From c4328f7cca17d687d3b6511fc690b4e4623d5a6a Mon Sep 17 00:00:00 2001
From: alper-han <89567766+alper-han@users.noreply.github.com>
Date: Wed, 8 Jul 2026 01:32:49 +0300
Subject: [PATCH 01/85] crossmacro: 1.2.1 -> 1.3.1

- Migrate to Native AOT (dotnet-runtime = null, selfContainedBuild = true) to align with upstream architecture.
- Add pipewire to runtimeDeps to support the Wayland screen reading backend.
- Align wrapper and ELF executable paths in postFixup to bypass KDE KWin's strict /proc/<pid>/exe authorization checks for input and screen capture.
---
 pkgs/by-name/cr/crossmacro/package.nix | 52 ++++++++++++++++++++++----
 1 file changed, 45 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/cr/crossmacro/package.nix b/pkgs/by-name/cr/crossmacro/package.nix
index bf9deb781197..efaadbb500d8 100644
--- a/pkgs/by-name/cr/crossmacro/package.nix
+++ b/pkgs/by-name/cr/crossmacro/package.nix
@@ -4,6 +4,8 @@
   dotnetCorePackages,
   fetchFromGitHub,
   installShellFiles,
+  clang,
+  autoPatchelfHook,
   nix-update-script,
   fontconfig,
   freetype,
@@ -23,33 +25,43 @@
   icu,
   openssl,
   zlib,
+  pipewire,
 }:
 
 buildDotnetModule rec {
   pname = "crossmacro";
-  version = "1.2.1";
+  version = "1.3.1";
 
   src = fetchFromGitHub {
     owner = "alper-han";
     repo = "CrossMacro";
     tag = "v${version}";
-    hash = "sha256-lMXp7ItwpZ14ATRKuR7Q8/FhfMNQ+YCgHL13oj6iBNs=";
+    hash = "sha256-2L25A2OO2Ju6n1QlblNBtKva1PfbidFz/QESjLBVuSU=";
   };
 
   projectFile = "src/CrossMacro.UI.Linux/CrossMacro.UI.Linux.csproj";
   nugetDeps = ./deps.json;
 
   dotnet-sdk = dotnetCorePackages.sdk_10_0;
-  dotnet-runtime = dotnetCorePackages.runtime_10_0;
+  dotnet-runtime = null;
 
   executables = [ "CrossMacro.UI" ];
   buildType = "Release";
+  selfContainedBuild = true;
 
   dotnetFlags = [
-    "-p:SelfContained=false"
+    "-p:PublishAot=true"
+    "-p:PublishReadyToRun=false"
+    "-p:OptimizationPreference=Speed"
+    "-p:StripSymbols=true"
+    "-p:IlcTrimMetadata=true"
+    "-p:DebugType=None"
+    "-p:DebugSymbols=false"
     "-p:Version=${version}"
   ];
 
+  buildInputs = runtimeDeps;
+
   runtimeDeps = [
     zlib
     icu
@@ -69,14 +81,21 @@ buildDotnetModule rec {
     libglvnd
     wayland
     libxkbcommon
+    pipewire
   ];
 
-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [
+    installShellFiles
+    clang
+    autoPatchelfHook
+  ];
 
   postInstall = ''
     installManPage docs/man/crossmacro.1
 
     install -Dm644 scripts/assets/CrossMacro.desktop $out/share/applications/crossmacro.desktop
+    substituteInPlace $out/share/applications/crossmacro.desktop \
+      --replace-fail "Exec=crossmacro" "Exec=$out/lib/crossmacro/CrossMacro.UI"
 
     for size in 16 32 48 64 128 256 512; do
       install -Dm644 src/CrossMacro.UI/Assets/icons/''${size}x''${size}/apps/crossmacro.png \
@@ -85,9 +104,28 @@ buildDotnetModule rec {
 
     install -Dm644 scripts/assets/io.github.alper-han.CrossMacro.metainfo.xml \
       $out/share/metainfo/io.github.alper-han.CrossMacro.metainfo.xml
+  '';
 
-    mkdir -p $out/bin
-    ln -sf $out/bin/CrossMacro.UI $out/bin/crossmacro
+  postFixup = ''
+    # Align wrapper and ELF paths so KWin's strict /proc/<pid>/exe check grants Wayland permissions.
+    # Move the real ELF binary to .CrossMacro.UI-wrapped
+    mv $out/lib/crossmacro/CrossMacro.UI \
+       $out/lib/crossmacro/.CrossMacro.UI-wrapped
+
+    # Move the buildDotnetModule wrapper from bin/ into lib/ so
+    # its path matches what KWin resolves after unwrapping.
+    mv $out/bin/CrossMacro.UI $out/lib/crossmacro/CrossMacro.UI
+
+    # Update the wrapper's exec target to the renamed binary
+    substituteInPlace $out/lib/crossmacro/CrossMacro.UI \
+      --replace-fail \
+        "\"$out/lib/crossmacro/CrossMacro.UI\"" \
+        "\"$out/lib/crossmacro/.CrossMacro.UI-wrapped\""
+
+    # Point bin/ entries at the lib/ wrapper
+    rm -f $out/bin/crossmacro
+    ln -s $out/lib/crossmacro/CrossMacro.UI $out/bin/CrossMacro.UI
+    ln -s $out/bin/CrossMacro.UI $out/bin/crossmacro
   '';
 
   passthru.updateScript = nix-update-script { };

From f0b01852060b27ae25a1ae781626396076641ff4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 20 Jul 2026 21:31:27 +0000
Subject: [PATCH 02/85] i2pd: 2.60.0 -> 2.61.0

---
 pkgs/by-name/i2/i2pd/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/i2/i2pd/package.nix b/pkgs/by-name/i2/i2pd/package.nix
index a99f43feac93..b58cfdb949b6 100644
--- a/pkgs/by-name/i2/i2pd/package.nix
+++ b/pkgs/by-name/i2/i2pd/package.nix
@@ -12,13 +12,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "i2pd";
-  version = "2.60.0";
+  version = "2.61.0";
 
   src = fetchFromGitHub {
     owner = "PurpleI2P";
     repo = "i2pd";
     tag = finalAttrs.version;
-    hash = "sha256-oVC31GpygznXbmjQ3qv3XZ58jZ9l6ibBoueuBM5Hk0M=";
+    hash = "sha256-dfCeY64TGRoTMNvKZk5jrhyRc8b8K03KM7YV5w/pbUM=";
   };
 
   postPatch = lib.optionalString (!stdenv.hostPlatform.isx86) ''

From 66fb8c837e4269ad8299d867468d830ae6cc99e0 Mon Sep 17 00:00:00 2001
From: Naxdy <naxdy@naxdy.org>
Date: Thu, 6 Aug 2026 16:44:07 +0200
Subject: [PATCH 03/85] linphonePackages.linphone-sdk: 5.4.85 -> 5.5.13

---
 .../networking/instant-messengers/linphone/default.nix        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/linphone/default.nix b/pkgs/applications/networking/instant-messengers/linphone/default.nix
index 814437cdac2a..96d1cc091726 100644
--- a/pkgs/applications/networking/instant-messengers/linphone/default.nix
+++ b/pkgs/applications/networking/instant-messengers/linphone/default.nix
@@ -8,8 +8,8 @@ makeScopeWithSplicing' {
   extra = self: {
     mkLinphoneDerivation = self.mk-linphone-derivation;
 
-    linphoneSdkVersion = "5.4.85";
-    linphoneSdkHash = "sha256-mdJDCuCaZlcQ92P6oMgH/8iWgm8hGz8gTVUilC+yaSU=";
+    linphoneSdkVersion = "5.5.13";
+    linphoneSdkHash = "sha256-RsSMLO7wZ7azWF7/KcERkd5et73w0kUZpwsqj9QxZgc=";
   };
   f =
     self:

From 9d84278364f097eb170070e5a5fca98cccfaa287 Mon Sep 17 00:00:00 2001
From: Sapphire <imsapphire0@gmail.com>
Date: Sun, 9 Aug 2026 03:02:05 -0500
Subject: [PATCH 04/85] wivrn: enable building debug information

---
 pkgs/by-name/wi/wivrn/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/wi/wivrn/package.nix b/pkgs/by-name/wi/wivrn/package.nix
index 6f6171c1834b..afe0bd5fb98d 100644
--- a/pkgs/by-name/wi/wivrn/package.nix
+++ b/pkgs/by-name/wi/wivrn/package.nix
@@ -177,6 +177,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   dontWrapQtApps = true;
+  separateDebugInfo = true;
 
   preFixup = lib.optional (!clientLibOnly) ''
     wrapProgram "$out/bin/wivrn-server" \

From 13a8f1e55a334a01a6a3d09eeb045d625f1b5059 Mon Sep 17 00:00:00 2001
From: Sapphire <imsapphire0@gmail.com>
Date: Sun, 9 Aug 2026 19:52:57 -0500
Subject: [PATCH 05/85] nixos/wivrn: remove unnecessary default service
 environment variables

XRT_COMPOSITOR_LOG=debug is particularly annoying, since it causes
a lot of log spam every frame.
---
 nixos/modules/services/video/wivrn.nix | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/nixos/modules/services/video/wivrn.nix b/nixos/modules/services/video/wivrn.nix
index 82e356d419d4..a47829280346 100644
--- a/nixos/modules/services/video/wivrn.nix
+++ b/nixos/modules/services/video/wivrn.nix
@@ -189,11 +189,6 @@ in
         wivrn = {
           description = "WiVRn XR runtime service";
           environment = recursiveUpdate {
-            # Default options
-            # https://gitlab.freedesktop.org/monado/monado/-/blob/598080453545c6bf313829e5780ffb7dde9b79dc/src/xrt/targets/service/monado.in.service#L12
-            XRT_COMPOSITOR_LOG = "debug";
-            XRT_PRINT_OPTIONS = "on";
-            IPC_EXIT_ON_DISCONNECT = "off";
             PRESSURE_VESSEL_IMPORT_OPENXR_1_RUNTIMES = mkIf cfg.steam.importOXRRuntimes "1";
           } cfg.monadoEnvironment;
           # WiVRn scans for .desktop files in $XDG_DATA_DIRS for the application launcher,

From e36b5c4e08699da405b2c321dd7776f8f7803daf Mon Sep 17 00:00:00 2001
From: Naxdy <naxdy@naxdy.org>
Date: Thu, 6 Aug 2026 16:44:16 +0200
Subject: [PATCH 06/85] linphonePackages.linphone-desktop: 6.1.0 -> 6.2.0

---
 .../linphone/linphone-desktop/default.nix     | 18 ++++++---
 .../use-absolute-resource-paths.patch         | 38 +++++++++++++++++++
 2 files changed, 50 insertions(+), 6 deletions(-)
 create mode 100644 pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/use-absolute-resource-paths.patch

diff --git a/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/default.nix b/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/default.nix
index 5f3d4de66b5a..6637736c3441 100644
--- a/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/default.nix
@@ -3,6 +3,7 @@
   bc-soci,
   bctoolbox,
   belcard,
+  cacert,
   belle-sip,
   belr,
   boost,
@@ -40,7 +41,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "linphone-desktop";
-  version = "6.1.0";
+  version = "6.2.0";
 
   src = fetchFromGitLab {
     domain = "gitlab.linphone.org";
@@ -48,13 +49,14 @@ stdenv.mkDerivation (finalAttrs: {
     group = "BC";
     repo = "linphone-desktop";
     tag = finalAttrs.version;
-    hash = "sha256-jCnovCFdPJExD0+ZLhU9np1R5uN+mPlSPi/Nb1aOD0U=";
+    hash = "sha256-JtNYeMu174afzuWSVIuLyI5M16iC5XGr2qTcTsixRg8=";
   };
 
   patches = [
     ./do-not-override-install-prefix.patch
     ./do-not-manually-compute-sdk-version.patch
     ./always-install-desktop-files.patch
+    ./use-absolute-resource-paths.patch
 
     # .mkv recordings are broken in NixOS and other distros (see
     # https://github.com/NixOS/nixpkgs/issues/219551), and simply changing the
@@ -79,8 +81,10 @@ stdenv.mkDerivation (finalAttrs: {
     minizip-ng
     qt6Packages.qtbase
     qt6Packages.qtnetworkauth
+    qt6Packages.qtkeychain
     zxing-cpp
     boost
+    cacert
 
     python3Packages.pystache
     python3Packages.six
@@ -103,9 +107,6 @@ stdenv.mkDerivation (finalAttrs: {
     # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
     "-DCMAKE_SKIP_BUILD_RPATH=ON"
 
-    # Requires EQt5Keychain
-    "-DENABLE_QT_KEYCHAIN=OFF"
-
     "-DCMAKE_INSTALL_BINDIR=bin"
     "-DCMAKE_INSTALL_INCLUDEDIR=include"
     "-DCMAKE_INSTALL_LIBDIR=lib"
@@ -114,7 +115,6 @@ stdenv.mkDerivation (finalAttrs: {
     "-DLINPHONEAPP_INSTALL_PREFIX=${placeholder "out"}"
     "-DLINPHONE_QML_DIR=${placeholder "out"}/${qt6Packages.qtbase.qtQmlPrefix}/ui"
     "-DLINPHONESDK_VERSION=${linphoneSdkVersion}"
-    "-DENABLE_APP_PACKAGE_ROOTCA=OFF"
 
     # normally set by the custom find modules, which we have disabled
     "-DLibLinphone_TARGET=liblinphone"
@@ -155,6 +155,12 @@ stdenv.mkDerivation (finalAttrs: {
     ln -s ${mediastreamer2}/lib/mediastreamer/plugins/* $out/lib/mediastreamer/plugins/
     ln -s ${grammars} $out/share/belr/grammars
 
+    # linphone looks for the TLS root CA bundle at `<dataResourcesDir>/rootca.pem`
+    # (with `<dataResourcesDir>` made absolute by `use-absolute-resource-paths.patch`).
+    # Provide nixpkgs' cacert bundle there instead of shipping the stale one
+    # bundled with linphone-sdk.
+    ln -s ${cacert}/etc/ssl/certs/ca-bundle.crt $out/share/linphone/rootca.pem
+
     mkdir -p $out/share/sounds/linphone/
     ln -s ${liblinphone}/share/sounds/linphone/rings $out/share/sounds/linphone/rings
 
diff --git a/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/use-absolute-resource-paths.patch b/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/use-absolute-resource-paths.patch
new file mode 100644
index 000000000000..2a617fbb6028
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/use-absolute-resource-paths.patch
@@ -0,0 +1,38 @@
+diff --git a/Linphone/core/path/Paths.cpp b/Linphone/core/path/Paths.cpp
+index 33449dc..734ba51 100644
+--- a/Linphone/core/path/Paths.cpp
++++ b/Linphone/core/path/Paths.cpp
+@@ -115,7 +115,6 @@ static inline QDir getAppPackageDir() {
+ }
+ 
+ static inline QString getAppPackageDataDirPath() {
+-	QDir executableDir(QCoreApplication::applicationDirPath());
+ 	QDir dir = getAppPackageDir();
+ #ifdef __APPLE__
+ 	if (!dir.cd("Resources")) {
+@@ -127,22 +126,17 @@ static inline QString getAppPackageDataDirPath() {
+ 		dir.mkdir("share");
+ 		dir.cd("share");
+ 	}
+-	lInfo() << executableDir.absolutePath() << " VS " << dir.absolutePath()
+-	        << " == " << executableDir.relativeFilePath(dir.absolutePath());
+-	return executableDir.relativeFilePath(dir.absolutePath());
++	return dir.absolutePath();
+ }
+ 
+ static inline QString getAppPackageMsPluginsDirPath() {
+-	QDir executableDir(QCoreApplication::applicationDirPath());
+ 	QDir dir = getAppPackageDir();
+ 	dir.cd(MSPLUGINS_DIR);
+-	return executableDir.relativeFilePath(dir.absolutePath());
++	return dir.absolutePath();
+ }
+ 
+ static inline QString getAppPackagePluginsDirPath() {
+-	QDir executableDir(QCoreApplication::applicationDirPath());
+-	QDir packageDir = getAppPackageDir();
+-	return executableDir.relativeFilePath(packageDir.absolutePath() + Constants::PathPlugins);
++	return getAppPackageDir().absolutePath() + Constants::PathPlugins;
+ }
+ 
+ static inline QString getAppBinDirPath() {

From 1c73436b36ada692ce5e20170822f90354e85c5c Mon Sep 17 00:00:00 2001
From: Naxdy <naxdy@naxdy.org>
Date: Thu, 6 Aug 2026 17:13:46 +0200
Subject: [PATCH 07/85] linphonePackages.bc-zxing-cpp: init at
 1.4.0-unstable-2026-08-08

Assisted-by: oh-my-pi / DeepSeek V4 Flash 0731
---
 .../linphone/bc-zxing-cpp/default.nix         | 55 +++++++++++++++++++
 1 file changed, 55 insertions(+)
 create mode 100644 pkgs/applications/networking/instant-messengers/linphone/bc-zxing-cpp/default.nix

diff --git a/pkgs/applications/networking/instant-messengers/linphone/bc-zxing-cpp/default.nix b/pkgs/applications/networking/instant-messengers/linphone/bc-zxing-cpp/default.nix
new file mode 100644
index 000000000000..b68d3ac8fa08
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/linphone/bc-zxing-cpp/default.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  cmake,
+  fetchFromGitLab,
+  stdenv,
+  libzint,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "zxing-cpp";
+  # Version taken from CMakeLists.txt - likely not actively updated
+  version = "1.4.0-unstable-2026-08-08";
+
+  src = fetchFromGitLab {
+    domain = "gitlab.linphone.org";
+    group = "BC";
+    owner = "public/external";
+    repo = "zxing-cpp";
+    rev = "722123ad0cadee0e4c313f80eac5162a9f8d7d73";
+    sha256 = "sha256-GhrrIk2Kph6H5qs0g01b98F1Xzh/6vCS3+p+q0mhqcQ=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  buildInputs = [
+    libzint
+  ];
+
+  cmakeFlags = [
+    "-DZXING_BLACKBOX_TESTS=OFF"
+    "-DZXING_DEPENDENCIES=LOCAL"
+    "-DZXING_EXAMPLES=OFF"
+    "-DZXING_USE_BUNDLED_ZINT=OFF"
+  ];
+
+  # The BC fork's zxing.pc.in joins @CMAKE_INSTALL_LIBDIR@/INCLUDEDIR@ onto a
+  # hardcoded "/" prefix, and never includes GNUInstallDirs, causing us to run into
+  # https://github.com/NixOS/nixpkgs/issues/144170
+  postPatch = ''
+    substituteInPlace CMakeLists.txt \
+      --replace-fail '# PC file generation.' 'include (GNUInstallDirs)'
+    substituteInPlace zxing.pc.in \
+      --replace-fail 'libdir=''${exec_prefix}/@CMAKE_INSTALL_LIBDIR@' 'libdir=@CMAKE_INSTALL_FULL_LIBDIR@' \
+      --replace-fail 'includedir=''${prefix}/@CMAKE_INSTALL_INCLUDEDIR@' 'includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@'
+  '';
+
+  meta = {
+    homepage = "https://gitlab.linphone.org/BC/public/external/zxing-cpp";
+    description = "BelledonneCommunications' fork of zxing-cpp";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ naxdy ];
+    platforms = lib.platforms.unix;
+  };
+})

From b1a9df5125ab5083e73feb43e58bd5db2b540cb8 Mon Sep 17 00:00:00 2001
From: Naxdy <naxdy@naxdy.org>
Date: Thu, 6 Aug 2026 17:14:18 +0200
Subject: [PATCH 08/85] linphonePackages.liblinphone: use BC's fork of
 zxing-cpp

