Merge master into staging-nixos

2026-10-04 22:10:14 +00:00 · 2026-09-09 18:12:25 +00:00
parent 48f9e1e804 47495f2a7f
commit a8fb0861e0
77 changed files with 3827 additions and 382 deletions
--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -31,7 +31,6 @@ let
    length
    mapAttrs
    mapAttrsToList
-    mapAttrsRecursiveCond
    min
    optional
    optionalAttrs
@@ -279,7 +278,11 @@ let
        let

          # For definitions that have an associated option
-          declaredConfig = mapAttrsRecursiveCond (v: !isOption v) (_: v: v.value) options;
+          declaredConfig =
+            let
+              recurse = mapAttrs (n: v: if isOption v then v.value else recurse v);
+            in
+            recurse options;

          # If freeformType is set, this is for definitions that don't have an associated option
          freeformConfig =
@@ -564,12 +567,23 @@ let
        modulesPath:
        { disabled, modules }:
        let
-          keyFilter = filter (attrs: !isDisabled modulesPath disabled attrs);
+          isDisabledModule = isDisabled modulesPath disabled;
+          keyFilter = filter (attrs: !isDisabledModule attrs);
        in
-        catAttrs "module" (genericClosure {
-          startSet = keyFilter modules;
-          operator = attrs: keyFilter attrs.modules;
-        });
+        catAttrs "module" (
+          genericClosure (
+            if disabled == [ ] then
+              {
+                startSet = modules;
+                operator = attrs: attrs.modules;
+              }
+            else
+              {
+                startSet = keyFilter modules;
+                operator = attrs: keyFilter attrs.modules;
+              }
+          )
+        );

      toGraph =
        modulesPath:
@@ -631,6 +645,28 @@ let
    : 3\. Function argument
  */
  unifyModuleSyntax =
+    let
+      attrsToRemove = [
+        "_class"
+        "_file"
+        "key"
+        "disabledModules"
+        "imports"
+        "options"
+        "config"
+        "meta"
+        "freeformType"
+      ];
+      shorthandAttrsToRemove = [
+        "_class"
+        "_file"
+        "key"
+        "disabledModules"
+        "require"
+        "imports"
+        "freeformType"
+      ];
+    in
    file: key: m:
    let
      addMeta =
@@ -654,17 +690,7 @@ let
    in
    if m ? config || m ? options then
      let
-        badAttrs = removeAttrs m [
-          "_class"
-          "_file"
-          "key"
-          "disabledModules"
-          "imports"
-          "options"
-          "config"
-          "meta"
-          "freeformType"
-        ];
+        badAttrs = removeAttrs m attrsToRemove;
      in
      if badAttrs != { } then
        throw "Module `${key}' has an unsupported attribute `${head (attrNames badAttrs)}'. This is caused by introducing a top-level `config' or `options' attribute. Add configuration attributes immediately on the top level instead, or move all of them (namely: ${toString (attrNames badAttrs)}) into the explicit `config' attribute."
@@ -690,17 +716,7 @@ let
        disabledModules = m.disabledModules or [ ];
        imports = m.require or [ ] ++ m.imports or [ ];
        options = { };
-        config = addFreeformType (
-          removeAttrs m [
-            "_class"
-            "_file"
-            "key"
-            "disabledModules"
-            "require"
-            "imports"
-            "freeformType"
-          ]
-        );
+        config = addFreeformType (removeAttrs m shorthandAttrsToRemove);
      };

  applyModuleArgsIfFunction =
@@ -876,15 +892,13 @@ let
        # We're descending into attribute ‘name’.
        let
          loc = prefix ++ [ name ];
-          defns = pushedDownDefinitionsByName.${name} or [ ];
          defns' = rawDefinitionsByName.${name} or [ ];
-          optionDecls = filter (
+          isOptionDecl =
            m:
            m.options ? _type
-            && (m.options._type == "option" || throwDeclarationTypeError loc m.options._type m._file)
-          ) decls;
+            && (m.options._type == "option" || throwDeclarationTypeError loc m.options._type m._file);
        in
-        if length optionDecls == length decls then
+        if all isOptionDecl decls then
          let
            opt = fixupOptionType loc (mergeOptionDecls loc decls);
          in
@@ -892,7 +906,35 @@ let
            matchedOptions = evalOptionValue loc opt defns';
            unmatchedDefns = [ ];
          }
-        else if optionDecls != [ ] then
+        # this may look like duplicate computations are performed, but testing
+        # with a minimal NixOS config (defined below):
+        #
+        # 1. in 87% of cases, the above `all isOptionDecl decls` passes and we
+        # short-circuit
+        # 2. In 12% of cases, there's only one decl and we short-circuit
+        # 3. in another 1% of cases, we loop again and short-circuit when
+        # `any isOptionDecl decls` fails
+        # 4. In the final case, we pass the `any` and have to refilter. This
+        # only triggers in 1 of the 48000 calls to this function.
+        #
+        # The minimal config was defined with this expression:
+        #
+        # let nixos = import ./nixos/lib/eval-config.nix {
+        #   modules = [
+        #     ./nixos/modules/profiles/minimal.nix
+        #     {
+        #       fileSystems."/" = {
+        #         device = "/dev/sda1";
+        #         fsType = "ext4";
+        #       };
+        #       boot.loader.grub.devices = [ "/dev/sda" ];
+        #     }
+        #   ];
+        # }; in nixos.config.system.build.toplevel
+        else if length decls != 1 && any isOptionDecl decls then
+          let
+            optionDecls = filter isOptionDecl decls;
+          in
          if
            all (x: x.options.type.name or null == "submodule") optionDecls
          # Raw options can only be merged into submodules. Merging into
@@ -920,7 +962,7 @@ let
              (head optionDecls).options.type.description or "<no description>"
            }' does not support nested options.\n${showRawDecls loc nonOptions}"
        else
-          mergeModules' loc decls defns
+          mergeModules' loc decls (pushedDownDefinitionsByName.${name} or [ ])
      ) declsByName;

      matchedOptions = mapAttrs (n: v: v.matchedOptions) resultsByName;
@@ -1009,19 +1051,17 @@ let
    : 2\. Function argument
  */
  mergeOptionDecls =
-    loc: opts:
+    loc:
    foldl'
      (
        res: opt:
        let
-          t = res.type;
-          t' = opt.options.type;
-          mergedType = t.typeMerge t'.functor;
-          typesMergeable = mergedType != null;
-
          typeSet =
-            if opt.options ? type && res ? type then
-              if typesMergeable then
+            if res ? type && opt.options ? type then
+              let
+                mergedType = res.type.typeMerge opt.options.type.functor;
+              in
+              if mergedType != null then
                {
                  type = mergedType;
                }
@@ -1032,7 +1072,7 @@ let
            else
              { };

-          bothHave = k: opt.options ? ${k} && res ? ${k};
+          bothHave = k: res ? ${k} && opt.options ? ${k};
        in
        if bothHave "default" || bothHave "example" || bothHave "description" || bothHave "apply" then
          # Keep in sync with the same error above!
@@ -1077,8 +1117,7 @@ let
        declarations = [ ];
        declarationPositions = [ ];
        options = [ ];
-      }
-      opts;
+      };

  /**
    Merge all the definitions of an option to produce the final
@@ -1131,21 +1170,19 @@ let
          throw "The option `${showOption loc}' is read-only, but it's set multiple times. Definition values:${showDefs separateDefs}"
        else
          mergeDefinitions loc opt.type defs';
-
-      # Apply the 'apply' function to the merged value. This allows options to
-      # yield a value computed from the definitions
-      value = if opt ? apply then opt.apply res.mergedValue else res.mergedValue;
-
-      warnDeprecation =
-        if (opt.type.deprecationMessage != null) then
-          warn "The type `types.${opt.type.name}' of option `${showOption loc}' defined in ${showFiles opt.declarations} is deprecated. ${opt.type.deprecationMessage}"
-        else
-          x: x;
-
    in
-    warnDeprecation opt
+    (
+      if opt.type.deprecationMessage != null then
+        warn "The type `types.${opt.type.name}' of option `${showOption loc}' 'defined in ${showFiles opt.declarations} is deprecated. ${opt.type.deprecationMessage}" opt
+      else
+        opt
+    )
    // {
-      value = addErrorContext "while evaluating the option `${showOption loc}':" value;
+      value = addErrorContext "while evaluating the option `${showOption loc}':" (
+        # Apply the 'apply' function to the merged value. This allows options to
+        # yield a value computed from the definitions
+        if opt ? apply then opt.apply res.mergedValue else res.mergedValue
+      );
      inherit (res.defsFinal') highestPrio;
      definitions = catAttrs "value" res.defsFinal;
      files = catAttrs "file" res.defsFinal;
@@ -1185,49 +1222,16 @@ let
  # Merge definitions of a value of a given type.
  mergeDefinitions = loc: type: defs: rec {
    defsFinal' =
-      let
-        # Process mkMerge and mkIf properties.
-        defsNormalized = concatMap (
-          m:
-          map (
-            value:
-            if value._type or null == "definition" then
-              value
-            else
-              {
-                inherit (m) file;
-                inherit value;
-              }
-          ) (addErrorContext "while evaluating definitions from `${m.file}':" (dischargeProperties m.value))
-        ) defs;
-
-        # Process mkOverride properties.
-        defsFiltered = filterOverrides' defsNormalized;
-
-        # Sort mkOrder properties.
-        defsSorted =
-          # Avoid sorting if we don't have to.
-          if any (def: def.value._type or "" == "order") defsFiltered.values then
-            sortProperties defsFiltered.values
-          else
-            defsFiltered.values;
-      in
      # Fast path: the overwhelming majority of options have exactly one
      # definition whose value carries no property wrapper
      # (mkIf/mkMerge/mkOverride/mkOrder/definition). In that case the
-      # discharge/filter/sort pipeline above is a no-op but still allocates
-      # several intermediate lists and closures. Detect it up front and hand
-      # the original singleton straight to the type merge. The let-bindings
-      # above are lazy and thus never forced on this branch.
+      # discharge/filter/sort pipeline below is a no-op but still allocates
+      # several intermediate lists and closures. Detect it up front and hand the
+      # original singleton straight to the type merge.
      if
        length defs == 1
-        && (
-          let
-            d = head defs;
-          in
-          addErrorContext "while evaluating definitions from `${d.file}':" (
-            !(isAttrs d.value && d.value ? _type)
-          )
+        && addErrorContext "while evaluating definitions from `${(head defs).file}':" (
+          !(head defs).value ? _type
        )
      then
        {
@@ -1235,6 +1239,33 @@ let
          highestPrio = defaultOverridePriority;
        }
      else
+        let
+          # Process mkMerge and mkIf properties.
+          defsNormalized = concatMap (
+            m:
+            map (
+              value:
+              if value._type or null == "definition" then
+                value
+              else
+                {
+                  inherit (m) file;
+                  inherit value;
+                }
+            ) (addErrorContext "while evaluating definitions from `${m.file}':" (dischargeProperties m.value))
+          ) defs;
+
+          # Process mkOverride properties.
+          defsFiltered = filterOverrides' defsNormalized;
+
+          # Sort mkOrder properties.
+          defsSorted =
+            # Avoid sorting if we don't have to.
+            if any (def: def.value._type or "" == "order") defsFiltered.values then
+              sortProperties defsFiltered.values
+            else
+              defsFiltered.values;
+        in
        {
          values = defsSorted;
          inherit (defsFiltered) highestPrio;
@@ -1346,13 +1377,16 @@ let
          val;
    in
    cfg:
-    if cfg._type or "" == "merge" then
-      concatMap pushDownProperties cfg.contents
-    else if cfg._type or "" == "if" then
-      map (mapAttrsIfAttrs (n: v: mkIf cfg.condition v)) (pushDownProperties cfg.content)
-    else if cfg._type or "" == "override" then
-      map (mapAttrsIfAttrs (n: v: mkOverride cfg.priority v)) (pushDownProperties cfg.content)
-    # FIXME: handle mkOrder?
+    if cfg ? _type then
+      if cfg._type == "if" then
+        map (mapAttrsIfAttrs (n: v: mkIf cfg.condition v)) (pushDownProperties cfg.content)
+      else if cfg._type == "merge" then
+        concatMap pushDownProperties cfg.contents
+      else if cfg._type == "override" then
+        map (mapAttrsIfAttrs (n: v: mkOverride cfg.priority v)) (pushDownProperties cfg.content)
+      # FIXME: handle mkOrder?
+      else
+        [ cfg ]
    else
      [ cfg ];

@@ -1375,13 +1409,16 @@ let
  */
  dischargeProperties =
    def:
-    if def._type or "" == "merge" then
-      concatMap dischargeProperties def.contents
-    else if def._type or "" == "if" then
-      if isBool def.condition then
-        if def.condition then dischargeProperties def.content else [ ]
+    if def ? _type then
+      if def._type == "if" then
+        if isBool def.condition then
+          if def.condition then dischargeProperties def.content else [ ]
+        else
+          throw "‘mkIf’ called with a non-Boolean condition"
+      else if def._type == "merge" then
+        concatMap dischargeProperties def.contents
      else
-        throw "‘mkIf’ called with a non-Boolean condition"
+        [ def ]
    else
      [ def ];

