From bbcb7d467ee67903744f6dc6b138a5e1a1644f64 Mon Sep 17 00:00:00 2001
From: ezratweaver <ezratweaver@gmail.com>
Date: Fri, 22 May 2026 02:04:42 -0400
Subject: [PATCH 01/31] adw-bluetooth: 1.0.0 -> 1.1.0

(cherry picked from commit 7d6b363b76905b6aea72e4313e82fe51c893470d)
---
 .../services/desktops/adw-bluetooth.nix       | 33 +++++++++++++++++++
 pkgs/by-name/ad/adw-bluetooth/package.nix     | 28 +++++++++++++---
 2 files changed, 56 insertions(+), 5 deletions(-)
 create mode 100644 nixos/modules/services/desktops/adw-bluetooth.nix

diff --git a/nixos/modules/services/desktops/adw-bluetooth.nix b/nixos/modules/services/desktops/adw-bluetooth.nix
new file mode 100644
index 000000000000..ab15b1cdfef4
--- /dev/null
+++ b/nixos/modules/services/desktops/adw-bluetooth.nix
@@ -0,0 +1,33 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.adw-bluetooth;
+in
+{
+  meta.maintainers = with lib.maintainers; [ ezratweaver ];
+
+  options.services.adw-bluetooth = {
+    enable = lib.mkEnableOption "Adwaita Bluetooth daemon";
+  };
+
+  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.adw-bluetooth ];
+    services.dbus.packages = [ pkgs.adw-bluetooth ];
+
+    systemd.user.services.adw-bluetooth-daemon = {
+      description = "AdwBluetooth Daemon";
+      wantedBy = [ "default.target" ];
+      after = [ "bluetooth.target" ];
+      serviceConfig = {
+        Type = "dbus";
+        BusName = "com.ezratweaver.AdwBluetoothDaemon";
+        ExecStart = "${pkgs.adw-bluetooth}/libexec/adw-bluetooth-daemon";
+      };
+    };
+  };
+}
diff --git a/pkgs/by-name/ad/adw-bluetooth/package.nix b/pkgs/by-name/ad/adw-bluetooth/package.nix
index fde7d2367c9a..f0b700ee9c9b 100644
--- a/pkgs/by-name/ad/adw-bluetooth/package.nix
+++ b/pkgs/by-name/ad/adw-bluetooth/package.nix
@@ -2,6 +2,7 @@
   stdenv,
   lib,
   fetchFromGitHub,
+  buildGoModule,
   meson,
   ninja,
   pkg-config,
@@ -13,17 +14,27 @@
   libadwaita,
 }:
 
-stdenv.mkDerivation (finalAttrs: {
-  pname = "adw-bluetooth";
-  version = "1.0.0";
+let
+  version = "1.1.0";
 
   src = fetchFromGitHub {
     owner = "ezratweaver";
     repo = "adw-bluetooth";
-    tag = finalAttrs.version;
-    hash = "sha256-/KJpB9i6tFDnB3C0tPtJtt8tTDfNftIkHmP1JSVSZNY=";
+    tag = version;
+    hash = "sha256-h3cHtecwBsx3j33qXVn/zaq4FZext71P7flzunCHqHg=";
   };
 
+  daemon = buildGoModule {
+    pname = "adw-bluetooth-daemon";
+    inherit version;
+    src = src + "/daemon";
+    vendorHash = "sha256-7tiSwNhq6e4LEh4lUkfh2i4tEdWWL6TxQpYYwYKsfog=";
+  };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "adw-bluetooth";
+  inherit version src;
+
   nativeBuildInputs = [
     meson
     ninja
@@ -39,6 +50,13 @@ stdenv.mkDerivation (finalAttrs: {
     libadwaita
   ];
 
+  mesonFlags = [ "-Dbuild_daemon=false" ];
+
+  postInstall = ''
+    mkdir -p $out/libexec
+    ln -s ${daemon}/bin/daemon $out/libexec/adw-bluetooth-daemon
+  '';
+
   meta = {
     description = "GNOME Inspired LibAdwaita Bluetooth Applet";
     homepage = "https://github.com/ezratweaver/adw-bluetooth";

From f11afdbc6b490f540f238ff244a39fb35b7b7e57 Mon Sep 17 00:00:00 2001
From: ezratweaver <ezratweaver@gmail.com>
Date: Fri, 22 May 2026 02:05:04 -0400
Subject: [PATCH 02/31] nixos/adw-bluetooth: init module

(cherry picked from commit a875214e7d216c7b8cad254361e76117ae7719e5)
---
 nixos/doc/manual/release-notes/rl-2605.section.md | 2 ++
 nixos/modules/module-list.nix                     | 1 +
 nixos/modules/services/desktops/adw-bluetooth.nix | 7 ++++---
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2605.section.md b/nixos/doc/manual/release-notes/rl-2605.section.md
index 30ed07c24604..4b5b1ec1f0f4 100644
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -78,6 +78,8 @@
 
 - [ImmichFrame](https://immichframe.dev/), display your photos from Immich as a digital photo frame. Available as [services.immichframe](#opt-services.immichframe.enable).
 
+- [adw-bluetooth](https://github.com/ezratweaver/adw-bluetooth), a GNOME-inspired LibAdwaita Bluetooth applet. Available as [services.adw-bluetooth](#opt-services.adw-bluetooth.enable).
+
 - [PdfDing](https://www.pdfding.com/), manage, view and edit your PDFs seamlessly on all your devices wherever you are. Available as [services.pdfding](#opt-services.pdfding.enable).
 
 - [mangowc](https://github.com/DreamMaoMao/mangowc), a lightweight and feature-rich Wayland compositor based on dwl. Available as [programs.mangowc](#opt-programs.mangowc.enable).
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index 83a7574f5a52..6134fee6a1ab 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -558,6 +558,7 @@
   ./services/databases/victoriametrics.nix
   ./services/databases/victoriatraces.nix
   ./services/desktops/accountsservice.nix
+  ./services/desktops/adw-bluetooth.nix
   ./services/desktops/ayatana-indicators.nix
   ./services/desktops/bamf.nix
   ./services/desktops/blueman.nix
diff --git a/nixos/modules/services/desktops/adw-bluetooth.nix b/nixos/modules/services/desktops/adw-bluetooth.nix
index ab15b1cdfef4..43c6cfe4e436 100644
--- a/nixos/modules/services/desktops/adw-bluetooth.nix
+++ b/nixos/modules/services/desktops/adw-bluetooth.nix
@@ -13,11 +13,12 @@ in
 
   options.services.adw-bluetooth = {
     enable = lib.mkEnableOption "Adwaita Bluetooth daemon";
+    package = lib.mkPackageOption pkgs "adw-bluetooth" { };
   };
 
   config = lib.mkIf cfg.enable {
-    environment.systemPackages = [ pkgs.adw-bluetooth ];
-    services.dbus.packages = [ pkgs.adw-bluetooth ];
+    environment.systemPackages = [ cfg.package ];
+    services.dbus.packages = [ cfg.package ];
 
     systemd.user.services.adw-bluetooth-daemon = {
       description = "AdwBluetooth Daemon";
@@ -26,7 +27,7 @@ in
       serviceConfig = {
         Type = "dbus";
         BusName = "com.ezratweaver.AdwBluetoothDaemon";
-        ExecStart = "${pkgs.adw-bluetooth}/libexec/adw-bluetooth-daemon";
+        ExecStart = "${cfg.package}/libexec/adw-bluetooth-daemon";
       };
     };
   };

From 3d96bb1c322e767f91883b84d90c082d3cd31116 Mon Sep 17 00:00:00 2001
From: BatteredBunny <ayes2022@protonmail.com>
Date: Wed, 1 Jul 2026 19:20:15 +0300
Subject: [PATCH 03/31] electron-mail: 5.3.7 -> 5.3.8

(cherry picked from commit 1b42ae4853d39d21c330be9cfd701add226e85e7)
---
 pkgs/by-name/el/electron-mail/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/el/electron-mail/package.nix b/pkgs/by-name/el/electron-mail/package.nix
index 22ed742e22d5..335241bfcf75 100644
--- a/pkgs/by-name/el/electron-mail/package.nix
+++ b/pkgs/by-name/el/electron-mail/package.nix
@@ -10,20 +10,20 @@
 
 let
   pname = "electron-mail";
-  version = "5.3.7";
+  version = "5.3.8";
 
   sources = {
     x86_64-linux = fetchurl {
       url = "https://github.com/vladimiry/ElectronMail/releases/download/v${version}/electron-mail-${version}-linux-x86_64.AppImage";
-      hash = "sha256-VJbCQ/4yIuBE4NPDFUbp8t2G/QjUclphH/MghvamDVo=";
+      hash = "sha256-twqB1D3zLlZJuxQWD4dGF70w57yYv6i3abGBidERsss=";
     };
     aarch64-darwin = fetchurl {
       url = "https://github.com/vladimiry/ElectronMail/releases/download/v${version}/electron-mail-${version}-mac-arm64.dmg";
-      hash = "sha256-ulB+dlp6ZBhcBJiLY4k+E/oEWy9XSIuIzd5rTzEq9+4=";
+      hash = "sha256-V32Wi0oCU9dLfzqxg3OdseiILX7wPiBGNz7KuG0vlZY=";
     };
     x86_64-darwin = fetchurl {
       url = "https://github.com/vladimiry/ElectronMail/releases/download/v${version}/electron-mail-${version}-mac-x64.dmg";
-      hash = "sha256-LbAqUj34m8qSq8sQ1xgCQj9+MfJHoFDRMq+/waMKtzM=";
+      hash = "sha256-I1UvFMSdAwkqgkhn+mkBGslA8v+VTajO/Za0lJ5uYZ8=";
     };
   };
 

