Merge staging-next into staging

2026-09-29 03:10:19 +00:00 · 2026-09-21 00:27:24 +00:00
parent 29698dbb12 e583ea4a3b
commit b7ab04901e
129 changed files with 3927 additions and 4302 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5592,12 +5592,6 @@
    githubId = 1736138;
    email = "cococolanosugar@gmail.com";
  };
-  coconnor = {
-    email = "coreyoconnor@gmail.com";
-    github = "coreyoconnor";
-    githubId = 34317;
-    name = "Corey O'Connor";
-  };
  code-asher = {
    email = "ash@coder.com";
    github = "code-asher";
@@ -32298,6 +32292,14 @@
    githubId = 65394961;
    name = "Yves Straten";
  };
+  yvnth = {
+    name = "Yashwanth Prasannakumar";
+    github = "yvnth";
+    githubId = 201552597;
+    email = "yashupress@gmail.com";
+    keys = [ { fingerprint = "D9AA B78D 42E1 4B5C 08C0  C2BE 9012 0221 65D9 7825"; } ];
+    matrix = "@yvnth:matrix.org";
+  };
  yzx9 = {
    email = "yuan.zx@outlook.com";
    github = "yzx9";
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@@ -1087,12 +1087,6 @@
  "module-services-jitsi-configuration": [
    "index.html#module-services-jitsi-configuration"
  ],
-  "module-services-honk": [
-    "index.html#module-services-honk"
-  ],
-  "module-services-honk-basic-usage": [
-    "index.html#module-services-honk-basic-usage"
-  ],
  "module-services-hatsu": [
    "index.html#module-services-hatsu"
  ],
@@ -2952,5 +2946,10 @@
  ],
  "ch-reference": [
    "index.html#ch-reference"
+  ],
+  "sec-release-26.05-incompatibilities-services-honk-removed": [
+    "release-notes.html#sec-release-26.05-incompatibilities-services-honk-removed",
+    "index.html#module-services-honk",
+    "index.html#module-services-honk-basic-usage"
  ]
 }
--- a/nixos/doc/manual/release-notes/rl-2205.section.md
+++ b/nixos/doc/manual/release-notes/rl-2205.section.md
@@ -135,7 +135,7 @@ In addition to numerous new and upgraded packages, this release has the followin

 - [prometheus-pve-exporter](https://github.com/prometheus-pve/prometheus-pve-exporter), a tool that exposes information from the Proxmox VE API for use by Prometheus. Available as [services.prometheus.exporters.pve](#opt-services.prometheus.exporters.pve.enable).

- [prosody-filer](https://github.com/ThomasLeister/prosody-filer), a server for handling XMPP HTTP Upload requests. Available at [services.prosody-filer](#opt-services.prosody-filer.enable).
+- [prosody-filer](https://github.com/ThomasLeister/prosody-filer), a server for handling XMPP HTTP Upload requests. Available at `services.prosody-filer`.

 - [Public Inbox](https://public-inbox.org), an "archives first" approach to mailing lists. Available as [services.public-inbox](#opt-services.public-inbox.enable).

--- a/nixos/doc/manual/release-notes/rl-2311.section.md
+++ b/nixos/doc/manual/release-notes/rl-2311.section.md
@@ -1044,9 +1044,8 @@ Make sure to also check the many updates in the [Nixpkgs library](#sec-release-2
  wrapper around Z-Wave JS to access it via a WebSocket. Available as
  [services.zwave-js](#opt-services.zwave-js.enable).

- [Honk](https://humungus.tedunangst.com/r/honk), a complete ActivityPub server
-  with minimal setup and support costs. Available as
-  [services.honk](#opt-services.honk.enable).
+- Honk, a complete ActivityPub server with minimal setup and support costs.
+  Available as services.honk.

 - [ferretdb](https://www.ferretdb.io/), an open-source proxy, converting the
  MongoDB 6.0+ wire protocol queries to PostgreSQL or SQLite. Available as
--- a/nixos/doc/manual/release-notes/rl-2605.section.md
+++ b/nixos/doc/manual/release-notes/rl-2605.section.md
@@ -416,6 +416,8 @@ See <https://github.com/NixOS/nixpkgs/issues/481673>.

 - `programs.benchexec.enable = true` no longer sets `programs.pqos-wrapper.enable = true` as the corresponding module has been deleted.

+- []{#sec-release-26.05-incompatibilities-services-honk-removed} `services.honk` has been removed due to lack of maintenance upstream, and source repository is now no longer existing.
+
 ## Other Notable Changes {#sec-release-26.05-notable-changes}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -298,6 +298,9 @@

 - The COSMIC desktop module now enables by default `system76-power` and `system76-scheduler` following upstream recommended packages. The previous power managment service can be enabled back by setting `services.power-profiles-daemon.enable = true`.

+- The `programs.dms-shell.enableVPN`, `enableDynamicTheming`, `enableAudioWavelength`, and `enableCalendarEvents` options have been removed. `matugen` and `cava` are now included in the default DMS environment and can be excluded with `programs.dms-shell.excludePackages`. Networking and calendar backends are configured separately.
+- `programs.dms-shell` no longer enables `services.power-profiles-daemon` by default. Configure a power profile provider separately.
+
 ## Other Notable Changes {#sec-release-26.11-notable-changes}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1741,7 +1741,6 @@
  ./services/web-apps/hledger-web.nix
  ./services/web-apps/homebox.nix
  ./services/web-apps/homer.nix
-  ./services/web-apps/honk.nix
  ./services/web-apps/icingaweb2/icingaweb2.nix
  ./services/web-apps/icingaweb2/module-monitoring.nix
  ./services/web-apps/ifm.nix
@@ -1830,7 +1829,6 @@
  ./services/web-apps/pretalx.nix
  ./services/web-apps/pretix.nix
  ./services/web-apps/privatebin.nix
-  ./services/web-apps/prosody-filer.nix
  ./services/web-apps/readeck.nix
  ./services/web-apps/remark42.nix
  ./services/web-apps/reposilite.nix
--- a/nixos/modules/programs/wayland/dms-shell.nix
+++ b/nixos/modules/programs/wayland/dms-shell.nix
@@ -2,6 +2,7 @@
  config,
  lib,
  pkgs,
+  utils,
  ...
 }:

@@ -12,8 +13,6 @@ let
    mkIf
    mkPackageOption
    types
-    optional
-    optionals
    mapAttrs
    mapAttrs'
    filterAttrs
@@ -27,15 +26,6 @@ let
  ];

  builtInRemovedMsg = "This is now built-in in DMS and doesn't need additional dependencies.";
-
-  optionalPackages =
-    optionals cfg.enableVPN [
-      pkgs.glib
-      pkgs.networkmanager
-    ]
-    ++ optional cfg.enableDynamicTheming pkgs.matugen
-    ++ optional cfg.enableAudioWavelength pkgs.cava
-    ++ optional cfg.enableCalendarEvents pkgs.khal;
 in
 {
  imports = [
@@ -47,6 +37,18 @@ in
    (lib.mkRemovedOptionModule (path ++ [ "enableClipboard" ]) builtInRemovedMsg)
    (lib.mkRemovedOptionModule (path ++ [ "enableSystemMonitoring" ]) builtInRemovedMsg)
    (lib.mkRemovedOptionModule (path ++ [ "enableClipboardPaste" ]) builtInRemovedMsg)
+    (lib.mkRemovedOptionModule (path ++ [ "enableVPN" ])
+      "Networking backends are detected by DMS at runtime. Configure the desired networking service separately."
+    )
+    (lib.mkRemovedOptionModule (path ++ [ "enableDynamicTheming" ])
+      "matugen is included in the default DMS environment. Use programs.dms-shell.excludePackages to exclude it."
+    )
+    (lib.mkRemovedOptionModule (path ++ [ "enableAudioWavelength" ])
+      "cava is included in the default DMS environment. Use programs.dms-shell.excludePackages to exclude it."
+    )
+    (lib.mkRemovedOptionModule (
+      path ++ [ "enableCalendarEvents" ]
+    ) "Install a supported calendar backend separately and select it in DMS settings.")
  ];

  options.programs.dms-shell = {
@@ -54,6 +56,12 @@ in

    package = mkPackageOption pkgs "dms-shell" { };

+    excludePackages = mkOption {
+      type = types.listOf types.package;
+      default = [ ];
+      description = "Which packages DMS should exclude from its default environment.";
+    };
+
    systemd = {
      enable = mkOption {
        type = types.bool;
@@ -86,50 +94,6 @@ in
      };
    };

-    enableVPN = mkOption {
-      type = types.bool;
-      default = true;
-      description = ''
-        Whether to install dependencies required for VPN widgets.
-        This enables VPN status monitoring and management through NetworkManager.
-
-        Requires: glib, networkmanager
-      '';
-    };
-
-    enableDynamicTheming = mkOption {
-      type = types.bool;
-      default = true;
-      description = ''
-        Whether to install dependencies required for dynamic theming support.
-        This enables automatic theme generation based on wallpapers and other sources.
-
-        Requires: matugen
-      '';
-    };
-
-    enableAudioWavelength = mkOption {
-      type = types.bool;
-      default = true;
-      description = ''
-        Whether to install dependencies required for audio wavelength visualization.
-        This enables audio spectrum and waveform visualizer widgets.
-
-        Requires: cava
-      '';
-    };
-
-    enableCalendarEvents = mkOption {
-      type = types.bool;
-      default = true;
-      description = ''
-        Whether to install dependencies required for calendar events support.
-        This enables calendar widgets that display events and reminders via khal.
-
-        Requires: khal
-      '';
-    };
-
    quickshell = {
      package = mkPackageOption pkgs "quickshell" { };
    };
@@ -180,11 +144,12 @@ in
      path = lib.mkForce [ ];
    };

-    environment.systemPackages = [
+    environment.systemPackages = utils.removePackagesByName [
      cfg.package
      cfg.quickshell.package
-    ]
-    ++ optionalPackages;
+      pkgs.matugen
+      pkgs.cava
+    ] cfg.excludePackages;

    environment.etc =
      mapAttrs'
@@ -198,7 +163,6 @@ in
          }) (filterAttrs (n: v: v.enable) cfg.plugins)
        );