@@ -1471,7 +1508,7 @@ let
  fixupOptionType =
    loc: opt:
    if opt.type.getSubModules or null == null then
-      opt // { type = opt.type or types.unspecified; }
+      if opt ? type then opt else opt // { type = types.unspecified; }
    else
      opt
      // {
@@ -1500,23 +1537,21 @@ let
  mergeAttrDefinitionsWithPrio =
    opt:
    let
-      defsByAttr = zipAttrs (
-        concatLists (
-          concatMap (
-            { value, ... }@def:
-            map (mapAttrsToList (
-              k: value: {
-                ${k} = def // {
-                  inherit value;
-                };
-              }
-            )) (pushDownProperties value)
-          ) opt.definitionsWithLocations
-        )
+      defsByAttr = concatLists (
+        concatMap (
+          { value, ... }@def:
+          map (mapAttrsToList (
+            k: value: {
+              ${k} = def // {
+                inherit value;
+              };
+            }
+          )) (pushDownProperties value)
+        ) opt.definitionsWithLocations
      );
    in
    assert opt.type.name == "attrsOf" || opt.type.name == "lazyAttrsOf";
-    mapAttrs (
+    zipAttrsWith (
      k: v:
      let
        merging = mergeDefinitions (opt.loc ++ [ k ]) opt.type.nestedTypes.elemType v;
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1250,6 +1250,11 @@
    githubId = 2545644;
    name = "Alessandro Di Federico";
  };
+  alejandroqh = {
+    github = "alejandroqh";
+    githubId = 40313108;
+    name = "Alejandro Quintanar";
+  };
  alejandrosame = {
    email = "alejandrosanchzmedina@gmail.com";
    matrix = "@alejandrosame:matrix.org";
--- a/nixos/modules/services/databases/cassandra.nix
+++ b/nixos/modules/services/databases/cassandra.nix
@@ -69,7 +69,8 @@ let
    cassandraEnvPkg = "${cfg.package}/conf/cassandra-env.sh";
    cassandraLogbackConfig = pkgs.writeText "logback.xml" cfg.logbackConfig;

-    passAsFile = [ "extraEnvSh" ];
+    strictDeps = true;
+    __structuredAttrs = true;
    inherit (cfg) extraEnvSh package;

    buildCommand = ''
@@ -80,7 +81,7 @@ let

      ( cat "$cassandraEnvPkg"
        echo "# lines from services.cassandra.extraEnvSh: "
-        cat "$extraEnvShPath"
+        printf "%s" "$extraEnvSh"
      ) > "$out/cassandra-env.sh"

      # Delete default JMX Port, otherwise we can't set it using env variable
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -2045,12 +2045,12 @@ final: prev: {

  blink-lib = buildVimPlugin {
    pname = "blink.lib";
-    version = "0-unstable-2026-08-08";
+    version = "0-unstable-2026-09-07";
    src = fetchFromGitHub {
      owner = "saghen";
      repo = "blink.lib";
-      rev = "c8fdc12c8a2fab6cf786dd7141a283f8079f902b";
-      hash = "sha256-g8t/Esmkln3Xpsb7ln258T+XCvuMHaquct3Nnv0TbvE=";
+      rev = "fd9a48ebbe6ec30d5dfcc5b42c243941ccdca1aa";
+      hash = "sha256-CyDv8bRHjGKpn/qDMaplDBcqwQl73ZPkhjmvzkizF/I=";
    };
    meta.homepage = "https://github.com/saghen/blink.lib/";
    meta.license = getLicenseFromSpdxId "MIT";
--- a/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/myriad-dreamin.tinymist/default.nix
@@ -11,7 +11,7 @@ vscode-utils.buildVscodeMarketplaceExtension {
    name = "tinymist";
    publisher = "myriad-dreamin";
    inherit (tinymist) version;
-    hash = "sha256-P0WAqrTf8adCtQ8SOjY7bkfGJo5VBXqazt0WhW8prcw=";
+    hash = "sha256-mTcTEvBsycCL2BW9EnmKJfyZN3aL6B/G8l8lnBTBojo=";
  };

  __structuredAttrs = true;
--- a/pkgs/by-name/al/all-the-package-names/package.nix
+++ b/pkgs/by-name/al/all-the-package-names/package.nix
@@ -7,16 +7,16 @@

 buildNpmPackage rec {
  pname = "all-the-package-names";
-  version = "2.0.2547";
+  version = "2.0.2558";

  src = fetchFromGitHub {
    owner = "nice-registry";
    repo = "all-the-package-names";
    tag = "v${version}";
-    hash = "sha256-y65jI+YmfSR+6siiy8kTbAsvu8tO4iuf3M0C9tnXhZ4=";
+    hash = "sha256-Dvl4URH8h8dDGfOZQ9rHiris8nhOoEtA2mRCdu7aiwo=";
  };

-  npmDepsHash = "sha256-oV9bW19LxeI/2OInI4w3MzFT/A7Wras0Nesdis2XRUw=";
+  npmDepsHash = "sha256-TkVVFdZ4h4hCMhXEXqHx2TwbdVZErTqdJqaTDHAc33w=";

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/bb/bbedit/package.nix
+++ b/pkgs/by-name/bb/bbedit/package.nix
@@ -18,6 +18,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {

  nativeBuildInputs = [ _7zz ];

+  # 7zz extracts APFS alternate data streams as separate files, breaking the seal
+  postUnpack = ''
+    find . -name "*:com.apple.*" -delete
+  '';
+
  installPhase = ''
    runHook preInstall

--- a/pkgs/by-name/da/davinci-resolve/package.nix
+++ b/pkgs/by-name/da/davinci-resolve/package.nix
@@ -39,7 +39,7 @@
  xkeyboard_config,
  glib,
  libarchive,
-  libxcrypt,
+  libxcrypt-legacy,
  python3,
  aprutil,
  makeDesktopItem,
@@ -56,7 +56,7 @@ let
  davinci = (
    stdenv.mkDerivation rec {
      pname = "davinci-resolve${lib.optionalString studioVariant "-studio"}";
-      version = "21.0.4";
+      version = "21.1";

      nativeBuildInputs = [
        appimageTools.appimage-exec
@@ -78,9 +78,9 @@ let
            outputHashAlgo = "sha256";
            outputHash =
              if studioVariant then
-                "sha256-FwaSnK3DAIRGCz6kiWxE4o0Cd0en2qoyuWCDHat1xHQ="
+                "sha256-D5RjUukwKMpULrDfMJOPsPWW9FxhQ/IUMh76u5JLytA="
              else
-                "sha256-oX/abUHhnl1AW3xb53x8l7WIdSKc9e2Ocp0qtGAOv/A=";
+                "sha256-bQ4Yag4xfIF9Fs0UVKaYFhObMsAof5n+Sy4osw35a9g=";

            impureEnvVars = lib.fetchers.proxyImpureEnvVars;

@@ -171,7 +171,7 @@ let
          test -e ${lib.escapeShellArg appimageName}
          appimage-exec.sh -x $out ${lib.escapeShellArg appimageName}

-          mkdir -p $out/{"Apple Immersive/Calibration",configs,DolbyVision,easyDCP,Extras,Fairlight,GPUCache,logs,Media,"Resolve Disk Database",.crashreport,.license,.LUT}
+          mkdir -p $out/{"Apple Immersive/Calibration",configs,DolbyVision,easyDCP,Extras,Fairlight,GPUCache,Immersive/Canon/STMap,logs,Media,"Resolve Disk Database",.crashreport,.license,.LUT}

          # Install udev rules for Blackmagic hardware (color panels, Speed Editor, Editor Keyboard)
          mkdir -p $out/lib/udev/rules.d
@@ -207,7 +207,6 @@ let
            addDriverRunpath "$program"
          fi
        done
-        ln -s $out/libs/libcrypto.so.1.1 $out/libs/libcrypt.so.1
      '';

      desktopItems = [
@@ -303,7 +302,7 @@ buildFHSEnv {
      librsvg
      libtool
      libuuid
-      libxcrypt # provides libcrypt.so.1
+      libxcrypt-legacy # provides libcrypt.so.1
      libxkbcommon
      nspr
      ocl-icd
--- a/pkgs/by-name/de/depot-cli/package.nix
+++ b/pkgs/by-name/de/depot-cli/package.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  stdenv,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+  gitMinimal,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "depot-cli";
+  version = "2.101.73";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "depot";
+    repo = "cli";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-7nUA8NW+hy79x3u+WTISkNLCeIlrYux5ZBmwlPpq+/w=";
+  };
+
+  vendorHash = "sha256-/EcczS/e8vQiCOXaA2J2yY5xM9ymIt1LEObDnC0O1Rc=";
+
+  ldflags = [
+    "-s"
+    # https://github.com/depot/cli/blob/0b6ec9863dd8cbaab85f6be0b29b59057c4f8008/.github/workflows/ci.yml#L164
+    "-X github.com/depot/cli/internal/build.Version=${finalAttrs.version}"
+    "-X github.com/depot/cli/internal/build.Date=1970-01-01T00:00:00Z"
+    "-X github.com/depot/cli/internal/build.SentryEnvironment=release"
+  ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd depot \
+      --bash <($out/bin/depot completion bash) \
+      --fish <($out/bin/depot completion fish) \
+      --zsh <($out/bin/depot completion zsh)
+  '';
+
+  nativeCheckInputs = [ gitMinimal ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  meta = {
+    description = "Official CLI for the Depot Docker image builder";
+    homepage = "https://github.com/depot/cli";
+    changelog = "https://github.com/depot/cli/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.ethancedwards8 ];
+    mainProgram = "depot";
+  };
+})
--- a/pkgs/by-name/dr/drawio-headless/package.nix
+++ b/pkgs/by-name/dr/drawio-headless/package.nix
@@ -41,5 +41,6 @@ writeTextFile {
      tfc
    ];
    mainProgram = "drawio";
+    license = lib.licenses.mit; # Wrapper itself is MIT
  };
 }
--- a/pkgs/by-name/ea/easyeffects/package.nix
+++ b/pkgs/by-name/ea/easyeffects/package.nix
@@ -61,13 +61,13 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "easyeffects";
-  version = "8.2.8";
+  version = "8.2.9";

  src = fetchFromGitHub {
    owner = "wwmm";
    repo = "easyeffects";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-gkUJxEmFfUAKUnr+Gs65y9l0bdNXXd0f8ql0keM2bVs=";
+    hash = "sha256-K1TZiH8Ykli1dIdTbqIOZt2uWXaROMhr1tGC9wfSmiI=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/fi/fish/package.nix
+++ b/pkgs/by-name/fi/fish/package.nix
@@ -150,13 +150,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "fish";
-  version = "4.9.2";
+  version = "4.9.3";

  src = fetchFromGitHub {
    owner = "fish-shell";
    repo = "fish-shell";
    tag = finalAttrs.version;
-    hash = "sha256-LomMNY+p3UViHRbwiy4z9ajkFlGq9NfK115mrYMNg+o=";
+    hash = "sha256-/q+w18Akm1VUAI1bM1lHud8QPNkpz2xCUh/7+ot44Gk=";
  };

  env = {
@@ -169,7 +169,7 @@ stdenv.mkDerivation (finalAttrs: {

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) src patches;
-    hash = "sha256-7dEeY3PM894E3ZVRq2O40Q/9HMwGSd0d+Xx1VTUizKg=";
+    hash = "sha256-vINXoQKol3rY2WDlU01eLzuzxnTx2w3tAfKSg7tRSGI=";
  };

  patches = [
--- a/pkgs/by-name/gc/gclient2nix/gclient2nix.py
+++ b/pkgs/by-name/gc/gclient2nix/gclient2nix.py
@@ -94,7 +94,7 @@ class Repo:
            {
                **{
                f"checkout_{platform}": platform == "linux"
-                for platform in ["ios", "chromeos", "android", "mac", "win", "linux", "fuchsia"]
+                for platform in ["ios", "chromeos", "android", "mac", "win", "linux", "fuchsia", "s390"]
                },
                **{
                f"checkout_{arch}": True
--- a/pkgs/by-name/gc/gclient2nix/package.nix
+++ b/pkgs/by-name/gc/gclient2nix/package.nix
@@ -69,8 +69,8 @@ runCommand "gclient2nix"
    # substitutions
    depot_tools_checkout = fetchgit {
      url = "https://chromium.googlesource.com/chromium/tools/depot_tools";
-      rev = "1b1b01fa912786b88a79f3504176a275183839b5";
-      hash = "sha256-SRPeosetXYUklafhcuqsJiIKfItUJACG70m4Z5pBQiU=";
+      rev = "604a436d8af23ca0b9fd3d1d8be193fc9a4679f6";
+      hash = "sha256-tNJq/a4j0AHmn2FS4zbwkWeEMYlp4uXDcpPzP9D3ULE=";
    };

