Merge master into staging-nixos

2026-10-03 21:40:12 +00:00 · 2026-09-15 12:14:10 +00:00
parent d587d68c43 7f3ae65c93
commit 7a8502da17
82 changed files with 687 additions and 583 deletions
--- a/nixos/lib/test-driver/default.nix
+++ b/nixos/lib/test-driver/default.nix
@@ -89,4 +89,6 @@ buildPythonApplication {
    echo -e "\x1b[32m## run ruff format\x1b[0m"
    ruff format --check --diff .
  '';
+
+  meta.license = lib.licenses.mit;
 }
--- a/nixos/modules/config/xdg/portal.nix
+++ b/nixos/modules/config/xdg/portal.nix
@@ -113,7 +113,11 @@ in
  config =
    let
      cfg = config.xdg.portal;
-      packages = [ pkgs.xdg-desktop-portal ] ++ cfg.extraPortals;
+      packages = [
+        pkgs.xdg-desktop-portal
+        pkgs.xdg-utils
+      ]
+      ++ cfg.extraPortals;
    in
    mkIf cfg.enable {
      programs.fuse.enable = true;
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -741,7 +741,11 @@ in
    };

    virtualisation.qemu = {
-      enableSharedMemory = mkEnableOption "shared memory";
+      enableSharedMemory = mkOption {
+        type = types.bool;
+        default = useVirtiofs; # Need shared memory for virtiofs: <https://www.qemu.org/docs/master/system/devices/virtio/vhost-user.html#shared-memory-object>
+        description = "Enable shared memory";
+      };

      package = mkOption {
        type = types.package;
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -461,12 +461,12 @@ final: prev: {

  SchemaStore-nvim = buildVimPlugin {
    pname = "SchemaStore.nvim";
-    version = "0-unstable-2026-09-10";
+    version = "0-unstable-2026-09-12";
    src = fetchFromGitHub {
      owner = "b0o";
      repo = "SchemaStore.nvim";
-      rev = "890d8f5cfca338a1f3e59c686569e461f6182f80";
-      hash = "sha256-CrcG5YG5hQ8IMNDf1/4kjBWPP2O9Qp3uDFSatTSuDSE=";
+      rev = "05e938c0aa5dfbdbb11972fa4c8a85f27f402ba0";
+      hash = "sha256-p+h2y42PRUM1ZPIlBe31/n7IPmh3oEiWgL3HuoUI8Yg=";
    };
    meta.homepage = "https://github.com/b0o/SchemaStore.nvim/";
    meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -1331,12 +1331,12 @@ final: prev: {

  auto-dark-mode-nvim = buildVimPlugin {
    pname = "auto-dark-mode.nvim";
-    version = "0-unstable-2026-03-29";
+    version = "0-unstable-2026-09-11";
    src = fetchFromGitHub {
      owner = "f-person";
      repo = "auto-dark-mode.nvim";
-      rev = "54058b4fe414bd64bd2904a6f8a63f1f14e3d8df";
-      hash = "sha256-xTgRyct3L6Gcz/vdYSc+h2IUgi/+Lh1Q4mxJwHISeis=";
+      rev = "2b16a24c202892e61fca7df4d2d7c4c872a44165";
+      hash = "sha256-xBpdk0D2LauLJoktw/vQfvic07NsKaBDeL8KAl4KE7s=";
    };
    meta.homepage = "https://github.com/f-person/auto-dark-mode.nvim/";
    meta.license = getLicenseFromSpdxId "GPL-3.0-only";
@@ -1429,12 +1429,12 @@ final: prev: {

  autoclose-nvim = buildVimPlugin {
    pname = "autoclose.nvim";
-    version = "0-unstable-2026-07-20";
+    version = "0-unstable-2026-09-13";
    src = fetchFromGitHub {
      owner = "m4xshen";
      repo = "autoclose.nvim";
-      rev = "27063904b2238ce7867e430885b6abcfb08357ea";
-      hash = "sha256-BjNP8Facn3Cy/EHYioUB9mXb19sBzBeSCY1xTpPOWG8=";
+      rev = "bcad8e84d9cd78ba73433cb396b68e489af11e31";
+      hash = "sha256-1uY/D5su4cA0OGn8jidfzkOrrTSjxmFTgN7YFVY0t/0=";
    };
    meta.homepage = "https://github.com/m4xshen/autoclose.nvim/";
    meta.license = getLicenseFromSpdxId "MIT";
@@ -1625,12 +1625,12 @@ final: prev: {

  base16-nvim = buildVimPlugin {
    pname = "base16-nvim";
-    version = "0-unstable-2026-08-10";
+    version = "0-unstable-2026-09-13";
    src = fetchFromGitHub {
      owner = "RRethy";
      repo = "base16-nvim";
-      rev = "09944b3120451d2881dc8cfb13c85c11949f477d";
-      hash = "sha256-UVTi+0D2SjaA+yG8kYuKZ14bAz3txGc1XCwYufSsEM0=";
+      rev = "44fc7a0d7ad878f90b04ffe8fa58c99c19007509";
+      hash = "sha256-Wb0fSya++a64lPIVtcdQjX9wkLfCEtq5uq6KG8jHvPY=";
    };
    meta.homepage = "https://github.com/RRethy/base16-nvim/";
    meta.license = getLicenseFromSpdxId "MIT";
@@ -3513,12 +3513,12 @@ final: prev: {

  coc-nvim = buildVimPlugin {
    pname = "coc.nvim";
-    version = "0.0.82-unstable-2026-09-08";
+    version = "0.0.82-unstable-2026-09-11";
    src = fetchFromGitHub {
      owner = "neoclide";
      repo = "coc.nvim";
-      rev = "1ceb010a202cc9e33aece04811de23a909addf5d";
-      hash = "sha256-+oDGDkGsC+skh1BONEpI9VDDGU44FwmnopfaWMDnlks=";
+      rev = "90b55f067595e7f9dd920c957d6345f434f32dd2";
+      hash = "sha256-6gX6voB7AZhBmG/NYUCEwEm6V5gunT+WHVSvOsZ0Kj4=";
    };
    meta.homepage = "https://github.com/neoclide/coc.nvim/";
    meta.license = getLicenseFromSpdxId "MIT";
@@ -3611,12 +3611,12 @@ final: prev: {

  codecompanion-nvim = buildVimPlugin {
    pname = "codecompanion.nvim";
-    version = "19.23.0";
+    version = "19.24.1";
    src = fetchFromGitHub {
      owner = "olimorris";
      repo = "codecompanion.nvim";
-      tag = "v19.23.0";
-      hash = "sha256-Qwp5GMiThljD7l9ygl8T333OlBQ2Me1k6/KWAkFq4QU=";
+      tag = "v19.24.1";
+      hash = "sha256-oihHiKhU093AT5aqvTxJ4wXmH+pMKFJ5zgzUo5SJ/Yw=";
    };
    meta.homepage = "https://github.com/olimorris/codecompanion.nvim/";
    meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -4130,12 +4130,12 @@ final: prev: {

  copilot-lua = buildVimPlugin {
    pname = "copilot.lua";
-    version = "3.1.5";
+    version = "3.1.7";
    src = fetchFromGitHub {
      owner = "zbirenbaum";
      repo = "copilot.lua";
-      tag = "v3.1.5";
-      hash = "sha256-/f20KI5XtjnEr8tOBqGy+X9RM7sc9pLn1uq5bIEQC1k=";
+      tag = "v3.1.7";
+      hash = "sha256-RYi+Ofn+kqXkw8z2f1avH62MMLqVyIIDJaYBCMt/fBw=";
    };
    meta.homepage = "https://github.com/zbirenbaum/copilot.lua/";
    meta.license = getLicenseFromSpdxId "MIT";
@@ -4284,12 +4284,12 @@ final: prev: {

  crates-nvim = buildVimPlugin {
    pname = "crates.nvim";
-    version = "0.7.1-unstable-2026-09-03";
+    version = "0.7.1-unstable-2026-09-12";
    src = fetchFromGitHub {
      owner = "saecki";
      repo = "crates.nvim";
-      rev = "b8281be336498035f9288d6542b2881a7140a9ec";
-      hash = "sha256-kZoKu5rCSymcafN6tlgx5mdnjWB0+oCxYulBcEp8Ut8=";
+      rev = "7039bc1d130e424232a7aa64ceddb170a154ff5b";
+      hash = "sha256-yZ9+R+T5LytIldgVgzIuVSurjN23R0mYsQsES7srFRw=";
    };
    meta.homepage = "https://github.com/saecki/crates.nvim/";
    meta.license = getLicenseFromSpdxId "MIT";
@@ -6180,12 +6180,12 @@ final: prev: {
    pname = "flow.nvim";
    version = "3.0.0";
    src = fetchFromGitHub {
-      owner = "0xstepit";
+      owner = "stefanopitton";
      repo = "flow.nvim";
      tag = "v3.0.0";
      hash = "sha256-PH08FeZMvIXcE9/dfYxj4PiKwBzPCXWFAVOLSci0iNk=";
    };
-    meta.homepage = "https://github.com/0xstepit/flow.nvim/";
+    meta.homepage = "https://github.com/stefanopitton/flow.nvim/";
    meta.license = getLicenseFromSpdxId "Apache-2.0";
    meta.hydraPlatforms = [ ];
  };
@@ -6333,12 +6333,12 @@ final: prev: {

  friendly-snippets = buildVimPlugin {
    pname = "friendly-snippets";
-    version = "0-unstable-2026-09-09";
+    version = "0-unstable-2026-09-11";
    src = fetchFromGitHub {
      owner = "rafamadriz";
      repo = "friendly-snippets";
-      rev = "a5a73e586521fe5c12d751ad81a0db67649a94ed";
-      hash = "sha256-LGAFrG7OxtdZNGRpLEkCaTGwegCExNYS/EBudH6rymQ=";
+      rev = "b4d01b0fdf3c9a549961c2f9ffe8dc09be166219";
+      hash = "sha256-Wp10iRKSn6yNUmNbu2o10cKPkytNjs0cdjBUpEYVlow=";
    };
    meta.homepage = "https://github.com/rafamadriz/friendly-snippets/";
    meta.license = getLicenseFromSpdxId "MIT";
@@ -6877,12 +6877,12 @@ final: prev: {

  go-nvim = buildVimPlugin {
    pname = "go.nvim";
-    version = "0.11-unstable-2026-06-04";
+    version = "0.11-unstable-2026-09-11";
    src = fetchFromGitHub {
      owner = "ray-x";
      repo = "go.nvim";
-      rev = "0768d79bbebdb1a112a845f9cd6293bfbd544dab";
-      hash = "sha256-Yj7iSfvXSjnQgKDZDEwC1QfOHMaIf7ZdJ0k+RmLtSPI=";
+      rev = "f5d1f11d4f616efbe2339286310bb89c4853d769";
+      hash = "sha256-/8AcDSqrAZj8xxpbWWgHVDQgwYyYiO00+7VTXhR23os=";
    };
    meta.homepage = "https://github.com/ray-x/go.nvim/";
    meta.license = getLicenseFromSpdxId "MIT";
@@ -7256,12 +7256,12 @@ final: prev: {

  hardtime-nvim = buildVimPlugin {
    pname = "hardtime.nvim";
-    version = "1.2.0-unstable-2026-07-20";
+    version = "1.2.0-unstable-2026-09-13";
    src = fetchFromGitHub {
      owner = "m4xshen";
      repo = "hardtime.nvim";
-      rev = "244753782b945def87472d8f4e9e6a9d4ec18689";
-      hash = "sha256-Zers7vdGRGy8n520G9uMuHwMAP3STHqU5d5a2Ln9rDQ=";
+      rev = "5165840fe680eab46de1fc6dbff48f148fdcf018";
+      hash = "sha256-AhCFZQYtwPicHS/6PDeTkkdU2R9hAGgbyz1Sow3GNdQ=";
    };
    meta.homepage = "https://github.com/m4xshen/hardtime.nvim/";
    meta.license = getLicenseFromSpdxId "MIT";
@@ -12731,11 +12731,11 @@ final: prev: {

  nvim-dap = buildVimPlugin {
    pname = "nvim-dap";
-    version = "0.10.0-unstable-2026-09-01";
+    version = "0.10.0-unstable-2026-09-11";
    src = fetchgit {
      url = "https://codeberg.org/mfussenegger/nvim-dap/";
-      rev = "c9a0738e45f1bd41d792a126941348dce661cf9b";
-      hash = "sha256-VVHXHBKGmDnltHBMcVoBElaKMElXwJwB/7IZROQGCpg=";
+      rev = "cfa2d58f4537aca6ca83e2de1a0d9f1491121264";
+      hash = "sha256-9T6EL8mZ1rddDXBNvkh68jQSKK1bhi73IvyD6v464x8=";
    };
    meta.homepage = "https://codeberg.org/mfussenegger/nvim-dap/";
    meta.license = unfree;
@@ -13314,7 +13314,7 @@ final: prev: {

  nvim-lint = buildVimPlugin {
    pname = "nvim-lint";
-    version = "0-unstable-2026-08-25";
+    version = "05-unstable-2026-08-25";
    src = fetchgit {
      url = "https://codeberg.org/mfussenegger/nvim-lint/";
      rev = "3d55c8f67c6ae5c15e1042571e107c7a3d5c5f4e";
@@ -13327,11 +13327,11 @@ final: prev: {

  nvim-lsp-file-operations = buildVimPlugin {
    pname = "nvim-lsp-file-operations";
-    version = "0-unstable-2026-09-04";
+    version = "1.0.0";
    src = fetchFromGitHub {
      owner = "antosha417";
      repo = "nvim-lsp-file-operations";
-      rev = "276f096ef324c140d00bd0188a0e70382e156771";
+      tag = "v1.0.0";
      hash = "sha256-FObv42EGkIao2Rmq9CG+G4JsntO+00CFNaNIXc7IK7A=";
    };
    meta.homepage = "https://github.com/antosha417/nvim-lsp-file-operations/";
@@ -13957,12 +13957,12 @@ final: prev: {

  nvim-treesitter = buildVimPlugin {
    pname = "nvim-treesitter";
-    version = "0.10.0-unstable-2026-09-10";
+    version = "0.10.0-unstable-2026-09-12";
    src = fetchFromGitHub {
      owner = "nvim-treesitter";
      repo = "nvim-treesitter";
-      rev = "d4d59cb369da46b95699bd2200efbcffc6dadb3b";
-      hash = "sha256-o9815JWolYzxjNGlBypPxTkZDLoP2z51W9g1OX3tD/E=";
+      rev = "9a168f6357ed21c3a636e1727bc7d382abc451b8";
+      hash = "sha256-NXt2xP6m2TMG1GHggG9S8sGnd8tl1Utv9kjjqJVEH9U=";
    };
    meta.homepage = "https://github.com/nvim-treesitter/nvim-treesitter/";
    meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -14377,12 +14377,12 @@ final: prev: {

  ocaml-nvim = buildVimPlugin {
    pname = "ocaml.nvim";
-    version = "1.0.0-unstable-2026-07-16";
+    version = "1.0.0-unstable-2026-09-10";
    src = fetchFromGitHub {
      owner = "tarides";
      repo = "ocaml.nvim";
-      rev = "d74934117fb7a513e64601ad1d1b53a34b00b01f";
-      hash = "sha256-zJJZP8jxa7e9Fn0N8JFzfP3d2TElkASFt8ptaWCOYpM=";
+      rev = "cd21b0d92270fa8aa455d3986dd73f447c28505f";
+      hash = "sha256-GveMCxN0KCPkoi07wVENM0tB1XWx6/L5nGJt04DGhzo=";
    };
    meta.homepage = "https://github.com/tarides/ocaml.nvim/";
    meta.license = getLicenseFromSpdxId "MIT";
@@ -14475,12 +14475,12 @@ final: prev: {

  oklch-color-picker-nvim = buildVimPlugin {
    pname = "oklch-color-picker.nvim";
-    version = "5.0.5";
+    version = "5.0.6";
    src = fetchFromGitHub {
      owner = "eero-lehtinen";
      repo = "oklch-color-picker.nvim";
-      tag = "v5.0.5";
-      hash = "sha256-VWVVD1/ZcGSjABqkCSc6tPjbet1K/WnlY3NJMEBw/kA=";
+      tag = "v5.0.6";
+      hash = "sha256-3rlmUXqFpxIvSSWSHmFb9eYGq91tuUREp1d2280ci2s=";
    };
    meta.homepage = "https://github.com/eero-lehtinen/oklch-color-picker.nvim/";
    meta.license = getLicenseFromSpdxId "MIT";
@@ -14671,12 +14671,12 @@ final: prev: {

