From fad51e608f49a203b947bca842cf958289006705 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 5 Oct 2025 00:32:49 +0200
Subject: [PATCH 01/28] limesurvey: use nix-update-script

---
 pkgs/by-name/li/limesurvey/package.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/limesurvey/package.nix b/pkgs/by-name/li/limesurvey/package.nix
index 5fad276e4eda..a56fc5bf834e 100644
--- a/pkgs/by-name/li/limesurvey/package.nix
+++ b/pkgs/by-name/li/limesurvey/package.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   writeText,
   nixosTests,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation rec {
@@ -33,8 +34,9 @@ stdenv.mkDerivation rec {
     runHook postInstall
   '';
 
-  passthru.tests = {
-    smoke-test = nixosTests.limesurvey;
+  passthru = {
+    tests = { inherit (nixosTests) limesurvey; };
+    updateScript = nix-update-script { };
   };
 
   meta = with lib; {

From 9d9f70b4e93e253445d62445fcfa2c4432662504 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 5 Oct 2025 00:37:40 +0200
Subject: [PATCH 02/28] nixos/limesurvey: deduplicate php references

---
 nixos/modules/services/web-apps/limesurvey.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/services/web-apps/limesurvey.nix b/nixos/modules/services/web-apps/limesurvey.nix
index cb1b1ed7d2ff..3015151ac625 100644
--- a/nixos/modules/services/web-apps/limesurvey.nix
+++ b/nixos/modules/services/web-apps/limesurvey.nix
@@ -27,6 +27,9 @@ let
   cfg = config.services.limesurvey;
   fpm = config.services.phpfpm.pools.limesurvey;
 
+  # https://github.com/LimeSurvey/LimeSurvey/blob/master/.github/workflows/main.yml
+  php = pkgs.php83;
+
   user = "limesurvey";
   group = config.services.httpd.group;
   stateDir = "/var/lib/limesurvey";
@@ -328,7 +331,7 @@ in
 
     services.phpfpm.pools.limesurvey = {
       inherit user group;
-      phpPackage = pkgs.php83;
+      phpPackage = php;
       phpEnv.DBENGINE = "${cfg.database.dbEngine}";
       phpEnv.LIMESURVEY_CONFIG = "${limesurveyConfig}";
       # App code cannot access credentials directly since the service starts
@@ -420,8 +423,8 @@ in
       environment.LIMESURVEY_CONFIG = limesurveyConfig;
       script = ''
         # update or install the database as required
-        ${pkgs.php83}/bin/php ${cfg.package}/share/limesurvey/application/commands/console.php updatedb || \
-        ${pkgs.php83}/bin/php ${cfg.package}/share/limesurvey/application/commands/console.php install admin password admin admin@example.com verbose
+        ${lib.getExe php} ${cfg.package}/share/limesurvey/application/commands/console.php updatedb || \
+        ${lib.getExe php} ${cfg.package}/share/limesurvey/application/commands/console.php install admin password admin admin@example.com verbose
       '';
       serviceConfig = {
         User = user;

From 4d28f658ba21fa7208a9ae31f3a754f4703a12df Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Sun, 5 Oct 2025 01:34:16 +0200
Subject: [PATCH 03/28] nixos/limesurvey: add nginx support

The majority of services in nixpkgs uses nginx, so for better coexistence
we add support for it. The option design follows that of mediawiki.

Co-Authored-By: Julien Malka <julien@malka.sh>
---
 .../manual/release-notes/rl-2511.section.md   |   2 +
 .../modules/services/web-apps/limesurvey.nix  | 450 ++++++++++--------
 nixos/tests/limesurvey.nix                    |  61 ++-
 3 files changed, 302 insertions(+), 211 deletions(-)

diff --git a/nixos/doc/manual/release-notes/rl-2511.section.md b/nixos/doc/manual/release-notes/rl-2511.section.md
index 4d3c6172e758..57021de3cce2 100644
--- a/nixos/doc/manual/release-notes/rl-2511.section.md
+++ b/nixos/doc/manual/release-notes/rl-2511.section.md
@@ -298,6 +298,8 @@
 
 - `services.dnscrypt-proxy` gains a `package` option to specify dnscrypt-proxy package to use.
 
+- `services.limesurvey` now supports nginx as reverse-proxy. Available through [services.limesurvey.webserver](#opt-services.limesurvey.webserver).
+
 - `services.nextcloud.configureRedis` now defaults to `true` in accordance with upstream recommendations to have caching for file locking. See the [upstream doc](https://docs.nextcloud.com/server/31/admin_manual/configuration_files/files_locking_transactional.html) for further details.
 
 - mate-wayland-session 1.28.4 is now using the default wayfire decorator instead of firedecor, thus `services.xserver.desktopManager.mate.enableWaylandSession` is no longer shipping firedecor. If you are experiencing broken window decorations after upgrade, backup and remove `~/.config/mate/wayfire.ini` and re-login.
diff --git a/nixos/modules/services/web-apps/limesurvey.nix b/nixos/modules/services/web-apps/limesurvey.nix
index 3015151ac625..8065efb7fcf8 100644
--- a/nixos/modules/services/web-apps/limesurvey.nix
+++ b/nixos/modules/services/web-apps/limesurvey.nix
@@ -8,6 +8,8 @@
 let
 
   inherit (lib)
+    literalExpression
+    mapAttrs
     mkDefault
     mkEnableOption
     mkForce
@@ -15,12 +17,10 @@ let
     mkMerge
     mkOption
     mkPackageOption
-    ;
-  inherit (lib)
-    literalExpression
-    mapAttrs
+    mkRenamedOptionModule
     optional
     optionalString
+    recursiveUpdate
     types
     ;
 
@@ -31,7 +31,7 @@ let
   php = pkgs.php83;
 
   user = "limesurvey";
-  group = config.services.httpd.group;
+  group = config.services.${cfg.webserver}.group;
   stateDir = "/var/lib/limesurvey";
 
   configType =
@@ -65,6 +65,13 @@ let
 
 in
 {
+  imports = [
+    (mkRenamedOptionModule
+      [ "services" "limesurvey" "virtualHost" ]
+      [ "services" "limesurvey" "httpd" "virtualHost" ]
+    )
+  ];
+
   # interface
 
   options.services.limesurvey = {
@@ -193,7 +200,19 @@ in
       };
     };
 
-    virtualHost = mkOption {
+    webserver = mkOption {
+      type = types.enum [
+        "httpd"
+        "nginx"
+      ];
+      default = "httpd";
+      example = "nginx";
+      description = ''
+        Webserver to configure for reverse-proxying limesurvey.
+      '';
+    };
+
+    httpd.virtualHost = mkOption {
       type = types.submodule (import ../web-servers/apache-httpd/vhost-options.nix);
       example = literalExpression ''
         {
@@ -209,6 +228,23 @@ in
       '';
     };
 
+    nginx.virtualHost = mkOption {
+      type = types.submodule (
+        recursiveUpdate (import ../web-servers/nginx/vhost-options.nix { inherit config lib; }) { }
+      );
+      example = literalExpression ''
+        {
+          serverName = "survey.example.org";
+          forceSSL = true;
+          enableACME = true;
+        }
+      '';
+      description = ''
+        Nginx configuration can be done by adapting `services.nginx.virtualHosts.<name>`.
+        See [](#opt-services.nginx.virtualHosts) for further information.
+      '';
+    };
+
     poolConfig = mkOption {
       type =
         with types;
@@ -244,192 +280,123 @@ in
 
   # implementation
 
-  config = mkIf cfg.enable {
-
-    assertions = [
-      {
-        assertion = cfg.database.createLocally -> cfg.database.type == "mysql";
-        message = "services.limesurvey.createLocally is currently only supported for database type 'mysql'";
-      }
-      {
-        assertion = cfg.database.createLocally -> cfg.database.user == user;
-        message = "services.limesurvey.database.user must be set to ${user} if services.limesurvey.database.createLocally is set true";
-      }
-      {
-        assertion = cfg.database.createLocally -> cfg.database.socket != null;
-        message = "services.limesurvey.database.socket must be set if services.limesurvey.database.createLocally is set to true";
-      }
-      {
-        assertion = cfg.database.createLocally -> cfg.database.passwordFile == null;
-        message = "a password cannot be specified if services.limesurvey.database.createLocally is set to true";
-      }
-      {
-        assertion = cfg.encryptionKey != null || cfg.encryptionKeyFile != null;
-        message = ''
-          You must set `services.limesurvey.encryptionKeyFile` to a file containing a 32-character uppercase hex string.
-
-          If this message appears when updating your system, please turn off encryption
-          in the LimeSurvey interface and create backups before filling the key.
-        '';
-      }
-      {
-        assertion = cfg.encryptionNonce != null || cfg.encryptionNonceFile != null;
-        message = ''
-          You must set `services.limesurvey.encryptionNonceFile` to a file containing a 24-character uppercase hex string.
-
-          If this message appears when updating your system, please turn off encryption
-          in the LimeSurvey interface and create backups before filling the nonce.
-        '';
-      }
-    ];
-
-    services.limesurvey.config = mapAttrs (name: mkDefault) {
-      runtimePath = "${stateDir}/tmp/runtime";
-      components = {
-        db = {
-          connectionString =
-            "${cfg.database.type}:dbname=${cfg.database.name};host=${
-              if pgsqlLocal then cfg.database.socket else cfg.database.host
-            };port=${toString cfg.database.port}"
-            + optionalString mysqlLocal ";socket=${cfg.database.socket}";
-          username = cfg.database.user;
-          password = mkIf (
-            cfg.database.passwordFile != null
-          ) "file_get_contents(\"${toString cfg.database.passwordFile}\");";
-          tablePrefix = "limesurvey_";
-        };
-        assetManager.basePath = "${stateDir}/tmp/assets";
-        urlManager = {
-          urlFormat = "path";
-          showScriptName = false;
-        };
-      };
-      config = {
-        tempdir = "${stateDir}/tmp";
-        uploaddir = "${stateDir}/upload";
-        userquestionthemerootdir = "${stateDir}/upload/themes/question";
-        force_ssl = mkIf (
-          cfg.virtualHost.addSSL || cfg.virtualHost.forceSSL || cfg.virtualHost.onlySSL
-        ) "on";
-        config.defaultlang = "en";
-      };
-    };
-
-    services.mysql = mkIf mysqlLocal {
-      enable = true;
-      package = mkDefault pkgs.mariadb;
-      ensureDatabases = [ cfg.database.name ];
-      ensureUsers = [
+  config = mkIf (cfg.enable) (mkMerge [
+    {
+      assertions = [
         {
-          name = cfg.database.user;
-          ensurePermissions = {
-            "${cfg.database.name}.*" = "SELECT, CREATE, INSERT, UPDATE, DELETE, ALTER, DROP, INDEX";
-          };
+          assertion = cfg.database.createLocally -> cfg.database.type == "mysql";
+          message = "services.limesurvey.createLocally is currently only supported for database type 'mysql'";
         }
-      ];
-    };
-
-    services.phpfpm.pools.limesurvey = {
-      inherit user group;
-      phpPackage = php;
-      phpEnv.DBENGINE = "${cfg.database.dbEngine}";
-      phpEnv.LIMESURVEY_CONFIG = "${limesurveyConfig}";
-      # App code cannot access credentials directly since the service starts
-      # with the root user so we copy the credentials to a place accessible to Limesurvey
-      phpEnv.CREDENTIALS_DIRECTORY = "${stateDir}/credentials";
-      settings = {
-        "listen.owner" = config.services.httpd.user;
-        "listen.group" = config.services.httpd.group;
-      }
-      // cfg.poolConfig;
-    };
-    systemd.services.phpfpm-limesurvey.serviceConfig = {
-      ExecStartPre = pkgs.writeShellScript "limesurvey-phpfpm-exec-pre" ''
-        cp -f "''${CREDENTIALS_DIRECTORY}"/encryption_key "${stateDir}/credentials/encryption_key"
-        chown ${user}:${group} "${stateDir}/credentials/encryption_key"
-        cp -f "''${CREDENTIALS_DIRECTORY}"/encryption_nonce "${stateDir}/credentials/encryption_nonce"
-        chown ${user}:${group} "${stateDir}/credentials/encryption_nonce"
-      '';
-      LoadCredential = [
-        "encryption_key:${
-          if cfg.encryptionKeyFile != null then
-            cfg.encryptionKeyFile
-          else
-            pkgs.writeText "key" cfg.encryptionKey
-        }"
-        "encryption_nonce:${
-          if cfg.encryptionNonceFile != null then
-            cfg.encryptionNonceFile
-          else
-            pkgs.writeText "nonce" cfg.encryptionKey
-        }"
-      ];
-    };
-
-    services.httpd = {
-      enable = true;
-      adminAddr = mkDefault cfg.virtualHost.adminAddr;
-      extraModules = [ "proxy_fcgi" ];
-      virtualHosts.${cfg.virtualHost.hostName} = mkMerge [
-        cfg.virtualHost
         {
-          documentRoot = mkForce "${cfg.package}/share/limesurvey";
-          extraConfig = ''
-            Alias "/tmp" "${stateDir}/tmp"
-            <Directory "${stateDir}">
-              AllowOverride all
-              Require all granted
-              Options -Indexes +FollowSymlinks
-            </Directory>
+          assertion = cfg.database.createLocally -> cfg.database.user == user;
+          message = "services.limesurvey.database.user must be set to ${user} if services.limesurvey.database.createLocally is set true";
+        }
+        {
+          assertion = cfg.database.createLocally -> cfg.database.socket != null;
+          message = "services.limesurvey.database.socket must be set if services.limesurvey.database.createLocally is set to true";
+        }
+        {
+          assertion = cfg.database.createLocally -> cfg.database.passwordFile == null;
+          message = "a password cannot be specified if services.limesurvey.database.createLocally is set to true";
+        }
+        {
+          assertion = cfg.encryptionKey != null || cfg.encryptionKeyFile != null;
+          message = ''
+            You must set `services.limesurvey.encryptionKeyFile` to a file containing a 32-character uppercase hex string.
 