    passthru = {
--- a/pkgs/by-name/la/lasuite-docs-collaboration-server/package.nix
+++ b/pkgs/by-name/la/lasuite-docs-collaboration-server/package.nix
@@ -13,20 +13,20 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "lasuite-docs-collaboration-server";
-  version = "5.5.0";
+  version = "5.6.1";

  src = fetchFromGitHub {
    owner = "suitenumerique";
    repo = "docs";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-NR4TooBjE9hTZOm830MRtebUtSZFxVsVwswPz1w8k48=";
+    hash = "sha256-4nTE7pjrheas/OdtHCLok8mw0ZhcDL1pL2VFekPgmdI=";
  };

  sourceRoot = "${finalAttrs.src.name}/src/frontend";

  offlineCache = fetchYarnDeps {
    yarnLock = "${finalAttrs.src}/src/frontend/yarn.lock";
-    hash = "sha256-1WqEF1M3YHt7IgoBe9WjX/kL1knfvOWWSli2K5V+gm4=";
+    hash = "sha256-fbq8XxqNCp2/Y8VE1OxdAdcfcCMwu721OByXzsyWnqM=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/la/lasuite-docs-frontend/package.nix
+++ b/pkgs/by-name/la/lasuite-docs-frontend/package.nix
@@ -12,20 +12,20 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "lasuite-docs-frontend";
-  version = "5.5.0";
+  version = "5.6.1";

  src = fetchFromGitHub {
    owner = "suitenumerique";
    repo = "docs";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-NR4TooBjE9hTZOm830MRtebUtSZFxVsVwswPz1w8k48=";
+    hash = "sha256-4nTE7pjrheas/OdtHCLok8mw0ZhcDL1pL2VFekPgmdI=";
  };

  sourceRoot = "${finalAttrs.src.name}/src/frontend";

  offlineCache = fetchYarnDeps {
    yarnLock = "${finalAttrs.src}/src/frontend/yarn.lock";
-    hash = "sha256-1WqEF1M3YHt7IgoBe9WjX/kL1knfvOWWSli2K5V+gm4=";
+    hash = "sha256-fbq8XxqNCp2/Y8VE1OxdAdcfcCMwu721OByXzsyWnqM=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/la/lasuite-docs/package.nix
+++ b/pkgs/by-name/la/lasuite-docs/package.nix
@@ -11,12 +11,12 @@
  yarnConfigHook,
 }:
 let
-  version = "5.5.0";
+  version = "5.6.1";
  src = fetchFromGitHub {
    owner = "suitenumerique";
    repo = "docs";
    tag = "v${version}";
-    hash = "sha256-NR4TooBjE9hTZOm830MRtebUtSZFxVsVwswPz1w8k48=";
+    hash = "sha256-4nTE7pjrheas/OdtHCLok8mw0ZhcDL1pL2VFekPgmdI=";
  };

  mail-templates = stdenv.mkDerivation {
@@ -29,7 +29,7 @@ let

    offlineCache = fetchYarnDeps {
      yarnLock = "${src}/src/mail/yarn.lock";
-      hash = "sha256-x3zcoOfb5vTBreswjZUcJstbXvbDHBBG/u0N4L7T1uI=";
+      hash = "sha256-Y+E1HhQRdmdQf9kfkL09W/R29oN8wCLNsMBDnNGx6T0=";
    };

    nativeBuildInputs = [
@@ -137,6 +137,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
      redis
      requests
      sentry-sdk
+      servestatic
      uvicorn
      whitenoise
    ]
--- a/pkgs/by-name/li/libretroPackages/cores/prboom.nix
+++ b/pkgs/by-name/li/libretroPackages/cores/prboom.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "prboom";
-  version = "0-unstable-2026-08-11";
+  version = "0-unstable-2026-09-08";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "libretro-prboom";
-    rev = "c180d47a5f9f1b5f74be18bf74deb5eccf97057e";
-    hash = "sha256-Y076+K39Ge2gTlEMQnB6BhoT3ebLPtME6XKeRMpzoYs=";
+    rev = "ddea2c6c041f7790c7bcf1dc3c1fe73b6cff0516";
+    hash = "sha256-Gjog5egR49CqERDHMgxDhWE2OQeDZd57NpJ5c/jSOx4=";
  };

  makefile = "Makefile";
--- a/pkgs/by-name/li/librewolf-unwrapped/src.json
+++ b/pkgs/by-name/li/librewolf-unwrapped/src.json
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "155.0-1",
+  "packageVersion": "155.0.1-1",
  "source": {
-    "rev": "155.0-1",
-    "hash": "sha256-LPLkMuKnEHJ+jYF5LnitnOzHaokDdRIyxZegWKEJ2wo="
+    "rev": "155.0.1-1",
+    "hash": "sha256-UjGUEDRohgDcNYUnX7EhNvDRPHUcYuC3GsNOpJ3yYFw="
  },
  "firefox": {
-    "version": "155.0",
-    "hash": "sha512-JCkmgZJO258ElOt3p7GZlAOau8OowLowTw5HK0mpQ4OFZXI96YO8jvCOAZlx4CowFMjSQbuIxkWgamJcis4Nag=="
+    "version": "155.0.1",
+    "hash": "sha512-bRN6ejFcsdCqwaP+MUr4D+KQxJt8Lkf4aHsl1HIJJ7Kg3HGj2p119sq0eQZ9sRTKpnMtF+iIsKv86ZI4qK8POQ=="
  }
 }
--- a/pkgs/by-name/mi/mint-l-theme/package.nix
+++ b/pkgs/by-name/mi/mint-l-theme/package.nix
@@ -8,13 +8,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "mint-l-theme";
-  version = "2.0.7";
+  version = "2.0.8";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = "mint-l-theme";
    tag = finalAttrs.version;
-    hash = "sha256-Wk480v9AHUfcaZP9sm/boIFWcbuhmJ5cH14qV4BRtuw=";
+    hash = "sha256-mY1hujZXUkBYuYoQSPykvvD53SEwPVzhuwIkdLJD8+U=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/mi/mint-themes/package.nix
+++ b/pkgs/by-name/mi/mint-themes/package.nix
@@ -8,13 +8,13 @@

 stdenvNoCC.mkDerivation rec {
  pname = "mint-themes";
-  version = "2.4.0";
+  version = "2.4.1";

  src = fetchFromGitHub {
    owner = "linuxmint";
    repo = "mint-themes";
    rev = version;
-    hash = "sha256-pO2qotVR48VTKIS1IDqb9GwKTo/l1BV1Hk0w4Pf5V+U=";
+    hash = "sha256-cpvWxUTDOfGVK0ZE75ghSB8LVwA8NqWPispXA+E32C4=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ne/nextvi/package.nix
+++ b/pkgs/by-name/ne/nextvi/package.nix
@@ -7,13 +7,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "nextvi";
-  version = "7.4";
+  version = "7.5";

  src = fetchFromGitHub {
    owner = "kyx0r";
    repo = "nextvi";
    tag = finalAttrs.version;
-    hash = "sha256-DZDaF3Na4jaAZcR4Tzx+9r+uBg/PRw6uwUlQtlCXiuk=";
+    hash = "sha256-TB2zRgZ7bZhmdzPog5CSUYXBo56K+iSX7EAcI2NxP18=";
  };

  nativeBuildInputs = [ installShellFiles ];
--- a/pkgs/by-name/te/term39/package.nix
+++ b/pkgs/by-name/te/term39/package.nix
@@ -0,0 +1,40 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  pam,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "term39";
+  version = "1.5.1";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "alejandroqh";
+    repo = "term39";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-IFJXBTjGedDl+FY7HDE5p+jYqA3c5EHHxQfn8hPY/es=";
+  };
+
+  cargoHash = "sha256-RguJr5xtuLcn4OO/8hmg06AmUT6WPzGtCpB0J+xw8+I=";
+
+  nativeBuildInputs = [
+    pkg-config
+    rustPlatform.bindgenHook
+  ];
+
+  buildInputs = [
+    pam
+  ];
+
+  meta = {
+    description = "Modern, retro-styled terminal multiplexer with a classic MS-DOS aesthetic";
+    homepage = "https://github.com/alejandroqh/term39";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ alejandroqh ];
+    mainProgram = "term39";
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/te/terminal-space-program/package.nix
+++ b/pkgs/by-name/te/terminal-space-program/package.nix
@@ -7,14 +7,14 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "terminal-space-program";
-  version = "0.38.1";
+  version = "0.40.0";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "jasonfen";
    repo = "terminal-space-program";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-G9yUzzREgu1OK44NbSs9teS+yP8dRZIV8gvATklc804=";
+    hash = "sha256-ZdSzBlw1x4Z1JjvvddGretcbFPEnfyg/pFuUJO93Xxo=";
  };

  vendorHash = "sha256-5bhIP7It6rqOFvXRBUIP6/nGz4X+dzm3/BjVeo3nw4I=";
--- a/pkgs/by-name/ti/tinycast/package.nix
+++ b/pkgs/by-name/ti/tinycast/package.nix
@@ -0,0 +1,57 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  _7zz,
+}:
+
+let
+  sources = lib.importJSON ./sources.json;
+in
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "tinycast";
+  inherit (sources) version;
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchurl {
+    url = "https://github.com/abue-ammar/tinycast/releases/download/${sources.tag}/Tinycast-${sources.version}.dmg";
+    inherit (sources) hash;
+  };
+
+  dontPatch = true;
+  dontConfigure = true;
+  dontBuild = true;
+  dontFixup = true;
+
+  # Tinycast.dmg is APFS formatted, which is unsupported by undmg.
+  nativeBuildInputs = [ _7zz ];
+
+  sourceRoot = "Tinycast Beta.app";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/Applications/Tinycast Beta.app"
+    cp -R . "$out/Applications/Tinycast Beta.app"
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "Beta release of Tinycast, a native macOS launcher, hotkeys, and clipboard history";
+    homepage = "https://github.com/abue-ammar/tinycast";
+    changelog = "https://github.com/abue-ammar/tinycast/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.agpl3Only;
+    maintainers = with lib.maintainers; [ pwnwriter ];
+    platforms = [
+      "aarch64-darwin"
+      "x86_64-darwin"
+    ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
--- a/pkgs/by-name/ti/tinycast/sources.json
+++ b/pkgs/by-name/ti/tinycast/sources.json
@@ -0,0 +1,5 @@
+{
+  "version": "0.10.3-beta.72",
+  "tag": "v0.10.3-beta.72",
+  "hash": "sha256-MMayl8yMZApInUH2SGzIycmvvgUWAR0E951pqwKEHQY="
+}
--- a/pkgs/by-name/ti/tinycast/update.sh
+++ b/pkgs/by-name/ti/tinycast/update.sh
@@ -0,0 +1,55 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq nix
+
+set -euo pipefail
+
+cd "$(dirname "$0")"
+
+repo="abue-ammar/tinycast"
+old_version=$(jq -r ".version" sources.json)
+
+release=$(curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
+  "https://api.github.com/repos/${repo}/releases?per_page=100" \
+  | jq '
+    [
+      .[]
+      | select(.prerelease == true)
+      | select(.tag_name | test("^v[0-9]+\\.[0-9]+\\.[0-9]+-beta\\.[0-9]+$"))
+    ]
+    | sort_by(.published_at)
+    | last
+  ')
+
+tag=$(jq -r ".tag_name" <<< "$release")
+version="${tag#v}"
+
+if [[ -z "$tag" || "$tag" == "null" ]]; then
+  echo "No Tinycast beta release found"
+  exit 1
+fi
+
+if [[ "$old_version" == "$version" ]]; then
+  echo "tinycast is already up to date at $version"
+  exit 0
+fi
+
+echo "Updating tinycast from $old_version to $version"
+
+asset_url=$(jq -r --arg name "Tinycast-${version}.dmg" '.assets[] | select(.name == $name) | .browser_download_url' <<< "$release")
+
+if [[ -z "$asset_url" || "$asset_url" == "null" ]]; then
+  echo "No Tinycast Beta DMG asset found for $tag"
+  exit 1
+fi
+
+sha256hash="$(nix-prefetch-url --type sha256 "$asset_url")"
+hash="$(nix hash convert --to sri --hash-algo sha256 "$sha256hash")"
+
+jq -n \
+  --arg version "$version" \
+  --arg tag "$tag" \
+  --arg hash "$hash" \
+  '{version: $version, tag: $tag, hash: $hash}' \
+  > sources.json
+
+echo "Updated tinycast to $version (tag: $tag)"
--- a/pkgs/by-name/ti/tinymist/package.nix
+++ b/pkgs/by-name/ti/tinymist/package.nix
@@ -15,7 +15,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  pname = "tinymist";
  # Please update the corresponding vscode extension when updating
  # this derivation.
-  version = "0.15.6";
+  version = "0.15.8";