From e8f498bc47ecc268978488864fc7a33bf381cc52 Mon Sep 17 00:00:00 2001
From: George Huebner <ghuebner@anduril.com>
Date: Tue, 16 Jun 2026 10:35:23 -0700
Subject: [PATCH 04/31] xquartz: properly replace X utility paths

(cherry picked from commit e53453bc1bb2ba77b8fb70ed6a3a093d0ae6dc0f)
---
 pkgs/by-name/xq/xquartz/package.nix | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/xq/xquartz/package.nix b/pkgs/by-name/xq/xquartz/package.nix
index a3a33b92d458..008e213e97e4 100644
--- a/pkgs/by-name/xq/xquartz/package.nix
+++ b/pkgs/by-name/xq/xquartz/package.nix
@@ -240,12 +240,12 @@ stdenv.mkDerivation {
     cp ${fontsConf} $fontsConfPath
 
     substituteInPlace $out/bin/startx \
-      --replace "bindir=${xinit}/bin" "bindir=$out/bin" \
-      --replace 'defaultserver=${xorg-server}/bin/X' "defaultserver=$out/bin/Xquartz" \
-      --replace "${xinit}" "$out" \
-      --replace "${xorg-server}" "$out" \
-      --replace "eval xinit" "eval $out/bin/xinit" \
-      --replace "sysclientrc=/etc/X11/xinit/xinitrc" "sysclientrc=$out/etc/X11/xinit/xinitrc"
+      --replace-fail "${xinit}" "$out" \
+      --replace-fail "xserver=\"${xorg-server}/bin/X\"" "xserver=\"$out/bin/Xquartz\"" \
+      --replace-fail 'xinit="xinit"' "xinit=$out/bin/xinit" \
+      --replace-fail '"xauth"' "${lib.getExe xauth}" \
+      --replace-fail "xauth " '"$xauth" ' \
+      --replace-fail "sysclientrc=/etc/X11/xinit/xinitrc" "sysclientrc=$out/etc/X11/xinit/xinitrc"
 
     wrapProgram $out/bin/Xquartz \
       --set XQUARTZ_APP $out/Applications/XQuartz.app
@@ -262,9 +262,9 @@ stdenv.mkDerivation {
     EOF
 
     substituteInPlace $out/etc/X11/xinit/xinitrc \
-      --replace ${xinit} $out \
-      --replace xmodmap ${xmodmap}/bin/xmodmap \
-      --replace xrdb ${xrdb}/bin/xrdb
+      --replace-fail ${xinit} $out \
+      --replace-fail '"xmodmap"' ${xmodmap}/bin/xmodmap \
+      --replace-fail '"xrdb"' ${xrdb}/bin/xrdb
 
     mkdir -p $out/etc/X11/xinit/xinitrc.d
 
@@ -281,7 +281,7 @@ stdenv.mkDerivation {
     chmod +x $out/etc/X11/xinit/xinitrc.d/99-quartz-wm.sh
 
     substituteInPlace $out/etc/X11/xinit/privileged_startx.d/20-font_cache \
-      --replace ${xinit} $out
+      --replace-fail ${xinit} $out
 
     cp ${./font_cache} $out/bin/font_cache
     substituteInPlace $out/bin/font_cache \

From d8d4551aa15e1bb87c4f0bfc62d1d3ca9e1190bf Mon Sep 17 00:00:00 2001
From: George Huebner <ghuebner@anduril.com>
Date: Tue, 16 Jun 2026 10:35:23 -0700
Subject: [PATCH 05/31] xorg-server: enable SECURITY module on darwin

This is required for `ssh -X` to work properly.

(cherry picked from commit eb4202e42878c3674857e2d85da9f6d5edd7c129)
---
 pkgs/by-name/xo/xorg-server/package.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/by-name/xo/xorg-server/package.nix b/pkgs/by-name/xo/xorg-server/package.nix
index 01e8f819be54..8c8beda35e34 100644
--- a/pkgs/by-name/xo/xorg-server/package.nix
+++ b/pkgs/by-name/xo/xorg-server/package.nix
@@ -152,8 +152,7 @@ stdenv.mkDerivation (finalAttrs: {
     "-Dxkb_bin_dir=${xkbcomp}/bin"
     "-Dxkb_dir=${xkeyboard-config}/share/X11/xkb"
     "-Dxkb_output_dir=$out/share/X11/xkb/compiled"
-  ]
-  ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
+
     "-Dxcsecurity=true"
   ]
   ++ lib.optionals stdenv.hostPlatform.isDarwin [

From 4a35131769a3c06c37232d60a1c3f1eb37392377 Mon Sep 17 00:00:00 2001
From: George Huebner <ghuebner@anduril.com>
Date: Tue, 16 Jun 2026 10:35:24 -0700
Subject: [PATCH 06/31] xorg-server: disable false positive buffer overrun
 check

The bounds checks introduced by `-D_FORTIFY_SOURCE=2` in functions
like `strlcpy` interact poorly with data structures that treat fixed
sized arrays as flexible arrays (e.g. `struct sockaddr`).  This bug
manifested as an endless crashloop in XQuartz.

See also https://github.com/llvm/llvm-project/issues/29694

(cherry picked from commit 44f293318432773f7f200d3e5440d75e2ede37bf)
---
 pkgs/by-name/xo/xorg-server/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/xo/xorg-server/package.nix b/pkgs/by-name/xo/xorg-server/package.nix
index 8c8beda35e34..25dd29a82489 100644
--- a/pkgs/by-name/xo/xorg-server/package.nix
+++ b/pkgs/by-name/xo/xorg-server/package.nix
@@ -176,6 +176,9 @@ stdenv.mkDerivation (finalAttrs: {
       --subst-var-by XQUARTZ_APP "$out/Applications/XQuartz.app"
   '';
 
+  # avoid linux rebuilds
+  ${if stdenv.hostPlatform.isDarwin then "hardeningDisable" else null} = [ "strictflexarrays1" ];
+
   # default X install symlinks this to Xorg, we want XQuartz
   postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
     ln -sf $out/bin/Xquartz $out/bin/X

From 2c123639c34cf0246663d7a1aa0b8d09a2c0e385 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 11 Jun 2026 02:10:27 +0000
Subject: [PATCH 07/31] gh: 2.93.0 -> 2.94.0

(cherry picked from commit e1e8cb3e58be8cc9e1b064a816e19e5d47e5e25c)
---
 pkgs/by-name/gh/gh/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gh/gh/package.nix b/pkgs/by-name/gh/gh/package.nix
index 75907d8c9ea5..d03d00f150f0 100644
--- a/pkgs/by-name/gh/gh/package.nix
+++ b/pkgs/by-name/gh/gh/package.nix
@@ -10,7 +10,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "gh";
-  version = "2.93.0";
+  version = "2.94.0";
 
   __structuredAttrs = true;
 
@@ -18,10 +18,10 @@ buildGoModule (finalAttrs: {
     owner = "cli";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-r/+JFdMOUIb32St+VkUw+Q7Lb2L6IiPczmONFE4hwDw=";
+    hash = "sha256-wv9hMep8dDKKpqzNI5We6KThOFX82ppzvkoGyhY21pk=";
   };
 
-  vendorHash = "sha256-eMPcla1XKfq+zBb633Zz4cn820FWuEaRrXQJ1TQ8Lkg=";
+  vendorHash = "sha256-sRpHQTJNDPVe1jaLO9zMqtIMDE6JQB3vUL7AMxlcnJA=";
 
   nativeBuildInputs = [
     installShellFiles

From ffc2840633b84702afb8a6d97cc5ee43e6cdb910 Mon Sep 17 00:00:00 2001
From: yvnth <yvnth@users.noreply.github.com>
Date: Fri, 19 Jun 2026 19:50:04 +0530
Subject: [PATCH 08/31] gh: 2.94.0 -> 2.95.0

(cherry picked from commit 8009e39e93e71b2bfa1c0bee2c9b108b8c30272a)
---
 pkgs/by-name/gh/gh/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gh/gh/package.nix b/pkgs/by-name/gh/gh/package.nix
index d03d00f150f0..d1acb9b209b7 100644
--- a/pkgs/by-name/gh/gh/package.nix
+++ b/pkgs/by-name/gh/gh/package.nix
@@ -10,7 +10,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "gh";
-  version = "2.94.0";
+  version = "2.95.0";
 
   __structuredAttrs = true;
 
@@ -18,10 +18,10 @@ buildGoModule (finalAttrs: {
     owner = "cli";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wv9hMep8dDKKpqzNI5We6KThOFX82ppzvkoGyhY21pk=";
+    hash = "sha256-Hzdod8dJuwFv3mNa4Nflqf8uy45RpoeO93sFSMq3D5E=";
   };
 
-  vendorHash = "sha256-sRpHQTJNDPVe1jaLO9zMqtIMDE6JQB3vUL7AMxlcnJA=";
+  vendorHash = "sha256-tqbo791t7phe6ip5UzBiLer0rGcKqpKGF0bqwxr3j78=";
 
   nativeBuildInputs = [
     installShellFiles

From a0b4d72b2d3150bfbc916d8980d1f43550c92ff7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 3 Jul 2026 01:20:29 +0000
Subject: [PATCH 09/31] gh: 2.95.0 -> 2.96.0

