Merge d95279435c into haskell-updates

2026-07-21 08:01:31 +00:00 · 2026-07-14 00:33:37 +00:00
parent 6a3c990a99 d95279435c
commit 92cbc9ca81
449 changed files with 7536 additions and 2980 deletions
--- a/doc/doc-support/header.html
+++ b/doc/doc-support/header.html
@@ -0,0 +1,7 @@
+<div class="manual-header">
+    <nav class="manual-header--tabs">
+        <a class="manual-header--tab manual-header--tab-active" href="#">Nixpkgs</a>
+        <a class="manual-header--tab" href="https://nixos.org/manual/nixos/stable/">NixOS</a>
+    </nav>
+    <span class="manual-header--title">Nixpkgs Manual</span>
+</div>
--- a/doc/doc-support/package.nix
+++ b/doc/doc-support/package.nix
@@ -119,6 +119,8 @@ stdenvNoCC.mkDerivation (
        --script ./anchor-use.js \
        --sidebar-depth 3 \
        --nav ./nav.json \
+        --header ${./header.html}\
+        --no-navheader \
        manual.md \
        out/index.html

--- a/doc/languages-frameworks/rocq.section.md
+++ b/doc/languages-frameworks/rocq.section.md
@@ -74,6 +74,8 @@ The recommended way of defining a derivation for a Rocq library, is to use the `
 * `enableParallelBuilding` (optional, defaults to `true`), since it is activated by default, we provide a way to disable it.
 * `extraInstallFlags` (optional), allows to extend `installFlags` which initializes the variables `COQLIBINSTALL` and `COQPLUGININSTALL` so as to install in the proper subdirectory. Indeed Rocq libraries should be installed in `$(out)/lib/coq/${rocq-core.rocq-version}/user-contrib/`. Such directories are automatically added to the `$ROCQPATH` environment variable by the hook defined in the Rocq derivation.
 * `setROCQBIN` (optional, defaults to `true`), by default, the environment variable `$ROCQBIN` is set to the current Rocq's binary, but one can disable this behavior by setting it to `false`,
+* `useCoq` (optional, defaults to `false`), adds the Coq compatibility binaries to the build environment, which is necessary for some packages that still depend on them and sets `COQBIN` to the path of the `coqc` binary (if `setROCQBIN` is also set to `true`). A wrapper `mkCoqDerivation` is provided that sets this option to `true`.
+* `useCoqifVersion` (optional, defaults to `(x: false)`), adds the Coq compatibility binaries to the build environment if the provided predicate evaluates to true on the version. This can be useful for supporting old package versions that need the Coq compatibility binaries, while newer versions do not.
 * `useMelquiondRemake` (optional, default to `null`) is an attribute set, which, if given, overloads the `preConfigurePhases`, `configureFlags`, `buildPhase`, and `installPhase` attributes of the derivation for a specific use in libraries using `remake` as set up by Guillaume Melquiond for `flocq`, `gappalib`, `interval`, and `coquelicot` (see the corresponding derivation for concrete examples of use of this option). For backward compatibility, the attribute `useMelquiondRemake.logpath` must be set to the logical root of the library (otherwise, one can pass `useMelquiondRemake = {}` to activate this without backward compatibility).
 * `dropAttrs`, `keepAttrs`, `dropDerivationAttrs` are all optional and allow to tune which attribute is added or removed from the final call to `mkDerivation`.

--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -44,6 +44,8 @@

 - `libgdata` has been removed, as it was archived upstream and relied on the insecure libsoup 2.4.

+- `mcphost` has been removed, as it was archived upstream and declared unmaintained.
+
 - `services.mysql` now sets `root@localhost` authentication to `auth_socket` when used with `mysql` or `percona-server`.
  Existing deployments will also be adjusted if possible. See the [security advisory GHSA-6qxx-6rg8-c4p8](https://github.com/NixOS/nixpkgs/security/advisories/GHSA-6qxx-6rg8-c4p8) for more information.

@@ -106,6 +108,7 @@
 - Starting with v14, `flameshot` will primarily utilise xdg-desktop-portal calls for screenshotting. This will directly affect users on X11 window managers due to the lack of a compatible portal with Screenshot feature. See [upstream changelog](https://github.com/flameshot-org/flameshot/releases/tag/v14.0.0) or [NixOS Flameshot](https://wiki.nixos.org/wiki/Flameshot) wiki page for workarounds.
 - `nim1` and respective aliases have been removed due to entering EOL; please migrate to `nim` or `nim-unwrapped` (nim 2).
 - `nim-2_0` & `nim-2_2` and respective aliases have been removed; please migrate to `nim` or `nim-unwrapped` (nim 2.2.10).
+- `domoticz` has been updated from `2024.7` to `2026.x`, breaking third party applications and scripts using the old RType calls. Review the [release notes](https://github.com/domoticz/domoticz/blob/2026.2/History.txt#L398) for more information.

 - `vimacs` has been removed, as it has not been maintained in 10 years and was built for an old version of vim (6.0).

@@ -142,10 +145,11 @@

 ### Deprecations {#sec-nixpkgs-release-26.11-lib-deprecations}

- Create the first release note entry in this section!
+- Setting `config.allowBrokenPredicate` is deprecated in favor of
+  using `config.problems.handlers.PackageName.broken = "warn"` (or `=
+  "ignore"`). For more information see [](#sec-allow-broken).


 ### Additions and Improvements {#sec-nixpkgs-release-26.11-lib-additions-improvements}

 - Create the first release note entry in this section!
-
--- a/doc/style.css
+++ b/doc/style.css
@@ -23,14 +23,14 @@ body {
@media screen and (min-width: 992px) {
  .book,
  .appendix {
-    max-width: 60rem;
+    max-width: 55rem;
  }
 }

@media screen and (min-width: 1200px) {
  .book,
  .appendix {
-    max-width: 73rem;
+    max-width: 55rem;
  }
 }

@@ -398,6 +398,7 @@ div.appendix .variablelist .term {

 :root {
  --sidebar-width: 20rem;
+  --header-height: 3rem;
  --background: #fff;
  --main-text-color: #000;
  --link-color: #405d99;
@@ -528,7 +529,7 @@ nav.toc-sidebar summary {
    min-height: 0;
    display: grid;
    grid-template-columns: minmax(0, 1fr);
-    grid-template-rows: auto minmax(0, 1fr);
+    grid-template-rows: var(--header-height) auto minmax(0, 1fr);
  }

  body:has(> nav.toc-sidebar) {
@@ -537,7 +538,7 @@ nav.toc-sidebar summary {

  .navheader {
    grid-column: 1 / -1;
-    grid-row: 1;
+    grid-row: 2;
  }

  nav.toc-sidebar {
@@ -548,7 +549,7 @@ nav.toc-sidebar summary {
    /*  */
    margin: 0;
    grid-column: 1;
-    grid-row: 2;
+    grid-row: 3;
    max-height: none;
    overflow-y: auto;
    border: none;
@@ -562,7 +563,7 @@ nav.toc-sidebar summary {

  main.content {
    grid-column: 1 / -1;
-    grid-row: 2;
+    grid-row: 3;
    overflow-y: auto;
    padding: 0 1rem;
  }
@@ -571,3 +572,73 @@ nav.toc-sidebar summary {
    grid-column: 2;
  }
 }
+
+.manual-header {
+  background-color: var(--background);
+  border-bottom: 0.0625rem solid #d8d8d8;
+  display: flex;
+  flex-direction: column;
+}
+
+.manual-header--title {
+  order: -1;
+  padding: 0.5rem 1rem 0;
+  font-size: 0.875rem;
+  font-weight: 500;
+  color: var(--small-heading-color);
+  text-align: center;
+}
+
+.manual-header--tabs {
+  display: flex;
+  align-items: stretch;
+  justify-content: space-around;
+  margin: 0;
+  padding: 0;
+}
+
+.manual-header--tab {
+  display: flex;
+  align-items: center;
+  padding: 0 1rem;
+  font-size: 0.875rem;
+  font-weight: 500;
+  color: var(--main-text-color);
+  text-decoration: none;
+  border-bottom: 0.1875rem solid transparent;
+  border-top: 0.1875rem solid transparent;
+  transition: border-bottom-color 0.15s ease;
+}
+
+.manual-header--tab:hover {
+  border-bottom-color: var(--heading-color);
+  color: var(--main-text-color);
+}
+
+.manual-header--tab-active {
+  border-bottom-color: var(--heading-color);
+  color: var(--heading-color);
+  font-weight: 700;
+}
+
+@media screen and (min-width: 768px) {
+  .manual-header {
+    height: var(--header-height);
+    flex-direction: row;
+    align-items: stretch;
+    grid-column: 1 / -1;
+    grid-row: 1;
+  }
+
+  .manual-header--title {
+    order: 0;
+    margin-left: auto;
+    padding: 0 1rem;
+    align-self: center;
+  }
+
+  .manual-header--tabs {
+    justify-content: flex-start;
+    padding: 0 1rem;
+  }
+}
--- a/maintainers/github-teams.json
+++ b/maintainers/github-teams.json
@@ -151,6 +151,7 @@
      "samuela": 226872
    },
    "members": {
+      "ethancedwards8": 60861925,
      "prusnak": 42201
    },
    "name": "cuda-maintainers"
@@ -365,10 +366,10 @@
  "freedesktop": {
    "description": "Maintain Freedesktop.org packages for graphical desktop.",
    "id": 3806136,
-    "maintainers": {},
-    "members": {
+    "maintainers": {
      "jtojnar": 705123
    },
+    "members": {},
    "name": "Freedesktop"
  },
  "geospatial": {
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1943,6 +1943,11 @@
    githubId = 143312793;
    name = "Annin";
  };
+  anntnzrb = {
+    github = "anntnzrb";
+    githubId = 51257127;
+    name = "anntnzrb";
+  };
  anoa = {
    matrix = "@andrewm:amorgan.xyz";
    email = "andrew@amorgan.xyz";
@@ -4640,6 +4645,13 @@
    githubId = 53847249;
    name = "Casey Avila";
  };
+  cassandracomar = {
+    name = "Cassandra Comar";
+    github = "cassandracomar";
+    githubId = 320772;
+    email = "cass@mountclare.net";
+    keys = [ { fingerprint = "104E E74E 24A0 372B EAF5  5533 B019 18F7 7E04 AC99"; } ];
+  };
  castorNova2 = {
    email = "solemnsquire@gmail.com";
    github = "castorNova2";
@@ -8841,6 +8853,13 @@
    githubId = 345808;
    name = "Jakub Okoński";
  };
+  FatBoyXPC = {
+    name = "FatBoyXPC";
+    email = "fatboyxpc@gmail.com";
+    github = "FatBoyXPC";
+    githubId = 744962;
+    keys = [ { fingerprint = "0E08 1B81 CBCA 1CF7 9568  A13F C4ED 3CA2 3211 8969"; } ];
+  };
  faukah = {
    github = "faukah";
    name = "faukah";
@@ -9021,6 +9040,11 @@
    githubId = 5198058;
    name = "Udo Sauer";
  };
+  fernvenue = {
+    github = "fernvenue";
+    githubId = 84565547;
+    name = "fernvenue";
+  };
  feyorsh = {
    email = "george@feyor.sh";
    github = "Feyorsh";
@@ -10386,6 +10410,12 @@
    githubId = 273582;
    name = "greg";
  };
+  gregshuflin = {
+    email = "greg@everdayimshuflin.com";
+    github = "neunenak";
+    githubId = 311545;
+    name = "Greg Shuflin";
+  };
  greizgh = {
    email = "greizgh@ephax.org";
    github = "greizgh";
@@ -11445,6 +11475,11 @@
    githubId = 69209;
    name = "Ian Duncan";
  };
+  IanHollow = {
+    github = "IanHollow";
+    githubId = 72767437;
+    name = "Ian Holloway";
+  };
  ianliu = {
    email = "ian.liu88@gmail.com";
    github = "ianliu";
@@ -12745,6 +12780,12 @@
    githubId = 5741620;
    name = "Jeremy Schlatter";
  };
+  jeremystucki = {
+    email = "dev@jeremystucki.ch";
+    github = "jeremystucki";
+    githubId = 7629727;
+    name = "Jeremy Stucki";
+  };
  jerith666 = {
    email = "github@matt.mchenryfamily.org";
    github = "jerith666";
@@ -14096,6 +14137,14 @@
    name = "Kenichi Kamiya";
    keys = [ { fingerprint = "9121 5D87 20CA B405 C63F  24D2 EF6E 574D 040A E2A5"; } ];
  };
+  kacper-uminski = {
+    name = "Kacper Uminski";
+    email = "kacper+nixpkgs@lysator.liu.se";
+    github = "kacper-uminski";
+    githubId = 57466578;
+    matrix = "@kacper.uminski:matrix.org";
+    keys = [ { fingerprint = "3DF9 3DEB CAA9 81FA B3E2  A7F0 87DA 201D E02F 14B1"; } ];
+  };
  kaction = {
    name = "Dmitry Bogatov";
    email = "KAction@disroot.org";
@@ -20309,6 +20358,12 @@
    githubId = 4242897;
    name = "Nikolai Mishin";
  };
+  nmoya = {
+    email = "nikolasmoya@gmail.com";
+    github = "nmoya";
+    githubId = 1767648;
+    name = "Nikolas Moya";
+  };
  noaccos = {
    name = "Francesco Noacco";
    email = "francesco.noacco2000@gmail.com";
--- a/nixos/doc/manual/default.nix
+++ b/nixos/doc/manual/default.nix
@@ -202,6 +202,8 @@ rec {
          --script ./anchor.min.js \
          --script ./anchor-use.js \
          --sidebar-depth 2 \
+          --header ${./header.html}\
+          --no-navheader \
          ./manual.md \
          $dst/${common.indexPath}

--- a/nixos/doc/manual/header.html
+++ b/nixos/doc/manual/header.html
@@ -0,0 +1,7 @@
+<div class="manual-header">
+    <nav class="manual-header--tabs">
+        <a class="manual-header--tab" href="https://nixos.org/manual/nixos/stable/">Nixpkgs</a>
+        <a class="manual-header--tab manual-header--tab-active" href="#">NixOS</a>
+    </nav>
+    <span class="manual-header--title">Nixos Manual</span>
+</div>
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@@ -1891,6 +1891,9 @@
  "sec-kubernetes": [
    "index.html#sec-kubernetes"
  ],
+  "module-services-nordvpn": [
+    "index.html#module-services-nordvpn"
+  ],
  "ch-running": [
    "index.html#ch-running"
  ],
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -56,6 +56,8 @@

 - [OO7](https://github.com/linux-credentials/oo7) is a desktop-agnostic Secret Service provider. Available as [services.oo7](#opt-services.oo7.enable)