  __structuredAttrs = true;

@@ -23,10 +23,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "Myriad-Dreamin";
    repo = "tinymist";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-2Wh0/HB0DfHMB+z/PFPsLlJCFxy8qKWrFMuxmv5fmZk=";
+    hash = "sha256-Y9HyVlHXtdVM26YZ3hqRnL0TDtZ0mkBulk5IQrxZig0=";
  };

-  cargoHash = "sha256-WcGCWjN8qEcJ+4jBYF3lu744A3xR+XZUGzW5i8e3dWU=";
+  cargoHash = "sha256-7A8bF9ZH/6fTIwO7PH6wkMCon1CofiyK9rtbj/lcEIg=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/by-name/tr/truecrack/package.nix
+++ b/pkgs/by-name/tr/truecrack/package.nix
@@ -2,6 +2,7 @@
  lib,
  gccStdenv,
  cudaPackages,
+  autoAddDriverRunpath,
  fetchFromGitLab,
  config,
  cudaSupport ? config.cudaSupport,
@@ -16,6 +17,9 @@ stdenv.mkDerivation (finalAttrs: {
  pname = "truecrack";
  version = "3.6";

+  strictDeps = true;
+  __structuredAttrs = true;
+
  src = fetchFromGitLab {
    owner = "kalilinux";
    repo = "packages/truecrack";
@@ -32,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
  configureFlags = (
    if cudaSupport then
      [
-        "--with-cuda=${cudaPackages.cudatoolkit}"
+        "--with-cuda=${lib.getLib cudaPackages.cuda_nvcc}"
      ]
    else
      [
@@ -42,10 +46,12 @@ stdenv.mkDerivation (finalAttrs: {

  nativeBuildInputs = [
    pkg-config
+  ]
+  ++ lib.optionals cudaSupport [
+    autoAddDriverRunpath
  ];

  buildInputs = lib.optionals cudaSupport [
-    cudaPackages.cudatoolkit
    cudaPackages.cuda_cudart
  ];

@@ -67,28 +73,29 @@ stdenv.mkDerivation (finalAttrs: {

  installFlags = [ "prefix=$(out)" ];

-  doInstallCheck = !cudaSupport;
-
+  doInstallCheck = false;
+  nativeInstallCheckInputs = [ versionCheckHook ];
  installCheckPhase = ''
    runHook preInstallCheck

    echo "Cracking test volumes"
-    $out/bin/${finalAttrs.meta.mainProgram} -t test/ripemd160_aes.test.tc -w test/passwords.txt | grep -aF "Found password"
-    $out/bin/${finalAttrs.meta.mainProgram} -t test/ripemd160_aes.test.tc -c test/tes -m 4 | grep -aF "Found password"
-    $out/bin/${finalAttrs.meta.mainProgram} -t test/ripemd160_aes.test.tc -w test/passwords.txt | grep -aF "Found password"
-    $out/bin/${finalAttrs.meta.mainProgram} -t test/whirlpool_aes.test.tc -w test/passwords.txt -k whirlpool | grep -aF "Found password"
-    $out/bin/${finalAttrs.meta.mainProgram} -t test/sha512_aes.test.tc -w test/passwords.txt -k sha512 | grep -aF "Found password"
-    $out/bin/${finalAttrs.meta.mainProgram} -t test/ripemd160_aes.test.tc -w test/passwords.txt | grep -aF "Found password"
-    $out/bin/${finalAttrs.meta.mainProgram} -t test/ripemd160_serpent.test.tc -w test/passwords.txt -e serpent | grep -aF "Found password"
-    $out/bin/${finalAttrs.meta.mainProgram} -t test/ripemd160_twofish.test.tc -w test/passwords.txt -e twofish | grep -aF "Found password"
+    $out/bin/truecrack -t test/ripemd160_aes.test.tc -w test/passwords.txt | grep -aF "Found password"
+    $out/bin/truecrack -t test/ripemd160_aes.test.tc -c test/tes -m 4 | grep -aF "Found password"
+    $out/bin/truecrack -t test/ripemd160_aes.test.tc -w test/passwords.txt | grep -aF "Found password"
+    $out/bin/truecrack -t test/whirlpool_aes.test.tc -w test/passwords.txt -k whirlpool | grep -aF "Found password"
+    $out/bin/truecrack -t test/sha512_aes.test.tc -w test/passwords.txt -k sha512 | grep -aF "Found password"
+    $out/bin/truecrack -t test/ripemd160_aes.test.tc -w test/passwords.txt | grep -aF "Found password"
+    $out/bin/truecrack -t test/ripemd160_serpent.test.tc -w test/passwords.txt -e serpent | grep -aF "Found password"
+    $out/bin/truecrack -t test/ripemd160_twofish.test.tc -w test/passwords.txt -e twofish | grep -aF "Found password"
    echo "Finished cracking test volumes"

    runHook postInstallCheck
  '';

-  nativeInstallCheckInputs = [
-    versionCheckHook
-  ];
+  passthru.gpuCheck = finalAttrs.finalPackage.overrideAttrs (oldAttrs: {
+    requiredSystemFeatures = [ "cuda" ];
+    doInstallCheck = true;
+  });

  meta = {
    description = "Brute-force password cracker for TrueCrypt volumes, optimized for Nvidia Cuda technology";
--- a/pkgs/by-name/tr/trusttunnel-endpoint/package.nix
+++ b/pkgs/by-name/tr/trusttunnel-endpoint/package.nix
@@ -10,17 +10,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "trusttunnel-endpoint";
-  version = "1.0.41";
+  version = "1.1.0";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "TrustTunnel";
    repo = "TrustTunnel";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ZFlHX17n0GQ+HVbJD9NQ5Jeg93G9A7dkjSkRD84ZNFQ=";
+    hash = "sha256-4cItVXJNGSFihHXWMpLKx/qJABwLZCvlJYGw2nM9SHY=";
  };

-  cargoHash = "sha256-2ivFP6JjFFlScO6jcaHOTzcmntKlmOmJQE0q/81NOxc=";
+  cargoHash = "sha256-8X0eA3a1zAYbRIWGunBHFUeluk9mYV9tn78tuYPru2Y=";

  postPatch = ''
    substituteInPlace $cargoDepsCopy/*/boring-sys-*/build/main.rs $cargoDepsCopy/*/quiche-*/src/build.rs \
@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      --replace-fail "cargo:rustc-link-lib=static=ssl" "cargo:rustc-link-lib=dylib=ssl"

    # remove reference to deprecated boringssl API
-    patch -d $cargoDepsCopy/*/boring-4.19.0/ -p1 -i ${./boring-no-secp224r1.patch}
+    patch -d $cargoDepsCopy/*/boring-4.22.0/ -p1 -i ${./boring-no-secp224r1.patch}
  '';

  env = {
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@@ -18,17 +18,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "uv";
-  version = "0.12.5";
+  version = "0.12.11";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "astral-sh";
    repo = "uv";
    tag = finalAttrs.version;
-    hash = "sha256-tKdqciPQnteeTqkXtWY8mliWUDv5gMdU8x0UPadQZlQ=";
+    hash = "sha256-JMlgO+3locpTzxjDURqSTh0ZUplRGlbky76rDXmPgjM=";
  };

-  cargoHash = "sha256-27NzA/YXYbcGO6ehXP9OgvgLJQG/YP/I+eeflLmzxRQ=";
+  cargoHash = "sha256-c4Kgtxvm0sMnnVdrs2O6w0MDTqllTuCHlyg31GnG1tY=";

  buildInputs = [
    rust-jemalloc-sys
--- a/pkgs/by-name/wo/woodpecker-plugin-git/package.nix
+++ b/pkgs/by-name/wo/woodpecker-plugin-git/package.nix
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "woodpecker-plugin-git";
-  version = "2.10.0";
+  version = "2.10.1";

  src = fetchFromGitHub {
    owner = "woodpecker-ci";
    repo = "plugin-git";
    tag = finalAttrs.version;
-    hash = "sha256-Ry6mBfkjZYer7MBiN8rU1+yjxuKFA5vLlRjq8zh6Ajk=";
+    hash = "sha256-9ALys0+JVBUo+jMjSg6FtLclzH2VOGUYnr8/3rpi+Vw=";
  };

-  vendorHash = "sha256-dJLeUO13lOov7+yUVoGq88YRQmjQN54TVmyC66mH7eY=";
+  vendorHash = "sha256-Wl1E5PHSQglSyLk+bLAyLn3hHsAEKaafeBRPVcauIwE=";

  env.CGO_ENABLED = "0";

--- a/pkgs/by-name/xa/xapp/package.nix
+++ b/pkgs/by-name/xa/xapp/package.nix
@@ -24,7 +24,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "xapp";
-  version = "3.2.2";
+  version = "3.2.3";

  outputs = [
    "out"
@@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "linuxmint";
    repo = "xapp";
    rev = finalAttrs.version;
-    hash = "sha256-xVGIrK7koqX6xKoanVHWQMBUusUjtvHzQg2OV0E0b78=";
+    hash = "sha256-WisSymt3l+bt02aUy+SaqDa5S9V+xxgy8mkFQfB+shM=";
  };

  # Recommended by upstream, which enables the build of xapp-debug.
--- a/pkgs/by-name/yt/ytmdesktop/package.nix
+++ b/pkgs/by-name/yt/ytmdesktop/package.nix
@@ -22,7 +22,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "ytmdesktop";
-  version = "2.0.11";
+  version = "2.0.12";

  src = fetchFromGitHub {
    owner = "ytmdesktop";
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
      find -name .git -print0 | xargs -0 rm -rf
    '';

-    hash = "sha256-3gUEdkTFaO6WT13HyVssVX0qSmluOPm4AAy1dovHw6g=";
+    hash = "sha256-fT5UdJ9YYK3hXC8GkEeJ/LK1bCyXofcKA0aCJUnjZdk=";
  };

  patches = [
@@ -65,7 +65,7 @@ stdenv.mkDerivation (finalAttrs: {

  yarnOfflineCache = yarn-berry.fetchYarnBerryDeps {
    inherit (finalAttrs) src missingHashes patches;
-    hash = "sha256-VpNK+44/FwHxZ+Hyx0QShpZ9fdP06VhhpoXxMFeLUzE=";
+    hash = "sha256-fpvBE4QZcDaWGgqU3jQlOe+bOLtnDEVNR4IuKBo35BQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/zi/zizmor/package.nix
+++ b/pkgs/by-name/zi/zizmor/package.nix
@@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "zizmor";
-  version = "1.30.0";
+  version = "1.30.1";

  src = fetchFromGitHub {
    owner = "zizmorcore";
    repo = "zizmor";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-qJfzQA2MGUDBIj1cYMOcYUYP9bcEyPHcO45AXFUKrBs=";
+    hash = "sha256-Oay7x5bS85w7bszaUHRyh/PuMA1d4hd7l//HqsV8Z3A=";
  };

-  cargoHash = "sha256-Y0R47fEGrY6MPHkUjIRM/++IcAkIld/1rCAhuzKbCks=";
+  cargoHash = "sha256-0cDYV7e9S6r4xF4UTqH3DAKGmwOkJ/DrOJd8Ohr9LwM=";

  buildInputs = [
    rust-jemalloc-sys
--- a/pkgs/development/compilers/gcc/common/configure-flags.nix
+++ b/pkgs/development/compilers/gcc/common/configure-flags.nix
@@ -40,15 +40,6 @@

 assert !enablePlugin -> disableGdbPlugin;

-# Note [Windows Exception Handling]
-# sjlj (short jump long jump) exception handling makes no sense on x86_64,
-# it's forcibly slowing programs down as it produces a constant overhead.
-# On x86_64 we have SEH (Structured Exception Handling) and we should use
-# that. On i686, we do not have SEH, and have to use sjlj with dwarf2.
-# Hence it's now conditional on x86_32 (i686 is 32bit).
-#
-# ref: https://stackoverflow.com/questions/15670169/what-is-difference-between-sjlj-vs-dwarf-vs-seh
-
 let
  inherit (stdenv)
    hostPlatform
@@ -70,6 +61,10 @@ let
        if targetPackages.stdenv.cc.bintools.isLLVM then binutils else targetPackages.stdenv.cc.bintools
      }/bin/${targetPlatform.config}-as"
    ]
+    ++ lib.optionals (crossMingw && targetPlatform.isx86_32) [
+      "--disable-sjlj-exceptions"
+      "--with-dwarf2"
+    ]
    ++ (
      if withoutTargetLibc then
        [
@@ -102,11 +97,6 @@ let
          # To keep ABI compatibility with upstream mingw-w64
          "--enable-fully-dynamic-string"
        ]
-        ++ lib.optionals (crossMingw && targetPlatform.isx86_32) [
-          # See Note [Windows Exception Handling]
-          "--enable-sjlj-exceptions"
-          "--with-dwarf2"
-        ]
      else
        [
          (
--- a/pkgs/development/cuda-modules/_cuda/db/bootstrap/nvcc.nix
+++ b/pkgs/development/cuda-modules/_cuda/db/bootstrap/nvcc.nix
@@ -304,7 +304,7 @@
    };