-            Alias "/upload" "${stateDir}/upload"
-            <Directory "${stateDir}/upload">
-              AllowOverride all
-              Require all granted
-              Options -Indexes
-            </Directory>
+            If this message appears when updating your system, please turn off encryption
+            in the LimeSurvey interface and create backups before filling the key.
+          '';
+        }
+        {
+          assertion = cfg.encryptionNonce != null || cfg.encryptionNonceFile != null;
+          message = ''
+            You must set `services.limesurvey.encryptionNonceFile` to a file containing a 24-character uppercase hex string.
 
-            <Directory "${cfg.package}/share/limesurvey">
-              <FilesMatch "\.php$">
-                <If "-f %{REQUEST_FILENAME}">
-                  SetHandler "proxy:unix:${fpm.socket}|fcgi://localhost/"
-                </If>
-              </FilesMatch>
-
-              AllowOverride all
-              Options -Indexes
-              DirectoryIndex index.php
-            </Directory>
+            If this message appears when updating your system, please turn off encryption
+            in the LimeSurvey interface and create backups before filling the nonce.
           '';
         }
       ];
-    };
 
-    systemd.tmpfiles.rules = [
-      "d ${stateDir} 0750 ${user} ${group} - -"
-      "d ${stateDir}/tmp 0750 ${user} ${group} - -"
-      "d ${stateDir}/tmp/assets 0750 ${user} ${group} - -"
-      "d ${stateDir}/tmp/runtime 0750 ${user} ${group} - -"
-      "d ${stateDir}/tmp/upload 0750 ${user} ${group} - -"
-      "d ${stateDir}/credentials 0700 ${user} ${group} - -"
-      "C ${stateDir}/upload 0750 ${user} ${group} - ${cfg.package}/share/limesurvey/upload"
-    ];
+      users.users.${user} = {
+        group = group;
+        isSystemUser = true;
+      };
 
-    systemd.services.limesurvey-init = {
-      wantedBy = [ "multi-user.target" ];
-      before = [ "phpfpm-limesurvey.service" ];
-      after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.target";
-      environment.DBENGINE = "${cfg.database.dbEngine}";
-      environment.LIMESURVEY_CONFIG = limesurveyConfig;
-      script = ''
-        # update or install the database as required
-        ${lib.getExe php} ${cfg.package}/share/limesurvey/application/commands/console.php updatedb || \
-        ${lib.getExe php} ${cfg.package}/share/limesurvey/application/commands/console.php install admin password admin admin@example.com verbose
-      '';
-      serviceConfig = {
-        User = user;
-        Group = group;
-        Type = "oneshot";
+      systemd.services.limesurvey-init = {
+        wantedBy = [ "multi-user.target" ];
+        before = [ "phpfpm-limesurvey.service" ];
+        after = optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.target";
+        environment.DBENGINE = "${cfg.database.dbEngine}";
+        environment.LIMESURVEY_CONFIG = limesurveyConfig;
+        script = ''
+          # update or install the database as required
+          ${lib.getExe php} ${cfg.package}/share/limesurvey/application/commands/console.php updatedb || \
+          ${lib.getExe php} ${cfg.package}/share/limesurvey/application/commands/console.php install admin password admin admin@example.com verbose
+        '';
+        serviceConfig = {
+          User = user;
+          Group = group;
+          Type = "oneshot";
+          LoadCredential = [
+            "encryption_key:${
+              if cfg.encryptionKeyFile != null then
+                cfg.encryptionKeyFile
+              else
+                pkgs.writeText "key" cfg.encryptionKey
+            }"
+            "encryption_nonce:${
+              if cfg.encryptionNonceFile != null then
+                cfg.encryptionNonceFile
+              else
+                pkgs.writeText "nonce" cfg.encryptionKey
+            }"
+          ];
+        };
+      };
+
+      services.limesurvey.config = mapAttrs (name: mkDefault) {
+        runtimePath = "${stateDir}/tmp/runtime";
+        components = {
+          db = {
+            connectionString =
+              "${cfg.database.type}:dbname=${cfg.database.name};host=${
+                if pgsqlLocal then cfg.database.socket else cfg.database.host
+              };port=${toString cfg.database.port}"
+              + optionalString mysqlLocal ";socket=${cfg.database.socket}";
+            username = cfg.database.user;
+            password = mkIf (
+              cfg.database.passwordFile != null
+            ) "file_get_contents(\"${toString cfg.database.passwordFile}\");";
+            tablePrefix = "limesurvey_";
+          };
+          assetManager.basePath = "${stateDir}/tmp/assets";
+          urlManager = {
+            urlFormat = "path";
+            showScriptName = false;
+          };
+        };
+        config = {
+          tempdir = "${stateDir}/tmp";
+          uploaddir = "${stateDir}/upload";
+          userquestionthemerootdir = "${stateDir}/upload/themes/question";
+          force_ssl = mkIf (
+            cfg.${cfg.webserver}.virtualHost.addSSL
+            || cfg.${cfg.webserver}.virtualHost.forceSSL
+            || cfg.${cfg.webserver}.virtualHost.onlySSL
+          ) "on";
+          config.defaultlang = "en";
+        };
+      };
+
+      systemd.services.phpfpm-limesurvey.serviceConfig = {
+        ExecStartPre = pkgs.writeShellScript "limesurvey-phpfpm-exec-pre" ''
+          cp -f "''${CREDENTIALS_DIRECTORY}"/encryption_key "${stateDir}/credentials/encryption_key"
+          chown ${user}:${group} "${stateDir}/credentials/encryption_key"
+          cp -f "''${CREDENTIALS_DIRECTORY}"/encryption_nonce "${stateDir}/credentials/encryption_nonce"
+          chown ${user}:${group} "${stateDir}/credentials/encryption_nonce"
+        '';
         LoadCredential = [
           "encryption_key:${
             if cfg.encryptionKeyFile != null then
@@ -445,15 +412,118 @@ in
           }"
         ];
       };
-    };
 
-    systemd.services.httpd.after =
-      optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.target";
+      services.phpfpm.pools.limesurvey = {
+        inherit user group;
+        phpPackage = php;
+        phpEnv.DBENGINE = "${cfg.database.dbEngine}";
+        phpEnv.LIMESURVEY_CONFIG = "${limesurveyConfig}";
+        # App code cannot access credentials directly since the service starts
+        # with the root user so we copy the credentials to a place accessible to Limesurvey
+        phpEnv.CREDENTIALS_DIRECTORY = "${stateDir}/credentials";
+        settings = {
+          "listen.owner" = config.services.${cfg.webserver}.user;
+          "listen.group" = config.services.${cfg.webserver}.group;
+        }
+        // cfg.poolConfig;
+      };
 
-    users.users.${user} = {
-      group = group;
-      isSystemUser = true;
-    };
+      systemd.tmpfiles.rules = [
+        "d ${stateDir} 0750 ${user} ${group} - -"
+        "d ${stateDir}/tmp 0750 ${user} ${group} - -"
+        "d ${stateDir}/tmp/assets 0750 ${user} ${group} - -"
+        "d ${stateDir}/tmp/runtime 0750 ${user} ${group} - -"
+        "d ${stateDir}/tmp/upload 0750 ${user} ${group} - -"
+        "d ${stateDir}/credentials 0700 ${user} ${group} - -"
+        "C ${stateDir}/upload 0750 ${user} ${group} - ${cfg.package}/share/limesurvey/upload"
+      ];
+    }
 
-  };
+    (mkIf mysqlLocal {
+      services.mysql = {
+        enable = true;
+        package = mkDefault pkgs.mariadb;
+        ensureDatabases = [ cfg.database.name ];
+        ensureUsers = [
+          {
+            name = cfg.database.user;
+            ensurePermissions = {
+              "${cfg.database.name}.*" = "SELECT, CREATE, INSERT, UPDATE, DELETE, ALTER, DROP, INDEX";
+            };
+          }
+        ];
+      };
+    })
+
+    (mkIf (cfg.webserver == "httpd") {
+      services.httpd = {
+        enable = true;
+        adminAddr = mkDefault cfg.httpd.virtualHost.adminAddr;
+        extraModules = [ "proxy_fcgi" ];
+        virtualHosts.${cfg.httpd.virtualHost.hostName} = mkMerge [
+          cfg.httpd.virtualHost
+          {
+            documentRoot = mkForce "${cfg.package}/share/limesurvey";
+            extraConfig = ''
+              Alias "/tmp" "${stateDir}/tmp"
+              <Directory "${stateDir}">
+                AllowOverride all
+                Require all granted
+                Options -Indexes +FollowSymlinks
+              </Directory>
+
+              Alias "/upload" "${stateDir}/upload"
+              <Directory "${stateDir}/upload">
+                AllowOverride all
+                Require all granted
+                Options -Indexes
+              </Directory>
+
+              <Directory "${cfg.package}/share/limesurvey">
+                <FilesMatch "\.php$">
+                  <If "-f %{REQUEST_FILENAME}">
+                    SetHandler "proxy:unix:${fpm.socket}|fcgi://localhost/"
+                  </If>
+                </FilesMatch>
+
+                AllowOverride all
+                Options -Indexes
+                DirectoryIndex index.php
+              </Directory>
+            '';
+          }
+        ];
+      };
+      systemd.services.httpd.after =
+        optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.target";
+    })
+
+    (mkIf (cfg.webserver == "nginx") {
+      services.nginx = {
+        enable = true;
+        virtualHosts.${cfg.nginx.virtualHost.serverName} = lib.mkMerge [
+          cfg.nginx.virtualHost
+          {
+            root = lib.mkForce "${cfg.package}/share/limesurvey";
+            locations = {
+              "/" = {
+                index = "index.php";
+                tryFiles = "$uri /index.php?$args";
+              };
+
+              "~ \.php$".extraConfig = ''
+                fastcgi_pass unix:${config.services.phpfpm.pools."limesurvey".socket};
+              '';
+              "/tmp".root = "/var/lib/limesurvey";
+              "/upload/".root = "/var/lib/limesurvey";
+
+            };
+          }
+        ];
+      };
+
+      systemd.services.nginx.after =
+        optional mysqlLocal "mysql.service" ++ optional pgsqlLocal "postgresql.service";
+    })
+  ]);
 }
diff --git a/nixos/tests/limesurvey.nix b/nixos/tests/limesurvey.nix
index 9f90b4d16820..3e24040c9903 100644
--- a/nixos/tests/limesurvey.nix
+++ b/nixos/tests/limesurvey.nix
@@ -1,31 +1,50 @@
 { lib, pkgs, ... }:
+
 {
   name = "limesurvey";
   meta.maintainers = [ lib.maintainers.aanderse ];
 
-  nodes.machine =
-    { ... }:
-    {
-      services.limesurvey = {
-        enable = true;
-        virtualHost = {
-          hostName = "example.local";
-          adminAddr = "root@example.local";
-        };
-        encryptionKeyFile = pkgs.writeText "key" (lib.strings.replicate 32 "0");
-        encryptionNonceFile = pkgs.writeText "nonce" (lib.strings.replicate 24 "0");
+  nodes.machine = {
+    services.limesurvey = {
+      enable = true;
+      httpd.virtualHost = {
+        hostName = "example.local";
+        adminAddr = "root@example.local";
       };
-
-      # limesurvey won't work without a dot in the hostname
-      networking.hosts."127.0.0.1" = [ "example.local" ];
+      encryptionKeyFile = pkgs.writeText "key" (lib.strings.replicate 32 "0");
+      encryptionNonceFile = pkgs.writeText "nonce" (lib.strings.replicate 24 "0");
     };
 
-  testScript = ''
-    start_all()
+    # limesurvey won't work without a dot in the hostname
+    networking.hosts."127.0.0.1" = [ "example.local" ];
 