  opencode-nvim = buildVimPlugin {
    pname = "opencode.nvim";
-    version = "1.0.0";
+    version = "1.0.1";
    src = fetchFromGitHub {
      owner = "nickjvandyke";
      repo = "opencode.nvim";
-      tag = "v1.0.0";
-      hash = "sha256-Au8vW7ISTH0jMxzgkRN3pFmLm4fMd9l27tBs1QH3v5c=";
+      tag = "v1.0.1";
+      hash = "sha256-rJz8AtUEgyTMvLd5cMD0wcsaNgW8FmPX1dtLymHM00o=";
    };
    meta.homepage = "https://github.com/nickjvandyke/opencode.nvim/";
    meta.license = getLicenseFromSpdxId "MIT";
@@ -15373,12 +15373,12 @@ final: prev: {

  project-nvim = buildVimPlugin {
    pname = "project.nvim";
-    version = "6.2.0-1";
+    version = "6.2.1-1";
    src = fetchFromGitHub {
      owner = "DrKJeff16";
      repo = "project.nvim";
-      tag = "v6.2.0-1";
-      hash = "sha256-IeihqzbJQ1sv9aZ0Kk0HzWSM4i00EUEXSIWFwuzuclk=";
+      tag = "v6.2.1-1";
+      hash = "sha256-jJwnMO5rYhlDp+ykL/72o4fllbtLCxdX+2ZCBJGxtwg=";
    };
    meta.homepage = "https://github.com/DrKJeff16/project.nvim/";
    meta.license = getLicenseFromSpdxId "Apache-2.0";
@@ -15429,12 +15429,12 @@ final: prev: {

  pum-vim = buildVimPlugin {
    pname = "pum.vim";
-    version = "2.0-unstable-2026-08-10";
+    version = "2.0-unstable-2026-09-11";
    src = fetchFromGitHub {
      owner = "Shougo";
      repo = "pum.vim";
-      rev = "e26a0c74a9ac33036a8387aedc96aac106870966";
-      hash = "sha256-m9eNkg7VH6W0d3PRrylTFcIHz5f435TN6PvUQzz7yuw=";
+      rev = "5969d9d2f8b14ec19e6252f4c5a32335bec4101f";
+      hash = "sha256-MK1H4btHeTSu2z+/fZKYjszWGHgWBvcfhoXqP+60EEM=";
    };
    meta.homepage = "https://github.com/Shougo/pum.vim/";
    meta.license = getLicenseFromSpdxId "MIT";
@@ -15990,12 +15990,12 @@ final: prev: {

  roslyn-nvim = buildVimPlugin {
    pname = "roslyn.nvim";
-    version = "0-unstable-2026-08-13";
+    version = "0-unstable-2026-09-10";
    src = fetchFromGitHub {
      owner = "seblyng";
      repo = "roslyn.nvim";
-      rev = "de9a98d61ed3fd01b5016eea5fe9e32f1a4c7cfb";
-      hash = "sha256-dSzC4A0jnetm5rNTy85bilUxcge+ERveSjOZ5p3gg54=";
+      rev = "bf1bd4e70bc7068d1b4aebf4ce03cc19a86615be";
+      hash = "sha256-YycY9uzShSxnKKJZxPLjOKPiwGfodOnHvrrFhqemcVI=";
    };
    meta.homepage = "https://github.com/seblyng/roslyn.nvim/";
    meta.license = getLicenseFromSpdxId "MIT";
@@ -16508,12 +16508,12 @@ final: prev: {

  smartcolumn-nvim = buildVimPlugin {
    pname = "smartcolumn.nvim";
-    version = "1.1.1-unstable-2026-07-20";
+    version = "1.1.1-unstable-2026-09-13";
    src = fetchFromGitHub {
      owner = "m4xshen";
      repo = "smartcolumn.nvim";
-      rev = "5351ae24e992a397d2abac48b7774dc8ef0acf40";
-      hash = "sha256-+ICVS16n0CFWbTqBzGkvxQohyYiAvr6gIxZqura3PUw=";
+      rev = "3a760dc239de71264072f829a184aafcf7d4d3e7";
+      hash = "sha256-QAb0O/ZwTVogRyTK8+Y4ORaN6nVaeYepKgfSCF/fIPU=";
    };
    meta.homepage = "https://github.com/m4xshen/smartcolumn.nvim/";
    meta.license = getLicenseFromSpdxId "MIT";
@@ -18193,12 +18193,12 @@ final: prev: {

  tinted-nvim = buildVimPlugin {
    pname = "tinted-nvim";
-    version = "1.0.0-unstable-2026-08-10";
+    version = "1.0.0-unstable-2026-09-13";
    src = fetchFromGitHub {
      owner = "tinted-theming";
      repo = "tinted-nvim";
-      rev = "a1f4cd347a26cec0e55dd992be52e93ba2f3c6a5";
-      hash = "sha256-8XRwslwHSFN7elxVZPtgToU+H+ZXE6EhAB30o8/7URA=";
+      rev = "72c8e25efea5b7911863a0c4380bb1e014f3e41a";
+      hash = "sha256-Y7zUq8poJFwfkaUEYFXjDpVRbzRdlD8VUqC+ER9GPnI=";
    };
    meta.homepage = "https://github.com/tinted-theming/tinted-nvim/";
    meta.license = getLicenseFromSpdxId "MIT";
@@ -18207,12 +18207,12 @@ final: prev: {

  tinted-vim = buildVimPlugin {
    pname = "tinted-vim";
-    version = "01-unstable-2026-08-10";
+    version = "01-unstable-2026-09-13";
    src = fetchFromGitHub {
      owner = "tinted-theming";
      repo = "tinted-vim";
-      rev = "66829e04041ceba72a9006d1c6c9d0c818e2b3dd";
-      hash = "sha256-ZEQ8D9NKoL+JKpTp9MAm3+js1wCmjNLgicmwUXqIusM=";
+      rev = "4242c2e29728af4d00fea05b094992747ad99a17";
+      hash = "sha256-w1JZrHJeTuasHOVGIdhV4GIKP4GzVhATykYVFrmpHPc=";
    };
    meta.homepage = "https://github.com/tinted-theming/tinted-vim/";
    meta.license = unfree;
@@ -18221,12 +18221,12 @@ final: prev: {

  tiny-cmdline-nvim = buildVimPlugin {
    pname = "tiny-cmdline.nvim";
-    version = "0-unstable-2026-06-23";
+    version = "0-unstable-2026-09-13";
    src = fetchFromGitHub {
      owner = "rachartier";
      repo = "tiny-cmdline.nvim";
-      rev = "e247d9ee4c980734f8f8bf616d31e0ab7c27485d";
-      hash = "sha256-DEfoqGFoGdybgZyO+Jqxz4gYkrgoek4cQYulLEsvnU8=";
+      rev = "d83700b48d8ff5625dbef4029af071db559544e5";
+      hash = "sha256-3Qyo1a8H6JboAWJ5t0r5jFIY/UMCvgVQb/8fL1KXLN4=";
    };
    meta.homepage = "https://github.com/rachartier/tiny-cmdline.nvim/";
    meta.license = getLicenseFromSpdxId "MIT";
@@ -19415,12 +19415,12 @@ final: prev: {

  vim-addon-sql = buildVimPlugin {
    pname = "vim-addon-sql";
-    version = "0-unstable-2017-02-11";
+    version = "0-unstable-2026-09-11";
    src = fetchFromGitHub {
      owner = "MarcWeber";
      repo = "vim-addon-sql";
-      rev = "048a139af36829fce670c8ff80d3aad927557ee6";
-      hash = "sha256-o3K+w7qVcqeh6PPxXkPNd9QqB+RPcKt508z4pU8JFUY=";
+      rev = "28f489dbb0edc1154c74a4a97eb1173345edceee";
+      hash = "sha256-fCQtr4hmI4k0QliwoaHZsAbvEP0jCGAZnTqm0B3yBxc=";
    };
    meta.homepage = "https://github.com/MarcWeber/vim-addon-sql/";
    meta.license = unfree;
@@ -21501,12 +21501,12 @@ final: prev: {

  vim-habamax = buildVimPlugin {
    pname = "vim-habamax";
-    version = "0-unstable-2026-09-08";
+    version = "0-unstable-2026-09-12";
    src = fetchFromGitHub {
      owner = "habamax";
      repo = "vim-habamax";
-      rev = "d5f91975c07c19abadf02ba60b0fa150c9f67c3f";
-      hash = "sha256-lw7SCGMh8I7xPWXlH7xTnYLZQnjQLO0sLy8TDIxcD30=";
+      rev = "c538284552cf22abb733140c77cd0cc95cb80a05";
+      hash = "sha256-TjFLjy3TOZCkC4vWAtCCPJul+ZsTyaBh8NK/tpUUS9s=";
    };
    meta.homepage = "https://github.com/habamax/vim-habamax/";
    meta.license = unfree;
@@ -24609,12 +24609,12 @@ final: prev: {

  vim-test = buildVimPlugin {
    pname = "vim-test";
-    version = "3.3.1";
+    version = "3.4.0";
    src = fetchFromGitHub {
      owner = "vim-test";
      repo = "vim-test";
-      tag = "v3.3.1";
-      hash = "sha256-8+Bk1a+cjlJmu2l3emizKkYpXfYwhTagBhcrbYKap74=";
+      tag = "v3.4.0";
+      hash = "sha256-az9rmgWrmKrAVVYNPsxmnrN2W0cEGKeMn6U9RKqwfNM=";
    };
    meta.homepage = "https://github.com/vim-test/vim-test/";
    meta.license = getLicenseFromSpdxId "MIT";
@@ -26178,12 +26178,12 @@ final: prev: {

  yats-vim = buildVimPlugin {
    pname = "yats.vim";
-    version = "0-unstable-2025-12-09";
+    version = "0-unstable-2026-09-10";
    src = fetchFromGitHub {
      owner = "HerringtonDarkholme";
      repo = "yats.vim";
-      rev = "2d9b95b91b9f72bb1769951841b32d2a879d3cd7";
-      hash = "sha256-Xu90d6VwucmM1mfBVzBeQ3gaRfIz8tz6qzRRtoYsnas=";
+      rev = "ed51b581160bf7b04092a5448c8dc3c8b4c6849b";
+      hash = "sha256-pfMBi+FbLYj1YOJpitq/BGCCBXf/GJryXjxM4ZK/oZA=";
      fetchSubmodules = true;
    };
    meta.homepage = "https://github.com/HerringtonDarkholme/yats.vim/";
@@ -26306,12 +26306,12 @@ final: prev: {

  zen-nvim = buildVimPlugin {
    pname = "zen.nvim";
-    version = "0-unstable-2026-08-23";
+    version = "0-unstable-2026-09-12";
    src = fetchFromGitHub {
      owner = "sand4rt";
      repo = "zen.nvim";
-      rev = "9ae3ce3cac4cf88b4369a8ec789aa755882f5cc9";
-      hash = "sha256-jJCtzZ4J4SsVMUK7wuVdh8fLbCKTzJQgEN2K/gGHqkY=";
+      rev = "5fd4b1cc12b91930d1a55d9b98ef01ed963a0b46";
+      hash = "sha256-xO+Xn3FR27Ib8aU7Of1LCpeEjOeg0PJVg29yTH2br3o=";
    };
    meta.homepage = "https://github.com/sand4rt/zen.nvim/";
    meta.license = getLicenseFromSpdxId "MIT";
--- a/pkgs/applications/editors/vim/plugins/non-generated/codediff-nvim/default.nix
+++ b/pkgs/applications/editors/vim/plugins/non-generated/codediff-nvim/default.nix
@@ -11,13 +11,13 @@
 }:
 vimUtils.buildVimPlugin rec {
  pname = "codediff.nvim";
-  version = "2.67.0";
+  version = "4.0.5";

  src = fetchFromGitHub {
    owner = "esmuellert";
    repo = "codediff.nvim";
    tag = "v${version}";
-    hash = "sha256-LNDCn8OAbRXBC2B4pbAhxVxGWBCbOJmDAELlB0LuGvI=";
+    hash = "sha256-wwb1u6Kpz3Nm0MMmo3OMtzWukeEEFsX4JjC+K/EaRQ4=";
  };

