Merge staging-next-26.05 into staging-26.05

2026-07-16 21:58:55 +00:00 · 2026-07-11 00:34:04 +00:00
parent ba9e4513c2 70c8522436
commit a56d23c83c
96 changed files with 1484 additions and 550 deletions
--- a/.github/actions/checkout/action.yml
+++ b/.github/actions/checkout/action.yml
@@ -19,6 +19,7 @@ runs:
        TARGET_SHA: ${{ inputs.target-as-trusted-at }}
        PIN_BUMP_SHA: ${{ inputs.untrusted-pin-bump }}
      with:
+        retries: 3
        script: |
          const { rm, writeFile } = require('node:fs/promises')
          const { spawn } = require('node:child_process')
--- a/.github/workflows/bot.yml
+++ b/.github/workflows/bot.yml
@@ -91,7 +91,7 @@ jobs:
          GH_TOKEN: ${{ steps.app-token.outputs.token || github.token }}
        run: gh api /rate_limit | jq

-      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
+      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
        name: Labels from touched files
        if: |
          github.event_name == 'pull_request_target' &&
@@ -101,7 +101,7 @@ jobs:
          configuration-path: .github/labeler.yml # default
          sync-labels: true

-      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
+      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
        name: Labels from touched files (no sync)
        if: |
          github.event_name == 'pull_request_target' &&
@@ -111,7 +111,7 @@ jobs:
          configuration-path: .github/labeler-no-sync.yml
          sync-labels: false

-      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
+      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
        name: Labels from touched files (development branches)
        # Development branches like staging-next, haskell-updates and python-updates get special labels.
        # This is to avoid the mass of labels there, which is mostly useless - and really annoying for
--- a/doc/hooks/check-phase-thread-limit-hook.section.md
+++ b/doc/hooks/check-phase-thread-limit-hook.section.md
@@ -0,0 +1,24 @@
+# checkPhaseThreadLimitHook {#setup-hook-check-phase-thread-limit}
+
+This hook defaults a variety of environment variables known
+to control thread counts to 1. Many of these otherwise default
+to `$(nproc)`, which causes massive overloads on build machines
+if nix build jobs and build cores are already tuned to fully utilize
+compute capacity of a builder without additional parallelism.
+
+Currently sets the following environment variables:
+- [`OMP_NUM_THREADS`](https://www.openmp.org/spec-html/5.0/openmpse50.html)
+- [`OPENBLAS_NUM_THREADS`](https://github.com/OpenMathLib/OpenBLAS/blob/e7b45174355edec1f04de1cabcf5ca6a98ea7fbc/USAGE.md#how-can-i-use-openblas-in-multi-threaded-applications)
+- [`MKL_NUM_THREADS`](https://www.intel.com/content/www/us/en/docs/onemkl/developer-guide-linux/2023-0/mkl-domain-num-threads.html)
+- [`BLIS_NUM_THREADS`](https://github.com/flame/blis/blob/b8b75b4e19459f5d618b57aa814ca38b1d82eb82/docs/Multithreading.md#specifying-multithreading)
+- `VECLIB_MAXIMUM_THREADS`: Only affects darwin, see [`man 7 Accelerate`](https://manp.gs/mac/7/Accelerate)
+- [`NUMBA_NUM_THREADS`](https://numba.readthedocs.io/en/stable/reference/envvars.html#threading-control)
+- [`NUMEXPR_NUM_THREADS`](https://numexpr.readthedocs.io/en/latest/user_guide.html#threadpool-configuration)
+
+The `NIX_CHECK_PHASE_DEFAULT_NUM_THREADS` environment variable
+can be used to override the default thread count limit.
+`dontLimitCheckPhaseThreads = true;` can be used to disable
+thread limiting on an individual package.
+
+This hook will not attempt to override already existing
+definitions for thread count environment variables.
--- a/doc/hooks/index.md
+++ b/doc/hooks/index.md
@@ -13,6 +13,7 @@ aws-c-common.section.md
 bmake.section.md
 breakpoint.section.md
 cernlib.section.md
+check-phase-thread-limit-hook.section.md
 cmake.section.md
 desktop-file-utils.section.md
 gdk-pixbuf.section.md
@@ -34,7 +35,6 @@ nodejs-install-manuals.section.md
 npm-build-hook.section.md
 npm-config-hook.section.md
 npm-install-hook.section.md
-openmp-check-hook.section.md
 patch-rc-path-hooks.section.md
 perl.section.md
 pkg-config.section.md
--- a/doc/hooks/openmp-check-hook.section.md
+++ b/doc/hooks/openmp-check-hook.section.md
@@ -1,10 +0,0 @@
-# openmpCheckPhaseHook {#setup-hook-omp-check}
-
-
-This hook can be used to setup a check phase that
-requires running a OpenMP application. It mostly
-serves to limit `OMP_NUM_THREADS` to avoid overloading
-build machines.
-
-This hook will not attempt to override an already existing
-definition of `OMP_NUM_THREADS` in the environment.
--- a/doc/redirects.json
+++ b/doc/redirects.json
@@ -2809,7 +2809,8 @@
  "setup-hook-mpi-check": [
    "index.html#setup-hook-mpi-check"
  ],
-  "setup-hook-omp-check": [
+  "setup-hook-check-phase-thread-limit": [
+    "index.html#setup-hook-check-phase-thread-limit",
    "index.html#setup-hook-omp-check"
  ],
  "ninja": [
--- a/doc/release-notes/rl-2611.section.md
+++ b/doc/release-notes/rl-2611.section.md
@@ -4,7 +4,17 @@

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

- Create the first release note entry in this section!
+- The {file}`nixexprs.tar.xz` tarball will be discontinued together with Nixpkgs
+  27.05 after 2027-12-31. Migrate to the {file}`nixexprs.tar.zst` tarball
+  instead.
+
+  This affects for example users who pull Nixpkgs as a flake input from
+  https://channels.nixos.org:
+
+  ```diff
+  -nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.xz";
+  +nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.zst";
+  ```

 ## Backward Incompatibilities {#sec-nixpkgs-release-26.11-incompatibilities}

--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -8207,6 +8207,12 @@
    githubId = 7820865;
    name = "Eric Dallo";
  };
+  erics118 = {
+    name = "Eric Shen";
+    github = "erics118";
+    githubId = 52634785;
+    email = "ericshen118@gmail.com";
+  };
  ericson2314 = {
    email = "John.Ericson@Obsidian.Systems";
    matrix = "@Ericson2314:matrix.org";
@@ -29991,6 +29997,13 @@
    github = "x807x";
    githubId = 86676478;
  };
+  xaltsc = {
+    email = "hey+dev@xaltsc.dev";
+    matrix = "@xaltsc:matrix.org";
+    name = "xaltsc";
+    github = "xaltsc";
+    githubId = 41400742;
+  };
  xanderio = {
    name = "Alexander Sieg";
    email = "alex@xanderio.de";
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -4,7 +4,17 @@

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

- Create the first release note entry in this section!
+- The {file}`nixexprs.tar.xz` tarball will be discontinued together with Nixpkgs
+  27.05 after 2027-12-31. Migrate to the {file}`nixexprs.tar.zst` tarball
+  instead.
+
+  This affects for example users who pull Nixpkgs as a flake input from
+  https://channels.nixos.org:
+
+  ```diff
+  -nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.xz";
+  +nixpkgs.url = "https://channels.nixos.org/nixos-26.05/nixexprs.tar.zst";
+  ```

 ## New Modules {#sec-release-26.11-new-modules}

--- a/nixos/lib/make-channel.nix
+++ b/nixos/lib/make-channel.nix
@@ -18,7 +18,10 @@ pkgs.releaseTools.makeSourceTarball {
  officialRelease = false; # FIXME: fix this in makeSourceTarball
  inherit version versionSuffix;

-  buildInputs = [ pkgs.nix ];
+  buildInputs = with pkgs; [
+    nix
+    zstd
+  ];

  distPhase = ''
    rm -rf .git
@@ -32,6 +35,35 @@ pkgs.releaseTools.makeSourceTarball {
    NIX_STATE_DIR=$TMPDIR nix-env -f ../$releaseName/default.nix -qaP --meta --show-trace --xml \* > /dev/null
    cd ..
    chmod -R u+w $releaseName
-    tar cfJ $out/tarballs/$releaseName.tar.xz $releaseName
+
+    # The compression tasks are shortlived; use all available CPUs (-T0) to
+    # prioritize fast channel advancement.
+    XZ_OPT="-T0" tar \
+      --create \
+      --file=$out/tarballs/$releaseName.tar.xz \
+      --xz \
+      --absolute-names \
+      --owner=0 \
+      --group=0 \
+      --numeric-owner \
+      --format=gnu \
+      --sort=name \
+      --mtime="@$SOURCE_DATE_EPOCH" \
+      --hard-dereference \
+      $releaseName
+
+    tar \
+      --create \
+      --file="$out/tarballs/$releaseName.tar.zst" \
+      --use-compress-program="zstd -19 -T0" \
+      --absolute-names \
+      --owner=0 \
+      --group=0 \
+      --numeric-owner \
+      --format=gnu \
+      --sort=name \
+      --mtime="@$SOURCE_DATE_EPOCH" \
+      --hard-dereference \
+      $releaseName
  '';
 }
--- a/nixos/modules/services/video/wivrn.nix
+++ b/nixos/modules/services/video/wivrn.nix
@@ -24,6 +24,7 @@ let
    getExe
    types
    maintainers
+    makeBinPath
    ;
  cfg = config.services.wivrn;
  configFormat = pkgs.formats.json { };
@@ -63,13 +64,24 @@ let
  enabledConfig = optionalString cfg.config.enable "-f ${configFile}";

  # Manage server executables and flags
-  serverExec = concatStringsSep " " (
+  serverCmdline = concatStringsSep " " (
    [
      serverPackageExe
      enabledConfig
    ]
    ++ cfg.extraServerFlags
  );
+  serverExec =
+    if cfg.steam.enable then
+      lib.getExe (
+        pkgs.writeShellScriptBin "start-wivrn-server" ''
+          # The server needs Steam in PATH to open Steam games from the application launcher
+          export PATH="${makeBinPath [ cfg.steam.package ]}:$PATH"
+          exec -a wivrn-server ${serverCmdline}
+        ''
+      )
+    else
+      serverCmdline;
 in
 {
  imports = [
@@ -184,6 +196,11 @@ in
            IPC_EXIT_ON_DISCONNECT = "off";
            PRESSURE_VESSEL_IMPORT_OPENXR_1_RUNTIMES = mkIf cfg.steam.importOXRRuntimes "1";
          } cfg.monadoEnvironment;
+          # WiVRn scans for .desktop files in $XDG_DATA_DIRS for the application launcher,
+          # which will execute the command in Exec when selected in the headset. If the
+          # Exec path isn't absolute, it will be resolved relative to $PATH, so we must
+          # not override the value of $PATH.
+          enableDefaultPath = false;
          serviceConfig = (
            if cfg.highPriority then
              {
@@ -211,8 +228,6 @@ in
                RestrictSUIDSGID = true;
              }
          );
-          # Needs Steam in the PATH to allow launching games from the headset
-          path = mkIf cfg.steam.enable [ cfg.steam.package ];
          wantedBy = mkIf cfg.autoStart [ "default.target" ];
          restartTriggers = [
            cfg.package
--- a/nixos/tests/unbound.nix
+++ b/nixos/tests/unbound.nix
@@ -7,6 +7,7 @@
    * running a recursive DNS resolver on the local machine, forwarding to a local DNS server via TCP/853 (DoT)
    * running a recursive DNS resolver on a machine in the network awaiting input from clients over TCP/53 & UDP/53
    * running a recursive DNS resolver on a machine in the network awaiting input from clients over TCP/853 (DoT)
+    * running a recursive DNS resolver on a machine in the network awaiting input from clients over UDP/853 (DoQ)

  In the below test setup we are trying to implement all of those use cases.

@@ -100,7 +101,7 @@ in
      };

    # The resolver that knows that forwards (only) to the authoritative server
-    # and listens on UDP/53, TCP/53 & TCP/853.
+    # and listens on UDP/53, TCP/53, TCP/853 & UDP/853.
    resolver =
      { lib, nodes, ... }:
      {
@@ -122,7 +123,10 @@ in
          853 # DNS over TLS
          443 # DNS over HTTPS
        ];
-        networking.firewall.allowedUDPPorts = [ 53 ];
+        networking.firewall.allowedUDPPorts = [
+          53 # regular DNS
+          853 # DNS over QUIC
+        ];

        services.unbound = {
          enable = true;
@@ -150,6 +154,8 @@ in
              ];
              tls-service-pem = "${cert}/cert.pem";
              tls-service-key = "${cert}/key.pem";
+              quic-port = 853;
+              quic-size = "8m";
            };
            forward-zone = [
              {
@@ -306,7 +312,7 @@ in
              assert expected == out, f"Expected `{expected}` but got `{out}`"


-      def test(machine, remotes, /, doh=False, zone=zone, records=records, args=[]):
+      def test(machine, remotes, /, doh=False, doq=False, zone=zone, records=records, args=[]):
          """
          Run queries for the given remotes on the given machine.
          """
@@ -331,6 +337,15 @@ in
                          expected,
                          ["+https"] + args,
                      )
+                  if doq:
+                      query(
+                          machine,
+                          remote,
+                          query_type,
+                          zone,
+                          expected,
+                          ["+quic"] + args,
+                      )


      client.start()
@@ -348,12 +363,12 @@ in

      # verify that the resolver is able to resolve on all the local protocols
      with subtest("test that the resolver resolves on all protocols and transports"):
-          test(resolver, ["::1", "127.0.0.1"], doh=True)
+          test(resolver, ["::1", "127.0.0.1"], doh=True, doq=True)

      resolver.wait_for_unit("multi-user.target")

      with subtest("client should be able to query the resolver"):
-          test(client, ["${(lib.head nodes.resolver.networking.interfaces.eth1.ipv6.addresses).address}", "${(lib.head nodes.resolver.networking.interfaces.eth1.ipv4.addresses).address}"], doh=True)
+          test(client, ["${(lib.head nodes.resolver.networking.interfaces.eth1.ipv6.addresses).address}", "${(lib.head nodes.resolver.networking.interfaces.eth1.ipv4.addresses).address}"], doh=True, doq=True)

