Merge master into staging-next

2026-07-18 14:41:18 +00:00 · 2026-07-11 12:19:24 +00:00
parent b74f0ab33c 83b85e6a2c
commit 85ea91b158
60 changed files with 324 additions and 186 deletions
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -24,6 +24,8 @@

 - [tranquil](https://tangled.org/tranquil.farm/tranquil-pds) is an ATProto PDS (personal data server) implementation in Rust. A featureful, spec conscious and community driven alternative to the Bluesky reference implementation PDS. Available as [services.tranquil-pds](#opt-services.tranquil-pds.enable).

+- [Moonlight Qt](https://moonlight-stream.org/), a client for playing your PC games on almost any device. Available as [programs.moonlight-qt](#opt-programs.moonlight-qt.enable).
+
 - [scx_loader](https://github.com/sched-ext/scx-loader), a system daemon and DBus-based loader for sched_ext schedulers. `scxctl` is the command-line client for interacting with the loader, allowing users to switch schedulers, modes, and arguments dynamically. Available as [services.scx-loader](#opt-services.scx-loader.enable)

 - [tap](https://github.com/bluesky-social/indigo/tree/main/cmd/tap), an ATProtocol firehose synchronisation utility. Available as [services.tap](#opt-services.tap.enable).
@@ -121,6 +123,8 @@

 - `security.polkit.settings` added for RFC42 style configuration of the polkitd daemon.

+- `boot.supportedFilesystems.ntfs` installs `ntfsprogs-plus` instead of `ntfs3g` on kernel version 7.1 and later, unless `boot.supportedFilesystems.ntfs-3g` is explicitly enabled.
+
 - The `programs.fuse` module, which provides the `fusermount3` executable and the `/etc/fuse.conf` config file, is now opt-in. The obligation to enable it has been shifted to its various consumers (e.g. gvfs, flatpak, appimage, sshfs). This can break fuse consumers at runtime, that don't explicitly declare that dependency with a module, e.g the mounting functionality in various backup tools (borg, restic, rclone, ...).

 - `services.plausible` can now again seed an initial admin user declaratively via [`services.plausible.adminUser.email`](#opt-services.plausible.adminUser.email).
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -268,6 +268,7 @@
  ./programs/mininet.nix
  ./programs/minipro.nix
  ./programs/miriway.nix
+  ./programs/moonlight-qt.nix
  ./programs/mosh.nix
  ./programs/mouse-actions.nix
  ./programs/msmtp.nix
--- a/nixos/modules/programs/moonlight-qt.nix
+++ b/nixos/modules/programs/moonlight-qt.nix
@@ -0,0 +1,39 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.programs.moonlight-qt;
+in
+{
+  options.programs.moonlight-qt = {
+    enable = lib.mkEnableOption "Moonlight Qt, a client for playing your PC games on almost any device";
+
+    package = lib.mkPackageOption pkgs "moonlight-qt" { };
+
+    capSysNice = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Add the CAP_SYS_NICE capability to Moonlight Qt so that it may raise
+        its scheduling priority.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ cfg.package ];
+
+    security.wrappers.moonlight = lib.mkIf cfg.capSysNice {
+      owner = "root";
+      group = "root";
+      source = lib.getExe cfg.package;
+      capabilities = "cap_sys_nice+ep";
+    };
+  };
+
+  meta.maintainers = with lib.maintainers; [ aaravrav ];
+}
--- a/nixos/modules/tasks/filesystems/ntfs.nix
+++ b/nixos/modules/tasks/filesystems/ntfs.nix
@@ -4,15 +4,24 @@
  pkgs,
  ...
 }:
-
-with lib;
-
+let
+  ntfsEnabled = config.boot.supportedFilesystems.ntfs or false;
+  ntfs3gEnabled = config.boot.supportedFilesystems.ntfs-3g or false;
+  ntfsPlusSupported = config.boot.kernelPackages.kernelAtLeast "7.1";
+  initrdSupport = config.boot.initrd.supportedFilesystems.ntfs or false;
+in
 {
-  config =
-    mkIf (config.boot.supportedFilesystems.ntfs or config.boot.supportedFilesystems.ntfs-3g or false)
-      {
+  config = lib.mkMerge [
+    (lib.mkIf (ntfsEnabled && ntfsPlusSupported && !ntfs3gEnabled) {
+      system.fsPackages = [ pkgs.ntfsprogs-plus ];

-        system.fsPackages = [ pkgs.ntfs3g ];
+      boot.initrd.availableKernelModules = lib.optionals initrdSupport [ "ntfs" ];
+    })

-      };
+    (lib.mkIf (ntfs3gEnabled || (ntfsEnabled && !ntfsPlusSupported)) {
+      system.fsPackages = [ pkgs.ntfs3g ];
+
+      boot.initrd.availableKernelModules = lib.optionals initrdSupport [ "ntfs3" ];
+    })
+  ];
 }
--- a/nixos/tests/sunshine.nix
+++ b/nixos/tests/sunshine.nix
@@ -40,9 +40,10 @@
        ./common/x11.nix
      ];

-      environment.systemPackages = with pkgs; [
-        moonlight-qt
-      ];
+      programs.moonlight-qt = {
+        enable = true;
+        capSysNice = true;
+      };

    };

@@ -52,6 +53,7 @@
    # start the tests, wait for sunshine to be up
    start_all()
    sunshine.wait_for_open_port(48010,"localhost")
+    moonlight.succeed("${pkgs.libcap}/bin/getcap \"$(command -v moonlight)\" | grep -q 'cap_sys_nice'")

    # set the admin username/password, restart sunshine
    sunshine.execute("sunshine --creds sunshine sunshine")
--- a/pkgs/applications/editors/emacs/elisp-packages/manual-packages/copilot/package.nix
+++ b/pkgs/applications/editors/emacs/elisp-packages/manual-packages/copilot/package.nix
@@ -12,13 +12,13 @@
 }:
 melpaBuild (finalAttrs: {
  pname = "copilot";
-  version = "0.6.0";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "copilot-emacs";
    repo = "copilot.el";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-l4TR3mk72j2VRN8s6DmlT+I5Ii2FgPEG62KKHql40L8=";
+    sha256 = "sha256-x2Lzhz8Yi3/EsahkJZ/pJoaJuVb1xIHgNt50qi0ndeo=";
  };

  files = ''(:defaults "dist")'';
--- a/pkgs/by-name/ad/adrs/package.nix
+++ b/pkgs/by-name/ad/adrs/package.nix
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "adrs";
-  version = "0.8.0";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "joshrotenberg";
    repo = "adrs";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-OXym/S88/y4UNp/BqV6RJb3EBV/TeqYCRHYlZJehur4=";
+    hash = "sha256-vs7EtIfyfBsXQQKPUKnJlAfUIuj+b17alDBT1WgH8xc=";
  };

