From 690af69257eb4349f20bedefffd24b9972e78274 Mon Sep 17 00:00:00 2001
From: cyclopentane <cyclopentane@aidoskyneen.eu>
Date: Sat, 20 Jun 2026 23:00:44 +0200
Subject: [PATCH 01/39] nixos/akkoma: fix assertion

---
 nixos/modules/services/web-apps/akkoma.nix | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/nixos/modules/services/web-apps/akkoma.nix b/nixos/modules/services/web-apps/akkoma.nix
index c351c87e72a8..fb3bad0cc504 100644
--- a/nixos/modules/services/web-apps/akkoma.nix
+++ b/nixos/modules/services/web-apps/akkoma.nix
@@ -1167,17 +1167,16 @@ in
   };
 
   config = mkIf cfg.enable {
-    assertions =
-      optionals
-        (
+    assertions = [
+      {
+        assertion =
           cfg.config.":pleroma".":media_proxy".enabled
-          && cfg.config.":pleroma".":media_proxy".base_url == null
-        )
-        [
-          ''
-            `services.akkoma.config.":pleroma".":media_proxy".base_url` must be set when the media proxy is enabled.
-          ''
-        ];
+          -> cfg.config.":pleroma".":media_proxy".base_url != null;
+        message = ''
+          `services.akkoma.config.":pleroma".":media_proxy".base_url` must be set when the media proxy is enabled.
+        '';
+      }
+    ];
     warnings =
       optionals (with config.security; cfg.installWrapper && (!sudo.enable) && (!sudo-rs.enable))
         [

From 77539dfef5b23a6fdb202314db7080adc8ffb5fd Mon Sep 17 00:00:00 2001
From: cyclopentane <cyclopentane@aidoskyneen.eu>
Date: Sat, 20 Jun 2026 23:02:49 +0200
Subject: [PATCH 02/39] nixos/akkoma: make assertion message more informative

---
 nixos/modules/services/web-apps/akkoma.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/web-apps/akkoma.nix b/nixos/modules/services/web-apps/akkoma.nix
index fb3bad0cc504..bc343817e3ad 100644
--- a/nixos/modules/services/web-apps/akkoma.nix
+++ b/nixos/modules/services/web-apps/akkoma.nix
@@ -1173,7 +1173,7 @@ in
           cfg.config.":pleroma".":media_proxy".enabled
           -> cfg.config.":pleroma".":media_proxy".base_url != null;
         message = ''
-          `services.akkoma.config.":pleroma".":media_proxy".base_url` must be set when the media proxy is enabled.
+          `services.akkoma.config.":pleroma".":media_proxy".base_url` must be set to a URL with a different host component (domain name) than the web endpoint when the media proxy is enabled.
         '';
       }
     ];

From 56e68c1764fd17ade5c4a466da43553f64fc3491 Mon Sep 17 00:00:00 2001
From: Paulchen <lukas.23022005@gmail.com>
Date: Tue, 22 Sep 2026 16:04:45 +0200
Subject: [PATCH 03/39] cloudfoundry-cli: Update `ldflags` to fix corrupted
 version

---
 pkgs/by-name/cl/cloudfoundry-cli/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/cl/cloudfoundry-cli/package.nix b/pkgs/by-name/cl/cloudfoundry-cli/package.nix
index 81d9f1a9c08a..445753df03dc 100644
--- a/pkgs/by-name/cl/cloudfoundry-cli/package.nix
+++ b/pkgs/by-name/cl/cloudfoundry-cli/package.nix
@@ -32,8 +32,9 @@ buildGoModule (finalAttrs: {
   ldflags = [
     "-s"
     "-w"
-    "-X code.cloudfoundry.org/cli/version.binaryBuildDate=1970-01-01"
-    "-X code.cloudfoundry.org/cli/version.binaryVersion=${finalAttrs.version}"
+    "-X code.cloudfoundry.org/cli/v8/version.binaryBuildDate=1970-01-01"
+    "-X code.cloudfoundry.org/cli/v8/version.binaryVersion=${finalAttrs.version}"
+    "-X code.cloudfoundry.org/cli/v8/version.binarySHA=${finalAttrs.src.rev}"
   ];
 
   postInstall = ''

From 32199a9e54d2e0e26319532eed7a82ea32fc339d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 25 Sep 2026 11:50:27 +0000
Subject: [PATCH 04/39] deno: 2.9.6 -> 2.9.7

---
 pkgs/by-name/de/deno/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/de/deno/package.nix b/pkgs/by-name/de/deno/package.nix
index ca06a0e755f3..1d81a9101d75 100644
--- a/pkgs/by-name/de/deno/package.nix
+++ b/pkgs/by-name/de/deno/package.nix
@@ -36,7 +36,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "deno";
-  version = "2.9.6";
+  version = "2.9.7";
 
   __structuredAttrs = true;
 
@@ -51,10 +51,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     repo = "deno";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true; # required for tests
-    hash = "sha256-4X7IfQk9NJizhZKqH2EuDnSfk8axkKFyiZEv1FOfWTM=";
+    hash = "sha256-GOhud8uXlsDdyAN84WscakxK2qCFTEYSUwR5Wt2QPAs=";
   };
 
-  cargoHash = "sha256-EKRC+wqIos9O0GHaxjmb/ghyzV6oCi1qwhO2tjszWR4=";
+  cargoHash = "sha256-VSWkdTJiSX8O3+Kpu7RKnydxB3OcbwG9+NJCvLdFl68=";
 
   patches = [
     ./patches/0002-tests-replace-hardcoded-paths.patch

From b9ec68235ebc7c9c5eca0c0b519871daf285501d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 28 Sep 2026 05:00:08 +0000
Subject: [PATCH 05/39] phpunit: 13.3.2 -> 13.3.5

---
 pkgs/by-name/ph/phpunit/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ph/phpunit/package.nix b/pkgs/by-name/ph/phpunit/package.nix
index 863597cc9341..5e9177d0367d 100644
--- a/pkgs/by-name/ph/phpunit/package.nix
+++ b/pkgs/by-name/ph/phpunit/package.nix
@@ -8,16 +8,16 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "phpunit";
-  version = "13.3.2";
+  version = "13.3.5";
 
   src = fetchFromGitHub {
     owner = "sebastianbergmann";
     repo = "phpunit";
     tag = finalAttrs.version;
-    hash = "sha256-pqLjCE7tW7NOAzgFe5grPlRfXTrEXqx1OcFOBCJuO7M=";
+    hash = "sha256-3tbre+82kk8ngpN4JfMEe36YQQZDtY6PgFBUECmUa8o=";
   };
 
-  vendorHash = "sha256-jxV72scmud977MHDItY7wSmZ5j9fUEafty4foSiGH4Y=";
+  vendorHash = "sha256-Pv5O63wsTaQX5owW0XpyQbcSajaGmesorIatfrgZKJk=";
 
   passthru = {
     updateScript = nix-update-script { };

From 4474afabdd7e6bc2cce4511d619c125c787c7efe Mon Sep 17 00:00:00 2001
From: Muhammad Falak R Wani <falakreyaz@gmail.com>
Date: Sun, 20 Sep 2026 11:52:37 +0530
Subject: [PATCH 06/39] tailcat: 0.6.0 -> 0.7.0

Diff: https://github.com/tailscale/tailcat/compare/v0.6.0...v0.7.0
Changelog: https://github.com/tailscale/tailcat/releases/tag/v0.7.0

Signed-off-by: Muhammad Falak R Wani <falakreyaz@gmail.com>
---
 pkgs/by-name/ta/tailcat/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ta/tailcat/package.nix b/pkgs/by-name/ta/tailcat/package.nix
index 1a405e5f0303..a372377e1c91 100644
--- a/pkgs/by-name/ta/tailcat/package.nix
+++ b/pkgs/by-name/ta/tailcat/package.nix
@@ -8,7 +8,7 @@
 
 buildGo127Module (finalAttrs: {
   pname = "tailcat";
-  version = "0.6.0";
+  version = "0.7.0";
 
   __structuredAttrs = true;
 
@@ -16,10 +16,10 @@ buildGo127Module (finalAttrs: {
     owner = "tailscale";
     repo = "tailcat";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TwrEezNpn9ylDl7+Vo4XS/SaVOgU6h6PO1UWSrXnBWk=";
+    hash = "sha256-Hue5NZAmAf8mxFqgoDcjt7YHiROeudpAoanxSFnZkTk=";
   };
 
-  vendorHash = "sha256-hpFVgsUKswE7g69EieoeKGPR1nVkcRmBhDKbnB2CDBg=";
+  vendorHash = "sha256-yfOl/gWIijLlqchXFiTRZ7vlgS/kn0xOmv52TFMYs+E=";
 
   subPackages = [ "cmd/tailcat" ];
 

From 653ef51de301b31600baeb648c82a0e4e7a03605 Mon Sep 17 00:00:00 2001
From: sophronesis <oleksandr.buzynnyi@gmail.com>
Date: Mon, 28 Sep 2026 14:17:01 +0200
Subject: [PATCH 07/39] tailcat: fix home DERP race in the e2e tests

In the build sandbox there is no non-loopback interface, so magicsock
starts with its network down. The server's first netcheck, started by
SetPrivateKey, can run before tailcat calls SetNetworkUp(true) and then
never picks a home DERP. The server stays unreachable until the
periodic re-STUN 20-26s later, so clients time out after 10s. This made
TestServeExec and TestServeExitNode fail on x86_64-linux.