      # discard the client we do not need anymore
      client.shutdown()
--- a/nixos/tests/web-apps/dashy.nix
+++ b/nixos/tests/web-apps/dashy.nix
@@ -1,6 +1,5 @@
 { pkgs, lib, ... }:
 let
-
  customSettings = {
    pageInfo = {
      title = "My Custom Dashy Title";
@@ -45,29 +44,29 @@ in
        }
      ];
    };
-  nodes = {
-    machine = { };
+  containers = {
+    container = { };

-    machine-custom = {
+    custom = {
      services.dashy.settings = customSettings;
    };
  };

  testScript = ''
    start_all()
-    machine.wait_for_unit("nginx.service")
-    machine.wait_for_open_port(80)
+    container.wait_for_unit("nginx.service")
+    container.wait_for_open_port(80)

-    actual = machine.succeed("curl -v --stderr - http://dashy.local/", timeout=10)
+    actual = container.succeed("curl -v --stderr - http://dashy.local/", timeout=10)
    expected = "<title>Dashy</title>"
    assert expected in actual, \
      f"unexpected reply from Dashy, expected: '{expected}' got: '{actual}'"

-    machine_custom.wait_for_unit("nginx.service")
-    machine_custom.wait_for_open_port(80)
+    custom.wait_for_unit("nginx.service")
+    custom.wait_for_open_port(80)

-    actual_custom = machine_custom.succeed("curl -s --stderr - http://dashy.local/conf.yml", timeout=10).strip()
-    expected_custom = machine_custom.succeed("cat ${customSettingsYaml}").strip()
+    actual_custom = custom.succeed("curl -s --stderr - http://dashy.local/conf.yml", timeout=10).strip()
+    expected_custom = custom.succeed("cat ${customSettingsYaml}").strip()

    assert expected_custom == actual_custom, \
      f"unexpected reply from Dashy, expected: '{expected_custom}' got: '{actual_custom}'"
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -1,10 +1,10 @@
 {
  "chromium": {
-    "version": "150.0.7871.100",
+    "version": "150.0.7871.114",
    "chromedriver": {
-      "version": "150.0.7871.101",
-      "hash_darwin": "sha256-LJPfzeJjVcEHenRNqKNOGcEZLL/rHRH55yBefLFTlEs=",
-      "hash_darwin_aarch64": "sha256-+WZw22dgaDsDMOQUJTjTuCGyUZT1t1RBjutyqmumX/A="
+      "version": "150.0.7871.115",
+      "hash_darwin": "sha256-3QytnwfqPqpYL2TMTMykvT+yAfZqWiRHMbMEK+whe0Q=",
+      "hash_darwin_aarch64": "sha256-jJ1URVS4led/1rTODm3t8wewJ8oIOzKIrq1utn5JJ3s="
    },
    "deps": {
      "depot_tools": {
@@ -21,8 +21,8 @@
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "b5a9b587b83512ef1fab99cb7510c58a06d22089",
-        "hash": "sha256-bylGmZC9NhUjcU6amK3mwuZ1it7uTm2hsC60DaKINr4=",
+        "rev": "f405107495a07cb1bfcf687d4af8d91117098db6",
+        "hash": "sha256-VdDnFbE+/leFzR/PqR3ColKKqwkvuY/LsFje0nrwiXU=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@@ -92,8 +92,8 @@
      },
      "src/third_party/angle": {
        "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "bbf3d8a4755268f016087be2f56099fa5a5f3f6e",
-        "hash": "sha256-8iuHtNgHumlMXeXj2k0ZPcvnTeJ00di298+789OjScs="
+        "rev": "8d3c5a8caebd836b99fa32062951a401910eba33",
+        "hash": "sha256-7X8FSWCA+BpAXbUPvjPyiGagmVXsadRGAY5haAEzRL8="
      },
      "src/third_party/angle/third_party/glmark2/src": {
        "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -262,8 +262,8 @@
      },
      "src/third_party/devtools-frontend/src": {
        "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "1d67dc0dafa344bbd6ca75c124e2d6d9d53074d8",
-        "hash": "sha256-VBXch2YwnKm+lMcZ5L0SlW+vAYeaSwgZvcOhg1TE5/A="
+        "rev": "ec97cf3bbeea2cb623fbf97c4e3f22f5acb4d568",
+        "hash": "sha256-kbGcNwpdmqFTIAe/OU3Y1C13ZEHz5OP+QDAExg6tw2g="
      },
      "src/third_party/dom_distiller_js/dist": {
        "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -827,8 +827,8 @@
      },
      "src/v8": {
        "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "968f19a8970f8d91702d86f0ec1522f3909781b7",
-        "hash": "sha256-x3rCWvC3hEjyJq6PNThhZEp4oRF9Y1JJEPnZTqVNVrY="
+        "rev": "ce0af5c0d181678bcda077c68d4beaec2854ad16",
+        "hash": "sha256-gjuH2HQAC0poQileS8JLusocBDoShuaQ9pbaAXmFj4g="
      },
      "src/agents/shared": {
        "url": "https://chromium.googlesource.com/chromium/agents.git",
@@ -838,7 +838,7 @@
    }
  },
  "ungoogled-chromium": {
-    "version": "150.0.7871.100",
+    "version": "150.0.7871.114",
    "deps": {
      "depot_tools": {
        "rev": "f4fadaf6a5ba1bced9d3d9021060667b563bf583",
@@ -850,16 +850,16 @@
        "hash": "sha256-/1A+DkzAQj2zGPe/A/G0Z3VrYJXUxq4Hd/+d/o5p3G8="
      },
      "ungoogled-patches": {
-        "rev": "150.0.7871.100-1",
-        "hash": "sha256-a+bGt3sROlE9edUBN2/VGn/grN6BqxWX/bsUlAVoAxY="
+        "rev": "150.0.7871.114-1",
+        "hash": "sha256-qvAtrj013U44vU+U3JLuItAPbgtHwm9Kq7hU2NLYDaE="
      },
      "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
    },
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "b5a9b587b83512ef1fab99cb7510c58a06d22089",
-        "hash": "sha256-bylGmZC9NhUjcU6amK3mwuZ1it7uTm2hsC60DaKINr4=",
+        "rev": "f405107495a07cb1bfcf687d4af8d91117098db6",
+        "hash": "sha256-VdDnFbE+/leFzR/PqR3ColKKqwkvuY/LsFje0nrwiXU=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@@ -929,8 +929,8 @@
      },
      "src/third_party/angle": {
        "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "bbf3d8a4755268f016087be2f56099fa5a5f3f6e",
-        "hash": "sha256-8iuHtNgHumlMXeXj2k0ZPcvnTeJ00di298+789OjScs="
+        "rev": "8d3c5a8caebd836b99fa32062951a401910eba33",
+        "hash": "sha256-7X8FSWCA+BpAXbUPvjPyiGagmVXsadRGAY5haAEzRL8="
      },
      "src/third_party/angle/third_party/glmark2/src": {
        "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -1099,8 +1099,8 @@
      },
      "src/third_party/devtools-frontend/src": {
        "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "1d67dc0dafa344bbd6ca75c124e2d6d9d53074d8",
-        "hash": "sha256-VBXch2YwnKm+lMcZ5L0SlW+vAYeaSwgZvcOhg1TE5/A="
+        "rev": "ec97cf3bbeea2cb623fbf97c4e3f22f5acb4d568",
+        "hash": "sha256-kbGcNwpdmqFTIAe/OU3Y1C13ZEHz5OP+QDAExg6tw2g="
      },
      "src/third_party/dom_distiller_js/dist": {
        "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -1664,8 +1664,8 @@
      },
      "src/v8": {
        "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "968f19a8970f8d91702d86f0ec1522f3909781b7",
-        "hash": "sha256-x3rCWvC3hEjyJq6PNThhZEp4oRF9Y1JJEPnZTqVNVrY="
+        "rev": "ce0af5c0d181678bcda077c68d4beaec2854ad16",
+        "hash": "sha256-gjuH2HQAC0poQileS8JLusocBDoShuaQ9pbaAXmFj4g="
      },
      "src/agents/shared": {
        "url": "https://chromium.googlesource.com/chromium/agents.git",
--- a/pkgs/applications/networking/mailreaders/thunderbird-bin/release_sources.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird-bin/release_sources.nix
--- a/pkgs/applications/office/softmaker/softmaker-office-nx.nix
+++ b/pkgs/applications/office/softmaker/softmaker-office-nx.nix
@@ -6,9 +6,9 @@
  # overridable. This is useful when the upstream archive was replaced
  # and nixpkgs is not in sync yet.
  officeVersion ? {
-    version = "1230";
+    version = "1234";
    edition = "";
-    hash = "sha256-/4qKFnLoou1ZuGkRt+2Yf/FPGOnYhx7fnE+8D3gutaY=";
+    hash = "sha256-00bscKt+4aE94x6wKGqXh6tE2GiDll6F4gWZZBEl2JE=";
  },

  ...
--- a/pkgs/applications/office/softmaker/softmaker-office.nix
+++ b/pkgs/applications/office/softmaker/softmaker-office.nix
@@ -7,9 +7,9 @@
  # Softmaker Office or when the upstream archive was replaced and
  # nixpkgs is not in sync yet.
  officeVersion ? {
-    version = "1230";
+    version = "1234";
    edition = "2024";
-    hash = "sha256-xaXS22feHbRVPWP43vGbfptoT2S6jLUrGVFQ3xY7SJY=";
+    hash = "sha256-oIO/p52ASIU0qjQqxp/l9GVrUK+LQNQxX1wKheKHT3w=";
  },

  ...
--- a/pkgs/by-name/ac/acli/sources.json
+++ b/pkgs/by-name/ac/acli/sources.json
@@ -1,21 +1,21 @@
 {
-  "version": "1.3.21-stable",
+  "version": "1.3.22-stable",
  "sources": {
    "aarch64-darwin": {
-      "url": "https://acli.atlassian.com/darwin/1.3.21-stable/acli_1.3.21-stable_darwin_arm64.tar.gz",
-      "sha256": "39687d1c18054736f7264d76d33ceb89e8ebf480fbbba9541d9fefdda94ded66"
+      "url": "https://acli.atlassian.com/darwin/1.3.22-stable/acli_1.3.22-stable_darwin_arm64.tar.gz",
+      "sha256": "3a9a6ff1bb0bce5902780e26e748b18b9adb4489df67d88ea878f4b7673944ad"
    },
    "aarch64-linux": {
-      "url": "https://acli.atlassian.com/linux/1.3.21-stable/acli_1.3.21-stable_linux_arm64.tar.gz",
-      "sha256": "b6104cd1737613fe4b24c20619965bb59b7b9bc09e39fb95f41a671b2b320ab8"
+      "url": "https://acli.atlassian.com/linux/1.3.22-stable/acli_1.3.22-stable_linux_arm64.tar.gz",
+      "sha256": "1a9e86d0b46a62a8f1992c1ef98b3af7e9a9ee3f76d0efa215fe1f2d1b2fd139"
    },
    "x86_64-darwin": {
-      "url": "https://acli.atlassian.com/darwin/1.3.21-stable/acli_1.3.21-stable_darwin_amd64.tar.gz",
-      "sha256": "75f08d45886f770117405bb5b053bfa4c8e98045afe3dfa965905fabd8825f5c"
+      "url": "https://acli.atlassian.com/darwin/1.3.22-stable/acli_1.3.22-stable_darwin_amd64.tar.gz",
+      "sha256": "993fd692700d602fd1e3cff7f1d29f70e44a2ebb8056fbb93bdc8aed1e5cbbd4"
    },
    "x86_64-linux": {
-      "url": "https://acli.atlassian.com/linux/1.3.21-stable/acli_1.3.21-stable_linux_amd64.tar.gz",
-      "sha256": "f158f6e8f6ae7e279d1ced8ce85a93647aa70c42c29f0d5ad303ebd3c727f956"
+      "url": "https://acli.atlassian.com/linux/1.3.22-stable/acli_1.3.22-stable_linux_amd64.tar.gz",
+      "sha256": "de9e0a60a556e4119428b9072f6ca787e75b9f9a538aa71ebcc8084deb8ca1a6"
    }
  }
 }
--- a/pkgs/by-name/be/bencher-cli/package.nix
+++ b/pkgs/by-name/be/bencher-cli/package.nix
@@ -0,0 +1,80 @@
+{
+  lib,
+  fetchFromGitHub,
+  rustPlatform,
+  mold,
+  nix-update-script,
+  versionCheckHook,
+  rustc,
+}:
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "bencher-cli";
+  version = "0.6.8";
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "bencherdev";
+    repo = "bencher";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-MlRj56QXRrvfBxi6+B6vpEKlDWMFB+V1CzQYOiGFpHE=";
+  };
+
+  cargoHash = "sha256-biCHEePgVxrnGUj94bwWrp9GVhspiMjcMRdp3A7O2h0=";
+
+  nativeBuildInputs = [ mold ];
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  cargoBuildFlags = [ "--package=bencher_cli" ];
+  cargoTestFlags = [ "--package=bencher_cli" ];
+  # Build the open-source version
+  buildNoDefaultFeatures = true;
+  checkNoDefaultFeatures = finalAttrs.buildNoDefaultFeatures;
+
+  postPatch = lib.optionalString finalAttrs.buildNoDefaultFeatures ''
+    # Replaces the proprietary Rust files with empty files
+    # This is just a safeguard, the build shouldn't touch these files anyways
+    echo "find . -path '*/plus/*' -type f ! -name Cargo.toml -exec truncate -s 0 {} +"
+    find . -path '*/plus/*' -type f ! -name Cargo.toml -exec truncate -s 0 {} +
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Command-Line interface for the Bencher continuous benchmarking platform";
+    mainProgram = "bencher";
+    longDescription = ''
+      Bencher is a suite of continuous benchmarking tools.
+      Bencher allows you to detect and prevent performance regressions
+      *before* they hit production.
+
+      - Run: Run your benchmarks locally or in CI using your favorite
+        benchmarking tools. The bencher CLI simply wraps your existing
+        benchmark harness and stores its results.
+      - Track: Track the results of your benchmarks over time. Monitor, query,
+        and graph the results using the Bencher web console based on the source
+        branch, testbed, benchmark, and measure.
+      - Catch: Catch performance regressions in CI. Bencher uses state of the
+        art, customizable analytics to detect performance regressions before
+        they make it to production.
+
+      Bencher's source repo includes non-free features, included in the build
+      as the Cargo feature "plus".
+      Files in the plus directories are proprietary, while the other files
+      are dual Apache-2.0/MIT licensed.
+      The Nix derivation does not compile the proprietary features.
+    '';
+    homepage = "https://bencher.dev";
+    license =
+      if finalAttrs.buildNoDefaultFeatures then
+        lib.licenses.OR [
+          lib.licenses.asl20
+          lib.licenses.mit
+        ]
+      else
+        lib.licenses.unfree;
+    platforms = rustc.meta.platforms;
+    maintainers = [ lib.maintainers.skyesoss ];
+  };
+})
--- a/pkgs/by-name/bl/blas/package.nix
+++ b/pkgs/by-name/bl/blas/package.nix
@@ -3,7 +3,7 @@
  stdenv,
  lapack-reference,
  openblas,
-  openmpCheckPhaseHook,
+  checkPhaseThreadLimitHook,
  isILP64 ? false,
  blasProvider ? openblas,
 }:
@@ -188,7 +188,7 @@ stdenv.mkDerivation {
  ];

