Merge staging-next-25.05 into staging-25.05

2026-10-02 21:10:08 +00:00 · 2025-11-07 00:21:19 +00:00
parent 42060afb92 b84c8f03f1
commit a5c7e8eb5d
28 changed files with 242 additions and 220 deletions
--- a/.github/workflows/pull-request-target.yml
+++ b/.github/workflows/pull-request-target.yml
@@ -12,9 +12,6 @@ on:
        required: true
      NIXPKGS_CI_APP_PRIVATE_KEY:
        required: true
-      OWNER_APP_PRIVATE_KEY:
-        # The Test workflow should not actually request reviews from owners.
-        required: false

 concurrency:
  group: pr-${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number || github.run_id }}
--- a/.github/workflows/teams.yml
+++ b/.github/workflows/teams.yml
@@ -16,13 +16,17 @@ jobs:
  sync:
    runs-on: ubuntu-24.04-arm
    steps:
+      # Use a GitHub App to create the PR so that CI gets triggered and to
+      # request team member lists.
      - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
-        id: team-token
+        id: app-token
        with:
-          app-id: ${{ vars.OWNER_APP_ID }}
-          private-key: ${{ secrets.OWNER_APP_PRIVATE_KEY }}
+          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
+          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
          permission-administration: read
+          permission-contents: write
          permission-members: read
+          permission-pull-requests: write

      - name: Fetch source
        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
@@ -38,7 +42,7 @@ jobs:
      - name: Synchronise teams
        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
        with:
-          github-token: ${{ steps.team-token.outputs.token }}
+          github-token: ${{ steps.app-token.outputs.token }}
          script: |
            require('./ci/github-script/get-teams.js')({
              github,
@@ -47,20 +51,11 @@ jobs:
              outFile: "maintainers/github-teams.json"
            })

-      # Use a GitHub App to create the PR so that CI gets triggered
-      - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2.1.4
-        id: sync-token
-        with:
-          app-id: ${{ vars.NIXPKGS_CI_APP_ID }}
-          private-key: ${{ secrets.NIXPKGS_CI_APP_PRIVATE_KEY }}
-          permission-contents: write
-          permission-pull-requests: write
-
      - name: Get GitHub App User Git String
        id: user
        env:
-          GH_TOKEN: ${{ steps.sync-token.outputs.token }}
-          APP_SLUG: ${{ steps.sync-token.outputs.app-slug }}
+          GH_TOKEN: ${{ steps.app-token.outputs.token }}
+          APP_SLUG: ${{ steps.app-token.outputs.app-slug }}
        run: |
          name="${APP_SLUG}[bot]"
          userId=$(gh api "/users/$name" --jq .id)
@@ -70,7 +65,7 @@ jobs:
      - name: Create Pull Request
        uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
        with:
-          token: ${{ steps.sync-token.outputs.token }}
+          token: ${{ steps.app-token.outputs.token }}
          add-paths: maintainers/github-teams.json
          author: ${{ steps.user.outputs.git-string }}
          committer: ${{ steps.user.outputs.git-string }}
--- a/ci/github-script/bot.js
+++ b/ci/github-script/bot.js
@@ -576,7 +576,10 @@ module.exports = async ({ github, context, core, dry }) => {

  // Controls level of parallelism. Applies to both the number of concurrent requests
  // as well as the number of concurrent workers going through the list of PRs.
-  const maxConcurrent = 20
+  // We'll only boost concurrency when we're running many PRs in parallel on a schedule,
+  // but not for single PRs. This avoids things going wild, when we accidentally make
+  // too many API requests on treewides.
+  const maxConcurrent = context.payload.pull_request ? 1 : 20

  await withRateLimit({ github, core, maxConcurrent }, async (stats) => {
    if (context.payload.pull_request) {
--- a/ci/github-script/merge.js
+++ b/ci/github-script/merge.js
@@ -128,11 +128,20 @@ async function handleMerge({
    (await getTeamMembers('nixpkgs-committers')).map(({ id }) => id),
  )

-  const files = await github.paginate(github.rest.pulls.listFiles, {
-    ...context.repo,
-    pull_number,
-    per_page: 100,
-  })
+  const files = (
+    await github.rest.pulls.listFiles({
+      ...context.repo,
+      pull_number,
+      per_page: 100,
+    })
+  ).data
+
+  // Early exit to prevent treewides from using up a lot of API requests (and time!) to list
+  // all the files in the pull request. For now, the merge-bot will not work when 100 or more
+  // files are touched in a PR - which should be more than fine.
+  // TODO: Find a more efficient way of downloading all the *names* of the touched files,
+  // including an early exit when the first non-by-name file is found.
+  if (files.length >= 100) return false

  // Only look through comments *after* the latest (force) push.
  const lastPush = events.findLastIndex(
@@ -182,7 +191,9 @@ async function handleMerge({
        }`,
        { node_id: pull_request.node_id, sha: pull_request.head.sha },
      )
-      return `[Queued](${resp.enqueuePullRequest.mergeQueueEntry.mergeQueue.url}) for merge`
+      return [
+        `:heavy_check_mark: [Queued](${resp.enqueuePullRequest.mergeQueueEntry.mergeQueue.url}) for merge (#306934)`,
+      ]
    } catch (e) {
      log('Enqueing failed', e.response.errors[0].message)
    }
@@ -201,7 +212,12 @@ async function handleMerge({
        }`,
        { node_id: pull_request.node_id, sha: pull_request.head.sha },
      )
-      return 'Enabled Auto Merge'
+      return [
+        `:heavy_check_mark: Enabled Auto Merge (#306934)`,
+        '',
+        '> [!TIP]',
+        '> Sometimes GitHub gets stuck after enabling Auto Merge. In this case, leaving another approval should trigger the merge.',
+      ]
    } catch (e) {
      log('Auto Merge failed', e.response.errors[0].message)
      throw new Error(e.response.errors[0].message)
@@ -287,7 +303,7 @@ async function handleMerge({
    if (result) {
      await react('ROCKET')
      try {
-        body.push(`:heavy_check_mark: ${await merge()} (#306934)`)
+        body.push(...(await merge()))
      } catch (e) {
        // Remove the HTML comment with node_id reference to allow retrying this merge on the next run.
        body.shift()
--- a/ci/github-script/reviewers.js
+++ b/ci/github-script/reviewers.js
@@ -13,6 +13,34 @@ async function handleReviewers({
 }) {
  const pull_number = pull_request.number