(cherry picked from commit 7493c1c27d300414314aaffd48bddbbdd40a187e)
---
 pkgs/by-name/gh/gh/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gh/gh/package.nix b/pkgs/by-name/gh/gh/package.nix
index d1acb9b209b7..6e4bbbbc4380 100644
--- a/pkgs/by-name/gh/gh/package.nix
+++ b/pkgs/by-name/gh/gh/package.nix
@@ -10,7 +10,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "gh";
-  version = "2.95.0";
+  version = "2.96.0";
 
   __structuredAttrs = true;
 
@@ -18,10 +18,10 @@ buildGoModule (finalAttrs: {
     owner = "cli";
     repo = "cli";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Hzdod8dJuwFv3mNa4Nflqf8uy45RpoeO93sFSMq3D5E=";
+    hash = "sha256-+Roh0eR3Cm+ktLRHwWkvTiEvMGxsj7ngODJnjajL2x4=";
   };
 
-  vendorHash = "sha256-tqbo791t7phe6ip5UzBiLer0rGcKqpKGF0bqwxr3j78=";
+  vendorHash = "sha256-pQNepOGVEHF8rwdgnaUCnFe/mzDxabYqhouN2V0WkOo=";
 
   nativeBuildInputs = [
     installShellFiles

From 2759ab2a0014f15d60eddfe4892952da2e5cf5aa Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 29 Jun 2026 22:06:06 +0000
Subject: [PATCH 10/31] mattermostLatest: 11.8.1 -> 11.8.2

(cherry picked from commit e1a4f68f2ae09dcb313677c27928a0972cfd16ad)
---
 pkgs/by-name/ma/mattermostLatest/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ma/mattermostLatest/package.nix b/pkgs/by-name/ma/mattermostLatest/package.nix
index e0fd905a82d2..e98f1f7032b5 100644
--- a/pkgs/by-name/ma/mattermostLatest/package.nix
+++ b/pkgs/by-name/ma/mattermostLatest/package.nix
@@ -15,10 +15,10 @@ mattermost.override (
       # and make sure the version regex is up to date here.
       # Ensure you also check ../mattermost/package.nix for ESR releases.
       regex = "^v(11\\.[0-9]+\\.[0-9]+)$";
-      version = "11.8.1";
-      srcHash = "sha256-9EIbTwnEeZQKg5uixkMp3sp/n+9I2N9W7hxsW5juF3M=";
+      version = "11.8.2";
+      srcHash = "sha256-XZ4yr7nbGum6UQaBjze50L8Yc/MLjo4NQBh263CNRtI=";
       vendorHash = "sha256-F2QMrLbio7812ZTGQZZPTqHWtIXbwbDmjUhtvv0DJ9s=";
-      npmDepsHash = "sha256-9GRM0VXrh1eR16ocSGEV/F2eflOflzkhrhRRnm9uB6s=";
+      npmDepsHash = "sha256-WIPLpi6lQvq9wieqvOACiRh7v1znxzcf+jyKXSjWzNc=";
       autoUpdate = ./package.nix;
     };
   }

From a2461c700f45071fc125668b362154f0ac267c54 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Fri, 3 Jul 2026 04:51:46 -0700
Subject: [PATCH 11/31] mattermostLatest: don't test unofficial patches

Warn if the user tries to enable them, and disable them in tests because
it's too much work to maintain them.

(cherry picked from commit eb435dcd1f5bbbcbcdc72a77ecc9cb99f04dc5b1)
---
 nixos/tests/mattermost/default.nix     | 7 +------
 pkgs/by-name/ma/mattermost/package.nix | 5 +++++
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/nixos/tests/mattermost/default.nix b/nixos/tests/mattermost/default.nix
index 075781583c00..1fd46f19abfa 100644
--- a/nixos/tests/mattermost/default.nix
+++ b/nixos/tests/mattermost/default.nix
@@ -66,12 +66,7 @@ import ../make-test-python.nix (
 
             # Upgrade to the latest Mattermost.
             specialisation.latest.configuration = {
-              services.mattermost.package = lib.mkForce (
-                pkgs.mattermostLatest.override {
-                  removeFreeBadge = true;
-                  removeUserLimit = true;
-                }
-              );
+              services.mattermost.package = lib.mkForce pkgs.mattermostLatest;
               system.stateVersion = lib.mkVMOverride (lib.versions.majorMinor lib.version);
             };
           }
diff --git a/pkgs/by-name/ma/mattermost/package.nix b/pkgs/by-name/ma/mattermost/package.nix
index d241c440c42a..077e35239ed7 100644
--- a/pkgs/by-name/ma/mattermost/package.nix
+++ b/pkgs/by-name/ma/mattermost/package.nix
@@ -35,6 +35,11 @@
   ...
 }:
 
+assert lib.warnIf (latestVersionInfo != null && (removeUserLimit || removeFreeBadge)) ''
+  The user limit and free badge patches are not tested with this Mattermost version
+  (${latestVersionInfo.version}).
+'' true;
+
 let
   /*
     Helper function that sets the `withTests` and `withoutTests` passthru correctly,

From 14bf0e2d25b0bfe72743f49c3df0226666cc590d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?W=C3=B6lfchen?= <w-lfchen@posteo.net>
Date: Fri, 3 Jul 2026 12:48:16 +0200
Subject: [PATCH 12/31] obsidian: drop electron version pin

(cherry picked from commit 276f50ae6695bf6258907dea1e826a8f6c959135)
---
 pkgs/by-name/ob/obsidian/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ob/obsidian/package.nix b/pkgs/by-name/ob/obsidian/package.nix
index d18f4f243409..ba5471ecedf0 100644
--- a/pkgs/by-name/ob/obsidian/package.nix
+++ b/pkgs/by-name/ob/obsidian/package.nix
@@ -3,7 +3,7 @@
   fetchurl,
   lib,
   makeWrapper,
-  electron_40, # see https://github.com/NixOS/nixpkgs/pull/521495
+  electron,
   makeDesktopItem,
   imagemagick,
   asar,
@@ -102,7 +102,7 @@ let
         --replace-fail "supportFetchAPI: true," "supportFetchAPI: true, corsEnabled: true,"
       asar pack app-src resources/app.asar
 
-      makeWrapper ${electron_40}/bin/electron $out/bin/obsidian \
+      makeWrapper ${electron}/bin/electron $out/bin/obsidian \
         --add-flags $out/share/obsidian/app.asar \
         --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform=wayland --enable-wayland-ime=true --wayland-text-input-version=3}}" \
         --add-flags ${lib.escapeShellArg commandLineArgs}

From 5f771633cfc95e22e45c7def132f55ca7798204c Mon Sep 17 00:00:00 2001
From: "[Assassin]" <ShyAssassin@assassin.dev>
Date: Thu, 2 Jul 2026 20:39:17 +0200
Subject: [PATCH 13/31] vrcx: Use electron 41

(cherry picked from commit 2bfec9251e5871b424c879531e4763ad6fbc51dd)
---
 pkgs/by-name/vr/vrcx/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vr/vrcx/package.nix b/pkgs/by-name/vr/vrcx/package.nix
index 08d7785d22c2..2db225e37a5f 100644
--- a/pkgs/by-name/vr/vrcx/package.nix
+++ b/pkgs/by-name/vr/vrcx/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   nodejs_24,
-  electron_40,
+  electron_41,
   makeWrapper,
   fetchFromGitHub,
   buildNpmPackage,
@@ -13,7 +13,7 @@
 }:
 let
   node = nodejs_24;
-  electron = electron_40;
+  electron = electron_41;
   dotnet = dotnetCorePackages.dotnet_9;
 in
 buildNpmPackage (finalAttrs: {

From 400f2e0dbcc3076141c96f49187514dc1f2baada Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Fri, 3 Jul 2026 19:55:59 +0200
Subject: [PATCH 14/31] mastodon: 4.6.2 -> 4.6.3

changelog: https://github.com/mastodon/mastodon/releases/tag/v4.6.3

diff: https://github.com/mastodon/mastodon/compare/v4.6.2...v4.6.3
(cherry picked from commit efe13f56f7a1b9b16b4748360865e63cf270991a)
---
 pkgs/by-name/ma/mastodon/gemset.nix | 8 ++++----
 pkgs/by-name/ma/mastodon/source.nix | 4 ++--
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/ma/mastodon/gemset.nix b/pkgs/by-name/ma/mastodon/gemset.nix
index 9e0500f11092..d2e16e05e7fa 100644
--- a/pkgs/by-name/ma/mastodon/gemset.nix
+++ b/pkgs/by-name/ma/mastodon/gemset.nix
@@ -804,10 +804,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0pfl5c0pyqaparxaqxi6s4gfl21bdldwiawrc0aknyvflli60lfw";
+      sha256 = "15djj19ynz3sbw54fsf8n7y3sha8a333f2mgvjfwhr46jhcqg1ll";
       type = "gem";
     };
-    version = "1.0.6";
+    version = "1.0.7";
   };
   css_parser = {
     dependencies = [
@@ -2274,10 +2274,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0v68nyl07xira30iyhn3118a4g59ar5748laq0cx2pwnsdy7ivrz";
+      sha256 = "18g6ps30z6m365bly7sfialavnsf6m6qamdxsr84w96k51j4mnlb";
       type = "gem";
     };
-    version = "1.8.1";
+    version = "1.8.3";
   };
   multi_json = {
     groups = [ "default" ];
diff --git a/pkgs/by-name/ma/mastodon/source.nix b/pkgs/by-name/ma/mastodon/source.nix
index dc6982dca446..7d292595b1b4 100644
--- a/pkgs/by-name/ma/mastodon/source.nix
+++ b/pkgs/by-name/ma/mastodon/source.nix
@@ -5,14 +5,14 @@
   patches ? [ ],
 }:
 let
-  version = "4.6.2";
+  version = "4.6.3";
 in
 applyPatches {
   src = fetchFromGitHub {
     owner = "mastodon";
     repo = "mastodon";
     rev = "v${version}";
-    hash = "sha256-RA9yGmWyzwiD/skPxOB27hqRxMqKGFmMMDOvHR5FjqI=";
+    hash = "sha256-NMeI8Ev0CSIf0dfbjqVAmFuTU9MFC8Y3qO9gI3p8Y+4=";
     passthru = {
       inherit version;
       yarnHash = "sha256-G1keSWDDpp0vBAOqQI8y8n7bmAeo9Hrdbo7R+cVZQwE=";