---
 .../instant-messengers/linphone/liblinphone/default.nix       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/instant-messengers/linphone/liblinphone/default.nix b/pkgs/applications/networking/instant-messengers/linphone/liblinphone/default.nix
index 41c7c5239a35..0a3c4b5a33a4 100644
--- a/pkgs/applications/networking/instant-messengers/linphone/liblinphone/default.nix
+++ b/pkgs/applications/networking/instant-messengers/linphone/liblinphone/default.nix
@@ -11,7 +11,7 @@
   python3,
   sqlite,
   xercesc,
-  zxing-cpp,
+  bc-zxing-cpp,
   mkLinphoneDerivation,
 }:
 mkLinphoneDerivation {
@@ -39,7 +39,7 @@ mkLinphoneDerivation {
     libxml2
     sqlite
     xercesc
-    zxing-cpp
+    bc-zxing-cpp
   ];
 
   propagatedBuildInputs = [

From e0eae1eb29b12f71bf9a00bbe70f06f28fbc7a0d Mon Sep 17 00:00:00 2001
From: Naxdy <naxdy@naxdy.org>
Date: Mon, 10 Aug 2026 20:21:02 +0200
Subject: [PATCH 09/85] linphonePackages.linphone-desktop: don't create a
 `.desktop` file under `~/.local/share/applications`

---
 .../linphone/linphone-desktop/default.nix     |  3 +++
 .../no-user-desktop-file.patch                | 19 +++++++++++++++++++
 2 files changed, 22 insertions(+)
 create mode 100644 pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/no-user-desktop-file.patch

diff --git a/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/default.nix b/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/default.nix
index 6637736c3441..3099c238c81c 100644
--- a/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/default.nix
+++ b/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/default.nix
@@ -57,6 +57,9 @@ stdenv.mkDerivation (finalAttrs: {
     ./do-not-manually-compute-sdk-version.patch
     ./always-install-desktop-files.patch
     ./use-absolute-resource-paths.patch
+    # Linphone creates a broken desktop file.
+    # See: https://github.com/NixOS/nixpkgs/issues/551204
+    ./no-user-desktop-file.patch
 
     # .mkv recordings are broken in NixOS and other distros (see
     # https://github.com/NixOS/nixpkgs/issues/219551), and simply changing the
diff --git a/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/no-user-desktop-file.patch b/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/no-user-desktop-file.patch
new file mode 100644
index 000000000000..5971a5e306c9
--- /dev/null
+++ b/pkgs/applications/networking/instant-messengers/linphone/linphone-desktop/no-user-desktop-file.patch
@@ -0,0 +1,19 @@
+diff --git a/Linphone/core/App.cpp b/Linphone/core/App.cpp
+index 315632d..78eba8b 100644
+--- a/Linphone/core/App.cpp
++++ b/Linphone/core/App.cpp
+@@ -1567,14 +1567,7 @@ QString App::getApplicationPath() const {
+ }
+ 
+ void App::exportDesktopFile() {
+-	QDir dir(ApplicationsDirectory);
+-	if (!dir.exists() && !dir.mkpath(ApplicationsDirectory)) {
+-		qWarning() << QStringLiteral("Unable to build applications dir path: `%1`.").arg(ApplicationsDirectory);
+-		return;
+-	}
+-
+ 	const QString confPath(ApplicationsDirectory + EXECUTABLE_NAME ".desktop");
+-	if (generateDesktopFile(confPath, true, false)) generateDesktopFile(confPath, false, false);
+ }
+ 
+ bool App::generateDesktopFile(const QString &confPath, bool remove, bool openInBackground) {

From 254d04d4bc8095e8aa8933d9d2b3cb7f06bcac89 Mon Sep 17 00:00:00 2001
From: Colin <colin@uninsane.org>
Date: Fri, 14 Aug 2026 07:23:51 +0000
Subject: [PATCH 10/85] unifont: fix cross compilation

fixes `nix-build -A pkgsCross.aarch64-multiplatform.unifont`.

unifont uses binaries produced early in the build to perform the later
build steps. that would mean invoking binaries built for the wrong
architecture when cross-compiling, but they provide a `BINDIR=...`
Makefile option for us to provide the build-time binaries in this case.
---
 pkgs/by-name/un/unifont/package.nix | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/un/unifont/package.nix b/pkgs/by-name/un/unifont/package.nix
index 04323ca1cb29..f008da06a492 100644
--- a/pkgs/by-name/un/unifont/package.nix
+++ b/pkgs/by-name/un/unifont/package.nix
@@ -1,6 +1,8 @@
 {
   lib,
   stdenv,
+  bashNonInteractive,
+  buildPackages,
   fetchurl,
   perl,
   bdftopcf,
@@ -25,6 +27,14 @@ stdenv.mkDerivation (finalAttrs: {
   postPatch = ''
     rm -r font/precompiled
     patchShebangs ./src
+    ${lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+      substituteInPlace Makefile --replace-fail \
+        'bin/unigenwidth ' \
+        '$(BINDIR)/unigenwidth '
+      substituteInPlace font/Makefile --replace-fail \
+        '"BINDIR:../../../$(BINDIR)/"' \
+        '"BINDIR:$(BINDIR)/"'
+    ''}
   '';
 
   nativeBuildInputs = [
@@ -35,10 +45,16 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
+    bashNonInteractive
     perlenv
   ];
 
-  makeFlags = [ "PREFIX=${placeholder "out"}" ];
+  makeFlags = [
+    "PREFIX=${placeholder "out"}"
+  ]
+  ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    "BINDIR=${buildPackages.unifont.bin}/bin"
+  ];
 
   buildFlags = [ "BUILDFONT=1" ];
 
@@ -47,6 +63,10 @@ stdenv.mkDerivation (finalAttrs: {
     moveToOutput share/unifont "$doc"
   '';
 
+  postFixup = ''
+    patchShebangs --host --update "$bin"
+  '';
+
   outputs = [
     "out"
     "bin"

From 24f54f91271f30a3a5beb68d0c6d41c19d6224e0 Mon Sep 17 00:00:00 2001
From: linsui <36977733+linsui@users.noreply.github.com>
Date: Fri, 14 Aug 2026 14:05:40 +0800
Subject: [PATCH 11/85] opendht: 3.5.4 -> 4.3.1

---
 pkgs/by-name/op/opendht/package.nix | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/op/opendht/package.nix b/pkgs/by-name/op/opendht/package.nix
index f93feb89d649..e097b9834979 100644
--- a/pkgs/by-name/op/opendht/package.nix
+++ b/pkgs/by-name/op/opendht/package.nix
@@ -14,6 +14,7 @@
   restinio,
   llhttp,
   openssl,
+  simdutf,
   fmt,
   nix-update-script,
   enableProxyServerAndClient ? false,
@@ -22,13 +23,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "opendht";
-  version = "3.5.4";
+  version = "4.3.1";
 
   src = fetchFromGitHub {
     owner = "savoirfairelinux";
     repo = "opendht";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mnnd6yATIk/TEuFG/M98d+pfeh42IKWBBYjkTP52xeM=";
+    hash = "sha256-LquXkbJUBgZfb7cc+Lc1lejO2NxFur83iI0QOuOg5bE=";
   };
 
   nativeBuildInputs = [
@@ -50,6 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
     restinio
     llhttp
     openssl
+    simdutf
   ];
 
   cmakeFlags =

From 2d933e02e27a926d430bb7be5d89064d0e746fde Mon Sep 17 00:00:00 2001
From: linsui <36977733+linsui@users.noreply.github.com>
Date: Fri, 14 Aug 2026 20:02:30 +0800
Subject: [PATCH 12/85] jami: 20251124.0 -> 20260811.0

---
 pkgs/by-name/ja/jami/package.nix | 121 ++++++++++++++-----------------
 1 file changed, 53 insertions(+), 68 deletions(-)

diff --git a/pkgs/by-name/ja/jami/package.nix b/pkgs/by-name/ja/jami/package.nix
index 390117e2f64c..fb89a3267759 100644
--- a/pkgs/by-name/ja/jami/package.nix
+++ b/pkgs/by-name/ja/jami/package.nix
@@ -9,8 +9,6 @@
   ninja,
 
   # for daemon
-  autoreconfHook,
-  perl, # for pod2man
   alsa-lib,
   asio,
   dbus,
@@ -30,6 +28,7 @@
   openssl,
   restinio,
   secp256k1,
+  simdutf,
   speex,
   udev,
   webrtc-audio-processing_0_3,
@@ -64,21 +63,27 @@
 
 stdenv.mkDerivation rec {
   pname = "jami";
-  version = "20251124.0";
+  version = "20260811.0";
 
   src = fetchFromGitLab {
     domain = "git.jami.net";
     owner = "savoirfairelinux";
     repo = "jami-client-qt";
     rev = "stable/${version}";
-    hash = "sha256-IQA6V0Sl+xhuit9kySpsSAS/a0GOsiT+ysYET91/gmc=";
+    hash = "sha256-6MywBm2kT1VJmgHEGKifcrHxG08s53fqfPYSfsFxgFk=";
     fetchSubmodules = true;
   };
 
   patches = [
     (fetchpatch {
-      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/jami-qt/-/raw/0ecbaf3b101bbdd0d4a06b06f3ce1ff654abf0b5/fix-link.patch";
-      hash = "sha256-VsQbOPHyNFcRhpae+9UCaUJdHH8bMGf3ZIAW3RKiu6k=";
+      url = "https://gitlab.archlinux.org/archlinux/packaging/packages/jami-qt/-/raw/20260717.0-2/zxing-cpp-3.patch";
+      hash = "sha256-fTGrsdeC3kN277DvSuKyR5fMZhtBmk1nsL2BbeHYjTY=";
+    })
+    (fetchpatch {
+      # Fix for Qt 6.11
+      url = "https://git.jami.net/savoirfairelinux/jami-client-qt/-/commit/b97eb85af48b36008a9d619077965d6284660031.patch";
+      hash = "sha256-2gY4cqWg5FY6Q6j6V/x3IMWN3AP8RThjZdxYI+ktLI4=";
+      revert = true;
     })
   ];
 
@@ -88,8 +93,8 @@ stdenv.mkDerivation rec {
     src = fetchFromGitHub {
       owner = "savoirfairelinux";
       repo = "pjproject";
-      rev = "93dc96918bb6ba74e1e1d00c40c80402e856f2ac";
-      hash = "sha256-wsbKa3TXqj+nQMtAaEAD0Zh248QdNMhKnIOnq08MPI0=";
+      rev = "3a92a7ee340dbc1f4730fcaf32acac9a54cacf1b";
+      hash = "sha256-luW1lZ+QrOXBVyaWjGCesSnI8tNDBLmAiqUtTjNmRN8=";
     };
 
     configureFlags = [
@@ -127,14 +132,14 @@ stdenv.mkDerivation rec {
 
   dhtnet = stdenv.mkDerivation {
     pname = "dhtnet";
-    version = "unstable-2025-11-10";
+    version = "unstable-2026-08-11";
 
     src = fetchFromGitLab {
       domain = "git.jami.net";
       owner = "savoirfairelinux";
       repo = "dhtnet";
-      rev = "03c6ce608daf906fc98b82f114b61ebfdeae5dc6";
-      hash = "sha256-VTciKJ1IYtQopdV/TpnuB3T2tipcQjjKDlh2cKGDtRQ=";
+      rev = "11f916f2cccba068a48d2fd6ed6f02407d95b7ce";
+      hash = "sha256-Ly3LvKqbvvA6FQTEwJKv1St+RvyaLIPQiY2MvPLvgaw=";
     };
 
     postPatch = ''
@@ -165,7 +170,8 @@ stdenv.mkDerivation rec {
     ];
 
     cmakeFlags = [
-      "-DBUILD_SHARED_LIBS=Off"
+      "-DBUILD_SHARED_LIBS=ON"
+      "-DCMAKE_CXX_STANDARD=20"
       "-DBUILD_BENCHMARKS=Off"
       "-DBUILD_TOOLS=Off"
       "-DBUILD_TESTING=Off"
@@ -181,56 +187,11 @@ stdenv.mkDerivation rec {
     };
   };
 
-  daemon = stdenv.mkDerivation {
-    pname = "jami-daemon";
-    inherit src version meta;
-    sourceRoot = "${src.name}/daemon";
-
-    nativeBuildInputs = [
-      autoreconfHook
-      pkg-config
-      perl
-    ];
-
-    buildInputs = [
-      alsa-lib
-      asio
-      dbus
-      dhtnet
-      sdbus-cpp_2
-      fmt
-      ffmpeg_6
-      gmp
-      gnutls
-      llhttp
-      libjack2
-      jsoncpp
-      libarchive
-      libgit2
-      libnatpmp
-      libpulseaudio
-      libupnp
-      msgpack-cxx
-      opendht-jami
-      openssl
-      pjsip-jami
-      restinio
-      secp256k1
-      speex
-      udev
-      webrtc-audio-processing_0_3
-      yaml-cpp
-      zlib
-    ];
-
-    enableParallelBuilding = true;
-  };
-
   qwindowkit-src = fetchFromGitHub {
-    owner = "stdware";
+    owner = "atraczyk";
     repo = "qwindowkit";
-    rev = "0131d673092ab18afd69fac84f4a17ad2ba615f2";
-    hash = "sha256-jajgLOj0h/byt3+fSbCpV3VPUoHxijUsKw/0BOwbXTw=";
+    rev = "c5c7da2163dfcba144e09a905ee98f920d9d94e7";
+    hash = "sha256-G7vX1zPrs+rKCrXNNZ5Lt7agK3hag13c4s61h53ExPE=";
     fetchSubmodules = true;
   };
 
@@ -239,15 +200,10 @@ stdenv.mkDerivation rec {
     cp -R --no-preserve=mode,ownership ${qwindowkit-src} qwindowkit
     substituteInPlace CMakeLists.txt \
       --replace-fail 'add_subdirectory(3rdparty/zxing-cpp EXCLUDE_FROM_ALL)' 'find_package(ZXing)'
-    sed -i -e '/pkg_check_modules/i FIND_PACKAGE(PkgConfig REQUIRED)' src/libclient/CMakeLists.txt
   '';
 
   preConfigure = ''
     echo 'const char VERSION_STRING[] = "${version}";' > src/app/version.h
-    # Currently the daemon is still built seperately but jami expects it in CMAKE_INSTALL_PREFIX
-    # This can be removed in future versions when JAMICORE_AS_SUBDIR is on
-    mkdir -p $out
-    ln -s ${daemon} $out/daemon
   '';
 
   dontWrapGApps = true;
@@ -264,13 +220,41 @@ stdenv.mkDerivation rec {
   ];
 
   buildInputs = [
+    alsa-lib
+    asio
+    dbus
+    dhtnet
+    fmt
     ffmpeg_6
+    gmp
+    gnutls
     html-tidy
     hunspell
+    jsoncpp
+    llhttp
+    libjack2
+    libarchive
+    libgit2
+    libnatpmp
     libnotify
+    libpulseaudio
+    libupnp
     md4c
+    msgpack-cxx
     networkmanager
+    opendht-jami
+    openssl
+    pjsip-jami
     qrencode
+    restinio
+    sdbus-cpp_2
+    secp256k1
+    simdutf
+    speex
+    udev
+    webrtc-audio-processing_0_3
+    yaml-cpp
+    zlib
     zxing-cpp
   ]
   ++ (
@@ -280,6 +264,7 @@ stdenv.mkDerivation rec {
       qt5compat
       qtnetworkauth
       qtdeclarative
+      qthttpserver
       qtmultimedia
       qtpositioning
       qtsvg
@@ -289,11 +274,11 @@ stdenv.mkDerivation rec {
   );
 
   cmakeFlags = [
-    (lib.cmakeBool "JAMICORE_AS_SUBDIR" false)
     (lib.cmakeBool "DWITH_WEBENGINE" withWebengine)
-    "-DLIBJAMI_INCLUDE_DIRS=${daemon}/include/jami"
   ];
 
+  env.NIX_LDFLAGS = "-lz";
+
   qtWrapperArgs = [
     # With wayland the titlebar is not themed and the wmclass is wrong.
     "--set-default QT_QPA_PLATFORM xcb"
@@ -305,7 +290,7 @@ stdenv.mkDerivation rec {
 
   passthru = {
     updateScript = gitUpdater { rev-prefix = "stable/"; };
-    inherit daemon pjsip dhtnet;
+    inherit pjsip-jami dhtnet;
   };
 
   meta = {

From 3ea3d743cf7def854d9afcdc019647d751148477 Mon Sep 17 00:00:00 2001
From: Mistyttm <contact@mistyttm.dev>
Date: Sat, 15 Aug 2026 19:23:35 +1000
Subject: [PATCH 13/85] jellystat: init at 1.1.11

---
 pkgs/by-name/je/jellystat/package.nix         |  66 ++++++++
 .../je/jellystat/remove-hardcoded-path.patch  | 151 ++++++++++++++++++
 2 files changed, 217 insertions(+)
 create mode 100644 pkgs/by-name/je/jellystat/package.nix
 create mode 100644 pkgs/by-name/je/jellystat/remove-hardcoded-path.patch