+- [NordVPN](https://github.com/NordSecurity/nordvpn-linux), a NordVPN client for linux. Available as [services.nordvpn](options.html#opt-services.nordvpn.enable).
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -358,6 +358,7 @@
  ./programs/wayland/mangowc.nix
  ./programs/wayland/miracle-wm.nix
  ./programs/wayland/niri.nix
+  ./programs/wayland/pinnacle.nix
  ./programs/wayland/river.nix
  ./programs/wayland/sway.nix
  ./programs/wayland/uwsm.nix
@@ -1343,6 +1344,7 @@
  ./services/networking/nncp.nix
  ./services/networking/nntp-proxy.nix
  ./services/networking/nomad.nix
+  ./services/networking/nordvpn.nix
  ./services/networking/nsd.nix
  ./services/networking/ntopng.nix
  ./services/networking/ntp/chrony.nix
--- a/nixos/modules/programs/wayland/pinnacle.nix
+++ b/nixos/modules/programs/wayland/pinnacle.nix
@@ -0,0 +1,70 @@
+{
+  pkgs,
+  config,
+  lib,
+  ...
+}:
+let
+  cfg = config.programs.pinnacle;
+  inherit (lib.options) mkEnableOption mkPackageOption;
+in
+{
+  options.programs.pinnacle = {
+    enable = mkEnableOption "pinnacle";
+    package = mkPackageOption pkgs "pinnacle" {
+      default = "pinnacle";
+      example = "pkgs.pinnacle";
+      extraDescription = "package containing the pinnacle server binary";
+    };
+    xdg-portals.enable = mkEnableOption "enable xdg-portals for pinnacle";
+    withUWSM = mkEnableOption ''
+      manage the pinnacle session with [UWSM](https://github.com/Vladimir-csp/uwsm) instead
+      of independent systemd services and targets.
+    '';
+  };
+
+  config = lib.mkIf cfg.enable (
+    lib.mkMerge [
+      {
+        environment.systemPackages = [
+          cfg.package
+          pkgs.protobuf
+          cfg.package.lua-client-api
+        ];
+        environment.pathsToLink = [
+          # For /run/current-system/sw/share/pinnacle protobuf files - for
+          # pinnacle to be able to launch with a non-default config out of the
+          # box.
+          "/share/pinnacle"
+        ];
+        xdg.portal = lib.mkIf cfg.xdg-portals.enable {
+          enable = true;
+          wlr.enable = true;
+          configPackages = [ cfg.package ];
+          extraPortals = [
+            pkgs.xdg-desktop-portal-wlr
+            pkgs.xdg-desktop-portal-gtk
+            pkgs.gnome-keyring
+          ];
+        };
+      }
+      (lib.mkIf (cfg.withUWSM) {
+        programs.uwsm.enable = true;
+        # Configure UWSM to launch Pinnacle from a display manager like SDDM
+        programs.uwsm.waylandCompositors = {
+          pinnacle = {
+            prettyName = "Pinnacle";
+            comment = "Pinnacle compositor managed by UWSM";
+            binPath = "/run/current-system/sw/bin/pinnacle";
+            extraArgs = [ "--session" ];
+          };
+        };
+      })
+      (lib.mkIf (!cfg.withUWSM) {
+        services.displayManager.sessionPackages = [ cfg.package ];
+      })
+    ]
+  );
+
+  meta.maintainers = with lib.maintainers; [ cassandracomar ];
+}
--- a/nixos/modules/services/matrix/dendrite.nix
+++ b/nixos/modules/services/matrix/dendrite.nix
@@ -13,6 +13,7 @@ in
 {
  options.services.dendrite = {
    enable = lib.mkEnableOption "matrix.org dendrite";
+    package = lib.mkPackageOption pkgs "dendrite" { };
    httpPort = lib.mkOption {
      type = lib.types.nullOr lib.types.port;
      default = 8008;
@@ -321,7 +322,7 @@ in
        ];
        ExecStart = lib.strings.concatStringsSep " " (
          [
-            "${pkgs.dendrite}/bin/dendrite"
+            (lib.getExe cfg.package)
            "--config /run/dendrite/dendrite.yaml"
          ]
          ++ lib.optionals (cfg.httpPort != null) [
--- a/nixos/modules/services/networking/networkd-dispatcher.nix
+++ b/nixos/modules/services/networking/networkd-dispatcher.nix
@@ -93,6 +93,10 @@ in

  config = mkIf cfg.enable {

+    warnings = mkIf (!config.networking.useNetworkd) [
+      "services.networkd-dispatcher will not execute any scripts unless networking.useNetworkd is enabled."
+    ];
+
    systemd = {
      packages = [ pkgs.networkd-dispatcher ];
      services.networkd-dispatcher = {
--- a/nixos/modules/services/networking/nordvpn.md
+++ b/nixos/modules/services/networking/nordvpn.md
@@ -0,0 +1,65 @@
+# NordVPN {#module-services-nordvpn}
+
+*Source:* {file}`modules/services/networking/nordvpn.nix`
+
+*Upstream documentation:* <https://github.com/NordSecurity/nordvpn-linux>
+
+NordVPN offers a paid virtual private network (VPN) service.
+The service operates as closed-source,
+but the Linux client uses open-source code licensed under GPLv3.
+A minimal configuration in NixOS appears as follows:
+
+```nix
+{
+  services.nordvpn.enable = true;
+  networking.firewall.enable = true;
+  networking.firewall.checkReversePath = "loose";
+}
+```
+
+When using a firewall, set `networking.firewall.checkReversePath` to `"loose"` or `false`.
+NordVPN includes a `kill-switch` feature that blocks all packets not associated with the VPN connection.
+
+Additionally, add your user to the `nordvpn` group.
+
+```nix
+{
+  users.users.yourUser = {
+    #..
+    extraGroups = [
+      #..
+      "nordvpn"
+    ];
+  };
+}
+```
+
+If you prefer to use your own user and group, you can do so using
+
+```nix
+{
+  services.nordvpn.user = "SOME-USER";
+  services.nordvpn.group = "SOME-GROUP";
+}
+```
+
+NordVPN provides several useful CLI commands, including:
+
+```bash
+nordvpn login  # Log in using an OAuth URL
+nordvpn login --token <token>  # Log in with a token obtained from your NordVPN account
+nordvpn c  # Connect to the VPN
+nordvpn c ie  # Connect to a NordVPN server in Ireland
+nordvpn d  # Disconnect from the VPN
+nordvpn set technology openvpn  # Switch to OpenVPN technology
+nordvpn c  # Reconnect after changing technology
+```
+
+Additionally, if you prefer to use the friendly GUI,
+
+```bash
+nordvpn-gui
+```
+
+**Disclaimer:** NixOS currently does not support meshnet.
+Contributions welcome!
--- a/nixos/modules/services/networking/nordvpn.nix
+++ b/nixos/modules/services/networking/nordvpn.nix
@@ -0,0 +1,171 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.nordvpn;
+  defaultUser = "nordvpn";
+  defaultGroup = "nordvpn";
+
+  nordvpn =
+    let
+      cli = cfg.package.cli.overrideAttrs (old: {
+        preBuild =
+          let
+            extraPreBuild = lib.optionalString (cfg.group != defaultGroup) ''
+              substituteInPlace internal/permissions.go \
+                --replace-fail \
+                      'string{"nordvpn"}' \
+                      'string{"${cfg.group}"}'
+
+              substituteInPlace internal/constants.go \
+                  --replace-fail \
+                      'NordvpnGroup = "nordvpn"' \
+                      'NordvpnGroup = "${cfg.group}"'
+            '';
+          in
+          extraPreBuild + (old.preBuild or "");
+
+        # postFixup wraps nordvpnd so that it can find binaries that it calls.
+        # here, instead, use systemd to update the path to those binaries.
+        postFixup = "";
+      });
+    in
+    pkgs.symlinkJoin {
+      inherit (cfg.package) pname version meta;
+      paths = [
+        cli
+        cfg.package.gui
+      ];
+    };
+in
+{
+  options.services.nordvpn = {
+    enable = lib.mkEnableOption "Enable NordVPN";
+    package = lib.mkPackageOption pkgs "nordvpn" { };
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = defaultUser;
+      description = ''
+        The User that owns the `nordvpnd` systemd process.
+        If overriding the default, a user with the same name must exist.
+      '';
+    };
+    group = lib.mkOption {
+      type = lib.types.str;
+      default = defaultGroup;
+      description = ''
+        The Group that owns the `nordvpnd` systemd process.
+        If overriding the default, a group with the same name must exist.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+
+    # create the default user if that's the one used
+    users.users = lib.mkIf (cfg.user == defaultUser) {
+      ${defaultUser} = {
+        description = "User that runs `nordvpnd`.";
+        group = cfg.group;
+        isSystemUser = true;
+      };
+    };
+
+    # create the default group if that's the one used
+    users.groups = lib.mkIf (cfg.group == defaultGroup) {
+      ${defaultGroup} = { };
+    };
+
+    # nordvpnd uses resolved to configure dns
+    services.resolved.enable = true;
+
+    # policy that allows nordvpnd to configure dns
+    security.polkit = {
+      enable = true;
+      extraConfig = ''
+        polkit.addRule(function(action, subject) {
+          if (action.id == "org.freedesktop.resolve1.set-dns-servers"
+              && subject.isInGroup("${cfg.group}")) {
+            return polkit.Result.YES;
+          }
+        });
+      '';
+    };
+
+    environment.systemPackages = [
+      nordvpn
+    ];
+
+    systemd.services.nordvpnd = {
+      after = [ "network-online.target" ];
+      description = "NordVPN daemon.";
+      path = (
+        with pkgs;
+        [
+          e2fsprogs
+          iproute2
+          libxslt
+          nftables
+          procps
+          wireguard-tools
+        ]
+        ++ [ nordvpn ]
+      );
+      serviceConfig = {
+        # nordvpnd needs CAP_NET_ADMIN to configure network interfaces
+        AmbientCapabilities = "CAP_NET_ADMIN";
+        CapabilityBoundingSet = "CAP_NET_ADMIN";
+        ExecStart = lib.getExe' nordvpn "nordvpnd";
+        Group = cfg.group;
+        KillMode = "process";
+        NonBlocking = true;
+        Requires = "nordvpnd.socket";
+        Restart = "on-failure";
+        RestartSec = 5;
+        RuntimeDirectory = "nordvpn";
+        RuntimeDirectoryMode = "0750";
+        StateDirectory = "nordvpn";
+        StateDirectoryMode = "0750";
+        User = cfg.user;
+      };
+      wantedBy = [ "default.target" ];
+      wants = [ "network-online.target" ];
+    };
+
+    systemd.sockets.nordvpnd = {
+      description = "NordVPN Daemon Socket";
+      listenStreams = [ "/run/nordvpn/nordvpnd.sock" ];
+      partOf = [ "nordvpnd.service" ];
+      socketConfig = {
+        DirectoryMode = "0750";
+        NoDelay = true;
+        SocketGroup = cfg.group;
+        SocketMode = "0770";
+        SocketUser = cfg.user;
+      };
+      wantedBy = [ "sockets.target" ];
+    };
+
+    systemd.user.services.norduserd = {
+      after = [ "network-online.target" ];
+      description = "NordUserD Service";
+      serviceConfig = {
+        ExecStart = lib.getExe' nordvpn "norduserd";
+        NonBlocking = true;
+        Restart = "on-failure";
+        RestartSec = 5;
+      };
+      wantedBy = [ "graphical-session.target" ];
+      wants = [ "network-online.target" ];
+    };
+
+  };
+
+  meta = {
+    doc = ./nordvpn.md;
+    maintainers = with lib.maintainers; [ different-error ];
+  };
+}
--- a/nixos/modules/services/networking/technitium-dns-server.nix
+++ b/nixos/modules/services/networking/technitium-dns-server.nix
@@ -65,6 +65,7 @@ in
        DynamicUser = true;

        StateDirectory = "technitium-dns-server";
+        LogsDirectory = "technitium";

        Restart = "always";
        RestartSec = 10;
@@ -102,5 +103,8 @@ in
    };
  };

-  meta.maintainers = with lib.maintainers; [ fabianrig ];
+  meta.maintainers = with lib.maintainers; [
+    fabianrig
+    awildleon
+  ];
 }
--- a/nixos/modules/system/boot/loader/limine/limine-install.py
+++ b/nixos/modules/system/boot/loader/limine/limine-install.py
@@ -347,7 +347,7 @@ def config_entry(levels: int, bootspec: BootSpec, label: str, time: str) -> str:
            os.path.basename(bootspec.toplevel) + "-secrets"
        )

-        if os.system(bootspec.initrdSecrets + " " + initrd_secrets_path_temp) != 0:
+        if subprocess.run([bootspec.initrdSecrets, initrd_secrets_path_temp]).returncode != 0:
            print(
                f'warning: failed to create initrd secrets for "{label}"',
                file=sys.stderr,
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -63,7 +63,7 @@ let
      - `config.node.pkgs.<name>` or `config.nodes.foo.nixpkgs.pkgs.<name>` to refer
        to the Nixpkgs used on the VM guest(s).
      - `hostPkgs.<name>` when invoking commands on the VM host (e.g. in Python
-        `os.system("foo")`)
+        `subprocess.run(["foo"])`)
    - Since the runTest argument is a module instead of a function, arguments
      must be passed as option definitions.
      You may declare explicit `options` for the test parameter(s), or use the
@@ -1205,6 +1205,7 @@ in
  nominatim = runTest ./nominatim.nix;
  non-default-filesystems = handleTest ./non-default-filesystems.nix { };
  non-switchable-system = runTest ./non-switchable-system.nix;
+  nordvpn = runTest ./nordvpn.nix;
  noto-fonts = runTest ./noto-fonts.nix;
  noto-fonts-cjk-qt-default-weight = runTest ./noto-fonts-cjk-qt-default-weight.nix;
  novacomd = handleTestOn [ "x86_64-linux" ] ./novacomd.nix { };
--- a/nixos/tests/blint.nix
+++ b/nixos/tests/blint.nix
@@ -14,7 +14,7 @@
    ]
    ++ teams.ngi.members;

-  nodes.machine = {
+  containers.machine = {
    environment.systemPackages = with pkgs; [
      blint
      jq
--- a/nixos/tests/bluesky-pds.nix
+++ b/nixos/tests/bluesky-pds.nix
@@ -2,7 +2,7 @@
 {
  name = "PDS";

-  nodes.machine = {
+  containers.machine = {
    services.bluesky-pds = {
      enable = true;
      settings = {
--- a/nixos/tests/boot.nix
+++ b/nixos/tests/boot.nix
@@ -203,11 +203,26 @@ in
    makeTest {
      name = "boot-uboot-extlinux";
      nodes = { };
-      testScript = ''
-        import os
+      testScript = /* py */ ''
+        import subprocess

        # Create a mutable linked image backed by the read-only SD image
-        if os.system("${pkgs.qemu}/bin/qemu-img create -f qcow2 -F raw -b ${sdImage} ${mutableImage}") != 0:
+        if (
+            subprocess.run(
+                [
+                    "${pkgs.qemu}/bin/qemu-img",
+                    "create",
+                    "-f",
+                    "qcow2",
+                    "-F",
+                    "raw",
+                    "-b",
+                    "${sdImage}",
+                    "${mutableImage}",
+                ]
+            ).returncode
+            != 0
+        ):
            raise RuntimeError("Could not create mutable linked image")

        machine = create_machine("${startCommand}")
--- a/nixos/tests/ec2-image.nix
+++ b/nixos/tests/ec2-image.nix
@@ -135,7 +135,17 @@ in
              public_key = os.path.join(key_dir, "id_ed25519.pub")

              # Generate key pair using host SSH tools
-              ret = os.system(f"${hostPkgs.openssh}/bin/ssh-keygen -t ed25519 -f {private_key} -N \"\"")
+              ret = subprocess.run(
+                  [
+                      "${hostPkgs.openssh}/bin/ssh-keygen",
+                      "-t",
+                      "ed25519",
+                      "-f",
+                      private_key,
+                      "-N",
+                      ""
+                  ]
+              ).returncode
              if ret != 0:
                  raise Exception("Failed to generate SSH key pair")

--- a/nixos/tests/ghostunnel-modular.nix
+++ b/nixos/tests/ghostunnel-modular.nix
@@ -54,13 +54,13 @@
  };

  testScript = ''
-    import os
+    import subprocess

    # prepare certificates

    def cmd(command):
      print(f"+{command}")
-      r = os.system(command)
+      r = subprocess.run(command, shell=True).returncode
      if r != 0:
        raise Exception(f"Command {command} failed with exit code {r}")

--- a/nixos/tests/ghostunnel.nix
+++ b/nixos/tests/ghostunnel.nix
@@ -48,13 +48,13 @@
  };

  testScript = ''
-    import os
+    import subprocess

    # prepare certificates

    def cmd(command):
      print(f"+{command}")
-      r = os.system(command)
+      r = subprocess.run(command, shell=True).returncode
      if r != 0:
        raise Exception(f"Command {command} failed with exit code {r}")

--- a/nixos/tests/haproxy.nix
+++ b/nixos/tests/haproxy.nix
@@ -69,12 +69,12 @@
      };
  };
  testScript = ''
-    import os
+    import subprocess

    # Helpers
    def cmd(command):
      print(f"+{command}")
-      r = os.system(command)
+      r = subprocess.run(command, shell=True).returncode
      if r != 0:
        raise Exception(f"Command {command} failed with exit code {r}")

--- a/nixos/tests/matter-server.nix
+++ b/nixos/tests/matter-server.nix
@@ -1,7 +1,7 @@
 { pkgs, lib, ... }:

 let
-  chipVersion = pkgs.python311Packages.home-assistant-chip-core.version;
+  chipVersion = pkgs.python3Packages.home-assistant-chip-core.version;
 in