+  const requested_reviewers = new Set(
+    pull_request.requested_reviewers.map(({ login }) => login),
+  )
+  log(
+    'reviewers - requested_reviewers',
+    Array.from(requested_reviewers).join(', '),
+  )
+
+  const existing_reviewers = new Set(
+    reviews.map(({ user }) => user?.login).filter(Boolean),
+  )
+  log(
+    'reviewers - existing_reviewers',
+    Array.from(existing_reviewers).join(', '),
+  )
+
+  // Early sanity check, before we start making any API requests. The list of maintainers
+  // does not have duplicates so the only user to filter out from this list would be the
+  // PR author. Therefore, we check for a limit of 15+1, where 15 is the limit we check
+  // further down again.
+  // This is to protect against huge treewides consuming all our API requests for no
+  // reason.
+  if (maintainers.length > 16) {
+    core.warning('Too many potential reviewers, skipping review requests.')
+    // Return a boolean on whether the "needs: reviewers" label should be set.
+    return existing_reviewers.size === 0 && requested_reviewers.size === 0
+  }
+
  const users = new Set([
    ...(await Promise.all(
      maintainers.map(async (id) => (await getUser(id)).login),
@@ -47,6 +75,9 @@ async function handleReviewers({
  const reviewers = (
    await Promise.all(
      Array.from(new_reviewers, async (username) => {
+        // TODO: Restructure this file to only do the collaborator check for those users
+        // who were not already part of a team. Being a member of a team makes them
+        // collaborators by definition.
        try {
          await github.rest.repos.checkCollaborator({
            ...context.repo,
@@ -65,29 +96,13 @@ async function handleReviewers({
  log('reviewers - reviewers', reviewers.join(', '))

  if (reviewers.length > 15) {
-    log(
+    core.warning(
      `Too many reviewers (${reviewers.join(', ')}), skipping review requests.`,
    )
-    // false indicates, that we do have reviewers and don't need the "needs: reviewers" label.
-    return false
+    // Return a boolean on whether the "needs: reviewers" label should be set.
+    return existing_reviewers.size === 0 && requested_reviewers.size === 0
  }

-  const requested_reviewers = new Set(
-    pull_request.requested_reviewers.map(({ login }) => login),
-  )
-  log(
-    'reviewers - requested_reviewers',
-    Array.from(requested_reviewers).join(', '),
-  )
-
-  const existing_reviewers = new Set(
-    reviews.map(({ user }) => user?.login).filter(Boolean),
-  )
-  log(
-    'reviewers - existing_reviewers',
-    Array.from(existing_reviewers).join(', '),
-  )
-
  const non_requested_reviewers = new Set(reviewers)
    .difference(requested_reviewers)
    // We don't want to rerequest reviews from people who already reviewed.
@@ -117,7 +132,7 @@ async function handleReviewers({

  // Return a boolean on whether the "needs: reviewers" label should be set.
  return (
-    new_reviewers.size === 0 &&
+    non_requested_reviewers.size === 0 &&
    existing_reviewers.size === 0 &&
    requested_reviewers.size === 0
  )
--- a/lib/customisation.nix
+++ b/lib/customisation.nix
@@ -752,11 +752,22 @@ rec {
    # Inputs

    `extendMkDerivation`-specific configurations
-    : `constructDrv`: Base build helper, the `mkDerivation`-like build helper to extend.
-    : `excludeDrvArgNames`: Argument names not to pass from the input fixed-point arguments to `constructDrv`. Note: It doesn't apply to the updating arguments returned by `extendDrvArgs`.
-    : `extendDrvArgs` : An extension (overlay) of the argument set, like the one taken by [overrideAttrs](#sec-pkg-overrideAttrs) but applied before passing to `constructDrv`.
-    : `inheritFunctionArgs`: Whether to inherit `__functionArgs` from the base build helper (default to `true`).
-    : `transformDrv`: Function to apply to the result derivation (default to `lib.id`).
+    : `constructDrv` (required)
+      : Base build helper, the `mkDerivation`-like build helper to extend.
+
+      `excludeDrvArgNames` (default to `[ ]`)
+      : Argument names not to pass from the input fixed-point arguments to `constructDrv`.
+        It doesn't apply to the updating arguments returned by `extendDrvArgs`.
+
+      `extendDrvArgs` (required)
+      : An extension (overlay) of the argument set, like the one taken by [overrideAttrs](#sec-pkg-overrideAttrs) but applied before passing to `constructDrv`.
+
+      `inheritFunctionArgs` (default to `true`)
+      : Whether to inherit `__functionArgs` from the base build helper.
+        Set `inheritFunctionArgs` to `false` when `extendDrvArgs`'s `args` set pattern does not contain an ellipsis.
+
+      `transformDrv` (default to `lib.id`)
+      : Function to apply to the result derivation.