Mark the network up before SetPrivateKey.

Assisted-by: Claude Code (claude-opus-5-5)
---
 .../network-up-before-first-netcheck.patch    | 29 +++++++++++++++++++
 pkgs/by-name/ta/tailcat/package.nix           |  8 +++++
 2 files changed, 37 insertions(+)
 create mode 100644 pkgs/by-name/ta/tailcat/network-up-before-first-netcheck.patch

diff --git a/pkgs/by-name/ta/tailcat/network-up-before-first-netcheck.patch b/pkgs/by-name/ta/tailcat/network-up-before-first-netcheck.patch
new file mode 100644
index 000000000000..51b3e04bfe12
--- /dev/null
+++ b/pkgs/by-name/ta/tailcat/network-up-before-first-netcheck.patch
@@ -0,0 +1,29 @@
+Mark magicsock's network up before SetPrivateKey starts the first netcheck.
+
+With no non-loopback interface (e.g. the Nix build sandbox) the engine
+starts with magicsock's network down. SetPrivateKey and SetDERPMap kick
+off endpoint updates in the background, and if one of them runs before
+the later SetNetworkUp(true), updateNetInfo bails out on networkDown()
+without ever picking a home DERP. A server then is not reachable over
+DERP until the periodic re-STUN 20-26s later, and clients give up after
+10s with "tailcat Ping: context deadline exceeded".
+
+diff --git a/tailcat.go b/tailcat.go
+--- a/tailcat.go
++++ b/tailcat.go
+@@ -1577,6 +1577,7 @@ func (lb *locoBackend) Start() error {
+ 	mc := lb.sys.MagicSock.Get()
+ 	lb.logf("disco pub key: %v", mc.DiscoPublicKey())
+ 
++	mc.SetNetworkUp(true)
+ 	mc.SetPrivateKey(lb.priv)
+ 	mc.SetDERPMap(lb.dm)
+ 
+@@ -1632,7 +1633,6 @@ func (lb *locoBackend) Start() error {
+ 	mc.SetNetworkMap(nm.SelfNode, nm.Peers)
+ 	e.SetSelfNode(nm.SelfNode)
+ 	lb.sys.Netstack.Get().UpdateNetstackIPs(nm)
+-	mc.SetNetworkUp(true)
+ 	lb.logf("NetworkMap: %v", logger.AsJSON(nm))
+ 
+ 	// Install the live per-peer config sources. WireGuard peers are
diff --git a/pkgs/by-name/ta/tailcat/package.nix b/pkgs/by-name/ta/tailcat/package.nix
index a372377e1c91..9c52cbf50dff 100644
--- a/pkgs/by-name/ta/tailcat/package.nix
+++ b/pkgs/by-name/ta/tailcat/package.nix
@@ -19,6 +19,14 @@ buildGo127Module (finalAttrs: {
     hash = "sha256-Hue5NZAmAf8mxFqgoDcjt7YHiROeudpAoanxSFnZkTk=";
   };
 
+  patches = [
+    # The sandbox has no non-loopback interface, so magicsock starts with
+    # its network down. The server's first netcheck can then run before
+    # SetNetworkUp(true) and it never picks a home DERP, which makes the
+    # e2e tests time out on "tailcat Ping: context deadline exceeded".
+    ./network-up-before-first-netcheck.patch
+  ];
+
   vendorHash = "sha256-yfOl/gWIijLlqchXFiTRZ7vlgS/kn0xOmv52TFMYs+E=";
 
   subPackages = [ "cmd/tailcat" ];

From 3e586911e305c35f198ec72ca9a21d2baf6c5065 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 28 Sep 2026 12:12:31 -0700
Subject: [PATCH 08/39] immich: 3.2.2 -> 3.2.4

Diff: https://github.com/immich-app/immich/compare/v3.2.2...v3.2.4

Changelog: https://github.com/immich-app/immich/releases/tag/v3.2.4
---
 pkgs/by-name/im/immich/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/im/immich/package.nix b/pkgs/by-name/im/immich/package.nix
index 77680ff05cab..1ba6f6727185 100644
--- a/pkgs/by-name/im/immich/package.nix
+++ b/pkgs/by-name/im/immich/package.nix
@@ -110,7 +110,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "immich";
-  version = "3.2.2";
+  version = "3.2.4";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -119,7 +119,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "immich-app";
     repo = "immich";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-napG+EMZbbbeq7R8FtnuDsDwdpxItkwTVWztnw07DfA=";
+    hash = "sha256-/wWep6A/ryocuGMOElcD1lOEwT6tJDdwa5HAcCZUXSs=";
   };
 
   pnpmDeps = fetchPnpmDeps {

From 45edcdc1e3c58d475494d9f67c299d602a1e8d1e Mon Sep 17 00:00:00 2001
From: Adib Hanna <adibhanna@gmail.com>
Date: Mon, 28 Sep 2026 15:32:31 -0500
Subject: [PATCH 09/39] zennotes-desktop: 2.45.0 -> 2.57.0

Use the source and npm hashes verified by ZenNotes/zennotes Nix update run 36478695469 and the main-branch package rebuild 36479600754.
---
 pkgs/by-name/ze/zennotes-desktop/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ze/zennotes-desktop/package.nix b/pkgs/by-name/ze/zennotes-desktop/package.nix
index 92e2c6b7d5c0..81e03daeebea 100644
--- a/pkgs/by-name/ze/zennotes-desktop/package.nix
+++ b/pkgs/by-name/ze/zennotes-desktop/package.nix
@@ -13,14 +13,14 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "zennotes-desktop";
-  version = "2.45.0";
-  npmDepsHash = "sha256-+5eIwbSTpRupYj4gR33MDeJEEDBlt+K4idnlZFWG4Z4=";
+  version = "2.57.0";
+  npmDepsHash = "sha256-mblscdXgrIV2D3MjIqR+uqHh304mGnEKDDqsiFZZrB4=";
 
   src = fetchFromGitHub {
     owner = "ZenNotes";
     repo = "zennotes";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/HoSAgt7INT5Hharc+ltb2ya8InAuZmhS8Tmftl0VOo=";
+    hash = "sha256-ECRkAs8QhwCp2wEyqGzZ6F9sG9hXaomVEShKXO34tEg=";
   };
 
   npmWorkspace = "apps/desktop";

From 1dcf5ede2b8bc1fa2947ed2b830fd993204f99c5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 28 Sep 2026 23:23:41 +0000
Subject: [PATCH 10/39] wlc: 2.1.1 -> 2.2.1

---
 pkgs/by-name/wl/wlc/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/wl/wlc/package.nix b/pkgs/by-name/wl/wlc/package.nix
index 499fa76dfacb..2c508d2a76cf 100644
--- a/pkgs/by-name/wl/wlc/package.nix
+++ b/pkgs/by-name/wl/wlc/package.nix
@@ -6,12 +6,12 @@
 
 python3.pkgs.buildPythonPackage rec {
   pname = "wlc";
-  version = "2.1.1";
+  version = "2.2.1";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-z0Ig+SuJ5XdZkDb3I5AXziVFjMAMCIly2vcQRqx62sw=";
+    hash = "sha256-8d5KOfHDY+4gUOc9lGNAayn8IBD5p706lGXpSuskKOU=";
   };
 
   build-system = with python3.pkgs; [ setuptools ];

From b768821e775365c029cdb26a92ca88184c893564 Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Tue, 29 Sep 2026 02:18:23 +0200
Subject: [PATCH 11/39] luajit_openresty: 2.1-20260724 -> 2.1-20260824

---
 pkgs/development/interpreters/luajit/openresty.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/interpreters/luajit/openresty.nix b/pkgs/development/interpreters/luajit/openresty.nix
index 4316871f8f97..c425e4bc8b1b 100644
--- a/pkgs/development/interpreters/luajit/openresty.nix
+++ b/pkgs/development/interpreters/luajit/openresty.nix
@@ -6,13 +6,13 @@
 }:
 
 callPackage ./default.nix rec {
-  version = "2.1-20260724";
+  version = "2.1-20260824";
 
   src = fetchFromGitHub {
     owner = "openresty";
     repo = "luajit2";
-    rev = "v${version}";
-    hash = "sha256-cvy9FgHWFuacCFl7/conLwNuMgaol1LnIUiqcnXy9H8=";
+    tag = "v${version}";
+    hash = "sha256-IynlDQOyjCr1C3qibLg3OJ9Qd/Rb5jzjy30ETKdKvFM=";
   };
 
   extraMeta = {

From a38c886f6251c04e3674adb3f3f9104ce1cb2131 Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Tue, 29 Sep 2026 02:23:01 +0200
Subject: [PATCH 12/39] luajit_openresty: add riscv64 support

