooDfVnMvU=";
+    hash = "sha256-2+yobqi5pOI8FyMK2StFIWAOLR2JgQGh/7gX6o4k8JU=";
   };
 
   wrapperOptions = [
@@ -152,13 +152,13 @@ let
 in
 goBuild (finalAttrs: {
   pname = "ollama";
-  version = "0.34.4";
+  version = "0.35.1";
 
   src = fetchFromGitHub {
     owner = "ollama";
     repo = "ollama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Wg1lVSJjN67TSIX75Xp/QyiuCW+HirpdJZIm92J0j6o=";
+    hash = "sha256-5qJyJhqL/Zhfq2s/Z3x5Sq0GFgBai812cQkgNq82nm4=";
   };
 
   vendorHash = "sha256-45FfI47tNHBPYOBLRrwuhADCUtkjAhlFrExlEy9piMI=";

From b5f19b2ad215b861f4424df83ac9948aebb328e6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 3 Oct 2026 22:56:07 +0000
Subject: [PATCH 51/78] croc: 11.5.3 -> 11.5.4

---
 pkgs/by-name/cr/croc/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/cr/croc/package.nix b/pkgs/by-name/cr/croc/package.nix
index 865a49bb0cd0..be659800d032 100644
--- a/pkgs/by-name/cr/croc/package.nix
+++ b/pkgs/by-name/cr/croc/package.nix
@@ -11,16 +11,16 @@
 
 buildGo127Module (finalAttrs: {
   pname = "croc";
-  version = "11.5.3";
+  version = "11.5.4";
 
   src = fetchFromGitHub {
     owner = "schollz";
     repo = "croc";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-Q+1KK+HA3SC9Kl7YV+ZfIMLUJMu+wjnIknRqn+l6cdM=";
+    hash = "sha256-QF++O86FqyTE/s0BiFhFts80/DCXPU1xAqeTMtviE2E=";
   };
 
-  vendorHash = "sha256-6B7KZd0Y/RvV9q9U8kHFnKqkDX7uA1tCW2vaFnfeQZ0=";
+  vendorHash = "sha256-eiuycihsdYZqdobRsMlryyQOhOeDIUAyM7cUavTPv+o=";
 
   subPackages = [ "." ];
 

From eeeccccf5f447fe3a73dc11b36c2126f4e26eafc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 3 Oct 2026 23:14:06 +0000
Subject: [PATCH 52/78] python3Packages.rmsd: 1.6.5 -> 1.7.0

---
 pkgs/development/python-modules/rmsd/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/rmsd/default.nix b/pkgs/development/python-modules/rmsd/default.nix
index 5b752ff48fc8..716153122f61 100644
--- a/pkgs/development/python-modules/rmsd/default.nix
+++ b/pkgs/development/python-modules/rmsd/default.nix
@@ -10,12 +10,12 @@
 
 buildPythonPackage rec {
   pname = "rmsd";
-  version = "1.6.5";
+  version = "1.7.0";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-blEDbbrGtOz067Jq24QMBU5P8otmBwnUl8Tpjvc7TLo=";
+    hash = "sha256-VQz+mnootttCRJEcMA8Yx7VzmWCcdgHHSVkJ3JZXIX0=";
   };
 
   build-system = [ setuptools ];

From 21a184fd1f707b1fa8a5d7ca9555ca0aacd4667e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 3 Oct 2026 23:14:13 +0000
Subject: [PATCH 53/78] python3Packages.altcha: 2.1.0 -> 2.2.0

---
 pkgs/development/python-modules/altcha/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/altcha/default.nix b/pkgs/development/python-modules/altcha/default.nix
index e00bd56512b0..4d8fe5ad3dd3 100644
--- a/pkgs/development/python-modules/altcha/default.nix
+++ b/pkgs/development/python-modules/altcha/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "altcha";
-  version = "2.1.0";
+  version = "2.2.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "altcha-org";
     repo = "altcha-lib-py";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-GPHmyt+5a/sGVt2ZwsWON1xkwNhYcmb3PShILiOhaoM=";
+    hash = "sha256-Lg28eGXVTwt8L/3fUZw/9Gn5BObM30YtJdLEaDt56Gc=";
   };
 
   build-system = [ setuptools ];

From 24ef615fb5bf519d93d2c3e13f1d146f38936f00 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 3 Oct 2026 23:23:37 +0000
Subject: [PATCH 54/78] havn: 0.3.9 -> 0.3.10

---
 pkgs/by-name/ha/havn/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ha/havn/package.nix b/pkgs/by-name/ha/havn/package.nix
index 2251bb0a3cbf..7ce651cd27c8 100644
--- a/pkgs/by-name/ha/havn/package.nix
+++ b/pkgs/by-name/ha/havn/package.nix
@@ -8,7 +8,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "havn";
-  version = "0.3.9";
+  version = "0.3.10";
 
   __structuredAttrs = true;
 
@@ -16,10 +16,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "mrjackwills";
     repo = "havn";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-G+aUTzlpUfVTkoftp1igCPeKaQpbS4CyydoitcLzxjk=";
+    hash = "sha256-CABTI2UilR4b0vQdWaiXJK8sRNVK1dV1d+2qckVcWSo=";
   };
 
-  cargoHash = "sha256-G4DNr69FKiLI3vrEX3AMPn3DdWzPbxA7t2vw3bJtW94=";
+  cargoHash = "sha256-qw/+eN27SxPrg0ma3Lj04BDh/XWFPQk0f4hL5a9IzIE=";
 
   nativeInstallCheckInputs = [ versionCheckHook ];
 

From 22dc734a5439168d29675840c49d7b3dcec45f86 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 3 Oct 2026 23:36:19 +0000
Subject: [PATCH 55/78] thunderbird-mcp: 0.9.1 -> 0.9.2

---
 .../th/thunderbird-mcp/package-lock.json      | 257 +++++++++++++-----
 pkgs/by-name/th/thunderbird-mcp/package.nix   |   6 +-
 2 files changed, 192 insertions(+), 71 deletions(-)