  propagatedNativeBuildInputs = [
-    openmpCheckPhaseHook
+    checkPhaseThreadLimitHook
  ];

  meta = (blasProvider'.meta or { }) // {
--- a/pkgs/by-name/bl/blink-qt/fix-none-account.patch
+++ b/pkgs/by-name/bl/blink-qt/fix-none-account.patch
@@ -0,0 +1,25 @@
+From 6e438d1ab9f9da5e55b0cc96ea81fbac1f1a871b Mon Sep 17 00:00:00 2001
+From: phanirithvij <phanirithvij2000@gmail.com>
+Date: Sun, 5 Jul 2026 19:40:36 +0530
+Subject: [PATCH] fix: handle None default_account on startup
+
+---
+ blink/mainwindow.py | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/blink/mainwindow.py b/blink/mainwindow.py
+index d0baa21..77c67e8 100644
+--- a/blink/mainwindow.py
+++ b/blink/mainwindow.py
+@@ -1109,7 +1109,7 @@ class MainWindow(base_class, ui_class):
+ 
+     def _NH_SIPAccountManagerDidStart(self, notification):
+         account = notification.sender.default_account
+-        if account is not BonjourAccount() and account.sms.enable_pgp and account.sms.private_key is not None and os.path.exists(account.sms.private_key.normalized):
+        if account is not None and account is not BonjourAccount() and account.sms.enable_pgp and account.sms.private_key is not None and os.path.exists(account.sms.private_key.normalized):
+             self.export_pgp_key_action.setEnabled(True)
+ 
+     def _NH_SIPAccountManagerDidRemoveAccount(self, notification):
+-- 
+2.54.0
+
--- a/pkgs/by-name/bl/blink-qt/package.nix
+++ b/pkgs/by-name/bl/blink-qt/package.nix
@@ -5,26 +5,24 @@
  python3Packages,
  qt6Packages,
  libvncserver,
+  stdenv,
 }:

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "blink-qt";
-  version = "6.0.4";
+  version = "6.0.6";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "AGProjects";
    repo = "blink-qt";
    tag = finalAttrs.version;
-    hash = "sha256-QESg9yo5oddYqSKuFLSMI2Oju3FCq97+j0uJDK85Yy8=";
+    hash = "sha256-0hsuAYYp7KvfxErAcN4EX8G3goirGRmpijJfAMvbZJQ=";
  };

  patches = [
-    # Remove when version > 6.0.4
-    (fetchpatch2 {
-      url = "https://github.com/AGProjects/blink-qt/commit/45343c90ae0680a3d03589fa8a12ac1eb85a6925.patch";
-      hash = "sha256-XwV5L3r0IqWkhlaJypS2cHkDCcoumOgEEqDpdcaTviE=";
-    })
+    # Remove once https://github.com/AGProjects/blink-qt/pull/7 is mereged and tagged
+    ./fix-none-account.patch
  ];

  nativeBuildInputs = [ qt6Packages.wrapQtAppsHook ];
@@ -40,26 +38,31 @@ python3Packages.buildPythonApplication (finalAttrs: {
    qt6Packages.qtsvg
  ];

-  dependencies = with python3Packages; [
-    dateutils
-    dnspython
-    google-api-python-client
-    lxml
-    lxml-html-clean
-    msrplib
-    oauth2client
-    otr
-    pgpy
-    pyqt6
-    pyqt6-webengine
-    python3-application
-    python3-eventlib
-    python3-gnutls
-    python3-sipsimple
-    sqlobject
-    standard-imghdr
-    xcaplib
-  ];
+  dependencies =
+    with python3Packages;
+    [
+      dateutils
+      dnspython
+      google-auth-oauthlib
+      google-api-python-client
+      lxml
+      lxml-html-clean
+      msrplib
+      otr
+      pgpy
+      pyqt6
+      pyqt6-webengine
+      python3-application
+      python3-eventlib
+      python3-gnutls
+      python3-sipsimple
+      sqlobject
+      standard-imghdr
+      xcaplib
+    ]
+    ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      numpy
+    ];

  dontWrapQtApps = true;

--- a/pkgs/by-name/bl/blis/package.nix
+++ b/pkgs/by-name/bl/blis/package.nix
@@ -5,6 +5,12 @@
  perl,
  python3,

+  # sets BLIS_NUM_THREADS and OMP_NUM_THREADS for packages
+  # invoking blis during checkPhase/installCheckPhase to
+  # avoid overloading builders with excessive parallelism
+  # See also: https://github.com/flame/blis/blob/b8b75b4e19459f5d618b57aa814ca38b1d82eb82/docs/Multithreading.md#specifying-multithreading
+  checkPhaseThreadLimitHook,
+
  # Enable BLAS interface with 64-bit integer width.
  blas64 ? false,

@@ -36,6 +42,10 @@ stdenv.mkDerivation (finalAttrs: {
    python3
  ];

+  propagatedNativeBuildInputs = [
+    checkPhaseThreadLimitHook
+  ];
+
  doCheck = true;

  enableParallelBuilding = true;
--- a/pkgs/by-name/ch/charm-freeze/package.nix
+++ b/pkgs/by-name/ch/charm-freeze/package.nix
@@ -23,6 +23,8 @@ buildGoModule (finalAttrs: {
    "-X=main.Version=${finalAttrs.version}"
  ];

+  excludedPackages = [ "test/input" ];
+
  meta = {
    description = "Tool to generate images of code and terminal output";
    mainProgram = "freeze";
--- a/pkgs/by-name/ch/checkPhaseThreadLimitHook/hook.sh
+++ b/pkgs/by-name/ch/checkPhaseThreadLimitHook/hook.sh
@@ -0,0 +1,32 @@
+setupThreadLimit() {
+  # Limit number of threads used during checks. Default is "all cores".
+  # Using all cores causes high load on builders if checks are executed with NIX_BUILD_CORE parallelism.
+  # This gets even worse if multiple builds are scheduled on the same machine, potentially growing O(n^3) without explicit core limits.
+
+  # global value to override all of these at once
+  NIX_CHECK_PHASE_DEFAULT_NUM_THREADS="${NIX_CHECK_PHASE_DEFAULT_NUM_THREADS:-1}"
+
+  thread_vars=(
+    OMP_NUM_THREADS
+    OPENBLAS_NUM_THREADS
+    MKL_NUM_THREADS
+    BLIS_NUM_THREADS
+    VECLIB_MAXIMUM_THREADS
+    NUMBA_NUM_THREADS
+    NUMEXPR_NUM_THREADS
+  )
+
+  echo "setting known thread variables to default: $NIX_CHECK_PHASE_DEFAULT_NUM_THREADS"
+  for var in "${thread_vars[@]}"; do
+    export "$var=${!var:-$NIX_CHECK_PHASE_DEFAULT_NUM_THREADS}"
+    printf " %s=%s" "$var" "${!var}"
+  done
+  printf "\n"
+}
+
+
+if [[ -z "${dontLimitCheckPhaseThreads-}" ]]; then
+    echo "Using checkPhaseThreadLimitHook"
+    preCheckHooks+=('setupThreadLimit')
+    preInstallCheckHooks+=('setupThreadLimit')
+fi
--- a/pkgs/by-name/ch/checkPhaseThreadLimitHook/package.nix
+++ b/pkgs/by-name/ch/checkPhaseThreadLimitHook/package.nix
@@ -0,0 +1,15 @@
+{
+  lib,
+  makeSetupHook,
+}:
+
+makeSetupHook {
+  name = "check-phase-thread-limit-hook";
+
+  __structuredAttrs = true;
+
+  meta = {
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ grimmauld ];
+  };
+} ./hook.sh
--- a/pkgs/by-name/co/cosmic-applets/package.nix
+++ b/pkgs/by-name/co/cosmic-applets/package.nix
@@ -20,14 +20,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-applets";
-  version = "1.1.0";
+  version = "1.2.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-applets";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-A8Qk9u3Q83Q4AjzTrdptfS9UNoyKq39YihC4d/dNBYc=";
+    hash = "sha256-tygAgaafoU0CnTzKPb00uVaYTieCJ4uNjux3AYyYtXQ=";
  };

  cargoPatches = [
--- a/pkgs/by-name/co/cosmic-applibrary/package.nix
+++ b/pkgs/by-name/co/cosmic-applibrary/package.nix
@@ -11,7 +11,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-applibrary";
-  version = "1.1.0";
+  version = "1.2.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
--- a/pkgs/by-name/co/cosmic-bg/package.nix
+++ b/pkgs/by-name/co/cosmic-bg/package.nix
@@ -13,14 +13,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-bg";
-  version = "1.1.0";
+  version = "1.2.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-bg";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-bczUWa91l52P6Q46/lkX1j9eKasM154D82fBaLFHF1M=";
+    hash = "sha256-r/7eyaUwxXNbfzO+7TCa25JaOefGF/hY+PBHFJtpoiw=";
  };

  postPatch = ''
@@ -29,7 +29,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      "${cosmic-wallpapers}/share/backgrounds/cosmic/orion_nebula_nasa_heic0601a.jpg"
  '';

-  cargoHash = "sha256-UDhXKg4lO6op/lfi3aZ4iclzUqcf5xQI85UWAHVTWig=";
+  cargoHash = "sha256-jU6KesqaHnfVZfCtDKrG/pVaJzh3Q5Q6UDMlOoFiLeY=";

  separateDebugInfo = true;
  __structuredAttrs = true;
--- a/pkgs/by-name/co/cosmic-comp/package.nix
+++ b/pkgs/by-name/co/cosmic-comp/package.nix
@@ -20,17 +20,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-comp";
-  version = "1.1.0";
+  version = "1.2.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-comp";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-fUuw7qwfojAmu/mkWMkWBhpcSgZNTIzdXmInjyKrZBI=";
+    hash = "sha256-yhgjdkAzUipGAo7Jv9hWlhOb/dLXn1/68yX+tRO6UV4=";
  };

-  cargoHash = "sha256-ki+unf58rXBCpj5PCpBcg/6FWo16+MdPQWae+w1YkJ8=";
+  cargoHash = "sha256-Yi1nVvWmFzlXxHN01BeeGc9YRqrRoVXTqehisOrGWS0=";

  separateDebugInfo = true;

--- a/pkgs/by-name/co/cosmic-edit/package.nix
+++ b/pkgs/by-name/co/cosmic-edit/package.nix
@@ -16,17 +16,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-edit";
-  version = "1.1.0";
+  version = "1.2.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-edit";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-5DsnhaiJgmTakn+q9o2Q7IeuakAC/j0Ck3F3pfFx/EA=";
+    hash = "sha256-w6Os3R//40ED9q6wyiABmIgofdj+WaLZPD/4+1EF7aY=";
  };

-  cargoHash = "sha256-2E+98uWtahyQufoZTzdUtkwbuISsUHwlqOmMSpyi1O8=";
+  cargoHash = "sha256-/OnmUO7WFXvZPq+0nPe2BKbYZRR0Ku+V8+qeLWnYHPQ=";

  separateDebugInfo = true;

--- a/pkgs/by-name/co/cosmic-files/package.nix
+++ b/pkgs/by-name/co/cosmic-files/package.nix
@@ -12,17 +12,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-files";
-  version = "1.1.0";
+  version = "1.2.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-files";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-cRwZrmm/zOIV6VCyz2dTH+qn8h6LOnaOiHU5nENTK6o=";
+    hash = "sha256-ZjV5HkVzDHH96OcaHSKKrTJdOSp3NqWHbLgtq/GOQ+M=";
  };

-  cargoHash = "sha256-+21DCCTkNrbdxgxQi0YyuAxpl1IvwUz3ccUE+E0sZ4Y=";
+  cargoHash = "sha256-HWkuWaF2UP5brDW39nq1pn9Zp1XgEUToumuD4MmHhU8=";

  separateDebugInfo = true;
  __structuredAttrs = true;
--- a/pkgs/by-name/co/cosmic-greeter/package.nix
+++ b/pkgs/by-name/co/cosmic-greeter/package.nix
@@ -19,14 +19,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-greeter";
-  version = "1.1.0";
+  version = "1.2.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-greeter";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-oxXCAvBISkZu76VpvQ9AliFRJ8r5Ay7mjWf4sEwV0Xs=";
+    hash = "sha256-JaPF2kFXQLumPBn8JFBiaSJ/tP3QqK/hwhy5rZrLuY4=";
  };

  cargoHash = "sha256-mfY2hsMxBooRjmTB2jgUIKyKHBpGfZ9Qslwv+2aEQyg=";
--- a/pkgs/by-name/co/cosmic-icons/package.nix
+++ b/pkgs/by-name/co/cosmic-icons/package.nix
@@ -9,7 +9,7 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "cosmic-icons";
-  version = "1.1.0";
+  version = "1.2.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
--- a/pkgs/by-name/co/cosmic-idle/package.nix
+++ b/pkgs/by-name/co/cosmic-idle/package.nix
@@ -16,7 +16,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-idle";
-  version = "1.1.0";
+  version = "1.2.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
--- a/pkgs/by-name/co/cosmic-initial-setup/package.nix
+++ b/pkgs/by-name/co/cosmic-initial-setup/package.nix
@@ -14,7 +14,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-initial-setup";
-  version = "1.1.0";
+  version = "1.2.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
--- a/pkgs/by-name/co/cosmic-launcher/package.nix
+++ b/pkgs/by-name/co/cosmic-launcher/package.nix
@@ -11,14 +11,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-launcher";
-  version = "1.1.0";
+  version = "1.2.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-launcher";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-9U64nSeI47bkc8BQU9ilXBlHQRGS2zC/FcBKc7Z17RY=";
+    hash = "sha256-Dy1sOEe/Cb1wyXHETZ5wJt8IcJMGw19OeDGOhuv4kQg=";
  };

  cargoHash = "sha256-WnZAPQR8hGGNC5S7hPmcGSMs9HrOw4/wqJR151eIgHY=";
--- a/pkgs/by-name/co/cosmic-monitor/package.nix
+++ b/pkgs/by-name/co/cosmic-monitor/package.nix
@@ -11,17 +11,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-monitor";
-  version = "1.1.0";
+  version = "1.2.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-monitor";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-CiJ9LeNcdOyC8yn0c7hCz0QEecxYK95KGvs1SWr9360=";
+    hash = "sha256-6Iz2CMcw131GrgSsSk2FgnwAnges1yMeEwblrusCc24=";
  };

