Merge master into staging-nixos

2026-09-30 20:00:10 +00:00 · 2026-08-04 12:39:28 +00:00
parent 216d1f302a 32d75cf7a3
commit 8cf40cc13a
96 changed files with 2395 additions and 1000 deletions
--- a/doc/packages/darwin-builder.section.md
+++ b/doc/packages/darwin-builder.section.md
@@ -83,6 +83,57 @@ $ sudo launchctl kickstart -k system/org.nixos.nix-daemon

 Note that if the builder is running and you have created the above ssh conf file, you can ssh into the builder with `sudo ssh builder@linux-builder`.

+## Using the Virtualization.framework backend {#sec-darwin-builder-vz}
+
+`darwin.linux-builder-vz` is a variant of `darwin.linux-builder` that runs the same
+NixOS guest on Apple's Virtualization.framework (via `pkgs.vzvm`) instead of QEMU.
+Instead of emulating x86_64, it exposes Rosetta to the guest, so `x86_64-linux`
+builds are translated rather than emulated, which is substantially faster. It
+requires an Apple silicon host (`aarch64-darwin`) running macOS 13 or newer, with
+Rosetta installed:
+
+```ShellSession
+$ softwareupdate --install-rosetta --agree-to-license
+```
+
+The builder refuses to start when Rosetta is missing, rather than silently dropping
+`x86_64-linux` support; set `virtualisation.vz.rosetta.enable = false` to run
+without it.
+
+It is a drop-in replacement: it listens on the same host port (31022) and presents
+the same host key as the QEMU builder, so the `nix.conf` and SSH configuration
+described above apply unchanged; only the transport behind the port changes, from
+TCP forwarding to vsock. Since a single builder VM handles both architectures
+through Rosetta, list both systems in your `builders` entry
+(`aarch64-linux,x86_64-linux`), or with nix-darwin:
+
+```nix
+{
+  nix.linux-builder = {
+    enable = true;
+    package = pkgs.darwin.linux-builder-vz;
+    systems = [
+      "aarch64-linux"
+      "x86_64-linux"
+    ];
+  };
+}
+```
+
+When switching an existing QEMU builder over, delete its data disk first (e.g.
+`sudo rm /var/lib/linux-builder/nixos.qcow2`): the vz builder reuses the file name
+but writes a raw image, and refuses to misread a genuine qcow2 left behind.
+
+The guest console goes to the macOS unified log by default; read it with:
+
+```ShellSession
+$ /usr/bin/log show --last 5m --predicate 'subsystem == "systems.applicative.vzvm"'
+```
+
+The `virtualisation.vz.*` NixOS options configure the backend further, e.g.
+`virtualisation.vz.nestedVirtualization` gives the guest a working `/dev/kvm` for
+running NixOS integration tests on the builder (macOS 15+, M3 or newer).
+
 ## Example flake usage {#sec-darwin-builder-example-flake}

 ```nix
--- a/doc/redirects.json
+++ b/doc/redirects.json
@@ -440,6 +440,9 @@
  "sec-darwin-availability-checks": [
    "index.html#sec-darwin-availability-checks"
  ],
+  "sec-darwin-builder-vz": [
+    "index.html#sec-darwin-builder-vz"
+  ],
  "sec-darwin-libcxx-deployment-targets": [
    "index.html#sec-darwin-libcxx-deployment-targets"
  ],
--- a/lib/licenses/licenses.nix
+++ b/lib/licenses/licenses.nix
@@ -925,6 +925,11 @@ lib.mapAttrs mkLicense (
      redistributable = true;
    };

+    fsfap = {
+      spdxId = "FSFAP";
+      fullName = "FSF All Permissive License";
+    };
+
    hl3 = {
      fullName = "Hippocratic License v3.0";
      url = "https://firstdonoharm.dev/version/3/0/core.txt";
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -162,6 +162,8 @@

 - The `shell_interact()` function on interactive runs of NixOS VM tests has been deprecated. Use the SSH backdoor instead.

+- `darwin.linux-builder-vz` has been added: a variant of `darwin.linux-builder` that runs the builder guest on Apple's Virtualization.framework via the new `vzvm` package, translating `x86_64-linux` builds with Rosetta instead of emulating them. Apple silicon hosts only. As part of this, the `nixos/modules/profiles/nix-builder-vm.nix` profile has been split into the backend-neutral `nixos/modules/profiles/nix-builder.nix` and a QEMU-specific part. Existing imports of `nix-builder-vm.nix` keep working unchanged.
+
 - [services.netbox](#opt-services.netbox.enable) has received a number of updates:
  - Default settings can now be introspected at [](#opt-services.netbox.settings).
  - Environment files can now be passed at [](#opt-services.netbox.environmentFiles).
--- a/nixos/lib/erofs-store-image.nix
+++ b/nixos/lib/erofs-store-image.nix
@@ -0,0 +1,30 @@
+# Shell-script fragment that packs a Nix store closure into a read-only erofs
+# image, built on the host when the VM starts. Shared by the VM backends
+# `qemu-vm.nix` and `vz-vm.nix`
+{
+  hostPkgs,
+  # path to a file listing the store paths to pack, one per line
+  storePaths,
+  # filesystem label of the image
+  label,
+  # shell word the image is written to
+  destination,
+}:
+''
+  ${hostPkgs.gnutar}/bin/tar --create \
+    --absolute-names \
+    --verbatim-files-from \
+    --transform 'flags=rSh;s|/nix/store/||' \
+    --transform 'flags=rSh;s|~nix~case~hack~[[:digit:]]\+||g' \
+    --files-from ${storePaths} \
+    | ${hostPkgs.erofs-utils}/bin/mkfs.erofs \
+      --quiet \
+      --force-uid=0 \
+      --force-gid=0 \
+      -L ${label} \
+      -U eb176051-bd15-49b7-9e6b-462e0b467019 \
+      -T 0 \
+      --hard-dereference \
+      --tar=f \
+      ${destination}
+''
--- a/nixos/modules/profiles/nix-builder-vm.nix
+++ b/nixos/modules/profiles/nix-builder-vm.nix
@@ -3,118 +3,19 @@
  which can be used to build packages for Linux on other operating systems;
  primarily macOS.

-  It contains both the relevant guest settings as well as an installer script
-  that manages it as a QEMU virtual machine on the host.
+  It combines the backend-neutral remote-builder profile (./nix-builder.nix)
+  with the QEMU VM backend (../virtualisation/qemu-vm.nix), which provides the
+  `config.system.build.vm` runner that the installer script launches.
 */
-{
-  config,
-  lib,
-  options,
-  ...
-}:
-
-let
-  keysDirectory = "/var/keys";
-
-  user = "builder";
-
-  keyType = "ed25519";
-
-  cfg = config.virtualisation.darwin-builder;
-
-in
+{ config, ... }:

 {
  imports = [
+    ./nix-builder.nix
    ../virtualisation/qemu-vm.nix
-
-    # Avoid a dependency on stateVersion
-    {
-      disabledModules = [
-        ../virtualisation/nixos-containers.nix
-        ../services/x11/desktop-managers/xterm.nix
-      ];
-      # swraid's default depends on stateVersion
-      config.boot.swraid.enable = false;
-      options.boot.isContainer = lib.mkOption {
-        default = false;
-        internal = true;
-      };
-      options.boot.isNspawnContainer = lib.mkOption {
-        default = false;
-        internal = true;
-      };
-    }
  ];

-  options.virtualisation.darwin-builder = with lib; {
-    diskSize = mkOption {
-      default = 20 * 1024;
-      type = types.int;
-      example = 30720;
-      description = "The maximum disk space allocated to the runner in MiB (1024×1024 bytes).";
-    };
-    memorySize = mkOption {
-      default = 3 * 1024;
-      type = types.int;
-      example = 8192;
-      description = "The runner's memory in MiB (1024×1024 bytes).";
-    };
-    min-free = mkOption {
-      default = 1024 * 1024 * 1024;
-      type = types.int;
-      example = 1073741824;
-      description = ''
-        The threshold (in bytes) of free disk space left at which to
-        start garbage collection on the runner
-      '';
-    };
-    max-free = mkOption {
-      default = 3 * 1024 * 1024 * 1024;
-      type = types.int;
-      example = 3221225472;
-      description = ''
-        The threshold (in bytes) of free disk space left at which to
-        stop garbage collection on the runner
-      '';
-    };
-    workingDirectory = mkOption {
-      default = ".";
-      type = types.str;
-      example = "/var/lib/darwin-builder";
-      description = ''
-        The working directory to use to run the script. When running
-        as part of a flake will need to be set to a non read-only filesystem.
-      '';
-    };
-    hostPort = mkOption {
-      default = 31022;
-      type = types.port;
-      example = 22;
-      description = ''
-        The localhost host port to forward TCP to the guest port.
-      '';
-    };
-  };
-
  config = {
-    # The builder is not intended to be used interactively
-    documentation.enable = false;
-
-    environment.etc = {
-      "ssh/ssh_host_ed25519_key" = {
-        mode = "0600";
-
-        source = ./keys/ssh_host_ed25519_key;
-      };
-
-      "ssh/ssh_host_ed25519_key.pub" = {
-        mode = "0644";
-
-        source = ./keys/ssh_host_ed25519_key.pub;
-      };
-    };
-
    # DNS fails for QEMU user networking (SLiRP) on macOS.  See:
    #
    # https://github.com/utmapp/UTM/issues/2353
@@ -123,163 +24,12 @@ in
    # server that QEMU provides (normally 10.0.2.3)
    networking.nameservers = [ "8.8.8.8" ];

-    # The linux builder is a lightweight VM for remote building; not evaluation.
-    nix.channel.enable = false;
-
-    # Deployment is by image.
-    # TODO system.switch.enable = false;?
-    system.disableInstallerTools = true;
-
-    # Allow the system derivation to be substituted, so that
-    # users are less likely to run into a state where they need
-    # the builder running to build the builder if they just want
-    # to make a tweak that only affects the macOS side of things,
-    # like changing the QEMU args.
-    #
-    # TODO(winter): Move to qemu-vm? Trying it here for now as a
-    # low impact change that'll probably improve people's experience.
-    system.systemBuilderArgs.allowSubstitutes = true;
-
-    nix.settings = {
-      min-free = cfg.min-free;
-
-      max-free = cfg.max-free;
-
-      trusted-users = [ user ];
-    };
-
-    services = {
-      getty.autologinUser = user;
-
-      openssh = {
-        enable = true;
-
-        authorizedKeysFiles = [ "${keysDirectory}/%u_${keyType}.pub" ];
-      };
-    };
-
-    system.build.macos-builder-installer =
-      let
-        privateKey = "/etc/nix/${user}_${keyType}";
-
-        publicKey = "${privateKey}.pub";
-
-        # This installCredentials script is written so that it's as easy as
-        # possible for a user to audit before confirming the `sudo`
-        installCredentials = hostPkgs.writeShellScript "install-credentials" ''
-          set -euo pipefail
-
-          KEYS="''${1}"
-          INSTALL=${hostPkgs.coreutils}/bin/install
-          "''${INSTALL}" -g nixbld -m 600 "''${KEYS}/${user}_${keyType}" ${privateKey}
-          "''${INSTALL}" -g nixbld -m 644 "''${KEYS}/${user}_${keyType}.pub" ${publicKey}
-        '';
-
-        hostPkgs = config.virtualisation.host.pkgs;
-
-        add-keys = hostPkgs.writeShellScriptBin "add-keys" (
-          ''
-            set -euo pipefail
-          ''
-          +
-            # When running as non-interactively as part of a DarwinConfiguration the working directory
-            # must be set to a writeable directory.
-            (
-              if cfg.workingDirectory != "." then
-                ''
-                  ${hostPkgs.coreutils}/bin/mkdir --parent "${cfg.workingDirectory}"
-                  cd "${cfg.workingDirectory}"
-                ''
-              else
-                ""
-            )
-          + ''
-            KEYS="''${KEYS:-./keys}"
-            ${hostPkgs.coreutils}/bin/mkdir --parent "''${KEYS}"
-            PRIVATE_KEY="''${KEYS}/${user}_${keyType}"
-            PUBLIC_KEY="''${PRIVATE_KEY}.pub"
-            if [ ! -e "''${PRIVATE_KEY}" ] || [ ! -e "''${PUBLIC_KEY}" ]; then
-                ${hostPkgs.coreutils}/bin/rm --force -- "''${PRIVATE_KEY}" "''${PUBLIC_KEY}"
-                ${hostPkgs.openssh}/bin/ssh-keygen -q -f "''${PRIVATE_KEY}" -t ${keyType} -N "" -C 'builder@localhost'
-            fi
-            if ! ${hostPkgs.diffutils}/bin/cmp "''${PUBLIC_KEY}" ${publicKey}; then
-              (set -x; sudo --reset-timestamp ${installCredentials} "''${KEYS}")
-            fi
-          ''
-        );
-
-        run-builder = hostPkgs.writeShellScriptBin "run-builder" ''
-          set -euo pipefail
-          KEYS="''${KEYS:-./keys}"
-          KEYS="$(${hostPkgs.nix}/bin/nix-store --add "$KEYS")" ${lib.getExe config.system.build.vm}
-        '';
-
-      in
-      hostPkgs.writeTextFile {
-        name = "create-builder";
-        executable = true;
-        destination = "/bin/create-builder";
-        text = ''
-          #!${hostPkgs.runtimeShell}
-          set -euo pipefail
-          export KEYS="''${KEYS:-./keys}"
-          ${lib.getExe add-keys}
-          ${lib.getExe run-builder}
-        '';
-        checkPhase = ''
-          ${hostPkgs.stdenv.shellDryRun} "$target"
-        '';
-        meta = {
-          mainProgram = "create-builder";
-          description = "Create a Linux builder VM for macOS";
-          platforms = lib.platforms.darwin;
-        };
-        passthru = {
-          # Let users in the repl inspect the config
-          nixosConfig = config;
-          nixosOptions = options;
-
-          inherit add-keys run-builder;
-        };
-      };
-
-    system = {
-      # To prevent gratuitous rebuilds on each change to Nixpkgs
-      nixos.revision = null;
-
-      # To prevent channels and Git checkouts resulting in different system drvs
-      nixos.versionSuffix = "";
-
-      # to be updated by module maintainers, see nixpkgs#325610
-      stateVersion = "24.05";
-    };
-
-    users.users."${user}" = {
-      isNormalUser = true;
-    };
-
-    security.polkit.enable = true;
-
-    security.polkit.extraConfig = ''
-      polkit.addRule(function(action, subject) {
-        if (action.id === "org.freedesktop.login1.power-off" && subject.user === "${user}") {
-          return "yes";
-        } else {
-          return "no";
-        }
-      })
-    '';
-
    virtualisation = {
-      diskSize = cfg.diskSize;
-
-      memorySize = cfg.memorySize;
-
      forwardPorts = [
        {
          from = "host";
          guest.port = 22;
-          host.port = cfg.hostPort;
+          host.port = config.virtualisation.darwin-builder.hostPort;
        }
      ];

@@ -287,11 +37,6 @@ in
      # non-interactively in the background.
      graphics = false;

-      sharedDirectories.keys = {
-        source = "\"$KEYS\"";
-        target = keysDirectory;
-      };
-
      # If we don't enable this option then the host will fail to delegate builds
      # to the guest, because:
      #
@@ -303,18 +48,6 @@ in
      # Snapshotting the host's /nix/store as an image isolates the guest VM's
      # /nix/store from the host's /nix/store, preventing this problem.
      useNixStoreImage = true;
-
-      # Obviously the /nix/store needs to be writable on the guest in order for it
-      # to perform builds.
-      writableStore = true;
-
-      # This ensures that anything built on the guest isn't lost when the guest is
-      # restarted.
-      writableStoreUseTmpfs = false;
-
-      # Pass certificates from host to the guest otherwise when custom CA certificates
-      # are required we can't use the cached builder.
-      useHostCerts = true;
    };
  };
 }
--- a/nixos/modules/profiles/nix-builder-vz-vm.nix
+++ b/nixos/modules/profiles/nix-builder-vz-vm.nix
@@ -0,0 +1,90 @@
+/*
+  The Linux remote-builder profile, on Apple's Virtualization.framework.
+
+  The vzvm counterpart to `./nix-builder-vm.nix`:
+
+  - Backend-neutral half lives in `./nix-builder.nix`.
+  - everything below is what differs from the QEMU backend.
+
+  Main differences:
+
+  - `networking.nameservers = [ "8.8.8.8" ]` is not needed.
+    vz uses the host's NAT, which provides working DNS.
+  - `virtualisation.graphics = false`: no display support in vz
+  - `virtualisation.useNixStoreImage`: vz only supports nix store image
+*/
+{
+  config,
+  lib,
+  ...
+}:
+
+let
+  cfg = config.virtualisation.darwin-builder;
+
+  keysDirectory = "/var/keys";
+  keysMountUnit = "var-keys.mount";
+in
+
+{
+  imports = [
+    ./nix-builder.nix
+    ../virtualisation/vz-vm.nix
+  ];
+
+  config = {
+    virtualisation.vz.forwardPorts = [
+      {
+        host.address = "127.0.0.1";
+        host.port = cfg.hostPort;
+        # `systemd-ssh-generator` serves SSH on vsock port 22 in the guest.
+        guest.port = 22;
+      }
+    ];
+
+    # The guest console belongs where a Mac user looks for service logs. Switch to `file`
+    # for a complete record: the unified log drops messages under bursts.
+    virtualisation.vz.console = lib.mkDefault "log";
+    virtualisation.vz.consoleLog = lib.mkDefault "./console.log";
+
+    # Our raw image must keep the `.qcow2` name nix-darwin's `ephemeral` wipes; vzvm checks
+    # the magic bytes and refuses a genuine leftover qcow2 rather than misreading it.
+    virtualisation.vz.diskImage = "./${config.networking.hostName}.qcow2";
+
+    # authorized keys come via virtiofs. fix uid and mode for sshd's ownership checks.
+    systemd.services.copy-builder-keys = {
+      description = "Stage builder SSH keys where sshd will accept them";
+      wantedBy = [ "multi-user.target" ];
+      requires = [ keysMountUnit ];
+      after = [ keysMountUnit ];
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+      };
+      script = ''
+        install -d -m 0755 -o root -g root /run/builder-keys
+        for key in ${keysDirectory}/*.pub; do
+          [ -e "$key" ] || continue
+          install -m 0444 -o root -g root "$key" /run/builder-keys/
+        done
+      '';
+    };
+
+    # The dependency belongs on the per-connection service, not on the socket.
+    systemd.services."sshd-vsock@" = {
+      overrideStrategy = "asDropin";
+      requires = [ "copy-builder-keys.service" ];
+      # ssh works before DHCP finishes
+      # don't accept build requests when substitution would still fail
+      wants = [ "network-online.target" ];
+      after = [
+        "copy-builder-keys.service"
+        "network-online.target"
+      ];
+    };
+
+    services.openssh.authorizedKeysFiles = lib.mkForce [
+      "/run/builder-keys/%u_ed25519.pub"
+    ];
+  };
+}
--- a/nixos/modules/profiles/nix-builder.nix
+++ b/nixos/modules/profiles/nix-builder.nix
@@ -0,0 +1,288 @@
+/*
+  Backend-neutral half of the profile that uses NixOS to create a remote
+  builder VM to build Linux packages, which can be used to build packages for
+  Linux on other operating systems; primarily macOS.
+
+  It contains the relevant guest settings as well as an installer script that
+  manages the VM on the host, but no VM backend. A backend module provides
+  `config.system.build.vm`, which the installer script launches; see
+  ./nix-builder-vm.nix for the QEMU-based composition.
+*/
+{
+  config,
+  lib,
+  options,
+  ...
+}:
+
+let
+  keysDirectory = "/var/keys";
+
+  user = "builder";
+
+  keyType = "ed25519";
+
+  cfg = config.virtualisation.darwin-builder;
+
+in
+
+{
+  imports = [
+    # Avoid a dependency on stateVersion
+    {
+      disabledModules = [
+        ../virtualisation/nixos-containers.nix
+        ../services/x11/desktop-managers/xterm.nix
+      ];
+      # swraid's default depends on stateVersion
+      config.boot.swraid.enable = false;
+      options.boot.isContainer = lib.mkOption {
+        default = false;
+        internal = true;
+      };
+      options.boot.isNspawnContainer = lib.mkOption {
+        default = false;
+        internal = true;
+      };
+    }
+  ];
+
+  options.virtualisation.darwin-builder = with lib; {
+    diskSize = mkOption {
+      default = 20 * 1024;
+      type = types.int;
+      example = 30720;
+      description = "The maximum disk space allocated to the runner in MiB (1024×1024 bytes).";
+    };
+    memorySize = mkOption {
+      default = 3 * 1024;
+      type = types.int;
+      example = 8192;
+      description = "The runner's memory in MiB (1024×1024 bytes).";
+    };
+    min-free = mkOption {
+      default = 1024 * 1024 * 1024;
+      type = types.int;
+      example = 1073741824;
+      description = ''
+        The threshold (in bytes) of free disk space left at which to
+        start garbage collection on the runner
+      '';
+    };
+    max-free = mkOption {
+      default = 3 * 1024 * 1024 * 1024;
+      type = types.int;
+      example = 3221225472;
+      description = ''
+        The threshold (in bytes) of free disk space left at which to
+        stop garbage collection on the runner
+      '';
+    };
+    workingDirectory = mkOption {
+      default = ".";
+      type = types.str;
+      example = "/var/lib/darwin-builder";
+      description = ''
+        The working directory to use to run the script. When running
+        as part of a flake will need to be set to a non read-only filesystem.
+      '';
+    };
+    hostPort = mkOption {
+      default = 31022;
+      type = types.port;
+      example = 22;
+      description = ''
+        The localhost host port to forward TCP to the guest port.
+      '';
+    };
+  };
+
+  config = {
+    # The builder is not intended to be used interactively
+    documentation.enable = false;
+
+    environment.etc = {
+      "ssh/ssh_host_ed25519_key" = {
+        mode = "0600";
+
+        source = ./keys/ssh_host_ed25519_key;
+      };
+
+      "ssh/ssh_host_ed25519_key.pub" = {
+        mode = "0644";
+
+        source = ./keys/ssh_host_ed25519_key.pub;
+      };
+    };
+
+    # The linux builder is a lightweight VM for remote building; not evaluation.
+    nix.channel.enable = false;
+
+    # Deployment is by image.
+    # TODO system.switch.enable = false;?
+    system.disableInstallerTools = true;
+
+    # Allow the system derivation to be substituted, so that
+    # users are less likely to run into a state where they need
+    # the builder running to build the builder if they just want
+    # to make a tweak that only affects the macOS side of things,
+    # like changing the QEMU args.