-    services.power-profiles-daemon.enable = lib.mkDefault true;
    services.accounts-daemon.enable = lib.mkDefault true;
    hardware.i2c.enable = lib.mkDefault true;
    hardware.graphics.enable = lib.mkDefault true;
--- a/nixos/modules/rename.nix
+++ b/nixos/modules/rename.nix
@@ -242,6 +242,10 @@ in
      ]
      "The grafana-agent module has been removed. Consider migrating to `grafana-alloy` (`services.alloy.enable`). See <https://grafana.com/docs/alloy/latest/set-up/migrate/>"
    )
+    (mkRemovedOptionModule [
+      "services"
+      "honk"
+    ] "The honk module has been removed.")
    (mkRemovedOptionModule
      [
        "services"
@@ -332,6 +336,9 @@ in
    (mkRemovedOptionModule [ "services" "prey" ] ''
      prey-bash-client is deprecated upstream
    '')
+    (mkRemovedOptionModule [ "services" "prosody-filer" ] ''
+      The Prosody Filer package and module have been removed because the project was discontinued upstream. Use Prosody's built-in `services.prosody.httpFileShare` support or Rusty Filer instead.
+    '')
    (mkRemovedOptionModule [
      "services"
      "quagga"
--- a/nixos/modules/services/networking/networkmanager.nix
+++ b/nixos/modules/services/networking/networkmanager.nix
@@ -241,14 +241,13 @@ in
        default = [ ];
        example = literalExpression ''
          with pkgs; [
-            networkmanager-fortisslvpn
            networkmanager-iodine
+            networkmanager-libreswan
            networkmanager-l2tp
            networkmanager-openconnect
            networkmanager-openvpn
            networkmanager-sstp
            networkmanager-strongswan
-            networkmanager-vpnc
          ]
        '';
        description = ''
--- a/nixos/modules/services/web-apps/honk.md
+++ b/nixos/modules/services/web-apps/honk.md
@@ -1,23 +0,0 @@
-# Honk {#module-services-honk}
-
-With Honk on NixOS you can quickly configure a complete ActivityPub server with
-minimal setup and support costs.
-
-## Basic usage {#module-services-honk-basic-usage}
-
-A minimal configuration looks like this:
-
-```nix
-{
-  services.honk = {
-    enable = true;
-    host = "0.0.0.0";
-    port = 8080;
-    username = "username";
-    passwordFile = "/etc/honk/password.txt";
-    servername = "honk.example.com";
-  };
-
-  networking.firewall.allowedTCPPorts = [ 8080 ];
-}
-```
--- a/nixos/modules/services/web-apps/honk.nix
+++ b/nixos/modules/services/web-apps/honk.nix
@@ -1,158 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-let
-  cfg = config.services.honk;
-
-  honk-initdb-script =
-    cfg:
-    pkgs.writeShellApplication {
-      name = "honk-initdb-script";
-
-      runtimeInputs = with pkgs; [ coreutils ];
-
-      text = ''
-        PW=$(cat "$CREDENTIALS_DIRECTORY/honk_passwordFile")
-
-        echo -e "${cfg.username}\n''$PW\n${cfg.host}:${toString cfg.port}\n${cfg.servername}" | ${lib.getExe cfg.package} -datadir "$STATE_DIRECTORY" init
-      '';
-    };
-in
-{
-  options = {
-    services.honk = {
-      enable = lib.mkEnableOption "the Honk server";
-      package = lib.mkPackageOption pkgs "honk" { };
-
-      host = lib.mkOption {
-        default = "127.0.0.1";
-        description = ''
-          The host name or IP address the server should listen to.
-        '';
-        type = lib.types.str;
-      };
-
-      port = lib.mkOption {
-        default = 8080;
-        description = ''
-          The port the server should listen to.
-        '';
-        type = lib.types.port;
-      };
-
-      username = lib.mkOption {
-        description = ''
-          The admin account username.
-        '';
-        type = lib.types.str;
-      };
-
-      passwordFile = lib.mkOption {
-        description = ''
-          Password for admin account.
-          NOTE: Should be string not a store path, to prevent the password from being world readable
-        '';
-        type = lib.types.path;
-      };
-
-      servername = lib.mkOption {
-        description = ''
-          The server name.
-        '';
-        type = lib.types.str;
-      };
-
-      extraJS = lib.mkOption {
-        default = null;
-        description = ''
-          An extra JavaScript file to be loaded by the client.
-        '';
-        type = lib.types.nullOr lib.types.path;
-      };
-
-      extraCSS = lib.mkOption {
-        default = null;
-        description = ''
-          An extra CSS file to be loaded by the client.
-        '';
-        type = lib.types.nullOr lib.types.path;
-      };
-    };
-  };
-
-  config = lib.mkIf cfg.enable {
-    assertions = [
-      {
-        assertion = cfg.username or "" != "";
-        message = ''
-          You have to define a username for Honk (`services.honk.username`).
-        '';
-      }
-      {
-        assertion = cfg.servername or "" != "";
-        message = ''
-          You have to define a servername for Honk (`services.honk.servername`).
-        '';
-      }
-    ];
-
-    systemd.services.honk-initdb = {
-      description = "Honk server database setup";
-      requiredBy = [ "honk.service" ];
-      before = [ "honk.service" ];
-
-      serviceConfig = {
-        LoadCredential = [
-          "honk_passwordFile:${cfg.passwordFile}"
-        ];
-        Type = "oneshot";
-        StateDirectory = "honk";
-        DynamicUser = true;
-        RemainAfterExit = true;
-        ExecStart = lib.getExe (honk-initdb-script cfg);
-        PrivateTmp = true;
-      };
-
-      unitConfig = {
-        ConditionPathExists = [
-          # Skip this service if the database already exists
-          "!%S/honk/honk.db"
-        ];
-      };
-    };
-
-    systemd.services.honk = {
-      description = "Honk server";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
-      bindsTo = [ "honk-initdb.service" ];
-      preStart = ''
-        mkdir -p $STATE_DIRECTORY/views
-        ${lib.optionalString (cfg.extraJS != null) "ln -fs ${cfg.extraJS} $STATE_DIRECTORY/views/local.js"}
-        ${lib.optionalString (
-          cfg.extraCSS != null
-        ) "ln -fs ${cfg.extraCSS} $STATE_DIRECTORY/views/local.css"}
-        ${lib.getExe cfg.package} -datadir $STATE_DIRECTORY -viewdir ${cfg.package}/share/honk backup $STATE_DIRECTORY/backup
-        ${lib.getExe cfg.package} -datadir $STATE_DIRECTORY -viewdir ${cfg.package}/share/honk upgrade
-        ${lib.getExe cfg.package} -datadir $STATE_DIRECTORY -viewdir ${cfg.package}/share/honk cleanup
-      '';
-      serviceConfig = {
-        ExecStart = ''
-          ${lib.getExe cfg.package} -datadir $STATE_DIRECTORY -viewdir ${cfg.package}/share/honk
-        '';
-        StateDirectory = "honk";
-        DynamicUser = true;
-        PrivateTmp = "yes";
-        Restart = "on-failure";
-      };
-    };
-  };
-
-  meta = {
-    maintainers = [ ];
-    doc = ./honk.md;
-  };
-}
--- a/nixos/modules/services/web-apps/prosody-filer.nix
+++ b/nixos/modules/services/web-apps/prosody-filer.nix
@@ -1,98 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-with lib;
-let
-
-  cfg = config.services.prosody-filer;
-
-  settingsFormat = pkgs.formats.toml { };
-  configFile = settingsFormat.generate "prosody-filer.toml" cfg.settings;
-in
-{
-
-  options = {
-    services.prosody-filer = {
-      enable = mkEnableOption "Prosody Filer XMPP upload file server";
-
-      settings = mkOption {
-        description = ''
-          Configuration for Prosody Filer.
-          Refer to <https://github.com/ThomasLeister/prosody-filer#configure-prosody-filer> for details on supported values.
-        '';
-
-        type = settingsFormat.type;
-
-        example = {
-          secret = "mysecret";
-          storeDir = "/srv/http/nginx/prosody-upload";
-        };
-
-        defaultText = literalExpression ''
-          {
-            listenport = mkDefault "127.0.0.1:5050";
-            uploadSubDir = mkDefault "upload/";
-          }
-        '';
-      };
-    };
-  };
-
-  config = mkIf cfg.enable {
-    services.prosody-filer.settings = {
-      listenport = mkDefault "127.0.0.1:5050";
-      uploadSubDir = mkDefault "upload/";
-    };
-
-    users.users.prosody-filer = {
-      group = "prosody-filer";
-      isSystemUser = true;
-    };
-
-    users.groups.prosody-filer = { };
-
-    systemd.services.prosody-filer = {
-      description = "Prosody file upload server";
-      wantedBy = [ "multi-user.target" ];
-      after = [ "network.target" ];
-
-      serviceConfig = {
-        User = "prosody-filer";
-        Group = "prosody-filer";
-        ExecStart = "${pkgs.prosody-filer}/bin/prosody-filer -config ${configFile}";
-        Restart = "on-failure";
-        CapabilityBoundingSet = "";
-        NoNewPrivileges = true;
-        PrivateDevices = true;
-        PrivateTmp = true;
-        PrivateMounts = true;
-        ProtectHome = true;
-        ProtectClock = true;
-        ProtectProc = "noaccess";
-        ProcSubset = "pid";
-        ProtectKernelLogs = true;
-        ProtectKernelModules = true;
-        ProtectKernelTunables = true;
-        ProtectControlGroups = true;
-        ProtectHostname = true;
-        RestrictSUIDSGID = true;
-        RestrictRealtime = true;
-        RestrictNamespaces = true;
-        LockPersonality = true;
-        RemoveIPC = true;
-        RestrictAddressFamilies = [
-          "AF_INET"
-          "AF_INET6"
-        ];
-        SystemCallFilter = [
-          "@system-service"
-          "~@privileged"
-        ];
-      };
-    };
-  };
-}
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -876,7 +876,6 @@ in
  homebridge = runTest ./homebridge.nix;
  homepage-dashboard = runTest ./homepage-dashboard.nix;
  homer = handleTest ./homer { };
-  honk = runTest ./honk.nix;
  hoogle = runTest ./hoogle.nix;
  hostname = import ./hostname.nix {
    inherit pkgs runTest;
--- a/nixos/tests/honk.nix
+++ b/nixos/tests/honk.nix
@@ -1,34 +0,0 @@
-{ lib, ... }:
-
-{
-  name = "honk-server";
-
-  nodes = {
-    machine =
-      { pkgs, ... }:
-      {
-        services.honk = {
-          enable = true;
-          host = "0.0.0.0";
-          port = 8080;
-          username = "username";
-          passwordFile = "${pkgs.writeText "honk-password" "secure"}";
-          servername = "servername";
-        };
-      };
-  };
-
-  testScript = ''
-    machine.start()
-    machine.wait_for_unit("honk.service")
-    machine.wait_for_open_port(8080)
-
-    machine.stop_job("honk")
-    machine.wait_for_closed_port(8080)
-
-    machine.start_job("honk")
-    machine.wait_for_open_port(8080)
-  '';
-
-  meta.maintainers = [ ];
-}
--- a/nixos/tests/miracle-wm.nix
+++ b/nixos/tests/miracle-wm.nix
@@ -3,7 +3,7 @@
  name = "miracle-wm";

  meta = {
-    maintainers = with lib.maintainers; [ OPNA2608 ];
+    maintainers = [ ];
  };

  nodes.machine =
--- a/nixos/tests/transmission.nix
+++ b/nixos/tests/transmission.nix
@@ -1,8 +1,8 @@
 { pkgs, ... }:
 {
  name = "transmission";
-  meta = with pkgs.lib.maintainers; {
-    maintainers = [ coconnor ];
+  meta = {
+    maintainers = [ ];
  };