From 517835d82d1a6a7a4cb0970e915caaa6222267e0 Mon Sep 17 00:00:00 2001
From: Bryan Lai <bryanlais@gmail.com>
Date: Thu, 14 May 2026 00:12:00 +0800
Subject: [PATCH 15/31] wol: fix clang build with gnu17 flag

Co-authored-by: dotlambda <github@dotlambda.de>
(cherry picked from commit 509a095d5fc707730cd25cea36fbadb8712da488)
---
 pkgs/by-name/wo/wol/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/wo/wol/package.nix b/pkgs/by-name/wo/wol/package.nix
index f1fc0f08c67d..ba903ed75cdf 100644
--- a/pkgs/by-name/wo/wol/package.nix
+++ b/pkgs/by-name/wo/wol/package.nix
@@ -21,6 +21,11 @@ stdenv.mkDerivation (finalAttrs: {
     ./macos-10_7-getline.patch
   ];
 
+  env = lib.optionalAttrs stdenv.cc.isClang {
+    # wol's bundled gettext sources do not compile as gnu23 with clang.
+    NIX_CFLAGS_COMPILE = "-std=gnu17";
+  };
+
   nativeBuildInputs = [
     perl # for pod2man in order to get a manpage
     autoreconfHook # for the patch

From 54ed788545c0ff55618427bb0305371d8a814183 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 28 Jun 2026 14:35:08 +0000
Subject: [PATCH 16/31] modrinth-app-unwrapped: 0.14.8 -> 0.15.1

(cherry picked from commit e179f51ea761ed3bad9e58e1350ff80945ea4c49)
---
 pkgs/by-name/mo/modrinth-app-unwrapped/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix b/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
index 6cb63b4bba03..287ed23699bb 100644
--- a/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
+++ b/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
@@ -31,13 +31,13 @@ in
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "modrinth-app-unwrapped";
-  version = "0.14.8";
+  version = "0.15.1";
 
   src = fetchFromGitHub {
     owner = "modrinth";
     repo = "code";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-s34vmm0Apy20FrfSjESXtj+uggvr4ODpOrxfapAKtlc=";
+    hash = "sha256-kF808vT/CO1Aklv+P23GWdxSBqDshFphL8hx0PYSgQk=";
   };
 
   patches = [
@@ -67,7 +67,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail '1.0.0-local' '${finalAttrs.version}'
   '';
 
-  cargoHash = "sha256-JU8QhdDikqe9a/MXVe2jSsXATvwdgpyjWr7pV/75C9E=";
+  cargoHash = "sha256-GQmhyTGN+MItwQEVyZ5Ai0cowvOxp++THuSrXsrRG1A=";
 
   mitmCache = gradle.fetchDeps {
     inherit (finalAttrs) pname;

From fd8e6b240246b28c29cdb60274da9ff15b28f5df Mon Sep 17 00:00:00 2001
From: coolcuber <rpgeorg@clemson.edu>
Date: Thu, 2 Jul 2026 23:40:45 -0400
Subject: [PATCH 17/31] xaos: fix desktop file install

(cherry picked from commit 95533ecf3d93fba9749df4808c2bf8ab6d12a904)
---
 pkgs/by-name/xa/xaos/package.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/xa/xaos/package.nix b/pkgs/by-name/xa/xaos/package.nix
index 23541c81ea66..7561b57d19a2 100644
--- a/pkgs/by-name/xa/xaos/package.nix
+++ b/pkgs/by-name/xa/xaos/package.nix
@@ -28,6 +28,8 @@ stdenv.mkDerivation (finalAttrs: {
     qt6.qmake
     qt6.qttools
     qt6.wrapQtAppsHook
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
     copyDesktopItems
   ];
 
@@ -53,7 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
         "QMAKE_APPLE_DEVICE_ARCHS = ${if stdenv.hostPlatform.isAarch64 then "arm64" else "x86_64"}"
   '';
 
-  desktopItems = [ "xdg/xaos.desktop" ];
+  desktopItems = [ "xdg/io.github.xaos_project.XaoS.desktop" ];
 
   postInstall = ''
     mkdir -p "${datapath}"

From 1cf4918ad85e6a94830c8f037cbe1f495f8a9117 Mon Sep 17 00:00:00 2001
From: Morgan Jones <me@numin.it>
Date: Fri, 3 Jul 2026 01:00:05 -0700
Subject: [PATCH 18/31] asn1c: 0.9.28 -> 0.9.29

(cherry picked from commit afacd7d03f3cae63600e09277e4d9b7735514a53)
---
 pkgs/by-name/as/asn1c/package.nix | 45 ++++++++++++++++++++++++-------
 1 file changed, 35 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/as/asn1c/package.nix b/pkgs/by-name/as/asn1c/package.nix
index 1072090c2112..9f07efcb9169 100644
--- a/pkgs/by-name/as/asn1c/package.nix
+++ b/pkgs/by-name/as/asn1c/package.nix
@@ -1,39 +1,64 @@
 {
   lib,
   stdenv,
-  fetchurl,
+  autoreconfHook,
+  versionCheckHook,
+  fetchFromGitHub,
   perl,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "asn1c";
-  version = "0.9.28";
+  version = "0.9.29";
 
-  src = fetchurl {
-    url = "https://lionet.info/soft/asn1c-${finalAttrs.version}.tar.gz";
-    hash = "sha256-gAdEC2R+8t2ftz2THDOsEXZOavskN9vmOLtOX8gjhrk=";
+  src = fetchFromGitHub {
+    owner = "vlm";
+    repo = "asn1c";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ms4+tzlVdV0pVGhdBod8sepjHGS4OVxJb3HdrFKv9Cc=";
   };
 
   outputs = [
     "out"
     "doc"
     "man"
+
+    # for the one perl utility
+    "crfc2asn1"
+  ];
+
+  postPatch = ''
+    patchShebangs examples/crfc2asn1.pl
+  '';
+
+  nativeBuildInputs = [
+    autoreconfHook
+    versionCheckHook
   ];
 
   buildInputs = [ perl ];
 
-  preConfigure = ''
-    patchShebangs examples/crfc2asn1.pl
-  '';
+  enableParallelBuilding = true;
 
   postInstall = ''
     cp -r skeletons/standard-modules $out/share/asn1c
   '';
 
-  doCheck = true;
+  # Barely anyone uses this, so make it a split-output
+  # so we don't carry the dependency on perl into bin.
+  postFixup = ''
+    mkdir -p $crfc2asn1/bin
+    mv $out/bin/crfc2asn1.pl $crfc2asn1/bin/crfc2asn1
+  '';
+
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
 
   meta = {
-    homepage = "http://lionet.info/asn1c/compiler.html";
+    mainProgram = "asn1c";
+    homepage = "https://lionet.info/asn1c/compiler.html";
     description = "Open Source ASN.1 Compiler";
     license = lib.licenses.bsd2;
     platforms = lib.platforms.unix;

From 73fcea124c8af970128ab3454a2e4814ad01f7c9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 3 Jul 2026 22:57:21 +0000
Subject: [PATCH 19/31] thunderbird-latest-unwrapped: 152.0 -> 152.0.1

(cherry picked from commit 110fec6e02f263fdaf23c16e84e876aec8c70fe3)
---
 .../networking/mailreaders/thunderbird/packages.nix           | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index f09df527aea4..6bcf1dcc1c68 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -77,8 +77,8 @@ rec {
   thunderbird = thunderbird-latest;
 
   thunderbird-latest = common {
-    version = "152.0";
-    sha512 = "51b950af634e7c7dfb7c043d69f925ed6d50d4c44341761e7e3ef02d5db28d2c539cd8d9286195e3facf84869f57b12a58760105b5195c449b4e1e4c9b6200d2";
+    version = "152.0.1";
+    sha512 = "f66c87de4dd73c3c45e420a55d76c3cb6ac091a61794ccf58ba59d1a40cf8001dee19a6a7f4c6bef7d36ea94ed4e4f677449d3006b2004abbd3fab42ad1c9228";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-latest";

From 96d5ebc8c2e94a4ad2685ecca393e98ad6d9dca4 Mon Sep 17 00:00:00 2001
From: adisbladis <adisbladis@gmail.com>
Date: Sun, 16 Nov 2025 21:14:20 +1300
Subject: [PATCH 20/31] lib.sources.sourceByGlobs: init function

Adds a source filtering function inspired by [doublestar](https://github.com/bmatcuk/doublestar).

This has been in used in a few private repositories since the last ~6 months with success.