+    #
+    # TODO(winter): Move to qemu-vm? Trying it here for now as a
+    # low impact change that'll probably improve people's experience.
+    system.systemBuilderArgs.allowSubstitutes = true;
+
+    nix.settings = {
+      min-free = cfg.min-free;
+
+      max-free = cfg.max-free;
+
+      trusted-users = [ user ];
+    };
+
+    services = {
+      getty.autologinUser = user;
+
+      openssh = {
+        enable = true;
+
+        authorizedKeysFiles = [ "${keysDirectory}/%u_${keyType}.pub" ];
+      };
+    };
+
+    system.build.macos-builder-installer =
+      let
+        privateKey = "/etc/nix/${user}_${keyType}";
+
+        publicKey = "${privateKey}.pub";
+
+        # This installCredentials script is written so that it's as easy as
+        # possible for a user to audit before confirming the `sudo`
+        installCredentials = hostPkgs.writeShellScript "install-credentials" ''
+          set -euo pipefail
+
+          KEYS="''${1}"
+          INSTALL=${hostPkgs.coreutils}/bin/install
+          "''${INSTALL}" -g nixbld -m 600 "''${KEYS}/${user}_${keyType}" ${privateKey}
+          "''${INSTALL}" -g nixbld -m 644 "''${KEYS}/${user}_${keyType}.pub" ${publicKey}
+        '';
+
+        hostPkgs = config.virtualisation.host.pkgs;
+
+        add-keys = hostPkgs.writeShellScriptBin "add-keys" (
+          ''
+            set -euo pipefail
+          ''
+          +
+            # When running as non-interactively as part of a DarwinConfiguration the working directory
+            # must be set to a writeable directory.
+            (
+              if cfg.workingDirectory != "." then
+                ''
+                  ${hostPkgs.coreutils}/bin/mkdir --parent "${cfg.workingDirectory}"
+                  cd "${cfg.workingDirectory}"
+                ''
+              else
+                ""
+            )
+          + ''
+            KEYS="''${KEYS:-./keys}"
+            ${hostPkgs.coreutils}/bin/mkdir --parent "''${KEYS}"
+            PRIVATE_KEY="''${KEYS}/${user}_${keyType}"
+            PUBLIC_KEY="''${PRIVATE_KEY}.pub"
+            if [ ! -e "''${PRIVATE_KEY}" ] || [ ! -e "''${PUBLIC_KEY}" ]; then
+                ${hostPkgs.coreutils}/bin/rm --force -- "''${PRIVATE_KEY}" "''${PUBLIC_KEY}"
+                ${hostPkgs.openssh}/bin/ssh-keygen -q -f "''${PRIVATE_KEY}" -t ${keyType} -N "" -C 'builder@localhost'
+            fi
+            if ! ${hostPkgs.diffutils}/bin/cmp "''${PUBLIC_KEY}" ${publicKey}; then
+              (set -x; sudo --reset-timestamp ${installCredentials} "''${KEYS}")
+            fi
+          ''
+        );
+
+        run-builder = hostPkgs.writeShellScriptBin "run-builder" ''
+          set -euo pipefail
+          KEYS="''${KEYS:-./keys}"
+          KEYS="$(${hostPkgs.nix}/bin/nix-store --add "$KEYS")" ${lib.getExe config.system.build.vm}
+        '';
+
+      in
+      hostPkgs.writeTextFile {
+        name = "create-builder";
+        executable = true;
+        destination = "/bin/create-builder";
+        text = ''
+          #!${hostPkgs.runtimeShell}
+          set -euo pipefail
+          export KEYS="''${KEYS:-./keys}"
+          ${lib.getExe add-keys}
+          ${lib.getExe run-builder}
+        '';
+        checkPhase = ''
+          ${hostPkgs.stdenv.shellDryRun} "$target"
+        '';
+        meta = {
+          mainProgram = "create-builder";
+          description = "Create a Linux builder VM for macOS";
+          platforms = lib.platforms.darwin;
+        };
+        passthru = {
+          # Let users in the repl inspect the config
+          nixosConfig = config;
+          nixosOptions = options;
+
+          inherit add-keys run-builder;
+        };
+      };
+
+    system = {
+      # To prevent gratuitous rebuilds on each change to Nixpkgs
+      nixos.revision = null;
+
+      # To prevent channels and Git checkouts resulting in different system drvs
+      nixos.versionSuffix = "";
+
+      # to be updated by module maintainers, see nixpkgs#325610
+      stateVersion = "24.05";
+    };
+
+    users.users."${user}" = {
+      isNormalUser = true;
+    };
+
+    security.polkit.enable = true;
+
+    security.polkit.extraConfig = ''
+      polkit.addRule(function(action, subject) {
+        if (action.id === "org.freedesktop.login1.power-off" && subject.user === "${user}") {
+          return "yes";
+        } else {
+          return "no";
+        }
+      })
+    '';
+
+    virtualisation = {
+      diskSize = cfg.diskSize;
+
+      memorySize = cfg.memorySize;
+
+      sharedDirectories.keys = {
+        source = "\"$KEYS\"";
+        target = keysDirectory;
+      };
+
+      # Obviously the /nix/store needs to be writable on the guest in order for it
+      # to perform builds.
+      writableStore = true;
+
+      # This ensures that anything built on the guest isn't lost when the guest is
+      # restarted.
+      writableStoreUseTmpfs = false;
+
+      # Pass certificates from host to the guest otherwise when custom CA certificates
+      # are required we can't use the cached builder.
+      useHostCerts = true;
+    };
+  };
+}
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -172,30 +172,19 @@ let
    ${lib.optionalString (cfg.useNixStoreImage) ''
      echo "Creating Nix store image..."

-      ${hostPkgs.gnutar}/bin/tar --create \
-        --absolute-names \
-        --verbatim-files-from \
-        --transform 'flags=rSh;s|/nix/store/||' \
-        --transform 'flags=rSh;s|~nix~case~hack~[[:digit:]]\+||g' \
-        --files-from ${
+      ${import ../../lib/erofs-store-image.nix {
+        inherit hostPkgs;
+        storePaths = "${
          hostPkgs.closureInfo {
            rootPaths = [
              config.system.build.toplevel
              regInfo
            ];
          }
-        }/store-paths \
-        | ${hostPkgs.erofs-utils}/bin/mkfs.erofs \
-          --quiet \
-          --force-uid=0 \
-          --force-gid=0 \
-          -L ${nixStoreFilesystemLabel} \
-          -U eb176051-bd15-49b7-9e6b-462e0b467019 \
-          -T 0 \
-          --hard-dereference \
-          --tar=f \
-          "$TMPDIR"/store.img
-
+        }/store-paths";
+        label = nixStoreFilesystemLabel;
+        destination = ''"$TMPDIR"/store.img'';
+      }}
      echo "Created Nix store image."
    ''}

--- a/nixos/modules/virtualisation/vm-base.nix
+++ b/nixos/modules/virtualisation/vm-base.nix
@@ -0,0 +1,204 @@
+# Backend-neutral pieces of running a NixOS guest in a VM.
+#
+# `qemu-vm.nix` still carries its own copies of these options: the two modules are
+# never imported together because a configuration has exactly one VM backend, so
+# the duplicated declarations cannot collide.
+# Deduping `qemu-vm.nix` onto this module is a refactor left for later.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.virtualisation;
+in
+{
+  options = {
+
+    virtualisation.memorySize = lib.mkOption {
+      type = lib.types.ints.positive;
+      default = 1024;
+      description = ''
+        The memory size in megabytes of the virtual machine.
+      '';
+    };
+
+    virtualisation.cores = lib.mkOption {
+      type = lib.types.ints.positive;
+      default = 1;
+      description = ''
+        Specify the number of cores the guest is permitted to use.
+        The number can be higher than the available cores on the
+        host system.
+      '';
+    };
+
+    # `virtualisation.diskSize` comes from `disk-size-option.nix` in the default module list.
+
+    virtualisation.additionalPaths = lib.mkOption {
+      type = lib.types.listOf lib.types.path;
+      default = [ ];
+      description = ''
+        A list of paths whose closure should be made available to the VM.
+
+        The closure is copied into the VM's Nix store image and registered in
+        the guest's Nix database.
+      '';
+    };
+
+    virtualisation.writableStore = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = ''
+        If enabled, the Nix store in the VM is made writable by layering an
+        overlay filesystem on top of the (read-only) store image.
+      '';
+    };
+
+    virtualisation.writableStoreUseTmpfs = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+      description = ''
+        Use a tmpfs for the writable store instead of writing to a disk image.
+
+        Turning this off makes store writes survive a reboot, at the cost of
+        needing a disk to put them on.
+      '';
+    };
+
+    virtualisation.useHostCerts = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        If enabled, when `NIX_SSL_CERT_FILE` is set on the host,
+        pass the CA certificates from the host to the VM.
+      '';
+    };
+
+    virtualisation.sharedDirectories = lib.mkOption {
+      type = lib.types.attrsOf (
+        lib.types.submodule (
+          { name, ... }:
+          {
+            options.source = lib.mkOption {
+              type = lib.types.str;
+              description = "The path of the directory to share, can be a shell variable";
+            };
+            options.target = lib.mkOption {
+              type = lib.types.path;
+              description = "The mount point of the directory inside the virtual machine";
+            };
+            options.tag = lib.mkOption {
+              type = lib.types.str;
+              default = name;
+              description = ''
+                The tag the guest mounts this share by. Defaults to the attribute
+                name. Backends impose their own length limits on tags.
+              '';
+            };
+          }
+        )
+      );
+      default = { };
+      example = {
+        my-share = {
+          source = "/path/to/be/shared";
+          target = "/mnt/shared";
+        };
+      };
+      description = ''
+        An attribute set of directories that will be shared with the virtual
+        machine. The attribute name is used as the mount tag.
+      '';
+    };
+
+    virtualisation.host.pkgs = lib.mkOption {
+      type = lib.types.pkgs;
+      default = pkgs;
+      defaultText = lib.literalExpression "pkgs";
+      example = lib.literalExpression ''
+        import pkgs.path { system = "aarch64-darwin"; }
+      '';
+      description = ''
+        Package set to use for the host-side tooling that launches the VM.
+
+        This is not the guest's package set: the host may well be a different
+        platform than the guest, which is the entire point of running a VM.
+      '';
+    };
+  };
+
+  config = {
+
+    # Passed on the kernel command line: a direct reference would make the closure self-referential.
+    systemd.services.register-nix-paths = lib.mkIf config.nix.enable {
+      # Runs early so the store DB is populated first; `--load-db` needs no daemon.
+      unitConfig.DefaultDependencies = false;
+      wantedBy = [ "sysinit.target" ];
+      before = [
+        "sysinit.target"
+        "shutdown.target"
+        "nix-daemon.socket"
+        "nix-daemon.service"
+      ];
+      after = [ "local-fs.target" ];
+      conflicts = [ "shutdown.target" ];
+      restartIfChanged = false;
+      serviceConfig = {
+        Type = "oneshot";
+        RemainAfterExit = true;
+        User = lib.mkIf (config.nix.daemonUser != "root") config.nix.daemonUser;
+        Group = lib.mkIf (config.nix.daemonGroup != "root") config.nix.daemonGroup;
+      };
+      script = ''
+        if [[ "$(cat /proc/cmdline)" =~ regInfo=([^ ]*) ]]; then
+          ${lib.getExe' config.nix.package.out "nix-store"} --load-db < "''${BASH_REMATCH[1]}"
+        fi
+      '';
+    };
+
+    virtualisation.additionalPaths = [ config.system.build.toplevel ];
+
+    # Read-only erofs store, overlaid when writable. Override per entry: `mkVMOverride` on
+    # the whole set would drop other modules' filesystems, including the Rosetta share.
+    fileSystems = {
+      "/nix/.ro-store" = lib.mkVMOverride {
+        device = "/dev/disk/by-label/nix-store";
+        fsType = "erofs";
+        neededForBoot = true;
+        options = [ "ro" ];
+      };
+      "/nix/store" = lib.mkVMOverride (
+        if cfg.writableStore then
+          {
+            overlay = {
+              lowerdir = [ "/nix/.ro-store" ];
+              upperdir = "/nix/.rw-store/upper";
+              workdir = "/nix/.rw-store/work";
+            };
+          }
+        else
+          {
+            device = "/nix/.ro-store";
+            fsType = "none";
+            options = [ "bind" ];
+          }
+      );
+      "/nix/.rw-store" = lib.mkIf (cfg.writableStore && cfg.writableStoreUseTmpfs) (
+        lib.mkVMOverride {
+          fsType = "tmpfs";
+          options = [ "mode=0755" ];
+          neededForBoot = true;
+        }
+      );
+    };
+
+    swapDevices = lib.mkVMOverride [ ];
+    boot.initrd.luks.devices = lib.mkVMOverride { };
+
+    # The host keeps time for us.
+    services.timesyncd.enable = false;
+  };
+}
--- a/nixos/modules/virtualisation/vz-vm.nix
+++ b/nixos/modules/virtualisation/vz-vm.nix
@@ -0,0 +1,407 @@
+# Runs a NixOS guest on Apple's Virtualization.framework with `vzvm`: Rosetta, and a
+# lighter hypervisor than QEMU.
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.virtualisation;
+  vzCfg = cfg.vz;
+
+  hostPkgs = cfg.host.pkgs;
+
+  regInfo = hostPkgs.closureInfo { rootPaths = cfg.additionalPaths; };
+
+  # Host-built erofs store image, named by closure hash so only a changed guest rebuilds it.
+  # A derivation is not an option: it would need the Linux builder this VM provides.
+  storeClosureInfo = hostPkgs.closureInfo {
+    rootPaths = [
+      config.system.build.toplevel
+      regInfo
+    ];
+  };
+  storeImageName = "store-${lib.head (lib.splitString "-" (baseNameOf (toString storeClosureInfo)))}.img";
+
+  toplevel = config.system.build.toplevel;
+
+  kernelParams = [
+    # Virtualization.framework offers a virtio console
+    "console=hvc0"
+    "init=${toplevel}/init"
+    "regInfo=${regInfo}/registration"
+  ]
+  ++ config.boot.kernelParams;
+
+  forwards = map (forward: {
+    listen = "${forward.host.address}:${toString forward.host.port}";
+    vsockPort = forward.guest.port;
+  }) vzCfg.forwardPorts;
+
+  # The builder profile passes the keys directory as `"$KEYS"`; the runner resolves it.
+  shareFragment = lib.concatMapStrings (share: ''
+    shares=$(${lib.getExe hostPkgs.jq} -n --argjson shares "$shares" \
+      --arg tag ${lib.escapeShellArg share.tag} --arg path ${share.source} \
+      '$shares + [{tag: $tag, path: $path}]')
+  '') (lib.attrValues cfg.sharedDirectories);
+
+  staticConfig = {
+    cpuCount = cfg.cores;
+    memorySizeMiB = cfg.memorySize;
+    kernel = "${toplevel}/kernel";
+    initrd = "${toplevel}/initrd";
+    cmdline = toString kernelParams;
+    vsock.forwards = forwards;
+    rosetta = vzCfg.rosetta.enable;
+    inherit (vzCfg) nestedVirtualization;
+    # Only `file` carries a path; dispatch rather than fall through, so a new mode cannot
+    # silently be emitted as `file`.
+    console =
+      if vzCfg.console == "file" then
+        {
+          mode = "file";
+          path = vzCfg.consoleLog;
+        }
+      else
+        { mode = vzCfg.console; };
+  }
+  // vzCfg.extraConfig;
+
+  staticConfigFile = hostPkgs.writeText "vzvm-config.json" (builtins.toJSON staticConfig);
+in
+{
+  imports = [ ./vm-base.nix ];
+
+  options = {
+
+    virtualisation.vz.package = lib.mkPackageOption hostPkgs "vzvm" { };
+
+    virtualisation.vz.rosetta = {
+      enable = lib.mkOption {
+        type = lib.types.bool;
+        default = true;
+        description = ''
+          Expose Rosetta to the guest, so that it can execute x86_64 binaries.
+
+          Rosetta must be installed on the host; the VM refuses to start
+          otherwise rather than quietly losing the ability to build for
+          x86_64-linux. Install it with:
+
+          ```
+          softwareupdate --install-rosetta --agree-to-license
+          ```
+        '';
+      };
+
+    };
+
+    virtualisation.vz.nestedVirtualization = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = ''
+        Boot the guest at EL2 so it gets a working `/dev/kvm`, which the Nix
+        daemon inside then advertises as the `kvm` system feature — required
+        for running NixOS integration tests on the builder.
+
+        Needs macOS 15+ and an M3 or newer chip; the VM refuses to start
+        otherwise rather than quietly advertising a `kvm` it does not have.
+      '';
+    };
+
+    virtualisation.vz.forwardPorts = lib.mkOption {
+      type = lib.types.listOf (
+        lib.types.submodule {
+          options.host.address = lib.mkOption {
+            type = lib.types.str;
+            default = "127.0.0.1";
+            description = "Host address to listen on.";
+          };
+          options.host.port = lib.mkOption {
+            type = lib.types.port;
+            description = "Host port to listen on.";
+          };
+          options.guest.port = lib.mkOption {
+            type = lib.types.port;
+            description = "Guest *vsock* port that connections are forwarded to.";
+          };
+        }
+      );
+      default = [ ];
+      example = lib.literalExpression ''
+        [ { host.port = 2222; guest.port = 22; } ]
+      '';
+      description = ''
+        Forward host TCP ports into guest over vsock.
+
+        Going via vsock relieves us from having to find a stable inbound address
+        in the NAT network setup.
+      '';
+    };
+
+    virtualisation.vz.console = lib.mkOption {
+      type = lib.types.enum [
+        "stdio"
+        "file"
+        "log"
+      ];
+      default = "stdio";
+      description = ''
+        Where the guest console goes.
+
+        - `stdio`: standard output, which is interactive but goes nowhere under launchd.
+        - `file`: the path in {option}`virtualisation.vz.consoleLog`. The only complete
+          record: the unified log rate-limits chatty sources and drops under bursts.
+        - `log`: macOS unified logging, alongside vzvm's own diagnostics. Read it with
+          `log show --predicate 'subsystem == "systems.applicative.vzvm"'`, and narrow to
+          the guest with `AND category == "guest"`.
+      '';
+    };
+
+    virtualisation.vz.consoleLog = lib.mkOption {
+      type = lib.types.str;
+      default = "./console.log";
+      description = ''
+        Console log file, used when {option}`virtualisation.vz.console` is `file`.
+        Relative paths are resolved against working directory.
+      '';
+    };
+
+    virtualisation.vz.diskImage = lib.mkOption {
+      type = lib.types.nullOr lib.types.str;
+      default = "./${config.system.name}.img";
+      defaultText = lib.literalExpression ''"./''${config.system.name}.img"'';
+      description = ''
+        Path to the raw data disk backing the writable store, created on first
+        start. Set to `null` to run without one, which requires
+        {option}`virtualisation.writableStoreUseTmpfs`.
+      '';
+    };
+
+    virtualisation.vz.extraConfig = lib.mkOption {
+      type = lib.types.attrs;
+      default = { };
+      description = ''
+        Additional attributes merged into the generated `vzvm` JSON configuration.
+      '';
+    };
+  };
+
+  config = lib.mkMerge [
+    {
+      assertions = [
+        {
+          assertion = hostPkgs.stdenv.hostPlatform.system == "aarch64-darwin";
+          message = ''
+            virtualisation.vz only runs on aarch64-darwin hosts, but
+            `virtualisation.host.pkgs` is ${hostPkgs.stdenv.hostPlatform.system}.
+          '';
+        }
+        {
+          assertion = pkgs.stdenv.hostPlatform.isAarch64;
+          message = ''
+            virtualisation.vz cannot emulate a foreign architecture: the guest
+            (${pkgs.stdenv.hostPlatform.system}) must be aarch64. x86_64 guest
+            binaries run through Rosetta instead, not through emulation.
+          '';
+        }
+        {
+          assertion = vzCfg.diskImage != null || cfg.writableStoreUseTmpfs;
+          message = ''
+            virtualisation.vz.diskImage is null, so there is nowhere to put the
+            writable store. Enable virtualisation.writableStoreUseTmpfs.
+          '';
+        }
+      ];
+
+      boot.loader.grub.enable = false;
+
+      boot.initrd.availableKernelModules = [
+        "virtio_pci"
+        "virtio_blk"
+        "virtio_console"
+        "virtiofs"
+        "erofs"
+        "overlay"
+      ];
+
+      # Inbound connections go via vsock; loaded in the initrd so `systemd-ssh-generator` finds `/dev/vsock`.
+      boot.initrd.kernelModules = [ "vmw_vsock_virtio_transport" ];
+
+      boot.initrd.systemd.enable = lib.mkDefault true;
+
+      system.requiredKernelConfig = with config.lib.kernelConfig; [
+        (isEnabled "VIRTIO_BLK")
+        (isEnabled "VIRTIO_PCI")
+        (isEnabled "VIRTIO_CONSOLE")
+        (isEnabled "VIRTIO_NET")
+        (isYes "BLK_DEV_INITRD")
+        (isEnabled "FUSE_FS")
+        (isEnabled "VIRTIO_FS")
+        (isEnabled "EROFS_FS")
+        (isEnabled "OVERLAY_FS")
+        (isEnabled "VSOCKETS")
+        (isEnabled "VIRTIO_VSOCKETS")
+      ];
+
+      # Override per entry and not as a whole: see note in vm-base.nix.
+      fileSystems = {
+        "/" = lib.mkVMOverride {
+          device = "tmpfs";
+          fsType = "tmpfs";
+          neededForBoot = true;
+          options = [ "mode=0755" ];
+        };
+      }
+      // lib.optionalAttrs (!cfg.writableStoreUseTmpfs && vzCfg.diskImage != null) {
+        # Second disk, hence /dev/vdb: store image is always first.
+        "/nix/.rw-store" = lib.mkVMOverride {
+          device = "/dev/vdb";
+          fsType = "ext4";
+          autoFormat = true;
+          neededForBoot = true;
+        };
+      }
+      // lib.mapAttrs' (
+        _: share:
+        lib.nameValuePair share.target (
+          lib.mkVMOverride {
+            device = share.tag;
+            fsType = "virtiofs";
+          }
+        )
+      ) cfg.sharedDirectories;
+
+      # DHCP and DNS come from host NAT
+      networking.useDHCP = lib.mkDefault true;
+
+      virtualisation.rosetta.enable = lib.mkIf vzCfg.rosetta.enable true;
+      # Must agree with the tag vzvm shares Rosetta under, which is fixed.