  dependencies = [ vimPlugins.nui-nvim ];
--- a/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/nvim-treesitter/generated.nix
@@ -451,12 +451,12 @@
    };
    cuda = buildGrammar {
      language = "cuda";
-      version = "0.0.0+rev=1ebcedd";
+      version = "0.0.0+rev=fbafd28";
      src = fetchFromGitHub {
        owner = "tree-sitter-grammars";
        repo = "tree-sitter-cuda";
-        rev = "1ebcedde2e36c4e7fecf79b3119ffeddf5e7a683";
-        hash = "sha256-mfcRR2Qlk1e6CL7gQAluKPhqvFzWIFFzAipvnJ5Mhq0=";
+        rev = "fbafd28773ef10cb498771e642575b47fb15abe9";
+        hash = "sha256-P/G0vUIP1YegpJkrZq8lDo0yy1NDInfJl8WsuRThOiM=";
      };
      passthru.requires = [
        "cpp"
@@ -966,12 +966,12 @@
    };
    gitcommit = buildGrammar {
      language = "gitcommit";
-      version = "0.0.0+rev=a87878a";
+      version = "0.0.0+rev=55a265c";
      src = fetchFromGitHub {
        owner = "gbprod";
        repo = "tree-sitter-gitcommit";
-        rev = "a87878a27b78f75ba59df5bb2fbe36ce88c319ab";
-        hash = "sha256-6kBoXBdXxTnoEiEAlKwop9qYbSST12H1AfiSftG4zwo=";
+        rev = "55a265cf763ec15d6e2d96bb206e3f5e30d82bae";
+        hash = "sha256-GaxjYAfDTxhwNA3cNLCNWmmz/H1OpuD6kodSD73684E=";
      };
      meta.homepage = "https://github.com/gbprod/tree-sitter-gitcommit";
    };
@@ -1408,12 +1408,12 @@
    };
    idris = buildGrammar {
      language = "idris";
-      version = "0.0.0+rev=c56a25c";
+      version = "0.0.0+rev=9fe334f";
      src = fetchFromGitHub {
        owner = "kayhide";
        repo = "tree-sitter-idris";
-        rev = "c56a25cf57c68ff929356db25505c1cc4c7820f6";
-        hash = "sha256-aOAxb0KjhSwlNX/IDvGwEysYvImgUEIDeNDOWRl1qNk=";
+        rev = "9fe334fb603fdce0e84349ed78f41ae3d2f7036b";
+        hash = "sha256-Y3UN9sldWw5MLvdi8bGTzid2p5h27pMICEb6tvZbC4w=";
      };
      meta.homepage = "https://github.com/kayhide/tree-sitter-idris";
    };
@@ -1477,12 +1477,12 @@
    };
    javadoc = buildGrammar {
      language = "javadoc";
-      version = "0.0.0+rev=2ba54a7";
+      version = "0.0.0+rev=4e9e1db";
      src = fetchFromGitHub {
        owner = "rmuir";
        repo = "tree-sitter-javadoc";
-        rev = "2ba54a791a31a8c1ed60045a755a86eb10c602e2";
-        hash = "sha256-VcAYKbB7V/gd35WQR51463IIx2QqaFn7drLbiiDcL2w=";
+        rev = "4e9e1db7a116244aaa248f0cf58ca058694a0de4";
+        hash = "sha256-PPq8SNVowtYYIsMGU1F6QvIPb7Ry56I7AHMeBU0sq+Q=";
      };
      meta.homepage = "https://github.com/rmuir/tree-sitter-javadoc";
    };
@@ -1636,12 +1636,12 @@
    };
    kdl = buildGrammar {
      language = "kdl";
-      version = "0.0.0+rev=b37e3d5";
+      version = "0.0.0+rev=v2.0.0";
      src = fetchFromGitHub {
        owner = "tree-sitter-grammars";
        repo = "tree-sitter-kdl";
-        rev = "b37e3d58e5c5cf8d739b315d6114e02d42e66664";
-        hash = "sha256-irx8aMEdZG2WcQVE2c7ahwLjqEoUAOOjvhDDk69a6lE=";
+        tag = "v2.0.0";
+        hash = "sha256-Ot1abHQPNFaXeWzOGNPNe4WTvdFGP8pNuc+tfGlpXEU=";
      };
      meta.homepage = "https://github.com/tree-sitter-grammars/tree-sitter-kdl";
    };
@@ -1769,12 +1769,12 @@
    };
    liquidsoap = buildGrammar {
      language = "liquidsoap";
-      version = "0.0.0+rev=fa565a3";
+      version = "0.0.0+rev=301f669";
      src = fetchFromGitHub {
        owner = "savonet";
        repo = "tree-sitter-liquidsoap";
-        rev = "fa565a337b673050ba4f1131d21a1d259153140b";
-        hash = "sha256-UjFgw3AUDvsFLBdAh/zbQDjpZL1qBlCFMyxx3VVmXfM=";
+        rev = "301f66950622949f630fef9fa758ba69f66cf97a";
+        hash = "sha256-BPRaHi/TqU7s/XsrVz9+1aSfelmesOKr98ynELBgWM0=";
      };
      meta.homepage = "https://github.com/savonet/tree-sitter-liquidsoap";
    };
@@ -2012,12 +2012,12 @@
    };
    nix = buildGrammar {
      language = "nix";
-      version = "0.0.0+rev=3d0173d";
+      version = "0.0.0+rev=5a64e75";
      src = fetchFromGitHub {
        owner = "nix-community";
        repo = "tree-sitter-nix";
-        rev = "3d0173d903e630b6e14d17f1cf79488791379ded";
-        hash = "sha256-DFmFRZ47TPr8mgmRyXuHLfkQRmO58m4QyN9OBISb7IE=";
+        rev = "5a64e75fc1ee54f9e14e3a23918e057d43b2de2b";
+        hash = "sha256-gwiOJzi+t3g4PXmh+i6P/k0DLqY/ALjJr1wCb0FpbDA=";
      };
      meta.homepage = "https://github.com/nix-community/tree-sitter-nix";
    };
@@ -2153,12 +2153,12 @@
    };
    perl = buildGrammar {
      language = "perl";
-      version = "0.0.0+rev=c3e17b3";
+      version = "0.0.0+rev=f678e35";
      src = fetchFromGitHub {
        owner = "tree-sitter-perl";
        repo = "tree-sitter-perl";
-        rev = "c3e17b31179bf8f658c9f37c7a3ea6a202212d5a";
-        hash = "sha256-i5T7jT0zi0TSt7eAvjvJRak8kpzxOEoPydU+yEosNgA=";
+        rev = "f678e356280566100e7eed21716d6f59abdf96b7";
+        hash = "sha256-teMMSUPOlxzA+0edCIbxyvf/zoO3HBgDcKsoBVaOL40=";
      };
      generate = true;
      meta.homepage = "https://github.com/tree-sitter-perl/tree-sitter-perl";
@@ -2907,12 +2907,12 @@
    };
    sql = buildGrammar {
      language = "sql";
-      version = "0.0.0+rev=b2bd686";
+      version = "0.0.0+rev=593a5ec";
      src = fetchFromGitHub {
        owner = "derekstride";
        repo = "tree-sitter-sql";
-        rev = "b2bd686bb5f258506be69cddf76e49aa6b9de2c3";
-        hash = "sha256-kS65jw5jta4+hE6U+Kmg/GmgS2V8Kzo5TEhn7CxTomg=";
+        rev = "593a5ecc5dc3889890d8b24ba8fa7487ee01bfe5";
+        hash = "sha256-b7MtDuyESBiKkH/60KwMdXoQ44ox/ia9ihYtcYMDB4s=";
      };
      meta.homepage = "https://github.com/derekstride/tree-sitter-sql";
    };
@@ -3029,12 +3029,12 @@
    };
    swift = buildGrammar {
      language = "swift";
-      version = "0.0.0+rev=73c7923";
+      version = "0.0.0+rev=00bbb0a";
      src = fetchFromGitHub {
        owner = "alex-pinkus";
        repo = "tree-sitter-swift";
-        rev = "73c7923ac17ba6b9ebc0a2688bbddd0b75b725d6";
-        hash = "sha256-Kg3QcouSGKvKufBjIctwSc8h1gIwYnyPEJpw6xgOzL4=";
+        rev = "00bbb0a2550f8bc0023a2a4992922d51ae045626";
+        hash = "sha256-1HZ6LNvBWUntNONR1aNxbN8zHsnLQisgh+k2Fp/XpXk=";
      };
      generate = true;
      meta.homepage = "https://github.com/alex-pinkus/tree-sitter-swift";
@@ -3074,12 +3074,12 @@
    };
    t32 = buildGrammar {
      language = "t32";
-      version = "0.0.0+rev=acc92b0";
+      version = "0.0.0+rev=11947ac";
      src = fetchFromGitHub {
        owner = "xasc";
        repo = "tree-sitter-t32";
-        rev = "acc92b00d8564421f9c9c05ececfd2c7c942fe47";
-        hash = "sha256-7qWKy5ZcAB2VptlVHIGf3qTPmDI7mRdvB8weRvH9mi0=";
+        rev = "11947ac01ba681fb6f62667cb1447354833f4a5b";
+        hash = "sha256-hs0JHC4SOC4LvBQTMv/kKDQnW590p6waPHuO58CUaUw=";
      };
      meta.homepage = "https://github.com/xasc/tree-sitter-t32";
    };
@@ -3417,12 +3417,12 @@
    };
    vhdl = buildGrammar {
      language = "vhdl";
-      version = "0.0.0+rev=3fd99cd";
+      version = "0.0.0+rev=a88fb78";
      src = fetchFromGitHub {
        owner = "jpt13653903";
        repo = "tree-sitter-vhdl";
-        rev = "3fd99cd6681d3f3be00d05171c0d24551073c0a6";
-        hash = "sha256-cH/ns/RSM41QVeI6U6DWbn8Gs4NsitNhWe4HjXwExn4=";
+        rev = "a88fb782d4ec5ffe9303c32d6e86009e7e94a04a";
+        hash = "sha256-75Xg2B48S7okhS9jKCTRZYdshSjLWVB6EXRFeuNHRuk=";
      };
      meta.homepage = "https://github.com/jpt13653903/tree-sitter-vhdl";
    };
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -439,7 +439,7 @@ https://github.com/ncm2/float-preview.nvim/,,
 https://github.com/nvzone/floaterm/,,
 https://github.com/liangxianzhe/floating-input.nvim/,,
 https://github.com/floobits/floobits-neovim/,,
-https://github.com/0xstepit/flow.nvim/,,
+https://github.com/stefanopitton/flow.nvim/,,
 https://github.com/projectfluent/fluent.vim/,,
 https://github.com/maxmx03/fluoromachine.nvim/,,
 https://github.com/nvim-flutter/flutter-tools.nvim/,,
--- a/pkgs/by-name/ca/cargo-nextest/package.nix
+++ b/pkgs/by-name/ca/cargo-nextest/package.nix
@@ -7,13 +7,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-nextest";
-  version = "0.9.143";
+  version = "0.9.144";

  src = fetchFromGitHub {
    owner = "nextest-rs";
    repo = "nextest";
    tag = "cargo-nextest-${finalAttrs.version}";
-    hash = "sha256-nbkNUWa3Meht5b4pXjteWP0XVwJZjSx6AuWxaJgdMm0=";
+    hash = "sha256-Lvwiqs5vhxndL4it/kmhYChWqh3/BkheOGGewgsTrm4=";
  };

  # FIXME: we don't support dtrace probe generation on macOS until we have a dtrace build: https://github.com/NixOS/nixpkgs/pull/392918
@@ -21,7 +21,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    ./no-dtrace-macos.patch
  ];

-  cargoHash = "sha256-j3OciGSKymfDuLqsnMSOInLvpSuAm92/SNMDACP23Gc=";
+  cargoHash = "sha256-jWG7OlUJxVGaRkU6KGzwGVkRuZepElpIyQK9fsXpD+Y=";

  cargoBuildFlags = [
    "-p"
--- a/pkgs/by-name/ch/chhoto-url/package.nix
+++ b/pkgs/by-name/ch/chhoto-url/package.nix
@@ -8,13 +8,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "chhoto-url";
-  version = "7.5.1";
+  version = "7.5.5";

  src = fetchFromGitHub {
    owner = "SinTan1729";
    repo = "chhoto-url";
    tag = finalAttrs.version;
-    hash = "sha256-FAYbqNZVPUpfBKOn+cXvk5d8o29M9+d8t5ecihCQ4aY=";
+    hash = "sha256-u0S5HHTyuCYKnNDVs8mSjMyOPdhfKwNSIVh4pPXnpPM=";
    fetchLFS = true;
  };

@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      --replace-fail 'rust-version = "1.96"' 'rust-version = "1.95"'
  '';

-  cargoHash = "sha256-C+eH6lrFSpE7zuR3fyyP44KG/rV0N2Uh4E7She0HuEA=";
+  cargoHash = "sha256-23nDGYjGW4gL7sKh2YPPxkTUaxIQFRbPtVUVFDUlbHo=";

  postInstall = ''
    mkdir -p $out/share/chhoto-url
--- a/pkgs/by-name/cl/cliproxyapi/package.nix
+++ b/pkgs/by-name/cl/cliproxyapi/package.nix
@@ -10,13 +10,13 @@ buildGoModule (finalAttrs: {
  __structuredAttrs = true;

  pname = "cliproxyapi";
-  version = "7.2.146";
+  version = "7.3.2";

  src = fetchFromGitHub {
    owner = "router-for-me";
    repo = "CLIProxyAPI";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-6A01jfwnydP5ww+Kr47TS6KHAt05enOiaHc9rYQEswU=";
+    hash = "sha256-AgyWs2xkgkUqKKOSY1dAaN9BdEqo73BKmPpYMzSxVds=";
  };

  vendorHash = "sha256-CrDp7MOr+AwJUhTovklXx3F1yaktQlvD7VYhYSY6VvY=";
--- a/pkgs/by-name/cl/clouddrive2/package.nix
+++ b/pkgs/by-name/cl/clouddrive2/package.nix
@@ -11,15 +11,15 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "clouddrive2";
-  version = "1.0.16";
+  version = "1.0.17";

  src = fetchurl {
    url = "https://github.com/cloud-fs/cloud-fs.github.io/releases/download/v${finalAttrs.version}/clouddrive-2-${os}-${arch}-${finalAttrs.version}.tgz";
    hash =
      {
-        x86_64-linux = "sha256-7iqzoB3uIuer4ydVTqIMM6ngh08vmHsr9SKNNXcSK3M=";
-        aarch64-linux = "sha256-YTA5v7i7LFVuDQRtV+T/D+o3dxf1Zep/rkUMDUhzMY0=";
-        aarch64-darwin = "sha256-WPvN7bHYFEnpnb9UE266Ws36iMV0hGvDe8b0FhCW0Ms=";
+        x86_64-linux = "sha256-WnvY7c++9ZWDYpSssX1P0jKJDiSMrLCkongkWMlwSfU=";
+        aarch64-linux = "sha256-GBzr4HXbClTqTgMhVzW3jljrMYWqjM/Uj8TLXZ6aUes=";
+        aarch64-darwin = "sha256-/U+DczEKskbYawjIh1s0sGX3Sja4XksYlQgYKvT20AY=";
      }
      .${stdenv.hostPlatform.system} or (throw "unsupported system ${stdenv.hostPlatform.system}");
  };
--- a/pkgs/by-name/co/cosmopolitan/cosmocc.nix
+++ b/pkgs/by-name/co/cosmopolitan/cosmocc.nix
@@ -1,14 +1,27 @@
-{ runCommand, cosmopolitan }:
+{
+  runCommand,
+  cosmopolitan,
+  unzip,
+  fetchurl,
+}:

 let
+  version = "3.9.2";
+  cosmocc-zip = fetchurl {
+    url = "https://github.com/jart/cosmopolitan/releases/download/${version}/cosmocc-${version}.zip";
+    sha256 = "sha256-9P8Tr2X80wnz8c/QQnWZb7f3KkiXcmYoqMnPcy6FAZM=";
+  };
+
  cosmocc =
    runCommand "cosmocc-${cosmopolitan.version}"
      {
        pname = "cosmocc";
        inherit (cosmopolitan) version;

+        nativeBuildInputs = [ unzip ];
+
        passthru.tests = {
-          cc = runCommand "c-test" { } ''
+          cc = runCommand "c-test" { nativeBuildInputs = [ unzip ]; } ''
            ${cosmocc}/bin/cosmocc ${./hello.c}
            ./a.out > $out
          '';
@@ -19,9 +32,8 @@ let
        };
      }
      ''
-        mkdir -p $out/bin
-        install ${cosmopolitan.dist}/tool/scripts/{cosmocc,cosmoc++} $out/bin
-        sed 's|/opt/cosmo\([ /]\)|${cosmopolitan.dist}\1|g' -i $out/bin/*
+        mkdir -p $out
+        unzip -qo ${cosmocc-zip} -d $out
      '';
 in
 cosmocc
--- a/pkgs/by-name/co/cosmopolitan/fix-paths.patch
+++ b/pkgs/by-name/co/cosmopolitan/fix-paths.patch
@@ -1,12 +1,11 @@
 --- a/test/tool/plinko/plinko_test.c
 +++ b/test/tool/plinko/plinko_test.c
-@@ -91,8 +91,8 @@ TEST(plinko, worksOrPrintsNiceError) {
+@@ -89,7 +89,7 @@ TEST(plinko, worksOrPrintsNiceError) {
     sigaction(SIGQUIT, &savequit, 0);
     sigaction(SIGPIPE, &savepipe, 0);
     sigprocmask(SIG_SETMASK, &savemask, 0);
-     execve("bin/plinko.com", (char *const[]){"bin/plinko.com", 0},
-           (char *const[]){0});
-+           (char *const[]){"PATH=@coreutils@/bin", 0});
+-    execve("bin/plinko", (char *const[]){"bin/plinko", 0}, (char *const[]){0});
+    execve("bin/plinko", (char *const[]){"bin/plinko", 0}, (char *const[]){"PATH=@coreutils@/bin", 0});
     _exit(127);
   }
   close(pfds[0][0]);
--- a/pkgs/by-name/co/cosmopolitan/package.nix
+++ b/pkgs/by-name/co/cosmopolitan/package.nix
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  fetchurl,
  bintools-unwrapped,
  callPackage,
  coreutils,
@@ -9,15 +10,23 @@
  unzip,
 }:

+let
+  bootstrap-version = "3.9.2";
+  cosmocc-zip = fetchurl {
+    url = "https://github.com/jart/cosmopolitan/releases/download/${bootstrap-version}/cosmocc-${bootstrap-version}.zip";
+    sha256 = "sha256-9P8Tr2X80wnz8c/QQnWZb7f3KkiXcmYoqMnPcy6FAZM=";
+  };
+in
+
 stdenv.mkDerivation (finalAttrs: {
  pname = "cosmopolitan";
-  version = "2.2";
+  version = "4.0.2";

  src = fetchFromGitHub {
    owner = "jart";
    repo = "cosmopolitan";
    rev = finalAttrs.version;
-    hash = "sha256-DTL1dXH+LhaxWpiCrsNjV74Bw5+kPbhEAA2Z1NKiPDk=";
+    hash = "sha256-NaWQK7SkqS3rrGG95dEjq8ptXogYU4bNndoXPU2rXnM=";
  };

  patches = [
@@ -41,7 +50,6 @@ stdenv.mkDerivation (finalAttrs: {

  # slashes are significant because upstream uses o/$(MODE)/foo.o
  buildFlags = [
-    "o/cosmopolitan.h"
    "o//cosmopolitan.a"
    "o//libc/crt/crt.o"
    "o//ape/ape.o"
@@ -56,6 +64,12 @@ stdenv.mkDerivation (finalAttrs: {
  dontConfigure = true;
  dontFixup = true;