diff --git a/pkgs/by-name/je/jellystat/package.nix b/pkgs/by-name/je/jellystat/package.nix
new file mode 100644
index 000000000000..94a5321cd40c
--- /dev/null
+++ b/pkgs/by-name/je/jellystat/package.nix
@@ -0,0 +1,66 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  makeWrapper,
+  nodejs_22,
+}:
+buildNpmPackage (finalAttrs: {
+  pname = "jellystat";
+  version = "1.1.11";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "CyferShepard";
+    repo = "Jellystat";
+    tag = finalAttrs.version;
+    hash = "sha256-HuLSXhj90fPfxv5qyCVCY67w07WwTBGp220iG9dGZyk=";
+  };
+
+  patches = [
+    ./remove-hardcoded-path.patch
+  ];
+
+  npmDepsFetcherVersion = 2;
+
+  npmDepsHash = "sha256-yfcrBLbD11x3Siqv670jw8A3K11DrwnBj0VSC64JBP0=";
+
+  makeCacheWritable = true;
+
+  nodejs = nodejs_22;
+
+  npmPackFlags = [ "--ignore-scripts" ];
+  npmFlags = [ "--legacy-peer-deps" ];
+
+  env.NODE_OPTIONS = "--openssl-legacy-provider";
+
+  postPatch = ''
+    substituteInPlace backend/server.js \
+      --replace-fail "const PORT = 3000;" "const PORT = Number(process.env.JS_PORT || 3000);"
+  '';
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/jellystat $out/bin
+    cp -r . $out/share/jellystat/
+
+    makeWrapper ${nodejs_22}/bin/node $out/bin/jellystat \
+      --chdir $out/share/jellystat \
+      --add-flags $out/share/jellystat/backend/server.js
+
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Jellystat is a free and open source Statistics App for Jellyfin";
+    homepage = "https://github.com/CyferShepard/Jellystat";
+    license = licenses.mit;
+    maintainers = with maintainers; [ mistyttm ];
+    mainProgram = "jellystat";
+    platforms = platforms.linux;
+  };
+})
diff --git a/pkgs/by-name/je/jellystat/remove-hardcoded-path.patch b/pkgs/by-name/je/jellystat/remove-hardcoded-path.patch
new file mode 100644
index 000000000000..08564c6e4d15
--- /dev/null
+++ b/pkgs/by-name/je/jellystat/remove-hardcoded-path.patch
@@ -0,0 +1,151 @@
+diff --git a/backend/classes/backup.js b/backend/classes/backup.js
+index 981b7d6..c6b4124 100644
+--- a/backend/classes/backup.js
++++ b/backend/classes/backup.js
+@@ -15,7 +15,9 @@ const postgresPassword = process.env.POSTGRES_PASSWORD;
+ const postgresIp = process.env.POSTGRES_IP;
+ const postgresPort = process.env.POSTGRES_PORT;
+ const postgresDatabase = process.env.POSTGRES_DB || "jfstat";
+-const backupfolder = "backup-data";
++const backupfolder = process.env.JS_BACKUP_DIR
++  ? path.resolve(process.env.JS_BACKUP_DIR)
++  : path.join(__dirname, "..", "backup-data");
+ 
+ function checkFolderWritePermission(folderPath) {
+   try {
+@@ -51,7 +53,7 @@ async function backup(refLog) {
+ 
+   try {
+     let now = dayjs();
+-    const backuppath = "./" + backupfolder;
++    const backuppath = backupfolder;
+ 
+     if (!fs.existsSync(backuppath)) {
+       fs.mkdirSync(backuppath);
+@@ -79,7 +81,7 @@ async function backup(refLog) {
+     }
+ 
+     // const backupPath = `../backup-data/backup_${now.format('YYYY-MM-DD HH-mm-ss')}.json`;
+-    const directoryPath = path.join(__dirname, "..", backupfolder, `backup_${now.format("YYYY-MM-DD HH-mm-ss")}.json`);
++    const directoryPath = path.join(backupfolder, `backup_${now.format("YYYY-MM-DD HH-mm-ss")}.json`);
+     refLog.logData.push({ color: "yellow", Message: "Begin Backup " + directoryPath });
+     const stream = fs.createWriteStream(directoryPath, { flags: "a" });
+     stream.on("error", async (error) => {
+@@ -105,7 +107,7 @@ async function backup(refLog) {
+ 
+     //Cleanup excess backups
+     let deleteCount = 0;
+-    const directoryPathDelete = path.join(__dirname, "..", backupfolder);
++    const directoryPathDelete = backupfolder;
+ 
+     const files = await new Promise((resolve, reject) => {
+       fs.readdir(directoryPathDelete, (err, files) => {
+@@ -132,7 +134,7 @@ async function backup(refLog) {
+     fileData = fileData.sort((a, b) => new Date(b.datecreated) - new Date(a.datecreated)).slice(5);
+ 
+     for (var oldBackup of fileData) {
+-      const oldBackupFile = path.join(__dirname, "..", backupfolder, oldBackup.name);
++      const oldBackupFile = path.join(backupfolder, oldBackup.name);
+ 
+       await new Promise((resolve, reject) => {
+         fs.unlink(oldBackupFile, (err) => {
+diff --git a/backend/classes/env.js b/backend/classes/env.js
+index afb76e7..5863934 100644
+--- a/backend/classes/env.js
++++ b/backend/classes/env.js
+@@ -16,7 +16,12 @@ async function writeEnvVariables() {
+   const envContent = `window.env = ${JSON.stringify(envVariables, null, 2)};`;
+ 
+   // Define the output file path
+-  const outputPath = path.join(__dirname, "..", "..", "dist", "env.js");
++  const envDir = process.env.JS_ENV_DIR ? path.resolve(process.env.JS_ENV_DIR) : path.join(__dirname, "..", "..", "dist");
++  const outputPath = path.join(envDir, "env.js");
++
++  if (process.env.JS_ENV_DIR) {
++    fs.mkdirSync(envDir, { recursive: true });
++  }
+ 
+   // Write the environment variables to the file
+   fs.writeFile(outputPath, envContent, "utf8", (err) => {
+diff --git a/backend/routes/backup.js b/backend/routes/backup.js
+index cfc3d3f..12d9b32 100644
+--- a/backend/routes/backup.js
++++ b/backend/routes/backup.js
+@@ -25,7 +25,9 @@ const postgresPort = process.env.POSTGRES_PORT;
+ const postgresDatabase = process.env.POSTGRES_DB || "jfstat";
+ const postgresSslRejectUnauthorized = process.env.POSTGRES_SSL_REJECT_UNAUTHORIZED === undefined ? true : process.env.POSTGRES_SSL_REJECT_UNAUTHORIZED === "true";
+ 
+-const backupfolder = "backup-data";
++const backupfolder = process.env.JS_BACKUP_DIR
++  ? path.resolve(process.env.JS_BACKUP_DIR)
++  : path.join(__dirname, "..", "backup-data");
+ 
+ // Restore function
+ 
+@@ -187,7 +189,7 @@ router.get("/restore/:filename", async (req, res) => {
+     Logging.insertLog(uuid, triggertype.Manual, taskName.restore);
+ 
+     const filename = sanitizeFilename(req.params.filename);
+-    const filePath = path.join(__dirname, "..", backupfolder, filename);
++    const filePath = path.join(backupfolder, filename);
+ 
+     await restore(filePath, refLog);
+     Logging.updateLog(uuid, refLog.logData, taskstate.SUCCESS);
+@@ -202,7 +204,7 @@ router.get("/restore/:filename", async (req, res) => {
+ 
+ router.get("/files", (req, res) => {
+   try {
+-    const directoryPath = path.join(__dirname, "..", backupfolder);
++    const directoryPath = backupfolder;
+     fs.readdir(directoryPath, (err, files) => {
+       if (err) {
+         res.status(500).send("Unable to read directory");
+@@ -229,7 +231,7 @@ router.get("/files", (req, res) => {
+ //download backup file
+ router.get("/files/:filename", (req, res) => {
+   const filename = sanitizeFilename(req.params.filename);
+-  const filePath = path.join(__dirname, "..", backupfolder, filename);
++  const filePath = path.join(backupfolder, filename);
+   res.download(filePath);
+ });
+ 
+@@ -237,7 +239,7 @@ router.get("/files/:filename", (req, res) => {
+ router.delete("/files/:filename", (req, res) => {
+   try {
+     const filename = sanitizeFilename(req.params.filename);
+-    const filePath = path.join(__dirname, "..", backupfolder, filename);
++    const filePath = path.join(backupfolder, filename);
+ 
+     fs.unlink(filePath, (err) => {
+       if (err) {
+@@ -256,7 +258,7 @@ router.delete("/files/:filename", (req, res) => {
+ 
+ const storage = multer.diskStorage({
+   destination: function (req, file, cb) {
+-    cb(null, path.join(__dirname, "..", backupfolder)); // Set the destination folder for uploaded files
++    cb(null, backupfolder); // Set the destination folder for uploaded files
+   },
+   filename: function (req, file, cb) {
+     cb(null, file.originalname); // Set the file name
+diff --git a/backend/server.js b/backend/server.js
+index d70975d..1898ec6 100644
+--- a/backend/server.js
++++ b/backend/server.js
+@@ -106,6 +106,17 @@ const findFile = (dir, fileName) => {
+ 
+ const root = path.join(__dirname, "..", "dist");
+ 
++// When JS_ENV_DIR is set, env.js is written outside of `root` (e.g. because
++// `root` lives on a read-only filesystem), so serve it explicitly from
++// there instead of relying on the findFile() lookup below, which only
++// searches under `root`.
++if (process.env.JS_ENV_DIR) {
++  const envDir = path.resolve(process.env.JS_ENV_DIR);
++  app.get(/\/env\.js$/, (req, res) => {
++    res.sendFile(path.join(envDir, "env.js"));
++  });
++}
++
+ //hacky middleware to handle basename changes for UI
+ 
+ app.use((req, res, next) => {
\ No newline at end of file

From 3e1f44784c2980ae90507eec236140a3eee9eeea Mon Sep 17 00:00:00 2001
From: Nicholas Malcolm <bubylou@pm.me>
Date: Sun, 16 Aug 2026 13:14:24 -0400
Subject: [PATCH 14/85] =?UTF-8?q?vintagestory:=201.22.6=20=E2=86=92=201.22?=
 =?UTF-8?q?.7?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/by-name/vi/vintagestory/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vi/vintagestory/package.nix b/pkgs/by-name/vi/vintagestory/package.nix
index a4d9d31c98c9..81f5358e683c 100644
--- a/pkgs/by-name/vi/vintagestory/package.nix
+++ b/pkgs/by-name/vi/vintagestory/package.nix
@@ -27,11 +27,11 @@ assert waylandSupport -> libxkbcommon != null;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vintagestory";
-  version = "1.22.6";
+  version = "1.22.7";
 
   src = fetchurl {
     url = "https://cdn.vintagestory.at/gamefiles/stable/vs_client_linux-x64_${finalAttrs.version}.tar.gz";
-    hash = "sha256-xJPyaYklEq2BeUX9+7hNPI6WC6ibcQDS+sKeqKYSh3A=";
+    hash = "sha256-SDzGgnpQwIxcQczQJixvEiPBBOVMpxNcRmBSeNifXeE=";
   };
 
   __structuredAttrs = true;

From f6e2fccc724a3562434edf08b147b7f631845ce1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 18 Aug 2026 00:34:07 +0000
Subject: [PATCH 15/85] lobster: 2026.4 -> 2026.5

---
 pkgs/by-name/lo/lobster/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/lo/lobster/package.nix b/pkgs/by-name/lo/lobster/package.nix
index 5ad33aa42ec8..a9673fd3fd88 100644
--- a/pkgs/by-name/lo/lobster/package.nix
+++ b/pkgs/by-name/lo/lobster/package.nix
@@ -20,13 +20,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "lobster";
-  version = "2026.4";
+  version = "2026.5";
 
   src = fetchFromGitHub {
     owner = "aardappel";
     repo = "lobster";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-kqKOf0zrHyqRTs+57owHR5sORZgNIgGghtjUtSaFjZw=";
+    hash = "sha256-coUsn3sYTWO4UGqw5DIWFvnA5+TpkUukRx0Axg8Lfhc=";
   };
 
   nativeBuildInputs = [

From 7dc3643a32b03cc0a75606959f1751d00fb0cc7c Mon Sep 17 00:00:00 2001
From: Benjamin Sparks <b.sparks@alugha.com>
Date: Wed, 19 Aug 2026 01:30:00 +0200
Subject: [PATCH 16/85] pgschema: init at 1.12.3

---
 pkgs/by-name/pg/pgschema/package.nix | 55 ++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)
 create mode 100644 pkgs/by-name/pg/pgschema/package.nix

diff --git a/pkgs/by-name/pg/pgschema/package.nix b/pkgs/by-name/pg/pgschema/package.nix
new file mode 100644
index 000000000000..6d826859b09f
--- /dev/null
+++ b/pkgs/by-name/pg/pgschema/package.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  postgresql,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "pgschema";
+  version = "1.12.3";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "pgplex";
+    repo = "pgschema";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-zfG87Uc5bx14zhYnuT3CF+sW5EEQLBRRMyBe57FBHJ4=";
+  };
+
+  # Adapted from $src/nix/pgschema.nix
+  proxyVendor = true;
+  vendorHash = "sha256-3nV7AEsWyEvIbxHetoEsA8PPXJ6ENvU/sz7Wn5aysss=";
+
+  env.CGO_ENABLED = "0";
+  ldflags = [
+    "-s"
+    "-w"
+    "-X"
+    "github.com/pgplex/pgschema/cmd.GitCommit=${finalAttrs.src.rev}"
+    # "-X"
+    # "github.com/pgplex/pgschema/cmd.BuildDate=${buildDate}"
+    "-X"
+    "github.com/pgplex/pgschema/internal/postgres.binariesPath=${postgresql}"
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  versionCheckProgramArg = "--help"; # there is no -v/--version
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Terraform-style, declarative Postgres schema migration";
+    homepage = "https://github.com/pgplex/pgschema";
+    changelog = "https://github.com/pgplex/pgschema/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.bengsparks ];
+    mainProgram = "pgschema";
+    platforms = lib.platforms.unix;
+  };
+})

From af6a4648c0305f6d7e7ebed4a884d4d9deeae6e4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 18 Aug 2026 23:53:41 +0000
Subject: [PATCH 17/85] lunar-client: 3.7.14 -> 3.7.15

---
 pkgs/by-name/lu/lunar-client/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/lu/lunar-client/package.nix b/pkgs/by-name/lu/lunar-client/package.nix
index 2729c3d90590..59d2a22641be 100644
--- a/pkgs/by-name/lu/lunar-client/package.nix
+++ b/pkgs/by-name/lu/lunar-client/package.nix
@@ -7,11 +7,11 @@
 
 appimageTools.wrapType2 rec {
   pname = "lunarclient";
-  version = "3.7.14";
+  version = "3.7.15";
 
   src = fetchurl {
     url = "https://launcherupdates.lunarclientcdn.com/Lunar%20Client-${version}-ow.AppImage";
-    hash = "sha512-UmaMEDkLMU/V0Rddu4IATsH8LrmyV7KOQE1ac0rWHWld7tE1ZU9vp+/VTR68KFkxfTm0wNMxy4ilAP84GVA7pQ==";
+    hash = "sha512-F2rJpU7PLvknzkkYwlPSxLZAiuw8om7XT6cDMnw9IRODyHfWzBgTL5481GK6ySNV6sVZAlWVg4hf7XsPtdci/A==";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 13c071ddd6e5c914e48c5a6fa50395f575f7a33a Mon Sep 17 00:00:00 2001
From: nick <54501296+2hexed@users.noreply.github.com>
Date: Wed, 19 Aug 2026 23:26:34 +0530
Subject: [PATCH 18/85] modules/nvidia: Clean and fix NVIDIA module parameters
 example

Fixes a small issue where search.nixos.org shows a text block with `''`'s for the example snippet (which may confuse the user) and added a `;` to correct the example snippet's syntax.
---
 nixos/modules/hardware/video/nvidia.nix | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/nixos/modules/hardware/video/nvidia.nix b/nixos/modules/hardware/video/nvidia.nix
index bd553409cff6..248f45584e9b 100644
--- a/nixos/modules/hardware/video/nvidia.nix
+++ b/nixos/modules/hardware/video/nvidia.nix
@@ -386,14 +386,12 @@ in
       moduleParams = lib.mkOption {
         type = lib.types.attrsOf (lib.types.attrsOf lib.types.raw);
         default = { };
-        example = ''
-          {
-            nvidia = {
-              NVreg_UsePageAttributeTable = 1;
-              NVreg_RegistryDwords = "EnableBrightnessControl=1"
-            };
-          }
-        '';
+        example = {
+          nvidia = {
+            NVreg_UsePageAttributeTable = 1;
+            NVreg_RegistryDwords = "EnableBrightnessControl=1";
+          };
+        };
         description = "Additional parameters to pass to the NVIDIA kernel module.";
       };
     };

From 035427541af8de5b29c0176624b49719e7715aeb Mon Sep 17 00:00:00 2001
From: NTBBloodbath <bloodbathalchemist@protonmail.com>
Date: Fri, 21 Aug 2026 13:50:37 -0400
Subject: [PATCH 19/85] penpot-desktop: 0.23.1 -> 0.23.2

---
 pkgs/by-name/pe/penpot-desktop/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/pe/penpot-desktop/package.nix b/pkgs/by-name/pe/penpot-desktop/package.nix
index 664a74686731..0c88f18200f2 100644
--- a/pkgs/by-name/pe/penpot-desktop/package.nix
+++ b/pkgs/by-name/pe/penpot-desktop/package.nix
@@ -2,7 +2,7 @@
   lib,
   buildNpmPackage,
   copyDesktopItems,
-  electron_41,
+  electron_42,
   fetchFromGitHub,
   jq,
   makeDesktopItem,
@@ -15,17 +15,17 @@ let
   description = "Unofficial desktop application for the open-source design tool, Penpot";
   icon = "penpot";
   nodejs = nodejs_24;
-  electron = electron_41;
+  electron = electron_42;
 in
 buildNpmPackage rec {
   pname = "penpot-desktop";
-  version = "0.23.1";
+  version = "0.23.2";
 
   src = fetchFromGitHub {
     owner = "author-more";
     repo = "penpot-desktop";
     tag = "v${version}";
-    hash = "sha256-/vRF5eqtjdmd2Qmb+OAgKfLJmh78S0WrLWA94SeOJQA=";
+    hash = "sha256-V/JqrEkag6tVcq46wqLdheJqSAFmfeEVxueIgeuyToA=";
   };
 
   makeCacheWritable = true;
@@ -33,7 +33,7 @@ buildNpmPackage rec {
     "--engine-strict"
     "--legacy-peer-deps"
   ];
-  npmDepsHash = "sha256-hu2v2Dw2SRs4Egmsi5hb81vgnZDjQahLXyAYm/uaMao=";
+  npmDepsHash = "sha256-5CD/sK/DYfzIgnuvTi4OevtyNLEOTedmuStrg4ru14A=";
   # Do not run the default build script as it leads to errors caused by the electron-builder configuration
   dontNpmBuild = true;
 

From 9d97ad0a22163896c000875356c53bedda5dabf5 Mon Sep 17 00:00:00 2001
From: coolcuber <rpgeorg@clemson.edu>
Date: Sat, 22 Aug 2026 19:18:22 -0400
Subject: [PATCH 20/85] glpaper: fix version, modernize

---
 pkgs/by-name/gl/glpaper/package.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gl/glpaper/package.nix b/pkgs/by-name/gl/glpaper/package.nix
index 7bb9373346c5..428df6b30021 100644
--- a/pkgs/by-name/gl/glpaper/package.nix
+++ b/pkgs/by-name/gl/glpaper/package.nix
@@ -12,14 +12,17 @@
 
 stdenv.mkDerivation {
   pname = "glpaper";
-  version = "unstable-2024-08-07";
+  version = "0-unstable-2024-08-07";
+
+  __structuredAttrs = true;
+  strictDeps = true;
 
   src = fetchFromSourcehut {
     owner = "~scoopta";
     repo = "glpaper";
     vc = "hg";
     rev = "af9827d20bfe1956dd88fb2202b38ed0de705305";
-    sha256 = "sha256-zgvnWqsw243jZ9e6fG6L0hDfRRHwzmIdsxwnnWhimu0=";
+    hash = "sha256-zgvnWqsw243jZ9e6fG6L0hDfRRHwzmIdsxwnnWhimu0=";
   };
 
   # nop() is used as a typed Wayland callback stub, which GCC 15 rejects as an error.

From 8fecff8aa456c13272cd859659490c6cea8ef013 Mon Sep 17 00:00:00 2001
From: coolcuber <rpgeorg@clemson.edu>
Date: Sat, 22 Aug 2026 22:29:14 -0400
Subject: [PATCH 21/85] guile-xcb: fix version; enable strictDeps,
 structuredAttrs

---
 pkgs/by-name/gu/guile-xcb/package.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gu/guile-xcb/package.nix b/pkgs/by-name/gu/guile-xcb/package.nix
index 26f83441f1b9..a64596300840 100644
--- a/pkgs/by-name/gu/guile-xcb/package.nix
+++ b/pkgs/by-name/gu/guile-xcb/package.nix
@@ -10,7 +10,10 @@
 
 stdenv.mkDerivation {
   pname = "guile-xcb";
-  version = "unstable-2017-05-29";
+  version = "1.3-unstable-2017-05-28";
+
+  strictDeps = true;
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "mwitmer";
@@ -21,11 +24,12 @@ stdenv.mkDerivation {
 
   nativeBuildInputs = [
     autoreconfHook
+    guile_2_2
     pkg-config
+    texinfo
   ];
   buildInputs = [
     guile_2_2
-    texinfo
   ];
 
   configureFlags = [

From 20d6c2532e688349296cba75204880f7faf842f9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 24 Aug 2026 00:21:31 +0000
Subject: [PATCH 22/85] 
 home-assistant-custom-lovelace-modules.weather-radar-card: 3.7.2 -> 3.7.3

---
 .../custom-lovelace-modules/weather-radar-card/package.nix  | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/weather-radar-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/weather-radar-card/package.nix
index 9314ed1798c0..9e850d97dc43 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/weather-radar-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/weather-radar-card/package.nix
@@ -7,13 +7,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "weather-radar-card";
-  version = "3.7.2";
+  version = "3.7.3";
 
   src = fetchFromGitHub {
     owner = "jpettitt";
     repo = "weather-radar-card";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4c7XMHfLx5tE6NFHfKn6s9pOktVJcaSulhz7s1FXgcQ=";
+    hash = "sha256-94fag6+i+9otVQRAllZA0dSyC0MGhv0Q6brEavWMs8k=";
   };
 
   postPatch = ''
@@ -23,7 +23,7 @@ buildNpmPackage (finalAttrs: {
 
   npmDepsFetcherVersion = 2;
   npmFlags = [ "--legacy-peer-deps" ];
-  npmDepsHash = "sha256-1ln1V9UzyN9KyaYkUfCJbeItSIcV3/Mqzc90CoNM3W4=";
+  npmDepsHash = "sha256-pYvnYYgmm4+2fOO/pLR+OtlKfBKf2Xws6Oz8mEOSNPM=";
 
   installPhase = ''
     runHook preInstall

From ee107c5e3d51fbf53858fc68d4ccd0e66b8be1a4 Mon Sep 17 00:00:00 2001
From: loner <2788892716@qq.com>
Date: Thu, 13 Aug 2026 11:11:17 +0800
Subject: [PATCH 23/85] resterm: 0.49.4 -> 1.2.4