---
 .../interpreters/lua-5/default.nix            | 11 ++++++++-
 .../interpreters/luajit/openresty.nix         | 23 +++++++++++++++++--
 2 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/interpreters/lua-5/default.nix b/pkgs/development/interpreters/lua-5/default.nix
index 50843b9a6583..68642e38678a 100644
--- a/pkgs/development/interpreters/lua-5/default.nix
+++ b/pkgs/development/interpreters/lua-5/default.nix
@@ -4,6 +4,8 @@
   lib,
   callPackage,
   fetchFromGitHub,
+  fetchpatch2,
+  applyPatches,
   makeBinaryWrapper,
 }:
 
@@ -199,6 +201,13 @@ rec {
 
   luajit_openresty = import ../luajit/openresty.nix {
     self = luajit_openresty;
-    inherit callPackage fetchFromGitHub passthruFun;
+    inherit
+      callPackage
+      fetchFromGitHub
+      fetchpatch2
+      applyPatches
+      stdenv
+      passthruFun
+      ;
   };
 }
diff --git a/pkgs/development/interpreters/luajit/openresty.nix b/pkgs/development/interpreters/luajit/openresty.nix
index c425e4bc8b1b..c51837773b0d 100644
--- a/pkgs/development/interpreters/luajit/openresty.nix
+++ b/pkgs/development/interpreters/luajit/openresty.nix
@@ -2,10 +2,13 @@
   self,
   callPackage,
   fetchFromGitHub,
+  fetchpatch2,
+  applyPatches,
+  stdenv,
   passthruFun,
 }:
 
-callPackage ./default.nix rec {
+let
   version = "2.1-20260824";
 
   src = fetchFromGitHub {
@@ -15,10 +18,26 @@ callPackage ./default.nix rec {
     hash = "sha256-IynlDQOyjCr1C3qibLg3OJ9Qd/Rb5jzjy30ETKdKvFM=";
   };
 
+  # upstream LuaJIT has no riscv64.
+  # port submitted at https://github.com/openresty/luajit2/pull/236 same as Debian
+  srcWithRiscv64Port = applyPatches {
+    inherit src;
+    patches = [
+      (fetchpatch2 {
+        url = "https://github.com/openresty/luajit2/compare/v2.1-20260824...ce14aff834d8d62220fc730a16042c52451f41cc.diff";
+        hash = "sha256-VHDTUr7PWpthmhO3BokCbdL1cricAnX6BjZGTi1wr3Q=";
+      })
+    ];
+  };
+in
+callPackage ./default.nix {
+  inherit version;
+
+  src = if stdenv.hostPlatform.isRiscV64 then srcWithRiscv64Port else src;
+
   extraMeta = {
     badPlatforms = [
       "loongarch64-linux" # See https://github.com/LuaJIT/LuaJIT/issues/1278
-      "riscv64-linux" # See https://github.com/LuaJIT/LuaJIT/issues/628
       # 64-bit POWER (LE and BE, either ELF ABI version on the latter) *is* supported, but ELFv1 powerpc64-linux has an
       # issue with memory allocation
       # https://github.com/openresty/luajit2/issues/258

From 7c0bdd0e0b6bb59b9959d9bacf75ba42f63e67ce Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Mon, 28 Sep 2026 21:02:35 +0200
Subject: [PATCH 13/39] luajit: use luajit_openresty on riscv64

---
 pkgs/top-level/all-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index d5d401db6e0a..f9b6dd7e48a9 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -4390,7 +4390,7 @@ with pkgs;
 
   luaPackages = lua52Packages;
 
-  luajit = luajit_2_1;
+  luajit = if stdenv.hostPlatform.isRiscV64 then luajit_openresty else luajit_2_1;
 
   luarocks = luaPackages.luarocks;
   luarocks-nix = luaPackages.luarocks-nix;

From ea8f81c9f422027e2a832bf27ac1c7ecc3b7d4cb Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Tue, 29 Sep 2026 02:48:27 +0200
Subject: [PATCH 14/39] luajit_openresty: fix luaAttr for the lua package set

---
 pkgs/development/interpreters/luajit/openresty.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/interpreters/luajit/openresty.nix b/pkgs/development/interpreters/luajit/openresty.nix
index c51837773b0d..856bad91c6ae 100644
--- a/pkgs/development/interpreters/luajit/openresty.nix
+++ b/pkgs/development/interpreters/luajit/openresty.nix
@@ -33,6 +33,9 @@ in
 callPackage ./default.nix {
   inherit version;
 
+  # default luaAttr would be luajit_2_1, the wrong interpreter for the lua package set
+  luaAttr = "luajit_openresty";
+
   src = if stdenv.hostPlatform.isRiscV64 then srcWithRiscv64Port else src;
 
   extraMeta = {

From 58dedacf870aa966be241fbb6920e77c662b1013 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 29 Sep 2026 01:02:57 +0000
Subject: [PATCH 15/39] matrix-conduit: 0.10.13 -> 0.10.14

---
 pkgs/by-name/ma/matrix-conduit/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ma/matrix-conduit/package.nix b/pkgs/by-name/ma/matrix-conduit/package.nix
index 9debe7777978..f03587fb25c7 100644
--- a/pkgs/by-name/ma/matrix-conduit/package.nix
+++ b/pkgs/by-name/ma/matrix-conduit/package.nix
@@ -12,16 +12,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "matrix-conduit";
-  version = "0.10.13";
+  version = "0.10.14";
 
   src = fetchFromGitLab {
     owner = "famedly";
     repo = "conduit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-1j3q/n6sC3bIVwbcZfegJQO9WaLPfJWqgibO/XNmj6s=";
+    hash = "sha256-A7Gryk1ZWDu751n3rBfv9HUTiokoGhBol/ve9mWwRjA=";
   };
 
-  cargoHash = "sha256-YfgvcY1yYwlQuoEl21XEAxDR/SDce+OHhZOzp6tkzR0=";
+  cargoHash = "sha256-afYD2cR6VyFSa1M33ktuNcg2/r/Ag3HNKSz95gRCwuE=";
 
   # Conduit enables rusqlite's bundled feature by default, but we'd rather use our copy of SQLite.
   preBuild = ''

From d12e75647404fb53470beaabcad0c647d02506e2 Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Tue, 29 Sep 2026 03:06:22 +0200
Subject: [PATCH 16/39] tree-sitter: fix riscv64-linux build

---
 pkgs/by-name/tr/tree-sitter/package.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/tr/tree-sitter/package.nix b/pkgs/by-name/tr/tree-sitter/package.nix
index f16b467c5821..ebd2c362f222 100644
--- a/pkgs/by-name/tr/tree-sitter/package.nix
+++ b/pkgs/by-name/tr/tree-sitter/package.nix
@@ -193,6 +193,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
       substituteInPlace ./Makefile \
           --replace-fail 'all: libtree-sitter.a libtree-sitter.$(SOEXT) tree-sitter.pc' 'all: libtree-sitter.a tree-sitter.pc'
       sed -i '/^install:/,/^[^[:space:]]/ { /$(SOEXT/d; }' ./Makefile
+    ''
+    # rquickjs-sys passes the raw rust target to clang, which does not know riscv64gc
+    + lib.optionalString stdenv.hostPlatform.isRiscV64 ''
+      substituteInPlace $cargoDepsCopy/source-*/rquickjs-sys-*/build.rs \
+        --replace-fail \
+          'let mut cflags = vec![format!("--target={}", target)];' \
+          'let mut cflags = vec![format!("--target={}", target.replace("riscv64gc", "riscv64"))];'
     '';
 
   # The Makefile install can't enable the wasm feature.

From fef45ac42e887d0982ec66428ad40a185c0d1d2f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 29 Sep 2026 03:01:34 +0000
Subject: [PATCH 17/39] cook-cli: 0.36.0 -> 0.37.0

---
 pkgs/by-name/co/cook-cli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/co/cook-cli/package.nix b/pkgs/by-name/co/cook-cli/package.nix
index bc2241469da7..38cf3ca4e31d 100644
--- a/pkgs/by-name/co/cook-cli/package.nix
+++ b/pkgs/by-name/co/cook-cli/package.nix
@@ -11,16 +11,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cook-cli";
-  version = "0.36.0";
+  version = "0.37.0";
 
   src = fetchFromGitHub {
     owner = "cooklang";
     repo = "cookcli";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ihsVvlyp//A4pNlt1+DlYWyz52enHVeU6uST7bxcwqw=";
+    hash = "sha256-tHPVKigUqHZo84E+2wnky21UQfE7bQ1ZB1vZZNPlm7E=";
   };
 
-  cargoHash = "sha256-e47x9XzABpXO+qvTydrBOPU9KTZTYJkbJvWvpUUh7Bo=";
+  cargoHash = "sha256-DOXHQMYWyuArVwS+odyjImGCfzS4flNZM7NRSnLkLfc=";
 