+  preBuild = ''
+    # Extract cosmocc to the expected location
+    mkdir -p .cosmocc/${bootstrap-version}
+    unzip -qo ${cosmocc-zip} -d .cosmocc/${bootstrap-version}
+  '';
+
  preCheck =
    let
      failingTests = [
@@ -63,8 +77,9 @@ stdenv.mkDerivation (finalAttrs: {
        "test/libc/calls/sched_setscheduler_test.c"
        "test/libc/thread/pthread_create_test.c"
        "test/libc/calls/getgroups_test.c"
-        # fails
-        "test/libc/stdio/posix_spawn_test.c"
+        "test/libc/calls/cachestat_test.c"
+        "test/libc/calls/getprogramexecutablename_test.c"
+        "test/libc/proc/posix_spawn_test.c"
      ];
    in
    lib.concatStringsSep ";\n" (map (t: "rm -v ${t}") failingTests);
@@ -73,8 +88,7 @@ stdenv.mkDerivation (finalAttrs: {
    runHook preInstall

    mkdir -p $out/{include,lib}
-    install o/cosmopolitan.h $out/include
-    install o/cosmopolitan.a o/libc/crt/crt.o o/ape/ape.{o,lds} o/ape/ape-no-modify-self.o $out/lib
+    install o//cosmopolitan.a o//libc/crt/crt.o o//ape/ape.{o,lds} o//ape/ape-no-modify-self.o $out/lib
    cp -RT . "$dist"

    runHook postInstall
--- a/pkgs/by-name/cr/cronet-go/package.nix
+++ b/pkgs/by-name/cr/cronet-go/package.nix
@@ -29,15 +29,16 @@ in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "cronet-go";
  # NOTE: https://github.com/SagerNet/sing-box/blob/stable/.github/CRONET_GO_VERSION
-  version = "150.0.7871.63-2";
+  version = "150.0.7871.63-3";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "SagerNet";
    repo = "cronet-go";
-    rev = "d9872d6dd0d39cc7e042d1199d736f16fc40cf8c";
+    # NOTE: keep rev for easier overriding
+    rev = "049f2909701ca088c9569f6b303bba5376a2b2ff";
    fetchSubmodules = true;
-    hash = "sha256-b7sOKn5d5BsZa73Jukw25fz3MVWHlQBteXrufWwszUk=";
+    hash = "sha256-705cctVHseRSJuEPFxlTRJJUWsNgZ4y5ZQ9nwhyTqFY=";
  };

  patches = [
--- a/pkgs/by-name/cs/csharp-ls/package.nix
+++ b/pkgs/by-name/cs/csharp-ls/package.nix
@@ -11,9 +11,9 @@ in

 buildDotnetGlobalTool (finalAttrs: {
  pname = "csharp-ls";
-  version = "0.27.0";
+  version = "0.28.0";

-  nugetHash = "sha256-pJo01GZOT7pHgctQ1TfvrRdxOTgoNw4y7OP+deK87a8=";
+  nugetHash = "sha256-j4FeTyJnQQaoJEvroH5LSwYuMVKOQEqoSJMS7/uMDgw=";

  inherit dotnet-sdk;
  dotnet-runtime = dotnet-sdk;
--- a/pkgs/by-name/da/dayon/package.nix
+++ b/pkgs/by-name/da/dayon/package.nix
@@ -12,13 +12,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "dayon";
-  version = "18.0.0";
+  version = "18.0.2";

  src = fetchFromGitHub {
    owner = "RetGal";
    repo = "dayon";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-ZjmPM0epVlkarUCQxdiaP5kghqJZ1J3QuP8nHzK3+xE=";
+    hash = "sha256-/58b99kaKp2Q2idWvy7CudjJeOfIEH0QEa7j2DG+lsU=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/di/diskwatch/package.nix
+++ b/pkgs/by-name/di/diskwatch/package.nix
@@ -11,18 +11,18 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "diskwatch";
-  version = "0.5.4";
+  version = "0.5.7";

  src = fetchFromGitHub {
    owner = "matthart1983";
    repo = "diskwatch";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-gDgF8PFyiMVk/XEiLPt8kPc50tjqiUm1FvCZVKX5f9M=";
+    hash = "sha256-RDQg3DIlfF/BIxcN8+Jg1UWnPZYp73wmfUb8DLsw9Ng=";
  };

  __structuredAttrs = true;

-  cargoHash = "sha256-4gTWfdJswuf7vISA1aIF/nVuzIrIIoI0GSnRCCYC/pA=";
+  cargoHash = "sha256-zgPA8YUVaN8ZqosjlSZzAxLBwMwturQdF2eZpyXlIAQ=";

  nativeCheckInputs = [ versionCheckHook ];

@@ -30,6 +30,11 @@ rustPlatform.buildRustPackage (finalAttrs: {

  doInstallCheck = true;

+  cargoTestFlags = [
+    "--"
+    "--skip=left_right_cycle_all_tabs_without_moving_selections"
+  ];
+
  meta = {
    description = "Single-host, read-only disk diagnostics TUI";
    homepage = "https://www.netwatchlabs.com/labs/diskwatch";
--- a/pkgs/by-name/do/doxygen-awesome-css/package.nix
+++ b/pkgs/by-name/do/doxygen-awesome-css/package.nix
@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "doxygen-awesome-css";
-  version = "2.4.2";
+  version = "2.5.0";

  src = fetchFromGitHub {
    owner = "jothepro";
    repo = "doxygen-awesome-css";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-AlnoIgH4DeIWM+Da7y7P6vkey0a0rlko9/slKHce49E=";
+    hash = "sha256-QXwR6nkjoowTxnbKdv2LFwwCVcehsdeeatK81B6c6sc=";
  };

  makeFlags = [ "PREFIX=$(out)" ];
--- a/pkgs/by-name/en/en-croissant/package.nix
+++ b/pkgs/by-name/en/en-croissant/package.nix
@@ -27,13 +27,13 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "en-croissant";
-  version = "0.15.0";
+  version = "0.15.1";

  src = fetchFromGitHub {
    owner = "franciscoBSalgueiro";
    repo = "en-croissant";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-xP/u3EABj11bylZKDpvBsuUF6QRmtArQV/pTY+0ANb0=";
+    hash = "sha256-a+UVorsX3A8/NYjXJM+k2uDvCdySLr88UqzTq7ROJEM=";
  };

  pnpmDeps = fetchPnpmDeps {
@@ -44,7 +44,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      ;
    inherit pnpm;
    fetcherVersion = 3;
-    hash = "sha256-icJ5cU0ZNnYSZl+MPASNmGanc9Vaa61sotza8/G/xs4=";
+    hash = "sha256-U6iJFtbgQV8VV3tvTP0DMUQWZ5FI+QUGpqpEhQJl40E=";
  };

  postPatch = ''
@@ -58,7 +58,7 @@ rustPlatform.buildRustPackage (finalAttrs: {

  cargoRoot = "src-tauri";

-  cargoHash = "sha256-/L3URUdUIVrWHlXgRJfmDfFfOKGz9slDe49iE5nPw5k=";
+  cargoHash = "sha256-B5LAt2SKGZ8ksQZDvajWfkTKDzFZPCWGqRWvQAJPh/c=";

  buildAndTestSubdir = finalAttrs.cargoRoot;

--- a/pkgs/by-name/en/ente-desktop/package.nix
+++ b/pkgs/by-name/en/ente-desktop/package.nix
@@ -1,38 +1,28 @@
 {
-  stdenv,
  lib,
-  fetchFromGitHub,
-  fetchYarnDeps,
-  nodejs,
-  electron_41,
-  yarnConfigHook,
-  copyDesktopItems,
-  vips,
-  ffmpeg,
-  makeWrapper,
+  stdenv,
+
  autoPatchelfHook,
+  buildNpmPackage,
+  copyDesktopItems,
+  fetchFromGitHub,
+  fetchNpmDeps,
  makeDesktopItem,
-  imagemagick,
-  wasm-pack,
  rustPlatform,
-  cargo,
-  rustc,
-  wasm-bindgen-cli_0_2_121,
-  binaryen,
+
+  electron_42,
+  ente-web,
+  ffmpeg,
+  imagemagick,
+  makeWrapper,
+  vips,
+
+  wasm-bindgen-cli_0_2_125,
+
+  nix-update-script,
 }:
 let
-  electron = electron_41;
-
-  resourcesDir =
-    if stdenv.hostPlatform.isDarwin then
-      "$out/Applications/ente.app/Contents/Resources"
-    else
-      "$out/share/ente-desktop/resources";
-in
-
-stdenv.mkDerivation (finalAttrs: {
-  pname = "ente-desktop";
-  version = "1.7.24";
+  version = "1.7.27";

  src = fetchFromGitHub {
    owner = "ente";
@@ -43,48 +33,58 @@ stdenv.mkDerivation (finalAttrs: {
      "web"
      "rust"
    ];
-    tag = "photosd-v${finalAttrs.version}";
-    hash = "sha256-/dO9qLJKbqR5h/GEJW9rLO1jNTa5GkqnJ9ORPSf5R8o=";
+
+    tag = "photos-desktop-v${version}";
+    hash = "sha256-H6ac1xcoQsxftREukIHpcYc8lFxnvmyxS9xNcr8H3/U=";
  };

+  electron = electron_42;
+
+  resourcesDir =
+    if stdenv.hostPlatform.isDarwin then
+      "$out/Applications/ente.app/Contents/Resources"
+    else
+      "$out/share/ente-desktop/resources";
+
+  webCargoDeps = rustPlatform.fetchCargoVendor {
+    inherit src;
+    name = "ente-desktop-web-cargo-deps";
+    sourceRoot = "${src.name}/rust";
+    hash = "sha256-RWemVZmH/NAQ+yDv2jwLhpHZpcp8BK3lZ4GjHMVLGLA=";
+  };
+
+  webNpmDeps = fetchNpmDeps {
+    inherit src;
+    name = "ente-desktop-web-npm-deps";
+    sourceRoot = "${src.name}/web";
+    hash = "sha256-iSqxANhb/DC/57Ltw4F9YKjTlJaAeZG3K4NrUN/+omA=";
+  };
+
+  webApp =
+    (ente-web.override {
+      # This produces an eval error when we're out of sync with ente-web
+      wasm-bindgen-cli_0_2_125 = wasm-bindgen-cli_0_2_125;
+      extraBuildEnv = {
+        _ENTE_IS_DESKTOP = "1";
+      };
+    }).overrideAttrs
+      {
+        inherit version src;
+        npmDeps = webNpmDeps;
+        cargoDeps = webCargoDeps;
+      };
+in
+buildNpmPackage (finalAttrs: {
+  pname = "ente-desktop";
+  inherit version src;
+
  sourceRoot = "${finalAttrs.src.name}/desktop";
-  cargoRoot = "../rust";

-  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit (finalAttrs)
-      pname
-      version
-      src
-      sourceRoot
-      cargoRoot
-      ;
-    hash = "sha256-F+g/6mcMnplOkTlR/vedS3MhimFAbXFZi6CTJ/cqoU0=";
-  };
-  offlineCache = fetchYarnDeps {
-    name = "ente-desktop-${finalAttrs.version}-offline-cache";
-    inherit (finalAttrs) src sourceRoot;
-    hash = "sha256-ne3gyI6psDpYzCPpepIIWao0yBiiv9qXQ+Iri3ELK/U=";
-  };
-  webOfflineCache = fetchYarnDeps {
-    name = "ente-desktop-${finalAttrs.version}-web-offline-cache";
-    inherit (finalAttrs) src;
-    sourceRoot = "${finalAttrs.src.name}/web";
-    hash = "sha256-MqsmOHVyPz+YiwNmrs447wrQ/Nk+t5TrLMsbDITM8p0=";
-  };
+  npmDepsHash = "sha256-qhimZHLD6mTUomZylLCyWWwPPi/m0VgjkMXGu2Wdkis=";

  nativeBuildInputs = [
-    nodejs
-    yarnConfigHook
-    makeWrapper
    imagemagick
-
-    wasm-pack
-    rustPlatform.cargoSetupHook
-    cargo
-    rustc
-    rustc.llvmPackages.lld
-    wasm-bindgen-cli_0_2_121
-    binaryen
+    makeWrapper
  ]
  ++ lib.optionals stdenv.hostPlatform.isLinux [
    autoPatchelfHook # for onnxruntime
@@ -101,38 +101,25 @@ stdenv.mkDerivation (finalAttrs: {
      --replace-fail "process.resourcesPath" "\"${resourcesDir}\""
  '';

-  postConfigure = ''
-    chmod u+w -R ..
+  preConfigure = ''
+    cp -R ${webApp}/ out/

-    pushd ../web
-    offlineCache=$webOfflineCache yarnConfigHook
-    rm -rf node_modules/wasm-pack node_modules/.bin/wasm-pack
-    popd
-
-    cp -r ${electron.dist} ./electron_dist
-    chmod u+w -R ./electron_dist
+    cp -R ${electron.dist} ./electron_dist
+    chmod -R u+w ./electron_dist
  '';

-  buildPhase = ''
-    runHook preBuild
+  npmBuildScript = "build-main";

-    pushd ../web
-    _ENTE_IS_DESKTOP=1 yarn build
-    popd
-    cp -r ../web/apps/photos/out out
-
-    yarn run tsc
-    yarn run electron-builder -- \
-      --dir \
-      --c.electronDist=./electron_dist \
-      --c.electronVersion=${electron.version} \
-      ${lib.optionalString stdenv.hostPlatform.isDarwin ''
-        --c.mac.identity=null \
-        --c.mac.notarize=false \
-      ''}
-
-    runHook postBuild
-  '';
+  npmBuildFlags = [
+    "--"
+    "--dir"
+    "--c.electronDist=./electron_dist"
+    "--c.electronVersion=${electron.version}"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    "--c.mac.identity=null"
+    "--c.mac.notarize=false"
+  ];

  installPhase = ''
    runHook preInstall
@@ -187,6 +174,18 @@ stdenv.mkDerivation (finalAttrs: {
    })
  ];

+  passthru = {
+    inherit webApp;
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--version-regex"
+        "photos-desktop-v(.*)"
+        "--subpackage"
+        "webApp"
+      ];
+    };
+  };
+
  meta = {
    description = "Desktop (Electron) client for Ente Photos";
    homepage = "https://ente.io/";
@@ -196,6 +195,7 @@ stdenv.mkDerivation (finalAttrs: {
      pinpox
      yuka
      Br1ght0ne
+      wrench-exile-legacy
    ];
    platforms = lib.platforms.linux ++ lib.platforms.darwin;
  };
--- a/pkgs/by-name/ev/evil-winrm-py/package.nix
+++ b/pkgs/by-name/ev/evil-winrm-py/package.nix
@@ -10,14 +10,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "evil-winrm-py";
-  version = "1.6.0";
+  version = "1.7.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "adityatelange";
    repo = "evil-winrm-py";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-arfH7z7QGZPenyHLAubuG1VOJArUxI4wlQgV+iU7CvU=";
+    hash = "sha256-xB+JLeh5MUWHd9wWLEVFLkN4QxyRaaa1p6442hsshXc=";
  };

  pythonRelaxDeps = true;
--- a/pkgs/by-name/ex/explo/package.nix
+++ b/pkgs/by-name/ex/explo/package.nix
@@ -9,7 +9,7 @@

 buildGoModule (finalAttrs: {
  pname = "explo";
-  version = "1.1.3";
+  version = "1.2.0";

  strictDeps = true;
  __structuredAttrs = true;
@@ -18,7 +18,7 @@ buildGoModule (finalAttrs: {
    owner = "LumePart";
    repo = "Explo";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Wq5oU5AVgBYN3j/m7T07ZI16RF11orysXqjPbYKVd98=";
+    hash = "sha256-T0EYPiidK/qUaCCKePDT8KIbMnu3j7Z3ADmgtuhUb/o=";
  };

  webui = buildNpmPackage {
--- a/pkgs/by-name/fo/fosrl-olm/package.nix
+++ b/pkgs/by-name/fo/fosrl-olm/package.nix
@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "olm";
-  version = "1.8.2";
+  version = "1.9.1";

  src = fetchFromGitHub {
    owner = "fosrl";
    repo = "olm";
    tag = finalAttrs.version;
-    hash = "sha256-4uHRWAgJzDBnPXi4XyzsAUgNp+l5R7anUD7sfoYLY/k=";
+    hash = "sha256-LsT+Dt6Ozp447VtLKc/2MH9HGkfMwrOFIEp43DsNaXY=";
  };

-  vendorHash = "sha256-7eKAftMOnVBnZhC800fRmOoV+8+Tq+RlSEpVUdZKSlk=";
+  vendorHash = "sha256-1lZoB27aedPGxsiZrKy0++QN1OobCXc69r3j+0XhCjM=";

  nativeInstallCheckInputs = [ versionCheckHook ];

--- a/pkgs/by-name/ge/geesefs/package.nix
+++ b/pkgs/by-name/ge/geesefs/package.nix
@@ -5,7 +5,7 @@
 }:

 let
-  version = "0.43.8";
+  version = "0.43.9";
 in
 buildGoModule {
  pname = "geesefs";
@@ -15,12 +15,12 @@ buildGoModule {
    owner = "yandex-cloud";
    repo = "geesefs";
    rev = "v${version}";
-    hash = "sha256-NDe3GnB0xVly6Elfpa60+Wx3RyWhfPfssf1l7Tt20zY=";
+    hash = "sha256-hvuDQATjSyMUVne/x9STEAMaiZz1wswTH8dvKSdtBEI=";
  };