-  cargoHash = "sha256-gv/A2t0BjDsDySLOkUY8YIRS2tciRU8sbmjXdgSBiwE=";
+  cargoHash = "sha256-8iDb6DNBCJkjKORIOLZQNPthMLSHC0Lfd6vo9+HIkS4=";

  meta = {
    description = "Command-line tool for managing Architectural Decision Records";
--- a/pkgs/applications/graphics/apngasm/default.nix
+++ b/pkgs/applications/graphics/apngasm/default.nix
--- a/pkgs/applications/graphics/apngasm/2.nix
+++ b/pkgs/applications/graphics/apngasm/2.nix
@@ -30,7 +30,9 @@ stdenv.mkDerivation rec {
  env.NIX_CFLAGS_LINK = "-lzopfli";

  installPhase = ''
+    runHook preInstall
    install -Dt $out/bin apngasm
+    runHook postInstall
  '';

  enableParallelBuilding = true;
--- a/pkgs/by-name/bo/bottom/package.nix
+++ b/pkgs/by-name/bo/bottom/package.nix
@@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "bottom";
-  version = "0.14.3";
+  version = "0.14.4";

  src = fetchFromGitHub {
    owner = "ClementTsang";
    repo = "bottom";
    tag = finalAttrs.version;
-    hash = "sha256-DJ1Vw1YG4CXhXUwFh2pGyH6lqLw1oHG18AEXlC4xvZk=";
+    hash = "sha256-axzZEviUVosXo5XzQB32A2+sUdiLzEtjZg52Z6hp4lM=";
  };

-  cargoHash = "sha256-SUR1O5Sm3CFxjkxkPWih7gnvf7L04D+x5SUFXvA/KgQ=";
+  cargoHash = "sha256-RUFlv95VoRhfHeIXWFWWtbwn71uJnEYoi2NozU4ybK8=";

  nativeBuildInputs = [
    autoAddDriverRunpath
--- a/pkgs/by-name/br/bruno/package.nix
+++ b/pkgs/by-name/br/bruno/package.nix
@@ -21,13 +21,13 @@

 buildNpmPackage rec {
  pname = "bruno";
-  version = "3.5.0";
+  version = "3.5.1";

  src = fetchFromGitHub {
    owner = "usebruno";
    repo = "bruno";
    tag = "v${version}";
-    hash = "sha256-Vdd/z3xYuU8axfEfuDOKPTfV0xiZXJ15G5z16VoGYLQ=";
+    hash = "sha256-ud1zdA38k5RW6qlmPQGnkYUIHOhiHNYWmlXbEzJsIUk=";

    postFetch = ''
      ${lib.getExe npm-lockfile-fix} $out/package-lock.json
--- a/pkgs/by-name/ch/chhoto-url/package.nix
+++ b/pkgs/by-name/ch/chhoto-url/package.nix
@@ -8,13 +8,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "chhoto-url";
-  version = "7.4.1";
+  version = "7.4.10";

  src = fetchFromGitHub {
    owner = "SinTan1729";
    repo = "chhoto-url";
    tag = finalAttrs.version;
-    hash = "sha256-1kPXsN5gOfY8JyaV6J5X2cEH00Xm06nsU5GNuVDxBJo=";
+    hash = "sha256-iZQFH+WoGu91DJT7X8FTs1qktf/SSrh6F9U4/OQWZiI=";
    fetchLFS = true;
  };

@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      --replace-fail 'rust-version = "1.96"' 'rust-version = "1.95"'
  '';

-  cargoHash = "sha256-H3HrHu1y8wIc0j3cCIPOUnFe1jzpx1vCSfZvushIf70=";
+  cargoHash = "sha256-1q5WWNnqDILgDbd9Wztvm0pYDDtaufqOxixwHb4VifY=";

  postInstall = ''
    mkdir -p $out/share/chhoto-url
--- a/pkgs/by-name/cl/cloudlog/package.nix
+++ b/pkgs/by-name/cl/cloudlog/package.nix
@@ -9,13 +9,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "cloudlog";
-  version = "2.8.14";
+  version = "2.8.15";

  src = fetchFromGitHub {
    owner = "magicbug";
    repo = "Cloudlog";
    rev = version;
-    hash = "sha256-036wo8QiRoqiMNj7ag/txfecxITb1aPI4YydWc9N/yA=";
+    hash = "sha256-WkOe1Y1pmyAqRfEy7PigiBGscfIJemqcEYTqvpNnwsc=";
  };

  postPatch = ''
--- a/pkgs/by-name/dr/drupal/package.nix
+++ b/pkgs/by-name/dr/drupal/package.nix
@@ -8,18 +8,18 @@

 php.buildComposerProject2 (finalAttrs: {
  pname = "drupal";
-  version = "11.4.0";
+  version = "11.4.2";

  src = fetchFromGitLab {
    domain = "git.drupalcode.org";
    owner = "project";
    repo = "drupal";
    tag = finalAttrs.version;
-    hash = "sha256-om+WoR+uIGhHjttWpavBx3PJ4HUft4Hjtrr4F3csBsI=";
+    hash = "sha256-GHhavn9H1x7xo72r9KSOSkrOzW4jEBAe033m2ATeh2E=";
  };

  composerNoPlugins = false;
-  vendorHash = "sha256-9MQ6C0gslubUlDeUSI5Tv4jO9SbxPzciOjry0KB7plI=";
+  vendorHash = "sha256-1Qns0npuzdVONtkDk3tXlGib9VCnbM6zVOVIsMRfZks=";

  passthru = {
    tests = {
--- a/pkgs/by-name/fr/frigate/package.nix
+++ b/pkgs/by-name/fr/frigate/package.nix
@@ -29,8 +29,8 @@ let
    inherit version src;
  };

-  python = python313Packages.python.override {
-    packageOverrides = self: super: {
+  python3Packages = python313Packages.overrideScope (
+    self: super: {
      joserfc = super.joserfc.overridePythonAttrs (oldAttrs: {
        version = "1.1.0";
        src = fetchFromGitHub {
@@ -43,9 +43,10 @@ let

      huggingface-hub = super.huggingface-hub_0;
      transformers = super.transformers_4;
-    };
-  };
-  python3Packages = python.pkgs;
+    }
+  );
+
+  inherit (python3Packages) python;

  # Tensorflow audio model
  # https://github.com/blakeblackshear/frigate/blob/v0.15.0/docker/main/Dockerfile#L125
@@ -101,6 +102,9 @@ python3Packages.buildPythonApplication rec {
    # Fix excessive trailing whitespaces in process commandlines
    # https://github.com/blakeblackshear/frigate/pull/22089
    ./proc-cmdline-strip.patch
+
+    # Fix more granular dtype resultion in Pandas 3.0
+    ./pandas3-compat.patch
  ];

  postPatch = ''
--- a/pkgs/by-name/fr/frigate/pandas3-compat.patch
+++ b/pkgs/by-name/fr/frigate/pandas3-compat.patch
@@ -0,0 +1,13 @@
+diff --git a/frigate/api/review.py b/frigate/api/review.py
+index 76619dcb2..f72c0efc3 100644
+--- a/frigate/api/review.py
+++ b/frigate/api/review.py
+@@ -660,7 +660,7 @@ def motion_activity(
+             df.iloc[i : i + chunk, 0] = 0.0
+ 
+     # change types for output
+-    df.index = df.index.astype(int) // (10**9)
+    df.index = df.index.as_unit("s").astype("int64")
+     normalized = df.reset_index().to_dict("records")
+     return JSONResponse(content=normalized)
+ 
--- a/pkgs/by-name/ja/jackett/package.nix
+++ b/pkgs/by-name/ja/jackett/package.nix
@@ -12,13 +12,13 @@

 buildDotnetModule (finalAttrs: {
  pname = "jackett";
-  version = "0.24.2151";
+  version = "0.24.2200";

  src = fetchFromGitHub {
    owner = "jackett";
    repo = "jackett";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-V4oBku723EWLTBBjFVkAJTBdhXYTs3Vx98YDinTr5Kc=";
+    hash = "sha256-hmgv17zju1BnT6eapTUhY+3Do/lr2+Cu/ejlU0/vF/I=";
  };

  projectFile = "src/Jackett.Server/Jackett.Server.csproj";
--- a/pkgs/by-name/li/lintspec/package.nix
+++ b/pkgs/by-name/li/lintspec/package.nix
@@ -8,17 +8,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "lintspec";
-  version = "0.17.0";
+  version = "0.18.0";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "beeb";
    repo = "lintspec";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-iIanf/lQRD+JZEa9jAa4JNATJq2EYoKoiA4dOmXxgtY=";
+    hash = "sha256-CPyMP/UGP2PJ9tjNT0Ytj7jnA4BFBIXw3ZT1NHfKGAA=";
  };

