Merge c10e9960ea into haskell-updates

2026-10-02 13:00:23 +00:00 · 2025-12-30 00:24:15 +00:00
parent 1c945fab18 c10e9960ea
commit aeb3cbd186
155 changed files with 1294 additions and 686 deletions
--- a/doc/packages/linux.section.md
+++ b/doc/packages/linux.section.md
@@ -158,3 +158,9 @@ The change gets submitted like this:
  * Keep the previously latest kernel until its mainline counterpart gets removed.
    After that `linux_hardened` points to the latest LTS supported by hardened.
 * __SQUASH__ the changes into the `linux_X_Y_hardened: init at …` commit.
+
+### Policy for accepting new kernel flavours {#sec-linux-new-kernels}
+
+No new downstream kernels are accepted into nixpkgs. That includes kernels that use the mainline
+sourcetree, but a different configuration. Kernels for extended hardware support should go
+to [nixos-hardware](github.com/NixOS/nixos-hardware) instead.
--- a/doc/redirects.json
+++ b/doc/redirects.json
@@ -4398,6 +4398,9 @@
  "sec-linux-kernel-developing-modules": [
    "index.html#sec-linux-kernel-developing-modules"
  ],
+  "sec-linux-new-kernels": [
+    "index.html#sec-linux-new-kernels"
+  ],
  "ex-edit-compile-run-kernel-modules": [
    "index.html#ex-edit-compile-run-kernel-modules"
  ],
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -3918,6 +3918,12 @@
    githubId = 15181236;
    keys = [ { fingerprint = "AE1E 3B80 7727 C974 B972  AB3C C324 01C3 BF52 1179"; } ];
  };
+  bridgesense = {
+    name = "Saad Nadeem";
+    email = "saad29nadeem@gmail.com";
+    github = "BridgeSenseDev";
+    githubId = 88615188;
+  };
  britter = {
    name = "Benedikt Ritter";
    email = "beneritter@gmail.com";
@@ -5686,6 +5692,7 @@
    github = "0xda157";
    githubId = 153149335;
    name = "0xda157";
+    keys = [ { fingerprint = "5A66 FF95 36DE B501 DDD2  1647 B7AC 1B10 365D 45FF"; } ];
  };
  dabao1955 = {
    email = "dabao1955@163.com";
@@ -6483,6 +6490,11 @@
      }
    ];
  };
+  Dev380 = {
+    name = "Dev380";
+    github = "Dev380";
+    githubId = 49997896;
+  };
  developer-guy = {
    name = "Batuhan Apaydın";
    email = "developerguyn@gmail.com";
@@ -10990,6 +11002,13 @@
    githubId = 1550265;
    name = "Dominic Steinitz";
  };
+  iedame = {
+    name = "Rafael Ieda";
+    github = "iedame";
+    githubId = 60272;
+    email = "git@ieda.me";
+    matrix = "@ieda:matrix.org";
+  };
  if-loop69420 = {
    github = "if-loop69420";
    githubId = 81078181;
@@ -29195,6 +29214,9 @@
      {
        fingerprint = "4E67 A4AC 2FA4 2A28 DB40  1FC8 F9FB 19F1 C1DC 9C23";
      }
+      {
+        fingerprint = "42EF 09B8 31E1 7646 8BFE  CAD8 E922 D634 9DB9 F861";
+      }
    ];
  };
  Zaechus = {
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@@ -1489,6 +1489,9 @@
  "module-services-postgres-upstream-deviation": [
    "index.html#module-services-postgres-upstream-deviation"
  ],
+  "module-services-postgresql-target-vs-service": [
+    "index.html#module-services-postgresql-target-vs-service"
+  ],
  "module-services-foundationdb": [
    "index.html#module-services-foundationdb"
  ],
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -22,6 +22,8 @@

 - [LibreChat](https://www.librechat.ai/), open-source self-hostable ChatGPT clone with Agents and RAG APIs. Available as [services.librechat](#opt-services.librechat.enable).

+- [nohang](https://github.com/hakavlad/nohang), a daemon for Linux that prevents out of memory (OOM) situations from affecting system responsiveness. Available as [services.nohang](#opt-services.nohang.enable)
+
 - [DankMaterialShell](https://danklinux.com), a complete desktop shell for Wayland compositors built with Quickshell. Available as [programs.dms-shell](#opt-programs.dms-shell.enable).

 - [dms-greeter](https://danklinux.com), a modern display manager greeter for DankMaterialShell that works with greetd and supports multiple Wayland compositors. Available as [services.displayManager.dms-greeter](#opt-services.displayManager.dms-greeter.enable).
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1532,6 +1532,7 @@
  ./services/system/localtimed.nix
  ./services/system/nix-daemon-firewall.nix
  ./services/system/nix-daemon.nix
+  ./services/system/nohang.nix
  ./services/system/nscd.nix
  ./services/system/nvme-rs.nix
  ./services/system/saslauthd.nix
--- a/nixos/modules/services/databases/postgresql.md
+++ b/nixos/modules/services/databases/postgresql.md
@@ -485,6 +485,35 @@ with hardening, it's considered a bug.
 When using extensions that are not packaged in `nixpkgs`, hardening adjustments may
 become necessary.

+## `postgresql.service` vs `postgresql.target` {#module-services-postgresql-target-vs-service}
+
+In order to delay a service's startup until the local PostgreSQL instance is up, one usually uses a combination of `wants`/`after`, i.e.
+
+```nix
+{
+  systemd.services.myservice = {
+    wants = [ "postgresql.target" ];
+    after = [ "postgresql.target" ];
+  };
+}
+```
+
+::: {.note}
+`wants` makes sure that `postgresql.target` is being started when `myservice.service` is started.
+If it's necessary to restart `myservice` when `postgresql.target` gets restarted and `myservice.service` fails to start if `postgresql.service` fails to start, use `requires` instead.
+
+See also {manpage}`systemd.unit(5)`.
+:::
+
+It's also possible to wait for `postgresql.service` instead, however that has a slightly different meaning:
+
+* `postgresql.service` is `active` if the database is __at least__ in read-only mode.
+* `postgresql.target` is `active` if the database is either in __read-write__ mode or a standby server.
+
+This is implemented by making `postgresql.target` wait for `postgresql-setup.service` which waits for the database to be fully up and applies the changes necessary for `ensureUsers`.
+
+Restarting `postgresql.service` by hand also triggers a restart of `postgresql.target`.
+
 ## Notable differences to upstream {#module-services-postgres-upstream-deviation}

 - To avoid circular dependencies between default and -dev outputs, the output of the `pg_config` system view has been removed.
--- a/nixos/modules/services/mail/roundcube.nix
+++ b/nixos/modules/services/mail/roundcube.nix
@@ -100,7 +100,8 @@ in
    maxAttachmentSize = lib.mkOption {
      type = lib.types.int;
      default = 18;
-      apply = configuredMaxAttachmentSize: "${toString (configuredMaxAttachmentSize * 1.37)}M";
+      apply =
+        configuredMaxAttachmentSize: "${toString (builtins.ceil (configuredMaxAttachmentSize * 1.37))}M";
      description = ''
        The maximum attachment size in MB.
        [upstream issue comment]: https://github.com/roundcube/roundcubemail/issues/7979#issuecomment-808879209
--- a/nixos/modules/services/matrix/synapse.nix
+++ b/nixos/modules/services/matrix/synapse.nix
@@ -1441,6 +1441,10 @@ in
      gid = config.ids.gids.matrix-synapse;
    };

+    systemd.slices.system-synapse = {
+      description = "Matrix reference homeserver";
+    };
+
    systemd.targets.matrix-synapse = lib.mkIf hasWorkers {
      description = "Synapse Matrix parent target";
      wants = [ "network-online.target" ];
@@ -1480,6 +1484,7 @@ in
            ExecReload = "${pkgs.util-linux}/bin/kill -HUP $MAINPID";
            Restart = "on-failure";
            UMask = "0077";
+            Slice = "system-synapse.slice";

            # Security Hardening
            # Refer to systemd.exec(5) for option descriptions.
--- a/nixos/modules/services/system/nohang.nix
+++ b/nixos/modules/services/system/nohang.nix
@@ -0,0 +1,113 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+let
+  cfg = config.services.nohang;
+
+  inherit (lib)
+    literalExpression
+    mkEnableOption
+    mkIf
+    mkOption
+    mkPackageOption
+    types
+    ;
+in
+{
+  meta = {
+    maintainers = with lib.maintainers; [ Dev380 ];
+  };
+
+  options.services.nohang = {
+    enable = mkEnableOption "nohang, a daemon that keeps system responsiveness when Linux is out of memory";
+
+    package = mkPackageOption pkgs "nohang" { };
+
+    configPath = mkOption {
+      type = types.either (types.enum [
+        "basic"
+        "desktop"
+      ]) types.path;
+      default = "desktop";
+      example = literalExpression "./my-nohang-config.conf";
+      description = ''
+        Configuration file to use with nohang. The default and desktop example configurations in the nohang repository
+        can be used by setting this to "basic" or "desktop" (which is the default). Otherwise, you can set it to the path
+        of a custom configuration file.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    systemd.services.nohang = {
+      description = "Sophisticated low memory handler";
+      documentation = [
+        "man:nohang(8)"
+        "https://github.com/hakavlad/nohang"
+      ];
+      after = [ "sysinit.target" ];
+      wantedBy = [ "multi-user.target" ];
+      serviceConfig = {
+        ExecStart =
+          "${lib.getExe cfg.package} --monitor --config "
+          + (
+            if cfg.configPath == "basic" then
+              "${cfg.package}/etc/nohang/nohang.conf"
+            else if cfg.configPath == "desktop" then
+              "${cfg.package}/etc/nohang/nohang-desktop.conf"
+            else
+              cfg.configPath
+          );
+        Slice = "hostcritical.slice";
+        SyslogIdentifier =
+          if cfg.configPath == "basic" then
+            "nohang"
+          else if cfg.configPath == "desktop" then
+            "nohang-desktop"
+          else
+            "nohang-custom-config";
+        KillMode = "mixed";
+        Restart = "always";
+        RestartSec = 0;
+
+        CPUSchedulingResetOnFork = true;
+        RestrictRealtime = "yes";
+
+        TasksMax = 25;
+        MemoryMax = "100M";
+        MemorySwapMax = "100M";
+
+        UMask = 27;
+        ProtectSystem = "strict";
+        ReadWritePaths = "/var/log";
+        InaccessiblePaths = "/home /root";
+        ProtectKernelTunables = true;
+        ProtectKernelModules = true;
+        ProtectControlGroups = true;
+        ProtectHostname = true;
+        MemoryDenyWriteExecute = "yes";
+        RestrictNamespaces = "yes";
+        LockPersonality = "yes";
+        PrivateTmp = true;
+        DeviceAllow = "/dev/kmsg rw";
+        DevicePolicy = "closed";
+
+        CapabilityBoundingSet = [
+          "CAP_KILL"
+          "CAP_IPC_LOCK"
+          "CAP_SYS_PTRACE"
+          "CAP_DAC_READ_SEARCH"
+          "CAP_DAC_OVERRIDE"
+          "CAP_AUDIT_WRITE"
+          "CAP_SETUID"
+          "CAP_SETGID"
+          "CAP_SYS_RESOURCE"
+          "CAP_SYSLOG"
+        ];
+      };
+    };
+  };
+}
--- a/nixos/modules/virtualisation/xen-dom0.nix
+++ b/nixos/modules/virtualisation/xen-dom0.nix
@@ -720,15 +720,6 @@ in
        "xen-blkback"
        "xen-netback"
        "xen-pciback"
-        "evtchn"
-        "gntdev"
-        "netbk"
-        "blkbk"
-        "xen-scsibk"
-        "usbbk"
-        "pciback"
-        "xen-acpi-processor"
-        "blktap2"
        "tun"
        "netxen_nic"
        "xen_wdt"
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1105,6 +1105,7 @@ in
  nixpkgs = pkgs.callPackage ../modules/misc/nixpkgs/test.nix { inherit evalMinimalConfig; };
  nixseparatedebuginfod2 = runTest ./nixseparatedebuginfod2.nix;
  node-red = runTest ./node-red.nix;
+  nohang = runTest ./nohang.nix;
  nomad = runTest ./nomad.nix;
  nominatim = runTest ./nominatim.nix;
  non-default-filesystems = handleTest ./non-default-filesystems.nix { };
--- a/nixos/tests/nohang.nix
+++ b/nixos/tests/nohang.nix
@@ -0,0 +1,56 @@
+# The following was modified from ./earlyoom.nix
+{ lib, pkgs, ... }:
+{
+  name = "nohang";
+  meta = {
+    maintainers = with lib.maintainers; [
+      Dev380
+    ];
+  };
+
+  nodes.machine =
+    { pkgs, ... }:
+    {
+      # Limit VM resource usage.
+      virtualisation.memorySize = 1024;
+
+      services.nohang.enable = true;
+      # disable other oom killers just in case
+      systemd.oomd.enable = false;
+
+      systemd.services.testbloat = {
+        description = "Create a lot of memory pressure";
+        serviceConfig = {
+          ExecStart = "${lib.getExe' pkgs.coreutils "tail"} /dev/zero";
+        };
+      };
+    };
+
+  # SIGTERM may be given so tail /dev/zero may or may not succeed
+  # The output will have have something like "Sending SIGTERM to /nix/store/87fc"
+  # with the truncated path so we'll check for that in the test
+  testScript = ''
+    machine.wait_for_unit("nohang.service")
+
+    with subtest("nohang should kill the bad service"):
+        machine.execute("systemctl start --wait testbloat.service")
+        signal_type = None
+        match machine.get_unit_info("testbloat.service")["Result"]:
+          case "signal":
+            signal_type = "SIGKILL"
+          case "success":
+            signal_type = "SIGTERM"
+        output = machine.succeed('journalctl -u nohang.service -b0')
+
+        if not f'[ OK ] Sending {signal_type}' in output:
+          raise Exception(f"'[ OK ] Sending {signal_type}' not in output")
+        if not 'The victim' in output:
+          raise Exception("'The victim' not in output")
+        if not 'Memory status after implementing a corrective action:' in output:
+          raise Exception("'Memory status after implementing a corrective action:' not in output")
+        if not 'FINISHING implement_corrective_action()' in output:
+          raise Exception("'FINISHING implement_corrective_action()' not in output")
+        if not f"{signal_type} to {'${pkgs.coreutils}'[:len('/nix/store/1234')]}: 1" in output:
+          raise Exception(f"'{signal_type} to {'${pkgs.coreutils}'[:len('/nix/store/1234')]}: 1' not in output")
+  '';
+}
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@@ -46,7 +46,7 @@ let

  products = versions.${system} or (throw "Unsupported system: ${system}");