  # hashes differ per architecture otherwise.
  proxyVendor = true;
-  vendorHash = "sha256-mvzt/pk+S7DRcU6T3fBBQw1uvluO/tfeFmONucMv7t8=";
+  vendorHash = "sha256-VwqpiWdUa32dkoltgGxk+3hV9y6z6B0szIaWNLSx3Rs=";

  subPackages = [ "." ];

--- a/pkgs/by-name/ha/harlequin/package.nix
+++ b/pkgs/by-name/ha/harlequin/package.nix
@@ -13,7 +13,7 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "harlequin";
-  version = "2.13.0";
+  version = "2.14.0";
  pyproject = true;
  __structuredAttrs = true;

@@ -21,7 +21,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
    owner = "tconbeer";
    repo = "harlequin";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-l8iLRLHf5m5ULClRtR+x0IJ3s/8NY5hVWFCODYhCcEo=";
+    hash = "sha256-sInr0zOw2efjbcr5+clzNodODCnzwVH36vOD+LJY0IM=";
  };

  postPatch =
--- a/pkgs/by-name/hy/hyprlax/package.nix
+++ b/pkgs/by-name/hy/hyprlax/package.nix
@@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "hyprlax";
-  version = "2.2.5";
+  version = "2.2.6";

  src = fetchFromGitHub {
    owner = "sandwichfarm";
    repo = "hyprlax";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-pI+JEuUOuUh4ZBT4YhIxc6FU3rMwau6qacypDrQG+dg=";
+    hash = "sha256-IfkukFP93EbJu9zBmqgJ98AeAWqCZjH3+dA2Q/1YZOw=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ja/jackett/package.nix
+++ b/pkgs/by-name/ja/jackett/package.nix
@@ -12,13 +12,13 @@

 buildDotnetModule (finalAttrs: {
  pname = "jackett";
-  version = "0.24.2527";
+  version = "0.24.2586";

  src = fetchFromGitHub {
    owner = "jackett";
    repo = "jackett";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-IbSXGddfsD9r0ElsSToQ+n75F09WUnF2jHirFOAiu+Q=";
+    hash = "sha256-rYUkxFkMcClN+GFt/nFR/y+zLbgLF9CFQUvfwuwNpo0=";
  };

  projectFile = "src/Jackett.Server/Jackett.Server.csproj";
--- a/pkgs/by-name/ki/kin-openapi/package.nix
+++ b/pkgs/by-name/ki/kin-openapi/package.nix
@@ -5,14 +5,14 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "kin-openapi";
-  version = "0.147.0";
-  vendorHash = "sha256-uprdzJnaxd1UyEdZFFPvmo2Xu/QXJdheC1eqkyKY9Zc=";
+  version = "0.149.0";
+  vendorHash = "sha256-SCuvGh6m9lq/tR1vKioh3EWbgJsKbocXzqxPy4uPvaw=";

  src = fetchFromGitHub {
    owner = "getkin";
    repo = "kin-openapi";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-kf+p+UgqM3JonbtX54WRtKpYp9hHT7Cq+Uux1J7x8f0=";
+    hash = "sha256-a1foAgxxnjkX9DB7wZC9hDfRLnPjoJOhW5+45lIa1ZQ=";
  };

  checkFlags =
--- a/pkgs/by-name/ku/kubescape/package.nix
+++ b/pkgs/by-name/ku/kubescape/package.nix
@@ -9,18 +9,18 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "kubescape";
-  version = "4.0.13";
+  version = "4.0.14";

  src = fetchFromGitHub {
    owner = "kubescape";
    repo = "kubescape";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-OsMCmh2KxpPKjXd0XkaoHtmaocw/kYDlZDPSPFgu5oU=";
+    hash = "sha256-QdWnwjvXsABcTsf+xzIYZ7GgwukzvyPQOppm7SDCK64=";
    fetchSubmodules = true;
  };

  proxyVendor = true;
-  vendorHash = "sha256-dF6JC6Ransv8iCHz3LfmIs4HZAmbATlNsnII379rNyo=";
+  vendorHash = "sha256-y0iwBSUVh2pBEaiS1cGmW7F0/geGDuSdSHMmvhW5c9o=";

  subPackages = [ "." ];

--- a/pkgs/by-name/le/ledger-autosync/package.nix
+++ b/pkgs/by-name/le/ledger-autosync/package.nix
@@ -1,50 +0,0 @@
-{
-  lib,
-  stdenv,
-  python3Packages,
-  fetchFromGitHub,
-  ledger,
-  hledger,
-}:
-
-python3Packages.buildPythonApplication (finalAttrs: {
-  pname = "ledger-autosync";
-  version = "1.2.0";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "egh";
-    repo = "ledger-autosync";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-bbFjDdxYr85OPjdvY3JYtCe/8Epwi+8JN60PKVKbqe0=";
-  };
-
-  build-system = with python3Packages; [ poetry-core ];
-
-  dependencies = with python3Packages; [
-    ofxclient
-    ofxparse
-  ];
-
-  nativeCheckInputs = [
-    hledger
-    ledger
-    python3Packages.ledger
-    python3Packages.pytestCheckHook
-  ];
-
-  disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
-    # keyring.errors.KeyringError: Can't get password from keychain: (-50, 'Unknown Error')
-    # keyring.backends.macOS.api.Error: (-50, 'Unknown Error')
-    "tests/test_cli.py"
-    "tests/test_weird_ofx.py"
-  ];
-
-  meta = {
-    homepage = "https://github.com/egh/ledger-autosync";
-    changelog = "https://github.com/egh/ledger-autosync/releases/tag/v${finalAttrs.version}";
-    description = "OFX/CSV autosync for ledger and hledger";
-    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ eamsden ];
-  };
-})
--- a/pkgs/by-name/li/lief/package.nix
+++ b/pkgs/by-name/li/lief/package.nix
@@ -31,6 +31,7 @@ stdenv.mkDerivation (finalAttrs: {

  outputs = [
    "out"
+    "dev"
    "py"
  ];

@@ -83,6 +84,8 @@ stdenv.mkDerivation (finalAttrs: {
    };
  };

+  __structuredAttrs = true;
+
  meta = {
    description = "Library to Instrument Executable Formats";
    homepage = "https://lief.quarkslab.com/";
--- a/pkgs/by-name/mo/mobsf/package.nix
+++ b/pkgs/by-name/mo/mobsf/package.nix
@@ -158,5 +158,6 @@ buildPythonApplication (finalAttrs: {
    license = lib.licenses.gpl3;
    maintainers = with lib.maintainers; [ felbinger ];
    platforms = lib.platforms.linux;
+    mainProgram = "mobsf";
  };
 })
--- a/pkgs/by-name/os/osmium/package.nix
+++ b/pkgs/by-name/os/osmium/package.nix
@@ -31,11 +31,11 @@

 stdenv.mkDerivation rec {
  pname = "osmium";
-  version = "0.0.33-alpha";
+  version = "0.0.40-alpha";

  src = fetchurl {
    url = "https://updater.osmium.chat/Osmium-${version}-x64.tar.gz";
-    hash = "sha256-ybv/CCaCqcNvoyTNKQbjSdNxOC81QDnnKjKcw8X9y2Y=";
+    hash = "sha256-3rnDG3erDi7anPbOjTq5F5j/HB0f4z1XrDRmDRJgPFw=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/pa/pantalaimon/package.nix
+++ b/pkgs/by-name/pa/pantalaimon/package.nix
@@ -93,5 +93,10 @@ python3Packages.buildPythonApplication rec {
    homepage = "https://github.com/matrix-org/pantalaimon";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ valodim ];
+    knownVulnerabilities = [
+      ''
+        pantalaimon was archived upstream, the last activity was from 4. June 2025.
+      ''
+    ];
  };
 }
--- a/pkgs/by-name/pr/prek/package.nix
+++ b/pkgs/by-name/pr/prek/package.nix
@@ -10,17 +10,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "prek";
-  version = "0.5.2";
+  version = "0.5.3";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "j178";
    repo = "prek";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-8LvrsmHTvlJ/1xrVsO/81zZBOVv6nyJ1rKeF8DCrTf8=";
+    hash = "sha256-O0CFdM4rQZSSj7k8LslvRaDabHU8//Z0wMr42bRRzz0=";
  };

-  cargoHash = "sha256-COOU7CelDvnMKxBbAPiNvo+E+GnrS+tXiyqPBdUYBMk=";
+  cargoHash = "sha256-TRmnVE+zyFTnKjyJU/rnhKQoL8rJA/ZNWfI2NOrzOOs=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/by-name/ru/rumdl/package.nix
+++ b/pkgs/by-name/ru/rumdl/package.nix
@@ -11,7 +11,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rumdl";
-  version = "0.2.64";
+  version = "0.2.73";

  __structuredAttrs = true;

@@ -19,10 +19,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "rvben";
    repo = "rumdl";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Y/G50woA477wh7pUVuCrcm9h4JEufT6bI3x5uRwupzw=";
+    hash = "sha256-ExIsl0JlEb8hylph8r1r4mx/hOyiLZVVutVxvfgMSrU=";
  };

-  cargoHash = "sha256-cKBBhhz0mqaSXy57CKhYQ9tWzRPUs05HpxdvqZ676eA=";
+  cargoHash = "sha256-lGTe+efabf3MtSfPCKlsbNQviCQH5DEmXlXDFOCQSgw=";

  cargoBuildFlags = [
    "--bin=rumdl"
--- a/pkgs/by-name/sc/sccache/package.nix
+++ b/pkgs/by-name/sc/sccache/package.nix
@@ -8,17 +8,17 @@
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
-  version = "0.17.0";
+  version = "0.18.0";
  pname = "sccache";

  src = fetchFromGitHub {
    owner = "mozilla";
    repo = "sccache";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-nnPhRbhcKjV5ODt782IZgsA7qXSFzeFQ/Xmq4MTK74Y=";
+    sha256 = "sha256-QGsDxUAQzAr6Aia5/D21cGbVV0YJyuH3aBmEr9NynXQ=";
  };

-  cargoHash = "sha256-mmpDFXEcMJGRVwNHKdme6uEZ8aJlZtgEsWGIECKCLg4=";
+  cargoHash = "sha256-Jr4+46/yhcuTC017TA2UZQJUNIBuioI3xZnxxD/rKuc=";

  buildFeatures = lib.optionals distributed [
    "dist-client"
--- a/pkgs/by-name/se/searxng/package.nix
+++ b/pkgs/by-name/se/searxng/package.nix
@@ -13,14 +13,14 @@ in
 python.pkgs.toPythonModule (
  python.pkgs.buildPythonApplication rec {
    pname = "searxng";
-    version = "0-unstable-2026-09-01";
+    version = "0-unstable-2026-09-12";
    pyproject = true;

    src = fetchFromGitHub {
      owner = "searxng";
      repo = "searxng";
-      rev = "79c8ffe0da5d75e48dbd55d505adab5d0ca554b9";
-      hash = "sha256-lxxO1wcZ9RDnw/28mVaT4oGGWkw5yEaeagcCdnlEInI=";
+      rev = "d4f00d15d4c2b8260124a9039b80bc9c1c26499b";
+      hash = "sha256-N5sCetc2JEnKl9eZn2HtJ4QP3TAH9h75/lmqqSWpPSg=";
    };

    nativeBuildInputs = with python.pkgs; [ pythonRelaxDepsHook ];
@@ -48,33 +48,26 @@ python.pkgs.toPythonModule (

    build-system = with python.pkgs; [ setuptools ];

-    dependencies =
-      with python.pkgs;
-      [
-        babel
-        certifi
-        cloudscraper
-        flask
-        flask-babel
-        httpx
-        httpx-socks
-        isodate
-        jinja2
-        lxml
-        markdown-it-py
-        msgspec
-        pygments
-        python-dateutil
-        pyyaml
-        sniffio
-        typer
-        typing-extensions
-        valkey
-        whitenoise
-      ]
-      ++ httpx.optional-dependencies.http2
-      ++ httpx.optional-dependencies.socks
-      ++ httpx-socks.optional-dependencies.asyncio;
+    dependencies = with python.pkgs; [
+      babel
+      certifi
+      cloudscraper
+      curl-cffi
+      flask
+      flask-babel
+      isodate
+      jinja2
+      lxml
+      markdown-it-py
+      msgspec
+      pygments
+      python-dateutil
+      pyyaml
+      typer
+      typing-extensions
+      valkey
+      whitenoise
+    ];

    # tests try to connect to network
    doCheck = false;
--- a/pkgs/by-name/si/sing-box/package.nix
+++ b/pkgs/by-name/si/sing-box/package.nix
@@ -19,7 +19,7 @@ assert lib.assertMsg (
 buildGoModule (finalAttrs: {
  pname = "sing-box";
  # NOTE: also update cronet-go
-  version = "1.14.0";
+  version = "1.14.1";

  __structuredAttrs = true;

@@ -28,10 +28,10 @@ buildGoModule (finalAttrs: {
    owner = "SagerNet";
    repo = "sing-box";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-1v9bgM2H439ZoSkomv5dmT5SNrkuyOJ1iFFPlYPsW/k=";
+    hash = "sha256-Ce1eukO8ERZEKUoqwcJEJIZcO6VcG/cRnfCdg4FCYJw=";
  };

-  vendorHash = "sha256-Bl73SkmnOyh5kULctDaxcOzXsYXRY2DOt80ME2+lBJo=";
+  vendorHash = "sha256-ttkDc8vRomNMNwqrZcGuvS0/M7Yqrpkz/h8wO5IVRQ4=";

  tags = [
    "with_gvisor"
--- a/pkgs/by-name/st/stackit-cli/package.nix
+++ b/pkgs/by-name/st/stackit-cli/package.nix
@@ -12,16 +12,16 @@

 buildGoModule (finalAttrs: {
  pname = "stackit-cli";
-  version = "0.72.0";
+  version = "0.73.0";

  src = fetchFromGitHub {
    owner = "stackitcloud";
    repo = "stackit-cli";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-Mh7AnagPxTyVBQPpghnc2Y9LrDwiO1JowG352jJw9NI=";
+    hash = "sha256-ZA/mmuF0svJOGps32K659NxGGLtcnobY1V7jsqzuROU=";
  };

-  vendorHash = "sha256-XlXPCYK57H8P2lluE/4KeQPPMmftx0teARjqb5FxnVM=";
+  vendorHash = "sha256-1uNrYr8wr00SlNfxZNVRkpc7OUp4K+nQ+0Gl90PHuxg=";

  subPackages = [ "." ];

--- a/pkgs/by-name/st/stalwart_0_16/package.nix
+++ b/pkgs/by-name/st/stalwart_0_16/package.nix
@@ -51,7 +51,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "stalwart" + (lib.optionalString stalwartEnterprise "-enterprise");
-  version = "0.16.20";
+  version = "0.16.22";

  __structuredAttrs = true;

@@ -59,10 +59,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "stalwartlabs";
    repo = "stalwart";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-BEWD6hxRJL5WkdRChWvx9Ubn8pSWW8Wy7fpa7oQxtGU=";
+    hash = "sha256-GQprWpJ+/QyiZvshBL+TSDOhj+1RDIxMzVNN8OWCw1A=";
  };

-  cargoHash = "sha256-zGGJeMoEJOn/BtNUysuyuPeH3hHkJdrb9jUw6ZTpDgk=";
+  cargoHash = "sha256-qgVCMnaUFLw+q7kTB8ZV0nNc58/9Dq7Q6CwdsMluRX8=";

  env = {
    # https://docs.rs/openssl/latest/openssl/#manual
--- a/pkgs/by-name/st/stalwart_0_16/spam-filter.nix
+++ b/pkgs/by-name/st/stalwart_0_16/spam-filter.nix
@@ -9,13 +9,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "spam-filter";
-  version = "3.0.0";
+  version = "3.0.1";

  src = fetchFromGitHub {
    owner = "stalwartlabs";
    repo = "spam-filter";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-mADA62eOHV7cJf4khkLh/OX0eQHRUus6nlGkieGFsKA=";
+    hash = "sha256-EeLzo8XZHdc9p/cUBMFF/IbHtW1QbMVWEjtOJdy9Gg8=";
  };

