Merge staging-next into staging

2026-09-28 10:50:15 +00:00 · 2026-08-27 15:42:47 +00:00
parent 14f7c4ac52 598c3ec942
commit b05f2bb56c
81 changed files with 1068 additions and 345 deletions
--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -722,10 +722,9 @@ let
      # a module will resolve strictly the attributes used as argument but
      # not their values.  The values are forwarding the result of the
      # evaluation of the option.
-      context = name: ''while evaluating the module argument `${name}' in "${key}":'';
      extraArgs = mapAttrs (
        name: _:
-        addErrorContext (context name) (
+        addErrorContext ''while evaluating the module argument `${name}' in "${key}":'' (
          args.${name} or (addErrorContext
            "noting that argument `${name}` is not externally provided, so querying `_module.args` instead, requiring `config`"
            config._module.args.${name}
--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@@ -386,14 +386,12 @@ in
      moduleParams = lib.mkOption {
        type = lib.types.attrsOf (lib.types.attrsOf lib.types.raw);
        default = { };
-        example = ''
-          {
-            nvidia = {
-              NVreg_UsePageAttributeTable = 1;
-              NVreg_RegistryDwords = "EnableBrightnessControl=1"
-            };
-          }
-        '';
+        example = {
+          nvidia = {
+            NVreg_UsePageAttributeTable = 1;
+            NVreg_RegistryDwords = "EnableBrightnessControl=1";
+          };
+        };
        description = "Additional parameters to pass to the NVIDIA kernel module.";
      };
    };
--- a/nixos/modules/services/video/wivrn.nix
+++ b/nixos/modules/services/video/wivrn.nix
@@ -189,11 +189,6 @@ in
        wivrn = {
          description = "WiVRn XR runtime service";
          environment = recursiveUpdate {
-            # Default options
-            # https://gitlab.freedesktop.org/monado/monado/-/blob/598080453545c6bf313829e5780ffb7dde9b79dc/src/xrt/targets/service/monado.in.service#L12
-            XRT_COMPOSITOR_LOG = "debug";
-            XRT_PRINT_OPTIONS = "on";
-            IPC_EXIT_ON_DISCONNECT = "off";
            PRESSURE_VESSEL_IMPORT_OPENXR_1_RUNTIMES = mkIf cfg.steam.importOXRRuntimes "1";
          } cfg.monadoEnvironment;
          # WiVRn scans for .desktop files in $XDG_DATA_DIRS for the application launcher,
--- a/pkgs/applications/emulators/libretro/cores/fceumm.nix
+++ b/pkgs/applications/emulators/libretro/cores/fceumm.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "fceumm";
-  version = "0-unstable-2026-07-28";
+  version = "0-unstable-2026-08-22";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "libretro-fceumm";
-    rev = "b5e3566515c27dc66c9c20572171673126532e06";
-    hash = "sha256-MnI7SItJcFw8RmpF9BsV3d160azLG7rFmOoZ2DKnyR4=";
+    rev = "236ccdfc911e84c60fea6b9d0699c2d440a8de14";
+    hash = "sha256-BCue1mINcrIjc+45T/JpTyxhW669pUl5HgzoMPbaDj8=";
  };

  meta = {
--- a/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
+++ b/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "genesis-plus-gx";
-  version = "0-unstable-2026-08-14";
+  version = "0-unstable-2026-08-21";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "Genesis-Plus-GX";
-    rev = "2d7131c5efa606f649d36e1685a8ca47c24f31b3";
-    hash = "sha256-tu/FTJDP+auXCDQ5DUbSLrRyCRdlD3dhPv2/PeBqeAc=";
+    rev = "b7e79b3641eb2e322c5ba29903352e115887e83c";
+    hash = "sha256-aitbT6hRrLd202u1FXMmJvzIwE8E6My3cA2wKEavlO8=";
  };

  meta = {
--- a/pkgs/applications/emulators/libretro/cores/nxengine.nix
+++ b/pkgs/applications/emulators/libretro/cores/nxengine.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "nxengine";
-  version = "0-unstable-2026-04-09";
+  version = "0-unstable-2026-08-22";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "nxengine-libretro";
-    rev = "a1c45fd4d045333f4ea523e556469b545be82b0a";
-    hash = "sha256-v7mUr4GeNc/bOe4gQvtPns4/uLA+r7UFGavDdtBNj6E=";
+    rev = "fd1c0686f8b4c0aea9b5addbc077e3ad7da23bb7";
+    hash = "sha256-auignLadG47leMeN6XqIVzs1KEJ+LwLpHO/8ZC+46po=";
  };

  makefile = "Makefile";
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1256,13 +1256,13 @@
    "vendorHash": "sha256-mNEzE2eACy63BGoFOamG52JD8mvC7okhSN9hMuesTlg="
  },
  "spotinst_spotinst": {
-    "hash": "sha256-zfEZyJyD/yH1lnH1tawrX/FzKhcP4bhZKl2jreQjqR4=",
+    "hash": "sha256-CgsA+mw+8EXbDMO7t897B2Xa19o2naW2gu6qDSKrAeA=",
    "homepage": "https://registry.terraform.io/providers/spotinst/spotinst",
    "owner": "spotinst",
    "repo": "terraform-provider-spotinst",
-    "rev": "v1.240.0",
+    "rev": "v1.241.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-gAYHmSFGNEAm/LhouWlQtLFra2ZSsacR/PjrSQxTfR0="
+    "vendorHash": "sha256-o7DX6kQgt5+qNbZO3o8TfE8H/wT/8V5kZIuyT9z7+J0="
  },
  "statuscakedev_statuscake": {
    "hash": "sha256-zXBZZA+2uRN2FeGrayq0a4EBk7T+PvlBIwbuxwM7yBc=",
@@ -1274,13 +1274,13 @@
    "vendorHash": "sha256-9M1DsE/FPQK8TG7xCJWbU3HAJCK3p/7lxdzjO1oAfWs="
  },
  "sumologic_sumologic": {
-    "hash": "sha256-GzVXWyFQ9k6a8o7faKpAcRGj8M4NQxVLY8iw1iGFM1w=",
+    "hash": "sha256-Ql3Bc9C83IpINqkTtiZAK5kV0DvnsgpSXg5EKLjyXBs=",
    "homepage": "https://registry.terraform.io/providers/SumoLogic/sumologic",
    "owner": "SumoLogic",
    "repo": "terraform-provider-sumologic",
-    "rev": "v3.3.0",
+    "rev": "v3.3.1",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-nbiLH+J051XxTx+z8xGrp/DPYB7g9S4clFSWcZUKnAg="
+    "vendorHash": "sha256-h3hQfJsyvq6yv/sQAjA+9kPHHrejaF+NyBHFdchLHoA="
  },
  "sysdiglabs_sysdig": {
    "hash": "sha256-MfwzmTzikzZAg0U7W5Dmjww6Oadnr4Oq+uIQSZaRHEo=",
--- a/pkgs/applications/networking/instant-messengers/linphone/bc-zxing-cpp/default.nix
+++ b/pkgs/applications/networking/instant-messengers/linphone/bc-zxing-cpp/default.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  cmake,
+  fetchFromGitLab,
+  stdenv,
+  libzint,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "zxing-cpp";
+  # Version taken from CMakeLists.txt - likely not actively updated
+  version = "1.4.0-unstable-2026-08-08";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.linphone.org";
+    group = "BC";
+    owner = "public/external";
+    repo = "zxing-cpp";
+    rev = "722123ad0cadee0e4c313f80eac5162a9f8d7d73";
+    sha256 = "sha256-GhrrIk2Kph6H5qs0g01b98F1Xzh/6vCS3+p+q0mhqcQ=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    libzint
+  ];
+
+  cmakeFlags = [
+    "-DZXING_BLACKBOX_TESTS=OFF"
+    "-DZXING_DEPENDENCIES=LOCAL"
+    "-DZXING_EXAMPLES=OFF"
+    "-DZXING_USE_BUNDLED_ZINT=OFF"
+  ];
+
+  # The BC fork's zxing.pc.in joins @CMAKE_INSTALL_LIBDIR@/INCLUDEDIR@ onto a
+  # hardcoded "/" prefix, and never includes GNUInstallDirs, causing us to run into
+  # https://github.com/NixOS/nixpkgs/issues/144170
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail '# PC file generation.' 'include (GNUInstallDirs)'
+    substituteInPlace zxing.pc.in \
+      --replace-fail 'libdir=''${exec_prefix}/@CMAKE_INSTALL_LIBDIR@' 'libdir=@CMAKE_INSTALL_FULL_LIBDIR@' \
+      --replace-fail 'includedir=''${prefix}/@CMAKE_INSTALL_INCLUDEDIR@' 'includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@'
+  '';
+
+  meta = {
+    homepage = "https://gitlab.linphone.org/BC/public/external/zxing-cpp";
+    description = "BelledonneCommunications' fork of zxing-cpp";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ naxdy ];
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/applications/networking/instant-messengers/linphone/default.nix
+++ b/pkgs/applications/networking/instant-messengers/linphone/default.nix
@@ -8,8 +8,8 @@ makeScopeWithSplicing' {
  extra = self: {
    mkLinphoneDerivation = self.mk-linphone-derivation;

-    linphoneSdkVersion = "5.4.85";
-    linphoneSdkHash = "sha256-mdJDCuCaZlcQ92P6oMgH/8iWgm8hGz8gTVUilC+yaSU=";
+    linphoneSdkVersion = "5.5.13";
+    linphoneSdkHash = "sha256-RsSMLO7wZ7azWF7/KcERkd5et73w0kUZpwsqj9QxZgc=";
  };
  f =
    self:
--- a/pkgs/applications/networking/instant-messengers/linphone/liblinphone/default.nix
+++ b/pkgs/applications/networking/instant-messengers/linphone/liblinphone/default.nix
@@ -11,7 +11,7 @@
  python3,
  sqlite,
  xercesc,
-  zxing-cpp,
+  bc-zxing-cpp,
  mkLinphoneDerivation,
 }:
 mkLinphoneDerivation {
@@ -39,7 +39,7 @@ mkLinphoneDerivation {
    libxml2
    sqlite
    xercesc
-    zxing-cpp
+    bc-zxing-cpp
  ];

  propagatedBuildInputs = [
--- a/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/default.nix
@@ -3,6 +3,7 @@
  bc-soci,
  bctoolbox,
  belcard,
+  cacert,
  belle-sip,
  belr,
  boost,
@@ -40,7 +41,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "linphone-desktop";
-  version = "6.1.0";
+  version = "6.2.0";

  src = fetchFromGitLab {
    domain = "gitlab.linphone.org";
@@ -48,13 +49,17 @@ stdenv.mkDerivation (finalAttrs: {
    group = "BC";
    repo = "linphone-desktop";
    tag = finalAttrs.version;
-    hash = "sha256-jCnovCFdPJExD0+ZLhU9np1R5uN+mPlSPi/Nb1aOD0U=";
+    hash = "sha256-JtNYeMu174afzuWSVIuLyI5M16iC5XGr2qTcTsixRg8=";
  };

  patches = [
    ./do-not-override-install-prefix.patch
    ./do-not-manually-compute-sdk-version.patch
    ./always-install-desktop-files.patch
+    ./use-absolute-resource-paths.patch
+    # Linphone creates a broken desktop file.
+    # See: https://github.com/NixOS/nixpkgs/issues/551204
+    ./no-user-desktop-file.patch

    # .mkv recordings are broken in NixOS and other distros (see
    # https://github.com/NixOS/nixpkgs/issues/219551), and simply changing the
@@ -79,8 +84,10 @@ stdenv.mkDerivation (finalAttrs: {
    minizip-ng
    qt6Packages.qtbase
    qt6Packages.qtnetworkauth
+    qt6Packages.qtkeychain
    zxing-cpp
    boost
+    cacert

    python3Packages.pystache
    python3Packages.six
@@ -103,9 +110,6 @@ stdenv.mkDerivation (finalAttrs: {
    # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
    "-DCMAKE_SKIP_BUILD_RPATH=ON"

-    # Requires EQt5Keychain
-    "-DENABLE_QT_KEYCHAIN=OFF"
-
    "-DCMAKE_INSTALL_BINDIR=bin"
    "-DCMAKE_INSTALL_INCLUDEDIR=include"
    "-DCMAKE_INSTALL_LIBDIR=lib"
@@ -114,7 +118,6 @@ stdenv.mkDerivation (finalAttrs: {
    "-DLINPHONEAPP_INSTALL_PREFIX=${placeholder "out"}"
    "-DLINPHONE_QML_DIR=${placeholder "out"}/${qt6Packages.qtbase.qtQmlPrefix}/ui"
    "-DLINPHONESDK_VERSION=${linphoneSdkVersion}"
-    "-DENABLE_APP_PACKAGE_ROOTCA=OFF"

    # normally set by the custom find modules, which we have disabled
    "-DLibLinphone_TARGET=liblinphone"
@@ -155,6 +158,12 @@ stdenv.mkDerivation (finalAttrs: {
    ln -s ${mediastreamer2}/lib/mediastreamer/plugins/* $out/lib/mediastreamer/plugins/
    ln -s ${grammars} $out/share/belr/grammars

+    # linphone looks for the TLS root CA bundle at `<dataResourcesDir>/rootca.pem`
+    # (with `<dataResourcesDir>` made absolute by `use-absolute-resource-paths.patch`).
+    # Provide nixpkgs' cacert bundle there instead of shipping the stale one
+    # bundled with linphone-sdk.
+    ln -s ${cacert}/etc/ssl/certs/ca-bundle.crt $out/share/linphone/rootca.pem
+
    mkdir -p $out/share/sounds/linphone/
    ln -s ${liblinphone}/share/sounds/linphone/rings $out/share/sounds/linphone/rings