    # Type

--- a/maintainers/github-teams.json
+++ b/maintainers/github-teams.json
@@ -724,7 +724,6 @@
    "description": "Provides leadership for and has authority over Nixpkgs.",
    "id": 14317027,
    "maintainers": {
-      "K900": 386765,
      "alyssais": 2768870,
      "emilazy": 18535642,
      "wolfgangwalther": 9132420
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -1,10 +1,10 @@
 {
  "chromium": {
-    "version": "142.0.7444.59",
+    "version": "142.0.7444.134",
    "chromedriver": {
-      "version": "142.0.7444.60",
-      "hash_darwin": "sha256-5Atr7h0jIneU4VbSF20j+3tcYVneYvqOsJ0GG8sD7r4=",
-      "hash_darwin_aarch64": "sha256-sh2BTEKJaAYbiuNYiSW6iChiCroo95EHoGqxVgX6Jw0="
+      "version": "142.0.7444.135",
+      "hash_darwin": "sha256-i34SR1pfHcAA4N4ppIioa7r33PnvY0OYA8/+U1bQFs8=",
+      "hash_darwin_aarch64": "sha256-dsbjEDkZ0AVghazgF5w9O3aUWZNSy8R9WiHn9m/Sa9g="
    },
    "deps": {
      "depot_tools": {
@@ -21,8 +21,8 @@
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "4b8153ab58d3c3f4c9f7e4baad9616ecf80db5fa",
-        "hash": "sha256-RZQD9aL/YglC8chM7tqtB1Y2u6DF+6kkgwklUohaBXc=",
+        "rev": "b6965f826881a60c51151cfc0a0175966a0a4e81",
+        "hash": "sha256-NTBQrGihsT7kuY/Mac5s4oH1xEn3CFEAR6eOEvZwmYs=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@@ -132,8 +132,8 @@
      },
      "src/third_party/dawn": {
        "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "cee9cb0d67e749bf42f5e90cb3b8a6f525dbb920",
-        "hash": "sha256-loKRLJfTxBxlTbPVWZqGdx0DyPvEopbs2zIf4gaxoLo="
+        "rev": "95f9c2b375395cc82941babdf1e9f0cf60a32831",
+        "hash": "sha256-BFJsVt7hkSyyPQiX7QCN7Fu6CgTF/2xwAQbWCkJVq6M="
      },
      "src/third_party/dawn/third_party/glfw": {
        "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -257,8 +257,8 @@
      },
      "src/third_party/devtools-frontend/src": {
        "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "38cfe98a56a034da33ee62a5f1ea235fe47f58a7",
-        "hash": "sha256-bUJuFEDqgUFdMfmMyroX4s2ky/2n37PsTWaV+iQHCJg="
+        "rev": "f063edc91e3610a60fb9d486ae8694f2a11fcd17",
+        "hash": "sha256-qiucde85rKA7TefveIa++sOF+MzT56pe8pHUUCj9Zeo="
      },
      "src/third_party/dom_distiller_js/dist": {
        "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -807,13 +807,13 @@
      },
      "src/v8": {
        "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "bb294624702efbb17691b642333f06bf5108e600",
-        "hash": "sha256-ovlKdiBYD9RAjA1XI0PLp/pt25LAvm3fn5AqWlJQfgs="
+        "rev": "4427aa4a9c14d3d542866c0ed2ae8a8554cfd68d",
+        "hash": "sha256-SL9YaplMFA1Ez11bIzAfl/F5qQob/PvCP1uknP1LiLs="
      }
    }
  },
  "ungoogled-chromium": {
-    "version": "142.0.7444.59",
+    "version": "142.0.7444.134",
    "deps": {
      "depot_tools": {
        "rev": "675a3a9ccd7cf9367bb4caa58c30f08b56d45ef5",
@@ -825,16 +825,16 @@
        "hash": "sha256-sm5GWbkm3ua7EkCWTuY4TG6EXKe3asXTrH1APnNARJQ="
      },
      "ungoogled-patches": {
-        "rev": "142.0.7444.59-2",
-        "hash": "sha256-Cjcy6ohVNt2eAD+m4ZTbeoHH9i4znkdgN0ZaysU8Whk="
+        "rev": "142.0.7444.134-1",
+        "hash": "sha256-kwKzDTte0wPnx+tUmIaQ2EVf6HHacunmBbwLlUqYnOI="
      },
      "npmHash": "sha256-i1eQ4YlrWSgY522OlFtGDDPmxE2zd1hDM03AzR8RafE="
    },
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "4b8153ab58d3c3f4c9f7e4baad9616ecf80db5fa",
-        "hash": "sha256-RZQD9aL/YglC8chM7tqtB1Y2u6DF+6kkgwklUohaBXc=",
+        "rev": "b6965f826881a60c51151cfc0a0175966a0a4e81",
+        "hash": "sha256-NTBQrGihsT7kuY/Mac5s4oH1xEn3CFEAR6eOEvZwmYs=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@@ -944,8 +944,8 @@
      },
      "src/third_party/dawn": {
        "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "cee9cb0d67e749bf42f5e90cb3b8a6f525dbb920",
-        "hash": "sha256-loKRLJfTxBxlTbPVWZqGdx0DyPvEopbs2zIf4gaxoLo="
+        "rev": "95f9c2b375395cc82941babdf1e9f0cf60a32831",
+        "hash": "sha256-BFJsVt7hkSyyPQiX7QCN7Fu6CgTF/2xwAQbWCkJVq6M="
      },
      "src/third_party/dawn/third_party/glfw": {
        "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1069,8 +1069,8 @@
      },
      "src/third_party/devtools-frontend/src": {
        "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "38cfe98a56a034da33ee62a5f1ea235fe47f58a7",
-        "hash": "sha256-bUJuFEDqgUFdMfmMyroX4s2ky/2n37PsTWaV+iQHCJg="
+        "rev": "f063edc91e3610a60fb9d486ae8694f2a11fcd17",
+        "hash": "sha256-qiucde85rKA7TefveIa++sOF+MzT56pe8pHUUCj9Zeo="
      },
      "src/third_party/dom_distiller_js/dist": {
        "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -1619,8 +1619,8 @@
      },
      "src/v8": {
        "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "bb294624702efbb17691b642333f06bf5108e600",
-        "hash": "sha256-ovlKdiBYD9RAjA1XI0PLp/pt25LAvm3fn5AqWlJQfgs="
+        "rev": "4427aa4a9c14d3d542866c0ed2ae8a8554cfd68d",
+        "hash": "sha256-SL9YaplMFA1Ez11bIzAfl/F5qQob/PvCP1uknP1LiLs="
      }
    }
  }
--- a/pkgs/by-name/ch/chatzone-desktop/package.nix
+++ b/pkgs/by-name/ch/chatzone-desktop/package.nix
@@ -10,10 +10,10 @@

 let
  pname = "chatzone-desktop";
-  version = "5.4.1";
+  version = "5.5.0";
  src = fetchurl {
-    url = "https://cdn1.ozone.ru/s3/chatzone-clients/ci/5.4.1/872/chatzone-desktop-linux-5.4.1.AppImage";
-    hash = "sha256-ONr8rIP7oXtafACkW4fDHfYew83F4R8un+hGdVI75iA=";
+    url = "https://cdn1.ozone.ru/s3/chatzone-clients/ci/5.5.0/925/chatzone-desktop-linux-5.5.0.AppImage";
+    hash = "sha256-2Ly0qABTqleqH0AoAIJ+JNYFyoikxZroiFrYwSxBtdw=";
  };
  appimageContents = appimageTools.extract { inherit pname version src; };
 in
--- a/pkgs/by-name/de/devenv/package.nix
+++ b/pkgs/by-name/de/devenv/package.nix
@@ -15,7 +15,7 @@
 }:

 let
-  version = "1.9";
+  version = "1.9.1";
  devenvNixVersion = "2.30.4";

  devenv_nix =
@@ -42,10 +42,10 @@ rustPlatform.buildRustPackage {
    owner = "cachix";
    repo = "devenv";
    tag = "v${version}";
-    hash = "sha256-MG+c0mo4g9UHSuqibX3OVkiADWmMn/PWDfVhD4U29PM=";
+    hash = "sha256-v86pQGIWHJPkRryglJSXOp0aEoU6ZtURuURsXLqfqSE=";
  };