+      virtualisation.rosetta.mountTag = lib.mkIf vzCfg.rosetta.enable "rosetta";
+
+      system.build.vm =
+        hostPkgs.runCommand "nixos-vm"
+          {
+            preferLocalBuild = true;
+            meta.mainProgram = "run-${config.system.name}-vm";
+          }
+          ''
+            mkdir -p $out/bin
+            ln -s ${config.system.build.toplevel} $out/system
+            ln -s ${hostPkgs.writeShellScript "run-${config.system.name}-vm" ''
+              set -eu
+
+              # nix-darwin runs this with a working directory it owns
+              imageDir="''${VZVM_STATE_DIR:-$PWD}"
+              mkdir -p "$imageDir"
+
+              if [ -z "''${TMPDIR:-}" ]; then
+                # GNU mktemp needs the XXXXXX placeholder; only reachable when TMPDIR is unset.
+                TMPDIR=$(${hostPkgs.coreutils}/bin/mktemp -d -t vzvm.XXXXXX)
+              fi
+              export TMPDIR
+
+              ${lib.optionalString cfg.useHostCerts ''
+                mkdir -p "$TMPDIR/certs"
+                if [ -e "''${NIX_SSL_CERT_FILE:-}" ]; then
+                  ${hostPkgs.coreutils}/bin/install -m 0644 \
+                    "$NIX_SSL_CERT_FILE" "$TMPDIR/certs/ca-certificates.crt"
+                else
+                  echo "vzvm: NIX_SSL_CERT_FILE is unset or missing; guest gets no host CA certificates" >&2
+                  : > "$TMPDIR/certs/ca-certificates.crt"
+                fi
+              ''}
+
+              storeImage="$imageDir/${storeImageName}"
+
+              if [ ! -f "$storeImage" ]; then
+                echo "Building Nix store image, this can take a minute on first boot..." >&2
+
+                # Build into a temp file so an interrupted run leaves no truncated image behind.
+                storeImageTmp="$storeImage.tmp.$$"
+                # shellcheck disable=SC2064
+                trap "rm -f '$storeImageTmp'" EXIT
+
+                ${import ../../lib/erofs-store-image.nix {
+                  inherit hostPkgs;
+                  storePaths = "${storeClosureInfo}/store-paths";
+                  label = "nix-store";
+                  destination = ''"$storeImageTmp"'';
+                }}
+                mv "$storeImageTmp" "$storeImage"
+                trap - EXIT
+
+                # Images from previous generations are dead weight and cheap to rebuild.
+                find "$imageDir" -maxdepth 1 -name 'store-*.img' ! -name ${lib.escapeShellArg storeImageName} -delete
+              fi
+
+              disks=$(${lib.getExe hostPkgs.jq} -n --arg store "$storeImage" \
+                '[{path: $store, readOnly: true}]')
+
+              shares='[]'
+              ${shareFragment}
+
+              ${lib.optionalString (vzCfg.diskImage != null) ''
+                dataDisk="${vzCfg.diskImage}"
+                case "$dataDisk" in
+                  /*) ;;
+                  *) dataDisk="$imageDir/''${dataDisk#./}" ;;
+                esac
+
+                if [ ! -f "$dataDisk" ]; then
+                  echo "Creating ${toString cfg.diskSize}M data disk at $dataDisk..." >&2
+                  ${hostPkgs.coreutils}/bin/dd if=/dev/zero of="$dataDisk" bs=1M count=0 \
+                     seek=${toString cfg.diskSize}
+                fi
+
+                disks=$(${lib.getExe hostPkgs.jq} -n --argjson disks "$disks" --arg data "$dataDisk" \
+                  '$disks + [{path: $data, readOnly: false}]')
+              ''}
+
+              config="$imageDir/vzvm.json"
+              ${lib.getExe hostPkgs.jq} --argjson disks "$disks" --argjson shares "$shares" \
+                '.disks = $disks | .shares = $shares' ${staticConfigFile} > "$config"
+
+              exec ${lib.getExe vzCfg.package} "$config"
+            ''} $out/bin/run-${config.system.name}-vm
+          '';
+    }
+
+    (lib.mkIf config.services.openssh.enable {
+      # `systemd-ssh-generator` serves SSH on vsock:22; retune its socket for `ssh-ng://` build traffic.
+      systemd.sockets.sshd-vsock = {
+        overrideStrategy = "asDropin";
+        socketConfig = {
+          # past the default 64 concurrent connections, systemd stops accepting and ssh hangs silently
+          MaxConnections = 512;
+
+          # don't stop the socket unit outright when connections arrive in bursts
+          TriggerLimitIntervalSec = 0;
+        };
+      };
+
+      systemd.services."sshd-vsock@" = {
+        overrideStrategy = "asDropin";
+        # don't race host key generation on first boot
+        wants = [ "sshd-keygen.service" ];
+        after = [ "sshd-keygen.service" ];
+        serviceConfig.TimeoutStopSec = 10;
+      };
+
+      # vsock delivers no RST, so without keepalives a session whose peer vanished never dies.
+      services.openssh.settings = {
+        ClientAliveInterval = lib.mkDefault 60;
+        ClientAliveCountMax = lib.mkDefault 3;
+      };
+    })
+
+    (lib.mkIf cfg.useHostCerts {
+      virtualisation.sharedDirectories.certs = {
+        source = "$TMPDIR/certs";
+        target = "/etc/ssl/certs";
+      };
+      security.pki.installCACerts = false;
+    })
+  ];
+}
--- a/nixos/tests/web-apps/goupile/default.nix
+++ b/nixos/tests/web-apps/goupile/default.nix
@@ -100,7 +100,6 @@ in
    in
    # py
    ''
-      import os
      start_all()

      machine.wait_for_unit("goupile.service")
@@ -113,8 +112,7 @@ in
      try:
          machine.succeed("run-goupile-test")
      finally:
-          out_dir = os.environ.get("out", os.getcwd())
-          machine.copy_from_machine("/tmp/videos", out_dir)
+          machine.copy_from_machine("/tmp/videos")
    '';

  # Debug interactively with:
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -1030,6 +1030,27 @@ assertNoAdditions {
    ];
  };

+  copilot-lua = super.copilot-lua.overrideAttrs {
+    # Avoid copying the bundled 500MB language server into the plugin output.
+    preInstall = ''
+      rm -rf copilot/js
+    '';
+
+    postInstall = ''
+      mkdir -p $target/copilot
+      ln -s ${copilot-language-server}/share/copilot-language-server $target/copilot/js
+
+      substituteInPlace $target/lua/copilot/lsp/nodejs.lua \
+        --replace-fail "copilot/js/language-server.js" "copilot/js/main.js"
+      sed -i 's/version = "[^"]*"/version = "${copilot-language-server.version}"/' $target/lua/copilot/util.lua
+    '';
+
+    runtimeDeps = [
+      copilot-language-server
+      nodejs
+    ];
+  };
+
  copilot-lualine = super.copilot-lualine.overrideAttrs {
    dependencies = with self; [
      copilot-lua
--- a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
@@ -21,22 +21,22 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
      sources = {
        "x86_64-linux" = {
          arch = "linux-x64";
-          hash = "sha256-GUuO8kJczyQOV/wIxFd8AJ5Td6kuSqPCxB/pPsbwxi4=";
+          hash = "sha256-f3LZmh6UYiMK1fUwlwG+oeaukvbf5cy9yOPay+l5XfU=";
        };
        "aarch64-linux" = {
          arch = "linux-arm64";
-          hash = "sha256-EhN34a1o8qMPp8oOnoBfUQDTaibTQq5DlQo++kl/ugQ=";
+          hash = "sha256-T/LEgnwGBuB/+1kbyedKr9MKH2J9sJrIIT3HAU1LYPU=";
        };
        "aarch64-darwin" = {
          arch = "darwin-arm64";
-          hash = "sha256-5nHyEKub7LLHN+bpN+u36wAs7Q4iY+vgVgd4VPgzOXg=";
+          hash = "sha256-0duH4OMNXXciZmWG+Y+oPmWWcemn+Y0t0GTJOQ1jSyQ=";
        };
      };
    in
    {
      name = "claude-code";
      publisher = "anthropic";
-      version = "2.1.220";
+      version = "2.1.221";
    }
    // sources.${stdenvNoCC.hostPlatform.system}
      or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
--- a/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/saoudrizwan.claude-dev/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "claude-dev";
    publisher = "saoudrizwan";
-    version = "4.0.11";
-    hash = "sha256-uMPvpwpMOryh8lmL90wwI4GSOefX+hQioaEKNt0WmU8=";
+    version = "4.1.3";
+    hash = "sha256-z1TrY/GWPkB14LSbFBALotU/WY2qHW6aj92PxCn4Uhc=";
  };

  meta = {
--- a/pkgs/applications/networking/charles/default.nix
+++ b/pkgs/applications/networking/charles/default.nix
@@ -114,8 +114,8 @@ in
 {
  charles5 = (
    generic {
-      version = "5.1";
-      hash = "sha256-gExmuh1A21QGkfcmcwPPgk51Ag7Ced9kPTHha2ofbKg=";
+      version = "5.2.1";
+      hash = "sha256-li08tpPDumfXnjeVkkNdO7kRhxqyrGIaWCWU2rV1fu8=";
      platform = "_x86_64";
      jdk = jdk25;

--- a/pkgs/by-name/ap/apfel-llm/package.nix
+++ b/pkgs/by-name/ap/apfel-llm/package.nix
@@ -8,7 +8,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "apfel-llm";
-  version = "1.8.4";
+  version = "1.9.0";

  __structuredAttrs = true;
  strictDeps = true;
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
  # Building from source requires swift 6.3.0 while nixpkgs only has 5.10.1
  src = fetchurl {
    url = "https://github.com/Arthur-Ficial/apfel/releases/download/v${finalAttrs.version}/apfel-${finalAttrs.version}-arm64-macos.tar.gz";
-    hash = "sha256-farvPPo3VU2qUat+72qaiMpcd9LwFO7kqzGGKKtPwGE=";
+    hash = "sha256-1DnZbp4iXlrC7eUGWd8NEEiryxPvRqndJ1++gAskEYQ=";
  };

  sourceRoot = ".";
--- a/pkgs/by-name/ba/babeldoc/package.nix
+++ b/pkgs/by-name/ba/babeldoc/package.nix
@@ -1,83 +1,77 @@
 {
  lib,
-  python3Packages,
+  python313Packages,
  fetchFromGitHub,
-  fetchpatch2,
-  writableTmpDirAsHomeHook,
  versionCheckHook,
 }:

+let
+  python3Packages = python313Packages;
+in
 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "babeldoc";
-  version = "0.5.22";
+  version = "0.6.4";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "funstory-ai";
    repo = "BabelDOC";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ArLTv5AjpUdbsN8bQs03ATwg5ugXetld2FmHhicU8OE=";
+    hash = "sha256-eYCIXMYOJPGReDFkFdxgrhpkAG/pA14v3Si+5unfXz4=";
  };

-  patches = [
-    (fetchpatch2 {
-      name = "rename-python-levenshtein-to-levenshtein";
-      url = "https://github.com/funstory-ai/BabelDOC/pull/542.patch?full_index=1";
-      hash = "sha256-rjXhKVFivkJo54WdYiihqB3lrlu4YEwVZZkE4WBatWs=";
-    })
+  build-system = with python3Packages; [
+    hatchling
  ];

-  build-system = with python3Packages; [ hatchling ];
-
  dependencies =
    with python3Packages;
    [
      bitstring
+      chardet
+      charset-normalizer
      configargparse
+      cryptography
+      freetype-py
      httpx
      huggingface-hub
+      hyperscan
+      levenshtein
+      msgpack
      numpy
      onnx
      onnxruntime
      openai
+      opencv-python-headless
      orjson
-      charset-normalizer
-      cryptography
      peewee
      psutil
+      pydantic
      pymupdf
+      pyzstd
+      rapidocr-onnxruntime
      rich
+      rtree
+      scikit-image
+      scikit-learn
+      scipy
+      tenacity
+      tiktoken
      toml
      tqdm
-      xsdata
-      msgpack
-      pydantic
-      tenacity
-      scikit-image
-      freetype-py
-      tiktoken
-      levenshtein
-      opencv-python-headless
-      rapidocr-onnxruntime
-      pyzstd
-      hyperscan
-      rtree
-      chardet
-      scipy
      uharfbuzz
-      scikit-learn
+      xsdata
    ]
    ++ httpx.optional-dependencies.socks
    ++ (with xsdata.optional-dependencies; cli ++ lxml ++ soap);

  pythonImportsCheck = [ "babeldoc" ];

+  # Upstream dropped its test suite in 0.6.0
  nativeCheckInputs = [
-    writableTmpDirAsHomeHook
-    python3Packages.pytestCheckHook
    versionCheckHook
  ];
-  versionCheckKeepEnvironment = "HOME";

  meta = {
    description = "PDF scientific paper translation and bilingual comparison library";
--- a/pkgs/by-name/ca/cargo-modules/package.nix
+++ b/pkgs/by-name/ca/cargo-modules/package.nix
@@ -6,16 +6,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-modules";
-  version = "0.26.0";
+  version = "0.27.0";

  src = fetchFromGitHub {
    owner = "regexident";
    repo = "cargo-modules";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-wERrtMrmR4PKfCzhTCMLZyIkvawDy5HcfeMCTzxVLPc=";
+    hash = "sha256-wwGuf6ev2H19XauDN60T9NS/onY6ZKr99S6nGhK/V98=";
  };

-  cargoHash = "sha256-RriIKgRmSmgdTWncfmnbFfusru/+ChgDoS7bkmjI7N8=";
+  cargoHash = "sha256-cESCXoETQzy+3Lb/z2jdbPmnyYNEoNUckFsPZWfDF8o=";

  checkFlags = [
    "--skip=cfg_test::with_tests::smoke"
--- a/pkgs/by-name/ch/changie/package.nix
+++ b/pkgs/by-name/ch/changie/package.nix
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "changie";
-  version = "1.25.1";
+  version = "1.25.2";

  src = fetchFromGitHub {
    owner = "miniscruff";
    repo = "changie";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-zLAUOxe/PdVGBeT7inwZJuf/vascir32ade5CWqyvrM=";
+    hash = "sha256-fWPN3oEhJEosb47QUPpi9KtXzTORFVWq/W241L+tnyQ=";
  };

  vendorHash = "sha256-+N/h5kNEiSFe1fnzuk/oqf8g0eND4SgHCN/HM9oOgoE=";
--- a/pkgs/by-name/ch/chromium-hsts-preload-list/package.nix
+++ b/pkgs/by-name/ch/chromium-hsts-preload-list/package.nix
@@ -6,11 +6,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "chromium-hsts-preload-list";
-  version = "152.0.7972.1";
+  version = "153.0.7990.1";

  src = fetchurl {
    url = "https://raw.github.com/chromium/chromium/${finalAttrs.version}/net/http/transport_security_state_static.json";
-    hash = "sha256-WcMwEnezQY5xbYGNJhEO2wc37bhxxbunRiFY2hstG9k=";
+    hash = "sha256-ObT9lWtjw/V0UGY552pEWJ6KbfF0izB/zJ7v+00IFB8=";
  };

  dontUnpack = true;
--- a/pkgs/by-name/cl/claude-code/manifest.json
+++ b/pkgs/by-name/cl/claude-code/manifest.json
@@ -1,47 +1,47 @@
 {
-  "version": "2.1.220",
-  "commit": "4073f59596e272f39393db4f96abc5f4b10eff21",
-  "buildDate": "2026-07-24T22:28:51Z",
+  "version": "2.1.221",
+  "commit": "6efaf12e8b43dc7dbe50e0955c76dc4174a15876",
+  "buildDate": "2026-08-03T21:08:11Z",
  "platforms": {
    "darwin-arm64": {
      "binary": "claude",
-      "checksum": "8addc857f3fe64d5a0368af9ee50321b50afb4a6918ba3ef018ab84f5dbbe081",
-      "size": 256908272
+      "checksum": "7a181f36ed0fc4fbac6cee4ecf2b615eff93d8b434221fff5d7c878dc5ebf380",
+      "size": 270518240
    },
    "darwin-x64": {
      "binary": "claude",
-      "checksum": "dca7be0aa7d3d924836d440e0c6d8e3d47ef3c8e61fa5809b54b9017170ce2f3",
-      "size": 266397712
+      "checksum": "f408b9f7e46439f6e34a3687ff67433fc6bc189f40220ce4f0a1e829e58f0a52",
+      "size": 280087584
    },
    "linux-arm64": {
      "binary": "claude",
-      "checksum": "159e4a51d796f3bf14677577100f7efb845611b1ceaf0c30cbd8d4650d942185",
-      "size": 271825824
+      "checksum": "d3c59d6bcc4adcf4cd85abca3bc13fa1131a34cb32f982bdf030d83a3b11e700",
+      "size": 285457336
    },
    "linux-x64": {
      "binary": "claude",
-      "checksum": "674f61f20ff306f3100cf9200e4c36c4b70278b5bef2884549819b942a89c863",
-      "size": 275012592
+      "checksum": "60db8e88d42c24b5199c92cfd56ec88370c510c3789c6f364af748354f087ada",
+      "size": 288705544
    },
    "linux-arm64-musl": {
      "binary": "claude",
-      "checksum": "5eb2697a1500c1b8736e53fd696392196dc6758cf1d470c64d8d2a2fd1629eeb",
-      "size": 265074024
+      "checksum": "85985afd58d33578efd217788dd9e5cbbc0177ad00e638d9316c6fd89640f3ff",
+      "size": 278771048
    },
    "linux-x64-musl": {
      "binary": "claude",
-      "checksum": "f1c20514a3571cdf9982e25c490042d740ed7cfed3f00c64ba92dc7ec47c3c5b",
-      "size": 269636176
+      "checksum": "15b068e06eafff9b64583b46cdc065ac18b0d0d13950c2a83c6ee854f301a32f",
+      "size": 283312720
    },
    "win32-x64": {
      "binary": "claude.exe",
-      "checksum": "af5bf1f1b2aadffc768eccd787084c6fdf9ba81624cbe96c1c6d9ac1a1550231",
-      "size": 265720480
+      "checksum": "0f73196359a07f9ad435a8c83ca7c741b9f2adbc0ad9b05f71a0c2f4aabe906a",
+      "size": 278279328
    },
    "win32-arm64": {
      "binary": "claude.exe",
-      "checksum": "07343ace8a2e9ba87eed716e9c0261ce4bda8954c316695e4cb26fd0605de13c",
-      "size": 260095648
+      "checksum": "1407585e0c33a70061d6ea7cb873b8582dcedbe928d2118982676f1951576a58",
+      "size": 272952480
    }
  },
  "sdkCompat": {
@@ -68,9 +68,14 @@
      "0.3.207",
      "0.3.208",
      "0.3.209",
+      "0.3.210",
+      "0.3.211",
+      "0.3.212",
+      "0.3.214",
      "0.3.215",
      "0.3.217",
-      "0.3.218"
+      "0.3.218",
+      "0.3.220"
    ],
    "harnessSchema": 1
  }
--- a/pkgs/by-name/cr/cri-o-unwrapped/package.nix
+++ b/pkgs/by-name/cr/cri-o-unwrapped/package.nix
@@ -17,13 +17,13 @@

 buildGoModule (finalAttrs: {
  pname = "cri-o";
-  version = "1.36.2";
+  version = "1.36.3";

  src = fetchFromGitHub {
    owner = "cri-o";
    repo = "cri-o";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-mrR0Q23PCe2OMCgH6AgmSzE4zmZzTA6SiMD8OYiWdpE=";
+    hash = "sha256-AhsSi79HUbNvPoa7duOl9290ZjKss2a6RLvRPHDh6Sg=";
  };
  vendorHash = null;

--- a/pkgs/by-name/fd/fdk-aac-encoder/package.nix
+++ b/pkgs/by-name/fd/fdk-aac-encoder/package.nix
@@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "fdkaac";
-  version = "1.0.8";
+  version = "1.0.9";

  src = fetchFromGitHub {
    owner = "nu774";
    repo = "fdkaac";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-8fI3mbHPb6E5YXl4RaqU8P0ALldkOh+RKfecDX87m/s=";
+    hash = "sha256-JEgjiY0i/c7MWEpc61BUmQsoV3FtvGMjMkRdbMkIpfo=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/fi/filebrowser/package.nix
+++ b/pkgs/by-name/fi/filebrowser/package.nix
@@ -15,13 +15,13 @@
 }:

 let
-  version = "2.63.20";
+  version = "2.63.23";

  src = fetchFromGitHub {
    owner = "filebrowser";
    repo = "filebrowser";
    tag = "v${version}";
-    hash = "sha256-TyCd3AAfc/qMSG1mYZ9OF5kiHTrSRuJ8EzBM5fNzqnA=";
+    hash = "sha256-G0TIQE+Rru4JWBJIi8kdxSaP0CDPo2DyWLmcU2AX7Fs=";
  };

  frontend = stdenvNoCC.mkDerivation (finalAttrs: {
@@ -46,7 +46,7 @@ let
        ;
      fetcherVersion = 3;
      pnpm = pnpm_10;
-      hash = "sha256-UwTA7Eogp2GrvmXDbdfGBTJS3DuOTJ42e6fHlQxSHoA=";
+      hash = "sha256-XZdHaXnIfjA1wO6KQihj6PwXQ5LEcMrLRe2Md65nQ38=";
    };

    installPhase = ''
@@ -64,7 +64,7 @@ buildGoModule {
  pname = "filebrowser";
  inherit version src;

-  vendorHash = "sha256-BXw+fURCh1qNlwWo49aXIpSM339bV3Gwn9Ov8HLEVF0=";
+  vendorHash = "sha256-CuYi2PfR0F0lppFiRFzFj0yLms7VFNxzKpzlmEaCWWs=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/fr/frei0r/package.nix
+++ b/pkgs/by-name/fr/frei0r/package.nix
@@ -1,33 +1,38 @@
 {
-  lib,
-  config,
-  stdenv,
-  fetchFromGitHub,
  cairo,
  cmake,
+  config,
+  fetchFromGitHub,
+  gavl,
+  lib,
  opencv,
  pkg-config,
-  cudaSupport ? config.cudaSupport,
+  stdenv,
  cudaPackages,
+  cudaSupport ? config.cudaSupport,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "frei0r-plugins";
-  version = "2.5.1";
+  version = "3.2.1";

  src = fetchFromGitHub {
    owner = "dyne";
    repo = "frei0r";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-3gUWvO5izOrJt+XwcNBNiLfu+iMqo4nuPbx++TYzao0=";
+    hash = "sha256-eBaaEE+4mKYr5VCXUnoS/4aE6EV8DnXFJLFYsrk3gs0=";
  };

+  strictDeps = true;
+  __structuredAttrs = true;
+
  nativeBuildInputs = [
    cmake
    pkg-config
  ];
  buildInputs = [
    cairo
+    gavl
    opencv
  ]
  ++ lib.optionals cudaSupport [
@@ -42,10 +47,12 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  meta = {
-    homepage = "https://frei0r.dyne.org";
    description = "Minimalist, cross-platform, shared video plugins";
+    homepage = "https://frei0r.dyne.org";
    license = lib.licenses.gpl2Plus;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      nick-linux
+    ];
    platforms = lib.platforms.unix;
  };
 })
--- a/pkgs/by-name/ga/gavl/package.nix
+++ b/pkgs/by-name/ga/gavl/package.nix
@@ -0,0 +1,56 @@
+{
+  autoreconfHook,
+  doxygen,
+  fetchFromGitHub,
+  gnutls,
+  lib,
+  libdrm,
+  libGL,
+  libGLU,
+  libpng,
+  nettle,
+  pkg-config,
+  stdenv,
+  zlib,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "gavl";
+  version = "2.0.1";
+
+  src = fetchFromGitHub {
+    owner = "bplaum";
+    repo = "gavl";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-nvgBsUiSF6+voMzo5XRWHig2Iq8DD2hVV5hWodGxgQo=";
+  };
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    autoreconfHook
+    doxygen
+    pkg-config
+  ];
+
+  buildInputs = [
+    gnutls
+    libdrm
+    libGL
+    libGLU
+    libpng
+    nettle
+    zlib
+  ];
+
+  meta = {
+    description = "Low level library for handling uncompressed audio and video data";
+    homepage = "https://github.com/bplaum/gavl";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [
+      nick-linux
+    ];
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/by-name/gi/git-metrics/package.nix
+++ b/pkgs/by-name/gi/git-metrics/package.nix
@@ -5,20 +5,22 @@
  gitMinimal,
  rustPlatform,
  openssl,
+  versionCheckHook,
+  nix-update-script,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "git-metrics";
-  version = "0.2.6";
+  version = "0.2.7";

  src = fetchFromGitHub {
    owner = "jdrouet";
    repo = "git-metrics";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-SdA/FpdrbC36Ny7aBpTUvFldbYXyajSqWGheaDPHYoE=";
+    hash = "sha256-z34yzKHoTskIDPWl9LHy9dsXeNxwlI6kD73EzeSUrN0=";
  };

-  cargoHash = "sha256-e4CdpwoFl8leV5HJWkWBpvPrVrk+7vq49yTPkpeQ2Ng=";
+  cargoHash = "sha256-7/1Jf3GJmEydTDVL3oGIKIkCHAMKJ8BE6PUmpWH0xcQ=";

  buildInputs = [
    openssl
@@ -38,10 +40,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
    "--skip=tests::display_diff::execute"
    "--skip=tests::simple_use_case::execute::with_command_backend"
    "--skip=tests::simple_use_case::execute::with_git2_backend"
+    "--skip=tests::config_override"
  ];

+  passthru.updateScript = nix-update-script { };
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
  meta = {
    homepage = "https://github.com/jdrouet/git-metrics";
+    changelog = "https://github.com/jdrouet/git-metrics/releases/tag/v${finalAttrs.version}";
    description = "Git extension to be able to track metrics about your project, within the git repository";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [
--- a/pkgs/by-name/gr/gramps/package.nix
+++ b/pkgs/by-name/gr/gramps/package.nix
@@ -23,7 +23,7 @@
 }:

 python3Packages.buildPythonApplication (finalAttrs: {
-  version = "6.0.6";
+  version = "6.0.8";
  pname = "gramps";
  pyproject = true;

@@ -31,7 +31,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
    owner = "gramps-project";
    repo = "gramps";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-+sWO+c7haKXH42JVT6Zpz70cHdGC/TPgBUMSD+0+/JI=";
+    hash = "sha256-Kq+QyhghBmUzl+ooCYSl2yNMvrBDnQS6Zg3nBI1jbRo=";
  };

  patches = [
--- a/pkgs/by-name/hy/hyperscan/package.nix
+++ b/pkgs/by-name/hy/hyperscan/package.nix
@@ -8,7 +8,7 @@
  util-linux,
  pkg-config,
  boost,
-  pcre2,
+  pcre,
  withStatic ? false, # build only shared libs by default, build static+shared if true
 }:

@@ -16,6 +16,9 @@ stdenv.mkDerivation (finalAttrs: {
  pname = "hyperscan";
  version = "5.4.2";

+  __structuredAttrs = true;
+  strictDeps = true;
+
  src = fetchFromGitHub {
    owner = "intel";
    repo = "hyperscan";
@@ -75,10 +78,11 @@ stdenv.mkDerivation (finalAttrs: {
  # hyperscan CMake is completely broken for chimera builds when pcre is compiled
  # the only option to make it build - building from source
  # In case pcre is built from source, chimera build is turned on by default
+  # NOTE: chimera requires PCRE1 (>= 8.41), it is not compatible with pcre2.