  nodes.machine =
--- a/pkgs/applications/networking/browsers/brave/packages/brave-origin.nix
+++ b/pkgs/applications/networking/browsers/brave/packages/brave-origin.nix
@@ -1,21 +1,21 @@
 # Expression generated by update.py; do not edit it by hand!
 rec {
  pname = "brave-origin";
-  version = "1.95.102";
+  version = "1.95.104";
  flavor = "origin";

  archives = {
    aarch64-linux = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-origin_${version}_arm64.deb";
-      sha256 = "3869eb0a0037a399871def707016e45e1eca113a493dc78c81666cfbe1639aab";
+      sha256 = "3efe3d4325b241a19449348a3e32af574be9842b2b0fae1eb942a87bb50333a7";
    };
    x86_64-linux = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-origin_${version}_amd64.deb";
-      sha256 = "296dab8bd88cfcf7178dac175d65acd2284046706690f64b0923d819ffc5f217";
+      sha256 = "fe6a88b3301eb8a08ed062d32bde01786d1b666e5ab842b5625c854eb11f2886";
    };
    aarch64-darwin = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/Brave-Origin-arm64.dmg";
-      sha256 = "e24b7585526746c0533541eec011f20dd17980a0ad0302e848f04087f7d434d8";
+      sha256 = "2f59547e4b53ac300450cb4f56f292bcbf508b20fdfa06c6341e5fd976d66859";
    };
  };
 }
--- a/pkgs/applications/networking/browsers/brave/packages/brave.nix
+++ b/pkgs/applications/networking/browsers/brave/packages/brave.nix
@@ -1,20 +1,20 @@
 # Expression generated by update.py; do not edit it by hand!
 rec {
  pname = "brave";
-  version = "1.95.102";
+  version = "1.95.104";

  archives = {
    aarch64-linux = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      sha256 = "d92e02754ec727430f530e51d8a3a51041d0df07d62589072c1a4d06bbf0037b";
+      sha256 = "251ee83fa383db6106ae6140df0975689b226d15ceb96cdb4147cb90cd7c25ba";
    };
    x86_64-linux = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      sha256 = "930110fe57c83be3327388a943e9eacbcec083a3e1b4bc08bec413788418bdfe";
+      sha256 = "e09e3c3e9fc84f75e65048a0be830c7c4907744a402b5790530d2206b276426e";
    };
    aarch64-darwin = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/Brave-Browser-arm64.dmg";
-      sha256 = "97eb5f8a17d1a0e191d3a47059e79b9fa47d3930035d10a23ad086df9e4ab1fb";
+      sha256 = "f6823d53b3e9a287b8f8830b728ba9b34fe2d4a9f6ee4e05b3bcd4a21ee25eaf";
    };
  };
 }
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -45,13 +45,13 @@
    "vendorHash": "sha256-d9hJUjHczxy2/3bOmEYjTxKDIRc6Cox4sr5k40ZHWFE="
  },
  "aliyun_alicloud": {
-    "hash": "sha256-caOnwD9wXa533I2kUpcbMwAJUUcSzyZNY4LIgJQjdc0=",
+    "hash": "sha256-u4u8p3+Gxwa+gCDgcqZqi1RXYG9c+O27uZoOlc+RoKc=",
    "homepage": "https://registry.terraform.io/providers/aliyun/alicloud",
    "owner": "aliyun",
    "repo": "terraform-provider-alicloud",
-    "rev": "v1.292.0",
+    "rev": "v1.293.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-bJcVf4Yj70VwKn0p6RN+/dc5J+K6xFJcifVei9dK2bA="
+    "vendorHash": "sha256-GIKSIlWD+TTm0EsUu9ga3emENwGLXMDYqp//BmjNwDA="
  },
  "aminueza_minio": {
    "hash": "sha256-MOc2DaH1uTb92emRNe/aS+Jsit8K+ZrldHBIMyYgeFU=",
@@ -436,13 +436,13 @@
    "vendorHash": "sha256-ZbU2z7qUHPR7vDSflesSjgK7x3LYXVe/gnVsy19q6Bs="
  },
  "fortinetdev_fortios": {
-    "hash": "sha256-yT8YkcW80A/3wwZqeLWH7A/oonNKm+yuUyuC2hl+KHg=",
+    "hash": "sha256-Rc6hPvT9mxWQz2W55O+I+JUPpr1s2c5IDMNqPbsIdyg=",
    "homepage": "https://registry.terraform.io/providers/fortinetdev/fortios",
    "owner": "fortinetdev",
    "repo": "terraform-provider-fortios",
-    "rev": "1.26.0",
+    "rev": "1.26.1",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-pVzjpgYNYMOlL4m+lw6uf6W0elVC2BDyGomgY2yAFBg="
+    "vendorHash": "sha256-H3ssaSZb61mhNW/tp7h6GNCgEcyDpHkEhC1qIKHJcEA="
  },
  "gavinbunney_kubectl": {
    "hash": "sha256-UQ/xvhs7II+EGH5bKdrVC47hp5dhLqQZeqSBz06ho1s=",
@@ -1247,13 +1247,13 @@
    "vendorHash": "sha256-skswuFKhN4FFpIunbom9rM/FVRJVOFb1WwHeAIaEjn8="
  },
  "spacelift-io_spacelift": {
-    "hash": "sha256-YII7lvargOUDhw+pBFcKNrSyjDHhyk3AErN9N9LFrpE=",
+    "hash": "sha256-Kn43SQM/uxNd32g+nm40fmLStPXyHhuGUX48g16AvKw=",
    "homepage": "https://registry.terraform.io/providers/spacelift-io/spacelift",
    "owner": "spacelift-io",
    "repo": "terraform-provider-spacelift",
-    "rev": "v1.54.0",
+    "rev": "v1.55.0",
    "spdx": "MIT",
-    "vendorHash": "sha256-Yg4EcYUckcnAeADgCo1U1pdsltDVrH0Uma7u9vU3nE8="
+    "vendorHash": "sha256-XpXZqb6j6WdTFowdwNf3e8i9lg69tavzb2H65LyQJvE="
  },
  "splunk-terraform_signalfx": {
    "hash": "sha256-KoPLEVzR/MtMTrufqvxrOuVsfjCUXQ9UMbqjosAy2oc=",
--- a/pkgs/by-name/ae/aerion/package.nix
+++ b/pkgs/by-name/ae/aerion/package.nix
@@ -99,5 +99,9 @@ buildGoModule {
    license = lib.licenses.asl20;
    mainProgram = "aerion";
    maintainers = with lib.maintainers; [ curious ];
+    # Never built on darwin since first introduction in nixpkgs
+    # Fails to link on Darwin with undefined `_OBJC_CLASS_$_UTType`
+    # (likely requires linking `UniformTypeIdentifiers.framework`)
+    broken = stdenv.hostPlatform.isDarwin;
  };
 }
--- a/pkgs/by-name/am/ameba-ls/package.nix
+++ b/pkgs/by-name/am/ameba-ls/package.nix
@@ -1,23 +1,26 @@
 {
  lib,
  fetchFromGitHub,
-  crystal_1_15,
+  crystal,
  versionCheckHook,
+  _experimental-update-script-combinators,
+  nix-update-script,
+  writeShellScript,
+  crystal2nix,
+  runCommand,
 }:

-let
-  # Use the same Crystal minor version as specified in upstream
-  crystal = crystal_1_15;
-in
 crystal.buildCrystalPackage rec {
  pname = "ameba-ls";
-  version = "0.1.0";
+  version = "0.2.0";
+
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "crystal-ameba";
    repo = "ameba-ls";
    tag = "v${version}";
-    hash = "sha256-TEHjR+34wrq24XJNLhWZCEzcDEMDlmUHv0iiF4Z6JlI=";
+    hash = "sha256-0HIs+KpsiIDDh9pqg1bDLAcvCV2M7S5TJGtLycNxndI=";
  };

  shardsFile = ./shards.nix;
@@ -45,6 +48,38 @@ crystal.buildCrystalPackage rec {
  doInstallCheck = true;
  versionCheckProgram = "${placeholder "out"}/bin/ameba-ls";

+  passthru = {
+    updateScript = _experimental-update-script-combinators.sequence [
+      (nix-update-script {
+        extraArgs = [
+          "--use-github-releases"
+          "--src-only"
+        ];
+      })
+      (
+        (_experimental-update-script-combinators.copyAttrOutputToFile "ameba-ls.shardLock" "${toString ./.}/shard.lock")
+        // {
+          supportedFeatures = [ ];
+        }
+      )
+      {
+        command = [
+          (writeShellScript "update-lock" "cd $1; ${lib.getExe crystal2nix}")
+          ./.
+        ];
+      }
+      {
+        command = [
+          "rm"
+          "${toString ./.}/shard.lock"
+        ];
+      }
+    ];
+    shardLock = runCommand "shard.lock" { inherit src; } ''
+      cp "$src/shard.lock" "$out"
+    '';
+  };
+
  meta = {
    description = "Crystal language server powered by Ameba linter";
    homepage = "https://github.com/crystal-ameba/ameba-ls";
--- a/pkgs/by-name/am/ameba-ls/shards.nix
+++ b/pkgs/by-name/am/ameba-ls/shards.nix
@@ -1,25 +1,25 @@
 {
-  ameba = {
+  "ameba" = {
    url = "https://github.com/crystal-ameba/ameba.git";
-    rev = "a21dea0b44642f4fc87429283f8b0dd9f1e47a9f";
-    sha256 = "1kzr4ynd4r5w87y2czzrlir1dvqmv43ijm07804kgsy1g20k00fs";
+    rev = "v1.7.0";
+    sha256 = "0blfyizcajyrgbfxhiwnvf1xmz3wfx6kpf9jf8x7daxihany4r9z";
  };
-  larimar = {
+  "larimar" = {
    url = "https://github.com/nobodywasishere/larimar.git";
-    rev = "97d37e665f7189a7ec35f54fb65003a8438d6cf0";
-    sha256 = "0s5hnfdybwbfk8sbjzrly2p6xppc5niww14h9cx00xkm8m1rlyj2";
+    rev = "84872f191466e41eb986a905e1559ffb8f160684";
+    sha256 = "0w5l4kx7895hshk3gydn9lrhdvykm8k2whc7j05yqfqk0yx80j6i";
  };
-  lsprotocol = {
+  "lsprotocol" = {
    url = "https://github.com/nobodywasishere/lsprotocol-crystal.git";
    rev = "28986890c7657af4aefea8355ca3f3c7fc2bc9dd";
    sha256 = "0pccgq5g87mnvrhpgw3j22p3wgch8kp1svxcrbz2dha7zvgn65kj";
  };
-  rwlock = {
+  "rwlock" = {
    url = "https://github.com/spider-gazelle/readers-writer.git";
-    tag = "v1.0.7";
+    rev = "v1.0.7";
    sha256 = "1cs4ang50cza7sb5zh94rl1ppwcn9z1l8jjcsshhy4w72wkbqyny";
  };
-  tree_sitter = {
+  "tree_sitter" = {
    url = "https://github.com/crystal-lang-tools/crystal-tree-sitter.git";
    rev = "1d46ca231a641b30b8e7fbbae7eba050f7717a9f";
    sha256 = "16g0ii3b3pmpnwmx2iz9dr1865pgfka7a724dfj62csjavqm5i1k";
--- a/pkgs/by-name/bl/blocky/package.nix
+++ b/pkgs/by-name/bl/blocky/package.nix
@@ -7,20 +7,20 @@

 buildGoModule (finalAttrs: {
  pname = "blocky";
-  version = "0.34.0";
+  version = "0.35.0";

  src = fetchFromGitHub {
    owner = "0xERR0R";
    repo = "blocky";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-EgZId3EzfAUWsQo56Y5VGs2VJxj0tXiSuZNhd6/U/zc=";
+    hash = "sha256-TROP6hwaDo8OAEVATWYCrQZlAjjtjcz5yyZthOVteC8=";
  };