-  cargoHash = "sha256-7uB9oC0jHWBFeUtIyVpTjeximU6eSxSCiBzo/whoKxQ=";
+  cargoHash = "sha256-41VmzZvoRd2pL5/o6apHztpS2XrL4HGPIJPBkUbPL1I=";

  buildAndTestSubdir = "devenv";

--- a/pkgs/by-name/er/errands/package.nix
+++ b/pkgs/by-name/er/errands/package.nix
@@ -18,7 +18,7 @@
 }:
 python3Packages.buildPythonApplication rec {
  pname = "errands";
-  version = "46.2.8";
+  version = "46.2.9";

  pyproject = false;

@@ -26,7 +26,7 @@ python3Packages.buildPythonApplication rec {
    owner = "mrvladus";
    repo = "Errands";
    tag = version;
-    hash = "sha256-Gs3/DPMsoPTxH+fR7H3gPJr8ITrQDPlmw236vDnmBaA";
+    hash = "sha256-+x6zp14leFryxwQJdI0UKPp4N0IuJRIX5/94QrlzDAU=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ga/garnet/deps.json
+++ b/pkgs/by-name/ga/garnet/deps.json
@@ -6,18 +6,18 @@
  },
  {
    "pname": "Azure.Core",
-    "version": "1.47.1",
-    "hash": "sha256-YJR1bDI9H9lr6p/9QcOWEhnpMD8ePyxxO39S32VAOak="
+    "version": "1.47.3",
+    "hash": "sha256-fWyfqF1lpnap4cF3l9J0fYtZbxIqm6UFsuJgN+/hwW4="
  },
  {
    "pname": "Azure.Identity",
-    "version": "1.15.0",
-    "hash": "sha256-eqR6Akmrtu4U4fPvkDwMbwk2dPGx+MaKPj+Y80e0/Ak="
+    "version": "1.16.0",
+    "hash": "sha256-vJa746fywiLlC2QoUu2SLf+mQPzGTGxbXzGoWqAUb0Q="
  },
  {
    "pname": "Azure.Storage.Blobs",
-    "version": "12.25.0",
-    "hash": "sha256-SjIwM1sIBd4I9ShAeaIAfPUzc3K7tbodW6y1vNAD+4U="
+    "version": "12.25.1",
+    "hash": "sha256-OJgmzE7+BJsrqGMErUwG4wmaguYL1zPbhtdQvvqFuHY="
  },
  {
    "pname": "Azure.Storage.Common",
@@ -126,13 +126,13 @@
  },
  {
    "pname": "Microsoft.Identity.Client",
-    "version": "4.73.1",
-    "hash": "sha256-cd5ArtDvQK4gdX8M0GHQEsCFWlqpdm6lxvaM2yMHkhc="
+    "version": "4.76.0",
+    "hash": "sha256-v5/iulShs0yMHvNoRo/pbDVYu3tOl9Y7kovSKJbgQnc="
  },
  {
    "pname": "Microsoft.Identity.Client.Extensions.Msal",
-    "version": "4.73.1",
-    "hash": "sha256-wc4oHBGKCJhAqNIyD4LlugCFvmyiW5iVzGYP88bnWqs="
+    "version": "4.76.0",
+    "hash": "sha256-OCt+XN0tt1URnn0Wh7y19YCNo3ViG5th9HAa6GusFeE="
  },
  {
    "pname": "Microsoft.IdentityModel.Abstractions",
@@ -181,8 +181,8 @@
  },
  {
    "pname": "System.ClientModel",
-    "version": "1.5.1",
-    "hash": "sha256-n4PHKtjmFXo37s5yhfUQ9UbfnWplqHpC+wsvlHxctow="
+    "version": "1.6.1",
+    "hash": "sha256-OMnamkT9Nt5ZSR6xPKFmOQRUjdn0a4nP9jkD2eZxxc0="
  },
  {
    "pname": "System.Diagnostics.DiagnosticSource",
@@ -224,6 +224,11 @@
    "version": "8.0.1",
    "hash": "sha256-cxYZL0Trr6RBplKmECv94ORuyjrOM6JB0D/EwmBSisg="
  },
+  {
+    "pname": "System.Numerics.Tensors",
+    "version": "9.0.9",
+    "hash": "sha256-wc7lhmydATxle8Wv124yFPT+bkpKpcCQL2TAPGodIAc="
+  },
  {
    "pname": "System.Numerics.Vectors",
    "version": "4.5.0",
--- a/pkgs/by-name/ga/garnet/package.nix
+++ b/pkgs/by-name/ga/garnet/package.nix
@@ -8,13 +8,13 @@

 buildDotnetModule rec {
  pname = "garnet";
-  version = "1.0.84";
+  version = "1.0.86";

  src = fetchFromGitHub {
    owner = "microsoft";
    repo = "garnet";
    tag = "v${version}";
-    hash = "sha256-Bg+WQrGs9HyH3E9Ry4fPrnfDcKL8WuTH798pwHrLIuo=";
+    hash = "sha256-EmwDc6kbOL++g1Xq4LoV3JuxYWSifOmv8vvWKsU3CE4=";
  };

  projectFile = "main/GarnetServer/GarnetServer.csproj";
--- a/pkgs/by-name/ge/gerrit/package.nix
+++ b/pkgs/by-name/ge/gerrit/package.nix
@@ -8,11 +8,11 @@

 stdenv.mkDerivation rec {
  pname = "gerrit";
-  version = "3.11.5";
+  version = "3.11.7";

  src = fetchurl {
    url = "https://gerrit-releases.storage.googleapis.com/gerrit-${version}.war";
-    hash = "sha256-S9hit76hqNUrTfXPetFis3Rs+wA7vGNH+fXprseuBpg=";
+    hash = "sha256-eDf7MW3ikW2yiPEPVZA5RxRbYeSw0ucbS1rsFcdzdk4=";
  };

  buildCommand = ''
--- a/pkgs/by-name/lo/lock/package.nix
+++ b/pkgs/by-name/lo/lock/package.nix
@@ -19,13 +19,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "lock";
-  version = "1.7.5";
+  version = "1.8.0";