--- a/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/no-user-desktop-file.patch
+++ b/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/no-user-desktop-file.patch
@@ -0,0 +1,19 @@
+diff --git a/Linphone/core/App.cpp b/Linphone/core/App.cpp
+index 315632d..78eba8b 100644
+--- a/Linphone/core/App.cpp
+++ b/Linphone/core/App.cpp
+@@ -1567,14 +1567,7 @@ QString App::getApplicationPath() const {
+ }
+ 
+ void App::exportDesktopFile() {
+-	QDir dir(ApplicationsDirectory);
+-	if (!dir.exists() && !dir.mkpath(ApplicationsDirectory)) {
+-		qWarning() << QStringLiteral("Unable to build applications dir path: `%1`.").arg(ApplicationsDirectory);
+-		return;
+-	}
+-
+ 	const QString confPath(ApplicationsDirectory + EXECUTABLE_NAME ".desktop");
+-	if (generateDesktopFile(confPath, true, false)) generateDesktopFile(confPath, false, false);
+ }
+ 
+ bool App::generateDesktopFile(const QString &confPath, bool remove, bool openInBackground) {
--- a/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/use-absolute-resource-paths.patch
+++ b/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/use-absolute-resource-paths.patch
@@ -0,0 +1,38 @@
+diff --git a/Linphone/core/path/Paths.cpp b/Linphone/core/path/Paths.cpp
+index 33449dc..734ba51 100644
+--- a/Linphone/core/path/Paths.cpp
+++ b/Linphone/core/path/Paths.cpp
+@@ -115,7 +115,6 @@ static inline QDir getAppPackageDir() {
+ }
+ 
+ static inline QString getAppPackageDataDirPath() {
+-	QDir executableDir(QCoreApplication::applicationDirPath());
+ 	QDir dir = getAppPackageDir();
+ #ifdef __APPLE__
+ 	if (!dir.cd("Resources")) {
+@@ -127,22 +126,17 @@ static inline QString getAppPackageDataDirPath() {
+ 		dir.mkdir("share");
+ 		dir.cd("share");
+ 	}
+-	lInfo() << executableDir.absolutePath() << " VS " << dir.absolutePath()
+-	        << " == " << executableDir.relativeFilePath(dir.absolutePath());
+-	return executableDir.relativeFilePath(dir.absolutePath());
+	return dir.absolutePath();
+ }
+ 
+ static inline QString getAppPackageMsPluginsDirPath() {
+-	QDir executableDir(QCoreApplication::applicationDirPath());
+ 	QDir dir = getAppPackageDir();
+ 	dir.cd(MSPLUGINS_DIR);
+-	return executableDir.relativeFilePath(dir.absolutePath());
+	return dir.absolutePath();
+ }
+ 
+ static inline QString getAppPackagePluginsDirPath() {
+-	QDir executableDir(QCoreApplication::applicationDirPath());
+-	QDir packageDir = getAppPackageDir();
+-	return executableDir.relativeFilePath(packageDir.absolutePath() + Constants::PathPlugins);
+	return getAppPackageDir().absolutePath() + Constants::PathPlugins;
+ }
+ 
+ static inline QString getAppBinDirPath() {
--- a/pkgs/by-name/_2/_2ship2harkinian/package.nix
+++ b/pkgs/by-name/_2/_2ship2harkinian/package.nix
@@ -119,13 +119,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "2ship2harkinian";
-  version = "5.0.0";
+  version = "5.0.1";

  src = fetchFromGitHub {
    owner = "HarbourMasters";
    repo = "2ship2harkinian";
    tag = finalAttrs.version;
-    hash = "sha256-lx5+i/S+deWB6iYTTrUOffQfB6qnUvDZrU80NWyqb2Y=";
+    hash = "sha256-+8c6AolEjM7VDhlNTnMRoQMLze4DssARlHl33nJ1zM8=";
    fetchSubmodules = true;
    deepClone = true;
    postFetch = ''
--- a/pkgs/by-name/am/amazon-ssm-agent/package.nix
+++ b/pkgs/by-name/am/amazon-ssm-agent/package.nix
@@ -43,13 +43,13 @@ let
 in
 buildGoModule (finalAttrs: {
  pname = "amazon-ssm-agent";
-  version = "3.3.5068.0";
+  version = "3.3.5226.0";

  src = fetchFromGitHub {
    owner = "aws";
    repo = "amazon-ssm-agent";
    tag = finalAttrs.version;
-    hash = "sha256-gZDYspw/SnE2lMCjfQbkdWldsc5vi9dGMQ4KX643j3g=";
+    hash = "sha256-iFk5wlcw6wnc3AjCdhFXxyNrCTdAWQNIYDFis2yTIlY=";
  };

  vendorHash = null;
--- a/pkgs/by-name/ap/aptakube/package.nix
+++ b/pkgs/by-name/ap/aptakube/package.nix
@@ -23,11 +23,11 @@ stdenvNoCC.mkDerivation (
    sources = {
      aarch64-darwin = {
        name = "Aptakube_${finalAttrs.version}_universal.dmg";
-        hash = "sha256-JWDwsvqZnEQc6Ne+aC2WbdMaEO20f8AEK7SlC3lEzUk=";
+        hash = "sha256-SgkLQ4dHEja58EDTHs6qi7CGw6mT3tKPNQxS2LKDHn0=";
      };
      x86_64-linux = {
        name = "aptakube_${finalAttrs.version}_amd64.deb";
-        hash = "sha256-JooC/fwy1zaIU2UAmDooejEbBmCChVrJ2rTsn0M8WaI=";
+        hash = "sha256-I0QkI/utkEck3WiDt9NtN5zwqfPX2GJCx4PUzLnCE58=";
      };
    };

@@ -42,7 +42,7 @@ stdenvNoCC.mkDerivation (
  in
  {
    pname = "aptakube";
-    version = "1.18.8";
+    version = "1.19.3";

    __structuredAttrs = true;
    strictDeps = true;
--- a/pkgs/by-name/ba/babashka-unwrapped/default-tools-dir.patch
+++ b/pkgs/by-name/ba/babashka-unwrapped/default-tools-dir.patch
@@ -0,0 +1,19 @@
+diff --git a/borkdude/deps.clj b/borkdude/deps.clj
+index 281ead5..ab8dd7a 100755
+--- a/borkdude/deps.clj
+++ b/borkdude/deps.clj
+@@ -773,6 +773,14 @@ public class ClojureToolsDownloader {
+   Otherwise, use `DEPS_CLJ_TOOLS_DIR`"
+   []
+   (or
+   ;; The default (wrapped) babashka derivation sets `NIX_DEPS_CLJ_TOOLS_DIR` to a nix-store path.
+   ;; We use this custom variable here instead of the upstream `DEPS_CLJ_TOOLS_DIR` so that we don't
+   ;; affect subprocesses spawned by babashka which may themselves use `deps.clj`. Furthermore, we
+   ;; don't use the custom variable when `DEPS_CLJ_TOOLS_VERSION` is set because `deps.clj` would
+   ;; then try to store the desired tools version in the nix-store path which would of course fail
+   ;; because it's read-only (see https://github.com/NixOS/nixpkgs/issues/431312).
+   (when-not (*getenv-fn* "DEPS_CLJ_TOOLS_VERSION")
+     (*getenv-fn* "NIX_DEPS_CLJ_TOOLS_DIR"))
+     ;; legacy name
+    (*getenv-fn* "CLOJURE_TOOLS_DIR")
+    (*getenv-fn* "DEPS_CLJ_TOOLS_DIR")
--- a/pkgs/by-name/ba/babashka-unwrapped/package.nix
+++ b/pkgs/by-name/ba/babashka-unwrapped/package.nix
@@ -4,6 +4,8 @@
  fetchurl,
  writeScript,
  installShellFiles,
+  unzip,
+  zip,
 }:

 buildGraalvmNativeImage (finalAttrs: {
@@ -15,7 +17,24 @@ buildGraalvmNativeImage (finalAttrs: {
    sha256 = "sha256-cVcfEt7OVKHG3I9ZSEk6mU5ULKAXJYsEEBD2D4SUZxc=";
  };

-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [
+    installShellFiles
+    unzip
+    zip
+  ];
+
+  dontUnpack = false;
+  unpackCmd = "unzip -d babashka $curSrc";
+
+  patches = [
+    ./default-tools-dir.patch
+  ];
+
+  preBuild = ''
+    zip -r ../babashka.jar .
+    cd ..
+    src=babashka.jar
+  '';

  extraNativeImageBuildArgs = [
    "-H:+ReportExceptionStackTraces"
--- a/pkgs/by-name/ba/babashka/package.nix
+++ b/pkgs/by-name/ba/babashka/package.nix
@@ -26,7 +26,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {

    makeWrapper "${babashka-unwrapped}/bin/bb" "$out/bin/bb" \
      --inherit-argv0 \
-      --set-default DEPS_CLJ_TOOLS_DIR $out/clojure_tools \
+      --set NIX_DEPS_CLJ_TOOLS_DIR $out/clojure_tools \
      --set-default JAVA_HOME ${jdkBabashka}

    installShellCompletion --cmd bb --bash ${babashka-unwrapped}/share/bash-completion/completions/bb.bash
--- a/pkgs/by-name/bl/blender/package.nix
+++ b/pkgs/by-name/bl/blender/package.nix
@@ -119,12 +119,12 @@ in

 stdenv'.mkDerivation (finalAttrs: {
  pname = "blender";
-  version = "5.2.0";
+  version = "5.2.1";

  src = fetchzip {
    name = "source";
    url = "https://download.blender.org/source/blender-${finalAttrs.version}.tar.xz";
-    hash = "sha256-V2+Oc7GT31JvWccffzUaingEs8CtSFaazgQ+YdZUB7M=";
+    hash = "sha256-LXdJZDJoO9/yjkxn6qT42jv0YRpiwCiIWWGKubs3VLI=";
  };

  patches = [
--- a/pkgs/by-name/ca/cargo-zigbuild/package.nix
+++ b/pkgs/by-name/ca/cargo-zigbuild/package.nix
@@ -10,16 +10,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-zigbuild";
-  version = "0.23.0";
+  version = "0.23.2";

  src = fetchFromGitHub {
    owner = "rust-cross";
    repo = "cargo-zigbuild";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Y73aPGsrSAZVxNJ1r1lS9uXmfpAwthq6NW4urKS8ab0=";
+    hash = "sha256-Woa8lcx9D5U2NyxHqLE9nIkgtvLc35lo+H+Cp+NOHKg=";
  };

-  cargoHash = "sha256-dt2s18B9RVwEBlun5cegoqfW1KYXFqjdScdc/Q2aDlI=";
+  cargoHash = "sha256-Q/Hf9fHxA/3EhnbWapyMak4nyZt/5HTL8osE7Nit6g0=";

  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/by-name/cr/crossmacro/package.nix
+++ b/pkgs/by-name/cr/crossmacro/package.nix
@@ -4,6 +4,8 @@
  dotnetCorePackages,
  fetchFromGitHub,
  installShellFiles,
+  clang,
+  autoPatchelfHook,
  nix-update-script,
  fontconfig,
  freetype,
@@ -23,33 +25,43 @@
  icu,
  openssl,
  zlib,
+  pipewire,
 }:

 buildDotnetModule rec {
  pname = "crossmacro";
-  version = "1.2.1";
+  version = "1.3.1";

  src = fetchFromGitHub {
    owner = "alper-han";
    repo = "CrossMacro";
    tag = "v${version}";
-    hash = "sha256-lMXp7ItwpZ14ATRKuR7Q8/FhfMNQ+YCgHL13oj6iBNs=";
+    hash = "sha256-2L25A2OO2Ju6n1QlblNBtKva1PfbidFz/QESjLBVuSU=";
  };

  projectFile = "src/CrossMacro.UI.Linux/CrossMacro.UI.Linux.csproj";
  nugetDeps = ./deps.json;

  dotnet-sdk = dotnetCorePackages.sdk_10_0;
-  dotnet-runtime = dotnetCorePackages.runtime_10_0;
+  dotnet-runtime = null;

  executables = [ "CrossMacro.UI" ];
  buildType = "Release";
+  selfContainedBuild = true;

  dotnetFlags = [
-    "-p:SelfContained=false"
+    "-p:PublishAot=true"
+    "-p:PublishReadyToRun=false"
+    "-p:OptimizationPreference=Speed"
+    "-p:StripSymbols=true"
+    "-p:IlcTrimMetadata=true"
+    "-p:DebugType=None"
+    "-p:DebugSymbols=false"
    "-p:Version=${version}"
  ];

+  buildInputs = runtimeDeps;
+
  runtimeDeps = [
    zlib
    icu
@@ -69,14 +81,21 @@ buildDotnetModule rec {
    libglvnd
    wayland
    libxkbcommon
+    pipewire
  ];

-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [
+    installShellFiles
+    clang
+    autoPatchelfHook
+  ];

  postInstall = ''
    installManPage docs/man/crossmacro.1

    install -Dm644 scripts/assets/CrossMacro.desktop $out/share/applications/crossmacro.desktop
+    substituteInPlace $out/share/applications/crossmacro.desktop \
+      --replace-fail "Exec=crossmacro" "Exec=$out/lib/crossmacro/CrossMacro.UI"

    for size in 16 32 48 64 128 256 512; do
      install -Dm644 src/CrossMacro.UI/Assets/icons/''${size}x''${size}/apps/crossmacro.png \
@@ -85,9 +104,28 @@ buildDotnetModule rec {

    install -Dm644 scripts/assets/io.github.alper-han.CrossMacro.metainfo.xml \
      $out/share/metainfo/io.github.alper-han.CrossMacro.metainfo.xml
+  '';