-  dotnet-sdk = dotnetCorePackages.sdk_9_0-source;
+  dotnet-sdk = dotnetCorePackages.sdk_10_0-source;

  package = if stdenv.hostPlatform.isDarwin then ./bin/darwin.nix else ./bin/linux.nix;
  mkJetBrainsProductCore = callPackage package { inherit vmopts; };
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -945,6 +945,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  artio-nvim = buildVimPlugin {
+    pname = "artio.nvim";
+    version = "2025-12-28";
+    src = fetchFromGitHub {
+      owner = "comfysage";
+      repo = "artio.nvim";
+      rev = "83909f659c1da7cf8403c31a051f0ccb64c4c636";
+      hash = "sha256-22CIZrIWI8ZjXPnDtdpCzbPmV/EI7z/YFrbGzoogjGA=";
+    };
+    meta.homepage = "https://github.com/comfysage/artio.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
  astrocore = buildVimPlugin {
    pname = "astrocore";
    version = "2.0.5-unstable-2025-06-06";
@@ -6974,6 +6987,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  iswap-nvim = buildVimPlugin {
+    pname = "iswap.nvim";
+    version = "0-unstable-2024-05-23";
+    src = fetchFromGitHub {
+      owner = "mizlan";
+      repo = "iswap.nvim";
+      rev = "e02cc91f2a8feb5c5a595767d208c54b6e3258ec";
+      hash = "sha256-lAYHvz23f9nJ6rb0NIm+1aq0Vr0SwjPVitPuROtUS2A=";
+    };
+    meta.homepage = "https://github.com/mizlan/iswap.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
  jdaddy-vim = buildVimPlugin {
    pname = "jdaddy.vim";
    version = "1.0-unstable-2014-02-22";
@@ -7053,6 +7079,19 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  jj-nvim = buildVimPlugin {
+    pname = "jj.nvim";
+    version = "0.1.0-unstable-2025-12-25";
+    src = fetchFromGitHub {
+      owner = "NicolasGB";
+      repo = "jj.nvim";
+      rev = "faf1a9f63c55d1d3649896de0d7cc18e4581d71e";
+      hash = "sha256-OxBSxxPQRFq1EPmoUsICMTZFatkkb1mI/tPHCzeIW4Q=";
+    };
+    meta.homepage = "https://github.com/NicolasGB/jj.nvim/";
+    meta.hydraPlatforms = [ ];
+  };
+
  jq-vim = buildVimPlugin {
    pname = "jq.vim";
    version = "1.0.3-unstable-2024-11-19";
--- a/pkgs/applications/editors/vim/plugins/overrides.nix
+++ b/pkgs/applications/editors/vim/plugins/overrides.nix
@@ -196,6 +196,14 @@ assertNoAdditions {
    ];
  };

+  artio-nvim = super.artio-nvim.overrideAttrs {
+    # Requires extui enabled
+    nvimSkipModules = [
+      "artio.view"
+      "artio.picker"
+    ];
+  };
+
  astrocore = super.astrocore.overrideAttrs {
    dependencies = [ self.lazy-nvim ];
  };
@@ -1530,6 +1538,10 @@ assertNoAdditions {
    dependencies = [ self.nvim-treesitter ];
  };

+  iswap-nvim = super.iswap-nvim.overrideAttrs {
+    dependencies = [ self.nvim-treesitter ];
+  };
+
  jdd-nvim = super.jdd-nvim.overrideAttrs {
    dependencies = [ self.plenary-nvim ];
  };
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -71,6 +71,7 @@ https://github.com/solarnz/arcanist.vim/,,
 https://github.com/vim-scripts/argtextobj.vim/,,
 https://github.com/otavioschwanck/arrow.nvim/,,
 https://github.com/arsham/arshlib.nvim/,HEAD,
+https://github.com/comfysage/artio.nvim/,HEAD,
 https://github.com/AstroNvim/astrocore/,HEAD,
 https://github.com/AstroNvim/astrolsp/,HEAD,
 https://github.com/AstroNvim/astrotheme/,,
@@ -534,12 +535,14 @@ https://github.com/neutaaaaan/iosvkem/,,
 https://github.com/twerth/ir_black/,,
 https://github.com/Vigemus/iron.nvim/,HEAD,
 https://github.com/haya14busa/is.vim/,,
+https://github.com/mizlan/iswap.nvim/,HEAD,
 https://github.com/vim-scripts/jdaddy.vim/,,
 https://github.com/mahyarmirrashed/jdd.nvim/,HEAD,
 https://github.com/davidhalter/jedi-vim/,,
 https://github.com/metalelf0/jellybeans-nvim/,,
 https://github.com/nanotech/jellybeans.vim/,,
 https://github.com/HiPhish/jinja.vim/,HEAD,
+https://github.com/NicolasGB/jj.nvim/,HEAD,
 https://github.com/vito-c/jq.vim/,,
 https://github.com/neoclide/jsonc.vim/,,
 https://github.com/julelang/jule.nvim/,HEAD,
--- a/pkgs/applications/emulators/libretro/cores/play.nix
+++ b/pkgs/applications/emulators/libretro/cores/play.nix
@@ -14,13 +14,13 @@
 }:
 mkLibretroCore {
  core = "play";
-  version = "0-unstable-2025-12-10";
+  version = "0-unstable-2025-12-23";

  src = fetchFromGitHub {
    owner = "jpd002";
    repo = "Play-";
-    rev = "6400e0f0d8a1e2345def663bc646e8adc0e42e76";
-    hash = "sha256-2hmeEuO+Z0FDyDYiA59ntXl24B5OcLWuvxbiLLfiWE8=";
+    rev = "d0f1375248e3003199cb973a12332b4cc9f0724f";
+    hash = "sha256-uMPlJDjLmXDO9mrnjYu/3Fr5qwBBADUARTMz1hckLJM=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/emulators/libretro/cores/scummvm.nix
+++ b/pkgs/applications/emulators/libretro/cores/scummvm.nix
@@ -25,13 +25,13 @@ let
 in
 mkLibretroCore {
  core = "scummvm";
-  version = "0-unstable-2025-07-03";
+  version = "0-unstable-2025-12-24";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "scummvm";
-    rev = "686cdd13719b92554fa46b264c512ca7deec7a96";
-    hash = "sha256-3w1rYVPX7ENGUgKdrFRQShWoEXfagxdtzd98m1hKeYU=";
+    rev = "b56c0d796ebcb4a3a8ea966cc3b8ec3e02b452be";
+    hash = "sha256-CPYKOqyEDRdA2D1+eomrsb7w8pDWyxtqmGZF8j15OJU=";
  };

  extraBuildInputs = [
--- a/pkgs/applications/graphics/inkscape/default.nix
+++ b/pkgs/applications/graphics/inkscape/default.nix
@@ -74,7 +74,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "inkscape";
-  version = "1.4.2";
+  version = "1.4.3";
  outputs = [
    "out"
    "man"
@@ -82,7 +82,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://inkscape.org/release/inkscape-${finalAttrs.version}/source/archive/xz/dl/inkscape-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-IABTDHkX5SYMnoV1pxVP9pJmQ9IAZIfXFOMEqWPwx4I=";
+    sha256 = "sha256-6DosPbVwtsWh/w/M/nCYg3s/a9dLEzVnk3yKkXEO0dE=";
  };

  # Inkscape hits the ARGMAX when linking on macOS. It appears to be
@@ -101,26 +101,6 @@ stdenv.mkDerivation (finalAttrs: {
      # Fix path to ps2pdf binary
      inherit ghostscript;
    })
-    (fetchpatch {
-      name = "fix-build-poppler-25.06.0.patch";
-      url = "https://gitlab.com/inkscape/inkscape/-/commit/40f5b15b7e29908b79c54e81db6f340936102e08.patch";
-      hash = "sha256-bYRd/KUh/7qFb7x0EuUgQYA9P8abcTf5XS67gzaAiXA=";
-    })
-    (fetchpatch {
-      name = "fix-build-poppler-25.07.0.patch";
-      url = "https://gitlab.com/inkscape/inkscape/-/commit/8ae83ca81bbaebcc0ff0abe82300d56d2c94e6f9.patch";
-      hash = "sha256-s7UMnv1pAiQA/HL5CEdBwCn4v/tsphc0MSnBJAoqolY=";
-    })
-    (fetchpatch {
-      name = "fix-build-poppler-25.09.0.patch";
-      url = "https://gitlab.com/inkscape/inkscape/-/commit/f48b429827dca510b41a5671d467e574ef348625.patch";
-      hash = "sha256-9CfmkTGMVHjZiiE3zvi4YOrytcir8a7O2z3PrhjcohI=";
-    })
-    (fetchpatch {
-      name = "fix-build-poppler-25.10.0.patch";
-      url = "https://gitlab.com/inkscape/inkscape/-/commit/4dba481fe898c6317696d50b109f5aed8f269c19.patch";
-      hash = "sha256-FFCkMU+Ec2qobG4ru89NPcM9Gxw8ZyFV+6jpW8ZwgE4=";
-    })
  ];

  postPatch = ''
--- a/pkgs/applications/networking/cluster/nomad/default.nix
+++ b/pkgs/applications/networking/cluster/nomad/default.nix
@@ -2,6 +2,7 @@
  lib,
  buildGoModule,
  buildGo124Module,
+  buildGo125Module,
  fetchFromGitHub,
  nixosTests,
  installShellFiles,
@@ -40,12 +41,6 @@ let
          inherit hash;
        };

-        # Nomad requires Go 1.24.6, but nixpkgs doesn't have it in unstable yet.
-        postPatch = ''
-          substituteInPlace go.mod \
-            --replace-warn "go 1.24.6" "go 1.24.5"
-        '';
-
        nativeBuildInputs = [ installShellFiles ];

        ldflags = [
@@ -88,6 +83,18 @@ rec {

  nomad = nomad_1_10;

+  nomad_1_11 = generic {
+    buildGoModule = buildGo125Module;
+    version = "1.11.0";
+    hash = "sha256-ETC9zJVup/BLivsBWVez5/OLpl7cjdlIRACVK9ga3Io=";
+    vendorHash = "sha256-WqGWEjaPicpmkARSEQ/bqw8+GSemh1fcM3pb4BGjZpU=";
+    license = lib.licenses.bsl11;
+    passthru.tests.nomad = nixosTests.nomad;
+    preCheck = ''
+      export PATH="$PATH:$NIX_BUILD_TOP/go/bin"
+    '';
+  };
+
  nomad_1_10 = generic {
    buildGoModule = buildGo124Module;
    version = "1.10.5";
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1229,13 +1229,13 @@
    "vendorHash": "sha256-skswuFKhN4FFpIunbom9rM/FVRJVOFb1WwHeAIaEjn8="
  },
  "spacelift-io_spacelift": {
-    "hash": "sha256-leXROTarkEHfDmJVLS7kSU3Z27dCF/BfZwBsnujlB90=",
+    "hash": "sha256-GSGKjV5tuwTyPvdwd/Z8t9g7LFkkg4gHKhI3FYt00gQ=",
    "homepage": "https://registry.terraform.io/providers/spacelift-io/spacelift",
    "owner": "spacelift-io",
    "repo": "terraform-provider-spacelift",
-    "rev": "v1.40.0",
+    "rev": "v1.42.0",
    "spdx": "MIT",
-    "vendorHash": "sha256-cX5K221Jnq701Nb+2bC1LmXVL7YvkZ8dkc2wYjDNOSw="
+    "vendorHash": "sha256-XNPXjqrrTIC3WrpvDBP7veAYgmYws9FdF4W3j6ewRPk="
  },
  "splunk-terraform_signalfx": {
    "hash": "sha256-Wixg+biff6OER/nXYa+WGXG7svs4T3E/qwPlV5xJEao=",
--- a/pkgs/applications/science/logic/hol_light/default.nix
+++ b/pkgs/applications/science/logic/hol_light/default.nix
@@ -9,6 +9,7 @@
  zarith,
  camlp5,
  camlp-streams,
+  bash,
 }:

 let
@@ -52,6 +53,8 @@ stdenv.mkDerivation {

  patches = [ ./0004-Fix-compilation-with-camlp5-7.11.patch ];

+  buildInputs = [ bash ];
+
  strictDeps = true;

  nativeBuildInputs = [
--- a/pkgs/applications/virtualization/OVMF/default.nix
+++ b/pkgs/applications/virtualization/OVMF/default.nix
@@ -40,7 +40,6 @@
  sourceDebug ? false,
  projectDscPath ?
    {
-      i686 = "OvmfPkg/OvmfPkgIa32.dsc";
      x86_64 = "OvmfPkg/OvmfPkgX64.dsc";
      aarch64 = "ArmVirtPkg/ArmVirtQemu.dsc";
      riscv64 = "OvmfPkg/RiscVVirt/RiscVVirtQemu.dsc";
@@ -50,7 +49,6 @@
      or (throw "Unsupported OVMF `projectDscPath` on ${stdenv.hostPlatform.parsed.cpu.name}"),
  fwPrefix ?
    {
-      i686 = "OVMF";
      x86_64 = "OVMF";
      aarch64 = "AAVMF";
      riscv64 = "RISCV_VIRT";
@@ -58,16 +56,12 @@
    }
    .${stdenv.hostPlatform.parsed.cpu.name}
      or (throw "Unsupported OVMF `fwPrefix` on ${stdenv.hostPlatform.parsed.cpu.name}"),
-  metaPlatforms ? edk2.meta.platforms,
+  metaPlatforms ? lib.subtractLists lib.platforms.i686 edk2.meta.platforms,
 }:

 let

  platformSpecific = {
-    i686.msVarsArgs = {
-      flavor = "OVMF";
-      archDir = "Ia32";
-    };
    x86_64.msVarsArgs = {
      flavor = "OVMF_4M";
      archDir = "X64";
--- a/pkgs/by-name/ak/akkoma-admin-fe/package.nix
+++ b/pkgs/by-name/ak/akkoma-admin-fe/package.nix
@@ -4,7 +4,7 @@
  fetchFromGitea,
  yarn-berry_3,
  nodejs,
-  python3,
+  python311,
  pkg-config,
  libsass,
  xcbuild,
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
    yarn-berry
    nodejs
    pkg-config
-    python3
+    python311
    libsass
  ]
  ++ lib.optional stdenv.hostPlatform.isDarwin xcbuild;
--- a/pkgs/by-name/ak/akkoma/package.nix
+++ b/pkgs/by-name/ak/akkoma/package.nix
@@ -1,6 +1,6 @@
 {
  lib,
-  beamPackages,
+  beam_minimal,
  fetchFromGitea,
  cmake,
  file,
@@ -8,6 +8,16 @@
  nix-update-script,
 }:

+let
+  beamPackages = beam_minimal.packages.erlang_26.extend (
+    self: super: {
+      elixir = self.elixir_1_16;
+      rebar3 = self.rebar3WithPlugins {
+        plugins = with self; [ pc ];
+      };
+    }
+  );
+in
 beamPackages.mixRelease rec {
  pname = "akkoma";
  version = "3.17.0";
--- a/pkgs/by-name/al/alsa-utils/package.nix
+++ b/pkgs/by-name/al/alsa-utils/package.nix
@@ -14,7 +14,7 @@
  procps,
  tree,
  which,
-  fftw,
+  fftwFloat,
  pipewire,
  withPipewireLib ? true,
  symlinkJoin,
@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
    alsa-lib
    ncurses
    libsamplerate
-    fftw
+    fftwFloat
  ];

  configureFlags = [
--- a/pkgs/by-name/aq/aquamarine/package.nix
+++ b/pkgs/by-name/aq/aquamarine/package.nix
@@ -1,6 +1,6 @@
 {
  lib,
-  stdenv,
+  gcc15Stdenv,
  cmake,
  fetchFromGitHub,
  hwdata,
@@ -21,7 +21,7 @@
  wayland-protocols,
  wayland-scanner,
 }:
-stdenv.mkDerivation (finalAttrs: {
+gcc15Stdenv.mkDerivation (finalAttrs: {
  pname = "aquamarine";
  version = "0.10.0";

--- a/pkgs/by-name/ar/armips/package.nix
+++ b/pkgs/by-name/ar/armips/package.nix
@@ -1,11 +1,11 @@
 {
-  stdenv,
+  clangStdenv,
  lib,
  fetchFromGitHub,
  cmake,
 }:

-stdenv.mkDerivation rec {
+clangStdenv.mkDerivation rec {
  pname = "armips";
  version = "0.11.0";

--- a/pkgs/by-name/ar/art/package.nix
+++ b/pkgs/by-name/ar/art/package.nix
@@ -22,7 +22,7 @@
  lcms2,
  libraw,
  libiptcdata,
-  fftw,
+  fftwSinglePrec,
  expat,
  pcre2,
  libsigcxx,
@@ -81,7 +81,7 @@ stdenv.mkDerivation rec {
    lcms2
    libraw
    libiptcdata
-    fftw
+    fftwSinglePrec
    expat
    pcre2
    libsigcxx
--- a/pkgs/by-name/as/asap/package.nix
+++ b/pkgs/by-name/as/asap/package.nix
@@ -7,11 +7,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "asap";
-  version = "6.0.3";
+  version = "7.0.0";

  src = fetchzip {
    url = "mirror://sourceforge/project/asap/asap/${finalAttrs.version}/asap-${finalAttrs.version}.tar.gz";
-    hash = "sha256-a4RUtFue5wdoGUykLRb46s4+yR/I/7DhwE1SiWPRg8s=";
+    hash = "sha256-T4uTcaS8qIqUptggxJwZNSI/kN2NxNI+2ZUgncveb3E=";
  };

  outputs = [
--- a/pkgs/by-name/as/aseprite/package.nix
+++ b/pkgs/by-name/as/aseprite/package.nix
@@ -4,7 +4,6 @@
  cmark,
  curl,
  fetchFromGitHub,
-  fetchpatch,
  fmt,
  fontconfig,
  freetype,
@@ -23,6 +22,7 @@
  libXi,
  libXxf86vm,
  libxcb,
+  libXrandr,
  ninja,
  pcre2,
  pixman,
@@ -34,7 +34,7 @@

 clangStdenv.mkDerivation (finalAttrs: {
  pname = "aseprite";
-  version = "1.3.13";
+  version = "1.3.16.1";

  srcs = [
    (fetchFromGitHub {
@@ -43,7 +43,7 @@ clangStdenv.mkDerivation (finalAttrs: {
      repo = "aseprite";
      tag = "v${finalAttrs.version}";
      fetchSubmodules = true;
-      hash = "sha256-eeB/4fQp1lbNYQj9LpNhOn7DYxaTc+BcmyvY2vPzpxk=";
+      hash = "sha256-s2lWg5udg/8pXjOcj2nXDS2uE3urkg1iC0Div7wkxUY=";
    })

    # Translation strings
@@ -51,8 +51,8 @@ clangStdenv.mkDerivation (finalAttrs: {
      name = "aseprite-strings";
      owner = "aseprite";
      repo = "strings";
-      rev = "7b0af61dec1d98242d7eb2e9cab835d442d21235";
-      hash = "sha256-8OwwHCFP55pwLjk5O+a36hDZf9uX3P7cNliJM5SZdAg=";
+      rev = "0f49265d7e7aea4b862b7d1e670ed969e8a469b8";
+      hash = "sha256-S3YkWA5ECvyyqGvojDhIZci04CTjbJzTQiJ5FZsB4lU=";
    })
  ];

@@ -89,6 +89,7 @@ clangStdenv.mkDerivation (finalAttrs: {
    libXi
    libXxf86vm
    libxcb
+    libXrandr
    pcre2
    pixman
    skia-aseprite
@@ -100,6 +101,7 @@ clangStdenv.mkDerivation (finalAttrs: {
    ./shared-fmt.patch
    ./shared-libwebp.patch
    ./shared-skia-deps.patch
+    ./shared-libjpeg-turbo.patch
  ];

  postPatch = ''
@@ -108,7 +110,6 @@ clangStdenv.mkDerivation (finalAttrs: {
  '';

  cmakeFlags = [
-    "-DCMAKE_POLICY_VERSION_MINIMUM=3.5"
    "-DENABLE_DESKTOP_INTEGRATION=ON"
    "-DENABLE_UPDATER=OFF"
    "-DUSE_SHARED_CMARK=ON"
@@ -117,9 +118,7 @@ clangStdenv.mkDerivation (finalAttrs: {
    "-DUSE_SHARED_FREETYPE=ON"
    "-DUSE_SHARED_GIFLIB=ON"
    "-DUSE_SHARED_HARFBUZZ=ON"
-    "-DUSE_SHARED_JPEGLIB=ON"
    "-DUSE_SHARED_LIBPNG=ON"
-    "-DUSE_SHARED_LIBWEBP=ON"
    "-DUSE_SHARED_PIXMAN=ON"
    "-DUSE_SHARED_TINYXML=OFF"
    "-DUSE_SHARED_WEBP=ON"
@@ -167,8 +166,7 @@ clangStdenv.mkDerivation (finalAttrs: {
                - Pixel-art specific tools like filled Contour, Polygon, Shading mode, etc.
                - Onion skinning.
    '';
-    maintainers = [
-    ];
+    maintainers = [ ];
    platforms = lib.platforms.linux;
    mainProgram = "aseprite";
  };
--- a/pkgs/by-name/as/aseprite/shared-libjpeg-turbo.patch
+++ b/pkgs/by-name/as/aseprite/shared-libjpeg-turbo.patch
@@ -0,0 +1,21 @@
+diff --git a/cmake/FindJpegTurbo.cmake b/cmake/FindJpegTurbo.cmake
+index 33b5204..0407a6a 100644
+--- a/cmake/FindJpegTurbo.cmake
+++ b/cmake/FindJpegTurbo.cmake
+@@ -9,14 +9,11 @@
+ 
+ if(LAF_BACKEND STREQUAL "skia")
+ 
+-  find_library(LIBJPEG_TURBO_LIBRARY NAMES libjpeg jpeg
+-    HINTS "${SKIA_LIBRARY_DIR}" NO_DEFAULT_PATH)
+-  set(LIBJPEG_TURBO_INCLUDE_DIRS "${SKIA_DIR}/third_party/externals/libjpeg-turbo")
+  find_library(LIBJPEG_TURBO_LIBRARY NAMES libjpeg jpeg)
+ 
+   add_library(libjpeg-turbo STATIC IMPORTED)
+   set_target_properties(libjpeg-turbo PROPERTIES
+-    IMPORTED_LOCATION "${LIBJPEG_TURBO_LIBRARY}"
+-    INTERFACE_INCLUDE_DIRECTORIES ${LIBJPEG_TURBO_INCLUDE_DIRS})
+    IMPORTED_LOCATION "${LIBJPEG_TURBO_LIBRARY}")
+ 
+ else()
+ 
--- a/pkgs/by-name/at/atf/package.nix
+++ b/pkgs/by-name/at/atf/package.nix
@@ -1,6 +1,7 @@
 {
  lib,
  stdenv,
+  darwin,
  fetchFromGitHub,
  fetchpatch,
  autoreconfHook,
@@ -8,7 +9,11 @@
  gitUpdater,
 }:

-stdenv.mkDerivation (finalAttrs: {
+let
+  # atf is a dependency of libiconv. Avoid an infinite recursion with `pkgsStatic` by using a bootstrap stdenv.
+  stdenv' = if stdenv.hostPlatform.isDarwin then darwin.bootstrapStdenv else stdenv;
+in
+stdenv'.mkDerivation (finalAttrs: {
  pname = "atf";
  version = "0.23";

@@ -26,12 +31,12 @@ stdenv.mkDerivation (finalAttrs: {
        --replace-fail 'atf_test_program{name="srcdir_test"}' ""
    ''
    # These tests fail on Darwin.
-    + lib.optionalString (finalAttrs.doInstallCheck && stdenv.hostPlatform.isDarwin) ''
+    + lib.optionalString (finalAttrs.doInstallCheck && stdenv'.hostPlatform.isDarwin) ''
      substituteInPlace atf-c/detail/process_test.c \
        --replace-fail 'ATF_TP_ADD_TC(tp, status_coredump);' ""
    ''
    # This test fails on Linux.
-    + lib.optionalString (finalAttrs.doInstallCheck && stdenv.hostPlatform.isLinux) ''
+    + lib.optionalString (finalAttrs.doInstallCheck && stdenv'.hostPlatform.isLinux) ''
      substituteInPlace atf-c/detail/fs_test.c \
        --replace-fail 'ATF_TP_ADD_TC(tp, eaccess);' ""
    '';
--- a/pkgs/by-name/ba/babeld/package.nix
+++ b/pkgs/by-name/ba/babeld/package.nix
@@ -14,6 +14,11 @@ stdenv.mkDerivation rec {
    hash = "sha256-FfJNJtoMz8Bzq83vAwnygeRoTyqnESb4JlcsTIRejdk=";
  };

+  postPatch = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    substituteInPlace Makefile \
+      --replace-fail "-lrt" ""
+  '';
+
  outputs = [
    "out"
    "man"
@@ -30,7 +35,7 @@ stdenv.mkDerivation rec {
    homepage = "http://www.irif.fr/~jch/software/babel/";
    description = "Loop-avoiding distance-vector routing protocol";
    license = lib.licenses.mit;
-    platforms = lib.platforms.linux;
+    platforms = lib.platforms.unix;
    mainProgram = "babeld";
  };
 }
--- a/pkgs/by-name/ba/balena-cli/package.nix
+++ b/pkgs/by-name/ba/balena-cli/package.nix
@@ -21,16 +21,16 @@ let
 in
 buildNpmPackage' rec {
  pname = "balena-cli";
-  version = "23.2.11";
+  version = "23.2.12";

  src = fetchFromGitHub {
    owner = "balena-io";
    repo = "balena-cli";
    rev = "v${version}";
-    hash = "sha256-+tTZRDDYHZqZBsH+RVX2pdOJPlRZqD4fFzir4VsdB3o=";
+    hash = "sha256-sJ2Kf2xslaztQhhPWioGEnQZVW0pBu5apcUOQrpkr+Y=";
  };

-  npmDepsHash = "sha256-y/DNm4TiPx515UgpiCX1U9fHLPk19/8LlfqTGZHDmAA=";
+  npmDepsHash = "sha256-RC93b6mGPqqPPs6wqNuwyf3vE8wr/uGArA3wIFh+dO8=";

  makeCacheWritable = true;

--- a/pkgs/by-name/ba/basalt-monado/package.nix
+++ b/pkgs/by-name/ba/basalt-monado/package.nix
@@ -25,6 +25,10 @@
  cudaPackages,
  enableCuda ? config.cudaSupport,
 }:
+
+let
+  opencv' = opencv.override { enableGtk3 = true; };
+in
 stdenv.mkDerivation {
  pname = "basalt-monado";
  version = "0-unstable-2025-09-25";
@@ -57,7 +61,7 @@ stdenv.mkDerivation {
    libGL
    lz4
    magic-enum
-    opencv.cxxdev
+    opencv'.cxxdev
    onetbb
    xorg.libX11
  ]
--- a/pkgs/by-name/ba/bazel_7/package.nix
+++ b/pkgs/by-name/ba/bazel_7/package.nix
@@ -12,7 +12,8 @@
  buildFHSEnv,
  # this package (through the fixpoint glass)
  # TODO probably still need for tests at some point
-  bazel_self,
+  bazel_7,
+  bazel_self ? bazel_7,
  # native build inputs
  runtimeShell,
  zip,
@@ -35,10 +36,11 @@
  # Apple dependencies
  cctools,
  libtool,
-  sigtool,
+  darwin,
  # Allow to independently override the jdks used to build and run respectively
-  buildJdk,
-  runJdk,
+  jdk21_headless,
+  buildJdk ? jdk21_headless,
+  runJdk ? jdk21_headless,
  # Toggle for hacks for running bazel under buildBazelPackage:
  # Always assume all markers valid (this is needed because we remove markers; they are non-deterministic).
  # Also, don't clean up environment variables (so that NIX_ environment variables are passed to compilers).
@@ -417,7 +419,7 @@ stdenv.mkDerivation rec {
        # don't use system installed Xcode to run clang, use Nix clang instead
        sed -i -E \
          -e "s;/usr/bin/xcrun (--sdk macosx )?clang;${stdenv.cc}/bin/clang $NIX_CFLAGS_COMPILE $(bazelLinkFlags) -framework CoreFoundation;g" \
-          -e "s;/usr/bin/codesign;CODESIGN_ALLOCATE=${cctools}/bin/${cctools.targetPrefix}codesign_allocate ${sigtool}/bin/codesign;" \
+          -e "s;/usr/bin/codesign;CODESIGN_ALLOCATE=${cctools}/bin/${cctools.targetPrefix}codesign_allocate ${darwin.sigtool}/bin/codesign;" \
          scripts/bootstrap/compile.sh \
          tools/osx/BUILD