-    machine.wait_for_unit("phpfpm-limesurvey.service")
-    assert "The following surveys are available" in machine.succeed(
-        "curl -f http://example.local/"
-    )
-  '';
+    specialisation.nginx = {
+      inheritParentConfig = true;
+      configuration.services.limesurvey = {
+        webserver = "nginx";
+        nginx.virtualHost.serverName = "example.local";
+      };
+    };
+  };
+
+  testScript =
+    { nodes, ... }:
+    ''
+      def test():
+        machine.wait_until_succeeds("curl --fail --silent http://example.local/ | grep -q 'The following surveys are available'")
+
+      start_all()
+
+      machine.wait_for_unit("phpfpm-limesurvey.service")
+      machine.wait_for_unit("httpd.service")
+      machine.wait_for_open_port(80)
+      test()
+
+      machine.execute("${nodes.machine.system.build.toplevel}/specialisation/nginx/bin/switch-to-configuration test")
+
+      machine.wait_for_unit("nginx.service")
+      test()
+
+
+    '';
 }

From 858b9901ff6dbe9b5ab36f8ee0517dab4a69f5d1 Mon Sep 17 00:00:00 2001
From: Arsenii Zorin <me@wrb.bz>
Date: Wed, 8 Oct 2025 15:30:31 +0300
Subject: [PATCH 04/28] mark: 14.1.1 -> 15.0.0

---
 pkgs/by-name/ma/mark/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ma/mark/package.nix b/pkgs/by-name/ma/mark/package.nix
index c71ff3bda690..3ed2f30bf763 100644
--- a/pkgs/by-name/ma/mark/package.nix
+++ b/pkgs/by-name/ma/mark/package.nix
@@ -8,16 +8,16 @@
 # https://github.com/kovetskiy/mark/pull/581#issuecomment-2797872996
 buildGoModule rec {
   pname = "mark";
-  version = "14.1.1";
+  version = "15.0.0";
 
   src = fetchFromGitHub {
     owner = "kovetskiy";
     repo = "mark";
-    rev = "${version}";
-    sha256 = "sha256-jKc5QugqfdjSQjK7SbLG02a9+YdFcweS+91LhdR0Dzg=";
+    rev = "v${version}";
+    sha256 = "sha256-OYLL96xvyrsnfIc0h+kQhZeW1ImyO7IG2ybD2SMBn/U=";
   };
 
-  vendorHash = "sha256-AHtIVp2n5v4YoYfWAsE7eD1QcEFKdjSqzGIlR7+mnxg=";
+  vendorHash = "sha256-y7MDgCYOvrFF4IMy8zpWXqyaOel1Xjei7h2OkiE6r+g=";
 
   ldflags = [
     "-s"

From 30340b5c2f33eededf538b5bb26c2db79ffd6bc5 Mon Sep 17 00:00:00 2001
From: Thomas Gerbet <thomas@gerbet.me>
Date: Sun, 12 Oct 2025 23:42:18 +0200
Subject: [PATCH 05/28] redict: 7.3.2 -> 7.3.6

Fixes CVE-2025-49844, CVE-2025-46817, CVE-2025-46818, CVE-2025-46819,
CVE-2025-32023, CVE-2025-48367 and CVE-2025-21605.

Announcements:
https://redict.io/posts/2025-05-05-redict-7.3.3-released/
https://redict.io/posts/2025-07-11-redict-7.3.4-release/
https://redict.io/posts/2025-07-14-redict-7.3.5-release/
https://redict.io/posts/2025-10-08-redict-7.3.6-release/
---
 pkgs/by-name/re/redict/package.nix | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/re/redict/package.nix b/pkgs/by-name/re/redict/package.nix
index eacfc8278357..544a7edd7952 100644
--- a/pkgs/by-name/re/redict/package.nix
+++ b/pkgs/by-name/re/redict/package.nix
@@ -24,14 +24,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "redict";
-  version = "7.3.2";
+  version = "7.3.6";
 
   src = fetchFromGitea {
     domain = "codeberg.org";
     owner = "redict";
     repo = "redict";
-    rev = finalAttrs.version;
-    hash = "sha256-MY4OWoYQ4a5efqcUTN6lNL/kd1VrJ/OBqKw27cQ5WC8=";
+    tag = finalAttrs.version;
+    hash = "sha256-ye2uO6EQzfyonRvM0/+pVPoNZe2f9WO/2yafy52G10M=";
   };
 
   patches = lib.optionals useSystemJemalloc [
@@ -101,7 +101,8 @@ stdenv.mkDerivation (finalAttrs: {
       --timeout 2000 \
       --clients $NIX_BUILD_CORES \
       --tags -leaks \
-      --skipunit integration/failover # flaky and slow
+      --skipunit integration/failover \
+      --skipunit integration/aof-multi-part
 
     runHook postCheck
   '';

From 078f95bb584a53472d49b520b9f555e9ebd741a9 Mon Sep 17 00:00:00 2001
From: 06kellyjac <dev@j-k.io>
Date: Mon, 22 Sep 2025 12:43:38 +0100
Subject: [PATCH 06/28] llama-swap: 156 -> 165

Diff: https://github.com/mostlygeek/llama-swap/compare/v156...v165

Changelog: https://github.com/mostlygeek/llama-swap/releases/tag/v165
---
 pkgs/by-name/ll/llama-swap/package.nix | 32 +++++++++++++++++++++++---
 1 file changed, 29 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ll/llama-swap/package.nix b/pkgs/by-name/ll/llama-swap/package.nix
index 8361419894df..18f8c1ea75dd 100644
--- a/pkgs/by-name/ll/llama-swap/package.nix
+++ b/pkgs/by-name/ll/llama-swap/package.nix
@@ -16,13 +16,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "llama-swap";
-  version = "156";
+  version = "165";
 
   src = fetchFromGitHub {
     owner = "mostlygeek";
     repo = "llama-swap";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-z0262afVjsdGe6WPoWO1wbccLO538fXBuxOOqLnJHRU=";
+    hash = "sha256-3NlA4LnAJ1qCy1+Jcv6wrPg/7trQhpwx00Sk98V7ZdY=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -38,12 +38,15 @@ buildGoModule (finalAttrs: {
   vendorHash = "sha256-5mmciFAGe8ZEIQvXejhYN+ocJL3wOVwevIieDuokhGU=";
 
   passthru.ui = callPackage ./ui.nix { llama-swap = finalAttrs.finalPackage; };
-  passthru.npmDepsHash = "sha256-Sbvz3oudMVf+PxOJ6s7LsDaxFwvftNc8ZW5KPpbI/cA=";
+  passthru.npmDepsHash = "sha256-F6izMZY4554M6PqPYjKcjNol3A6BZHHYA0CIcNrU5JA=";
 
   nativeBuildInputs = [
     versionCheckHook
   ];
 
+  # required for testing
+  __darwinAllowLocalNetworking = true;
+
   ldflags = [
     "-s"
     "-w"
@@ -71,6 +74,29 @@ buildGoModule (finalAttrs: {
     "misc/simple-responder"
   ];
 
+  checkFlags =
+    let
+      skippedTests = lib.optionals (stdenv.isDarwin && stdenv.isx86_64) [
+        # Fail only on x86_64-darwin intermittently
+        # https://github.com/mostlygeek/llama-swap/issues/320
+        "TestProcess_AutomaticallyStartsUpstream"
+        "TestProcess_WaitOnMultipleStarts"
+        "TestProcess_BrokenModelConfig"
+        "TestProcess_UnloadAfterTTL"
+        "TestProcess_LowTTLValue"
+        "TestProcess_HTTPRequestsHaveTimeToFinish"
+        "TestProcess_SwapState"
+        "TestProcess_ShutdownInterruptsHealthCheck"
+        "TestProcess_ExitInterruptsHealthCheck"
+        "TestProcess_ConcurrencyLimit"
+        "TestProcess_StopImmediately"
+        "TestProcess_ForceStopWithKill"
+        "TestProcess_StopCmd"
+        "TestProcess_EnvironmentSetCorrectly"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
+
   # some tests expect to execute `simple-something` and proxy/helpers_test.go
   # checks the file exists
   doCheck = canExecute;

From 0bfe070dcf3a8fbc646fda1b2e52f5c4890d8fea Mon Sep 17 00:00:00 2001
From: jopejoe1 <jopejoe1@missing.ninja>
Date: Mon, 13 Oct 2025 20:06:19 +0000
Subject: [PATCH 07/28] alistral: 0.5.14 -> 0.6.0

---
 pkgs/by-name/al/alistral/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/al/alistral/package.nix b/pkgs/by-name/al/alistral/package.nix
index 30f1aa77e88b..613c2fced83e 100644
--- a/pkgs/by-name/al/alistral/package.nix
+++ b/pkgs/by-name/al/alistral/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "alistral";
-  version = "0.5.14";
+  version = "0.6.0";
 
   src = fetchFromGitHub {
     owner = "RustyNova016";
     repo = "Alistral";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PffZx2rkOdwwhZ4LYE6ZiAWa68oZT3Gly6Is9gRPWdw=";
+    hash = "sha256-IJ12v/mmrs6jW6jWPHEjtS74lSLWSIvJejQz4BTFbEQ=";
   };
 
-  cargoHash = "sha256-FfTySXynezMs/Nkuai+jZCSJnIo5D3obh3LboYYGhVk=";
+  cargoHash = "sha256-x695jOKR/s5J/51LUqPlNMgGzsoq8D8KR9gLjyLPfkA=";
 
   buildNoDefaultFeatures = true;
   # Would be cleaner with an "--all-features" option

From 27d384a5ee33b71d97e3f39cece5e6a7b7b6b5a9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Mon, 13 Oct 2025 22:05:53 -0700
Subject: [PATCH 08/28] python3Packages.zulip: 0.9.0 -> 0.9.1

Diff: https://github.com/zulip/python-zulip-api/compare/0.9.0...0.9.1
---
 .../python-modules/zulip/default.nix          | 21 +++++++------------
 1 file changed, 8 insertions(+), 13 deletions(-)

diff --git a/pkgs/development/python-modules/zulip/default.nix b/pkgs/development/python-modules/zulip/default.nix
index 54cd375944b8..358a8b9daeb1 100644
--- a/pkgs/development/python-modules/zulip/default.nix
+++ b/pkgs/development/python-modules/zulip/default.nix
@@ -1,7 +1,6 @@
 {
   lib,
   buildPythonPackage,
-  pythonOlder,
   fetchFromGitHub,
   setuptools,
   requests,
@@ -14,24 +13,20 @@
 
 buildPythonPackage rec {
   pname = "zulip";
-  version = "0.9.0";
-
-  disabled = pythonOlder "3.8";
-
+  version = "0.9.1";
   pyproject = true;
 
-  # no sdist on PyPI
   src = fetchFromGitHub {
     owner = "zulip";
     repo = "python-zulip-api";
-    rev = version;
-    hash = "sha256-YnNXduZ2KOjRHGwhojkqpMP2mwhflk8/f4FVZL8NvHU=";
+    tag = version;
+    hash = "sha256-mcqIfha+4nsqlshayLQ2Sd+XOYVKf1FkoczjiFRNybc=";
   };
   sourceRoot = "${src.name}/zulip";
 
-  nativeBuildInputs = [ setuptools ];
+  build-system = [ setuptools ];
 
-  propagatedBuildInputs = [
+  dependencies = [
     requests
     distro
     click
@@ -46,10 +41,10 @@ buildPythonPackage rec {
 
   pythonImportsCheck = [ "zulip" ];
 
-  meta = with lib; {
+  meta = {
     description = "Bindings for the Zulip message API";
     homepage = "https://github.com/zulip/python-zulip-api";
-    license = licenses.asl20;
-    maintainers = with maintainers; [ dotlambda ];
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ dotlambda ];
   };
 }

From 68aeba31146eee45a75a027bfa1fe7776673ccec Mon Sep 17 00:00:00 2001
From: Paul Meyer <katexochen0@gmail.com>
Date: Tue, 14 Oct 2025 10:47:36 +0200
Subject: [PATCH 09/28] envoy-bin: 1.35.3 -> 1.35.4

https://github.com/envoyproxy/envoy/releases/tag/v1.35.4

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
---
 pkgs/by-name/en/envoy-bin/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/en/envoy-bin/package.nix b/pkgs/by-name/en/envoy-bin/package.nix
index 641c61bd5f21..f447be7d017d 100644
--- a/pkgs/by-name/en/envoy-bin/package.nix
+++ b/pkgs/by-name/en/envoy-bin/package.nix
@@ -8,7 +8,7 @@
   versionCheckHook,
 }:
 let
-  version = "1.35.3";
+  version = "1.35.4";
   inherit (stdenv.hostPlatform) system;
   throwSystem = throw "envoy-bin is not available for ${system}.";
 
@@ -21,8 +21,8 @@ let
 
   hash =
     {
-      aarch64-linux = "sha256-NN5VDwIYLTHSYpVljAQQOdRjQavNGn5BLmpOK+Azg18=";
-      x86_64-linux = "sha256-JBwXAvDtHA26MTOauqtCKQakKVzJJkD1uDLBMe44V2c=";
+      aarch64-linux = "sha256-iTZilcY0Tc6xjMCSOEdwyzyJeRhd+5A4WIhq89817bc=";
+      x86_64-linux = "sha256-hBy2DmJlTADt9E3V81CKlFXkM17q52gN5Eq/l4F+qcw=";
     }
     .${system} or throwSystem;
 in