  preConfigure = lib.optionalString withStatic (
    ''
      mkdir -p pcre
-      tar xvf ${pcre2.src} --strip-components 1 -C pcre
+      tar xvf ${pcre.src} --strip-components 1 -C pcre
    ''
    # - CMake 4 dropped support of versions lower than 3.5, versions lower than 3.10 are deprecated.
    #   https://github.com/NixOS/nixpkgs/issues/445447
--- a/pkgs/by-name/hy/hysteria/package.nix
+++ b/pkgs/by-name/hy/hysteria/package.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "hysteria";
-  version = "2.9.1";
+  version = "2.11.0";

  src = fetchFromGitHub {
    owner = "apernet";
    repo = "hysteria";
    rev = "app/v${finalAttrs.version}";
-    hash = "sha256-pWiEY1H9iX5aX2nR/K8fNKeAbzLOCZhEe5KLk4arot4=";
+    hash = "sha256-9G+kbYLfrucZ9WhLRZmenZUGDXuMjtwR8a91deCAzGk=";
  };

-  vendorHash = "sha256-IFC/LMI28cGfUTtgTYf045OAEaMdPgd1bzhdSngQlrA=";
+  vendorHash = "sha256-oQBdrolZLliesWQ9uqqKp5gXLU/Ze8+b2QTGOamTLjQ=";
  proxyVendor = true;

  ldflags =
--- a/pkgs/by-name/ka/karp/package.nix
+++ b/pkgs/by-name/ka/karp/package.nix
@@ -65,7 +65,7 @@ stdenv.mkDerivation {
      bsd3
      cc-by-sa-40
      cc0
-      # FSFAP
+      fsfap
      gpl2Only
      gpl3Only
      lgpl2Plus
--- a/pkgs/by-name/ko/koreader/package.nix
+++ b/pkgs/by-name/ko/koreader/package.nix
@@ -17,7 +17,7 @@
 }:

 let
-  version = "2026.03";
+  version = "2026.07.1";

  # LuaJIT with table.pack/unpack support for KOReader
  # https://github.com/koreader/koreader-base/tree/master/thirdparty/luajit
@@ -35,7 +35,7 @@ let
    owner = "koreader";
    tag = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-KWpWlFoBEAhVDuRTiF7yj1wlKLzYmvcngI9iWqsDuQY=";
+    hash = "sha256-395G5bu0gs0oKOc/CfKNeal66vgXBDgHSpopoQ0GRzw=";
  };
 in
 stdenv.mkDerivation {
@@ -59,9 +59,9 @@ stdenv.mkDerivation {
    fetchurl {
      url = "https://github.com/koreader/koreader/releases/download/v${version}/koreader_${version}-1_${arch}.deb";
      hash = selectSystem {
-        aarch64-linux = "sha256-4ulpMXYcICQ5/9Q0GGn9lkbW0ntzIfUHQ5woTAhyXLU=";
-        armv7l-linux = "sha256-diMWFhL0D5bWPQFc9vvZZRPMfNxlxchGyT8Lz/TLHPs=";
-        x86_64-linux = "sha256-OhBu3oj9IqNmK5ngCkXvucVQq5aJohObgENtjdDcQcE=";
+        aarch64-linux = "sha256-swwNcmquMjnO31pFNkKZbqU8Kx7Rtwq2ebT12XK8yvQ=";
+        armv7l-linux = "sha256-TpMm9smcDff7A4BkWguWuOwDAJXQITk/HGmDgDIRtrw=";
+        x86_64-linux = "sha256-CWmnfC7Dy4nVf7diwRvsOvE12W/gkE2235h49Hq0f4k=";
      };
    };

--- a/pkgs/by-name/ml/mlkit/package.nix
+++ b/pkgs/by-name/ml/mlkit/package.nix
@@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "mlkit";
-  version = "4.7.21";
+  version = "4.7.22";

  src = fetchFromGitHub {
    owner = "melsman";
    repo = "mlkit";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-c1GdM3K6dgY0EgHu01adBXwAxuMehRfo73Lo71couJ4=";
+    hash = "sha256-YbWvKakqLnsPeM2kTDlqcRZRqcpUHfd0PI34iwlXQGI=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/mu/multiviewer-for-f1/package.nix
+++ b/pkgs/by-name/mu/multiviewer-for-f1/package.nix
@@ -31,15 +31,15 @@
  writeScript,
 }:
 let
-  id = "415542776";
+  id = "490012920";
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "multiviewer-for-f1";
-  version = "2.7.3";
+  version = "2.8.3";

  src = fetchurl {
    url = "https://releases.multiviewer.app/download/${id}/multiviewer_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-O5yo51VHQW+t8uz6SZIzkyhznCi6Tv1xv7WU3DD7y+w=";
+    hash = "sha256-yYCbWRnh66vIZo7/RNAaj/0wuwIJcYxqquuDEfkua7g=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/nt/ntfy-sh/package.nix
+++ b/pkgs/by-name/nt/ntfy-sh/package.nix
@@ -38,13 +38,13 @@ buildGoModule (
  in
  {
    pname = "ntfy-sh";
-    version = "2.26.0";
+    version = "2.26.3";

    src = fetchFromGitHub {
      owner = "binwiederhier";
      repo = "ntfy";
      tag = "v${finalAttrs.version}";
-      hash = "sha256-/VOCztlfi8n12PrUmv17jNpV2/aVh+G0Qq0/leuHnzw=";
+      hash = "sha256-J76og4Iosaf22hlx5CJRwReXhAELsaY+PCGtxhcP1Ug=";
    };

    vendorHash = "sha256-t/NTLIL+eVFBFuTy6T1st8cdRliJZCYHojyDx76IW7o=";
--- a/pkgs/by-name/nu/nuclei-templates/package.nix
+++ b/pkgs/by-name/nu/nuclei-templates/package.nix
@@ -6,13 +6,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "nuclei-templates";
-  version = "10.4.6";
+  version = "10.4.7";

  src = fetchFromGitHub {
    owner = "projectdiscovery";
    repo = "nuclei-templates";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Mv+W1CmUUAs6KntuTBgrp5JDlvyMC1C2Ddm5AGDPtbU=";
+    hash = "sha256-Jaa5q6I8v3BpLaBzjLhNHCUd4wB3RRNfFoUe9BArh9o=";
  };

  installPhase = ''
--- a/pkgs/by-name/op/openrct2/package.nix
+++ b/pkgs/by-name/op/openrct2/package.nix
@@ -43,7 +43,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "openrct2";
-  version = "0.5.3";
+  version = "0.5.4";

  __structuredAttrs = true;
  strictDeps = true;
@@ -52,13 +52,13 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "OpenRCT2";
    repo = "OpenRCT2";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-my7fPBD5N0bO1yPaxwHUFqw6TvayQs10kcAX/NqPpIg=";
+    hash = "sha256-NzPkrPQ8XIekFfTzPwHnR1skhKv530x80YBZ5fvTRqw=";
  };

  passthru = {
    updateScript = ./update.sh;

-    objects-version = "1.7.10";
+    objects-version = "1.7.11";
    openmusic-version = "1.6.1";
    opensfx-version = "1.0.6";
    title-sequences-version = "0.4.26";
@@ -66,7 +66,7 @@ stdenv.mkDerivation (finalAttrs: {
    assets = {
      objects = fetchurl {
        url = "https://github.com/OpenRCT2/objects/releases/download/v${finalAttrs.passthru.objects-version}/objects.zip";
-        hash = "sha256-9IO+Jm3CIHe6hRe78y/+OIw1Q7LuWF4K+9QQLbRSgCE=";
+        hash = "sha256-dOc7vQEjOVEbs1ndD7sUj9qJl5CuN9fWmGHYgYOxlFI=";
      };
      openmusic = fetchurl {
        url = "https://github.com/OpenRCT2/OpenMusic/releases/download/v${finalAttrs.passthru.openmusic-version}/openmusic.zip";
--- a/pkgs/by-name/pa/par-lang/package.nix
+++ b/pkgs/by-name/pa/par-lang/package.nix
@@ -19,13 +19,13 @@

 rustPlatform.buildRustPackage {
  pname = "par-lang";
-  version = "0-unstable-2026-07-24";
+  version = "0-unstable-2026-07-29";

  src = fetchFromGitHub {
    owner = "par-team";
    repo = "par-lang";
-    rev = "9f667875a46b9cfe43d44fa7dcf41ff34ae74e11";
-    hash = "sha256-IF9VpwfRFCjTx+CkXyHOGIC+rilHWvRhQ0/xH8rgMwE=";
+    rev = "97e3ae546d7da1baa05bb0f4d523e39132e1d7ff";
+    hash = "sha256-gBXf2XYtlThr7X4uMfREeoYhmsfcqKU9z8rYX74gH1c=";
  };

  cargoHash = "sha256-8lG+cKN3/W+LYWhmOfDwGiq6u3nlLJaD5uNABaY0zRY=";
--- a/pkgs/by-name/pr/prisma-engines_7/package.nix
+++ b/pkgs/by-name/pr/prisma-engines_7/package.nix
@@ -11,16 +11,16 @@
 # function correctly.
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "prisma-engines_7";
-  version = "7.8.0";
+  version = "7.9.1";

  src = fetchFromGitHub {
    owner = "prisma";
    repo = "prisma-engines";
    tag = finalAttrs.version;
-    hash = "sha256-nquIcOmFz+ikD0x/YEPZ5NVKCFPCdR5MSCHldn+b9jI=";
+    hash = "sha256-bGtVKGoWZc/3s0lhTXksp+6fM/Q461ve/HQsRPxWD0Q=";
  };

-  cargoHash = "sha256-uiFvzxwVJXCW9LUDFRC6ZkzSa7LQk+9ZJcaJw8mrBX4=";
+  cargoHash = "sha256-zLl2ErsCTXZVShPFLH94GLJ0q2FrMnfnecnfKD7VDL4=";

  # Use system openssl.
  env.OPENSSL_NO_VENDOR = 1;
--- a/pkgs/by-name/pr/prisma_7/package.nix
+++ b/pkgs/by-name/pr/prisma_7/package.nix
@@ -3,7 +3,7 @@
  fetchFromGitHub,
  stdenv,
  nodejs,
-  pnpm_10,
+  pnpm_11,
  prisma-engines_7,
  jq,
  makeWrapper,
@@ -15,13 +15,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "prisma_7";
-  version = "7.8.0";
+  version = "7.9.1";

  src = fetchFromGitHub {
    owner = "prisma";
    repo = "prisma";
    tag = finalAttrs.version;
-    hash = "sha256-89q5433z54h3oGX+lEYDQykN2mNltGz4+LWlYSE75/E=";
+    hash = "sha256-h89lJbGG2ZkK3Viipsqe8hqTSTZk6vEulaMLPPkgn8c=";
  };

  nativeBuildInputs = [
@@ -30,14 +30,14 @@ stdenv.mkDerivation (finalAttrs: {
    jq
    makeWrapper
    moreutils
-    pnpm_10
+    pnpm_11
  ];

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
-    pnpm = pnpm_10;
-    fetcherVersion = 3;
-    hash = "sha256-mrFU5SAF4QuTBJj5TP8tUkYDG4zchttjcQMLtx6OBnI=";
+    pnpm = pnpm_11;
+    fetcherVersion = 4;
+    hash = "sha256-EEfVAdF6QawXV95NUmEL9IqzPqazCz47Y9Hg/F6IybU=";
  };

  patchPhase = ''
--- a/pkgs/by-name/pr/prometheus/source.nix
+++ b/pkgs/by-name/pr/prometheus/source.nix
@@ -1,6 +1,6 @@
 {
-  version = "3.13.1";
-  hash = "sha256-DtUdZp/o/tzLjiOZJ3duGqaLoNvkzulbL+wyLnY0dwA=";
+  version = "3.13.2";
+  hash = "sha256-82M1CACdTogsCKA6OK2spbkQ6W2DUP2ZDg3hc1q3ZQo=";
  pnpmDepsHash = "sha256-Z1TYYZhELi+rIiuleN8xR/WiMn9TF4KotFMTOsR2e6Y=";
-  vendorHash = "sha256-yvzQHfe7yd6Sjh1Vd2VxTp3jK8OWoKTmJ2uMyXX3+xs=";
+  vendorHash = "sha256-d2pQl6SnPIVIgn1lYIpQbKeloWtYwDMLHnmqsLtHjoA=";
 }
--- a/pkgs/by-name/pr/protonmail-desktop/package.nix
+++ b/pkgs/by-name/pr/protonmail-desktop/package.nix
@@ -10,9 +10,9 @@
 }:
 let
  mainProgram = "proton-mail";
-  version = "1.13.3";
-  linuxHash = "sha256-ZG3l9QhNtSXjkJ4wa/bJ15Kd7MIgw68tJTPP653HTIg=";
-  darwinHash = "sha256-C0URhmxcbQfP8uMe8nRuUx5f0JL0BMvvrWFfXHCVR90=";
+  version = "1.13.4";
+  linuxHash = "sha256-m6l2I/Lqr16+bAEEiAS//etsJeRFrr3J3K4E6xu3d1k=";
+  darwinHash = "sha256-4yEfNT89sOoAAhjjZVaY1yg6AFuYp6tM/ArnFX+1WZw=";
 in
 stdenv.mkDerivation {
  pname = "protonmail-desktop";
--- a/pkgs/by-name/py/pyca/package.nix
+++ b/pkgs/by-name/py/pyca/package.nix
@@ -1,92 +0,0 @@
-{
-  lib,
-  python3,
-  buildNpmPackage,
-  fetchFromGitHub,
-  jq,
-  stdenv,
-}:
-
-let
-  python = python3.override {
-    self = python;
-    packageOverrides = self: super: {
-      # pyca is incompatible with SQLAlchemy 2.0
-      sqlalchemy = super.sqlalchemy_1_4;
-    };
-  };
-
-  frontend = buildNpmPackage rec {
-    pname = "pyca";
-    version = "4.5";
-
-    src = fetchFromGitHub {
-      owner = "opencast";
-      repo = "pyCA";
-      rev = "v${version}";
-      sha256 = "sha256-cTkWkOmgxJZlddqaSYKva2wih4Mvsdrd7LD4NggxKQk=";
-    };
-
-    npmDepsHash = "sha256-0U+semrNWTkNu3uQQkiJKZT1hB0/IfkL84G7/oP8XYY=";
-
-    nativeBuildInputs = [
-      jq
-      python
-    ];
-
-    postPatch = ''
-      ${jq}/bin/jq '. += {"version": "${version}"}' < package.json > package.json.tmp
-      mv package.json.tmp package.json
-    '';
-
-    installPhase = ''
-      mkdir -p $out/static
-      cp -R pyca/ui/static/* $out/static/
-    '';
-  };
-
-in
-python3.pkgs.buildPythonApplication rec {
-  pname = "pyca";
-  version = "4.5";
-  pyproject = true;
-
-  src = fetchFromGitHub {
-    owner = "opencast";
-    repo = "pyCA";
-    rev = "v${version}";
-    sha256 = "sha256-cTkWkOmgxJZlddqaSYKva2wih4Mvsdrd7LD4NggxKQk=";
-  };
-
-  build-system = with python3.pkgs; [ setuptools ];
-
-  dependencies = with python.pkgs; [
-    pycurl
-    python-dateutil
-    configobj
-    sqlalchemy
-    sdnotify
-    psutil
-    flask
-    prometheus-client
-  ];
-
-  postPatch = ''
-    sed -i -e 's#static_folder=.*#static_folder="${frontend}/static")#' pyca/ui/__init__.py
-  '';
-
-  pythonImportsCheck = [ "pyca" ];
-
-  passthru = {
-    inherit frontend;
-  };
-
-  meta = {
-    broken = stdenv.hostPlatform.isDarwin;
-    description = "Fully functional Opencast capture agent written in Python";
-    mainProgram = "pyca";
-    homepage = "https://github.com/opencast/pyCA";
-    license = lib.licenses.lgpl3;
-    maintainers = with lib.maintainers; [ pmiddend ];
-  };
-}
--- a/pkgs/by-name/qc/qc/package.nix
+++ b/pkgs/by-name/qc/qc/package.nix
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "qc";
-  version = "0.6.2";
+  version = "0.6.3";

  src = fetchFromGitHub {
    owner = "qownnotes";
    repo = "qc";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-Y7SjlVNiZjWDTRPNZfyoFjI5qyo2SHgTPurNJzGmN0k=";
+    hash = "sha256-Z96wEb9jTf3zeIxgHJMBl7OQHeEIrP/uIcJncXggA/g=";
  };

-  vendorHash = "sha256-ad4IuGv2y4L9cS7pf/fEVJ3wXwy9pEIegMTbUoJHPmg=";
+  vendorHash = "sha256-/nRPv6SlvWV8mHlQstV19BLou9iwGt/VvJbrpVwiTCU=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/rc/rclone/package.nix
+++ b/pkgs/by-name/rc/rclone/package.nix
@@ -16,7 +16,7 @@

 buildGoModule (finalAttrs: {
  pname = "rclone";
-  version = "1.74.4";
+  version = "1.75.0";

  outputs = [
    "out"
@@ -27,10 +27,10 @@ buildGoModule (finalAttrs: {
    owner = "rclone";
    repo = "rclone";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-n+s9OiSwjiFwR1/DEd81YZIAyaMWMj0g8ORf6grnE3M=";
+    hash = "sha256-8Al3jB+R8U68TuIfDQ+q9V/OjIed176csajwiSljwZU=";
  };

-  vendorHash = "sha256-PVTcYFRr4Zb4VVsY6dkO+emZ48Nyr9aUBJbehFlDh9c=";
+  vendorHash = "sha256-jjbDyZwHCx9oeFuMVMY5sJeRNlCUyU9quO/aqzxeJnU=";

  subPackages = [ "." ];

--- a/pkgs/by-name/se/seagoat/failing_tests.nix
+++ b/pkgs/by-name/se/seagoat/failing_tests.nix
@@ -22,15 +22,10 @@
  "test_does_not_crash_because_of_non_existent_files"
  "test_ignored_files_is_really_ignored"
  "test_allows_limiting_how_many_files_are_automatically_analized"
-  "test_allows_limiting_how_many_files_are_automatically_analized"
-  "test_allows_limiting_how_many_files_are_automatically_analized"
  "test_includes_all_matching_lines_from_line"
  "test_search_is_case_insensitive"
  "test_respects_file_extension_restrictions"
  "test_includes_context_lines_properly"
-  "test_includes_context_lines_properly"
-  "test_includes_context_lines_properly"
-  "test_includes_context_lines_properly"
  "test_ripgrep_respects_custom_ignore_patterns"
  "test_filters_stop_words"
  "test_does_not_filter_stop_words_if_that_is_all_whats_in_the_query"
@@ -38,8 +33,6 @@
  "test_integration_test_vimgrep_mode"
  "test_integration_test_no_results"
  "test_server_is_not_running_error"
-  "test_server_is_not_running_error"
-  "test_reverse_ordering"
  "test_reverse_ordering"
  "test_file_returns_global_metadata_1"
  "test_file_returns_global_metadata_2"
@@ -54,11 +47,13 @@

  # Compatibility issue with click 8.2
  # https://github.com/kantord/SeaGOAT/issues/1021
-  "test_seagoat_warns_on_incomplete_accuracy[99]"
-  "test_seagoat_warns_on_incomplete_accuracy[100]"
-  "test_server_error_handling[File Not Found on Server-500]"
-  "test_server_error_handling[Database Connection Failed-503]"
+  "test_seagoat_warns_on_incomplete_accuracy"
+  "test_server_error_handling"
  "test_server_does_not_exist_error"
  "test_no_network_to_update"
  "test_server_shows_error_when_folder_is_not_a_git_repo"
+
+  # These only assert that chardet mis-detects the given UTF-8 sequences,
+  # which it no longer does since chardet 6
+  "test_file_reader_does_not_crash_because_of_misdetected_utf8"
 ]
--- a/pkgs/by-name/se/seagoat/package.nix
+++ b/pkgs/by-name/se/seagoat/package.nix
@@ -14,24 +14,26 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "seagoat";
-  version = "1.1.0";
+  version = "1.2.0";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "kantord";
    repo = "SeaGOAT";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-HdIvXXpMEynZV6J++kClNDubXuPORn6GEPHSD+UYBv0=";
+    hash = "sha256-ps+pwFOpCQWyI2SrOZSysq1kUeo53I2cfW2WC+SwccE=";
  };

  build-system = [ python3Packages.poetry-core ];

  pythonRelaxDeps = [
+    "chardet"
    "chromadb"
+    "ollama"
    "psutil"
    "setuptools"
    "stop-words"
-    "ollama"
  ];

  dependencies = with python3Packages; [
@@ -44,6 +46,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
    gitpython
    halo
    jsonschema
+    mcp
    nest-asyncio
    ollama
    psutil
--- a/pkgs/by-name/si/siesta/package.nix
+++ b/pkgs/by-name/si/siesta/package.nix
@@ -8,6 +8,7 @@
  useMpi ? false,
  mpi,
  fetchFromGitLab,
+  fetchpatch,
  cmake,
  pkg-config,
  readline,
@@ -18,16 +19,25 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "siesta";
-  version = "5.4.1";
+  version = "5.4.2";

  src = fetchFromGitLab {
    owner = "siesta-project";
    repo = "siesta";
    tag = finalAttrs.version;
-    hash = "sha256-pud8RlJAT+0TwyPRsbf5D/8FfLjZvPYPf84Xb7UH6os=";
+    hash = "sha256-J6cR8h6wMaofNLcTVyH9cr59FN533GhkviOQ4/5whIM=";
    fetchSubmodules = true;