  __structuredAttrs = true;
--- a/pkgs/by-name/st/stalwart_0_16/webui.nix
+++ b/pkgs/by-name/st/stalwart_0_16/webui.nix
@@ -8,13 +8,13 @@
 }:
 buildNpmPackage (finalAttrs: {
  pname = "webui";
-  version = "1.0.9";
+  version = "1.0.10";

  src = fetchFromGitHub {
    owner = "stalwartlabs";
    repo = "webui";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-EFENMnBuHU7ugciB/ib4iKGctZLMLl6rOZVQiakPgaU=";
+    hash = "sha256-ZWx9Ikkf9uCGK6EBiCIXr6rIpbFeoltCId1DAxUpiTI=";
  };

  npmDepsHash = "sha256-qe9cSrvs6kWwgbOO0xL7MBaJvICOvyuLFVi9R0dgnXQ=";
--- a/pkgs/by-name/su/sub-store-frontend/package.nix
+++ b/pkgs/by-name/su/sub-store-frontend/package.nix
@@ -14,13 +14,13 @@ let
 in
 buildNpmPackage (finalAttrs: {
  pname = "sub-store-frontend";
-  version = "2.31.1";
+  version = "2.32.2";

  src = fetchFromGitHub {
    owner = "sub-store-org";
    repo = "Sub-Store-Front-End";
    tag = finalAttrs.version;
-    hash = "sha256-eqaS5bPHBx92C6gv2iE9MYtBpI0UsvM0ptG97lPt8HE=";
+    hash = "sha256-TbKJNSA+ivUd7bHDtE9COaZFMqxRkRdBXWkK7y7JMSU=";
  };

  nativeBuildInputs = [
@@ -33,7 +33,7 @@ buildNpmPackage (finalAttrs: {
    inherit (finalAttrs) pname version src;
    inherit pnpm;
    fetcherVersion = 3;
-    hash = "sha256-Pr0l1JxHvpsgfsvQdENbxLehBAn7/X87lPxsbKfNBw0=";
+    hash = "sha256-EV6NpYQV9kQ4/2j012r0x66o5L9lNAYNvc5wI7DXiAU=";
  };

  npmConfigHook = pnpmConfigHook;
--- a/pkgs/by-name/sy/syswatch/package.nix
+++ b/pkgs/by-name/sy/syswatch/package.nix
@@ -7,18 +7,18 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "syswatch";
-  version = "0.14.1";
+  version = "0.14.2";

  src = fetchFromGitHub {
    owner = "matthart1983";
    repo = "syswatch";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ROuPauHvrwXoDyYg0OZV2OtpuC9dTwhPuqU8+JDzTCw=";
+    hash = "sha256-udVUX1qNaPDBI+nEjm7LQ+2+HG6TBlgsjyQOP8pBqao=";
  };

  __structuredAttrs = true;

-  cargoHash = "sha256-jwWvZaU+mOeg80ImdTXDnu4219SXRiKlPzvpFBn1bbE=";
+  cargoHash = "sha256-iFqECXUMODxvjXQ4o0mD4dTdG9RYbpOBeyJzvteZZmI=";

  nativeCheckInputs = [ versionCheckHook ];

--- a/pkgs/by-name/te/temporal-ui-server/package.nix
+++ b/pkgs/by-name/te/temporal-ui-server/package.nix
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "temporal-ui-server";
-  version = "2.53.3";
+  version = "2.54.1";

  src = fetchFromGitHub {
    owner = "temporalio";
    repo = "ui-server";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-I8xUAs5eNceicxR7S4ahCxZEfg1tMjFZ/cgwsSErl94=";
+    hash = "sha256-qu/UVA7l6oZmL+k8xAUIJkPwbahu42uI8KjCqtxi1wk=";
  };

-  vendorHash = "sha256-PugVDr9HQnuNXzHGEDwna71SroL7m1RTG68PphYdbag=";
+  vendorHash = "sha256-KKQ2BEMAud5rpP97Iubbkh3ZuWV6aOsc44BvebQZy54=";

  postInstall = ''
    mv $out/bin/server $out/bin/temporal-ui-server
--- a/pkgs/by-name/te/texpresso/package.nix
+++ b/pkgs/by-name/te/texpresso/package.nix
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
+  unstableGitUpdater,

  # nativeBuildInputs
  makeWrapper,
@@ -21,13 +22,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "texpresso";
-  version = "0.1-unstable-2026-04-02";
+  version = "0.1-unstable-2026-07-22";

  src = fetchFromGitHub {
    owner = "let-def";
    repo = "texpresso";
-    rev = "96f008c94ece067fac8e896d0ab1808c948a4dd3";
-    hash = "sha256-ew7n3Sp4uYLv5jijRW2rRM9s63TQCeFgKXmmBXdYjx4=";
+    rev = "e8df7709077b2f86f6e16e6c86ceefb86de06f8d";
+    hash = "sha256-ijQwoQIJ6CsAd7eY9kkK2aHO/5FRFP5/tE6H9R/pngY=";
  };

  postPatch = ''
@@ -41,6 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  strictDeps = true;
+  __structuredAttrs = true;

  nativeBuildInputs = [
    makeWrapper
@@ -72,6 +74,10 @@ stdenv.mkDerivation (finalAttrs: {
    ];
  };

+  passthru.updateScript = unstableGitUpdater {
+    tagPrefix = "v";
+  };
+
  installPhase = ''
    runHook preInstall
    install -D -t "$out/bin/" "build/texpresso"
@@ -82,7 +88,12 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    inherit (finalAttrs.src.meta) homepage;
    description = "Live rendering and error reporting for LaTeX";
-    maintainers = with lib.maintainers; [ nickhu ];
+    changelog = "https://github.com/let-def/texpresso/blob/main/CHANGELOG.md";
+    mainProgram = "texpresso";
+    maintainers = with lib.maintainers; [
+      nickhu
+      stephen-huan
+    ];
    license = lib.licenses.mit;
    platforms = lib.platforms.unix;
  };
--- a/pkgs/by-name/us/usage/package.nix
+++ b/pkgs/by-name/us/usage/package.nix
@@ -13,16 +13,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "usage";
-  version = "6.6.1";
+  version = "6.9.0";

  src = fetchFromGitHub {
    owner = "jdx";
    repo = "usage";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-OQCIQqR8tO10w1WTi6rPCdBN5o9bZetmwGojU3p4o4I=";
+    hash = "sha256-LMgvgmh32CkbKzC6h/F6oYdI5iK2gdaCuoY2dVJrQp0=";
  };

-  cargoHash = "sha256-dZo75rg3kh4R7D79A1JOYnq0s8iWzf1bJffm3oK7I2A=";
+  cargoHash = "sha256-L8+fIgoGoDbgCTkQ/IG24EkDq7OwW2JShoRLoyEdJCE=";

  # Upstream's releases ship only the `usage` binary.
  cargoBuildFlags = [
--- a/pkgs/by-name/wa/wasmtime/package.nix
+++ b/pkgs/by-name/wa/wasmtime/package.nix
@@ -17,9 +17,9 @@
 let
  sources = {
    lts-36 = {
-      version = "36.0.14";
-      hash = "sha256-OI8wixfzV4U2brmW7uqhk55eLhj+Fdp+J5Pzz1iBO6U=";
-      cargoHash = "sha256-2Nwcw3Z4/cbkRcG2hJ2/1PcXZf3vYB9NGUlr7pxdqzU=";
+      version = "36.0.15";
+      hash = "sha256-I+CGuTxtIOMz/VBkiQ9En5/YniskQKLHeGrmnTYa9m0=";
+      cargoHash = "sha256-68EM8hDN5dFxcBnEkqDt0sX86BYYiUZXfRaXut4WYpI=";
    };
    main = {
      version = "48.0.1";
--- a/pkgs/by-name/wp/wpscan/Gemfile.lock
+++ b/pkgs/by-name/wp/wpscan/Gemfile.lock
@@ -1,7 +1,7 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    activesupport (8.1.3)
+    activesupport (8.1.3.1)
      base64
      bigdecimal
      concurrent-ruby (~> 1.0, >= 1.3.1)
@@ -18,32 +18,31 @@ GEM
      public_suffix (>= 2.0.2, < 8.0)
    base64 (0.3.0)
    bigdecimal (4.1.2)
-    concurrent-ruby (1.3.6)
+    concurrent-ruby (1.3.8)
    connection_pool (3.0.2)
    drb (2.2.3)
    ethon (0.18.0)
      ffi (>= 1.15.0)
      logger
-    ferrum (0.17.2)
+    ferrum (0.18.0)
      addressable (~> 2.5)
      base64 (~> 0.2)
      concurrent-ruby (~> 1.1)
-      webrick (~> 1.7)
      websocket-driver (~> 0.7)
    ffi (1.17.4)
    fiddle (1.1.8)
    get_process_mem (1.0.0)
      bigdecimal (>= 2.0)
      ffi (~> 1.0)
-    i18n (1.14.8)
+    i18n (1.15.2)
      concurrent-ruby (~> 1.0)
-    json (2.19.8)
+    json (3.0.2)
    logger (1.7.0)
    mini_portile2 (2.8.9)
    minitest (6.0.6)
      drb (~> 2.0)
      prism (~> 1.5)
-    nokogiri (1.19.3)
+    nokogiri (1.19.4)
      mini_portile2 (~> 2.8.2)
      racc (~> 1.4)
    ostruct (0.6.3)
@@ -61,11 +60,11 @@ GEM
      concurrent-ruby (~> 1.0)
    uri (1.1.1)
    webrick (1.9.2)
-    websocket-driver (0.8.1)
+    websocket-driver (0.8.2)
      base64
      websocket-extensions (>= 0.1.0)
    websocket-extensions (0.1.5)
-    wpscan (4.0.0)
+    wpscan (4.1.0)
      activesupport (>= 7.1, < 8.2)
      addressable (~> 2.9)
      ethon (>= 0.14, < 0.19)
--- a/pkgs/by-name/wp/wpscan/gemset.nix
+++ b/pkgs/by-name/wp/wpscan/gemset.nix
@@ -18,10 +18,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "03m2vjhq3nmc8c3hpivxhvkjd8igg16nmv0p2fgdsgacppgy1991";
+      sha256 = "0xhkhdx8svhaf439y398yixik0snzarnnsy43688p92yy9jqfic5";
      type = "gem";
    };
-    version = "8.1.3";
+    version = "8.1.3.1";
  };
  addressable = {
    dependencies = [ "public_suffix" ];
@@ -59,10 +59,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1aymcakhzl83k77g2f2krz07bg1cbafbcd2ghvwr4lky3rz86mkb";
+      sha256 = "1qfi2ns3zwkgq616fc127xiqhan7g7m7gqpwriwcr34nds1vxwdj";
      type = "gem";
    };
-    version = "1.3.6";
+    version = "1.3.8";
  };
  connection_pool = {
    groups = [ "default" ];
@@ -103,17 +103,16 @@
      "addressable"
      "base64"
      "concurrent-ruby"
-      "webrick"
      "websocket-driver"
    ];
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1vp62wy85hr5fa0d29y3wh3zaj10sszj3pl19mps84dja2l4099c";
+      sha256 = "1inpi750jjbjlhqcf414jfx966zc6i5j3sc7y1sivz2jwcbbxf2c";
      type = "gem";
    };
-    version = "0.17.2";
+    version = "0.18.0";
  };
  ffi = {
    groups = [ "default" ];
@@ -155,20 +154,20 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1994i044vdmzzkyr76g8rpl1fq1532wf0sb21xg5r1ilj5iphmr8";
+      sha256 = "1dfikmmd9dllirsfq0kjiyxpmlq0afkxm5sslsr97r9g85ifpy80";
      type = "gem";
    };
-    version = "1.14.8";
+    version = "1.15.2";
  };
  json = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1anz6a6n33x4s3906s0bz6x161kk1ns3h7xxsn3rpxkfsw7k2m33";
+      sha256 = "1pqrpn0wkxvhcrwm4i0z9ailjj7if45zkkih0hij2k1q25xpwvcf";
      type = "gem";
    };
-    version = "2.19.8";
+    version = "3.0.2";
  };
  logger = {
    groups = [ "default" ];
@@ -213,10 +212,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1s30b7h7qpyim30m8060xs415mbr3ci7i5hdg09chh1aqfx2qcbq";
+      sha256 = "1d9safb4dly6qmc2g06444l0zifby52yy6j1a5fa1g4j3ihm3jah";
      type = "gem";
    };
-    version = "1.19.3";
+    version = "1.19.4";
  };
  ostruct = {
    groups = [ "default" ];
@@ -350,10 +349,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "15idgibqpdaj97f734drx8a7k1jcc8wvxlk2nbafac72ihikicjs";
+      sha256 = "0ij19k6034x0c4hw0ywa7wnk5s912r8aq0hhjss10d5z36q5dicp";
      type = "gem";
    };
-    version = "0.8.1";
+    version = "0.8.2";
  };
  websocket-extensions = {
    groups = [ "default" ];
@@ -386,10 +385,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "17i50avb4qa4dsvbd53mdp2mklbkhirvqczvrzz17zdswm2gfy39";
+      sha256 = "0pm9mlgajr2maf84b3cfbf0srgdvmkb9fclinddfhvqiczw7yipy";
      type = "gem";
    };
-    version = "4.0.0";
+    version = "4.1.0";
  };
  xmlrpc = {
    dependencies = [
--- a/pkgs/by-name/ze/zeek/broker/default.nix
+++ b/pkgs/by-name/ze/zeek/broker/default.nix
@@ -12,22 +12,22 @@ let
  src-cmake = fetchFromGitHub {
    owner = "zeek";
    repo = "cmake";
-    rev = "fd0696f9077933660f7da5f81978e86b3e967647";
-    hash = "sha256-21wZVwoOB05l/WX/VrVbSx+lFKFQ9MHWjQQD4weavFs=";
-  };
-  src-3rdparty = fetchFromGitHub {
-    owner = "zeek";
-    repo = "zeek-3rdparty";
-    rev = "a6cc3c7603bb535cf3bec7442140e7126e0577a8";
-    hash = "sha256-yzhuTam9zOQ3MP7fk+ACN5P5tHtHXWbyQP73DwISIv8=";
+    rev = "a1482b8f9829cea870b4db75c085de1249e11bcb";
+    hash = "sha256-kFkLig0g/sBKRg8EnfUldj9R7qX6V+c8Ap98p0YBsIw=";
  };
+  prometheus-cpp' = prometheus-cpp.overrideAttrs (old: {
+    # Zeek expects Broker to include prometheus-cpp symbols rather than link them dynamically.
+    cmakeFlags = builtins.filter (flag: flag != "-DBUILD_SHARED_LIBS=ON") old.cmakeFlags ++ [
+      "-DBUILD_SHARED_LIBS=OFF"
+    ];
+  });
  caf' = caf.overrideAttrs (old: {
-    version = "unstable-2024-09-14-zeek";
+    version = "unstable-2025-07-23-zeek";
    src = fetchFromGitHub {
      owner = "zeek";
      repo = "actor-framework";
-      rev = "10afbbc5ee40263b258b7cf3f0e5abb436f79e89";
-      hash = "sha256-R22eKAFNP2VVA4eL6ycN6aHM0NgDHVll9aFNmOQ/pDc=";
+      rev = "4aa660d003d8bbb922a33fb7a31f80d9d3271262";
+      hash = "sha256-OlrW+gk/oLEEIWRSugI1DqRJ+KYF4ZJxHVWKXWllGjU=";
    };
    cmakeFlags = old.cmakeFlags ++ [
      "-DCAF_ENABLE_TESTING=OFF"
@@ -37,7 +37,7 @@ let
 in
 stdenv.mkDerivation {
  pname = "zeek-broker";
-  version = "2.6.0-unstable-2025-04-23";
+  version = "2.8.0-unstable-2026-08-11";
  outputs = [
    "out"
    "py"
@@ -48,13 +48,13 @@ stdenv.mkDerivation {
  src = fetchFromGitHub {
    owner = "zeek";
    repo = "broker";
-    rev = "5b6cbb8c2d9124aa1fb0bea5799433138dc64cf9";
-    hash = "sha256-L6Z+ltX3tJEwZ05zEftrJlOhwbhs06MY9cEJDM2kcck=";
+    rev = "fdca6b8ef4b95ec6518a32db46503c28cc812be4";
+    hash = "sha256-GuqmbFCIeS9maW9cy+dIMqwOTTiQIKJX1nVQoAIxDpA=";
  };
  postUnpack = ''
-    rmdir $sourceRoot/cmake $sourceRoot/3rdparty
+    rmdir $sourceRoot/cmake $sourceRoot/caf
    ln -s ${src-cmake} ''${sourceRoot}/cmake
-    ln -s ${src-3rdparty} ''${sourceRoot}/3rdparty
+    ln -s ${caf'.src} ''${sourceRoot}/caf