From 9e9dd22825f2c5058ed52889488563f3615bf49f Mon Sep 17 00:00:00 2001
From: "Braian A. Diez" <bdiez19@gmail.com>
Date: Tue, 14 Oct 2025 15:05:56 -0300
Subject: [PATCH 10/28] evil-winrm: add support for ssl legacy provider

---
 pkgs/by-name/ev/evil-winrm/package.nix | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/pkgs/by-name/ev/evil-winrm/package.nix b/pkgs/by-name/ev/evil-winrm/package.nix
index 681f38d8bae7..aa0c97c89253 100644
--- a/pkgs/by-name/ev/evil-winrm/package.nix
+++ b/pkgs/by-name/ev/evil-winrm/package.nix
@@ -5,6 +5,8 @@
   makeWrapper,
   bundlerEnv,
   bundlerUpdateScript,
+  writeText,
+  sslLegacyProvider ? false,
 }:
 let
   rubyEnv = bundlerEnv {
@@ -13,6 +15,22 @@ let
     lockfile = ./Gemfile.lock;
     gemset = ./gemset.nix;
   };
+  openssl_conf = writeText "openssl.conf" ''
+    openssl_conf = openssl_init
+
+    [openssl_init]
+    providers = provider_sect
+
+    [provider_sect]
+    default = default_sect
+    legacy = legacy_sect
+
+    [default_sect]
+    activate = 1
+
+    [legacy_sect]
+    activate = 1
+  '';
 in
 stdenv.mkDerivation rec {
   pname = "evil-winrm";
@@ -38,6 +56,10 @@ stdenv.mkDerivation rec {
     cp evil-winrm.rb $out/bin/evil-winrm
   '';
 
+  postFixup = lib.optionalString sslLegacyProvider ''
+    wrapProgram $out/bin/evil-winrm --prefix OPENSSL_CONF : "${openssl_conf}"
+  '';
+
   passthru.updateScript = bundlerUpdateScript "evil-winrm";
 
   meta = {

From 36c4abcd839dad2268785a541d6399c3273448e0 Mon Sep 17 00:00:00 2001
From: Weijia Wang <9713184+wegank@users.noreply.github.com>
Date: Mon, 21 Jul 2025 21:06:35 +0200
Subject: [PATCH 11/28] ocaml-ng: drop ocaml <=4.08

---
 pkgs/development/compilers/ocaml/4.00.1.nix   | 99 -------------------
 pkgs/development/compilers/ocaml/4.01.0.nix   | 21 ----
 pkgs/development/compilers/ocaml/4.02.nix     | 26 -----
 pkgs/development/compilers/ocaml/4.03.nix     | 25 -----
 pkgs/development/compilers/ocaml/4.04.nix     | 28 ------
 pkgs/development/compilers/ocaml/4.05.nix     | 28 ------
 pkgs/development/compilers/ocaml/4.06.nix     | 23 -----
 pkgs/development/compilers/ocaml/4.07.nix     | 23 -----
 pkgs/development/compilers/ocaml/4.08.nix     | 26 -----
 .../ocaml/fix-clang-build-on-osx.diff         | 20 ----
 .../compilers/ocaml/ocamlbuild.patch          | 45 ---------
 pkgs/top-level/ocaml-packages.nix             | 69 ++++---------
 12 files changed, 19 insertions(+), 414 deletions(-)
 delete mode 100644 pkgs/development/compilers/ocaml/4.00.1.nix
 delete mode 100644 pkgs/development/compilers/ocaml/4.01.0.nix
 delete mode 100644 pkgs/development/compilers/ocaml/4.02.nix
 delete mode 100644 pkgs/development/compilers/ocaml/4.03.nix
 delete mode 100644 pkgs/development/compilers/ocaml/4.04.nix
 delete mode 100644 pkgs/development/compilers/ocaml/4.05.nix
 delete mode 100644 pkgs/development/compilers/ocaml/4.06.nix
 delete mode 100644 pkgs/development/compilers/ocaml/4.07.nix
 delete mode 100644 pkgs/development/compilers/ocaml/4.08.nix
 delete mode 100644 pkgs/development/compilers/ocaml/fix-clang-build-on-osx.diff
 delete mode 100644 pkgs/development/compilers/ocaml/ocamlbuild.patch