-  cargoHash = "sha256-+Hi9vciLSeIijTH3tCKMv2USTYrWzfuTUaxSOW0hi4g=";
+  cargoHash = "sha256-WMe9/7rk6tkpWQ7hezHTAoyvCE6Oo66RAfhz7NpT7JM=";
  cargoBuildFlags = [
    "--package"
    "lintspec"
--- a/pkgs/by-name/li/livekit-cli/package.nix
+++ b/pkgs/by-name/li/livekit-cli/package.nix
@@ -10,16 +10,16 @@

 buildGoModule (finalAttrs: {
  pname = "livekit-cli";
-  version = "2.16.7";
+  version = "2.17.0";

  src = fetchFromGitHub {
    owner = "livekit";
    repo = "livekit-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-flb0gX2mt4dAtB6f9G2i/bkelMc0bKuDOrgNw02icrw=";
+    hash = "sha256-l8RXYwLRrnekNeIocRQPBLCqMscMwKlWrVmts7Ce2EI=";
  };

-  vendorHash = "sha256-0Fdj4j0PoW2MubnxOfnV9qUg0bv1g9aioVmNxikE9Oo=";
+  vendorHash = "sha256-gfiWS6hWqe4eqmKGiYYGeSaygCGhhgSzgp0eicTwSa8=";

  # Use nixpkgs portaudio package + pkg-config rather than relying on a vendored
  # git submodule, similar to the homebrew solution
--- a/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
+++ b/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
@@ -14,19 +14,19 @@

 python3Packages.buildPythonApplication rec {
  pname = "matrix-synapse";
-  version = "1.155.0";
+  version = "1.156.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "element-hq";
    repo = "synapse";
    rev = "v${version}";
-    hash = "sha256-ka92mJvm/7PaENPkQRWuw8c8BdzMvIuTsc3xSEmEms8=";
+    hash = "sha256-x3EVmNPqcxtvt6ZaPsDCCcr7Z0LIO257s2gO3HCNmKA=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit pname version src;
-    hash = "sha256-+Z2GyHlVothtcTKHjbr+iKQG8wi5tgtoZr8+FHYJEFk=";
+    hash = "sha256-N/JWRFz9OKcxigjp86AVVZGK63MdZmEzwHhBgBuWZcY=";
  };

  build-system =
--- a/pkgs/by-name/oc/oci-cli/package.nix
+++ b/pkgs/by-name/oc/oci-cli/package.nix
@@ -31,14 +31,14 @@ in

 py.pkgs.buildPythonApplication (finalAttrs: {
  pname = "oci-cli";
-  version = "3.89.0";
+  version = "3.89.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "oracle";
    repo = "oci-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-VnELp2RWpbES13AYXdZviobXtpV0OI7ptvdkghwUm9c=";
+    hash = "sha256-9sr+7zFP7THy39XWWI8bC2Th9e2t6zwfjbBkyajvOHM=";
  };

  nativeBuildInputs = [ installShellFiles ];
--- a/pkgs/by-name/oh/oha/package.nix
+++ b/pkgs/by-name/oh/oha/package.nix
@@ -13,16 +13,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "oha";
-  version = "1.14.0";
+  version = "1.15.0";

  src = fetchFromGitHub {
    owner = "hatoo";
    repo = "oha";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-N6XHnglCn7MwSaMLy8qNUBXf23EJEuh6xn92SgNJgQs=";
+    hash = "sha256-WkV4tiDjaFy0fttR7HhhqxWF2VggQfdNMLIZzxjTCOA=";
  };

-  cargoHash = "sha256-Tg30RKcaLDWvSW0Ny34kPEZpIWnjILO+yO6kqz2wyQk=";
+  cargoHash = "sha256-KZZKV5DXABfgjXRc+BhO0AGONaKxoCNKYxTnupzvZV0=";

  env = {
    CARGO_PROFILE_RELEASE_LTO = "fat";
--- a/pkgs/by-name/pd/pdfding/frontend.nix
+++ b/pkgs/by-name/pd/pdfding/frontend.nix
@@ -4,9 +4,7 @@
  fetchzip,
  npmHooks,

-  tailwindcss_4,
  nodejs,
-
  pdfding,
 }:
 let
@@ -39,8 +37,6 @@ stdenv.mkDerivation (finalAttrs: {
  nativeBuildInputs = [
    nodejs
    npmHooks.npmConfigHook
-    # it is in package.json and thus node_modules but no cli executable
-    tailwindcss_4
  ];

  strictDeps = true;
@@ -53,7 +49,12 @@ stdenv.mkDerivation (finalAttrs: {
    cp -r --no-preserve=mode pdfding/static $out/pdfding/static
    cp -r --no-preserve=mode ${finalAttrs.passthru.pdfjs} $out/pdfding/static/pdfjs

-    tailwindcss -i $out/pdfding/static/css/input.css -o $out/pdfding/static/css/tailwind.css --minify
+    # NOTE: Directly using tailwindcss package from nixpkgs gave a `Trace/BPT trap: 5` error on darwin
+    # Trace/BPT trap: 5 tailwindcss -i $out/pdfding/static/css/input.css -o $out/pdfding/static/css/tailwind.css --minify
+    # It didn't occur when building the package in an interactive ssh session but on nixpkgs-review-gha it failed consistently
+    # https://github.com/NixOS/nixpkgs/pull/540436#issuecomment-4942029413
+
+    node node_modules/@tailwindcss/cli/dist/index.mjs -i pdfding/static/css/input.css -o $out/pdfding/static/css/tailwind.css --minify
    rm $out/pdfding/static/css/input.css

    for i in build/pdf.mjs build/pdf.sandbox.mjs build/pdf.worker.mjs web/viewer.mjs;
--- a/pkgs/by-name/re/readest/package.nix
+++ b/pkgs/by-name/re/readest/package.nix
@@ -23,13 +23,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "readest";
-  version = "0.11.17";
+  version = "0.11.18";

  src = fetchFromGitHub {
    owner = "readest";
    repo = "readest";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-vueP/UGu1G+DnwqJ7GhcYIxIsyTeFGYIiz7Iu0fs3NA=";
+    hash = "sha256-ate2vEYdE121wy3WUautpbIzfejbcaBZr/CnA6rf2Zw=";
    fetchSubmodules = true;
  };