-    mkdir -p $out/bin
-    ln -sf $out/bin/CrossMacro.UI $out/bin/crossmacro
+  postFixup = ''
+    # Align wrapper and ELF paths so KWin's strict /proc/<pid>/exe check grants Wayland permissions.
+    # Move the real ELF binary to .CrossMacro.UI-wrapped
+    mv $out/lib/crossmacro/CrossMacro.UI \
+       $out/lib/crossmacro/.CrossMacro.UI-wrapped
+
+    # Move the buildDotnetModule wrapper from bin/ into lib/ so
+    # its path matches what KWin resolves after unwrapping.
+    mv $out/bin/CrossMacro.UI $out/lib/crossmacro/CrossMacro.UI
+
+    # Update the wrapper's exec target to the renamed binary
+    substituteInPlace $out/lib/crossmacro/CrossMacro.UI \
+      --replace-fail \
+        "\"$out/lib/crossmacro/CrossMacro.UI\"" \
+        "\"$out/lib/crossmacro/.CrossMacro.UI-wrapped\""
+
+    # Point bin/ entries at the lib/ wrapper
+    rm -f $out/bin/crossmacro
+    ln -s $out/lib/crossmacro/CrossMacro.UI $out/bin/CrossMacro.UI
+    ln -s $out/bin/CrossMacro.UI $out/bin/crossmacro
  '';

  passthru.updateScript = nix-update-script { };
--- a/pkgs/by-name/ct/ctx7/package.nix
+++ b/pkgs/by-name/ct/ctx7/package.nix
@@ -16,7 +16,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "ctx7";
-  version = "0.5.8";
+  version = "0.5.9";

  __structuredAttrs = true;
  strictDeps = true;
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "upstash";
    repo = "context7";
    tag = "${finalAttrs.pname}@${finalAttrs.version}";
-    hash = "sha256-ocO8tXxooMIOWuCTpSgORRg4hjMs0o0uoBxEkaNKCu8=";
+    hash = "sha256-QBVy3KkZLuSe7sDu/im1upxLwkEG8kg3Ef8Qo761Qc4=";
  };

  nativeBuildInputs = [
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
    inherit (finalAttrs) pname version src;
    inherit pnpm;
    fetcherVersion = 3;
-    hash = "sha256-F3c2/y3fgtPiUQOsg3hFdAp9b85AFs2mCTO1Eoa0i5E=";
+    hash = "sha256-1ZrQ+GMGgBNyycp/Xp2/meGwxaWTh+c53qgaEy30dl8=";
  };

  buildPhase = ''
--- a/pkgs/by-name/dn/dnscontrol/package.nix
+++ b/pkgs/by-name/dn/dnscontrol/package.nix
@@ -1,24 +1,24 @@
 {
  lib,
  stdenv,
-  buildGoModule,
+  buildGo127Module,
  fetchFromGitHub,
  installShellFiles,
  versionCheckHook,
 }:

-buildGoModule (finalAttrs: {
+buildGo127Module (finalAttrs: {
  pname = "dnscontrol";
-  version = "4.46.0";
+  version = "5.0.0";

  src = fetchFromGitHub {
    owner = "DNSControl";
    repo = "dnscontrol";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-pckjHak61FyPV6YikUwvIAVP2NeLMUtGqn0utXaly4w=";
+    hash = "sha256-axFNUudghfk0H9U33igg60rTZd1L3leeMtIq8PWojfs=";
  };

-  vendorHash = "sha256-MhF/ZUPj3slDD9Pn3j4Gy0WT3iGHlF7o7sMjo6DS+y8=";
+  vendorHash = "sha256-j7OjDUDHmH2RdipzuqH5hJUUKuVe5Ij2IX1zeI/Ldm4=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/du/dusklight/package.nix
+++ b/pkgs/by-name/du/dusklight/package.nix
@@ -52,7 +52,7 @@ let
      };
      aarch64-linux = {
        url = "https://github.com/encounter/dawn-build/releases/download/v20260603.191052/dawn-linux-aarch64.tar.gz";
-        hash = "sha256-C9pMaUOkSknwQfIw45+WIFve+noTiqud+RiQ0/kV4fA=";
+        hash = "sha256-EiNj16S0sIOWzOByiecsl2bZScBA5MOK348sqyxDchc=";
      };
    }
    .${stdenv.hostPlatform.system}
--- a/pkgs/by-name/fe/feishin/package.nix
+++ b/pkgs/by-name/fe/feishin/package.nix
@@ -3,7 +3,7 @@
  stdenv,
  buildNpmPackage,
  fetchFromGitHub,
-  electron_41,
+  electron_43,
  mpv-unwrapped,
  fetchPnpmDeps,
  pnpmConfigHook,
@@ -15,28 +15,25 @@
  makeDesktopItem,
  nix-update-script,
  webVersion ? false,
+  nixosTests,
 }:
 let
+  electron = electron_43;
+
+  # Fix pnpm issue on darwin https://github.com/NixOS/nixpkgs/issues/525627
+  pnpm = pnpm_11.override { nodejs-slim = nodejs-slim_latest; };
+in
+buildNpmPackage (finalAttrs: {
  pname = "feishin";
  version = "1.15.1";

  src = fetchFromGitHub {
    owner = "jeffvli";
    repo = "feishin";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-2UKJBUZNUpUUZIG1JFXok7YJdzqt+Ge0ykHUm8BeNcw=";
  };

-  electron = electron_41;
-
-  # Fix pnpm issue on darwin https://github.com/NixOS/nixpkgs/issues/525627
-  pnpm = pnpm_11.override { nodejs-slim = nodejs-slim_latest; };
-in
-buildNpmPackage {
-  inherit pname version;
-
-  inherit src;
-
  __structuredAttrs = true;

  npmConfigHook = pnpmConfigHook;
@@ -44,9 +41,9 @@ buildNpmPackage {

  npmDeps = null;
  pnpmDeps = fetchPnpmDeps {
-    inherit
+    inherit pnpm;
+    inherit (finalAttrs)
      pname
-      pnpm
      version
      src
      ;
@@ -145,12 +142,19 @@ buildNpmPackage {
    })
  ];

-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    updateScript = nix-update-script { };
+
+    # add a tests
+    tests = {
+      inherit (nixosTests.feishin) caddy nginx;
+    };
+  };

  meta = {
    description = "Full-featured Jellyfin, Navidrome, and OpenSubsonic Compatible Music Player";
    homepage = "https://github.com/jeffvli/feishin";
-    changelog = "https://github.com/jeffvli/feishin/releases/tag/v${version}";
+    changelog = "https://github.com/jeffvli/feishin/releases/tag/v${finalAttrs.version}";
    sourceProvenance = with lib.sourceTypes; [ fromSource ];
    license = lib.licenses.gpl3Plus;
    platforms = lib.platforms.unix;
@@ -161,4 +165,4 @@ buildNpmPackage {
    ];
  }
  // lib.optionalAttrs (!webVersion) { mainProgram = "feishin"; };
-}
+})
--- a/pkgs/by-name/gl/glpaper/package.nix
+++ b/pkgs/by-name/gl/glpaper/package.nix
@@ -12,14 +12,17 @@

 stdenv.mkDerivation {
  pname = "glpaper";
-  version = "unstable-2024-08-07";
+  version = "0-unstable-2024-08-07";
+
+  __structuredAttrs = true;
+  strictDeps = true;

  src = fetchFromSourcehut {
    owner = "~scoopta";
    repo = "glpaper";
    vc = "hg";
    rev = "af9827d20bfe1956dd88fb2202b38ed0de705305";
-    sha256 = "sha256-zgvnWqsw243jZ9e6fG6L0hDfRRHwzmIdsxwnnWhimu0=";
+    hash = "sha256-zgvnWqsw243jZ9e6fG6L0hDfRRHwzmIdsxwnnWhimu0=";
  };

  # nop() is used as a typed Wayland callback stub, which GCC 15 rejects as an error.
--- a/pkgs/by-name/go/go-mockery/package.nix
+++ b/pkgs/by-name/go/go-mockery/package.nix
@@ -10,17 +10,17 @@

 buildGoModule (finalAttrs: {
  pname = "go-mockery";
-  version = "3.7.2";
+  version = "3.7.4";

  src = fetchFromGitHub {
    owner = "vektra";
    repo = "mockery";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-lPyoWjLaRhE4SpVahJd8T3LsCyfdFMIsuxmWODRoLL0=";
+    hash = "sha256-2KhyuS6k8EyPnEVunAIamGJgePmvDVJqSyN0UlAFyvQ=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-izMi4MqbfKX1PmNMWyCwBOWqiPZfth/ZSzsuEcTN6Pg=";
+  vendorHash = "sha256-ockGzV+nj/O6iRcscmhfx220TqJ8LACER/pOPqs21tY=";

  ldflags = [
    "-s"
@@ -28,7 +28,14 @@ buildGoModule (finalAttrs: {
    "-X github.com/vektra/mockery/v${lib.versions.major finalAttrs.version}/internal/logging.SemVer=v${finalAttrs.version}"
  ];

-  env.CGO_ENABLED = 0;
+  env = {
+    CGO_ENABLED = 0;
+
+    # go.work pulls ./tools into the workspace, which raises mockery's own
+    # dependencies to the tools build list. Build and test against go.mod
+    # alone, matching what upstream's Taskfile does.
+    GOWORK = "off";
+  };

  subPackages = [ "." ];

@@ -45,12 +52,25 @@ buildGoModule (finalAttrs: {
  prePatch = ''
    # remove test.ci's dependency on lint since we don't need it and
    # it tries to use remote golangci-lint
+    #
    # remove test.ci's git-state check, which runs `git diff --exit-code`;
    # the source has no .git directory, so the check cannot work here
+    #
+    # use gotestsum from nativeCheckInputs rather than building it from the
+    # tools module, which would need network access
    substituteInPlace Taskfile.yml \
      --replace-fail "deps: [lint]" "" \
      --replace-fail "      - task: git-state" "" \
-      --replace-fail "go run gotest.tools/gotestsum" "gotestsum"
+      --replace-fail "    deps: [tools.gotestsum]" "" \
+      --replace-fail "./tools/gotestsum{{exeExt}}" "gotestsum"
+
+    # the e2e scripts reach go-task through the workspace, which GOWORK=off
+    # rules out; use go-task from nativeCheckInputs instead
+    substituteInPlace \
+      e2e/test_mockery_generation.sh \
+      e2e/test_infinite_mocking.sh \
+      e2e/test_missing_interface/run.sh \
+      --replace-fail "go run github.com/go-task/task/v3/cmd/task" "task"

    # patch scripts used in e2e testing
    patchShebangs e2e
--- a/pkgs/by-name/go/gogup/package.nix
+++ b/pkgs/by-name/go/gogup/package.nix
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "gogup";
-  version = "1.8.0";
+  version = "1.8.1";

  src = fetchFromGitHub {
    owner = "nao1215";
    repo = "gup";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-kit/xnnkhY7N98QK4KSPW3K+mKTfttv5sHW5By4nd68=";
+    hash = "sha256-3GOdORigV+5pqFySnlsL/ZOUqAIFQicfDCzeOCFa+A0=";
  };

  vendorHash = "sha256-qYMUIy9yvWAedA2fL0KKoysaHHoKFJnzl58pInXpa60=";
--- a/pkgs/by-name/gr/graphify/package.nix
+++ b/pkgs/by-name/gr/graphify/package.nix
@@ -8,14 +8,14 @@
 python3Packages.buildPythonApplication rec {
  __structuredAttrs = true;
  pname = "graphify";
-  version = "0.9.42";
+  version = "0.9.48";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Graphify-Labs";
    repo = "graphify";
    tag = "v${version}";
-    hash = "sha256-QXdjA+xSgh6I+A2snvlaigHG2FQJWoFWIYQJfCmshGQ=";
+    hash = "sha256-gcQ8isXZQu/VQkK74vAaOKnbNdsxiez+TSZdRUxEMiA=";
  };

  build-system = [
@@ -77,6 +77,9 @@ python3Packages.buildPythonApplication rec {
    chinese = [
      jieba
    ];
+    commonlisp = [
+      tree-sitter-grammars.tree-sitter-commonlisp
+    ];
    leiden = [
      graspologic
    ];
--- a/pkgs/by-name/gu/guile-xcb/package.nix
+++ b/pkgs/by-name/gu/guile-xcb/package.nix
@@ -10,7 +10,10 @@

 stdenv.mkDerivation {
  pname = "guile-xcb";
-  version = "unstable-2017-05-29";
+  version = "1.3-unstable-2017-05-28";
+
+  strictDeps = true;
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "mwitmer";
@@ -21,11 +24,12 @@ stdenv.mkDerivation {

  nativeBuildInputs = [
    autoreconfHook
+    guile_2_2
    pkg-config
+    texinfo
  ];
  buildInputs = [
    guile_2_2
-    texinfo
  ];

  configureFlags = [
--- a/pkgs/by-name/ho/hockeypuck/package.nix
+++ b/pkgs/by-name/ho/hockeypuck/package.nix
@@ -7,13 +7,13 @@

 buildGoModule (finalAttrs: {
  pname = "hockeypuck";
-  version = "2.3.3";
+  version = "2.4";

  src = fetchFromGitHub {
    owner = "hockeypuck";
    repo = "hockeypuck";
    rev = finalAttrs.version;
-    sha256 = "sha256-1AOvtAvx2OFxjJE5YhZwqdm9G8mWgS0hKPdTctU2MV4=";
+    sha256 = "sha256-EyXLOttABKMFKjXD/L1tXx7kvO2TEy2VZT8SIZJeLsI=";
  };

  modRoot = "src/hockeypuck/";
--- a/pkgs/by-name/i2/i2pd/package.nix
+++ b/pkgs/by-name/i2/i2pd/package.nix
@@ -12,13 +12,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "i2pd";
-  version = "2.60.0";
+  version = "2.61.0";

  src = fetchFromGitHub {
    owner = "PurpleI2P";
    repo = "i2pd";
    tag = finalAttrs.version;
-    hash = "sha256-oVC31GpygznXbmjQ3qv3XZ58jZ9l6ibBoueuBM5Hk0M=";
+    hash = "sha256-dfCeY64TGRoTMNvKZk5jrhyRc8b8K03KM7YV5w/pbUM=";
  };

  postPatch = lib.optionalString (!stdenv.hostPlatform.isx86) ''
--- a/pkgs/by-name/ja/jami/package.nix
+++ b/pkgs/by-name/ja/jami/package.nix
@@ -9,8 +9,6 @@
  ninja,