diff --git a/pkgs/by-name/th/thunderbird-mcp/package-lock.json b/pkgs/by-name/th/thunderbird-mcp/package-lock.json
index b6898bb0ad9b..933a8832b5a2 100644
--- a/pkgs/by-name/th/thunderbird-mcp/package-lock.json
+++ b/pkgs/by-name/th/thunderbird-mcp/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "thunderbird-mcp",
-  "version": "0.9.1",
+  "version": "0.9.2",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "thunderbird-mcp",
-      "version": "0.9.1",
+      "version": "0.9.2",
       "license": "MIT",
       "bin": {
         "thunderbird-mcp": "mcp-bridge.cjs"
@@ -22,10 +22,34 @@
         "node": ">=18.0.0"
       }
     },
+    "node_modules/@cacheable/memory": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/@cacheable/memory/-/memory-2.2.0.tgz",
+      "integrity": "sha512-CTLKqLItRCEixEAewD3/j9DB3/o96gpTPD4eJ1v+DGOlxZRZncRQkGYqqnAGCscYd6RNeXfGeiuCphsPtqyIfQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@cacheable/utils": "^2.5.0",
+        "@keyv/bigmap": "^1.3.1",
+        "hookified": "^1.15.1",
+        "keyv": "^5.6.0"
+      }
+    },
+    "node_modules/@cacheable/utils": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/@cacheable/utils/-/utils-2.5.0.tgz",
+      "integrity": "sha512-buipgOVDkkPXNR5+xBpDw7Zk2n1EvU7qBJCNUcL7rhQ//kfpOXPAvQ511Os0vpLYJ1pZnvudNytkQt2hst3wqA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "hashery": "^1.5.1",
+        "keyv": "^5.6.0"
+      }
+    },
     "node_modules/@eslint-community/eslint-utils": {
-      "version": "4.9.1",
-      "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.9.1.tgz",
-      "integrity": "sha512-phrYmNiYppR7znFEdqgfWHXR6NCkZEK7hwWDHZUjit/2/U0r6XvkDl0SYnoM51Hq7FhCGdLDT6zxCCOY1hexsQ==",
+      "version": "4.10.1",
+      "resolved": "https://registry.npmjs.org/@eslint-community/eslint-utils/-/eslint-utils-4.10.1.tgz",
+      "integrity": "sha512-cuadcxVFE8sDK6iWJbs8Sn0av2Nrh2QSGQhVlBW9AaAHqHwjWsZHT8LJ4hFGPh7ASBV2deFdM7H/DPjulmh8rg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -80,9 +104,9 @@
       }
     },
     "node_modules/@eslint/config-helpers": {
-      "version": "0.6.0",
-      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.6.0.tgz",
-      "integrity": "sha512-ii6Bw9jJ2zi2cWA2Z+9/QZ/+3DX6kwaV5Q986D/CdP3Lap3w/pgQZ373FV7byY/i7L4IRH/G43I5dz1ClsCbpA==",
+      "version": "0.7.0",
+      "resolved": "https://registry.npmjs.org/@eslint/config-helpers/-/config-helpers-0.7.0.tgz",
+      "integrity": "sha512-DObd/KKUsU+FaFv4PLxSRenpXfQWmPXXP3pPZ6/K1PCrMu2vQpMDMuQe/BqYeoLcz8ro0bVDF1RxOJgfVEdhUw==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -137,9 +161,9 @@
       }
     },
     "node_modules/@eslint/plugin-kit": {
-      "version": "0.7.2",
-      "resolved": "https://registry.npmjs.org/@eslint/plugin-kit/-/plugin-kit-0.7.2.tgz",
-      "integrity": "sha512-+CNAzxglkrpNf/kKywqQfk74QjtceuOE7Qm+AF8miRvPF/wmmK5+OJOgVh3AVTT3RP2mH3+FOaxlE5v72owk0A==",
+      "version": "0.7.3",
+      "resolved": "https://registry.npmjs.org/@eslint/plugin-kit/-/plugin-kit-0.7.3.tgz",
+      "integrity": "sha512-IkO+/KEUvwbVpiURZg+P7zF74z5Jxe0UgJxVni+RtoHQ6IZieXaO02kmadomap/q+l6bc/jdPGGqTjhuZnuz1Q==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
@@ -216,6 +240,30 @@
         "url": "https://github.com/sponsors/nzakas"
       }
     },
+    "node_modules/@keyv/bigmap": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/@keyv/bigmap/-/bigmap-1.3.1.tgz",
+      "integrity": "sha512-WbzE9sdmQtKy8vrNPa9BRnwZh5UF4s1KTmSK0KUVLo3eff5BlQNNWDnFOouNpKfPKDnms9xynJjsMYjMaT/aFQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "hashery": "^1.4.0",
+        "hookified": "^1.15.0"
+      },
+      "engines": {
+        "node": ">= 18"
+      },
+      "peerDependencies": {
+        "keyv": "^5.6.0"
+      }
+    },
+    "node_modules/@keyv/serialize": {
+      "version": "1.1.1",
+      "resolved": "https://registry.npmjs.org/@keyv/serialize/-/serialize-1.1.1.tgz",
+      "integrity": "sha512-dXn3FZhPv0US+7dtJsIi2R+c7qWYiReoEh5zUntWCf4oSpMNib8FDhSoed6m3QyZdx5hK7iLFkYk3rNxwt8vTA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/@types/esrecurse": {
       "version": "4.3.1",
       "resolved": "https://registry.npmjs.org/@types/esrecurse/-/esrecurse-4.3.1.tgz",
@@ -238,9 +286,9 @@
       "license": "MIT"
     },
     "node_modules/acorn": {
-      "version": "8.17.0",
-      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.17.0.tgz",
-      "integrity": "sha512-xRQbDb9BnwDafYNn6Vwl839DYVjqXYb1XVGtWAZ1kcDc6iwAL4hg3B1dZlRiuENFeO2H53gFG3in621AdERVAg==",
+      "version": "8.18.0",
+      "resolved": "https://registry.npmjs.org/acorn/-/acorn-8.18.0.tgz",
+      "integrity": "sha512-lGq+9yr1/GuAWaVYIHRjvvySG5/4VfKIvC8EWxStPdcDh/Ka7FG3twP6v4d5BkravUilhIAsG4Qj83t02LWUPQ==",
       "dev": true,
       "license": "MIT",
       "bin": {
@@ -277,6 +325,13 @@
         "url": "https://github.com/sponsors/epoberezkin"
       }
     },
+    "node_modules/argparse": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
+      "dev": true,
+      "license": "Python-2.0"
+    },
     "node_modules/balanced-match": {
       "version": "4.0.4",
       "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
@@ -288,16 +343,30 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "5.0.7",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
-      "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
+      "version": "5.0.12",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.12.tgz",
+      "integrity": "sha512-YovQ3rzhaLMIrDjNDMkNS01tea93qhEhG5xy8f6+R0l+dw3Ki+5sCoIoI942iuLZTHWogWktgwVDhU09iNEimQ==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "balanced-match": "^4.0.2"
       },
       "engines": {
-        "node": "18 || 20 || >=22"
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/cacheable": {
+      "version": "2.5.0",
+      "resolved": "https://registry.npmjs.org/cacheable/-/cacheable-2.5.0.tgz",
+      "integrity": "sha512-60cyAOytib/OzBw1JNSoSV/boK1AtHryDIjvVBk7XbN4ugfkM3+Sry7fEjNgPMGgOjuaZPAp8ruZ0Cxafwyq9g==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@cacheable/memory": "^2.2.0",
+        "@cacheable/utils": "^2.5.0",
+        "hookified": "^1.15.0",
+        "keyv": "^5.6.0",
+        "qified": "^0.10.1"
       }
     },
     "node_modules/cross-spawn": {
@@ -341,9 +410,9 @@
       "license": "MIT"
     },
     "node_modules/enhanced-resolve": {
-      "version": "5.24.2",
-      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.24.2.tgz",
-      "integrity": "sha512-rpsZEGT1jFuve6QlpyRp9ckQ+kN61hvF9BzCPyMdaKTm8UJce96KBn3sorXOFXlzjPrs3Vc4T1NsSroZ3PxlFw==",
+      "version": "5.26.0",
+      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.26.0.tgz",
+      "integrity": "sha512-9vhedylFonb2YGogzUKX6+Ja72gOJbN1QHAqdrvqLwhdl/QWbKopzoUC9EbQNVsAns/bx/4uyqalrQAoy1IByw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -368,9 +437,9 @@
       }
     },
     "node_modules/eslint": {
-      "version": "10.7.0",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.7.0.tgz",
-      "integrity": "sha512-GVTD7s1vdIl6UYvAfriOPeY1Df8LIZjfofLvHwde+erDHGGuHyuM6xoxRxmHiebhYuD2p1vN4wWh0XzPARSGDQ==",
+      "version": "10.12.0",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-10.12.0.tgz",
+      "integrity": "sha512-npHjrHb2o4ehH3mE+YuxABR+0gyb0aVWCIolgJDArwCiHEIsonBm3ZKjel5b0U5+a+MbEvIyRCGCzD3eKKK2NA==",
       "dev": true,
       "license": "MIT",
       "workspaces": [
@@ -380,9 +449,9 @@
         "@eslint-community/eslint-utils": "^4.8.0",
         "@eslint-community/regexpp": "^4.12.2",
         "@eslint/config-array": "^0.23.5",
-        "@eslint/config-helpers": "^0.6.0",
+        "@eslint/config-helpers": "^0.7.0",
         "@eslint/core": "^1.2.1",
-        "@eslint/plugin-kit": "^0.7.2",
+        "@eslint/plugin-kit": "^0.7.3",
         "@humanfs/node": "^0.16.6",
         "@humanwhocodes/module-importer": "^1.0.1",
         "@humanwhocodes/retry": "^0.4.2",
@@ -397,14 +466,14 @@
         "esquery": "^1.7.0",
         "esutils": "^2.0.2",
         "fast-deep-equal": "^3.1.3",
-        "file-entry-cache": "^8.0.0",
+        "file-entry-cache": "11.1.5 || >11.1.6 <12",
         "find-up": "^5.0.0",
         "glob-parent": "^6.0.2",
         "ignore": "^5.2.0",
         "imurmurhash": "^0.1.4",
         "is-glob": "^4.0.0",
         "json-stable-stringify-without-jsonify": "^1.0.1",
-        "minimatch": "^10.2.4",
+        "minimatch": "^10.2.5",
         "natural-compare": "^1.4.0",
         "optionator": "^0.9.3"
       },
@@ -465,9 +534,9 @@
       }
     },
     "node_modules/eslint-plugin-n": {
-      "version": "18.2.2",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-n/-/eslint-plugin-n-18.2.2.tgz",
-      "integrity": "sha512-gOO0lIqwEjZ750kv9/SptCWArUoAZXJoBr0vYWTO2dCBxctHUXlBIigiC8xuxxr/NKqgIT6Ehz1xRcilj8a5cA==",
+      "version": "18.4.1",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-n/-/eslint-plugin-n-18.4.1.tgz",
+      "integrity": "sha512-2sBReWOvCbzgkPri9M5SFmD5EbIwZLa1xz6B5RZsrI19WSFKpyx1sOMr+pdk8puCiXuEgCbErEHy1PuaUrc/4w==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -478,6 +547,7 @@
         "globals": "^15.11.0",
         "globrex": "^0.1.2",
         "ignore": "^5.3.2",
+        "js-yaml": "^5.4.1",
         "semver": "^7.6.3"
       },
       "engines": {
@@ -650,16 +720,13 @@
       "license": "MIT"
     },
     "node_modules/file-entry-cache": {
-      "version": "8.0.0",
-      "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-8.0.0.tgz",
-      "integrity": "sha512-XXTUwCvisa5oacNGRP9SfNtYBNAMi+RPwBFmblZEF7N7swHYQS6/Zfk7SRwx4D5j3CH211YNRco1DEMNVfZCnQ==",
+      "version": "11.1.5",
+      "resolved": "https://registry.npmjs.org/file-entry-cache/-/file-entry-cache-11.1.5.tgz",
+      "integrity": "sha512-+PFTHITI08JIGhnNpGNI8T8inUpgZfk3GNEqfT9R2zZV2iFXg3CvqzSl/uEhs7TSGujYRELEANyDvS8Fj7+S7Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "flat-cache": "^4.0.0"
-      },
-      "engines": {
-        "node": ">=16.0.0"
+        "flat-cache": "^6.1.23"
       }
     },
     "node_modules/find-up": {
@@ -680,30 +747,28 @@
       }
     },
     "node_modules/flat-cache": {
-      "version": "4.0.1",
-      "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-4.0.1.tgz",
-      "integrity": "sha512-f7ccFPK3SXFHpx15UIGyRJ/FJQctuKZ0zVuN3frBo4HnK3cay9VEW0R6yPYFHC0AgqhukPzKjq22t5DmAyqGyw==",
+      "version": "6.1.23",
+      "resolved": "https://registry.npmjs.org/flat-cache/-/flat-cache-6.1.23.tgz",
+      "integrity": "sha512-f++BY9pTk+983xK1FLzlLpmM0i0z+jHmx3QESGkURMXujQZz1k5wzwX6hjnQ8goaD0B+sYnDK1yZ6MTyZfUaqA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "flatted": "^3.2.9",
-        "keyv": "^4.5.4"
-      },
-      "engines": {
-        "node": ">=16"
+        "cacheable": "^2.5.0",
+        "flatted": "^3.4.2",
+        "hookified": "^1.15.0"
       }
     },
     "node_modules/flatted": {
-      "version": "3.4.2",
-      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.2.tgz",
-      "integrity": "sha512-PjDse7RzhcPkIJwy5t7KPWQSZ9cAbzQXcafsetQoD7sOJRQlGikNbx7yZp2OotDnJyrDcbyRq3Ttb18iYOqkxA==",
+      "version": "3.4.4",
+      "resolved": "https://registry.npmjs.org/flatted/-/flatted-3.4.4.tgz",
+      "integrity": "sha512-5+ybhBZANEJxaH3X5evAFatUxLfEHSr7n6kYJ+1Qd0mUqr4eu9gIf6GDbWHf8RJijHrjjO8G+la14SlL2SeS1Q==",
       "dev": true,
       "license": "ISC"
     },
     "node_modules/get-tsconfig": {
-      "version": "4.14.0",
-      "resolved": "https://registry.npmjs.org/get-tsconfig/-/get-tsconfig-4.14.0.tgz",
-      "integrity": "sha512-yTb+8DXzDREzgvYmh6s9vHsSVCHeC0G3PI5bEXNBHtmshPnO+S5O7qgLEOn0I5QvMy6kpZN8K1NKGyilLb93wA==",
+      "version": "4.14.3",
+      "resolved": "https://registry.npmjs.org/get-tsconfig/-/get-tsconfig-4.14.3.tgz",
+      "integrity": "sha512-++QEw4DIY7WGoukz+/+A/8dGYPT9l9yIadnmSgZ8Rjr3YVSVDipQSO9CdnJo9ePqFqUUqh+wk9uIaoiAwsiPkA==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -727,9 +792,9 @@
       }
     },
     "node_modules/globals": {
-      "version": "17.7.0",
-      "resolved": "https://registry.npmjs.org/globals/-/globals-17.7.0.tgz",
-      "integrity": "sha512-Czmyns5dUsq4seFBR/Kdydhmo8y9kC79hiSkPn0YcGtNnYWnrgt0vjrSjx9tspoDGWm2CMarffRuLjM4xUz8xg==",
+      "version": "17.13.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-17.13.0.tgz",
+      "integrity": "sha512-RwMTC61u7hrG3ZJMkZQOK4JLJrKS8QtoTii63EmWvFXHqycY9FObBJQCbsLxSO8kjKhWE5kV1GC+Vb1g3RI0Zg==",
       "dev": true,
       "license": "MIT",
       "engines": {
@@ -753,6 +818,26 @@
       "dev": true,
       "license": "ISC"
     },
+    "node_modules/hashery": {
+      "version": "1.5.1",
+      "resolved": "https://registry.npmjs.org/hashery/-/hashery-1.5.1.tgz",
+      "integrity": "sha512-iZyKG96/JwPz1N55vj2Ie2vXbhu440zfUfJvSwEqEbeLluk7NnapfGqa7LH0mOsnDxTF85Mx8/dyR6HfqcbmbQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "hookified": "^1.15.0"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/hookified": {
+      "version": "1.15.1",
+      "resolved": "https://registry.npmjs.org/hookified/-/hookified-1.15.1.tgz",
+      "integrity": "sha512-MvG/clsADq1GPM2KGo2nyfaWVyn9naPiXrqIe4jYjXNZQt238kWyOGrsyc/DmRAQ+Re6yeo6yX/yoNCG5KAEVg==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/ignore": {
       "version": "5.3.2",
       "resolved": "https://registry.npmjs.org/ignore/-/ignore-5.3.2.tgz",
@@ -803,12 +888,28 @@
       "dev": true,
       "license": "ISC"
     },
-    "node_modules/json-buffer": {
-      "version": "3.0.1",
-      "resolved": "https://registry.npmjs.org/json-buffer/-/json-buffer-3.0.1.tgz",
-      "integrity": "sha512-4bV5BfR2mqfQTJm+V5tPPdf+ZpuhiIvTuAB5g8kcrXOZpTT/QwwVRWBywX1ozr6lEuPdbHxwaJlm9G6mI2sfSQ==",
+    "node_modules/js-yaml": {
+      "version": "5.4.2",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-5.4.2.tgz",
+      "integrity": "sha512-m+aqu+LwO1O6sIopafj8HUVl5aawITwZQe/yHpMCKjaWBaA/d07B/QdMb3529REftiU+RMMHL3Vlsw3hON7vWg==",
       "dev": true,
-      "license": "MIT"
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/puzrin"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/nodeca"
+        }
+      ],
+      "license": "MIT",
+      "dependencies": {
+        "argparse": "^2.0.1"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.mjs"
+      }
     },
     "node_modules/json-schema-traverse": {
       "version": "0.4.1",
@@ -825,13 +926,13 @@
       "license": "MIT"
     },
     "node_modules/keyv": {
-      "version": "4.5.4",
-      "resolved": "https://registry.npmjs.org/keyv/-/keyv-4.5.4.tgz",
-      "integrity": "sha512-oxVHkHR/EJf2CNXnWxRLW6mg7JyCCUcG0DtEGmL2ctUo1PNTin1PUil+r/+4r5MpVgC/fn1kjsx7mjSujKqIpw==",
+      "version": "5.6.0",
+      "resolved": "https://registry.npmjs.org/keyv/-/keyv-5.6.0.tgz",
+      "integrity": "sha512-CYDD3SOtsHtyXeEORYRx2qBtpDJFjRTGXUtmNEMGyzYOKj1TE3tycdlho7kA1Ufx9OYWZzg52QFBGALTirzDSw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "json-buffer": "3.0.1"
+        "@keyv/serialize": "^1.1.1"
       }
     },
     "node_modules/levn": {
@@ -865,13 +966,13 @@
       }
     },
     "node_modules/minimatch": {
-      "version": "10.2.5",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
-      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
+      "version": "10.2.6",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.6.tgz",
+      "integrity": "sha512-vpLQEs+VLCr1nU0BXS07maYoFwlDAH0gngQuuttxIwutDFEMHq2blX+8vpgxDdK3J1PwjCJiep77OitTZ4Ll1A==",
       "dev": true,
       "license": "BlueOak-1.0.0",
       "dependencies": {
-        "brace-expansion": "^5.0.5"
+        "brace-expansion": "^5.0.8"
       },
       "engines": {
         "node": "18 || 20 || >=22"
@@ -984,6 +1085,26 @@
         "node": ">=6"
       }
     },
+    "node_modules/qified": {
+      "version": "0.10.1",
+      "resolved": "https://registry.npmjs.org/qified/-/qified-0.10.1.tgz",
+      "integrity": "sha512-+Owyggi9IxT1ePKGafcI87ubSmxol6smwJ+RAHDQlx9+9cPwFWDiKFFCPuWhr9ignlGpZ9vDQLw67N4dcTVFEA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "hookified": "^2.1.1"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/qified/node_modules/hookified": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/hookified/-/hookified-2.2.0.tgz",
+      "integrity": "sha512-p/LgFzRN5FeoD3DLS6bkUapeye6E4SI6yJs6KetENd18S+FBthqYq2amJUWpt5z0EQwwHemidjY5OqJGEKm5uA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/resolve-pkg-maps": {
       "version": "1.0.0",
       "resolved": "https://registry.npmjs.org/resolve-pkg-maps/-/resolve-pkg-maps-1.0.0.tgz",
diff --git a/pkgs/by-name/th/thunderbird-mcp/package.nix b/pkgs/by-name/th/thunderbird-mcp/package.nix
index 87ca28a07a39..2467feac15b7 100644
--- a/pkgs/by-name/th/thunderbird-mcp/package.nix
+++ b/pkgs/by-name/th/thunderbird-mcp/package.nix
@@ -7,13 +7,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "thunderbird-mcp";
-  version = "0.9.1";
+  version = "0.9.2";
 