@@ -59,7 +59,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  };

  cargoRoot = "../..";
-  cargoHash = "sha256-QxsiYl7mG+kS35pcU8/WLQA+f3gepe7qrHelhUzONbY=";
+  cargoHash = "sha256-RgqkTttEScAp1R+CWE1ItD5yCDMtJ5tb3fjgkMi3x9E=";

  buildAndTestSubdir = "src-tauri";

--- a/pkgs/by-name/ru/rumdl/package.nix
+++ b/pkgs/by-name/ru/rumdl/package.nix
@@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rumdl";
-  version = "0.2.27";
+  version = "0.2.30";

  src = fetchFromGitHub {
    owner = "rvben";
    repo = "rumdl";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-sKw4BUPXMBjdKVuu0R707A44t+TzzFvo0DTDgkySMpo=";
+    hash = "sha256-P+mqXeafWRtaaNKPAlAP5zjmzP51PazMAvWL0FZK7jk=";
  };

-  cargoHash = "sha256-YHk0IirDoDR9R/qgR8CT8zcgQuBlM+qlsy3Xy7GDBCg=";
+  cargoHash = "sha256-SAmjBtRokZ9Qkz1DMXy1MZ2MCidXgWaMfhdTYXbLBQU=";

  cargoBuildFlags = [
    "--bin=rumdl"
--- a/pkgs/applications/graphics/scantailor/advanced.nix
+++ b/pkgs/applications/graphics/scantailor/advanced.nix
--- a/pkgs/applications/graphics/scantailor/universal.nix
+++ b/pkgs/applications/graphics/scantailor/universal.nix
--- a/pkgs/by-name/sc/scipopt-papilo/package.nix
+++ b/pkgs/by-name/sc/scipopt-papilo/package.nix
@@ -12,13 +12,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "scipopt-papilo";
-  version = "3.0.0";
+  version = "3.0.1";

  src = fetchFromGitHub {
    owner = "scipopt";
    repo = "papilo";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-oxuXv/xWQiApxrrVdH3aEUOp40Em6kCz/DJXXpCxdzs=";
+    hash = "sha256-YDaahgsE7NqTNE1WvkSp5DwyvfJrP19IcytTkM8VKZo=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/sc/scipopt-scip/package.nix
+++ b/pkgs/by-name/sc/scipopt-scip/package.nix
@@ -20,13 +20,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "scipopt-scip";
-  version = "10.0.2";
+  version = "10.0.3";

  src = fetchFromGitHub {
    owner = "scipopt";
    repo = "scip";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-8R9/6dTsTIcvp2pYWXlTh7WuzlotJb+y5hJpzY+r1pc=";
+    hash = "sha256-dR2H18xLbLko3AQMiEwAL5mzLYcUD9U9g3AjWDT5Kz8=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/st/starship/package.nix
+++ b/pkgs/by-name/st/starship/package.nix
@@ -3,6 +3,7 @@
  stdenv,
  fetchFromGitHub,
  rustPlatform,
+  llvmPackages,
  installShellFiles,
  writableTmpDirAsHomeHook,
  gitMinimal,
@@ -22,13 +23,24 @@ rustPlatform.buildRustPackage (finalAttrs: {
    hash = "sha256-pStNE8SMMVavL3ld6RO+5QQRJPXpqlU3asccS2tUoMQ=";
  };

-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [
+    installShellFiles
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [ llvmPackages.lld ];

  buildInputs = lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64) [
    writableTmpDirAsHomeHook
  ];

-  env.TZDIR = "${tzdata}/share/zoneinfo";
+  env = {
+    TZDIR = "${tzdata}/share/zoneinfo";
+  }
+  // lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    # Work around ld64's libc++ hardening issue.
+    #
+    # TODO: Remove once #536365 reaches this branch.
+    NIX_CFLAGS_LINK = "-fuse-ld=lld";
+  };

  postInstall = ''
    presetdir=$out/share/starship/presets/
--- a/pkgs/by-name/su/subcat/package.nix
+++ b/pkgs/by-name/su/subcat/package.nix
@@ -6,7 +6,7 @@

 python3.pkgs.buildPythonApplication {
  pname = "subcat";
-  version = "1.6.0-unstable-2026-06-28";
+  version = "1.6.0";
  pyproject = true;

  src = fetchFromGitHub {
--- a/pkgs/by-name/su/super-productivity/package.nix
+++ b/pkgs/by-name/su/super-productivity/package.nix
@@ -20,7 +20,7 @@ let
 in
 buildNpmPackage rec {
  pname = "super-productivity";
-  version = "18.12.1";
+  version = "18.13.1";

  inherit nodejs;

@@ -28,7 +28,7 @@ buildNpmPackage rec {
    owner = "johannesjo";
    repo = "super-productivity";
    tag = "v${version}";
-    hash = "sha256-19wMmVKHnnSUsu2xOplNY3HeDhoOdFgX05I5XKTwRhM=";
+    hash = "sha256-gfoGGLJ2Pyl2BPcCAukk2eNPTsGYofT2G6a9FmlDwTE=";
  };

  # Use custom fetcher for deps because super-productivity uses multiple
@@ -74,7 +74,7 @@ buildNpmPackage rec {
      dontInstall = true;

      outputHashMode = "recursive";
-      hash = "sha256-MBlILswZWTpfjHxazTyH72vYUrJ/9ZD3Kdcix/yFNJ0=";
+      hash = "sha256-staJsDxwcF2TC+Y8wr9iaq7TmfQVG3ZIQh17UTCP/9I=";
    }
  );

--- a/pkgs/by-name/ti/timoni/package.nix
+++ b/pkgs/by-name/ti/timoni/package.nix
@@ -10,16 +10,16 @@

 buildGoModule (finalAttrs: {
  pname = "timoni";
-  version = "0.26.0";
+  version = "0.27.0";

  src = fetchFromGitHub {
    owner = "stefanprodan";
    repo = "timoni";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-KdUFIGbP6tG7LVYUJFhVtgSfc1FSjlNOLCc+kQqGP4A=";
+    hash = "sha256-MCqpap94d1+4TJmn7JgYcNgZaqqB2c+G2w8BdNZG5ac=";
  };

-  vendorHash = "sha256-UGpwdcITI8/aJ3Mt4dJ3xJRxLrohX2sHD3DGEJgQeo4=";
+  vendorHash = "sha256-r4Q1kXbDfYjRilmRmtjVW9rb9YfQOFPg51x8ZHSRVpk=";

  subPackages = [ "cmd/timoni" ];
  nativeBuildInputs = [ installShellFiles ];
--- a/pkgs/by-name/to/tofu-ls/package.nix
+++ b/pkgs/by-name/to/tofu-ls/package.nix
@@ -8,7 +8,7 @@

 buildGoModule (finalAttrs: {
  pname = "tofu-ls";
-  version = "0.5.1";
+  version = "0.5.3";

  __structuredAttrs = true;

@@ -16,10 +16,10 @@ buildGoModule (finalAttrs: {
    owner = "opentofu";
    repo = "tofu-ls";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-lmTvFtgXV8u4GNR3Bof+bfLMoq+luFdT1YeQq7ooLg8=";
+    hash = "sha256-VBJ4UhurJRDxZD5TJhiZrH6ArNdIirCzBDZzZoWpx9Q=";
  };