  # for daemon
-  autoreconfHook,
-  perl, # for pod2man
  alsa-lib,
  asio,
  dbus,
@@ -30,6 +28,7 @@
  openssl,
  restinio,
  secp256k1,
+  simdutf,
  speex,
  udev,
  webrtc-audio-processing_0_3,
@@ -64,21 +63,27 @@

 stdenv.mkDerivation rec {
  pname = "jami";
-  version = "20251124.0";
+  version = "20260811.0";

  src = fetchFromGitLab {
    domain = "git.jami.net";
    owner = "savoirfairelinux";
    repo = "jami-client-qt";
    rev = "stable/${version}";
-    hash = "sha256-IQA6V0Sl+xhuit9kySpsSAS/a0GOsiT+ysYET91/gmc=";
+    hash = "sha256-6MywBm2kT1VJmgHEGKifcrHxG08s53fqfPYSfsFxgFk=";
    fetchSubmodules = true;
  };

  patches = [
    (fetchpatch {
-      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/jami-qt/-/raw/0ecbaf3b101bbdd0d4a06b06f3ce1ff654abf0b5/fix-link.patch";
-      hash = "sha256-VsQbOPHyNFcRhpae+9UCaUJdHH8bMGf3ZIAW3RKiu6k=";
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/jami-qt/-/raw/20260717.0-2/zxing-cpp-3.patch";
+      hash = "sha256-fTGrsdeC3kN277DvSuKyR5fMZhtBmk1nsL2BbeHYjTY=";
+    })
+    (fetchpatch {
+      # Fix for Qt 6.11
+      url = "https://git.jami.net/savoirfairelinux/jami-client-qt/-/commit/b97eb85af48b36008a9d619077965d6284660031.patch";
+      hash = "sha256-2gY4cqWg5FY6Q6j6V/x3IMWN3AP8RThjZdxYI+ktLI4=";
+      revert = true;
    })
  ];

@@ -88,8 +93,8 @@ stdenv.mkDerivation rec {
    src = fetchFromGitHub {
      owner = "savoirfairelinux";
      repo = "pjproject";
-      rev = "93dc96918bb6ba74e1e1d00c40c80402e856f2ac";
-      hash = "sha256-wsbKa3TXqj+nQMtAaEAD0Zh248QdNMhKnIOnq08MPI0=";
+      rev = "3a92a7ee340dbc1f4730fcaf32acac9a54cacf1b";
+      hash = "sha256-luW1lZ+QrOXBVyaWjGCesSnI8tNDBLmAiqUtTjNmRN8=";
    };

    configureFlags = [
@@ -127,14 +132,14 @@ stdenv.mkDerivation rec {

  dhtnet = stdenv.mkDerivation {
    pname = "dhtnet";
-    version = "unstable-2025-11-10";
+    version = "unstable-2026-08-11";

    src = fetchFromGitLab {
      domain = "git.jami.net";
      owner = "savoirfairelinux";
      repo = "dhtnet";
-      rev = "03c6ce608daf906fc98b82f114b61ebfdeae5dc6";
-      hash = "sha256-VTciKJ1IYtQopdV/TpnuB3T2tipcQjjKDlh2cKGDtRQ=";
+      rev = "11f916f2cccba068a48d2fd6ed6f02407d95b7ce";
+      hash = "sha256-Ly3LvKqbvvA6FQTEwJKv1St+RvyaLIPQiY2MvPLvgaw=";
    };

    postPatch = ''
@@ -165,7 +170,8 @@ stdenv.mkDerivation rec {
    ];

    cmakeFlags = [
-      "-DBUILD_SHARED_LIBS=Off"
+      "-DBUILD_SHARED_LIBS=ON"
+      "-DCMAKE_CXX_STANDARD=20"
      "-DBUILD_BENCHMARKS=Off"
      "-DBUILD_TOOLS=Off"
      "-DBUILD_TESTING=Off"
@@ -181,56 +187,11 @@ stdenv.mkDerivation rec {
    };
  };

-  daemon = stdenv.mkDerivation {
-    pname = "jami-daemon";
-    inherit src version meta;
-    sourceRoot = "${src.name}/daemon";
-
-    nativeBuildInputs = [
-      autoreconfHook
-      pkg-config
-      perl
-    ];
-
-    buildInputs = [
-      alsa-lib
-      asio
-      dbus
-      dhtnet
-      sdbus-cpp_2
-      fmt
-      ffmpeg_6
-      gmp
-      gnutls
-      llhttp
-      libjack2
-      jsoncpp
-      libarchive
-      libgit2
-      libnatpmp
-      libpulseaudio
-      libupnp
-      msgpack-cxx
-      opendht-jami
-      openssl
-      pjsip-jami
-      restinio
-      secp256k1
-      speex
-      udev
-      webrtc-audio-processing_0_3
-      yaml-cpp
-      zlib
-    ];
-
-    enableParallelBuilding = true;
-  };
-
  qwindowkit-src = fetchFromGitHub {
-    owner = "stdware";
+    owner = "atraczyk";
    repo = "qwindowkit";
-    rev = "0131d673092ab18afd69fac84f4a17ad2ba615f2";
-    hash = "sha256-jajgLOj0h/byt3+fSbCpV3VPUoHxijUsKw/0BOwbXTw=";
+    rev = "c5c7da2163dfcba144e09a905ee98f920d9d94e7";
+    hash = "sha256-G7vX1zPrs+rKCrXNNZ5Lt7agK3hag13c4s61h53ExPE=";
    fetchSubmodules = true;
  };

@@ -239,15 +200,10 @@ stdenv.mkDerivation rec {
    cp -R --no-preserve=mode,ownership ${qwindowkit-src} qwindowkit
    substituteInPlace CMakeLists.txt \
      --replace-fail 'add_subdirectory(3rdparty/zxing-cpp EXCLUDE_FROM_ALL)' 'find_package(ZXing)'
-    sed -i -e '/pkg_check_modules/i FIND_PACKAGE(PkgConfig REQUIRED)' src/libclient/CMakeLists.txt
  '';

  preConfigure = ''
    echo 'const char VERSION_STRING[] = "${version}";' > src/app/version.h
-    # Currently the daemon is still built seperately but jami expects it in CMAKE_INSTALL_PREFIX
-    # This can be removed in future versions when JAMICORE_AS_SUBDIR is on
-    mkdir -p $out
-    ln -s ${daemon} $out/daemon
  '';

  dontWrapGApps = true;
@@ -264,13 +220,41 @@ stdenv.mkDerivation rec {
  ];

  buildInputs = [
+    alsa-lib
+    asio
+    dbus
+    dhtnet
+    fmt
    ffmpeg_6
+    gmp
+    gnutls
    html-tidy
    hunspell
+    jsoncpp
+    llhttp
+    libjack2
+    libarchive
+    libgit2
+    libnatpmp
    libnotify
+    libpulseaudio
+    libupnp
    md4c
+    msgpack-cxx
    networkmanager
+    opendht-jami
+    openssl
+    pjsip-jami
    qrencode
+    restinio
+    sdbus-cpp_2
+    secp256k1
+    simdutf
+    speex
+    udev
+    webrtc-audio-processing_0_3
+    yaml-cpp
+    zlib
    zxing-cpp
  ]
  ++ (
@@ -280,6 +264,7 @@ stdenv.mkDerivation rec {
      qt5compat
      qtnetworkauth
      qtdeclarative
+      qthttpserver
      qtmultimedia
      qtpositioning
      qtsvg
@@ -289,11 +274,11 @@ stdenv.mkDerivation rec {
  );

  cmakeFlags = [
-    (lib.cmakeBool "JAMICORE_AS_SUBDIR" false)
    (lib.cmakeBool "DWITH_WEBENGINE" withWebengine)
-    "-DLIBJAMI_INCLUDE_DIRS=${daemon}/include/jami"
  ];

+  env.NIX_LDFLAGS = "-lz";
+
  qtWrapperArgs = [
    # With wayland the titlebar is not themed and the wmclass is wrong.
    "--set-default QT_QPA_PLATFORM xcb"
@@ -305,7 +290,7 @@ stdenv.mkDerivation rec {

  passthru = {
    updateScript = gitUpdater { rev-prefix = "stable/"; };
-    inherit daemon pjsip dhtnet;
+    inherit pjsip-jami dhtnet;
  };

  meta = {
--- a/pkgs/by-name/je/jellystat/package.nix
+++ b/pkgs/by-name/je/jellystat/package.nix
@@ -0,0 +1,66 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  makeWrapper,
+  nodejs_22,
+}:
+buildNpmPackage (finalAttrs: {
+  pname = "jellystat";
+  version = "1.1.11";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "CyferShepard";
+    repo = "Jellystat";
+    tag = finalAttrs.version;
+    hash = "sha256-HuLSXhj90fPfxv5qyCVCY67w07WwTBGp220iG9dGZyk=";
+  };
+
+  patches = [
+    ./remove-hardcoded-path.patch
+  ];
+
+  npmDepsFetcherVersion = 2;
+
+  npmDepsHash = "sha256-yfcrBLbD11x3Siqv670jw8A3K11DrwnBj0VSC64JBP0=";
+
+  makeCacheWritable = true;
+
+  nodejs = nodejs_22;
+
+  npmPackFlags = [ "--ignore-scripts" ];
+  npmFlags = [ "--legacy-peer-deps" ];
+
+  env.NODE_OPTIONS = "--openssl-legacy-provider";
+
+  postPatch = ''
+    substituteInPlace backend/server.js \
+      --replace-fail "const PORT = 3000;" "const PORT = Number(process.env.JS_PORT || 3000);"
+  '';
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/jellystat $out/bin
+    cp -r . $out/share/jellystat/
+
+    makeWrapper ${nodejs_22}/bin/node $out/bin/jellystat \
+      --chdir $out/share/jellystat \
+      --add-flags $out/share/jellystat/backend/server.js
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Jellystat is a free and open source Statistics App for Jellyfin";
+    homepage = "https://github.com/CyferShepard/Jellystat";
+    license = licenses.mit;
+    maintainers = with maintainers; [ mistyttm ];
+    mainProgram = "jellystat";
+    platforms = platforms.linux;
+  };
+})
--- a/pkgs/by-name/je/jellystat/remove-hardcoded-path.patch
+++ b/pkgs/by-name/je/jellystat/remove-hardcoded-path.patch
@@ -0,0 +1,151 @@
+diff --git a/backend/classes/backup.js b/backend/classes/backup.js
+index 981b7d6..c6b4124 100644
+--- a/backend/classes/backup.js
+++ b/backend/classes/backup.js
+@@ -15,7 +15,9 @@ const postgresPassword = process.env.POSTGRES_PASSWORD;
+ const postgresIp = process.env.POSTGRES_IP;
+ const postgresPort = process.env.POSTGRES_PORT;
+ const postgresDatabase = process.env.POSTGRES_DB || "jfstat";
+-const backupfolder = "backup-data";
+const backupfolder = process.env.JS_BACKUP_DIR
+  ? path.resolve(process.env.JS_BACKUP_DIR)
+  : path.join(__dirname, "..", "backup-data");
+ 
+ function checkFolderWritePermission(folderPath) {
+   try {
+@@ -51,7 +53,7 @@ async function backup(refLog) {
+ 
+   try {
+     let now = dayjs();
+-    const backuppath = "./" + backupfolder;
+    const backuppath = backupfolder;
+ 
+     if (!fs.existsSync(backuppath)) {
+       fs.mkdirSync(backuppath);
+@@ -79,7 +81,7 @@ async function backup(refLog) {
+     }
+ 
+     // const backupPath = `../backup-data/backup_${now.format('YYYY-MM-DD HH-mm-ss')}.json`;
+-    const directoryPath = path.join(__dirname, "..", backupfolder, `backup_${now.format("YYYY-MM-DD HH-mm-ss")}.json`);
+    const directoryPath = path.join(backupfolder, `backup_${now.format("YYYY-MM-DD HH-mm-ss")}.json`);
+     refLog.logData.push({ color: "yellow", Message: "Begin Backup " + directoryPath });
+     const stream = fs.createWriteStream(directoryPath, { flags: "a" });
+     stream.on("error", async (error) => {
+@@ -105,7 +107,7 @@ async function backup(refLog) {
+ 
+     //Cleanup excess backups
+     let deleteCount = 0;
+-    const directoryPathDelete = path.join(__dirname, "..", backupfolder);
+    const directoryPathDelete = backupfolder;
+ 
+     const files = await new Promise((resolve, reject) => {
+       fs.readdir(directoryPathDelete, (err, files) => {
+@@ -132,7 +134,7 @@ async function backup(refLog) {
+     fileData = fileData.sort((a, b) => new Date(b.datecreated) - new Date(a.datecreated)).slice(5);
+ 
+     for (var oldBackup of fileData) {
+-      const oldBackupFile = path.join(__dirname, "..", backupfolder, oldBackup.name);
+      const oldBackupFile = path.join(backupfolder, oldBackup.name);
+ 
+       await new Promise((resolve, reject) => {
+         fs.unlink(oldBackupFile, (err) => {
+diff --git a/backend/classes/env.js b/backend/classes/env.js
+index afb76e7..5863934 100644
+--- a/backend/classes/env.js
+++ b/backend/classes/env.js
+@@ -16,7 +16,12 @@ async function writeEnvVariables() {
+   const envContent = `window.env = ${JSON.stringify(envVariables, null, 2)};`;
+ 
+   // Define the output file path
+-  const outputPath = path.join(__dirname, "..", "..", "dist", "env.js");
+  const envDir = process.env.JS_ENV_DIR ? path.resolve(process.env.JS_ENV_DIR) : path.join(__dirname, "..", "..", "dist");
+  const outputPath = path.join(envDir, "env.js");
+
+  if (process.env.JS_ENV_DIR) {
+    fs.mkdirSync(envDir, { recursive: true });
+  }
+ 
+   // Write the environment variables to the file
+   fs.writeFile(outputPath, envContent, "utf8", (err) => {
+diff --git a/backend/routes/backup.js b/backend/routes/backup.js
+index cfc3d3f..12d9b32 100644
+--- a/backend/routes/backup.js
+++ b/backend/routes/backup.js
+@@ -25,7 +25,9 @@ const postgresPort = process.env.POSTGRES_PORT;
+ const postgresDatabase = process.env.POSTGRES_DB || "jfstat";
+ const postgresSslRejectUnauthorized = process.env.POSTGRES_SSL_REJECT_UNAUTHORIZED === undefined ? true : process.env.POSTGRES_SSL_REJECT_UNAUTHORIZED === "true";
+ 
+-const backupfolder = "backup-data";
+const backupfolder = process.env.JS_BACKUP_DIR
+  ? path.resolve(process.env.JS_BACKUP_DIR)
+  : path.join(__dirname, "..", "backup-data");
+ 
+ // Restore function
+ 
+@@ -187,7 +189,7 @@ router.get("/restore/:filename", async (req, res) => {
+     Logging.insertLog(uuid, triggertype.Manual, taskName.restore);
+ 
+     const filename = sanitizeFilename(req.params.filename);
+-    const filePath = path.join(__dirname, "..", backupfolder, filename);
+    const filePath = path.join(backupfolder, filename);
+ 
+     await restore(filePath, refLog);
+     Logging.updateLog(uuid, refLog.logData, taskstate.SUCCESS);
+@@ -202,7 +204,7 @@ router.get("/restore/:filename", async (req, res) => {
+ 
+ router.get("/files", (req, res) => {
+   try {
+-    const directoryPath = path.join(__dirname, "..", backupfolder);
+    const directoryPath = backupfolder;
+     fs.readdir(directoryPath, (err, files) => {
+       if (err) {
+         res.status(500).send("Unable to read directory");
+@@ -229,7 +231,7 @@ router.get("/files", (req, res) => {
+ //download backup file
+ router.get("/files/:filename", (req, res) => {
+   const filename = sanitizeFilename(req.params.filename);
+-  const filePath = path.join(__dirname, "..", backupfolder, filename);
+  const filePath = path.join(backupfolder, filename);
+   res.download(filePath);
+ });
+ 
+@@ -237,7 +239,7 @@ router.get("/files/:filename", (req, res) => {
+ router.delete("/files/:filename", (req, res) => {
+   try {
+     const filename = sanitizeFilename(req.params.filename);
+-    const filePath = path.join(__dirname, "..", backupfolder, filename);
+    const filePath = path.join(backupfolder, filename);
+ 
+     fs.unlink(filePath, (err) => {
+       if (err) {
+@@ -256,7 +258,7 @@ router.delete("/files/:filename", (req, res) => {
+ 
+ const storage = multer.diskStorage({
+   destination: function (req, file, cb) {
+-    cb(null, path.join(__dirname, "..", backupfolder)); // Set the destination folder for uploaded files
+    cb(null, backupfolder); // Set the destination folder for uploaded files
+   },
+   filename: function (req, file, cb) {
+     cb(null, file.originalname); // Set the file name
+diff --git a/backend/server.js b/backend/server.js
+index d70975d..1898ec6 100644
+--- a/backend/server.js
+++ b/backend/server.js
+@@ -106,6 +106,17 @@ const findFile = (dir, fileName) => {
+ 
+ const root = path.join(__dirname, "..", "dist");
+ 
+// When JS_ENV_DIR is set, env.js is written outside of `root` (e.g. because
+// `root` lives on a read-only filesystem), so serve it explicitly from
+// there instead of relying on the findFile() lookup below, which only
+// searches under `root`.
+if (process.env.JS_ENV_DIR) {
+  const envDir = path.resolve(process.env.JS_ENV_DIR);
+  app.get(/\/env\.js$/, (req, res) => {
+    res.sendFile(path.join(envDir, "env.js"));
+  });
+}
+
+ //hacky middleware to handle basename changes for UI
+ 
+ app.use((req, res, next) => {
--- a/pkgs/by-name/ld/ldap-manager/package.nix
+++ b/pkgs/by-name/ld/ldap-manager/package.nix
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "ldap-manager";
-  version = "1.5.1";
+  version = "1.6.0";