  src = fetchFromGitHub {
    owner = "konstantintutsch";
    repo = "Lock";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-vm1Tv3av9x5KZcUwL/yvnE7MeHhdFEutOpbgyWJRR0g=";
+    hash = "sha256-t472uLuuT5QPmfxkRP6wPalblMU68iD2wyKOxSrJfeU=";
  };

  strictDeps = true;
--- a/pkgs/by-name/ne/nexusmods-app/package.nix
+++ b/pkgs/by-name/ne/nexusmods-app/package.nix
@@ -5,7 +5,6 @@
  desktop-file-utils,
  dotnetCorePackages,
  fetchFromGitHub,
-  fetchpatch2,
  imagemagick,
  lib,
  xdg-utils,
@@ -23,13 +22,13 @@ let
 in
 buildDotnetModule (finalAttrs: {
  inherit pname;
-  version = "0.19.4";
+  version = "0.20.2";

  src = fetchFromGitHub {
    owner = "Nexus-Mods";
    repo = "NexusMods.App";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-WKfv5y6UmO3dmzkXrqZ+VtIbXf0FszRdsa5Rmp95rYg=";
+    hash = "sha256-hpsrHHh0Bk+9Z4Qp5aTqH5i8KnqCLQdseYGrbr4sh1k=";
    fetchSubmodules = true;
  };

@@ -57,14 +56,6 @@ buildDotnetModule (finalAttrs: {
  dotnet-sdk = dotnetCorePackages.sdk_9_0;
  dotnet-runtime = dotnetCorePackages.runtime_9_0;

-  patches = [
-    (fetchpatch2 {
-      name = "Fix-SMAPI-installation.patch";
-      url = "https://github.com/Nexus-Mods/NexusMods.App/pull/4026.patch?full_index=1";
-      hash = "sha256-1LgFTi63fVhGUZXZtS6iD2yqd0RxhdpiXKtWMFNEoD4=";
-    })
-  ];
-
  postPatch = ''
    # Specify a fixed date to improve build reproducibility
    echo "1970-01-01T00:00:00Z" >buildDate.txt
@@ -82,11 +73,6 @@ buildDotnetModule (finalAttrs: {
    ${lib.optionalString finalAttrs.doCheck ''
      # For some reason these tests fail (intermittently?) with a zero timestamp
      touch tests/NexusMods.UI.Tests/WorkspaceSystem/*.verified.png
-
-      # Fix expected version number in text fixture
-      # https://github.com/Nexus-Mods/NexusMods.App/issues/4030
-      substituteInPlace tests/NexusMods.Backend.Tests/EventTrackerTests.Test_PrepareRequest.verified.txt \
-        --replace-fail 0.0.1 ${finalAttrs.version}
    ''}
  '';

--- a/pkgs/by-name/ne/nexusmods-app/vendored/games.json
+++ b/pkgs/by-name/ne/nexusmods-app/vendored/games.json
@@ -6,12 +6,12 @@
    "forum_url": "https://forums.nexusmods.com/games/19-stardew-valley/",
    "nexusmods_url": "https://www.nexusmods.com/stardewvalley",
    "genre": "Simulation",
-    "file_count": 143212,
-    "downloads": 627187655,
+    "file_count": 144372,
+    "downloads": 635510946,
    "domain_name": "stardewvalley",
    "approved_date": 1457432329,
-    "mods": 25945,
-    "collections": 2020
+    "mods": 26187,
+    "collections": 1990
  },
  {
    "id": 1704,
@@ -20,12 +20,12 @@
    "forum_url": "https://forums.nexusmods.com/games/6-skyrim/",
    "nexusmods_url": "https://www.nexusmods.com/skyrimspecialedition",
    "genre": "RPG",
-    "file_count": 661698,
-    "downloads": 9193533035,
+    "file_count": 667120,
+    "downloads": 9346275237,
    "domain_name": "skyrimspecialedition",
    "approved_date": 1477480498,
-    "mods": 118807,
-    "collections": 4852
+    "mods": 119859,
+    "collections": 4876
  },
  {
    "id": 3174,
@@ -34,12 +34,12 @@
    "forum_url": "https://forums.nexusmods.com/games/9-mount-blade-ii-bannerlord/",
    "nexusmods_url": "https://www.nexusmods.com/mountandblade2bannerlord",
    "genre": "Strategy",
-    "file_count": 50603,
-    "downloads": 116400189,
+    "file_count": 50960,
+    "downloads": 117558949,
    "domain_name": "mountandblade2bannerlord",
    "approved_date": 1582898627,
-    "mods": 6341,
-    "collections": 293
+    "mods": 6397,
+    "collections": 294
  },
  {
    "id": 3333,
@@ -48,12 +48,12 @@
    "forum_url": "https://forums.nexusmods.com/games/1-cyberpunk-2077/",
    "nexusmods_url": "https://www.nexusmods.com/cyberpunk2077",
    "genre": "Action",
-    "file_count": 125224,
-    "downloads": 930909718,
+    "file_count": 126752,
+    "downloads": 958960285,
    "domain_name": "cyberpunk2077",
    "approved_date": 1607433331,
-    "mods": 18032,
-    "collections": 1588
+    "mods": 18283,
+    "collections": 1597
  },
  {
    "id": 3474,
@@ -62,11 +62,11 @@
    "forum_url": "https://forums.nexusmods.com/games/2-baldurs-gate-3/",
    "nexusmods_url": "https://www.nexusmods.com/baldursgate3",
    "genre": "RPG",
-    "file_count": 105632,
-    "downloads": 351591575,
+    "file_count": 106755,
+    "downloads": 359737700,
    "domain_name": "baldursgate3",
    "approved_date": 1602863114,
-    "mods": 15020,
-    "collections": 1752
+    "mods": 15196,
+    "collections": 1740
  }
 ]
--- a/pkgs/by-name/pa/paretosecurity/package.nix
+++ b/pkgs/by-name/pa/paretosecurity/package.nix
@@ -17,16 +17,16 @@ buildGoModule (finalAttrs: {
    webkitgtk_4_1
  ];
  pname = "paretosecurity";
-  version = "0.3.8";
+  version = "0.3.11";

  src = fetchFromGitHub {
    owner = "ParetoSecurity";
    repo = "agent";
    rev = finalAttrs.version;
-    hash = "sha256-pqqcyWFyJX5IJkkLxAafbQu/8yygBsQL1/BAENFdk4g=";
+    hash = "sha256-BYSbLeWW0DSVNAgBvWKRLgwDg47QjTbvloGfyCDYIOU=";
  };