-  vendorHash = "sha256-+yG4Tz29NJ3m2is0ERMqW8vC/HJv4uudyDg9KSA/z/o=";
+  vendorHash = "sha256-D/LaFzgmpqW4xG5V2Ng3O2ogG/maqbHbD0JaXWU/dbQ=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/tu/tui-journal/package.nix
+++ b/pkgs/by-name/tu/tui-journal/package.nix
@@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "tui-journal";
-  version = "0.16.1";
+  version = "0.17.0";

  src = fetchFromGitHub {
    owner = "AmmarAbouZor";
    repo = "tui-journal";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-crrh7lV5ZMKaxsrFmhXsUgBMbN5nmbf8wQ6croTqUKI=";
+    hash = "sha256-ahjCfSodq4foBV3aBbU0FsSUrEo3wgvFYSBr/OClmpc=";
  };

-  cargoHash = "sha256-PmQDLGOXvI0OJ+gMsYa/XLc0WgSH6++23X/b1+iU3JQ=";
+  cargoHash = "sha256-hbRSQ9iVmp0oKEK53y4IuU34WNgq+pRefNxFbP1DPVQ=";

  nativeBuildInputs = [
    pkg-config
@@ -34,9 +34,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
  nativeInstallCheckInputs = [ versionCheckHook ];

  meta = {
+    changelog = "https://github.com/AmmarAbouZor/tui-journal/blob/${finalAttrs.src.rev}/CHANGELOG.md";
    description = "Your journal app if you live in a terminal";
    homepage = "https://github.com/AmmarAbouZor/tui-journal";
-    changelog = "https://github.com/AmmarAbouZor/tui-journal/blob/${finalAttrs.src.rev}/CHANGELOG.ron";
    license = lib.licenses.mit;
    mainProgram = "tjournal";
    maintainers = with lib.maintainers; [ phanirithvij ];
--- a/pkgs/by-name/va/vacuum-tube/package.nix
+++ b/pkgs/by-name/va/vacuum-tube/package.nix
@@ -10,16 +10,16 @@

 buildNpmPackage rec {
  pname = "vacuum-tube";
-  version = "1.8.0";
+  version = "1.8.1";

  src = fetchFromGitHub {
    owner = "shy1132";
    repo = "VacuumTube";
    tag = "v${version}";
-    hash = "sha256-LVsNCf0rvgWuyKEzt5b2AcwK6JdDe3ghiSOUXg7nSaA=";
+    hash = "sha256-jLktsUza5cEPIry+LyP8lB4A0ivxdGtE5y1i6UHap30=";
  };

-  npmDepsHash = "sha256-hbSN5I3LG4+y0Ggkv5C1zsaLYbrFjGXiwURfc51d0Kk=";
+  npmDepsHash = "sha256-Q/E+Rc9CuaN2cN6AKKT3EHiR97sdLAAnks5DYBQK24I=";
  makeCacheWritable = true;

  env = {
--- a/pkgs/by-name/wi/wire-desktop/package.nix
+++ b/pkgs/by-name/wi/wire-desktop/package.nix
@@ -58,7 +58,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "wire-desktop";
-  inherit (sources.${stdenv.system}) version src;
+  inherit (sources.${stdenv.system} or sources.x86_64-linux) version src;

  missingHashes = ./missing-hashes.json;
  offlineCache = yarn-berry.fetchYarnBerryDeps {
--- a/pkgs/by-name/wo/wootility/package.nix
+++ b/pkgs/by-name/wo/wootility/package.nix
@@ -7,10 +7,10 @@

 let
  pname = "wootility";
-  version = "5.3.1";
+  version = "5.3.2";
  src = fetchurl {
    url = "https://wootility-updates.ams3.cdn.digitaloceanspaces.com/wootility-linux/Wootility-${version}.AppImage";
-    sha256 = "sha256-KRqXjguylH5FjV6j+ckZwXbg6Wm2y0CE9HQaoNgfyc0=";
+    sha256 = "sha256-XCQTVFUv5SkqQamC8uJqJ2sHqU2ap2jvkzDGjTUuWug=";
  };
 in

--- a/pkgs/by-name/yt/ytdl-sub/package.nix
+++ b/pkgs/by-name/yt/ytdl-sub/package.nix
@@ -59,6 +59,8 @@ python3Packages.buildPythonApplication (finalAttrs: {
    "test_no_config_works"
    "test_presets_run"
    "test_thumbnail"
+    # fails in bwrap nix-portable sandbox
+    "test_directory_exists"
  ];

  disabledTestPaths = [
--- a/pkgs/by-name/za/zashboard/package.nix
+++ b/pkgs/by-name/za/zashboard/package.nix
@@ -12,13 +12,13 @@ let
 in
 buildNpmPackage (finalAttrs: {
  pname = "zashboard";
-  version = "3.12.0";
+  version = "3.14.0";

  src = fetchFromGitHub {
    owner = "Zephyruso";
    repo = "zashboard";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-bNkp3FQYM8gdkszPgbN3Ovypg0Uj7Ny0WNkfC82xark=";
+    hash = "sha256-GSzJpBGDCh7OPPr5OWfAAbraRjIhKkVo5/EMRmrLm/o=";
  };

  npmDeps = null;
@@ -26,7 +26,7 @@ buildNpmPackage (finalAttrs: {
    inherit (finalAttrs) pname version src;
    inherit pnpm;
    fetcherVersion = 3;
-    hash = "sha256-ag72Aw8Kor9vpVthq/shWqyNUFL8hHrwdeKHNHgm8NU=";
+    hash = "sha256-8EQziLcmP+bjQez+b0QdgF43XGydYC9yh4m9lEkbhCY=";
  };

  nativeBuildInputs = [ pnpm ];
--- a/pkgs/development/python-modules/aio-geojson-client/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-client/default.nix
@@ -1,6 +1,7 @@
 {
  lib,
  aiohttp,
+  aiointercept,
  aioresponses,
  buildPythonPackage,
  fetchFromGitHub,
@@ -12,16 +13,16 @@
  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "aio-geojson-client";
-  version = "0.21";
+  version = "2026.6.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "exxamalte";
    repo = "python-aio-geojson-client";
-    tag = "v${version}";
-    hash = "sha256-zHgqsl278XBr2X8oQOsnIQxfyYuB5G8NLcTNy4oerUI=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-gC6z3If8OJKDXqpBsWFMy5rYpeqZ2wjljw/dksD0XIU=";
  };

  pythonRelaxDeps = [ "geojson" ];
@@ -38,6 +39,7 @@ buildPythonPackage rec {

  nativeCheckInputs = [
    aioresponses
+    aiointercept
    mock
    pytest-asyncio
    pytestCheckHook
@@ -48,8 +50,8 @@ buildPythonPackage rec {
  meta = {
    description = "Python module for accessing GeoJSON feeds";
    homepage = "https://github.com/exxamalte/python-aio-geojson-client";
-    changelog = "https://github.com/exxamalte/python-aio-geojson-client/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/exxamalte/python-aio-geojson-client/blob/${finalAttrs.src.tag}/CHANGELOG.md";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
--- a/pkgs/development/python-modules/aio-geojson-generic-client/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-generic-client/default.nix
@@ -2,6 +2,7 @@
  lib,
  aio-geojson-client,
  aiohttp,
+  aiointercept,
  aioresponses,
  buildPythonPackage,
  fetchFromGitHub,
@@ -12,27 +13,22 @@
  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "aio-geojson-generic-client";
-  version = "0.5";
+  version = "2026.6.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "exxamalte";
    repo = "python-aio-geojson-generic-client";
-    tag = "v${version}";
-    hash = "sha256-/I/n/XXRvm7G16WqVmU+KkyP5DeadqhEpy2EAtDFlCk=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ZRPagyzFAa7f6liT1hWVf6FtabxPKfOzMS/Id14Jpv0=";
  };