  src = fetchFromGitHub {
    owner = "netresearch";
    repo = "ldap-manager";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-rc3JsWy8tkEzQnLygC5Y6GlEjawjO8d1RB1qxOVo404=";
+    hash = "sha256-MqR4Dj/obMpUKGDMDwEi8kQMMFQXVBPjDBby5t7RfAk=";
  };

-  vendorHash = "sha256-Oc7pnVFHX8uKgMgf7TRrTuDf0zjEM7KpGIenQiCNeuE=";
+  vendorHash = "sha256-ZM2MjG3roOl4PFiBuo9F8cTTVWt1ZHuNmaZFvpH804c=";

  excludedPackages = [
    "internal/e2e"
--- a/pkgs/by-name/li/libmateweather/package.nix
+++ b/pkgs/by-name/li/libmateweather/package.nix
@@ -62,8 +62,6 @@ stdenv.mkDerivation (finalAttrs: {
    "--with-zoneinfo-dir=${tzdata}/share/zoneinfo"
  ];

-  preFixup = "rm -f $out/share/icons/mate/icon-theme.cache";
-
  enableParallelBuilding = true;

  passthru.updateScript = gitUpdater {
--- a/pkgs/by-name/li/libphonenumber/package.nix
+++ b/pkgs/by-name/li/libphonenumber/package.nix
@@ -15,13 +15,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libphonenumber";
-  version = "9.0.37";
+  version = "9.0.38";

  src = fetchFromGitHub {
    owner = "google";
    repo = "libphonenumber";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-RBYLcJdnf+n4Bq+mw8EyWjJGNr6lTOHMmduV8YXKLQs=";
+    hash = "sha256-Usln8w9OyACsYBDn85kTUmsombrkaRc3qRt2oKMs+0k=";
  };

  patches = [
--- a/pkgs/by-name/li/librechat/package.nix
+++ b/pkgs/by-name/li/librechat/package.nix
@@ -2,7 +2,6 @@
  lib,
  buildNpmPackage,
  fetchFromGitHub,
-  nodejs_22,
  pkg-config,
  node-gyp,
  vips,
@@ -12,13 +11,13 @@

 buildNpmPackage (finalAttrs: {
  pname = "librechat";
-  version = "0.8.6";
+  version = "0.8.7";

  src = fetchFromGitHub {
    owner = "danny-avila";
    repo = "LibreChat";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-cWgjsLN7NnJNJ1hYPo0h3lh+W4wi9qqttevNfNrYdXg=";
+    hash = "sha256-egnmkYpQS/AshMmXP5C8qhwA+7TPZYnu0ct552HFjGg=";
  };

  patches = [
@@ -35,10 +34,7 @@ buildNpmPackage (finalAttrs: {
  ];

  npmDepsFetcherVersion = 2;
-  npmDepsHash = "sha256-Y+oC9eigwzL8jei5Hs4YOf32oFgULPmHrSDApxPKh+0=";
-
-  # npm dependency install fails with nodejs_24: https://github.com/NixOS/nixpkgs/issues/474535
-  nodejs = nodejs_22;
+  npmDepsHash = "sha256-U2DzvfzKCmAYLFG0FbFcng5goj1mYCjTpJuQ36fVNuA=";

  nativeBuildInputs = [
    pkg-config
@@ -61,7 +57,12 @@ buildNpmPackage (finalAttrs: {

  # npmConfigHook only patches the root node_modules
  postConfigure = ''
-    patchShebangs client/node_modules
+    patchShebangs $(find "$PWD" -type d -name node_modules -prune ! -path "$PWD/node_modules" -print)
+  '';
+
+  preInstall = ''
+    # not sure why this is something npm pack tries to keep
+    rm -rf ./packages/data-schemas/node_modules/winston-transport/.nyc_output
  '';

  # For reasons beyond my understanding, the api and client directory disappears after the build finishes.
--- a/pkgs/by-name/lo/lobster/package.nix
+++ b/pkgs/by-name/lo/lobster/package.nix
@@ -20,13 +20,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "lobster";
-  version = "2026.4";
+  version = "2026.5";

  src = fetchFromGitHub {
    owner = "aardappel";
    repo = "lobster";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-kqKOf0zrHyqRTs+57owHR5sORZgNIgGghtjUtSaFjZw=";
+    hash = "sha256-coUsn3sYTWO4UGqw5DIWFvnA5+TpkUukRx0Axg8Lfhc=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/lu/lunar-client/package.nix
+++ b/pkgs/by-name/lu/lunar-client/package.nix
@@ -7,11 +7,11 @@

 appimageTools.wrapType2 rec {
  pname = "lunarclient";
-  version = "3.7.14";
+  version = "3.7.15";

  src = fetchurl {
    url = "https://launcherupdates.lunarclientcdn.com/Lunar%20Client-${version}-ow.AppImage";
-    hash = "sha512-UmaMEDkLMU/V0Rddu4IATsH8LrmyV7KOQE1ac0rWHWld7tE1ZU9vp+/VTR68KFkxfTm0wNMxy4ilAP84GVA7pQ==";
+    hash = "sha512-F2rJpU7PLvknzkkYwlPSxLZAiuw8om7XT6cDMnw9IRODyHfWzBgTL5481GK6ySNV6sVZAlWVg4hf7XsPtdci/A==";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/ma/mango/package.nix
+++ b/pkgs/by-name/ma/mango/package.nix
@@ -27,13 +27,13 @@ stdenv.mkDerivation (finalAttrs: {
  __structuredAttrs = true;
  strictDeps = true;
  pname = "mango";
-  version = "0.16.1";
+  version = "0.16.2";

  src = fetchFromGitHub {
    owner = "mangowm";
    repo = "mango";
    tag = finalAttrs.version;
-    hash = "sha256-0mX95LpyZuMMkEKS1qTiVrpDLeuCzO5hVJdmdpr7SY0=";
+    hash = "sha256-od6lK1KOquakP/GD17fGEm1ck5EMZa/s+jhmvGrRFzk=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ma/mate-wayland-session/package.nix
+++ b/pkgs/by-name/ma/mate-wayland-session/package.nix
@@ -14,13 +14,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "mate-wayland-session";
-  version = "1.28.5";
+  version = "1.28.6";

  src = fetchFromGitHub {
    owner = "mate-desktop";
    repo = "mate-wayland-session";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-YWuBAzsLrvnwGgXbcDzIZtQIscIl37Y3wIRCOKidtYo=";
+    hash = "sha256-jlUmA+a59VGXtPUftmA7DruZK53IQM+66RgeP1Jg3e8=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ma/mathic/package.nix
+++ b/pkgs/by-name/ma/mathic/package.nix
@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "mathic";
-  version = "1.4";
+  version = "1.5";

  src = fetchFromGitHub {
    owner = "Macaulay2";
    repo = "mathic";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-0/ws95MTrNXt6BhqyWjsOGyXvh2tTd48/pT6kWwQPd4=";
+    hash = "sha256-O/5fNnKiHTX/VV7ztFofRlRQZuoTmag3BNok7qFyffQ=";
  };

  buildInputs = [
--- a/pkgs/by-name/ni/niks3/package.nix
+++ b/pkgs/by-name/ni/niks3/package.nix
@@ -9,17 +9,17 @@

 buildGoModule (finalAttrs: {
  pname = "niks3";
-  version = "1.8.0";
+  version = "1.9.0";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "Mic92";
    repo = "niks3";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-86afR/fMjLRLmBEMFA6ow6SRI9T5Qe83l0em/FciW2g=";
+    hash = "sha256-mfoin/yCAdHJpwKX0VHXknbUYvEm+F5XSgMQ4oLgP/g=";
  };

-  vendorHash = "sha256-qkB99S/9fmSk5G9uHyQF/z+joi9JACIJWaHMrIo4ziU=";
+  vendorHash = "sha256-lql+r9+hy7XX9/aSezwweKSU/MphxvIkaT0gHf59fsc=";

  subPackages = [
    "cmd/niks3"
--- a/pkgs/by-name/no/nono/package.nix
+++ b/pkgs/by-name/no/nono/package.nix
@@ -15,7 +15,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "nono";
-  version = "0.71.0";
+  version = "0.74.0";

  __darwinAllowLocalNetworking = true; # required for tests

@@ -23,9 +23,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "nolabs-ai";
    repo = "nono";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Xrqd8Do1R2kCwTAmju2VmOLAf329eoOSslfa8i9ogJc=";
+    hash = "sha256-Njfs0kkoNj3VjLd6ziz5WAgI+HLMZ+djqxjbXabEdzg=";
  };
-  cargoHash = "sha256-bMGrLh3DEA3yJsyb62Xdt+SfhzFY5VXawai4V6xttpI=";
+  cargoHash = "sha256-+JLE0hBmsxqDnTwkFRVxphA6HdA/EgkWHIAJiExsxp4=";

  nativeBuildInputs = [
    pkg-config
@@ -46,11 +46,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
      "test_all_profiles_signal_mode_resolves"
      "test_restrict_execute_does_not_break_rename_into_new_subdir"
      # panic
-      "build_run_profile_patch_adds_override_deny_for_sensitive_file"
      "build_run_profile_patch_merges_read_and_write_to_allow_file"
      "prepare_profile_save_from_patch_updates_existing_user_profile"
-      "would_shadow_builtin_allows_update_of_existing_user_override"
-      "would_shadow_builtin_flags_known_builtin_names"
      "create_audit_state_creates_session_when_enabled"

      # audit_attestation
@@ -58,6 +55,18 @@ rustPlatform.buildRustPackage (finalAttrs: {
      "audit_verify_reports_signed_attestation_with_pinned_public_key"
      "rollback_signed_session_verifies_from_audit_dir_bundle"