  # needs network connection and fails at
  # https://github.com/0xERR0R/blocky/blob/development/resolver/upstream_resolver_test.go
  doCheck = false;

-  vendorHash = "sha256-BeRM5X0cuxHCud23lgy+fL6PGAlY7XOmeKTiDeToAeQ=";
+  vendorHash = "sha256-QQ+bhLpDa1X4UVl8L3qJtI3lx8Ba3yLVqKoUR+aHSf0=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/br/brutecraber/package.nix
+++ b/pkgs/by-name/br/brutecraber/package.nix
@@ -0,0 +1,42 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  nix-update-script,
+  ocl-icd,
+  rustPlatform,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "brutecraber";
+  version = "0.9.0";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "Erikgavs";
+    repo = "brutecraber";
+    tag = finalAttrs.version;
+    hash = "sha256-rTSusRTh+7pPnKdhfyLMAFhsFcQkfFlYUxRJeulv0Ho=";
+  };
+
+  cargoHash = "sha256-b+LrTAW21To7UZC+Rh3NkDGDCrXgiOHUkhE7OFJsBHs=";
+
+  buildInputs = [ ocl-icd ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Hash cracker";
+    homepage = "https://github.com/Erikgavs/brutecraber";
+    changelog = "https://github.com/Erikgavs/brutecraber/blob/${finalAttrs.src.rev}/CHANGELOG.md";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "brutecraber";
+    broken = stdenv.hostPlatform.isDarwin;
+  };
+})
--- a/pkgs/by-name/ca/cargo-dist/package.nix
+++ b/pkgs/by-name/ca/cargo-dist/package.nix
@@ -14,16 +14,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-dist";
-  version = "0.32.0";
+  version = "0.33.0";

  src = fetchFromGitHub {
    owner = "axodotdev";
    repo = "cargo-dist";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-WNbo3sm5tSNYQMLB4bjiNtLwp5pD4KAoyG2lwWYEpzk=";
+    hash = "sha256-Q46HGVJ9pPVptiW6TdAgVBc0CHUIYefZ3eV361r4+1Q=";
  };

-  cargoHash = "sha256-gzaDAGAjWDcJyoES0foFOyhTP4HDsaQHrrwCQmAzXZA=";
+  cargoHash = "sha256-F3UER8KXlxeLtWJoIojPGFU6A+zG8fXbouyhIF19jwg=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/co/cockpit/package.nix
+++ b/pkgs/by-name/co/cockpit/package.nix
@@ -34,7 +34,7 @@
  pam,
  pkg-config,
  polkit,
-  python312Packages,
+  python3Packages,
  removeReferencesTo,
  sscg,
  systemd,
@@ -45,13 +45,6 @@
  withBranding ? true,
  nixos-icons,
 }:
-
-let
-  # Pinned to 3.12 due to cockpit-zfs dependency py-libzfs not being compatible
-  # with 3.13+
-  python3Packages = python312Packages;
-in
-
 stdenv.mkDerivation (finalAttrs: {
  pname = "cockpit";
  version = "366";
--- a/pkgs/by-name/dm/dms-shell/package.nix
+++ b/pkgs/by-name/dm/dms-shell/package.nix
@@ -29,19 +29,19 @@ buildGoModule (
  in
  {
    pname = "dms-shell";
-    version = "1.6.1";
+    version = "1.6.2";

    src = fetchFromGitHub {
      owner = "AvengeMedia";
      repo = "DankMaterialShell";
      tag = "v${finalAttrs.version}";
      fetchSubmodules = true;
-      hash = "sha256-q8ciRRLhTMKsGl7OPU8v5sqToY64Fm61SeIHYOAEyjI=";
+      hash = "sha256-U1D/RVtIULXwywT5BgOrhW5qge4AdBfTLSXxCSLn4F0=";
    };

    sourceRoot = "${finalAttrs.src.name}/core";

-    vendorHash = "sha256-Ls6Dquwt0fzDCEjZ6FfTsZTXDI8408mFdByv/OWHVgI=";
+    vendorHash = "sha256-ejDi+TzstUtxtWpcl5yYw4UZuTnZraOsIdJuXPKxJ6s=";

    tags = [ "withshell" ];

--- a/pkgs/by-name/ev/evil-winrm/Gemfile
+++ b/pkgs/by-name/ev/evil-winrm/Gemfile
@@ -1,7 +1,11 @@
 source 'https://rubygems.org'

+gem 'benchmark'
+gem 'csv'
+gem 'fileutils'
+gem 'logger'
+gem 'readline'
+gem 'stringio'
+gem 'syslog'
 gem 'winrm'
 gem 'winrm-fs'
-gem 'stringio'
-gem 'logger'
-gem 'fileutils'
--- a/pkgs/by-name/ev/evil-winrm/Gemfile.lock
+++ b/pkgs/by-name/ev/evil-winrm/Gemfile.lock
@@ -2,8 +2,10 @@ GEM
  remote: https://rubygems.org/
  specs:
    base64 (0.3.0)
+    benchmark (0.5.0)
    bigdecimal (3.3.1)
    builder (3.3.0)
+    csv (3.3.6)
    erubi (1.13.1)
    ffi (1.17.2)
    fileutils (1.7.3)
@@ -14,6 +16,7 @@ GEM
      rexml (~> 3.0)
    httpclient (2.9.0)
      mutex_m
+    io-console (0.9.4)
    little-plugger (1.1.4)
    logger (1.7.0)
    logging (2.4.0)
@@ -23,11 +26,17 @@ GEM
    mutex_m (0.3.0)
    nori (2.7.1)
      bigdecimal
+    readline (0.0.4)
+      reline
+    reline (0.7.0)
+      io-console (~> 0.5)
    rexml (3.4.4)
    rubyntlm (0.6.5)
      base64
    rubyzip (2.4.1)
    stringio (3.1.7)
+    syslog (0.4.0)
+      logger
    winrm (2.3.9)
      builder (>= 2.1.2)
      erubi (~> 1.8)
@@ -48,11 +57,15 @@ PLATFORMS
  ruby

 DEPENDENCIES
+  benchmark
+  csv
  fileutils
  logger
+  readline
  stringio
+  syslog
  winrm
  winrm-fs

 BUNDLED WITH
-   2.7.1
+   2.6.9
--- a/pkgs/by-name/ev/evil-winrm/gemset.nix
+++ b/pkgs/by-name/ev/evil-winrm/gemset.nix
@@ -9,6 +9,16 @@
    };
    version = "0.3.0";
  };
+  benchmark = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0v1337j39w1z7x9zs4q7ag0nfv4vs4xlsjx2la0wpv8s6hig2pa6";
+      type = "gem";
+    };
+    version = "0.5.0";
+  };
  bigdecimal = {
    groups = [ "default" ];
    platforms = [ ];
@@ -29,6 +39,16 @@
    };
    version = "3.3.0";
  };
+  csv = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0mj4kq4wwpc7c8ll52q30hsir1jrcd5kq7yb8lyz0rksa1z1x9mb";
+      type = "gem";
+    };
+    version = "3.3.6";
+  };
  erubi = {
    groups = [ "default" ];
    platforms = [ ];
@@ -95,6 +115,16 @@
    };
    version = "2.9.0";
  };
+  io-console = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1cgvhm0d4awr8j42b8v1nl1jfgx45ihv8mylargfi3lj697k00x4";
+      type = "gem";
+    };
+    version = "0.9.4";
+  };
  little-plugger = {
    groups = [ "default" ];
    platforms = [ ];
@@ -160,6 +190,28 @@
    };
    version = "2.7.1";
  };
+  readline = {
+    dependencies = [ "reline" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0shxkj3kbwl43rpg490k826ibdcwpxiymhvjnsc85fg2ggqywf31";
+      type = "gem";
+    };
+    version = "0.0.4";
+  };
+  reline = {
+    dependencies = [ "io-console" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0gaq2lc463ap1srz7y5kh2p4dxazs7vjrpiby58d9yfvan72s0av";
+      type = "gem";
+    };
+    version = "0.7.0";
+  };
  rexml = {
    groups = [ "default" ];
    platforms = [ ];
@@ -201,6 +253,17 @@
    };
    version = "3.1.7";
  };
+  syslog = {
+    dependencies = [ "logger" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0wklh86rhpiff34ja0hda5pwdfywybjvb50hqhz90wpyhblqmhy4";
+      type = "gem";
+    };
+    version = "0.4.0";
+  };
  winrm = {
    dependencies = [
      "builder"
--- a/pkgs/by-name/ev/evil-winrm/package.nix
+++ b/pkgs/by-name/ev/evil-winrm/package.nix
@@ -3,6 +3,7 @@
  stdenv,
  fetchFromGitHub,
  makeWrapper,
+  versionCheckHook,
  bundlerEnv,
  bundlerUpdateScript,
  writeText,
@@ -65,6 +66,9 @@ stdenv.mkDerivation (finalAttrs: {

  passthru.updateScript = bundlerUpdateScript "evil-winrm";

+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
  meta = {
    description = "WinRM shell for hacking/pentesting";
    mainProgram = "evil-winrm";
--- a/pkgs/by-name/fi/filius/package.nix
+++ b/pkgs/by-name/fi/filius/package.nix
@@ -10,13 +10,13 @@

 maven.buildMavenPackage rec {
  pname = "filius";
-  version = "2.13.0";
+  version = "2.14.0";

  src = fetchFromGitLab {
    owner = "filius1";
    repo = "filius";
    tag = "v${version}";
-    hash = "sha256-u4X6jrlNzgm1vWyRFSzVjoQ3dtZUK9pAHSMxUHsSV84=";
+    hash = "sha256-LXedyREtdinbxwg4CiC2ei7w5v/bZp8H6vwwHQ3GTwg=";
  };

  mvnHash = "sha256-0xc/gnodgBo6gOkvz7Oe/5AQyjh2xMgyWEeEyktFqEA=";
--- a/pkgs/by-name/fi/findutils/no-install-statedir.patch
+++ b/pkgs/by-name/fi/findutils/no-install-statedir.patch
--- a/pkgs/by-name/fi/findutils/package.nix
+++ b/pkgs/by-name/fi/findutils/package.nix
--- a/pkgs/by-name/fl/flake-du/package.nix
+++ b/pkgs/by-name/fl/flake-du/package.nix
@@ -1,24 +1,27 @@
 {
  lib,
  rustPlatform,
-  fetchgit,
+  fetchFromGitHub,
+  versionCheckHook,
 }:
-let
-  version = "0.2.0";
-in
-rustPlatform.buildRustPackage {
-  pname = "flake-du";
-  inherit version;