-  vendorHash = "sha256-6OQ9SPr9z+uoGeeJwo3jrr1nMECcHgULMvjn2G4uLx4=";
+  vendorHash = "sha256-hH+4rYvFuDsCa90C1uNM2WaQSYK9n0PpVv6P+o54RoU=";
  proxyVendor = true;

  # Skip building the Windows installer
--- a/pkgs/by-name/si/signal-desktop-bin/copy-noto-emoji.py
+++ b/pkgs/by-name/si/signal-desktop-bin/copy-noto-emoji.py
@@ -18,24 +18,6 @@ import sys
 from pathlib import Path


-def signal_name_to_emoji(signal_emoji_name: str) -> str:
-    r"""Return the emoji corresponding to a Signal emoji name.
-
-    Signal emoji names are concatenations of UTF‐16 code units,
-    represented in lowercase big‐endian hex padded to four digits.
-
-    >>> signal_name_to_emoji("d83dde36200dd83cdf2bfe0f")
-    '😶‍🌫️'
-    >>> b"\xd8\x3d\xde\x36\x20\x0d\xd8\x3c\xdf\x2b\xfe\x0f".decode("utf-16-be")
-    '😶‍🌫️'
-    """
-    hex_bytes = zip(signal_emoji_name[::2], signal_emoji_name[1::2])
-    emoji_utf_16_be = bytes(
-        int("".join(hex_pair), 16) for hex_pair in hex_bytes
-    )
-    return emoji_utf_16_be.decode("utf-16-be")
-
-
 def emoji_to_noto_name(emoji: str) -> str:
    r"""Return the Noto emoji name of an emoji.

@@ -68,16 +50,15 @@ def _main() -> None:

    for signal_emoji_names in jumbomoji_packs.values():
        for signal_emoji_name in signal_emoji_names:
-            emoji = signal_name_to_emoji(signal_emoji_name)

            try:
                shutil.copy(
-                    noto_png_path / f"emoji_u{emoji_to_noto_name(emoji)}.png",
-                    out_path / emoji,
+                    noto_png_path / f"emoji_u{emoji_to_noto_name(signal_emoji_name)}.png",
+                    out_path / signal_emoji_name,
                )
            except FileNotFoundError:
                print(
-                    f"Missing Noto emoji: {emoji} {signal_emoji_name}",
+                    f"Missing Noto emoji: {signal_emoji_name}",
                    file=sys.stderr,
                )
                continue
--- a/pkgs/by-name/si/signal-desktop-bin/generic.nix
+++ b/pkgs/by-name/si/signal-desktop-bin/generic.nix
@@ -92,12 +92,12 @@ let
  });

  noto-emoji-sheet-32 = fetchurl {
-    url = "https://raw.githubusercontent.com/iamcal/emoji-data/refs/tags/v15.1.2/sheet_google_32.png";
-    hash = "sha256-S03NCTbvB5yeQl62WpLNjNGhjNErtgaOB6tAj/X8vPc=";
+    url = "https://raw.githubusercontent.com/iamcal/emoji-data/refs/tags/v16.0.0/sheet_google_32.png";
+    hash = "sha256-tBfp9s1LvBBla7/V4TtumiVFtV5qTPcxLXW+H6qjSVI=";
  };
  noto-emoji-sheet-64 = fetchurl {
-    url = "https://raw.githubusercontent.com/iamcal/emoji-data/refs/tags/v15.1.2/sheet_google_64.png";
-    hash = "sha256-kZYStR5xAuausSpOD6wJZRJZ1K6nPpweE3aYSgWntS4=";
+    url = "https://raw.githubusercontent.com/iamcal/emoji-data/refs/tags/v16.0.0/sheet_google_64.png";
+    hash = "sha256-eVoMWY0WLJpKriPyGIxge4ybwZEst9hDgkWfjekaOuE=";
  };
 in
 stdenv.mkDerivation rec {
@@ -263,8 +263,7 @@ stdenv.mkDerivation rec {

    # Fix the desktop link
    substituteInPlace $out/share/applications/signal-desktop.desktop \
-      --replace-fail "/${bindir}/signal-desktop" ${meta.mainProgram} \
-      --replace-fail "StartupWMClass=Signal" "StartupWMClass=signal"
+      --replace-fail "/${bindir}/signal-desktop" ${meta.mainProgram}

    mv $out/share/applications/signal{-desktop,}.desktop

--- a/pkgs/by-name/si/signal-desktop-bin/signal-desktop-aarch64.nix
+++ b/pkgs/by-name/si/signal-desktop-bin/signal-desktop-aarch64.nix
@@ -1,7 +1,7 @@
 { callPackage, commandLineArgs }:
 callPackage ./generic.nix { inherit commandLineArgs; } {
  pname = "signal-desktop-bin";
-  version = "7.71.0";
+  version = "7.77.1";

  libdir = "usr/lib64/signal-desktop";
  bindir = "usr/bin";
@@ -10,6 +10,6 @@ callPackage ./generic.nix { inherit commandLineArgs; } {
    bsdtar -xf $downloadedFile -C "$out"
  '';

-  url = "https://download.copr.fedorainfracloud.org/results/useidel/signal-desktop/fedora-42-aarch64/09571107-signal-desktop/signal-desktop-7.71.0-1.fc42.aarch64.rpm";
-  hash = "sha256-sNGIkO2HAXl0ykFyZNNV75iVUQ+oRGv6NZW8tVUxfJA=";
+  url = "https://download.copr.fedorainfracloud.org/results/useidel/signal-desktop/fedora-42-aarch64/09751999-signal-desktop/signal-desktop-7.77.1-1.fc42.aarch64.rpm";
+  hash = "sha256-IkAJxq3JK3kKdtLy1lkVUfJNuEStMjn7iQEwsFurwOs=";
 }
--- a/pkgs/by-name/si/signal-desktop-bin/signal-desktop-darwin.nix
+++ b/pkgs/by-name/si/signal-desktop-bin/signal-desktop-darwin.nix
@@ -6,11 +6,11 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "signal-desktop-bin";
-  version = "7.71.0";
+  version = "7.77.1";

  src = fetchurl {
    url = "https://updates.signal.org/desktop/signal-desktop-mac-universal-${finalAttrs.version}.dmg";
-    hash = "sha256-G4wCIzKnWwBYSTuXhZ6681Z2+0Rn2bpvb3vhKMAXFc4=";
+    hash = "sha256-vnNR5KTdeTKUMlHnjfB+WkBtpcLP+KEmIPoTfk7Q1+w=";
  };
  sourceRoot = ".";