   # Build without the self-updating feature
   buildNoDefaultFeatures = true;

From 1c1ab471f6b401d49396d6b46b960e982820f28b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 29 Sep 2026 03:15:58 +0000
Subject: [PATCH 18/39] simplebluez: 1.1.0 -> 1.2.0

---
 pkgs/by-name/si/simplebluez/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/si/simplebluez/package.nix b/pkgs/by-name/si/simplebluez/package.nix
index b0d3d7488b00..528f6a5d39e7 100644
--- a/pkgs/by-name/si/simplebluez/package.nix
+++ b/pkgs/by-name/si/simplebluez/package.nix
@@ -10,13 +10,13 @@
 stdenv.mkDerivation (finalAttrs: {
   pname = "simplebluez";
 
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "simpleble";
     repo = "SimpleBLE";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-GNLD62w5zTfW7CaknaZmU0jBro92HFw3gA29KJqOHGA=";
+    hash = "sha256-yA/InInNmK77/VxIX8CH0Nkqy9MJZr0Ci6xrVo76DK4=";
   };
 
   outputs = [

From 3ee1ab335ce44a7e9569971d50eb39710f501eb2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Tue, 29 Sep 2026 07:52:31 +0200
Subject: [PATCH 19/39] uboot*: fix build

https://hydra.nixos.org/build/347450920/step/2/log/tail
Thanks to r-burns who investigated the issue and found this solution.
---
 pkgs/misc/uboot/default.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index 95d589220a20..ae9dcb727dd4 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -82,6 +82,13 @@ let
           '') (builtins.attrNames pythonScriptsToInstall)}
           patchShebangs tools
           patchShebangs scripts
+        ''
+        # This warning got removed in
+        # https://git.kernel.org/pub/scm/utils/dtc/dtc.git/commit/?id=cba90ce82064ad1e6d25f20d8eaa940bd2fc97ed
+        + ''
+          for f in scripts/Makefile.lib dts/upstream/Makefile; do
+            substituteInPlace "$f" --replace-fail -Wno-graph_child_address ""
+          done
         '';
 
         nativeBuildInputs = [

From 1e5202adb8db0c1253f6551a4674d77c82d5b784 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 29 Sep 2026 09:36:04 +0200
Subject: [PATCH 20/39] python3Packages.flare-capa: rename

---
 pkgs/by-name/ca/capa/package.nix                              | 2 +-
 .../python-modules/{capa => flare-capa}/default.nix           | 2 +-
 pkgs/top-level/python-aliases.nix                             | 1 +
 pkgs/top-level/python-packages.nix                            | 4 ++--
 4 files changed, 5 insertions(+), 4 deletions(-)
 rename pkgs/development/python-modules/{capa => flare-capa}/default.nix (98%)

diff --git a/pkgs/by-name/ca/capa/package.nix b/pkgs/by-name/ca/capa/package.nix
index fad27bfb2801..f9b436fcaf4b 100644
--- a/pkgs/by-name/ca/capa/package.nix
+++ b/pkgs/by-name/ca/capa/package.nix
@@ -1 +1 @@
-{ python3Packages }: with python3Packages; toPythonApplication capa
+{ python3Packages }: with python3Packages; toPythonApplication flare-capa
diff --git a/pkgs/development/python-modules/capa/default.nix b/pkgs/development/python-modules/flare-capa/default.nix
similarity index 98%
rename from pkgs/development/python-modules/capa/default.nix
rename to pkgs/development/python-modules/flare-capa/default.nix
index 4aeb280f6ad1..0b7016668c6a 100644
--- a/pkgs/development/python-modules/capa/default.nix
+++ b/pkgs/development/python-modules/flare-capa/default.nix
@@ -45,7 +45,7 @@
 }:
 
 buildPythonPackage (finalAttrs: {
-  pname = "capa";
+  pname = "flare-capa";
   version = "9.4.0";
   pyproject = true;
 
diff --git a/pkgs/top-level/python-aliases.nix b/pkgs/top-level/python-aliases.nix
index 3c5c2369bcd8..857bf22e50a7 100644
--- a/pkgs/top-level/python-aliases.nix
+++ b/pkgs/top-level/python-aliases.nix
@@ -156,6 +156,7 @@ mapAliases {
   bz2file = throw "'bz2file' has beem removed, as it was not longed maintained upstream since 2020"; # added 2025-08-26
   calysto-scheme = throw "'calysto-scheme' has been removed as it is no longer maintained upstream"; # Added 2026-01-31
   can = throw "'can' has been renamed to/replaced by 'python-can'"; # Converted to throw 2025-10-29
+  capa = flare-capa; # added 2026-09-29
   casbin = pycasbin; # added 2025-06-12
   cchardet = throw "'cchardet' has been renamed to/replaced by 'faust-cchardet'"; # Converted to throw 2025-10-29
   chai = throw "'chai' has been removed as it is no longer maintained upstream and the repository was archived"; # Added 2026-06-08
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ef18a7b2f4d5..33a47ed0c3b5 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2877,8 +2877,6 @@ self: super: with self; {
 
   cantools = callPackage ../development/python-modules/cantools { };
 
-  capa = callPackage ../development/python-modules/capa { };
-
   capstone = callPackage ../development/python-modules/capstone { inherit (pkgs) capstone; };
 
   capstone_4 = callPackage ../development/python-modules/capstone/4.nix {
@@ -6201,6 +6199,8 @@ self: super: with self; {
 
   flammkuchen = callPackage ../development/python-modules/flammkuchen { };
 
+  flare-capa = callPackage ../development/python-modules/flare-capa { };
+
   flasgger = callPackage ../development/python-modules/flasgger { };
 
   flash-attn = callPackage ../development/python-modules/flash-attn { };

From 14ea24b049833ac5e548e265c7470b1eca4aefb3 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Tue, 29 Sep 2026 11:05:56 +0200
Subject: [PATCH 21/39] python3Packages.flare-capa: disable on darwin

---
 pkgs/development/python-modules/flare-capa/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/development/python-modules/flare-capa/default.nix b/pkgs/development/python-modules/flare-capa/default.nix
index 0b7016668c6a..450c6624282d 100644
--- a/pkgs/development/python-modules/flare-capa/default.nix
+++ b/pkgs/development/python-modules/flare-capa/default.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  stdenv,
   buildPythonPackage,
   colorama,
   deptry,
@@ -127,5 +128,8 @@ buildPythonPackage (finalAttrs: {
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
     mainProgram = "capa";
+    # Never built on darwin since first introduction in nixpkgs
+    # see https://hydra.nixos.org/build/345235630
+    broken = stdenv.hostPlatform.isDarwin;
   };
 })

From 85981abf4a811319987a28b2beaffe5a1521c4e6 Mon Sep 17 00:00:00 2001
From: Rafael Ieda <git@ieda.me>
Date: Tue, 29 Sep 2026 05:17:17 -0300
Subject: [PATCH 22/39] wesnoth-devel: 1.19.24 -> 1.19.28

---
 pkgs/by-name/we/wesnoth/package.nix | 39 +++++++++++++++++++++++------
 1 file changed, 31 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/we/wesnoth/package.nix b/pkgs/by-name/we/wesnoth/package.nix
index 34edbac94248..13c9e8a9aa44 100644
--- a/pkgs/by-name/we/wesnoth/package.nix
+++ b/pkgs/by-name/we/wesnoth/package.nix
@@ -10,6 +10,9 @@
   SDL2_net,
   makeBinaryWrapper,
   SDL2_ttf,
+  sdl3,
+  sdl3-image,
+  sdl3-mixer,
   pango,
   gettext,
   boost186,
@@ -22,12 +25,30 @@
   lua5_4,
   curl,
   nix-update-script,
+  versionCheckHook,
   enableDevel ? false,
 }:
 
 let
   boost = boost186;
   suffix = lib.optionalString enableDevel "-devel";
+
+  sdl =
+    if enableDevel then
+      [
+        sdl3
+        sdl3-image
+        sdl3-mixer
+      ]
+    else
+      [
+        SDL2
+        SDL2_image
+        SDL2_mixer
+        SDL2_net
+        SDL2_ttf
+      ];
+
   # wesnoth requires lua built with c++, see https://github.com/wesnoth/wesnoth/pull/8234
   lua = lua5_4.override {
     postConfigure = ''
@@ -38,7 +59,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wesnoth${suffix}";
-  version = if enableDevel then "1.19.24" else "1.18.8";
+  version = if enableDevel then "1.19.28" else "1.18.8";
 
   src = fetchFromGitHub {
     owner = "wesnoth";
@@ -46,11 +67,17 @@ stdenv.mkDerivation (finalAttrs: {
     tag = finalAttrs.version;
     hash =
       if enableDevel then
-        "sha256-q6gdzHDPkG/RqpJxIHqWsxD0n8dzKajDhAT49bjmq78="
+        "sha256-5S2kgqn+HZIPguQP+FYaK79Cvx0IRnmcGSeWPQflt/g="
       else
         "sha256-Tgp3y120j5nqoBrDo7D9C0FcVO3TH5lf+/SoCjR+ikc=";
   };
 