--- a/pkgs/by-name/bi/biblioteca/package.nix
+++ b/pkgs/by-name/bi/biblioteca/package.nix
@@ -12,7 +12,7 @@
  gtk4,
  gobject-introspection,
  libadwaita,
-  webkitgtk,
+  webkitgtk_6_0,
  coreutils,
  makeShellWrapper,
  wrapGAppsHook4,
@@ -54,7 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
    gtk4
    gobject-introspection
    libadwaita
-    webkitgtk
+    webkitgtk_6_0
    glib-networking
  ];

@@ -64,7 +64,7 @@ stdenv.mkDerivation (finalAttrs: {
      gtk4.devdoc
      glib.devdoc
      libadwaita.devdoc
-      webkitgtk.devdoc
+      webkitgtk_6_0.devdoc
      gobject-introspection.devdoc
    ]
    ++ extraDocsPackage;
--- a/pkgs/by-name/bl/blender/package.nix
+++ b/pkgs/by-name/bl/blender/package.nix
@@ -67,7 +67,7 @@
  pkg-config,
  potrace,
  pugixml,
-  python3Packages, # must use instead of python3.pkgs, see https://github.com/NixOS/nixpkgs/issues/211340
+  python311Packages, # must use python3Packages instead of python3.pkgs, see https://github.com/NixOS/nixpkgs/issues/211340
  rocmPackages, # comes with a significantly larger closure size
  rubberband,
  runCommand,
@@ -95,8 +95,8 @@ let
    (!stdenv.hostPlatform.isAarch64 && stdenv.hostPlatform.isLinux) || stdenv.hostPlatform.isDarwin;
  vulkanSupport = !stdenv.hostPlatform.isDarwin;

-  python3 = python3Packages.python;
-  pyPkgsOpenusd = python3Packages.openusd.override (old: {
+  python3 = python311Packages.python;
+  pyPkgsOpenusd = python311Packages.openusd.override (old: {
    opensubdiv = old.opensubdiv.override { inherit cudaSupport; };
    withOsl = false;
  });
@@ -131,7 +131,7 @@ stdenv'.mkDerivation (finalAttrs: {
      substituteInPlace source/creator/CMakeLists.txt \
        --replace-fail '${"$"}{LIBDIR}/python' \
                  '${python3}' \
-        --replace-fail '${"$"}{LIBDIR}/materialx/' '${python3Packages.materialx}/'
+        --replace-fail '${"$"}{LIBDIR}/materialx/' '${python311Packages.materialx}/'
      substituteInPlace build_files/cmake/platform/platform_apple.cmake \
        --replace-fail '${"$"}{LIBDIR}/brotli/lib/libbrotlicommon-static.a' \
                  '${lib.getLib brotli}/lib/libbrotlicommon.dylib' \
@@ -149,12 +149,12 @@ stdenv'.mkDerivation (finalAttrs: {
  cmakeFlags = [
    "-C../build_files/cmake/config/blender_release.cmake"

-    (lib.cmakeFeature "MaterialX_DIR" "${python3Packages.materialx}/lib/cmake/MaterialX")
+    (lib.cmakeFeature "MaterialX_DIR" "${python311Packages.materialx}/lib/cmake/MaterialX")
    (lib.cmakeFeature "PYTHON_INCLUDE_DIR" "${python3}/include/${python3.libPrefix}")
    (lib.cmakeFeature "PYTHON_LIBPATH" "${python3}/lib")
    (lib.cmakeFeature "PYTHON_LIBRARY" "${python3.libPrefix}")
-    (lib.cmakeFeature "PYTHON_NUMPY_INCLUDE_DIRS" "${python3Packages.numpy_1}/${python3.sitePackages}/numpy/core/include")
-    (lib.cmakeFeature "PYTHON_NUMPY_PATH" "${python3Packages.numpy_1}/${python3.sitePackages}")
+    (lib.cmakeFeature "PYTHON_NUMPY_INCLUDE_DIRS" "${python311Packages.numpy_1}/${python3.sitePackages}/numpy/core/include")
+    (lib.cmakeFeature "PYTHON_NUMPY_PATH" "${python311Packages.numpy_1}/${python3.sitePackages}")
    (lib.cmakeFeature "PYTHON_VERSION" "${python3.pythonVersion}")

    (lib.cmakeBool "WITH_BUILDINFO" false)
@@ -221,7 +221,7 @@ stdenv'.mkDerivation (finalAttrs: {
    cmake
    llvmPackages.llvm.dev
    makeWrapper
-    python3Packages.wrapPython
+    python311Packages.wrapPython
  ]
  ++ lib.optionals cudaSupport [
    addDriverRunpath
@@ -263,7 +263,7 @@ stdenv'.mkDerivation (finalAttrs: {
    potrace
    pugixml
    python3
-    python3Packages.materialx
+    python311Packages.materialx
    rubberband
    zlib
    zstd
@@ -316,7 +316,7 @@ stdenv'.mkDerivation (finalAttrs: {

  pythonPath =
    let
-      ps = python3Packages;
+      ps = python311Packages;
    in
    [
      ps.materialx
@@ -362,13 +362,13 @@ stdenv'.mkDerivation (finalAttrs: {

  passthru = {
    python = python3;
-    pythonPackages = python3Packages;
+    pythonPackages = python311Packages;

    withPackages =
      f:
      (callPackage ./wrapper.nix { }).override {
        blender = finalAttrs.finalPackage;
-        extraModules = (f python3Packages);
+        extraModules = (f python311Packages);
      };

    tests = {
--- a/pkgs/by-name/bl/bluespec/package.nix
+++ b/pkgs/by-name/bl/bluespec/package.nix
@@ -17,7 +17,8 @@
  yices, # bsc uses a patched version of yices
  zlib,
  ghc,
-  gmp-static,
+  gmp,
+  gmp-static ? gmp.override { withStatic = true; },
  iverilog,
  asciidoctor,
  texliveFull,
--- a/pkgs/by-name/bo/bob/package.nix
+++ b/pkgs/by-name/bo/bob/package.nix
@@ -1,62 +0,0 @@
-{
-  lib,
-  stdenv,
-  buildGoModule,
-  fetchFromGitHub,
-  installShellFiles,
-  fetchpatch,
-}:
-
-buildGoModule rec {
-  pname = "bob";
-  version = "0.8.2";
-
-  src = fetchFromGitHub {
-    owner = "benchkram";
-    repo = "bob";
-    tag = version;
-    hash = "sha256-zmWfOLBb+GWw9v6LdCC7/WaP1Wz7UipPwqkmI1+rG8Q=";
-  };
-
-  patches = [
-    # Fix vulnerable dependencies
-    # Backport of https://github.com/benchkram/bob/pull/387
-    (fetchpatch {
-      url = "https://github.com/benchkram/bob/commit/5020e6fafbfbcb1b3add5d936886423ce882793d.patch";
-      hash = "sha256-if1ZErI0Un7d26eOkYSkEa87+VTRcEtF6JbsJYOHpHE=";
-    })
-  ];
-
-  ldflags = [
-    "-s"
-    "-w"
-    "-X main.Version=${version}"
-  ];
-
-  vendorHash = "sha256-u0nFaTQWU9O7A/RAhGaLcBka+YNGjSlpycDF8TLQALw=";
-
-  excludedPackages = [
-    "example/server-db"
-    "test/e2e"
-    "tui-example"
-  ];
-
-  nativeBuildInputs = [ installShellFiles ];
-
-  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-    installShellCompletion --cmd bob \
-      --bash <($out/bin/bob completion) \
-      --zsh <($out/bin/bob completion -z)
-  '';
-
-  # tests require network access
-  doCheck = false;
-
-  meta = {
-    description = "Build system for microservices";
-    mainProgram = "bob";
-    homepage = "https://bob.build";
-    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ zuzuleinen ];
-  };
-}
--- a/pkgs/by-name/bo/bolt-launcher/package.nix
+++ b/pkgs/by-name/bo/bolt-launcher/package.nix
@@ -156,6 +156,7 @@ buildFHSEnv {
    maintainers = with lib.maintainers; [
      nezia
      jaspersurmont
+      iedame
    ];
    platforms = lib.platforms.linux;
    mainProgram = "${bolt.name}";
--- a/pkgs/by-name/ca/calibre-no-speech/package.nix
+++ b/pkgs/by-name/ca/calibre-no-speech/package.nix
@@ -0,0 +1,3 @@
+{ calibre }:
+
+calibre.override { speechSupport = false; }
--- a/pkgs/by-name/ca/calibre/package.nix
+++ b/pkgs/by-name/ca/calibre/package.nix
@@ -150,27 +150,35 @@ stdenv.mkDerivation (finalAttrs: {
      ]
      ++ lib.optional unrarSupport unrardll
    ))
-    piper-tts
    xdg-utils
  ]
-  ++ lib.optional speechSupport speechd-minimal;
+  ++ lib.optionals speechSupport [
+    piper-tts
+    speechd-minimal
+  ];
+
+  env = {
+    HOME = "/tmp";
+    MAGICK_INC = "${lib.getDev imagemagick}/include/ImageMagick";
+    MAGICK_LIB = "${lib.getLib imagemagick}/lib";
+    FC_INC_DIR = "${lib.getDev fontconfig}/include/fontconfig";
+    FC_LIB_DIR = "${lib.getLib fontconfig}/lib";
+    PODOFO_INC_DIR = "${lib.getDev podofo_0_10}/include/podofo";
+    PODOFO_LIB_DIR = "${lib.getLib podofo_0_10}/lib";
+    XDG_DATA_HOME = "${placeholder "out"}/share";
+    XDG_UTILS_INSTALL_MODE = "user";
+  }
+  // lib.optionalAttrs popplerSupport {
+    POPPLER_INC_DIR = "${lib.getDev poppler-utils}/include/poppler";
+    POPPLER_LIB_DIR = "${lib.getLib poppler-utils}/lib";
+  }
+  // lib.optionalAttrs speechSupport {
+    PIPER_TTS_DIR = "${lib.getBin piper-tts}/bin";
+  };

  installPhase = ''
    runHook preInstall

-    export HOME=$TMPDIR/fakehome
-    export POPPLER_INC_DIR=${poppler-utils.dev}/include/poppler
-    export POPPLER_LIB_DIR=${poppler-utils.out}/lib
-    export MAGICK_INC=${imagemagick.dev}/include/ImageMagick
-    export MAGICK_LIB=${imagemagick.out}/lib
-    export FC_INC_DIR=${fontconfig.dev}/include/fontconfig
-    export FC_LIB_DIR=${fontconfig.lib}/lib
-    export PODOFO_INC_DIR=${podofo_0_10.dev}/include/podofo
-    export PODOFO_LIB_DIR=${podofo_0_10}/lib
-    export XDG_DATA_HOME=$out/share
-    export XDG_UTILS_INSTALL_MODE="user"
-    export PIPER_TTS_DIR=${piper-tts}/bin
-
    python setup.py install --root=$out \
      --prefix=$out \
      --libdir=$out/lib \
@@ -211,7 +219,7 @@ stdenv.mkDerivation (finalAttrs: {
              optipng
            ]
          } \
-          ${if popplerSupport then popplerArgs else ""}
+          ${lib.optionalString popplerSupport popplerArgs}
      done
    '';

@@ -243,6 +251,9 @@ stdenv.mkDerivation (finalAttrs: {
        # Attempt to use DefaultLogger but none has been registered.
        "test_plugins"
      ]
+      ++ lib.optionals (!speechSupport) [
+        "test_speech_dispatcher"
+      ]
      ++ lib.optionals (!unrarSupport) [
        "test_unrar"
      ];
--- a/pkgs/by-name/ca/candy-icons/package.nix
+++ b/pkgs/by-name/ca/candy-icons/package.nix
@@ -8,13 +8,13 @@

 stdenvNoCC.mkDerivation {
  pname = "candy-icons";
-  version = "0-unstable-2025-12-10";
+  version = "0-unstable-2025-12-26";

  src = fetchFromGitHub {
    owner = "EliverLara";
    repo = "candy-icons";
-    rev = "93f38a6acf70e156ca0ef2b902e44171894021de";
-    hash = "sha256-vVVqU6GkNJ6x9PrujcmoQRgEF0G6iAs8CarVZ6NZ1QA=";
+    rev = "1ec7ed314104847d6bffdc89ef67663917a67268";
+    hash = "sha256-p8WZTNHwYTom0QnWvOU0JLRbEYZlGQq/QPpK3KlwBH8=";
  };

  nativeBuildInputs = [ gtk3 ];
--- a/pkgs/by-name/ca/cantata/package.nix
+++ b/pkgs/by-name/ca/cantata/package.nix
@@ -25,7 +25,7 @@
  withHttpStream ? true,
  gst_all_1,
  withReplaygain ? true,
-  ffmpeg,
+  ffmpeg_6,
  speex,
  mpg123,
  withMtp ? true,
@@ -92,7 +92,7 @@ let
      ];
      enable = withReplaygain;
      pkgs = [
-        ffmpeg
+        ffmpeg_6
        speex
        mpg123
      ];
--- a/pkgs/by-name/ca/cargo-insta/package.nix
+++ b/pkgs/by-name/ca/cargo-insta/package.nix
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "cargo-insta";
-  version = "1.45.0";
+  version = "1.45.1";

  src = fetchFromGitHub {
    owner = "mitsuhiko";
    repo = "insta";
    tag = version;
-    hash = "sha256-LNHxyvShfuI1CAhnYeFDTSRmitKtCeeC6U/OJRWdJH0=";
+    hash = "sha256-uNf2KkwgRCBCVFDN5ql8MisfAoU4+z7XLWogyx8sgKw=";
  };

-  cargoHash = "sha256-mL2Z1EXXlfJyODInG+YCRtJU6xoxgS7Gt0Lpb/Rj37o=";
+  cargoHash = "sha256-U9rtovpekFiSv+RhPwgTiUVjAPPDzis1O0RrIOKWcQc=";

  checkFlags = [
    # Depends on `rustfmt` and does not matter for packaging.
--- a/pkgs/by-name/cl/clang-uml/package.nix
+++ b/pkgs/by-name/cl/clang-uml/package.nix
@@ -1,7 +1,7 @@
 {
  lib,
  fetchFromGitHub,
-  stdenv,
+  clangStdenv,
  cmake,
  pkg-config,
  installShellFiles,
@@ -15,7 +15,7 @@
  enableLibcxx ? false,
  debug ? false,
 }:
-stdenv.mkDerivation (finalAttrs: {
+clangStdenv.mkDerivation (finalAttrs: {
  pname = "clang-uml";
  version = "0.6.2";