-  cargoHash = "sha256-OMhLPQ3GkV/wdeb9F7lsKY1Uzzg8+UlhOeakGZo6mYk=";
+  cargoHash = "sha256-INILXUO4637bcq51OV+ENJG306kXOrKN8547/RRSG0k=";

  separateDebugInfo = true;
  __structuredAttrs = true;
--- a/pkgs/by-name/co/cosmic-notifications/package.nix
+++ b/pkgs/by-name/co/cosmic-notifications/package.nix
@@ -12,7 +12,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-notifications";
-  version = "1.1.0";
+  version = "1.2.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
--- a/pkgs/by-name/co/cosmic-osd/package.nix
+++ b/pkgs/by-name/co/cosmic-osd/package.nix
@@ -15,7 +15,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-osd";
-  version = "1.1.0";
+  version = "1.2.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
--- a/pkgs/by-name/co/cosmic-panel/package.nix
+++ b/pkgs/by-name/co/cosmic-panel/package.nix
@@ -11,7 +11,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-panel";
-  version = "1.1.0";
+  version = "1.2.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
--- a/pkgs/by-name/co/cosmic-player/package.nix
+++ b/pkgs/by-name/co/cosmic-player/package.nix
@@ -18,17 +18,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-player";
-  version = "1.1.0";
+  version = "1.2.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-player";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-aHQbwpNr8tsfUR0Dm4WTzz6XNXjgdqZ9/2AQRPPbnog=";
+    hash = "sha256-4oIfTsEGMVmgS0VWLnQ1xAcPAzBeYaGT8xU3b/ObeO8=";
  };

-  cargoHash = "sha256-KVaKTMrWijResBqzH62j/YqBR4TQ77x2sK/kN40UWjw=";
+  cargoHash = "sha256-aY5QYZ1OjiCHgfFysTTU6Wp/1IexAWjuZCkTFuFY1PI=";

  separateDebugInfo = true;
  __structuredAttrs = true;
--- a/pkgs/by-name/co/cosmic-randr/package.nix
+++ b/pkgs/by-name/co/cosmic-randr/package.nix
@@ -12,7 +12,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-randr";
-  version = "1.1.0";
+  version = "1.2.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
--- a/pkgs/by-name/co/cosmic-screenshot/package.nix
+++ b/pkgs/by-name/co/cosmic-screenshot/package.nix
@@ -11,7 +11,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-screenshot";
-  version = "1.1.0";
+  version = "1.2.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
--- a/pkgs/by-name/co/cosmic-session/package.nix
+++ b/pkgs/by-name/co/cosmic-session/package.nix
@@ -12,14 +12,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-session";
-  version = "1.1.0";
+  version = "1.2.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-session";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-FphY53MaOUUR2oQfZak3HbT+kvysUnw2AIc4L9O+TcU=";
+    hash = "sha256-nKrdjvD1dcFvwhCiruM/bxrh8CYOWnoVgJj/2nkfEFg=";
  };

  cargoHash = "sha256-5dLG40X+yxJo566guyHqOCLNp+uNSE+HONS8GIDm58A=";
--- a/pkgs/by-name/co/cosmic-settings-daemon/package.nix
+++ b/pkgs/by-name/co/cosmic-settings-daemon/package.nix
@@ -17,14 +17,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-settings-daemon";
-  version = "1.1.0";
+  version = "1.2.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-settings-daemon";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-6MLZpGGvE1EnUlRv2T6+iXy8B0aqBTNNrqDtBbeABYs=";
+    hash = "sha256-cCxcIRrLvCxWDujXuREukkxZ0qPl3SH4n1VWAR1c/QY=";
  };

  postPatch = ''
--- a/pkgs/by-name/co/cosmic-settings/package.nix
+++ b/pkgs/by-name/co/cosmic-settings/package.nix
@@ -27,14 +27,14 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-settings";
-  version = "1.1.0";
+  version = "1.2.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-settings";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-LfhFza0G85+fIuACMdwV50Okh5/46z8tLoJ9IvLqTgw=";
+    hash = "sha256-zs8QJc8bLbLLj1lqLsxdgkVOLIHqk+fOEyNEEmViv0g=";
  };

  cargoPatches = [
--- a/pkgs/by-name/co/cosmic-store/package.nix
+++ b/pkgs/by-name/co/cosmic-store/package.nix
@@ -15,17 +15,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-store";
-  version = "1.1.0";
+  version = "1.2.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-store";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-pePtfOgeQtaD15dfWzrMQmXcINf/V5ovKWAG8kOPf+c=";
+    hash = "sha256-DqkYwbEph6GJM9Gok/XaiIFyWnv0+W+geviyzrXmQ8I=";
  };

-  cargoHash = "sha256-jECZ/6hxaDfz2pOOqLkbq5HfF3YnCVK2geFAC+n286A=";
+  cargoHash = "sha256-IuMCYUZWtzvGyLMNb+Kwoj6M9fKaEYFMfcfYYVggVYw=";

  separateDebugInfo = true;
  __structuredAttrs = true;
--- a/pkgs/by-name/co/cosmic-term/package.nix
+++ b/pkgs/by-name/co/cosmic-term/package.nix
@@ -15,17 +15,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-term";
-  version = "1.1.0";
+  version = "1.2.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "cosmic-term";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-ocOPssCxm2p2HoAIHIAoAMh66cGcGXuGWDuAEtHFoPQ=";
+    hash = "sha256-0LGbe9oOwkNKU3XboEeZfi3isRbX95rIu+/VWWf6N68=";
  };

-  cargoHash = "sha256-ezFCpU4ZNfANYRVTMrvPMC79j55XGUwYMMKeihekYds=";
+  cargoHash = "sha256-JJQ+CLSaqdqTWcbb/Oj6a1vjIHXIYQsmMn+PtmHt0Gc=";

  separateDebugInfo = true;
  __structuredAttrs = true;
--- a/pkgs/by-name/co/cosmic-wallpapers/package.nix
+++ b/pkgs/by-name/co/cosmic-wallpapers/package.nix
@@ -7,7 +7,7 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "cosmic-wallpapers";
-  version = "1.1.0";
+  version = "1.2.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
--- a/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix
+++ b/pkgs/by-name/co/cosmic-workspaces-epoch/package.nix
@@ -14,7 +14,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cosmic-workspaces-epoch";
-  version = "1.1.0";
+  version = "1.2.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
--- a/pkgs/by-name/da/dashy-ui/package.nix
+++ b/pkgs/by-name/da/dashy-ui/package.nix
@@ -17,16 +17,16 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "dashy-ui";
-  version = "4.0.7";
+  version = "4.4.2";
  src = fetchFromGitHub {
    owner = "lissy93";
    repo = "dashy";
    tag = finalAttrs.version;
-    hash = "sha256-PWuynBFOp4A/0AC5Lc5zAkb5Y5DWJgdZHtDc/douYQc=";
+    hash = "sha256-4AJx/BoRVYA8dU6HrIvGYWflvppxNsi2PWSpnJLWR0w=";
  };
  yarnOfflineCache = fetchYarnDeps {
    yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-jU/XnX6i6P1CWWWyUeVXt2q2PXMExDvmPTiLBOEuHcE=";
+    hash = "sha256-oxVxzdap3dWi1ORP+eviFabO+G8GcFd0ZM3/a20Qbog=";
  };

  passthru = {
--- a/pkgs/by-name/do/docker-sbx/package.nix
+++ b/pkgs/by-name/do/docker-sbx/package.nix
@@ -0,0 +1,128 @@
+{
+  lib,
+  fetchurl,
+  stdenvNoCC,
+  installShellFiles,
+  autoPatchelfHook,
+  makeWrapper,
+  gccForLibs,
+  e2fsprogs,
+  lz4,
+  xxhash,
+  zlib,
+  zstd,
+  versionCheckHook,
+  nix-update-script,
+}:
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "docker-sbx";
+  version = "0.34.0";
+  src =
+    if stdenvNoCC.hostPlatform.system == "x86_64-linux" then
+      fetchurl {
+        url = "https://github.com/docker/sbx-releases/releases/download/v${finalAttrs.version}/DockerSandboxes-linux-amd64.tar.gz";
+        hash = "sha256-5H9LOyKi0/SBVJ0ld6OkcP1h9r9eHrAb4fsVVVdMusg=";
+      }
+    else if stdenvNoCC.hostPlatform.system == "aarch64-linux" then
+      fetchurl {
+        url = "https://github.com/docker/sbx-releases/releases/download/v${finalAttrs.version}/DockerSandboxes-linux-arm64.tar.gz";
+        hash = "sha256-dZ/ttnmaf62rA5Cs8YSmZGHVQoy9PQh3Ok/AnIjCqZ4=";
+      }
+    else if stdenvNoCC.hostPlatform.system == "aarch64-darwin" then
+      fetchurl {
+        url = "https://github.com/docker/sbx-releases/releases/download/v${finalAttrs.version}/DockerSandboxes-darwin.tar.gz";
+        hash = "sha256-aBh6NbtQ5o2zxuR+d1U1gZpm2bch/J3Y8GZ73DeUBUk=";
+      }
+    else
+      throw "Unsupported host platform ${stdenvNoCC.hostPlatform.system}";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  sourceRoot = if stdenvNoCC.hostPlatform.isDarwin then "." else null;
+
+  nativeBuildInputs = [
+    installShellFiles
+    versionCheckHook
+  ]
+  ++ lib.optionals stdenvNoCC.hostPlatform.isLinux [
+    autoPatchelfHook
+    makeWrapper
+    e2fsprogs
+  ];
+
+  buildInputs = lib.optionals stdenvNoCC.hostPlatform.isLinux [
+    lz4
+    zlib
+    zstd
+    xxhash
+    gccForLibs
+  ];
+
+  dontBuild = true;
+  doInstallCheck = true;
+  versionCheckProgramArg = "version";
+  versionCheckKeepEnvironment = [ "HOME" ];
+  preVersionCheck = ''
+    export HOME=$TMPDIR
+  '';
+
+  installPhase =
+    if stdenvNoCC.hostPlatform.isLinux then
+      ''
+        runHook preInstall
+
+        PREFIX=$out bash ./install.sh
+
+        wrapProgram $out/bin/sbx \
+          --prefix PATH : ${lib.makeBinPath [ e2fsprogs ]}
+
+        ${lib.optionalString (stdenvNoCC.buildPlatform.canExecute stdenvNoCC.hostPlatform) ''
+          export HOME=$TMPDIR
+          $out/bin/sbx completion bash > sbx.bash
+          $out/bin/sbx completion fish > sbx.fish
+          $out/bin/sbx completion zsh  > sbx.zsh
+          installShellCompletion sbx.{bash,fish,zsh}
+        ''}
+
+        runHook postInstall
+      ''
+    else
+      ''
+        runHook preInstall
+
+        mkdir -pv $out
+        cp -rv bin libexec $out
+
+        installShellCompletion \
+          --bash --name sbx.bash completions/bash/sbx \
+          --zsh  --name _sbx     completions/zsh/_sbx \
+          --fish --name sbx.fish completions/fish/sbx.fish
+
+        runHook postInstall
+      '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Safe environments for agents";
+    longDescription = ''
+      Docker Sandboxes provides sandboxes with controlled access to your
+      filesystem, network, and tools. This means your agents can work
+      autonomously without putting your machine or data at risk.
+    '';
+    homepage = "https://docs.docker.com/reference/cli/sbx/";
+    changelog = "https://github.com/docker/sbx-releases/releases/tag/v${finalAttrs.version}";
+    mainProgram = "sbx";
+    platforms = [
+      "x86_64-linux"
+      "aarch64-linux"
+      "aarch64-darwin"
+    ];
+    license = lib.licenses.unfree;
+    maintainers = [
+      lib.maintainers.skyesoss
+      lib.maintainers.erics118
+    ];
+  };
+})
--- a/pkgs/by-name/ed/edhm-ui/package.nix
+++ b/pkgs/by-name/ed/edhm-ui/package.nix
@@ -28,13 +28,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "edhm-ui";
-  version = "3.0.67";
+  version = "3.0.69";

  strictDeps = true;

  src = fetchzip {
    url = "https://github.com/BlueMystical/EDHM_UI/releases/download/v${finalAttrs.version}/edhm-ui-v3-linux-x64.zip";
-    hash = "sha256-JhWHub1YmdSJXZcyOK97/5TnBsKVN0dg7nwqg0EP7H8=";
+    hash = "sha256-t/K8VohJjjP/VgreHZWYtlsMXp1gp9Gme/joHywfeH4=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/fo/forgejo-runner/package.nix
+++ b/pkgs/by-name/fo/forgejo-runner/package.nix
@@ -55,14 +55,14 @@ let
 in
 buildGoModule (finalAttrs: {
  pname = "forgejo-runner";
-  version = "12.12.0";
+  version = "12.13.0";

  src = fetchFromGitea {
    domain = "code.forgejo.org";
    owner = "forgejo";
    repo = "runner";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-6czLxFgjcrBepoFN4iYDUt8uBkhfC8qx4yqmcfQ8FAg=";
+    hash = "sha256-wrHZ4vgWNw0tbcNpZesU5SoV2gqle1MJcPjj6lNMwOw=";
  };

  vendorHash = "sha256-du7fXehcxZ70Lsr5VCkz646G0Us/XwM4Sl98HXimoao=";
--- a/pkgs/by-name/fo/forgejo/package.nix
+++ b/pkgs/by-name/fo/forgejo/package.nix
@@ -1,8 +1,8 @@
 import ./generic.nix {
-  version = "15.0.3";
-  hash = "sha256-tGZ83TEG6iyZd5mfSuSvVkmUJINWLN661YpOk1+dgbM=";
+  version = "15.0.4";
+  hash = "sha256-8AMq5CT4q7aaF5gj9d5+JINp5rrI5U98juI9BA0wVVo=";
  npmDepsHash = "sha256-BZSYjEsjUqMYWu3EUP+K35hqSOniv8Y6ek5bEC2vTPg=";
-  vendorHash = "sha256-z3YTjt+SM9yPCsJdfSQbTpy3vRiXaFV2QMz1y6J6k/Q=";
+  vendorHash = "sha256-00QiJ8W76FdG96fmsIRLkaYlMQTZoIRmRd/qYGyPuig=";
  lts = true;
  nixUpdateExtraArgs = [
    "--override-filename"
--- a/pkgs/by-name/fr/frr/package.nix
+++ b/pkgs/by-name/fr/frr/package.nix
@@ -46,6 +46,7 @@
  cumulusSupport ? false,
  irdpSupport ? true,
  mgmtdSupport ? true,
+  scriptingSupport ? true,
  # Experimental as of 10.1, reconsider if upstream changes defaults
  grpcSupport ? false,