  __darwinAllowLocalNetworking = true;

  build-system = [ setuptools ];

-  pythonRelaxDeps = [
-    # geojson>=2.4.0,<3, but we have 3.x
-    "geojson"
-  ];
-
  dependencies = [
    aiohttp
    aio-geojson-client
@@ -42,6 +38,7 @@ buildPythonPackage rec {

  nativeCheckInputs = [
    aioresponses
+    aiointercept
    pytest-asyncio
    pytestCheckHook
  ];
@@ -51,8 +48,8 @@ buildPythonPackage rec {
  meta = {
    description = "Python library for accessing GeoJSON feeds";
    homepage = "https://github.com/exxamalte/python-aio-geojson-generic-client";
-    changelog = "https://github.com/exxamalte/python-aio-geojson-generic-client/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/exxamalte/python-aio-geojson-generic-client/blob/${finalAttrs.src.tag}/CHANGELOG.md";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
--- a/pkgs/development/python-modules/aio-geojson-geonetnz-quakes/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-geonetnz-quakes/default.nix
@@ -2,6 +2,7 @@
  lib,
  aio-geojson-client,
  aiohttp,
+  aiointercept,
  aioresponses,
  buildPythonPackage,
  fetchFromGitHub,
@@ -11,16 +12,16 @@
  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "aio-geojson-geonetnz-quakes";
-  version = "0.17";
+  version = "2026.6.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "exxamalte";
    repo = "python-aio-geojson-geonetnz-quakes";
-    tag = "v${version}";
-    hash = "sha256-RZ+wgLYMl7y3CdmlipsfZGcew1pYSMEhkyyeLqIwVwI=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-JzhKlQR7tNRCtiEVSQGWFIDxUl6o+jhR3kKYjRCMTAU=";
  };

  build-system = [ setuptools ];
@@ -32,6 +33,7 @@ buildPythonPackage rec {
  ];

  nativeCheckInputs = [
+    aiointercept
    aioresponses
    pytest-asyncio
    pytestCheckHook
@@ -44,8 +46,8 @@ buildPythonPackage rec {
  meta = {
    description = "Python module for accessing the GeoNet NZ Quakes GeoJSON feeds";
    homepage = "https://github.com/exxamalte/python-aio-geojson-geonetnz-quakes";
-    changelog = "https://github.com/exxamalte/python-aio-geojson-geonetnz-quakes/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/exxamalte/python-aio-geojson-geonetnz-quakes/blob/${finalAttrs.src.tag}/CHANGELOG.md";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
--- a/pkgs/development/python-modules/aio-geojson-geonetnz-volcano/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-geonetnz-volcano/default.nix
@@ -2,6 +2,7 @@
  lib,
  aio-geojson-client,
  aiohttp,
+  aiointercept,
  aioresponses,
  mock,
  buildPythonPackage,
@@ -13,16 +14,16 @@
  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "aio-geojson-geonetnz-volcano";
-  version = "0.10";
+  version = "2026.6.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "exxamalte";
    repo = "python-aio-geojson-geonetnz-volcano";
-    tag = "v${version}";
-    hash = "sha256-B+jULYeel7efk7fB26zXQyS1ZCsmFVKlOkfnKWFQFJ4=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-BA8ejjzwonIYsLrBP3MGBfZ3bKoj2h/Qe4TcjL16FOA=";
  };

  build-system = [ setuptools ];
@@ -34,6 +35,7 @@ buildPythonPackage rec {
  ];

  nativeCheckInputs = [
+    aiointercept
    aioresponses
    mock
    pytest-asyncio
@@ -48,8 +50,8 @@ buildPythonPackage rec {
  meta = {
    description = "Python module for accessing the GeoNet NZ Volcanic GeoJSON feeds";
    homepage = "https://github.com/exxamalte/python-aio-geojson-geonetnz-volcano";
-    changelog = "https://github.com/exxamalte/python-aio-geojson-geonetnz-volcano/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/exxamalte/python-aio-geojson-geonetnz-volcano/blob/${finalAttrs.src.tag}/CHANGELOG.md";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
--- a/pkgs/development/python-modules/aio-geojson-nsw-rfs-incidents/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-nsw-rfs-incidents/default.nix
@@ -2,6 +2,7 @@
  lib,
  aio-geojson-client,
  aiohttp,
+  aiointercept,
  aioresponses,
  buildPythonPackage,
  fetchFromGitHub,
@@ -11,16 +12,16 @@
  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "aio-geojson-nsw-rfs-incidents";
-  version = "0.8";
+  version = "2026.6.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "exxamalte";
    repo = "python-aio-geojson-nsw-rfs-incidents";
-    tag = "v${version}";
-    hash = "sha256-JOvmUWrmYQt2hJ9u08Aliv9ImI3AOTk4uBx3Pv8/7/c=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-oZLpmEqsZewPVCKo1HwKK1vzAF0Vr+Vw0bhWV5c0uCw=";
  };

  build-system = [ setuptools ];
@@ -32,6 +33,7 @@ buildPythonPackage rec {
  ];

  nativeCheckInputs = [
+    aiointercept
    aioresponses
    pytest-asyncio
    pytestCheckHook
@@ -44,8 +46,8 @@ buildPythonPackage rec {
  meta = {
    description = "Python module for accessing the NSW Rural Fire Service incidents feeds";
    homepage = "https://github.com/exxamalte/python-aio-geojson-nsw-rfs-incidents";
-    changelog = "https://github.com/exxamalte/python-aio-geojson-geonetnz-quakes/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/exxamalte/python-aio-geojson-nsw-rfs-incidents/blob/${finalAttrs.src.tag}/CHANGELOG.md";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
--- a/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix
+++ b/pkgs/development/python-modules/aio-geojson-usgs-earthquakes/default.nix
@@ -11,15 +11,15 @@
  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "aio-geojson-usgs-earthquakes";
-  version = "0.4";
+  version = "2026.6.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "exxamalte";
    repo = "python-aio-geojson-usgs-earthquakes";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-UzLnctft/D38bqClqyyJ4b5GvVXM4CFSd6TypuLo0Y4=";
  };