 {
--- a/nixos/tests/nordvpn.nix
+++ b/nixos/tests/nordvpn.nix
@@ -0,0 +1,129 @@
+{ lib, ... }:
+{
+  name = "nordvpn";
+  meta.maintainers = with lib.maintainers; [ different-error ];
+  nodes =
+    let
+      commonConfig = user: {
+        # norduserd reads DBUS_SESSION_BUS_ADDRESS which the
+        # desktopManager sets on user session creation (i.e. login)
+        services.xserver.enable = true;
+        services.desktopManager.plasma6.enable = true;
+        services.displayManager.gdm.enable = true;
+        services.displayManager.autoLogin = {
+          enable = true;
+          user = user;
+        };
+      };
+    in
+    {
+      nada = { ... }: { };
+      basic =
+        { ... }:
+        lib.recursiveUpdate {
+          users.users.alice = {
+            extraGroups = [ "nordvpn" ];
+            isNormalUser = true;
+          };
+          # default: run nordvpnd as nordvpn:nordvpn
+          services.nordvpn.enable = true;
+        } (commonConfig "alice");
+      userOnly =
+        { ... }:
+        lib.recursiveUpdate {
+          users.users.kanye = {
+            extraGroups = [ "nordvpn" ];
+            isNormalUser = true;
+          };
+          # run nordvpnd as kanye:nordvpn
+          services.nordvpn = {
+            enable = true;
+            user = "kanye";
+          };
+        } (commonConfig "kanye");
+      groupOnly =
+        { ... }:
+        lib.recursiveUpdate {
+          users.users.alice = {
+            extraGroups = [ "kanye" ];
+            isNormalUser = true;
+          };
+          users.groups.kanye = { };
+          # run nordvpnd as nordvpn:kanye
+          services.nordvpn = {
+            enable = true;
+            group = "kanye";
+          };
+        } (commonConfig "alice");
+      userAndGroup =
+        { ... }:
+        lib.recursiveUpdate {
+          users.users.kanye = {
+            group = "kanye";
+            isNormalUser = true;
+          };
+          users.groups.kanye = { };
+          # run nordvpnd as kanye:kanye
+          services.nordvpn = {
+            enable = true;
+            group = "kanye";
+            user = "kanye";
+          };
+        } (commonConfig "kanye");
+    };
+
+  testScript = ''
+    class UserGroupTestCase:
+      def __init__(self, machine, user, has_nordvpn_usr, has_nordvpn_gp):
+        self.machine = machine
+        self.user = user
+        self.has_nordvpn_usr = has_nordvpn_usr
+        self.has_nordvpn_gp = has_nordvpn_gp
+
+      def run(self):
+        self.machine.start()
+        self.verify_nordvpn_user()
+        self.verify_nordvpn_group()
+        self.verify_services()
+        self.machine.shutdown()
+
+      def verify_nordvpn_user(self):
+          if self.has_nordvpn_usr:
+            self.machine.succeed("id nordvpn")
+          else:
+            self.machine.fail("id nordvpn")
+
+      def verify_nordvpn_group(self):
+        group_str = self.machine.succeed(f"sudo -u {self.user} groups")
+        groups = [x.strip() for x in group_str.split(" ")]
+        if self.has_nordvpn_gp:
+          assert "nordvpn" in groups, f"nordvpn is not in {groups} but should be"
+        else:
+          assert "nordvpn" not in groups, f"nordvpn is in {groups} but should not be"
+
+      def verify_services(self):
+        self.machine.wait_for_unit("nordvpnd", timeout=60)
+        self.machine.wait_for_unit("norduserd", self.user, timeout=90)
+        # verify can talk to nordvpnd. give nordvpnd at most 5s to initialize.
+        self.machine.wait_until_succeeds("nordvpn status", timeout=5)
+        self.machine.succeed("nordvpn status")
+
+    test_cases = [
+      UserGroupTestCase(basic, "alice", has_nordvpn_usr=True,  has_nordvpn_gp=True),
+      UserGroupTestCase(userOnly, "kanye", has_nordvpn_usr=False, has_nordvpn_gp=True),
+      UserGroupTestCase(groupOnly, "alice", has_nordvpn_usr=True,  has_nordvpn_gp=False),
+      UserGroupTestCase(userAndGroup, "kanye", has_nordvpn_usr=False, has_nordvpn_gp=False),
+    ]
+
+    # NADA
+    nada.start()
+    nada.wait_for_unit("multi-user.target", timeout=60)
+    nada.fail("nordvpnd")
+    nada.fail("nordvpn")
+    nada.fail("norduserd")
+    nada.shutdown()
+
+    for test_case in test_cases:
+      test_case.run()
+  '';
+}
--- a/nixos/tests/slipshow.nix
+++ b/nixos/tests/slipshow.nix
@@ -8,7 +8,7 @@

  meta.maintainers = with lib.maintainers; [ ethancedwards8 ];

-  nodes.machine = {
+  containers.machine = {
    environment.systemPackages = with pkgs; [ slipshow ];

    environment.etc."slipshow".source = pkgs.fetchFromGitHub {
--- a/pkgs/applications/editors/jetbrains/ides/webstorm.nix
+++ b/pkgs/applications/editors/jetbrains/ides/webstorm.nix
@@ -12,20 +12,20 @@ let
  # update-script-start: urls
  urls = {
    x86_64-linux = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3.tar.gz";
-      hash = "sha256-lryIoVxoytyDyfgjnobQ3e94wIIohmIKL88fwf2I49w=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.4.tar.gz";
+      hash = "sha256-BPuMTwZ3Xkk4SBRCdgZ8vCoEYjhTa3d8CFOqrGlcGg0=";
    };
    aarch64-linux = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3-aarch64.tar.gz";
-      hash = "sha256-oZQaxpVV0O4WlDE6Ia+KzHIF0SfWQBubBFIopSRMbvE=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.4-aarch64.tar.gz";
+      hash = "sha256-f9KenMq1gtldzpBraSBwOb/186WQwh1ps5Ypj5JoOU0=";
    };
    x86_64-darwin = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3.dmg";
-      hash = "sha256-KUcQRWYUD/+4HHWnkGuqoltqL2an0WQkUEfUcttwjCI=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.4.dmg";
+      hash = "sha256-SGdo6WYMCcCBuZUjvURcMTbJUqhZ4MzFlSLg6Zjr84I=";
    };
    aarch64-darwin = {
-      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.3-aarch64.dmg";
-      hash = "sha256-1N1RtN1QLvuJ1QL8jbN5TdbOHAHSN84W9XEK2PEPijI=";
+      url = "https://download.jetbrains.com/webstorm/WebStorm-2026.1.4-aarch64.dmg";
+      hash = "sha256-ZYen6Ew0GYbBAmuGCDACPBsygxZ6sT787o6gqF9DJzw=";
    };
  };
  # update-script-end: urls
@@ -39,8 +39,8 @@ mkJetBrainsProduct {
  product = "WebStorm";

  # update-script-start: version
-  version = "2026.1.3";
-  buildNumber = "261.25134.101";
+  version = "2026.1.4";
+  buildNumber = "261.26222.58";
  # update-script-end: version

  src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));
--- a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
@@ -21,26 +21,26 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
      sources = {
        "x86_64-linux" = {
          arch = "linux-x64";
-          hash = "sha256-OY34TyyPj0Vjc6rLdR7uaVYsgmCXQFTS/1+QLA9pGgk=";
+          hash = "sha256-QxZa6ugaMC7otLQmDZU54Fv3OGMNYO5iyjqjCLDNdbI=";
        };
        "aarch64-linux" = {
          arch = "linux-arm64";
-          hash = "sha256-A8CrNx6GfFmaFWe1Awck/2B0VuJhNX6HHI5YNSG1qVo=";
+          hash = "sha256-lgE5dld8lvt/dyGVNjR1ZiV2qtBu9pMZayNe5dBfHo0=";
        };
        "x86_64-darwin" = {
          arch = "darwin-x64";
-          hash = "sha256-egXg308OJWvMyMqLHiANNEIGCSza/yKPFIqWq1X6JdE=";
+          hash = "sha256-AnqO7aZ3uybYnAHYCi5ppZ/5xOuiTqs+75TflN7bVow=";
        };
        "aarch64-darwin" = {
          arch = "darwin-arm64";
-          hash = "sha256-BmI7NTlKUVMnTBS8nf2jqYYSA+LT3qP9Yu5gQIv7Mxo=";
+          hash = "sha256-KKuUXjfIsngnKrSLTMYNzb6XVZkJszUwIihCGHQJ0gU=";
        };
      };
    in
    {
      name = "claude-code";
      publisher = "anthropic";
-      version = "2.1.206";
+      version = "2.1.207";
    }
    // sources.${stdenvNoCC.hostPlatform.system}
      or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -1007,8 +1007,8 @@ let
        mktplcRef = {
          name = "coder-remote";
          publisher = "coder";
-          version = "1.15.0";
-          hash = "sha256-Nw1aXRIJI6kBJl3yp2hripZLf+wIecb8gmIjT5zVBjk=";
+          version = "1.15.2";
+          hash = "sha256-mBACvGUQF3LoaFJ9MIewN9zu4jDTWfUgyd1MQvZQUvk=";
        };
        meta = {
          description = "Extension for Visual Studio Code to open any Coder workspace in VS Code with a single click";
@@ -1346,8 +1346,8 @@ let
        mktplcRef = {
          publisher = "discloud";
          name = "discloud";
-          version = "2.29.7";
-          hash = "sha256-l0CTWC16Aw2u8uob5tKauYIT3KaDsptV/L8WR54eN64=";
+          version = "2.29.8";
+          hash = "sha256-dvyIdixtmg5ZTo/REB/E5QlHJu2xZ+Ui5qwJegoHTfk=";
        };
        meta = {
          changelog = "https://marketplace.visualstudio.com/items/discloud.discloud/changelog";
--- a/pkgs/applications/editors/vscode/extensions/detachhead.basedpyright/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/detachhead.basedpyright/default.nix
@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
  mktplcRef = {
    name = "basedpyright";
    publisher = "detachhead";
-    version = "1.39.8";
-    hash = "sha256-MiCa1OuLvXYC5HmXNzM7LCL72weG40tDTgLWWl9Kxug=";
+    version = "1.39.9";
+    hash = "sha256-Iycuj7EXzRwVgvpk0KXa3dNw2rL21DnG4ohqIExS6Go=";
  };
  meta = {
    changelog = "https://github.com/detachhead/basedpyright/releases";
--- a/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix
+++ b/pkgs/applications/emulators/libretro/cores/dosbox-pure.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "dosbox-pure";
-  version = "0-unstable-2026-06-26";
+  version = "0-unstable-2026-07-06";

  src = fetchFromGitHub {
    owner = "schellingb";
    repo = "dosbox-pure";
-    rev = "424f2dfd6d08c587020857421b89a5d9acda4beb";
-    hash = "sha256-QkHgLWW+gk106wNeF5bKYsA4e6IKPiXakWb92AImRQc=";
+    rev = "d137f0cacff196fb44a2783ecbc6e8ddb3e57cfc";
+    hash = "sha256-4KPYwvtVLrzZcn3LYqSWmP+qWFjtNsCjrVY/L93/ZOE=";
  };

  hardeningDisable = [ "format" ];
--- a/pkgs/applications/emulators/libretro/cores/gambatte.nix
+++ b/pkgs/applications/emulators/libretro/cores/gambatte.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "gambatte";
-  version = "0-unstable-2026-06-19";
+  version = "0-unstable-2026-07-03";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "gambatte-libretro";
-    rev = "4832d33cc3427ee0a1c1b9065339dd18ff57370d";
-    hash = "sha256-qn3zYecSmQjQV1f0Aw6+zVEQttMSHsrNQuMFbsDyKC8=";
+    rev = "dfc165599f3f1068c40a0b7ad6fe5f161283d483";
+    hash = "sha256-a7GXw0B/ekIcNl08s1DpuRQZyxm4tYGWzNVVBTjXeOk=";
  };

  meta = {
--- a/pkgs/applications/emulators/libretro/cores/play.nix
+++ b/pkgs/applications/emulators/libretro/cores/play.nix
@@ -14,13 +14,13 @@
 }:
 mkLibretroCore {
  core = "play";
-  version = "0-unstable-2026-06-22";
+  version = "0-unstable-2026-07-11";

  src = fetchFromGitHub {
    owner = "jpd002";
    repo = "Play-";
-    rev = "1e4f393f3c52581cdec7867ddadc47f6b4d20cec";
-    hash = "sha256-a02AsJg7mm/fUBN/5IC2Q6NexLYsBYp74bfqfJosaxc=";
+    rev = "50aedca2639521bc498ace0b2be1ea012801a86a";
+    hash = "sha256-ywqwy8HwxigRG/2GfvfpewNjTIeunXH9NtyAH5iUfa8=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -54,13 +54,13 @@
    "vendorHash": "sha256-sESuNlWNyjjGYb7z+tQF7RGBgicnPISuwXRzB+QJ7E4="
  },
  "aminueza_minio": {
-    "hash": "sha256-DfpZjIkjo5bEZ2BtHJoBLtjEDAD6ZiqpoCOMbmd1Jvo=",
+    "hash": "sha256-4b5K2Hyy26euJct1/0dxC39DMM41W6+jdJS68/d4yCw=",
    "homepage": "https://registry.terraform.io/providers/aminueza/minio",
    "owner": "aminueza",
    "repo": "terraform-provider-minio",
-    "rev": "v3.38.1",
+    "rev": "v3.38.3",
    "spdx": "AGPL-3.0",
-    "vendorHash": "sha256-OLabFXYTe+Yhlf0Ja63tCcrc5mvPeXfN7yLoRZCkdvg="
+    "vendorHash": "sha256-se32x/vxIRiAewIIUZb/wR9eB6sDpDzN3n7OS5m8t5g="
  },
  "argoproj-labs_argocd": {
    "hash": "sha256-c6+WY4oXL8evvPk/RzVrwtgq4XLB/LzAH5tpjErbE60=",
@@ -283,13 +283,13 @@
    "vendorHash": "sha256-3o6YRDrq4rQhNAFyqiGJrAoxuAykWw85OExRGSE3kGI="
  },
  "datadog_datadog": {
-    "hash": "sha256-pTtEKgxh17Oi41oqgBrtUCsriRMfRew30kLjbOdM9jo=",
+    "hash": "sha256-PmzUO8mCYQRYWI0MxFqVua+laKybLAFgeW9+9HZ/7A8=",
    "homepage": "https://registry.terraform.io/providers/DataDog/datadog",
    "owner": "DataDog",
    "repo": "terraform-provider-datadog",
-    "rev": "v4.13.0",
+    "rev": "v4.15.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-GRxcI8+3uarErfVhzoz+Iku3mCmY9XfriDZZX0wSI5s="
+    "vendorHash": "sha256-G3lkLzLo31XGDyTgprHd7LbbOaAGRvq9LTIth2vnH00="
  },
  "datadrivers_nexus": {
    "hash": "sha256-gwExaFhOoJFrAhH91oZEp1AFvI7kgWekp655zd4tyd8=",
@@ -508,13 +508,13 @@
    "vendorHash": "sha256-ikBqIxD5aTOcwNHCMN6EaOwSHCAP5n/SULuqQXPLpOc="
  },
  "hashicorp_aws": {
-    "hash": "sha256-710i6mRyieTzltcaC23OXZm8mtqjyOc5Fk9fmcqkXY4=",
+    "hash": "sha256-876U9ojKfnJCRKaTFhW9NvBQ6fvTpC0NYE+fhwkCwk8=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
    "owner": "hashicorp",
    "repo": "terraform-provider-aws",
-    "rev": "v6.52.0",
+    "rev": "v6.54.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-COWHnLR6aRwcGJVo6IFvqQLwAYxFpqUGQbZVvEo/b/I="
+    "vendorHash": "sha256-lxxSwaBXrl2xrZJ+OHrCBvHKmsq3D9Om7/Y0zPaYIQg="
  },
  "hashicorp_awscc": {
    "hash": "sha256-z1wns0zuanfoeIb7CDRBtt4CoRQ4+b5PNKpmDbfyHd0=",
@@ -706,11 +706,11 @@
    "vendorHash": "sha256-47xWjlzpQ/EYzjbuuMKQiu5cfYAXdYkXRl+AOEP+sA4="
  },
  "heroku_heroku": {
-    "hash": "sha256-hR4DvSneqG/5P4tYljcuFxQ34AnDIjIt+JMn1BhloeU=",
+    "hash": "sha256-AmHgAlz4J3l9OCjUMVxLMWtKZB1LpNOyX1exUI6fWHA=",
    "homepage": "https://registry.terraform.io/providers/heroku/heroku",
    "owner": "heroku",
    "repo": "terraform-provider-heroku",
-    "rev": "v5.3.2",
+    "rev": "v5.4.0",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@@ -760,13 +760,13 @@
    "vendorHash": null
  },
  "integrations_github": {
-    "hash": "sha256-OpuKe7/Ymr46J41zgYdk1Qet+trEGTafl6TM23PV1lA=",
+    "hash": "sha256-2y25AE4iLckdvvFv+vPRdl2wLCPlUnK2Xc73m0qVyxc=",
    "homepage": "https://registry.terraform.io/providers/integrations/github",
    "owner": "integrations",
    "repo": "terraform-provider-github",
-    "rev": "v6.12.1",
+    "rev": "v6.13.0",
    "spdx": "MIT",
-    "vendorHash": "sha256-qzyV/rgQ79XvoTBRjjIsPFfqAXLROiIAlY7Y/d8SYcM="
+    "vendorHash": "sha256-crDSVC0UvJ8fXoKwSgyFWHivwOA9XRO7dXoEOYLPZTo="
  },
  "jfrog_artifactory": {
    "hash": "sha256-BSUOmqHwnDEYojtwTXBWo9oGG2FbgaODUKClZPCaK/I=",
@@ -1319,11 +1319,11 @@
    "vendorHash": "sha256-7ZoJg1HEVj5Nygr46lmBZeJDfZuU4F90yntrgkBVgGg="
  },
  "tencentcloudstack_tencentcloud": {
-    "hash": "sha256-tADmls3GAmR3S5wdasoHrBYOtZTVXDS2alZD6Mzfo4M=",
+    "hash": "sha256-1UBML3E5ZnOcsdGZlZ5qkaqQsE1+Q9Uw9R8FeWJXFSw=",
    "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
    "owner": "tencentcloudstack",
    "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.83.7",
+    "rev": "v1.83.10",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
@@ -1427,13 +1427,13 @@
    "vendorHash": null
  },
  "vancluever_acme": {
-    "hash": "sha256-AlT7Qe4YGdPUhM1N4OiMyjbmupgqXcQ/6SLz/v+W8lI=",
+    "hash": "sha256-CziwRMh53FPGhXw/TFWJUuI3KtMlwobCVNOgfRyjRLA=",
    "homepage": "https://registry.terraform.io/providers/vancluever/acme",
    "owner": "vancluever",
    "repo": "terraform-provider-acme",
-    "rev": "v2.48.1",
+    "rev": "v2.48.3",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-lWBMihP6oX7qPpTuPQQwQS3IDwdyb/rEYqtBsTozb7Q="
+    "vendorHash": "sha256-I6u4huFtk7dXmSyPRX4NxvcUJ4Q2iKuw8qzCdNzYjoQ="
  },
  "venafi_venafi": {
    "hash": "sha256-tCjeApdanKPNEy7snb6QJoCvwjpNa2fdDryoD+7wn8Y=",
--- a/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix
+++ b/pkgs/applications/networking/instant-messengers/telegram/telegram-desktop/unwrapped.nix
@@ -34,6 +34,7 @@
  libjxl,
  libicns,
  apple-sdk_15,
+  llvmPackages,
  nix-update-script,
 }:

@@ -67,6 +68,11 @@ stdenv.mkDerivation (finalAttrs: {
    # to build bundled libdispatch
    clang
    gobject-introspection
+  ]
+  # Work around ld64's libc++ hardening issue causing Trace/BPT trap: 5
+  # TODO: Remove once nixpkgs#536365 reaches this branch.
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    llvmPackages.lld
  ];

  buildInputs = [
@@ -102,6 +108,12 @@ stdenv.mkDerivation (finalAttrs: {

  dontWrapQtApps = true;

+  # Work around ld64's libc++ hardening issue causing Trace/BPT trap: 5
+  # TODO: Remove once nixpkgs#536365 reaches this branch.
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    NIX_CFLAGS_LINK = "-fuse-ld=lld";
+  };
+
  cmakeFlags = [
    # We're allowed to used the API ID of the Snap package:
    (lib.cmakeFeature "TDESKTOP_API_ID" "611335")
--- a/pkgs/applications/science/logic/coq/default.nix
+++ b/pkgs/applications/science/logic/coq/default.nix
@@ -79,7 +79,7 @@ let
  };
  releaseRev = v: "V${v}";
  fetched =
-    import ../../../../build-support/coq/meta-fetch/default.nix
+    import ../../../../build-support/rocq/meta-fetch/default.nix
      {
        inherit
          lib
--- a/pkgs/applications/science/logic/rocq-core/default.nix
+++ b/pkgs/applications/science/logic/rocq-core/default.nix
@@ -32,7 +32,7 @@ let
  };
  releaseRev = v: "V${v}";
  fetched =
-    import ../../../../build-support/coq/meta-fetch/default.nix
+    import ../../../../build-support/rocq/meta-fetch/default.nix
      {
        inherit
          lib
--- a/pkgs/build-support/coq/default.nix
+++ b/pkgs/build-support/coq/default.nix
@@ -1,246 +0,0 @@
-{
-  lib,
-  stdenv,
-  coqPackages,
-  coq,
-  which,
-  fetchzip,
-  fetchurl,
-  dune,
-}@args:
-
-let
-  lib = import ./extra-lib.nix {
-    inherit (args) lib;
-  };
-
-  inherit (lib)
-    concatStringsSep
-    flip
-    foldl
-    isFunction
-    isString
-    optional
-    optionalAttrs
-    optionals
-    optionalString
-    pred
-    remove
-    switch
-    versions
-    ;
-
-  inherit (lib.attrsets) removeAttrs;
-  inherit (lib.strings) match;
-
-  isGitHubDomain = d: match "^github.*" d != null;
-  isGitLabDomain = d: match "^gitlab.*" d != null;
-in
-
-{
-  pname,
-  version ? null,
-  fetcher ? null,
-  owner ? "rocq-community",
-  domain ? "github.com",
-  repo ? pname,
-  defaultVersion ? null,
-  releaseRev ? (v: v),
-  displayVersion ? { },
-  release ? { },
-  buildInputs ? [ ],
-  nativeBuildInputs ? [ ],
-  extraBuildInputs ? [ ],
-  extraNativeBuildInputs ? [ ],
-  overrideBuildInputs ? [ ],
-  overrideNativeBuildInputs ? [ ],
-  namePrefix ? [ "coq" ],
-  enableParallelBuilding ? true,
-  extraInstallFlags ? [ ],
-  setCOQBIN ? true,
-  mlPlugin ? false,
-  useMelquiondRemake ? null,
-  dropAttrs ? [ ],
-  keepAttrs ? [ ],
-  dropDerivationAttrs ? [ ],
-  useDuneifVersion ? (x: false),
-  useDune ? false,
-  opam-name ? (concatStringsSep "-" (namePrefix ++ [ pname ])),
-  ...
-}@args:
-let
-  args-to-remove = foldl (flip remove) (
-    [
-      "version"
-      "fetcher"
-      "repo"
-      "owner"
-      "domain"
-      "releaseRev"
-      "displayVersion"
-      "defaultVersion"
-      "useMelquiondRemake"
-      "release"
-      "buildInputs"
-      "nativeBuildInputs"
-      "extraBuildInputs"
-      "extraNativeBuildInputs"
-      "overrideBuildInputs"
-      "overrideNativeBuildInputs"
-      "namePrefix"
-      "meta"
-      "useDuneifVersion"
-      "useDune"
-      "opam-name"
-      "extraInstallFlags"
-      "setCOQBIN"
-      "mlPlugin"
-      "dropAttrs"
-      "dropDerivationAttrs"
-      "keepAttrs"
-      "env"
-    ]
-    ++ dropAttrs
-  ) keepAttrs;
-  fetch =
-    import ../coq/meta-fetch/default.nix
-      {
-        inherit
-          lib
-          stdenv
-          fetchzip
-          fetchurl
-          ;
-      }
-      (
-        {
-          inherit release releaseRev;
-          location = { inherit domain owner repo; };
-        }
-        // optionalAttrs (args ? fetcher) { inherit fetcher; }
-      );
-  fetched = fetch (if version != null then version else defaultVersion);
-  display-pkg =
-    n: sep: v:
-    let
-      d = displayVersion.${n} or (if sep == "" then ".." else true);
-    in
-    n
-    + optionalString (v != "" && v != null) (
-      switch d [
-        {
-          case = true;
-          out = sep + v;
-        }
-        {
-          case = ".";
-          out = sep + versions.major v;
-        }
-        {
-          case = "..";
-          out = sep + versions.majorMinor v;
-        }
-        {
-          case = "...";
-          out = sep + versions.majorMinorPatch v;
-        }
-        {
-          case = isFunction;
-          out = optionalString (d v != "") (sep + d v);
-        }
-        {
-          case = isString;
-          out = optionalString (d != "") (sep + d);
-        }
-      ] ""
-    )
-    + optionalString (v == null) "-broken";
-  append-version = p: n: p + display-pkg n "" coqPackages.${n}.version + "-";
-  prefix-name = foldl append-version "" namePrefix;
-  useDune = args.useDune or (useDuneifVersion fetched.version);
-  coqlib-flags = [
-    "COQLIBINSTALL=$(out)/lib/coq/${coq.coq-version}/user-contrib"
-    "COQPLUGININSTALL=$(OCAMLFIND_DESTDIR)"
-  ];
-  docdir-flags = [ "COQDOCINSTALL=$(out)/share/coq/${coq.coq-version}/user-contrib" ];
-  COQUSERCONTRIB = "$out/lib/coq/${coq.coq-version}/user-contrib";
-in
-stdenv.mkDerivation (
-  removeAttrs (
-    {
-
-      name = prefix-name + (display-pkg pname "-" fetched.version);
-
-      inherit (fetched) version src;
-
-      nativeBuildInputs =
-        args.overrideNativeBuildInputs or (
-          [ which ]
-          ++ optional useDune dune
-          ++ optionals (useDune || mlPlugin) [
-            coq.ocamlPackages.ocaml
-            coq.ocamlPackages.findlib
-          ]
-          ++ (args.nativeBuildInputs or [ ])
-          ++ extraNativeBuildInputs
-        );
-      buildInputs =
-        args.overrideBuildInputs or ([ coq ] ++ (args.buildInputs or [ ]) ++ extraBuildInputs);
-      inherit enableParallelBuilding;
-
-      env =
-        optionalAttrs setCOQBIN {
-          COQBIN = "${coq}/bin/";
-        }
-        // optionalAttrs (args ? useMelquiondRemake) {
-          inherit COQUSERCONTRIB;
-        }
-        // (args.env or { });
-
-      meta =
-        (
-          {
-            platforms = coq.meta.platforms;
-          }
-          // (switch domain [
-            {
-              case = pred.union isGitHubDomain isGitLabDomain;
-              out = {
-                homepage = "https://${domain}/${owner}/${repo}";
-              };
-            }
-          ] { })
-          // optionalAttrs (fetched.broken or false) {
-            coqFilter = true;
-            broken = true;
-          }
-        )
-        // (args.meta or { });
-
-    }
-    // (optionalAttrs (!args ? installPhase && !args ? useMelquiondRemake) {
-      installFlags = coqlib-flags ++ docdir-flags ++ extraInstallFlags;
-    })
-    // (optionalAttrs useDune {
-      buildPhase = ''
-        runHook preBuild
-        dune build -p ${opam-name} ''${enableParallelBuilding:+-j $NIX_BUILD_CORES}
-        runHook postBuild
-      '';
-      installPhase = ''
-        runHook preInstall
-        dune install --prefix=$out --libdir $OCAMLFIND_DESTDIR ${opam-name}
-        mkdir $out/lib/coq/
-        mv $OCAMLFIND_DESTDIR/coq $out/lib/coq/${coq.coq-version}
-        runHook postInstall
-      '';
-    })
-    // (optionalAttrs (args ? useMelquiondRemake) {
-      preConfigurePhases = [ "autoconf" ];
-      configureFlags = [ "--libdir=${COQUSERCONTRIB}/${useMelquiondRemake.logpath or ""}" ];
-      buildPhase = "./remake -j$NIX_BUILD_CORES";
-      installPhase = "./remake install";
-    })
-    // (removeAttrs args args-to-remove)
-  ) dropDerivationAttrs
-)
--- a/pkgs/build-support/rocq/default.nix
+++ b/pkgs/build-support/rocq/default.nix
@@ -3,15 +3,16 @@
  stdenv,
  rocqPackages,
  rocq-core,
+  coq,
  which,
  fetchzip,
  fetchurl,
  dune,
-}@args:
+}@args0:

 let
  lib = import ./extra-lib.nix {
-    inherit (args) lib;
+    inherit (args0) lib;
  };

  inherit (lib)
@@ -66,6 +67,8 @@ in
  useDuneifVersion ? (x: false),
  useDune ? false,
  opam-name ? (concatStringsSep "-" (namePrefix ++ [ pname ])),
+  useCoq ? false,
+  useCoqifVersion ? (x: false),
  ...
 }@args:
 let
@@ -99,11 +102,13 @@ let
      "dropDerivationAttrs"
      "keepAttrs"
      "env"
+      "useCoq"
+      "useCoqifVersion"
    ]
    ++ dropAttrs
  ) keepAttrs;
  fetch =
-    import ../coq/meta-fetch/default.nix
+    import ../rocq/meta-fetch/default.nix
      {
        inherit
          lib
@@ -158,6 +163,8 @@ let
  append-version = p: n: p + display-pkg n "" rocqPackages.${n}.version + "-";
  prefix-name = foldl append-version "" namePrefix;
  useDune = args.useDune or (useDuneifVersion fetched.version);
+  useCoq = args.useCoq or (useCoqifVersion fetched.version);
+  rocq-core = if useCoq then coq // { rocq-version = coq.coq-version; } else args0.rocq-core;
  rocqlib-flags = [
    "COQLIBINSTALL=$(out)/lib/coq/${rocq-core.rocq-version}/user-contrib"
    "COQPLUGININSTALL=$(OCAMLFIND_DESTDIR)"
@@ -190,9 +197,10 @@ stdenv.mkDerivation (
      inherit enableParallelBuilding;

      env =
-        optionalAttrs setROCQBIN {
+        optionalAttrs (setROCQBIN && !useCoq) {
          ROCQBIN = "${rocq-core}/bin/";
        }
+        // optionalAttrs (setROCQBIN && useCoq) { COQBIN = "${rocq-core}/bin/"; }
        // optionalAttrs (args ? useMelquiondRemake) {
          inherit COQUSERCONTRIB;
        }
--- a/pkgs/build-support/rocq/meta-fetch/default.nix
+++ b/pkgs/build-support/rocq/meta-fetch/default.nix
--- a/pkgs/by-name/ac/ace-of-penguins/fix-wayland-segfault.patch
+++ b/pkgs/by-name/ac/ace-of-penguins/fix-wayland-segfault.patch
@@ -0,0 +1,16 @@
+diff --git a/lib/help.c b/lib/help.c
+--- a/lib/help.c
+++ b/lib/help.c
+@@ -177,8 +177,12 @@
+   for (i=0; i<17; i++)
+   {
+     if (!fonts[i])
+       fonts[i] = XLoadQueryFont(display, i & STYLE_TT ? "fixed" : "variable");
+    if (!fonts[i])
+      fonts[i] = XLoadQueryFont(display, "fixed");
+    if (!fonts[i])
+      return;
+     thin_space[i] = XTextWidth(fonts[i], " ", 1);
+   }
+   for (i=0; i<NTAGS; i++)
+     tags[i].taglen = strlen(tags[i].tag);
--- a/pkgs/by-name/ac/ace-of-penguins/package.nix
+++ b/pkgs/by-name/ac/ace-of-penguins/package.nix
@@ -27,6 +27,8 @@ stdenv.mkDerivation (finalAttrs: {
    ./fix-gcc-14.patch
    # error: initialization of 'void (*)(int,  int,  int)' from incompatible pointer type 'void (*)(void)' [-Wincompatible-pointer-types]
    ./fix-gcc-15.patch
+    # fixes Wayland segfault from missing X11 fonts by providing a fallback
+    ./fix-wayland-segfault.patch
  ];

  nativeBuildInputs = [
--- a/pkgs/by-name/ag/agent-safehouse/package.nix
+++ b/pkgs/by-name/ag/agent-safehouse/package.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation rec {
+  pname = "safehouse";
+  version = "0.10.1";
+
+  src = fetchFromGitHub {
+    owner = "eugene1g";
+    repo = "agent-safehouse";
+    rev = "v" + version;
+    hash = "sha256-Nm04UnyQ2mVLkIIEspDd2vbdcJxZ17MH07fW6PvokJI=";
+  };
+
+  postPatch = "patchShebangs scripts bin";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  buildPhase = ''
+    runHook preBuild
+    scripts/generate-dist.sh
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 dist/safehouse.sh $out/bin/safehouse
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Sandbox your local AI agents so they can read/write only what they need";
+    homepage = "https://github.com/eugene1g/agent-safehouse";
+    mainProgram = "safehouse";
+    license = lib.licenses.asl20;
+    platforms = lib.platforms.darwin;
+    maintainers = with lib.maintainers; [ myzel394 ];
+  };
+}
--- a/pkgs/by-name/al/algia/package.nix
+++ b/pkgs/by-name/al/algia/package.nix
@@ -7,13 +7,13 @@

 buildGoModule (finalAttrs: {
  pname = "algia";
-  version = "0.0.130";
+  version = "0.0.131";

  src = fetchFromGitHub {
    owner = "mattn";
    repo = "algia";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-QuusIoZfNhETaVJJ8sUy3Zo3VnRUp7cfudDP562ZNLU=";
+    hash = "sha256-ywpaMeJ7vyf4uwoUHyZf7kK3/em7vj86AvfdC2T/UwQ=";
  };

  vendorHash = "sha256-mim8EImPFHF2vf1vCi9jgECbVAOB32oXxsPMgUwYDBA=";
--- a/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
+++ b/pkgs/by-name/an/ananicy-rules-cachyos/package.nix
@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation {
  pname = "ananicy-rules-cachyos";
-  version = "0-unstable-2026-06-24";
+  version = "0-unstable-2026-07-11";

  src = fetchFromGitHub {
    owner = "CachyOS";
    repo = "ananicy-rules";
-    rev = "c273ac846fade148468bce83d0221ed80d238c57";
-    hash = "sha256-upHgVyGnR6BIgXRzA3FCoryBukqx/CFp/39jKsc7BFo=";
+    rev = "c59d59711268395b324fa5d4af149f2f94f17b4f";
+    hash = "sha256-+hDuzZtsKkoP5mD0VmzO/mXNjP0RPLz+hzK2XFUBvpc=";
  };

  dontConfigure = true;
--- a/pkgs/by-name/an/ani-skip/package.nix
+++ b/pkgs/by-name/an/ani-skip/package.nix
@@ -10,13 +10,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "ani-skip";
-  version = "1.0.1";
+  version = "1.2.1";

  src = fetchFromGitHub {
    owner = "synacktraa";
    repo = "ani-skip";
    tag = finalAttrs.version;
-    hash = "sha256-VEEG3d6rwTAS7/+gBKHFKIg9zFfBu5eBOu6Z23621gM=";
+    hash = "sha256-8EXJIY/YqTe2H0JDX/feMISCnHl2zs1LnvBkEk7Sss0=";
  };

  nativeBuildInputs = [ makeWrapper ];
@@ -30,7 +30,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  installPhase = ''
    runHook preInstall