-  src = fetchgit {
-    url = "https://github.com/kmein/flake-du";
-    rev = "v${version}";
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "flake-du";
+  version = "0.2.0";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "kmein";
+    repo = "flake-du";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-mwSZvAEs4RKzIKErnxPhK7J7yhqo1ibDRy0FXoKlsHY=";
  };

  cargoHash = "sha256-DYVT9jM9WcgoVSOnoUIWWR9EmNywR1f4xZOAzkbNkCk=";

-  __structuredAttrs = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;

  meta = {
    description = "Tool for managing flake inputs with disk usage insights";
@@ -26,4 +29,4 @@ rustPlatform.buildRustPackage {
    homepage = "https://github.com/kmein/flake-du";
    maintainers = [ lib.maintainers.kmein ];
  };
-}
+})
--- a/pkgs/by-name/gg/ggshield/package.nix
+++ b/pkgs/by-name/gg/ggshield/package.nix
@@ -1,5 +1,6 @@
 {
  lib,
+  stdenv,
  fetchFromGitHub,
  git,
  python3,
@@ -91,8 +92,13 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    # Generated hooks config references pytest binary, instead of ggshield CLI. Odd!
    "test_install_cursor_local_fresh"
    "test_install_vibe_global"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    "test_git_command_includes_longpaths_on_windows"
  ];

+  __darwinAllowLocalNetworking = true;
+
  meta = {
    description = "Tool to find and fix various types of hardcoded secrets and infrastructure-as-code misconfigurations";
    homepage = "https://github.com/GitGuardian/ggshield";
--- a/pkgs/by-name/go/gomuks/package.nix
+++ b/pkgs/by-name/go/gomuks/package.nix
@@ -1,68 +0,0 @@
-{
-  lib,
-  stdenv,
-  buildGoModule,
-  fetchFromGitHub,
-  makeDesktopItem,
-  makeWrapper,
-  libnotify,
-  olm,
-  pulseaudio,
-  sound-theme-freedesktop,
-}:
-
-buildGoModule rec {
-  pname = "gomuks";
-  version = "0.3.1";
-
-  src = fetchFromGitHub {
-    owner = "gomuks";
-    repo = "gomuks";
-    rev = "v${version}";
-    sha256 = "sha256-bDJXo8d9K5UO599HDaABpfwc9/dJJy+9d24KMVZHyvI=";
-  };
-
-  vendorHash = "sha256-0my58bVKLWbdTwhAnXMruNjujd07NXFn4bkRe1cUYpE=";
-
-  doCheck = false;
-
-  nativeBuildInputs = [ makeWrapper ];
-  buildInputs = [ olm ];
-
-  postInstall = ''
-    cp -r ${
-      makeDesktopItem {
-        name = "net.maunium.gomuks.desktop";
-        exec = "@out@/bin/gomuks";
-        terminal = true;
-        desktopName = "Gomuks";
-        genericName = "Matrix client";
-        categories = [
-          "Network"
-          "Chat"
-        ];
-        comment = meta.description;
-      }
-    }/* $out/
-    substituteAllInPlace $out/share/applications/*
-    wrapProgram $out/bin/gomuks \
-      --prefix PATH : "${
-        lib.makeBinPath (
-          lib.optionals stdenv.hostPlatform.isLinux [
-            libnotify
-            pulseaudio
-          ]
-        )
-      }" \
-      --set-default GOMUKS_SOUND_NORMAL "${sound-theme-freedesktop}/share/sounds/freedesktop/stereo/message-new-instant.oga" \
-      --set-default GOMUKS_SOUND_CRITICAL "${sound-theme-freedesktop}/share/sounds/freedesktop/stereo/complete.oga"
-  '';
-
-  meta = {
-    homepage = "https://maunium.net/go/gomuks/";
-    description = "Terminal based Matrix client written in Go";
-    mainProgram = "gomuks";
-    license = lib.licenses.agpl3Plus;
-    maintainers = with lib.maintainers; [ chvp ];
-  };
-}
--- a/pkgs/by-name/gu/guvcview/package.nix
+++ b/pkgs/by-name/gu/guvcview/package.nix
@@ -71,7 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
    description = "Simple interface for devices supported by the linux UVC driver";
    mainProgram = "guvcview";
    homepage = "https://guvcview.sourceforge.net";
-    maintainers = [ lib.maintainers.coconnor ];
+    maintainers = [ ];
    license = lib.licenses.gpl3;
    platforms = lib.platforms.linux;
  };
--- a/pkgs/by-name/ho/honk/package.nix
+++ b/pkgs/by-name/ho/honk/package.nix
@@ -1,65 +0,0 @@
-{
-  lib,
-  buildGoModule,
-  fetchurl,
-  sqlite,
-  installShellFiles,
-  nixosTests,
-}:
-buildGoModule (finalAttrs: {
-  pname = "honk";
-  version = "1.5.2";
-
-  src = fetchurl {
-    url = "https://humungus.tedunangst.com/r/honk/d/honk-${finalAttrs.version}.tgz";
-    hash = "sha256-7dIui+VMHn916yMdhqN6Pk2P/s0vvXzVKFsTZ5wp12A=";
-  };
-  vendorHash = null;
-
-  buildInputs = [
-    sqlite
-  ];
-
-  nativeBuildInputs = [
-    installShellFiles
-  ];
-
-  subPackages = [ "." ];
-
-  # This susbtitution is not mandatory. It is only existing to have something
-  # working out of the box. This value can be overridden by the user, by
-  # providing the `-viewdir` parameter in the command line.
-  postPatch = ''
-    substituteInPlace main.go --replace-fail \
-      "var viewDir = \".\"" \
-      "var viewDir = \"$out/share/honk\""
-  '';
-
-  postInstall = ''
-    mkdir -p $out/share/honk
-    mkdir -p $out/share/doc/honk
-
-    mv docs/{,honk-}intro.1
-    mv docs/{,honk-}hfcs.1
-    mv docs/{,honk-}vim.3
-    mv docs/{,honk-}activitypub.7
-
-    installManPage docs/honk.1 docs/honk.3 docs/honk.5 docs/honk.8 \
-      docs/honk-intro.1 docs/honk-hfcs.1 docs/honk-vim.3 docs/honk-activitypub.7
-    mv docs/{*.html,*.txt,*.jpg,*.png} $out/share/doc/honk
-    mv views $out/share/honk
-  '';
-
-  passthru.tests = {
-    inherit (nixosTests) honk;
-  };
-
-  meta = {
-    changelog = "https://humungus.tedunangst.com/r/honk/v/v${finalAttrs.version}/f/docs/changelog.txt";
-    description = "ActivityPub server with minimal setup and support costs";
-    homepage = "https://humungus.tedunangst.com/r/honk";
-    license = lib.licenses.isc;
-    mainProgram = "honk";
-    maintainers = with lib.maintainers; [ huyngo ];
-  };
-})
--- a/pkgs/by-name/ht/htmlunit-driver/package.nix
+++ b/pkgs/by-name/ht/htmlunit-driver/package.nix
@@ -20,9 +20,7 @@ stdenv.mkDerivation rec {
  meta = {
    homepage = "https://github.com/SeleniumHQ/htmlunit-driver";
    description = "WebDriver server for running Selenium tests on the HtmlUnit headless browser";
-    maintainers = with lib.maintainers; [
-      coconnor
-    ];
+    maintainers = [ ];
    platforms = lib.platforms.all;
    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
    license = lib.licenses.asl20;
--- a/pkgs/by-name/ht/httrack/package.nix
+++ b/pkgs/by-name/ht/httrack/package.nix
@@ -1,31 +1,21 @@
 {
  lib,
  stdenv,
-  fetchFromGitHub,
+  fetchurl,
  zlib,
  openssl,
  libiconv,
-  autoreconfHook,
-  autoconf-archive,
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "3.50.1";
  pname = "httrack";
+  version = "3.50.3";

-  src = fetchFromGitHub {
-    owner = "xroche";
-    repo = "httrack";
-    tag = finalAttrs.version;
-    hash = "sha256-n3myEvrlICMMLvI6YHKw8BIryHZzCyadIpZylpHM9M4=";
-    fetchSubmodules = true;
+  src = fetchurl {
+    url = "https://github.com/xroche/httrack/releases/download/${finalAttrs.version}/httrack-${finalAttrs.version}.tar.gz";
+    hash = "sha256-ZE1OwOSK1ZbazX+AF7aNij8d/BQChLQStTCG59FmTp0=";
  };

-  nativeBuildInputs = [
-    autoreconfHook
-    autoconf-archive
-  ];
-
  buildInputs = [
    libiconv
    openssl
@@ -35,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    description = "Easy-to-use offline browser / website mirroring utility";
    homepage = "https://www.httrack.com";
-    changelog = "https://github.com/xroche/httrack/releases/tag/${finalAttrs.src.tag}";
+    changelog = "https://github.com/xroche/httrack/releases/tag/${finalAttrs.version}";
    license = lib.licenses.gpl3Plus;
    maintainers = with lib.maintainers; [ tbutter ];
    platforms = with lib.platforms; unix;
--- a/pkgs/by-name/ik/ikebuster/package.nix
+++ b/pkgs/by-name/ik/ikebuster/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  fetchFromGitHub,
+  libpcap,
+  nix-update-script,
+  pkg-config,
+  rustPlatform,
+  versionCheckHook,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "ikebuster";
+  version = "0.2.0";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "myOmikron";
+    repo = "ikebuster";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-7+i/Zzjey555M3fv7KBNsgSapehz1OUhzrTUIWmO/qM=";
+  };
+
+  buildFeatures = [ "bin" ];
+
+  cargoHash = "sha256-hFi9CaG4xaP5bf152Be1ihubtmYLEauDkeBhoeXkkAw=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ libpcap ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  # Cargo.lock is outdated
+  doInstallCheck = false;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Scanner for IKE";
+    homepage = "https://github.com/myOmikron/ikebuster";
+    changelog = "https://github.com/myOmikron/ikebuster/blob/${finalAttrs.src.rev}/Changelog.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "ikebuster";
+  };
+})
--- a/pkgs/by-name/li/libdicom/package.nix
+++ b/pkgs/by-name/li/libdicom/package.nix
@@ -1,8 +1,8 @@
 {
  lib,
  stdenv,
+  buildPackages,
  fetchFromGitHub,
-  fetchpatch,
  uthash,
  meson,
  ninja,
@@ -12,32 +12,24 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libdicom";
-  version = "1.0.5";
+  version = "1.3.0";

  src = fetchFromGitHub {
    owner = "ImagingDataCommons";
    repo = "libdicom";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-9n0Gp9+fmTM/shgWC8zpwt1pic9BrvDubOt7f+ZDMeE=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Z1x6pA4oRDtrf9tRAnpJ0e+mmh6nSCIpQrtQGSyxFak=";
  };