   src = fetchFromGitHub {
     owner = "TKasperczyk";
     repo = "thunderbird-mcp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uN/xvN+bbtFTWMd2Kko/d07FXna5e7jdfZPX8vAwfa4=";
+    hash = "sha256-OH8uAy9ka2ao/7UF2Bi4dfhOa0IZz+z2Bm6MpfBF1Gk=";
   };
 
   postPatch = ''
@@ -23,7 +23,7 @@ buildNpmPackage (finalAttrs: {
   forceEmptyCache = true;
   dontNpmBuild = true;
 
-  npmDepsHash = "sha256-Dhm/6nJOGAFKUTmnWmDfnsLyYcDSVPvrWS4DlyOlBNk=";
+  npmDepsHash = "sha256-cngbvIIP7lgwuXhIM6CA7oNlg9ctj9I2AA3SMKxk54g=";
 
   doCheck = true;
 

From 8ffef3a85cefa07b5072b2ccc65f690340a77e0f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 4 Oct 2026 01:06:08 +0000
Subject: [PATCH 56/78] multimon-ng: 1.6.1 -> 1.6.2

---
 pkgs/by-name/mu/multimon-ng/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mu/multimon-ng/package.nix b/pkgs/by-name/mu/multimon-ng/package.nix
index aa2e38c70a17..128c5e1977eb 100644
--- a/pkgs/by-name/mu/multimon-ng/package.nix
+++ b/pkgs/by-name/mu/multimon-ng/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "multimon-ng";
-  version = "1.6.1";
+  version = "1.6.2";
 
   src = fetchFromGitHub {
     owner = "EliasOenal";
     repo = "multimon-ng";
     rev = finalAttrs.version;
-    sha256 = "sha256-FxX01+bFcca+wvnilOV4xJx1bSV9lxy83EhpwWhi/Cs=";
+    sha256 = "sha256-OHl9y1Pk/8N4IwKYuiikHoW2sfLWU4G4uyozxHxB0WY=";
   };
 
   buildInputs = lib.optionals stdenv.hostPlatform.isLinux [

From b7de69c75642dae83800f117e71eb09a7675f1b1 Mon Sep 17 00:00:00 2001
From: Ruddickmg <ruddickmg@gmail.com>
Date: Sat, 3 Oct 2026 17:38:31 -1000
Subject: [PATCH 57/78] vimPlugins.hermes-nvim: 0.12.1 -> 0.14.0; fix
 updateScript