@@ -120,7 +121,6 @@ stdenv.mkDerivation (finalAttrs: {
    python3
    readline
    rtrlib
-    lua53Packages.lua
    sqlite
  ]
  ++ lib.optionals stdenv.hostPlatform.isLinux [
@@ -135,11 +135,17 @@ stdenv.mkDerivation (finalAttrs: {
  ++ lib.optionals grpcSupport [
    grpc
    protobuf
+  ]
+  ++ lib.optionals scriptingSupport [
+    lua53Packages.lua
  ];

  # otherwise in cross-compilation: "configure: error: no working python version found"
  depsBuildBuild = [
    buildPackages.python3
+  ]
+  ++ lib.optionals scriptingSupport [
+    buildPackages.lua53Packages.lua
  ];

  # cross-compiling: clippy is compiled with the build host toolchain, split it out to ease
@@ -157,7 +163,6 @@ stdenv.mkDerivation (finalAttrs: {
    "--enable-logfile-mask=0640"
    "--enable-multipath=${toString numMultipath}"
    "--enable-config-rollbacks"
-    "--enable-scripting"
    "--enable-user=frr"
    "--enable-vty-group=frrvty"
    "--localstatedir=/var"
@@ -171,6 +176,7 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.strings.enableFeature irdpSupport "irdp")
    (lib.strings.enableFeature mgmtdSupport "mgmtd")
    (lib.strings.enableFeature grpcSupport "grpc")
+    (lib.strings.enableFeature scriptingSupport "scripting")

    # routing protocols
    (lib.strings.enableFeature bgpdSupport "bgpd")
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -179,11 +179,11 @@ let

  linux = stdenvNoCC.mkDerivation (finalAttrs: {
    inherit pname meta passthru;
-    version = "150.0.7871.100";
+    version = "150.0.7871.114";

    src = fetchurl {
      url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-SbV/ACzm31CA1fglQtxc8RdBuTeal/HXXXtUFa0IYHk=";
+      hash = "sha256-DxnmjcpXSEljLiUinxWFPSvqwz+gZJj+7UPzRii8LVM=";
    };

    # With strictDeps on, some shebangs were not being patched correctly
@@ -289,11 +289,11 @@ let

  darwin = stdenvNoCC.mkDerivation (finalAttrs: {
    inherit pname meta passthru;
-    version = "150.0.7871.101";
+    version = "150.0.7871.115";

    src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/fwvlzsetnpzv5sb7rdxd5a6nke_150.0.7871.101/GoogleChrome-150.0.7871.101.dmg";
-      hash = "sha256-cumG2dMFXZuYCWWdIn6iJT0Bd24hauVMfXZzbDFVvuU=";
+      url = "http://dl.google.com/release2/chrome/acd57hhfrcygivr2dnxpq2q56zka_150.0.7871.115/GoogleChrome-150.0.7871.115.dmg";
+      hash = "sha256-AB16I7Tl/E4F4ydXHSLeyoKAWNwP7JSL0wLyrUvn3FE=";
    };

    dontPatch = true;
--- a/pkgs/by-name/hu/hugo/package.nix
+++ b/pkgs/by-name/hu/hugo/package.nix
@@ -11,16 +11,16 @@

 buildGoModule (finalAttrs: {
  pname = "hugo";
-  version = "0.161.1";
+  version = "0.163.3";

  src = fetchFromGitHub {
    owner = "gohugoio";
    repo = "hugo";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-TmsXtsH3NgxrAvYzyMKGK+DZRAPjvo/Uy3zXw0lWss8=";
+    hash = "sha256-o8MoGrdOXBN/HkcuRsHyyyFLvPvNo3PI0oWBlO6Xfpw=";
  };

-  vendorHash = "sha256-pgyJMdiifwqft29wG36TAYY1LlW4P21LIWKfepeDmYg=";
+  vendorHash = "sha256-Bn+RA+EHd3gAKL4N/ibydX7yWNKOSYnIl2pfecfOu1k=";

  checkFlags =
    let
--- a/pkgs/by-name/kb/kbd-ergol/package.nix
+++ b/pkgs/by-name/kb/kbd-ergol/package.nix
@@ -0,0 +1,36 @@
+{
+  stdenv,
+  fetchFromCodeberg,
+  lib,
+  nix-update-script,
+}:
+stdenv.mkDerivation {
+  pname = "kbd-ergol";
+  version = "0-unstable-2026-07-07";
+
+  src = fetchFromCodeberg {
+    owner = "Alerymin";
+    repo = "kbd-ergol";
+    rev = "0af6404625fe4da03bc27e1141dc255ac49fa94e";
+    hash = "sha256-875ss78HdU03EgoSpQqLWG279Zg3tIoc6ZTP/hnedcg=";
+  };
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  # console.nix expects keymaps to be under /share/keymaps
+  postPatch = ''
+    substituteInPlace Makefile \
+      --replace "/usr/share/kbd/" "$out/share/"
+  '';
+
+  passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+
+  meta = {
+    description = "Ergo-L layout in keymap format for linux console";
+    homepage = "https://codeberg.org/Alerymin/kbd-ergol";
+    maintainers = with lib.maintainers; [ xaltsc ];
+    platforms = lib.platforms.linux;
+    license = lib.licenses.wtfpl;
+  };
+}
--- a/pkgs/by-name/le/lektor/package.nix
+++ b/pkgs/by-name/le/lektor/package.nix
@@ -13,14 +13,7 @@ let
  python = python3.override {
    self = python;
    packageOverrides = self: super: {
-      mistune = super.mistune.overridePythonAttrs (old: rec {
-        version = "2.0.5";
-        src = fetchPypi {
-          inherit (old) pname;
-          inherit version;
-          hash = "sha256-AkYRPLJJLbh1xr5Wl0p8iTMzvybNkokchfYxUc7gnTQ=";
-        };
-      });
+      mistune = self.mistune_2;
    };
  };
 in
--- a/pkgs/by-name/lo/lockbook-desktop/package.nix
+++ b/pkgs/by-name/lo/lockbook-desktop/package.nix
@@ -18,16 +18,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "lockbook-desktop";
-  version = "26.6.22";
+  version = "26.7.4";

  src = fetchFromGitHub {
    owner = "lockbook";
    repo = "lockbook";
    tag = finalAttrs.version;
-    hash = "sha256-OgNscshw445uf2PtiYVlyCfx/l2BNZyZK5QwQSunCQ0=";
+    hash = "sha256-gwpobBTugTTTtd/mWVoyiU0E/NjWCTfMnMF0reWLKrA=";
  };

-  cargoHash = "sha256-USdDHcWexjAllH/kOZVc4XMehESoIozkvvOw47ZeBD8=";
+  cargoHash = "sha256-EH3uIjz2M+Ytkx/gD0gwslUrDVPvm5+hwOGoDtAdblg=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/ma/mattermost/mattermost-remove-free-banner.patch
+++ b/pkgs/by-name/ma/mattermost/mattermost-remove-free-banner.patch
@@ -11,7 +11,7 @@ index 93cb8ab263..3d12cd5e54 100644
     );
 };
 diff --git a/channels/src/components/header_footer_route/header.scss b/channels/src/components/header_footer_route/header.scss
-index c2e6fbd187..828955cc79 100644
+index c2e6fbd187..bc1cedcff1 100644
 --- a/channels/src/components/header_footer_route/header.scss
 +++ b/channels/src/components/header_footer_route/header.scss
@@ -47,20 +47,7 @@
@@ -36,6 +36,19 @@ index c2e6fbd187..828955cc79 100644
             }
         }
     }
+@@ -83,12 +70,6 @@
+             margin-top: 12px;
+         }
+     }
+-
+-    &.has-free-banner.has-custom-site-name {
+-        .header-back-button {
+-            bottom: -20px;
+-        }
+-    }
+ }
+ 
+ @media screen and (max-width: 699px) {
 diff --git a/channels/src/components/widgets/menu/menu_items/menu_item.scss b/channels/src/components/widgets/menu/menu_items/menu_item.scss
 index dee9b57f8c..8ef4aa073a 100644
 --- a/channels/src/components/widgets/menu/menu_items/menu_item.scss
@@ -57,7 +70,7 @@ index dee9b57f8c..8ef4aa073a 100644
         button {
             padding: 3px 0;
 diff --git a/channels/webpack.config.js b/channels/webpack.config.js
-index 852046de70..cf28fdcbd6 100644
+index 852046de70..a310da48f4 100644
 --- a/channels/webpack.config.js
 +++ b/channels/webpack.config.js
@@ -470,6 +470,9 @@ if (targetIsDevServer) {
--- a/pkgs/by-name/ma/mattermost/mattermost-remove-user-limit.patch
+++ b/pkgs/by-name/ma/mattermost/mattermost-remove-user-limit.patch
@@ -1,8 +1,19 @@
 diff --git a/server/channels/app/limits.go b/server/channels/app/limits.go
-index 4c88c1f049..fb7d84ef05 100644
+index 45448e4b2b..6125c02baf 100644
 --- a/server/channels/app/limits.go
 +++ b/server/channels/app/limits.go
-@@ -18,23 +18,8 @@ func (a *App) GetServerLimits() (*model.ServerLimits, *model.AppError) {
+@@ -10,8 +10,8 @@ import (
+ )
+ 
+ const (
+-	maxUsersLimit     = 200
+-	maxUsersHardLimit = 250
+	maxUsersLimit     = 10000000
+	maxUsersHardLimit = 10000000
+ )
+ 
+ // GetServerLimits returns the server's seat/post-history limits. The license-derived
+@@ -25,23 +25,8 @@ func (a *App) GetServerLimits(includeUserCounts bool) (*model.ServerLimits, *mod
 	limits := &model.ServerLimits{}
 	license := a.License()
 
@@ -28,11 +39,11 @@ index 4c88c1f049..fb7d84ef05 100644
 
 	// Check if license has post history limits and get the calculated timestamp
 	if license != nil && license.Limits != nil && license.Limits.PostHistory > 0 {
-@@ -99,14 +84,5 @@ func (a *App) GetPostHistoryLimit() int64 {
+@@ -112,14 +97,5 @@ func (a *App) GetPostHistoryLimit() int64 {
 }
 
 func (a *App) isAtUserLimit() (bool, *model.AppError) {
-	userLimits, appErr := a.GetServerLimits()
+-	userLimits, appErr := a.GetServerLimits(true)
 -	if appErr != nil {
 -		return false, appErr
 -	}
--- a/pkgs/by-name/ma/mattermost/package.nix
+++ b/pkgs/by-name/ma/mattermost/package.nix
@@ -27,10 +27,10 @@
    #
    # Ensure you also check ../mattermostLatest/package.nix.
    regex = "^v(11\\.7\\.[0-9]+)$";
-    version = "11.7.4";
-    srcHash = "sha256-kO4ntGffvMis7JFZLMpnPdjotPiZ/kJcxeKoMjXAZ3U=";
+    version = "11.7.6";
+    srcHash = "sha256-oMjfSX45+sEQwNpNVDTOlCBUK7OSBCCKpaUMMrRzdQM=";
    vendorHash = "sha256-XaXqQN20c3DhW2/L0zhTA8dLeRp4MyBxUKpiMVwp/7s=";
-    npmDepsHash = "sha256-lqgYZAGCjChGwBKACKKiMRzI2WP0ByanMMIVxo/h8t8=";
+    npmDepsHash = "sha256-F7o+AVM1WiuHKDQaqHbxDjWT1vAiddh4/D8EktxncAs=";
  },
  ...
 }:
--- a/pkgs/by-name/ma/mattermostLatest/package.nix
+++ b/pkgs/by-name/ma/mattermostLatest/package.nix
@@ -15,10 +15,10 @@ mattermost.override (
      # and make sure the version regex is up to date here.
      # Ensure you also check ../mattermost/package.nix for ESR releases.
      regex = "^v(11\\.[0-9]+\\.[0-9]+)$";
-      version = "11.8.2";
-      srcHash = "sha256-XZ4yr7nbGum6UQaBjze50L8Yc/MLjo4NQBh263CNRtI=";
+      version = "11.8.3";
+      srcHash = "sha256-OWHW6UifUljL+yyWtc5XD/spbn7Yu1FqZ8gQAs073gY=";
      vendorHash = "sha256-F2QMrLbio7812ZTGQZZPTqHWtIXbwbDmjUhtvv0DJ9s=";
-      npmDepsHash = "sha256-WIPLpi6lQvq9wieqvOACiRh7v1znxzcf+jyKXSjWzNc=";
+      npmDepsHash = "sha256-C8L5g+HY5aArLJzPbw3fESvA+U4JK1OQFWA4wwaan1M=";
      autoUpdate = ./package.nix;
    };
  }
--- a/pkgs/by-name/mc/mctc-lib/package.nix
+++ b/pkgs/by-name/mc/mctc-lib/package.nix
@@ -10,7 +10,7 @@
  pkg-config,
  python3,
  jonquil,
-  openmpCheckPhaseHook,
+  checkPhaseThreadLimitHook,
 }:

 assert (
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
    gfortran
    pkg-config
    python3
-    openmpCheckPhaseHook
+    checkPhaseThreadLimitHook
  ]
  ++ lib.optionals (buildType == "meson") [
    meson
--- a/pkgs/by-name/md/mdns-scanner/package.nix
+++ b/pkgs/by-name/md/mdns-scanner/package.nix
@@ -7,7 +7,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "mdns-scanner";
-  version = "0.27.3";
+  version = "0.27.4";