    # No changes from 13.2 to 13.3
-    # https://docs.nvidia.com/cuda/cuda-installation-guide-linux/index.html#host-compiler-support-policy
+    # https://docs.nvidia.com/cuda/archive/13.3.0/cuda-installation-guide-linux/index.html#host-compiler-support-policy
    "13.3" = {
      clang = {
        maxMajorVersion = "21";
@@ -315,5 +315,18 @@
        minMajorVersion = "6";
      };
    };
+
+    # 13.3 to 13.4 adds support for Clang 22 and GCC 16
+    # https://docs.nvidia.com/cuda/cuda-installation-guide-linux/index.html#host-compiler-support-policy
+    "13.4" = {
+      clang = {
+        maxMajorVersion = "22";
+        minMajorVersion = "7";
+      };
+      gcc = {
+        maxMajorVersion = "16";
+        minMajorVersion = "6";
+      };
+    };
  };
 }
--- a/pkgs/development/cuda-modules/_cuda/manifests/cuda/redistrib_13.4.1.json
+++ b/pkgs/development/cuda-modules/_cuda/manifests/cuda/redistrib_13.4.1.json
--- a/pkgs/development/cuda-modules/packages/cccl.nix
+++ b/pkgs/development/cuda-modules/packages/cccl.nix
@@ -37,7 +37,7 @@ buildRedist {
        hash = "sha256-hYfMFsd7Y8CwuNGaPYG6uEB+lg1TmWSIIU5ToVMULKY=";
      })
    ]
-    ++ lib.optionals (cudaAtLeast "13.2") [
+    ++ lib.optionals (cudaAtLeast "13.2" && cudaOlder "13.4") [
      # Fix onnxruntime compilation error: https://github.com/microsoft/onnxruntime/issues/28023
      # Backport: https://github.com/NVIDIA/cccl/pull/8771
      (fetchpatch {
--- a/pkgs/development/ocaml-modules/brr/default.nix
+++ b/pkgs/development/ocaml-modules/brr/default.nix
@@ -12,10 +12,10 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ocaml${ocaml.version}-brr";
-  version = "0.0.8";
+  version = "0.0.9";
  src = fetchurl {
    url = "https://erratique.ch/software/brr/releases/brr-${finalAttrs.version}.tbz";
-    hash = "sha256-g4ROHy9rHlaEFi5+euyRuEKK5HwKJWPmFkdvFhdIYgg=";
+    hash = "sha256-Zuh+DRpGxB8DxrLnLyf8Ok+YJDQwWiaI59HlZKdD4Jk=";
  };
  buildInputs = [
    ocaml
--- a/pkgs/development/python-modules/cliff/default.nix
+++ b/pkgs/development/python-modules/cliff/default.nix
@@ -3,7 +3,7 @@
  buildPythonPackage,
  fetchPypi,
  autopage,
-  cmd2,
+  cmd2_4,
  openstackdocstheme,
  pbr,
  prettytable,
@@ -15,12 +15,12 @@

 buildPythonPackage rec {
  pname = "cliff";
-  version = "4.15.0";
+  version = "4.16.0";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-7KaZ9rOQx1Xm7RgWp2zfwav19e99HO4Z84M2Z6Oh/jk=";
+    hash = "sha256-hTFK1JvWL5ClEJTU4xsctNO5L7g8s5Ne66AjbDKDnnU=";
  };

  build-system = [
@@ -33,7 +33,7 @@ buildPythonPackage rec {

  dependencies = [
    autopage
-    cmd2
+    cmd2_4
    prettytable
    pyyaml
    stevedore
--- a/pkgs/development/python-modules/cliff/tests.nix
+++ b/pkgs/development/python-modules/cliff/tests.nix
@@ -2,7 +2,7 @@
  buildPythonPackage,
  cliff,
  sphinx,
-  stestr,
+  stestrCheckHook,
 }:

 buildPythonPackage {
@@ -22,10 +22,6 @@ buildPythonPackage {
  nativeCheckInputs = [
    cliff
    sphinx
-    stestr
+    stestrCheckHook
  ];
-
-  checkPhase = ''
-    stestr run
-  '';
 }
--- a/pkgs/development/python-modules/cmd2_4/default.nix
+++ b/pkgs/development/python-modules/cmd2_4/default.nix
@@ -0,0 +1,69 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  glibcLocales,
+  prompt-toolkit,
+  pyperclip,
+  pytest-cov-stub,
+  pytest-mock,
+  pytestCheckHook,
+  rich,
+  rich-argparse,
+  setuptools-scm,
+  stdenv,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "cmd2";
+  version = "4.2.4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "python-cmd2";
+    repo = "cmd2";
+    tag = finalAttrs.version;
+    hash = "sha256-htU0/cFg157tOWBdLwNvnHwvoXizJUIBcp2jgzFqQrQ=";
+  };
+
+  pythonRelaxDeps = [ "prompt-toolkit" ];
+
+  build-system = [ setuptools-scm ];
+
+  dependencies = [
+    prompt-toolkit
+    pyperclip
+    rich
+    rich-argparse
+  ];
+
+  doCheck = true;
+
+  nativeCheckInputs = [
+    glibcLocales
+    pytestCheckHook
+    pytest-cov-stub
+    pytest-mock
+  ];
+
+  disabledTests = [
+    # Don't require an editor just to be able to discover it
+    "test_find_editor_not_specified"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # does not work under darwin sandbox
+    "test_history_file_bad_compression"
+    "test_history_file_bad_json"
+    "test_path_completion_complete_user"
+  ];
+
+  pythonImportsCheck = [ "cmd2" ];
+
+  meta = {
+    description = "Enhancements for standard library's cmd module";
+    homepage = "https://github.com/python-cmd2/cmd2";
+    changelog = "https://github.com/python-cmd2/cmd2/releases/tag/${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ teto ];
+  };
+})
--- a/pkgs/development/python-modules/indicio/default.nix
+++ b/pkgs/development/python-modules/indicio/default.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitea,
+
+  # build-system
+  uv-build,
+
+  # tests
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "indicio";
+  version = "1.1.0";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "victorpoughon";
+    repo = "indicio";
+    tag = finalAttrs.version;
+    hash = "sha256-F2afc+Gi1EPxJYfvcIRdiCKpqTObxtU/ae6Y7qijw9Q=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "uv_build>=0.10.9,<0.11.0" "uv_build"
+  '';
+
+  build-system = [
+    uv-build
+  ];
+
+  pythonImportsCheck = [
+    "indicio"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "Python interface to refractiveindex.info";
+    longDescription = ''
+      Indicio is a python package that provides offline access to the
+      refractiveindex.info database of optical constants.
+    '';
+    homepage = "https://codeberg.org/victorpoughon/indicio";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ eljamm ];
+    teams = with lib.teams; [ ngi ];
+  };
+})
--- a/pkgs/development/python-modules/jupyter-collaboration/default.nix
+++ b/pkgs/development/python-modules/jupyter-collaboration/default.nix
@@ -24,7 +24,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "jupyter-collaboration";
-  version = "5.0.0";
+  version = "5.0.2";
  pyproject = true;
  __structuredAttrs = true;

@@ -32,7 +32,7 @@ buildPythonPackage (finalAttrs: {
    owner = "jupyterlab";
    repo = "jupyter-collaboration";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Gho8ndF8SU1AWJUlcuw2a/kHD2zu7vH/z4QV8drDrP0=";
+    hash = "sha256-cGCM4kkBwOaXcGWuihOglLsjTKpTrejhwzYVE1g9jBI=";
  };

  sourceRoot = "${finalAttrs.src.name}/projects/jupyter-collaboration";
--- a/pkgs/development/python-modules/keystoneauth1/default.nix
+++ b/pkgs/development/python-modules/keystoneauth1/default.nix
@@ -17,7 +17,7 @@
  requests-kerberos,
  requests-mock,
  setuptools,
-  stestr,
+  stestrCheckHook,
  stevedore,
  testresources,
  testtools,
@@ -26,12 +26,12 @@

 buildPythonPackage rec {
  pname = "keystoneauth1";
-  version = "5.15.0";
+  version = "5.17.0";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-ziys39Ao5lvSP/QD1lcuv6s7AG1tLd46qFwmNnWp+7U=";
+    hash = "sha256-gjWazCDHVPyyKBjgkOL+pkfkxcETemrdtJhOn7pwirM=";
  };

  build-system = [ setuptools ];
@@ -63,16 +63,12 @@ buildPythonPackage rec {
    oslo-utils
    pycodestyle
    requests-mock
-    stestr
+    stestrCheckHook
    testresources
    testtools
  ]
  ++ lib.concatAttrValues optional-dependencies;

-  checkPhase = ''
-    stestr run
-  '';
-
  pythonImportsCheck = [ "keystoneauth1" ];

  meta = {
--- a/pkgs/development/python-modules/mlflow-skinny/default.nix
+++ b/pkgs/development/python-modules/mlflow-skinny/default.nix
@@ -8,6 +8,7 @@
  setuptools,

  # dependencies
+  anyio,
  cachetools,
  click,
  cloudpickle,
@@ -40,7 +41,7 @@ buildPythonPackage (finalAttrs: {
    owner = "mlflow";
    repo = "mlflow";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-G5PybKonwsAg1MLOF9wc10RJE0x948+EVbcDq1+94mc=";
+    hash = "sha256-2nWu+P9bGAl+1p3ZfxO2XdBMrfePJI6EBk82r99w480=";
  };

  postPatch = ''
@@ -55,6 +56,7 @@ buildPythonPackage (finalAttrs: {
  build-system = [ setuptools ];

  dependencies = [
+    anyio
    cachetools
    click
    cloudpickle
--- a/pkgs/development/python-modules/mlflow-tracing/default.nix
+++ b/pkgs/development/python-modules/mlflow-tracing/default.nix
@@ -27,7 +27,7 @@ buildPythonPackage (finalAttrs: {
    owner = "mlflow";
    repo = "mlflow";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-G5PybKonwsAg1MLOF9wc10RJE0x948+EVbcDq1+94mc=";
+    hash = "sha256-2nWu+P9bGAl+1p3ZfxO2XdBMrfePJI6EBk82r99w480=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/mlflow/default.nix
+++ b/pkgs/development/python-modules/mlflow/default.nix
@@ -6,6 +6,7 @@
  # dependencies
  aiohttp,
  alembic,
+  anyio,
  cryptography,
  docker,
  flask,
@@ -27,7 +28,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "mlflow";
-  version = "3.15.2";
+  version = "3.16.0";
  format = "wheel";
  __structuredAttrs = true;

@@ -39,7 +40,7 @@ buildPythonPackage (finalAttrs: {
    format = "wheel";
    dist = "py3";
    python = "py3";
-    hash = "sha256-eqWWZDUaqm9jR4zzwml3wYXbpg0ovKi5pRJb46K0MRw=";
+    hash = "sha256-xKxehjSqytGj19WhoxvpJ5WT69SLhCcoQ2gtsRlwz3E=";
  };

  # Nix-wrapped python populates sys.path via NIX_PYTHONPATH/site hooks,
@@ -50,17 +51,10 @@ buildPythonPackage (finalAttrs: {
    patch -p1 -d "$out/lib/python"*/site-packages < ${./subprocess-pythonpath.patch}
  '';

-  pythonRelaxDeps = [
-    "cryptography"
-
-    # 3.14.0 dependency check fails with pandas >= 3.0. But the code changes required are minimal
-    # (strings are now `str` instead of `numpy.object`.)
-    "pandas"
-  ];
-
  dependencies = [
    aiohttp
    alembic
+    anyio
    cryptography
    docker
    flask
--- a/pkgs/development/python-modules/openstacksdk/default.nix
+++ b/pkgs/development/python-modules/openstacksdk/default.nix
@@ -25,14 +25,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "openstacksdk";
-  version = "4.13.0";
+  version = "4.20.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "openstack";
    repo = "openstacksdk";
    tag = finalAttrs.version;
-    hash = "sha256-nMpUNLz7OosoGd5rozWcOcOEf3jdEHo5dhxmOv0xONw=";
+    hash = "sha256-5a4BIbdgAauq8dRBhY+8X2Y90HkGxN3X2VXa6iU0e1E=";
  };

  patches = [
@@ -93,7 +93,7 @@ buildPythonPackage (finalAttrs: {
  ];

  meta = {
-    description = "SDK for building applications to work with OpenStack clouds.";
+    description = "SDK for building applications to work with OpenStack clouds";
    mainProgram = "openstack";
    homepage = "https://docs.openstack.org/openstacksdk/latest/";
    downloadPage = "https://github.com/openstack/openstacksdk/releases/tag/${finalAttrs.src.tag}";
--- a/pkgs/development/python-modules/openstacksdk/fix-pyproject.patch
+++ b/pkgs/development/python-modules/openstacksdk/fix-pyproject.patch
@@ -1,8 +1,8 @@
 diff --git a/pyproject.toml b/pyproject.toml
-index 7c1c1ce58..4e9f3a493 100644
+index bb15ab443..2bc46d2dc 100644
 --- a/pyproject.toml
 +++ b/pyproject.toml
-@@ -33,8 +33,12 @@ Repository = "https://opendev.org/openstack/openstacksdk/"
+@@ -85,6 +85,9 @@ Repository = "https://opendev.org/openstack/openstacksdk/"
 # TODO(mordred) Move this to an OSC command at some point
 openstack-inventory = "openstack.cloud.cmd.inventory:main"
 