--- a/pkgs/by-name/cl/clash-verge-rev/package.nix
+++ b/pkgs/by-name/cl/clash-verge-rev/package.nix
@@ -8,7 +8,7 @@
  wrapGAppsHook3,
  v2ray-geoip,
  v2ray-domain-list-community,
-  libsoup,
+  libsoup_3,
 }:
 let
  pname = "clash-verge-rev";
@@ -38,7 +38,7 @@ let
      pnpm-hash
      vendor-hash
      meta
-      libsoup
+      libsoup_3
      ;
  };

--- a/pkgs/by-name/cl/clash-verge-rev/unwrapped.nix
+++ b/pkgs/by-name/cl/clash-verge-rev/unwrapped.nix
@@ -23,7 +23,7 @@
  kdePackages,
  libayatana-appindicator,
  libsForQt5,
-  libsoup,
+  libsoup_3,
  openssl,
  webkitgtk_4_1,
 }:
@@ -106,7 +106,7 @@ rustPlatform.buildRustPackage {

  buildInputs = [
    libayatana-appindicator
-    libsoup
+    libsoup_3
    openssl
    webkitgtk_4_1
  ];
--- a/pkgs/by-name/co/cope/package.nix
+++ b/pkgs/by-name/co/cope/package.nix
@@ -1,10 +1,12 @@
 {
  lib,
  fetchFromGitHub,
-  perl,
-  perlPackages,
+  perl538Packages,
  makeWrapper,
 }:
+let
+  perlPackages = perl538Packages;
+in
 perlPackages.buildPerlPackage {
  pname = "cope";
  version = "0-unstable-2025-06-20";
@@ -50,7 +52,7 @@ perlPackages.buildPerlPackage {
        if [[ -f "$script" && -x "$script" ]]; then
          wrapProgram "$script" \
            --set PERL5LIB "${perlPath}:$out/lib/perl5/site_perl"
-          sed -i "1s|^#!.*perl|#!${perl}/bin/perl|" "$out/libexec/.''${script##*/}-wrapped"
+          sed -i "1s|^#!.*perl|#!${perlPackages.perl}/bin/perl|" "$out/libexec/.''${script##*/}-wrapped"
        fi
      done
      rm -r $out/${perlPackages.perl.libPrefix}/${perlPackages.perl.version}/auto
--- a/pkgs/by-name/cp/cp2k/package.nix
+++ b/pkgs/by-name/cp/cp2k/package.nix
@@ -12,7 +12,7 @@
  fftw,
  libint,
  libvori,
-  libxc,
+  libxc_7,
  dftd4,
  simple-dftd3,
  tblite,
@@ -165,7 +165,7 @@ stdenv.mkDerivation rec {
    gsl
    libint
    libvori
-    libxc
+    libxc_7
    libxsmm
    mpi
    spglib
--- a/pkgs/by-name/cs/csharpier/package.nix
+++ b/pkgs/by-name/cs/csharpier/package.nix
@@ -2,10 +2,10 @@

 buildDotnetGlobalTool {
  pname = "csharpier";
-  version = "1.2.3";
+  version = "1.2.4";
  executables = "csharpier";

-  nugetHash = "sha256-mUpciGlqLVkQW+V1KEe1/p99cy4+NYCG8PGYSynNhbs=";
+  nugetHash = "sha256-kgVQpFxQmMT/eoWkGyA8A0z//p7VponlyYF+CV7Txs8=";

  meta = {
    description = "Opinionated code formatter for C#";
--- a/pkgs/by-name/ev/everest-bin/package.nix
+++ b/pkgs/by-name/ev/everest-bin/package.nix
@@ -8,15 +8,15 @@

 let
  pname = "everest";
-  version = "6064";
+  version = "6088";
  phome = "$out/lib/Celeste";
 in
 stdenvNoCC.mkDerivation {
  inherit pname version;
  src = fetchzip {
-    url = "https://github.com/EverestAPI/Everest/releases/download/stable-1.6064.0/main.zip";
+    url = "https://github.com/EverestAPI/Everest/releases/download/stable-1.6088.0/main.zip";
    extension = "zip";
-    hash = "sha256-9NFaQNxy+2XCLr7JloxaobsNGCwJ8BLXrI5gq+8KOi0=";
+    hash = "sha256-npcjx7KOCe8T4MyK1d8Z485+XlvkMgjJ5m0PN5TbpgU=";
  };
  buildInputs = [
    icu
--- a/pkgs/by-name/ev/everest/deps.json
+++ b/pkgs/by-name/ev/everest/deps.json
@@ -26,8 +26,8 @@
  },
  {
    "pname": "KeraLua",
-    "version": "1.3.2",
-    "hash": "sha256-15C9K/S9L3yzB4wmDRNWQoWNskUVcm6qZjCbQQFGMPI="
+    "version": "1.4.7",
+    "hash": "sha256-Hr8Cs+dwmDU7ZdtLaSmAvsZ+EN3zwuazb6EjUam/cCc="
  },
  {
    "pname": "MAB.DotIgnore",
@@ -64,11 +64,6 @@
    "version": "7.0.20",
    "hash": "sha256-vq59xMfrET8InzUhkAsbs2xp3ML+SO9POsbwAiYKzkA="
  },
-  {
-    "pname": "Microsoft.Build.Tasks.Git",
-    "version": "1.1.0",
-    "hash": "sha256-cwZU5VeF6aRZJqoIevJtF9hdYC1rKEf1GuqgCmoVAzE="
-  },
  {
    "pname": "Microsoft.Build.Tasks.Git",
    "version": "8.0.0",
@@ -194,21 +189,11 @@
    "version": "1.0.3",
    "hash": "sha256-vVIonl+4dlCQuxibOZoGR3o1DAhjAYpFW15dnkUpjMk="
  },
-  {
-    "pname": "Microsoft.SourceLink.Common",
-    "version": "1.1.0",
-    "hash": "sha256-bVbHHr6Mo1NUdaaQgfj1GvGPzrobRlYb2pI7f4VDslk="
-  },
  {
    "pname": "Microsoft.SourceLink.Common",
    "version": "8.0.0",
    "hash": "sha256-AfUqleVEqWuHE7z2hNiwOLnquBJ3tuYtbkdGMppHOXc="
  },
-  {
-    "pname": "Microsoft.SourceLink.GitHub",
-    "version": "1.1.0",
-    "hash": "sha256-Y5zUGJfiSj8/rQ1lK0t5Zje8rjoUhgbWrR8IpwtzB34="
-  },
  {
    "pname": "Microsoft.SourceLink.GitHub",
    "version": "8.0.0",
--- a/pkgs/by-name/ev/everest/package.nix
+++ b/pkgs/by-name/ev/everest/package.nix
@@ -11,7 +11,7 @@

 let
  pname = "everest";
-  version = "6064";
+  version = "6088";
  phome = "$out/lib/Celeste";
 in
 buildDotnetModule {
@@ -20,11 +20,11 @@ buildDotnetModule {
  src = fetchFromGitHub {
    owner = "EverestAPI";
    repo = "Everest";
-    rev = "b5257c4a51642ca0cdda7b0e4b7287e9d1fb45e3";
+    rev = "d7bc4c2716b747d243fa4347b98422766b3d8b5a";
    fetchSubmodules = true;
    # TODO: use leaveDotGit = true and modify external/MonoMod in postFetch to please SourceLink
    # Microsoft.SourceLink.Common.targets(53,5): warning : Source control information is not available - the generated source link is empty.
-    hash = "sha256-aGZ0n9iBg5gnNEtZCWxhdEeIdmmKJuzuQBpdlc7P6QE=";
+    hash = "sha256-aCeqEqSxpLZjO8xskjcBjrKOFFGun1TxK88P2VO6BEg=";
  };

  nativeBuildInputs = [ autoPatchelfHook ];
--- a/pkgs/by-name/fa/fabric-ai/package.nix
+++ b/pkgs/by-name/fa/fabric-ai/package.nix
@@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "fabric-ai";
-  version = "1.4.357";
+  version = "1.4.364";

  src = fetchFromGitHub {
    owner = "danielmiessler";
    repo = "fabric";
    tag = "v${version}";
-    hash = "sha256-h4BcHZHKseI+L3oabvLhs9NePZTZziQdBseYDSehJqc=";
+    hash = "sha256-XOvvT13L2vOQiq0gYeWdRP/H+mu0BI47koG+DzvuAhg=";
  };

-  vendorHash = "sha256-jseTLfBGUmwXz63+jTgv6k4RHh1cJVPQA/DI5OYlsdA=";
+  vendorHash = "sha256-U7oVc7DiFWdnEfemSDtmo4XYJj/564qDOZzQX0AVOqc=";

  # Fabric introduced plugin tests that fail in the nix build sandbox.
  doCheck = false;
--- a/pkgs/by-name/fa/fasmg/package.nix
+++ b/pkgs/by-name/fa/fasmg/package.nix
@@ -90,7 +90,7 @@ stdenv.mkDerivation rec {
    mainProgram = "fasmg";
    homepage = "https://flatassembler.net";
    license = lib.licenses.bsd3;
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.iamanaws ];
    platforms = with lib.platforms; lib.intersectLists (linux ++ darwin) x86;
  };
 }
--- a/pkgs/by-name/fi/fish/package.nix
+++ b/pkgs/by-name/fi/fish/package.nix
@@ -151,13 +151,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "fish";
-  version = "4.2.1";
+  version = "4.3.1";

  src = fetchFromGitHub {
    owner = "fish-shell";
    repo = "fish-shell";
    tag = finalAttrs.version;
-    hash = "sha256-BUtHMx44efWTiS6heCUqONxngLwUCBOoDQqxoCj189U=";
+    hash = "sha256-M1/jgIbFY0VSQrHwT9/gcfA0HJ0r2cL1eJ3Y7lmmYVE=";
  };

  env = {
@@ -168,7 +168,7 @@ stdenv.mkDerivation (finalAttrs: {

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) src patches;
-    hash = "sha256-00Ch1EcX4cxMwvuDQLzTUIY7XkE3WX8bXBUA3yMRAMI=";
+    hash = "sha256-j+V4/oxKDg4oQ+7eg34sefIMJLelOSUKXTXasQK2Z1g=";
  };

  patches = [
@@ -221,6 +221,17 @@ stdenv.mkDerivation (finalAttrs: {
    substituteInPlace tests/checks/complete.fish \
      --replace-fail '/bin/ls' '${lib.getExe' coreutils "ls"}'

+    substituteInPlace tests/checks/output-buffering.fish \
+      --replace-fail '/bin/echo' '${lib.getExe' coreutils "echo"}'
+
+    substituteInPlace tests/pexpects/wait.py \
+      --replace-fail 'expect_prompt("Job ' 'expect_prompt("fish: Job ' \
+      --replace-fail 'expect_str("Job ' 'expect_str("fish: Job '
+
+    substituteInPlace share/tools/web_config/webconfig.py \
+      --replace-fail 'os.environ["__fish_terminal_color_theme"]' \
+        'os.environ.get("__fish_terminal_color_theme", "default")'
+
    # Several pexpect tests are flaky
    # See https://github.com/fish-shell/fish-shell/issues/8789
    rm tests/pexpects/exit_handlers.py
--- a/pkgs/by-name/fl/fluxcd-operator-mcp/package.nix
+++ b/pkgs/by-name/fl/fluxcd-operator-mcp/package.nix
@@ -9,16 +9,16 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "fluxcd-operator-mcp";
-  version = "0.29.0";
+  version = "0.38.1";

  src = fetchFromGitHub {
    owner = "controlplaneio-fluxcd";
    repo = "fluxcd-operator";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-yV8aGmY2mUAu0urIi7d1pIjhJasRX17hpmvFEQm4YpY=";
+    hash = "sha256-thSUS3OQecOSaC6e5o1yRuI7FAyy/wZEvp+tIdJrtSo=";
  };

-  vendorHash = "sha256-zCzMNlpBBUS2P2aywFDUp/RSl+HlfQe+L8a1+vVYbgY=";
+  vendorHash = "sha256-Z5oKy9u/aqxoEiyDJWBBoUS5WJYWcfh77kK5wyl/pdc=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/fo/fosrl-newt/package.nix
+++ b/pkgs/by-name/fo/fosrl-newt/package.nix
@@ -8,13 +8,13 @@

 buildGoModule rec {
  pname = "newt";
-  version = "1.7.0";
+  version = "1.8.1";

  src = fetchFromGitHub {
    owner = "fosrl";
    repo = "newt";
    tag = version;
-    hash = "sha256-R6X9DOu1iGS/a4d5kmKoBZI0L5k7S0w3SHHFQnQH/ho=";
+    hash = "sha256-ndgigIk/3/cPZaJHfxWh6XvtAJe3S57sEwNTMBH0lSE=";
  };

  vendorHash = "sha256-5Xr6mwPtsqEliKeKv2rhhp6JC7u3coP4nnhIxGMqccU=";
--- a/pkgs/by-name/fr/freetube/package.nix
+++ b/pkgs/by-name/fr/freetube/package.nix
@@ -20,13 +20,14 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "freetube";
-  version = "0.23.12";
+  version = "0.23.12-unstable-2025-12-13";

  src = fetchFromGitHub {
    owner = "FreeTubeApp";
    repo = "FreeTube";
-    tag = "v${finalAttrs.version}-beta";
-    hash = "sha256-DH5uT3dPDFZnFYoiMjxpNouNDRbWDctVqvDwHpUlnkY=";
+    # tag = "v${finalAttrs.version}-beta";
+    rev = "6717114de5653b08caec20b7bf3f3217723866a4";
+    hash = "sha256-PfK4Ny8MyBJ9Xw6ozJUzu+4rX+/rLWNac3lE8dBNPE0=";
  };

  # Darwin requires writable Electron dist
@@ -38,7 +39,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
      ''
    else
      ''
-        ln -s ${electron.dist} electron-dist
+        ln -s ${electron.dist} source/electron-dist
      '';

  patches = [
@@ -49,7 +50,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {

  yarnOfflineCache = fetchYarnDeps {
    yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-sM9CkDnATSEUf/uuUyT4JuRmjzwa1WzIyNYEw69MPtU=";
+    hash = "sha256-at/Kq7M8qSjlDmB6R4z51VRZRvkKAGyjU6sgHho8tBQ=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/fr/freetube/patch-build-script.patch
+++ b/pkgs/by-name/fr/freetube/patch-build-script.patch
@@ -1,13 +1,13 @@
-diff --git a/_scripts/ebuilder.config.js b/_scripts/ebuilder.config.js
-index 5b79d961..9f5945d2 100644
--- a/_scripts/ebuilder.config.js
-+++ b/_scripts/ebuilder.config.js
-@@ -1,6 +1,8 @@
- const { name, productName } = require('../package.json')
+diff --git a/_scripts/ebuilder.config.mjs b/_scripts/ebuilder.config.mjs
+index 55e72b227..d218f5ac4 100644
+--- a/_scripts/ebuilder.config.mjs
+++ b/_scripts/ebuilder.config.mjs
+@@ -2,6 +2,8 @@ import packageDetails from '../package.json' with { type: 'json' }
 