-  patches = [
-    (fetchpatch {
-      name = "CVE-2024-24793.CVE-2024-24794.patch";
-      url = "https://github.com/ImagingDataCommons/libdicom/commit/3661aa4cdbe9c39f67d38ae87520f9e3ed50ab16.patch";
-      excludes = [ "CHANGELOG.md" ];
-      hash = "sha256-/KTp0nKYk6jX4phNHY+nzjEptUBHKM2JkOftS5vHsEw=";
-    })
-  ];
+  depsBuildBuild = [ buildPackages.stdenv.cc ];

-  buildInputs = [ uthash ];
+  buildInputs = [ uthash ] ++ lib.optionals (finalAttrs.finalPackage.doCheck) [ check ];

  nativeBuildInputs = [
    meson
    ninja
    pkg-config
-  ]
-  ++ lib.optionals (finalAttrs.finalPackage.doCheck) [ check ];
+  ];

  mesonBuildType = "release";

--- a/pkgs/by-name/li/licensed/Gemfile.lock
+++ b/pkgs/by-name/li/licensed/Gemfile.lock
@@ -1,56 +1,58 @@
 GEM
  remote: https://rubygems.org/
  specs:
-    addressable (2.8.7)
-      public_suffix (>= 2.0.2, < 7.0)
-    csv (3.3.5)
-    dotenv (3.1.8)
-    faraday (2.14.0)
+    addressable (2.9.0)
+      public_suffix (>= 2.0.2, < 8.0)
+    csv (3.3.6)
+    dotenv (3.2.0)
+    faraday (2.14.3)
      faraday-net_http (>= 2.0, < 3.5)
      json
      logger
-    faraday-net_http (3.4.2)
+    faraday-net_http (3.4.4)
      net-http (~> 0.5)
-    json (2.16.0)
-    licensed (5.0.4)
+    json (2.21.2)
+    licensed (5.1.0)
      csv (~> 3.3)
      json (~> 2.6)
      licensee (~> 9.16)
+      ostruct (~> 0.6.3)
      parallel (~> 1.22)
      pathname-common_prefix (~> 0.0.1)
      reverse_markdown (>= 2.1, < 4.0)
      ruby-xxHash (~> 0.4.0)
      thor (~> 1.2)
      tomlrb (~> 2.0)
-    licensee (9.18.0)
+    licensee (9.20.0)
      dotenv (>= 2, < 4)
-      octokit (>= 4.20, < 10.0)
+      octokit (>= 4.20, < 11.0)
      reverse_markdown (>= 1, < 4)
      rugged (>= 0.24, < 2.0)
      thor (>= 0.19, < 2.0)
    logger (1.7.0)
    mini_portile2 (2.8.9)
-    net-http (0.8.0)
+    net-http (0.9.1)
      uri (>= 0.11.1)
-    nokogiri (1.18.10)
+    nokogiri (1.19.4)
      mini_portile2 (~> 2.8.2)
      racc (~> 1.4)
-    octokit (9.2.0)
+    octokit (10.0.0)
      faraday (>= 1, < 3)
      sawyer (~> 0.9)
-    parallel (1.27.0)
+    ostruct (0.6.3)
+    parallel (1.28.0)
    pathname-common_prefix (0.0.2)
-    public_suffix (6.0.2)
+    public_suffix (7.0.5)
    racc (1.8.1)
-    reverse_markdown (3.0.0)
+    reverse_markdown (3.0.2)
      nokogiri
    ruby-xxHash (0.4.0.2)
-    rugged (1.9.0)
+    rugged (1.9.6)
    sawyer (0.9.3)
      addressable (>= 2.3.5)
      faraday (>= 0.17.3, < 3)
-    thor (1.4.0)
-    tomlrb (2.0.3)
+    thor (1.5.0)
+    tomlrb (2.0.4)
    uri (1.1.1)

 PLATFORMS
--- a/pkgs/by-name/li/licensed/gemset.nix
+++ b/pkgs/by-name/li/licensed/gemset.nix
@@ -5,30 +5,30 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0cl2qpvwiffym62z991ynks7imsm87qmgxf0yfsmlwzkgi9qcaa6";
+      sha256 = "1by7h2lwziiblizpd5yx87jsq8ppdhzvwf08ga34wzqgcv1nmpvz";
      type = "gem";
    };
-    version = "2.8.7";
+    version = "2.9.0";
  };
  csv = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0gz7r2kazwwwyrwi95hbnhy54kwkfac5swh2gy5p5vw36fn38lbf";
+      sha256 = "0mj4kq4wwpc7c8ll52q30hsir1jrcd5kq7yb8lyz0rksa1z1x9mb";
      type = "gem";
    };
-    version = "3.3.5";
+    version = "3.3.6";
  };
  dotenv = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1hwjsddv666wpp42bip3fqx7c5qq6s8lwf74dj71yn7d1h37c4cy";
+      sha256 = "17b1zr9kih0i3wb7h4yq9i8vi6hjfq07857j437a8z7a44qvhxg3";
      type = "gem";
    };
-    version = "3.1.8";
+    version = "3.2.0";
  };
  faraday = {
    dependencies = [
@@ -40,10 +40,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1ka175ci0q9ylpcy651pjj580diplkaskycn4n7jcmbyv7jwz6c6";
+      sha256 = "0y7j6yzv07zggic6g0p2v1ivnvkzsbqjnfdl4215qqb6cxz290hq";
      type = "gem";
    };
-    version = "2.14.0";
+    version = "2.14.3";
  };
  faraday-net_http = {
    dependencies = [ "net-http" ];
@@ -51,26 +51,27 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0v4hfmc7d4lrqqj2wl366rm9551gd08zkv2ppwwnjlnkc217aizi";
+      sha256 = "125m3qri52vwh5v9dhq0dkqxf8629cxrf99yyc01pva72wasyy0f";
      type = "gem";
    };
-    version = "3.4.2";
+    version = "3.4.4";
  };
  json = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "098m3q2jrx4xbf0knrbmflsynmmb5x9q9b0bzpmj7jmm1cr30mna";
+      sha256 = "0shwgjqbj856mb6m9kgkpy08nhym2gdvc2yaprlimfmky9y3n78z";
      type = "gem";
    };
-    version = "2.16.0";
+    version = "2.21.2";
  };
  licensed = {
    dependencies = [
      "csv"
      "json"
      "licensee"
+      "ostruct"
      "parallel"
      "pathname-common_prefix"
      "reverse_markdown"
@@ -82,10 +83,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1hf1c8mn1l3qw28jrmkw7vzm3n0f03f5y2kmmrriiki3j12bb8f0";
+      sha256 = "05y0hrq18x7fzpfgbapn0c8v1d3ky8ajfi8wq4jiw4bym2b9k0gh";
      type = "gem";
    };
-    version = "5.0.4";
+    version = "5.1.0";
  };
  licensee = {
    dependencies = [
@@ -99,10 +100,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0xyzk7gzi91l6xlwfvf2z0963jwd2csf987yk0ffbr5p9ycdp0ry";
+      sha256 = "12n2s6z2fry9q89j9qcjdy59c14k0qbkvwwhkp4m62wkw6hp282i";
      type = "gem";
    };
-    version = "9.18.0";
+    version = "9.20.0";
  };
  logger = {
    groups = [ "default" ];
@@ -130,10 +131,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0vdlxiv9h9gzliz8722j6spw2nwl5z0rfz1i5b9mmsgrx5yc8hnz";
+      sha256 = "15k96fj6qwbaiv6g52l538ass95ds1qwgynqdridz29yqrkhpfi5";
      type = "gem";
    };
-    version = "0.8.0";
+    version = "0.9.1";
  };
  nokogiri = {
    dependencies = [
@@ -144,10 +145,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1hcwwr2h8jnqqxmf8mfb52b0dchr7pm064ingflb78wa00qhgk6m";
+      sha256 = "1d9safb4dly6qmc2g06444l0zifby52yy6j1a5fa1g4j3ihm3jah";
      type = "gem";
    };
-    version = "1.18.10";
+    version = "1.19.4";
  };
  octokit = {
    dependencies = [
@@ -158,20 +159,30 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "05j3gz79gxkid3lc2balyllqik4v4swnm0rcvxz14m76bkrpz92g";
+      sha256 = "1s14kbjfm9vdvcrwqdarfdbfsjqs1jxpglp60plvfdvnkd9rmsc2";
      type = "gem";
    };
-    version = "9.2.0";
+    version = "10.0.0";
+  };
+  ostruct = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "04nrir9wdpc4izqwqbysxyly8y7hsfr4fsv69rw91lfi9d5fv8lm";
+      type = "gem";
+    };
+    version = "0.6.3";
  };
  parallel = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0c719bfgcszqvk9z47w2p8j2wkz5y35k48ywwas5yxbbh3hm3haa";
+      sha256 = "0w697335hi5dk5ay9kyn53399sy87y8v0y6ij93m5wmshhadxrik";
      type = "gem";
    };
-    version = "1.27.0";
+    version = "1.28.0";
  };
  pathname-common_prefix = {
    groups = [ "default" ];
@@ -188,10 +199,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1543ap9w3ydhx39ljcd675cdz9cr948x9mp00ab8qvq6118wv9xz";
+      sha256 = "08znfv30pxmdkjyihvbjqbvv874dj3nybmmyscl958dy3f7v12qs";
      type = "gem";
    };
-    version = "6.0.2";
+    version = "7.0.5";
  };
  racc = {
    groups = [ "default" ];
@@ -209,10 +220,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "195c7yra7amggqj7rir0yr09r4v29c2hgkbkb21mj0jsfs3868mb";
+      sha256 = "1bxqlpwnixn8x4bnna958w6m6qkdkbnd23b9j6ib3nrrrs9bp3l1";
      type = "gem";
    };
-    version = "3.0.0";
+    version = "3.0.2";
  };
  ruby-xxHash = {
    groups = [ "default" ];
@@ -229,10 +240,10 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1b7gcf6pxg4x607bica68dbz22b4kch33yi0ils6x3c8ql9akakz";
+      sha256 = "1iyk4gz5jyipj47mhxjcbm3szmm81cl0w18d2gv1kpqwwm855r66";
      type = "gem";
    };
-    version = "1.9.0";
+    version = "1.9.6";
  };
  sawyer = {
    dependencies = [
@@ -253,20 +264,20 @@
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "0gcarlmpfbmqnjvwfz44gdjhcmm634di7plcx2zdgwdhrhifhqw7";
+      sha256 = "0wsy88vg2mazl039392hqrcwvs5nb9kq8jhhrrclir2px1gybag3";
      type = "gem";
    };
-    version = "1.4.0";
+    version = "1.5.0";
  };
  tomlrb = {
    groups = [ "default" ];
    platforms = [ ];
    source = {
      remotes = [ "https://rubygems.org" ];
-      sha256 = "1xyl2nlfm39lklyaf0p7zj9psr60jvrlyfh26hrpk7wi4k7nlwy2";
+      sha256 = "168v339gqaly00i4zqg2ag2h10r3rl7999d0cqrrpb63gaa7fbr6";
      type = "gem";
    };
-    version = "2.0.3";
+    version = "2.0.4";
  };
  uri = {
    groups = [ "default" ];
--- a/pkgs/by-name/li/lief/package.nix
+++ b/pkgs/by-name/li/lief/package.nix
@@ -8,6 +8,8 @@
  nix-update-script,
  testers,
  validatePkgConfig,
+  withPython ? true,
+  withRust ? true,
 }:

 let
@@ -32,6 +34,8 @@ stdenv.mkDerivation (finalAttrs: {
  outputs = [
    "out"
    "dev"
+  ]
+  ++ lib.optionals withPython [
    "py"
  ];