---
 pkgs/by-name/re/resterm/package.nix | 19 ++++---------------
 1 file changed, 4 insertions(+), 15 deletions(-)

diff --git a/pkgs/by-name/re/resterm/package.nix b/pkgs/by-name/re/resterm/package.nix
index 66f145378d8d..3d153462f2b9 100644
--- a/pkgs/by-name/re/resterm/package.nix
+++ b/pkgs/by-name/re/resterm/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "resterm";
-  version = "0.49.4";
+  version = "1.2.4";
 
   src = fetchFromGitHub {
     owner = "unkn0wn-root";
     repo = "resterm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4hLhmQ2ks1g9eF+wKKLc8/6g07IHisgwYMBhGr4DjbE=";
+    hash = "sha256-vp1/yWDqx8fQp4NifjENr/x8e0TVSRlLYv7TshfwC2Y=";
   };
 
   vendorHash = "sha256-K6edyYLkVQwEZBAfRwgckUJI8dmo/ZxFRjEkExtyLxY=";
@@ -27,19 +27,8 @@ buildGoModule (finalAttrs: {
 
   subPackages = [ "cmd/resterm" ];
 
-  # Skip tests that require network access or socket binding
-  checkFlags = [
-    "-skip"
-    "^(${
-      lib.concatStringsSep "|" [
-        "TestServeMocksStartsAndStopsWithContext"
-        "TestServeMocksRequiresTLSPair"
-        "TestServeMocksValidatesJournalLimitsAsUsageErrors"
-        "TestMockControlCommandsResetClearAndVerify"
-        "TestCLIUpdaterCheckDev"
-      ]
-    })$"
-  ];
+  # for tests binding 127.0.0.1:0 on darwin
+  __darwinAllowLocalNetworking = true;
 
   ldflags = [
     "-s"

From 49b6387892dac4c13078cb9cc087bed6ce8d552c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 24 Aug 2026 04:24:35 +0000
Subject: [PATCH 24/85] home-assistant-custom-components.blueprints-updater:
 2.13.1 -> 2.13.3

---
 .../custom-components/blueprints-updater/package.nix          | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix b/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
index fa59c6984e6f..cb2edc9456b6 100644
--- a/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/blueprints-updater/package.nix
@@ -14,13 +14,13 @@
 buildHomeAssistantComponent rec {
   owner = "luuquangvu";
   domain = "blueprints_updater";
-  version = "2.13.1";
+  version = "2.13.3";
 
   src = fetchFromGitHub {
     inherit owner;
     repo = "blueprints-updater";
     tag = version;
-    hash = "sha256-80Jq+26l+VKZX2fR5a/08hfpLA8RLCqFmZALK+U4SPQ=";
+    hash = "sha256-JFXxv46hUYPxdNjIgEn8pI3yV7z1CopIp9KfdDxkHU8=";
   };
 
   patches = [

From 2af9a3df7c6969ee5eabababe8007714dd51a480 Mon Sep 17 00:00:00 2001
From: Shogo Takata <shogo-takata@st.go.tuat.ac.jp>
Date: Mon, 24 Aug 2026 14:46:44 +0900
Subject: [PATCH 25/85] super-productivity: 18.19.0 -> 18.20.1

Also updates the electron version to 43.
---
 pkgs/by-name/su/super-productivity/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/su/super-productivity/package.nix b/pkgs/by-name/su/super-productivity/package.nix
index 285a01c2df30..e4ec3d4879e1 100644
--- a/pkgs/by-name/su/super-productivity/package.nix
+++ b/pkgs/by-name/su/super-productivity/package.nix
@@ -1,7 +1,7 @@
 {
   buildNpmPackage,
   copyDesktopItems,
-  electron_41,
+  electron_43,
   fetchFromGitHub,
   lib,
   makeDesktopItem,
@@ -15,12 +15,12 @@
   cargo,
 }:
 let
-  electron = electron_41;
+  electron = electron_43;
   nodejs = nodejs_22;
 in
 buildNpmPackage rec {
   pname = "super-productivity";
-  version = "18.19.0";
+  version = "18.20.1";
 
   inherit nodejs;
 
@@ -28,7 +28,7 @@ buildNpmPackage rec {
     owner = "super-productivity";
     repo = "super-productivity";
     tag = "v${version}";
-    hash = "sha256-tUK2vytQ/fBSw8drjBLh4HlrnQh/0tX9e9otYMhXYsA=";
+    hash = "sha256-7bDPG3OPXVDzIjxpQw3XLXnLNSfjdq0pIlSqZhYZSIs=";
   };
 
   # Use custom fetcher for deps because super-productivity uses multiple
@@ -74,7 +74,7 @@ buildNpmPackage rec {
       dontInstall = true;
 
       outputHashMode = "recursive";
-      hash = "sha256-Je3pHgkBwt35sIvxQqnYX3F+uJQeBGc5kzCAL9czCYs=";
+      hash = "sha256-esVslmbko0mbANyR67b4a6YHO4sRniv5ZVISNk1u0Bg=";
     }
   );
 

From 4e1dc87a7718506d4e94e8ee7f8fa46235be4e39 Mon Sep 17 00:00:00 2001
From: happysalada <raphael@megzari.com>
Date: Mon, 24 Aug 2026 05:56:05 -0400
Subject: [PATCH 26/85] nono: 0.71.0 -> 0.74.0

---
 pkgs/by-name/no/nono/package.nix | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/no/nono/package.nix b/pkgs/by-name/no/nono/package.nix
index baaa58a7b41c..2c96a6f3a6fe 100644
--- a/pkgs/by-name/no/nono/package.nix
+++ b/pkgs/by-name/no/nono/package.nix
@@ -15,7 +15,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nono";
-  version = "0.71.0";
+  version = "0.74.0";
 
   __darwinAllowLocalNetworking = true; # required for tests
 
@@ -23,9 +23,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "nolabs-ai";
     repo = "nono";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Xrqd8Do1R2kCwTAmju2VmOLAf329eoOSslfa8i9ogJc=";
+    hash = "sha256-Njfs0kkoNj3VjLd6ziz5WAgI+HLMZ+djqxjbXabEdzg=";
   };
-  cargoHash = "sha256-bMGrLh3DEA3yJsyb62Xdt+SfhzFY5VXawai4V6xttpI=";
+  cargoHash = "sha256-+JLE0hBmsxqDnTwkFRVxphA6HdA/EgkWHIAJiExsxp4=";
 
   nativeBuildInputs = [
     pkg-config
@@ -46,11 +46,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
       "test_all_profiles_signal_mode_resolves"
       "test_restrict_execute_does_not_break_rename_into_new_subdir"
       # panic
-      "build_run_profile_patch_adds_override_deny_for_sensitive_file"
       "build_run_profile_patch_merges_read_and_write_to_allow_file"
       "prepare_profile_save_from_patch_updates_existing_user_profile"
-      "would_shadow_builtin_allows_update_of_existing_user_override"
-      "would_shadow_builtin_flags_known_builtin_names"
       "create_audit_state_creates_session_when_enabled"
 
       # audit_attestation
@@ -58,6 +55,18 @@ rustPlatform.buildRustPackage (finalAttrs: {
       "audit_verify_reports_signed_attestation_with_pinned_public_key"
       "rollback_signed_session_verifies_from_audit_dir_bundle"
 
+      # audit_ledger
+      # needs /bin/pwd
+      "corrupt_audit_ledger_downgrades_only_a_clean_exit"
+      "corrupt_audit_ledger_is_reported_on_every_run_and_left_untouched"
+
+      # execution_strategy_run
+      # needs /usr/bin/env
+      "direct_workdir_overrides_untrusted_host_pwd"
+      "direct_workdir_sets_child_pwd_from_uncovered_launch_dir"
+      "supervised_workdir_overrides_untrusted_host_pwd"
+      "supervised_workdir_sets_child_pwd_from_uncovered_launch_dir"
+
       # nono-cli
       # wants a script `scripts/test-list-aliases.sh`, `git`, and `.git` history
       "alias_inventory_script_passes"

From 8c49a9bcb8e620c17237caa0b0f4f24c521a0181 Mon Sep 17 00:00:00 2001
From: happysalada <raphael@megzari.com>
Date: Mon, 24 Aug 2026 05:44:57 -0400
Subject: [PATCH 27/85] graphify: 0.9.42 -> 0.9.48

---
 pkgs/by-name/gr/graphify/package.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gr/graphify/package.nix b/pkgs/by-name/gr/graphify/package.nix
index 5cfe4c272b01..8e44e286cbf1 100644
--- a/pkgs/by-name/gr/graphify/package.nix
+++ b/pkgs/by-name/gr/graphify/package.nix
@@ -8,14 +8,14 @@
 python3Packages.buildPythonApplication rec {
   __structuredAttrs = true;
   pname = "graphify";
-  version = "0.9.42";
+  version = "0.9.48";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Graphify-Labs";
     repo = "graphify";
     tag = "v${version}";
-    hash = "sha256-QXdjA+xSgh6I+A2snvlaigHG2FQJWoFWIYQJfCmshGQ=";
+    hash = "sha256-gcQ8isXZQu/VQkK74vAaOKnbNdsxiez+TSZdRUxEMiA=";
   };
 
   build-system = [
@@ -77,6 +77,9 @@ python3Packages.buildPythonApplication rec {
     chinese = [
       jieba
     ];
+    commonlisp = [
+      tree-sitter-grammars.tree-sitter-commonlisp
+    ];
     leiden = [
       graspologic
     ];

From 73dcefbbee92bffffe816fb65034eb01800c54c1 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Sun, 19 Jul 2026 00:37:58 +0200
Subject: [PATCH 28/85] tart: 2.30.6 -> 2.36.0

---
 pkgs/by-name/ta/tart/package.nix | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/ta/tart/package.nix b/pkgs/by-name/ta/tart/package.nix
index e01a60ea1fe4..f43b6d263222 100644
--- a/pkgs/by-name/ta/tart/package.nix
+++ b/pkgs/by-name/ta/tart/package.nix
@@ -10,15 +10,15 @@
   enableSoftnet ? false,
   softnet,
   nix-update-script,
-  versionCheckHook,
+  testers,
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "tart";
-  version = "2.30.6";
+  version = "2.36.0";
 
   src = fetchurl {
-    url = "https://github.com/cirruslabs/tart/releases/download/${finalAttrs.version}/tart.tar.gz";
-    hash = "sha256-wepqDaJp1oRjGqEVrXUM/JO5gfAKc12AUkZUbfwwdx0=";
+    url = "https://github.com/openai/tart/releases/download/${finalAttrs.version}/tart.tar.gz";
+    hash = "sha256-xyqKuNeKZJih5CaIsaHsbFEs5GyjWjo74TDD3hRAx+g=";
   };
   sourceRoot = ".";
 
@@ -39,16 +39,16 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  nativeInstallCheckInputs = [
-    versionCheckHook
-  ];
-  doInstallCheck = true;
   passthru.updateScript = nix-update-script { };
+  passthru.tests.version = testers.testVersion {
+    inherit (finalAttrs) version;
+    package = finalAttrs.finalPackage;
+  };
 
   meta = {
     description = "macOS and Linux VMs on Apple Silicon to use in CI and other automations";
     homepage = "https://tart.run";
-    license = lib.licenses.fairsource09;
+    license = lib.licenses.fsl11Asl20;
     maintainers = with lib.maintainers; [
       emilytrau
       aduh95

From 38290b0095f9571fec6a14c94a7d636433d04891 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 25 Aug 2026 15:52:40 +0000
Subject: [PATCH 29/85] mate-wayland-session: 1.28.5 -> 1.28.6

---
 pkgs/by-name/ma/mate-wayland-session/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ma/mate-wayland-session/package.nix b/pkgs/by-name/ma/mate-wayland-session/package.nix
index 5ddeb27b4f66..5c0ec3a14007 100644
--- a/pkgs/by-name/ma/mate-wayland-session/package.nix
+++ b/pkgs/by-name/ma/mate-wayland-session/package.nix
@@ -14,13 +14,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "mate-wayland-session";
-  version = "1.28.5";
+  version = "1.28.6";
 
   src = fetchFromGitHub {
     owner = "mate-desktop";
     repo = "mate-wayland-session";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-YWuBAzsLrvnwGgXbcDzIZtQIscIl37Y3wIRCOKidtYo=";
+    hash = "sha256-jlUmA+a59VGXtPUftmA7DruZK53IQM+66RgeP1Jg3e8=";
   };
 
   nativeBuildInputs = [

From cedcd0ea028c639ce94fe7a9f126196b5c6c2abd Mon Sep 17 00:00:00 2001
From: qubitnano <146656568+qubitnano@users.noreply.github.com>
Date: Tue, 25 Aug 2026 20:08:36 -0400
Subject: [PATCH 30/85] _2ship2harkinian: 5.0.0 -> 5.0.1

https://github.com/HarbourMasters/2ship2harkinian/releases/tag/5.0.1
---
 pkgs/by-name/_2/_2ship2harkinian/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/_2/_2ship2harkinian/package.nix b/pkgs/by-name/_2/_2ship2harkinian/package.nix
index cc897aaa19f7..bcef2bedde09 100644
--- a/pkgs/by-name/_2/_2ship2harkinian/package.nix
+++ b/pkgs/by-name/_2/_2ship2harkinian/package.nix
@@ -119,13 +119,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "2ship2harkinian";
-  version = "5.0.0";
+  version = "5.0.1";
 
   src = fetchFromGitHub {
     owner = "HarbourMasters";
     repo = "2ship2harkinian";
     tag = finalAttrs.version;
-    hash = "sha256-lx5+i/S+deWB6iYTTrUOffQfB6qnUvDZrU80NWyqb2Y=";
+    hash = "sha256-+8c6AolEjM7VDhlNTnMRoQMLze4DssARlHl33nJ1zM8=";
     fetchSubmodules = true;
     deepClone = true;
     postFetch = ''

From a63a609103451ca140147cd9ce5402db40159128 Mon Sep 17 00:00:00 2001
From: Santhosh Raju <santhosh.raju@gmail.com>
Date: Tue, 11 Aug 2026 15:37:54 +0200
Subject: [PATCH 31/85] yopass: init at 14.9.0

---
 pkgs/by-name/yo/yopass/package.nix | 57 ++++++++++++++++++++++++++++++
 pkgs/by-name/yo/yopass/website.nix | 35 ++++++++++++++++++
 2 files changed, 92 insertions(+)
 create mode 100644 pkgs/by-name/yo/yopass/package.nix
 create mode 100644 pkgs/by-name/yo/yopass/website.nix

diff --git a/pkgs/by-name/yo/yopass/package.nix b/pkgs/by-name/yo/yopass/package.nix
new file mode 100644
index 000000000000..f6da068b784d
--- /dev/null
+++ b/pkgs/by-name/yo/yopass/package.nix
@@ -0,0 +1,57 @@
+{
+  buildGoModule,
+  callPackage,
+  fetchFromGitHub,
+  makeBinaryWrapper,
+  lib,
+}:
+let
+  version = "14.9.0";
+  src = fetchFromGitHub {
+    owner = "jhaals";
+    repo = "yopass";
+    tag = version;
+    hash = "sha256-YZeSGcQcAsOmIwhhVpGN7bxlNGsWIJNAwUBxJM/7314=";
+  };
+
+  website = callPackage ./website.nix { inherit src version; };
+in
+buildGoModule (finalAttrs: {
+  inherit version src;
+  pname = "yopass";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  vendorHash = "sha256-mR17QPGZNJ9Vx6y6mExvZDKReVxdUif8aQ6VMfKVgcM=";
+
+  nativeBuildInputs = [ makeBinaryWrapper ];
+
+  subPackages = [
+    "cmd/yopass"
+    "cmd/yopass-server"
+  ];
+
+  checkFlags = [
+    # Disable tests that require network access
+    "-skip=TestSecretNotFoundError"
+  ];
+
+  postInstall = ''
+    wrapProgram $out/bin/yopass-server \
+      --add-flags "--asset-path ${website}"
+  '';
+
+  meta = {
+    description = "Secure sharing of secrets, passwords and files";
+    homepage = "https://github.com/jhaals/yopass";
+    changelog = "https://github.com/jhaals/yopass/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      ivarmedi
+      fraggerfox
+    ];
+    mainProgram = "yopass";
+    platforms = lib.platforms.unix;
+  };
+})
diff --git a/pkgs/by-name/yo/yopass/website.nix b/pkgs/by-name/yo/yopass/website.nix
new file mode 100644
index 000000000000..fc80fba3a76c
--- /dev/null
+++ b/pkgs/by-name/yo/yopass/website.nix
@@ -0,0 +1,35 @@
+{
+  fetchYarnDeps,
+  nodejs-slim,
+  src,
+  stdenv,
+  version,
+  yarnBuildHook,
+  yarnConfigHook,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "yopass-website";
+  inherit version;
+
+  src = src + "/website";
+
+  yarnOfflineCache = fetchYarnDeps {
+    yarnLock = "${finalAttrs.src}/yarn.lock";
+    hash = "sha256-x3ouozoDreaeeqoh8osXOqEYphy6vTalLMjQt5vowkg=";
+  };
+
+  nativeBuildInputs = [
+    yarnConfigHook
+    yarnBuildHook
+    nodejs-slim
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mv dist $out
+
+    runHook postInstall
+  '';
+})

From 2023145ba3bc0826f41efae58052bf145e51f7dd Mon Sep 17 00:00:00 2001
From: qrzbing <qrzbing@foxmail.com>
Date: Wed, 26 Aug 2026 15:06:10 +0800
Subject: [PATCH 32/85] picgo: 3.0.1 -> 3.0.2

---
 pkgs/by-name/pi/picgo/package.nix | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/pi/picgo/package.nix b/pkgs/by-name/pi/picgo/package.nix
index 24bcc055a3e1..306d6c237634 100644
--- a/pkgs/by-name/pi/picgo/package.nix
+++ b/pkgs/by-name/pi/picgo/package.nix
@@ -6,7 +6,7 @@
   pnpm_10,
   fetchPnpmDeps,
   pnpmConfigHook,
-  electron_41,
+  electron_43,
   makeWrapper,
   copyDesktopItems,
   makeDesktopItem,
@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "picgo";
-  version = "3.0.1";
+  version = "3.0.2";
 
   src = fetchFromGitHub {
     owner = "Molunerfinn";
     repo = "PicGo";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-uxgrtuxcIlwCuz3X2hL0ZSpq8hMA4JxQD8ibNFw+35g=";
+    hash = "sha256-wT9CfPchNbD2CzSVA9kZAYsstpc2mvgqAl305rmrUdo=";
   };
 
   pnpmDeps = fetchPnpmDeps {
@@ -48,6 +48,15 @@ stdenv.mkDerivation (finalAttrs: {
     NODE_ENV = "development";
   };
 
+  postPatch = ''
+    # Maximizing a hidden BrowserWindow makes it visible on Linux. Defer restoring
+    # the maximized state until the main window is explicitly shown.
+    # https://github.com/Molunerfinn/PicGo/blob/4676326eb88d087432989366d71e61e17a039e98/src/main/apis/app/window/windowList.ts#L83-L94
+    substituteInPlace src/main/apis/app/window/windowList.ts \
+      --replace-fail "      window.maximize()" \
+        "      window.once('show', () => window.maximize())"
+  '';
+
   buildPhase = ''
     runHook preBuild
 
@@ -57,12 +66,8 @@ stdenv.mkDerivation (finalAttrs: {
   '';
 
   postBuild = ''
-    cp -r src/renderer/public/. dist_electron/renderer/
-
-    # Renderer assets are loaded from a file:// URL, so root-relative paths like
-    # /squareLogo.png resolve to the filesystem root. Copy the renderer public assets
-    # next to index.html and rewrite those references to relative paths.
-    # https://github.com/Molunerfinn/PicGo/blob/dev/src/renderer/components/independent-window/mini/picgo-mini-page.tsx
+    # Renderer assets are loaded from a file:// URL, so the mini window logo must
+    # use a path relative to its index.html.
     substituteInPlace dist_electron/renderer/assets/mini-*.js \
       --replace-fail '"/squareLogo.png"' '"./squareLogo.png"'
   '';
@@ -92,7 +97,7 @@ stdenv.mkDerivation (finalAttrs: {
     # ELECTRON_FORCE_IS_PACKAGED makes PicGo use its production resource path,
     # but with the nixpkgs Electron wrapper process.resourcesPath points to Electron
     # itself, so point PicGo at the installed public assets
-    makeWrapper ${lib.getExe electron_41} $out/bin/picgo \
+    makeWrapper ${lib.getExe electron_43} $out/bin/picgo \
       --add-flags "--class=picgo" \
       --add-flags "$out/lib/picgo/.launcher.cjs" \
       --set NODE_ENV production \

From c8c3394d56533f9faa48d773c29e9635020fc3d0 Mon Sep 17 00:00:00 2001
From: Moritz Heidkamp <moritz@twoticketsplease.de>
Date: Wed, 6 Aug 2025 22:01:55 +0200
Subject: [PATCH 33/85] babashka: Don't set DEPS_CLJ_TOOLS_DIR in wrapper

Instead, introduce custom NIX_DEPS_CLJ_TOOLS_DIR so as not to also affect sub-processes spawned by
babashka (see patch comment for more details).