-    install -D skip.lua $out/share/mpv/scripts/skip.lua
+    install -D integrations/mpv.lua $out/share/mpv/scripts/skip.lua
    install -Dm 755 ani-skip $out/bin/ani-skip

    runHook postInstall
--- a/pkgs/by-name/an/ansi/package.nix
+++ b/pkgs/by-name/an/ansi/package.nix
@@ -6,14 +6,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ansi-escape-sequences-cli";
-  version = "0.2.2";
+  version = "0.2.3";

  src = fetchCrate {
    inherit (finalAttrs) pname version;
-    hash = "sha256-55CdEw1bVgabWRbZIRe9jytwDf70Y92nITwDRQaTXaQ=";
+    hash = "sha256-/dyvhgNUPitSUGtQSEMPGqHED1YNGSKumIY6Rj0hnH0=";
  };

-  cargoHash = "sha256-g+FP98lcC3EeQtcGO0kE+g6Z9tUgrlieTlVJYKs/ig4=";
+  cargoHash = "sha256-vAJmpILjzj9pqW2M9gIkQiKAntwvhwsHLCSbvHJ4Fug=";

  meta = {
    description = "Quickly get ANSI escape sequences";
--- a/pkgs/by-name/an/ansible-navigator/package.nix
+++ b/pkgs/by-name/an/ansible-navigator/package.nix
@@ -8,13 +8,13 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "ansible-navigator";
-  version = "26.4.0";
+  version = "26.6.0";
  pyproject = true;

  src = fetchPypi {
    inherit (finalAttrs) version;
    pname = "ansible_navigator";
-    hash = "sha256-FpDFWyNnlt28wAG6OgJjwvK+UMCEDyH4P9fQ+t5J8FQ=";
+    hash = "sha256-WyazCoFg4uPx0jLAG8u19l4dr806pQFzbYFadJwYfTM=";
  };

  build-system = with python3Packages; [
--- a/pkgs/by-name/ap/apko/package.nix
+++ b/pkgs/by-name/ap/apko/package.nix
@@ -11,13 +11,13 @@

 buildGoModule (finalAttrs: {
  pname = "apko";
-  version = "1.2.21";
+  version = "1.2.25";

  src = fetchFromGitHub {
    owner = "chainguard-dev";
    repo = "apko";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-I5t+xML6M88vfshqMwl/wdBWo0F3l7xOa0DSbyqyB1o=";
+    hash = "sha256-IRiW4sZZyzqmYGxNEmLZgbRb/z+Gfbn5bi4ci3/Rz4g=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@@ -29,7 +29,7 @@ buildGoModule (finalAttrs: {
      find "$out" -name .git -print0 | xargs -0 rm -rf
    '';
  };
-  vendorHash = "sha256-Oj1BbZA84GO+EkYyjjFf9gaMxMpMnEeU0H3OuqSLQ88=";
+  vendorHash = "sha256-nms4bDB9z4H2IbMO49bri0aQBiBfVj4kzVqwzURZ75c=";

  excludedPackages = [
    "internal/gen-jsonschema"
--- a/pkgs/by-name/ap/application-title-bar/package.nix
+++ b/pkgs/by-name/ap/application-title-bar/package.nix
@@ -8,13 +8,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "application-title-bar";
-  version = "0.9.1";
+  version = "0.10.0";

  src = fetchFromGitHub {
    owner = "antroids";
    repo = "application-title-bar";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-UsAZaYA088nJWnVkT7Awcib3G3JUNTY0mA8ao+9m4d0=";
+    hash = "sha256-Zph+TwPXyf2r3PpJqWSdR0V9fFt2b2XWVfsAzuY3bP4=";
  };

  propagatedUserEnvPkgs = with kdePackages; [ kconfig ];
--- a/pkgs/by-name/ar/arkade/package.nix
+++ b/pkgs/by-name/ar/arkade/package.nix
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "arkade";
-  version = "0.11.106";
+  version = "0.11.113";

  src = fetchFromGitHub {
    owner = "alexellis";
    repo = "arkade";
    tag = finalAttrs.version;
-    hash = "sha256-D6Vq263mo77CSTOwLLPqBbM31bb+d0I8DiuQElx1z70=";
+    hash = "sha256-8T7gYaT52L4Xnbuxvi9GayQ1qfI5U2cphSIkRGqx5Go=";
  };

  env.CGO_ENABLED = 0;
--- a/pkgs/by-name/ar/art/package.nix
+++ b/pkgs/by-name/ar/art/package.nix
@@ -39,13 +39,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "art";
-  version = "1.26.6";
+  version = "1.26.7";

  src = fetchFromGitHub {
    owner = "artraweditor";
    repo = "ART";
    tag = finalAttrs.version;
-    hash = "sha256-m5KQUY7loLKH7X2cDw5n7biH1GJTVONTbguILdjNWrI=";
+    hash = "sha256-HuXDdrfb3r8B5u4Ifvb3EfbF/b1mMbDAunOIBtEaKtk=";
  };

  # Fix the build with CMake 4.
--- a/pkgs/by-name/ba/backrest/0001-fix-rm-deprecated-import-github.com-ncruces-go-sqlit.patch
+++ b/pkgs/by-name/ba/backrest/0001-fix-rm-deprecated-import-github.com-ncruces-go-sqlit.patch
@@ -0,0 +1,52 @@
+From c2d19683ba90d7cd3919ca3ea21ae4332d3ea82b Mon Sep 17 00:00:00 2001
+From: phanirithvij <phanirithvij2000@gmail.com>
+Date: Sun, 12 Jul 2026 14:39:09 +0530
+Subject: [PATCH 1/3] fix: rm deprecated import
+ github.com/ncruces/go-sqlite3/embed
+
+Signed-off-by: phanirithvij <phanirithvij2000@gmail.com>
+---
+ internal/kvstore/sqlitekvstore.go         | 1 -
+ internal/logstore/logstore.go             | 1 -
+ internal/oplog/sqlitestore/sqlitestore.go | 1 -
+ 3 files changed, 3 deletions(-)
+
+diff --git a/internal/kvstore/sqlitekvstore.go b/internal/kvstore/sqlitekvstore.go
+index 9453228..e360a2c 100644
+--- a/internal/kvstore/sqlitekvstore.go
+++ b/internal/kvstore/sqlitekvstore.go
+@@ -8,7 +8,6 @@ import (
+ 	"strings"
+ 
+ 	_ "github.com/ncruces/go-sqlite3/driver"
+-	_ "github.com/ncruces/go-sqlite3/embed"
+ )
+ 
+ var ErrNotExist = errors.New("key does not exist")
+diff --git a/internal/logstore/logstore.go b/internal/logstore/logstore.go
+index 48e0509..dd6ac17 100644
+--- a/internal/logstore/logstore.go
+++ b/internal/logstore/logstore.go
+@@ -17,7 +17,6 @@ import (
+ 
+ 	"github.com/hashicorp/go-multierror"
+ 	_ "github.com/ncruces/go-sqlite3/driver"
+-	_ "github.com/ncruces/go-sqlite3/embed"
+ 	"go.uber.org/zap"
+ )
+ 
+diff --git a/internal/oplog/sqlitestore/sqlitestore.go b/internal/oplog/sqlitestore/sqlitestore.go
+index 41b12ac..08a53e0 100644
+--- a/internal/oplog/sqlitestore/sqlitestore.go
+++ b/internal/oplog/sqlitestore/sqlitestore.go
+@@ -27,7 +27,6 @@ import (
+ 
+ 	"github.com/gofrs/flock"
+ 	_ "github.com/ncruces/go-sqlite3/driver"
+-	_ "github.com/ncruces/go-sqlite3/embed"
+ 	"github.com/ncruces/go-sqlite3/vfs"
+ 	"github.com/ncruces/go-sqlite3/vfs/memdb"
+ 	_ "github.com/ncruces/go-sqlite3/vfs/memdb"
+-- 
+2.54.0
+
--- a/pkgs/by-name/ba/backrest/0002-fix-exit-after-printing-version.patch
+++ b/pkgs/by-name/ba/backrest/0002-fix-exit-after-printing-version.patch
@@ -0,0 +1,26 @@
+From 2d84683ee874d9f7ca506c61f810aaf4bdc06e63 Mon Sep 17 00:00:00 2001
+From: phanirithvij <phanirithvij2000@gmail.com>
+Date: Sun, 12 Jul 2026 15:12:39 +0530
+Subject: [PATCH 2/3] fix: exit after printing version
+
+Signed-off-by: phanirithvij <phanirithvij2000@gmail.com>
+---
+ cmd/backrest/backrest.go | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/cmd/backrest/backrest.go b/cmd/backrest/backrest.go
+index dd59512..9c0ca7e 100644
+--- a/cmd/backrest/backrest.go
+++ b/cmd/backrest/backrest.go
+@@ -58,7 +58,7 @@ func runApp() {
+ 	flag.Parse()
+ 	if *printVersion {
+ 		fmt.Printf("backrest version: %s, commit: %s\n", version, commit)
+-		return
+		os.Exit(0)
+ 	}
+ 	installLoggers(version, commit)
+ 
+-- 
+2.54.0
+
--- a/pkgs/by-name/ba/backrest/0003-fix-quit-tray-on-graceful-shutdown.patch
+++ b/pkgs/by-name/ba/backrest/0003-fix-quit-tray-on-graceful-shutdown.patch
@@ -0,0 +1,28 @@
+From 809a1e95a2d322ac2c00f95a274b639860d3b5bc Mon Sep 17 00:00:00 2001
+From: phanirithvij <phanirithvij2000@gmail.com>
+Date: Sun, 12 Jul 2026 16:07:29 +0530
+Subject: [PATCH 3/3] fix: quit tray on graceful shutdown
+
+---
+ cmd/backrest/tray.go | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/cmd/backrest/tray.go b/cmd/backrest/tray.go
+index 68db4f2..cca1b36 100644
+--- a/cmd/backrest/tray.go
+++ b/cmd/backrest/tray.go
+@@ -16,7 +16,10 @@ func startTray() {
+ 	status := newTrayStatus()
+ 	// Observe oplog status in-process so the icon can reflect backup state.
+ 	onOpLogReady = status.attach
+-	go runApp()
+	go func() {
+		runApp()
+		systray.Quit()
+	}()
+ 	systray.Run(func() { onReady(status) }, func() {})
+ }
+ 
+-- 
+2.54.0
+
--- a/pkgs/by-name/ba/backrest/package.nix
+++ b/pkgs/by-name/ba/backrest/package.nix
@@ -22,13 +22,13 @@ let
  pnpm = pnpm_11;

  pname = "backrest";
-  version = "1.13.0";
+  version = "1.14.1";

  src = fetchFromGitHub {
    owner = "garethgeorge";
    repo = "backrest";
    tag = "v${version}";
-    hash = "sha256-JcrHQDjoaaK6BONEcn6XKsjhGlth4SaZKqfxa3cD0gY=";
+    hash = "sha256-RxjPjvnKy8UM1OXRklJF/HSZ6FMiHWYQBsZ6owMJMF0=";
    leaveDotGit = true;
    postFetch = ''
      cd "$out"
@@ -62,7 +62,7 @@ let
      inherit pnpm;
      sourceRoot = "${finalAttrs.src.name}/webui";
      fetcherVersion = 4;
-      hash = "sha256-xPZg7kYRlqdO/EfZr+m+IVhDcyYegQ6v8ZAF2EjrKjU=";
+      hash = "sha256-y6NYFPepibiTuvPMwyc5cN3TwAc2W7RtPbCmzWDozNQ=";
    };

    postPatch = ''
@@ -99,6 +99,15 @@ buildGoModule (finalAttrs: {
  __structuredAttrs = true;
  strictDeps = true;

+  patches = [
+    # https://github.com/garethgeorge/backrest/pull/1293
+    ./0001-fix-rm-deprecated-import-github.com-ncruces-go-sqlit.patch
+    # https://github.com/garethgeorge/backrest/pull/1294
+    ./0002-fix-exit-after-printing-version.patch
+    # https://github.com/garethgeorge/backrest/pull/1295
+    ./0003-fix-quit-tray-on-graceful-shutdown.patch
+  ];
+
  postPatch = ''
    sed -i -e \
      '/func installRestic(targetPath string) error {/a\
@@ -107,7 +116,7 @@ buildGoModule (finalAttrs: {
  '';

  proxyVendor = true;
-  vendorHash = "sha256-1PecXGXdSu4FzOKVZ15lTLLPy3VlLiGvGeTUDzqe9sc=";
+  vendorHash = "sha256-yadRulgtcDPthWLeTydcMol/vwriflKvDu7zgoehZCM=";

  subPackages = [ "cmd/backrest" ];

@@ -116,6 +125,8 @@ buildGoModule (finalAttrs: {
    makeBinaryWrapper
  ];

+  tags = [ "tray" ];
+
  ldflags = [
    "-s"
    "-X main.version=${finalAttrs.version}"
@@ -164,6 +175,8 @@ buildGoModule (finalAttrs: {
  postInstall = ''
    wrapProgram $out/bin/backrest \
      --set-default BACKREST_RESTIC_COMMAND "${lib.getExe restic}"
+    makeBinaryWrapper $out/bin/backrest $out/bin/backrest-tray \
+      --add-flags "-tray"
  '';

  doInstallCheck = true;
--- a/pkgs/by-name/bi/bisq1/package.nix
+++ b/pkgs/by-name/bi/bisq1/package.nix
@@ -36,7 +36,10 @@
 }:

 let
-  version = "1.10.2";
+  # This is separated into its own file so it's easier for `update.sh`.
+  sources = import ./sources.nix;
+
+  version = sources.version;

  # JDK 21 is the toolchain required by docs/build.md. enableJavaFX is not
  # strictly required (Bisq bundles its own JavaFX jars), but mirrors the
@@ -86,17 +89,17 @@ let
  publicKey = {
    "E222AA02" = fetchurl {
      url = "https://github.com/bisq-network/bisq/releases/download/v${version}/E222AA02.asc";
-      hash = "sha256-Ue/UmS6F440/ybEEIAR+pdPEIksAt6QSMN6G5TZVWzc=";
+      hash = sources."key-E222AA02-hash";
    };

    "4A133008" = fetchurl {
      url = "https://github.com/bisq-network/bisq/releases/download/v${version}/4A133008.asc";
-      hash = "sha256-UijG3DkJNNTakVJd2wl30mDepa27n6R/Xxfl4sjt0sk=";
+      hash = sources."key-4A133008-hash";
    };

    "387C8307" = fetchurl {
      url = "https://github.com/bisq-network/bisq/releases/download/v${version}/387C8307.asc";
-      hash = "sha256-PrRYZLT0xv82dUscOBgQGKNf6zwzWUDhriAffZbNpmI=";
+      hash = sources."key-387C8307-hash";
    };
  };

@@ -133,7 +136,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://github.com/bisq-network/bisq/releases/download/v${version}/Bisq-64bit-${version}.deb";
-    hash = "sha256-e7rPUhA6KF3Tz3zlYqEfM9G0owe9hAUFDifKseRvb6A=";
+    hash = sources."deb-hash";

    # Verify the upstream Debian package's detached PGP signature prior to use.
    # This ensures that a successful build of this Nix package requires the
@@ -158,7 +161,7 @@ stdenv.mkDerivation (finalAttrs: {

  signature = fetchurl {
    url = "https://github.com/bisq-network/bisq/releases/download/v${version}/Bisq-64bit-${version}.deb.asc";
-    hash = "sha256-kBRaOXuP22DvXMkJ1XQatwvTmu/Ds8FvmUgYnRT7Vg0=";
+    hash = sources."sig-hash";
  };

  nativeBuildInputs = [
@@ -241,6 +244,8 @@ stdenv.mkDerivation (finalAttrs: {
    runHook postInstall
  '';