diff --git a/pkgs/development/compilers/ocaml/4.00.1.nix b/pkgs/development/compilers/ocaml/4.00.1.nix
deleted file mode 100644
index e6b80294592f..000000000000
--- a/pkgs/development/compilers/ocaml/4.00.1.nix
+++ /dev/null
@@ -1,99 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchurl,
-  fetchpatch,
-  ncurses,
-  libX11,
-}:
-
-let
-  useX11 = !stdenv.hostPlatform.isAarch32 && !stdenv.hostPlatform.isMips;
-  useNativeCompilers = !stdenv.hostPlatform.isMips;
-  inherit (lib) optional optionals optionalString;
-in
-
-stdenv.mkDerivation rec {
-  pname = "ocaml";
-  version = "4.00.1";
-
-  src = fetchurl {
-    url = "https://caml.inria.fr/pub/distrib/ocaml-4.00/${pname}-${version}.tar.bz2";
-    sha256 = "33c3f4acff51685f5bfd7c260f066645e767d4e865877bf1613c176a77799951";
-  };
-
-  # Compatibility with Glibc 2.34
-  patches = [
-    (fetchpatch {
-      url = "https://github.com/ocaml/ocaml/commit/60b0cdaf2519d881947af4175ac4c6ff68901be3.patch";
-      sha256 = "sha256:07g9q9sjk4xsbqix7jxggfp36v15pmqw4bms80g5car0hfbszirn";
-    })
-  ];
-
-  # Workaround build failure on -fno-common toolchains like upstream
-  # gcc-10. Otherwise build fails as:
-  #   ld: libcamlrun.a(startup.o):(.bss+0x800): multiple definition of
-  #     `caml_code_fragments_table'; libcamlrun.a(backtrace.o):(.bss+0x20): first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
-
-  prefixKey = "-prefix ";
-  configureFlags = [
-    "-no-tk"
-  ]
-  ++ optionals useX11 [
-    "-x11lib"
-    libX11
-  ];
-  buildFlags = [
-    "world"
-  ]
-  ++ optionals useNativeCompilers [
-    "bootstrap"
-    "world.opt"
-  ];
-  buildInputs = [ ncurses ] ++ optionals useX11 [ libX11 ];
-  installTargets = "install" + optionalString useNativeCompilers " installopt";
-  preConfigure = ''
-    CAT=$(type -tp cat)
-    sed -e "s@/bin/cat@$CAT@" -i config/auto-aux/sharpbang
-  '';
-  postBuild = ''
-    mkdir -p $out/include
-    ln -sv $out/lib/ocaml/caml $out/include/caml
-  '';
-
-  passthru = {
-    nativeCompilers = useNativeCompilers;
-  };
-
-  meta = with lib; {
-    homepage = "http://caml.inria.fr/ocaml";
-    branch = "4.00";
-    license = with licenses; [
-      qpl # compiler
-      lgpl2 # library
-    ];
-    description = "Most popular variant of the Caml language";
-
-    longDescription = ''
-      OCaml is the most popular variant of the Caml language.  From a
-      language standpoint, it extends the core Caml language with a
-      fully-fledged object-oriented layer, as well as a powerful module
-      system, all connected by a sound, polymorphic type system featuring
-      type inference.
-
-      The OCaml system is an industrial-strength implementation of this
-      language, featuring a high-performance native-code compiler (ocamlopt)
-      for 9 processor architectures (IA32, PowerPC, AMD64, Alpha, Sparc,
-      Mips, IA64, HPPA, StrongArm), as well as a bytecode compiler (ocamlc)
-      and an interactive read-eval-print loop (ocaml) for quick development
-      and portability.  The OCaml distribution includes a comprehensive
-      standard library, a replay debugger (ocamldebug), lexer (ocamllex) and
-      parser (ocamlyacc) generators, a pre-processor pretty-printer (camlp4)
-      and a documentation generator (ocamldoc).
-    '';
-
-    platforms = with platforms; linux;
-  };
-
-}
diff --git a/pkgs/development/compilers/ocaml/4.01.0.nix b/pkgs/development/compilers/ocaml/4.01.0.nix
deleted file mode 100644
index 55347bb3a20e..000000000000
--- a/pkgs/development/compilers/ocaml/4.01.0.nix
+++ /dev/null
@@ -1,21 +0,0 @@
-import ./generic.nix {
-  major_version = "4";
-  minor_version = "01";
-  patch_version = "0";
-  patches = [
-    ./fix-clang-build-on-osx.diff
-
-    # Compatibility with Glibc 2.34
-    {
-      url = "https://github.com/ocaml/ocaml/commit/d111407bf4ff71171598d30825c8e59ed5f75fd6.patch";
-      sha256 = "sha256:08mpy7lsiwv8m5qrqc4xzyiv2hri5713gz2qs1nfz02hz1bd79mc";
-    }
-  ];
-  sha256 = "03d7ida94s1gpr3gadf4jyhmh5rrszd5s4m4z59daaib25rvfyv7";
-
-  # Workaround build failure on -fno-common toolchains like upstream
-  # gcc-10. Otherwise build fails as:
-  #   ld: libcamlrun.a(startup.o):(.bss+0x800): multiple definition of
-  #     `caml_code_fragments_table'; libcamlrun.a(backtrace.o):(.bss+0x20): first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
-}
diff --git a/pkgs/development/compilers/ocaml/4.02.nix b/pkgs/development/compilers/ocaml/4.02.nix
deleted file mode 100644
index 0d54d0aaae96..000000000000
--- a/pkgs/development/compilers/ocaml/4.02.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-import ./generic.nix {
-  major_version = "4";
-  minor_version = "02";
-  patch_version = "3";
-  patches = [
-    ./ocamlbuild.patch
-
-    # Compatibility with Glibc 2.34
-    {
-      url = "https://github.com/ocaml/ocaml/commit/9de2b77472aee18a94b41cff70caee27fb901225.patch";
-      sha256 = "sha256:12sw512kpwk0xf2g6j0h5vqgd8xcmgrvgyilx6fxbd6bnfv1yib9";
-    }
-    # Compatibility with Binutils 2.29
-    {
-      url = "https://github.com/ocaml/ocaml/commit/bcc7a767279ff70518b3f4219cc0b9bffec7dd43.patch";
-      sha256 = "sha256-z3xrqN6bh/EW9dkPg6Hz8mT79DFm26yGRoPbE+RMYi0=";
-    }
-  ];
-  sha256 = "1qwwvy8nzd87hk8rd9sm667nppakiapnx4ypdwcrlnav2dz6kil3";
-
-  # Workaround build failure on -fno-common toolchains like upstream
-  # gcc-10. Otherwise build fails as:
-  #   ld: libcamlrun.a(startup.o):(.bss+0x800): multiple definition of
-  #     `caml_code_fragments_table'; libcamlrun.a(backtrace.o):(.bss+0x20): first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
-}
diff --git a/pkgs/development/compilers/ocaml/4.03.nix b/pkgs/development/compilers/ocaml/4.03.nix
deleted file mode 100644
index 58dec68b892d..000000000000
--- a/pkgs/development/compilers/ocaml/4.03.nix
+++ /dev/null
@@ -1,25 +0,0 @@
-import ./generic.nix {
-  major_version = "4";
-  minor_version = "03";
-  patch_version = "0";
-  sha256 = "09p3iwwi55r6rbrpyp8f0wmkb0ppcgw67yxw6yfky60524wayp39";
-
-  patches = [
-    # Compatibility with Glibc 2.34
-    {
-      url = "https://github.com/ocaml/ocaml/commit/a8b2cc3b40f5269ce8525164ec2a63b35722b22b.patch";
-      sha256 = "sha256:1rrknmrk86xrj2k3hznnjk1gwnliyqh125zabg1hvy6dlvml9b0x";
-    }
-    # Compatibility with Binutils 2.29
-    {
-      url = "https://github.com/ocaml/ocaml/commit/c204f07bfb20174f9e1c9ff586fb7b2f42b8bf18.patch";
-      sha256 = "sha256-AAXyMZ7ujO67SGz+tGXKZkVcINAwvccHlFHmKnUt848=";
-    }
-  ];
-
-  # Workaround build failure on -fno-common toolchains like upstream
-  # gcc-10. Otherwise build fails as:
-  #   ld: libcamlrun.a(startup.o):(.bss+0x800): multiple definition of
-  #     `caml_code_fragments_table'; libcamlrun.a(backtrace.o):(.bss+0x20): first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
-}
diff --git a/pkgs/development/compilers/ocaml/4.04.nix b/pkgs/development/compilers/ocaml/4.04.nix
deleted file mode 100644
index 030d7c36c6f4..000000000000
--- a/pkgs/development/compilers/ocaml/4.04.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-import ./generic.nix {
-  major_version = "4";
-  minor_version = "04";
-  patch_version = "2";
-  sha256 = "0bhgjzi78l10824qga85nlh18jg9lb6aiamf9dah1cs6jhzfsn6i";
-
-  # If the executable is stripped it does not work
-  dontStrip = true;
-
-  patches = [
-    # Compatibility with Glibc 2.34
-    {
-      url = "https://github.com/ocaml/ocaml/commit/6bcff7e6ce1a43e088469278eb3a9341e6a2ca5b.patch";
-      sha256 = "sha256:1hd45f7mwwrrym2y4dbcwklpv0g94avbz7qrn81l7w8mrrj3bngi";
-    }
-    # Compatibility with Binutils 2.29
-    {
-      url = "https://github.com/ocaml/ocaml/commit/db11f141a0e35c7fbaec419a33c4c39d199e2635.patch";
-      sha256 = "sha256-oIwmbXOCzDGyASpbQ7hd7SCs4YHjd9hBBksJ74V3GiY=";
-    }
-  ];
-
-  # Workaround build failure on -fno-common toolchains like upstream
-  # gcc-10. Otherwise build fails as:
-  #   ld: libcamlrun.a(startup.o):(.bss+0x800): multiple definition of
-  #     `caml_code_fragments_table'; libcamlrun.a(backtrace.o):(.bss+0x20): first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
-}
diff --git a/pkgs/development/compilers/ocaml/4.05.nix b/pkgs/development/compilers/ocaml/4.05.nix
deleted file mode 100644
index 7a6aef47d22c..000000000000
--- a/pkgs/development/compilers/ocaml/4.05.nix
+++ /dev/null
@@ -1,28 +0,0 @@
-import ./generic.nix {
-  major_version = "4";
-  minor_version = "05";
-  patch_version = "0";
-  sha256 = "1y9fw1ci9pwnbbrr9nwr8cq8vypcxwdf4akvxard3mxl2jx2g984";
-
-  # If the executable is stipped it does not work
-  dontStrip = true;
-
-  patches = [
-    # Compatibility with Glibc 2.34
-    {
-      url = "https://github.com/ocaml/ocaml/commit/50c2d1275e537906ea144bd557fde31e0bf16e5f.patch";
-      sha256 = "sha256:0ck9b2dpgg5k2p9ndbgniql24h35pn1bbpxjvk69j715lswzy4mh";
-    }
-    # Compatibility with Binutils 2.29
-    {
-      url = "https://github.com/ocaml/ocaml/commit/b00000c6679804731692362b0baac27fa3fddfd5.patch";
-      sha256 = "sha256-CuEXGK3EsOevyUrc9TmSZo9DVBwjunQX7mKnDVHFpkY=";
-    }
-  ];
-
-  # Workaround build failure on -fno-common toolchains like upstream
-  # gcc-10. Otherwise build fails as:
-  #   ld: libcamlrun.a(startup.o):(.bss+0x800): multiple definition of
-  #     `caml_code_fragments_table'; libcamlrun.a(backtrace.o):(.bss+0x20): first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
-}
diff --git a/pkgs/development/compilers/ocaml/4.06.nix b/pkgs/development/compilers/ocaml/4.06.nix
deleted file mode 100644
index e14ef4e16807..000000000000
--- a/pkgs/development/compilers/ocaml/4.06.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-import ./generic.nix {
-  major_version = "4";
-  minor_version = "06";
-  patch_version = "1";
-  sha256 = "1n3pygfssd6nkrq876wszm5nm3v4605q4k16a66h1nmq9wvf01vg";
-
-  # If the executable is stripped it does not work
-  dontStrip = true;
-
-  patches = [
-    # Compatibility with Glibc 2.34
-    {
-      url = "https://github.com/ocaml/ocaml/commit/137a4ad167f25fe1bee792977ed89f30d19bcd74.patch";
-      sha256 = "sha256:0izsf6rm3677vbbx0snkmn9pkfcsayrdwz3ipiml5wjiaysnchjz";
-    }
-  ];
-
-  # Workaround build failure on -fno-common toolchains like upstream
-  # gcc-10. Otherwise build fails as:
-  #   ld: libcamlrun.a(startup.o):(.bss+0x800): multiple definition of
-  #     `caml_code_fragments_table'; libcamlrun.a(backtrace.o):(.bss+0x20): first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
-}
diff --git a/pkgs/development/compilers/ocaml/4.07.nix b/pkgs/development/compilers/ocaml/4.07.nix
deleted file mode 100644
index d6b91add256d..000000000000
--- a/pkgs/development/compilers/ocaml/4.07.nix
+++ /dev/null
@@ -1,23 +0,0 @@
-import ./generic.nix {
-  major_version = "4";
-  minor_version = "07";
-  patch_version = "1";
-  sha256 = "1f07hgj5k45cylj1q3k5mk8yi02cwzx849b1fwnwia8xlcfqpr6z";
-
-  # If the executable is stripped it does not work
-  dontStrip = true;
-
-  patches = [
-    # Compatibility with Glibc 2.34
-    {
-      url = "https://github.com/ocaml/ocaml/commit/00b8c4d503732343d5d01761ad09650fe50ff3a0.patch";
-      sha256 = "sha256:02cfya5ff5szx0fsl5x8ax76jyrla9zmf3qxavf3adhwq5ssrfcv";
-    }
-  ];
-
-  # Workaround build failure on -fno-common toolchains like upstream
-  # gcc-10. Otherwise build fails as:
-  #   ld: libcamlrun.a(startup.o):(.bss+0x800): multiple definition of
-  #     `caml_code_fragments_table'; libcamlrun.a(backtrace.o):(.bss+0x20): first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
-}
diff --git a/pkgs/development/compilers/ocaml/4.08.nix b/pkgs/development/compilers/ocaml/4.08.nix
deleted file mode 100644
index a163955a6148..000000000000
--- a/pkgs/development/compilers/ocaml/4.08.nix
+++ /dev/null
@@ -1,26 +0,0 @@
-import ./generic.nix {
-  major_version = "4";
-  minor_version = "08";
-  patch_version = "1";
-  sha256 = "18sycl3zmgb8ghpxymriy5d72gvw7m5ra65v51hcrmzzac21hkyd";
-
-  # If the executable is stripped it does not work
-  dontStrip = true;
-
-  # Breaks build with Clang
-  hardeningDisable = [ "strictoverflow" ];
-
-  patches = [
-    # Compatibility with Glibc 2.34
-    {
-      url = "https://github.com/ocaml/ocaml/commit/17df117b4939486d3285031900587afce5262c8c.patch";
-      sha256 = "sha256:1b3jc6sj2k23yvfwrv6nc1f4x2n2biqbhbbp74aqb6iyqyjsq35n";
-    }
-  ];
-
-  # Workaround build failure on -fno-common toolchains like upstream
-  # gcc-10. Otherwise build fails as:
-  #   ld: libcamlrun.a(startup.o):(.bss+0x800): multiple definition of
-  #     `caml_code_fragments_table'; libcamlrun.a(backtrace.o):(.bss+0x20): first defined here
-  env.NIX_CFLAGS_COMPILE = "-fcommon";
-}
diff --git a/pkgs/development/compilers/ocaml/fix-clang-build-on-osx.diff b/pkgs/development/compilers/ocaml/fix-clang-build-on-osx.diff
deleted file mode 100644
index d7d9c863858f..000000000000
--- a/pkgs/development/compilers/ocaml/fix-clang-build-on-osx.diff
+++ /dev/null
@@ -1,20 +0,0 @@
-diff --git a/configure b/configure
-index d45e88f..25d872b 100755
---- a/configure
-+++ b/configure
-@@ -322,7 +322,14 @@ case "$bytecc,$target" in
-     bytecccompopts="-fno-defer-pop $gcc_warnings -DSHRINKED_GNUC"
-     mathlib="";;
-   *,*-*-darwin*)
--    bytecccompopts="-fno-defer-pop $gcc_warnings"
-+    # On recent version of OSX, gcc is a symlink to clang
-+    if $bytecc --version | grep -q clang; then
-+        # -fno-defer-pop is not supported by clang, and make recent
-+        # versions of clang to fail
-+        bytecccompopts="$gcc_warnings"
-+    else
-+        bytecccompopts="-fno-defer-pop $gcc_warnings"
-+    fi
-     mathlib=""
-     mkexe="$mkexe -Wl,-no_compact_unwind"
-     # Tell gcc that we can use 32-bit code addresses for threaded code
diff --git a/pkgs/development/compilers/ocaml/ocamlbuild.patch b/pkgs/development/compilers/ocaml/ocamlbuild.patch
deleted file mode 100644
index d153fb67d419..000000000000
--- a/pkgs/development/compilers/ocaml/ocamlbuild.patch
+++ /dev/null
@@ -1,45 +0,0 @@
-Author: Vincent Laporte <Vincent.Laporte@gmail.com>
-Date:   Sun Feb 1 11:19:50 2015 +0100
-
-    ocamlbuild: use ocamlfind to discover camlp4 path
-    
-    and default to `+camlp4`
-
-diff --git a/ocamlbuild/ocaml_specific.ml b/ocamlbuild/ocaml_specific.ml
-index b902810..a73b7a5 100644
---- a/ocamlbuild/ocaml_specific.ml
-+++ b/ocamlbuild/ocaml_specific.ml
-@@ -698,15 +698,25 @@ ocaml_lib ~extern:true ~tag_name:"use_toplevel" "toplevellib";;
- ocaml_lib ~extern:true ~dir:"+ocamldoc" "ocamldoc";;
- ocaml_lib ~extern:true ~dir:"+ocamlbuild" ~tag_name:"use_ocamlbuild" "ocamlbuildlib";;
- 
--ocaml_lib ~extern:true ~dir:"+camlp4" ~tag_name:"use_camlp4" "camlp4lib";;
--ocaml_lib ~extern:true ~dir:"+camlp4" ~tag_name:"use_old_camlp4" "camlp4";;
--ocaml_lib ~extern:true ~dir:"+camlp4" ~tag_name:"use_camlp4_full" "camlp4fulllib";;
-+let camlp4dir =
-+  Findlib.(
-+    try
-+      if sys_command "sh -c 'ocamlfind list >/dev/null' 2>/dev/null" != 0
-+      then raise (Findlib_error Cannot_run_ocamlfind);
-+      (query "camlp4").location
-+    with Findlib_error _ ->
-+      "+camlp4"
-+  );;
-+
-+ocaml_lib ~extern:true ~dir:camlp4dir ~tag_name:"use_camlp4" "camlp4lib";;
-+ocaml_lib ~extern:true ~dir:camlp4dir ~tag_name:"use_old_camlp4" "camlp4";;
-+ocaml_lib ~extern:true ~dir:camlp4dir ~tag_name:"use_camlp4_full" "camlp4fulllib";;
- flag ["ocaml"; "compile"; "use_camlp4_full"]
--     (S[A"-I"; A"+camlp4/Camlp4Parsers";
--        A"-I"; A"+camlp4/Camlp4Printers";
--        A"-I"; A"+camlp4/Camlp4Filters"]);;
--flag ["ocaml"; "use_camlp4_bin"; "link"; "byte"] (A"+camlp4/Camlp4Bin.cmo");;
--flag ["ocaml"; "use_camlp4_bin"; "link"; "native"] (A"+camlp4/Camlp4Bin.cmx");;
-+     (S[A"-I"; A(camlp4dir^"/Camlp4Parsers");
-+        A"-I"; A(camlp4dir^"/Camlp4Printers");
-+        A"-I"; A(camlp4dir^"/Camlp4Filters")]);;
-+flag ["ocaml"; "use_camlp4_bin"; "link"; "byte"] (A(camlp4dir^"/Camlp4Bin.cmo"));;
-+flag ["ocaml"; "use_camlp4_bin"; "link"; "native"] (A(camlp4dir^"/Camlp4Bin.cmx"));;
- 
- flag ["ocaml"; "debug"; "compile"; "byte"] (A "-g");;
- flag ["ocaml"; "debug"; "link"; "byte"; "program"] (A "-g");;
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 4cfb1604df2a..8b30769c3e46 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -2247,56 +2247,6 @@ in
 rec {
   inherit mkOcamlPackages;
 