  };

+  patches = [
+    # upstream patch, remove with next upgrade
+    (fetchpatch {
+      name = "gcc-bug-125383";
+      url = "https://gitlab.com/siesta-project/siesta/-/commit/bb6d7f5493c19078ecc236cf36b8672eeaf228c8.patch";
+      hash = "sha256-p7jE5m055m0XW/lJHtyHYmGIJ3Dz+5sLy0jcG/zyAqg=";
+    })
+  ];
+
  passthru = {
    inherit mpi;
    updateScript = nix-update-script { };
@@ -59,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
    "-DCMAKE_INSTALL_LIBDIR=lib"
  ];

-  enableParallelBuilding = false; # Started making trouble with gcc-11
+  enableParallelBuilding = true;

  preBuild =
    if useMpi then
--- a/pkgs/by-name/sl/slock/package.nix
+++ b/pkgs/by-name/sl/slock/package.nix
@@ -18,11 +18,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "slock";
-  version = "1.6";
+  version = "1.7";

  src = fetchzip {
    url = "https://dl.suckless.org/tools/slock-${finalAttrs.version}.tar.gz";
-    hash = "sha256-EIzLEIGd631dwYoAe7PXNoki9iaQPP3Y0S5H80aY+l8=";
+    hash = "sha256-3tk55DgIU3HtFkNhM3QfpWRZn/Q0aZtMv/h6r1qdong=";
  };

  buildInputs = [
--- a/pkgs/by-name/st/stable-diffusion-cpp/package.nix
+++ b/pkgs/by-name/st/stable-diffusion-cpp/package.nix
@@ -41,7 +41,7 @@ let
 in
 effectiveStdenv.mkDerivation (finalAttrs: {
  pname = "stable-diffusion-cpp";
-  version = "master-782-b290693";
+  version = "master-797-5ef4a75";

  outputs = [
    "out"
@@ -51,8 +51,8 @@ effectiveStdenv.mkDerivation (finalAttrs: {
  src = fetchFromGitHub {
    owner = "leejet";
    repo = "stable-diffusion.cpp";
-    rev = "master-782-b290693";
-    hash = "sha256-VXRjsJ+AVpja2NMiwA6/R4WOfUXAQ9KFKEFY5/FGOfQ=";
+    rev = "master-797-5ef4a75";
+    hash = "sha256-Bfft6ZqEK1+U6SoEZNKorPDNVDQNPQnt7kb+hQj6qbQ=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/um/umami/package.nix
+++ b/pkgs/by-name/um/umami/package.nix
@@ -64,21 +64,27 @@ let
      };
    }
  );
-  prisma' = (prisma_7.override { prisma-engines_7 = prisma-engines'; }).overrideAttrs (
-    finalAttrs: prevAttrs: {
-      version = "7.8.0";
-      src = fetchFromGitHub {
-        owner = "prisma";
-        repo = "prisma";
-        tag = finalAttrs.version;
-        hash = "sha256-89q5433z54h3oGX+lEYDQykN2mNltGz4+LWlYSE75/E=";
-      };
-      pnpmDeps = prevAttrs.pnpmDeps.override {
-        inherit (finalAttrs) src version;
-        hash = "sha256-mrFU5SAF4QuTBJj5TP8tUkYDG4zchttjcQMLtx6OBnI=";
-      };
-    }
-  );
+  prisma' =
+    (prisma_7.override {
+      pnpm_11 = pnpm_10;
+      prisma-engines_7 = prisma-engines';
+    }).overrideAttrs
+      (
+        finalAttrs: prevAttrs: {
+          version = "7.8.0";
+          src = fetchFromGitHub {
+            owner = "prisma";
+            repo = "prisma";
+            tag = finalAttrs.version;
+            hash = "sha256-89q5433z54h3oGX+lEYDQykN2mNltGz4+LWlYSE75/E=";
+          };
+          pnpmDeps = prevAttrs.pnpmDeps.override {
+            inherit (finalAttrs) src version;
+            fetcherVersion = 3;
+            hash = "sha256-mrFU5SAF4QuTBJj5TP8tUkYDG4zchttjcQMLtx6OBnI=";
+          };
+        }
+      );
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "umami";
--- a/pkgs/by-name/vs/vscode-runner/package.nix
+++ b/pkgs/by-name/vs/vscode-runner/package.nix
@@ -7,13 +7,13 @@
 }:

 let
-  version = "1.9.1";
+  version = "1.9.3";

  src = fetchFromGitHub {
    owner = "Merrit";
    repo = "vscode-runner";
    rev = "v${version}";
-    hash = "sha256-y9mexT02z6rw0uAbkHxOsPZQw5kgsm4v9qHHlyumcmo=";
+    hash = "sha256-qeB6lroBxdZP5+AFfMgTzli2ID8Ed3+1m2nACb1d+Bk=";
  };
 in
 buildDartApplication {
--- a/pkgs/by-name/vz/vzvm/package.nix
+++ b/pkgs/by-name/vz/vzvm/package.nix
@@ -0,0 +1,71 @@
+{
+  lib,
+  fetchFromGitHub,
+  darwin,
+  swift,
+  swiftPackages,
+  nix-update-script,
+}:
+
+swiftPackages.stdenv.mkDerivation (finalAttrs: {
+  pname = "vzvm";
+  version = "1.0.0";
+
+  src = fetchFromGitHub {
+    owner = "applicative-systems";
+    repo = "vzvm";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-wAozYULlBYelKH5Z35uOWm6nzu9gpMCV6G5WhWL8GKk=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/vzvm";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    darwin.sigtool
+    swift
+  ];
+
+  # No external deps: avoids need for swiftpm2nix and `swift build` (network fetches)
+  buildPhase = ''
+    runHook preBuild
+
+    swiftc -O -o vzvm Sources/vzvm/*.swift
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 vzvm $out/bin/vzvm
+
+    runHook postInstall
+  '';
+
+  # Virtualization.framework can't create VMs without this entitlement
+  postFixup = ''
+    codesign --entitlements ${finalAttrs.src}/vzvm/vzvm.entitlements -f -s - $out/bin/vzvm
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Minimal Linux VM monitor built on Apple's Virtualization.framework";
+    longDescription = ''
+      vzvm boots a Linux guest from a kernel and initrd on Apple's
+      Virtualization.framework, configured from a JSON file. It supports
+      Rosetta directory shares for running x86_64 binaries on Apple silicon, and
+      forwards host TCP ports into the guest over vsock, so inbound connections need
+      no guest IP discovery. Highly specialized for use as linux-builder.
+    '';
+    homepage = "https://github.com/applicative-systems/vzvm";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ tfc ];
+    platforms = [ "aarch64-darwin" ];
+    sourceProvenance = [ lib.sourceTypes.fromSource ];
+    mainProgram = "vzvm";
+  };
+})
--- a/pkgs/by-name/wa/waypaper-engine/package.nix
+++ b/pkgs/by-name/wa/waypaper-engine/package.nix
@@ -17,13 +17,13 @@
 let
  pnpm = pnpm_11;

-  version = "3.0.0";
+  version = "3.1.1";

  src = fetchFromGitHub {
    owner = "0bCdian";
    repo = "Waypaper-Engine";
    tag = "v${version}";
-    hash = "sha256-oee44RABW+0BcirsJbc5WnLVQeyAamXfxj4Q1x4B2JA=";
+    hash = "sha256-MnxxHJ6ff13N2ABqr/29uTxBbgmm1hySROVCwXEYCc0=";
  };

  backend = buildGoModule (finalAttrs: {
@@ -42,7 +42,7 @@ let
    buildInputs = [ wayland ];

    proxyVendor = true;
-    vendorHash = "sha256-KGyaZhWU5UOPV73MitA5eycy3ugH+rwgNu09r3ALtIo=";
+    vendorHash = "sha256-yKXPQ3Q/dyn/ZHQX/lDRjkYiF+6/lUkDioqnzPlYtN0=";

    subPackages = [ "cmd/daemon" ];

@@ -70,8 +70,8 @@ stdenv.mkDerivation (finalAttrs: {
  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
    inherit pnpm;
-    fetcherVersion = 3;
-    hash = "sha256-m/TtZ1rUXyzSYfxDMuZGW8d0Rl6T7qU+v4kRHAa6PM0=";
+    fetcherVersion = 4;
+    hash = "sha256-8x0qzKW2iGTKIF2VI9KGEgFeSPtnOjURZHtN/azbfSw=";
  };

  patchPhase = ''
--- a/pkgs/by-name/za/zapzap/package.nix
+++ b/pkgs/by-name/za/zapzap/package.nix
@@ -25,24 +25,16 @@ let
 in
 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "zapzap";
-  version = "7.0";
+  version = "7.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "rafatosta";
    repo = "zapzap";
    tag = finalAttrs.version;
-    hash = "sha256-0LrIx7k9b0+zsmezjF6CmJo4nqU7GPW1HHWAUVVnbzk=";
+    hash = "sha256-/fJd9D1f1D215o461B9XcaxKV//7au3FBNDBUsq5uD8=";
  };

-  patches = [
-    # Support setting dict lookup path. Remove with next release.
-    (fetchpatch {
-      url = "https://github.com/rafatosta/zapzap/commit/3517079e8fbd3853fe184c393137709de68f020e.patch";
-      hash = "sha256-Eqy483+mJHLHsS21B8LnJ9oIqwTRCMVKhHBO8hleBh4=";
-    })
-  ];
-
  nativeBuildInputs = [
    qt6.wrapQtAppsHook
  ];
--- a/pkgs/by-name/zi/zizmor/package.nix
+++ b/pkgs/by-name/zi/zizmor/package.nix
@@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "zizmor";
-  version = "1.28.0";
+  version = "1.29.0";

  src = fetchFromGitHub {
    owner = "zizmorcore";
    repo = "zizmor";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-T4Ww5PAcRZmCyBt142gBcQ8Mj6Rswj3QO+W/nCvqlNI=";
+    hash = "sha256-2I4RvLsAzsq8HMCiXeG2IrZ9fRvr/VIGCw9qKQ5NHlA=";
  };

-  cargoHash = "sha256-0buSU2wg3Yx3pE4rlESyukbFcZ7kReFmr3H2yHV5Unk=";
+  cargoHash = "sha256-B8TMVvNWKdGUqXWBZ4900alkItj8tIikKFEv8cbpEVw=";

  buildInputs = [
    rust-jemalloc-sys
--- a/pkgs/development/python-modules/adguardhome/default.nix
+++ b/pkgs/development/python-modules/adguardhome/default.nix
@@ -5,31 +5,29 @@
  buildPythonPackage,
  fetchFromGitHub,
  poetry-core,
+  pyprojectVersionPatchHook,
  pytest-asyncio,
  pytest-cov-stub,
  pytestCheckHook,
  yarl,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "adguardhome";
  version = "0.8.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "frenck";
-    repo = "python-${pname}";
-    tag = "v${version}";
+    repo = "python-adguardhome";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-pc7UfR/0mQZ98FyomQErz5hePHy6KE2h9UhJ9lFGtFA=";
  };

-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail '"0.0.0"' '"${version}"'
-  '';
-
  build-system = [ poetry-core ];

+  nativeBuildInputs = [ pyprojectVersionPatchHook ];
+
  dependencies = [
    aiohttp
    yarl
@@ -49,8 +47,8 @@ buildPythonPackage rec {
  meta = {
    description = "Python client for the AdGuard Home API";
    homepage = "https://github.com/frenck/python-adguardhome";
-    changelog = "https://github.com/frenck/python-adguardhome/releases/tag/v${version}";
+    changelog = "https://github.com/frenck/python-adguardhome/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ jamiemagee ];
  };
-}
+})
--- a/pkgs/development/python-modules/datamodel-code-generator/default.nix
+++ b/pkgs/development/python-modules/datamodel-code-generator/default.nix
@@ -1,59 +1,70 @@
 {
  lib,
-  argcomplete,
-  black,
  buildPythonPackage,
-  email-validator,
  fetchFromGitHub,
-  genson,
-  graphql-core,
-  grpcio-tools,
+
+  # build-system
  hatch-vcs,
  hatchling,
+
+  # dependencies
+  argcomplete,
+  black,
+  genson,
+  inflect,
+  isort,
+  jinja2,
+  packaging,
+  pydantic,
+  pyyaml,
+
+  # optional-dependencies
+  # debug:
+  pysnooper,
+  # graphql:
+  graphql-core,
+  # http:
  httpx,
+  # protobuf:
+  grpcio-tools,
+  # ruff:
+  ruff,
+  # validation:
+  openapi-spec-validator,
+  prance,
+  # watch:
+  watchfiles,
+
+  # tests
+  email-validator,
  hypothesis,
  hypothesis-jsonschema,
-  inflect,
  inline-snapshot,
-  isort,
  jsonschema,
  msgspec,
-  jinja2,
-  openapi-spec-validator,
-  packaging,
-  prance,
-  ruff,
-  pydantic,
-  pysnooper,
  pytest-mock,
  pytest-timeout,
  pytest-xdist,
  pytestCheckHook,
-  pyyaml,
  time-machine,
-  watchfiles,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "datamodel-code-generator";
  version = "0.71.0";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "koxudaxi";
    repo = "datamodel-code-generator";
-    tag = version;
+    tag = finalAttrs.version;
    hash = "sha256-0vh/iynZzmMzvdUXNScb+JWANdSrzPLT1qt+jyKleg4=";
  };

-  pythonRelaxDeps = [
-    "inflect"
-    "isort"
-  ];
-
  build-system = [
-    hatchling
    hatch-vcs
+    hatchling
  ];

  dependencies = [
@@ -68,8 +79,7 @@ buildPythonPackage rec {
    pyyaml
  ];

-  optional-dependencies = {
-    all = lib.concatAttrValues (lib.removeAttrs optional-dependencies [ "all" ]);
+  optional-dependencies = lib.fix (self: {
    debug = [ pysnooper ];
    graphql = [ graphql-core ];
    http = [ httpx ];
@@ -82,13 +92,13 @@ buildPythonPackage rec {
    watch = [
      watchfiles
    ];
-  };
+  });

  nativeCheckInputs = [
    email-validator
-    inline-snapshot
    hypothesis
    hypothesis-jsonschema
+    inline-snapshot
    jsonschema
    msgspec
    pytest-mock
@@ -97,15 +107,20 @@ buildPythonPackage rec {
    pytestCheckHook
    time-machine
  ]
-  ++ optional-dependencies.all;
-
-  pytestFlags = [
-    "--maxfail=2"
-  ];
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;

  disabledTests = [
    # remote testing, name resolution failure.
    "test_openapi_parser_parse_remote_ref"
+
+    # ruff formatting changed, causing errors such as
+    #   Failed: Output mismatch
+    #   AssertionError: Content mismatch for ...
+    "test_no_use_type_checking_imports"
+    "test_ruff_batch_formatting_directory"
+    "test_ruff_check_and_format_combined"
+    "test_ruff_check_only"
+    "test_type_checking_imports_default_to_runtime_imports_for_modular_pydantic_ruff"
  ];

  pythonImportsCheck = [ "datamodel_code_generator" ];
@@ -113,9 +128,9 @@ buildPythonPackage rec {
  meta = {
    description = "Pydantic model and dataclasses.dataclass generator for easy conversion of JSON, OpenAPI, JSON Schema, and YAML data sources";
    homepage = "https://github.com/koxudaxi/datamodel-code-generator";
-    changelog = "https://github.com/koxudaxi/datamodel-code-generator/releases/tag/${src.tag}";
+    changelog = "https://github.com/koxudaxi/datamodel-code-generator/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ tochiaha ];
    mainProgram = "datamodel-code-generator";
  };
-}
+})
--- a/pkgs/development/python-modules/dictdiffer/default.nix
+++ b/pkgs/development/python-modules/dictdiffer/default.nix
@@ -2,39 +2,46 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+  hatch-vcs,
+  hatchling,
+  pytest-cov-stub,
  pytestCheckHook,
-  setuptools-scm,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "dictdiffer";
-  version = "0.9.0";
-  format = "setuptools";
+  version = "0.10.0";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "inveniosoftware";
    repo = "dictdiffer";
-    rev = "v${version}";
-    hash = "sha256-lQyPs3lQWtsvNPuvvwJUTDzrFaOX5uwGuRHe3yWUheU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-5jYfkqyU3LrYDy+U9+McOYXyutp8gZSeCmx99NsLYgo=";
  };

-  nativeBuildInputs = [ setuptools-scm ];
-
-  nativeCheckInputs = [ pytestCheckHook ];
-
  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "'pytest-runner>=2.7'," ""
-    substituteInPlace pytest.ini \
-      --replace ' --isort --pydocstyle --pycodestyle --doctest-glob="*.rst" --doctest-modules --cov=dictdiffer --cov-report=term-missing' ""
+    substituteInPlace pyproject.toml \
+      --replace-fail "--isort --pydocstyle" ""
  '';

+  nativeBuildInputs = [
+    hatch-vcs
+    hatchling
+  ];
+
+  nativeCheckInputs = [
+    pytest-cov-stub
+    pytestCheckHook
+  ];
+
  pythonImportsCheck = [ "dictdiffer" ];

  meta = {
    description = "Module to diff and patch dictionaries";
    homepage = "https://github.com/inveniosoftware/dictdiffer";
+    changelog = "https://github.com/inveniosoftware/dictdiffer/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
--- a/pkgs/development/python-modules/emerge/default.nix
+++ b/pkgs/development/python-modules/emerge/default.nix
@@ -0,0 +1,157 @@
+{
+  lib,
+  stdenv,
+  config,
+  buildPythonPackage,
+  fetchFromGitHub,
+  writableTmpDirAsHomeHook,
+
+  cudaPackages,
+
+  # build-system
+  hatchling,
+
+  # dependencies
+  emsutil,
+  gmsh,
+  joblib,
+  loguru,
+  matplotlib,
+  mkl,
+  msgpack,
+  msgpack-numpy,
+  numba,
+  numpy,
+  psutil,
+  pyvista,
+  scipy,
+
+  # optional-dependencies
+  cupy,
+  nvmath-python,
+  ezdxf,
+  pygerber,
+  #scikit-umfpack,
+
+  # tests
+  callPackage,
+
+  cudaSupport ? config.cudaSupport,
+}:
+
+let
+  # NOTE:
+  # `nvmath.bindings.cudss.AlgType` has been removed in newer versions of
+  # `nvmath-python`, but `emerge` still uses it. See:
+  #   - https://docs.nvidia.com/cuda/nvmath-python/latest/bindings/generated/nvmath.bindings.cudss.AlgType.html
+  #   - https://docs.nvidia.com/cuda/nvmath-python/1.0.0/release-notes.html
+  nvmath-python' = nvmath-python.overrideAttrs rec {
+    version = "0.9.0";
+    src = fetchFromGitHub {
+      owner = "NVIDIA";
+      repo = "nvmath-python";
+      tag = "v${version}";
+      hash = "sha256-sIVvehCmkPvpPbHxhUPbKZ1cHnHTSlrgBHKSsHbUJPg=";
+    };
+    pythonRelaxDeps = [
+      "cuda-core"
+    ];
+  };
+in
+
+buildPythonPackage (finalAttrs: {
+  pname = "emerge";
+  version = "2.8.1";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "FennisRobert";
+    repo = "EMerge";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-TArhxtPAGEmPI4L+/pgy+RhV9atAZ5Ig0TkUDoV+eXQ=";
+  };
+
+  postPatch = ''
+    # TODO: get from pypi?