Resolves #431312
---
 .../default-tools-dir.patch                   | 19 +++++++++++++++++
 .../by-name/ba/babashka-unwrapped/package.nix | 21 ++++++++++++++++++-
 pkgs/by-name/ba/babashka/package.nix          |  2 +-
 3 files changed, 40 insertions(+), 2 deletions(-)
 create mode 100644 pkgs/by-name/ba/babashka-unwrapped/default-tools-dir.patch

diff --git a/pkgs/by-name/ba/babashka-unwrapped/default-tools-dir.patch b/pkgs/by-name/ba/babashka-unwrapped/default-tools-dir.patch
new file mode 100644
index 000000000000..ea2add6f675d
--- /dev/null
+++ b/pkgs/by-name/ba/babashka-unwrapped/default-tools-dir.patch
@@ -0,0 +1,19 @@
+diff --git a/borkdude/deps.clj b/borkdude/deps.clj
+index 281ead5..ab8dd7a 100755
+--- a/borkdude/deps.clj
++++ b/borkdude/deps.clj
+@@ -773,6 +773,14 @@ public class ClojureToolsDownloader {
+   Otherwise, use `DEPS_CLJ_TOOLS_DIR`"
+   []
+   (or
++   ;; The default (wrapped) babashka derivation sets `NIX_DEPS_CLJ_TOOLS_DIR` to a nix-store path.
++   ;; We use this custom variable here instead of the upstream `DEPS_CLJ_TOOLS_DIR` so that we don't
++   ;; affect subprocesses spawned by babashka which may themselves use `deps.clj`. Furthermore, we
++   ;; don't use the custom variable when `DEPS_CLJ_TOOLS_VERSION` is set because `deps.clj` would
++   ;; then try to store the desired tools version in the nix-store path which would of course fail
++   ;; because it's read-only (see https://github.com/NixOS/nixpkgs/issues/431312).
++   (when-not (*getenv-fn* "DEPS_CLJ_TOOLS_VERSION")
++     (*getenv-fn* "NIX_DEPS_CLJ_TOOLS_DIR"))
+     ;; legacy name
+    (*getenv-fn* "CLOJURE_TOOLS_DIR")
+    (*getenv-fn* "DEPS_CLJ_TOOLS_DIR")
diff --git a/pkgs/by-name/ba/babashka-unwrapped/package.nix b/pkgs/by-name/ba/babashka-unwrapped/package.nix
index cf4e9c77f06f..f7f2d70642af 100644
--- a/pkgs/by-name/ba/babashka-unwrapped/package.nix
+++ b/pkgs/by-name/ba/babashka-unwrapped/package.nix
@@ -4,6 +4,8 @@
   fetchurl,
   writeScript,
   installShellFiles,
+  unzip,
+  zip,
 }:
 
 buildGraalvmNativeImage (finalAttrs: {
@@ -15,7 +17,24 @@ buildGraalvmNativeImage (finalAttrs: {
     sha256 = "sha256-cVcfEt7OVKHG3I9ZSEk6mU5ULKAXJYsEEBD2D4SUZxc=";
   };
 
-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [
+    installShellFiles
+    unzip
+    zip
+  ];
+
+  dontUnpack = false;
+  unpackCmd = "unzip -d babashka $curSrc";
+
+  patches = [
+    ./default-tools-dir.patch
+  ];
+
+  preBuild = ''
+    zip -r ../babashka.jar .
+    cd ..
+    src=babashka.jar
+  '';
 
   extraNativeImageBuildArgs = [
     "-H:+ReportExceptionStackTraces"
diff --git a/pkgs/by-name/ba/babashka/package.nix b/pkgs/by-name/ba/babashka/package.nix
index 64e5a1694f03..4954e9d20e70 100644
--- a/pkgs/by-name/ba/babashka/package.nix
+++ b/pkgs/by-name/ba/babashka/package.nix
@@ -26,7 +26,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
     makeWrapper "${babashka-unwrapped}/bin/bb" "$out/bin/bb" \
       --inherit-argv0 \
-      --set-default DEPS_CLJ_TOOLS_DIR $out/clojure_tools \
+      --set NIX_DEPS_CLJ_TOOLS_DIR $out/clojure_tools \
       --set-default JAVA_HOME ${jdkBabashka}
 
     installShellCompletion --cmd bb --bash ${babashka-unwrapped}/share/bash-completion/completions/bb.bash

From 4b374356a644aa37514417363e58f220af6dd8d2 Mon Sep 17 00:00:00 2001
From: sh0uv1 <mirantuten@yandex.com>
Date: Wed, 26 Aug 2026 09:52:54 +0000
Subject: [PATCH 34/85] feishin: bump electron to v43

---
 pkgs/by-name/fe/feishin/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fe/feishin/package.nix b/pkgs/by-name/fe/feishin/package.nix
index 0ecd436e621c..bee3c1cd6da7 100644
--- a/pkgs/by-name/fe/feishin/package.nix
+++ b/pkgs/by-name/fe/feishin/package.nix
@@ -3,7 +3,7 @@
   stdenv,
   buildNpmPackage,
   fetchFromGitHub,
-  electron_41,
+  electron_43,
   mpv-unwrapped,
   fetchPnpmDeps,
   pnpmConfigHook,
@@ -27,7 +27,7 @@ let
     hash = "sha256-2UKJBUZNUpUUZIG1JFXok7YJdzqt+Ge0ykHUm8BeNcw=";
   };
 
-  electron = electron_41;
+  electron = electron_43;
 
   # Fix pnpm issue on darwin https://github.com/NixOS/nixpkgs/issues/525627
   pnpm = pnpm_11.override { nodejs-slim = nodejs-slim_latest; };

From 17bfb6b19606f4f9927217a250836bc95f9467ab Mon Sep 17 00:00:00 2001
From: sh0uv1 <mirantuten@yandex.com>
Date: Wed, 26 Aug 2026 10:02:33 +0000
Subject: [PATCH 35/85] feishin: clean up

---
 pkgs/by-name/fe/feishin/package.nix | 36 ++++++++++++++++-------------
 1 file changed, 20 insertions(+), 16 deletions(-)

diff --git a/pkgs/by-name/fe/feishin/package.nix b/pkgs/by-name/fe/feishin/package.nix
index bee3c1cd6da7..094111c60555 100644
--- a/pkgs/by-name/fe/feishin/package.nix
+++ b/pkgs/by-name/fe/feishin/package.nix
@@ -15,28 +15,25 @@
   makeDesktopItem,
   nix-update-script,
   webVersion ? false,
+  nixosTests,
 }:
 let
+  electron = electron_43;
+
+  # Fix pnpm issue on darwin https://github.com/NixOS/nixpkgs/issues/525627
+  pnpm = pnpm_11.override { nodejs-slim = nodejs-slim_latest; };
+in
+buildNpmPackage (finalAttrs: {
   pname = "feishin";
   version = "1.15.1";
 
   src = fetchFromGitHub {
     owner = "jeffvli";
     repo = "feishin";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-2UKJBUZNUpUUZIG1JFXok7YJdzqt+Ge0ykHUm8BeNcw=";
   };
 
-  electron = electron_43;
-
-  # Fix pnpm issue on darwin https://github.com/NixOS/nixpkgs/issues/525627
-  pnpm = pnpm_11.override { nodejs-slim = nodejs-slim_latest; };
-in
-buildNpmPackage {
-  inherit pname version;
-
-  inherit src;
-
   __structuredAttrs = true;
 
   npmConfigHook = pnpmConfigHook;
@@ -44,9 +41,9 @@ buildNpmPackage {
 
   npmDeps = null;
   pnpmDeps = fetchPnpmDeps {
-    inherit
+    inherit pnpm;
+    inherit (finalAttrs)
       pname
-      pnpm
       version
       src
       ;
@@ -145,12 +142,19 @@ buildNpmPackage {
     })
   ];
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    updateScript = nix-update-script { };
+
+    # add a tests
+    tests = {
+      inherit (nixosTests.feishin) caddy nginx;
+    };
+  };
 
   meta = {
     description = "Full-featured Jellyfin, Navidrome, and OpenSubsonic Compatible Music Player";
     homepage = "https://github.com/jeffvli/feishin";
-    changelog = "https://github.com/jeffvli/feishin/releases/tag/v${version}";
+    changelog = "https://github.com/jeffvli/feishin/releases/tag/v${finalAttrs.version}";
     sourceProvenance = with lib.sourceTypes; [ fromSource ];
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.unix;
@@ -161,4 +165,4 @@ buildNpmPackage {
     ];
   }
   // lib.optionalAttrs (!webVersion) { mainProgram = "feishin"; };
-}
+})

From 23484004f128eecf7a0a27e2414e7665de348dc6 Mon Sep 17 00:00:00 2001
From: Holiu618 <165534185+Holiu618@users.noreply.github.com>
Date: Sat, 22 Aug 2026 01:49:08 +0800
Subject: [PATCH 36/85] ytdownloader: 3.22.0 -> 4.0.1, electron_41 ->
 electron_43

---
 pkgs/by-name/yt/ytdownloader/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/yt/ytdownloader/package.nix b/pkgs/by-name/yt/ytdownloader/package.nix
index 6d5288b2d581..32dfdd411444 100644
--- a/pkgs/by-name/yt/ytdownloader/package.nix
+++ b/pkgs/by-name/yt/ytdownloader/package.nix
@@ -7,23 +7,23 @@
   ffmpeg-headless,
   yt-dlp,
   makeDesktopItem,
-  electron_41,
+  electron_43,
 }:
 let
-  electron = electron_41;
+  electron = electron_43;
 in
 buildNpmPackage rec {
   pname = "ytDownloader";
-  version = "3.22.0";
+  version = "4.0.1";
 
   src = fetchFromGitHub {
     owner = "aandrew-me";
     repo = "ytDownloader";
     tag = "v${version}";
-    hash = "sha256-zAHDBLQJa0FFX2esz7jVRnIY6aBwnoGp6Kr2jWDX+lg=";
+    hash = "sha256-chTaQ0nHTtdIhMo4GBSoQ6YbqDy8HNj190JNUt5nDiE=";
   };
 
-  npmDepsHash = "sha256-J/3m6HN2/gndtTrxf4rwhZtBAQUv1oQYbo8HeNLV8Xw=";
+  npmDepsHash = "sha256-Czs09QnQ7lnNjgysvSb7TFKz6t8ChvoT+1KzHFJ87SA=";
   makeCacheWritable = true;
 
   nativeBuildInputs = [

From cc451ffb44b500d6b836c27855ca49a9c2f59170 Mon Sep 17 00:00:00 2001
From: Aliaksandr Samatyia <41731334+qweered@users.noreply.github.com>
Date: Wed, 26 Aug 2026 14:27:38 +0300
Subject: [PATCH 37/85] libmateweather: remove unnecessary deletion of
 icon-theme.cache

This is handled by drop-icon-theme-cache hook
---
 pkgs/by-name/li/libmateweather/package.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/by-name/li/libmateweather/package.nix b/pkgs/by-name/li/libmateweather/package.nix
index 715c88951512..3fbcd6fd0faa 100644
--- a/pkgs/by-name/li/libmateweather/package.nix
+++ b/pkgs/by-name/li/libmateweather/package.nix
@@ -62,8 +62,6 @@ stdenv.mkDerivation (finalAttrs: {
     "--with-zoneinfo-dir=${tzdata}/share/zoneinfo"
   ];
 
-  preFixup = "rm -f $out/share/icons/mate/icon-theme.cache";
-
   enableParallelBuilding = true;
 
   passthru.updateScript = gitUpdater {

From 2fa7b1004e848b3a2cd41509cd9884fb256733bd Mon Sep 17 00:00:00 2001
From: Esteve Fernandez <esteve@apache.org>
Date: Wed, 12 Aug 2026 17:29:38 +0200
Subject: [PATCH 38/85] pitchfork: init at 2.23.0

---
 pkgs/by-name/pi/pitchfork/package.nix | 94 +++++++++++++++++++++++++++
 1 file changed, 94 insertions(+)
 create mode 100644 pkgs/by-name/pi/pitchfork/package.nix

diff --git a/pkgs/by-name/pi/pitchfork/package.nix b/pkgs/by-name/pi/pitchfork/package.nix
new file mode 100644
index 000000000000..f5bb6aa350c0
--- /dev/null
+++ b/pkgs/by-name/pi/pitchfork/package.nix
@@ -0,0 +1,94 @@
+{
+  lib,
+  fetchFromGitHub,
+  fetchPnpmDeps,
+  nodejs,
+  pnpm_10,
+  pnpmConfigHook,
+  rustPlatform,
+  stdenv,
+  ...
+}:
+
+let
+  pnpm = pnpm_10;
+in
+rustPlatform.buildRustPackage (
+  finalAttrs:
+  let
+    webui = stdenv.mkDerivation {
+      pname = "${finalAttrs.pname}-webui";
+      inherit (finalAttrs) version src;
+
+      sourceRoot = "${finalAttrs.src.name}/ui";
+      pnpmDeps = finalAttrs.pnpmDeps;
+
+      nativeBuildInputs = [
+        nodejs
+        pnpm
+        pnpmConfigHook
+      ];
+
+      buildPhase = ''
+        runHook preBuild
+
+        pnpm build
+
+        runHook postBuild
+      '';
+
+      installPhase = ''
+        runHook preInstall
+
+        mkdir -p $out
+        cp -r dist/. $out/
+
+        runHook postInstall
+      '';
+    };
+  in
+  {
+    pname = "pitchfork";
+    version = "2.23.0";
+
+    __structuredAttrs = true;
+
+    src = fetchFromGitHub {
+      owner = "jdx";
+      repo = "pitchfork";
+      tag = "v${finalAttrs.version}";
+      hash = "sha256-P3N4YquQPJ+xr/M6foK9r2EDKjOsslRVMU3aIsJr04U=";
+    };
+
+    cargoHash = "sha256-jNf0dTsZgS8CWBrGu+o1d11Nil9OgsLykxNkGxTd9aY=";
+
+    cargoDeps = rustPlatform.fetchCargoVendor {
+      inherit (finalAttrs) pname src version;
+      hash = finalAttrs.cargoHash;
+    };
+
+    pnpmDeps = fetchPnpmDeps {
+      inherit (finalAttrs) pname version src;
+      inherit pnpm;
+      sourceRoot = "${finalAttrs.src.name}/ui";
+      fetcherVersion = 3;
+      hash = "sha256-zh0JlHe6NDpsuDKsGq5Eto8Rx7gGLc7ayxV/NIhm4EQ=";
+    };
+
+    preBuild = ''
+      mkdir -p ui/dist
+      cp -r ${webui}/. ui/dist/
+    '';
+
+    doCheck = false;
+
+    meta = {
+      homepage = "https://pitchfork.jdx.dev";
+      description = "Daemons with DX";
+      changelog = "https://github.com/jdx/pitchfork/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+      license = lib.licenses.mit;
+      mainProgram = "pitchfork";
+      maintainers = with lib.maintainers; [ esteve ];
+    };
+  }
+)

From 74de58b5481e5c38f76c61947321cb4cd6c827c6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 26 Aug 2026 17:39:20 +0000
Subject: [PATCH 39/85] blender: 5.2.0 -> 5.2.1

---
 pkgs/by-name/bl/blender/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/bl/blender/package.nix b/pkgs/by-name/bl/blender/package.nix
index f8ac2e9b512d..a89b95864abd 100644
--- a/pkgs/by-name/bl/blender/package.nix
+++ b/pkgs/by-name/bl/blender/package.nix
@@ -119,12 +119,12 @@ in
 
 stdenv'.mkDerivation (finalAttrs: {
   pname = "blender";
-  version = "5.2.0";
+  version = "5.2.1";
 
   src = fetchzip {
     name = "source";
     url = "https://download.blender.org/source/blender-${finalAttrs.version}.tar.xz";
-    hash = "sha256-V2+Oc7GT31JvWccffzUaingEs8CtSFaazgQ+YdZUB7M=";
+    hash = "sha256-LXdJZDJoO9/yjkxn6qT42jv0YRpiwCiIWWGKubs3VLI=";
   };
 
   patches = [

From 10a939abcda37fd997df4716911474ed86f54c15 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 26 Aug 2026 19:53:53 +0000
Subject: [PATCH 40/85] mathic: 1.4 -> 1.5

---
 pkgs/by-name/ma/mathic/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ma/mathic/package.nix b/pkgs/by-name/ma/mathic/package.nix
index 9d90e17fa8f5..e7996a77720d 100644
--- a/pkgs/by-name/ma/mathic/package.nix
+++ b/pkgs/by-name/ma/mathic/package.nix
@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "mathic";
-  version = "1.4";
+  version = "1.5";
 
   src = fetchFromGitHub {
     owner = "Macaulay2";
     repo = "mathic";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-0/ws95MTrNXt6BhqyWjsOGyXvh2tTd48/pT6kWwQPd4=";
+    hash = "sha256-O/5fNnKiHTX/VV7ztFofRlRQZuoTmag3BNok7qFyffQ=";
   };
 
   buildInputs = [

From b908b68a5ef6b31ec7477b8789acaddee7d9e6aa Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 26 Aug 2026 23:10:14 +0000
Subject: [PATCH 41/85] hockeypuck: 2.3.3 -> 2.4

---
 pkgs/by-name/ho/hockeypuck/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ho/hockeypuck/package.nix b/pkgs/by-name/ho/hockeypuck/package.nix
index 6b726bda99b4..96f52efedbe1 100644
--- a/pkgs/by-name/ho/hockeypuck/package.nix
+++ b/pkgs/by-name/ho/hockeypuck/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "hockeypuck";
-  version = "2.3.3";
+  version = "2.4";
 
   src = fetchFromGitHub {
     owner = "hockeypuck";
     repo = "hockeypuck";
     rev = finalAttrs.version;
-    sha256 = "sha256-1AOvtAvx2OFxjJE5YhZwqdm9G8mWgS0hKPdTctU2MV4=";
+    sha256 = "sha256-EyXLOttABKMFKjXD/L1tXx7kvO2TEy2VZT8SIZJeLsI=";
   };
 
   modRoot = "src/hockeypuck/";

From 9e4abe5b1d8e3493b4276d83bd413d2c1feac987 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 27 Aug 2026 02:06:11 +0000
Subject: [PATCH 42/85] libretro.fceumm: 0-unstable-2026-07-28 ->
 0-unstable-2026-08-22