+  strictDeps = true;
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgram = "${placeholder "out"}/bin/wesnothd${suffix}";
+
   nativeBuildInputs = [
     cmake
     pkg-config
@@ -58,11 +85,6 @@ stdenv.mkDerivation (finalAttrs: {
   ++ lib.optionals stdenv.hostPlatform.isDarwin [ makeBinaryWrapper ];
 
   buildInputs = [
-    SDL2
-    SDL2_image
-    SDL2_mixer
-    SDL2_net
-    SDL2_ttf
     pango
     gettext
     boost
@@ -74,7 +96,8 @@ stdenv.mkDerivation (finalAttrs: {
     icu
     lua
     curl
-  ];
+  ]
+  ++ sdl;
 
   cmakeFlags = [
     (lib.cmakeBool "ENABLE_SYSTEM_LUA" true)

From 423d232d61320dba9db8a272ca7d1fde854e6edc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 29 Sep 2026 09:26:02 +0000
Subject: [PATCH 23/39] dbeaver-bin: 26.2.0 -> 26.2.1

---
 pkgs/by-name/db/dbeaver-bin/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/db/dbeaver-bin/package.nix b/pkgs/by-name/db/dbeaver-bin/package.nix
index cb6091c0a997..83c161878825 100644
--- a/pkgs/by-name/db/dbeaver-bin/package.nix
+++ b/pkgs/by-name/db/dbeaver-bin/package.nix
@@ -19,7 +19,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "dbeaver-bin";
-  version = "26.2.0";
+  version = "26.2.1";
 
   src =
     let
@@ -31,9 +31,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         aarch64-darwin = "macos-aarch64.dmg";
       };
       hash = selectSystem {
-        x86_64-linux = "sha256-9QTnCnR2OqAuC2PWhCuFymRSb2gr5Fez8w4zDMEHSO0=";
-        aarch64-linux = "sha256-atqAOjnAcvyPHHdwZpKY6So1AXRKbh/5GXlKDe35WWM=";
-        aarch64-darwin = "sha256-YqA6qIQp1O7zV2VQOXquddJXagEt7aDIPUtE9fvNSj8=";
+        x86_64-linux = "sha256-Fte9AehPjNj0bWl2rBJ/olZ47AEJU8m03OQZM68gZ+g=";
+        aarch64-linux = "sha256-dvrR2QZNDtra33rIEbM7Z17KeXoQjcRqjjgtoiOZzI4=";
+        aarch64-darwin = "sha256-K/9ehDV8pe4mY/SEI9o52zg9EZbAhvl6oiYYj0qiwKA=";
       };
     in
     fetchurl {

From 7cd906d12003365b008cb3edb344598f00df6a89 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 29 Sep 2026 09:28:53 +0000
Subject: [PATCH 24/39] aseprite: 1.3.18.5 -> 1.3.18.6

---
 pkgs/by-name/as/aseprite/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/as/aseprite/package.nix b/pkgs/by-name/as/aseprite/package.nix
index 836b169fad16..a04b5ccc69ad 100644
--- a/pkgs/by-name/as/aseprite/package.nix
+++ b/pkgs/by-name/as/aseprite/package.nix
@@ -34,21 +34,21 @@
 
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "aseprite";
-  version = "1.3.18.5";
+  version = "1.3.18.6";
 
   src = fetchFromGitHub {
     owner = "aseprite";
     repo = "aseprite";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-8BLbAX+wif4vJySv11/NGzGrwRIsK3tvKhpkX2Zoci0=";
+    hash = "sha256-oeTO93T/BQcM0PkrFVMw+kLDG6w3uT2798Kzgua4gsE=";
   };
 
   asepriteStrings = fetchFromGitHub {
     owner = "aseprite";
     repo = "strings";
-    rev = "b43be33343efa40c1c4bda00f985b8cd83bddf2a";
-    hash = "sha256-JxNEtWnP3RtntXM3CmJLXyByW6dri98COp2O0A6ZwBA=";
+    rev = "c6a218e3629ab5c0924682425091be6dec87f489";
+    hash = "sha256-JAKKxkWXJGchPYyr504vQs7QqF4c2Q7RYqFJ/AhOw9A=";
   };
 
   # Translation files are copied without overwriting existing ones to preserve

From 5d4ec2e8e2611f861f2e49d1d9d2a9c2f01d8ffe Mon Sep 17 00:00:00 2001
From: Ryan Burns <rtburns@protonmail.com>
Date: Tue, 29 Sep 2026 03:20:37 -0700
Subject: [PATCH 25/39] openvino: forbid compiler references

This is a dependency of firefox, which forbids compiler references, so
we hoist the same disallowedRequisites requirement here to catch
regressions earlier.

Thanks to K900 for the CMake option that avoids embedding build options,
as was happening in the previous SCons build. Now that SCons is no
longer needed, we can remove it entirely from the build.

Co-authored-by: K900 <me@0upti.me>
---
 pkgs/by-name/op/openvino/package.nix | 25 +++++--------------------
 1 file changed, 5 insertions(+), 20 deletions(-)

diff --git a/pkgs/by-name/op/openvino/package.nix b/pkgs/by-name/op/openvino/package.nix
index 5b97a543359d..7cbea42f8597 100644
--- a/pkgs/by-name/op/openvino/package.nix
+++ b/pkgs/by-name/op/openvino/package.nix
@@ -5,7 +5,6 @@
   cudaSupport ? opencv.cudaSupport or false,
 
   # build
-  scons,
   addDriverRunpath,
   autoPatchelfHook,
   cmake,
@@ -37,9 +36,6 @@ let
     getLib
     ;
 
-  # prevent scons from leaking in the default python version
-  scons' = scons.override { inherit python3Packages; };
-
   python = python3Packages.python.withPackages (
     ps: with ps; [
       cython
@@ -83,7 +79,6 @@ stdenv.mkDerivation (finalAttrs: {
     patchelf
     pkg-config
     python
-    scons'
   ]
   ++ lib.optionals cudaSupport [
     cudaPackages.cuda_nvcc
@@ -98,21 +93,6 @@ stdenv.mkDerivation (finalAttrs: {
     ./gcc-16-fix.patch
   ];
 
-  # Fix arm computelib ar/ranlib toolchain paths for LTO awareness
-  postPatch = ''
-    substituteInPlace src/plugins/intel_cpu/thirdparty/ComputeLibrary/SConstruct \
-      --replace-fail \
-        "env['AR'] = toolchain_prefix + \"ar\"" \
-        "env['AR'] = \"${lib.getExe' stdenv.cc.cc "gcc-ar"}\"" \
-      --replace-fail \
-        "env['RANLIB'] = toolchain_prefix + \"ranlib\"" \
-        "env['RANLIB'] = \"${lib.getExe' stdenv.cc.cc "gcc-ranlib"}\""
-  '';
-
-  dontUseSconsCheck = true;
-  dontUseSconsBuild = true;
-  dontUseSconsInstall = true;
-
   cmakeFlags = [
     "-Wno-dev"
     "-DCMAKE_MODULE_PATH:PATH=${placeholder "out"}/lib/cmake"
@@ -159,6 +139,7 @@ stdenv.mkDerivation (finalAttrs: {
     (cmakeBool "ENABLE_SYSTEM_PUGIXML" true)
     (cmakeBool "ENABLE_SYSTEM_SNAPPY" true)
     (cmakeBool "ENABLE_SYSTEM_TBB" true)
+    (cmakeBool "ENABLE_ARM_COMPUTE_CMAKE" true)
   ];
 
   # src/graph/src/plugins/intel_gpu/src/graph/include/reorder_inst.h:24:8: error: type 'struct typed_program_node' violates the C++ One Definition Rule [-Werror=odr]
@@ -193,6 +174,10 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail "exec_prefix=\''${prefix}/" "exec_prefix="
   '';
 
+  disallowedRequisites = [
+    stdenv.cc.cc
+  ];
+
   meta = {
     changelog = "https://github.com/openvinotoolkit/openvino/releases/tag/${finalAttrs.src.tag}";
     description = "Open-source toolkit for optimizing and deploying AI inference";

From 333a8ce4885eb8afc141bfaed1a2e0b9a2d66da6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 29 Sep 2026 10:38:09 +0000
Subject: [PATCH 26/39] circup: 3.0.4 -> 3.1.0

---
 pkgs/by-name/ci/circup/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ci/circup/package.nix b/pkgs/by-name/ci/circup/package.nix
index f4b0917e23ec..1059c9c3e6ed 100644
--- a/pkgs/by-name/ci/circup/package.nix
+++ b/pkgs/by-name/ci/circup/package.nix
@@ -6,14 +6,14 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "circup";
-  version = "3.0.4";
+  version = "3.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "adafruit";
     repo = "circup";
     tag = finalAttrs.version;
-    hash = "sha256-sv+ixo5S9JRuVu8JkKt29Kpn1ioRIwGW4Ss/A77YiFU=";
+    hash = "sha256-+/1lL5mVeVPFFLitLYIGzSxmnoizNxjb6+MYWreSijw=";
   };
 
   pythonRelaxDeps = [ "semver" ];