@@ -43,29 +47,32 @@ stdenv.mkDerivation (finalAttrs: {

  # Not in propagatedBuildInputs because only the $py output needs it; $out is
  # just the library itself (e.g. C/C++ headers).
-  buildInputs = with python3.pkgs; [
-    python
-    build
-    pathspec
-    pip
-    pydantic
-    scikit-build-core
-  ];
+  buildInputs =
+    with python3.pkgs;
+    lib.optionals withPython [
+      python
+      build
+      pathspec
+      pip
+      pydantic
+      scikit-build-core
+    ];

  cmakeFlags = [
-    (lib.cmakeBool "LIEF_PYTHON_API" true)
+    (lib.cmakeBool "LIEF_PYTHON_API" withPython)
+    (lib.cmakeBool "LIEF_RUST_API" withRust)
    (lib.cmakeBool "LIEF_EXAMPLES" false)
    (lib.cmakeBool "BUILD_SHARED_LIBS" (!stdenv.hostPlatform.isStatic))
    (lib.cmakeFeature "Python_EXECUTABLE" pyEnv.interpreter)
  ];

-  postBuild = ''
+  postBuild = lib.optionalString withPython ''
    pushd ../api/python
    ${pyEnv.interpreter} -m build --no-isolation --wheel --skip-dependency-check --config-setting=--parallel=$NIX_BUILD_CORES
    popd
  '';

-  postInstall = ''
+  postInstall = lib.optionalString withPython ''
    pushd ../api/python
    ${pyEnv.interpreter} -m pip install --prefix $py dist/*.whl
    popd
--- a/pkgs/by-name/li/liteparse/package.nix
+++ b/pkgs/by-name/li/liteparse/package.nix
@@ -64,14 +64,14 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "liteparse";
-  version = "2.14.4";
+  version = "2.14.6";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "run-llama";
    repo = "liteparse";
    tag = "crates-v${finalAttrs.version}";
-    hash = "sha256-E8SjKTw9yCQWKRzwszPneGg74s9CG6wglekeZzH9tNQ=";
+    hash = "sha256-sEZYU41C3AzVJBtDlJFhtU+L1zhx25y1UAF3e5b4kXg=";
  };

  postPatch = ''
@@ -106,7 +106,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    tesseract
  ];

-  cargoHash = "sha256-JaETOf3tRlrr39WyVo2R/IyHZ/qFubk04CNLKdzbebQ=";
+  cargoHash = "sha256-LUiE4bAEhsP98LuCp7qhJS+ybg5qSQVdIfF6lDruO+U=";
  cargoBuildFlags = [
    "--package"
    "liteparse"
--- a/pkgs/by-name/me/memcached/package.nix
+++ b/pkgs/by-name/me/memcached/package.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
    description = "Distributed memory object caching system";
    homepage = "http://memcached.org/";
    license = lib.licenses.bsd3;
-    maintainers = [ lib.maintainers.coconnor ];
+    maintainers = [ ];
    platforms = lib.platforms.linux ++ lib.platforms.darwin;
    mainProgram = "memcached";
  };
--- a/pkgs/by-name/me/mesonlsp/disable-tests-that-require-network-access.patch
+++ b/pkgs/by-name/me/mesonlsp/disable-tests-that-require-network-access.patch
@@ -1,26 +1,12 @@
-From 5a886abd956607503e9dc7cd22923eaf8b01e46f Mon Sep 17 00:00:00 2001
+From 32376566bc8e0e8b43e51cd7e6f14f15ac219baf Mon Sep 17 00:00:00 2001
 From: Pavel Sobolev <contact@paveloom.dev>
 Date: Mon, 3 Jun 2024 20:31:27 +0300
 Subject: [PATCH] Disable tests that require network access.

 ---
- tests/integration/meson.build |  2 --
- tests/libutils/test.cpp       | 20 --------------------
- 2 files changed, 22 deletions(-)
+ tests/libutils/test.cpp | 20 --------------------
+ 1 file changed, 20 deletions(-)

-diff --git a/tests/integration/meson.build b/tests/integration/meson.build
-index da1b3b76..8908e690 100644
--- a/tests/integration/meson.build
-+++ b/tests/integration/meson.build
-@@ -51,8 +51,6 @@ wrap_files = files(
-     'wrap-test/vorbis.wrap',
- )
-
-test('wrap-test', wrap_tester, args: [wrap_files], timeout: 200000)
-
- partial_interpreter_tests = [
-     [
-         'foreach',
 diff --git a/tests/libutils/test.cpp b/tests/libutils/test.cpp
 index 2b20191c..c313312b 100644
 --- a/tests/libutils/test.cpp
@@ -28,7 +14,7 @@ index 2b20191c..c313312b 100644
@@ -131,26 +131,6 @@ TEST(UtilsTest, testMergingDirectories) {
   ASSERT_EQ('a', std::ifstream(outputDir / "i1/a.txt").get());
 }
-
+ 
 -TEST(UtilsTest, testDownloadAndExtraction) {
 -  auto zipFileName = std::filesystem::path{randomFile() + "-1"};
 -  auto result = downloadFile(
@@ -52,6 +38,6 @@ index 2b20191c..c313312b 100644
 int main(int argc, char **argv) {
   testing::InitGoogleTest(&argc, argv);
   return RUN_ALL_TESTS();
--
-2.45.1
+-- 
+2.55.0

--- a/pkgs/by-name/me/mesonlsp/package.nix
+++ b/pkgs/by-name/me/mesonlsp/package.nix
@@ -1,11 +1,9 @@
 {
  lib,
  stdenv,
-  llvmPackages_19,
  fetchFromGitHub,

  gtest,
-  makeWrapper,
  meson,
  ninja,
  pkg-config,
@@ -15,45 +13,91 @@
  libarchive,
  libossp_uuid,
  libpkgconf,
+  tomlplusplus,
  libuuid,
  nlohmann_json,
+  tree-sitter,
  pkgsStatic,

-  mesonlsp,
+  versionCheckHook,
  nix-update-script,
-  testers,
 }:

-let
-  stdenv' = if stdenv.hostPlatform.isDarwin then llvmPackages_19.stdenv else stdenv;
-in
-stdenv'.mkDerivation (finalAttrs: {
+stdenv.mkDerivation (finalAttrs: {
  pname = "mesonlsp";
-  version = "4.3.7";
+  version = "5.0.4";
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "JCWasmx86";
    repo = "mesonlsp";
-    rev = "v${finalAttrs.version}";
-    hash = "sha256-QhZv4PTcf1jzSOcp1+bPZWf5COugCIMq1zkhc0PJjUQ=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-j8J/IREXYwH6KP9KlUTAfLpNN3n7yJSxoh8fqcvQ2P8=";
  };

-  patches = [ ./disable-tests-that-require-network-access.patch ];
+  mesonSubprojects = {
+    ada = fetchFromGitHub {
+      owner = "ada-url";
+      repo = "ada";
+      rev = "v2.7.4";
+      hash = "sha256-V5LwL03x7/a9Lvg1gPvgGipo7IICU7xyO2D3GqP6Lbw=";
+    };
+
+    muon = fetchFromGitHub {
+      owner = "JCWasmx86";
+      repo = "muon";
+      rev = "cea0b8e6c2874d1f2ce4057a17bd37090f619b6b";
+      hash = "sha256-MM47mdMKpQBykWeL1aSufH/BYfy+uAWVJLWWMhXolsE=";
+    };
+
+    sha256 = fetchFromGitHub {
+      owner = "amosnier";
+      repo = "sha-2";
+      rev = "49265c656f9b370da660531db8cc6bf0a2e110a6";
+      hash = "sha256-X9M/ZATYXUiE4oGorPBnsdaKnKaObarnMRh6QEfkBls=";
+    };
+
+    tree-sitter-ini = fetchFromGitHub {
+      owner = "JCWasmx86";
+      repo = "tree-sitter-ini";
+      rev = "848b6269f7039739aebd169fbd3d5e6e34bef661";
+      hash = "sha256-Lmlp20gxwfkWMbk81pBwfS7nc3ZBcMfjPzFB2ozhhLk=";
+    };
+
+    tree-sitter-meson = fetchFromGitHub {
+      owner = "JCWasmx86";
+      repo = "tree-sitter-meson";
+      rev = "09665faff74548820c10d77dd8738cd76d488572";
+      hash = "sha256-ice2NdK1/U3NylIQDnNCN41rK/G6uqFOX+OeNf3zm18=";
+    };
+  };
+
+  patches = [
+    # TODO: use mesonCheckFlag once nixpkgs updates to meson 1.12.0
+    ./disable-tests-that-require-network-access.patch
+  ];
+
+  strictDeps = true;

  nativeBuildInputs = [
-    gtest
-    makeWrapper
    meson
    ninja
    pkg-config
    python3
  ];

+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
  buildInputs = [
    curl
+    gtest
    libarchive
    libpkgconf
    nlohmann_json
+    tomlplusplus
+    tree-sitter
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
    libossp_uuid
@@ -61,101 +105,46 @@ stdenv'.mkDerivation (finalAttrs: {
  ]
  ++ lib.optionals stdenv.hostPlatform.isLinux [ libuuid ];

-  mesonFlags = [ "-Dbenchmarks=false" ];
-
-  mesonCheckFlags = [ "--print-errorlogs" ];
+  mesonFlags = with lib.strings; [
+    (mesonBool "use_own_tree_sitter" false) # one less vendored dependency
+    (mesonBool "benchmarks" false)
+    # meson flags from $src/mesonlsp.spec
+    # couldn't get it to find tracy anyway
+    (mesonEnable "muon:tracy" false)
+    (mesonEnable "muon:meson-docs" false)
+    (mesonEnable "muon:meson-tests" false)
+    (mesonEnable "muon:man-pages" false)
+    (mesonEnable "muon:website" false)
+    (mesonEnable "muon:native_backtrace" false)
+  ];

  doCheck = true;
+  doInstallCheck = true;