- const config = {
+ /** @type {import('electron-builder').Configuration} */
+ export default {
 +  electronVersion: "@electron-version@",
 +  electronDist: "electron-dist",
-   appId: `io.freetubeapp.${name}`,
-   copyright: 'Copyleft © 2020-2024 freetubeapp@protonmail.com',
+   appId: `io.freetubeapp.${packageDetails.name}`,
+   copyright: 'Copyleft © 2020-2025 freetubeapp@protonmail.com',
   // asar: false,
--- a/pkgs/by-name/ft/ftxui/package.nix
+++ b/pkgs/by-name/ft/ftxui/package.nix
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchFromGitHub,
+
  cmake,
  doxygen,
  gbenchmark,
@@ -9,14 +10,14 @@
  gtest,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "ftxui";
  version = "6.1.9";

  src = fetchFromGitHub {
    owner = "ArthurSonzogni";
    repo = "ftxui";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-plJxTLhOhUyuay5uYv4KLK9UTmM2vsoda+iDXVa4b+k=";
  };

@@ -33,20 +34,20 @@ stdenv.mkDerivation rec {
    gbenchmark
  ];

+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+
  cmakeFlags = [
    (lib.cmakeBool "FTXUI_BUILD_EXAMPLES" false)
    (lib.cmakeBool "FTXUI_BUILD_DOCS" true)
-    (lib.cmakeBool "FTXUI_BUILD_TESTS" doCheck)
+    (lib.cmakeBool "FTXUI_BUILD_TESTS" finalAttrs.doCheck)
  ];

-  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
-
  meta = {
    homepage = "https://github.com/ArthurSonzogni/FTXUI";
-    changelog = "https://github.com/ArthurSonzogni/FTXUI/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/ArthurSonzogni/FTXUI/blob/v${finalAttrs.version}/CHANGELOG.md";
    description = "Functional Terminal User Interface library for C++";
    license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ phanirithvij ];
    platforms = lib.platforms.all;
  };
-}
+})
--- a/pkgs/by-name/fu/fuse-overlayfs/package.nix
+++ b/pkgs/by-name/fu/fuse-overlayfs/package.nix
@@ -10,13 +10,13 @@

 stdenv.mkDerivation rec {
  pname = "fuse-overlayfs";
-  version = "1.15";
+  version = "1.16";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "fuse-overlayfs";
    rev = "v${version}";
-    hash = "sha256-awVDq87lxMtpTADhy8k95N/4yuGH+2Fn94j3JZzkuUY=";
+    hash = "sha256-FwAv5PmiBz25PNH/IEIV6cHjhlE+1mDTrgvR2vN++ZY=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/fw/fwup/package.nix
+++ b/pkgs/by-name/fw/fwup/package.nix
@@ -21,13 +21,13 @@

 stdenv.mkDerivation rec {
  pname = "fwup";
-  version = "1.13.2";
+  version = "1.15.0";

  src = fetchFromGitHub {
    owner = "fhunleth";
    repo = "fwup";
-    rev = "v${version}";
-    sha256 = "sha256-s9M734Ohf8kItoOdaxewk4Enbrm2wsT0M4Ak9+q3KA8=";
+    tag = "v${version}";
+    hash = "sha256-kVkw+/Z3+ZM1wXV/OmfaVPoUKc6MRuz8GRwpvOscuEM=";
  };

  nativeBuildInputs = [
@@ -62,6 +62,7 @@ stdenv.mkDerivation rec {
  doCheck = !stdenv.hostPlatform.isDarwin;

  meta = {
+    changelog = "https://github.com/fwup-home/fwup/blob/${src.tag}/CHANGELOG.md";
    description = "Configurable embedded Linux firmware update creator and runner";
    homepage = "https://github.com/fhunleth/fwup";
    license = lib.licenses.asl20;
--- a/pkgs/by-name/gi/gitlab-ci-ls/package.nix
+++ b/pkgs/by-name/gi/gitlab-ci-ls/package.nix
@@ -8,15 +8,15 @@

 rustPlatform.buildRustPackage rec {
  pname = "gitlab-ci-ls";
-  version = "1.2.2";
+  version = "1.2.5";
  src = fetchFromGitHub {
    owner = "alesbrelih";
    repo = "gitlab-ci-ls";
    rev = "${version}";
-    hash = "sha256-ZpLkiTJP3pofDcXrQPdl5Vm6SKsp6DecwSfXWC9h2qI=";
+    hash = "sha256-Ly4pk+16RCr3r33VrYPTZGUXfUNd5IJHfA+uj7Ef3bk=";
  };

-  cargoHash = "sha256-wDu89bhyR4a0U9KDF0iasdYrc1GUGlYH1y6D8+NKPy4=";
+  cargoHash = "sha256-/w5inDL6ECs2Ce8Bdfr4sOKhGeFC0tE5SrW3aIXjHnA=";

  nativeBuildInputs = [ pkg-config ];
  buildInputs = [ openssl ];
--- a/pkgs/by-name/go/go-errorlint/package.nix
+++ b/pkgs/by-name/go/go-errorlint/package.nix
@@ -7,17 +7,17 @@

 buildGoModule rec {
  pname = "go-errorlint";
-  version = "1.8.0";
+  version = "1.9.0";

  src = fetchFromGitea {
    domain = "codeberg.org";
    owner = "polyfloyd";
    repo = "go-errorlint";
    rev = "v${version}";
-    hash = "sha256-jczsgZAC90f2Kkrwpb9oeoK1HtlFDLOjqlexn9v5ojk=";
+    hash = "sha256-79hbXvLnlry2j1mmeHoEx1PRIRd0iRbzN6BDnUyFV+4=";
  };

-  vendorHash = "sha256-smOu92BigepCH02qm2Im3T65nUoR/IYhWTjhnjRPppA=";
+  vendorHash = "sha256-U/19X5iY7IHOHkbTADT4ueCJBPh/ryI4PCfg8ZbMLzU=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/go/goose-cli/package.nix
+++ b/pkgs/by-name/go/goose-cli/package.nix
@@ -8,6 +8,7 @@
  xorg,
  pkg-config,
  protobuf,
+  openssl,
  writableTmpDirAsHomeHook,
  nix-update-script,
  llvmPackages,
@@ -27,23 +28,34 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "goose-cli";
-  version = "1.13.1";
+  version = "1.16.1";

  src = fetchFromGitHub {
    owner = "block";
    repo = "goose";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-61MFtAhz7yq2wStNWDIlBo+OubBVor0NnpOAX8nQ8K0=";
+    hash = "sha256-lMlpgsLkPQsvc5Ad8sRrwO27ytb5hpF3doUR18DUrvw=";
  };

-  cargoHash = "sha256-YR/QUEE+EbwytiL0xkCr/EYE0O2/B/KmuLaF6TA7N6I=";
+  cargoHash = "sha256-WPrCwvGVOuTKXEHLR0WRV+YXr4r10fQf9t/Sfs/2bNI=";
+
+  cargoBuildFlags = [
+    "--bin"
+    "goose"
+    "--bin"
+    "goosed"
+  ];

  nativeBuildInputs = [
    pkg-config
    protobuf
  ];

-  buildInputs = [ dbus ] ++ lib.optionals stdenv.hostPlatform.isLinux [ xorg.libxcb ];
+  buildInputs = [
+    dbus
+    openssl
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [ xorg.libxcb ];

  env.LIBCLANG_PATH = "${lib.getLib llvmPackages.libclang}/lib";

@@ -83,6 +95,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
    "--skip=transport::streamable_http::tests::test_handle_outgoing_message_successful_request"
    "--skip=routes::audio::tests::test_transcribe_endpoint_requires_auth"
    "--skip=routes::config_management::tests::test_get_provider_models_openai_configured"
+    # tunnel tests that need external connectivity to Cloudflare
+    "--skip=tunnel::lapstone_test::test_tunnel_end_to_end"
+    "--skip=tunnel::lapstone_test::test_tunnel_post_request"
    # integration tests that need network access
    "--skip=test_replayed_session::vec_uvx_mcp_server_fetch_vec_calltoolrequestparam_name_fetch_into_arguments_some_object_url_https_example_com_vec_expects"
    "--skip=test_replayed_session::vec_github_mcp_server_stdio_vec_calltoolrequestparam_name_get_file_contents_into_arguments_some_object_owner_block_repo_goose_path_readme_md_sha_ab62b863c1666232a67048b6c4e10007a2a5b83c_vec_github_personal_access_token_expects"
--- a/pkgs/by-name/hu/hunspell/dictionaries.nix
+++ b/pkgs/by-name/hu/hunspell/dictionaries.nix
@@ -969,14 +969,14 @@ rec {
  th_TH = th-th;
  th-th = mkDict {
    pname = "hunspell-dict-th-th";
-    version = "experimental-2024-04-15";
+    version = "0-unstable-2025-12-23";
    dictFileName = "th_TH";
    readmeFile = "README.md";
    src = fetchFromGitHub {
      owner = "SyafiqHadzir";
      repo = "Hunspell-TH";
-      rev = "419eb32115b936da9c949e35b35c29b8187f6c93";
-      sha256 = "sha256-aXjof5dcEoCmep3PtvVkBhcgcd2NtqUpUEu37wsi1Uk=";
+      rev = "2c85c67288df6c5c161086eb5314cb7ba360c961";
+      sha256 = "sha256-2+tfLJGPHopfwOp2FufZYVHiWSo2z4LjvCozqr6TyGU=";
    };
    meta = {
      description = "Hunspell dictionary for Central Thai (Thailand)";
--- a/pkgs/by-name/hy/hyprpanel/package.nix
+++ b/pkgs/by-name/hy/hyprpanel/package.nix
@@ -37,7 +37,7 @@
 }:
 ags.bundle {
  pname = "hyprpanel";
-  version = "0-unstable-2025-11-07";
+  version = "0-unstable-2025-12-24";

  __structuredAttrs = true;
  strictDeps = true;
@@ -45,8 +45,8 @@ ags.bundle {
  src = fetchFromGitHub {
    owner = "Jas-SinghFSU";
    repo = "HyprPanel";
-    rev = "f9a04192e8fb90a48e1756989f582dc0baec2351";
-    hash = "sha256-W/eYgKKVqCh7SJLHk6Asc4LvU3YXvGtlL29yBMGymz4=";
+    rev = "17ecff630bece1ac81569e427088ee8b11322f36";
+    hash = "sha256-xgMcrwKhFSQeSQN7ak0iUHNsnxaprEzuRYRo2ADeTtg=";
  };

  # keep in sync with https://github.com/Jas-SinghFSU/HyprPanel/blob/master/flake.nix#L42
--- a/pkgs/by-name/im/impala/package.nix
+++ b/pkgs/by-name/im/impala/package.nix
@@ -21,6 +21,9 @@ rustPlatform.buildRustPackage rec {
    homepage = "https://github.com/pythops/impala";
    platforms = lib.platforms.linux;
    license = lib.licenses.gpl3Only;
-    maintainers = [ lib.maintainers.nydragon ];
+    maintainers = with lib.maintainers; [
+      nydragon
+      bridgesense
+    ];
  };
 }
--- a/pkgs/by-name/ja/jack-link/package.nix
+++ b/pkgs/by-name/ja/jack-link/package.nix
@@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "jack-link";
-  version = "0.2.5";
+  version = "0.2.6";

  src = fetchFromGitHub {
    owner = "rncbc";
    repo = "jack_link";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-UYyVGc9/NOLzFD/31zB9lhUJW8G/PGt7VkSBjntpymw=";
+    hash = "sha256-mZ74nkiAQHkJAZYHTsNcQnrisaUIyHwEDUbrvOL6CAU=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/js/json-tui/package.nix
+++ b/pkgs/by-name/js/json-tui/package.nix
@@ -0,0 +1,69 @@
+{
+  lib,
+  stdenv,
+  fetchpatch2,
+  fetchFromGitHub,
+
+  cmake,
+  ftxui,
+  libargs,
+  nlohmann_json,
+  gtest,
+  gbenchmark,
+
+  versionCheckHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "json-tui";
+  version = "1.4.1";
+
+  src = fetchFromGitHub {
+    owner = "ArthurSonzogni";
+    repo = "json-tui";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-qS2EbCxH8sUUJMu5hwm1+Nu6SsJRfLReX56YSd1RZU4=";
+  };
+
+  patches = [
+    # fixes tests - https://github.com/ArthurSonzogni/json-tui/pull/37
+    (fetchpatch2 {
+      url = "https://github.com/ArthurSonzogni/json-tui/commit/645060a016c1e1ca84b9e1dc638a926415aaa5fe.patch?full_index=1";
+      hash = "sha256-8AZEZgU8HHyaasb/7LegSwRAMo1iyonv3XUY284nYKg=";
+    })
+  ];
+
+  strictDeps = true;
+
+  buildInputs = [
+    ftxui
+    libargs
+    nlohmann_json
+  ];
+
+  nativeBuildInputs = [ cmake ];
+
+  checkInputs = [ gbenchmark ];
+
+  doCheck = stdenv.buildPlatform.canExecute stdenv.hostPlatform;
+
+  cmakeFlags = [
+    "-Wno-dev" # suppress cmake warning about deprecated usage
+    (lib.cmakeBool "JSON_TUI_BUILD_TESTS" finalAttrs.doCheck)
+    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_GOOGLETEST" "${gtest.src}")
+  ];
+
+  doInstallCheck = true;
+  versionCheckProgramArg = "--version";
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  meta = {
+    homepage = "https://github.com/ArthurSonzogni/json-tui";
+    changelog = "https://github.com/ArthurSonzogni/json-tui/blob/v${finalAttrs.version}/CHANGELOG.md";
+    description = "JSON terminal UI made in C++";
+    license = lib.licenses.mit;
+    mainProgram = "json-tui";
+    maintainers = with lib.maintainers; [ phanirithvij ];
+    platforms = lib.platforms.all;
+  };
+})
--- a/pkgs/by-name/ka/kaidan/package.nix
+++ b/pkgs/by-name/ka/kaidan/package.nix
@@ -21,14 +21,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "kaidan";
-  version = "0.13.0-unstable-2025-12-13";
+  version = "0.13.0-unstable-2025-12-25";