+  passthru.updateScript = ./update.sh;
+
  meta = {
    description = "Decentralized bitcoin exchange network (Bisq 1)";
    homepage = "https://bisq.network";
--- a/pkgs/by-name/bi/bisq1/sources.nix
+++ b/pkgs/by-name/bi/bisq1/sources.nix
@@ -0,0 +1,9 @@
+# Generated by ./update.sh - do not update manually!
+{
+  version = "1.10.3";
+  deb-hash = "sha256-kzLtadq8gfX6j9XU3PD5kNV43wLDoICPlXdJqULkAWE=";
+  sig-hash = "sha256-+51j+SBp7buukop1T4Gz0YDUga6540BVxDRoU2YE3pY=";
+  key-E222AA02-hash = "sha256-Ue/UmS6F440/ybEEIAR+pdPEIksAt6QSMN6G5TZVWzc=";
+  key-4A133008-hash = "sha256-UijG3DkJNNTakVJd2wl30mDepa27n6R/Xxfl4sjt0sk=";
+  key-387C8307-hash = "sha256-PrRYZLT0xv82dUscOBgQGKNf6zwzWUDhriAffZbNpmI=";
+}
--- a/pkgs/by-name/bi/bisq1/update.sh
+++ b/pkgs/by-name/bi/bisq1/update.sh
@@ -0,0 +1,79 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash --pure --keep GITHUB_TOKEN -p nix git curl cacert jq
+
+set -euo pipefail
+
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+# Fetch the latest release version from GitHub
+payload=$(curl -sL https://api.github.com/repos/bisq-network/bisq/releases/latest)
+version=$(jq -r .tag_name <<< "$payload" | sed 's/^v//')
+
+echo "Updating bisq1 to version $version"
+
+# URLs for the new version
+deb_url="https://github.com/bisq-network/bisq/releases/download/v${version}/Bisq-64bit-${version}.deb"
+sig_url="https://github.com/bisq-network/bisq/releases/download/v${version}/Bisq-64bit-${version}.deb.asc"
+
+# Fetch and compute hashes using nix-prefetch-url and convert to SRI format
+echo "Prefetching .deb package..."
+deb_hash_raw=$(nix-prefetch-url "$deb_url" 2>/dev/null)
+deb_hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$deb_hash_raw")
+echo "  deb hash: $deb_hash"
+
+echo "Prefetching signature..."
+sig_hash_raw=$(nix-prefetch-url "$sig_url" 2>/dev/null)
+sig_hash=$(nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$sig_hash_raw")
+echo "  signature hash: $sig_hash"
+
+# Fetch and compute hashes for public keys (these may not exist in all releases)
+get_key_hash() {
+  local key_name=$1
+  local url="https://github.com/bisq-network/bisq/releases/download/v${version}/${key_name}.asc"
+  local hash_raw
+  if hash_raw=$(nix-prefetch-url "$url" 2>/dev/null); then
+    nix --extra-experimental-features nix-command hash convert --to sri --hash-algo sha256 "$hash_raw"
+  else
+    echo ""  # Return empty if key doesn't exist
+  fi
+}
+
+echo "Prefetching public keys..."
+key_E222AA02_hash=$(get_key_hash "E222AA02")
+if [ -n "$key_E222AA02_hash" ]; then
+  echo "  E222AA02 hash: $key_E222AA02_hash"
+else
+  echo "  E222AA02: not found in this release, keeping old hash"
+  key_E222AA02_hash=$(grep 'key-E222AA02-hash' sources.nix | sed 's/.*= "\(.*\)".*/\1/')
+fi
+
+key_4A133008_hash=$(get_key_hash "4A133008")
+if [ -n "$key_4A133008_hash" ]; then
+  echo "  4A133008 hash: $key_4A133008_hash"
+else
+  echo "  4A133008: not found in this release, keeping old hash"
+  key_4A133008_hash=$(grep 'key-4A133008-hash' sources.nix | sed 's/.*= "\(.*\)".*/\1/')
+fi
+
+key_387C8307_hash=$(get_key_hash "387C8307")
+if [ -n "$key_387C8307_hash" ]; then
+  echo "  387C8307 hash: $key_387C8307_hash"
+else
+  echo "  387C8307: not found in this release, keeping old hash"
+  key_387C8307_hash=$(grep 'key-387C8307-hash' sources.nix | sed 's/.*= "\(.*\)".*/\1/')
+fi
+
+# Write sources.nix (only include keys that exist)
+cat >sources.nix <<EOF
+# Generated by ./update.sh
+{
+  version = "$version";
+  deb-hash = "$deb_hash";
+  sig-hash = "$sig_hash";
+  key-E222AA02-hash = "$key_E222AA02_hash";
+  key-4A133008-hash = "$key_4A133008_hash";
+  key-387C8307-hash = "$key_387C8307_hash";
+}
+EOF
+
+echo "Updated sources.nix with version $version"
--- a/pkgs/by-name/bl/bloaty/package.nix
+++ b/pkgs/by-name/bl/bloaty/package.nix
@@ -3,6 +3,7 @@
  stdenv,
  cmake,
  zlib,
+  zstd,
  fetchFromGitHub,
  re2,
  abseil-cpp,
@@ -18,19 +19,19 @@ let
  demumble = fetchFromGitHub {
    owner = "nico";
    repo = "demumble";
-    rev = "01098eab821b33bd31b9778aea38565cd796aa85";
-    hash = "sha256-605SsXd7TSdm3BH854ChHIZbOXcHI/n8RN+pFMz4Ex4=";
+    rev = "10e00fb708a3d24c1bb16682cac76925ffb76af5";
+    hash = "sha256-JNSSvYE5bh/9RVLQXVNmWRKAzidg4ktmqLI7pcUATDs=";
  };
 in
 stdenv.mkDerivation {
  pname = "bloaty";
-  version = "1.1-unstable-2024-09-23";
+  version = "1.1-unstable-2026-05-31";

  src = fetchFromGitHub {
    owner = "google";
    repo = "bloaty";
-    rev = "0c89acd7e8b9d91fd1e9c8c129be627b4e47f1ea";
-    hash = "sha256-txZDPytWnkjkiVkPL2SWLwCPEtVvqoI/MVRvbJ2kBGw=";
+    rev = "4a601b636e2347322d0371c8bf8ca5eaeaca4bac";
+    hash = "sha256-16Ic2x5JctSCuHJZjK96xkgJw8qyy8GqFupwWuc2U/k=";
  };

  cmakeFlags = [
@@ -43,7 +44,6 @@ stdenv.mkDerivation {
    # Build system relies on some of those source files
    rm -rf third_party/googletest third_party/abseil-cpp third_party/demumble
    ln -s ${gtest.src} third_party/googletest
-    ln -s ${abseil-cpp.src} third_party/abseil-cpp
    ln -s ${demumble} third_party/demumble
    substituteInPlace CMakeLists.txt \
      --replace "find_package(Python COMPONENTS Interpreter)" "" \
@@ -60,6 +60,7 @@ stdenv.mkDerivation {

  buildInputs = [
    zlib
+    zstd
    re2
    abseil-cpp
    protobuf
--- a/pkgs/by-name/bl/bloop/package.nix
+++ b/pkgs/by-name/bl/bloop/package.nix
@@ -11,7 +11,7 @@

 stdenv.mkDerivation rec {
  pname = "bloop";
-  version = "2.1.0";
+  version = "2.1.1";

  platform =
    if stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86_64 then
@@ -42,11 +42,11 @@ stdenv.mkDerivation rec {
    url = "https://github.com/scalacenter/bloop/releases/download/v${version}/bloop-${platform}";
    sha256 =
      if stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isx86_64 then
-        "sha256-yZEN3w2pvCmDRcvwE3KjUaJOVbUSDvVthMmlRSY2cSY="
+        "sha256-F5wRihAwf/TNBSYortTCoK9qKqTI+1N5InJ+rqLFp8A="
      else if stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64 then
-        "sha256-U1rPA1h0xVjAsuDFfaFvy7n6L+yRNKgqS9OQYvZH8MM="
+        "sha256-wQXAldzU6Typ6pZB8k3dfX7g+aaVF7jXvd0pnuk5gZU="
      else if stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64 then
-        "sha256-1MO14ChMnn/cDSEl1qiwDhzgX3pQjsSN8ksp4WkPDMk="
+        "sha256-OrONKbC2l0jjfmguDmoiyEaJWdTrKBiP0ZEa5rhizDM="
      else
        throw "unsupported platform";
  };
--- a/pkgs/by-name/bl/bluetuith/package.nix
+++ b/pkgs/by-name/bl/bluetuith/package.nix
@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "bluetuith";
-  version = "0.2.6";
+  version = "0.2.7";

  src = fetchFromGitHub {
    owner = "bluetuith-org";
    repo = "bluetuith";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-jxN4FLefv+edlpBnwDN/pBxZ7sHkv2w+R2tUeNCI6Tw=";
+    hash = "sha256-FoFmkc6/sPxssEkWHgwM+jtvwJzpDsTJ4T3dzYcxcVc=";
  };

-  vendorHash = "sha256-baSiOHiB02hfqDt95ldeKwz+tJgunXheTvREznxPUSc=";
+  vendorHash = "sha256-38yPy0dhZ99smFQK0tvQLHah+Sn6DsXvNrh8nQaR5qk=";

  subPackages = [ "." ];

--- a/pkgs/by-name/br/brewtarget/package.nix
+++ b/pkgs/by-name/br/brewtarget/package.nix
@@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "brewtarget";
-  version = "5.1.0";
+  version = "5.1.1";

  src = fetchFromGitHub {
    owner = "Brewtarget";
    repo = "brewtarget";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-CVFj/tsOOFj/LpkmMy4h9dnCBTOq9WGkXFUr/yJdcK0=";
+    hash = "sha256-1baUFgw3L+q2Ig/xvakP14mzk3Uop+NZy53YHhJLkR8=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/br/brutespray/package.nix
+++ b/pkgs/by-name/br/brutespray/package.nix
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "brutespray";
-  version = "2.6.2";
+  version = "2.6.3";

  src = fetchFromGitHub {
    owner = "x90skysn3k";
    repo = "brutespray";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ckw5U0TAF8NI3B8jyk7iPJ8T+9YEwFxoa9dJqb7kygI=";
+    hash = "sha256-Da43ngdqRsJW8Ippbu1vZ1vT0ushwg3h/3Ep5BQmoR0=";
  };

-  vendorHash = "sha256-bzyvh7Ty9kl/fZwxYGH2G60wZvp607/+KflaFiZgs60=";
+  vendorHash = "sha256-zmNhYW+r5WBgv2sEZgnvTEO/yfqfQuHX26kvIwJ7ygs=";

  nativeBuildInputs = [ makeBinaryWrapper ];

--- a/pkgs/by-name/ca/cabextract/package.nix
+++ b/pkgs/by-name/ca/cabextract/package.nix
@@ -13,6 +13,11 @@ stdenv.mkDerivation (finalAttrs: {
    sha256 = "sha256-tVRtsRVeTHGP89SyeFc2BPMN1kw8W/1GV80Im4I6OsY=";
  };

+  # Remove vendored getopt.h in favor of stdenv's to fix non-gnu builds.
+  postPatch = ''
+    rm getopt.h
+  '';
+
  # Let's assume that fnmatch works for cross-compilation, otherwise it gives an error:
  # undefined reference to `rpl_fnmatch'.
  configureFlags = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
--- a/pkgs/by-name/ca/caffeine/package.nix
+++ b/pkgs/by-name/ca/caffeine/package.nix
@@ -5,6 +5,7 @@
  apple-sdk,
  darwin,
  xcbuildHook,
+  llvmPackages,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -31,6 +32,8 @@ stdenv.mkDerivation (finalAttrs: {
  nativeBuildInputs = [
    xcbuildHook
    darwin.autoSignDarwinBinariesHook
+    # TODO: Remove once #536365 reaches this branch
+    llvmPackages.lld
  ];

  buildInputs = [
@@ -42,6 +45,9 @@ stdenv.mkDerivation (finalAttrs: {
    "-configuration Release"
  ];

+  # TODO: Remove once #536365 reaches this branch
+  env.NIX_CFLAGS_LINK = "-fuse-ld=lld";
+
  installPhase = ''
    runHook preInstall

--- a/pkgs/by-name/ca/cardpeek/package.nix
+++ b/pkgs/by-name/ca/cardpeek/package.nix
@@ -52,6 +52,13 @@ stdenv.mkDerivation {
  ]
  ++ lib.optional stdenv.hostPlatform.isLinux pcsclite;

+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    # macOS iconv implementation is slightly broken since Sonoma
+    # https://github.com/Homebrew/homebrew-core/pull/199639
+    # https://savannah.gnu.org/bugs/index.php?66541
+    am_cv_func_iconv_works = "yes";
+  };
+
  enableParallelBuilding = true;

  meta = {
--- a/pkgs/by-name/ca/cargo-release/package.nix
+++ b/pkgs/by-name/ca/cargo-release/package.nix
@@ -13,16 +13,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-release";
-  version = "1.1.2";
+  version = "1.1.3";

  src = fetchFromGitHub {
    owner = "crate-ci";
    repo = "cargo-release";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-xil5k+AyJHpDLVvSbtPJOuADRXvdLrHLlC7GRSE4z4s=";
+    hash = "sha256-5fe+iIPZAKi8aQW2PfanO7U2d70Oc3KvL/RZTV9/ZU8=";
  };

-  cargoHash = "sha256-WLDRJQvzkL1FxD0eXsJmH5wh9QkReaQBBxe7ZFQMWUM=";
+  cargoHash = "sha256-abTQuKpVcjorr6RQ1t9sAzqvS39XT6lg4fALAqO68YI=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/ca/cargo-tarpaulin/package.nix
+++ b/pkgs/by-name/ca/cargo-tarpaulin/package.nix
@@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-tarpaulin";
-  version = "0.36.0";
+  version = "0.37.0";

  src = fetchFromGitHub {
    owner = "xd009642";
    repo = "tarpaulin";
    tag = finalAttrs.version;
-    hash = "sha256-qd0PmCCUmd9Y4kUei+hZoc+rIYYZMf0s2ml9IoHtXX8=";
+    hash = "sha256-8LD4huR6xcksxkxF3Axoh5tx3FQgzE8nYVSpeSdY7us=";
  };

-  cargoHash = "sha256-EJTzITwwLEMVWdLdSE+A9D3Deh501561rxrlsqzmRKs=";
+  cargoHash = "sha256-FH0skHQ0eR9qgoCqDqO+NZZLzBw8U/ijNUupTYexIGI=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/cc/cc-switch/package.nix
+++ b/pkgs/by-name/cc/cc-switch/package.nix
@@ -25,7 +25,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cc-switch";
-  version = "3.16.3";
+  version = "3.16.5";

  __structuredAttrs = true;
  strictDeps = true;
@@ -34,7 +34,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "farion1231";
    repo = "cc-switch";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-jj7FHJtXn127hqpjCe6buxvJNCtWxRe5HZPY8NRcglM=";
+    hash = "sha256-CrUoTfGAy+gi3gdcSlNyjwM2Rm4nahqDWdM6I9OQgPc=";
  };

  pnpmDeps = fetchPnpmDeps {
@@ -57,7 +57,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  cargoRoot = "src-tauri";
  buildAndTestSubdir = finalAttrs.cargoRoot;

-  cargoHash = "sha256-PfTkrD3ts/OugZ5qM82tTfWwSOcSddgDYzQhr6wLvOg=";
+  cargoHash = "sha256-gX32xCiVKHQ0BIIB9GyWHessIW30zbTcMZLtPJycxn8=";

  nativeBuildInputs = [
    jq
--- a/pkgs/by-name/cd/cdk8s-cli/package.nix
+++ b/pkgs/by-name/cd/cdk8s-cli/package.nix
@@ -12,18 +12,18 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cdk8s-cli";
-  version = "2.207.29";
+  version = "2.207.40";

  src = fetchFromGitHub {
    owner = "cdk8s-team";
    repo = "cdk8s-cli";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-dhTKWlvmoFAUKKltdUBtT9F/QBtqHTzCnZWkBp+bi68=";
+    hash = "sha256-bSqvHUw9J9cmMqexZurVS14WFdD8budmjPGZ3Z6yOkc=";
  };

  yarnOfflineCache = fetchYarnDeps {
    inherit (finalAttrs) src;
-    hash = "sha256-36YUlea5kGE0EoMMuQrVHDK7tl1atwXm5zIKu8Agd7Y=";
+    hash = "sha256-wmT/CBAebKlaue9/TVRwoe8pavA6Fl+9D+3FbUK3+SM=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/cd/cdncheck/package.nix
+++ b/pkgs/by-name/cd/cdncheck/package.nix
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "cdncheck";
-  version = "1.2.43";
+  version = "1.2.44";

  src = fetchFromGitHub {
    owner = "projectdiscovery";
    repo = "cdncheck";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-DSM57Wkddl57EMvWK4Zfym+pbuG9HFZlYyjLC5LS3HE=";
+    hash = "sha256-8Lte+arj2nqEU8WmaX4bf/WOJV6bdMLskm0BqSyBOuE=";
  };

  vendorHash = "sha256-iJ1agL7sZ3ZKbW1wMA+qi8FgHdPa6gZLQ5BBPKJTNaQ=";
--- a/pkgs/by-name/ce/cell/package.nix
+++ b/pkgs/by-name/ce/cell/package.nix
@@ -8,17 +8,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cell";
-  version = "0.5.0";
+  version = "0.5.1";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "garritfra";
    repo = "cell";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-J13D46ttG7KlePyFZYxqjaMF7ZR5m3nTJ8/GLm4VH5o=";
+    hash = "sha256-43E2EW3SS35VyJpOE7KdDz7XcOsn3V9aVglIW1vPgIE=";
  };