@@ -44,8 +44,8 @@ buildPythonPackage rec {
  meta = {
    description = "Module for accessing the U.S. Geological Survey Earthquake Hazards Program feeds";
    homepage = "https://github.com/exxamalte/python-aio-geojson-usgs-earthquakes";
-    changelog = "https://github.com/exxamalte/python-aio-geojson-usgs-earthquakes/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/exxamalte/python-aio-geojson-usgs-earthquakes/blob/${finalAttrs.src.tag}/CHANGELOG.md";
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
--- a/pkgs/development/python-modules/aio-georss-client/default.nix
+++ b/pkgs/development/python-modules/aio-georss-client/default.nix
@@ -1,6 +1,7 @@
 {
  lib,
  aiohttp,
+  aiointercept,
  aioresponses,
  buildPythonPackage,
  dateparser,
@@ -14,16 +15,16 @@
  xmltodict,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "aio-georss-client";
-  version = "0.14";
+  version = "2026.6.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "exxamalte";
    repo = "python-aio-georss-client";
-    tag = "v${version}";
-    hash = "sha256-d5QKF/aDLzZ2/Pbm6VygsSYWab7Jqs/5zTeKHg6Zr74=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-HstN/X3fJHJHLtduMyeUCK8epqY6yfXi8LlF75mn8+g=";
  };

  __darwinAllowLocalNetworking = true;
@@ -39,6 +40,7 @@ buildPythonPackage rec {
  ];

  nativeCheckInputs = [
+    aiointercept
    aioresponses
    mock
    pytest-asyncio
@@ -48,12 +50,10 @@ buildPythonPackage rec {
  pythonImportsCheck = [ "aio_georss_client" ];

  meta = {
-    # https://github.com/exxamalte/python-aio-georss-client/issues/63
-    broken = lib.versionAtLeast xmltodict.version "1";
    description = "Python library for accessing GeoRSS feeds";
    homepage = "https://github.com/exxamalte/python-aio-georss-client";
-    changelog = "https://github.com/exxamalte/python-aio-georss-client/blob/v${version}/CHANGELOG.md";
-    license = with lib.licenses; [ asl20 ];
+    changelog = "https://github.com/exxamalte/python-aio-georss-client/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
--- a/pkgs/development/python-modules/aio-georss-gdacs/default.nix
+++ b/pkgs/development/python-modules/aio-georss-gdacs/default.nix
@@ -1,6 +1,7 @@
 {
  lib,
  aio-georss-client,
+  aiointercept,
  aioresponses,
  buildPythonPackage,
  fetchFromGitHub,
@@ -10,16 +11,16 @@
  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "aio-georss-gdacs";
-  version = "0.10";
+  version = "2026.6.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "exxamalte";
    repo = "python-aio-georss-gdacs";
-    tag = "v${version}";
-    hash = "sha256-PhOI0v3dKTNGZLk1/5wIgvQkm4Cwfr1UYilr5rW7e3g=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-2Ot7w2TU7nwnHePFCaCr7LZNbKbOLxADnHoieFUGg40=";
  };

  __darwinAllowLocalNetworking = true;
@@ -32,6 +33,7 @@ buildPythonPackage rec {
  ];

  nativeCheckInputs = [
+    aiointercept
    aioresponses
    pytest-asyncio
    pytestCheckHook
@@ -42,8 +44,8 @@ buildPythonPackage rec {
  meta = {
    description = "Python library for accessing GeoRSS feeds";
    homepage = "https://github.com/exxamalte/python-aio-georss-gdacs";
-    changelog = "https://github.com/exxamalte/python-aio-georss-gdacs/releases/tag/v${version}";
-    license = with lib.licenses; [ asl20 ];
+    changelog = "https://github.com/exxamalte/python-aio-georss-gdacs/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
--- a/pkgs/development/python-modules/gftools/default.nix
+++ b/pkgs/development/python-modules/gftools/default.nix
@@ -8,15 +8,12 @@
  absl-py,
  afdko,
  axisregistry,
-  babelfont,
  beautifulsoup4,
  black,
  brotli,
-  bumpfontversion,
  coreutils,
  diffenator2,
  ffmpeg-python,
-  font-v,
  fontbakery,
  fontfeatures,
  fontmake,
@@ -44,8 +41,6 @@
  requests,
  rich,
  ruamel-yaml,
-  skia-pathops,
-  statmake,
  strictyaml,
  tabulate,
  ttfautohint-py,
@@ -62,14 +57,14 @@ let
 in
 buildPythonPackage rec {
  pname = "gftools";
-  version = "0.9.995";
+  version = "0.9.996";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "googlefonts";
    repo = "gftools";
    tag = "v${version}";
-    hash = "sha256-XnlA5u6GP8K+xxazfxMrh16Utxs9uhfxoZFV81yFOfA=";
+    hash = "sha256-8tz6xsDtjJMa5Vnpv69BbcmGtDHp6eFlryAtO1zKyDs=";
  };

  postPatch = ''
@@ -131,12 +126,9 @@ buildPythonPackage rec {
    absl-py
    afdko
    axisregistry
-    babelfont
    beautifulsoup4
    brotli
-    bumpfontversion
    ffmpeg-python
-    font-v
    fontfeatures
    fontmake
    fonttools
@@ -158,8 +150,6 @@ buildPythonPackage rec {
    requests
    rich
    ruamel-yaml
-    skia-pathops
-    statmake
    strictyaml
    tabulate
    ttfautohint-py
--- a/pkgs/development/python-modules/kivy-garden/default.nix
+++ b/pkgs/development/python-modules/kivy-garden/default.nix
@@ -2,22 +2,31 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+  setuptools,
  requests,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "kivy-garden";
  version = "0.1.5";
-  format = "setuptools";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "kivy-garden";
    repo = "garden";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-xOMBPFKV7mTa51Q0VKja7b0E509IaWjwlJVlSRVdct8=";
  };

-  propagatedBuildInputs = [ requests ];
+  patches = [
+    # See https://github.com/kivy-garden/garden/commit/6257325da4b91c8cd288bfb107c366703f9f17c2
+    ./fix-name.diff
+    ./remove-import-pkg-resources.diff
+  ];
+
+  build-system = [ setuptools ];
+
+  dependencies = [ requests ];

  pythonImportsCheck = [ "garden" ];

@@ -30,4 +39,4 @@ buildPythonPackage rec {
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ risson ];
  };
-}
+})
--- a/pkgs/development/python-modules/kivy-garden/fix-name.diff
+++ b/pkgs/development/python-modules/kivy-garden/fix-name.diff
@@ -0,0 +1,13 @@
+diff --git a/setup.py b/setup.py
+index ca8791b81f..a78fb9bfc2 100644
+--- a/setup.py
+++ b/setup.py
+@@ -4,7 +4,7 @@
+ from setuptools import setup
+ 
+ setup(
+-        name='Kivy Garden',
+        name='Kivy-Garden',
+         version='0.1.5',
+         license='MIT',
+         packages=['garden'],
--- a/pkgs/development/python-modules/kivy-garden/remove-import-pkg-resources.diff
+++ b/pkgs/development/python-modules/kivy-garden/remove-import-pkg-resources.diff
@@ -0,0 +1,37 @@
+diff --git a/ez_setup.py b/ez_setup.py
+index b02f3f17b0..de90a8e805 100644
+--- a/ez_setup.py
+++ b/ez_setup.py
+@@ -124,32 +124,6 @@
+                    to_dir=os.curdir, download_delay=15):
+     # making sure we use the absolute path
+     to_dir = os.path.abspath(to_dir)
+-    was_imported = 'pkg_resources' in sys.modules or \
+-        'setuptools' in sys.modules
+-    try:
+-        import pkg_resources
+-    except ImportError:
+-        return _do_download(version, download_base, to_dir, download_delay)
+-    try:
+-        pkg_resources.require("setuptools>=" + version)
+-        return
+-    except pkg_resources.VersionConflict:
+-        e = sys.exc_info()[1]
+-        if was_imported:
+-            sys.stderr.write(
+-            "The required version of setuptools (>=%s) is not available,\n"
+-            "and can't be installed while this script is running. Please\n"
+-            "install a more recent version first, using\n"
+-            "'easy_install -U setuptools'."
+-            "\n\n(Currently using %r)\n" % (version, e.args[0]))
+-            sys.exit(2)
+-        else:
+-            del pkg_resources, sys.modules['pkg_resources']    # reload ok
+-            return _do_download(version, download_base, to_dir,
+-                                download_delay)
+-    except pkg_resources.DistributionNotFound:
+-        return _do_download(version, download_base, to_dir,
+-                            download_delay)
+ 
+ def download_file_powershell(url, target):
+     """
--- a/pkgs/development/python-modules/pysmlight/default.nix
+++ b/pkgs/development/python-modules/pysmlight/default.nix
@@ -16,14 +16,14 @@