  src = fetchFromGitLab {
    domain = "invent.kde.org";
    owner = "network";
    repo = "kaidan";
-    rev = "eb43bd732997f52c630dc94d45682713c2bb5c75";
-    hash = "sha256-YIK6te7pjD28M/5bkPnYojGeaBNk8j8pt1VPlh+OnXE=";
+    rev = "834d89c2115a48188e827089db05a88db5dc1f8f";
+    hash = "sha256-o7x6Ib9zL4akzjvz+mSACQHyj2xH6RzoCniumNjK1lw=";
  };

  patches = [
--- a/pkgs/by-name/ka/kata-runtime/kata-images.nix
+++ b/pkgs/by-name/ka/kata-runtime/kata-images.nix
@@ -4,6 +4,7 @@
  lib,
  stdenv,
  version,
+  zstd,
 }:

 let
@@ -16,16 +17,17 @@ let

  imageHash =
    {
-      "x86_64-linux" = "sha256-7xDc5Rr3rP36zS3kpM2QEqOCtmka3EAnts4Z1h8MNWY=";
-      "aarch64-linux" = "sha256-8nLHTPetEfIrdtrpiT9Czcpf0NhL97TZ2DXyeBL04LA=";
+      "x86_64-linux" = "sha256-roS2pGO00ORN+xxNU3/uqJG9RzhVqf8gCkt8EJJbY/g=";
+      "aarch64-linux" = "sha256-AuK5a2Qtd176B91+vSsEFwuWICpe8wcGTbXoE7B8b20=";
    }
    ."${stdenv.hostPlatform.system}" or (throw "Unsupported system: ${stdenv.hostPlatform.system}");

 in
 fetchzip {
  name = "kata-images-${version}";
-  url = "https://github.com/kata-containers/kata-containers/releases/download/${version}/kata-static-${version}-${imageSuffix}.tar.xz";
+  url = "https://github.com/kata-containers/kata-containers/releases/download/${version}/kata-static-${version}-${imageSuffix}.tar.zst";
  hash = imageHash;
+  nativeBuildInputs = [ zstd ];

  postFetch = ''
    mv $out/kata/share/kata-containers kata-containers
--- a/pkgs/by-name/ka/kata-runtime/package.nix
+++ b/pkgs/by-name/ka/kata-runtime/package.nix
@@ -11,7 +11,7 @@
 }:

 let
-  version = "3.16.0";
+  version = "3.21.0";

  kata-images = callPackage ./kata-images.nix { inherit version; };

@@ -34,7 +34,7 @@ buildGoModule rec {
    owner = "kata-containers";
    repo = "kata-containers";
    rev = version;
-    hash = "sha256-+SppAF77NbXlSrBGvIm40AmNC12GrexbX7fAPBoDAcs=";
+    hash = "sha256-gOPabvimKzP7U1/BRzjKPDKE0MHnhKI4j0WZPM6ZTSA=";
  };

  sourceRoot = "${src.name}/src/runtime";
--- a/pkgs/by-name/li/libmt32emu/package.nix
+++ b/pkgs/by-name/li/libmt32emu/package.nix
@@ -7,13 +7,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libmt32emu";
-  version = "2.7.2";
+  version = "2.7.3";

  src = fetchFromGitHub {
    owner = "munt";
    repo = "munt";
    tag = "libmt32emu_${lib.replaceStrings [ "." ] [ "_" ] finalAttrs.version}";
-    hash = "sha256-wXIvdGoup/AOQggkeXvtbi3pXhyKUKWmyt/ZbGzufds=";
+    hash = "sha256-3sL9ZDM4/70vKPkOU6Et82c3RC5OYt0eQb5miDYRU0I=";
  };

  outputs = [
--- a/pkgs/by-name/li/libretro-shaders-slang/package.nix
+++ b/pkgs/by-name/li/libretro-shaders-slang/package.nix
@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation {
  pname = "libretro-shaders-slang";
-  version = "0-unstable-2025-12-22";
+  version = "0-unstable-2025-12-27";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "slang-shaders";
-    rev = "92ec9ff8c2d53d397b6d943788c748c073ee1fe8";
-    hash = "sha256-p2CmXbgd0oKibZa2PiS3xI6KXfsIWtJ+QyvLrc9PFWY=";
+    rev = "e24402e35d762a017127f44701cad8d3f4704f44";
+    hash = "sha256-yv0MM90ACG5JGf9ypkyK3xlr6V284F/PrPAbXjuLZWw=";
  };

  dontConfigure = true;
--- a/pkgs/by-name/li/limine/package.nix
+++ b/pkgs/by-name/li/limine/package.nix
@@ -47,14 +47,14 @@ in
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation (finalAttrs: {
  pname = "limine";
-  version = "10.5.1";
+  version = "10.6.0";

  # We don't use the Git source but the release tarball, as the source has a
  # `./bootstrap` script performing network access to download resources.
  # Packaging that in Nix is very cumbersome.
  src = fetchurl {
    url = "https://codeberg.org/Limine/Limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-sD41QQJ3zGDHinynlj5lpZoOPVPyutMCLDnNZNmttHI=";
+    hash = "sha256-rNLPfDHYVGOzO7pnv7w+l8kevmKPFFJ3O5MtPN6YlG4=";
  };

  enableParallelBuilding = true;
--- a/pkgs/by-name/lu/luau-lsp/package.nix
+++ b/pkgs/by-name/lu/luau-lsp/package.nix
@@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "luau-lsp";
-  version = "1.58.0";
+  version = "1.59.0";

  src = fetchFromGitHub {
    owner = "JohnnyMorganz";
    repo = "luau-lsp";
    tag = finalAttrs.version;
-    hash = "sha256-6+GVyUSDsv9INoivIsiO+eoBZvueLeDGA/9Lc2l7xRk=";
+    hash = "sha256-hd1yQ+VJenmBk2WIjO7tFdoyJ8jIq6248ljz9T6c4Vc=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/ly/lynis/package.nix
+++ b/pkgs/by-name/ly/lynis/package.nix
@@ -7,15 +7,15 @@
  installShellFiles,
 }:

-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "lynis";
  version = "3.1.6";

  src = fetchFromGitHub {
    owner = "CISOfy";
    repo = "lynis";
-    rev = version;
-    sha256 = "sha256-f1iV9OBkycrwP3ydjaGMX45JIBtzZKHEJqnEoVuZPu4=";
+    tag = finalAttrs.version;
+    hash = "sha256-XMgC6KjkLgjSOBHBx7WM7C2Vm3Z/lto7CFs10kIxwZc=";
  };

  nativeBuildInputs = [
@@ -28,10 +28,11 @@ stdenv.mkDerivation rec {
  '';

  installPhase = ''
-    install -d $out/bin $out/share/lynis/plugins
-    cp -r include db default.prf $out/share/lynis/
-    cp -a lynis $out/bin
-    wrapProgram "$out/bin/lynis" --prefix PATH : ${lib.makeBinPath [ gawk ]}
+    install -d $out/bin $out/share/lynis
+    install -Dm555 -t $out/libexec lynis
+    cp -r include db default.prf plugins $out/share/lynis/
+    makeWrapper "$out/libexec/lynis" "$out/bin/lynis" \
+      --prefix PATH : ${lib.makeBinPath [ gawk ]}

    installManPage lynis.8
    installShellCompletion --bash --name lynis.bash \
@@ -44,6 +45,6 @@ stdenv.mkDerivation rec {
    homepage = "https://cisofy.com/lynis/";
    license = lib.licenses.gpl3Only;
    platforms = lib.platforms.unix;
-    maintainers = [ lib.maintainers.ryneeverett ];
+    maintainers = with lib.maintainers; [ ryneeverett ];
  };
-}
+})
--- a/pkgs/by-name/mi/microsoft-edge/package.nix
+++ b/pkgs/by-name/mi/microsoft-edge/package.nix
@@ -274,6 +274,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
      leleuvilela
      bricklou
      jonhermansen
+      iedame
    ];
    platforms = [ "x86_64-linux" ];
    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
--- a/pkgs/by-name/mi/mirrord/manifest.json
+++ b/pkgs/by-name/mi/mirrord/manifest.json
@@ -1,21 +1,21 @@
 {
-  "version": "3.178.0",
+  "version": "3.179.0",
  "assets": {
    "x86_64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.178.0/mirrord_linux_x86_64",
-      "hash": "sha256-UFG/N5qNuBuBnmD6FDJk3Ly+zKGaUtOEO+7H82VFeFc="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.179.0/mirrord_linux_x86_64",
+      "hash": "sha256-VStFqwOut1VnspK7963VvR5tnEEmASiWxHj8riiPUCg="
    },
    "aarch64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.178.0/mirrord_linux_aarch64",
-      "hash": "sha256-/K9VoCHacmPZuv0ycvt9GPrDG/xDPlq6AP3zAO0Lmlo="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.179.0/mirrord_linux_aarch64",
+      "hash": "sha256-mK+b3oCCZ098MMYQtRoXo1BuAlxz+4rtdB7EN1vDO38="
    },
    "aarch64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.178.0/mirrord_mac_universal",
-      "hash": "sha256-l3ho45nkazyk8byirvq5J0ZMmrqcMasUMUYBj88bh24="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.179.0/mirrord_mac_universal",
+      "hash": "sha256-TX4DolNZE0dqZj3DFzCyDOKSBcfHK2b8vjJQ07SOtIM="
    },
    "x86_64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.178.0/mirrord_mac_universal",
-      "hash": "sha256-l3ho45nkazyk8byirvq5J0ZMmrqcMasUMUYBj88bh24="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.179.0/mirrord_mac_universal",
+      "hash": "sha256-TX4DolNZE0dqZj3DFzCyDOKSBcfHK2b8vjJQ07SOtIM="
    }
  }
 }
--- a/pkgs/by-name/na/naja/package.nix
+++ b/pkgs/by-name/na/naja/package.nix
@@ -17,13 +17,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "naja";
-  version = "0.3.0";
+  version = "0.3.2";

  src = fetchFromGitHub {
    owner = "najaeda";
    repo = "naja";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-u7pblUmMJYYd0o7jzT5g9moPrWdOgqhPXPzx+B90ybg=";
+    hash = "sha256-94sv8eeQacsCELTMIUhG9JKtJtVAxmF88Pvj9udN/fM=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/no/nohang/package.nix
+++ b/pkgs/by-name/no/nohang/package.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  stdenv,
+  nixosTests,
+  fetchFromGitHub,
+  python3,
+  sudo,
+  libnotify,
+  coreutils,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "nohang";
+  version = "0.2.0";
+
+  src = fetchFromGitHub {
+    owner = "hakavlad";
+    repo = "nohang";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-aRiBGnJHdtQ5euvJ4DSuCZO5i5OJVRiCesaatrIARmg=";
+  };
+
+  postPatch = ''
+    patchShebangs src
+    substituteInPlace src/nohang \
+      --replace-fail 'notify-send' '${lib.getExe libnotify}' \
+      --replace-fail 'sudo' '${lib.getExe sudo}' \
+      --replace-fail "'env'" "'${lib.getExe' coreutils "env"}'"
+  '';
+
+  buildInputs = [ python3 ];
+
+  dontBuild = true;
+
+  installTargets = [ "base" ];
+  installFlags = [
+    "DESTDIR=${placeholder "out"}"
+    "PREFIX=/"
+    "SBINDIR=/sbin"
+    "SYSCONFDIR=/etc"
+    "SYSTEMDUNITDIR=/lib/systemd/system"
+  ];
+
+  passthru.tests = {
+    inherit (nixosTests) nohang;
+  };
+
+  meta = {
+    homepage = "https://github.com/hakavlad/nohang";
+    description = "Sophisticated low memory handler for Linux";
+    license = with lib.licenses; [ mit ];
+    mainProgram = "nohang";
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ Dev380 ];
+  };
+})
--- a/pkgs/by-name/op/openapi-generator-cli/package.nix
+++ b/pkgs/by-name/op/openapi-generator-cli/package.nix
@@ -10,7 +10,7 @@

 let
  jre = jre_headless;
-  version = "7.17.0";
+  version = "7.18.0";
  mainProgram = "openapi-generator-cli";
  this = maven.buildMavenPackage {
    inherit version;
@@ -21,10 +21,10 @@ let
      owner = "OpenAPITools";
      repo = "openapi-generator";
      tag = "v${version}";
-      hash = "sha256-9jO+u08wrxW0RcXTGDh8mpPp9Eu2PwRifKNsso6s3QM=";
+      hash = "sha256-D7F4fbgXqUMH0ZOsnGtB3gVWmans0MPdD7ix6ImXsfA=";
    };

-    mvnHash = "sha256-PiLpJponpJUXakdno+KGxzDvZG6jYRPp3t5q/G5JX+M=";
+    mvnHash = "sha256-17siKb+TIYAuY1p7+1mcc3QY+Rfnsoy+CJiWT5LFM0w=";
    mvnParameters = "-Duser.home=$TMPDIR";
    doCheck = false;

--- a/pkgs/by-name/op/opengamepadui/package.nix
+++ b/pkgs/by-name/op/opengamepadui/package.nix
@@ -23,7 +23,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "opengamepadui";
-  version = "0.42.2";
+  version = "0.42.3";

  buildType = if withDebug then "debug" else "release";

@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "ShadowBlip";
    repo = "OpenGamepadUI";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-POTW6qnzaVtoTo8ibCCaap0DS8VJiEGm2Mr5ZBkuLZc=";
+    hash = "sha256-sqzCGGrMxOjepi9GxJFCAY+tzuIwOgs5qYeIYKb7Y1U=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
--- a/pkgs/by-name/op/opensnitch-ui/package.nix
+++ b/pkgs/by-name/op/opensnitch-ui/package.nix
@@ -1,6 +1,6 @@
 {
  python3Packages,
-  qt5,
+  qt6,
  lib,
  opensnitch,
 }:
@@ -12,29 +12,21 @@ python3Packages.buildPythonApplication {
  inherit (opensnitch) src version;
  sourceRoot = "${opensnitch.src.name}/ui";