---
 .../non-generated/hermes-nvim/default.nix     | 41 +++++++++++++++----
 1 file changed, 34 insertions(+), 7 deletions(-)

diff --git a/pkgs/applications/editors/vim/plugins/non-generated/hermes-nvim/default.nix b/pkgs/applications/editors/vim/plugins/non-generated/hermes-nvim/default.nix
index 3f42d8339f7f..f029d3f0360e 100644
--- a/pkgs/applications/editors/vim/plugins/non-generated/hermes-nvim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/hermes-nvim/default.nix
@@ -8,17 +8,20 @@
   curl,
   cacert,
   jq,
+  nix,
+  gnugrep,
+  gnused,
   common-updater-scripts,
   nix-prefetch-scripts,
   pkg-config,
 }:
 
 let
-  version = "0.12.1";
+  version = "0.14.0";
 
   src = fetchzip {
     url = "https://github.com/Ruddickmg/hermes.nvim/archive/refs/tags/v${version}.tar.gz";
-    hash = "sha256-chPhu7e3LG28DAzkJRWEIG5tVnKXrF+ctc23ZwQc8o0=";
+    hash = "sha256-YUe+Mg1StwcxpcIcWr9T/32nkH921UranMM0bE+7lu8=";
   };
 
   dejavuFont = fetchzip {
@@ -57,7 +60,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   inherit version src;
   __structuredAttrs = true;
 
-  cargoHash = "sha256-cKMurBrYpCv0F6AvAKycsCFbY1tl35WNgyBwh5T3oao=";
+  cargoHash = "sha256-X1YI0iT3/5hncU0M5qJY+12nO6Et4B/xqwvjaq8AV1Q=";
 
   cargoBuildFeatures = [ "with-icons" ];
 
@@ -86,7 +89,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     inherit agentSvgs dejavuFont;
 
     tests.basic =
-      runCommand "hermes-nvim-test-basic" { nativeBuildInputs = [ finalAttrs.finalPackage ]; }
+      runCommand "hermes-nvim-test-basic"
+        {
+          nativeBuildInputs = [ finalAttrs.finalPackage ];
+        }
         ''
           test -f "${finalAttrs.finalPackage}/lua/hermes/init.lua"
           test -f "${finalAttrs.finalPackage}/plugin/hermes.lua"
@@ -101,6 +107,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
         lib.makeBinPath [
           curl
           jq
+          nix
+          gnugrep
+          gnused
           common-updater-scripts
           nix-prefetch-scripts
         ]
@@ -112,6 +121,25 @@ rustPlatform.buildRustPackage (finalAttrs: {
       fi
       update-source-version "vimPlugins.hermes-nvim" "$NEW_VERSION" --ignore-same-version
 
+      PKG_FILE="pkgs/applications/editors/vim/plugins/non-generated/hermes-nvim/default.nix"
+
+      NEW_CARGO_HASH=$(
+        nix-build --no-out-link -E '
+          let
+            pkgs = import ./. {};
+            pkg = pkgs.vimPlugins.hermes-nvim;
+          in pkg.cargoDeps.overrideAttrs (old: {
+            vendorStaging = old.vendorStaging.overrideAttrs (_: {
+              outputHash = "";
+              outputHashAlgo = "sha256";
+            });
+          })
+        ' 2>&1 | grep -oP 'got:\s+\K\S+'
+      ) || true
+      if [[ -n "$NEW_CARGO_HASH" ]]; then
+        sed -i "s|cargoHash = \"sha256-[^\"]*\";|cargoHash = \"$NEW_CARGO_HASH\";|" "$PKG_FILE"
+      fi
+
       NEW_SVG_HASH=$(
         nix-build --no-out-link -E '
           let
@@ -121,11 +149,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
             outputHash = "";
             outputHashAlgo = "sha256";
           })
-        ' 2>&1 | grep -oP 'got: \K.*'
+        ' 2>&1 | grep -oP 'got:\s+\K\S+'
       ) || true
       if [[ -n "$NEW_SVG_HASH" ]]; then
-        sed -i "s|outputHash = \"[^\"]*\";|outputHash = \"$NEW_SVG_HASH\";|" \
-          "pkgs/applications/editors/vim/plugins/non-generated/hermes-nvim/default.nix"
+        sed -i "s|outputHash = \"sha256-[^\"]*\";|outputHash = \"$NEW_SVG_HASH\";|" "$PKG_FILE"
       fi
     '';
   };

From 2ff7d86de582ed7d507c8ccc27f4264d3082a108 Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Sat, 3 Oct 2026 23:39:21 -0400
Subject: [PATCH 58/78] lightgbm: fix build, remove `cudatoolkit`

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 pkgs/by-name/li/lightgbm/package.nix | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/li/lightgbm/package.nix b/pkgs/by-name/li/lightgbm/package.nix
index 674ac37cd563..3e3da206aab8 100644
--- a/pkgs/by-name/li/lightgbm/package.nix
+++ b/pkgs/by-name/li/lightgbm/package.nix
@@ -49,6 +49,9 @@ stdenv.mkDerivation (finalAttrs: {
   pname = lib.optionalString rLibrary "r-" + "lightgbm";
   version = "4.6.0";
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   src = fetchFromGitHub {
     owner = "lightgbm-org";
     repo = "lightgbm";
@@ -95,6 +98,7 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     cmake
   ]
+  ++ lib.optionals cudaSupport [ cudaPackages.cuda_nvcc ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.openmp ]
   ++ lib.optionals openclSupport [
     opencl-headers
@@ -110,7 +114,7 @@ stdenv.mkDerivation (finalAttrs: {
     pandoc
   ];
 
-  buildInputs = [ gtest ] ++ lib.optional cudaSupport cudaPackages.cudatoolkit;
+  buildInputs = [ gtest ] ++ lib.optionals cudaSupport [ cudaPackages.cuda_cudart ];
 
   propagatedBuildInputs = lib.optionals rLibrary [
     rPackages.data_table
@@ -128,6 +132,9 @@ stdenv.mkDerivation (finalAttrs: {
     ++ lib.optionals cudaSupport [
       (lib.cmakeBool "USE_CUDA" true)
       (lib.cmakeFeature "CMAKE_CXX_COMPILER" (lib.getExe cudaPackages.backendStdenv.cc))
+      (lib.cmakeFeature "CMAKE_CUDA_STANDARD" "14")
+      (lib.cmakeFeature "CMAKE_CUDA_ARCHITECTURES" cudaPackages.flags.cmakeCudaArchitecturesString)
+      (lib.cmakeBool "CMAKE_CUDA_RESOLVE_DEVICE_SYMBOLS" true)
     ]
     ++ lib.optionals openclSupport [
       (lib.cmakeBool "USE_GPU" true)

From 5597008ea87b1e8ea94f863c5e4e872cf6db2ffc Mon Sep 17 00:00:00 2001
From: sia <sia@nixos>
Date: Sat, 3 Oct 2026 23:01:11 -0500
Subject: [PATCH 59/78] vimPlugins.dadbod-grip-nvim: init at 3.11.0

https://github.com/joryeugene/dadbod-grip.nvim

Assisted-by: Pi 0.86.1 (deepseek-flash)
---
 .../applications/editors/vim/plugins/generated.nix | 14 ++++++++++++++
 .../applications/editors/vim/plugins/overrides.nix |  9 +++++++++
 .../editors/vim/plugins/vim-plugin-names           |  1 +
 3 files changed, 24 insertions(+)

diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 31e2e68341db..24d88fd3e4f8 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -4450,6 +4450,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  dadbod-grip-nvim = buildVimPlugin {
+    pname = "dadbod-grip.nvim";
+    version = "3.11.0";
+    src = fetchFromGitHub {
+      owner = "joryeugene";
+      repo = "dadbod-grip.nvim";
+      tag = "v3.11.0";
+      hash = "sha256-iy3J41D1X0u7pTqSSgvBL5ATQeilon2VRDHFxzFAEqs=";
+    };
+    meta.homepage = "https://github.com/joryeugene/dadbod-grip.nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   dailies-nvim = buildVimPlugin {
     pname = "dailies.nvim";
     version = "0-unstable-2025-04-21";
diff --git a/pkgs/applications/editors/vim/plugins/overrides.nix b/pkgs/applications/editors/vim/plugins/overrides.nix
index 9dc038f7af46..d408eca5e25e 100644
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -1167,6 +1167,15 @@ assertNoAdditions {
     };
   });
 
+  dadbod-grip-nvim = super.dadbod-grip-nvim.overrideAttrs {
+    # Optional pickers: these adapters probe for telescope/snacks with pcall and
+    # fall back to the built-in picker when the dependency is absent.
+    checkInputs = with self; [
+      snacks-nvim
+      telescope-nvim
+    ];
+  };
+
   dailies-nvim = super.dailies-nvim.overrideAttrs {
     runtimeDeps = [
       dailies
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index b11557364843..f34a5d4a7177 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -316,6 +316,7 @@ https://github.com/gbprod/cutlass.nvim/,,
 https://github.com/scottmckendry/cyberdream.nvim/,,
 https://github.com/ghillb/cybu.nvim/,,
 https://github.com/d2lang/d2-vim/,,
+https://github.com/joryeugene/dadbod-grip.nvim/,,
 https://github.com/JachymPutta/dailies.nvim/,,
 https://github.com/Koalhack/darcubox-nvim/,,
 https://github.com/ptdewey/darkearth-nvim/,,