--- a/pkgs/by-name/si/signal-desktop-bin/signal-desktop.nix
+++ b/pkgs/by-name/si/signal-desktop-bin/signal-desktop.nix
@@ -1,12 +1,12 @@
 { callPackage, commandLineArgs }:
 callPackage ./generic.nix { inherit commandLineArgs; } rec {
  pname = "signal-desktop-bin";
-  version = "7.71.0";
+  version = "7.77.1";

  libdir = "opt/Signal";
  bindir = libdir;
  extractPkg = "dpkg-deb -x $downloadedFile $out";

  url = "https://updates.signal.org/desktop/apt/pool/s/signal-desktop/signal-desktop_${version}_amd64.deb";
-  hash = "sha256-y7ONN6VBVFH8zyXJNM3+cY4JegSolXfhH3T85WiM2Dk=";
+  hash = "sha256-57sm6wmtp0eXWCv7LviCiBEi5/IysubiuBYSP7eVkkU=";
 }
--- a/pkgs/by-name/sy/sydbox/package.nix
+++ b/pkgs/by-name/sy/sydbox/package.nix
@@ -12,7 +12,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "sydbox";
-  version = "3.37.9";
+  version = "3.39.1";

  outputs = [
    "out"
@@ -24,10 +24,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "Sydbox";
    repo = "sydbox";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-SG19p7TuN7+TX5tafNBU6R48PzT44WqvGydmpfUo+FU=";
+    hash = "sha256-LJHZb4TGo+Lep7yiej2G1H6mXAoEk5ixn/lGDxAWqvg=";
  };

-  cargoHash = "sha256-rxlnlu8RziOhSNbCU8ESL0a+f+594E0q+3gmyQLhPaw=";
+  cargoHash = "sha256-mUeJ3A2HW2pXWXW3Abb+aqTaZjVrchYJNCJCDC2Em9s=";