  __structuredAttrs = true;

@@ -15,10 +15,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "CramBL";
    repo = "mdns-scanner";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-daJEiYOF1N2m4zVbsBuRl8KGrDs62GGDP9lCok9r/3w=";
+    hash = "sha256-oEXqaatURQxLnWY1086Gf6AJDpc6q+4Yreffsw2egEI=";
  };

-  cargoHash = "sha256-eCB5nVEucMFX/wz9zrAKO9d3yI7BK/URpjlU39Y4g4I=";
+  cargoHash = "sha256-lRxGqNIctckQZioP2jjMEjSyLUlI0wN9nIv0ym3YCrI=";

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/mk/mkl/package.nix
+++ b/pkgs/by-name/mk/mkl/package.nix
@@ -8,6 +8,11 @@
  _7zz,
  cctools,
  validatePkgConfig,
+  # sets MKL_NUM_THREADS for packages
+  # invoking mkl during checkPhase/installCheckPhase to
+  # avoid overloading builders with excessive parallelism
+  # See also: https://www.intel.com/content/www/us/en/docs/onemkl/developer-guide-linux/2023-0/mkl-domain-num-threads.html
+  checkPhaseThreadLimitHook,
  enableStatic ? stdenv.hostPlatform.isStatic,
 }:

@@ -86,6 +91,10 @@ stdenvNoCC.mkDerivation (
        [ rpmextract ]
    );

+    propagatedNativeBuildInputs = [
+      checkPhaseThreadLimitHook
+    ];
+
    buildPhase =
      if stdenvNoCC.hostPlatform.isDarwin then
        ''
--- a/pkgs/by-name/mp/mpiCheckPhaseHook/package.nix
+++ b/pkgs/by-name/mp/mpiCheckPhaseHook/package.nix
@@ -1,7 +1,7 @@
 {
  makeSetupHook,
  stdenv,
-  openmpCheckPhaseHook,
+  checkPhaseThreadLimitHook,
 }:

 makeSetupHook {
@@ -13,6 +13,6 @@ makeSetupHook {
  };

  propagatedNativeBuildInputs = [
-    openmpCheckPhaseHook
+    checkPhaseThreadLimitHook
  ];
 } ./mpi-check-hook.sh
--- a/pkgs/by-name/nv/nvibrant/hatch_build.patch
+++ b/pkgs/by-name/nv/nvibrant/hatch_build.patch
@@ -0,0 +1,84 @@
+diff --git a/hatch_build.py b/hatch_build.py
+index da19ad8..f33e582 100644
+--- a/hatch_build.py
+++ b/hatch_build.py
+@@ -1,7 +1,6 @@
+ import hashlib
+ import os
+ import subprocess
+-import sys
+ from pathlib import Path
+ from tempfile import TemporaryDirectory
+ 
+@@ -57,46 +56,33 @@ class BuildHook(BuildHookInterface):
+ 
+         build_data["pure_python"] = False
+ 
+-        # Ensure submodule on git main
+-        subprocess.check_call(
+-            ("git", "submodule", "update", "--init", "--remote"),
+-            cwd=Dirs.repository,
+-        )
+-
+         # Configure the project
+         subprocess.check_call((
+-            sys.executable, "-m", "mesonbuild.mesonmain",
+-            "setup", Dirs.build,
+            "meson", "setup", Dirs.build,
+             "--buildtype", "release",
+             "--reconfigure", "--wipe",
+         ), cwd=Dirs.repository)
+ 
+-        # Intended operation
+-        subprocess.check_call(
+-            ("git", "config", "advice.detachedHead", "false"),
+-            cwd=Dirs.opengpu,
+-        )
+-
+         # Keep track of breaking changes
+         hashes: dict[str, str] = dict()
+ 
+         # Make binaries for all known driver version
+-        for driver in sorted(subprocess.check_output(
+-            args=("git", "tag"),
+        for driver in subprocess.check_output(
+            args=("cat", "./SOURCE_TAGS"),
+             cwd=Dirs.opengpu
+-        ).decode().strip().splitlines()):
+        ).decode().strip().splitlines():
+ 
+             # Checkout driver version
+-            subprocess.check_call(
+-                ("git", "checkout", "-f", driver),
+-                cwd=Dirs.opengpu,
+-            )
+            if driver != os.environ["OLDEST_DRIVER_VERSION"]:
+                subprocess.check_call(
+                    ("git", "apply", f"./PATCHES/{driver}.patch"),
+                    cwd=Dirs.opengpu,
+                )
+ 
+             # Compile an executable
+-            subprocess.check_call((
+-                sys.executable, "-m", "ninja",
+-                "-C", Dirs.build,
+-            ))
+            subprocess.check_call(
+                ("ninja", "-C", Dirs.build)
+            )
+ 
+             # Find and vendor the binary for this version
+             binary = Dirs.build.joinpath("nvibrant")
+@@ -109,12 +95,6 @@ class BuildHook(BuildHookInterface):
+             build_data["force_include"][str(target)] = f"nvibrant/resources/{target.name}"
+             hashes.setdefault(hashlib.md5(target.read_bytes()).hexdigest(), driver)
+ 
+-        # Revert back main branch
+-        subprocess.check_call(
+-            ("git", "checkout", "-f", "main"),
+-            cwd=Dirs.opengpu
+-        )
+-
+         print("\nBreaking changes across driver versions:")
+ 
+         for hashsum, driver in hashes.items():
--- a/pkgs/by-name/nv/nvibrant/package.nix
+++ b/pkgs/by-name/nv/nvibrant/package.nix
@@ -1,38 +1,152 @@
 {
  lib,
-  stdenv,
  fetchFromGitHub,
-  meson,
-  ninja,
-  pkg-config,
+  python3Packages,
+  writeShellScript,
+  common-updater-scripts,
+  coreutils,
+  gitMinimal,
 }:

-stdenv.mkDerivation (finalAttrs: {
+python3Packages.buildPythonApplication (finalAttrs: {
  pname = "nvibrant";
-  version = "1.1.0";
+  version = finalAttrs.passthru._version;
+  pyproject = true;

-  src = fetchFromGitHub {
-    owner = "Tremeschin";
-    repo = "nvibrant";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-RZIi1V3hcwZdaI84Nd0YSQOjDng9/ZDg7aqfTL7GJIU=";
-    fetchSubmodules = true;
+  passthru = {
+    nvibrantVersion = "1.2.1";
+
+    oldestDriverVersion = "515.43.04";
+    latestDriverVersion = "610.43.02";
+
+    _version = lib.concatStringsSep "-" [
+      finalAttrs.passthru.nvibrantVersion
+      "unstable"
+      finalAttrs.passthru.latestDriverVersion
+    ];
+
+    srcAttrs = {
+      nvibrant = fetchFromGitHub {
+        owner = "tremeschin";
+        repo = "nvibrant";
+        name = "nvibrant";
+        tag = "v${finalAttrs.passthru.nvibrantVersion}";
+        hash = "sha256-M83WSQiJwzFZl8ECkZjKigvLTlMkzRa6o2hqPOt1378=";
+      };
+      open-gpu = fetchFromGitHub {
+        owner = "nvidia";
+        repo = "open-gpu-kernel-modules";
+        name = "open-gpu";
+        tag = finalAttrs.passthru.oldestDriverVersion;
+        hash = "sha256-MfLR5sYSjBrENWkCChcS9rk1zSlRFfTRpof/4lQ3qow=";
+
+        # since .git isn't deterministic, we can't use it to checkout tags in
+        # the build phase, so instead we generate patches for each version
+        # upgrade before .git is removed and apply them incrementally
+        fetchTags = true;
+        postCheckout = ''
+          cd $out
+
+          while IFS= read -r tag; do
+            echo "adding $tag"
+            echo "$tag" >> SOURCE_TAGS
+
+            if [[ "$tag" == ${finalAttrs.passthru.latestDriverVersion} ]]; then
+              echo 'reached end of known tags'
+              break
+            fi
+          done < <(git tag --sort v:refname)
+
+          mkdir PATCHES
+
+          prev_tag=${finalAttrs.passthru.oldestDriverVersion}
+          while IFS= read -r tag; do
+            if [ "$prev_tag" == "$tag" ]; then continue; fi
+
+            echo "generating patch: $prev_tag -> $tag"
+            git diff --minimal --binary "$prev_tag" "$tag" \
+              > "PATCHES/$tag.patch"
+
+            prev_tag=$tag
+          done < SOURCE_TAGS
+          unset prev_tag
+
+          rm -rf .git
+        '';
+      };
+    };
+
+    updateScript = writeShellScript "update-nvibrant" ''
+      set -euo pipefail
+
+      export PATH="${
+        lib.makeBinPath [
+          common-updater-scripts
+          coreutils
+          gitMinimal
+        ]
+      }:$PATH"
+
+      list_tags() {
+        git ls-remote --tags --sort v:refname --refs "$1" |
+          cut --delimiter=/ --field=3-
+      }
+
+      readarray -t nvibrant_tags < <(list_tags \
+        'https://github.com/tremeschin/nvibrant.git')
+
+      readarray -t open_gpu_tags < <(list_tags \
+        'https://github.com/nvidia/open-gpu-kernel-modules.git')
+
+      update-source-version nvibrant "''${nvibrant_tags[-1]:1}" \
+        --version-key=nvibrantVersion --source-key=srcAttrs.nvibrant \
+        --ignore-same-hash --ignore-same-version
+
+      update-source-version nvibrant "''${open_gpu_tags[0]}" \
+        --version-key=oldestDriverVersion --source-key=srcAttrs.open-gpu \
+        --ignore-same-hash --ignore-same-version
+
+      update-source-version nvibrant "''${open_gpu_tags[-1]}" \
+        --version-key=latestDriverVersion --source-key=srcAttrs.open-gpu \
+        --ignore-same-hash --ignore-same-version
+    '';
  };

-  nativeBuildInputs = [
+  srcs = lib.attrValues finalAttrs.passthru.srcAttrs;
+  sourceRoot = ".";
+
+  postUnpack = ''
+    mv open-gpu nvibrant/
+    cd nvibrant
+  '';
+
+  # replaces code that depends on .git and uses of python -m {ninja,meson}
+  patches = [ ./hatch_build.patch ];
+
+  configurePhase = ''
+    export OLDEST_DRIVER_VERSION=${finalAttrs.passthru.oldestDriverVersion}
+  '';
+
+  nativeBuildInputs = [ gitMinimal ];
+
+  build-system = with python3Packages; [
+    hatchling
    meson
    ninja
-    pkg-config
  ];

-  mesonBuildType = "release";
+  dependencies = with python3Packages; [
+    packaging
+  ];

-  meta = with lib; {
+  meta = {
    description = "Configure NVIDIA's Digital Vibrance on Wayland";
    homepage = "https://github.com/Tremeschin/nvibrant";
-    license = licenses.gpl3Only;
-    maintainers = [ maintainers.mikaeladev ];
-    platforms = [ "x86_64-linux" ];
    mainProgram = "nvibrant";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      mikaeladev
+    ];
  };
 })
--- a/pkgs/by-name/op/openmpCheckPhaseHook/omp-check-hook.sh
+++ b/pkgs/by-name/op/openmpCheckPhaseHook/omp-check-hook.sh
@@ -1,11 +0,0 @@
-preCheckHooks+=('setupOmpCheck')
-preInstallCheckHooks+=('setupOmpCheck')
-
-
-setupOmpCheck() {
-  # Limit number of OpenMP threads. Default is "all cores".
-  # Using all cores causes high load on builders if checks are executed with NIX_BUILD_CORE parallelism.
-  # This gets even worse if multiple builds are scheduled on the same machine, potentially growing O(n^3) without explicit core limits.
-  export OMP_NUM_THREADS="${OMP_NUM_THREADS:-1}"
-}
-
--- a/pkgs/by-name/op/openmpCheckPhaseHook/package.nix
+++ b/pkgs/by-name/op/openmpCheckPhaseHook/package.nix
@@ -1,12 +0,0 @@
-{
-  lib,
-  makeSetupHook,
-}:
-
-makeSetupHook {
-  name = "omp-checkPhase-hook";
-
-  __structuredAttrs = true;
-
-  meta.license = lib.licenses.mit;
-} ./omp-check-hook.sh
--- a/pkgs/by-name/pi/pipeweaver/package.nix
+++ b/pkgs/by-name/pi/pipeweaver/package.nix
@@ -0,0 +1,126 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  rustPlatform,
+  pkg-config,
+  pipewire,
+  nix-update-script,
+  stdenv,
+}:
+
+rustPlatform.buildRustPackage (
+  finalAttrs:
+  let
+    web = buildNpmPackage {
+      pname = "${finalAttrs.pname}-web";
+      inherit (finalAttrs) version src;
+
+      sourceRoot = "${finalAttrs.src.name}/web";
+
+      npmDepsHash = "sha256-ZX/3H/VdRdWC2j+mPA/0rZflDhslqTN1mqA9vvQRQG0=";
+
+      installPhase = ''
+        runHook preInstall
+        cp -r dist $out
+        runHook postInstall
+      '';
+    };
+  in
+  {
+    pname = "pipeweaver";
+    version = "0.1.6";
+
+    __structuredAttrs = true;
+
+    src = fetchFromGitHub {
+      owner = "pipeweaver";
+      repo = "pipeweaver";
+      tag = "v${finalAttrs.version}";
+      hash = "sha256-wf3gxCLT5vOz+5+CpfmkX0stKoAOpQ6KIoW6xBNV1xk=";
+    };
+
+    cargoHash = "sha256-Jv0fF6keg2NcUnCJhCId7rwPVZK1/Q9+otQNjp54RCI=";
+
+    nativeBuildInputs = [
+      pkg-config
+      rustPlatform.bindgenHook
+    ];
+
+    buildInputs = [
+      pipewire
+    ];
+
+    cargoBuildFlags = [
+      "--workspace"
+      "--exclude"
+      "pipeweaver-app"
+      "--all-features"
+    ];
+
+    cargoTestFlags = [
+      "--workspace"
+      "--exclude"
+      "pipeweaver-app"
+      "--all-features"
+    ];
+
+    postPatch = ''
+      # Prevent daemon/build.rs from running to prevent impure git and npm calls.
+      rm daemon/build.rs
+      substituteInPlace daemon/Cargo.toml --replace-fail 'build = "build.rs"' ""
+
+      mkdir -p daemon/web-content
+      cp -r ${web}/* daemon/web-content/
+    '';
+
+    # Provide GIT_HASH that build.rs would have set
+    env.GIT_HASH = finalAttrs.src.tag;
+
+    installPhase = ''
+      runHook preInstall
+
+      releaseDir=target/${stdenv.hostPlatform.rust.cargoShortTarget}/release
+
+      install -Dm755 $releaseDir/pipeweaver-daemon -t $out/bin
+      install -Dm755 $releaseDir/pipeweaver-client -t $out/bin
+
+      install -Dm644 daemon/resources/icons/pipeweaver.png \
+        $out/share/icons/hicolor/48x48/apps/pipeweaver.png
+      install -Dm644 daemon/resources/icons/pipeweaver.svg \
+        $out/share/icons/hicolor/scalable/apps/pipeweaver.svg
+      install -Dm644 daemon/resources/icons/pipeweaver-large.png \
+        $out/share/pixmaps/pipeweaver.png
+      install -Dm644 daemon/resources/desktop/pipeweaver.desktop \
+        $out/share/applications/pipeweaver.desktop
+
+      substituteInPlace $out/share/applications/pipeweaver.desktop \
+        --replace-fail "Path=/usr/bin" "Path=$out/bin" \
+        --replace-fail "Exec=/usr/bin/pipeweaver-daemon" "Exec=$out/bin/pipeweaver-daemon"
+
+      install -Dm644 README.md $out/share/doc/pipeweaver/README.md
+      install -Dm644 LICENSE $out/share/licenses/pipeweaver/LICENSE
+
+      runHook postInstall
+    '';
+
+    passthru = {
+      inherit web;
+      updateScript = nix-update-script {
+        extraArgs = [
+          "--subpackage"
+          "web"
+        ];
+      };
+    };
+
+    meta = {
+      description = "Manage streaming audio on Linux through PipeWire with virtual channels, mixing, and routing";
+      homepage = "https://github.com/pipeweaver/pipeweaver";
+      license = lib.licenses.mit;
+      mainProgram = "pipeweaver-daemon";
+      platforms = lib.platforms.linux;
+      maintainers = with lib.maintainers; [ saadndm ];
+    };
+  }
+)
--- a/pkgs/by-name/pi/pixman/package.nix
+++ b/pkgs/by-name/pi/pixman/package.nix
@@ -6,7 +6,7 @@
  ninja,
  pkg-config,
  libpng,
-  openmpCheckPhaseHook,
+  checkPhaseThreadLimitHook,
  glib, # just passthru