    # Refuses to build the bindings unless this file is present, but never
    # actually uses it.
@@ -71,7 +71,7 @@ stdenv.mkDerivation {
  ];
  buildInputs = [
    openssl
-    prometheus-cpp
+    prometheus-cpp'
    python3.pkgs.pybind11
  ];
  propagatedBuildInputs = [ caf' ];
@@ -80,12 +80,11 @@ stdenv.mkDerivation {
    "-DCAF_ROOT=${caf'}"
    "-DENABLE_STATIC_ONLY:BOOL=${if stdenv.hostPlatform.isStatic then "ON" else "OFF"}"
    "-DPY_MOD_INSTALL_DIR=${placeholder "py"}/${python3.sitePackages}/"
-    "-Dprometheus-cpp_ROOT=${lib.getDev prometheus-cpp}"
+    "-Dprometheus-cpp_ROOT=${lib.getDev prometheus-cpp'}"
  ];

  meta = {
    description = "Zeek's Messaging Library";
-    mainProgram = "broker-benchmark";
    homepage = "https://github.com/zeek/broker";
    license = lib.licenses.bsd3;
    platforms = lib.platforms.unix;
--- a/pkgs/by-name/ze/zeek/fix-installation.patch
+++ b/pkgs/by-name/ze/zeek/fix-installation.patch
@@ -80,3 +80,24 @@ index 1ebe7c2..1435509 100644
 
 # A couple of configuration options that are needed are placed in here.
 configure_file(etc/zeekctl.cfg.in
+diff --git a/tools/systemd-generator/CMakeLists.txt b/tools/systemd-generator/CMakeLists.txt
+index 0e6a46f..031eb1f 100644
+--- a/tools/systemd-generator/CMakeLists.txt
+++ b/tools/systemd-generator/CMakeLists.txt
+@@ -14,6 +14,6 @@ if (NOT is_subproject)
+     set(_default_config_file "/usr/local/zeek/etc/zeek/zeek.conf")
+     set(_default_base_dir "/usr/local/zeek/")
+ else ()
+-    set(_default_config_file "${ZEEK_ETC_INSTALL_DIR}/zeek/zeek.conf")
+    set(_default_config_file "${ZEEK_ETC_INSTALL_DIR}/zeek.conf")
+     set(_default_base_dir "${CMAKE_INSTALL_PREFIX}")
+ endif ()
+@@ -49,7 +49,7 @@ if (ENABLE_ZEEK_SYSTEMD_GENERATOR)
+     if (is_subproject)
+         # Install a default configuration at <PREFXI>etc/default/zeek
+         include(InstallPackageConfigFile)
+         InstallPackageConfigFile(${CMAKE_CURRENT_SOURCE_DIR}/etc/zeek/zeek.conf
+-                                 ${ZEEK_ETC_INSTALL_DIR}/zeek zeek.conf)
+                                 ${CMAKE_INSTALL_PREFIX}/etc/zeek zeek.conf)
+     endif ()
+ endif ()
--- a/pkgs/by-name/ze/zeek/package.nix
+++ b/pkgs/by-name/ze/zeek/package.nix
@@ -4,6 +4,7 @@
  callPackage,
  fetchurl,
  cmake,
+  civetweb,
  flex,
  bison,
  openssl,
@@ -19,6 +20,7 @@
  gettext,
  coreutils,
  ncurses,
+  zeromq,
 }:

 let
@@ -30,11 +32,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "zeek";
-  version = "7.2.2";
+  version = "8.2.2";

  src = fetchurl {
    url = "https://download.zeek.org/zeek-${finalAttrs.version}.tar.gz";
-    hash = "sha256-Kx3ySPlBmaFoThxGDWTPHF5J10ccK1YvlCrF++mAWJM=";
+    hash = "sha256-o7bWDva+w+sSgY/jLK7HB/m21jBT6u7pQuTsmvZNhiw=";
  };

  strictDeps = true;
@@ -54,12 +56,14 @@ stdenv.mkDerivation (finalAttrs: {

  buildInputs = [
    broker
+    civetweb
    curl
    gperftools
    libmaxminddb
    libpcap
    ncurses
    openssl
+    zeromq
    zlib
    python
  ]
@@ -73,6 +77,12 @@ stdenv.mkDerivation (finalAttrs: {
  postPatch = ''
    patchShebangs ./ci/collect-repo-info.py
    patchShebangs ./auxil/spicy/scripts
+
+    # Broker statically includes prometheus-cpp, but uses nixpkgs' shared civetweb.
+    substituteInPlace cmake/FindPrometheusCpp.cmake \
+      --replace-fail \
+        '#set(zeekdeps ''${zeekdeps} prometheus-cpp::core prometheus-cpp::pull)' \
+        $'find_package(civetweb CONFIG REQUIRED)\nset(zeekdeps ''${zeekdeps} civetweb::civetweb-cpp)'
  '';

  cmakeFlags = [
--- a/pkgs/development/cuda-modules/packages/cudnn-frontend/package.nix
+++ b/pkgs/development/cuda-modules/packages/cudnn-frontend/package.nix
@@ -35,13 +35,13 @@ backendStdenv.mkDerivation (finalAttrs: {
  name = "${cudaNamePrefix}-${finalAttrs.pname}-${finalAttrs.version}";

  pname = "cudnn-frontend";
-  version = "1.28.0";
+  version = "1.29.0";

  src = fetchFromGitHub {
    owner = "NVIDIA";
    repo = "cudnn-frontend";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-oMsXgbLHhCnU+Q7bItzAPAN0U8LL4ZZCuXJwFKbJpEg=";
+    hash = "sha256-fCmsjglU4rSreN4249ZL/Y0dY0v8se1Jbani2UZT36g=";
  };

  # nlohmann_json should be the only vendored dependency.
--- a/pkgs/development/ocaml-modules/asn1-combinators/default.nix
+++ b/pkgs/development/ocaml-modules/asn1-combinators/default.nix
@@ -11,11 +11,11 @@ buildDunePackage (finalAttrs: {
  minimalOCamlVersion = "4.13.0";

  pname = "asn1-combinators";
-  version = "0.3.2";
+  version = "0.3.3";

  src = fetchurl {
    url = "https://github.com/mirleft/ocaml-asn1-combinators/releases/download/v${finalAttrs.version}/asn1-combinators-${finalAttrs.version}.tbz";
-    hash = "sha256-KyaYX24nIgc9zZ+ENVvWdX4SZDtaSOMLPAf/fPsNin8=";
+    hash = "sha256-9NFZqL2nw7GGpIAUSOh5zO0TZ5nGiuxR+zc85OEoSxE=";
  };

  propagatedBuildInputs = [ ptime ];
--- a/pkgs/development/ocaml-modules/http-mirage-client/default.nix
+++ b/pkgs/development/ocaml-modules/http-mirage-client/default.nix
@@ -14,15 +14,13 @@

 buildDunePackage (finalAttrs: {
  pname = "http-mirage-client";
-  version = "0.0.10";
-
-  minimalOCamlVersion = "4.08";
+  version = "0.0.11";

  __darwinAllowLocalNetworking = true;

  src = fetchurl {
    url = "https://github.com/robur-coop/http-mirage-client/releases/download/v${finalAttrs.version}/http-mirage-client-${finalAttrs.version}.tbz";
-    hash = "sha256-AXEIH1TIAayD4LkFv0yGD8OYvcdC/AJnGudGlkjcWLY=";
+    hash = "sha256-sNl/GvHATfLKymy5f91GUJkyjOgjpYIouuFntIzE+CM=";
  };

  propagatedBuildInputs = [
--- a/pkgs/development/ocaml-modules/jsont/default.nix
+++ b/pkgs/development/ocaml-modules/jsont/default.nix
@@ -1,6 +1,7 @@
 {
  lib,
  fetchzip,
+  ocaml,
  topkg,
  buildTopkgPackage,
  withBrr ? true,
@@ -9,35 +10,45 @@
  bytesrw,
  withCmdliner ? true,
  cmdliner,
+  withTypegist ? lib.versionAtLeast ocaml.version "5.5",
+  typegist,
 }:

 buildTopkgPackage rec {
  pname = "jsont";
-  version = "0.3.0";
+  version = "0.4.0";

  minimalOCamlVersion = "4.14.0";

  src = fetchzip {
    url = "https://erratique.ch/software/jsont/releases/jsont-${version}.tbz";
-    hash = "sha256-Gojblihb+So/0KpQHbIWuE33Ir2a4w5DdY+F3S9+qBk=";
+    hash = "sha256-2L7YaPXn4PzGl/3XwuwvpQTr4aiS85Hm1HNofuaK7DY=";
  };

  buildInputs = lib.optional withCmdliner cmdliner;

-  propagatedBuildInputs = lib.optional withBrr brr ++ lib.optional withBytesrw bytesrw;
+  propagatedBuildInputs =
+    lib.optional withBrr brr ++ lib.optional withBytesrw bytesrw ++ lib.optional withTypegist typegist;

-  buildPhase = "${topkg.run} build ${
-    lib.escapeShellArgs [
-      "--with-brr"
-      (lib.boolToString withBrr)
+  buildPhase = ''
+    runHook preBuild
+    ${topkg.run} build ${
+      lib.escapeShellArgs [
+        "--with-brr"
+        (lib.boolToString withBrr)

-      "--with-bytesrw"
-      (lib.boolToString withBytesrw)
+        "--with-bytesrw"
+        (lib.boolToString withBytesrw)

-      "--with-cmdliner"
-      (lib.boolToString withCmdliner)
-    ]
-  }";
+        "--with-cmdliner"
+        (lib.boolToString withCmdliner)
+
+        "--with-typegist"
+        (lib.boolToString withTypegist)
+      ]
+    }
+    runHook postBuild
+  '';

  meta = {
    description = "Declarative JSON data manipulation";
--- a/pkgs/development/ocaml-modules/typegist/default.nix
+++ b/pkgs/development/ocaml-modules/typegist/default.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  fetchzip,
+  topkg,
+  buildTopkgPackage,
+}:
+
+buildTopkgPackage rec {
+  pname = "typegist";
+  version = "0.0.0";
+
+  minimalOCamlVersion = "5.5.0";
+
+  src = fetchzip {
+    url = "https://erratique.ch/software/typegist/releases/typegist-${version}.tbz";
+    hash = "sha256-zt37VVZnlxvzw7idYw9v34rNiuJkWG37DqaqkzLDRXI=";
+  };
+
+  buildPhase = "${topkg.run} build";
+
+  doCheck = true;
+
+  meta = {
+    description = "The essence of OCaml types as values";
+    longDescription = ''
+      This dynamic type representation can be used to devise generic
+      type-indexed functions — value serializers, generators, differs, editors,
+      FFI glue, etc. Any accessible type can be described up to the limits
+      defined by its public interface.
+
+      Typegist does not model OCaml’s type language in full detail. It focuses
+      on a core structural subset decorated with typed-indexed metadata to
+      provide an ergonomic interface for both producers and processors of the
+      representation.
+    '';
+    homepage = "https://erratique.ch/software/typegist";
+    license = lib.licenses.isc;
+    maintainers = with lib.maintainers; [ toastal ];
+  };
+}
--- a/pkgs/development/python-modules/azure-mgmt-resource-deployments/default.nix
+++ b/pkgs/development/python-modules/azure-mgmt-resource-deployments/default.nix
@@ -12,13 +12,13 @@

 buildPythonPackage (finalAttrs: {
  pname = "azure-mgmt-resource-deployments";
-  version = "1.0.0";
+  version = "2.0.0";
  pyproject = true;

  src = fetchPypi {
    pname = "azure_mgmt_resource_deployments";
    inherit (finalAttrs) version;
-    hash = "sha256-uA8p9i4Ot9l642mp/Tz7ReCp12JmzctiwHkoDXlR0ss=";
+    hash = "sha256-8DnRSQgY0zcoD2OpFbulQHaytlabg/OSPNXF4vP8Q4c=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -358,13 +358,13 @@

 buildPythonPackage (finalAttrs: {
  pname = "boto3-stubs";
-  version = "1.43.93";
+  version = "1.43.94";
  pyproject = true;

  src = fetchPypi {
    pname = "boto3_stubs";
    inherit (finalAttrs) version;
-    hash = "sha256-e3TTrxAzcoDPatwmay9zPOG52SSLXvEq1XDYTt76uE0=";
+    hash = "sha256-XRc+9lUml+uhp50zgQaUB7J348Ko2XcfppgsJDcxzko=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/credsweeper/default.nix
+++ b/pkgs/development/python-modules/credsweeper/default.nix
@@ -1,19 +1,21 @@
 {
  lib,
  stdenv,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  hatchling,
+
+  # dependencies
  base58,
  beautifulsoup4,
  bech32,
  brotli,
-  buildPythonPackage,
  colorama,
  cryptography,
-  deepdiff,
-  fetchFromGitHub,
  gitpython,
-  hatchling,
  humanfriendly,
-  hypothesis,
  lxml,
  numpy,
  odfpy,
@@ -21,39 +23,43 @@
  openpyxl,
  pandas,
  pdfminer-six,
-  psutil,
  pybase62,
  pygments,
  pyjks,
  pysquashfsimage,
-  pytestCheckHook,
  python-dateutil,
  python-docx,
  python-pptx,
-  pythonOlder,
  pyxlsb,
  pyyaml,
  rpmfile,
  striprtf,
  tqdm,
-  versionCheckHook,
  whatthepatch,
  xlrd,
+  # python>=3.14 only:
  zstandard,
+
+  # tests
+  deepdiff,
+  hypothesis,
+  psutil,
+  pytestCheckHook,
+  pythonOlder,
+  versionCheckHook,
 }:

 buildPythonPackage (finalAttrs: {
  pname = "credsweeper";
-  version = "1.18.3";
+  version = "1.18.4";
  pyproject = true;
-
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "Samsung";
    repo = "CredSweeper";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-3PE/tf8GjDY6yakMuWCTcCVZMobiEx/o/QJQdJai4JY=";
+    hash = "sha256-1ElNvejQc5pzMvPJVjEyCkIY14M42W0ktNY83WKWk7A=";
  };

  build-system = [ hatchling ];
@@ -126,6 +132,7 @@ buildPythonPackage (finalAttrs: {
    "test_it_works_n"
    "test_log_n"
    "test_log_p"
+    "test_sqlite_injection_n"
  ];

  meta = {
--- a/pkgs/development/python-modules/daft/default.nix
+++ b/pkgs/development/python-modules/daft/default.nix
@@ -14,7 +14,6 @@
  nasm,

  # dependencies
-  fsspec,
  packaging,
  pyarrow,
  tqdm,
@@ -79,7 +78,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "daft";
-  version = "0.7.24";
+  version = "0.7.25";
  pyproject = true;
  __structuredAttrs = true;

@@ -87,7 +86,7 @@ buildPythonPackage (finalAttrs: {
    owner = "Eventual-Inc";
    repo = "Daft";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-HCqkeN9kmQTvzlPlweeE1nYPf2YjLep2RUUIFRXlGGw=";
+    hash = "sha256-XVtMB+fZ1zbFoStwlZmmam3/t8eD7vRop+7YlNhuLhs=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
@@ -143,11 +142,9 @@ buildPythonPackage (finalAttrs: {
  };

  pythonRelaxDeps = [
-    "fsspec"
    "tqdm"
  ];
  dependencies = [
-    fsspec
    packaging
    pyarrow
    tqdm
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "iamdata";
-  version = "0.1.202609141";
+  version = "0.1.202609151";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "cloud-copilot";
    repo = "iam-data-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-e8iqM4EHIV7BsQzSgauiPVdt2rouMxIcIpcVcjCMFQ8=";
+    hash = "sha256-PuEHycBvNed0vLi3W9FuLfgAPp7W9RSXG3TfWda1Z7A=";
  };