From a09cb142e553d21df68f135bedaaa6c29d8864be Mon Sep 17 00:00:00 2001
From: sia <sia@nixos>
Date: Sat, 3 Oct 2026 23:01:25 -0500
Subject: [PATCH 60/78] vimPlugins.code-helper-nvim: init at
 0-unstable-2026-10-04

https://github.com/sergioia-dev/code-helper-nvim

Assisted-by: Pi 0.86.1 (deepseek-flash)
---
 .../applications/editors/vim/plugins/generated.nix | 14 ++++++++++++++
 .../editors/vim/plugins/vim-plugin-names           |  1 +
 2 files changed, 15 insertions(+)

diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 24d88fd3e4f8..ae106d4c359c 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -3567,6 +3567,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  code-helper-nvim = buildVimPlugin {
+    pname = "code-helper-nvim";
+    version = "0-unstable-2026-10-04";
+    src = fetchFromGitHub {
+      owner = "sergioia-dev";
+      repo = "code-helper-nvim";
+      rev = "318856be95cafd863c7a1983a1b7381c6454b906";
+      hash = "sha256-OHrZiroVLJEmUKIzuw8l59Ql3Xmv8rImrqtGof9DiUM=";
+    };
+    meta.homepage = "https://github.com/sergioia-dev/code-helper-nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   codecompanion-history-nvim = buildVimPlugin {
     pname = "codecompanion-history.nvim";
     version = "0-unstable-2026-01-22";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index f34a5d4a7177..df6b7cf01803 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -253,6 +253,7 @@ https://github.com/iamcco/coc-tailwindcss/,,
 https://github.com/neoclide/coc.nvim/,release,
 https://github.com/ahf/cocci-syntax/,,
 https://github.com/manicmaniac/coconut.vim/,,
+https://github.com/sergioia-dev/code-helper-nvim/,,
 https://github.com/ravitemer/codecompanion-history.nvim/,,
 https://github.com/franco-ruggeri/codecompanion-lualine.nvim/,,
 https://github.com/franco-ruggeri/codecompanion-spinner.nvim/,,

From 47d830db3fca6d975170e43fecc89c5593629690 Mon Sep 17 00:00:00 2001
From: sia <sia@nixos>
Date: Sat, 3 Oct 2026 23:01:38 -0500
Subject: [PATCH 61/78] vimPlugins.carderne-pi-nvim: init at 0.2.5

https://github.com/carderne/pi-nvim

Assisted-by: Pi 0.86.1 (deepseek-flash)
---
 .../applications/editors/vim/plugins/generated.nix | 14 ++++++++++++++
 .../editors/vim/plugins/vim-plugin-names           |  1 +
 2 files changed, 15 insertions(+)

diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index ae106d4c359c..ff5479391377 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -2323,6 +2323,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  carderne-pi-nvim = buildVimPlugin {
+    pname = "carderne-pi-nvim";
+    version = "0.2.5";
+    src = fetchFromGitHub {
+      owner = "carderne";
+      repo = "pi-nvim";
+      tag = "v0.2.5";
+      hash = "sha256-1ZpHYfpgdezwM5go5KAPhjPeKDIgKgmVSCVGgbPv63o=";
+    };
+    meta.homepage = "https://github.com/carderne/pi-nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   catppuccin-nvim = buildVimPlugin {
     pname = "catppuccin-nvim";
     version = "2.0.0";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index df6b7cf01803..a6e2b9e093b9 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -164,6 +164,7 @@ https://github.com/kwkarlwang/bufresize.nvim/,,
 https://github.com/bullets-vim/bullets.vim/,,
 https://github.com/itchyny/calendar.vim/,,
 https://github.com/bkad/camelcasemotion/,,
+https://github.com/carderne/pi-nvim/,,carderne-pi-nvim
 https://github.com/catppuccin/nvim/,,catppuccin-nvim
 https://github.com/catppuccin/vim/,,catppuccin-vim
 https://github.com/tyru/caw.vim/,,

From 25435917ecbf3a835f920256e70ac8f50ca0647d Mon Sep 17 00:00:00 2001
From: sia <sia@nixos>
Date: Sat, 3 Oct 2026 23:01:47 -0500
Subject: [PATCH 62/78] vimPlugins.toggable-term-nvim: init at
 0-unstable-2026-10-04

https://github.com/sergioia-dev/toggable-term-nvim

Assisted-by: Pi 0.86.1 (deepseek-flash)
---
 .../applications/editors/vim/plugins/generated.nix | 14 ++++++++++++++
 .../editors/vim/plugins/vim-plugin-names           |  1 +
 2 files changed, 15 insertions(+)

diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index ff5479391377..f96ce7b19b8a 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -18402,6 +18402,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  toggable-term-nvim = buildVimPlugin {
+    pname = "toggable-term-nvim";
+    version = "0-unstable-2026-10-04";
+    src = fetchFromGitHub {
+      owner = "sergioia-dev";
+      repo = "toggable-term-nvim";
+      rev = "c61ddbcad7484b1306d643bd2a41699fbf0239d6";
+      hash = "sha256-ellFepBoskQ6iIV5lU7OSSyD7StOHsUgQFRoG+wbNDE=";
+    };
+    meta.homepage = "https://github.com/sergioia-dev/toggable-term-nvim/";
+    meta.license = getLicenseFromSpdxId "MIT";
+    meta.hydraPlatforms = [ ];
+  };
+
   toggleterm-nvim = buildVimPlugin {
     pname = "toggleterm.nvim";
     version = "2.13.1-unstable-2025-03-09";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index a6e2b9e093b9..2e756d412a75 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -1312,6 +1312,7 @@ https://github.com/aserowy/tmux.nvim/,,
 https://github.com/edkolev/tmuxline.vim/,,
 https://github.com/folke/todo-comments.nvim/,,
 https://github.com/freitass/todo.txt-vim/,,
+https://github.com/sergioia-dev/toggable-term-nvim/,,
 https://github.com/akinsho/toggleterm.nvim/,,
 https://github.com/tiagovla/tokyodark.nvim/,,
 https://github.com/folke/tokyonight.nvim/,,

From 9faad49f1aee9a871966ff1ab791d49686d7dffb Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 4 Oct 2026 04:46:15 +0000
Subject: [PATCH 63/78] free5gc-upf: 1.2.12 -> 1.2.13

---
 pkgs/by-name/fr/free5gc-upf/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fr/free5gc-upf/package.nix b/pkgs/by-name/fr/free5gc-upf/package.nix
index ffb12e735b11..4859ad84487c 100644
--- a/pkgs/by-name/fr/free5gc-upf/package.nix
+++ b/pkgs/by-name/fr/free5gc-upf/package.nix
@@ -7,17 +7,17 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "free5gc-upf";
-  version = "1.2.12";
+  version = "1.2.13";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "free5gc";
     repo = "go-upf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MfQbHVEqnoFzUL5FPIE6dQSJxQD7PAZSbAgy/skHs+8=";
+    hash = "sha256-KWJCESbgfggAWMI76U2EhSjvwF+nHwI+ItEo9nPRVzU=";
   };
 
-  vendorHash = "sha256-VPm0Z67Sm/liIofVm1bI3/HU+lwYtwkg6zMRdZFZTZ8=";
+  vendorHash = "sha256-sdeFBWZDzkk28ycoIsVoZNUC2OH1Zv7C/1DqYdCtLyo=";
 
   ldflags = [
     "-X github.com/free5gc/util/version.VERSION=v${finalAttrs.version}"

From 19908524d4598b01f232450612852db0e753858e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 4 Oct 2026 05:20:53 +0000
Subject: [PATCH 64/78] remnote: 1.28.28 -> 1.28.37

---
 pkgs/by-name/re/remnote/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/re/remnote/package.nix b/pkgs/by-name/re/remnote/package.nix
index 69fa4b87a097..008cd400909c 100644
--- a/pkgs/by-name/re/remnote/package.nix
+++ b/pkgs/by-name/re/remnote/package.nix
@@ -8,11 +8,11 @@
 
 appimageTools.wrapType2 (finalAttrs: {
   pname = "remnote";
-  version = "1.28.28";
+  version = "1.28.37";
 
   src = fetchurl {
     url = "https://download2.remnote.io/remnote-desktop2/RemNote-${finalAttrs.version}.AppImage";
-    hash = "sha256-YUnIWxtMg7zJjJVkhkp+MPKnQ0uUOSZC2tmQ7JjXcaI=";
+    hash = "sha256-K972+NFq5qmgeu8+kF5v1TOrP+wg+zHjgnmlveiJyyk=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 79366ae79976029976e03198623156ef6c668966 Mon Sep 17 00:00:00 2001
From: Andrew Prokhorenkov <andrew.prokhorenkov@gmail.com>
Date: Sat, 3 Oct 2026 13:11:52 -0500
Subject: [PATCH 65/78] pi-coding-agent: 1.0.0 -> 1.0.2

---
 pkgs/by-name/pi/pi-coding-agent/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/pi/pi-coding-agent/package.nix b/pkgs/by-name/pi/pi-coding-agent/package.nix
index 29250a74b1a9..6550a7ca3ccd 100644
--- a/pkgs/by-name/pi/pi-coding-agent/package.nix
+++ b/pkgs/by-name/pi/pi-coding-agent/package.nix
@@ -13,16 +13,16 @@
 }:
 buildNpmPackage (finalAttrs: {
   pname = "pi-coding-agent";
-  version = "1.0.0";
+  version = "1.0.2";
 
   src = fetchFromGitHub {
     owner = "earendil-works";
     repo = "pi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CGznIVHXG6gr2F8vzHcR/v4P9xJgZHeMTt/CJ/kB78o=";
+    hash = "sha256-DjWJE7KcCdNF/M3RrO76rKCSd6oFLo2dX9wFT0nwEXk=";
   };
 