@@ -10,10 +10,5 @@ index 7c1c1ce58..4e9f3a493 100644
 +"*" = ["**/*"]
 +
 [tool.setuptools.packages.find]
-include = ["openstack"]
-+where = ["."]
-+include = ["openstack", "openstack.*"]
+ include = ["openstack*"]
 
- [tool.mypy]
- python_version = "3.11"
-
--- a/pkgs/development/python-modules/openstacksdk/tests.nix
+++ b/pkgs/development/python-modules/openstacksdk/tests.nix
@@ -1,15 +1,16 @@
 {
  buildPythonPackage,
-  stestrCheckHook,
  ddt,
  hacking,
  jsonschema,
+  keyring,
  openstacksdk,
  oslo-config,
  oslotest,
  prometheus-client,
  requests-mock,
-  stestr,
+  statsd,
+  stestrCheckHook,
  testscenarios,
 }:

@@ -22,44 +23,35 @@ buildPythonPackage {
  dontInstall = true;

  nativeCheckInputs = [
-    stestrCheckHook
    ddt
    hacking
    jsonschema
+    keyring
    openstacksdk
    oslo-config
    oslotest
    prometheus-client
    requests-mock
-    stestr
+    statsd
+    stestrCheckHook
    testscenarios
  ];

  disabledTests = [
-    "openstack.tests.unit.config.test_config.TestConfig.test_force_ipv4_false"
    "openstack.tests.unit.cloud.test_volume_backups.TestVolumeBackups.test_delete_volume_backup_force"
-    "openstack.tests.unit.cloud.test_volume_backups.TestVolumeBackups.test_delete_volume_backup_wait"
-    "openstack.tests.unit.cloud.test_volume_backups.TestVolumeBackups.test_delete_volume_backup_force"
-    "openstack.tests.unit.cloud.test_volume_backups.TestVolumeBackups.test_delete_volume_backup_wait"
-    "openstack.tests.unit.image.v2.test_proxy.TestTask.test_wait_for_task_wait"
    "openstack.tests.unit.image.v2.test_proxy.TestTask.test_wait_for_task_error_396"
-    "openstack.tests.unit.test_resource.TestWaitForDelete.test_success_not_found"
-    "openstack.tests.unit.test_resource.TestWaitForDelete.test_status"
+    "openstack.tests.unit.image.v2.test_proxy.TestTask.test_wait_for_task_wait"
    "openstack.tests.unit.test_resource.TestWaitForDelete.test_callback"
+    "openstack.tests.unit.test_resource.TestWaitForDelete.test_callback_without_progress"
+    "openstack.tests.unit.test_resource.TestWaitForDelete.test_status"
+    "openstack.tests.unit.test_resource.TestWaitForDelete.test_success_not_found"
    "openstack.tests.unit.test_resource.TestWaitForStatus.test_callback"
    "openstack.tests.unit.test_resource.TestWaitForStatus.test_callback_without_progress"
-    "openstack.tests.unit.test_resource.TestWaitForStatus.test_status_match"
-    "openstack.tests.unit.test_resource.TestWaitForStatus.test_status_match_none"
-    "openstack.tests.unit.test_resource.TestWaitForStatus.test_status_match_with_none"
-    "openstack.tests.unit.test_resource.TestWaitForStatus.test_status_match_different_attribute"
    "openstack.tests.unit.test_resource.TestWaitForStatus.test_status_fails"
    "openstack.tests.unit.test_resource.TestWaitForStatus.test_status_fails_different_attribute"
-    "openstack.tests.unit.test_stats.TestStats.test_servers"
-    "openstack.tests.unit.test_stats.TestStats.test_servers_error"
-    "openstack.tests.unit.test_stats.TestStats.test_servers_no_detail"
-    "openstack.tests.unit.test_stats.TestStats.test_projects"
-    "openstack.tests.unit.test_stats.TestStats.test_list_projects"
-    "openstack.tests.unit.test_stats.TestStats.test_timeout"
+    "openstack.tests.unit.test_resource.TestWaitForStatus.test_status_match"
+    "openstack.tests.unit.test_resource.TestWaitForStatus.test_status_match_different_attribute"
+    "openstack.tests.unit.test_resource.TestWaitForStatus.test_status_match_none"
+    "openstack.tests.unit.test_resource.TestWaitForStatus.test_status_match_with_none"
  ];
-
 }
--- a/pkgs/development/python-modules/osc-lib/default.nix
+++ b/pkgs/development/python-modules/osc-lib/default.nix
@@ -12,26 +12,22 @@
  requests-mock,
  setuptools,
  stdenv,
-  stestr,
+  stestrCheckHook,
  stevedore,
 }:

 buildPythonPackage rec {
  pname = "osc-lib";
-  version = "4.6.0";
+  version = "4.7.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "openstack";
    repo = "osc-lib";
    tag = version;
-    hash = "sha256-XwOJSd3k/74FvSZGveSTjH+KGLlQ2jNbk8GrTzFhbL0=";
+    hash = "sha256-GVjzDPmASEItGsZCjH+tjgP8bRf5WgEOoDr+uOhQtws=";
  };

-  patches = [
-    ./fix-pyproject.diff
-  ];
-
  env.PBR_VERSION = version;

  build-system = [
@@ -51,23 +47,15 @@ buildPythonPackage rec {

  nativeCheckInputs = [
    requests-mock
-    stestr
+    stestrCheckHook
  ];

-  checkPhase =
-    let
-      disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
-        "osc_lib.tests.test_shell.TestShellCli.test_shell_args_cloud_public"
-        "osc_lib.tests.test_shell.TestShellCli.test_shell_args_precedence"
-        "osc_lib.tests.test_shell.TestShellCliPrecedence.test_shell_args_precedence_1"
-        "osc_lib.tests.test_shell.TestShellCliPrecedence.test_shell_args_precedence_2"
-      ];
-    in
-    ''
-      runHook preCheck
-      stestr run -e <(echo "${lib.concatStringsSep "\n" disabledTests}")
-      runHook postCheck
-    '';
+  disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
+    "osc_lib.tests.test_shell.TestShellCli.test_shell_args_cloud_public"
+    "osc_lib.tests.test_shell.TestShellCli.test_shell_args_precedence"
+    "osc_lib.tests.test_shell.TestShellCliPrecedence.test_shell_args_precedence_1"
+    "osc_lib.tests.test_shell.TestShellCliPrecedence.test_shell_args_precedence_2"
+  ];

  pythonImportsCheck = [
    "osc_lib"
--- a/pkgs/development/python-modules/osc-lib/fix-pyproject.diff
+++ b/pkgs/development/python-modules/osc-lib/fix-pyproject.diff
@@ -1,18 +0,0 @@
-diff --git a/pyproject.toml b/pyproject.toml
-index 34680b2..95f573c 100644
--- a/pyproject.toml
-+++ b/pyproject.toml
-@@ -37,10 +37,9 @@ test = [
-     "testtools>=2.2.0",  # MIT
- ]
- 
-[tool.setuptools]
-packages = [
-    "osc_lib"
-]
-+[tool.setuptools.packages.find]
-+where = ["."]
-+include = ["osc_lib*"]
- 
- [tool.mypy]
- show_column_numbers = true
--- a/pkgs/development/python-modules/python-manilaclient/tests.nix
+++ b/pkgs/development/python-modules/python-manilaclient/tests.nix
@@ -5,7 +5,7 @@
  python-manilaclient,
  python-openstackclient,
  requests-mock,
-  stestr,
+  stestrCheckHook,
  tempest,
  testtools,
 }:
@@ -24,12 +24,8 @@ buildPythonPackage {
    python-manilaclient
    python-openstackclient
    requests-mock
-    stestr
+    stestrCheckHook
    tempest
    testtools
  ];
-
-  checkPhase = ''
-    stestr run
-  '';
 }
--- a/pkgs/development/python-modules/python-openstackclient/default.nix
+++ b/pkgs/development/python-modules/python-openstackclient/default.nix
@@ -11,7 +11,6 @@
  pbr,
  aodhclient,
  python-barbicanclient,
-  python-cinderclient,
  python-designateclient,
  python-heatclient,
  python-ironicclient,
@@ -36,20 +35,16 @@

 buildPythonPackage (finalAttrs: {
  pname = "python-openstackclient";
-  version = "10.0.0";
+  version = "10.3.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "openstack";
    repo = "python-openstackclient";
    tag = finalAttrs.version;
-    hash = "sha256-UczEgOtZz4roIFg1R6RDGg0tiiiT6lAgJCdgpmK0960=";
+    hash = "sha256-xOvDAwnJGYbMJDG+lO1TCLRFavlciJRVmbjYqU/E1DY=";
  };

-  patches = [
-    ./fix-pyproject.patch
-  ];
-
  env.PBR_VERSION = finalAttrs.version;

  build-system = [
@@ -64,7 +59,7 @@ buildPythonPackage (finalAttrs: {
  dependencies = [
    osc-lib
    pbr
-    python-cinderclient
+    python-manilaclient
    python-keystoneclient
    requests
  ]
@@ -99,16 +94,20 @@ buildPythonPackage (finalAttrs: {
    # See https://github.com/openstack/python-openstackclient/blob/master/doc/source/contributor/plugins.rst
    cli-plugins = [
      aodhclient
+      # gnocchiclient not packaged
      osc-placement
      python-barbicanclient
+      # python-cyborgclient not packaged
      python-designateclient
      python-heatclient
      python-ironicclient
+      # python-ironic-inspector-client not packaged
      python-magnumclient
      python-manilaclient
      python-mistralclient
      python-neutronclient
      python-octaviaclient
+      # python-troveclient not packaged
      python-watcherclient
      python-zaqarclient
      python-zunclient
--- a/pkgs/development/python-modules/python-openstackclient/fix-pyproject.patch
+++ b/pkgs/development/python-modules/python-openstackclient/fix-pyproject.patch
@@ -1,13 +0,0 @@
-diff --git a/pyproject.toml b/pyproject.toml
-index 50d90b4c..b256bb2a 100644
--- a/pyproject.toml
-+++ b/pyproject.toml
-@@ -776,7 +776,7 @@ volume_summary = "openstackclient.volume.v3.volume:VolumeSummary"
- volume_revert = "openstackclient.volume.v3.volume:VolumeRevertToSnapshot"
- 
- [tool.setuptools.packages.find]
-include = ["openstackclient"]
-+include = ["openstackclient", "openstackclient.*"]
- 
- [tool.mypy]
- python_version = "3.11"
--- a/pkgs/development/python-modules/servestatic/default.nix
+++ b/pkgs/development/python-modules/servestatic/default.nix
@@ -0,0 +1,49 @@
+{
+  buildPythonPackage,
+  lib,
+  fetchFromGitHub,
+  hatchling,
+  asgiref,
+  brotli,
+  django,
+  httpx,
+  pytestCheckHook,
+  pytest-timeout,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "servestatic";
+  version = "4.3.4";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "Archmonger";
+    repo = "ServeStatic";
+    tag = "${finalAttrs.version}";
+    hash = "sha256-zm6wR+LZkmdooB9lXY8EVAhatd2eRMmBtHpV6Z7+Ey0=";
+  };
+
+  build-system = [ hatchling ];
+
+  dependencies = [ asgiref ];
+
+  nativeCheckInputs = [
+    brotli
+    django
+    httpx
+    pytestCheckHook
+    pytest-timeout
+  ];
+
+  disabledTests = [
+    # does not work when testing at epoch
+    "test_modified"
+  ];
+
+  meta = {
+    description = "Production-grade Python static file server. Middleware or standalone.";
+    homepage = "https://github.com/Archmonger/ServeStatic";
+    maintainers = with lib.maintainers; [ ma27 ];
+    license = lib.licenses.mit;
+  };
+})
--- a/pkgs/development/python-modules/spacy/default.nix
+++ b/pkgs/development/python-modules/spacy/default.nix
@@ -135,6 +135,10 @@ buildPythonPackage (finalAttrs: {
    #   assert eval["nel_macro_f"] > 0
    #   assert 0.0 > 0
    "test_overfitting_IO_with_ner"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # AssertionError: assert 'V' == 'N'
+    "test_tok2vec_frozen_overfitting"
  ];

  pythonImportsCheck = [ "spacy" ];
--- a/pkgs/development/python-modules/stevedore/default.nix
+++ b/pkgs/development/python-modules/stevedore/default.nix
@@ -9,12 +9,12 @@

 buildPythonPackage rec {
  pname = "stevedore";
-  version = "5.9.0";
+  version = "5.9.1";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-q70K96OKi7sdat6i41sXYJzwBOqsMj6IqNiWNkDdKzw=";
+    hash = "sha256-6XomZ5I+/akm6HE/3mpzYW32ghCjy8bwK0iWe2dv2L8=";
  };

  build-system = [
--- a/pkgs/development/python-modules/stevedore/tests.nix
+++ b/pkgs/development/python-modules/stevedore/tests.nix
@@ -1,7 +1,7 @@
 {
  buildPythonPackage,
  sphinx,
-  stestr,
+  stestrCheckHook,
  stevedore,
 }:

@@ -15,13 +15,7 @@ buildPythonPackage {

  nativeCheckInputs = [
    sphinx
-    stestr
+    stestrCheckHook
    stevedore
  ];
-
-  checkPhase = ''
-    runHook preCheck
-    stestr run
-    runHook postCheck
-  '';
 }
--- a/pkgs/development/python-modules/sweeps/default.nix
+++ b/pkgs/development/python-modules/sweeps/default.nix
@@ -0,0 +1,93 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  jsonref,
+  jsonschema,
+  numpy,
+  pydantic,
+  pyyaml,
+  scikit-learn,
+  scipy,
+
+  # tests
+  pytest-xdist,
+  pytestCheckHook,
+  writableTmpDirAsHomeHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "sweeps";
+  version = "0.2.0";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "wandb";
+    repo = "sweeps";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-QqtyYpPChPNFN+3Rlpp1x1H0FFgxHPO3zFGcY6Pl24A=";
+  };
+
+  # Requires unpackaged pytest-profiling
+  postPatch = ''
+    substituteInPlace pytest.ini \
+      --replace-fail "--profile" ""
+  '';
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    jsonref
+    jsonschema
+    numpy
+    pydantic
+    pyyaml
+    scikit-learn
+    scipy
+  ];
+
+  pythonImportsCheck = [ "sweeps" ];
+
+  nativeCheckInputs = [
+    pytest-xdist
+    pytestCheckHook
+    writableTmpDirAsHomeHook
+  ];
+
+  disabledTests = [
+    # AssertionError: assert [] == [SweepRun(nam...running=None)]
+    "test_5runs_band1_stop_2"
+    "test_5runs_band1_stop_2_1stnoband"
+    "test_eta_3"
+    "test_eta_3_max"
+
+    # AssertionError: assert [] == [10, 6, 1]
+    "test_skipped_steps"
+
+    # ValueError: Cannot extract metric loss from run
+    "test_runs_bayes_runs2"
+
+    # KeyError: 'loss is not a summary metric of this run.'
+    "test_summary_metric_none"
+
+    # AssertionError: Not equal to tolerance rtol=1e-07, atol=0.01
+    "test_bayes_impute_best"
+    "test_bayes_impute_latest"
+  ];
+
+  meta = {
+    description = "W&B Hyperparameter Sweep Engine";
+    homepage = "https://github.com/wandb/sweeps";
+    changelog = "https://github.com/wandb/sweeps/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ GaetanLepage ];
+  };
+})
--- a/pkgs/development/python-modules/tlmviewer/default.nix
+++ b/pkgs/development/python-modules/tlmviewer/default.nix
@@ -0,0 +1,61 @@
+{
+  lib,
+  buildPythonPackage,
+  torchlensmaker,
+
+  # build-system
+  uv-build,
+
+  # tests
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "tlmviewer";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  inherit (torchlensmaker)
+    version
+    src
+    ;
+
+  sourceRoot = "${finalAttrs.src.name}/tlmviewer-python";
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "uv_build>=0.10.9,<0.11.0" "uv_build"
+  '';
+
+  build-system = [
+    uv-build
+  ];
+
+  pythonImportsCheck = [
+    "tlmviewer"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  disabledTests = [
+    # Require connection to tlmserver (http://127.0.0.1:8765/push)
+    # TODO: package tlmserver?
+    "test_push_raises_connection_refused_when_unreachable"
+    "test_allow_fail_silences_http_error"
+    "test_allow_fail_not_set_still_raises"
+  ];
+
+  meta = {
+    description = "3D optical scene viewer for torchlensmaker";
+
+    inherit (torchlensmaker.meta)
+      homepage
+      changelog
+      license
+      maintainers
+      teams
+      ;
+  };
+})
--- a/pkgs/development/python-modules/torchimplicit/default.nix
+++ b/pkgs/development/python-modules/torchimplicit/default.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  buildPythonPackage,
+  torchlensmaker,
+
+  # build-system
+  uv-build,
+
+  # dependencies
+  torch,
+
+  # tests
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "torchimplicit";
+  version = "0.1.0";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  inherit (torchlensmaker)
+    src
+    ;
+
+  sourceRoot = "${finalAttrs.src.name}/torchimplicit";
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "uv_build>=0.10.9,<0.11.0" "uv_build"
+  '';
+
+  build-system = [
+    uv-build
+  ];
+
+  dependencies = [
+    torch
+  ];
+
+  pythonImportsCheck = [
+    "torchimplicit"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "Implicit 2D and 3D surfaces in PyTorch";
+
+    inherit (torchlensmaker.meta)
+      homepage
+      changelog
+      license
+      maintainers
+      teams
+      ;
+  };
+})
--- a/pkgs/development/python-modules/torchlensmaker/default.nix
+++ b/pkgs/development/python-modules/torchlensmaker/default.nix
@@ -0,0 +1,112 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildPythonPackage,
+
+  # build-system
+  hatchling,
+
+  # dependencies
+  indicio,
+  ipython,
+  jaxtyping,
+  matplotlib,
+  tlmviewer,
+  torchimplicit,
+
+  # tests
+  onnxruntime,
+  onnxscript,
+  pytestCheckHook,
+
+  # passthru
+  callPackage,
+  python,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "torchlensmaker";
+  version = "0.0.14";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "victorpoughon";
+    repo = "torchlensmaker";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-B9gjBo8piV9wNIDhV0YWV3nBtCgZlcMZ22KJ92Wn3lc=";
+  };
+
+  sourceRoot = "${finalAttrs.src.name}/torchlensmaker";
+
+  postPatch = ''
+    # Fix Jupyter widget: unpkg serves the UMD build for the bare URL,
+    # which has no ESM default export. Point at the ES module bundle and
+    # defend against a missing default export.
+    substituteInPlace src/torchlensmaker/viewer/script_template.js \
+      --replace-fail \
+        'https://unpkg.com/tlmviewer@''${version}' \
+        'https://unpkg.com/tlmviewer@''${version}/dist/tlmviewer-''${version}.es.js' \
+      --replace-fail \
+        'const tlmviewer = module.default;' \
+        'const tlmviewer = module.default ?? module;'
+  '';
+
+  build-system = [
+    hatchling
+  ];
+
+  dependencies = [
+    indicio
+    ipython
+    jaxtyping
+    matplotlib
+    tlmviewer
+    torchimplicit
+  ];
+
+  pythonRelaxDeps = [
+    "matplotlib"
+  ];
+
+  pythonImportsCheck = [
+    "torchlensmaker"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    onnxruntime
+    onnxscript
+  ];
+
+  passthru = {
+    tests = callPackage ./tests { };
+
+    # nix-shell -A python3Packages.torchlensmaker.pyEnv
+    pyEnv = python.withPackages (
+      ps: with ps; [
+        ipython
+        jupyter
+        torchlensmaker
+      ]
+    );
+  };
+
+  meta = {
+    description = "Python library for modeling and designing optical systems";
+    longDescription = ''
+      Torch Lens Maker is an open-source Python library for differentiable
+      geometric optics based on [PyTorch](https://pytorch.org/).
+
+      The goal of the project is to be able to design complex real-world
+      optical systems (lenses, mirrors, etc.) using modern computer code and
+      state-of-the art numerical optimization.
+    '';
+    homepage = "https://github.com/victorpoughon/torchlensmaker";
+    changelog = "https://github.com/victorpoughon/torchlensmaker/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.gpl3Only;
+    platforms = lib.platforms.all;
+    maintainers = with lib.maintainers; [ eljamm ];
+    teams = with lib.teams; [ ngi ];
+  };
+})
--- a/pkgs/development/python-modules/torchlensmaker/tests/default.nix
+++ b/pkgs/development/python-modules/torchlensmaker/tests/default.nix
@@ -0,0 +1,15 @@
+{
+  runCommand,
+  torchlensmaker,
+}:
+
+runCommand "test-torchlensmaker"
+  {
+    nativeBuildInputs = [
+      torchlensmaker.pyEnv
+    ];
+  }
+  ''
+    python ${./landscape.py}
+    mv landscape.json $out
+  ''
--- a/pkgs/development/python-modules/torchlensmaker/tests/landscape.py
+++ b/pkgs/development/python-modules/torchlensmaker/tests/landscape.py
@@ -0,0 +1,21 @@
+import torchlensmaker as tlm
+
+optics = tlm.Sequential(
+    tlm.ObjectAtInfinity(beam_diameter=10, angular_size=20),
+    tlm.Gap(15),
+    tlm.RefractiveSurface(
+        tlm.SphereByCurvature(diameter=25, C=1 / -45.0), materials=("air", "BK7")
+    ),
+    tlm.Gap(3),
+    tlm.RefractiveSurface(
+        tlm.SphereByCurvature(diameter=25, C=tlm.parameter(1 / -20)),
+        materials=("BK7", "air"),
+    ),
+    tlm.Gap(100),
+    tlm.ImagePlane(50),
+)
+
+tlm.simple_optimize(optics, tlm.optim.Adam(optics.parameters(), lr=5e-4), 100)
+
+tlm.show2d(optics, title="Landscape Lens")
+tlm.export_json(optics, "landscape.json", dim=2, title="Landscape Lens")
--- a/pkgs/development/python-modules/wandb/default.nix
+++ b/pkgs/development/python-modules/wandb/default.nix
@@ -25,13 +25,14 @@
  # dependencies
  click,
  opentelemetry-api,
+  opentelemetry-exporter-otlp-proto-http,
+  opentelemetry-sdk,
  packaging,
  platformdirs,
  protobuf,
  pydantic,
  pyyaml,
  requests,
-  sentry-sdk,
  setproctitle,
  typing-extensions,
  xxhash,
@@ -73,6 +74,7 @@
  responses,
  scikit-learn,
  soundfile,
+  sweeps,
  tenacity,
  torch,
  torchvision,
@@ -80,12 +82,12 @@
 }:

 let
-  version = "0.29.0";
+  version = "0.30.0";
  src = fetchFromGitHub {
    owner = "wandb";
    repo = "wandb";
    tag = "v${version}";
-    hash = "sha256-5YkJB5uS9GalNKL+MPf5GVQX/jgWM62nxMVmdnzOXGs=";
+    hash = "sha256-4ccIM8bXbz8IkZeMBdr5zqoG7IxwwW8lb/VKIOOJWeE=";
  };

  wandb-xpu = rustPlatform.buildRustPackage {
@@ -95,7 +97,7 @@ let

    sourceRoot = "${src.name}/xpu";

-    cargoHash = "sha256-YKuXtttLam4NmJsJPQH8sFbj1Qs5Gc2uoFJEvTYxkew=";
+    cargoHash = "sha256-arb96ajbju/CeAglgvTjD5/omrEpigEORjXVAVSSV2Q=";

    checkFlags = [
      # fails in sandbox
@@ -239,13 +241,14 @@ buildPythonPackage (finalAttrs: {
  dependencies = [
    click
    opentelemetry-api
+    opentelemetry-exporter-otlp-proto-http
+    opentelemetry-sdk
    packaging
    platformdirs
    protobuf
    pydantic
    pyyaml
    requests
-    sentry-sdk
    setproctitle
    typing-extensions
    xxhash
@@ -291,11 +294,12 @@ buildPythonPackage (finalAttrs: {
    responses
    scikit-learn
    soundfile
+    sweeps
    tenacity
-    versionCheckHook
    torch
    torchvision
    tqdm
+    versionCheckHook
    writableTmpDirAsHomeHook
  ];

@@ -308,9 +312,6 @@ buildPythonPackage (finalAttrs: {
    # Require docker access
    "tests/system_tests"

-    # broke somewhere between sentry-sdk 2.15.0 and 2.22.0
-    "tests/unit_tests/test_analytics/test_sentry.py"
-
    # Server connection times out under load
    "tests/unit_tests/test_wandb_login.py"