From c0923271505318f0bec2e6636561ceb516ead3da Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Tue, 29 Sep 2026 11:57:30 +0000
Subject: [PATCH 27/39] dbcsr: cleanup, fix

---
 pkgs/by-name/db/dbcsr/package.nix | 80 +++++++++++++++++++++----------
 1 file changed, 55 insertions(+), 25 deletions(-)

diff --git a/pkgs/by-name/db/dbcsr/package.nix b/pkgs/by-name/db/dbcsr/package.nix
index 8024f9c45ea4..0520eb4ce21d 100644
--- a/pkgs/by-name/db/dbcsr/package.nix
+++ b/pkgs/by-name/db/dbcsr/package.nix
@@ -1,41 +1,69 @@
 {
-  stdenv,
   lib,
+  stdenv,
   fetchFromGitHub,
+  fetchpatch,
+
+  # nativeBuildInputs
   cmake,
-  mpiCheckPhaseHook,
-  pkg-config,
   fypp,
   gfortran,
+  mpi,
+  pkg-config,
+  python3,
+
+  # buildInputs
   blas,
   lapack,
-  python3,
   libxsmm,
-  mpi,
+
+  # nativeCheckInputs
+  mpiCheckPhaseHook,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "dbcsr";
   version = "2.10.0";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   src = fetchFromGitHub {
     owner = "cp2k";
     repo = "dbcsr";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-BgZmc81TzgU3ifv4RHh2pfjbkUyxMIIpBrHCtnLF3p0=";
   };
 
+  patches = [
+    # Explicitly export the C API symbols, otherwise hidden with GCC 16
+    # https://github.com/cp2k/dbcsr/pull/1027
+    (fetchpatch {
+      name = "expose-c-api-procedures.patch";
+      url = "https://github.com/cp2k/dbcsr/commit/a5d9bcfcd487e3181b981687334da1b89bc61dce.patch";
+      hash = "sha256-a4glOtMx1EUzYdoQb66bZaRnCgatVFWTqvcQlvU3oIc=";
+    })
+  ];
+
   postPatch = ''
     patchShebangs .
-
-    # Force build of shared library, otherwise just static.
+  ''
+  # Force build of shared library, otherwise just static.
+  + ''
     substituteInPlace src/CMakeLists.txt \
-      --replace 'add_library(dbcsr ''${DBCSR_SRCS})' 'add_library(dbcsr SHARED ''${DBCSR_SRCS})' \
-      --replace 'add_library(dbcsr_c ''${DBCSR_C_SRCS})' 'add_library(dbcsr_c SHARED ''${DBCSR_C_SRCS})'
-
-    # Avoid calling the fypp wrapper script with python again. The nix wrapper took care of that.
+      --replace-fail \
+        'add_library(dbcsr ''${DBCSR_SRCS})' \
+        'add_library(dbcsr SHARED ''${DBCSR_SRCS})' \
+      --replace-fail \
+        'add_library(dbcsr_c ''${DBCSR_C_SRCS})' \
+        'add_library(dbcsr_c SHARED ''${DBCSR_C_SRCS})'
+  ''
+  # Avoid calling the fypp wrapper script with python again. The nix wrapper took care of that.
+  + ''
     substituteInPlace cmake/fypp-sources.cmake \
-      --replace 'COMMAND ''${Python_EXECUTABLE} ''${FYPP_EXECUTABLE}' 'COMMAND ''${FYPP_EXECUTABLE}'
+      --replace-fail \
+        'COMMAND ''${Python_EXECUTABLE} ''${FYPP_EXECUTABLE}' \
+        'COMMAND ''${FYPP_EXECUTABLE}'
   '';
 
   outputs = [
@@ -44,11 +72,12 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   nativeBuildInputs = [
-    gfortran
-    python3
     cmake
-    pkg-config
     fypp
+    gfortran
+    mpi
+    pkg-config
+    python3
   ];
 
   buildInputs = [
@@ -60,17 +89,17 @@ stdenv.mkDerivation (finalAttrs: {
   propagatedBuildInputs = [ mpi ];
 
   cmakeFlags = [
-    "-DUSE_OPENMP=ON"
-    "-DUSE_SMM=libxsmm"
-    "-DWITH_C_API=ON"
-    "-DBUILD_TESTING=ON"
-    "-DTEST_OMP_THREADS=2"
-    "-DTEST_MPI_RANKS=2"
-    "-DENABLE_SHARED=ON"
-    "-DUSE_MPI=ON"
+    (lib.cmakeBool "USE_OPENMP" true)
+    (lib.cmakeFeature "USE_SMM" "libxsmm")
+    (lib.cmakeBool "WITH_C_API" true)
+    (lib.cmakeBool "BUILD_TESTING" true)
+    (lib.cmakeFeature "TEST_OMP_THREADS" "2")
+    (lib.cmakeFeature "TEST_MPI_RANKS" "2")
+    (lib.cmakeBool "ENABLE_SHARED" true)
+    (lib.cmakeBool "USE_MPI" true)
   ];
 
-  checkInputs = [
+  nativeCheckInputs = [
     mpiCheckPhaseHook
   ];
 
@@ -80,6 +109,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Distributed Block Compressed Sparse Row matrix library";
     license = lib.licenses.gpl2Only;
     homepage = "https://github.com/cp2k/dbcsr";
+    changelog = "https://github.com/cp2k/dbcsr/releases/tag/${finalAttrs.src.tag}";
     maintainers = [ lib.maintainers.sheepforce ];
   };
 })

From c135c535f48bb5b8ccd53580c309cdad859db319 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 29 Sep 2026 12:53:18 +0000
Subject: [PATCH 28/39] copilot-language-server: 1.547.0 -> 1.551.2

---
 pkgs/by-name/co/copilot-language-server/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/co/copilot-language-server/package.nix b/pkgs/by-name/co/copilot-language-server/package.nix
index 9b8a3c25a982..f3c3afdf4874 100644
--- a/pkgs/by-name/co/copilot-language-server/package.nix
+++ b/pkgs/by-name/co/copilot-language-server/package.nix
@@ -13,14 +13,14 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "copilot-language-server";
-  version = "1.547.0";
+  version = "1.551.2";
 
   strictDeps = true;
   __structuredAttrs = true;
 
   src = fetchzip {
     url = "https://github.com/github/copilot-language-server-release/releases/download/${finalAttrs.version}/copilot-language-server-js-${finalAttrs.version}.zip";
-    hash = "sha256-JFAv+Trz8XUuk9x9ZXWINdfrZ8Mglwjy8ay/EX0gOPo=";
+    hash = "sha256-wDV1F8rzO49sp2XxcZdvwyWKSzu+2CWahZ2kLoVoGRE=";
     stripRoot = false;
   };
 

From f08680045cd5f5f1878ec8edef96c2496315e5b4 Mon Sep 17 00:00:00 2001
From: AlexAntonik <antonikavv@gmail.com>
Date: Tue, 29 Sep 2026 16:17:57 +0300
Subject: [PATCH 29/39] python3Packages.argos-translate-files: fix license

Signed-off-by: AlexAntonik <antonikavv@gmail.com>
---
 .../python-modules/argos-translate-files/default.nix            | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/argos-translate-files/default.nix b/pkgs/development/python-modules/argos-translate-files/default.nix
index 6003dd24a067..87c76ef7d43f 100644
--- a/pkgs/development/python-modules/argos-translate-files/default.nix
+++ b/pkgs/development/python-modules/argos-translate-files/default.nix
@@ -62,7 +62,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Translate files using Argos Translate";
     homepage = "https://www.argosopentech.com";
-    license = lib.licenses.mit;
+    license = lib.licenses.agpl3Only;
     maintainers = with lib.maintainers; [ misuzu ];
   };
 })

From 4f7be3c0a7c2a3b5598f35b69351bfd1a7876d3d Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Tue, 29 Sep 2026 11:21:13 +0000
Subject: [PATCH 30/39] plumed: cleanup

---
 pkgs/by-name/pl/plumed/package.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/by-name/pl/plumed/package.nix b/pkgs/by-name/pl/plumed/package.nix
index e0ea4f987d02..e7ef4568927c 100644
--- a/pkgs/by-name/pl/plumed/package.nix
+++ b/pkgs/by-name/pl/plumed/package.nix
@@ -3,6 +3,9 @@
   lib,
   fetchFromGitHub,
   blas,
+
+  # passthru
+  nix-update-script,
 }:
 
 assert !blas.isILP64;
@@ -11,6 +14,9 @@ stdenv.mkDerivation (finalAttrs: {
   pname = "plumed";
   version = "2.10.1";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   src = fetchFromGitHub {
     owner = "plumed";
     repo = "plumed2";
@@ -26,10 +32,15 @@ stdenv.mkDerivation (finalAttrs: {
 
   enableParallelBuilding = true;
 