- Testing

This was originally tested with the nix-unit testsuite:
```
let
  inherit (import ./internal.nix) mkSourceFilter mkMatcher;
in
{
  mkMatcher = {
    empty = {
      testMatch = {
        expr = mkMatcher "" "" "regular";
        expected = true;
      };

      testNoMatch = {
        expr = mkMatcher "" "foo" "regular";
        expected = false;
      };
    };

    simple = {
      testMatch = {
        expr = mkMatcher "foo" "foo" "regular";
        expected = true;
      };

      testNoMatch = {
        expr = mkMatcher "foo" "bar" "regular";
        expected = false;
      };
    };

    singleStar = {
      testMatch = {
        expr = mkMatcher "*.js" "foo.js" "regular";
        expected = true;
      };

      testNoMatch = {
        expr = mkMatcher "*.js" "foo.py" "regular";
        expected = false;
      };
    };

    doubleStar = {
      testMatch = {
        expr = mkMatcher "foo/**/bar" "foo/baz/bar" "regular";
        expected = true;
      };

      testNoMatch = {
        expr = mkMatcher "foo/**/bar" "foo/bar/baz" "regular";
        expected = false;
      };

      testMultiMatch = {
        expr = mkMatcher "foo/**/bar" "foo/baz/xyz/bar" "regular";
        expected = true;
      };

      testMultiMatchDoubleGlob = {
        expr = mkMatcher "foo/**/**/bar" "foo/baz/xyz/bar" "regular";
        expected = true;
      };

      testInfixMatch = {
        expr = mkMatcher "foo/**/qux/**/bar" "foo/baz/qux/baz/bar" "regular";
        expected = true;
      };

      testInfixNoMatch = {
        expr = mkMatcher "foo/**/xyz/**/bar" "foo/baz/qux/baz/bar" "regular";
        expected = false;
      };

      # Technically a partial match
      testInfixDirMatch = {
        expr = mkMatcher "foo/**/xyz/**/bar" "foo/baz/qux/baz/bar" "directory";
        expected = true;
      };
    };
  };

  mkSourceFilter = {
    testSourceFilter = {
      expr = mkSourceFilter ./fixtures [
        "bar/*.js"
      ] "bar/bar.js" "regular";
      expected = true;
    };
  };
}
```
but it was dropped in this nixpkgs contribution as the structure of nixpkgs lib testing is too primitive to incorp this without more extensive refactoring than I'd like at the momment.

- Performance

It's hard to benchmark this against anything else meaningful except [globsset](https://github.com/pdtpartners/globset), which has a very similar API.

`sourceByGlobs` avoids performance pitfalls by:

  - Using `builtins.filterSource`

      This is more performant than the fileset API.
      The downside compared to the fileset API is that any directory which matches the filter will be added to the build, even if it's empty.

  - Match paths component by component

      By splitting each pattern into a token per / separator.
      This is much faster in Nix than the doublestar algorithm.

- Globset source

```json
{
    "cpuTime": 0.8585879802703857,
    "envs": {
        "bytes": 148252864,
        "elements": 11899843,
        "number": 6631765
    },
    "gc": {
        "heapSize": 402915328,
        "totalBytes": 671288560
    },
    "list": {
        "bytes": 3358664,
        "concats": 28658,
        "elements": 419833
    },
    "nrAvoided": 11562713,
    "nrFunctionCalls": 4816963,
    "nrLookups": 4316209,
    "nrOpUpdateValuesCopied": 5686407,
    "nrOpUpdates": 464060,
    "nrPrimOpCalls": 2966970,
    "nrThunks": 7796186,
    "sets": {
        "bytes": 196404672,
        "elements": 10837802,
        "number": 1437490
    },
    "sizes": {
        "Attr": 16,
        "Bindings": 16,
        "Env": 8,
        "Value": 24
    },
    "symbols": {
        "bytes": 340652,
        "number": 32026
    },
    "values": {
        "bytes": 207367440,
        "number": 8640310
    }
}
```

- Glob-filter source

```json
{
    "cpuTime": 0.3904629945755005,
    "envs": {
        "bytes": 13263440,
        "elements": 1005877,
        "number": 652053
    },
    "gc": {
        "heapSize": 402915328,
        "totalBytes": 146914896
    },
    "list": {
        "bytes": 3032168,
        "concats": 5899,
        "elements": 379021
    },
    "nrAvoided": 1666598,
    "nrFunctionCalls": 484399,
    "nrLookups": 112698,
    "nrOpUpdateValuesCopied": 3432135,
    "nrOpUpdates": 13426,
    "nrPrimOpCalls": 1041954,
    "nrThunks": 1205792,
    "sets": {
        "bytes": 64304800,
        "elements": 3978167,
        "number": 40883
    },
    "sizes": {
        "Attr": 16,
        "Bindings": 16,
        "Env": 8,
        "Value": 24
    },
    "symbols": {
        "bytes": 285306,
        "number": 28864
    },
    "values": {
        "bytes": 42963240,
        "number": 1790135
    }
}
```

(cherry picked from commit 59d55cbaa3f3e323167a0ba8ee262b7218a709e2)
---
 lib/sources.nix      | 109 +++++++++++++++++++++++++++++++++++++++++++
 lib/tests/sources.sh |  12 +++++
 2 files changed, 121 insertions(+)

diff --git a/lib/sources.nix b/lib/sources.nix
index 43bc2ab2dbe3..81c5305842a1 100644
--- a/lib/sources.nix
+++ b/lib/sources.nix
@@ -7,12 +7,19 @@ let
     match
     split
     storeDir
+    escapeRegex
+    removePrefix
     ;
   inherit (lib)
     boolToString
     filter
     isString
     readFile
+    concatStrings
+    length
+    elemAt
+    isList
+    any
     ;
   inherit (lib.filesystem)
     pathIsRegularFile
@@ -513,6 +520,107 @@ let
     else
       throw "repoRevToName: invalid kind";
 
+  /**
+    Filter sources by a list of double star glob patterns.
+
+    # Inputs
+
+    `src`
+
+    : 1\. Function argument
+
+    `patterns`
+
+    : 2\. Function argument
+
+    # Examples
+    :::{.example}
+    ## `sourceByGlobs` usage example
+
+    - Include all .py files recursively
+    ```nix
+    src = sourceByGlobs ./my-subproject ["**\/*.py" ]
+    ```
+
+    - Include all .py files in root directory only
+    ```nix
+    src = sourceByGlobs ./my-subproject ["*.py" ]
+    ```
+
+    :::
+  */
+  sourceByGlobs =
+    let
+      splitPath = path: filter isString (split "\/" path);
+      # Make component regex
+      mkRe =
+        s:
+        if s == "**" then
+          ".*" # Has special handling below
+        else
+          concatStrings (map (tok: if isList tok then "[^\/]*" else escapeRegex tok) (split "\\*+" s));
+
+      # Make a source filter function from pattern
+      mkMatcher =
+        pat:
+        let
+          globs = map mkRe (splitPath pat);
+          glen = length globs;
+        in
+        path: type:
+        let
+          path' = splitPath path;
+          plen = length path';
+
+          recurse =
+            gi: pi:
+            let
+              g = elemAt globs gi;
+              p = elemAt path' pi;
+              m = match g p != null;
+            in
+            if pi >= plen then # Reached end of path
+              gi >= glen || (type == "directory" || type == "symlink") # Only allow partial matches for directories
+            else if gi >= glen then # Reached end of globs
+              false
+            else if g == ".*" then # Special handling for **
+              (
+                # Lookahead for next glob match
+                if (gi + 1) == glen then
+                  true
+                else if (match (elemAt globs (gi + 1)) p != null) then
+                  recurse (gi + 1) pi
+                else if m then
+                  recurse gi (pi + 1)
+                else
+                  false
+              )
+            else if m then
+              recurse (gi + 1) (pi + 1)
+            else
+              false;
+
+        in
+        recurse 0 0;
+
+      mkSourceFilter =
+        root: patterns:
+        let
+          root' = "${toString root}/";
+          matchers = map mkMatcher patterns;
+        in
+        name: type:
+        let
+          name' = removePrefix root' name;
+        in
+        any (m: m name' type) matchers;
+
+    in
+    src: patterns:
+    lib.cleanSourceWith {
+      filter = mkSourceFilter src patterns;
+      inherit src;
+    };
 in
 {
   inherit
@@ -532,6 +640,7 @@ in
 
     sourceByRegex
     sourceFilesBySuffices
+    sourceByGlobs
 
     trace
     ;
diff --git a/lib/tests/sources.sh b/lib/tests/sources.sh
index 079c7eea5657..08315a303bc2 100755
--- a/lib/tests/sources.sh
+++ b/lib/tests/sources.sh
@@ -70,4 +70,16 @@ dir="$(nix-instantiate --eval --strict --read-write-mode --json --expr '(with im
 EOF
 ) || die "cleanSourceWith + cleanSource"
 
+
+dir="$(nix-instantiate --eval --strict --read-write-mode --json --expr '(with import <nixpkgs/lib>; "${
+  sources.sourceByGlobs '"$work"' [ "*.md" "**/*.o" ]
+}")' | crudeUnquoteJSON)"
+(cd "$dir"; find) | sort -f | diff -U10 - <(cat <<EOF
+.
+./module.o
+./README.md
+EOF
+) || die "sourceByGlobs 1"
+
+
 echo >&2 tests ok

From 8b870d76666838edc7e0b062f5bc3a5d5c4816cc Mon Sep 17 00:00:00 2001
From: zimbatm <zimbatm@zimbatm.com>
Date: Fri, 22 May 2026 14:14:40 +0200
Subject: [PATCH 21/31] lib.sources.sourceByGlobs: address review comments

(cherry picked from commit 01bdc186ae9baf635bdfb732e3d81ac41da02ca4)
---
 lib/sources.nix | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/lib/sources.nix b/lib/sources.nix
index 81c5305842a1..43a374c16e73 100644
--- a/lib/sources.nix
+++ b/lib/sources.nix
@@ -521,44 +521,50 @@ let
       throw "repoRevToName: invalid kind";
 
   /**
-    Filter sources by a list of double star glob patterns.
+    Filter a source tree by a list of doublestar-style glob patterns,
+    returning a source that only contains paths matching at least one
+    pattern. `*` matches a single path component, and `**` matches any
+    number of components.
 