 buildPythonPackage rec {
  pname = "pysmlight";
-  version = "0.5.2";
+  version = "0.5.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "smlight-tech";
    repo = "pysmlight";
    tag = "v${version}";
-    hash = "sha256-zqb2rfY3JDnIhlaevqX+/ppX5YhB8xUeIrrM4OQKEq0=";
+    hash = "sha256-/FL1iRQAOb+4AdrRpRRkt8NsHpQt4fHfg6qO+aUUZeo=";
  };

  build-system = [
--- a/pkgs/development/python-modules/rns/default.nix
+++ b/pkgs/development/python-modules/rns/default.nix
@@ -14,14 +14,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "rns";
-  version = "1.3.7";
+  version = "1.3.8";
  pyproject = true;
  __structuredAttrs = true;

  src = fetchPypi {
    pname = "rns";
    version = finalAttrs.version;
-    hash = "sha256-Z1fbZcCvISs4a35EuV7aTjbWsRyug0JYvG0tEdrG4SU=";
+    hash = "sha256-1cHzlJOqm3WrZ7g5l9StW9NX5n6dYp/6KU4xov/eNH0=";
  };

  patches = [
--- a/pkgs/development/python-modules/symbolic/default.nix
+++ b/pkgs/development/python-modules/symbolic/default.nix
@@ -14,7 +14,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "symbolic";
-  version = "13.7.0";
+  version = "13.9.0";
  pyproject = true;

  src = fetchFromGitHub {
@@ -23,12 +23,12 @@ buildPythonPackage (finalAttrs: {
    tag = finalAttrs.version;
    # the `py` directory is not included in the tarball, so we fetch the source via git instead
    forceFetchGit = true;
-    hash = "sha256-YKq9fsFdv4uZa5FhK1CLeBo20AEJZ5mNgAY1HPH/abA=";
+    hash = "sha256-o7LqQb+tWpAl+W5sHI51tfd2FEZOpPPgChIpkXjM1D8=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
-    hash = "sha256-2Cz1J5YDsF9/tEPmBiYtaSIUPAyAiQh82a9DHjy2fxQ=";
+    hash = "sha256-q2+eJufBBzPJEgVqmUagXSU9fQPHQv4jfyCVgHJLBsk=";
  };

  nativeBuildInputs = [
--- a/pkgs/servers/home-assistant/custom-components/cable_modem_monitor/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/cable_modem_monitor/package.nix
@@ -17,12 +17,12 @@
  requests,
 }:
 let
-  version = "3.14.0-beta.11";
+  version = "3.14.0-beta.13";
  src = fetchFromGitHub {
    owner = "solentlabs";
    repo = "cable_modem_monitor";
    tag = "v${version}";
-    hash = "sha256-MvRDXwMfPS4yoOH4+KYj/215yu+FyTECU3UEb1e1//4=";
+    hash = "sha256-biQVMq2IoOdbpdP+zDfLXdl91++aKmN3EPQfvzEACyU=";
    fetchLFS = true;
  };

--- a/pkgs/servers/home-assistant/custom-components/smarthq/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/smarthq/package.nix
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent (finalAttrs: {
  owner = "geappliances";
  domain = "smarthq";
-  version = "1.2.1";
+  version = "1.2.2";

  src = fetchFromGitHub {
    owner = "geappliances";
    repo = "geappliances-smarthq-integration";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-8DAnALqtFuMfEXF4Kcu/RMmcK2LS7TLrvgrFP+Jwo/4=";
+    hash = "sha256-PwCorYIqRK4gQLaYxoebIVRIeTcIrDo3CRNs/6DUc9o=";
  };

  dependencies = [
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/universal-remote-card/package.nix
@@ -6,16 +6,16 @@

 buildNpmPackage rec {
  pname = "universal-remote-card";
-  version = "4.11.3";
+  version = "4.11.4";

  src = fetchFromGitHub {
    owner = "Nerwyn";
    repo = "android-tv-card";
    rev = version;
-    hash = "sha256-EUaybuKA9lu8UYpcAJEXfoJE1gbYZO+3Vz8fAs0dQ1U=";
+    hash = "sha256-R2fs9J0ibV9RUUbFBzKl6LCHGr5GATS4ZtABTS4Wjd8=";
  };

-  npmDepsHash = "sha256-+3RslxpHHYjcpHggr1OSOTu0xGavmhHjOZD7tULPqIA=";
+  npmDepsHash = "sha256-w21PeUt34FIy2BOQNXizEfM93Wd/UwvJjU1fdSzU2OY=";

  installPhase = ''
    runHook preInstall
--- a/pkgs/servers/sql/postgresql/ext/pg-gvm.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg-gvm.nix
@@ -14,13 +14,13 @@

 postgresqlBuildExtension (finalAttrs: {
  pname = "pg-gvm";
-  version = "22.6.17";
+  version = "22.6.18";

  src = fetchFromGitHub {
    owner = "greenbone";
    repo = "pg-gvm";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-rOtAAAIa+Ot+o1JLtgXOD32sZbX+nfKvl3CQqx02BtU=";
+    hash = "sha256-EjsDRQ07nxaY+ysQSKvapzxK0DlKanoVd+1CwIZfimw=";
  };

  nativeBuildInputs = [
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8437,9 +8437,6 @@ with pkgs;
  );
  android-studio-for-platform = androidStudioForPlatformPackages.stable;

-  apngasm = callPackage ../applications/graphics/apngasm { };
-  apngasm_2 = callPackage ../applications/graphics/apngasm/2.nix { };
-
  arelle = with python3Packages; toPythonApplication arelle;

  astroid = callPackage ../applications/networking/mailreaders/astroid {
@@ -9369,10 +9366,6 @@ with pkgs;

  rusty-psn-gui = rusty-psn.override { withGui = true; };

-  scantailor-advanced = callPackage ../applications/graphics/scantailor/advanced.nix { };
-
-  scantailor-universal = callPackage ../applications/graphics/scantailor/universal.nix { };
-
  sweethome3d = recurseIntoAttrs (
    (callPackage ../applications/misc/sweethome3d { })
    // (callPackage ../applications/misc/sweethome3d/editors.nix {