-  npmDepsHash = "sha256-ndEvWdB6sa5nNNtabk2OMZKUFG9x3op185deZHxFnXk=";
+  npmDepsHash = "sha256-gW0JO84SrPl3PDUu7eBzOKaNGSif23J1xY1tpS/oVhQ=";
 
   # The provider model catalog (packages/ai/src/providers/data/) is generated by
   # a network fetch (models.dev plus provider APIs) and is gitignored upstream,
@@ -31,7 +31,7 @@ buildNpmPackage (finalAttrs: {
   # under dist/providers/data/. Bump this hash alongside version.
   modelData = fetchurl {
     url = "https://registry.npmjs.org/@earendil-works/pi-ai/-/pi-ai-${finalAttrs.version}.tgz";
-    hash = "sha256-85uZwpuFmPF1sQhA5dKoGYPnwM5crk19+DoQB0R9LCs=";
+    hash = "sha256-isjl+r1l4PDsuFOLYhGCSFn1mXWUAF16A+H3CzhDihc=";
   };
 
   preConfigure = ''

From 2e7c54b444dcc00e730e3790730d286a4f41d91c Mon Sep 17 00:00:00 2001
From: Markus Hauck <markus1189@gmail.com>
Date: Sun, 4 Oct 2026 10:02:12 +0200
Subject: [PATCH 66/78] claude-code: 2.1.287 -> 2.1.289

Changelog: https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md

Assisted-by: Claude Code (Claude Opus 5.5)
---
 pkgs/by-name/cl/claude-code/manifest.zst.json | 50 +++++++++----------
 1 file changed, 24 insertions(+), 26 deletions(-)

diff --git a/pkgs/by-name/cl/claude-code/manifest.zst.json b/pkgs/by-name/cl/claude-code/manifest.zst.json
index b5effaa6c2ea..b353d2151808 100644
--- a/pkgs/by-name/cl/claude-code/manifest.zst.json
+++ b/pkgs/by-name/cl/claude-code/manifest.zst.json
@@ -1,63 +1,61 @@
 {
-  "version": "2.1.287",
+  "version": "2.1.289",
   "manifestSignatureEnforcement": "flag",
-  "commit": "3c446a1b98aceb99a6cdee0f84a8bea42f4a8937",
-  "modsCommit": "6160717d8994f236ab381cf534fc1cde5347c12f",
-  "buildDate": "2026-10-01T16:27:39Z",
+  "commit": "736d26eef42d1e3017e07e6d5bd0970b8c3a068f",
+  "modsCommit": "52c76441cae91f6891e4712306bffb057ff6fec5",
+  "buildDate": "2026-10-03T19:39:42Z",
   "platforms": {
     "darwin-arm64": {
       "binary": "claude.zst",
-      "checksum": "2701dac04e02acbea7d7584fc35e04adddf6f24021d321e3ba7eb95994edcf96",
-      "size": 75949326,
+      "checksum": "44404b386c30be106533bbd260b689d22cedb6956a6ae70118ba96a32711a82b",
+      "size": 76604429,
       "bundle": {
-        "checksum": "8939dd3a906fd909614c651595ba3636e5620cb1aafcf99d3d5ecd9b6b86c693",
-        "size": 75962691
+        "checksum": "ee67e3f1ea60471c9e78f7c4b1cf30be832862afeec0b80805207d3eee140046",
+        "size": 76620437
       }
     },
     "darwin-x64": {
       "binary": "claude.zst",
-      "checksum": "e4c6177a49a726d1a65dadf2fb08cdde0232a37a60017668246ab9246fcf11ad",
-      "size": 80136583,
+      "checksum": "104d246d33eecb9750b26eecae258ec81bb02cf8cda8ccd6cbc2d00f6664d176",
+      "size": 80786935,
       "bundle": {
-        "checksum": "dc23e02cbacb6762d4033998e76e182459e7a539ea698eebe267207563def62d",
-        "size": 80141664
+        "checksum": "1a416eb22c68a7a35ad50a28a6eaa56227ddb50ea661786ffb67677b134894ac",
+        "size": 80788940
       }
     },
     "linux-arm64": {
       "binary": "claude.zst",
-      "checksum": "f95d466d03381abe9effcbcfe8408704262eb8861af3a1fc20b8e0563c1f770b",
-      "size": 85057873
+      "checksum": "9bae454cf4f886a2c7833746a9253d877b65c24c4c4403689a573bc47bf4b35a",
+      "size": 85691403
     },
     "linux-x64": {
       "binary": "claude.zst",
-      "checksum": "add364007462fe694a95aa68c78bdf7a71b1ddf687f80dda603f58cc80cde574",
-      "size": 85795355
+      "checksum": "66f72a868a42ca10e5462ab78a88fd9f5576486f59b32a0afc5910ab4b73b765",
+      "size": 86429541
     },
     "linux-arm64-musl": {
       "binary": "claude.zst",
-      "checksum": "b277e35a54c5c3f891791276b1b5ca8959ab89c45e2123906f26c3b0c489c80a",
-      "size": 83460752
+      "checksum": "84f9baadb049624c58165510498427269ce0c07b31d597ac21c370808c359549",
+      "size": 84096543
     },
     "linux-x64-musl": {
       "binary": "claude.zst",
-      "checksum": "43f30b92560d69d1942dc7e9e4772a9c24f99cda2d71a1dc46b6033398d47a01",
-      "size": 84231480
+      "checksum": "4ef0cfc150a4c8cf82bd4a726828980aae965e6db8084d00191befab9234f123",
+      "size": 84854125
     },
     "win32-x64": {
       "binary": "claude.exe.zst",
-      "checksum": "0d03949c88db791ddee203b61c1cfbd69bf84214facc17dcfcd0c0987f6c27de",
-      "size": 88089498
+      "checksum": "e1f0154146bb2618ea9943fa25778362182f8f1bf6c65f8dfd1a68a9a1d2b897",
+      "size": 88725729
     },
     "win32-arm64": {
       "binary": "claude.exe.zst",
-      "checksum": "bd8a2ec0abb532aea9e4f6a70177193cd7e06e4f4803d63fe75ac15442160dca",
-      "size": 84412071
+      "checksum": "2ddfd5eeaff95051dc32e0b03e441f97fc10af43747402194fa7793e21827348",
+      "size": 85047493
     }
   },
   "sdkCompat": {
     "testedWrapperVersions": [
-      "0.3.247",
-      "0.3.248",
       "0.3.250",
       "0.3.251",
       "0.3.252",

From 35e4885d17800428e7cc03c9cebc609ff87727cf Mon Sep 17 00:00:00 2001
From: Markus Hauck <markus1189@gmail.com>
Date: Sun, 4 Oct 2026 10:02:12 +0200
Subject: [PATCH 67/78] vscode-extensions.anthropic.claude-code: 2.1.287 ->
 2.1.289

Changelog: https://github.com/anthropics/claude-code/blob/main/CHANGELOG.md

Assisted-by: Claude Code (Claude Opus 5.5)
---
 .../vscode/extensions/anthropic.claude-code/default.nix   | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
index c78bb35951e1..92ac521e3266 100644
--- a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
@@ -21,22 +21,22 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
       sources = {
         "x86_64-linux" = {
           arch = "linux-x64";
-          hash = "sha256-TY0MaNfh/Iv0K/AYy0frD71US0NFpgk7k2yrClTeXTc=";
+          hash = "sha256-dUWGAI6AtFbMToKDAUxiEzsPspfka6kitMJ9+l1moz0=";
         };
         "aarch64-linux" = {
           arch = "linux-arm64";
-          hash = "sha256-BGEyoZX6WARlrPevsunwrX5C9YvhTTURuzRi9A/c594=";
+          hash = "sha256-y/z/tqieh+mdrUXfq7wqgRXndvdmKQ5ocsEwhFN/N3c=";
         };
         "aarch64-darwin" = {
           arch = "darwin-arm64";
-          hash = "sha256-QTEgBlSjb/Y8eYBl9HQVgZCyeDIXZR5gzEizv/JxVN0=";
+          hash = "sha256-fzywaeVkfUKgVDEnsKn3jIuKFOoiyT1Gpy332cn7ZfA=";
         };
       };
     in
     {
       name = "claude-code";
       publisher = "anthropic";
-      version = "2.1.287";
+      version = "2.1.289";
     }
     // sources.${stdenvNoCC.hostPlatform.system}
       or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");

From 6db6c0a6537d031cf710172a062404646ff5fbee Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 4 Oct 2026 08:18:50 +0000
Subject: [PATCH 68/78] xdg-desktop-portal-generic: 0.9.0 -> 1.0.0

---
 pkgs/by-name/xd/xdg-desktop-portal-generic/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/xd/xdg-desktop-portal-generic/package.nix b/pkgs/by-name/xd/xdg-desktop-portal-generic/package.nix
index 7a6bacc82372..2b34dd9dbd8f 100644
--- a/pkgs/by-name/xd/xdg-desktop-portal-generic/package.nix
+++ b/pkgs/by-name/xd/xdg-desktop-portal-generic/package.nix
@@ -11,13 +11,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "xdg-desktop-portal-generic";
-  version = "0.9.0";
+  version = "1.0.0";
 
   src = fetchFromGitHub {
     owner = "lamco-admin";
     repo = "xdg-desktop-portal-generic";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-gwTEIW/1qaT+uDI1zJQIndM01FmQcYHDYWR98+jT0uI=";
+    hash = "sha256-YuwIaPA2E1QtSVz4mwteDEaZEBwaUoYLdfArGsJqHn0=";
   };
 