     # Inputs
 
     `src`
 
-    : 1\. Function argument
+    : The source tree to filter.
 
     `patterns`
 
-    : 2\. Function argument
+    : List of glob patterns to include, e.g. `[ "*.py" "src/**" ]`.
+      A leading `**` (e.g. `**\/*.py` for all `.py` files at any depth)
+      is also supported; the `\` here is just a Nix string escape used
+      to avoid closing this comment.
 
     # Examples
     :::{.example}
     ## `sourceByGlobs` usage example
 
-    - Include all .py files recursively
+    - Include everything under a subdirectory
     ```nix
-    src = sourceByGlobs ./my-subproject ["**\/*.py" ]
+    src = sourceByGlobs ./. [ "src/**" "tests/**" ]
     ```
 
     - Include all .py files in root directory only
     ```nix
-    src = sourceByGlobs ./my-subproject ["*.py" ]
+    src = sourceByGlobs ./. [ "*.py" ]
     ```
 
     :::
   */
   sourceByGlobs =
     let
-      splitPath = path: filter isString (split "\/" path);
+      splitPath = path: filter isString (split "/" path);
       # Make component regex
       mkRe =
         s:
         if s == "**" then
           ".*" # Has special handling below
         else
-          concatStrings (map (tok: if isList tok then "[^\/]*" else escapeRegex tok) (split "\\*+" s));
+          concatStrings (map (tok: if isList tok then "[^/]*" else escapeRegex tok) (split "\\*+" s));
 
       # Make a source filter function from pattern
       mkMatcher =

From 9dc23bf891b65d49130357aace01173b4e09e375 Mon Sep 17 00:00:00 2001
From: zimbatm <zimbatm@zimbatm.com>
Date: Fri, 22 May 2026 14:42:16 +0200
Subject: [PATCH 22/31] pkgs.formats.javaProperties: use
 lib.sources.sourceByGlobs

Uses the cleaner expression

(cherry picked from commit edb4b053f526fa2cd42bdf459a298de622ce2f66)
---
 pkgs/pkgs-lib/formats/java-properties/test/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/pkgs-lib/formats/java-properties/test/default.nix b/pkgs/pkgs-lib/formats/java-properties/test/default.nix
index 2ea787a90341..68cd5cfa1bcf 100644
--- a/pkgs/pkgs-lib/formats/java-properties/test/default.nix
+++ b/pkgs/pkgs-lib/formats/java-properties/test/default.nix
@@ -72,8 +72,8 @@ stdenv.mkDerivation {
     )
   );
 
-  src = lib.sourceByRegex ./. [
-    ".*\\.java"
+  src = lib.sources.sourceByGlobs ./. [
+    "**/*.java"
   ];
   # On Linux, this can be C.UTF-8, but darwin + zulu requires en_US.UTF-8
   LANG = "en_US.UTF-8";

From 576870d97cc2081b988a12ca46c4f857dbe7a8bc Mon Sep 17 00:00:00 2001
From: zimbatm <zimbatm@zimbatm.com>
Date: Fri, 22 May 2026 15:25:46 +0200
Subject: [PATCH 23/31] vimPluginsUpdater: use lib.sources.sourceByGlobs

Filter PYTHONPATH source to .py files only, dropping the 6 sibling
.nix files from the closure.

(cherry picked from commit 1b476677762937fc0364a4f37bb9e31aebb61220)
---
 pkgs/applications/editors/vim/plugins/utils/updater.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/applications/editors/vim/plugins/utils/updater.nix b/pkgs/applications/editors/vim/plugins/utils/updater.nix
index 2ed61a25c83a..0c77e7ce745c 100644
--- a/pkgs/applications/editors/vim/plugins/utils/updater.nix
+++ b/pkgs/applications/editors/vim/plugins/utils/updater.nix
@@ -43,7 +43,7 @@ buildPythonApplication {
         neovim-unwrapped
         nurl
       ]
-    }" --prefix PYTHONPATH : "${./.}" )
+    }" --prefix PYTHONPATH : "${lib.sources.sourceByGlobs ./. [ "**/*.py" ]}" )
     wrapPythonPrograms
   '';
 

From ba1f4720f0869a51a2ff2f8632dd3efa167470d4 Mon Sep 17 00:00:00 2001
From: zimbatm <zimbatm@zimbatm.com>
Date: Fri, 22 May 2026 15:25:46 +0200
Subject: [PATCH 24/31] purescript.tests.minimal-module: use
 lib.sources.sourceByGlobs

Filter src to the .purs and .js files actually compiled, dropping
default.nix from the closure.

(cherry picked from commit df1b67fdfd63eb27e7b135033b9228bdf4ea8826)
---
 .../purescript/purescript/test-minimal-module/default.nix | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/compilers/purescript/purescript/test-minimal-module/default.nix b/pkgs/development/compilers/purescript/purescript/test-minimal-module/default.nix
index a8503e1b9aae..2a0010b061a5 100644
--- a/pkgs/development/compilers/purescript/purescript/test-minimal-module/default.nix
+++ b/pkgs/development/compilers/purescript/purescript/test-minimal-module/default.nix
@@ -1,11 +1,17 @@
 {
+  lib,
   runCommand,
   purescript,
   nodejs,
 }:
 
 runCommand "purescript-test-minimal-module" { } ''
-  ${purescript}/bin/purs compile -o ./output ${./.}/Main.purs
+  ${purescript}/bin/purs compile -o ./output ${
+    lib.sources.sourceByGlobs ./. [
+      "*.purs"
+      "*.js"
+    ]
+  }/Main.purs
 
   echo 'import {main} from "./output/Main/index.js"; main()' > node.mjs
 

From cda195bdcbffa872c903be5265993faabf1257e1 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Wed, 1 Jul 2026 12:02:11 +0200
Subject: [PATCH 25/31] iredis: 1.15.2 -> 1.16.1

changelog: https://github.com/laixintao/iredis/blob/v1.16.1/CHANGELOG.md

diff: https://github.com/laixintao/iredis/compare/v1.15.2...v1.16.1
(cherry picked from commit 22b0bb03262762fcb0405d8632311e3486ca9bf2)
---
 pkgs/by-name/ir/iredis/package.nix | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/ir/iredis/package.nix b/pkgs/by-name/ir/iredis/package.nix
index a8fbb956c9ef..c621cfac7acc 100644
--- a/pkgs/by-name/ir/iredis/package.nix
+++ b/pkgs/by-name/ir/iredis/package.nix
@@ -7,22 +7,20 @@
 
 python3.pkgs.buildPythonApplication (finalAttrs: {
   pname = "iredis";
-  version = "1.15.2";
+  version = "1.16.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "laixintao";
     repo = "iredis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-g/gQb9QOyfa7kyHCUZf/kLZRO5IE8389BUCYz8Sqr8o=";
+    hash = "sha256-m8XDNzHgMWBgcN3AyFlb8K/UNXbGhH4toKBiX5Q4/QY=";
   };
 
-  postPatch = ''
-    substituteInPlace pyproject.toml \
-      --replace-fail 'packaging = "^23.0"' 'packaging = "*"' \
-      --replace-fail 'wcwidth = "0.1.9"' 'wcwidth = "*"' \
-      --replace-fail 'redis = "^5.0.0"' 'redis = "*"'
-  '';
+  pythonRelaxDeps = [
+    "packaging"
+    "redis"
+  ];
 
   nativeBuildInputs = with python3.pkgs; [
     poetry-core
@@ -37,7 +35,6 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     pygments
     python-dateutil
     redis
-    wcwidth
   ];
 
   nativeCheckInputs = with python3.pkgs; [

From e0526ede6eac819eb701251d28bc4cd3b78d0dc3 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Wed, 1 Jul 2026 12:09:36 +0200
Subject: [PATCH 26/31] iredis: modernize

(cherry picked from commit 6cc3d60de204045a3dccccb1bc0b7e55e065ec02)
---
 pkgs/by-name/ir/iredis/package.nix | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/ir/iredis/package.nix b/pkgs/by-name/ir/iredis/package.nix
index c621cfac7acc..bef043b7dcbd 100644
--- a/pkgs/by-name/ir/iredis/package.nix
+++ b/pkgs/by-name/ir/iredis/package.nix
@@ -1,14 +1,16 @@
 {
   lib,
   stdenv,
-  python3,
+  python3Packages,
   fetchFromGitHub,
+  versionCheckHook,
 }:
 
-python3.pkgs.buildPythonApplication (finalAttrs: {
+python3Packages.buildPythonApplication (finalAttrs: {
   pname = "iredis";
   version = "1.16.1";
   pyproject = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "laixintao";
@@ -22,11 +24,11 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     "redis"
   ];
 
-  nativeBuildInputs = with python3.pkgs; [
+  build-system = with python3Packages; [
     poetry-core
   ];
 
-  propagatedBuildInputs = with python3.pkgs; [
+  dependencies = with python3Packages; [
     click
     configobj
     mistune
@@ -37,7 +39,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
     redis
   ];
 
-  nativeCheckInputs = with python3.pkgs; [
+  nativeCheckInputs = with python3Packages; [
     freezegun
     pexpect
     pytestCheckHook
@@ -62,6 +64,11 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
 
   pythonImportsCheck = [ "iredis" ];
 