  __darwinAllowLocalNetworking = true;
--- a/pkgs/development/python-modules/ifcopenshell/boost-1.91-optional.patch
+++ b/pkgs/development/python-modules/ifcopenshell/boost-1.91-optional.patch
@@ -0,0 +1,38 @@
+boost 1.91 rewrote boost::optional and made its converting constructor
+unconditionally explicit, breaking aggregate brace-init of the radius
+member in the profile_point structs. std::optional (C++17) keeps the
+non-explicit converting constructor, so call sites compile unchanged.
+
+--- a/src/ifcgeom/profile_helper.h
+++ b/src/ifcgeom/profile_helper.h
+@@ -1,6 +1,8 @@
+ #ifndef PROFILE_HELPER_H
+ #define PROFILE_HELPER_H
+ 
+#include <optional>
+
+ #include "taxonomy.h"
+ 
+ namespace ifcopenshell {
+@@ -8,18 +10,18 @@
+ 	namespace geometry {
+ 		struct profile_point {
+ 			std::array<double, 2> xy;
+-			boost::optional<double> radius;
+			std::optional<double> radius;
+ 		};
+ 
+ 		struct profile_point_with_edges {
+ 			Eigen::Vector2d xy;
+-			boost::optional<double> radius;
+			std::optional<double> radius;
+ 			taxonomy::edge::ptr previous, next;
+ 		};
+ 
+ 		struct profile_point_with_edges_3d {
+ 			Eigen::Vector3d xy;
+-			boost::optional<double> radius;
+			std::optional<double> radius;
+ 			taxonomy::edge::ptr previous, next;
+ 		};
+ 
--- a/pkgs/development/python-modules/ifcopenshell/default.nix
+++ b/pkgs/development/python-modules/ifcopenshell/default.nix
@@ -75,6 +75,9 @@ buildPythonPackage rec {
      url = "https://github.com/IfcOpenShell/IfcOpenShell/commit/88b861737c7c206d0e7307f90d37467e9585515c.patch";
      hash = "sha256-zMoQcBWRdtavL0xdsr53SqyG6CZoeon8/mmJhrw85lc=";
    })
+
+    # boost 1.91 made boost::optional's converting constructor explicit
+    ./boost-1.91-optional.patch
  ];

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/jupyter-collaboration-ui/default.nix
+++ b/pkgs/development/python-modules/jupyter-collaboration-ui/default.nix
@@ -14,14 +14,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "jupyter-collaboration-ui";
-  version = "3.0.2";
+  version = "3.0.3";
  pyproject = true;
  __structuredAttrs = true;

  src = fetchPypi {
    pname = "jupyter_collaboration_ui";
    inherit (finalAttrs) version;
-    hash = "sha256-X2o6WEb5tAk6EYV212cx/fAa3SL7F5WmKyn9Pd/dExQ=";
+    hash = "sha256-rhzn916lgkn7K4E/9RCYYzU4ghWZv6DTeYKX/ZeA+X0=";
  };

  build-system = [
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -167,8 +167,8 @@ in
      "sha256-MOB/Ingh53OWXeT0YdKUGO3ExgPDe6N3WWe95m6twZY=";

  mypy-boto3-billingconductor =
-    buildMypyBoto3Package "billingconductor" "1.43.7"
-      "sha256-BWFbcDtacQzWwN0fc+OH/iSbsE3Lw0xAjn9V3/Lbxws=";
+    buildMypyBoto3Package "billingconductor" "1.43.94"
+      "sha256-IjuRZtPf62Ng1ZmBaSyOOAioNf2CNUKUMyB2im3gRNQ=";

  mypy-boto3-braket =
    buildMypyBoto3Package "braket" "1.43.0"
@@ -275,8 +275,8 @@ in
      "sha256-YnE8vRO1bzaGSCHM102N3ChinXrxj2/+vnHqst4pPbo=";

  mypy-boto3-codedeploy =
-    buildMypyBoto3Package "codedeploy" "1.43.82"
-      "sha256-WpKfZ0zeDn0qXnw98ATlOrBpyjWTx4YnGt11bNqVh84=";
+    buildMypyBoto3Package "codedeploy" "1.43.94"
+      "sha256-Ixx+vf5y9YZI+apS3rb80k5qMSU9mMZdhwK13Kvv9dg=";

  mypy-boto3-codeguru-reviewer =
    buildMypyBoto3Package "codeguru-reviewer" "1.43.0"
@@ -571,8 +571,8 @@ in
      "sha256-vMz4YKm78XMavlPUNiSVAYmAbyUBrJhUXbFrhxIvUJA=";

  mypy-boto3-glue =
-    buildMypyBoto3Package "glue" "1.43.72"
-      "sha256-RVRPMIAv+0iaJxpv/Xnj8dPt9HNIIOfPNe4yTQqspVI=";
+    buildMypyBoto3Package "glue" "1.43.94"
+      "sha256-sqiuAhdQg1wAwNjrMXz6KgOWNZQ5OLQ80J73omFgLaM=";
  mypy-boto3-grafana =
    buildMypyBoto3Package "grafana" "1.43.11"
      "sha256-XJOSLyL1+uEweZ9zER7IhH3DFLaLtpJKvuRIn8Ri+P4=";
@@ -610,8 +610,8 @@ in
      "sha256-9lzXp7Ug90MSZ7WdMiXoMnUiaAA9zCk/oS6gc0ulEMo=";

  mypy-boto3-imagebuilder =
-    buildMypyBoto3Package "imagebuilder" "1.43.37"
-      "sha256-6NLOcq8lrMDBgl+oaPrGSbPaHzObGq2vJYzPnNQFMCQ=";
+    buildMypyBoto3Package "imagebuilder" "1.43.94"
+      "sha256-2qbOe8e+74Ok8lBlkbAXFAuo8OKPeNDK+NltaoN/bxg=";

  mypy-boto3-importexport =
    buildMypyBoto3Package "importexport" "1.43.0"
@@ -1326,8 +1326,8 @@ in
      "sha256-Y3p6SUr/Ej8SiWm9Dk3ifaxF3vesKlCdglgIcoJDemk=";

  mypy-boto3-sts =
-    buildMypyBoto3Package "sts" "1.43.0"
-      "sha256-fDjP/Q8H/yJtC4AWYQv1+hm9b6KnWgTP3uy6LKvqikw=";
+    buildMypyBoto3Package "sts" "1.43.94"
+      "sha256-0WnjCd7s+Zy4qJfjRzNXH8qmBUR+Kbn2qMMiAsgmkM4=";

  mypy-boto3-support =
    buildMypyBoto3Package "support" "1.43.84"
--- a/pkgs/development/python-modules/nvidia-cudnn-frontend/default.nix
+++ b/pkgs/development/python-modules/nvidia-cudnn-frontend/default.nix
@@ -18,6 +18,10 @@
  # propagatedBuildInputs
  nlohmann_json,

+  # dependencies
+  apache-tvm-ffi,
+  nvidia-cutlass-dsl,
+
  # tests
  looseversion,
  pytestCheckHook,
@@ -74,6 +78,11 @@ buildPythonPackage.override { stdenv = cudaPackages.backendStdenv; } (finalAttrs
    nlohmann_json
  ];

+  dependencies = [
+    apache-tvm-ffi
+    nvidia-cutlass-dsl
+  ];
+
  pythonImportsCheck = [ "cudnn" ];

  # requires GPU
--- a/pkgs/development/python-modules/ofxclient/default.nix
+++ b/pkgs/development/python-modules/ofxclient/default.nix
@@ -1,43 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchPypi,
-  ofxhome,
-  ofxparse,
-  beautifulsoup4,
-  lxml,
-  keyring,
-}:
-
-buildPythonPackage rec {
-  version = "2.0.3";
-  format = "setuptools";
-  pname = "ofxclient";
-
-  src = fetchPypi {
-    inherit pname version;
-    sha256 = "0jdhqsbl34yn3n0x6mwsnl58c25v5lp6vr910c2hk7l74l5y7538";
-  };
-
-  patchPhase = ''
-    substituteInPlace setup.py --replace '"argparse",' ""
-  '';
-
-  # ImportError: No module named tests
-  doCheck = false;
-
-  propagatedBuildInputs = [
-    ofxhome
-    ofxparse
-    beautifulsoup4
-    lxml
-    keyring
-  ];
-
-  meta = {
-    homepage = "https://github.com/captin411/ofxclient";
-    description = "OFX client for downloading transactions from banks";
-    mainProgram = "ofxclient";
-    license = lib.licenses.mit;
-  };
-}
--- a/pkgs/development/python-modules/pydocket/default.nix
+++ b/pkgs/development/python-modules/pydocket/default.nix
@@ -25,7 +25,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "pydocket";
-  version = "0.25.0";
+  version = "0.25.2";
  pyproject = true;
  __structuredAttrs = true;

@@ -33,7 +33,7 @@ buildPythonPackage (finalAttrs: {
    owner = "chrisguidry";
    repo = "docket";
    tag = finalAttrs.version;
-    hash = "sha256-yVXWOoTGwIBeBmYZ6xW5SuQYzLXVNPPXZ/E2VBncivg=";
+    hash = "sha256-xiA4VHRDPv3iMil/MjFezAQCqw6rsR1nHj9fdBzHEQk=";
  };

  build-system = [
--- a/pkgs/development/python-modules/pydriller/default.nix
+++ b/pkgs/development/python-modules/pydriller/default.nix
@@ -12,17 +12,17 @@
  lizard,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "pydriller";
-  version = "2.11";
+  version = "2.12";
  pyproject = true;
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "ishepard";
    repo = "pydriller";
-    tag = version;
-    hash = "sha256-p4caHh95PnmWLC2fiSX8BCxfLymxSUUNIdxIWOc8O5w=";
+    tag = finalAttrs.version;
+    hash = "sha256-5zBb9z2+Hvkf/XdA9SOMcEQwcSE/r4jg9vW+mpPc5wM=";
  };

  build-system = [ setuptools ];
@@ -45,4 +45,4 @@ buildPythonPackage rec {
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ felbinger ];
  };
-}
+})
--- a/pkgs/development/python-modules/rich-click/default.nix
+++ b/pkgs/development/python-modules/rich-click/default.nix
@@ -1,23 +1,31 @@
 {
  lib,
  buildPythonPackage,
-  click,
  fetchFromGitHub,
-  rich,
+
+  # build-system
  setuptools,
+
+  # dependencies
+  click,
+  rich,
  typing-extensions,
+
+  # tests
+  versionCheckHook,
 }:

 buildPythonPackage (finalAttrs: {
  pname = "rich-click";
-  version = "1.9.8";
+  version = "1.9.9";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "ewels";
    repo = "rich-click";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-FjtwlWYFqI7vQ7JtpCtTIi90mbEkmHSKH8SROy9d+vU=";
+    hash = "sha256-vFwsaqgue5IKBnBeHMa4jXFPqT7kI/WT0NieaAgtUjM=";
  };

  build-system = [ setuptools ];
@@ -28,8 +36,10 @@ buildPythonPackage (finalAttrs: {
    typing-extensions
  ];

-  # Module has no test
-  doCheck = false;
+  # No python tests
+  nativeCheckInputs = [
+    versionCheckHook
+  ];

  pythonImportsCheck = [ "rich_click" ];

--- a/pkgs/development/python-modules/splunk-sdk/default.nix
+++ b/pkgs/development/python-modules/splunk-sdk/default.nix
@@ -6,16 +6,16 @@
  deprecation,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "splunk-sdk";
-  version = "3.0.0";
+  version = "3.0.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "splunk";
    repo = "splunk-sdk-python";
-    tag = version;
-    hash = "sha256-8544jRlv//Qkcq4JqrMOBZhFC6K6BI1WGT6PK4AwVvs=";
+    tag = finalAttrs.version;
+    hash = "sha256-wVndu+f7+6hWSnNZSZatTVuRxjZDA8o9MKMB3QzEOZQ=";
  };

  build-system = [ setuptools ];
@@ -27,8 +27,8 @@ buildPythonPackage rec {
  meta = {
    description = "Splunk Enterprise Software Development Kit (SDK) for Python";
    homepage = "https://github.com/splunk/splunk-sdk-python";
-    changelog = "https://github.com/splunk/splunk-sdk-python/releases/tag/${version}";
+    changelog = "https://github.com/splunk/splunk-sdk-python/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ levigross ];
  };
-}
+})
--- a/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
+++ b/pkgs/development/python-modules/tencentcloud-sdk-python/default.nix
@@ -9,14 +9,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "tencentcloud-sdk-python";
-  version = "3.1.175";
+  version = "3.1.176";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "TencentCloud";
    repo = "tencentcloud-sdk-python";
    tag = finalAttrs.version;
-    hash = "sha256-9XSmcieq0+U3TJPvXWZBfwag4WfyFrHQtJYWaOCaRww=";
+    hash = "sha256-dt4o3ePCcbNEpk98dmmDi1vMZV4d51EK+B1xDAzsf2w=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/textual-fastdatatable/default.nix
+++ b/pkgs/development/python-modules/textual-fastdatatable/default.nix
@@ -22,7 +22,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "textual-fastdatatable";
-  version = "0.19.1";
+  version = "0.19.2";
  pyproject = true;
  __structuredAttrs = true;

@@ -30,7 +30,7 @@ buildPythonPackage (finalAttrs: {
    owner = "tconbeer";
    repo = "textual-fastdatatable";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-dFKeeV3/ux5YhnkjwLJbbHr1Mms3EGcG3+ybJXxcdCI=";
+    hash = "sha256-buOgvDFzK6wRrzm7AvT7BFFzHbCNEqX3OVsFS1FyJio=";
  };

  build-system = [ hatchling ];
--- a/pkgs/servers/sql/postgresql/ext/pgrouting.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgrouting.nix
@@ -10,7 +10,7 @@

 postgresqlBuildExtension (finalAttrs: {
  pname = "pgrouting";
-  version = "4.0.1";
+  version = "4.0.2";

  nativeBuildInputs = [
    cmake
@@ -22,7 +22,7 @@ postgresqlBuildExtension (finalAttrs: {
    owner = "pgRouting";
    repo = "pgrouting";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-j3dlVcENhBveVmkuzWaLfHWy73OMDpC2FxrNQ4W6m9k=";
+    hash = "sha256-bETj/tG9O0kymTeJM9YlXzMPcBeegxnYQH/tMQsuXtY=";
  };

  meta = {
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1310,6 +1310,7 @@ mapAliases {
  leaf = throw "'leaf' has been removed as it is unmaintained. Consider using 'fastfetch' instead"; # Added 2026-04-24
  leafnode = throw "'leafnode' has been removed as it is unmaintained and depends on EOL library PCRE. Consider using leafnode1 instead"; # Added 2026-07-30
  ledger-agent = throw "ledger-agent has been removed because upstream dropped Ledger support"; # Added 2026-03-11
+  ledger-autosync = throw "ledger-autosync has been removed because ofxclient was dropped"; # Added 2026-08-14
  ledger_agent = throw "ledger-agent has been removed because upstream dropped Ledger support"; # Added 2026-03-11
  lepton = throw "'lepton' has been removed as it is archived upstream and has known vulnerabilities (CVE-2022-4104). Consider using 'lepton-jpeg-util' instead"; # Added 2026-06-29
  lesstif = throw "'lesstif' has been removed due to its being broken and unmaintained upstream. Consider using 'motif' instead."; # Added 2025-06-09
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -2204,6 +2204,8 @@ let

        twt = callPackage ../development/ocaml-modules/twt { };

+        typegist = callPackage ../development/ocaml-modules/typegist { };
+
        type_eq = callPackage ../development/ocaml-modules/type_eq { };

        type_id = callPackage ../development/ocaml-modules/type_id { };
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -457,6 +457,7 @@ mapAliases {
  oauth = throw "oauth has been removed as it is unmaintained"; # added 2025-05-16
  objax = throw "objax has been removed because the upstream project was archived."; # Added 2025-10-04
  ocrmypdf_16 = throw "'ocrmypdf_16' was removed because paperless-ngx no longer uses it"; # Added 2026-07-23
+  ofxclient = throw "ofxclient has been removed as upstream has been unmaintained for 6 years"; # Added 2025-08-26
  openai-triton = throw "'openai-triton' has been renamed to/replaced by 'triton'"; # Converted to throw 2025-10-29
  openai-triton-bin = throw "'openai-triton-bin' has been renamed to/replaced by 'triton-bin'"; # Converted to throw 2025-10-29
  openai-triton-cuda = throw "'openai-triton-cuda' has been renamed to/replaced by 'triton-cuda'"; # Converted to throw 2025-10-29
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -12389,8 +12389,6 @@ self: super: with self; {

  offtrac = callPackage ../development/python-modules/offtrac { };

-  ofxclient = callPackage ../development/python-modules/ofxclient { };
-
  ofxhome = callPackage ../development/python-modules/ofxhome { };

  ofxparse = callPackage ../development/python-modules/ofxparse { };