  # for passthru.tests
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
    meson
    ninja
    pkg-config
-    openmpCheckPhaseHook
+    checkPhaseThreadLimitHook
    __flattenIncludeHackHook
  ];

--- a/pkgs/by-name/pr/present/package.nix
+++ b/pkgs/by-name/pr/present/package.nix
@@ -8,14 +8,7 @@ let
  # https://github.com/NixOS/nixpkgs/issues/348788
  pythonPackages = python3Packages.overrideScope (
    self: super: {
-      mistune = super.mistune.overridePythonAttrs (oldAttrs: rec {
-        version = "2.0.5";
-        src = fetchPypi {
-          inherit (oldAttrs) pname;
-          inherit version;
-          hash = "sha256-AkYRPLJJLbh1xr5Wl0p8iTMzvybNkokchfYxUc7gnTQ=";
-        };
-      });
+      mistune = self.mistune_2;
    }
  );
 in
--- a/pkgs/by-name/rc/rclone/package.nix
+++ b/pkgs/by-name/rc/rclone/package.nix
@@ -17,7 +17,7 @@

 buildGoModule (finalAttrs: {
  pname = "rclone";
-  version = "1.74.3";
+  version = "1.74.4";

  outputs = [
    "out"
@@ -28,10 +28,10 @@ buildGoModule (finalAttrs: {
    owner = "rclone";
    repo = "rclone";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-GLl8juSCVKEjsVZAzvvfKx1TxC/rcM7lMBek9BLosi0=";
+    hash = "sha256-n+s9OiSwjiFwR1/DEd81YZIAyaMWMj0g8ORf6grnE3M=";
  };

-  vendorHash = "sha256-FuSqI5fCmt/fr4AwJhdFaolYugZDTYeOcity/VZzYZ0=";
+  vendorHash = "sha256-PVTcYFRr4Zb4VVsY6dkO+emZ48Nyr9aUBJbehFlDh9c=";

  subPackages = [ "." ];

--- a/pkgs/by-name/te/teleport_18/package.nix
+++ b/pkgs/by-name/te/teleport_18/package.nix
@@ -1,19 +1,19 @@
 {
  buildTeleport,
  buildGo125Module,
-  wasm-bindgen-cli_0_2_99,
+  wasm-bindgen-cli_0_2_122,
  withRdpClient ? true,
  extPatches ? [ ],
 }:

 buildTeleport {
-  version = "18.9.1";
-  hash = "sha256-FIPExc8tMoPXfWc7pQjwQRkxmiQEOxdkYgWS0GejQuk=";
-  vendorHash = "sha256-BlQhypAoK85ID0pgmXbUboks88qjSg3p5E8qxyTIc9M=";
-  pnpmHash = "sha256-ZGbuBMPwC3u/2qDTVLH2InOGVc94Vq0i3AKHMsOwq3k=";
-  cargoHash = "sha256-KbmacTEOElmboHMK6YxWGC0brlDsX7kcvpaOOZmuops=";
+  version = "18.9.2";
+  hash = "sha256-w6qCH57L2rwClbSpZeG01eekzj3JRNijwSdfl+wx8v8=";
+  vendorHash = "sha256-LJmpFHvFsBsneq1Cl3vvqxBGB94gSjaikNDZtQfwNjM=";
+  pnpmHash = "sha256-8tKVv5SPJlS89EsHhF8qpThkh4n47qRBbHDCgX17Cdg=";
+  cargoHash = "sha256-+B5fGIzCpiYmqVcM4iy+PTIdtvuvtufQiXMHNzHTDlQ=";

-  wasm-bindgen-cli = wasm-bindgen-cli_0_2_99;
+  wasm-bindgen-cli = wasm-bindgen-cli_0_2_122;
  buildGoModule = buildGo125Module;
  inherit withRdpClient extPatches;
 }
--- a/pkgs/by-name/un/unbound/package.nix
+++ b/pkgs/by-name/un/unbound/package.nix
@@ -31,6 +31,8 @@
  systemd ? null,
  # optionally support DNS-over-HTTPS as a server
  withDoH ? false,
+  # optionally support DNS-over-QUIC as a server
+  withDoQ ? false,
  withECS ? false,
  withDNSCrypt ? false,
  withDNSTAP ? false,
@@ -38,7 +40,7 @@
  withRedis ? false,
  # Avoid .lib depending on lib.getLib openssl
  # The build gets a little hacky, so in some cases we disable this approach.
-  withSlimLib ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isMusl && !withDNSTAP,
+  withSlimLib ? stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isMusl && !withDNSTAP && !withDoQ,
  # enable support for python plugins in unbound: note this is distinct from pyunbound
  # see https://unbound.docs.nlnetlabs.nl/en/latest/developer/python-modules.html
  withPythonModule ? false,
@@ -47,6 +49,7 @@
  withLto ? !stdenv.hostPlatform.isStatic && !stdenv.hostPlatform.isMinGW,
  withMakeWrapper ? !stdenv.hostPlatform.isMinGW,
  libnghttp2,
+  ngtcp2,

  # for passthru.updateScript
  nix-update-script,
@@ -55,6 +58,9 @@
  versionCheckHook,
 }:

+assert lib.assertMsg (
+  !withDoQ || lib.versionAtLeast openssl.version "3.5.0"
+) "unbound: withDoQ requires OpenSSL with QUIC support (OpenSSL >= 3.5)";
 stdenv.mkDerivation (finalAttrs: {
  pname = "unbound";
  version = "1.25.1";
@@ -90,6 +96,7 @@ stdenv.mkDerivation (finalAttrs: {
  ]
  ++ lib.optionals withSystemd [ systemd ]
  ++ lib.optionals withDoH [ libnghttp2 ]
+  ++ lib.optionals withDoQ [ ngtcp2 ]
  ++ lib.optionals withPythonModule [ python ];

  enableParallelBuilding = true;
@@ -120,6 +127,9 @@ stdenv.mkDerivation (finalAttrs: {
  ++ lib.optionals withDoH [
    "--with-libnghttp2=${libnghttp2.dev}"
  ]
+  ++ lib.optionals withDoQ [
+    "--with-libngtcp2=${ngtcp2.dev}"
+  ]
  ++ lib.optionals withECS [
    "--enable-subnet"
  ]
--- a/pkgs/by-name/vl/vlc/package.nix
+++ b/pkgs/by-name/vl/vlc/package.nix
@@ -5,7 +5,6 @@
  avahi,
  bison,
  cairo,
-  curl,
  dbus,
  faad2,
  fetchFromGitLab,
@@ -26,6 +25,7 @@
  libxinerama,
  libxpm,
  libarchive,
+  libaacs,
  libass,
  libbluray-full,
  libcaca,
@@ -82,10 +82,8 @@
  wayland-protocols,
  wayland-scanner,
  wrapGAppsHook3,
-  writeShellScript,
  libxcb-keysyms,
  zlib,
-
  chromecastSupport ? true,
  jackSupport ? false,
  onlyLibVLC ? false,
@@ -152,6 +150,7 @@ stdenv.mkDerivation (finalAttrs: {
    libGL
    libsm
    libarchive
+    libaacs
    libass
    libbluray-full
    libcaca
@@ -246,7 +245,7 @@ stdenv.mkDerivation (finalAttrs: {
  postPatch = ''
    echo "$version" > src/revision.txt
    substituteInPlace modules/text_renderer/freetype/platform_fonts.h \
-      --replace \
+      --replace-fail \
        /usr/share/fonts/truetype/freefont \
        ${freefont_ttf}/share/fonts/truetype
  ''
@@ -255,7 +254,7 @@ stdenv.mkDerivation (finalAttrs: {
  # https://www.lua.org/wshop13/Jericke.pdf#page=39
  + lib.optionalString (!stdenv.hostPlatform.canExecute stdenv.buildPlatform) ''
    substituteInPlace share/Makefile.am \
-      --replace $'.luac \\\n' $'.lua \\\n'
+      --replace-fail $'.luac \\\n' $'.lua \\\n'
  '';

  enableParallelBuilding = true;
@@ -299,6 +298,7 @@ stdenv.mkDerivation (finalAttrs: {
  # depends on a qt5.qttranslations that doesn't build, even though it
  # should be the same as pkgsBuildBuild.qt5.qttranslations.
  postFixup = ''
+    patchelf --add-rpath ${libaacs}/lib "$out/lib/vlc/plugins/access/liblibbluray_plugin.so"
    patchelf --add-rpath ${libv4l}/lib "$out/lib/vlc/plugins/access/libv4l2_plugin.so"
    find $out/lib/vlc/plugins -exec touch -d @1 '{}' ';'
    ${
--- a/pkgs/by-name/wa/wasm-bindgen-cli_0_2_122/package.nix
+++ b/pkgs/by-name/wa/wasm-bindgen-cli_0_2_122/package.nix
@@ -0,0 +1,19 @@
+{
+  buildWasmBindgenCli,
+  fetchCrate,
+  rustPlatform,
+}:
+
+buildWasmBindgenCli rec {
+  src = fetchCrate {
+    pname = "wasm-bindgen-cli";
+    version = "0.2.122";
+    hash = "sha256-vO4RSxi/sMWxmsEs3GuljdMfIRSu75A+Q+c5wgYToRU=";
+  };
+
+  cargoDeps = rustPlatform.fetchCargoVendor {
+    inherit src;
+    inherit (src) pname version;
+    hash = "sha256-Inup6vvJSG5ghNyeDPyZbfZo4d0LsMG2OJfStoaeDBs=";
+  };
+}
--- a/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
+++ b/pkgs/by-name/xd/xdg-desktop-portal-cosmic/package.nix
@@ -4,6 +4,7 @@
  rustPlatform,
  fetchFromGitHub,
  glib,
+  just,
  libcosmicAppHook,
  pkg-config,
  util-linux,
@@ -17,14 +18,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "xdg-desktop-portal-cosmic";
-  version = "1.1.0";
+  version = "1.2.0";

  # nixpkgs-update: no auto update
  src = fetchFromGitHub {
    owner = "pop-os";
    repo = "xdg-desktop-portal-cosmic";
    tag = "epoch-${finalAttrs.version}";
-    hash = "sha256-yN7dUhB8eMW/CK9HTeuK/CAYFjvWvCLApQ7mb71VLps=";
+    hash = "sha256-/2pn+snrXnPTPbcwg+pg/zcn9WxE3/3xXpNFlN/RITM=";
  };

  cargoHash = "sha256-wSwXzaU872KqcRgAIKRuQFvG9f/q4z0OysysLyYMwdg=";
@@ -34,6 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  __structuredAttrs = true;

  nativeBuildInputs = [
+    just
    libcosmicAppHook
    rustPlatform.bindgenHook
    pkg-config
@@ -53,11 +55,16 @@ rustPlatform.buildRustPackage (finalAttrs: {
      --replace-fail '/usr/share/backgrounds' '${cosmic-wallpapers}/share/backgrounds'
  '';

-  dontCargoInstall = true;
+  dontUseJustBuild = true;
+  dontUseJustCheck = true;