+      # audit_ledger
+      # needs /bin/pwd
+      "corrupt_audit_ledger_downgrades_only_a_clean_exit"
+      "corrupt_audit_ledger_is_reported_on_every_run_and_left_untouched"
+
+      # execution_strategy_run
+      # needs /usr/bin/env
+      "direct_workdir_overrides_untrusted_host_pwd"
+      "direct_workdir_sets_child_pwd_from_uncovered_launch_dir"
+      "supervised_workdir_overrides_untrusted_host_pwd"
+      "supervised_workdir_sets_child_pwd_from_uncovered_launch_dir"
+
      # nono-cli
      # wants a script `scripts/test-list-aliases.sh`, `git`, and `.git` history
      "alias_inventory_script_passes"
--- a/pkgs/by-name/nu/nushell/package.nix
+++ b/pkgs/by-name/nu/nushell/package.nix
@@ -114,7 +114,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    updateScript = nix-update-script { };

    withPlugins = plugins: callPackage ./with-plugins.nix { inherit plugins; };
-    tests.withPlugins = callPackage ./plugins/test-with-plugins.nix { };
+    tests = {
+      withPlugins = callPackage ./plugins/test-with-plugins.nix { };
+      pluginCompat = callPackage ./plugins/test-plugin-compat.nix { };
+    };
  };

  meta = {
--- a/pkgs/by-name/nu/nushell/plugins/bson/package.nix
+++ b/pkgs/by-name/nu/nushell/plugins/bson/package.nix
@@ -3,11 +3,12 @@
  rustPlatform,
  fetchFromGitHub,
  nix-update-script,
-  llvmPackages,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "nu_plugin_bson";
+  # NOTE: v26.1140.0 does not build: its Cargo.toml requires nu-plugin ^0.114.0
+  # while its Cargo.lock still pins 0.113.1.
  version = "26.1130.0";

  src = fetchFromGitHub {
@@ -19,19 +20,21 @@ rustPlatform.buildRustPackage (finalAttrs: {

  cargoHash = "sha256-aGUlItPfrr3Uz/t1XEXBtGM285up3A5Wva1QMKwBrg0=";

-  nativeBuildInputs = [
-    llvmPackages.libclang
-  ];
+  nativeBuildInputs = [ rustPlatform.bindgenHook ];

-  env.LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
+  passthru.updateScript = nix-update-script { };

-  passthru.update-script = nix-update-script { };
  meta = {
-    description = " Nushell plugin for BSON (Binary JSON) format `from bson` and `to bson`";
+    description = "Nushell plugin for BSON (Binary JSON) format `from bson` and `to bson`";
    homepage = "https://github.com/Kissaki/nu_plugin_bson";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ philocalyst ];
    mainProgram = "nu_plugin_bson";
    platforms = lib.platforms.unix ++ lib.platforms.windows;
+    # "Plugin `bson` is compiled for nushell version 0.113.0, which is not
+    # compatible with version 0.115.1".
+    # Upstream's main branch has already bumped to nu-plugin 0.115.0, so this
+    # should be unbroken by the next release.
+    broken = true;
  };
 })
--- a/pkgs/by-name/nu/nushell/plugins/dbus/package.nix
+++ b/pkgs/by-name/nu/nushell/plugins/dbus/package.nix
@@ -34,7 +34,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    maintainers = with lib.maintainers; [ aftix ];
    platforms = lib.platforms.linux;
    # "Plugin `dbus` is compiled for nushell version 0.101.0, which is not
-    # compatible with version 0.105.1"
+    # compatible with version 0.115.1"
    broken = true;
  };
 })
--- a/pkgs/by-name/nu/nushell/plugins/default.nix
+++ b/pkgs/by-name/nu/nushell/plugins/default.nix
@@ -1,9 +1,11 @@
 {
+  lib,
+  config,
  callPackage,
  dbus,
 }:
 {
-  bson = callPackage ./bson/package.nix;
+  bson = callPackage ./bson/package.nix { };
  dbus = callPackage ./dbus/package.nix { inherit dbus; };
  desktop_notifications = callPackage ./desktop_notifications/package.nix { };
  formats = callPackage ./formats/package.nix { };
@@ -13,7 +15,9 @@
  net = callPackage ./net/package.nix { };
  polars = callPackage ./polars/package.nix { };
  query = callPackage ./query/package.nix { };
-  semver = callPackage ./semver/package.nix { };
  skim = callPackage ./skim/package.nix { };
  units = callPackage ./units/package.nix { };
 }
+// lib.optionalAttrs config.allowAliases {
+  semver = throw "nushellPlugins.semver is EOL as starting with 0.114.0, nushell natively supports semver values."; # Added 2026-08-27
+}
--- a/pkgs/by-name/nu/nushell/plugins/highlight/package.nix
+++ b/pkgs/by-name/nu/nushell/plugins/highlight/package.nix
@@ -34,5 +34,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
    homepage = "https://github.com/cptpiepmatz/nu-plugin-highlight";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ mgttlinger ];
+    # "Plugin `highlight` is compiled for nushell version 0.114.1, which is
+    # not compatible with version 0.115.1"
+    broken = true;
  };
 })
--- a/pkgs/by-name/nu/nushell/plugins/net/package.nix
+++ b/pkgs/by-name/nu/nushell/plugins/net/package.nix
@@ -33,7 +33,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    maintainers = with lib.maintainers; [ happysalada ];
    mainProgram = "nu_plugin_net";
    # "Plugin `net` is compiled for nushell version 0.104.0, which is not
-    # compatible with version 0.105.1"
+    # compatible with version 0.115.1"
    broken = true;
  };
 })
--- a/pkgs/by-name/nu/nushell/plugins/semver/package.nix
+++ b/pkgs/by-name/nu/nushell/plugins/semver/package.nix
@@ -1,31 +0,0 @@
-{
-  lib,
-  rustPlatform,
-  fetchFromGitHub,
-  nix-update-script,
-}:
-
-rustPlatform.buildRustPackage (finalAttrs: {
-  pname = "nu_plugin_semver";
-  version = "0.11.17";
-
-  src = fetchFromGitHub {
-    owner = "abusch";
-    repo = "nu_plugin_semver";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-GJ3B7dENuSEZSkHV42plt7tsGLZPqqXCO3c/0ILZQ1Y=";
-  };
-
-  cargoHash = "sha256-U3wwXtvnHfbxfH5awVJbSI4OaVd/c/TsQHzaUljw99o=";
-
-  passthru.updateScript = nix-update-script { };
-
-  meta = {
-    description = "Nushell plugin to work with semver versions";
-    homepage = "https://github.com/abusch/nu_plugin_semver";
-    changelog = "https://github.com/abusch/nu_plugin_semver/blob/${finalAttrs.src.tag}/CHANGELOG.md";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ koffydrop ];
-    mainProgram = "nu_plugin_semver";
-  };
-})
--- a/pkgs/by-name/nu/nushell/plugins/skim/package.nix
+++ b/pkgs/by-name/nu/nushell/plugins/skim/package.nix
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "nu_plugin_skim";
-  version = "0.29.1";
+  version = "0.30.0";

  src = fetchFromGitHub {
    owner = "idanarye";
    repo = "nu_plugin_skim";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Ddnn5H2NjYuv+7v4JxT56pq5Kr7N8yv+NG5gYITf4qc=";
+    hash = "sha256-bZiNUQon4x82XQKINrDYTn6IgEZmLwhhFvmYMTBLOmA=";
  };

-  cargoHash = "sha256-ZYG8nIh/nQ3nRGkN3pnU6j7BMR5fOx/qOYppdZdfXe0=";
+  cargoHash = "sha256-s0VU8S/V/HJJ5DPLIFvUqhxu9391PJYY/tROUbfJnDQ=";

  nativeBuildInputs = lib.optionals stdenv.cc.isClang [ rustPlatform.bindgenHook ];

--- a/pkgs/by-name/nu/nushell/plugins/test-plugin-compat.nix
+++ b/pkgs/by-name/nu/nushell/plugins/test-plugin-compat.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  stdenv,
+  runCommand,
+  nushell,
+  nushellPlugins,
+}:
+let
+  # Nushell refuses to load a plugin that was not compiled against its own
+  # major/minor version, and nothing about building a plugin catches that: a
+  # stale plugin builds fine and only fails when nu tries to load it. So a
+  # nushell bump silently breaks every plugin not updated in lockstep. Load all
+  # of them here so that shows up in the build instead of on a user's machine.
+  # tryEval steps over the removal aliases, which throw when forced.
+  plugins = lib.filter (
+    p: lib.isDerivation p && lib.meta.availableOn stdenv.hostPlatform p && !(p.meta.broken or false)
+  ) (lib.filter (p: (builtins.tryEval p).success) (lib.attrValues nushellPlugins));
+
+  nuWithPlugins = nushell.withPlugins plugins;
+
+  # `plugin list` reports plugins by their registered name, which is the
+  # mainProgram without the `nu_plugin_` prefix.
+  expected = lib.sort (a: b: a < b) (
+    lib.map (p: lib.removePrefix "nu_plugin_" (baseNameOf (lib.getExe p))) plugins
+  );
+in
+runCommand "nushell-plugin-compat-test" { } ''
+  expected=${lib.escapeShellArg (lib.concatStringsSep "\n" expected)}
+
+  # nu exits non-zero when a plugin fails to load; keep going so the
+  # comparison below can report which one it was.
+  actual=$(env -u XDG_DATA_DIRS HOME=/homeless-shelter \
+    ${nuWithPlugins}/bin/nu --no-config-file -c 'plugin list | get name | sort | to text' 2>&1 || true)
+
+  if [ "$actual" != "$expected" ]; then
+    echo "FAIL: the set of loadable plugins does not match the set of non-broken plugins."
+    echo "A plugin that fails to load is compiled for a different nushell version;"
+    echo "either update it, or mark it broken in its package.nix."
+    echo "--- expected ---"
+    echo "$expected"
+    echo "--- actual ---"
+    echo "$actual"
+    exit 1
+  fi
+
+  touch $out
+''
--- a/pkgs/by-name/nu/nushell/plugins/units/package.nix
+++ b/pkgs/by-name/nu/nushell/plugins/units/package.nix
@@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "nu_plugin_units";
-  version = "0.1.7";
+  version = "0.1.8";

  src = fetchFromGitHub {
    owner = "JosephTLyons";
    repo = "nu_plugin_units";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-4donh0UlBbaEwgDxUECKTPWGLuAc9KUmrRty2Ob7ZMA=";
+    hash = "sha256-dPfEjK2Ws/cHfYdMwKbDL/gZp1ZMx6RRo7DWPcdrD7w=";
  };

-  cargoHash = "sha256-MjalDrjJTAHay9zcPhA8br2tOkkIzE4etL+yF5MKetY=";
+  cargoHash = "sha256-K3hzUmhEjCwhaSuC7MpZbIJGZEKoAzH+LsfK3krm5cU=";

  nativeBuildInputs = [ pkg-config ] ++ lib.optionals stdenv.cc.isClang [ rustPlatform.bindgenHook ];

@@ -30,6 +30,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
    homepage = "https://github.com/JosephTLyons/nu_plugin_units";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ mgttlinger ];
+    # "Plugin `units` is compiled for nushell version 0.106.1, which is not
+    # compatible with version 0.115.1"
    broken = true;
  };
 })
--- a/pkgs/by-name/op/opendht/package.nix
+++ b/pkgs/by-name/op/opendht/package.nix
@@ -14,6 +14,7 @@
  restinio,
  llhttp,
  openssl,
+  simdutf,
  fmt,
  nix-update-script,
  enableProxyServerAndClient ? false,
@@ -22,13 +23,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "opendht";
-  version = "3.5.4";
+  version = "4.3.1";

  src = fetchFromGitHub {
    owner = "savoirfairelinux";
    repo = "opendht";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-mnnd6yATIk/TEuFG/M98d+pfeh42IKWBBYjkTP52xeM=";
+    hash = "sha256-LquXkbJUBgZfb7cc+Lc1lejO2NxFur83iI0QOuOg5bE=";
  };

  nativeBuildInputs = [
@@ -50,6 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
    restinio
    llhttp
    openssl
+    simdutf
  ];

  cmakeFlags =
--- a/pkgs/by-name/pe/penpot-desktop/package.nix
+++ b/pkgs/by-name/pe/penpot-desktop/package.nix
@@ -2,7 +2,7 @@
  lib,
  buildNpmPackage,
  copyDesktopItems,
-  electron_41,
+  electron_42,
  fetchFromGitHub,
  jq,
  makeDesktopItem,
@@ -15,17 +15,17 @@ let
  description = "Unofficial desktop application for the open-source design tool, Penpot";
  icon = "penpot";
  nodejs = nodejs_24;
-  electron = electron_41;
+  electron = electron_42;
 in
 buildNpmPackage rec {
  pname = "penpot-desktop";
-  version = "0.23.1";
+  version = "0.23.2";

  src = fetchFromGitHub {
    owner = "author-more";
    repo = "penpot-desktop";
    tag = "v${version}";
-    hash = "sha256-/vRF5eqtjdmd2Qmb+OAgKfLJmh78S0WrLWA94SeOJQA=";
+    hash = "sha256-V/JqrEkag6tVcq46wqLdheJqSAFmfeEVxueIgeuyToA=";
  };

  makeCacheWritable = true;
@@ -33,7 +33,7 @@ buildNpmPackage rec {
    "--engine-strict"
    "--legacy-peer-deps"
  ];
-  npmDepsHash = "sha256-hu2v2Dw2SRs4Egmsi5hb81vgnZDjQahLXyAYm/uaMao=";
+  npmDepsHash = "sha256-5CD/sK/DYfzIgnuvTi4OevtyNLEOTedmuStrg4ru14A=";
  # Do not run the default build script as it leads to errors caused by the electron-builder configuration
  dontNpmBuild = true;