--- a/pkgs/development/tcl-modules/by-name/pg/pgtcl/package.nix
+++ b/pkgs/development/tcl-modules/by-name/pg/pgtcl/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  mkTclDerivation,
+  fetchFromGitHub,
+  autoreconfHook,
+  libpq,
+}:
+
+mkTclDerivation (finalAttrs: {
+  pname = "pgtcl";
+  version = "3.3.0";
+
+  src = fetchFromGitHub {
+    owner = "flightaware";
+    repo = "Pgtcl";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-rvGtQRmbWnvMGfPf7azjAdeVppjthTmFLuROBKZaD+A=";
+  };
+
+  # Fix Tcl9 stubs build
+  # https://github.com/flightaware/Pgtcl/pull/62
+  postPatch = ''
+    substituteInPlace generic/pgtcl.c \
+      --replace-fail 'Tcl_InitStubs(interp, "8.1"' 'Tcl_InitStubs(interp, "8.1-"'
+  '';
+
+  nativeBuildInputs = [
+    autoreconfHook
+  ];
+
+  buildInputs = [
+    libpq
+  ];
+
+  env.PG_CONFIG = "${libpq.pg_config}/bin/pg_config";
+
+  tclRequiresCheck = [ "Pgtcl" ];
+
+  meta = {
+    description = "Tcl client side interface to PostgreSQL";
+    homepage = "https://flightaware.github.io/Pgtcl/";
+    changelog = "https://github.com/flightaware/Pgtcl/blob/v${finalAttrs.version}/ChangeLog";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ fgaz ];
+  };
+})
--- a/pkgs/development/tools/electron/0001-Revert-build-stop-shipping-dummy-ANGLE-libs-in-Linux.patch
+++ b/pkgs/development/tools/electron/0001-Revert-build-stop-shipping-dummy-ANGLE-libs-in-Linux.patch
@@ -0,0 +1,58 @@
+From e624b5e2ff50227b78803d46dc1e35ebff1ee297 Mon Sep 17 00:00:00 2001
+From: Yureka <yuka@yuka.dev>
+Date: Sun, 6 Sep 2026 11:03:47 +0200
+Subject: [PATCH] Revert "build: stop shipping dummy ANGLE libs in Linux dist
+ zip (#52226)"
+
+This reverts commit b7b76b1afbfad5e1f1f777161a30a570ef7118a6.
+---
+ electron/build/zip.py                                       | 5 -----
+ electron/script/zip_manifests/dist_zip.linux.arm64.manifest | 2 ++
+ electron/script/zip_manifests/dist_zip.linux.x64.manifest   | 2 ++
+ 3 files changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/electron/build/zip.py b/electron/build/zip.py
+index 94004ff835..4cf7b654c1 100644
+--- a/electron/build/zip.py
+++ b/electron/build/zip.py
+@@ -22,11 +22,6 @@ EXTENSIONS_TO_SKIP = [
+ PATHS_TO_SKIP = [
+   # Skip because it is an output of //ui/gl that we don't need.
+   'angledata',
+-  # Skip because ANGLE is statically linked; these are dummy stubs
+-  # that upstream generates only for Chromium bot infrastructure and nothing
+-  # loads them at runtime. See the TODO(crbug.com/514229803) in ui/gl/BUILD.gn.
+-  './libEGL',
+-  './libGLESv2',
+   # Skip because these are outputs that we don't need.
+   './libVkICD_mock_',
+   # Skip because these are outputs that we don't need.
+diff --git a/electron/script/zip_manifests/dist_zip.linux.arm64.manifest b/electron/script/zip_manifests/dist_zip.linux.arm64.manifest
+index a1ad11ffea..224d2f036d 100644
+--- a/electron/script/zip_manifests/dist_zip.linux.arm64.manifest
+++ b/electron/script/zip_manifests/dist_zip.linux.arm64.manifest
+@@ -6,6 +6,8 @@ chrome_200_percent.pak
+ chrome_crashpad_handler
+ electron
+ icudtl.dat
+libEGL.so
+libGLESv2.so
+ libffmpeg.so
+ libvk_swiftshader.so
+ libvulkan.so.1
+diff --git a/electron/script/zip_manifests/dist_zip.linux.x64.manifest b/electron/script/zip_manifests/dist_zip.linux.x64.manifest
+index a1ad11ffea..224d2f036d 100644
+--- a/electron/script/zip_manifests/dist_zip.linux.x64.manifest
+++ b/electron/script/zip_manifests/dist_zip.linux.x64.manifest
+@@ -6,6 +6,8 @@ chrome_200_percent.pak
+ chrome_crashpad_handler
+ electron
+ icudtl.dat
+libEGL.so
+libGLESv2.so
+ libffmpeg.so
+ libvk_swiftshader.so
+ libvulkan.so.1
+-- 
+2.55.0
+
--- a/pkgs/development/tools/electron/binary/info.json
+++ b/pkgs/development/tools/electron/binary/info.json
@@ -48,5 +48,14 @@
            "x86_64-linux": "633a5ae0c2f35c8ef32126fc4a8ce428e39a5f6834a46a9215a342c74a076532"
        },
        "version": "43.5.1"
+    },
+    "44": {
+        "hashes": {
+            "aarch64-darwin": "076d79742986e1b100b69ebecc691cb07368045e54c9087cef631b8622b76a80",
+            "aarch64-linux": "74b6f18bc29c0d52cf8e963c45d476800419097c6f3d53b27c5df335207e52bb",
+            "headers": "0jz1ybp3y9dmv1v39jixf8nnhypi18kjibr763wz44m1adx7q9x3",
+            "x86_64-linux": "d65286d812719f2b4c1a1b806a80f288a1058c89c7b058dae1e03ab25e499446"
+        },
+        "version": "44.0.0"
    }
 }
--- a/pkgs/development/tools/electron/chromedriver/info.json
+++ b/pkgs/development/tools/electron/chromedriver/info.json
@@ -48,5 +48,14 @@
            "x86_64-linux": "662e9ecc009ea8143a944162e4ab06484aedf9e19cc1582743a3e70f9d5b65e6"
        },
        "version": "43.5.1"
+    },
+    "44": {
+        "hashes": {
+            "aarch64-darwin": "2ae9243bfc24fdb3827200b3f76951dac28bf1145e636ee203730ad6e96989c7",
+            "aarch64-linux": "589c9c395ea373602a48a1329ded0f23e5457d7d5c2d088fb05f89c603cb7d20",
+            "headers": "0jz1ybp3y9dmv1v39jixf8nnhypi18kjibr763wz44m1adx7q9x3",
+            "x86_64-linux": "d7d2c5e90b987d9c1eb917ad4438731d17f1e2f4414fbaa9ed0d3f48f0b3d105"
+        },
+        "version": "44.0.0"
    }
 }
--- a/pkgs/development/tools/electron/common.nix
+++ b/pkgs/development/tools/electron/common.nix
@@ -106,6 +106,13 @@ in

  src = null;

+  patches =
+    base.patches
+    ++
+      # Restore fake libGLESv2.so which is patchelf'd by the chromium derivation
+      lib.optional (lib.versionAtLeast info.version "44")
+        ./0001-Revert-build-stop-shipping-dummy-ANGLE-libs-in-Linux.patch;
+
  postPatch = ''
    mkdir -p third_party/jdk/current/bin

--- a/pkgs/development/tools/electron/info.json
+++ b/pkgs/development/tools/electron/info.json
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1884,6 +1884,7 @@ with pkgs;
    cudaPackages_13_1
    cudaPackages_13_2
    cudaPackages_13_3
+    cudaPackages_13_4
    ;

  cudaPackages_12 = cudaPackages_12_9;
@@ -4749,6 +4750,7 @@ with pkgs;
    electron_41-bin
    electron_42-bin
    electron_43-bin
+    electron_44-bin
    ;

  inherit (callPackages ../development/tools/electron/chromedriver { })
@@ -4757,6 +4759,7 @@ with pkgs;
    electron-chromedriver_41
    electron-chromedriver_42
    electron-chromedriver_43
+    electron-chromedriver_44
    ;

  inherit
@@ -4790,6 +4793,10 @@ with pkgs;
          src = electron-source.electron_43;
          bin = electron_43-bin;
        };
+        electron_44 = getElectronPkg {
+          src = electron-source.electron_44;
+          bin = electron_44-bin;
+        };
      }
    )
    electron_39
@@ -4797,6 +4804,7 @@ with pkgs;
    electron_41
    electron_42
    electron_43
+    electron_44
    ;
  electron = electron_43;
  electron-bin = electron_43-bin;
--- a/pkgs/top-level/cuda-packages.nix
+++ b/pkgs/top-level/cuda-packages.nix
@@ -197,6 +197,29 @@ let
      tensorrt =
        if hasPreThorJetsonCudaCapability requestedJetsonCudaCapabilities then "10.7.0" else "10.16.1";
    };
+
+  cudaPackages_13_4 =
+    let
+      inherit (cudaPackages_13_4.backendStdenv) requestedJetsonCudaCapabilities;
+    in
+    mkCudaPackages {
+      cublasmp = "0.8.1";
+      cuda = "13.4.1";
+      cudnn =
+        if hasPreThorJetsonCudaCapability requestedJetsonCudaCapabilities then "9.13.0" else "9.22.0";
+      cudss = "0.6.0";
+      cuquantum = "25.09.0";
+      cusolvermp = "0.8.0";
+      cusparselt = "0.8.1";
+      cutensor = "2.3.1";
+      nppplus = "0.10.0";
+      nvcomp = "5.0.0.6";
+      nvjpeg2000 = "0.9.0";
+      nvpl = "25.5";
+      nvtiff = "0.5.1";
+      tensorrt =
+        if hasPreThorJetsonCudaCapability requestedJetsonCudaCapabilities then "10.7.0" else "10.14.1";
+    };
 in
 {
  inherit
@@ -207,5 +230,6 @@ in
    cudaPackages_13_1
    cudaPackages_13_2
    cudaPackages_13_3
+    cudaPackages_13_4
    ;
 }
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -3311,6 +3311,8 @@ self: super: with self; {

  cmd2-ext-test = callPackage ../development/python-modules/cmd2-ext-test { };

+  cmd2_4 = callPackage ../development/python-modules/cmd2_4 { };
+
  cmdline = callPackage ../development/python-modules/cmdline { };

  cmdstanpy = callPackage ../development/python-modules/cmdstanpy { };
@@ -8332,6 +8334,8 @@ self: super: with self; {

  indexed-zstd = callPackage ../development/python-modules/indexed-zstd { inherit (pkgs) zstd; };

+  indicio = callPackage ../development/python-modules/indicio { };
+
  inequality = callPackage ../development/python-modules/inequality { };

  inference-gym = callPackage ../development/python-modules/inference-gym { };
@@ -17722,7 +17726,7 @@ self: super: with self; {

  rapt-ble = callPackage ../development/python-modules/rapt-ble { };

-  rarfile = callPackage ../development/python-modules/rarfile { inherit (pkgs) libarchive; };
+  rarfile = callPackage ../development/python-modules/rarfile { inherit (pkgs) libarchive unrar; };

  raspyrfm-client = callPackage ../development/python-modules/raspyrfm-client { };

@@ -18764,6 +18768,8 @@ self: super: with self; {

  serverlessrepo = callPackage ../development/python-modules/serverlessrepo { };

+  servestatic = callPackage ../development/python-modules/servestatic { };
+
  service-identity = callPackage ../development/python-modules/service-identity { };

  session-info2 = callPackage ../development/python-modules/session-info2 { };
@@ -20150,6 +20156,8 @@ self: super: with self; {

  swcgeom = callPackage ../development/python-modules/swcgeom { };

+  sweeps = callPackage ../development/python-modules/sweeps { };
+
  swh-auth = callPackage ../development/python-modules/swh-auth { };

  swh-core = callPackage ../development/python-modules/swh-core { };
@@ -20755,6 +20763,8 @@ self: super: with self; {

  tlds = callPackage ../development/python-modules/tlds { };

+  tlmviewer = callPackage ../development/python-modules/tlmviewer { };
+
  tlparse = callPackage ../development/python-modules/tlparse { };

  tls-client = callPackage ../development/python-modules/tls-client { };
@@ -20890,10 +20900,14 @@ self: super: with self; {

  torcheval = callPackage ../development/python-modules/torcheval { };

+  torchimplicit = callPackage ../development/python-modules/torchimplicit { };
+
  torchinfo = callPackage ../development/python-modules/torchinfo { };

  torchio = callPackage ../development/python-modules/torchio { };

+  torchlensmaker = callPackage ../development/python-modules/torchlensmaker { };
+
  torchlibrosa = callPackage ../development/python-modules/torchlibrosa { };

  torchmd-net = callPackage ../development/python-modules/torchmd-net { };
@@ -21939,7 +21953,7 @@ self: super: with self; {

  unrar = callPackage ../development/python-modules/unrar { inherit (pkgs) unrar; };

-  unrardll = callPackage ../development/python-modules/unrardll { };
+  unrardll = callPackage ../development/python-modules/unrardll { inherit (pkgs) unrar; };

  unrpa = callPackage ../development/python-modules/unrpa { };