   __structuredAttrs = true;
@@ -31,7 +31,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail '/usr/libexec/' '${placeholder "out"}/libexec/'
   '';
 
-  cargoHash = "sha256-6fD4Bxkx5W3CqB6m8+QlTFZJ7l+wC17VpLhLNr4ZjIw=";
+  cargoHash = "sha256-EVmHmeoh1THLRrqn3v1WjvHNxBFopdCz3n5C4eOBrNg=";
 
   nativeBuildInputs = [
     pkg-config

From 97cc754e0d7c584e4fe8856b9256a81cef05f019 Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Sun, 4 Oct 2026 02:45:33 -0400
Subject: [PATCH 69/78] python3Packages.gpuctypes: modernize

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 .../python-modules/gpuctypes/default.nix      | 27 ++++++++++++-------
 1 file changed, 18 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/python-modules/gpuctypes/default.nix b/pkgs/development/python-modules/gpuctypes/default.nix
index 8c6d8d7dfaac..e66bd124f35f 100644
--- a/pkgs/development/python-modules/gpuctypes/default.nix
+++ b/pkgs/development/python-modules/gpuctypes/default.nix
@@ -20,15 +20,16 @@
 assert testCudaRuntime -> cudaSupport;
 assert testRocmRuntime -> rocmSupport;
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "gpuctypes";
   version = "0.3.0";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     repo = "gpuctypes";
     owner = "tinygrad";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-xUMvMBK1UhZaMZfik0Ia6+siyZGpCkBV+LTnQvzt/rw=";
   };
 
@@ -43,22 +44,29 @@ buildPythonPackage rec {
     })
   ];
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
   postPatch = ''
     substituteInPlace gpuctypes/opencl.py \
-      --replace "ctypes.util.find_library('OpenCL')" "'${ocl-icd}/lib/libOpenCL.so'"
+      --replace-fail \
+        "ctypes.util.find_library('OpenCL')" \
+        "'${lib.getLib ocl-icd}/lib/libOpenCL.so'"
   ''
   # hipGetDevicePropertiesR0600 is a symbol from rocm-6. We are currently at rocm-5.
   # We are not sure that this works. Remove when rocm gets updated to version 6.
   + lib.optionalString rocmSupport ''
     substituteInPlace gpuctypes/hip.py \
-      --replace "/opt/rocm/lib/libamdhip64.so" "${rocmPackages.clr}/lib/libamdhip64.so" \
-      --replace "/opt/rocm/lib/libhiprtc.so" "${rocmPackages.clr}/lib/libhiprtc.so" \
-      --replace "hipGetDevicePropertiesR0600" "hipGetDeviceProperties"
+      --replace-fail \
+        "/opt/rocm/lib/libamdhip64.so" \
+        "${lib.getLib rocmPackages.clr}/lib/libamdhip64.so" \
+      --replace-fail \
+        "hipGetDevicePropertiesR0600" \
+        "hipGetDeviceProperties"
 
     substituteInPlace gpuctypes/comgr.py \
-      --replace "/opt/rocm/lib/libamd_comgr.so" "${rocmPackages.rocm-comgr}/lib/libamd_comgr.so"
+      --replace-fail \
+        "/opt/rocm/lib/libamd_comgr.so" \
+        "${lib.getLib rocmPackages.rocm-comgr}/lib/libamd_comgr.so"
   '';
 
   pythonImportsCheck = [ "gpuctypes" ];
@@ -112,6 +120,7 @@ buildPythonPackage rec {
   meta = {
     description = "Ctypes wrappers for HIP, CUDA, and OpenCL";
     homepage = "https://github.com/tinygrad/gpuctypes";
+    changelog = "https://github.com/tinygrad/gpuctypes/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [
       GaetanLepage
@@ -119,4 +128,4 @@ buildPythonPackage rec {
       wozeparrot
     ];
   };
-}
+})

From ec445062a7be69c60ed9f25575cd1035b9fdc2ab Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Sun, 4 Oct 2026 09:49:42 +0200
Subject: [PATCH 70/78] python3Packages.pyluwen: 0.9.0 -> 0.10.0

---
 pkgs/development/python-modules/pyluwen/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/pyluwen/default.nix b/pkgs/development/python-modules/pyluwen/default.nix
index ef186683868c..8c7598fc1435 100644
--- a/pkgs/development/python-modules/pyluwen/default.nix
+++ b/pkgs/development/python-modules/pyluwen/default.nix
@@ -9,7 +9,7 @@
 }:
 buildPythonPackage (finalAttrs: {
   pname = "pyluwen";
-  version = "0.9.0";
+  version = "0.10.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -17,12 +17,12 @@ buildPythonPackage (finalAttrs: {
     owner = "tenstorrent";
     repo = "luwen";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pc/7G9YxBTg2uYn47ONxI7zsfdK3Ex4zndLASRtDQyk=";
+    hash = "sha256-J0SvCBsDi3GMvnwqgqGMUDvrSO+baznDhsfuvF44Ens=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-2ibAZnfv++eyCB57F0uD7XFJ3MP9SnAApOn6uelo3Po=";
+    hash = "sha256-vEuVxBGIJAyc8POy3EPTzTK5g5SE3QDZcnTnAb3b5k0=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/bind/pyluwen";

From 48d30910305cdc3813c04d317ab8ce4951270903 Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Sun, 4 Oct 2026 09:49:58 +0200
Subject: [PATCH 71/78] python3Packages.tt-flash: 4.0.0 -> 4.1.0

---
 pkgs/development/python-modules/tt-flash/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tt-flash/default.nix b/pkgs/development/python-modules/tt-flash/default.nix
index 37a750b8401c..9ef363561095 100644
--- a/pkgs/development/python-modules/tt-flash/default.nix
+++ b/pkgs/development/python-modules/tt-flash/default.nix
@@ -18,7 +18,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tt-flash";
-  version = "4.0.0";
+  version = "4.1.0";
   pyproject = true;
 
   __structuredAttrs = true;
@@ -27,7 +27,7 @@ buildPythonPackage (finalAttrs: {
     owner = "tenstorrent";
     repo = "tt-flash";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-efl6Ecz7nBtixGZBv6wLU6Bdq+TLXRXIttgUvKXxQz4=";
+    hash = "sha256-7ImAI+A229NzNECu3dL6WvsPO0cn8Id/p8/QqyvZ/H8=";
   };
 
   pythonRelaxDeps = [

From 1beb2391f346396e79ee70cb28cac608e2eb4c00 Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Sun, 4 Oct 2026 10:46:14 +0200
Subject: [PATCH 72/78] tt-smi: relax pyluwen

---
 pkgs/by-name/tt/tt-smi/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/tt/tt-smi/package.nix b/pkgs/by-name/tt/tt-smi/package.nix
index 69e4e2d652da..98a7de43b4ce 100644
--- a/pkgs/by-name/tt/tt-smi/package.nix
+++ b/pkgs/by-name/tt/tt-smi/package.nix
@@ -36,7 +36,10 @@ python3Packages.buildPythonApplication (finalAttrs: {
     tt-umd
   ];
 
-  pythonRelaxDeps = [ "tt-umd" ];
+  pythonRelaxDeps = [
+    "tt-umd"
+    "pyluwen"
+  ];
 
   nativeCheckInputs = [ versionCheckHook ];
 

From 3d21a0f3e5ef94fcfc4e633029b56cea944be6f9 Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Sat, 3 Oct 2026 21:38:27 +0200
Subject: [PATCH 73/78] tt-burnin: 0.4.0 -> 0.4.4

---
 pkgs/by-name/tt/tt-burnin/package.nix | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/tt/tt-burnin/package.nix b/pkgs/by-name/tt/tt-burnin/package.nix
index 001b4cca5bf9..087872cea41e 100644
--- a/pkgs/by-name/tt/tt-burnin/package.nix
+++ b/pkgs/by-name/tt/tt-burnin/package.nix
@@ -1,27 +1,30 @@
 {
   lib,
   fetchFromGitHub,
-  python3Packages,
+  python313Packages,
   versionCheckHook,
 }:
-python3Packages.buildPythonApplication (finalAttrs: {
+# jsons depends on typish, which is disabled on Python 3.14
+# TODO: switch back to python3Packages once typish supports Python 3.14
+python313Packages.buildPythonApplication (finalAttrs: {
   pname = "tt-burnin";
-  version = "0.4.0";
+  version = "0.4.4";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "tenstorrent";
     repo = "tt-burnin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-NI32BerBCuMMulB2fsseeoWI50iklpNqMyTs4BArl2A=";
+    hash = "sha256-ZHc9qhOZE8fv/oj0bHGTyncZNT1mJtk1pFAPCRY4TtE=";
   };
 
-  build-system = with python3Packages; [
+  build-system = with python313Packages; [
     setuptools
     setuptools-scm
   ];
 
-  dependencies = with python3Packages; [
+  dependencies = with python313Packages; [
     pyluwen
     tt-tools-common
     jsons

From 7aa6bdcf4ed78eb00f45e9fd5c2d139729d618b8 Mon Sep 17 00:00:00 2001
From: Ethan Carter Edwards <ethan@ethancedwards.com>
Date: Sun, 20 Sep 2026 15:51:34 -0400
Subject: [PATCH 74/78] firestarter: add versionCheckHook, modernize