--- a/pkgs/by-name/pg/pgschema/package.nix
+++ b/pkgs/by-name/pg/pgschema/package.nix
@@ -0,0 +1,53 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  postgresql,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "pgschema";
+  version = "1.12.3";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "pgplex";
+    repo = "pgschema";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-zfG87Uc5bx14zhYnuT3CF+sW5EEQLBRRMyBe57FBHJ4=";
+  };
+
+  # Adapted from $src/nix/pgschema.nix
+  proxyVendor = true;
+  vendorHash = "sha256-3nV7AEsWyEvIbxHetoEsA8PPXJ6ENvU/sz7Wn5aysss=";
+
+  env.CGO_ENABLED = "0";
+  ldflags = [
+    "-s"
+    "-w"
+    "-X"
+    "github.com/pgplex/pgschema/cmd.GitCommit=${finalAttrs.src.rev}"
+    "-X"
+    "github.com/pgplex/pgschema/internal/postgres.binariesPath=${postgresql}"
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--help"; # there is no -v/--version
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Terraform-style, declarative Postgres schema migration";
+    homepage = "https://github.com/pgplex/pgschema";
+    changelog = "https://github.com/pgplex/pgschema/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.bengsparks ];
+    mainProgram = "pgschema";
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/by-name/pi/picgo/package.nix
+++ b/pkgs/by-name/pi/picgo/package.nix
@@ -6,7 +6,7 @@
  pnpm_10,
  fetchPnpmDeps,
  pnpmConfigHook,
-  electron_41,
+  electron_43,
  makeWrapper,
  copyDesktopItems,
  makeDesktopItem,
@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "picgo";
-  version = "3.0.1";
+  version = "3.0.2";

  src = fetchFromGitHub {
    owner = "Molunerfinn";
    repo = "PicGo";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-uxgrtuxcIlwCuz3X2hL0ZSpq8hMA4JxQD8ibNFw+35g=";
+    hash = "sha256-wT9CfPchNbD2CzSVA9kZAYsstpc2mvgqAl305rmrUdo=";
  };

  pnpmDeps = fetchPnpmDeps {
@@ -48,6 +48,15 @@ stdenv.mkDerivation (finalAttrs: {
    NODE_ENV = "development";
  };

+  postPatch = ''
+    # Maximizing a hidden BrowserWindow makes it visible on Linux. Defer restoring
+    # the maximized state until the main window is explicitly shown.
+    # https://github.com/Molunerfinn/PicGo/blob/4676326eb88d087432989366d71e61e17a039e98/src/main/apis/app/window/windowList.ts#L83-L94
+    substituteInPlace src/main/apis/app/window/windowList.ts \
+      --replace-fail "      window.maximize()" \
+        "      window.once('show', () => window.maximize())"
+  '';
+
  buildPhase = ''
    runHook preBuild

@@ -57,12 +66,8 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  postBuild = ''
-    cp -r src/renderer/public/. dist_electron/renderer/
-
-    # Renderer assets are loaded from a file:// URL, so root-relative paths like
-    # /squareLogo.png resolve to the filesystem root. Copy the renderer public assets
-    # next to index.html and rewrite those references to relative paths.
-    # https://github.com/Molunerfinn/PicGo/blob/dev/src/renderer/components/independent-window/mini/picgo-mini-page.tsx
+    # Renderer assets are loaded from a file:// URL, so the mini window logo must
+    # use a path relative to its index.html.
    substituteInPlace dist_electron/renderer/assets/mini-*.js \
      --replace-fail '"/squareLogo.png"' '"./squareLogo.png"'
  '';
@@ -92,7 +97,7 @@ stdenv.mkDerivation (finalAttrs: {
    # ELECTRON_FORCE_IS_PACKAGED makes PicGo use its production resource path,
    # but with the nixpkgs Electron wrapper process.resourcesPath points to Electron
    # itself, so point PicGo at the installed public assets
-    makeWrapper ${lib.getExe electron_41} $out/bin/picgo \
+    makeWrapper ${lib.getExe electron_43} $out/bin/picgo \
      --add-flags "--class=picgo" \
      --add-flags "$out/lib/picgo/.launcher.cjs" \
      --set NODE_ENV production \
--- a/pkgs/by-name/pi/pitchfork/package.nix
+++ b/pkgs/by-name/pi/pitchfork/package.nix
@@ -0,0 +1,93 @@
+{
+  lib,
+  fetchFromGitHub,
+  fetchPnpmDeps,
+  nodejs,
+  pnpm_10,
+  pnpmConfigHook,
+  rustPlatform,
+  stdenv,
+}:
+
+let
+  pnpm = pnpm_10;
+in
+rustPlatform.buildRustPackage (
+  finalAttrs:
+  let
+    webui = stdenv.mkDerivation {
+      pname = "${finalAttrs.pname}-webui";
+      inherit (finalAttrs) version src;
+
+      sourceRoot = "${finalAttrs.src.name}/ui";
+      pnpmDeps = finalAttrs.pnpmDeps;
+
+      nativeBuildInputs = [
+        nodejs
+        pnpm
+        pnpmConfigHook
+      ];
+
+      buildPhase = ''
+        runHook preBuild
+
+        pnpm build
+
+        runHook postBuild
+      '';
+
+      installPhase = ''
+        runHook preInstall
+
+        mkdir -p $out
+        cp -r dist/. $out/
+
+        runHook postInstall
+      '';
+    };
+  in
+  {
+    pname = "pitchfork";
+    version = "2.23.0";
+
+    __structuredAttrs = true;
+
+    src = fetchFromGitHub {
+      owner = "jdx";
+      repo = "pitchfork";
+      tag = "v${finalAttrs.version}";
+      hash = "sha256-P3N4YquQPJ+xr/M6foK9r2EDKjOsslRVMU3aIsJr04U=";
+    };
+
+    cargoHash = "sha256-jNf0dTsZgS8CWBrGu+o1d11Nil9OgsLykxNkGxTd9aY=";
+
+    cargoDeps = rustPlatform.fetchCargoVendor {
+      inherit (finalAttrs) pname src version;
+      hash = finalAttrs.cargoHash;
+    };
+
+    pnpmDeps = fetchPnpmDeps {
+      inherit (finalAttrs) pname version src;
+      inherit pnpm;
+      sourceRoot = "${finalAttrs.src.name}/ui";
+      fetcherVersion = 3;
+      hash = "sha256-zh0JlHe6NDpsuDKsGq5Eto8Rx7gGLc7ayxV/NIhm4EQ=";
+    };
+
+    preBuild = ''
+      mkdir -p ui/dist
+      cp -r ${webui}/. ui/dist/
+    '';
+
+    doCheck = false;
+
+    meta = {
+      homepage = "https://pitchfork.jdx.dev";
+      description = "Daemons with DX";
+      changelog = "https://github.com/jdx/pitchfork/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+      license = lib.licenses.mit;
+      mainProgram = "pitchfork";
+      maintainers = with lib.maintainers; [ esteve ];
+    };
+  }
+)
--- a/pkgs/by-name/re/resterm/package.nix
+++ b/pkgs/by-name/re/resterm/package.nix
@@ -8,13 +8,13 @@

 buildGoModule (finalAttrs: {
  pname = "resterm";
-  version = "0.49.4";
+  version = "1.2.4";

  src = fetchFromGitHub {
    owner = "unkn0wn-root";
    repo = "resterm";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-4hLhmQ2ks1g9eF+wKKLc8/6g07IHisgwYMBhGr4DjbE=";
+    hash = "sha256-vp1/yWDqx8fQp4NifjENr/x8e0TVSRlLYv7TshfwC2Y=";
  };

  vendorHash = "sha256-K6edyYLkVQwEZBAfRwgckUJI8dmo/ZxFRjEkExtyLxY=";
@@ -27,19 +27,8 @@ buildGoModule (finalAttrs: {

  subPackages = [ "cmd/resterm" ];

-  # Skip tests that require network access or socket binding
-  checkFlags = [
-    "-skip"
-    "^(${
-      lib.concatStringsSep "|" [
-        "TestServeMocksStartsAndStopsWithContext"
-        "TestServeMocksRequiresTLSPair"
-        "TestServeMocksValidatesJournalLimitsAsUsageErrors"
-        "TestMockControlCommandsResetClearAndVerify"
-        "TestCLIUpdaterCheckDev"
-      ]
-    })$"
-  ];
+  # for tests binding 127.0.0.1:0 on darwin
+  __darwinAllowLocalNetworking = true;

  ldflags = [
    "-s"
--- a/pkgs/by-name/re/retroshare/package.nix
+++ b/pkgs/by-name/re/retroshare/package.nix
@@ -107,6 +107,10 @@ stdenv.mkDerivation rec {
  postInstall = ''
    # BT DHT bootstrap
    cp libbitdht/src/bitdht/bdboot.txt $out/share/retroshare
+
+    substituteInPlace $out/share/applications/retroshare.desktop \
+      --replace-fail "/usr/bin/retroshare" "retroshare" \
+      --replace-fail "/usr/share/pixmaps/retroshare.xpm" "retroshare"
  '';

  meta = {
--- a/pkgs/by-name/sk/skills/package.nix
+++ b/pkgs/by-name/sk/skills/package.nix
@@ -14,13 +14,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "skills";
-  version = "1.5.22";
+  version = "1.5.23";

  src = fetchFromGitHub {
    owner = "vercel-labs";
    repo = "skills";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-F3KVn4OWpGKxKPzW8L/CnnLv8m51G7aflH65vv4SrtY=";
+    hash = "sha256-qD+gGPYjgbArf1Nz5rtlJVCS/2KNTuspag/B079l014=";
  };

  pnpmDeps = fetchPnpmDeps {
--- a/pkgs/by-name/su/super-productivity/package.nix
+++ b/pkgs/by-name/su/super-productivity/package.nix
@@ -1,7 +1,7 @@
 {
  buildNpmPackage,
  copyDesktopItems,
-  electron_41,
+  electron_43,
  fetchFromGitHub,
  lib,
  makeDesktopItem,
@@ -15,12 +15,12 @@
  cargo,
 }:
 let
-  electron = electron_41;
+  electron = electron_43;
  nodejs = nodejs_22;
 in
 buildNpmPackage rec {
  pname = "super-productivity";
-  version = "18.19.0";
+  version = "18.20.1";

  inherit nodejs;

@@ -28,7 +28,7 @@ buildNpmPackage rec {
    owner = "super-productivity";
    repo = "super-productivity";
    tag = "v${version}";
-    hash = "sha256-tUK2vytQ/fBSw8drjBLh4HlrnQh/0tX9e9otYMhXYsA=";
+    hash = "sha256-7bDPG3OPXVDzIjxpQw3XLXnLNSfjdq0pIlSqZhYZSIs=";
  };

  # Use custom fetcher for deps because super-productivity uses multiple
@@ -74,7 +74,7 @@ buildNpmPackage rec {
      dontInstall = true;

      outputHashMode = "recursive";
-      hash = "sha256-Je3pHgkBwt35sIvxQqnYX3F+uJQeBGc5kzCAL9czCYs=";
+      hash = "sha256-esVslmbko0mbANyR67b4a6YHO4sRniv5ZVISNk1u0Bg=";
    }
  );

--- a/pkgs/by-name/ta/tabularis/package.nix
+++ b/pkgs/by-name/ta/tabularis/package.nix
@@ -19,14 +19,14 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "tabularis";
-  version = "0.20.0";
+  version = "0.21.0";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "TabularisDB";
    repo = "tabularis";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Q03i0EhhRPOQYkb27MwIzcGH1uA4npcD3OJbTHQG0hw=";
+    hash = "sha256-81Y5sVeDJtzD1V8cj3KQhEkhreI7NaVhrHZlH9pO/T0=";
  };

  strictDeps = true;
@@ -34,7 +34,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  cargoRoot = "src-tauri";
  buildAndTestSubdir = finalAttrs.cargoRoot;

-  cargoHash = "sha256-7UMmX8dPAYtWM8dG150RKCTdpUpVqlUaEiqio7K7ZIg=";
+  cargoHash = "sha256-Rqjjsw+Pk2H2zoyIOuDlkBhkl8DJOgri5Ko95wcaoIM=";

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
--- a/pkgs/by-name/ta/tart/package.nix
+++ b/pkgs/by-name/ta/tart/package.nix
@@ -10,15 +10,15 @@
  enableSoftnet ? false,
  softnet,
  nix-update-script,
-  versionCheckHook,
+  testers,
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "tart";
-  version = "2.30.6";
+  version = "2.36.0";

  src = fetchurl {
-    url = "https://github.com/cirruslabs/tart/releases/download/${finalAttrs.version}/tart.tar.gz";
-    hash = "sha256-wepqDaJp1oRjGqEVrXUM/JO5gfAKc12AUkZUbfwwdx0=";
+    url = "https://github.com/openai/tart/releases/download/${finalAttrs.version}/tart.tar.gz";
+    hash = "sha256-xyqKuNeKZJih5CaIsaHsbFEs5GyjWjo74TDD3hRAx+g=";
  };
  sourceRoot = ".";

@@ -39,16 +39,16 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    runHook postInstall
  '';

-  nativeInstallCheckInputs = [
-    versionCheckHook
-  ];
-  doInstallCheck = true;
  passthru.updateScript = nix-update-script { };
+  passthru.tests.version = testers.testVersion {
+    inherit (finalAttrs) version;
+    package = finalAttrs.finalPackage;
+  };

  meta = {
    description = "macOS and Linux VMs on Apple Silicon to use in CI and other automations";
    homepage = "https://tart.run";
-    license = lib.licenses.fairsource09;
+    license = lib.licenses.fsl11Asl20;
    maintainers = with lib.maintainers; [
      emilytrau
      aduh95
--- a/pkgs/by-name/to/tomat/package.nix
+++ b/pkgs/by-name/to/tomat/package.nix
@@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "tomat";
-  version = "2.11.0";
+  version = "2.12.0";

  src = fetchFromGitHub {
    owner = "jolars";
    repo = "tomat";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-bHmVwtpDQCO8NS1dsilSsDBlMWotEZ3x1J/KD40vbVs=";
+    hash = "sha256-UJcUvTaFaR0I12T1MtMlXM/lFNEps8eOfaqR66OeNBI=";
  };