---
 pkgs/applications/emulators/libretro/cores/fceumm.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/libretro/cores/fceumm.nix b/pkgs/applications/emulators/libretro/cores/fceumm.nix
index 071ebeeeb398..e3ac9a9e5de9 100644
--- a/pkgs/applications/emulators/libretro/cores/fceumm.nix
+++ b/pkgs/applications/emulators/libretro/cores/fceumm.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "fceumm";
-  version = "0-unstable-2026-07-28";
+  version = "0-unstable-2026-08-22";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "libretro-fceumm";
-    rev = "b5e3566515c27dc66c9c20572171673126532e06";
-    hash = "sha256-MnI7SItJcFw8RmpF9BsV3d160azLG7rFmOoZ2DKnyR4=";
+    rev = "236ccdfc911e84c60fea6b9d0699c2d440a8de14";
+    hash = "sha256-BCue1mINcrIjc+45T/JpTyxhW669pUl5HgzoMPbaDj8=";
   };
 
   meta = {

From 8770da6abbdc31800c75eb772190e9fe1e8f26c8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 27 Aug 2026 03:05:15 +0000
Subject: [PATCH 43/85] ldap-manager: 1.5.1 -> 1.6.0

---
 pkgs/by-name/ld/ldap-manager/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ld/ldap-manager/package.nix b/pkgs/by-name/ld/ldap-manager/package.nix
index 1965327841eb..fd0af39b2946 100644
--- a/pkgs/by-name/ld/ldap-manager/package.nix
+++ b/pkgs/by-name/ld/ldap-manager/package.nix
@@ -8,16 +8,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "ldap-manager";
-  version = "1.5.1";
+  version = "1.6.0";
 
   src = fetchFromGitHub {
     owner = "netresearch";
     repo = "ldap-manager";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rc3JsWy8tkEzQnLygC5Y6GlEjawjO8d1RB1qxOVo404=";
+    hash = "sha256-MqR4Dj/obMpUKGDMDwEi8kQMMFQXVBPjDBby5t7RfAk=";
   };
 
-  vendorHash = "sha256-Oc7pnVFHX8uKgMgf7TRrTuDf0zjEM7KpGIenQiCNeuE=";
+  vendorHash = "sha256-ZM2MjG3roOl4PFiBuo9F8cTTVWt1ZHuNmaZFvpH804c=";
 
   excludedPackages = [
     "internal/e2e"

From 2705082f7ffaee598fdf2e82b576c0575723a11c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 27 Aug 2026 03:16:20 +0000
Subject: [PATCH 44/85] libretro.nxengine: 0-unstable-2026-04-09 ->
 0-unstable-2026-08-22

---
 pkgs/applications/emulators/libretro/cores/nxengine.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/libretro/cores/nxengine.nix b/pkgs/applications/emulators/libretro/cores/nxengine.nix
index d35837fca6fd..8c983c65afac 100644
--- a/pkgs/applications/emulators/libretro/cores/nxengine.nix
+++ b/pkgs/applications/emulators/libretro/cores/nxengine.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "nxengine";
-  version = "0-unstable-2026-04-09";
+  version = "0-unstable-2026-08-22";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "nxengine-libretro";
-    rev = "a1c45fd4d045333f4ea523e556469b545be82b0a";
-    hash = "sha256-v7mUr4GeNc/bOe4gQvtPns4/uLA+r7UFGavDdtBNj6E=";
+    rev = "fd1c0686f8b4c0aea9b5addbc077e3ad7da23bb7";
+    hash = "sha256-auignLadG47leMeN6XqIVzs1KEJ+LwLpHO/8ZC+46po=";
   };
 
   makefile = "Makefile";

From 74865bb41c32caf0c141d3a9570186836ca78b06 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Thu, 27 Aug 2026 13:46:32 +1000
Subject: [PATCH 45/85] dnscontrol: 4.46.0 -> 5.0.0

Diff: https://github.com/DNSControl/dnscontrol/compare/v4.46.0...v5.0.0

Changelog: https://github.com/DNSControl/dnscontrol/releases/tag/v5.0.0
---
 pkgs/by-name/dn/dnscontrol/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/dn/dnscontrol/package.nix b/pkgs/by-name/dn/dnscontrol/package.nix
index 5c85cf498f10..cb6d6ffe5c46 100644
--- a/pkgs/by-name/dn/dnscontrol/package.nix
+++ b/pkgs/by-name/dn/dnscontrol/package.nix
@@ -1,24 +1,24 @@
 {
   lib,
   stdenv,
-  buildGoModule,
+  buildGo127Module,
   fetchFromGitHub,
   installShellFiles,
   versionCheckHook,
 }:
 
-buildGoModule (finalAttrs: {
+buildGo127Module (finalAttrs: {
   pname = "dnscontrol";
-  version = "4.46.0";
+  version = "5.0.0";
 
   src = fetchFromGitHub {
     owner = "DNSControl";
     repo = "dnscontrol";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pckjHak61FyPV6YikUwvIAVP2NeLMUtGqn0utXaly4w=";
+    hash = "sha256-axFNUudghfk0H9U33igg60rTZd1L3leeMtIq8PWojfs=";
   };
 
-  vendorHash = "sha256-MhF/ZUPj3slDD9Pn3j4Gy0WT3iGHlF7o7sMjo6DS+y8=";
+  vendorHash = "sha256-j7OjDUDHmH2RdipzuqH5hJUUKuVe5Ij2IX1zeI/Ldm4=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From b037ad68bf9df49bbbb8a8120becd66acd5d5706 Mon Sep 17 00:00:00 2001
From: Jameel Al-Aziz <jameel@bastion.io>
Date: Sat, 15 Aug 2026 23:38:43 +0300
Subject: [PATCH 46/85] go-mockery: 3.7.2 -> 3.7.4

Upstream reworked the Taskfile in 3.7.3 to run mockery's own build and tests
with GOWORK=off, because the workspace includes ./tools and raises mockery's
dependencies (notably golang.org/x/tools) to the tools build list. Set GOWORK
in env so the module cache and the build agree, which also means the binary is
built against go.mod alone, as upstream intends. This changes vendorHash beyond
the usual version bump.

gotestsum is now built from the tools module rather than fetched with `go run`,
which needs network access, so keep using the gotestsum from nativeCheckInputs.
For the same reason the e2e scripts can no longer resolve go-task through the
workspace, so point them at the go-task in nativeCheckInputs.

https://github.com/vektra/mockery/releases/tag/v3.7.3
https://github.com/vektra/mockery/releases/tag/v3.7.4

Assisted-by: Claude Code (claude-opus-5)
---
 pkgs/by-name/go/go-mockery/package.nix | 30 +++++++++++++++++++++-----
 1 file changed, 25 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/go/go-mockery/package.nix b/pkgs/by-name/go/go-mockery/package.nix
index b772637d43e6..7a579be39ef4 100644
--- a/pkgs/by-name/go/go-mockery/package.nix
+++ b/pkgs/by-name/go/go-mockery/package.nix
@@ -10,17 +10,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "go-mockery";
-  version = "3.7.2";
+  version = "3.7.4";
 
   src = fetchFromGitHub {
     owner = "vektra";
     repo = "mockery";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lPyoWjLaRhE4SpVahJd8T3LsCyfdFMIsuxmWODRoLL0=";
+    hash = "sha256-2KhyuS6k8EyPnEVunAIamGJgePmvDVJqSyN0UlAFyvQ=";
   };
 
   proxyVendor = true;
-  vendorHash = "sha256-izMi4MqbfKX1PmNMWyCwBOWqiPZfth/ZSzsuEcTN6Pg=";
+  vendorHash = "sha256-ockGzV+nj/O6iRcscmhfx220TqJ8LACER/pOPqs21tY=";
 
   ldflags = [
     "-s"
@@ -28,7 +28,14 @@ buildGoModule (finalAttrs: {
     "-X github.com/vektra/mockery/v${lib.versions.major finalAttrs.version}/internal/logging.SemVer=v${finalAttrs.version}"
   ];
 
-  env.CGO_ENABLED = 0;
+  env = {
+    CGO_ENABLED = 0;
+
+    # go.work pulls ./tools into the workspace, which raises mockery's own
+    # dependencies to the tools build list. Build and test against go.mod
+    # alone, matching what upstream's Taskfile does.
+    GOWORK = "off";
+  };
 
   subPackages = [ "." ];
 
@@ -45,12 +52,25 @@ buildGoModule (finalAttrs: {
   prePatch = ''
     # remove test.ci's dependency on lint since we don't need it and
     # it tries to use remote golangci-lint
+    #
     # remove test.ci's git-state check, which runs `git diff --exit-code`;
     # the source has no .git directory, so the check cannot work here
+    #
+    # use gotestsum from nativeCheckInputs rather than building it from the
+    # tools module, which would need network access
     substituteInPlace Taskfile.yml \
       --replace-fail "deps: [lint]" "" \
       --replace-fail "      - task: git-state" "" \
-      --replace-fail "go run gotest.tools/gotestsum" "gotestsum"
+      --replace-fail "    deps: [tools.gotestsum]" "" \
+      --replace-fail "./tools/gotestsum{{exeExt}}" "gotestsum"
+
+    # the e2e scripts reach go-task through the workspace, which GOWORK=off
+    # rules out; use go-task from nativeCheckInputs instead
+    substituteInPlace \
+      e2e/test_mockery_generation.sh \
+      e2e/test_infinite_mocking.sh \
+      e2e/test_missing_interface/run.sh \
+      --replace-fail "go run github.com/go-task/task/v3/cmd/task" "task"
 
     # patch scripts used in e2e testing
     patchShebangs e2e

From 152688ccabe42141bf0f8e4837755f3da4fe43f6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 27 Aug 2026 04:52:43 +0000
Subject: [PATCH 47/85] cargo-zigbuild: 0.23.0 -> 0.23.2

---
 pkgs/by-name/ca/cargo-zigbuild/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ca/cargo-zigbuild/package.nix b/pkgs/by-name/ca/cargo-zigbuild/package.nix
index e8327d1ba95f..afaf16c272a6 100644
--- a/pkgs/by-name/ca/cargo-zigbuild/package.nix
+++ b/pkgs/by-name/ca/cargo-zigbuild/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-zigbuild";
-  version = "0.23.0";
+  version = "0.23.2";
 
   src = fetchFromGitHub {
     owner = "rust-cross";
     repo = "cargo-zigbuild";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Y73aPGsrSAZVxNJ1r1lS9uXmfpAwthq6NW4urKS8ab0=";
+    hash = "sha256-Woa8lcx9D5U2NyxHqLE9nIkgtvLc35lo+H+Cp+NOHKg=";
   };
 
-  cargoHash = "sha256-dt2s18B9RVwEBlun5cegoqfW1KYXFqjdScdc/Q2aDlI=";
+  cargoHash = "sha256-Q/Hf9fHxA/3EhnbWapyMak4nyZt/5HTL8osE7Nit6g0=";
 
   nativeBuildInputs = [ makeWrapper ];
 

From 7dd122b2b606cae52bed17433d2be7aebfa75b59 Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Thu, 27 Aug 2026 07:12:14 +0200
Subject: [PATCH 48/85] ty: 0.0.74 -> 0.0.75

Changelog: https://github.com/astral-sh/ty/releases/tag/0.0.75
Diff: https://github.com/astral-sh/ty/compare/0.0.74...0.0.75
---
 pkgs/by-name/ty/ty/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ty/ty/package.nix b/pkgs/by-name/ty/ty/package.nix
index fb9cbade6c06..4fffcf5b083b 100644
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -17,7 +17,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ty";
-  version = "0.0.74";
+  version = "0.0.75";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     repo = "ty";
     tag = finalAttrs.version;
     fetchSubmodules = true;
-    hash = "sha256-6obXsyfHHgPPON7rZj2cYtMdg20sv33LR05gey/w56A=";
+    hash = "sha256-hzEgbimysGMH+bQoKmTOWZl8DgaW/G1QUkI5T18UMp4=";
   };
 
   # For Darwin platforms, remove the integration test for file notifications,
@@ -39,7 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoBuildFlags = [ "--package=ty" ];
 
-  cargoHash = "sha256-kwnSLBK4H/RPUY+Nb08quRe3q9Ke5Sgmdf588b2QfUs=";
+  cargoHash = "sha256-TSvfiHsXyn1MLUwfi+9ZxWH5AqKhkPPU297lL5nL7fI=";
 
   nativeBuildInputs = [ installShellFiles ];
   buildInputs = [ rust-jemalloc-sys ];

From b48bca5f3e5757a10082b87558eba05d11245754 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 27 Aug 2026 06:12:01 +0000
Subject: [PATCH 49/85] libretro.genesis-plus-gx: 0-unstable-2026-08-14 ->
 0-unstable-2026-08-21

---
 .../emulators/libretro/cores/genesis-plus-gx.nix            | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix b/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
index 0c2631576863..2e07729a8b65 100644
--- a/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
+++ b/pkgs/applications/emulators/libretro/cores/genesis-plus-gx.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "genesis-plus-gx";
-  version = "0-unstable-2026-08-14";
+  version = "0-unstable-2026-08-21";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "Genesis-Plus-GX";
-    rev = "2d7131c5efa606f649d36e1685a8ca47c24f31b3";
-    hash = "sha256-tu/FTJDP+auXCDQ5DUbSLrRyCRdlD3dhPv2/PeBqeAc=";
+    rev = "b7e79b3641eb2e322c5ba29903352e115887e83c";
+    hash = "sha256-aitbT6hRrLd202u1FXMmJvzIwE8E6My3cA2wKEavlO8=";
   };
 
   meta = {

From 975a0cc19e6223ce7dcc947cdd8bb6c2c1fe7e6f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 27 Aug 2026 07:20:27 +0000
Subject: [PATCH 50/85] skills: 1.5.22 -> 1.5.23

---
 pkgs/by-name/sk/skills/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sk/skills/package.nix b/pkgs/by-name/sk/skills/package.nix
index d132ba001be7..776e5caec283 100644
--- a/pkgs/by-name/sk/skills/package.nix
+++ b/pkgs/by-name/sk/skills/package.nix
@@ -14,13 +14,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "skills";
-  version = "1.5.22";
+  version = "1.5.23";
 
   src = fetchFromGitHub {
     owner = "vercel-labs";
     repo = "skills";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-F3KVn4OWpGKxKPzW8L/CnnLv8m51G7aflH65vv4SrtY=";
+    hash = "sha256-qD+gGPYjgbArf1Nz5rtlJVCS/2KNTuspag/B079l014=";
   };
 
   pnpmDeps = fetchPnpmDeps {

From c3a57f0d5ce32ce19b8bc31f05fbdaa6792e7d5c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 27 Aug 2026 07:24:12 +0000
Subject: [PATCH 51/85] gogup: 1.8.0 -> 1.8.1

---
 pkgs/by-name/go/gogup/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/go/gogup/package.nix b/pkgs/by-name/go/gogup/package.nix
index f5527f225da4..dc350416c490 100644
--- a/pkgs/by-name/go/gogup/package.nix
+++ b/pkgs/by-name/go/gogup/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "gogup";
-  version = "1.8.0";
+  version = "1.8.1";
 
   src = fetchFromGitHub {
     owner = "nao1215";
     repo = "gup";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-kit/xnnkhY7N98QK4KSPW3K+mKTfttv5sHW5By4nd68=";
+    hash = "sha256-3GOdORigV+5pqFySnlsL/ZOUqAIFQicfDCzeOCFa+A0=";
   };
 
   vendorHash = "sha256-qYMUIy9yvWAedA2fL0KKoysaHHoKFJnzl58pInXpa60=";

From 34dfec22a740ba4885c70184c836fbb732aa6251 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 27 Aug 2026 07:34:46 +0000
Subject: [PATCH 52/85] python3Packages.prefect: 3.8.3 -> 3.8.4

---
 pkgs/development/python-modules/prefect/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/prefect/default.nix b/pkgs/development/python-modules/prefect/default.nix
index 464107d45118..f729604662a1 100644
--- a/pkgs/development/python-modules/prefect/default.nix
+++ b/pkgs/development/python-modules/prefect/default.nix
@@ -92,7 +92,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "prefect";
-  version = "3.8.3";
+  version = "3.8.4";
   pyproject = true;
 
   # keeps list elements containing spaces intact, which disabledTests below needs
@@ -102,7 +102,7 @@ buildPythonPackage (finalAttrs: {
     owner = "PrefectHQ";
     repo = "prefect";
     tag = finalAttrs.version;
-    hash = "sha256-C20gFzsswVOVfJiz2UcDamUSSMbvm+KVIM115ZAzEyM=";
+    hash = "sha256-o5mYaGuYDBixac99T68niXKoDOENHGfExGhs3vDEONc=";
   };
 
   postPatch = ''

From d5c312b7663bb2638b91c0b44950ec60b7d32177 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 27 Aug 2026 07:39:03 +0000
Subject: [PATCH 53/85] ocamlPackages.mirage-crypto: 2.3.0 -> 2.4.1

---
 pkgs/development/ocaml-modules/mirage-crypto/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/ocaml-modules/mirage-crypto/default.nix b/pkgs/development/ocaml-modules/mirage-crypto/default.nix
index 02772c62c66c..aa854f6ae18c 100644
--- a/pkgs/development/ocaml-modules/mirage-crypto/default.nix
+++ b/pkgs/development/ocaml-modules/mirage-crypto/default.nix
@@ -12,11 +12,11 @@ buildDunePackage (finalAttrs: {
   minimalOCamlVersion = "4.13";
 
   pname = "mirage-crypto";
-  version = "2.3.0";
+  version = "2.4.1";
 
   src = fetchurl {
     url = "https://github.com/mirage/mirage-crypto/releases/download/v${finalAttrs.version}/mirage-crypto-${finalAttrs.version}.tbz";
-    hash = "sha256-hA+/QTZgW0ofHdXAYRkyonT+O/l0ZMgqazqXMaaOII4=";
+    hash = "sha256-MyiGw2XGA1B3485namPaj3UAwVoWKLPAfhObDlUfH28=";
   };
 
   doCheck = true;

From 8e5ab8f853b59d5be26800810a9397b6d94973d2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 27 Aug 2026 07:52:30 +0000
Subject: [PATCH 54/85] tabularis: 0.20.0 -> 0.21.0

---
 pkgs/by-name/ta/tabularis/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ta/tabularis/package.nix b/pkgs/by-name/ta/tabularis/package.nix
index 1cf457556900..f1842f98f7e2 100644
--- a/pkgs/by-name/ta/tabularis/package.nix
+++ b/pkgs/by-name/ta/tabularis/package.nix
@@ -19,14 +19,14 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tabularis";
-  version = "0.20.0";
+  version = "0.21.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "TabularisDB";
     repo = "tabularis";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Q03i0EhhRPOQYkb27MwIzcGH1uA4npcD3OJbTHQG0hw=";
+    hash = "sha256-81Y5sVeDJtzD1V8cj3KQhEkhreI7NaVhrHZlH9pO/T0=";
   };
 
   strictDeps = true;
@@ -34,7 +34,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   cargoRoot = "src-tauri";
   buildAndTestSubdir = finalAttrs.cargoRoot;
 
-  cargoHash = "sha256-7UMmX8dPAYtWM8dG150RKCTdpUpVqlUaEiqio7K7ZIg=";
+  cargoHash = "sha256-Rqjjsw+Pk2H2zoyIOuDlkBhkl8DJOgri5Ko95wcaoIM=";
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;

From fce1e30281146d6799d070eef57ef97c05c02b1f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 27 Aug 2026 07:55:40 +0000
Subject: [PATCH 55/85] mango: 0.16.1 -> 0.16.2

---
 pkgs/by-name/ma/mango/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ma/mango/package.nix b/pkgs/by-name/ma/mango/package.nix
index 682c062dedc5..80b12823024c 100644
--- a/pkgs/by-name/ma/mango/package.nix
+++ b/pkgs/by-name/ma/mango/package.nix
@@ -27,13 +27,13 @@ stdenv.mkDerivation (finalAttrs: {
   __structuredAttrs = true;
   strictDeps = true;
   pname = "mango";
-  version = "0.16.1";
+  version = "0.16.2";
 
   src = fetchFromGitHub {
     owner = "mangowm";
     repo = "mango";
     tag = finalAttrs.version;
-    hash = "sha256-0mX95LpyZuMMkEKS1qTiVrpDLeuCzO5hVJdmdpr7SY0=";
+    hash = "sha256-od6lK1KOquakP/GD17fGEm1ck5EMZa/s+jhmvGrRFzk=";
   };
 
   nativeBuildInputs = [

From cf20a5063a071d48d099c1dbbbea16317dab48c5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 27 Aug 2026 08:17:09 +0000
Subject: [PATCH 56/85] amazon-ssm-agent: 3.3.5068.0 -> 3.3.5226.0