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+
   meta = {
     description = "Terminal Client for Redis with AutoCompletion and Syntax Highlighting";
     changelog = "https://github.com/laixintao/iredis/blob/${finalAttrs.src.tag}/CHANGELOG.md";

From 3109dcb94e6afecd6d08c4085f4b7237ab9b3050 Mon Sep 17 00:00:00 2001
From: Diogo Correia <me@diogotc.com>
Date: Fri, 3 Jul 2026 17:22:47 +0100
Subject: [PATCH 27/31] umami: 3.1.0 -> 3.2.0

(cherry picked from commit d9114b31e57e71bb896630f4cc18c226180d9d0d)
---
 pkgs/by-name/um/umami/package.nix  | 22 +++++++++++-----------
 pkgs/by-name/um/umami/sources.json |  6 +++---
 2 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/pkgs/by-name/um/umami/package.nix b/pkgs/by-name/um/umami/package.nix
index 849a61176dd3..2e68c5304f4b 100644
--- a/pkgs/by-name/um/umami/package.nix
+++ b/pkgs/by-name/um/umami/package.nix
@@ -46,12 +46,12 @@ let
   # to guarantee compatibility.
   prisma-engines' = prisma-engines_7.overrideAttrs (
     finalAttrs: prevAttrs: {
-      version = "7.6.0";
+      version = "7.8.0";
       src = fetchFromGitHub {
         owner = "prisma";
         repo = "prisma-engines";
         tag = finalAttrs.version;
-        hash = "sha256-NMoAaiTa68i51lR6iMCyHyCAsFuuhPx2+tHFSSoqWqA=";
+        hash = "sha256-nquIcOmFz+ikD0x/YEPZ5NVKCFPCdR5MSCHldn+b9jI=";
       };
       cargoHash = "sha256-uiFvzxwVJXCW9LUDFRC6ZkzSa7LQk+9ZJcaJw8mrBX4=";
 
@@ -65,23 +65,23 @@ let
   );
   prisma' = (prisma_7.override { prisma-engines_7 = prisma-engines'; }).overrideAttrs (
     finalAttrs: prevAttrs: {
-      version = "7.6.0";
+      version = "7.8.0";
       src = fetchFromGitHub {
         owner = "prisma";
         repo = "prisma";
         tag = finalAttrs.version;
-        hash = "sha256-BesX2ySfgew6+9Q6fnhZ8gMnnxh4D4fefaA5BhehlHE=";
+        hash = "sha256-89q5433z54h3oGX+lEYDQykN2mNltGz4+LWlYSE75/E=";
       };
       pnpmDeps = prevAttrs.pnpmDeps.override {
         inherit (finalAttrs) src version;
-        hash = "sha256-ZOpNt+W5b1troicfkCi4wCCDtwhTB4VlPgxYMZetcs0=";
+        hash = "sha256-mrFU5SAF4QuTBJj5TP8tUkYDG4zchttjcQMLtx6OBnI=";
       };
     }
   );
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "umami";
-  version = "3.1.0";
+  version = "3.2.0";
 
   nativeBuildInputs = [
     makeWrapper
@@ -94,7 +94,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     owner = "umami-software";
     repo = "umami";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-EH3ebwTbajcNasn25ets2w068ZmCQRYUY2XON39J5HA=";
+    hash = "sha256-0nfCcaST06cTg43Rz1rCV8GYYDjQLP+6TrVRJF2/Yuk=";
   };
 
   # Umami uses next/font/google, which tries to download from Google Fonts at build time.
@@ -114,11 +114,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       src
       ;
     inherit pnpm;
-    fetcherVersion = 3;
-    hash = "sha256-QNWmCsVFh8xpsO4ZPTaKGszwuRaxTrWLMVh/6VV5oIw=";
+    fetcherVersion = 4;
+    hash = "sha256-6ho5xoVdqZdihThL5q8+RhVPfaSwu1y3+p9d8DnfO3o=";
   };
 
-  env.CYPRESS_INSTALL_BINARY = "0";
   env.NODE_ENV = "production";
   env.NEXT_TELEMETRY_DISABLED = "1";
 
@@ -150,7 +149,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   checkPhase = ''
     runHook preCheck
 
-    pnpm test
+    # Tests fail if NODE_ENV=production
+    NODE_ENV=development pnpm test
 
     runHook postCheck
   '';
diff --git a/pkgs/by-name/um/umami/sources.json b/pkgs/by-name/um/umami/sources.json
index 30d51dfd4329..0680e40a0888 100644
--- a/pkgs/by-name/um/umami/sources.json
+++ b/pkgs/by-name/um/umami/sources.json
@@ -1,7 +1,7 @@
 {
   "geocities": {
-    "rev": "6a3ef689a4673ff2bf292548716e7cc6c5a2c903",
-    "date": "2026-04-16",
-    "hash": "sha256-GUUeFU1DKGL+NpzK1oJlsyB/VrFWe6Lj7U7yJXj8mNo="
+    "rev": "04017f13909e499135afea605a1e07427e845641",
+    "date": "2026-07-02",
+    "hash": "sha256-4IYGsxNGdzilI0mYXlwEo43auqNug307pYyPuilR3aw="
   }
 }

From 2b8b447948abd3983616d0b1918327b2efb478cf Mon Sep 17 00:00:00 2001
From: Coca <me@coca.codes>
Date: Tue, 30 Jun 2026 15:10:38 +0100
Subject: [PATCH 28/31] space-station-14-launcher: 0.38.0 -> 0.39.0

(cherry picked from commit ad9369938f568425b9abd1cff57ef82a8aab8103)
---
 .../sp/space-station-14-launcher/deps.json    | 42 +++----------------
 .../sp/space-station-14-launcher/package.nix  |  4 +-
 2 files changed, 8 insertions(+), 38 deletions(-)

diff --git a/pkgs/by-name/sp/space-station-14-launcher/deps.json b/pkgs/by-name/sp/space-station-14-launcher/deps.json
index 7534e52508cb..297016604a97 100644
--- a/pkgs/by-name/sp/space-station-14-launcher/deps.json
+++ b/pkgs/by-name/sp/space-station-14-launcher/deps.json
@@ -49,11 +49,6 @@
     "version": "11.2.4",
     "hash": "sha256-MvxivGjYerXcr70JpWe9CCXO6MU9QQgCkmZfjZCFdJM="
   },
-  {
-    "pname": "Avalonia.ReactiveUI",
-    "version": "11.2.4",
-    "hash": "sha256-LqwLUDCIbJowol6BNTTsK7a7KjcLLbCM3y3KKvuHRGw="
-  },
   {
     "pname": "Avalonia.Remote.Protocol",
     "version": "11.2.4",
@@ -94,11 +89,6 @@
     "version": "8.4.1",
     "hash": "sha256-r+haH5VlmZFJTEJ3UedsYybw+oddn/CSvfm6x7PrrQ4="
   },
-  {
-    "pname": "Fody",
-    "version": "6.6.4",
-    "hash": "sha256-Xe9sGzIdQ970f0RwxD3KhdfqvGUoTpim2u2oqYHkDcI="
-  },
   {
     "pname": "Fody",
     "version": "6.9.2",
@@ -204,20 +194,10 @@
     "version": "25.4.0",
     "hash": "sha256-jwsuS+Kp+sD31S41tTHv/zkFqnzxnGOEty2iZVmBb6E="
   },
-  {
-    "pname": "ReactiveUI",
-    "version": "20.1.1",
-    "hash": "sha256-p9l2GMzBRchKb4gW9pQ3DIKhs2O9fX3t/V7jDDztBqE="
-  },
-  {
-    "pname": "ReactiveUI.Fody",
-    "version": "18.4.26",
-    "hash": "sha256-ucLfi/HB3cJIdmNssfazZAXPC8QJ35YVA+GtWKVU6UQ="
-  },
   {
     "pname": "Robust.Natives",
-    "version": "0.2.3",
-    "hash": "sha256-EwaSVnPsDSjY61vBIHaRSs/xpigGPqRStjYLcz+xaB0="
+    "version": "0.2.5",
+    "hash": "sha256-XHTGa14j5A/rycs7Y7iEOmDFpbyG8abVH0pBYmvtk00="
   },
   {
     "pname": "Robust.Natives.Angle",
@@ -246,8 +226,8 @@
   },
   {
     "pname": "Robust.Natives.Sdl3",
-    "version": "0.1.1-sdl3.2.20",
-    "hash": "sha256-dQPO/zME+e/Hsmic32hn5YIy4+LKfjDk064o6N7PKvM="
+    "version": "0.1.3-sdl3.4.8",
+    "hash": "sha256-jPwa4krPM9I3zbYtWcs4JIOBDlolNKZSUfioo+X1c/k="
   },
   {
     "pname": "Robust.Natives.Swnfd",
@@ -321,8 +301,8 @@
   },
   {
     "pname": "Splat",
-    "version": "15.1.1",
-    "hash": "sha256-WipAVaUx2HrYNQ9LcYm496LndmSpVbuzJxzP9FA6Ohg="
+    "version": "15.3.1",
+    "hash": "sha256-1MlkqywOtLr5TbQ+zAqzw0l92LK9+9h2+sJgmfV32RU="
   },
   {
     "pname": "SQLitePCLRaw.bundle_e_sqlite3",
@@ -344,11 +324,6 @@
     "version": "2.1.4",
     "hash": "sha256-Zdj676VT6j6k9ZCL2hYVl4F8bi4TK/ldvQBPmW0oDi0="
   },
-  {
-    "pname": "System.ComponentModel.Annotations",
-    "version": "5.0.0",
-    "hash": "sha256-0pST1UHgpeE6xJrYf5R+U7AwIlH3rVC3SpguilI/MAg="
-  },
   {
     "pname": "System.Net.Http.WinHttpHandler",
     "version": "8.0.0",
@@ -359,11 +334,6 @@
     "version": "6.0.0",
     "hash": "sha256-hXB18OsiUHSCmRF3unAfdUEcbXVbG6/nZxcyz13oe9Y="
   },
-  {
-    "pname": "System.Reactive",
-    "version": "6.0.1",
-    "hash": "sha256-Lo5UMqp8DsbVSUxa2UpClR1GoYzqQQcSxkfyFqB/d4Q="
-  },
   {
     "pname": "TerraFX.Interop.Windows",
     "version": "10.0.26100.2",
diff --git a/pkgs/by-name/sp/space-station-14-launcher/package.nix b/pkgs/by-name/sp/space-station-14-launcher/package.nix
index e318204281be..09262aa781c7 100644
--- a/pkgs/by-name/sp/space-station-14-launcher/package.nix
+++ b/pkgs/by-name/sp/space-station-14-launcher/package.nix
@@ -39,7 +39,7 @@
 }:
 let
   pname = "space-station-14-launcher";
-  version = "0.38.0";
+  version = "0.39.0";
 in
 buildDotnetModule rec {
   inherit pname;
@@ -52,7 +52,7 @@ buildDotnetModule rec {
     owner = "space-wizards";
     repo = "SS14.Launcher";
     tag = "v${version}";
-    hash = "sha256-/FPNCNDC09NMg1bTSZHNFfzabxYQ2FhV1t6Ire9WBtg=";
+    hash = "sha256-i5jcaB1wa+Toj6orpEQ9sK3EX1CLWadnhTEQDOU7QU4=";
     fetchSubmodules = true;
   };
 