-  cargoHash = "sha256-wxVWYOMYVi8R1YpBp+KPirqubAPYA561R+maG1vgrl0=";
+  cargoHash = "sha256-b6b5fIjortiVhCgzU3Qn1w3ccsTZsuuyY6Me+ZuuUHk=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -17,7 +17,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ty";
-  version = "0.0.74";
+  version = "0.0.75";
  __structuredAttrs = true;

  src = fetchFromGitHub {
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    repo = "ty";
    tag = finalAttrs.version;
    fetchSubmodules = true;
-    hash = "sha256-6obXsyfHHgPPON7rZj2cYtMdg20sv33LR05gey/w56A=";
+    hash = "sha256-hzEgbimysGMH+bQoKmTOWZl8DgaW/G1QUkI5T18UMp4=";
  };

  # For Darwin platforms, remove the integration test for file notifications,
@@ -39,7 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: {

  cargoBuildFlags = [ "--package=ty" ];

-  cargoHash = "sha256-kwnSLBK4H/RPUY+Nb08quRe3q9Ke5Sgmdf588b2QfUs=";
+  cargoHash = "sha256-TSvfiHsXyn1MLUwfi+9ZxWH5AqKhkPPU297lL5nL7fI=";

  nativeBuildInputs = [ installShellFiles ];
  buildInputs = [ rust-jemalloc-sys ];
--- a/pkgs/by-name/un/unifont/package.nix
+++ b/pkgs/by-name/un/unifont/package.nix
@@ -1,6 +1,8 @@
 {
  lib,
  stdenv,
+  bashNonInteractive,
+  buildPackages,
  fetchurl,
  perl,
  bdftopcf,
@@ -25,6 +27,14 @@ stdenv.mkDerivation (finalAttrs: {
  postPatch = ''
    rm -r font/precompiled
    patchShebangs ./src
+    ${lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+      substituteInPlace Makefile --replace-fail \
+        'bin/unigenwidth ' \
+        '$(BINDIR)/unigenwidth '
+      substituteInPlace font/Makefile --replace-fail \
+        '"BINDIR:../../../$(BINDIR)/"' \
+        '"BINDIR:$(BINDIR)/"'
+    ''}
  '';

  nativeBuildInputs = [
@@ -35,10 +45,16 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  buildInputs = [
+    bashNonInteractive
    perlenv
  ];

-  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+  ]
+  ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    "BINDIR=${buildPackages.unifont.bin}/bin"
+  ];

  buildFlags = [ "BUILDFONT=1" ];

@@ -64,6 +80,10 @@ stdenv.mkDerivation (finalAttrs: {
      "$out"/share/fonts/opentype/unifont/*_sample.*
  '';

+  postFixup = ''
+    patchShebangs --host --update "$bin"
+  '';
+
  outputs = [
    "out"
    "bin"
--- a/pkgs/by-name/vi/vintagestory/package.nix
+++ b/pkgs/by-name/vi/vintagestory/package.nix
@@ -27,11 +27,11 @@ assert waylandSupport -> libxkbcommon != null;

 stdenv.mkDerivation (finalAttrs: {
  pname = "vintagestory";
-  version = "1.22.6";
+  version = "1.22.7";

  src = fetchurl {
    url = "https://cdn.vintagestory.at/gamefiles/stable/vs_client_linux-x64_${finalAttrs.version}.tar.gz";
-    hash = "sha256-xJPyaYklEq2BeUX9+7hNPI6WC6ibcQDS+sKeqKYSh3A=";
+    hash = "sha256-SDzGgnpQwIxcQczQJixvEiPBBOVMpxNcRmBSeNifXeE=";
  };

  __structuredAttrs = true;
--- a/pkgs/by-name/wi/wivrn/package.nix
+++ b/pkgs/by-name/wi/wivrn/package.nix
@@ -177,6 +177,7 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  dontWrapQtApps = true;
+  separateDebugInfo = true;

  preFixup = lib.optionalString (!clientLibOnly) ''
    wrapProgram "$out/bin/wivrn-server" \
--- a/pkgs/by-name/yo/yopass/package.nix
+++ b/pkgs/by-name/yo/yopass/package.nix
@@ -0,0 +1,57 @@
+{
+  buildGoModule,
+  callPackage,
+  fetchFromGitHub,
+  makeBinaryWrapper,
+  lib,
+}:
+let
+  version = "14.9.0";
+  src = fetchFromGitHub {
+    owner = "jhaals";
+    repo = "yopass";
+    tag = version;
+    hash = "sha256-YZeSGcQcAsOmIwhhVpGN7bxlNGsWIJNAwUBxJM/7314=";
+  };
+
+  website = callPackage ./website.nix { inherit src version; };
+in
+buildGoModule (finalAttrs: {
+  inherit version src;
+  pname = "yopass";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  vendorHash = "sha256-mR17QPGZNJ9Vx6y6mExvZDKReVxdUif8aQ6VMfKVgcM=";
+
+  nativeBuildInputs = [ makeBinaryWrapper ];
+
+  subPackages = [
+    "cmd/yopass"
+    "cmd/yopass-server"
+  ];
+
+  checkFlags = [
+    # Disable tests that require network access
+    "-skip=TestSecretNotFoundError"
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/yopass-server \
+      --add-flags "--asset-path ${website}"
+  '';
+
+  meta = {
+    description = "Secure sharing of secrets, passwords and files";
+    homepage = "https://github.com/jhaals/yopass";
+    changelog = "https://github.com/jhaals/yopass/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      ivarmedi
+      fraggerfox
+    ];
+    mainProgram = "yopass";
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/by-name/yo/yopass/website.nix
+++ b/pkgs/by-name/yo/yopass/website.nix
@@ -0,0 +1,35 @@
+{
+  fetchYarnDeps,
+  nodejs-slim,
+  src,
+  stdenv,
+  version,
+  yarnBuildHook,
+  yarnConfigHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "yopass-website";
+  inherit version;
+
+  src = src + "/website";
+
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = "${finalAttrs.src}/yarn.lock";
+    hash = "sha256-x3ouozoDreaeeqoh8osXOqEYphy6vTalLMjQt5vowkg=";
+  };
+
+  nativeBuildInputs = [
+    yarnConfigHook
+    yarnBuildHook
+    nodejs-slim
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mv dist $out
+
+    runHook postInstall
+  '';
+})
--- a/pkgs/by-name/yt/ytdownloader/package.nix
+++ b/pkgs/by-name/yt/ytdownloader/package.nix
@@ -7,23 +7,23 @@
  ffmpeg-headless,
  yt-dlp,
  makeDesktopItem,
-  electron_41,
+  electron_43,
 }:
 let
-  electron = electron_41;
+  electron = electron_43;
 in
 buildNpmPackage rec {
  pname = "ytDownloader";
-  version = "3.22.0";
+  version = "4.0.1";

  src = fetchFromGitHub {
    owner = "aandrew-me";
    repo = "ytDownloader";
    tag = "v${version}";
-    hash = "sha256-zAHDBLQJa0FFX2esz7jVRnIY6aBwnoGp6Kr2jWDX+lg=";
+    hash = "sha256-chTaQ0nHTtdIhMo4GBSoQ6YbqDy8HNj190JNUt5nDiE=";
  };

-  npmDepsHash = "sha256-J/3m6HN2/gndtTrxf4rwhZtBAQUv1oQYbo8HeNLV8Xw=";
+  npmDepsHash = "sha256-Czs09QnQ7lnNjgysvSb7TFKz6t8ChvoT+1KzHFJ87SA=";
  makeCacheWritable = true;

  nativeBuildInputs = [
--- a/pkgs/development/ocaml-modules/mirage-crypto/default.nix
+++ b/pkgs/development/ocaml-modules/mirage-crypto/default.nix
@@ -12,11 +12,11 @@ buildDunePackage (finalAttrs: {
  minimalOCamlVersion = "4.13";

  pname = "mirage-crypto";
-  version = "2.3.0";
+  version = "2.4.1";

  src = fetchurl {
    url = "https://github.com/mirage/mirage-crypto/releases/download/v${finalAttrs.version}/mirage-crypto-${finalAttrs.version}.tbz";
-    hash = "sha256-hA+/QTZgW0ofHdXAYRkyonT+O/l0ZMgqazqXMaaOII4=";
+    hash = "sha256-MyiGw2XGA1B3485namPaj3UAwVoWKLPAfhObDlUfH28=";
  };

  doCheck = true;
--- a/pkgs/development/python-modules/prefect/default.nix
+++ b/pkgs/development/python-modules/prefect/default.nix
@@ -92,7 +92,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "prefect";
-  version = "3.8.3";
+  version = "3.8.4";
  pyproject = true;

  # keeps list elements containing spaces intact, which disabledTests below needs
@@ -102,7 +102,7 @@ buildPythonPackage (finalAttrs: {
    owner = "PrefectHQ";
    repo = "prefect";
    tag = finalAttrs.version;
-    hash = "sha256-C20gFzsswVOVfJiz2UcDamUSSMbvm+KVIM115ZAzEyM=";
+    hash = "sha256-o5mYaGuYDBixac99T68niXKoDOENHGfExGhs3vDEONc=";
  };

  postPatch = ''
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -5,43 +5,43 @@
        "lts": false
    },
    "6.1": {
-        "version": "6.1.184",
-        "hash": "sha256:1facdyxlvcmfkiman0jzq6nvjs81h51arzmyl1pqam30bc47c2cn",
+        "version": "6.1.185",
+        "hash": "sha256:0x1639znr91szyahgj2ni7ymcm46dmm41ispfx4jdikx2fhxjr1q",
        "lts": true
    },
    "5.15": {
-        "version": "5.15.217",
-        "hash": "sha256:1rd5ffv9j3d5g2iygapjgkmqpsqfq69xyig3jifmmr5x9wsgs873",
+        "version": "5.15.218",
+        "hash": "sha256:0dpjimmxs648j9gri7h3flfimb1647a8629pgsvyxsgk6k8ip063",
        "lts": true
    },
    "5.10": {
-        "version": "5.10.266",
-        "hash": "sha256:1zisyafmky3s4byxh98gg8q4gw702gkcp2krf1q6z94hjfza63ll",
+        "version": "5.10.267",
+        "hash": "sha256:01migk31fib50zgqf8rqmm71cff8s93msvy20sy8mj22mi80fi2v",
        "lts": true
    },
    "6.6": {
-        "version": "6.6.153",
-        "hash": "sha256:0mwmr68vz1a296gkizwywvrjr8i86wg3crk777p0sli3i437gg1r",
+        "version": "6.6.154",
+        "hash": "sha256:0d02xm0xglyhac9iyf01a01ab0kp0ghkar8qq6gj6l5h7pw01vpd",
        "lts": true
    },
    "6.12": {
-        "version": "6.12.105",
-        "hash": "sha256:0ggni16ill7acfxsmwr96q2zfcia1v19sif32csv2acm24g80dpb",
+        "version": "6.12.106",
+        "hash": "sha256:11fpivj271143v8rdk4jifbpxxrd3saphq9za027d76rc5bmb4h3",
        "lts": true
    },
    "6.18": {
-        "version": "6.18.46",
-        "hash": "sha256:186c850qncfvwqnvmllzkiqj6xfrh6h4nh65d4lwq0lbh29lpm7m",
+        "version": "6.18.47",
+        "hash": "sha256:0678vsivrr3qw2pdg2ch26a2kx365cm1gy3w21rm86k08gyvlgqv",
        "lts": true
    },
    "7.1": {
-        "version": "7.1.10",
-        "hash": "sha256:16crmblk96nwjzpbb22fpcj0r4ky63f1njvliv4vxwq2g9lz9lk7",
+        "version": "7.1.11",
+        "hash": "sha256:1z0s6pv34d5mk75jxj05s6hzy2x6vahc5dxxbkp5pirfiw6m8a9h",
        "lts": false
    },
    "7.2": {
-        "version": "7.2",
-        "hash": "sha256:1cq2jj1g06gav6xvbxfb1l5jlp43b52ffjvg08ckix8d9k8z7zpr",
+        "version": "7.2.1",
+        "hash": "sha256:1csp8m7a5ws9j35x7bc2cb8067illqx5v1cc0sz8zsi8ia60jn21",
        "lts": false
    }
 }
--- a/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
@@ -14,13 +14,13 @@
 buildHomeAssistantComponent rec {
  owner = "luuquangvu";
  domain = "blueprints_updater";
-  version = "2.13.1";
+  version = "2.13.3";

  src = fetchFromGitHub {
    inherit owner;
    repo = "blueprints-updater";
    tag = version;
-    hash = "sha256-80Jq+26l+VKZX2fR5a/08hfpLA8RLCqFmZALK+U4SPQ=";
+    hash = "sha256-JFXxv46hUYPxdNjIgEn8pI3yV7z1CopIp9KfdDxkHU8=";
  };

  patches = [
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/weather-radar-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/weather-radar-card/package.nix
@@ -7,13 +7,13 @@

 buildNpmPackage (finalAttrs: {
  pname = "weather-radar-card";
-  version = "3.7.2";
+  version = "3.7.3";

  src = fetchFromGitHub {
    owner = "jpettitt";
    repo = "weather-radar-card";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-4c7XMHfLx5tE6NFHfKn6s9pOktVJcaSulhz7s1FXgcQ=";
+    hash = "sha256-94fag6+i+9otVQRAllZA0dSyC0MGhv0Q6brEavWMs8k=";
  };

  postPatch = ''
@@ -23,7 +23,7 @@ buildNpmPackage (finalAttrs: {

  npmDepsFetcherVersion = 2;
  npmFlags = [ "--legacy-peer-deps" ];
-  npmDepsHash = "sha256-1ln1V9UzyN9KyaYkUfCJbeItSIcV3/Mqzc90CoNM3W4=";
+  npmDepsHash = "sha256-pYvnYYgmm4+2fOO/pLR+OtlKfBKf2Xws6Oz8mEOSNPM=";

  installPhase = ''
    runHook preInstall