+    # https://pypi.org/project/mkl
+    sed -i '/mkl!=2024.0;/d' pyproject.toml
+  '';
+
+  build-system = [
+    hatchling
+  ];
+
+  dependencies = [
+    emsutil
+    gmsh
+    joblib
+    loguru
+    matplotlib
+    msgpack
+    msgpack-numpy
+    numba
+    numpy
+    psutil
+    pyvista
+    scipy
+  ]
+  ++ lib.optionals cudaSupport finalAttrs.passthru.optional-dependencies.cudss;
+
+  nativeBuildInputs = [
+    writableTmpDirAsHomeHook
+  ];
+
+  buildInputs =
+    lib.optionals stdenv.hostPlatform.isx86_64 [
+      mkl
+    ]
+    ++ lib.optionals cudaSupport [
+      cudaPackages.libcudss
+    ];
+
+  optional-dependencies = {
+    cudss = [
+      cupy
+      cudaPackages.libcudss
+      nvmath-python'
+    ];
+    dxf = [
+      ezdxf
+    ];
+    gerber = [
+      pygerber
+    ];
+    umfpack = [
+      #scikit-umfpack # TODO: package
+    ];
+  };
+
+  pythonRelaxDeps = [
+    "gmsh"
+    "numpy"
+  ];
+
+  pythonImportsCheck = [
+    "emerge"
+  ];
+
+  # upstream has no tests
+  doCheck = false;
+
+  passthru = {
+    inherit
+      cudaSupport
+      ;
+
+    tests = callPackage ./tests { };
+  };
+
+  meta = {
+    description = "Electromagnetic field computation program";
+    homepage = "https://github.com/FennisRobert/EMerge";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [ eljamm ];
+    teams = with lib.teams; [ ngi ];
+  };
+})
--- a/pkgs/development/python-modules/emerge/tests/default.nix
+++ b/pkgs/development/python-modules/emerge/tests/default.nix
@@ -0,0 +1,69 @@
+{
+  lib,
+  runCommand,
+  python,
+  writableTmpDirAsHomeHook,
+  xvfb-run,
+  pkgs,
+}:
+
+let
+  testRoot = ./.;
+  fs = lib.fileset;
+
+  testFiles = lib.pipe testRoot [
+    (fs.fileFilter (file: file.hasExt "py"))
+    (fs.toList)
+  ];
+
+  brokenTests = [
+    # FIX:
+    # scipy.sparse.linalg._eigen.arpack.arpack.ArpackNoConvergence: ARPACK
+    # error -1: No convergence (20221 iterations, 1/3 eigenvectors converged)
+    ./resonant-cavity.py
+  ];
+
+  # /path/to/foo.py -> "foo"
+  nameOf = file: lib.removeSuffix ".py" (lib.baseNameOf file);
+
+  mkTest =
+    file:
+    runCommand "test-${nameOf file}"
+      {
+        nativeBuildInputs =
+          let
+            pyEnv = python.withPackages (ps: with ps; [ emerge ]);
+
+            # Since we're calling this file using python's `callPackage`, it tries to use
+            # `python3Packages.mesa` rather than the toplevel one. However, the former has
+            # been removed because it's broken.
+            #
+            # As a workaround, we're getting the toplevel `mesa` through `pkgs`.
+            mesa = pkgs.mesa;
+          in
+          [
+            pyEnv
+            writableTmpDirAsHomeHook
+            xvfb-run
+            mesa.llvmpipeHook # OpenGL context
+          ];
+
+        env.EMERGE_MP_SOLVER = lib.optionalString python.pkgs.emerge.cudaSupport "CUDSS";
+        env.NUMBA_DISABLE_JIT = 1; # quite slow and won't be cached anyways
+
+        meta.broken = lib.elem file brokenTests;
+      }
+      ''
+        xvfb-run python ${file}
+        mkdir -p $out
+        cp *.png $out
+      '';
+
+  testAttrs = lib.listToAttrs (
+    map (file: {
+      name = nameOf file;
+      value = mkTest file;
+    }) testFiles
+  );
+in
+testAttrs
--- a/pkgs/development/python-modules/emerge/tests/first-simulation.py
+++ b/pkgs/development/python-modules/emerge/tests/first-simulation.py
@@ -0,0 +1,40 @@
+import emerge as em
+
+mm = 0.001  # Define a millimeter
+wg_width = 22.86 * mm  # Width of WR90 waveguide
+wg_height = 10.16 * mm  # Height of WR90 waveguide
+wg_length = 50 * mm  # Arbitrary length
+
+model = em.Simulation("MyFirstModel")
+
+box = em.geo.Box(wg_width, wg_length, wg_height)
+
+model.commit_geometry()
+
+model.view(screenshot="001-01.png", off_screen=True)
+
+model.mw.set_frequency_range(8e9, 10e9, 21)
+
+model.generate_mesh()
+
+model.view(plot_mesh=True, screenshot="001-02.png", off_screen=True)
+
+port1 = model.mw.bc.RectangularWaveguide(box.front, 1)
+port2 = model.mw.bc.RectangularWaveguide(box.back, 2)
+
+fdata = model.mw.run_sweep()
+
+freqs = fdata.scalar.grid.freq
+S11 = fdata.scalar.grid.S(1, 1)
+S21 = fdata.scalar.grid.S(2, 1)
+
+from emerge.plot import plot_sp
+
+plot_sp(
+    freqs,
+    [S11, S21],
+    labels=["S11", "S21"],
+    dblim=[-60, 3],
+    show_plot=False,
+    filename="001-03.png",
+)
--- a/pkgs/development/python-modules/emerge/tests/resonant-cavity.py
+++ b/pkgs/development/python-modules/emerge/tests/resonant-cavity.py
@@ -0,0 +1,36 @@
+import emerge as em
+import numpy as np
+
+model = em.Simulation("ResonanceCavity")
+cm = 0.01
+width = 6 * cm
+height = 2 * cm
+length = 10 * cm
+Nmodes = 3  # Amount of modes to solve for
+f = 2e9  # First eigenfreq at around 21GHz
+
+box = em.geo.Box(width, length, height, alignment=em.CENTER)
+model.commit_geometry()
+
+model.mw.set_frequency(f)
+model.mw.set_resolution(0.1)
+model.generate_mesh()
+model.view(plot_mesh=True, screenshot="002-01.png", off_screen=True)
+
+data = model.mw.eigenmode(f, nmodes=Nmodes)
+# Example: Access the eigenfrequency of the first solution
+field = data.field[0]
+print(f"Frequency = {field.freq / 1e9:.2f} GHz")
+# 2.91GHz
+
+model.display.add_field(
+    field.cutplane(ds=0.05 * cm, z=0).scalar("Ez", "real"), cmap="rainbow"
+)
+model.display.add_field(
+    field.cutplane(ds=0.05 * cm, z=height / 3).scalar("Ez", "real"), cmap="rainbow"
+)
+model.display.add_field(
+    field.cutplane(ds=0.05 * cm, z=-height / 3).scalar("Ez", "real"), cmap="rainbow"
+)
+model.display.populate()
+model.display.show(screenshot="002-02.png", off_screen=True)
--- a/pkgs/development/python-modules/emsutil/default.nix
+++ b/pkgs/development/python-modules/emsutil/default.nix
@@ -0,0 +1,61 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  hatchling,
+
+  # dependencies
+  loguru,
+  matplotlib,
+  msgpack,
+  msgpack-numpy,
+  numpy,
+  pyvista,
+  scipy,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "emsutil";
+  version = "0.8.3-unstable-2026-08-03";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "FennisRobert";
+    repo = "emsutil";
+    rev = "18449659ca374ba84f02709a0d245b6bebb8ddb6";
+    hash = "sha256-9kyEBNKKP9Dz6s1svzq6C3ow27jV+zwz2M82gJndZsg=";
+  };
+
+  build-system = [
+    hatchling
+  ];
+
+  dependencies = [
+    loguru
+    matplotlib
+    msgpack
+    msgpack-numpy
+    numpy
+    pyvista
+    scipy
+  ];
+
+  pythonRelaxDeps = [
+    "numpy"
+  ];
+
+  pythonImportsCheck = [
+    "emsutil"
+  ];
+
+  meta = {
+    description = "Utilities for the EMerge software suite";
+    homepage = "https://github.com/FennisRobert/emsutil";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ eljamm ];
+    teams = with lib.teams; [ ngi ];
+  };
+})
--- a/pkgs/development/python-modules/fast-query-parsers/default.nix
+++ b/pkgs/development/python-modules/fast-query-parsers/default.nix
@@ -4,6 +4,7 @@
  cargo,
  fetchFromGitHub,
  poetry-core,
+  pyprojectVersionPatchHook,
  pytestCheckHook,
  rustc,
  rustPlatform,
@@ -34,6 +35,8 @@ buildPythonPackage (finalAttrs: {
    rustc
  ];

+  nativeBuildInputs = [ pyprojectVersionPatchHook ];
+
  nativeCheckInputs = [ pytestCheckHook ];

  pythonImportsCheck = [ "fast_query_parsers" ];
--- a/pkgs/development/python-modules/hf-xet/default.nix
+++ b/pkgs/development/python-modules/hf-xet/default.nix
@@ -9,14 +9,15 @@

 buildPythonPackage (finalAttrs: {
  pname = "hf-xet";
-  version = "1.5.1";
+  version = "1.6.0";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "huggingface";
    repo = "xet-core";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-TqSErydAOaHzCN7qglO/aqMF8BWYXvEv09adhxTwny0=";
+    hash = "sha256-SP6Z8iIkrt3FVXxXYdvjeiIAfcrVlfCPQq6C36DfhEM=";
  };

  sourceRoot = "${finalAttrs.src.name}/hf_xet";
@@ -28,7 +29,7 @@ buildPythonPackage (finalAttrs: {
      src
      sourceRoot
      ;
-    hash = "sha256-pwHUIkx+Dk8fGOVxRJKLswLjQB+sKzpyOOeqV6+Xyxo=";
+    hash = "sha256-pvtq9mKlmwaqAq281Lin/UgVGcRe2SEvyzCa+xWSwVQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/python-modules/huggingface-hub/default.nix
+++ b/pkgs/development/python-modules/huggingface-hub/default.nix
@@ -7,6 +7,7 @@
  setuptools,

  # dependencies
+  click,
  filelock,
  fsspec,
  hf-xet,
@@ -14,7 +15,6 @@
  packaging,
  pyyaml,
  tqdm,
-  typer,
  typing-extensions,

  # optional-dependencies
@@ -41,19 +41,24 @@

 buildPythonPackage (finalAttrs: {
  pname = "huggingface-hub";
-  version = "1.16.0";
+  version = "1.26.0";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "huggingface";
    repo = "huggingface_hub";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-GuTsoz7ow3A/PJyU3L/xLp56r3RVx5O1YH3nr3T4u7U=";
+    hash = "sha256-JF0hWsDO0ERiTwFJ9pu1ImuD+ggWySg/zeU/c++GEXE=";
  };

  build-system = [ setuptools ];

+  pythonRelaxDeps = [
+    "click"
+  ];
  dependencies = [
+    click
    filelock
    fsspec
    hf-xet
@@ -61,13 +66,11 @@ buildPythonPackage (finalAttrs: {
    packaging
    pyyaml
    tqdm
-    typer
    typing-extensions
  ];

  optional-dependencies = {
    all = [
-
    ];
    fastai = [
      toml
--- a/pkgs/development/python-modules/hyperscan/default.nix
+++ b/pkgs/development/python-modules/hyperscan/default.nix
@@ -21,19 +21,23 @@ let
    ];
  };
 in
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "hyperscan";
-  version = "0.8.0";
+  version = "0.8.2";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "darvid";
    repo = "python-hyperscan";
-    tag = "v${version}";
-    hash = "sha256-on++eSNaVY2Q6yT/O+unvE0x/Pt/SsIQFQblIqii2sM=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-jIDUfl6ReWvypfWecM8hReux6YxzXSsLCFU3AO97xUY=";
  };

-  env.CMAKE_ARGS = "-DHS_SRC_ROOT=${pkgs.hyperscan.src} -DHS_BUILD_LIB_ROOT=${lib-deps}/lib";
+  env.CMAKE_ARGS = lib.toString [
+    (lib.cmakeFeature "HS_SRC_ROOT" pkgs.hyperscan.src.outPath)
+    (lib.cmakeFeature "HS_BUILD_LIB_ROOT" "${lib-deps}/lib")
+  ];

  dontUseCmakeConfigure = true;

@@ -56,11 +60,11 @@ buildPythonPackage rec {
  meta = {
    description = "CPython extension for the Hyperscan regular expression matching library";
    homepage = "https://github.com/darvid/python-hyperscan";
-    changelog = "https://github.com/darvid/python-hyperscan/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/darvid/python-hyperscan/blob/${finalAttrs.src.tag}/CHANGELOG.md";
    platforms = [
      "x86_64-linux"
    ];
    license = lib.licenses.mit;
    maintainers = [ ];
  };
-}
+})
--- a/pkgs/development/python-modules/karton-classifier/default.nix
+++ b/pkgs/development/python-modules/karton-classifier/default.nix
@@ -46,6 +46,8 @@ buildPythonPackage (finalAttrs: {
    "test_process_misc_csv"
    "test_process_runnable_win32_jar"
    "test_process_runnable_win32_lnk"
+    # Assertion error
+    "test_process_runnable_win32_msi"
  ];

  meta = {
--- a/pkgs/development/python-modules/myjwt/default.nix
+++ b/pkgs/development/python-modules/myjwt/default.nix
@@ -10,11 +10,12 @@
  poetry-core,
  pyopenssl,
  pyperclip,
+  pyprojectVersionPatchHook,
  pytest-mock,
  pytestCheckHook,
  questionary,
-  requests,
  requests-mock,
+  requests,
 }:

 buildPythonPackage (finalAttrs: {
@@ -37,6 +38,8 @@ buildPythonPackage (finalAttrs: {

  build-system = [ poetry-core ];

+  nativeBuildInputs = [ pyprojectVersionPatchHook ];
+
  dependencies = [
    click
    colorama
--- a/pkgs/development/python-modules/nvmath-python/default.nix
+++ b/pkgs/development/python-modules/nvmath-python/default.nix
@@ -0,0 +1,78 @@
+{
+  lib,
+  config,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  cudaPackages_13_1,
+  cython,
+  setuptools,
+  tomli,
+
+  # dependencies
+  cuda-bindings,
+  cuda-core,
+  cuda-pathfinder,
+  numpy,
+
+  cudaSupport ? config.cudaSupport,
+}:
+
+buildPythonPackage.override { stdenv = cudaPackages_13_1.backendStdenv; } (finalAttrs: {
+  pname = "nvmath-python";
+  version = "1.0.0";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "NVIDIA";
+    repo = "nvmath-python";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-RpgEX6IFBw35TED3mb8ibLc0o15ciMNwX+LuIrlClqg=";
+  };
+
+  postPatch = ''
+    # FIX:
+    # > ERROR Unmet dependencies (checked against /nix/store/XXX-python3-3.14.6/bin/python3.14):
+    # >       cuda-toolkit[cudart,nvcc]<14,>=13.1
+    # >             wanted: <14,>=13.1
+    # >              found: not installed
+    sed -i '/cuda-toolkit/d' pyproject.toml
+  '';
+
+  build-system = [
+    cudaPackages_13_1.cudatoolkit
+    cython
+    setuptools
+    tomli
+  ];
+
+  dependencies = [
+    cuda-bindings
+    cuda-core
+    cuda-pathfinder
+    numpy
+  ];
+
+  nativeBuildInputs = [
+    cudaPackages_13_1.cudatoolkit
+  ];
+
+  buildInputs = [
+    cudaPackages_13_1.cudatoolkit
+  ];
+
+  pythonImportsCheck = [
+    "nvmath"
+  ];
+
+  meta = {
+    description = "NVIDIA Math Libraries for the Python Ecosystem";
+    homepage = "https://pypi.org/project/nvmath-python";
+    license = with lib.licenses; [ asl20 ];
+    maintainers = with lib.maintainers; [ eljamm ];
+    teams = with lib.teams; [ ngi ];
+    broken = !cudaSupport;
+  };
+})
--- a/pkgs/development/python-modules/oracledb/default.nix
+++ b/pkgs/development/python-modules/oracledb/default.nix
@@ -8,17 +8,17 @@
  typing-extensions,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "oracledb";
-  version = "3.4.1";
+  version = "4.0.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "oracle";
    repo = "python-oracledb";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-Pwbb+/vzNnliBpcDmOpkkNMVI/cPbJY+yMIKKR6m01w=";
+    hash = "sha256-xT2PWP6kQ0K+9kxe0vNWY5+kMyKZ1J7toiEZBxfsAGE=";
  };

  build-system = [
@@ -39,11 +39,11 @@ buildPythonPackage rec {
  meta = {
    description = "Python driver for Oracle Database";
    homepage = "https://oracle.github.io/python-oracledb";
-    changelog = "https://github.com/oracle/python-oracledb/blob/${src.tag}/doc/src/release_notes.rst";
+    changelog = "https://github.com/oracle/python-oracledb/blob/${finalAttrs.src.tag}/doc/src/release_notes.rst";
    license = with lib.licenses; [
      asl20 # and or
      upl
    ];
    maintainers = with lib.maintainers; [ harvidsen ];
  };
-}
+})
--- a/pkgs/development/python-modules/pycep-parser/default.nix
+++ b/pkgs/development/python-modules/pycep-parser/default.nix
@@ -4,6 +4,7 @@
  buildPythonPackage,
  fetchFromGitHub,
  lark,
+  pyprojectVersionPatchHook,
  pytestCheckHook,
  regex,
  typing-extensions,
@@ -30,6 +31,8 @@ buildPythonPackage (finalAttrs: {
      --replace-fail "uv_build~=0.9.0" "uv_build"
  '';

+  nativeBuildInputs = [ pyprojectVersionPatchHook ];
+
  pythonRelaxDeps = [ "regex" ];

  dependencies = [
--- a/pkgs/development/python-modules/pydeps/default.nix
+++ b/pkgs/development/python-modules/pydeps/default.nix
@@ -12,14 +12,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "pydeps";
-  version = "3.0.6";
+  version = "3.0.7";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "thebjorn";
    repo = "pydeps";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-/Ie75jQWG3t4cGMRMVPJ7r6aBdm4hC7/CgwmuOUk4BA=";
+    hash = "sha256-XAUDnhCmO3czZPBpD3AaPxSFBlpqWjQ1xva5mvuF6Lc=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/pygpgme/default.nix
+++ b/pkgs/development/python-modules/pygpgme/default.nix
@@ -1,35 +0,0 @@
-{
-  lib,
-  buildPythonPackage,
-  fetchurl,
-  gpg,
-  isPyPy,
-  pythonAtLeast,
-}:
-
-buildPythonPackage rec {
-  version = "0.3";
-  format = "setuptools";
-  pname = "pygpgme";
-
-  # Native code doesn't compile against the C API of Python 3.11:
-  # https://bugs.launchpad.net/pygpgme/+bug/1996122
-  disabled = isPyPy || pythonAtLeast "3.11";
-
-  src = fetchurl {
-    url = "https://launchpad.net/pygpgme/trunk/${version}/+download/${pname}-${version}.tar.gz";
-    sha256 = "5fd887c407015296a8fd3f4b867fe0fcca3179de97ccde90449853a3dfb802e1";
-  };
-
-  # error: invalid command 'test'
-  doCheck = false;
-
-  propagatedBuildInputs = [ gpg ];
-
-  meta = {
-    homepage = "https://launchpad.net/pygpgme";
-    description = "Python wrapper for the GPGME library";
-    license = lib.licenses.lgpl21;
-    maintainers = [ ];
-  };
-}
--- a/pkgs/development/python-modules/pygrok/default.nix
+++ b/pkgs/development/python-modules/pygrok/default.nix
@@ -3,27 +3,31 @@
  buildPythonPackage,
  fetchFromGitHub,
  regex,
-  pytest,
+  pytestCheckHook,
+  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "pygrok";
  version = "1.0.0";
-  format = "setuptools";
+  pyproject = true;
+
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "garyelephant";
    repo = "pygrok";
-    rev = "v${version}";
-    sha256 = "07487rcmv74srnchh60jp0vg46g086qmpkaj8gxqhp9rj47r1s4m";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-leiQD5E5XYj7Q1LNW7FB4BnyNrgSGAiZzZqcXVk+iBw=";
  };

-  propagatedBuildInputs = [ regex ];
+  build-system = [ setuptools ];

-  nativeCheckInputs = [ pytest ];
-  checkPhase = ''
-    pytest
-  '';
+  dependencies = [ regex ];
+
+  pythonImportsCheck = [ "pygrok" ];
+
+  nativeCheckInputs = [ pytestCheckHook ];

  meta = {
    maintainers = with lib.maintainers; [ winpat ];
@@ -32,4 +36,4 @@ buildPythonPackage rec {
    license = lib.licenses.mit;
    platforms = lib.platforms.unix;
  };
-}
+})
--- a/pkgs/development/python-modules/pyhomepilot/default.nix
+++ b/pkgs/development/python-modules/pyhomepilot/default.nix
@@ -3,21 +3,26 @@
  aiohttp,
  buildPythonPackage,
  fetchFromGitHub,
+  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "pyhomepilot";
  version = "0.0.3";
-  format = "setuptools";
+
+  __structuredAttrs = true;
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "nico0302";
    repo = "pyhomepilot";
-    rev = "v${version}";
-    sha256 = "00gmqx8cwsd15iccnlr8ypgqrdg6nw9ha518cfk7pyp8vhw1ziwy";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-nscfONzo+numYygUBRO35rWM3/UoU8tYLKFpzlDH9QE=";
  };

-  propagatedBuildInputs = [ aiohttp ];
+  build-system = [ setuptools ];
+
+  dependencies = [ aiohttp ];

  # Project has no tests
  doCheck = false;
@@ -30,4 +35,4 @@ buildPythonPackage rec {
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
--- a/pkgs/development/python-modules/pyi2cflash/default.nix
+++ b/pkgs/development/python-modules/pyi2cflash/default.nix
@@ -3,21 +3,28 @@
  buildPythonPackage,
  fetchPypi,
  pyftdi,
+  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "pyi2cflash";
  version = "0.2.2";
-  format = "setuptools";
+
+  pyproject = true;
+  __structuredAttrs = true;

  src = fetchPypi {
-    inherit pname version;
-    sha256 = "1nkazgf7pajz7jym5rfy2df71lyfp4skxqbrg5ch0h4dwjdwllx1";
+    pname = "pyi2cflash";
+    inherit (finalAttrs) version;
+    hash = "sha256-oVPKm+SNQABZeXnhPjW5ztNwXBPe5VK9PF+qe9z7ato=";
  };

-  propagatedBuildInputs = [ pyftdi ];
+  build-system = [ setuptools ];
+
+  dependencies = [ pyftdi ];

  # tests are not shipped with the PyPI source
+  # and require ftdi connection that cannot be reproduced in sandbox
  doCheck = false;

  pythonImportsCheck = [ "i2cflash" ];
@@ -28,4 +35,4 @@ buildPythonPackage rec {
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
--- a/pkgs/development/python-modules/pyialarm/default.nix
+++ b/pkgs/development/python-modules/pyialarm/default.nix
@@ -4,21 +4,26 @@
  dicttoxml2,
  fetchFromGitHub,
  xmltodict,
+  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "pyialarm";
  version = "2.2.0";
-  format = "setuptools";
+
+  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "RyuzakiKK";
    repo = "pyialarm";
-    rev = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-rOdeYewjoFVbHdNPHN6ZC2g6X5yr84/JFE6tGSDIoRU=";
  };

-  propagatedBuildInputs = [
+  build-system = [ setuptools ];
+
+  dependencies = [
    dicttoxml2
    xmltodict
  ];
@@ -34,4 +39,4 @@ buildPythonPackage rec {
    license = lib.licenses.asl20;
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
--- a/pkgs/development/python-modules/python-benedict/default.nix
+++ b/pkgs/development/python-modules/python-benedict/default.nix
@@ -19,6 +19,7 @@
  pydantic,
  setuptools,
  tomli-w,
+  typing-extensions,
  useful-types,
  xlrd,
  xmltodict,
@@ -36,7 +37,10 @@ buildPythonPackage (finalAttrs: {
    hash = "sha256-1YZqc0Ytqx4a1WGaqz5y0r2hw3okvax0/r267YTTGCE=";
  };

-  pythonRelaxDeps = [ "boto3" ];
+  pythonRelaxDeps = [
+    "boto3"
+    "typing_extensions"
+  ];

  build-system = [ setuptools ];

@@ -45,6 +49,7 @@ buildPythonPackage (finalAttrs: {
    python-slugify
    requests
    useful-types
+    typing-extensions
  ];

  optional-dependencies = {
--- a/pkgs/development/python-modules/stringzilla/default.nix
+++ b/pkgs/development/python-modules/stringzilla/default.nix
@@ -10,14 +10,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "stringzilla";
-  version = "5.0.3";
+  version = "5.0.7";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "ashvardanian";
    repo = "stringzilla";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-W8h+PzOY0AhVTG7myBo5IgoL4+XnsLExRkxHNr4CpWQ=";
+    hash = "sha256-qVWHbtr3lo2LGX376Ctuo6hzRRXTpEug7a77UZCVd70=";
  };

  build-system = [
--- a/pkgs/development/python-modules/tensorflow-datasets/default.nix
+++ b/pkgs/development/python-modules/tensorflow-datasets/default.nix
@@ -75,6 +75,13 @@ buildPythonPackage (finalAttrs: {
    hash = "sha256-nq0c5hBTVwkxCRvWxtnfI+AHD+URY+nNfZAurEGaLXk=";
  };

+  postPatch =
+    # The git checkout ships the development `version.py`, which appends a `+nightly` suffix.