-  ocamlPackages_4_00_1 = mkOcamlPackages (
-    callPackage ../development/compilers/ocaml/4.00.1.nix {
-      stdenv = pkgs.gcc13Stdenv;
-    }
-  );
-
-  ocamlPackages_4_01_0 = mkOcamlPackages (
-    callPackage ../development/compilers/ocaml/4.01.0.nix {
-      stdenv = pkgs.gcc13Stdenv;
-    }
-  );
-
-  ocamlPackages_4_02 = mkOcamlPackages (
-    callPackage ../development/compilers/ocaml/4.02.nix {
-      stdenv = pkgs.gcc13Stdenv;
-    }
-  );
-
-  ocamlPackages_4_03 = mkOcamlPackages (
-    callPackage ../development/compilers/ocaml/4.03.nix {
-      stdenv = pkgs.gcc13Stdenv;
-    }
-  );
-
-  ocamlPackages_4_04 = mkOcamlPackages (
-    callPackage ../development/compilers/ocaml/4.04.nix {
-      stdenv = pkgs.gcc13Stdenv;
-    }
-  );
-
-  ocamlPackages_4_05 = mkOcamlPackages (
-    callPackage ../development/compilers/ocaml/4.05.nix {
-      stdenv = pkgs.gcc13Stdenv;
-    }
-  );
-
-  ocamlPackages_4_06 = mkOcamlPackages (
-    callPackage ../development/compilers/ocaml/4.06.nix {
-      stdenv = pkgs.gcc13Stdenv;
-    }
-  );
-
-  ocamlPackages_4_07 = mkOcamlPackages (
-    callPackage ../development/compilers/ocaml/4.07.nix {
-      stdenv = pkgs.gcc13Stdenv;
-    }
-  );
-
-  ocamlPackages_4_08 = mkOcamlPackages (callPackage ../development/compilers/ocaml/4.08.nix { });
-
   ocamlPackages_4_09 = mkOcamlPackages (callPackage ../development/compilers/ocaml/4.09.nix { });
 
   ocamlPackages_4_10 = mkOcamlPackages (callPackage ../development/compilers/ocaml/4.10.nix { });
@@ -2331,3 +2281,22 @@ rec {
     }
   );
 }
+// lib.optionalAttrs config.allowAliases {
+  ocamlPackages_4_00_1 = throw "ocamlPackages_4_00_1 has been removed. Please use a newer version of OCaml.";
+
+  ocamlPackages_4_01_0 = throw "ocamlPackages_4_01_0 has been removed. Please use a newer version of OCaml.";
+
+  ocamlPackages_4_02 = throw "ocamlPackages_4_02 has been removed. Please use a newer version of OCaml.";
+
+  ocamlPackages_4_03 = throw "ocamlPackages_4_03 has been removed. Please use a newer version of OCaml.";
+
+  ocamlPackages_4_04 = throw "ocamlPackages_4_04 has been removed. Please use a newer version of OCaml.";
+
+  ocamlPackages_4_05 = throw "ocamlPackages_4_05 has been removed. Please use a newer version of OCaml.";
+
+  ocamlPackages_4_06 = throw "ocamlPackages_4_06 has been removed. Please use a newer version of OCaml.";
+
+  ocamlPackages_4_07 = throw "ocamlPackages_4_07 has been removed. Please use a newer version of OCaml.";
+
+  ocamlPackages_4_08 = throw "ocamlPackages_4_08 has been removed. Please use a newer version of OCaml.";
+}

From d19c9b5f3a1f37181418c79b31ce2784adcc47c6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 14 Oct 2025 21:06:50 +0000
Subject: [PATCH 12/28] python3Packages.ariadne: 0.26.2 -> 0.27.0

---
 pkgs/development/python-modules/ariadne/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/ariadne/default.nix b/pkgs/development/python-modules/ariadne/default.nix
index b279311510ae..3ec6f131f8fd 100644
--- a/pkgs/development/python-modules/ariadne/default.nix
+++ b/pkgs/development/python-modules/ariadne/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "ariadne";
-  version = "0.26.2";
+  version = "0.27.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "mirumee";
     repo = "ariadne";
     tag = version;
-    hash = "sha256-zkxRg11O/P7+qU+vdDG3i8Tpn6dXByaGLN9t+e2dhyE=";
+    hash = "sha256-y09w1y+NV2HX8cXGMqv6LvPqGXxFfoaz4DS+oH25dNg=";
   };
 
   patches = [ ./remove-opentracing.patch ];

From b9610cd1b43d533eb745c1d1c707e758d554e369 Mon Sep 17 00:00:00 2001
From: Yiyu Zhou <yiyuzhou19@gmail.com>
Date: Tue, 14 Oct 2025 18:07:54 -0700
Subject: [PATCH 13/28] yt-dlp: 2025.09.26 -> 2025.10.14

---
 pkgs/by-name/yt/yt-dlp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/yt/yt-dlp/package.nix b/pkgs/by-name/yt/yt-dlp/package.nix
index b6f1857ec672..ae0b2733f6b9 100644
--- a/pkgs/by-name/yt/yt-dlp/package.nix
+++ b/pkgs/by-name/yt/yt-dlp/package.nix
@@ -19,14 +19,14 @@ python3Packages.buildPythonApplication rec {
   # The websites yt-dlp deals with are a very moving target. That means that
   # downloads break constantly. Because of that, updates should always be backported
   # to the latest stable release.
-  version = "2025.09.26";
+  version = "2025.10.14";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "yt-dlp";
     repo = "yt-dlp";
     tag = version;
-    hash = "sha256-/uzs87Vw+aDNfIJVLOx3C8RyZvWLqjggmnjrOvUX1Eg=";
+    hash = "sha256-x7vpuXUihlC4jONwjmWnPECFZ7xiVAOFSDUgBNvl+aA=";
   };
 
   postPatch = ''

From d921034ba6a2f289dee3539c8ca914ae2b22c003 Mon Sep 17 00:00:00 2001
From: Greg Hellings <greg.hellings@gmail.com>
Date: Tue, 14 Oct 2025 23:50:43 -0500
Subject: [PATCH 14/28] restic-browser: 0.3.2 -> 0.3.3

Update to Tauri v2 and WebKit 4.1
---
 pkgs/by-name/re/restic-browser/package.nix | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/re/restic-browser/package.nix b/pkgs/by-name/re/restic-browser/package.nix
index 3a94a4936704..3a4d48430c47 100644
--- a/pkgs/by-name/re/restic-browser/package.nix
+++ b/pkgs/by-name/re/restic-browser/package.nix
@@ -4,36 +4,37 @@
   rustPlatform,
   fetchFromGitHub,
   fetchNpmDeps,
-  cargo-tauri_1,
+  cargo-tauri,
   nodejs,
   npmHooks,
   pkg-config,
   wrapGAppsHook3,
-  webkitgtk_4_0,
+  webkitgtk_4_1,
   dbus,
   nix-update-script,
+  restic,
 }:
 rustPlatform.buildRustPackage rec {
   pname = "restic-browser";
-  version = "0.3.2";
+  version = "0.3.3";
 
   src = fetchFromGitHub {
     owner = "emuell";
     repo = "restic-browser";
     rev = "v${version}";
-    hash = "sha256-magf19hA5PVAZafRcQXFaAD50qGofztpiluVc2aCeOk=";
+    hash = "sha256-K8JEt1kOvu/G3S1O6W/ee2JM968bgPR/FeGaBKP6elU=";
   };
 
-  cargoHash = "sha256-5wSxa8jgto+v+tJHbenc2nvGlLaOBYyRrCqFyCPnncc=";
+  cargoHash = "sha256-/EgSr46mJV84s/MG/3nUnU6XQ8RtEWiWo0gFtegblEQ=";
 
   npmDeps = fetchNpmDeps {
     name = "${pname}-npm-deps-${version}";
     inherit src;
-    hash = "sha256-U82hVPfVd12vBeDT3PHexwmc9OitkuxTugYRe4Z/3eo=";
+    hash = "sha256-uyn5cXMKm7+LLuF+n94pBTypLiPvfAs5INDEtd9cHs0=";
   };
 
   nativeBuildInputs = [
-    cargo-tauri_1.hook
+    cargo-tauri.hook
 
     nodejs
     npmHooks.npmConfigHook
@@ -44,8 +45,9 @@ rustPlatform.buildRustPackage rec {
   ];
 
   buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
-    webkitgtk_4_0
+    webkitgtk_4_1
     dbus
+    restic
   ];
 
   cargoRoot = "src-tauri";

From 17c93b8dfb0988517e4341978d0bf532c62332c4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 15 Oct 2025 05:48:12 +0000
Subject: [PATCH 15/28] rclip: 2.0.8 -> 2.0.11

---
 pkgs/by-name/rc/rclip/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/rc/rclip/package.nix b/pkgs/by-name/rc/rclip/package.nix
index ecb9e22f09d8..9495eb01fea6 100644
--- a/pkgs/by-name/rc/rclip/package.nix
+++ b/pkgs/by-name/rc/rclip/package.nix
@@ -6,14 +6,14 @@
 }:
 python3Packages.buildPythonApplication rec {
   pname = "rclip";
-  version = "2.0.8";
+  version = "2.0.11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "yurijmikhalevich";
     repo = "rclip";
     tag = "v${version}";
-    hash = "sha256-ScNyy5qWDskKgqxjfRU7y8WBCdThXTjlE3x0oIa8fhU=";
+    hash = "sha256-TXJpaMCSKCeOiWPVb9//czux+JV8VlJsiWH8fUb1tkw=";
   };
 
   build-system = with python3Packages; [

From 443c3caf7ddae9606e6bda736fc2367a2499ce0c Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Wed, 15 Oct 2025 07:55:15 +0000
Subject: [PATCH 16/28] mujoco: 3.3.6 -> 3.3.7

Diff: https://github.com/google-deepmind/mujoco/compare/3.3.6...3.3.7

Changelog: https://mujoco.readthedocs.io/en/3.3.7/changelog.html
---
 pkgs/by-name/mu/mujoco/package.nix            | 21 +++++++++++--------
 .../python-modules/mujoco/default.nix         |  2 +-
 2 files changed, 13 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/mu/mujoco/package.nix b/pkgs/by-name/mu/mujoco/package.nix
index 3acbbe9e1fc2..709d6ee9dd74 100644
--- a/pkgs/by-name/mu/mujoco/package.nix
+++ b/pkgs/by-name/mu/mujoco/package.nix
@@ -18,14 +18,14 @@ let
     abseil-cpp = fetchFromGitHub {
       owner = "abseil";
       repo = "abseil-cpp";
-      rev = "987c57f325f7fa8472fa84e1f885f7534d391b0d";
-      hash = "sha256-6Ro7miql9+wcArsOKTjlyDSyD91rmmPsIfO5auk9kiI=";
+      rev = "d38452e1ee03523a208362186fd42248ff2609f6";
+      hash = "sha256-SCQDORhmJmTb0CYm15zjEa7dkwc+lpW2s1d4DsMRovI=";
     };
     benchmark = fetchFromGitHub {
       owner = "google";
       repo = "benchmark";
-      rev = "049f6e79cc3e8636cec21bbd94ed185b4a5f2653";
-      hash = "sha256-VmSKKCsBvmvXSnFbw6GJRgiGjlne8rw22+RCLBV/kD4=";
+      rev = "5f7d66929fb66869d96dfcbacf0d8a586b33766d";
+      hash = "sha256-G9jMWq8BxKvRGP4D2/tcogdLwmek4XGYESqepnZIlCw=";
     };
     ccd = fetchFromGitHub {
       owner = "danfis";
@@ -36,8 +36,8 @@ let
     eigen3 = fetchFromGitLab {
       owner = "libeigen";
       repo = "eigen";
-      rev = "4be7e6b4e0a82853e853c0c7c4ef72f395e1f497";
-      hash = "sha256-SOTQ9j8YCsEuxNULsulQ0bmtxOZJKF7zc4GZOQlrmdo=";
+      rev = "4033cfcc1dd45b3cdf7285afd93556f2cfbe9425";
+      hash = "sha256-E1jfbHldIQOwonHvMn0feQiLI9zq3zB8Q9a0ufw1HuY=";
     };
     googletest = fetchFromGitHub {
       owner = "google";
@@ -86,7 +86,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "mujoco";
-  version = "3.3.6";
+  version = "3.3.7";
 
   # Bumping version? Make sure to look though the MuJoCo's commit
   # history for bumped dependency pins!
@@ -94,7 +94,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "google-deepmind";
     repo = "mujoco";
     tag = finalAttrs.version;
-    hash = "sha256-6lZ36XFMsjzck/ouSSiX47+dxbEzXgrMhw1Mi3PEnq4=";
+    hash = "sha256-qetgQDgXtaDAuAo/PakZJEsevnvZFJB5EYXPMWeaEqo=";
   };
 
   patches = [ ./mujoco-system-deps-dont-fetch.patch ];
@@ -127,7 +127,10 @@ stdenv.mkDerivation (finalAttrs: {
     ln -s ${pin.qhull} build/_deps/qhull-src
     ln -s ${pin.tinyobjloader} build/_deps/tinyobjloader-src
     ln -s ${pin.tinyxml2} build/_deps/tinyxml2-src
-    ln -s ${pin.trianglemeshdistance} build/_deps/trianglemeshdistance-src
+  ''
+  # Mujoco's cmake apply a patch on the trianglemeshdistance source code. Requires write permission.
+  + ''
+    cp -r ${pin.trianglemeshdistance} build/_deps/trianglemeshdistance-src
     ln -s ${pin.marchingcubecpp} build/_deps/marchingcubecpp-src
   '';
 
diff --git a/pkgs/development/python-modules/mujoco/default.nix b/pkgs/development/python-modules/mujoco/default.nix
index 91020733522d..69ccd0ec6a77 100644
--- a/pkgs/development/python-modules/mujoco/default.nix
+++ b/pkgs/development/python-modules/mujoco/default.nix
@@ -38,7 +38,7 @@ buildPythonPackage rec {
   # in the project's CI.
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-Emv7DbRC62QHd23E+Yx8AilUlHkx4Dw5XsRfpYRj+14=";
+    hash = "sha256-lw28RAEzccLeZF+cN6m0Hxi0/DaK3IxfgFeYgSG+YQs=";
   };
 
   nativeBuildInputs = [ cmake ];