-  patches = [
-    # https://github.com/evilsocket/opensnitch/pull/1413
-    # unicode-slugify has failing tests and is overall unmaintained and broken.
-    # python-slugify is a preferrable replacement
-    ./use_python_slugify.patch
-  ];
-
  postPatch = ''
    substituteInPlace opensnitch/utils/__init__.py \
      --replace-fail /usr/lib/python3/dist-packages/data ${python3Packages.pyasn}/${python3Packages.python.sitePackages}/pyasn/data
  '';

  nativeBuildInputs = [
-    qt5.wrapQtAppsHook
+    qt6.wrapQtAppsHook
  ];

  buildInputs = [
-    qt5.qtwayland
+    qt6.qtwayland
  ];

  build-system = with python3Packages; [
    setuptools
-    pyqt5
  ];

  dependencies = with python3Packages; [
@@ -43,7 +35,7 @@ python3Packages.buildPythonApplication {
    packaging
    pyasn
    pyinotify
-    pyqt5
+    pyqt6
    qt-material
    python-slugify
    unidecode
@@ -52,7 +44,6 @@ python3Packages.buildPythonApplication {
  preBuild = ''
    make -C ../proto ../ui/opensnitch/ui_pb2.py
    # sourced from ui/Makefile
-    pyrcc5 -o opensnitch/resources_rc.py opensnitch/res/resources.qrc
    sed -i 's/^import ui_pb2/from . import ui_pb2/' opensnitch/proto/ui_pb2*
  '';

--- a/pkgs/by-name/op/opensnitch-ui/use_python_slugify.patch
+++ b/pkgs/by-name/op/opensnitch-ui/use_python_slugify.patch
@@ -1,11 +0,0 @@
-diff --git a/requirements.txt b/requirements.txt
-index 66e0de13..68d651b1 100644
--- a/requirements.txt
-+++ b/requirements.txt
-@@ -1,5 +1,5 @@
- grpcio-tools>=1.10.1
- pyinotify==0.9.6
-unicode_slugify==0.1.5
-+python-slugify>=7.0.0
- pyqt5>=5.6
- protobuf
--- a/pkgs/by-name/op/opensnitch/package.nix
+++ b/pkgs/by-name/op/opensnitch/package.nix
@@ -1,7 +1,6 @@
 {
  buildGoModule,
  fetchFromGitHub,
-  fetchpatch,
  protobuf,
  go-protobuf,
  pkg-config,
@@ -35,29 +34,15 @@ let
 in
 buildGoModule (finalAttrs: {
  pname = "opensnitch";
-  version = "1.7.2";
+  version = "1.8.0";

  src = fetchFromGitHub {
    owner = "evilsocket";
    repo = "opensnitch";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-XAR7yZjAzbMxIVGSV82agpAGwlejkILGgDI6iRicZuQ=";
+    hash = "sha256-Bz5h2DEC61vpkeWZxFlogh6NvTubJcnHuwgTNSzZd68=";
  };

-  patches = [
-    (fetchpatch {
-      # https://github.com/evilsocket/opensnitch/pull/1418
-      # allow configuring the audit socket path
-      url = "https://github.com/evilsocket/opensnitch/commit/f9358a464f204068359bf5174e6ff43288f12c7e.patch?full_index=1";
-      hash = "sha256-s9CM1CyGpfJZXEtihXCM7nfPhBY8XuwubynTotqtf3E=";
-    })
-    (fetchpatch {
-      # add missing colon in test definition
-      url = "https://github.com/evilsocket/opensnitch/commit/4b38ca1260295d2e0f8c4a7313529f83dcca4554.patch?full_index=1";
-      hash = "sha256-/z3iFRpcv75FyarVnpK8/PTU2fcFHS+SNbHn7M5Etk8=";
-    })
-  ];
-
  postPatch = ''
    # Allow configuring Version at build time
    substituteInPlace daemon/core/version.go --replace-fail "const " "var "
@@ -87,13 +72,11 @@ buildGoModule (finalAttrs: {
  postBuild = ''
    mv $GOPATH/bin/daemon $GOPATH/bin/opensnitchd
    mkdir -p $out/etc/opensnitchd $out/lib/systemd/system
-    cp system-fw.json $out/etc/opensnitchd/
-    substitute default-config.json $out/etc/opensnitchd/default-config.json \
+    cp -r data/{rules,*.json} $out/etc/opensnitchd/
+    substituteInPlace $out/etc/opensnitchd/default-config.json \
      --replace-fail "/var/log/opensnitchd.log" "/dev/stdout"
-    # Do not mkdir rules path
-    sed -i '8d' opensnitchd.service
    # Fixup hardcoded paths
-    substitute opensnitchd.service $out/lib/systemd/system/opensnitchd.service \
+    substitute data/init/opensnitchd.service $out/lib/systemd/system/opensnitchd.service \
      --replace-fail "/usr/local/bin/opensnitchd" "$out/bin/opensnitchd"
  '';

--- a/pkgs/by-name/op/openvscode-server/package.nix
+++ b/pkgs/by-name/op/openvscode-server/package.nix
@@ -36,13 +36,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "openvscode-server";
-  version = "1.103.1";
+  version = "1.106.3";

  src = fetchFromGitHub {
    owner = "gitpod-io";
    repo = "openvscode-server";
    rev = "openvscode-server-v${finalAttrs.version}";
-    hash = "sha256-Co0MF8Yr60Ppv6Zv85nJeua2S5Rnye6wGB1hTWNpMm4=";
+    hash = "sha256-wcmk35oqJ6d5MR9YnqC/pR0pC03/vCFCd9KLRByQWqk=";
  };

  ## fetchNpmDeps doesn't correctly process git dependencies
@@ -55,7 +55,7 @@ stdenv.mkDerivation (finalAttrs: {
        inherit (finalAttrs) src nativeBuildInputs;
        outputHashMode = "recursive";
        outputHashAlgo = "sha256";
-        outputHash = "sha256-xK4qfzkWuOsEyP1+6cY5Dhrr5wNW3eOJBTyQaE6gTcc=";
+        outputHash = "sha256-FnlzXlhu72G9dUnezzc62qH2TG5mU9EJNe9akWtR6zg=";
        env = {
          FORCE_EMPTY_CACHE = true;
          FORCE_GIT_DEPS = true;
@@ -69,10 +69,8 @@ stdenv.mkDerivation (finalAttrs: {
        mkdir $out
        for p in $(find -name package-lock.json)
        do (
-          ${prefetch-npm-deps}/bin/prefetch-npm-deps "$p" "$out"
-          local lockpath=$out/lockfiles/$p
-          mkdir -p "$(dirname $lockpath)"
-          mv $out/package-lock.json "$lockpath"
+          echo "Prefetching $p"
+          ${prefetch-npm-deps}/bin/prefetch-npm-deps "$p" "$out/$(dirname $p)"
        )
        done
      '';
@@ -89,9 +87,6 @@ stdenv.mkDerivation (finalAttrs: {
    NIX_NODEJS_BUILDNPMPACKAGE = "1";
    npm_config_nodedir = nodejs;
    npm_config_node_gyp = "${nodejs}/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js";
-
-    # use local npm cache (see <nixpkgs/pkgs/build-support/node/build-npm-package/hooks/npm-config-hook.sh>)
-    npm_config_cache = finalAttrs.nodeModules;
    npm_config_offline = true;
    npm_config_progress = false;

@@ -145,12 +140,9 @@ stdenv.mkDerivation (finalAttrs: {
  preConfigure = ''
    export HOME=$TMPDIR/home
    mkdir -p $HOME
-    mkdir -p $TMPDIR/cache/_cacache
-    # ln -s $nodeModules/_cacache/* $TMPDIR/cache/_cacache
-    # mkdir -p $TMPDIR/cache
-    cp -R $nodeModules/_cacache $TMPDIR/cache
+    mkdir -p $TMPDIR
+    cp -R $nodeModules $TMPDIR/cache
    chmod -R +w $TMPDIR/cache
-    export npm_config_cache=$TMPDIR/cache
  '';

  configurePhase = ''
@@ -167,7 +159,7 @@ stdenv.mkDerivation (finalAttrs: {
        echo >&2 "File exists $p/node_modules"
        exit 0
      fi
-      npm ci --ignore-scripts
+      npm_config_cache=$TMPDIR/cache/$p npm ci --ignore-scripts
      patchShebangs node_modules
    )
    done
@@ -186,13 +178,10 @@ stdenv.mkDerivation (finalAttrs: {
  ''
  ## node-pty build fix
  + ''
-    substituteInPlace remote/node_modules/node-pty/scripts/post-install.js \
-      --replace-fail "npx node-gyp" "$npm_config_node_gyp"
-  ''
-  ## rebuild native binaries
-  + ''
-    echo >&2 "Rebuilding from source in ./remote"
-    npm --offline --prefix ./remote rebuild --build-from-source
+    find -path node_modules/node-pty/scripts/gen-compile-commands.js \
+         -exec substituteInPlace {} \
+                 --replace-fail "npx node-gyp" "$npm_config_node_gyp" \
+               \;
  ''
  ## run postinstall scripts
  + ''
@@ -200,11 +189,16 @@ stdenv.mkDerivation (finalAttrs: {
      if jq -e ".scripts.postinstall" {} >-
      then
        echo >&2 "Running postinstall script in $(dirname {})"
-        npm --offline --prefix=$(dirname {}) run postinstall
+        npm --prefix=$(dirname {}) run postinstall
      fi
      exit 0
    ' \;
  ''
+  ## rebuild native binaries
+  + ''
+    echo >&2 "Rebuilding from source in ./remote"
+    npm --prefix ./remote rebuild --build-from-source
+  ''
  + ''
    runHook postConfigure
  '';
--- a/pkgs/by-name/pi/pixelfed/package.nix
+++ b/pkgs/by-name/pi/pixelfed/package.nix
@@ -44,7 +44,7 @@ php.buildComposerProject2 (finalAttrs: {
    description = "Federated image sharing platform";
    license = lib.licenses.agpl3Only;
    homepage = "https://pixelfed.org/";
-    maintainers = [ ];
+    teams = with lib.teams; [ ngi ];
    platforms = php.meta.platforms;
  };
 })
--- a/pkgs/by-name/pl/plasma-panel-colorizer/package.nix
+++ b/pkgs/by-name/pl/plasma-panel-colorizer/package.nix
@@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "plasma-panel-colorizer";
-  version = "6.0.0";
+  version = "6.1.0";

  src = fetchFromGitHub {
    owner = "luisbocanegra";
    repo = "plasma-panel-colorizer";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-gK5WkGWAS64R/msPbHDrMPtWlHQQbnxfPINmFARCBR8=";
+    hash = "sha256-s+4TH6xYs53/HVU5UD3YyjYgbc0Ul+RmC1kV7eJHO/o=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/pr/proton-ge-bin/package.nix
+++ b/pkgs/by-name/pr/proton-ge-bin/package.nix
@@ -9,11 +9,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "proton-ge-bin";
-  version = "GE-Proton10-26";
+  version = "GE-Proton10-27";

  src = fetchzip {
    url = "https://github.com/GloriousEggroll/proton-ge-custom/releases/download/${finalAttrs.version}/${finalAttrs.version}.tar.gz";
-    hash = "sha256-Q5bKTDn3sTgp4mbsevOdN3kcdRsyKylghXqM2I2cYq8=";
+    hash = "sha256-yBPjPb2LzxdgEobuoeSfs3UZ1XUxZF6vIMYF+fAnLA0=";
  };

  dontUnpack = true;
--- a/pkgs/by-name/re/resterm/package.nix
+++ b/pkgs/by-name/re/resterm/package.nix
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "resterm";
-  version = "0.12.0";
+  version = "0.13.2";

  src = fetchFromGitHub {
    owner = "unkn0wn-root";
    repo = "resterm";
    tag = "v${finalAttrs.version}";
-    sha256 = "sha256-fqCJXWmmvgGpdJ+mAP2rizQUX3gQdN6rYW5dqkvWFns=";
+    sha256 = "sha256-CA1+Sa9fqeTaz37FCJGErShinMP6cSNoCtuifdyLUpk=";
  };

  vendorHash = "sha256-Kj60MkxqRYORANalbJnjgtHMDgxOUOeaF1opqcYnVww=";
--- a/pkgs/by-name/re/reth/package.nix
+++ b/pkgs/by-name/re/reth/package.nix
@@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage rec {
  pname = "reth";
-  version = "1.8.3";
+  version = "1.9.3";

  src = fetchFromGitHub {
    owner = "paradigmxyz";
    repo = "reth";
    rev = "v${version}";
-    hash = "sha256-jyStSIVTQeBJGwNelxHItIjHPQyvg3luGRj0qziZ8u0=";
+    hash = "sha256-zTSwRSSZDINHEkbtTiLP3mgod9lDzFrPxMXq88NTOAM=";
  };

-  cargoHash = "sha256-v7B2W9SSQvUlJQzP/AAffsJq+fP4Ghxr4C5+gB1LE9k=";
+  cargoHash = "sha256-WDe75Sg7y4GfH3dSfY48aXrIBe89skj1VW0NcgtLEVU=";

  nativeBuildInputs = [
    rustPlatform.bindgenHook
--- a/pkgs/by-name/s7/s7/package.nix
+++ b/pkgs/by-name/s7/s7/package.nix
@@ -26,14 +26,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "s7";
-  version = "11.7-unstable-2025-12-19";
+  version = "11.7-unstable-2025-12-27";

  src = fetchFromGitLab {
    domain = "cm-gitlab.stanford.edu";
    owner = "bil";
    repo = "s7";
-    rev = "7fb6a59b5150e6146c6d3df3bb9e9cba7ae449bc";
-    hash = "sha256-nZMvdlaVyI2zH0r8yrZn1ESN+7/Wk2D+OWujzPahnZU=";
+    rev = "3cccb2a354966fc4b7e30182b1b0956a8a84523c";
+    hash = "sha256-uLo/DvTfOU615wMm/Qgp89wdqTeSlAt0Vqv99fUPwjw=";
  };

  buildInputs =
--- a/pkgs/by-name/sd/sdl3-shadercross/package.nix
+++ b/pkgs/by-name/sd/sdl3-shadercross/package.nix
@@ -13,7 +13,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "sdl3-shadercross";
-  version = "0-unstable-2025-12-06";
+  version = "0-unstable-2025-12-24";

  outputs = [
    "out"
@@ -24,8 +24,8 @@ stdenv.mkDerivation (finalAttrs: {
  src = fetchFromGitHub {
    owner = "libsdl-org";
    repo = "SDL_shadercross";
-    rev = "f1ca8cfefba8f32095861bbcf2a4f4d773f0fbb4";
-    hash = "sha256-q0iEoN8+f438ScgAvobDh7evulfaZ3Cd8zkc19kRT54=";
+    rev = "feec623003c01a9fff5b30e114c38f550255b511";
+    hash = "sha256-AGfuUYUGbea3LDgGiwxq6XBMgLeatsdWDpciL4JeTWU=";
  };

  strictDeps = true;
--- a/Show More
+++ b/Show More