-  cargoHash = "sha256-ZQXyt/hL6wamGrFvmrShoUCTSGAo8V5CuejAzO5oCuU=";
+  cargoHash = "sha256-4qWI1dKv84Ga6A2ImkI3rRypqm+UkDNzD94Gxl43wj0=";

  doInstallCheck = true;
  nativeInstallCheckInputs = [ versionCheckHook ];
--- a/pkgs/by-name/cg/cgt-calc/package.nix
+++ b/pkgs/by-name/cg/cgt-calc/package.nix
@@ -1,6 +1,7 @@
 {
  lib,
  fetchFromGitHub,
+  fetchpatch,
  python3Packages,
  withTeXLive ? true,
  texliveSmall,
@@ -17,6 +18,15 @@ python3Packages.buildPythonApplication (finalAttrs: {
    hash = "sha256-KPzADW+n82X08IMfSIl5JyYPm8fxbbowud8sBdUxRgA=";
  };

+  patches = [
+    (fetchpatch {
+      # https://github.com/KapJI/capital-gains-calculator/pull/781
+      name = "update uv-build requirement.patch";
+      url = "https://github.com/KapJI/capital-gains-calculator/commit/0222eafdcf1911f3e2fd781697dc53311f529f62.patch";
+      hash = "sha256-L8jgrdA9t3x8mdaLmAuW6vFhHCLGA+0gQ/8j9EcYKhE=";
+    })
+  ];
+
  build-system = with python3Packages; [
    uv-build
  ];
--- a/pkgs/by-name/cl/claude-agent-acp/package.nix
+++ b/pkgs/by-name/cl/claude-agent-acp/package.nix
@@ -8,16 +8,16 @@

 buildNpmPackage (finalAttrs: {
  pname = "claude-agent-acp";
-  version = "0.52.0";
+  version = "0.58.1";

  src = fetchFromGitHub {
    owner = "agentclientprotocol";
    repo = "claude-agent-acp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-w8lrc/4cW7QZNDMvq663eas7Dl4tnya4JCM9xkLF8S8=";
+    hash = "sha256-9bnUVYfE3iMOcHFg9PK25MoMla978/YbkZLzWgVkd84=";
  };

-  npmDepsHash = "sha256-czNQInLxK/DMFViJWa15PGOU61qnqm0wNwFqjTH3Z+k=";
+  npmDepsHash = "sha256-cqglQ/XW+E1U0CzhUBltKduwKdgvjH3hrPRb5MZJovM=";

  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/by-name/cl/claude-code/manifest.json
+++ b/pkgs/by-name/cl/claude-code/manifest.json
@@ -1,47 +1,68 @@
 {
-  "version": "2.1.206",
-  "commit": "edc8ebf7f852d3abffad32a5bf8e49e439f92afb",
-  "buildDate": "2026-07-09T01:48:20Z",
+  "version": "2.1.207",
+  "commit": "bc512d56332530b2be3f5079e29ec17aa20b8553",
+  "buildDate": "2026-07-10T21:39:38Z",
  "platforms": {
    "darwin-arm64": {
      "binary": "claude",
-      "checksum": "3197aba4442dbd5b3df42b6f35e6d7bd03b5e48ce18b7a3c5c6f5f8c28e03b7f",
-      "size": 240395024
+      "checksum": "1397a062c6889675055e3314dd956376ac51262a7734ad9e819c26975d71547a",
+      "size": 241237136
    },
    "darwin-x64": {
      "binary": "claude",
-      "checksum": "b1e1636917a12c7d4e1fa54cd13f7f76ba3779fb988180610b6ca483258c2f46",
-      "size": 248431568
+      "checksum": "8a4355d251a60c90d8cf08f32fdb22a8157dd3d085542f95d0da0475f9a2c57c",
+      "size": 249273680
    },
    "linux-arm64": {
      "binary": "claude",
-      "checksum": "cb8ccaf4ae6beb558747227a362010c6b32b4f4a5868c3a7e96aa9972fc6ef58",
-      "size": 255376112
+      "checksum": "8bc14a284065383460f37981d724b8f7aa7ca93c9849d2fe367e08f03383f454",
+      "size": 256228080
    },
    "linux-x64": {
      "binary": "claude",
-      "checksum": "d131494be407ff56a62f4e99a96ba60102002d01e3b6b1494db16bef4b7f060f",
-      "size": 258566968
+      "checksum": "85e7e988a392d859f90802ca21fb26e89d3c9ab527f5ed0b08df3955e34d5c83",
+      "size": 259402552
    },
    "linux-arm64-musl": {
      "binary": "claude",
-      "checksum": "b1920556c3b077694d52397f4e5221df2419ad9b44af641be0f49647b51f87ad",
-      "size": 248624312
+      "checksum": "ec3b657344dcf6693f434fe11ffe4592381d31d4e6a7976649c1a610770dcc74",
+      "size": 249476280
    },
    "linux-x64-musl": {
      "binary": "claude",
-      "checksum": "b0d780783401de979024c25f14a2cae665873afbcfe718c090b73e13c4cd08a0",
-      "size": 253251968
+      "checksum": "09a43ff41e33cbb0c4903a4939353933ee8f0d1964abab4b837004a951edb9ee",
+      "size": 254091648
    },
    "win32-x64": {
      "binary": "claude.exe",
-      "checksum": "d5072b25b9a20bffb24625d36129a05ed2be4d2eb7e35625aad6aa35596892c2",
-      "size": 248682144
+      "checksum": "781fdc2c89868b1cb05cc22c253ef142a0b44e7cc36236aecd6335745c7d42d0",
+      "size": 249485472
    },
    "win32-arm64": {
      "binary": "claude.exe",
-      "checksum": "c17ac3a5a8edf5cfa658e82bd41fcf83170af21538e51cc9d4cbaeefe382aba3",
-      "size": 243149984
+      "checksum": "fa0c887a3f944ba1915766b525538b82b029ca8078ed6ee180c3b83c1b862521",
+      "size": 243952800
    }
+  },
+  "sdkCompat": {
+    "testedWrapperVersions": [
+      "0.3.181",
+      "0.3.182",
+      "0.3.183",
+      "0.3.185",
+      "0.3.186",
+      "0.3.187",
+      "0.3.190",
+      "0.3.191",
+      "0.3.195",
+      "0.3.196",
+      "0.3.197",
+      "0.3.198",
+      "0.3.201",
+      "0.3.202",
+      "0.3.204",
+      "0.3.205"
+    ],
+    "harnessSchema": 1
  }
 }
--- a/pkgs/by-name/cl/claude-usage-tracker/package.nix
+++ b/pkgs/by-name/cl/claude-usage-tracker/package.nix
@@ -7,11 +7,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "claude-usage-tracker";
-  version = "3.1.1";
+  version = "3.2.0";

  src = fetchzip {
    url = "https://github.com/hamed-elfayome/Claude-Usage-Tracker/releases/download/v${finalAttrs.version}/Claude-Usage.zip";
-    hash = "sha256-g2mTU64iEWg7YaEQdWhAnnB1Tb1PrTDezojDw+535H0=";
+    hash = "sha256-V8fc5OuEBHf4w0fe5QX9znSLlu/xGkycVi3JzShVk+A=";
    stripRoot = false;
  };

--- a/pkgs/by-name/cl/clickhouse-backup/package.nix
+++ b/pkgs/by-name/cl/clickhouse-backup/package.nix
@@ -9,13 +9,13 @@

 buildGoModule (finalAttrs: {
  pname = "clickhouse-backup";
-  version = "2.7.3";
+  version = "2.7.4";

  src = fetchFromGitHub {
    owner = "Altinity";
    repo = "clickhouse-backup";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-tcNQoNxzlRcXcSyGWOzCmGtV34ZSzfnyi98QAIWwYF0=";
+    hash = "sha256-HlVngChgU+Do6e5gfP1fg1R/fSGfB8kjG2Ul+N7eJkE=";
  };

  vendorHash = "sha256-HN0H2YFj7k/T2ff1GCrjfE9PO6MtdR/SWKZL/FoqHZ8=";
--- a/pkgs/by-name/cl/clipaste/package.nix
+++ b/pkgs/by-name/cl/clipaste/package.nix
@@ -0,0 +1,38 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  testers,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "clipaste";
+  version = "2.4.0";
+
+  src = fetchFromGitHub {
+    owner = "hqhq1025";
+    repo = "clipaste";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-MNrhOvdyYs99Z6Wwf2X+xCNRzc6erpLpFB/GHBJRhrg=";
+  };
+
+  cargoHash = "sha256-QrUR3xHZ/1FFkBYt5qxi0mNVTvEaWBcLSjp6OnzR9GY=";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  passthru = {
+    tests.version = testers.testVersion {
+      package = finalAttrs.finalPackage;
+    };
+  };
+
+  meta = {
+    description = "Screenshot clipboard paste fix for AI agents";
+    homepage = "https://github.com/hqhq1025/clipaste";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.darwin;
+    maintainers = with lib.maintainers; [ aaronjheng ];
+    mainProgram = "clipaste";
+  };
+})
--- a/pkgs/by-name/cl/cloud-hypervisor/package.nix
+++ b/pkgs/by-name/cl/cloud-hypervisor/package.nix
@@ -6,29 +6,34 @@
  pkg-config,
  dtc,
  openssl,
+  zstd,
  versionCheckHook,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cloud-hypervisor";
-  version = "52.0";
+  version = "53.0";

  src = fetchFromGitHub {
    owner = "cloud-hypervisor";
    repo = "cloud-hypervisor";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-OGyvmedSaWPsyH6mdHhgXN7MvTnK1HzdfTKUhJRlq8I=";
+    hash = "sha256-fPTGf8bAITDA8QwllWbbGXA7tJ6p/SxRDfcBQVRvCTI=";
  };

-  cargoHash = "sha256-ZNj1H3Iq+IUSe0McHJjrwPOoR+YRB+rsSmZHMhXsHy0=";
+  cargoHash = "sha256-+RbW/9ap/69MyODUk/bHBlH6ZuqYYIyKaarYSMQ2G7w=";

  separateDebugInfo = true;

  nativeBuildInputs = [ pkg-config ];
-  buildInputs = lib.optional stdenv.hostPlatform.isAarch64 dtc;
-  checkInputs = [ openssl ];
+  buildInputs = [
+    openssl
+    zstd
+  ]
+  ++ lib.optional stdenv.hostPlatform.isAarch64 dtc;

  env.OPENSSL_NO_VENDOR = true;
+  env.ZSTD_SYS_USE_PKG_CONFIG = true;

  cargoTestFlags = [
    "--workspace"
@@ -40,10 +45,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
    "vmm" # /dev/kvm
    "--"
    # io_uring syscalls are blocked by the Lix sandbox
-    "--skip=io_uring"
-    "--skip=qcow_async::unit_tests::"
-    # fallocate(PUNCH_HOLE) reported size depends on the host filesystem
-    "--skip=test_query_device_size_sparse_file_punch_hole"
+    "--skip=formats"
+    "--skip=io_impl::async_io::uring_data_io"
  ];

  nativeInstallCheckInputs = [
--- a/pkgs/by-name/co/cockpit-zfs/package.nix
+++ b/pkgs/by-name/co/cockpit-zfs/package.nix
@@ -46,28 +46,22 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "cockpit-zfs";
-  version = "1.2.27-3";
+  version = "1.2.30";

  src = fetchFromGitHub {
    owner = "45Drives";
    repo = "cockpit-zfs";
    tag = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-7hx9FJxFN7xsozMvAb0fdRTX2hAcxtJc5wdgrs2PGJc=";
+    hash = "sha256-G24xNoKoBnlXxxyo9IJIoQW3PrktQxsx37/cX6QYfyE=";
  };

-  patches = [
-    # Remove after upstream updates to Yarn 4.14
-    # https://github.com/45Drives/cockpit-zfs/blob/main/package.json#L13
-    ./yarn-4.14-support.patch
-  ];
-
  missingHashes = ./missing-hashes.json;

  # Use buildPackages for cross-compilation support
  offlineCache = yarnBerryForBuild.fetchYarnBerryDeps {
-    inherit (finalAttrs) src missingHashes patches;
-    hash = "sha256-Tdxe5bXN9psSrnUXL1f+1nh4WPzuvOI7j0I+VPU2/1s=";
+    inherit (finalAttrs) src missingHashes;
+    hash = "sha256-nm3iHf9Rm5JFKzH0HAvglkQPFIV6Fl1e9WvNdqevTug=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/co/cockpit-zfs/yarn-4.14-support.patch
+++ b/pkgs/by-name/co/cockpit-zfs/yarn-4.14-support.patch
@@ -1,11 +0,0 @@
-diff --git a/yarn.lock b/yarn.lock
--- a/yarn.lock
-+++ b/yarn.lock
-@@ -2,6 +2,6 @@
- # Manual changes might be lost - proceed with caution!
- 
- __metadata:
-  version: 8
-+  version: 9
-   cacheKey: 10c0
- 
--- a/pkgs/by-name/co/code-cursor/package.nix
+++ b/pkgs/by-name/co/code-cursor/package.nix
@@ -24,7 +24,14 @@ let
 in
 (buildVscode rec {
  inherit commandLineArgs useVSCodeRipgrep;
-  inherit (sourcesJson) version vscodeVersion;
+  inherit (sourcesJson) version;
+  # Cursor reports vscode >= 1.122 but still ships @vscode/ripgrep.
+  # Capping the build-time vscodeVersion avoids modifying the notarized app bundle on Darwin.
+  vscodeVersion =
+    if lib.versionAtLeast sourcesJson.vscodeVersion "1.122.0" then
+      "1.121.0"
+    else
+      sourcesJson.vscodeVersion;

  pname = "cursor";