From 708dc43f9e7691db1f2026a88df40fc1e9418ea2 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 15 Oct 2025 10:04:28 +0200
Subject: [PATCH 17/28] equilux-theme: drop gnome-themes-extra dependency

This does not change the resulting build.
---
 pkgs/by-name/eq/equilux-theme/package.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/by-name/eq/equilux-theme/package.nix b/pkgs/by-name/eq/equilux-theme/package.nix
index 785c3e0f68bd..04a6bd2032d2 100644
--- a/pkgs/by-name/eq/equilux-theme/package.nix
+++ b/pkgs/by-name/eq/equilux-theme/package.nix
@@ -3,7 +3,6 @@
   stdenv,
   fetchFromGitHub,
   gnome-shell,
-  gnome-themes-extra,
   glib,
   libxml2,
   gtk-engine-murrine,
@@ -30,7 +29,6 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
-    gnome-themes-extra
     gdk-pixbuf
     librsvg
   ];

From 8803be75c3b145d73f587b074dd85c5441e7b8d4 Mon Sep 17 00:00:00 2001
From: Stefan Frijters <sfrijters@gmail.com>
Date: Wed, 15 Oct 2025 10:04:59 +0200
Subject: [PATCH 18/28] equilux-theme: modernize derivation

---
 pkgs/by-name/eq/equilux-theme/package.nix | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/eq/equilux-theme/package.nix b/pkgs/by-name/eq/equilux-theme/package.nix
index 04a6bd2032d2..4dc7b7fff8db 100644
--- a/pkgs/by-name/eq/equilux-theme/package.nix
+++ b/pkgs/by-name/eq/equilux-theme/package.nix
@@ -11,15 +11,15 @@
   bc,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "equilux-theme";
   version = "20181029";
 
   src = fetchFromGitHub {
     owner = "ddnexus";
     repo = "equilux-theme";
-    rev = "equilux-v${version}";
-    sha256 = "0lv2yyxhnmnkwxp576wnb01id4fp734b5z5n0l67sg5z7vc2h8fc";
+    tag = "equilux-v${finalAttrs.version}";
+    hash = "sha256-zCEo2D6/PH0MBbb8ssg415EWA1iWm1Nu59NWC7v3YlM=";
   };
 
   nativeBuildInputs = [
@@ -47,11 +47,11 @@ stdenv.mkDerivation rec {
     rm $out/share/themes/*/COPYING
   '';
 
-  meta = with lib; {
-    inherit (src.meta) homepage;
+  meta = {
+    inherit (finalAttrs.src.meta) homepage;
     description = "Material Design theme for GNOME/GTK based desktop environments";
-    license = licenses.gpl2;
-    platforms = platforms.all;
-    maintainers = [ maintainers.fpletz ];
+    license = lib.licenses.gpl2;
+    platforms = lib.platforms.all;
+    maintainers = [ lib.maintainers.fpletz ];
   };
-}
+})

From 786c47896e030a060f58de4f969193a498bc6fcd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Karel=20Ko=C4=8D=C3=AD?= <cynerd@email.cz>
Date: Wed, 15 Oct 2025 10:46:22 +0200
Subject: [PATCH 19/28] python3Packages.hawkmoth: fix broken state with llvm 21
 by using 20

Hawkmoth is broken with LLVM 21 release. This is already reported, but
there is no stable fix on the Hawkmoth's size, yet. Thus this changes
the used LLVM version in Hawkmoth to 20.

https://github.com/jnikula/hawkmoth/pull/291
---
 .../development/python-modules/hawkmoth/default.nix | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/hawkmoth/default.nix b/pkgs/development/python-modules/hawkmoth/default.nix
index ff0d98f2334b..03520ea155a6 100644
--- a/pkgs/development/python-modules/hawkmoth/default.nix
+++ b/pkgs/development/python-modules/hawkmoth/default.nix
@@ -3,13 +3,18 @@
   buildPythonPackage,
   fetchFromGitHub,
   hatchling,
+  llvmPackages_20,
   libclang,
   sphinx,
-  clang,
   pytestCheckHook,
   strictyaml,
 }:
+let
+  libclang_20 = libclang.override {
+    llvmPackages = llvmPackages_20;
+  };
 
+in
 buildPythonPackage rec {
   pname = "hawkmoth";
   version = "0.21.0";
@@ -25,13 +30,13 @@ buildPythonPackage rec {
   build-system = [ hatchling ];
 
   dependencies = [
-    libclang
+    libclang_20
     sphinx
   ];
-  propagatedBuildInputs = [ clang ];
+  propagatedBuildInputs = [ llvmPackages_20.clang ];
 
   nativeCheckInputs = [
-    clang
+    llvmPackages_20.clang
     pytestCheckHook
     strictyaml
   ];

From 5d614b371c47ed72daa059f87051cb5d1b27cf03 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 15 Oct 2025 10:51:09 +0000
Subject: [PATCH 20/28] cliqr: 0.1.29 -> 0.1.30

---
 pkgs/by-name/cl/cliqr/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/cl/cliqr/package.nix b/pkgs/by-name/cl/cliqr/package.nix
index 2f5774a48419..1d9fddf98708 100644
--- a/pkgs/by-name/cl/cliqr/package.nix
+++ b/pkgs/by-name/cl/cliqr/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "cliqr";
-  version = "0.1.29";
+  version = "0.1.30";
 
   src = fetchFromGitHub {
     owner = "paepckehh";
     repo = "cliqr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fhNMiUaCTk4xYGJRMuZCHeYvzGeVwkS7E7LU1L+LuBg=";
+    hash = "sha256-+HP7RDh/8gIsHAO1adtClKZbBg70LSxvf88aS0hFBJs=";
   };
 
   vendorHash = null;

From 8f504d1eaea986d9db2197b2e2dbbb4c50b9883c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lo=C3=AFc=20Reynier?= <loic@loicreynier.fr>
Date: Tue, 14 Oct 2025 20:31:32 +0200
Subject: [PATCH 21/28] fortitude: init at 0.7.5-unstable-2025-10-14

---
 pkgs/by-name/fo/fortitude/package.nix | 30 +++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)
 create mode 100644 pkgs/by-name/fo/fortitude/package.nix

diff --git a/pkgs/by-name/fo/fortitude/package.nix b/pkgs/by-name/fo/fortitude/package.nix
new file mode 100644
index 000000000000..216151c00df0
--- /dev/null
+++ b/pkgs/by-name/fo/fortitude/package.nix
@@ -0,0 +1,30 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+}:
+
+rustPlatform.buildRustPackage {
+  pname = "fortitude";
+  version = "0.7.5-unstable-2025-10-14";
+
+  src = fetchFromGitHub {
+    owner = "PlasmaFAIR";
+    repo = "fortitude";
+    rev = "ca65546d69947500eeb37a2bbc58151012ab40d9";
+    hash = "sha256-PKOPQnVQbvqEoCPO9K3ofajbcId83uLbma6R9RiBzys=";
+  };
+
+  cargoHash = "sha256-hNAONXSy1uxm7AHvMHWNboL9NpQfvEOfTQivushp7S4=";
+
+  meta = {
+    description = "Fortran linter written in Rust inspired by Ruff";
+    homepage = "https://fortitude.readthedocs.io/en/stable/";
+    downloadPage = "https://github.com/PlasmaFAIR/fortitude";
+    changelog = "https://github.com/PlasmaFAIR/fortitude/blob/main/CHANGELOG.md";
+    license = lib.licenses.mit;
+    mainProgram = "fortitude";
+    maintainers = with lib.maintainers; [ loicreynier ];
+    platforms = with lib.platforms; windows ++ darwin ++ linux;
+  };
+}

From f8ab24951f72f365d9d94358d10c4c301cc30fc5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lo=C3=AFc=20Reynier?= <loic@loicreynier.fr>
Date: Tue, 14 Oct 2025 20:34:10 +0200
Subject: [PATCH 22/28] maintainers: update loicreynier

---
 maintainers/maintainer-list.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 93c82e9811a3..2f2272186b35 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -14897,7 +14897,7 @@
     name = "Isaac Silverstein";
   };
   loicreynier = {
-    email = "loic@loicreynier.fr";
+    email = "contact@loicreynier.fr";
     github = "loicreynier";
     githubId = 88983487;
     name = "Loïc Reynier";

From fd20b1b44bfe538060477b1888eb0ee5a490b251 Mon Sep 17 00:00:00 2001
From: Antonis Kotronakis <mail@akotro.dev>
Date: Wed, 15 Oct 2025 01:20:03 +0100
Subject: [PATCH 23/28] nixos/tsidp: pass dir flag to avoid state being created
 in $HOME/.config

---
 nixos/modules/services/security/tsidp.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/services/security/tsidp.nix b/nixos/modules/services/security/tsidp.nix
index f79c4eceaf3e..4b854cf183ca 100644
--- a/nixos/modules/services/security/tsidp.nix
+++ b/nixos/modules/services/security/tsidp.nix
@@ -23,6 +23,8 @@ let
     nullOr
     ;
 
+  stateDir = "/var/lib/tsidp";
+
   cfg = config.services.tsidp;
 in
 {
@@ -154,7 +156,7 @@ in
         ];
 
         environment = {
-          HOME = "/var/lib/tsidp";
+          HOME = stateDir;
           TAILSCALE_USE_WIP_CODE = "1"; # Needed while tsidp is in development (< v1.0.0).
         };
 
@@ -163,6 +165,7 @@ in
           ExecStart =
             let
               args = lib.cli.toGNUCommandLineShell { mkOptionName = k: "-${k}"; } {
+                dir = stateDir;
                 hostname = cfg.settings.hostName;
                 port = cfg.settings.port;
                 local-port = cfg.settings.localPort;
@@ -179,8 +182,8 @@ in
           RestartSec = "15";
 
           DynamicUser = true;
-          StateDirectory = "tsidp";
-          WorkingDirectory = "/var/lib/tsidp";
+          StateDirectory = baseNameOf stateDir;
+          WorkingDirectory = stateDir;
           ReadWritePaths = mkIf (cfg.settings.useLocalTailscaled) [
             "/var/run/tailscale" # needed due to `ProtectSystem = "strict";`
             "/var/lib/tailscale"

From a118341fb1826870872895c6938c2cb0bed13321 Mon Sep 17 00:00:00 2001
From: "Braian A. Diez" <bdiez19@gmail.com>
Date: Tue, 14 Oct 2025 15:07:20 -0300
Subject: [PATCH 24/28] evil-winrm: fix libgssapi issue related to kerberos

---
 pkgs/by-name/ev/evil-winrm/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ev/evil-winrm/package.nix b/pkgs/by-name/ev/evil-winrm/package.nix
index aa0c97c89253..6fce8efa0ecc 100644
--- a/pkgs/by-name/ev/evil-winrm/package.nix
+++ b/pkgs/by-name/ev/evil-winrm/package.nix
@@ -6,6 +6,7 @@
   bundlerEnv,
   bundlerUpdateScript,
   writeText,
+  krb5,
   sslLegacyProvider ? false,
 }:
 let
@@ -57,7 +58,9 @@ stdenv.mkDerivation rec {
   '';
 
   postFixup = lib.optionalString sslLegacyProvider ''
-    wrapProgram $out/bin/evil-winrm --prefix OPENSSL_CONF : "${openssl_conf}"
+    wrapProgram $out/bin/evil-winrm \
+      --prefix OPENSSL_CONF : "${openssl_conf}" \
+      --prefix LD_LIBRARY_PATH : ${krb5.lib}/lib
   '';
 
   passthru.updateScript = bundlerUpdateScript "evil-winrm";

From 425fe9b34aecd8eab5ff32d1f6071f0ad7b7732c Mon Sep 17 00:00:00 2001
From: "Braian A. Diez" <bdiez19@gmail.com>
Date: Tue, 14 Oct 2025 15:19:22 -0300
Subject: [PATCH 25/28] evil-winrm: 3.5 -> 3.7