  nativeBuildInputs = [
    mandoc
--- a/pkgs/by-name/we/wechat/package.nix
+++ b/pkgs/by-name/we/wechat/package.nix
@@ -30,14 +30,14 @@ let
      # https://dldir1.qq.com/weixin/mac/mac-release.xml
      any-darwin =
        let
-          version = "4.1.4.12-31227";
+          version = "4.1.4.15-31252";
          version' = lib.replaceString "-" "_" version;
        in
        {
          inherit version;
          src = fetchurl {
            url = "https://dldir1v6.qq.com/weixin/Universal/Mac/xWeChatMac_universal_${version'}.dmg";
-            hash = "sha256-xVWEABH3dzQkQpmhJ3gKXJd9lQ4fqN7ptkWLTpJ4vaY=";
+            hash = "sha256-nG9fYaQjeCwYFV7yKdlUxbXnFALc1VomQ/hnGQtJ17o=";
          };
        };
    in
@@ -45,17 +45,17 @@ let
      aarch64-darwin = any-darwin;
      x86_64-darwin = any-darwin;
      aarch64-linux = {
-        version = "4.1.0.10";
+        version = "4.1.0.13";
        src = fetchurl {
-          url = "https://web.archive.org/web/20250930121708/https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_arm64.AppImage";
-          hash = "sha256-qkNLA8nILsIi2ciIzr9pb3PejhbEvZ5fe4GlmjyjrEI=";
+          url = "https://web.archive.org/web/20251106024910/https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_arm64.AppImage";
+          hash = "sha256-/d5crM6IGd0k0fSlBSQx4TpIVX/8iib+an0VMkWMNdw=";
        };
      };
      x86_64-linux = {
-        version = "4.1.0.10";
+        version = "4.1.0.13";
        src = fetchurl {
-          url = "https://web.archive.org/web/20250930121506/https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_x86_64.AppImage";
-          hash = "sha256-d/zdb69gmIcgAFCbWLKGfmD8ZFfuDlYdOy7vUJ7SiXc=";
+          url = "https://web.archive.org/web/20251106024907/https://dldir1v6.qq.com/weixin/Universal/Linux/WeChatLinux_x86_64.AppImage";
+          hash = "sha256-+r5Ebu40GVGG2m2lmCFQ/JkiDsN/u7XEtnLrB98602w=";
        };
      };
    };
--- a/pkgs/development/python-modules/mat2/default.nix
+++ b/pkgs/development/python-modules/mat2/default.nix
@@ -41,6 +41,16 @@ buildPythonPackage rec {
      url = "https://0xacab.org/jvoisin/mat2/-/commit/473903b70e1b269a6110242a9c098a10c18554e2.patch";
      hash = "sha256-vxxjAFwiTDlcTT3ZlfhOG4rlzBJS+LhLoA++8y2hEok=";
    })
+    (fetchpatch {
+      name = "fix-test-on-python313.patch";
+      url = "https://0xacab.org/jvoisin/mat2/-/commit/f07344444d6d2f04a1f93e2954f4910b194bee0c.patch";
+      hash = "sha256-y756sKkjGO11A2lrRsXAwWgupOZ00u0cDypvkbsiNbY=";
+    })
+    (fetchpatch {
+      name = "fix-test-on-python312.patch";
+      url = "https://0xacab.org/jvoisin/mat2/-/commit/7a8ea224bc327b8ee929379d577c74968ea1c352.patch";
+      hash = "sha256-pPiYhoql5WhjhLKvd6y3OnvxORSbXIGCsZMc7UH3i1Q=";
+    })
    # hardcode paths to some binaries
    (replaceVars ./paths.patch {
      exiftool = lib.getExe exiftool;
@@ -54,6 +64,11 @@ buildPythonPackage rec {
    ./executable-name.patch
    # hardcode path to mat2 executable
    ./tests.patch
+    (fetchpatch {
+      name = "fix-test_html.patch";
+      url = "https://github.com/jvoisin/mat2/commit/00b4f110711754496932c59d5af3c0b2ed694484.patch";
+      hash = "sha256-5h/nM1dK8HmYtoIBVGOvUegMFBpGxcfpn5O6QrjLi9M=";
+    })
  ]
  ++ lib.optionals (stdenv.hostPlatform.isLinux) [
    (replaceVars ./bubblewrap-path.patch {
--- a/pkgs/os-specific/linux/kernel/hardened/patches.json
+++ b/pkgs/os-specific/linux/kernel/hardened/patches.json
@@ -2,61 +2,61 @@
    "5.10": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-v5.10.245-hardened1.patch",
-            "sha256": "1yc5bq01nm7h2i8ygv0nnqsy7j31fhl5339al39nd28sffn073hf",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.10.245-hardened1/linux-hardened-v5.10.245-hardened1.patch"
+            "name": "linux-hardened-v5.10.246-hardened1.patch",
+            "sha256": "0jdxf6qknp922rp57czbb5vmj6gfwzmf6mjwng1c39gsa2ay1v61",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.10.246-hardened1/linux-hardened-v5.10.246-hardened1.patch"
        },
-        "sha256": "17wxs8i8vd5ivv99ra0sri3wmkw5c22wsaw8nf1xcvys2kmpa7hk",
-        "version": "5.10.245"
+        "sha256": "0xd8r8qqgxh3zhqkl4a5plmgsycxrffhpc9q2rwhkp6jd717cszb",
+        "version": "5.10.246"
    },
    "5.15": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-v5.15.194-hardened1.patch",
-            "sha256": "1r2iflsnvg9l9isn5n2d401jvm2pni75vc1g3vbirg55nqp7ykgs",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.15.194-hardened1/linux-hardened-v5.15.194-hardened1.patch"
+            "name": "linux-hardened-v5.15.196-hardened1.patch",
+            "sha256": "1k3bc2cdhxmpxl5gjdi69ww4qpxsidaqkiyzbaxb5qq0vf9s45c2",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.15.196-hardened1/linux-hardened-v5.15.196-hardened1.patch"
        },
-        "sha256": "0zi6ihvjmaf940arnc7jjvdqrjf3cvkc9mqc8n24dz85vam6z39l",
-        "version": "5.15.194"
+        "sha256": "018ffzi91xh46l7r3fgc4mpri3pxzl6wc1n946vny0lbb59pj5c3",
+        "version": "5.15.196"
    },
    "5.4": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-v5.4.300-hardened1.patch",
-            "sha256": "1k6ca8ifcqva6r4qrg403l5d0q9n9ph96vihyz75mzkq08w8kbvb",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.4.300-hardened1/linux-hardened-v5.4.300-hardened1.patch"
+            "name": "linux-hardened-v5.4.301-hardened1.patch",
+            "sha256": "0i3cjcbn91pla5g6d7mwp69p368n3rjbighrqx5ydalh2vhzbqhp",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v5.4.301-hardened1/linux-hardened-v5.4.301-hardened1.patch"
        },
-        "sha256": "0nl1l689d4jq2l39v816yy7z5lzc5dvv8aqn85xlv4najc022jcr",
-        "version": "5.4.300"
+        "sha256": "0qkra8ci2mx5p8ngdys2ixsl9s30qdqlq027pr5p3rk0s1k8fwdp",
+        "version": "5.4.301"
    },
    "6.1": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-v6.1.155-hardened1.patch",
-            "sha256": "0bihz31mic1j6wjfgzkm829d8k1y50p18v024px5yvg1gdkx86ww",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.1.155-hardened1/linux-hardened-v6.1.155-hardened1.patch"
+            "name": "linux-hardened-v6.1.158-hardened1.patch",
+            "sha256": "0pvq3sr1rn2fnfbvbskbqsvwf2xw8kk9a3i5578f931rhyyac2xc",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.1.158-hardened1/linux-hardened-v6.1.158-hardened1.patch"
        },
-        "sha256": "0wsw99h2jsrcx9fff59nqjx66l40vywj8qi3j6yvqpq8xsp8g4y2",
-        "version": "6.1.155"
+        "sha256": "1nmz4rknw82k9ylyrbm4g2m0hh4lmgkwi1g3gm7hzv04nvyqn1md",
+        "version": "6.1.158"
    },
    "6.12": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-v6.12.50-hardened1.patch",
-            "sha256": "0bzq364d6i7wis9sdljjkzmbvjnv45hmyqikmxagps2rdh57916p",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.12.50-hardened1/linux-hardened-v6.12.50-hardened1.patch"
+            "name": "linux-hardened-v6.12.56-hardened1.patch",
+            "sha256": "1s6z7ypkrvd0da5k8wjyidbsi33mgsrj7813nsblrfcs50f65wi4",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.12.56-hardened1/linux-hardened-v6.12.56-hardened1.patch"
        },
-        "sha256": "19bjzhxasj4r6m1lhsa486a96axfigbm06kqa2lwa7y2s5sbsdf4",
-        "version": "6.12.50"
+        "sha256": "15pclwn3nbwccdfwcqd3lkmdxwpjkmadhj63acqbzxsjycm2nhsm",
+        "version": "6.12.56"
    },
    "6.6": {
        "patch": {
            "extra": "-hardened1",
-            "name": "linux-hardened-v6.6.109-hardened1.patch",
-            "sha256": "1hjjacf2gm02wkilimn58ny2y0slazjy1vfm5rx6agjj2pg7nd9f",
-            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.6.109-hardened1/linux-hardened-v6.6.109-hardened1.patch"
+            "name": "linux-hardened-v6.6.115-hardened1.patch",
+            "sha256": "0xv7whb6fzqcdycdgx0yn02x3g3wvmdmsbbslxirn1y0122pc1ni",
+            "url": "https://github.com/anthraxx/linux-hardened/releases/download/v6.6.115-hardened1/linux-hardened-v6.6.115-hardened1.patch"
        },
-        "sha256": "1x1h2x04xvds8k59x36zqxzbj4cm6yl5l6xacgfyxzccfycwscbp",
-        "version": "6.6.109"
+        "sha256": "0iwhzlrqcw9hzr21gn0pmsjix0d022a7g38vszx4jsqgimgc160a",
+        "version": "6.6.115"
    }
 }
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -16,9 +16,9 @@ let
  variants = {
    # ./update-zen.py zen
    zen = {
-      version = "6.17.6"; # zen
+      version = "6.17.7"; # zen
      suffix = "zen1"; # zen
-      sha256 = "0kkrfmxj1q7il7njc1s8fnn459rcgviyy5q2kbynasrqij5kdciy"; # zen
+      sha256 = "01dh7cdqa4rx0fmr22yyn8d6qb8ns7v0x53k2ij3vrp9pz6p5cs4"; # zen
      isLqx = false;
    };
    # ./update-zen.py lqx