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
   meta = {
     description = "Molecular metadynamics library";
     homepage = "https://github.com/plumed/plumed2";
     license = lib.licenses.lgpl3Only;
     maintainers = [ lib.maintainers.sheepforce ];
+    mainProgram = "plumed";
   };
 })

From 35364ec9c206ed1fc532f1d07913ae14d42ae4d1 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Tue, 29 Sep 2026 11:21:31 +0000
Subject: [PATCH 31/39] python3Packages.plumed: init at 2.10.1

---
 pkgs/by-name/pl/plumed/package.nix            |  5 ++
 .../python-modules/plumed/default.nix         | 58 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  4 ++
 3 files changed, 67 insertions(+)
 create mode 100644 pkgs/development/python-modules/plumed/default.nix

diff --git a/pkgs/by-name/pl/plumed/package.nix b/pkgs/by-name/pl/plumed/package.nix
index e7ef4568927c..a8cdeed578a2 100644
--- a/pkgs/by-name/pl/plumed/package.nix
+++ b/pkgs/by-name/pl/plumed/package.nix
@@ -5,6 +5,7 @@
   blas,
 
   # passthru
+  python3Packages,
   nix-update-script,
 }:
 
@@ -33,6 +34,10 @@ stdenv.mkDerivation (finalAttrs: {
   enableParallelBuilding = true;
 
   passthru = {
+    tests = {
+      pythonPackage = python3Packages.plumed;
+    };
+
     updateScript = nix-update-script { };
   };
 
diff --git a/pkgs/development/python-modules/plumed/default.nix b/pkgs/development/python-modules/plumed/default.nix
new file mode 100644
index 000000000000..327c41e6cc97
--- /dev/null
+++ b/pkgs/development/python-modules/plumed/default.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  plumed,
+
+  # build-system
+  cython,
+  setuptools,
+
+  # tests
+  numpy,
+  pandas,
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "plumed";
+  inherit (plumed) version src;
+  pyproject = true;
+  __structuredAttrs = true;
+
+  sourceRoot = "${finalAttrs.src.name}/python";
+
+  env = {
+    plumed_version = finalAttrs.version;
+    plumed_include_dir = "${lib.getDev plumed}/include/plumed/wrapper";
+
+    # Hardcode the path to the kernel so that PLUMED_KERNEL does not need to be set at runtime
+    plumed_default_kernel = "${lib.getLib plumed}/lib/libplumedKernel${stdenv.hostPlatform.extensions.sharedLibrary}";
+  };
+
+  build-system = [
+    cython
+    setuptools
+  ];
+
+  buildInputs = [
+    plumed
+  ];
+
+  pythonImportsCheck = [ "plumed" ];
+
+  nativeCheckInputs = [
+    numpy
+    pandas
+    pytestCheckHook
+  ];
+
+  enabledTestPaths = [ "test" ];
+
+  meta = {
+    description = "Python wrappers for plumed";
+    homepage = "https://github.com/plumed/plumed2/tree/master/python";
+    license = lib.licenses.lgpl3Plus;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 33a47ed0c3b5..fdd9d676c094 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -13804,6 +13804,10 @@ self: super: with self; {
 
   plumbum = callPackage ../development/python-modules/plumbum { };
 
+  plumed = callPackage ../development/python-modules/plumed {
+    inherit (pkgs) plumed;
+  };
+
   pluralizer = callPackage ../development/python-modules/pluralizer { };
 
   pluthon = callPackage ../development/python-modules/pluthon { };

From f584225bea576ebcbee92e01ddbc798f1763e1be Mon Sep 17 00:00:00 2001
From: Paulchen <lukas.23022005@gmail.com>
Date: Tue, 22 Sep 2026 16:27:54 +0200
Subject: [PATCH 32/39] cloudfoundry-cli: Add install check
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: Sandro Jäckel <sandro.jaeckel@gmail.com>
---
 pkgs/by-name/cl/cloudfoundry-cli/package.nix | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/pkgs/by-name/cl/cloudfoundry-cli/package.nix b/pkgs/by-name/cl/cloudfoundry-cli/package.nix
index 445753df03dc..6f6318caa2ec 100644
--- a/pkgs/by-name/cl/cloudfoundry-cli/package.nix
+++ b/pkgs/by-name/cl/cloudfoundry-cli/package.nix
@@ -4,6 +4,8 @@
   fetchFromGitHub,
   fetchurl,
   installShellFiles,
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
 }:
 
 buildGoModule (finalAttrs: {
@@ -42,6 +44,15 @@ buildGoModule (finalAttrs: {
     installShellCompletion --bash $bashCompletionScript
   '';
 
+  doInstallCheck = true;
+
+  versionCheckKeepEnvironment = [ "HOME" ];
+
+  nativeInstallCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ];
+
   meta = {
     description = "Official command line client for Cloud Foundry";
     homepage = "https://github.com/cloudfoundry/cli";

From 63d2c77f2c588221fcb6e3b56c18c94600f15e90 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 29 Sep 2026 13:31:19 +0000
Subject: [PATCH 33/39] ripwire: 0.6.1 -> 0.6.5

---
 pkgs/by-name/ri/ripwire/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ri/ripwire/package.nix b/pkgs/by-name/ri/ripwire/package.nix
index 8bba0f62dc78..87053062b64a 100644
--- a/pkgs/by-name/ri/ripwire/package.nix
+++ b/pkgs/by-name/ri/ripwire/package.nix
@@ -10,7 +10,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ripwire";
-  version = "0.6.1";
+  version = "0.6.5";
   __structuredAttrs = true;
   strictDeps = true;
 
@@ -18,7 +18,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "redhat-et";
     repo = "ripwire";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2a4J9lS0rdJyhkXkpQSkFrSf+NsMyeI2mJJNIYvgA8Y=";
+    hash = "sha256-6TeiT79KcEMhJI0HJIDTIOtrjmWgUxz8t8mkLpa2InQ=";
   };
 
   # Unvendor tree-sitter

From 7ef2bbcf984b4131ba12db524fa32abbe3dacd6f Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Tue, 29 Sep 2026 11:28:19 -0400
Subject: [PATCH 34/39] beamPackages.mixReleaseSetupHook: restore postFixup
 behavior and maintain perms

By moving to preFixup we exposed a bug where permissions, critically execute bit, were not maintained. This caused our logic to do the initial stripping of erlang store paths. Restore the original behavior by running these as postFixup, and also fix the bug by maintaining perms if we do indeed strip here.
---
 .../development/beam-modules/hooks/mix-release-setup-hook.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/beam-modules/hooks/mix-release-setup-hook.sh b/pkgs/development/beam-modules/hooks/mix-release-setup-hook.sh
index 81bd142fcc70..5057a1debade 100644
--- a/pkgs/development/beam-modules/hooks/mix-release-setup-hook.sh
+++ b/pkgs/development/beam-modules/hooks/mix-release-setup-hook.sh
@@ -54,6 +54,7 @@ mixReleaseRemoveErlangReferences() {
     # use bbe to substitute strings in binary files, because using substituteInPlace
     # on binaries will raise errors
     bbe -e "s|${erlang}/lib/erlang|$out|" -o "$file".tmp "$file"
+    chmod --reference="$file" "$file".tmp
     rm -f "$file"
     mv "$file".tmp "$file"
   done
@@ -75,11 +76,11 @@ mixReleaseStripDebugHook() {
 }
 
 if [ -z "${dontMixReleaseFixup-}" ]; then
-  preFixupHooks+=(mixReleaseFixupHook)
+  postFixupHooks+=(mixReleaseFixupHook)
 fi
 
 if [ -n "${removeCookie-1}" ]; then
-  preFixupHooks+=(mixReleaseRemoveCookieHook)
+  postFixupHooks+=(mixReleaseRemoveCookieHook)
 fi
 
 if [ -n "${stripDebug-}" ]; then

From 0c6fcccb3efeb05df6b4c68cd82c39e889b43ca6 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Tue, 29 Sep 2026 17:54:52 +0200
Subject: [PATCH 35/39] nix-fast-build: 2.0.3 -> 2.0.4

Diff: https://github.com/Mic92/nix-fast-build/compare/2.0.3...2.0.4

Changelog: https://github.com/Mic92/nix-fast-build/releases/tag/2.0.4
---
 pkgs/by-name/ni/nix-fast-build/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ni/nix-fast-build/package.nix b/pkgs/by-name/ni/nix-fast-build/package.nix
index 58e3db685e2c..6fe54a243187 100644
--- a/pkgs/by-name/ni/nix-fast-build/package.nix
+++ b/pkgs/by-name/ni/nix-fast-build/package.nix
@@ -9,7 +9,7 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "nix-fast-build";
-  version = "2.0.3";
+  version = "2.0.4";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -17,7 +17,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "Mic92";
     repo = "nix-fast-build";
     tag = finalAttrs.version;
-    hash = "sha256-L4HfADUq4Imq1LnvmjBPFBEAZAIKD9Pnj6ExRkVqHC4=";
+    hash = "sha256-sc/NZIHkRhgyAzK8Xn6G++vGrl/Uf7QHh+J5fnZ/o4s=";
   };
 
   build-system = [ python3Packages.setuptools ];