---
 pkgs/by-name/ev/evil-winrm/Gemfile.lock | 16 +++++++-------
 pkgs/by-name/ev/evil-winrm/gemset.nix   | 28 ++++++++++++-------------
 pkgs/by-name/ev/evil-winrm/package.nix  |  4 ++--
 3 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/pkgs/by-name/ev/evil-winrm/Gemfile.lock b/pkgs/by-name/ev/evil-winrm/Gemfile.lock
index 63d93e828e22..0c88daea6d14 100644
--- a/pkgs/by-name/ev/evil-winrm/Gemfile.lock
+++ b/pkgs/by-name/ev/evil-winrm/Gemfile.lock
@@ -1,11 +1,11 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    base64 (0.2.0)
-    bigdecimal (3.1.9)
+    base64 (0.3.0)
+    bigdecimal (3.3.1)
     builder (3.3.0)
     erubi (1.13.1)
-    ffi (1.17.1)
+    ffi (1.17.2)
     fileutils (1.7.3)
     gssapi (1.3.1)
       ffi (>= 1.0.1)
@@ -15,19 +15,19 @@ GEM
     httpclient (2.9.0)
       mutex_m
     little-plugger (1.1.4)
-    logger (1.6.6)
+    logger (1.7.0)
     logging (2.4.0)
       little-plugger (~> 1.1)
       multi_json (~> 1.14)
-    multi_json (1.15.0)
+    multi_json (1.17.0)
     mutex_m (0.3.0)
     nori (2.7.1)
       bigdecimal
-    rexml (3.4.1)
+    rexml (3.4.4)
     rubyntlm (0.6.5)
       base64
     rubyzip (2.4.1)
-    stringio (3.1.5)
+    stringio (3.1.7)
     winrm (2.3.9)
       builder (>= 2.1.2)
       erubi (~> 1.8)
@@ -55,4 +55,4 @@ DEPENDENCIES
   winrm-fs
 
 BUNDLED WITH
-   2.6.2
+   2.7.1
diff --git a/pkgs/by-name/ev/evil-winrm/gemset.nix b/pkgs/by-name/ev/evil-winrm/gemset.nix
index 7eb90702fa47..54c38cb871a5 100644
--- a/pkgs/by-name/ev/evil-winrm/gemset.nix
+++ b/pkgs/by-name/ev/evil-winrm/gemset.nix
@@ -4,20 +4,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "01qml0yilb9basf7is2614skjp8384h2pycfx86cr8023arfj98g";
+      sha256 = "0yx9yn47a8lkfcjmigk79fykxvr80r4m1i35q82sxzynpbm7lcr7";
       type = "gem";
     };
-    version = "0.2.0";
+    version = "0.3.0";
   };
   bigdecimal = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1k6qzammv9r6b2cw3siasaik18i6wjc5m0gw5nfdc6jj64h79z1g";
+      sha256 = "0612spks81fvpv2zrrv3371lbs6mwd7w6g5zafglyk75ici1x87a";
       type = "gem";
     };
-    version = "3.1.9";
+    version = "3.3.1";
   };
   builder = {
     groups = [ "default" ];
@@ -44,10 +44,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0fgwn1grxf4zxmyqmb9i4z2hr111585n9jnk17y6y7hhs7dv1xi6";
+      sha256 = "19kdyjg3kv7x0ad4xsd4swy5izsbb1vl1rpb6qqcqisr5s23awi9";
       type = "gem";
     };
-    version = "1.17.1";
+    version = "1.17.2";
   };
   fileutils = {
     groups = [ "default" ];
@@ -110,10 +110,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "05s008w9vy7is3njblmavrbdzyrwwc1fsziffdr58w9pwqj8sqfx";
+      sha256 = "00q2zznygpbls8asz5knjvvj2brr3ghmqxgr83xnrdj4rk3xwvhr";
       type = "gem";
     };
-    version = "1.6.6";
+    version = "1.7.0";
   };
   logging = {
     dependencies = [
@@ -134,10 +134,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0pb1g1y3dsiahavspyzkdy39j4q377009f6ix0bh1ag4nqw43l0z";
+      sha256 = "06sabsvnw0x1aqdcswc6bqrqz6705548bfd8z22jxgxfjrn1yn3n";
       type = "gem";
     };
-    version = "1.15.0";
+    version = "1.17.0";
   };
   mutex_m = {
     groups = [ "default" ];
@@ -165,10 +165,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1jmbf6lf7pcyacpb939xjjpn1f84c3nw83dy3p1lwjx0l2ljfif7";
+      sha256 = "0hninnbvqd2pn40h863lbrn9p11gvdxp928izkag5ysx8b1s5q0r";
       type = "gem";
     };
-    version = "3.4.1";
+    version = "3.4.4";
   };
   rubyntlm = {
     dependencies = [ "base64" ];
@@ -196,10 +196,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1j1mgvrgkxhadi6nb6pz1kcff7gsb5aivj1vfhsia4ssa5hj9adw";
+      sha256 = "1yh78pg6lm28c3k0pfd2ipskii1fsraq46m6zjs5yc9a4k5vfy2v";
       type = "gem";
     };
-    version = "3.1.5";
+    version = "3.1.7";
   };
   winrm = {
     dependencies = [
diff --git a/pkgs/by-name/ev/evil-winrm/package.nix b/pkgs/by-name/ev/evil-winrm/package.nix
index 6fce8efa0ecc..8179f1edd858 100644
--- a/pkgs/by-name/ev/evil-winrm/package.nix
+++ b/pkgs/by-name/ev/evil-winrm/package.nix
@@ -35,13 +35,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "evil-winrm";
-  version = "3.5";
+  version = "3.7";
 
   src = fetchFromGitHub {
     owner = "Hackplayers";
     repo = "evil-winrm";
     tag = "v${version}";
-    hash = "sha256-8Lyo7BgypzrHMEcbYlxo/XWwOtBqs2tczYnc3+XEbeA=";
+    hash = "sha256-jr8glS732UvSt+qFkhhLFZUB7OIRpRj3SzXm6mVikrE=";
   };
 
   nativeBuildInputs = [

From 60e29dadaefb3bc678d9a8c9ed4cba83252fddc9 Mon Sep 17 00:00:00 2001
From: Soumyadip Sarkar <soumyadip@soumyadipsarkar.com>
Date: Wed, 15 Oct 2025 20:45:40 +0530
Subject: [PATCH 26/28] doc: fixed typo in python-interpreter-table.nix

---
 doc/doc-support/python-interpreter-table.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/doc/doc-support/python-interpreter-table.nix b/doc/doc-support/python-interpreter-table.nix
index 0ea478812872..84e6c7003616 100644
--- a/doc/doc-support/python-interpreter-table.nix
+++ b/doc/doc-support/python-interpreter-table.nix
@@ -61,7 +61,7 @@ let
 
 in
 writeText "python-interpreter-table.md" ''
-  | Package | Aliases | Interpeter |
-  |---------|---------|------------|
+  | Package | Aliases | Interpreter |
+  |---------|---------|-------------|
   ${toMarkdown result}
 ''

From 67857730528669d454db967db1c0914a894b3f33 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 15 Oct 2025 17:41:42 +0200
Subject: [PATCH 27/28] python315: init add 3.15.0a1

https://docs.python.org/3.15/whatsnew/changelog.html#python-3-15-0-alpha-1
---
 doc/languages-frameworks/python.section.md    |  1 +
 .../python/cpython/3.15/no-ldconfig.patch     | 40 +++++++++++++++++++
 .../interpreters/python/default.nix           | 13 ++++++
 pkgs/top-level/all-packages.nix               |  7 ++++
 4 files changed, 61 insertions(+)
 create mode 100644 pkgs/development/interpreters/python/cpython/3.15/no-ldconfig.patch

diff --git a/doc/languages-frameworks/python.section.md b/doc/languages-frameworks/python.section.md
index 487b7d4b3401..61c211c0dfcb 100644
--- a/doc/languages-frameworks/python.section.md
+++ b/doc/languages-frameworks/python.section.md
@@ -55,6 +55,7 @@ sets are
 * `pkgs.python312Packages`
 * `pkgs.python313Packages`
 * `pkgs.python314Packages`
+* `pkgs.python315Packages`
 * `pkgs.pypy27Packages`
 * `pkgs.pypy310Packages`
 
diff --git a/pkgs/development/interpreters/python/cpython/3.15/no-ldconfig.patch b/pkgs/development/interpreters/python/cpython/3.15/no-ldconfig.patch
new file mode 100644
index 000000000000..d7e148b510d9
--- /dev/null
+++ b/pkgs/development/interpreters/python/cpython/3.15/no-ldconfig.patch
@@ -0,0 +1,40 @@
+diff --git a/Lib/ctypes/util.py b/Lib/ctypes/util.py
+index 378f12167c6..21710702e69 100644
+--- a/Lib/ctypes/util.py
++++ b/Lib/ctypes/util.py
+@@ -374,34 +374,7 @@ def find_library(name, is64 = False):
+     else:
+ 
+         def _findSoname_ldconfig(name):
+-            import struct
+-            if struct.calcsize('l') == 4:
+-                machine = os.uname().machine + '-32'
+-            else:
+-                machine = os.uname().machine + '-64'
+-            mach_map = {
+-                'x86_64-64': 'libc6,x86-64',
+-                'ppc64-64': 'libc6,64bit',
+-                'sparc64-64': 'libc6,64bit',
+-                's390x-64': 'libc6,64bit',
+-                'ia64-64': 'libc6,IA-64',
+-                }
+-            abi_type = mach_map.get(machine, 'libc6')
+-
+-            # XXX assuming GLIBC's ldconfig (with option -p)
+-            regex = r'\s+(lib%s\.[^\s]+)\s+\(%s'
+-            regex = os.fsencode(regex % (re.escape(name), abi_type))
+-            try:
+-                with subprocess.Popen(['/sbin/ldconfig', '-p'],
+-                                      stdin=subprocess.DEVNULL,
+-                                      stderr=subprocess.DEVNULL,
+-                                      stdout=subprocess.PIPE,
+-                                      env={'LC_ALL': 'C', 'LANG': 'C'}) as p:
+-                    res = re.search(regex, p.stdout.read())
+-                    if res:
+-                        return os.fsdecode(res.group(1))
+-            except OSError:
+-                pass
++            return None
+ 
+         def _findLib_ld(name):
+             # See issue #9998 for why this is needed
diff --git a/pkgs/development/interpreters/python/default.nix b/pkgs/development/interpreters/python/default.nix
index 6a4bf4a42133..2764e6a95344 100644
--- a/pkgs/development/interpreters/python/default.nix
+++ b/pkgs/development/interpreters/python/default.nix
@@ -97,6 +97,19 @@
       hash = "sha256-Ipna5ULTlc44g6ygDTyRAwfNaOCy9zNgmMjnt+7p8+k=";
       inherit passthruFun;
     };
+
+    python315 = callPackage ./cpython {
+      self = __splicedPackages.python315;
+      sourceVersion = {
+        major = "3";
+        minor = "15";
+        patch = "0";
+        suffix = "a1";
+      };
+      hash = "sha256-MZSTnUiO6u79z5kNNVQtmtHOeIeJxOIwWiBg63BY5aQ=";
+      inherit passthruFun;
+    };
+
     # Minimal versions of Python (built without optional dependencies)
     python3Minimal =
       (callPackage ./cpython (
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a2c59749b7bc..294a73b11b90 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -5942,6 +5942,11 @@ with pkgs;
     pythonAttr = "python314FreeThreading";
     enableGIL = false;
   };
+  python315FreeThreading = python315.override {
+    self = python315FreeThreading;
+    pythonAttr = "python315FreeThreading";
+    enableGIL = false;
+  };
 
   pythonInterpreters = callPackage ./../development/interpreters/python { };
   inherit (pythonInterpreters)
@@ -5951,6 +5956,7 @@ with pkgs;
     python312
     python313
     python314
+    python315
     python3Minimal
     pypy27
     pypy310
@@ -5967,6 +5973,7 @@ with pkgs;
   python312Packages = recurseIntoAttrs python312.pkgs;
   python313Packages = recurseIntoAttrs python313.pkgs;
   python314Packages = python314.pkgs;
+  python315Packages = python315.pkgs;
   pypyPackages = pypy.pkgs;
   pypy2Packages = pypy2.pkgs;
   pypy27Packages = pypy27.pkgs;

From 12c7b5d37c98ff23af4077d310cf636ae8ccaf2d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 15 Oct 2025 16:35:37 +0000
Subject: [PATCH 28/28] python3Packages.fast-array-utils: 1.2.3 -> 1.2.4

---
 pkgs/development/python-modules/fast-array-utils/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/fast-array-utils/default.nix b/pkgs/development/python-modules/fast-array-utils/default.nix
index 9d8fc827f752..2c6675ac026a 100644
--- a/pkgs/development/python-modules/fast-array-utils/default.nix
+++ b/pkgs/development/python-modules/fast-array-utils/default.nix
@@ -18,14 +18,14 @@
 
 buildPythonPackage rec {
   pname = "fast-array-utils";
-  version = "1.2.3";
+  version = "1.2.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scverse";
     repo = "fast-array-utils";
     tag = "v${version}";
-    hash = "sha256-uvTViDaLey+jxWyic9m542Ip4x8cCfGaNUfYp8cQPXo=";
+    hash = "sha256-R8pOID9Lws29OCMWb7RZNDsWakEYDf7bya6iSXp8Ips=";
   };
 
   # hatch-min-requirements tries to talk to PyPI by default. See https://github.com/tlambert03/hatch-min-requirements?tab=readme-ov-file#environment-variables.