---
 pkgs/by-name/am/amazon-ssm-agent/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/am/amazon-ssm-agent/package.nix b/pkgs/by-name/am/amazon-ssm-agent/package.nix
index c75468bbd184..d72198e8c88e 100644
--- a/pkgs/by-name/am/amazon-ssm-agent/package.nix
+++ b/pkgs/by-name/am/amazon-ssm-agent/package.nix
@@ -43,13 +43,13 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "amazon-ssm-agent";
-  version = "3.3.5068.0";
+  version = "3.3.5226.0";
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "amazon-ssm-agent";
     tag = finalAttrs.version;
-    hash = "sha256-gZDYspw/SnE2lMCjfQbkdWldsc5vi9dGMQ4KX643j3g=";
+    hash = "sha256-iFk5wlcw6wnc3AjCdhFXxyNrCTdAWQNIYDFis2yTIlY=";
   };
 
   vendorHash = null;

From dccde518a45fda73284c3c4772b6556337975805 Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Thu, 27 Aug 2026 10:31:36 +0200
Subject: [PATCH 57/85] dusklight: fix aarch64 hash

---
 pkgs/by-name/du/dusklight/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/du/dusklight/package.nix b/pkgs/by-name/du/dusklight/package.nix
index 7b02a5045432..8d3088368eb9 100644
--- a/pkgs/by-name/du/dusklight/package.nix
+++ b/pkgs/by-name/du/dusklight/package.nix
@@ -52,7 +52,7 @@ let
       };
       aarch64-linux = {
         url = "https://github.com/encounter/dawn-build/releases/download/v20260603.191052/dawn-linux-aarch64.tar.gz";
-        hash = "sha256-C9pMaUOkSknwQfIw45+WIFve+noTiqud+RiQ0/kV4fA=";
+        hash = "sha256-EiNj16S0sIOWzOByiecsl2bZScBA5MOK348sqyxDchc=";
       };
     }
     .${stdenv.hostPlatform.system}

From 99ab47157a87dd50959f8b29fcddd8bde70b8ee9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 27 Aug 2026 08:48:54 +0000
Subject: [PATCH 58/85] aptakube: 1.18.8 -> 1.19.3

---
 pkgs/by-name/ap/aptakube/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ap/aptakube/package.nix b/pkgs/by-name/ap/aptakube/package.nix
index 792507ac2a29..ce7e6ca3c029 100644
--- a/pkgs/by-name/ap/aptakube/package.nix
+++ b/pkgs/by-name/ap/aptakube/package.nix
@@ -23,11 +23,11 @@ stdenvNoCC.mkDerivation (
     sources = {
       aarch64-darwin = {
         name = "Aptakube_${finalAttrs.version}_universal.dmg";
-        hash = "sha256-JWDwsvqZnEQc6Ne+aC2WbdMaEO20f8AEK7SlC3lEzUk=";
+        hash = "sha256-SgkLQ4dHEja58EDTHs6qi7CGw6mT3tKPNQxS2LKDHn0=";
       };
       x86_64-linux = {
         name = "aptakube_${finalAttrs.version}_amd64.deb";
-        hash = "sha256-JooC/fwy1zaIU2UAmDooejEbBmCChVrJ2rTsn0M8WaI=";
+        hash = "sha256-I0QkI/utkEck3WiDt9NtN5zwqfPX2GJCx4PUzLnCE58=";
       };
     };
 
@@ -42,7 +42,7 @@ stdenvNoCC.mkDerivation (
   in
   {
     pname = "aptakube";
-    version = "1.18.8";
+    version = "1.19.3";
 
     __structuredAttrs = true;
     strictDeps = true;

From 2ccccbb040eb9153a461c04b02e60cc2fe55f6c4 Mon Sep 17 00:00:00 2001
From: ceridwen15 <ceridwen@tutamail.com>
Date: Thu, 27 Aug 2026 16:11:00 +1000
Subject: [PATCH 59/85] retroshare: fix desktop entry

---
 pkgs/by-name/re/retroshare/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/re/retroshare/package.nix b/pkgs/by-name/re/retroshare/package.nix
index dc164b52c6f0..de45273237a2 100644
--- a/pkgs/by-name/re/retroshare/package.nix
+++ b/pkgs/by-name/re/retroshare/package.nix
@@ -107,6 +107,10 @@ stdenv.mkDerivation rec {
   postInstall = ''
     # BT DHT bootstrap
     cp libbitdht/src/bitdht/bdboot.txt $out/share/retroshare
+
+    substituteInPlace $out/share/applications/retroshare.desktop \
+      --replace-fail "/usr/bin/retroshare" "retroshare" \
+      --replace-fail "/usr/share/pixmaps/retroshare.xpm" "retroshare"
   '';
 
   meta = {

From 824a4b90df26d8487e6283c1227d28686a509e9d Mon Sep 17 00:00:00 2001
From: happysalada <raphael@megzari.com>
Date: Thu, 27 Aug 2026 06:41:43 -0400
Subject: [PATCH 60/85] nushellPlugins: add compatibility tests

---
 pkgs/by-name/nu/nushell/package.nix           |  5 +-
 .../nu/nushell/plugins/test-plugin-compat.nix | 47 +++++++++++++++++++
 2 files changed, 51 insertions(+), 1 deletion(-)
 create mode 100644 pkgs/by-name/nu/nushell/plugins/test-plugin-compat.nix

diff --git a/pkgs/by-name/nu/nushell/package.nix b/pkgs/by-name/nu/nushell/package.nix
index d8fed2d39945..5c957f316778 100644
--- a/pkgs/by-name/nu/nushell/package.nix
+++ b/pkgs/by-name/nu/nushell/package.nix
@@ -114,7 +114,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     updateScript = nix-update-script { };
 
     withPlugins = plugins: callPackage ./with-plugins.nix { inherit plugins; };
-    tests.withPlugins = callPackage ./plugins/test-with-plugins.nix { };
+    tests = {
+      withPlugins = callPackage ./plugins/test-with-plugins.nix { };
+      pluginCompat = callPackage ./plugins/test-plugin-compat.nix { };
+    };
   };
 
   meta = {
diff --git a/pkgs/by-name/nu/nushell/plugins/test-plugin-compat.nix b/pkgs/by-name/nu/nushell/plugins/test-plugin-compat.nix
new file mode 100644
index 000000000000..0057ad4bfadb
--- /dev/null
+++ b/pkgs/by-name/nu/nushell/plugins/test-plugin-compat.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  stdenv,
+  runCommand,
+  nushell,
+  nushellPlugins,
+}:
+let
+  # Nushell refuses to load a plugin that was not compiled against its own
+  # major/minor version, and nothing about building a plugin catches that: a
+  # stale plugin builds fine and only fails when nu tries to load it. So a
+  # nushell bump silently breaks every plugin not updated in lockstep. Load all
+  # of them here so that shows up in the build instead of on a user's machine.
+  # tryEval steps over the removal aliases, which throw when forced.
+  plugins = lib.filter (
+    p: lib.isDerivation p && lib.meta.availableOn stdenv.hostPlatform p && !(p.meta.broken or false)
+  ) (lib.filter (p: (builtins.tryEval p).success) (lib.attrValues nushellPlugins));
+
+  nuWithPlugins = nushell.withPlugins plugins;
+
+  # `plugin list` reports plugins by their registered name, which is the
+  # mainProgram without the `nu_plugin_` prefix.
+  expected = lib.sort (a: b: a < b) (
+    lib.map (p: lib.removePrefix "nu_plugin_" (baseNameOf (lib.getExe p))) plugins
+  );
+in
+runCommand "nushell-plugin-compat-test" { } ''
+  expected=${lib.escapeShellArg (lib.concatStringsSep "\n" expected)}
+
+  # nu exits non-zero when a plugin fails to load; keep going so the
+  # comparison below can report which one it was.
+  actual=$(env -u XDG_DATA_DIRS HOME=/homeless-shelter \
+    ${nuWithPlugins}/bin/nu --no-config-file -c 'plugin list | get name | sort | to text' 2>&1 || true)
+
+  if [ "$actual" != "$expected" ]; then
+    echo "FAIL: the set of loadable plugins does not match the set of non-broken plugins."
+    echo "A plugin that fails to load is compiled for a different nushell version;"
+    echo "either update it, or mark it broken in its package.nix."
+    echo "--- expected ---"
+    echo "$expected"
+    echo "--- actual ---"
+    echo "$actual"
+    exit 1
+  fi
+
+  touch $out
+''

From 8dc89315a2f62fa3216ec5e6eb4dc5461c6a85e3 Mon Sep 17 00:00:00 2001
From: happysalada <raphael@megzari.com>
Date: Thu, 27 Aug 2026 06:42:17 -0400
Subject: [PATCH 61/85] nushellPlugins.net: mark broken

---
 pkgs/by-name/nu/nushell/plugins/net/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/nu/nushell/plugins/net/package.nix b/pkgs/by-name/nu/nushell/plugins/net/package.nix
index 6e8314d80937..890c6c0057d2 100644
--- a/pkgs/by-name/nu/nushell/plugins/net/package.nix
+++ b/pkgs/by-name/nu/nushell/plugins/net/package.nix
@@ -33,7 +33,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     maintainers = with lib.maintainers; [ happysalada ];
     mainProgram = "nu_plugin_net";
     # "Plugin `net` is compiled for nushell version 0.104.0, which is not
-    # compatible with version 0.105.1"
+    # compatible with version 0.115.1"
     broken = true;
   };
 })

From 8bde2444d12ed08f60a51bf340afa3082c357721 Mon Sep 17 00:00:00 2001
From: happysalada <raphael@megzari.com>
Date: Thu, 27 Aug 2026 06:42:40 -0400
Subject: [PATCH 62/85] nushellPlugins.units: mark broken

---
 pkgs/by-name/nu/nushell/plugins/units/package.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/nu/nushell/plugins/units/package.nix b/pkgs/by-name/nu/nushell/plugins/units/package.nix
index 021ebe374490..5098814f5d78 100644
--- a/pkgs/by-name/nu/nushell/plugins/units/package.nix
+++ b/pkgs/by-name/nu/nushell/plugins/units/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nu_plugin_units";
-  version = "0.1.7";
+  version = "0.1.8";
 
   src = fetchFromGitHub {
     owner = "JosephTLyons";
     repo = "nu_plugin_units";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4donh0UlBbaEwgDxUECKTPWGLuAc9KUmrRty2Ob7ZMA=";
+    hash = "sha256-dPfEjK2Ws/cHfYdMwKbDL/gZp1ZMx6RRo7DWPcdrD7w=";
   };
 
-  cargoHash = "sha256-MjalDrjJTAHay9zcPhA8br2tOkkIzE4etL+yF5MKetY=";
+  cargoHash = "sha256-K3hzUmhEjCwhaSuC7MpZbIJGZEKoAzH+LsfK3krm5cU=";
 
   nativeBuildInputs = [ pkg-config ] ++ lib.optionals stdenv.cc.isClang [ rustPlatform.bindgenHook ];
 
@@ -30,6 +30,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
     homepage = "https://github.com/JosephTLyons/nu_plugin_units";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ mgttlinger ];
+    # "Plugin `units` is compiled for nushell version 0.106.1, which is not
+    # compatible with version 0.115.1"
     broken = true;
   };
 })

From c132f4a0b426b35534b355380a98e1bdca877738 Mon Sep 17 00:00:00 2001
From: happysalada <raphael@megzari.com>
Date: Thu, 27 Aug 2026 06:43:02 -0400
Subject: [PATCH 63/85] nushellPlugins.semver: remove as deprecated

---
 pkgs/by-name/nu/nushell/plugins/default.nix   |  8 +++--
 .../nu/nushell/plugins/semver/package.nix     | 31 -------------------
 2 files changed, 6 insertions(+), 33 deletions(-)
 delete mode 100644 pkgs/by-name/nu/nushell/plugins/semver/package.nix

diff --git a/pkgs/by-name/nu/nushell/plugins/default.nix b/pkgs/by-name/nu/nushell/plugins/default.nix
index 257486986b51..6ae93796e060 100644
--- a/pkgs/by-name/nu/nushell/plugins/default.nix
+++ b/pkgs/by-name/nu/nushell/plugins/default.nix
@@ -1,9 +1,11 @@
 {
+  lib,
+  config,
   callPackage,
   dbus,
 }:
 {
-  bson = callPackage ./bson/package.nix;
+  bson = callPackage ./bson/package.nix { };
   dbus = callPackage ./dbus/package.nix { inherit dbus; };
   desktop_notifications = callPackage ./desktop_notifications/package.nix { };
   formats = callPackage ./formats/package.nix { };
@@ -13,7 +15,9 @@
   net = callPackage ./net/package.nix { };
   polars = callPackage ./polars/package.nix { };
   query = callPackage ./query/package.nix { };
-  semver = callPackage ./semver/package.nix { };
   skim = callPackage ./skim/package.nix { };
   units = callPackage ./units/package.nix { };
 }
+// lib.optionalAttrs config.allowAliases {
+  semver = throw "nushellPlugins.semver is EOL as starting with 0.114.0, nushell natively supports semver values."; # Added 2026-08-27
+}
diff --git a/pkgs/by-name/nu/nushell/plugins/semver/package.nix b/pkgs/by-name/nu/nushell/plugins/semver/package.nix
deleted file mode 100644
index dbddc5a9d324..000000000000
--- a/pkgs/by-name/nu/nushell/plugins/semver/package.nix
+++ /dev/null
@@ -1,31 +0,0 @@
-{
-  lib,
-  rustPlatform,
-  fetchFromGitHub,
-  nix-update-script,
-}:
-
-rustPlatform.buildRustPackage (finalAttrs: {
-  pname = "nu_plugin_semver";
-  version = "0.11.17";
-
-  src = fetchFromGitHub {
-    owner = "abusch";
-    repo = "nu_plugin_semver";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-GJ3B7dENuSEZSkHV42plt7tsGLZPqqXCO3c/0ILZQ1Y=";
-  };
-
-  cargoHash = "sha256-U3wwXtvnHfbxfH5awVJbSI4OaVd/c/TsQHzaUljw99o=";
-
-  passthru.updateScript = nix-update-script { };
-
-  meta = {
-    description = "Nushell plugin to work with semver versions";
-    homepage = "https://github.com/abusch/nu_plugin_semver";
-    changelog = "https://github.com/abusch/nu_plugin_semver/blob/${finalAttrs.src.tag}/CHANGELOG.md";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ koffydrop ];
-    mainProgram = "nu_plugin_semver";
-  };
-})

From 9d543958c27ccc657d7544632b90b98515f494c2 Mon Sep 17 00:00:00 2001
From: happysalada <raphael@megzari.com>
Date: Thu, 27 Aug 2026 06:43:16 -0400
Subject: [PATCH 64/85] nushellPlugins.highlight: mark broken

---
 pkgs/by-name/nu/nushell/plugins/highlight/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/nu/nushell/plugins/highlight/package.nix b/pkgs/by-name/nu/nushell/plugins/highlight/package.nix
index 4717b939017b..8b946eb1b8d8 100644
--- a/pkgs/by-name/nu/nushell/plugins/highlight/package.nix
+++ b/pkgs/by-name/nu/nushell/plugins/highlight/package.nix
@@ -34,5 +34,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
     homepage = "https://github.com/cptpiepmatz/nu-plugin-highlight";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ mgttlinger ];
+    # "Plugin `highlight` is compiled for nushell version 0.114.1, which is
+    # not compatible with version 0.115.1"
+    broken = true;
   };
 })

From 422bd5f9a9197713b27d5b078906b7a161fd2a61 Mon Sep 17 00:00:00 2001
From: happysalada <raphael@megzari.com>
Date: Thu, 27 Aug 2026 06:43:31 -0400
Subject: [PATCH 65/85] nushellPlugins.dbus: update broken comment

---
 pkgs/by-name/nu/nushell/plugins/dbus/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/nu/nushell/plugins/dbus/package.nix b/pkgs/by-name/nu/nushell/plugins/dbus/package.nix
index d989b61def66..16acc15008d9 100644
--- a/pkgs/by-name/nu/nushell/plugins/dbus/package.nix
+++ b/pkgs/by-name/nu/nushell/plugins/dbus/package.nix
@@ -34,7 +34,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     maintainers = with lib.maintainers; [ aftix ];
     platforms = lib.platforms.linux;
     # "Plugin `dbus` is compiled for nushell version 0.101.0, which is not
-    # compatible with version 0.105.1"
+    # compatible with version 0.115.1"
     broken = true;
   };
 })

From 394e947512662ae4ddb00c6bf2ce9820551e1be6 Mon Sep 17 00:00:00 2001
From: happysalada <raphael@megzari.com>
Date: Thu, 27 Aug 2026 06:43:47 -0400
Subject: [PATCH 66/85] nushellPlugins.bson: mark broken

---
 .../by-name/nu/nushell/plugins/bson/package.nix | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/nu/nushell/plugins/bson/package.nix b/pkgs/by-name/nu/nushell/plugins/bson/package.nix
index 2b2b89d144e1..56cae445a7e7 100644
--- a/pkgs/by-name/nu/nushell/plugins/bson/package.nix
+++ b/pkgs/by-name/nu/nushell/plugins/bson/package.nix
@@ -3,11 +3,12 @@
   rustPlatform,
   fetchFromGitHub,
   nix-update-script,
-  llvmPackages,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nu_plugin_bson";
+  # NOTE: v26.1140.0 does not build: its Cargo.toml requires nu-plugin ^0.114.0
+  # while its Cargo.lock still pins 0.113.1.
   version = "26.1130.0";
 
   src = fetchFromGitHub {
@@ -19,19 +20,21 @@ rustPlatform.buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-aGUlItPfrr3Uz/t1XEXBtGM285up3A5Wva1QMKwBrg0=";
 
-  nativeBuildInputs = [
-    llvmPackages.libclang
-  ];
+  nativeBuildInputs = [ rustPlatform.bindgenHook ];
 
-  env.LIBCLANG_PATH = "${llvmPackages.libclang.lib}/lib";
+  passthru.updateScript = nix-update-script { };
 
-  passthru.update-script = nix-update-script { };
   meta = {
-    description = " Nushell plugin for BSON (Binary JSON) format `from bson` and `to bson`";
+    description = "Nushell plugin for BSON (Binary JSON) format `from bson` and `to bson`";
     homepage = "https://github.com/Kissaki/nu_plugin_bson";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ philocalyst ];
     mainProgram = "nu_plugin_bson";
     platforms = lib.platforms.unix ++ lib.platforms.windows;
+    # "Plugin `bson` is compiled for nushell version 0.113.0, which is not
+    # compatible with version 0.115.1".
+    # Upstream's main branch has already bumped to nu-plugin 0.115.0, so this
+    # should be unbroken by the next release.
+    broken = true;
   };
 })

From 2306650fff36c49b42ac5a0fab2319ae3a239b96 Mon Sep 17 00:00:00 2001
From: happysalada <raphael@megzari.com>
Date: Thu, 27 Aug 2026 06:44:04 -0400
Subject: [PATCH 67/85] nushellPlugins.skim: 0.29.1 -> 0.30.0

---
 pkgs/by-name/nu/nushell/plugins/skim/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/nu/nushell/plugins/skim/package.nix b/pkgs/by-name/nu/nushell/plugins/skim/package.nix
index ac2910848e8d..e5756ef09f9f 100644
--- a/pkgs/by-name/nu/nushell/plugins/skim/package.nix
+++ b/pkgs/by-name/nu/nushell/plugins/skim/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nu_plugin_skim";
-  version = "0.29.1";
+  version = "0.30.0";
 
   src = fetchFromGitHub {
     owner = "idanarye";
     repo = "nu_plugin_skim";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ddnn5H2NjYuv+7v4JxT56pq5Kr7N8yv+NG5gYITf4qc=";
+    hash = "sha256-bZiNUQon4x82XQKINrDYTn6IgEZmLwhhFvmYMTBLOmA=";
   };
 