+    # Upstream replaces it with `version_stable.py` for stable releases.
+    ''
+      cp tensorflow_datasets/version_stable.py tensorflow_datasets/version.py
+    '';
+
  build-system = [
    packaging
    setuptools
--- a/pkgs/development/python-modules/testrepository/default.nix
+++ b/pkgs/development/python-modules/testrepository/default.nix
@@ -1,41 +1,51 @@
 {
  lib,
  buildPythonPackage,
-  fetchPypi,
-  testtools,
-  testresources,
-  pbr,
-  python-subunit,
+  fetchFromGitHub,
  fixtures,
+  hatch-vcs,
+  hatchling,
+  python-subunit,
  python,
+  testresources,
+  testtools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "testrepository";
-  version = "0.0.21";
-  format = "setuptools";
+  version = "0.0.22";
+  pyproject = true;

-  src = fetchPypi {
-    inherit pname version;
-    hash = "sha256-Nor89+CQs8aIvddUol9kvDFOUSuBb4xxufn8F9w3o9k=";
+  src = fetchFromGitHub {
+    owner = "testing-cabal";
+    repo = "testrepository";
+    tag = finalAttrs.version;
+    hash = "sha256-t5cTVMtzYIu4AIQVUVz3odvj+qFeYyUxIroB3yb0bFQ=";
  };

-  nativeCheckInputs = [ testresources ];
-  buildInputs = [ pbr ];
-  propagatedBuildInputs = [
+  build-system = [
+    hatch-vcs
+    hatchling
+  ];
+
+  dependencies = [
    fixtures
    python-subunit
    testtools
  ];

+  nativeCheckInputs = [ testresources ];
+
  checkPhase = ''
    ${python.interpreter} ./testr
  '';

  meta = {
    description = "Database of test results which can be used as part of developer workflow";
-    mainProgram = "testr";
-    homepage = "https://pypi.org/project/testrepository/";
+    homepage = "https://github.com/testing-cabal/testrepository";
+    changelog = "https://github.com/testing-cabal/testrepository/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.bsd2;
+    maintainers = [ ];
+    mainProgram = "testr";
  };
-}
+})
--- a/pkgs/development/python-modules/textual-textarea/default.nix
+++ b/pkgs/development/python-modules/textual-textarea/default.nix
@@ -20,14 +20,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "textual-textarea";
-  version = "0.17.2";
+  version = "0.17.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "tconbeer";
    repo = "textual-textarea";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-y+2WvqD96eYkDEJn5qCGfGFNiJFAcF4KWWNgAIZUqJo=";
+    hash = "sha256-m3aXTUKOklk6TJgxRV+KqxeHBL+Y7XDNCJaW12SLj0E=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/transformers/default.nix
+++ b/pkgs/development/python-modules/transformers/default.nix
@@ -94,14 +94,15 @@

 buildPythonPackage (finalAttrs: {
  pname = "transformers";
-  version = "5.5.4";
+  version = "5.14.1";
  pyproject = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "huggingface";
    repo = "transformers";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ZqynYPj8VxH6BmvxHuw3lq16e2FFi3p8pw5of+vkz40=";
+    hash = "sha256-BmjfFETKt01Z7fYgL83KOSPthZBu19yU5IdITCrpEv0=";
  };

  build-system = [ setuptools ];
@@ -183,7 +184,6 @@ buildPythonPackage (finalAttrs: {
    mistral-common = [ mistral-common ] ++ mistral-common.optional-dependencies.image;
    chat-template = [
      jinja2
-      jmespath
    ];
    quality = [
      datasets
--- a/pkgs/development/python-modules/troi/default.nix
+++ b/pkgs/development/python-modules/troi/default.nix
@@ -26,14 +26,14 @@

 buildPythonPackage rec {
  pname = "troi";
-  version = "2026.03.10.0";
+  version = "2026.07.31.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "metabrainz";
    repo = "troi-recommendation-playground";
    tag = "v${version}";
-    hash = "sha256-wZeWdps60cOO5aIPZLGjZMsgEqAjnKuA56WKXVg9nuo=";
+    hash = "sha256-SG2o6ng6aCVMNNv6nTO3FG4A8GCrMOsxSiM69r3QX0c=";
  };

  build-system = [
--- a/pkgs/development/tools/continuous-integration/woodpecker/common.nix
+++ b/pkgs/development/tools/continuous-integration/woodpecker/common.nix
@@ -1,8 +1,8 @@
 { lib, fetchFromGitHub }:
 let
-  version = "3.16.0";
-  vendorHash = "sha256-z87enzlH2jVq/BI6uVbpLG6jKsO5Wr2alJOcFjt/+MM=";
-  nodeModulesHash = "sha256-zj8InXWu8hRgJaN0dkb6K16kWvXAhAzUPUU1OQcw0Yo=";
+  version = "3.17.0";
+  vendorHash = "sha256-+opo+WWxRY3FVoshancL/9cWdgQ12uPmdDaERgMikOg=";
+  nodeModulesHash = "sha256-ZbQJvYfwzXFe/gKb5/S/BdKSlnhbyO0wCpC7fdDtd9Q=";
 in
 {
  inherit version vendorHash nodeModulesHash;
@@ -11,7 +11,7 @@ in
    owner = "woodpecker-ci";
    repo = "woodpecker";
    tag = "v${version}";
-    hash = "sha256-9Bc7225CZFELgra5gnmo7KeNeY4X7+YpyvVGG/Y+sAs=";
+    hash = "sha256-qdptuPcrB9UFFC1Ua+WQCbaJNonJwudKYgz4/wHUXGs=";
  };

  postInstall = ''
--- a/pkgs/kde/generated/sources/plasma.json
+++ b/pkgs/kde/generated/sources/plasma.json
@@ -1,377 +1,377 @@
 {
  "aurorae": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/aurorae-6.7.3.tar.xz",
-    "hash": "sha256-p5U+jGXKZToBAl92qgbOwTxAmZZl95JR8Ab28BJI7Ow="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/aurorae-6.7.4.tar.xz",
+    "hash": "sha256-sc7qGW/JWtsUGRfiMPsmCZINQgqdskUeuKaQObTJZiM="
  },
  "bluedevil": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/bluedevil-6.7.3.tar.xz",
-    "hash": "sha256-8ciQQrUTmixvXGjFdMiD/T+0JZr4wH2slmz8ZeGT3NE="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/bluedevil-6.7.4.tar.xz",
+    "hash": "sha256-iju30wBbCgGvFxvbQb7OzVhI3nXEpNaNOZpJxRd5FlI="
  },
  "breeze": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/breeze-6.7.3.tar.xz",
-    "hash": "sha256-2FP8RaQ+ZO5tkBhgsZ54pQyKA8/pEn8qV4HVDxP/6Dg="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/breeze-6.7.4.tar.xz",
+    "hash": "sha256-MdyI+SSl9cl58JJ1zMiXywABvaRWBFYcjxjrNbLji1o="
  },
  "breeze-grub": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/breeze-grub-6.7.3.tar.xz",
-    "hash": "sha256-sVmO8iHflWn0jpUVwoOebI/ePEZjU+kTNEqQGFZ/z0c="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/breeze-grub-6.7.4.tar.xz",
+    "hash": "sha256-pXHRV9JCtxVg9Gww/Abkud4DBlCAyvCXTaJLAOgtBag="
  },
  "breeze-gtk": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/breeze-gtk-6.7.3.tar.xz",
-    "hash": "sha256-+pO2gZ3F5Ky26W7A27PU3n7r/y8d5IC+AXdqgBB6CHs="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/breeze-gtk-6.7.4.tar.xz",
+    "hash": "sha256-8w/FrmCAA3rY5ALlkIf3aqUnCuvH+g1dG7dECrq0ss4="
  },
  "breeze-plymouth": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/breeze-plymouth-6.7.3.tar.xz",
-    "hash": "sha256-T6UQTxqQG+wHFBJevKg4HQP1K5ecHP3MRFUJDRoR7yc="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/breeze-plymouth-6.7.4.tar.xz",
+    "hash": "sha256-L95FqWz+HXMKTpncyJFWcZdTLSGE7ILHGNOIksc5tqw="
  },
  "discover": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/discover-6.7.3.tar.xz",
-    "hash": "sha256-8oxHVp3f/ZXBCV6mxzz+AaaUO7s75dgVjVQxxENDnxw="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/discover-6.7.4.tar.xz",
+    "hash": "sha256-+LgJyaqiXB1jawvfFE2Ho+5lnV2A8mlh0xFqYn/vhZ0="
  },
  "drkonqi": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/drkonqi-6.7.3.tar.xz",
-    "hash": "sha256-0uLBWMDj9+R/GiUpwwyv/Dv/Gqg5jdbf+MlkUkT5ziY="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/drkonqi-6.7.4.tar.xz",
+    "hash": "sha256-x/lAK3oy4HeyPTTQg5Jrx6ePGLkxhFEN7z/MMlMtaVk="
  },
  "flatpak-kcm": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/flatpak-kcm-6.7.3.tar.xz",
-    "hash": "sha256-ADdm/seYB/htw9UEv4iNqdNx67jdCukoDfmzjtBT/tI="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/flatpak-kcm-6.7.4.tar.xz",
+    "hash": "sha256-ETO0Dk1/rSNJqEteDxKsqqIqCUD6T8FQDix5SCU14hk="
  },
  "kactivitymanagerd": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/kactivitymanagerd-6.7.3.tar.xz",
-    "hash": "sha256-UzbZrd68iehdO2E/8RNsfIQvdMqYbdHUbAovdzPcCVo="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/kactivitymanagerd-6.7.4.tar.xz",
+    "hash": "sha256-sunCU33cwkN3TUE1VCgzUWfCu46fxIFDxORnUoU2yH8="
  },
  "kde-cli-tools": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/kde-cli-tools-6.7.3.tar.xz",
-    "hash": "sha256-8u8t+Cm1Y2XoZO7MjVBA2bJYOtuP5nMjT4P1gdiQifE="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/kde-cli-tools-6.7.4.tar.xz",
+    "hash": "sha256-m5NzDL6p7s0rF8hGA8FJbRjQh0nShh+Hp1UvRj167LA="
  },
  "kde-gtk-config": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/kde-gtk-config-6.7.3.tar.xz",
-    "hash": "sha256-wHZx76h5iI6BvdrkEbyyWoHuOEU7TuLGheWGT6Mp1hQ="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/kde-gtk-config-6.7.4.tar.xz",
+    "hash": "sha256-Uuqx6fceCpLVQu4cxlWJXtS5manjlNRo9O8sg48Mc5s="
  },
  "kdecoration": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/kdecoration-6.7.3.tar.xz",
-    "hash": "sha256-aWkHE9IhYyPa6W1h104Ie9nl5bPv/PHFT3o+gjZy0Oc="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/kdecoration-6.7.4.tar.xz",
+    "hash": "sha256-rzZrq6hpThYiaESpS0dypjp+jY1D5MGVAhXrFjtMpZA="
  },
  "kdeplasma-addons": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/kdeplasma-addons-6.7.3.tar.xz",
-    "hash": "sha256-eoaZSv6R9U/FYkzF8+kgZMK015AEfmV8kwO/AbSWbKg="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/kdeplasma-addons-6.7.4.tar.xz",
+    "hash": "sha256-UJjCi35ODByTINsowud48+zVxi1lXJWYOZP2YAOYDsE="
  },
  "kgamma": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/kgamma-6.7.3.tar.xz",
-    "hash": "sha256-HN9bYzQ+oFJacmQt2ISXhiiQYVUkJJUglgO9bXayA6A="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/kgamma-6.7.4.tar.xz",
+    "hash": "sha256-sI0uunFIZ3mA07YHskD/xwte0K4USUVykL5eWxGz2IY="
  },
  "kglobalacceld": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/kglobalacceld-6.7.3.tar.xz",
-    "hash": "sha256-zZQNIbsFDW7midWWLTEpLFLzHPqSEep4nb7U/wUCLx0="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/kglobalacceld-6.7.4.tar.xz",
+    "hash": "sha256-U4+IPnsEOX0MWxdW51ARcCL+agOkO6iQ9l1i4s9F54M="
  },
  "kinfocenter": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/kinfocenter-6.7.3.tar.xz",
-    "hash": "sha256-Q2636V4GHr3bhNDlG1q/R3paOyaYRi6iR+prpjOohlU="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/kinfocenter-6.7.4.tar.xz",
+    "hash": "sha256-uC9/rmlBq54DJ6BXmtpRsSrTxaT6X82CcscK6gmh/yM="
  },
  "kmenuedit": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/kmenuedit-6.7.3.tar.xz",
-    "hash": "sha256-3ZLunDvz/ebXvEmQRTucciOLUbhtUQ2UPWi7HRYC4uw="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/kmenuedit-6.7.4.tar.xz",
+    "hash": "sha256-vI2u1chZkE5YDKhBW4iDb83hmJV/pnK1so3kAXOYsMM="
  },
  "knighttime": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/knighttime-6.7.3.tar.xz",
-    "hash": "sha256-Iilc82QOFesE0oNQk0odRXpOxXgDOvjCiUi9EKjHU4c="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/knighttime-6.7.4.tar.xz",
+    "hash": "sha256-3zZ0iPCHiXFWUj6pjNI5KXZC3hDl4FO45yVelOeTXt4="
  },
  "kpipewire": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/kpipewire-6.7.3.tar.xz",
-    "hash": "sha256-tiLz0tjUOvF5UQPse0a5DxGvVZJFyfE3H71WY9DY7jM="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/kpipewire-6.7.4.tar.xz",
+    "hash": "sha256-ICCmqUu3cm7GgATHlGrX9u1FDc7o9Oi3EMNoB1Wvsas="
  },
  "krdp": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/krdp-6.7.3.tar.xz",
-    "hash": "sha256-TYAZsAsg6R6E802g1Ty8wrGuWleh9DekJsZzX8+kFNA="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/krdp-6.7.4.tar.xz",
+    "hash": "sha256-3ZUokr+v0GKB/Z/SOftfO1gH8/NGvkVlVAYRg4gav4s="
  },
  "kscreen": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/kscreen-6.7.3.tar.xz",
-    "hash": "sha256-3+anJN11jV2VElYvWVWZRMXJTh0qJZ0P1h2Ot0Q580w="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/kscreen-6.7.4.tar.xz",
+    "hash": "sha256-iRjJcK42PHwbjbdrIdyWkWK19BNT/Yi96GZ7RlNuuKY="
  },
  "kscreenlocker": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/kscreenlocker-6.7.3.tar.xz",
-    "hash": "sha256-dtS7sSARAuG13TQULFUAa/J/PO05+mTJen9Eux5TTf4="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/kscreenlocker-6.7.4.tar.xz",
+    "hash": "sha256-+c1SXVAfCJMfLAtNCPU4RYiWe8ifrGLjntSuLaKSWjk="
  },
  "ksshaskpass": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/ksshaskpass-6.7.3.tar.xz",
-    "hash": "sha256-0nXms0J+bxIMl/em5k2dFXgpl2oSQSd/E83vHH4rGTo="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/ksshaskpass-6.7.4.tar.xz",
+    "hash": "sha256-04QwYVhPJSaXcbLPcrpKkw9rIePaaXsO+dVpqZ6ZXGc="
  },
  "ksystemstats": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/ksystemstats-6.7.3.tar.xz",
-    "hash": "sha256-OUptNCofiiw9YnP7hgTBgiD5E10jS9LmUe92+Z0Zwlk="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/ksystemstats-6.7.4.tar.xz",
+    "hash": "sha256-kZ8kNv+NqP9up9LAB72va82KLwltBUS6RQEk/6xW3JQ="
  },
  "kwallet-pam": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/kwallet-pam-6.7.3.tar.xz",
-    "hash": "sha256-pyChRA7fhzTkuNTU1eqW/BSUbCHzj2pcobc42KjcWDs="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/kwallet-pam-6.7.4.tar.xz",
+    "hash": "sha256-JEMO9b74t8Brj2dwBYr6q4+7wWY5JTVAi04dnpmhypw="
  },
  "kwayland": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/kwayland-6.7.3.tar.xz",
-    "hash": "sha256-DjMdyhKKni8LQI4QIOW2E+JNdCzBv9i7X4lFn+4Rwhc="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/kwayland-6.7.4.tar.xz",
+    "hash": "sha256-LLOtJgoPwHUzseDp4pTaLsm+gwlakBFA6fqxb6F6VQ0="
  },
  "kwayland-integration": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/kwayland-integration-6.7.3.tar.xz",
-    "hash": "sha256-guCscD7uZbPoO0xpcwIM7gMrecLdQeQ8tl9yhtB2WWI="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/kwayland-integration-6.7.4.tar.xz",
+    "hash": "sha256-gfDmUnFkjGEsaJmn0tOg0Xt3iW3glpNODnk7EzdUYoI="
  },
  "kwin": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/kwin-6.7.3.tar.xz",
-    "hash": "sha256-NFtF1ACITMawD0s1hcwFaqJ4DzKv4t85TSDFqYJzxVk="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/kwin-6.7.4.tar.xz",
+    "hash": "sha256-23p9unGqyh5SGHM7gPkKmY2E4qs25NYtDj6gA3bFgC0="
  },
  "kwin-x11": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/kwin-x11-6.7.3.tar.xz",
-    "hash": "sha256-pEATYMGrgytEizYsMwnwIrMi2kxCuvzslwgSjdIprHE="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/kwin-x11-6.7.4.tar.xz",
+    "hash": "sha256-LEcewHZTK2V6EBdho1Ba5FIayj2QyG14PIE/QmIqHi4="
  },
  "kwrited": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/kwrited-6.7.3.tar.xz",
-    "hash": "sha256-DiBpY1OpnGzE8YgkCxqbUf0Hewy7IMnVEjuaKo+3/C0="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/kwrited-6.7.4.tar.xz",
+    "hash": "sha256-5Va7aqCWzMFGxM3fjB6j+Z12woP5nx1h1J1OwrDp6rY="
  },
  "layer-shell-qt": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/layer-shell-qt-6.7.3.tar.xz",
-    "hash": "sha256-UZJPoU0FMg6s743v6lGJXJYRe8id1wnnRTbdjs37RYE="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/layer-shell-qt-6.7.4.tar.xz",
+    "hash": "sha256-alsGRhlznG9KLecMVqv7rfwzTctiYVKh6BiKgHyoZWc="
  },
  "libkscreen": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/libkscreen-6.7.3.tar.xz",
-    "hash": "sha256-Jt/iPyDq+VtdT6JZXVWpx0DRNW1eMXtI7esQl16mNZ4="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/libkscreen-6.7.4.tar.xz",
+    "hash": "sha256-9Av72DFHp8f/OH/+UFPMLqAAvbIVVaCz0G2jxZ17SXc="
  },
  "libksysguard": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/libksysguard-6.7.3.tar.xz",
-    "hash": "sha256-IFnzDWhAeHBEk4cKf116oxv5WMg0dneMCL7IYw5bv80="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/libksysguard-6.7.4.tar.xz",
+    "hash": "sha256-OIL+c1oAET1vx1TV1CVwO6tCtru/8WeI6VrbTvEbsEw="
  },
  "libplasma": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/libplasma-6.7.3.tar.xz",
-    "hash": "sha256-ljTqdDLQX8dCmlEtPOVnPYv/9Z+WGKoEAT6k8Jq4sBA="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/libplasma-6.7.4.tar.xz",
+    "hash": "sha256-jxh4UOoM1G5UWzN4dhn6KPaCOI5Lgo0JCgaSh0p8mVU="
  },
  "milou": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/milou-6.7.3.tar.xz",
-    "hash": "sha256-ILjZ4ED/vu6+BbJ9iXWcjoyJCBq6Rj464NOEfmCtTVI="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/milou-6.7.4.tar.xz",
+    "hash": "sha256-iO2RGbd3xxB2V7R7aK80osLeQi9wnRQJt8LXchRj4kc="
  },
  "ocean-sound-theme": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/ocean-sound-theme-6.7.3.tar.xz",
-    "hash": "sha256-mtEv2thR5p9P99lm6Lhbk8I8/HsB+QQ0kUMAxgFA6XE="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/ocean-sound-theme-6.7.4.tar.xz",
+    "hash": "sha256-PQNo6ZI4j84AFeNiJ3gGKmeCe2YLrmq1UehzrhijBFw="
  },
  "oxygen": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/oxygen-6.7.3.tar.xz",
-    "hash": "sha256-1FN9x9WvoqdUJ4q+8yzurYLaQajIyhnmy9b2ePSa6pw="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/oxygen-6.7.4.tar.xz",
+    "hash": "sha256-nmSsgKAe2QQRC4gjLlCceukg1tixICiA/1V+XGIZGa8="
  },
  "oxygen-sounds": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/oxygen-sounds-6.7.3.tar.xz",
-    "hash": "sha256-eZoSvDe2MMoP1lCC4ufYka/3bP34FAb/jHbOtIe81lc="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/oxygen-sounds-6.7.4.tar.xz",
+    "hash": "sha256-TnuUJUTl697NpesjpoWKwqlCnAxU/7qKJFXx/0ucqd4="
  },
  "plasma-activities": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/plasma-activities-6.7.3.tar.xz",
-    "hash": "sha256-Op+/ADlGQnAji4Q0SxBkxX+xGmql15APCKCoaAY6Yuo="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/plasma-activities-6.7.4.tar.xz",