--- a/pkgs/by-name/co/code-cursor/sources.json
+++ b/pkgs/by-name/co/code-cursor/sources.json
@@ -1,22 +1,22 @@
 {
-  "version": "3.9.16",
-  "vscodeVersion": "1.105.1",
+  "version": "3.11.13",
+  "vscodeVersion": "1.125.0",
  "sources": {
    "x86_64-linux": {
-      "url": "https://downloads.cursor.com/production/042b3c1a4c53f2c3808067f519fbfc67b72cad8b/linux/x64/Cursor-3.9.16-x86_64.AppImage",
-      "hash": "sha256-dG61VYGMHPip57ldzNICEi1yPc4s1dON+MlDGiKadKc="
+      "url": "https://downloads.cursor.com/production/3f21b08f0b436a07be29fbfe00b304fa15553353/linux/x64/Cursor-3.11.13-x86_64.AppImage",
+      "hash": "sha256-MXBXgGe7HXiL3kAMKxBSRTZxWMbh15D5dfXw6iemG9g="
    },
    "aarch64-linux": {
-      "url": "https://downloads.cursor.com/production/042b3c1a4c53f2c3808067f519fbfc67b72cad8b/linux/arm64/Cursor-3.9.16-aarch64.AppImage",
-      "hash": "sha256-7tkupyy8EFeOpzQqoHQsYxWQlFoW6VBpXkuCJsRIhRw="
+      "url": "https://downloads.cursor.com/production/3f21b08f0b436a07be29fbfe00b304fa15553353/linux/arm64/Cursor-3.11.13-aarch64.AppImage",
+      "hash": "sha256-UCjZFxXjzeovYrZWp6xrZGp+eH4uGo41Tl9Uj9q16W4="
    },
    "x86_64-darwin": {
-      "url": "https://downloads.cursor.com/production/042b3c1a4c53f2c3808067f519fbfc67b72cad8b/darwin/x64/Cursor-darwin-x64.dmg",
-      "hash": "sha256-5sAj/FiPAs1facGmNKgXiNzs1Kc1ht9eXYU1aZ1VoUA="
+      "url": "https://downloads.cursor.com/production/3f21b08f0b436a07be29fbfe00b304fa15553353/darwin/x64/Cursor-darwin-x64.dmg",
+      "hash": "sha256-FbSBuRaWKjTD7vdg0GvFsizmbpNvnNyzB6yAljMAtSs="
    },
    "aarch64-darwin": {
-      "url": "https://downloads.cursor.com/production/042b3c1a4c53f2c3808067f519fbfc67b72cad8b/darwin/arm64/Cursor-darwin-arm64.dmg",
-      "hash": "sha256-pnSsOvyFiBKJsPUPkfnSY1l+LEzz3g5kbepIco7dDIM="
+      "url": "https://downloads.cursor.com/production/3f21b08f0b436a07be29fbfe00b304fa15553353/darwin/arm64/Cursor-darwin-arm64.dmg",
+      "hash": "sha256-j1k40mFZDWnNTl/IwCB39JZ+Zc4/JwEthNh8SPCXAZE="
    }
  }
 }
--- a/pkgs/by-name/co/codechecker/package.nix
+++ b/pkgs/by-name/co/codechecker/package.nix
@@ -1,65 +1,30 @@
 {
  lib,
-  python3,
  fetchPypi,
-  fetchFromGitHub,
-  clang,
+  makeWrapper,
+  python3Packages,
+  libclang,
  clang-tools,
  cppcheck,
  gcc,
-  makeWrapper,
+  infer,
  withClang ? false,
  withClangTools ? false,
  withCppcheck ? false,
  withGcc ? false,
+  withInfer ? false,
 }:
-let
-  python = python3.override {
-    packageOverrides = self: super: rec {
-      # codechecker is incompatible with SQLAlchemy greater than 1.3
-      sqlalchemy = super.sqlalchemy_1_4.overridePythonAttrs (oldAttrs: rec {
-        version = "1.3.23";
-        pname = oldAttrs.pname;
-        src = fetchFromGitHub {
-          owner = "sqlalchemy";
-          repo = "sqlalchemy";
-          rev = "rel_${lib.replaceStrings [ "." ] [ "_" ] version}";
-          hash = "sha256-hWA0/f7rQpEfYTg10i0rBK3qeJbw3p6HW7S59rLnD0Q=";
-        };
-        doCheck = false;
-        # That test does not exist in the 1.3 branch so we get an error for disabling it
-        disabledTestPaths = builtins.filter (
-          testPath: testPath != "test/ext/mypy"
-        ) oldAttrs.disabledTestPaths;
-      });
-      sqlalchemy_1_4 = sqlalchemy;
-
-      # The current alembic version is not compatible with SQLAlchemy 1.3 so we need to downgrade it
-      alembic = super.alembic.overridePythonAttrs (oldAttrs: rec {
-        pname = "alembic";
-        version = "1.5.5";
-        src = fetchPypi {
-          inherit pname version;
-          hash = "sha256-3wAowZJ1os/xN+OWF6Oc3NvRFzczuHtr+iV7fAhgITs=";
-        };
-        doCheck = false;
-        dependencies = oldAttrs.dependencies ++ [
-          super.python-dateutil
-          super.python-editor
-        ];
-      });
-    };
-  };
-  python3Packages = python.pkgs;
-in
 python3Packages.buildPythonApplication rec {
  pname = "codechecker";
-  version = "6.24.0";
+  version = "6.28.0";
  pyproject = true;

+  strictDeps = true;
+  __structuredAttrs = true;
+
  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-ftZACUf2lAHokcUXj45LRA7/3goOcIy521cGl6qhR98=";
+    hash = "sha256-wxV+/hzsk7RrzWTXNz5HyweYdFFI1upNS508QRPCefo=";
  };

  build-system = with python3Packages; [
@@ -67,40 +32,39 @@ python3Packages.buildPythonApplication rec {
  ];

  dependencies = with python3Packages; [
+    alembic
+    argcomplete
+    authlib
    distutils # required in python312 to call subcommands (see https://github.com/Ericsson/codechecker/issues/4350)
    lxml
-    sqlalchemy
-    alembic
+    multiprocess
    portalocker
    psutil
-    multiprocess
+    semver
+    sqlalchemy
    thrift
    gitpython
    pyyaml
+    requests
    types-pyyaml
    sarif-tools
+    types-psutil
  ];

-  pythonRelaxDeps = [
-    "thrift"
-    "portalocker"
-    "types-pyyaml"
-    "lxml"
-    "psutil"
-    "multiprocess"
-    "gitpython"
-    "sarif-tools"
-    "pyyaml"
+  pythonRelaxDeps = true;
+  nativeBuildInputs = with python3Packages; [
+    makeWrapper
+    pythonRelaxDepsHook
  ];

  postInstall = ''
    wrapProgram "$out/bin/CodeChecker" --prefix PATH : ${
      lib.makeBinPath (
-        [ ]
-        ++ lib.optional withClang clang
+        lib.optional withClang libclang
        ++ lib.optional withClangTools clang-tools
        ++ lib.optional withCppcheck cppcheck
        ++ lib.optional withGcc gcc
+        ++ lib.optional withInfer infer
      )
    }
  '';
@@ -116,6 +80,7 @@ python3Packages.buildPythonApplication rec {
    maintainers = with lib.maintainers; [
      zebreus
      felixsinger
+      kacper-uminski
    ];
    mainProgram = "CodeChecker";
    platforms = lib.platforms.darwin ++ lib.platforms.linux;
--- a/pkgs/by-name/co/comrak/package.nix
+++ b/pkgs/by-name/co/comrak/package.nix
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "comrak";
-  version = "0.53.0";
+  version = "0.54.0";

  src = fetchFromGitHub {
    owner = "kivikakk";
    repo = "comrak";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-neiDYC1wvCCYKlSX5R1PupZiH5vP3W5bWw17+8wv6uM=";
+    sha256 = "sha256-nLyGIN5AsWJsi+RPsQqPb2DLeSVF30ZrJAcDTsBV1V8=";
  };

-  cargoHash = "sha256-ErZ0yD9G0i0EEafrFGP2MQoVQR/plIkJjBrfbNTeEy8=";
+  cargoHash = "sha256-CXdjr6ScUN1JehyFDlk1Fji93X5tCF5/fs4obRTBzOU=";

  meta = {
    description = "CommonMark-compatible GitHub Flavored Markdown parser and formatter";
--- a/pkgs/by-name/co/container/package.nix
+++ b/pkgs/by-name/co/container/package.nix
@@ -5,23 +5,25 @@
  libarchive,
  xar,
  installShellFiles,
+  makeWrapper,
  versionCheckHook,
  nix-update-script,
 }:

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "container";
-  version = "0.12.3";
+  version = "1.1.0";

  src = fetchurl {
    url = "https://github.com/apple/container/releases/download/${finalAttrs.version}/container-${finalAttrs.version}-installer-signed.pkg";
-    hash = "sha256-g/NjEmrB8GRYjeOc1rR0NA1InBkmSSosTlnE1Uqm2OM=";
+    hash = "sha256-DKHEKiJpwlV++x2CsbOKxVPmo6PaGxF5xDm87h59ZxQ=";
  };

  nativeBuildInputs = [
    libarchive
    xar
    installShellFiles
+    makeWrapper
  ];

  dontUnpack = true;
@@ -43,6 +45,13 @@ stdenvNoCC.mkDerivation (finalAttrs: {
      --zsh <($out/bin/${finalAttrs.meta.mainProgram} --generate-completion-script zsh)
  '';

+  postFixup = ''
+    wrapProgram $out/bin/container \
+      --set-default CONTAINER_INSTALL_ROOT "$out"
+    wrapProgram $out/bin/container-apiserver \
+      --set-default CONTAINER_INSTALL_ROOT "$out"
+  '';
+
  nativeInstallCheckInputs = [
    versionCheckHook
  ];
@@ -60,6 +69,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    mainProgram = "container";
    maintainers = with lib.maintainers; [
      xiaoxiangmoe
+      Br1ght0ne
    ];
    platforms = [ "aarch64-darwin" ];
    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
--- a/pkgs/by-name/co/context7-mcp/package.nix
+++ b/pkgs/by-name/co/context7-mcp/package.nix
@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "context7-mcp";
-  version = "3.2.2";
+  version = "3.2.3";

  src = fetchFromGitHub {
    owner = "upstash";
    repo = "context7";
    tag = "${tag-prefix}@${finalAttrs.version}";
-    hash = "sha256-v3zKMnZsc0gWVAdgZwFTskWcFVlOU6sG2i+qDwjx+dw=";
+    hash = "sha256-yyz4UraRm1JR/C7J2ib0nBU6zsNpKCWIWduTu7OlebM=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/co/copacetic/package.nix
+++ b/pkgs/by-name/co/copacetic/package.nix
@@ -12,13 +12,13 @@

 buildGoModule (finalAttrs: {
  pname = "copacetic";
-  version = "0.14.1";
+  version = "0.14.2";

  src = fetchFromGitHub {
    owner = "project-copacetic";
    repo = "copacetic";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-pD6AdJ9GfTPVgI/e4zRW4oJjOzpEk9uY4kdEm5yLDrw=";
+    hash = "sha256-MH3HSbJ+/5vjUrjFZQVf4Qv2+qAezOShxfkAoCJMnFU=";
  };

  vendorHash = "sha256-RKqaIwGDZj91lfbEJHcnG8RhIrixtR0VtieCfZD/rns=";
--- a/pkgs/by-name/ct/ctx7/package.nix
+++ b/pkgs/by-name/ct/ctx7/package.nix
@@ -16,7 +16,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "ctx7";
-  version = "0.5.3";
+  version = "0.5.4";

  __structuredAttrs = true;
  strictDeps = true;
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "upstash";
    repo = "context7";
    tag = "${finalAttrs.pname}@${finalAttrs.version}";
-    hash = "sha256-J3FS0HPpkuriuxEyY1dluwdMovdvgWUTFgBxVUlf+GA=";
+    hash = "sha256-yyz4UraRm1JR/C7J2ib0nBU6zsNpKCWIWduTu7OlebM=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/cu/cursor-cli/package.nix
+++ b/pkgs/by-name/cu/cursor-cli/package.nix
@@ -10,26 +10,26 @@ let
  inherit (stdenv) hostPlatform;
  sources = {
    x86_64-linux = fetchurl {
-      url = "https://downloads.cursor.com/lab/2026.06.19-20-24-33-653a7fb/linux/x64/agent-cli-package.tar.gz";
-      hash = "sha256-3xHrn1JaG2Leok/CiWtZezERrYqVcpZggXSD/zuWyy4=";
+      url = "https://downloads.cursor.com/lab/2026.06.26-7079533/linux/x64/agent-cli-package.tar.gz";
+      hash = "sha256-fZNlWkdPQsK12SfmKmG+VrxWA4Df7sAFQJ5DSToq+Eg=";
    };
    aarch64-linux = fetchurl {
-      url = "https://downloads.cursor.com/lab/2026.06.19-20-24-33-653a7fb/linux/arm64/agent-cli-package.tar.gz";
-      hash = "sha256-6iiinIexiEKqXDXOHzKut1d0Mtg89A8zel0zeXna4Qc=";
+      url = "https://downloads.cursor.com/lab/2026.06.26-7079533/linux/arm64/agent-cli-package.tar.gz";
+      hash = "sha256-WcMurHV8Pm/2Y1HvNJGZYqjgt3OzHwn5oW5W27egueE=";
    };
    x86_64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/lab/2026.06.19-20-24-33-653a7fb/darwin/x64/agent-cli-package.tar.gz";
-      hash = "sha256-HgxyZ1TPLnyJJJuvi8VrQhm33/rzD9kCwxy4Mp0D9C0=";
+      url = "https://downloads.cursor.com/lab/2026.06.26-7079533/darwin/x64/agent-cli-package.tar.gz";
+      hash = "sha256-5J2SA5AoyOxT9Ng58MnyCFtNllQCYhbO5MQZaONwgsk=";
    };
    aarch64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/lab/2026.06.19-20-24-33-653a7fb/darwin/arm64/agent-cli-package.tar.gz";
-      hash = "sha256-Qa22+f5+x5+4sHesqp24d9GlKqPp6xBJG7BFxz6LUVU=";
+      url = "https://downloads.cursor.com/lab/2026.06.26-7079533/darwin/arm64/agent-cli-package.tar.gz";
+      hash = "sha256-UO8SRA6depwO9SNhvYl9uOy9Dp625vHVNiyfxtmq3c4=";
    };
  };
 in
 stdenv.mkDerivation {
  pname = "cursor-cli";
-  version = "2026.06.19-20-24-33-653a7fb";
+  version = "0-unstable-2026-06-26";

  src = sources.${hostPlatform.system};

--- a/pkgs/by-name/cy/cyberstrike/package.nix
+++ b/pkgs/by-name/cy/cyberstrike/package.nix
@@ -16,7 +16,7 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "cyberstrike";
-  version = "1.1.14";
+  version = "1.1.15";

  __structuredAttrs = true;
  strictDeps = true;
@@ -25,7 +25,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    owner = "CyberStrikeus";
    repo = "CyberStrike";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-MlFEGP/MiuDtLl7Ms6j11u1MdLV6w8T/7TYo7eeE/rc=";
+    hash = "sha256-U1yYTFZCjF3z+161CL4xyxYwcWJh5zCbGAOm/ctACSs=";
  };

  node_modules = stdenvNoCC.mkDerivation {
@@ -75,7 +75,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    # Required so fixed-output derivation does not retain store references
    dontFixup = true;

-    outputHash = "sha256-IxIdzd9MJJRpc0nB5eEASSW0LIckU+SvcUgkKoL+mog=";
+    outputHash = "sha256-O5p/2+14dFt/gbONLVSvqPdNmLgQ8L+cUTGp81Rm0js=";
    outputHashAlgo = "sha256";
    outputHashMode = "recursive";
  };
--- a/pkgs/by-name/cy/cypress/package.nix
+++ b/pkgs/by-name/cy/cypress/package.nix
@@ -1,6 +1,7 @@
 {
  alsa-lib,
  autoPatchelfHook,
+  darwin,
  fetchzip,
  gtk2,
  gtk3,
@@ -55,6 +56,9 @@ stdenv.mkDerivation rec {
    unzip
    makeShellWrapper
  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    darwin.autoSignDarwinBinariesHook
+  ]
  ++ lib.optionals stdenv.hostPlatform.isLinux [
    autoPatchelfHook
    # override doesn't preserve splicing https://github.com/NixOS/nixpkgs/issues/132651
--- a/pkgs/by-name/da/daisydisk/package.nix
+++ b/pkgs/by-name/da/daisydisk/package.nix
@@ -10,11 +10,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "daisydisk";
-  version = "4.33.3";
+  version = "4.34.2";

  src = fetchzip {
    url = "https://daisydiskapp.com/download/DaisyDisk.zip";
-    hash = "sha256-2QhaY4oQV+bkvcyC88Zsk7eZJ6dySsb5G2+juH8HNjI=";
+    hash = "sha256-lSV367twsKDp0e5TsVYfjYO5GPcjtteBCxmUIOrz+0E=";
    stripRoot = false;
  };

--- a/pkgs/by-name/da/databricks-cli/package.nix
+++ b/pkgs/by-name/da/databricks-cli/package.nix
@@ -7,7 +7,6 @@
  versionCheckHook,
  nix-update-script,
 }:
-
 buildGoModule (finalAttrs: {
  pname = "databricks-cli";
  version = "1.7.0";
@@ -31,6 +30,12 @@ buildGoModule (finalAttrs: {

  ldflags = [
    "-X github.com/databricks/cli/internal/build.buildVersion=${finalAttrs.version}"
+    "-X github.com/databricks/cli/internal/build.buildTag=v${finalAttrs.version}"
+    "-X github.com/databricks/cli/internal/build.buildSummary=v${finalAttrs.version}"
+    "-X github.com/databricks/cli/internal/build.buildMajor=${lib.versions.major finalAttrs.version}"
+    "-X github.com/databricks/cli/internal/build.buildMinor=${lib.versions.minor finalAttrs.version}"
+    "-X github.com/databricks/cli/internal/build.buildPatch=${lib.versions.patch finalAttrs.version}"
+    "-X github.com/databricks/cli/internal/build.buildIsSnapshot=false"
  ];

  postBuild = ''
--- a/pkgs/by-name/da/davmail/package.nix
+++ b/pkgs/by-name/da/davmail/package.nix
@@ -23,13 +23,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "davmail";
-  version = "6.8.0";
+  version = "6.8.1";

  src = fetchFromGitHub {
    owner = "mguessan";
    repo = "davmail";
    tag = finalAttrs.version;
-    hash = "sha256-I5MQTxCU3SCIAj6Y6idJ9KbBRhvSbzZhZ9nY82BXM7k=";
+    hash = "sha256-kIDAMVenUzc7tIC49yzc1MzqNa9B7nNlX1bzwpG8Vp0=";
  };

  buildPhase = ''
--- a/Show More
+++ b/Show More