Signed-off-by: Ethan Carter Edwards <ethan@ethancedwards.com>
---
 pkgs/by-name/fi/firestarter/package.nix | 52 +++++++++++++++++--------
 1 file changed, 35 insertions(+), 17 deletions(-)

diff --git a/pkgs/by-name/fi/firestarter/package.nix b/pkgs/by-name/fi/firestarter/package.nix
index 660b3239c365..4e74e4395095 100644
--- a/pkgs/by-name/fi/firestarter/package.nix
+++ b/pkgs/by-name/fi/firestarter/package.nix
@@ -9,19 +9,24 @@
   glibc,
   git,
   pkg-config,
+  installShellFiles,
   config,
   cudaPackages,
+  versionCheckHook,
   withCuda ? config.cudaSupport,
 }:
 
 let
-  hwloc = stdenv.mkDerivation rec {
+  hwloc = stdenv.mkDerivation (finalAttrs: {
     pname = "hwloc";
     version = "2.2.0";
 
+    strictDeps = true;
+    __structuredAttrs = true;
+
     src = fetchzip {
-      url = "https://download.open-mpi.org/release/hwloc/v${lib.versions.majorMinor version}/hwloc-${version}.tar.gz";
-      sha256 = "1ibw14h9ppg8z3mmkwys8vp699n85kymdz20smjd2iq9b67y80b6";
+      url = "https://download.open-mpi.org/release/hwloc/v${lib.versions.majorMinor finalAttrs.version}/hwloc-${finalAttrs.version}.tar.gz";
+      hash = "sha256-ZgHkj1kJR9Fk1UD8Vv0syKZk7kba81nr+OjdmyAJfMU=";
     };
 
     configureFlags = [
@@ -53,10 +58,10 @@ let
       "doc"
       "man"
     ];
-  };
+  });
 
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "firestarter";
   version = "2.0";
 
@@ -66,22 +71,33 @@ stdenv.mkDerivation rec {
   src = fetchFromGitHub {
     owner = "tud-zih-energy";
     repo = "FIRESTARTER";
-    tag = "v${version}";
-    hash = "sha256-Q1jIvcuiAUzyF0v32beIqZLyMPeZUjoikY3awmmQZsY=";
+    tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
+    hash = "sha256-Q1jIvcuiAUzyF0v32beIqZLyMPeZUjoikY3awmmQZsY=";
   };
 
   postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail \
+        'set(_FIRESTARTER_VERSION_STRING "unknown")' \
+        'set(_FIRESTARTER_VERSION_STRING "v${finalAttrs.version}")'
+
     substituteInPlace lib/nitro/CMakeLists.txt \
-      --replace-fail 'cmake_minimum_required(VERSION 3.2)' 'cmake_minimum_required(VERSION 3.10)'
+      --replace-fail \
+        'cmake_minimum_required(VERSION 3.2)' \
+        'cmake_minimum_required(VERSION 3.10)'
+
     substituteInPlace lib/json/CMakeLists.txt \
-      --replace-fail 'cmake_minimum_required(VERSION 3.1)' 'cmake_minimum_required(VERSION 3.10)'
+      --replace-fail \
+        'cmake_minimum_required(VERSION 3.1)' \
+        'cmake_minimum_required(VERSION 3.10)'
   '';
 
   nativeBuildInputs = [
     cmake
     git
     pkg-config
+    installShellFiles
   ]
   ++ lib.optionals withCuda [
     addDriverRunpath
@@ -109,21 +125,23 @@ stdenv.mkDerivation rec {
   };
 
   cmakeFlags = [
-    "-DFIRESTARTER_BUILD_HWLOC=OFF"
-    "-DCMAKE_C_COMPILER_WORKS=1"
-    "-DCMAKE_CXX_COMPILER_WORKS=1"
+    (lib.cmakeBool "FIRESTARTER_BUILD_HWLOC" false)
+    (lib.cmakeFeature "CMAKE_C_COMPILER_WORKS" "1")
+    (lib.cmakeFeature "CMAKE_CXX_COMPILER_WORKS" "1")
   ]
   ++ lib.optionals withCuda [
-    "-DFIRESTARTER_BUILD_TYPE=FIRESTARTER_CUDA"
+    (lib.cmakeFeature "FIRESTARTER_BUILD_TYPE" "FIRESTARTER_CUDA")
   ];
 
   installPhase = ''
     runHook preInstall
-    mkdir -p $out/bin
-    cp src/FIRESTARTER${lib.optionalString withCuda "_CUDA"} $out/bin/
+    installBin src/FIRESTARTER${lib.optionalString withCuda "_CUDA"}
     runHook postInstall
   '';
 
+  doInstallCheck = !withCuda; # tries to access GPU
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
   postFixup = lib.optionalString withCuda ''
     addDriverRunpath $out/bin/FIRESTARTER_CUDA
   '';
@@ -138,6 +156,6 @@ stdenv.mkDerivation rec {
       marenz
     ];
     license = lib.licenses.gpl3;
-    mainProgram = "FIRESTARTER";
+    mainProgram = "FIRESTARTER${lib.optionalString withCuda "_CUDA"}";
   };
-}
+})

From 46dc8bd859bd6ab8e3180ae520fdb8c930c5e6e9 Mon Sep 17 00:00:00 2001
From: Naxdy <naxdy@naxdy.org>
Date: Sun, 4 Oct 2026 12:49:19 +0200
Subject: [PATCH 75/78] openssh: allow building with SELinux support

---
 pkgs/tools/networking/openssh/common.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/tools/networking/openssh/common.nix b/pkgs/tools/networking/openssh/common.nix
index d93f51d24cfd..2d59895f0dec 100644
--- a/pkgs/tools/networking/openssh/common.nix
+++ b/pkgs/tools/networking/openssh/common.nix
@@ -31,6 +31,8 @@
   etcDir ? null,
   withKerberos ? false,
   withLdns ? true,
+  withSelinux ? false,
+  libselinux,
   krb5,
   libfido2,
   libxcrypt,
@@ -99,6 +101,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional withKerberos krb5
   ++ lib.optional withLdns ldns
   ++ lib.optional withPAM pam
+  ++ lib.optional withSelinux libselinux
   ++ lib.optionals withAudit [
     audit
     libcap_ng
@@ -151,6 +154,7 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optional stdenv.hostPlatform.isOpenBSD "--with-bsd-auth"
   ++ lib.optional withLinuxMemlock "--with-linux-memlock-onfault"
   ++ lib.optional withAudit "--with-audit=linux"
+  ++ lib.optional withSelinux "--with-selinux"
   ++ extraConfigureFlags;
 
   buildFlags = [ "SSH_KEYSIGN=ssh-keysign" ];

From 5058791636bfe05da1d63f803827db4490ae362c Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Sun, 4 Oct 2026 13:37:14 +0200
Subject: [PATCH 76/78] swaymux: add update script

---
 pkgs/by-name/sw/swaymux/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/sw/swaymux/package.nix b/pkgs/by-name/sw/swaymux/package.nix
index e2e3443a5cb3..719b04d62feb 100644
--- a/pkgs/by-name/sw/swaymux/package.nix
+++ b/pkgs/by-name/sw/swaymux/package.nix
@@ -5,6 +5,7 @@
   nlohmann_json,
   qt6,
   stdenv,
+  nix-update-script,
 }:
 stdenv.mkDerivation (finalAttrs: {
   version = "1.1";
@@ -30,6 +31,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   doCheck = true;
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     changelog = "https://git.grimmauld.de/Grimmauld/swaymux/commits/branch/main";
     description = "Program to quickly navigate sway";

From 85e85a2da816c74478df58715e15fafcf3d98140 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Sun, 4 Oct 2026 13:51:39 +0200
Subject: [PATCH 77/78] swaymux: 1.1 -> 1.1.1

Changelog: https://git.grimmauld.de/Grimmauld/swaymux/commits/branch/main
---
 pkgs/by-name/sw/swaymux/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sw/swaymux/package.nix b/pkgs/by-name/sw/swaymux/package.nix
index 719b04d62feb..9aebd885087f 100644
--- a/pkgs/by-name/sw/swaymux/package.nix
+++ b/pkgs/by-name/sw/swaymux/package.nix
@@ -8,7 +8,7 @@
   nix-update-script,
 }:
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.1";
+  version = "1.1.1";
   pname = "swaymux";
 
   src = fetchFromGitea {
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
     domain = "git.grimmauld.de";
     owner = "Grimmauld";
     repo = "swaymux";
-    hash = "sha256-OMJ9wKNuvD1Z9KV7Bp7aIA5gWbBl9PmTdGcGegE0vqM=";
+    hash = "sha256-pe0YrhRJdy/3GePzM1RD1vQ0fGisImNHKzGMFeYQN88=";
   };
 
   buildInputs = [

From de9dd2c300e8debda8fc259c6e88540b34385798 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 4 Oct 2026 12:57:06 +0000
Subject: [PATCH 78/78] home-assistant-custom-components.blitzortung: 1.7.1 ->
 1.7.2

---
 .../home-assistant/custom-components/blitzortung/package.nix  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/blitzortung/package.nix b/pkgs/servers/home-assistant/custom-components/blitzortung/package.nix
index 3bfaf6033e3d..41b968f9e13c 100644
--- a/pkgs/servers/home-assistant/custom-components/blitzortung/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/blitzortung/package.nix
@@ -10,13 +10,13 @@
 buildHomeAssistantComponent (finalAttrs: {
   owner = "mrk-its";
   domain = "blitzortung";
-  version = "1.7.1";
+  version = "1.7.2";
 
   src = fetchFromGitHub {
     owner = "mrk-its";
     repo = "homeassistant-blitzortung";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CjO1SeArDYMZyHDNxGGhS26leUEgrpRYiXEWKYdeA7o=";
+    hash = "sha256-tvrHykntBzbMBPmat7Q/NsjraA1/RwAU95C1TJRFupk=";
   };
 
   dependencies = [