-  makeFlags = [
-    "prefix=${placeholder "out"}"
-    "CARGO_TARGET_DIR=target/${stdenv.hostPlatform.rust.cargoShortTarget}"
+  justFlags = [
+    "--set"
+    "prefix"
+    (placeholder "out")
+    "--set"
+    "cargo-target-dir"
+    "target/${stdenv.hostPlatform.rust.cargoShortTarget}"
  ];

  passthru = {
--- a/pkgs/development/compilers/llvm/common/openmp/default.nix
+++ b/pkgs/development/compilers/llvm/common/openmp/default.nix
@@ -19,7 +19,7 @@
  ompdSupport ? true,
  ompdGdbSupport ? ompdSupport,
  getVersionFile,
-  openmpCheckPhaseHook,
+  checkPhaseThreadLimitHook,
 }:

 assert lib.assertMsg (ompdGdbSupport -> ompdSupport) "OMPD GDB support requires OMPD support!";
@@ -61,7 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  propagatedNativeBuildInputs = [
-    openmpCheckPhaseHook
+    checkPhaseThreadLimitHook
  ];

  buildInputs = [
--- a/pkgs/development/libraries/science/math/openblas/default.nix
+++ b/pkgs/development/libraries/science/math/openblas/default.nix
@@ -4,6 +4,11 @@
  fetchFromGitHub,
  fetchpatch,
  cmake,
+  # sets OPENBLAS_NUM_THREADS and OMP_NUM_THREADS for packages
+  # invoking openblas during checkPhase/installCheckPhase to
+  # avoid overloading builders with excessive parallelism
+  # See also: https://github.com/OpenMathLib/OpenBLAS/blob/e7b45174355edec1f04de1cabcf5ca6a98ea7fbc/USAGE.md#how-can-i-use-openblas-in-multi-threaded-applications
+  checkPhaseThreadLimitHook,
  # Most packages depending on openblas expect integer width to match
  # pointer width, but some expect to use 32-bit integers always
  # (for compatibility with reference BLAS).
@@ -232,6 +237,10 @@ stdenv.mkDerivation (finalAttrs: {
    cmake
  ];

+  propagatedNativeBuildInputs = [
+    checkPhaseThreadLimitHook
+  ];
+
  buildInputs = lib.optional (stdenv.cc.isClang && config.USE_OPENMP) openmp;

  depsBuildBuild = [
--- a/pkgs/development/php-packages/xdebug/default.nix
+++ b/pkgs/development/php-packages/xdebug/default.nix
@@ -5,7 +5,7 @@
 }:

 let
-  version = "3.5.1";
+  version = "3.5.3";
 in
 buildPecl {
  inherit version;
@@ -16,7 +16,7 @@ buildPecl {
    owner = "xdebug";
    repo = "xdebug";
    rev = version;
-    hash = "sha256-GOlWCKDLwptsHV9SvOOlR4uScvcw8V/DjwXIpfWjSkM=";
+    hash = "sha256-UrRQqnWEE0y8I4DTDWn21yGScG42+XaFFl6UjcJXbtM=";
  };

  doCheck = true;
--- a/pkgs/development/python-modules/joblib/default.nix
+++ b/pkgs/development/python-modules/joblib/default.nix
@@ -5,6 +5,14 @@
  pythonAtLeast,
  stdenv,

+  # sets various thread limit env vars for packages
+  # invoking joblib during checkPhase/installCheckPhase to
+  # avoid overloading builders with excessive parallelism
+  # See also:
+  # https://github.com/joblib/joblib/blob/b030e4e1ed6a227c0e587c31b266c03b3b692372/joblib/_parallel_backends.py#L59-L67
+  # https://github.com/joblib/joblib/blob/b030e4e1ed6a227c0e587c31b266c03b3b692372/joblib/_parallel_backends.py#L221-L248
+  checkPhaseThreadLimitHook,
+
  # build-system
  setuptools,

@@ -40,6 +48,14 @@ buildPythonPackage rec {
    threadpoolctl
  ];

+  propagatedNativeBuildInputs = [
+    checkPhaseThreadLimitHook
+  ];
+
+  # joblib expects to set thread limits itself while checking for propagation of thread limit environment variables.
+  # Setting these via checkPhaseThreadLimitHook on joblib itself causes tests to fail, but we do want the hook to propagate.
+  dontLimitCheckPhaseThreads = true;
+
  enabledTestPaths = [ "joblib/test" ];

  disabledTests = [
--- a/pkgs/development/python-modules/mistune/2.nix
+++ b/pkgs/development/python-modules/mistune/2.nix
@@ -0,0 +1,62 @@
+{
+  buildPythonPackage,
+  fetchPypi,
+  lib,
+  pytestCheckHook,
+  setuptools,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "mistune";
+  version = "2.0.5";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-AkYRPLJJLbh1xr5Wl0p8iTMzvybNkokchfYxUc7gnTQ=";
+  };
+
+  build-system = [ setuptools ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "mistune" ];
+
+  meta = {
+    changelog = "https://github.com/lepture/mistune/blob/v${finalAttrs.version}/docs/changes.rst";
+    description = "Sane Markdown parser with useful plugins and renderers";
+    homepage = "https://github.com/lepture/mistune";
+    knownVulnerabilities = [
+      "GHSA-h7ww-273w-6cm8"
+      "CVE-2026-44896"
+      "CVE-2026-59926"
+      "CVE-2026-33441"
+      "CVE-2026-59924"
+      "CVE-2026-33079"
+      "CVE-2026-59923"
+      "GHSA-jhcm-5rpf-j3wv"
+      "CVE-2026-44708"
+      "CVE-2026-44897"
+      "CVE-2026-44898"
+      "CVE-2026-44899"
+      "GHSA-9jjx-3hq3-hx4j"
+      "GHSA-xrpv-r66x-8p7j"
+      "CVE-2026-59929"
+      "GHSA-xmwc-wjpr-q378"
+      "CVE-2026-59922"
+      "CVE-2026-59925"
+      "CVE-2026-59928"
+      "GHSA-96vr-jm8v-g22j"
+      "CVE-2026-59930"
+      "CVE-2026-59927"
+      "GHSA-3q64-rw38-243v"
+      "CVE-2026-49851"
+      "GHSA-x2gr-6qf2-fc9x"
+      "GHSA-f32h-38gf-rg5r"
+      "GHSA-jxhr-4j38-fpxg"
+      "GHSA-8ppg-4vv7-9p53"
+    ];
+    license = lib.licenses.bsd3;
+    maintainers = [ ];
+  };
+})
--- a/pkgs/development/python-modules/numba/default.nix
+++ b/pkgs/development/python-modules/numba/default.nix
@@ -9,6 +9,12 @@
  # nativeBuildInputs
  setuptools,

+  # sets NUMBA_NUM_THREADS and OMP_NUM_THREADS for packages
+  # invoking numba during checkPhase/installCheckPhase to
+  # avoid overloading builders with excessive parallelism
+  # See also: https://numba.readthedocs.io/en/stable/reference/envvars.html#threading-control
+  checkPhaseThreadLimitHook,
+
  # dependencies
  llvmlite,
  numpy,
@@ -114,6 +120,10 @@ buildPythonPackage (finalAttrs: {
    writableTmpDirAsHomeHook
  ];

+  propagatedNativeBuildInputs = [
+    checkPhaseThreadLimitHook
+  ];
+
  # https://github.com/NixOS/nixpkgs/issues/255262
  preCheck = ''
    cd $out
--- a/pkgs/development/python-modules/numexpr/default.nix
+++ b/pkgs/development/python-modules/numexpr/default.nix
@@ -5,6 +5,11 @@
  numpy,
  pytestCheckHook,
  setuptools,
+  # sets NUMEXPR_NUM_THREADS and OMP_NUM_THREADS for packages
+  # invoking numexpr during checkPhase/installCheckPhase to
+  # avoid overloading builders with excessive parallelism
+  # See also: https://numexpr.readthedocs.io/en/latest/user_guide.html#threadpool-configuration
+  checkPhaseThreadLimitHook,
 }:

 buildPythonPackage rec {
@@ -31,6 +36,10 @@ buildPythonPackage rec {

  nativeCheckInputs = [ pytestCheckHook ];

+  propagatedNativeBuildInputs = [
+    checkPhaseThreadLimitHook
+  ];
+
  preCheck = ''
    pushd $out
  '';
--- a/pkgs/development/python-modules/numpy/1.nix
+++ b/pkgs/development/python-modules/numpy/1.nix
@@ -18,7 +18,7 @@
  blas,
  lapack,

-  openmpCheckPhaseHook,
+  checkPhaseThreadLimitHook,

  # Reverse dependency
  sage,
@@ -112,7 +112,7 @@ buildPythonPackage (finalAttrs: {
  ];

  propagatedNativeBuildInputs = [
-    openmpCheckPhaseHook
+    checkPhaseThreadLimitHook
  ];

  preCheck = ''
--- a/pkgs/development/python-modules/numpy/2.nix
+++ b/pkgs/development/python-modules/numpy/2.nix
@@ -19,7 +19,7 @@
  coreutils,
  lapack,

-  openmpCheckPhaseHook,
+  checkPhaseThreadLimitHook,

  # Reverse dependency
  sage,
@@ -112,7 +112,7 @@ buildPythonPackage (finalAttrs: {
  ];

  propagatedNativeBuildInputs = [
-    openmpCheckPhaseHook
+    checkPhaseThreadLimitHook
  ];

  preCheck = ''
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1147,8 +1147,8 @@ mapAliases {
  libpthreadstubs = libpthread-stubs; # Added 2025-02-04
  libpulseaudio-vanilla = throw "'libpulseaudio-vanilla' has been renamed to/replaced by 'libpulseaudio'"; # Converted to throw 2025-10-27
  libqt5pas = throw "'libqt5pas' has been renamed to/replaced by 'libsForQt5.libqtpas'"; # Converted to throw 2025-10-27
-  libqtdbusmock = warnAlias "'libqtdbusmock' has been renamed to 'libsForQt5.libqtdbusmock'"; # Added 2026-03-10
-  libqtdbustest = warnAlias "'libqtdbustest' has been renamed to 'libsForQt5.libqtdbustest'"; # Added 2026-03-10
+  libqtdbusmock = warnAlias "'libqtdbusmock' has been renamed to 'libsForQt5.libqtdbusmock'" libsForQt5.libqtdbusmock; # Added 2026-03-10
+  libqtdbustest = warnAlias "'libqtdbustest' has been renamed to 'libsForQt5.libqtdbustest'" libsForQt5.libqtdbustest; # Added 2026-03-10
  libquotient = throw "'libquotient' for qt5 was removed as upstream removed qt5 support. Consider explicitly upgrading to qt6 'libquotient'"; # Converted to throw 2025-07-04
  LibreArp = throw "'LibreArp' has been renamed to/replaced by 'librearp'"; # Converted to throw 2025-10-27
  LibreArp-lv2 = throw "'LibreArp-lv2' has been renamed to/replaced by 'librearp-lv2'"; # Converted to throw 2025-10-27
@@ -1629,6 +1629,7 @@ mapAliases {
  openjfx23 = throw "OpenJFX 23 was removed as it has reached its end of life"; # Added 2025-11-04
  openjfx24 = throw "OpenJFX 24 was removed as it has reached its end of life"; # Added 2025-10-04
  openmodelica = throw "'openmodelica' has been removed as it was unmaintained in nixpkgs and depends on insecure&unmtaintained qtwebkit"; # Added 2026-04-26
+  openmpCheckPhaseHook = warnAlias "'openmpCheckPhaseHook' has been renamed to 'checkPhaseThreadLimitHook' to reflect its handling of all known thread-limiting mechanisms during check phase" checkPhaseThreadLimitHook; # Added 2026-07-09
  openmw-tes3mp = throw "'openmw-tes3mp' has been removed due to lack of maintenance upstream"; # Added 2025-08-30
  openssl_3_0 = throw "'openssl_3_0' has been renamed to/replaced by 'openssl_3'"; # Converted to throw 2025-10-27
  opensycl = throw "'opensycl' has been renamed to/replaced by 'adaptivecpp'"; # Converted to throw 2025-10-27
@@ -1819,7 +1820,7 @@ mapAliases {
  qflipper = throw "'qflipper' has been renamed to/replaced by 'qFlipper'"; # Converted to throw 2025-10-27
  qMasterPassword = warnAlias "'qMasterPassword' has been renamed to/replaced by 'qmasterpassword'" qmasterpassword; # Added 2026-02-01
  qMasterPassword-wayland = warnAlias "'qMasterPassword-wayland' has been renamed to/replaced by 'qmasterpassword-wayland'" qmasterpassword-wayland; # Added 2026-02-01
-  qmenumodel = warnAlias "'qmenumodel' has been renamed to 'libsForQt5.qmenumodel'"; # Added 2026-03-26
+  qmenumodel = warnAlias "'qmenumodel' has been renamed to 'libsForQt5.qmenumodel'" libsForQt5.qmenumodel; # Added 2026-03-26
  qnial = throw "'qnial' has been removed due to failing to build and being unmaintained"; # Added 2025-06-26
  qrscan = throw "qrscan has been removed, as it does not build with supported LLVM versions"; # Added 2025-08-19
  qscintilla = throw "'qscintilla' has been renamed to/replaced by 'libsForQt5.qscintilla'"; # Converted to throw 2025-10-27
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3244,6 +3244,7 @@ with pkgs;
    withDynlibModule = true;
    withPythonModule = true;
    withDoH = true;
+    withDoQ = true;
    withECS = true;
    withDNSCrypt = true;
    withDNSTAP = true;
--- a/pkgs/top-level/make-tarball.nix
+++ b/pkgs/top-level/make-tarball.nix
@@ -24,6 +24,7 @@ pkgs.releaseTools.sourceTarball {
    jq
    lib-tests
    brotli
+    zstd
  ];

  configurePhase = ''
@@ -63,6 +64,9 @@ pkgs.releaseTools.sourceTarball {
  #   Some context: https://github.com/NixOS/infra/issues/438
  distPhase = ''
    mkdir -p $out/tarballs
+
+    # The compression tasks are shortlived; use all available CPUs (-T0) to
+    # prioritize fast channel advancement.
    XZ_OPT="-T0" tar \
      --create \
      --xz \
@@ -79,5 +83,22 @@ pkgs.releaseTools.sourceTarball {
      --mode=ug+w \
      --hard-dereference \
      $src $(pwd)/{.version-suffix,.git-revision}
+
+    tar \
+      --create \
+      --use-compress-program="zstd -19 -T0" \
+      --file=$out/tarballs/$releaseName.tar.zst \
+      --absolute-names \
+      --transform="s|^$src|$releaseName|g" \
+      --transform="s|^$(pwd)|$releaseName|g" \
+      --owner=0 \
+      --group=0 \
+      --numeric-owner \
+      --format=gnu \
+      --sort=name \
+      --mtime="@$SOURCE_DATE_EPOCH" \
+      --mode=ug+w \
+      --hard-dereference \
+      $src $(pwd)/{.version-suffix,.git-revision}
  '';
 }
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -10058,6 +10058,8 @@ self: super: with self; {

  mistune = callPackage ../development/python-modules/mistune { };

+  mistune_2 = callPackage ../development/python-modules/mistune/2.nix { };
+
  mitmproxy = callPackage ../development/python-modules/mitmproxy { };

  mitmproxy-linux = callPackage ../development/python-modules/mitmproxy-linux { };