-  cargoHash = "sha256-ZYG8nIh/nQ3nRGkN3pnU6j7BMR5fOx/qOYppdZdfXe0=";
+  cargoHash = "sha256-s0VU8S/V/HJJ5DPLIFvUqhxu9391PJYY/tROUbfJnDQ=";
 
   nativeBuildInputs = lib.optionals stdenv.cc.isClang [ rustPlatform.bindgenHook ];
 

From 00688dc2c47049d2216154a7da27a1f66f1754e2 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Thu, 27 Aug 2026 10:49:21 +0000
Subject: [PATCH 68/85] niks3: 1.8.0 -> 1.9.0

Diff: https://github.com/Mic92/niks3/compare/v1.8.0...v1.9.0

Changelog: https://github.com/Mic92/niks3/releases/tag/v1.9.0
---
 pkgs/by-name/ni/niks3/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ni/niks3/package.nix b/pkgs/by-name/ni/niks3/package.nix
index 2cd085f223fa..f854dda895a8 100644
--- a/pkgs/by-name/ni/niks3/package.nix
+++ b/pkgs/by-name/ni/niks3/package.nix
@@ -9,17 +9,17 @@
 
 buildGoModule (finalAttrs: {
   pname = "niks3";
-  version = "1.8.0";
+  version = "1.9.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "Mic92";
     repo = "niks3";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-86afR/fMjLRLmBEMFA6ow6SRI9T5Qe83l0em/FciW2g=";
+    hash = "sha256-mfoin/yCAdHJpwKX0VHXknbUYvEm+F5XSgMQ4oLgP/g=";
   };
 
-  vendorHash = "sha256-qkB99S/9fmSk5G9uHyQF/z+joi9JACIJWaHMrIo4ziU=";
+  vendorHash = "sha256-lql+r9+hy7XX9/aSezwweKSU/MphxvIkaT0gHf59fsc=";
 
   subPackages = [
     "cmd/niks3"

From 95a30bbf10dd8c38c6b8b22aa7ce0518c2feea0e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 27 Aug 2026 10:49:45 +0000
Subject: [PATCH 69/85] terraform-providers.spotinst_spotinst: 1.240.0 ->
 1.241.0

---
 .../networking/cluster/terraform-providers/providers.json   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 1efbb2d49223..bdd9ab20c8bd 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1256,13 +1256,13 @@
     "vendorHash": "sha256-mNEzE2eACy63BGoFOamG52JD8mvC7okhSN9hMuesTlg="
   },
   "spotinst_spotinst": {
-    "hash": "sha256-zfEZyJyD/yH1lnH1tawrX/FzKhcP4bhZKl2jreQjqR4=",
+    "hash": "sha256-CgsA+mw+8EXbDMO7t897B2Xa19o2naW2gu6qDSKrAeA=",
     "homepage": "https://registry.terraform.io/providers/spotinst/spotinst",
     "owner": "spotinst",
     "repo": "terraform-provider-spotinst",
-    "rev": "v1.240.0",
+    "rev": "v1.241.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-gAYHmSFGNEAm/LhouWlQtLFra2ZSsacR/PjrSQxTfR0="
+    "vendorHash": "sha256-o7DX6kQgt5+qNbZO3o8TfE8H/wT/8V5kZIuyT9z7+J0="
   },
   "statuscakedev_statuscake": {
     "hash": "sha256-zXBZZA+2uRN2FeGrayq0a4EBk7T+PvlBIwbuxwM7yBc=",

From 9c6a0d4b3e8f0ab2399da48039815ffc76d09e1d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 27 Aug 2026 10:53:30 +0000
Subject: [PATCH 70/85] terraform-providers.sumologic_sumologic: 3.3.0 -> 3.3.1

---
 .../networking/cluster/terraform-providers/providers.json   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 1efbb2d49223..3ed028cc6128 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -1274,13 +1274,13 @@
     "vendorHash": "sha256-9M1DsE/FPQK8TG7xCJWbU3HAJCK3p/7lxdzjO1oAfWs="
   },
   "sumologic_sumologic": {
-    "hash": "sha256-GzVXWyFQ9k6a8o7faKpAcRGj8M4NQxVLY8iw1iGFM1w=",
+    "hash": "sha256-Ql3Bc9C83IpINqkTtiZAK5kV0DvnsgpSXg5EKLjyXBs=",
     "homepage": "https://registry.terraform.io/providers/SumoLogic/sumologic",
     "owner": "SumoLogic",
     "repo": "terraform-provider-sumologic",
-    "rev": "v3.3.0",
+    "rev": "v3.3.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-nbiLH+J051XxTx+z8xGrp/DPYB7g9S4clFSWcZUKnAg="
+    "vendorHash": "sha256-h3hQfJsyvq6yv/sQAjA+9kPHHrejaF+NyBHFdchLHoA="
   },
   "sysdiglabs_sysdig": {
     "hash": "sha256-MfwzmTzikzZAg0U7W5Dmjww6Oadnr4Oq+uIQSZaRHEo=",

From 4bed936b7a860d46769d59536e8527fcbf683d9c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 27 Aug 2026 10:55:08 +0000
Subject: [PATCH 71/85] ctx7: 0.5.8 -> 0.5.9

---
 pkgs/by-name/ct/ctx7/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ct/ctx7/package.nix b/pkgs/by-name/ct/ctx7/package.nix
index 86afcd891849..aade8b81c023 100644
--- a/pkgs/by-name/ct/ctx7/package.nix
+++ b/pkgs/by-name/ct/ctx7/package.nix
@@ -16,7 +16,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "ctx7";
-  version = "0.5.8";
+  version = "0.5.9";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "upstash";
     repo = "context7";
     tag = "${finalAttrs.pname}@${finalAttrs.version}";
-    hash = "sha256-ocO8tXxooMIOWuCTpSgORRg4hjMs0o0uoBxEkaNKCu8=";
+    hash = "sha256-QBVy3KkZLuSe7sDu/im1upxLwkEG8kg3Ef8Qo761Qc4=";
   };
 
   nativeBuildInputs = [
@@ -39,7 +39,7 @@ stdenv.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 3;
-    hash = "sha256-F3c2/y3fgtPiUQOsg3hFdAp9b85AFs2mCTO1Eoa0i5E=";
+    hash = "sha256-1ZrQ+GMGgBNyycp/Xp2/meGwxaWTh+c53qgaEy30dl8=";
   };
 
   buildPhase = ''

From f01ce79aecd8e59ab8a5e1fa2c2d66c224427c22 Mon Sep 17 00:00:00 2001
From: Johannes Kirschbauer <hsjobeki@gmail.com>
Date: Thu, 27 Aug 2026 12:22:03 +0200
Subject: [PATCH 72/85] lib/modules: inline errorContext string in
 applyModuleArgs

---
 lib/modules.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/lib/modules.nix b/lib/modules.nix
index 2e5228d232cb..d79382fdcd67 100644
--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -722,10 +722,9 @@ let
       # a module will resolve strictly the attributes used as argument but
       # not their values.  The values are forwarding the result of the
       # evaluation of the option.
-      context = name: ''while evaluating the module argument `${name}' in "${key}":'';
       extraArgs = mapAttrs (
         name: _:
-        addErrorContext (context name) (
+        addErrorContext ''while evaluating the module argument `${name}' in "${key}":'' (
           args.${name} or (addErrorContext
             "noting that argument `${name}` is not externally provided, so querying `_module.args` instead, requiring `config`"
             config._module.args.${name}

From 0e21ffaea07c45edcfdf9ba2e4765928c8eda9ca Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 27 Aug 2026 12:49:55 +0000
Subject: [PATCH 73/85] libphonenumber: 9.0.37 -> 9.0.38

---
 pkgs/by-name/li/libphonenumber/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libphonenumber/package.nix b/pkgs/by-name/li/libphonenumber/package.nix
index 1e412f8e48e2..e2d007f4275c 100644
--- a/pkgs/by-name/li/libphonenumber/package.nix
+++ b/pkgs/by-name/li/libphonenumber/package.nix
@@ -15,13 +15,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libphonenumber";
-  version = "9.0.37";
+  version = "9.0.38";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "libphonenumber";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RBYLcJdnf+n4Bq+mw8EyWjJGNr6lTOHMmduV8YXKLQs=";
+    hash = "sha256-Usln8w9OyACsYBDn85kTUmsombrkaRc3qRt2oKMs+0k=";
   };
 
   patches = [

From 0e9a5ec52e470d0e207bccb7e0e4ce102e996043 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 27 Aug 2026 12:57:00 +0000
Subject: [PATCH 74/85] tomat: 2.11.0 -> 2.12.0

---
 pkgs/by-name/to/tomat/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/to/tomat/package.nix b/pkgs/by-name/to/tomat/package.nix
index 8e65b2a93ddb..60d2748e79cc 100644
--- a/pkgs/by-name/to/tomat/package.nix
+++ b/pkgs/by-name/to/tomat/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tomat";
-  version = "2.11.0";
+  version = "2.12.0";
 
   src = fetchFromGitHub {
     owner = "jolars";
     repo = "tomat";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-bHmVwtpDQCO8NS1dsilSsDBlMWotEZ3x1J/KD40vbVs=";
+    hash = "sha256-UJcUvTaFaR0I12T1MtMlXM/lFNEps8eOfaqR66OeNBI=";
   };
 
-  cargoHash = "sha256-wxVWYOMYVi8R1YpBp+KPirqubAPYA561R+maG1vgrl0=";
+  cargoHash = "sha256-b6b5fIjortiVhCgzU3Qn1w3ccsTZsuuyY6Me+ZuuUHk=";
 
   nativeBuildInputs = [
     pkg-config

From cbf5c7866dbc6ee5a200b5cc940dee843c38d806 Mon Sep 17 00:00:00 2001
From: 06kellyjac <dev@j-k.io>
Date: Thu, 27 Aug 2026 14:25:38 +0100
Subject: [PATCH 75/85] librechat: 0.8.6 -> 0.8.7

Changelog: https://www.librechat.ai/changelog/v0.8.7
---
 pkgs/by-name/li/librechat/package.nix | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/li/librechat/package.nix b/pkgs/by-name/li/librechat/package.nix
index 45b334359418..fc875724100e 100644
--- a/pkgs/by-name/li/librechat/package.nix
+++ b/pkgs/by-name/li/librechat/package.nix
@@ -2,7 +2,6 @@
   lib,
   buildNpmPackage,
   fetchFromGitHub,
-  nodejs_22,
   pkg-config,
   node-gyp,
   vips,
@@ -12,13 +11,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "librechat";
-  version = "0.8.6";
+  version = "0.8.7";
 
   src = fetchFromGitHub {
     owner = "danny-avila";
     repo = "LibreChat";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cWgjsLN7NnJNJ1hYPo0h3lh+W4wi9qqttevNfNrYdXg=";
+    hash = "sha256-egnmkYpQS/AshMmXP5C8qhwA+7TPZYnu0ct552HFjGg=";
   };
 
   patches = [
@@ -35,10 +34,7 @@ buildNpmPackage (finalAttrs: {
   ];
 
   npmDepsFetcherVersion = 2;
-  npmDepsHash = "sha256-Y+oC9eigwzL8jei5Hs4YOf32oFgULPmHrSDApxPKh+0=";
-
-  # npm dependency install fails with nodejs_24: https://github.com/NixOS/nixpkgs/issues/474535
-  nodejs = nodejs_22;
+  npmDepsHash = "sha256-U2DzvfzKCmAYLFG0FbFcng5goj1mYCjTpJuQ36fVNuA=";
 
   nativeBuildInputs = [
     pkg-config
@@ -61,7 +57,12 @@ buildNpmPackage (finalAttrs: {
 
   # npmConfigHook only patches the root node_modules
   postConfigure = ''
-    patchShebangs client/node_modules
+    patchShebangs $(find "$PWD" -type d -name node_modules -prune ! -path "$PWD/node_modules" -print)
+  '';
+
+  preInstall = ''
+    # not sure why this is something npm pack tries to keep
+    rm -rf ./packages/data-schemas/node_modules/winston-transport/.nyc_output
   '';
 
   # For reasons beyond my understanding, the api and client directory disappears after the build finishes.

From 87b52cf9d5b30c7b472120ae56b4b6dbfdd6330b Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Thu, 27 Aug 2026 13:45:48 +0000
Subject: [PATCH 76/85] linux_7_2: 7.2 -> 7.2.1

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 82a08cb36728..b8f6db9e9480 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -40,8 +40,8 @@
         "lts": false
     },
     "7.2": {
-        "version": "7.2",
-        "hash": "sha256:1cq2jj1g06gav6xvbxfb1l5jlp43b52ffjvg08ckix8d9k8z7zpr",
+        "version": "7.2.1",
+        "hash": "sha256:1csp8m7a5ws9j35x7bc2cb8067illqx5v1cc0sz8zsi8ia60jn21",
         "lts": false
     }
 }

From aae95aaa5f8bf4dc3d6dc9c273cefea329430fdc Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Thu, 27 Aug 2026 13:46:02 +0000
Subject: [PATCH 77/85] linux_7_1: 7.1.10 -> 7.1.11

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index b8f6db9e9480..248faff3311c 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -35,8 +35,8 @@
         "lts": true
     },
     "7.1": {
-        "version": "7.1.10",
-        "hash": "sha256:16crmblk96nwjzpbb22fpcj0r4ky63f1njvliv4vxwq2g9lz9lk7",
+        "version": "7.1.11",
+        "hash": "sha256:1z0s6pv34d5mk75jxj05s6hzy2x6vahc5dxxbkp5pirfiw6m8a9h",
         "lts": false
     },
     "7.2": {

From 5f8a9ee2d608b9d6a3f349f6ea6b7c98b0d9c9a4 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Thu, 27 Aug 2026 13:46:05 +0000
Subject: [PATCH 78/85] linux_6_18: 6.18.46 -> 6.18.47

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 248faff3311c..8803714beb71 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -30,8 +30,8 @@
         "lts": true
     },
     "6.18": {
-        "version": "6.18.46",
-        "hash": "sha256:186c850qncfvwqnvmllzkiqj6xfrh6h4nh65d4lwq0lbh29lpm7m",
+        "version": "6.18.47",
+        "hash": "sha256:0678vsivrr3qw2pdg2ch26a2kx365cm1gy3w21rm86k08gyvlgqv",
         "lts": true
     },
     "7.1": {

From 2527a96fefdd33305a3d020c7303b541c7e4fcd0 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Thu, 27 Aug 2026 13:46:16 +0000
Subject: [PATCH 79/85] linux_6_12: 6.12.105 -> 6.12.106

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 8803714beb71..4150f664f99a 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -25,8 +25,8 @@
         "lts": true
     },
     "6.12": {
-        "version": "6.12.105",
-        "hash": "sha256:0ggni16ill7acfxsmwr96q2zfcia1v19sif32csv2acm24g80dpb",
+        "version": "6.12.106",
+        "hash": "sha256:11fpivj271143v8rdk4jifbpxxrd3saphq9za027d76rc5bmb4h3",
         "lts": true
     },
     "6.18": {

From 77803f5df70ff08b24db948ff4d232053c4fea0e Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Thu, 27 Aug 2026 13:46:40 +0000
Subject: [PATCH 80/85] linux_6_6: 6.6.153 -> 6.6.154

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 4150f664f99a..37195f942434 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -20,8 +20,8 @@
         "lts": true
     },
     "6.6": {
-        "version": "6.6.153",
-        "hash": "sha256:0mwmr68vz1a296gkizwywvrjr8i86wg3crk777p0sli3i437gg1r",
+        "version": "6.6.154",
+        "hash": "sha256:0d02xm0xglyhac9iyf01a01ab0kp0ghkar8qq6gj6l5h7pw01vpd",
         "lts": true
     },
     "6.12": {

From de42cfab7ba4dddda22e8154f9861aa5424b0d4f Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Thu, 27 Aug 2026 13:46:58 +0000
Subject: [PATCH 81/85] linux_6_1: 6.1.184 -> 6.1.185

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 37195f942434..8f25c96ed449 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -5,8 +5,8 @@
         "lts": false
     },
     "6.1": {
-        "version": "6.1.184",
-        "hash": "sha256:1facdyxlvcmfkiman0jzq6nvjs81h51arzmyl1pqam30bc47c2cn",
+        "version": "6.1.185",
+        "hash": "sha256:0x1639znr91szyahgj2ni7ymcm46dmm41ispfx4jdikx2fhxjr1q",
         "lts": true
     },
     "5.15": {

From 213f59ec5f06e2eaec0b45390b75275c00f86fe5 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Thu, 27 Aug 2026 13:47:18 +0000
Subject: [PATCH 82/85] linux_5_15: 5.15.217 -> 5.15.218

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 8f25c96ed449..65ba1f5c94f5 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -10,8 +10,8 @@
         "lts": true
     },
     "5.15": {
-        "version": "5.15.217",
-        "hash": "sha256:1rd5ffv9j3d5g2iygapjgkmqpsqfq69xyig3jifmmr5x9wsgs873",
+        "version": "5.15.218",
+        "hash": "sha256:0dpjimmxs648j9gri7h3flfimb1647a8629pgsvyxsgk6k8ip063",
         "lts": true
     },
     "5.10": {

From a3d20154eed4b2170314bba55ddd83356f779f28 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Thu, 27 Aug 2026 13:47:35 +0000
Subject: [PATCH 83/85] linux_5_10: 5.10.266 -> 5.10.267

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 65ba1f5c94f5..956e33771b40 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -15,8 +15,8 @@
         "lts": true
     },
     "5.10": {
-        "version": "5.10.266",
-        "hash": "sha256:1zisyafmky3s4byxh98gg8q4gw702gkcp2krf1q6z94hjfza63ll",
+        "version": "5.10.267",
+        "hash": "sha256:01migk31fib50zgqf8rqmm71cff8s93msvy20sy8mj22mi80fi2v",
         "lts": true
     },
     "6.6": {

From 1f48af598978461513703805175face70df8822f Mon Sep 17 00:00:00 2001
From: Sandro <sandro.jaeckel@gmail.com>
Date: Thu, 27 Aug 2026 15:49:20 +0200
Subject: [PATCH 84/85] pgschema: removed commented code

---
 pkgs/by-name/pg/pgschema/package.nix | 2 --
 1 file changed, 2 deletions(-)

diff --git a/pkgs/by-name/pg/pgschema/package.nix b/pkgs/by-name/pg/pgschema/package.nix
index 6d826859b09f..397d3bb6a2c7 100644
--- a/pkgs/by-name/pg/pgschema/package.nix
+++ b/pkgs/by-name/pg/pgschema/package.nix
@@ -29,8 +29,6 @@ buildGoModule (finalAttrs: {
     "-w"
     "-X"
     "github.com/pgplex/pgschema/cmd.GitCommit=${finalAttrs.src.rev}"
-    # "-X"
-    # "github.com/pgplex/pgschema/cmd.BuildDate=${buildDate}"
     "-X"
     "github.com/pgplex/pgschema/internal/postgres.binariesPath=${postgresql}"
   ];

From 906422d7dc6cc7f859750cdbadfaa388dd09b813 Mon Sep 17 00:00:00 2001
From: Sandro <sandro.jaeckel@gmail.com>
Date: Thu, 27 Aug 2026 15:51:59 +0200
Subject: [PATCH 85/85] pitchfork: remove unused 3 dots

---
 pkgs/by-name/pi/pitchfork/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/pi/pitchfork/package.nix b/pkgs/by-name/pi/pitchfork/package.nix
index f5bb6aa350c0..a85640f5ebbd 100644
--- a/pkgs/by-name/pi/pitchfork/package.nix
+++ b/pkgs/by-name/pi/pitchfork/package.nix
@@ -7,7 +7,6 @@
   pnpmConfigHook,
   rustPlatform,
   stdenv,
-  ...
 }:
 
 let