+    "hash": "sha256-+ZDohxWGx7r+NUVgmwcbFMMCEQXMkPYD2s9F4uAYXCo="
  },
  "plasma-activities-stats": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/plasma-activities-stats-6.7.3.tar.xz",
-    "hash": "sha256-RIuF1WnzkS+Mk8HEEuNlUbq33+iZG6oMYgbGAiPpigg="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/plasma-activities-stats-6.7.4.tar.xz",
+    "hash": "sha256-mLiINyx/dMYLAq9uHKixj+gmJ0j+v14EgL0OzJ4r3e8="
  },
  "plasma-bigscreen": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/plasma-bigscreen-6.7.3.tar.xz",
-    "hash": "sha256-2yE976OjqCcaVNowdgwt8BL6bukUO5D7KvBgrR+hrg4="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/plasma-bigscreen-6.7.4.tar.xz",
+    "hash": "sha256-X7duN3fOA71N7RGfsWnv6zCKOPQ97ACRlxWKvsE0RBw="
  },
  "plasma-browser-integration": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/plasma-browser-integration-6.7.3.tar.xz",
-    "hash": "sha256-mpfsZsKbmBflCBJZt6LIl0rr9g8KoTI/P38/uyR2dNI="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/plasma-browser-integration-6.7.4.tar.xz",
+    "hash": "sha256-KY7l4UyTXdgRrTaGoqZCL+jS6n8LaUZZUmjGrGslIyU="
  },
  "plasma-desktop": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/plasma-desktop-6.7.3.tar.xz",
-    "hash": "sha256-jBu3JbQjdejOIX+wQyytMPzKDLMV2GSzGLdrOLXwdMY="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/plasma-desktop-6.7.4.tar.xz",
+    "hash": "sha256-wvDCt6twy9me8X/61MMRfasS72pxeQ2jPjlog4ZHSWI="
  },
  "plasma-dialer": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/plasma-dialer-6.7.3.tar.xz",
-    "hash": "sha256-+e+WIOQv2eBjlFV0pZtcRz5ASsGtVhNcETnNLnyoAvI="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/plasma-dialer-6.7.4.tar.xz",
+    "hash": "sha256-vvIiQ9ZLtrPt3sPbEzTZs97rwOoGXnHgWK760TUOtYc="
  },
  "plasma-disks": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/plasma-disks-6.7.3.tar.xz",
-    "hash": "sha256-x6dgRYHWRrBOKqTizg4w993iBKhT3JWMyzkqz4nM4lk="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/plasma-disks-6.7.4.tar.xz",
+    "hash": "sha256-Iy1/Y0PlyKXFz8/04PgP39AGPkq6eevYpDHGbZpYwTo="
  },
  "plasma-firewall": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/plasma-firewall-6.7.3.tar.xz",
-    "hash": "sha256-bDIutWbTbSjCN5XVdghl+tjUFB2+ODqNXt8keugw+ao="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/plasma-firewall-6.7.4.tar.xz",
+    "hash": "sha256-fybCo7/JNd3pk28cxhHaxM+TbX19PLPqQfFBBk66rFY="
  },
  "plasma-integration": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/plasma-integration-6.7.3.tar.xz",
-    "hash": "sha256-q2Bt+HzDT7ioXOLFScxh4SbN8hCsFqHoWU+jYxc+idw="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/plasma-integration-6.7.4.tar.xz",
+    "hash": "sha256-VOZbEXBJnMxWf5u3WGgJ1HOepyjvzxvId9FwnbbnNHo="
  },
  "plasma-keyboard": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/plasma-keyboard-6.7.3.tar.xz",
-    "hash": "sha256-w3HZjEWI22ZyqTqhO1PRePLcODvbWAyL7WXRhJvnyX4="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/plasma-keyboard-6.7.4.tar.xz",
+    "hash": "sha256-e7z23z5POqLwxZ4z/cXPyTN3wENpKD8ZAL6Pe4/hlKE="
  },
  "plasma-login-manager": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/plasma-login-manager-6.7.3.tar.xz",
-    "hash": "sha256-GZzASx78/PTUzv0CeGGQIBPQw0K7x1TQIxhZ+hdWf9k="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/plasma-login-manager-6.7.4.tar.xz",
+    "hash": "sha256-i6X5pbMbLLCdaEbFkNCYkdrbmlYlQmuFUldymQk7Z/0="
  },
  "plasma-mobile": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/plasma-mobile-6.7.3.tar.xz",
-    "hash": "sha256-RASTkicy0CMFsqniDFMN/MWwPfKJH5RQkKVmVhH0kCc="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/plasma-mobile-6.7.4.tar.xz",
+    "hash": "sha256-N4CF91ywN4pG+hLMZ4oOh/K/nxdx61FHMNqLCmF+i+w="
  },
  "plasma-nano": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/plasma-nano-6.7.3.tar.xz",
-    "hash": "sha256-y1hXOPO/9I4kvGAluzLj/Bdx67/OlUWdQwj0RTAuIgE="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/plasma-nano-6.7.4.tar.xz",
+    "hash": "sha256-A+qXtXhW3xurYYWVuHd+UZ2OJExvLZ13/a/PVTx9WIU="
  },
  "plasma-nm": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/plasma-nm-6.7.3.tar.xz",
-    "hash": "sha256-tDi/EegrIWn83bcV8yTqLgFpM0LGysbDkiQPnGewm+Q="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/plasma-nm-6.7.4.tar.xz",
+    "hash": "sha256-xNSeCAclEO0dLqnhJNz0k6hkWDkcdW0UqqwowsCn5IQ="
  },
  "plasma-pa": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/plasma-pa-6.7.3.tar.xz",
-    "hash": "sha256-yX6YXTdJTDYXr8vh1D4DneAGjtU+I3CD8n3ARuINFmU="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/plasma-pa-6.7.4.tar.xz",
+    "hash": "sha256-QZw8/hXy8wk8QlXYSiRwjdetKNos6Az+41Ifdhumk34="
  },
  "plasma-sdk": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/plasma-sdk-6.7.3.tar.xz",
-    "hash": "sha256-sC2rfCIFGwHv9T4AOO9EVkcWF2l2YmXDtD+NpMrA3mE="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/plasma-sdk-6.7.4.tar.xz",
+    "hash": "sha256-nJfD79gh6L0hTx05Ph+bJiQqq5uAmRRtN+qt3wnZEHA="
  },
  "plasma-setup": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/plasma-setup-6.7.3.tar.xz",
-    "hash": "sha256-uAvesgJk/HEQ8XFnDX5oQEjLWMBhMU26HlUbAuOvvCY="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/plasma-setup-6.7.4.tar.xz",
+    "hash": "sha256-2Ndhx4xOpR634rk0LxD74LRtTO3+7rUVDJ04ey63nQM="
  },
  "plasma-systemmonitor": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/plasma-systemmonitor-6.7.3.tar.xz",
-    "hash": "sha256-XBGQxh0golTOjzad5VqDffLuMzZueBJLAVy7PWLRSQw="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/plasma-systemmonitor-6.7.4.tar.xz",
+    "hash": "sha256-gGlPnWg6NyARYZf3iZ5HoLEPAaRqZq9l7geeIUWJeo0="
  },
  "plasma-thunderbolt": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/plasma-thunderbolt-6.7.3.tar.xz",
-    "hash": "sha256-TOhi0C0wqZizYvcNbdg0wH8Oz8BA0zS5C/uaN2dDJvI="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/plasma-thunderbolt-6.7.4.tar.xz",
+    "hash": "sha256-zEBiX8UdHRV24C50EfJCb+9h94/257wU2z8oGAMqUwk="
  },
  "plasma-vault": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/plasma-vault-6.7.3.tar.xz",
-    "hash": "sha256-jF2RrXds7h7x7KL7ObXagtEpVntG0klMMXHhej6SOic="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/plasma-vault-6.7.4.tar.xz",
+    "hash": "sha256-bxi4XJvaaMwnGpDS8nW/rUFPWIglwyQx4muEP4/FcRM="
  },
  "plasma-welcome": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/plasma-welcome-6.7.3.tar.xz",
-    "hash": "sha256-/x198bN75SospvTRsCrrWsfqKkrzO9a2KF1ejQtzhBA="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/plasma-welcome-6.7.4.tar.xz",
+    "hash": "sha256-2YYkQKFoIMoAq7IjY75X6bFWrcdttpLU0Eyr0+hiqz0="
  },
  "plasma-workspace": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/plasma-workspace-6.7.3.tar.xz",
-    "hash": "sha256-Q4hRcIpweB7POvoKCEiP3Gdotu1avKXyAqh+OVqmN28="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/plasma-workspace-6.7.4.tar.xz",
+    "hash": "sha256-Iew8ACkp62U3ehrg6xBbmrb2CASdrFST4Yj1G9UDmNU="
  },
  "plasma-workspace-wallpapers": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/plasma-workspace-wallpapers-6.7.3.tar.xz",
-    "hash": "sha256-uPXbayVP3XX58o0Mb/Cvh9y8PsacGjiB1b23ADUHFVE="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/plasma-workspace-wallpapers-6.7.4.tar.xz",
+    "hash": "sha256-0Lq5sBgkgKQf4MZ3ofXU0cMIjg86pog6C8JUI9lOz9A="
  },
  "plasma5support": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/plasma5support-6.7.3.tar.xz",
-    "hash": "sha256-+nrWak0yFF7mqR7NafGUQMVU0GKvqTDiyFl+Ms/FD3w="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/plasma5support-6.7.4.tar.xz",
+    "hash": "sha256-eT/WdgRUfzTG7MiRBMnTnFbTiLa3MYEwLlyNd1eC5t0="
  },
  "plymouth-kcm": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/plymouth-kcm-6.7.3.tar.xz",
-    "hash": "sha256-NUvGwFg/MbAICnNLFsJvYQPrVi5axqYF7xGcNxCleEQ="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/plymouth-kcm-6.7.4.tar.xz",
+    "hash": "sha256-zGVlGUkxnJnaQLyYceL+Z8o9kb9BTnN4T/oHbMh0yzU="
  },
  "polkit-kde-agent-1": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/polkit-kde-agent-1-6.7.3.tar.xz",
-    "hash": "sha256-i3jeIBZogRWZVTWs03J+gnPkWCwbXNyIP0NoMiOXCyo="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/polkit-kde-agent-1-6.7.4.tar.xz",
+    "hash": "sha256-2AaZV1wIgkr4H8DircHEjF6apGapuAvCluA5STZzbgo="
  },
  "powerdevil": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/powerdevil-6.7.3.tar.xz",
-    "hash": "sha256-cuNilj1nSIy1W51sVjpmu+BDVTmAJp8uLCtpHwI+LzU="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/powerdevil-6.7.4.tar.xz",
+    "hash": "sha256-z9UxcvFotagMunq4XnuSn218fg+oDtDUjaFAtafWmOM="
  },
  "print-manager": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/print-manager-6.7.3.tar.xz",
-    "hash": "sha256-neMdnhIyRDHc0u+5gwFvlehXSoqnnmv3YXd9ZmrOF7I="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/print-manager-6.7.4.tar.xz",
+    "hash": "sha256-S84JXG3JYHsgVRsOpcXry1aklRDuDALTRFcmBNdBaGg="
  },
  "qqc2-breeze-style": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/qqc2-breeze-style-6.7.3.tar.xz",
-    "hash": "sha256-45na9M7iQeS8r3e2lUj3ufaxVQzA99xc5vLsT5nYKJk="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/qqc2-breeze-style-6.7.4.tar.xz",
+    "hash": "sha256-OuDJjTvb49GQn4ZucxtKCXH5C4wnQ1PWflgdIxR0ypg="
  },
  "sddm-kcm": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/sddm-kcm-6.7.3.tar.xz",
-    "hash": "sha256-NFrPXPPPK1/rLuCzFHFSHnkmhJEBmmuu+zGyNpD2Lg8="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/sddm-kcm-6.7.4.tar.xz",
+    "hash": "sha256-4pSYZ0v1QUDf7ISAGGzdDaUVouYpLHMyCK3rQXVRKWk="
  },
  "spacebar": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/spacebar-6.7.3.tar.xz",
-    "hash": "sha256-enyu7rn2urzUn9u5+U/oL/v9UMkUQohnOfi3y3mQPC0="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/spacebar-6.7.4.tar.xz",
+    "hash": "sha256-BLcNuG/AAosztkYhhSXDvwgUgLEAScjPtKT1I2lU6S4="
  },
  "spectacle": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/spectacle-6.7.3.tar.xz",
-    "hash": "sha256-T1yHWS81uxvVj6jnKCnDkElkasw9L3lFHao0DA27EVQ="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/spectacle-6.7.4.tar.xz",
+    "hash": "sha256-XGH/2bN8pjhLdU1EoFHI+Xmrd5hPkufd86HBUVbWVmU="
  },
  "systemsettings": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/systemsettings-6.7.3.tar.xz",
-    "hash": "sha256-lynNSHqDjIDIpa3Ji1DYS6QjHLR/VbXvqJciE7iOFkA="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/systemsettings-6.7.4.tar.xz",
+    "hash": "sha256-WiVLz3y+7QTuP0B7XoZgmZL5eNhzTnb6JLSvr71mODw="
  },
  "union": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/union-6.7.3.tar.xz",
-    "hash": "sha256-7pHo7PBm1bxy1lPlMnzvBYDYKqYOD86bR/lFgE05kZk="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/union-6.7.4.tar.xz",
+    "hash": "sha256-sag9xrgx+z5G0Y1MZEGCLJTjhime83uBYUghVIDTJaw="
  },
  "wacomtablet": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/wacomtablet-6.7.3.tar.xz",
-    "hash": "sha256-yPrxfXYqVUHt8fKqoY9xIXBQvXDza5+nEN8FGS7hXvI="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/wacomtablet-6.7.4.tar.xz",
+    "hash": "sha256-I2xnFHstpwHkK9nj6pnMRE4GFTk9Ag4CkIPASs1YZWk="
  },
  "xdg-desktop-portal-kde": {
-    "version": "6.7.3",
-    "url": "mirror://kde/stable/plasma/6.7.3/xdg-desktop-portal-kde-6.7.3.tar.xz",
-    "hash": "sha256-3pznR182cOVmLeijrZAC35GKte6UtEAePMsdZ/RtSRk="
+    "version": "6.7.4",
+    "url": "mirror://kde/stable/plasma/6.7.4/xdg-desktop-portal-kde-6.7.4.tar.xz",
+    "hash": "sha256-u0uVXi9SqDLyIdP7cYLOv5IGU6CtHjIBq9KfE01MM/M="
  }
 }
--- a/pkgs/kde/lib/mk-kde-derivation.nix
+++ b/pkgs/kde/lib/mk-kde-derivation.nix
@@ -35,11 +35,6 @@ let
      # https://invent.kde.org/kdevelop/kdevelop/-/blob/master/LICENSES/LicenseRef-MIT-KDevelop-Ideal.txt
      "LicenseRef-MIT-KDevelop-Ideal" = lib.licenses.mit;

-      "FSFAP" = {
-        spdxId = "FSFAP";
-        fullName = "FSF All Permissive License";
-      };
-
      "FSFULLR" = {
        spdxId = "FSFULLR";
        fullName = "FSF Unlimited License (with License Retention)";
--- a/pkgs/kde/misc/klevernotes/default.nix
+++ b/pkgs/kde/misc/klevernotes/default.nix
@@ -27,7 +27,7 @@ mkKdeDerivation rec {
    bsd3
    cc-by-sa-40
    cc0
-    # TODO: add FSFAP license
+    fsfap
    gpl2Plus
    gpl3Only
    gpl3Plus
--- a/pkgs/servers/home-assistant/custom-components/mass-queue/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/mass-queue/package.nix
@@ -8,13 +8,13 @@
 buildHomeAssistantComponent rec {
  owner = "droans";
  domain = "mass_queue";
-  version = "0.10.1";
+  version = "0.10.2";

  src = fetchFromGitHub {
    inherit owner;
    repo = "mass_queue";
-    tag = "v${version}";
-    hash = "sha256-Q41/DAwXByeq0Qim3U735XYpLsI2DQqe5r1mJ3N/I2w=";
+    tag = version;
+    hash = "sha256-kr3XV/C7TGffDX8U/81UnjN7HSZnsAd+k/ALls/QALc=";
  };

  dependencies = [
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -2014,6 +2014,7 @@ mapAliases {
  purple-slack = throw "'purple-slack' has been renamed to/replaced by 'pidginPackages.purple-slack'"; # Converted to throw 2025-10-27
  purple-vk-plugin = throw "'purple-vk-plugin' has been removed as upstream repository was deleted and no active forks are found."; # Added 2025-09-17
  purple-xmpp-http-upload = throw "'purple-xmpp-http-upload' has been renamed to/replaced by 'pidginPackages.purple-xmpp-http-upload'"; # Converted to throw 2025-10-27
+  pyca = throw "'pyca' was removed, because it was hard to maintain and not required by anything"; # Added 2026-07-31
  pyCA = warnAlias "'pyCA' was renamed to 'pyca'" pyca; # Added 2026-02-12
  pylint-exit = throw "'pylint-exit' was removed as it dependent on m2r which was removed."; # Added 2026-05-27
  pyload-ng = throw "'pyload-ng' has been removed due to vulnerabilities and being unmaintained"; # Added 2026-03-21
--- a/pkgs/top-level/darwin-packages.nix
+++ b/pkgs/top-level/darwin-packages.nix
@@ -179,6 +179,31 @@ makeScopeWithSplicing' {
      linux-builder-x86_64 = self.linux-builder.override {
        modules = [ { nixpkgs.hostPlatform = "x86_64-linux"; } ];
      };
+
+      # Like `linux-builder`, but runs the guest on Apple's Virtualization.framework
+      # via `vzvm`, translating x86_64-linux builds with Rosetta instead of emulating
+      # them. See doc/packages/darwin-builder.section.md
+      linux-builder-vz = lib.makeOverridable (
+        { modules }:
+        let
+          nixos = import ../../nixos {
+            configuration = {
+              imports = [
+                ../../nixos/modules/profiles/nix-builder-vz-vm.nix
+              ]
+              ++ modules;
+
+              virtualisation.host = { inherit pkgs; };
+
+              # aarch64-darwin is the only supported host, so the guest is fixed too.
+              nixpkgs.hostPlatform = lib.mkDefault "aarch64-linux";
+            };
+
+            system = null;
+          };
+        in
+        nixos.config.system.build.macos-builder-installer
+      ) { modules = [ ]; };
    }
  );
 }
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -491,6 +491,7 @@ mapAliases {
  pygame_sdl2 = throw "'pygame_sdl2' has been renamed to/replaced by 'pygame-sdl2'"; # Converted to throw 2025-10-29
  PyGithub = throw "'PyGithub' has been renamed to/replaced by 'pygithub'"; # Converted to throw 2025-10-29
  pygls_2 = pygls; # added 2026-01-05
+  pygpgme = throw "'pygpgme' has been removed as it was unmaintained and broken"; # Added 2026-08-02
  pygtk = throw "pygtk has been removed because it was not supported by python3"; # Added 2026-01-14
  pyheif = throw "pyheif has been removed due to lack of upstream maintenance and breakage. Use `pillow-heif` instead."; # added 2025-09-17
  pyhidra = throw "'pyhidra' has been removed as it was incorporated into upstream and renamed 'pyghidra'"; # Added 2026-04-21
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5409,6 +5409,8 @@ self: super: with self; {

  emcee = callPackage ../development/python-modules/emcee { };

+  emerge = callPackage ../development/python-modules/emerge { };
+
  emmiai-noether = callPackage ../development/python-modules/emmiai-noether { };

  emoji = callPackage ../development/python-modules/emoji { };
@@ -5421,6 +5423,8 @@ self: super: with self; {

  empy = callPackage ../development/python-modules/empy { };

+  emsutil = callPackage ../development/python-modules/emsutil { };
+
  emulated-roku = callPackage ../development/python-modules/emulated-roku { };

  emv = callPackage ../development/python-modules/emv { };
@@ -11976,6 +11980,8 @@ self: super: with self; {

  nvidia-ml-py = callPackage ../development/python-modules/nvidia-ml-py { };

+  nvmath-python = callPackage ../development/python-modules/nvmath-python { };
+
  nwdiag = callPackage ../development/python-modules/nwdiag { };

  nxt-python = callPackage ../development/python-modules/nxt-python { };
@@ -14709,8 +14715,6 @@ self: super: with self; {

  pygount = callPackage ../development/python-modules/pygount { };

-  pygpgme = callPackage ../development/python-modules/pygpgme { };
-
  pygraphviz = callPackage ../development/python-modules/pygraphviz { inherit (pkgs) graphviz; };

  pygreat = callPackage ../development/python-modules/pygreat { };