From 88f5e71492e70e79a41b0f9fa5c2a9bbc90a206d Mon Sep 17 00:00:00 2001
From: Daniel Schaefer <dhs@frame.work>
Date: Sun, 28 Jun 2026 18:43:24 +0800
Subject: [PATCH 29/31] coreboot-toolchain: 26.03 -> 26.06

Signed-off-by: Daniel Schaefer <dhs@frame.work>
(cherry picked from commit e12059e66d886d3559b22af9a5bb8dbc94320bd3)
---
 .../tools/misc/coreboot-toolchain/default.nix |  4 +--
 .../tools/misc/coreboot-toolchain/stable.nix  | 31 ++++++++++++-------
 2 files changed, 21 insertions(+), 14 deletions(-)

diff --git a/pkgs/development/tools/misc/coreboot-toolchain/default.nix b/pkgs/development/tools/misc/coreboot-toolchain/default.nix
index 2279ff8e5d4f..64359f53bd22 100644
--- a/pkgs/development/tools/misc/coreboot-toolchain/default.nix
+++ b/pkgs/development/tools/misc/coreboot-toolchain/default.nix
@@ -26,12 +26,12 @@ let
 
       stdenvNoCC.mkDerivation (finalAttrs: {
         pname = "coreboot-toolchain-${arch}";
-        version = "26.03";
+        version = "26.06";
 
         src = fetchgit {
           url = "https://review.coreboot.org/coreboot";
           rev = finalAttrs.version;
-          hash = "sha256-9ollzu6vtU+uHibvV/B5N70ZVl701kuI/orWlFZLjIU=";
+          hash = "sha256-MESai+UGo/Ref5t1VcgCrgQk+2ZeZW4Vh0xk3Z5v8ZE=";
           fetchSubmodules = false;
           leaveDotGit = true;
           postFetch = ''
diff --git a/pkgs/development/tools/misc/coreboot-toolchain/stable.nix b/pkgs/development/tools/misc/coreboot-toolchain/stable.nix
index 192c1e3fe3e0..008cf2d4e1ed 100644
--- a/pkgs/development/tools/misc/coreboot-toolchain/stable.nix
+++ b/pkgs/development/tools/misc/coreboot-toolchain/stable.nix
@@ -22,31 +22,38 @@
     };
   }
   {
-    name = "gcc-14.2.0.tar.xz";
+    name = "gcc-15.2.0.tar.xz";
     archive = fetchurl {
-      sha256 = "1j9wdznsp772q15w1kl5ip0gf0bh8wkanq2sdj12b7mzkk39pcx7";
-      url = "mirror://gnu/gcc/gcc-14.2.0/gcc-14.2.0.tar.xz";
+      sha256 = "0knj4ph6y7r7yhnp1v4339af7mki5nkh7ni9b948433bhabdk3s3";
+      url = "mirror://gnu/gcc/gcc-15.2.0/gcc-15.2.0.tar.xz";
     };
   }
   {
-    name = "binutils-2.45.tar.xz";
+    name = "binutils-2.45.1.tar.xz";
     archive = fetchurl {
-      sha256 = "1lpmpszs3lk9mcg7yn0m312745kbc8vlazn95h79i25ikizhw365";
-      url = "mirror://gnu/binutils/binutils-2.45.tar.xz";
+      sha256 = "199sa5igipbvz2zg0j1zgvrybphgcznq2bcnjpngs64xzvk03qaz";
+      url = "mirror://gnu/binutils/binutils-2.45.1.tar.xz";
     };
   }
   {
-    name = "acpica-unix-20250807.tar.gz";
+    name = "acpica-unix-20251212.tar.gz";
     archive = fetchurl {
-      sha256 = "0cwfm7i5a2fqq35hznnal38pgxgmnkm0v2xkb82jm1yv9014rjpa";
-      url = "https://downloadmirror.intel.com/864114/acpica-unix-20250807.tar.gz";
+      sha256 = "06azmpymppycmri6wf64pgf100k7gl2sxaddnl5xsm41bwj26r28";
+      url = "https://github.com/acpica/acpica/releases/download/20251212/acpica-unix-20251212.tar.gz";
     };
   }
   {
-    name = "nasm-2.16.03.tar.bz2";
+    name = "cmake-4.0.3.tar.gz";
     archive = fetchurl {
-      sha256 = "0mwynbnn7c4ay4rpcsyp99j49sa6j3p8gk5pigwssqfdkcaxxwxy";
-      url = "https://www.nasm.us/pub/nasm/releasebuilds/2.16.03/nasm-2.16.03.tar.bz2";
+      sha256 = "1yrzkwkr2nxl8hcjkk333l9ycbw9prkg363k4km609kknyvkfdcd";
+      url = "https://cmake.org/files/v4.0/cmake-4.0.3.tar.gz";
+    };
+  }
+  {
+    name = "nasm-3.01.tar.bz2";
+    archive = fetchurl {
+      sha256 = "1cf08p8ak15sksbzfyjxaiqggkjwc35f9yzjc9w29wzfn3riyyvs";
+      url = "https://www.nasm.us/pub/nasm/releasebuilds/3.01/nasm-3.01.tar.bz2";
     };
   }
 ]

From d4ad1dbfb7f9e23aae4a856fb2ac3ce65fd2abaa Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 27 Jun 2026 01:14:09 +0000
Subject: [PATCH 30/31] keycloak: 26.6.3 -> 26.6.4

(cherry picked from commit f202b3a7874d4ea3866b656651da48550ffa2745)
---
 pkgs/by-name/ke/keycloak/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ke/keycloak/package.nix b/pkgs/by-name/ke/keycloak/package.nix
index 437dd9f436f9..921923d1c323 100644
--- a/pkgs/by-name/ke/keycloak/package.nix
+++ b/pkgs/by-name/ke/keycloak/package.nix
@@ -24,11 +24,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "keycloak";
-  version = "26.6.3";
+  version = "26.6.4";
 
   src = fetchzip {
     url = "https://github.com/keycloak/keycloak/releases/download/${finalAttrs.version}/keycloak-${finalAttrs.version}.zip";
-    hash = "sha256-MlWWiTnQVB/JjBhEk3wUv/1WPWnEx9h2iULwzCxUKHU=";
+    hash = "sha256-rb3Wdzc3g8jMvUffOfMfJ4Uw9HJomznXzLtPOrHoWU8=";
   };
 
   nativeBuildInputs = [

From b11c4056e1568dd59199b70cae2ecdd117664c87 Mon Sep 17 00:00:00 2001
From: Robert Helgesson <robert@rycee.net>
Date: Sat, 4 Jul 2026 21:59:09 +0200
Subject: [PATCH 31/31] grav: 1.7.53 -> 1.7.53.2

(cherry picked from commit 3d92a88d7df0941754e43595ab23f78ba30ac9e0)
---
 pkgs/by-name/gr/grav/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gr/grav/package.nix b/pkgs/by-name/gr/grav/package.nix
index 284a3f8a09a9..f8e2888e4cc2 100644
--- a/pkgs/by-name/gr/grav/package.nix
+++ b/pkgs/by-name/gr/grav/package.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "1.7.53";
+  version = "1.7.53.2";
 in
 stdenvNoCC.mkDerivation {
   pname = "grav";
@@ -14,7 +14,7 @@ stdenvNoCC.mkDerivation {
 
   src = fetchzip {
     url = "https://github.com/getgrav/grav/releases/download/${version}/grav-admin-v${version}.zip";
-    hash = "sha256-Ug8sIEMwIoCUyHpxk5NaGHaJA7lThgbUuu+8NpmI9YI=";
+    hash = "sha256-6cQotHwIwWFR5phFQI9r79jpd+iYA1HpFBbYIzEVBsc=";
   };
 
   patches = [