From cedecfdc860d21f1b7335bfc1523fc1d3ee59ed6 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Tue, 29 Sep 2026 17:56:57 +0200
Subject: [PATCH 36/39] frigate: fix audio-labelmap.txt path substitution

---
 pkgs/by-name/fr/frigate/package.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/fr/frigate/package.nix b/pkgs/by-name/fr/frigate/package.nix
index bdf4fb1931d4..d97e1be68719 100644
--- a/pkgs/by-name/fr/frigate/package.nix
+++ b/pkgs/by-name/fr/frigate/package.nix
@@ -141,7 +141,9 @@ python3Packages.buildPythonApplication (finalAttrs: {
       --replace-fail "/labelmap.txt" "${placeholder "out"}/share/frigate/labelmap.txt"
 
     substituteInPlace frigate/events/audio.py \
-      --replace-fail "/cpu_audio_model.tflite" "${frigate.models.tflite.yamnet_classification_v1.model}" \
+      --replace-fail "/cpu_audio_model.tflite" "${frigate.models.tflite.yamnet_classification_v1.model}"
+
+    substituteInPlace frigate/events/audio.py frigate/api/app.py \
       --replace-fail "/audio-labelmap.txt" "${placeholder "out"}/share/frigate/audio-labelmap.txt"
   '';
 

From 5facc1c50aa6ddcb95e198a369c52a46ce2b22bb Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Tue, 29 Sep 2026 11:01:44 -0500
Subject: [PATCH 37/39] vimPlugins.jsonfly-nvim: fix moved upstream repository

---
 pkgs/applications/editors/vim/plugins/generated.nix    | 9 +++++----
 pkgs/applications/editors/vim/plugins/vim-plugin-names | 2 +-
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 87cd750901e0..5d92af8b14da 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -8323,12 +8323,13 @@ final: prev: {
   jsonfly-nvim = buildVimPlugin {
     pname = "jsonfly.nvim";
     version = "0-unstable-2025-11-02";
-    src = fetchgit {
-      url = "https://git.myzel394.app/Myzel394/jsonfly.nvim";
+    src = fetchFromGitHub {
+      owner = "Myzel394";
+      repo = "jsonfly.nvim";
       rev = "3d58635cb195a5435743e7882c6ac7cff710204f";
-      hash = "sha256-bTh/6zmYQ+XqBsccKo8i149nU5bBfFv+8UKMayHIoo4=";
+      hash = "sha256-qTxLDQKqmsf/DrgzhfrmtY2LUVhPcGNFU/Iq4ew29lA=";
     };
-    meta.homepage = "https://git.myzel394.app/Myzel394/jsonfly.nvim";
+    meta.homepage = "https://github.com/Myzel394/jsonfly.nvim";
     meta.license = unfree;
     meta.hydraPlatforms = [ ];
   };
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 772ea9f1a312..127444c0ae14 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -592,7 +592,7 @@ https://github.com/HiPhish/jinja.vim/,,
 https://github.com/NicolasGB/jj.nvim/,,
 https://github.com/vito-c/jq.vim/,,
 https://github.com/neoclide/jsonc.vim/,,
-https://git.myzel394.app/Myzel394/jsonfly.nvim,,
+https://github.com/Myzel394/jsonfly.nvim/,,
 https://github.com/yannvanhalewyn/jujutsu.nvim/,,
 https://github.com/julelang/jule.nvim/,,
 https://github.com/JuliaEditorSupport/julia-vim/,,

From 72f14508e38b4e1323c902b7fb6fe87957b2e1ed Mon Sep 17 00:00:00 2001
From: Marie Ramlow <marie@marie.cologne>
Date: Tue, 29 Sep 2026 18:12:23 +0200
Subject: [PATCH 38/39] vimPlugins.direnv-nvim: init at 0-unstable-2026-06-28

https://github.com/NotAShelf/direnv.nvim
---
 .../applications/editors/vim/plugins/generated.nix | 14 ++++++++++++++
 .../editors/vim/plugins/vim-plugin-names           |  1 +
 2 files changed, 15 insertions(+)

diff --git a/pkgs/applications/editors/vim/plugins/generated.nix b/pkgs/applications/editors/vim/plugins/generated.nix
index 87cd750901e0..b715b345b60a 100644
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -5334,6 +5334,20 @@ final: prev: {
     meta.hydraPlatforms = [ ];
   };
 
+  direnv-nvim = buildVimPlugin {
+    pname = "direnv.nvim";
+    version = "0-unstable-2026-06-28";
+    src = fetchFromGitHub {
+      owner = "NotAShelf";
+      repo = "direnv.nvim";
+      rev = "9258f9f10c4c729d8296fce0e3ecb12543daad06";
+      hash = "sha256-b5PpmkYWaDGLNcu+36tRR5ycATHYBjs9WrV8/jfmooQ=";
+    };
+    meta.homepage = "https://github.com/NotAShelf/direnv.nvim/";
+    meta.license = getLicenseFromSpdxId "MPL-2.0";
+    meta.hydraPlatforms = [ ];
+  };
+
   direnv-vim = buildVimPlugin {
     pname = "direnv.vim";
     version = "0-unstable-2023-12-02";
diff --git a/pkgs/applications/editors/vim/plugins/vim-plugin-names b/pkgs/applications/editors/vim/plugins/vim-plugin-names
index 772ea9f1a312..eee3b05f32d0 100644
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -379,6 +379,7 @@ https://github.com/barrettruth/diffs.nvim/,,
 https://github.com/dlyongemallo/diffview-plus.nvim/,,
 https://github.com/sindrets/diffview.nvim/,,
 https://github.com/elihunter173/dirbuf.nvim/,,
+https://github.com/NotAShelf/direnv.nvim/,,
 https://github.com/direnv/direnv.vim/,,
 https://github.com/chipsenkbeil/distant.nvim/,,
 https://github.com/doki-theme/doki-theme-vim/,,

From 65fe9eae2b57c9cb7bfbe5f352944d01b5c5be0b Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Tue, 29 Sep 2026 16:35:15 +0000
Subject: [PATCH 39/39] cudaPackages.buildRedistHook: remove
 fixupPropagatedBuildOutputsForMultipleOutputs fix

---
 .../cuda-modules/buildRedist/buildRedistHook.bash | 15 +--------------
 1 file changed, 1 insertion(+), 14 deletions(-)

diff --git a/pkgs/development/cuda-modules/buildRedist/buildRedistHook.bash b/pkgs/development/cuda-modules/buildRedist/buildRedistHook.bash
index 2a2ca6d257a4..b4ff85f0a4c0 100644
--- a/pkgs/development/cuda-modules/buildRedist/buildRedistHook.bash
+++ b/pkgs/development/cuda-modules/buildRedist/buildRedistHook.bash
@@ -24,9 +24,6 @@ buildRedistHookRegistration() {
   postInstallCheckHooks+=(checkCudaNonEmptyOutputs)
   nixLog "added checkCudaNonEmptyOutputs to postInstallCheckHooks"
 
-  preFixupHooks+=(fixupPropagatedBuildOutputsForMultipleOutputs)
-  nixLog "added fixupPropagatedBuildOutputsForMultipleOutputs to preFixupHooks"
-
   postFixupHooks+=(fixupCudaPropagatedBuildOutputsToOut)
   nixLog "added fixupCudaPropagatedBuildOutputsToOut to postFixupHooks"
 
@@ -193,16 +190,6 @@ checkCudaHasStubsIffIncludeRemoveStubsFromRunpathHook() {
   return 0
 }
 
-# TODO(@connorbaker): https://github.com/NixOS/nixpkgs/issues/323126.
-# _multioutPropagateDev() currently expects a space-separated string rather than an array.
-# NOTE: Because _multioutPropagateDev is a postFixup hook, we correct it in preFixup.
-fixupPropagatedBuildOutputsForMultipleOutputs() {
-  nixLog "converting propagatedBuildOutputs to a space-separated string"
-  # shellcheck disable=SC2124
-  export propagatedBuildOutputs="${propagatedBuildOutputs[@]}"
-  return 0
-}
-
 # The multiple outputs setup hook only propagates build outputs to dev.
 # We want to propagate them to out as well, in case the user interpolates
 # the package into a string -- in such a case, the dev output is not selected
@@ -217,7 +204,7 @@ fixupCudaPropagatedBuildOutputsToOut() {
   mkdir -p "${out:?}/nix-support"
 
   # NOTE: We must use printWords to ensure the output is a single line.
-  for output in $propagatedBuildOutputs; do
+  for output in "${propagatedBuildOutputs[@]}"; do
     # Propagate the other components to the out output
     nixLog "adding ${!output:?} to propagatedBuildInputs of ${out:?}"
     printWords "${!output:?}" >>"${out:?}/nix-support/propagated-build-inputs"