-  postUnpack =
-    let
-      ada = fetchFromGitHub {
-        owner = "ada-url";
-        repo = "ada";
-        rev = "v2.7.4";
-        hash = "sha256-V5LwL03x7/a9Lvg1gPvgGipo7IICU7xyO2D3GqP6Lbw=";
-      };
+  postUnpack = ''
+    (
+      cd "$sourceRoot"

-      muon = fetchFromGitHub {
-        owner = "JCWasmx86";
-        repo = "muon";
-        rev = "62af239567ec3b086bae7f02d4aed3a545949155";
-        hash = "sha256-k883mKwuP35f0WtwX8ybl9uYbvA3y6Vxtv2EJMpZDEs=";
-      };
+      ${lib.concatMapAttrsStringSep "\n" (name: value: ''
+        cp -R --no-preserve=mode,ownership ${value} subprojects/${name}
+      '') finalAttrs.mesonSubprojects}

-      sha256 = fetchFromGitHub {
-        owner = "amosnier";
-        repo = "sha-2";
-        rev = "49265c656f9b370da660531db8cc6bf0a2e110a6";
-        hash = "sha256-X9M/ZATYXUiE4oGorPBnsdaKnKaObarnMRh6QEfkBls=";
-      };
-
-      tomlplusplus = fetchFromGitHub {
-        owner = "marzer";
-        repo = "tomlplusplus";
-        rev = "v3.4.0";
-        hash = "sha256-h5tbO0Rv2tZezY58yUbyRVpsfRjY3i+5TPkkxr6La8M=";
-      };
-
-      tree-sitter = fetchFromGitHub {
-        owner = "tree-sitter";
-        repo = "tree-sitter";
-        rev = "v0.20.8";
-        hash = "sha256-278zU5CLNOwphGBUa4cGwjBqRJ87dhHMzFirZB09gYM=";
-      };
-
-      tree-sitter-ini = fetchFromGitHub {
-        owner = "JCWasmx86";
-        repo = "tree-sitter-ini";
-        rev = "20aa563306e9406ac55babb4474521060df90a30";
-        hash = "sha256-1hHjtghBIf7lOPpupT1pUCZQCnzUi4Qt/yHSCdjMhCU=";
-      };
-
-      tree-sitter-meson = fetchFromGitHub {
-        owner = "JCWasmx86";
-        repo = "tree-sitter-meson";
-        rev = "09665faff74548820c10d77dd8738cd76d488572";
-        hash = "sha256-ice2NdK1/U3NylIQDnNCN41rK/G6uqFOX+OeNf3zm18=";
-      };
-    in
-    ''
-      (
-        cd "$sourceRoot/subprojects"
-
-        cp -R --no-preserve=mode,ownership ${ada} ada
-        cp "packagefiles/ada/meson.build" ada
-
-        cp -R --no-preserve=mode,ownership ${muon} muon
-
-        cp -R --no-preserve=mode,ownership ${sha256} sha256
-        cp "packagefiles/sha256/meson.build" sha256
-
-        cp -R --no-preserve=mode,ownership ${tomlplusplus} tomlplusplus-3.4.0
-
-        cp -R --no-preserve=mode,ownership ${tree-sitter} tree-sitter-0.20.8
-        cp "packagefiles/tree-sitter-0.20.8/meson.build" tree-sitter-0.20.8
-
-        cp -R --no-preserve=mode,ownership ${tree-sitter-ini} tree-sitter-ini
-        cp "packagefiles/tree-sitter-ini/meson.build" tree-sitter-ini
-
-        cp -R --no-preserve=mode,ownership ${tree-sitter-meson} tree-sitter-meson
-        cp "packagefiles/tree-sitter-meson/meson.build" tree-sitter-meson
-      )
-    '';
+      meson subprojects packagefiles --apply
+    )
+  '';

  postPatch = ''
-    substituteInPlace subprojects/muon/include/compilers.h \
-      --replace-fail 'compiler_language new' 'compiler_language new_'
-
    patchShebangs src/libtypenamespace
  '';

+  mesonCheckFlags = [
+    "--print-errorlogs"
+    # requires internet
+    # "--exclude=utilstest" (meson 1.12.0)
+  ];
+
  passthru = {
    updateScript = nix-update-script { };
-    tests.version = testers.testVersion {
-      package = mesonlsp;
-      version = "v${finalAttrs.version}";
-    };
  };

  meta = {
@@ -164,9 +153,7 @@ stdenv'.mkDerivation (finalAttrs: {
    changelog = "https://github.com/JCWasmx86/mesonlsp/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.gpl3Plus;
    mainProgram = "mesonlsp";
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.quantenzitrone ];
    platforms = lib.platforms.unix;
-    # ../src/liblog/log.cpp:41:7: error: call to 'format' is ambiguous
-    broken = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64;
  };
 })
--- a/pkgs/by-name/mi/microsoft-edge/package.nix
+++ b/pkgs/by-name/mi/microsoft-edge/package.nix
@@ -164,11 +164,11 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "microsoft-edge";
-  version = "153.0.4234.32";
+  version = "153.0.4234.48";

  src = fetchurl {
    url = "https://packages.microsoft.com/repos/edge/pool/main/m/microsoft-edge-stable/microsoft-edge-stable_${finalAttrs.version}-1_amd64.deb";
-    hash = "sha256-Hn7ZQ9yE0iA2+QZpFAbSUwdT3xtJIydyNOoQBnE7l9E=";
+    hash = "sha256-JVNZQo8F9xzWNpKmJlwOKnRf/wiuDkJh+c/tUdgIEC8=";
  };

  # With strictDeps on, some shebangs were not being patched correctly
--- a/pkgs/by-name/mi/miracle-wm/package.nix
+++ b/pkgs/by-name/mi/miracle-wm/package.nix
@@ -165,7 +165,7 @@ stdenv.mkDerivation (finalAttrs: {
    changelog = "https://github.com/miracle-wm-org/miracle-wm/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.gpl3Only;
    mainProgram = "miracle-wm";
-    maintainers = with lib.maintainers; [ OPNA2608 ];
+    maintainers = [ ];
    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/by-name/mi/miru/package.nix
+++ b/pkgs/by-name/mi/miru/package.nix
@@ -49,7 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://codeberg.org/Vaishnav-Sabari-Girish/miru";
    changelog = "https://codeberg.org/Vaishnav-Sabari-Girish/miru/releases/tag/v${finalAttrs.version}";
    license = lib.licenses.mit;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ yvnth ];
    platforms = lib.platforms.linux;
    mainProgram = "miru-daemon";
  };
--- a/pkgs/by-name/mp/mph_2b_damase/package.nix
+++ b/pkgs/by-name/mp/mph_2b_damase/package.nix
@@ -1,4 +1,5 @@
 {
+  lib,
  stdenvNoCC,
  fetchzip,
  installFonts,
@@ -15,5 +16,9 @@ stdenvNoCC.mkDerivation {

  nativeBuildInputs = [ installFonts ];

-  meta = { };
+  meta = {
+    # Some other repositories list it as Public Domain; couldn't find evidence for this
+    license = lib.licenses.unfree;
+    homepage = "https://www.wazu.jp/gallery/views/View_MPH2BDamase.html";
+  };
 }
--- a/pkgs/by-name/ms/msedgedriver/package.nix
+++ b/pkgs/by-name/ms/msedgedriver/package.nix
@@ -12,11 +12,11 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "msedgedriver";
-  version = "153.0.4234.32";
+  version = "153.0.4234.48";

  src = fetchzip {
    url = "https://msedgedriver.microsoft.com/${finalAttrs.version}/edgedriver_linux64.zip";
-    hash = "sha256-kP3uXg9CueiGUn7zBM3G/0olam2AIxxePXk+OAJLZ2o=";
+    hash = "sha256-5gCrPPjYC/AmsO5vSNTX/r3hm6wATvNeIxRt4TYyZhY=";
    stripRoot = false;
  };

--- a/pkgs/by-name/ne/networkmanager-fortisslvpn/fix-paths.patch
+++ b/pkgs/by-name/ne/networkmanager-fortisslvpn/fix-paths.patch
@@ -1,12 +0,0 @@
-diff --git a/src/nm-fortisslvpn-service.c b/src/nm-fortisslvpn-service.c
-index 6c340d0..995c981 100644
--- a/src/nm-fortisslvpn-service.c
-+++ b/src/nm-fortisslvpn-service.c
-@@ -182,6 +182,7 @@ nm_find_openfortivpn (void)
- {
- 	static const char *openfortivpn_binary_paths[] =
- 		{
-+			"@openfortivpn@/bin/openfortivpn",
- 			"/usr/local/bin/openfortivpn",
- 			"/usr/bin/openfortivpn",
- 			NULL
--- a/pkgs/by-name/ne/networkmanager-fortisslvpn/package.nix
+++ b/pkgs/by-name/ne/networkmanager-fortisslvpn/package.nix
@@ -1,95 +0,0 @@
-{
-  stdenv,
-  lib,
-  fetchurl,
-  replaceVars,
-  openfortivpn,
-  autoreconfHook,
-  gettext,
-  pkg-config,
-  file,
-  glib,
-  gtk3,
-  gtk4,
-  networkmanager,
-  ppp,
-  libsecret,
-  withGnome ? true,
-  gnome,
-  libnma,
-  libnma-gtk4,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "NetworkManager-fortisslvpn";
-  version = "1.4.0";
-  name = "${pname}${lib.optionalString withGnome "-gnome"}-${version}";
-
-  src = fetchurl {
-    url = "mirror://gnome/sources/${pname}/${lib.versions.majorMinor version}/${pname}-${version}.tar.xz";
-    sha256 = "sFXiY0m1FrI1hXmKs+9XtDawFIAOkqiscyz8jnbF2vo=";
-  };
-
-  patches = [
-    (replaceVars ./fix-paths.patch {
-      inherit openfortivpn;
-    })
-    ./support-ppp-2.5.0.patch
-    ./pppd-accept-remote.patch
-  ];
-
-  strictDeps = true;
-
-  nativeBuildInputs = [
-    autoreconfHook
-    gettext
-    pkg-config
-    file
-    glib
-  ];
-
-  buildInputs = [
-    openfortivpn
-    networkmanager
-    ppp
-    glib
-  ]
-  ++ lib.optionals withGnome [
-    gtk3
-    gtk4
-    libsecret
-    libnma
-    libnma-gtk4
-  ];
-
-  configureFlags = [
-    "--with-gnome=${lib.boolToYesNo withGnome}"
-    "--with-gtk4=${lib.boolToYesNo withGnome}"
-    "--localstatedir=/var"
-    "--enable-absolute-paths"
-  ];
-
-  installFlags = [
-    # the installer only creates an empty directory in localstatedir, so
-    # we can drop it
-    "localstatedir=."
-  ];
-
-  passthru = {
-    updateScript = gnome.updateScript {
-      packageName = pname;
-      attrPath = "networkmanager-fortisslvpn";
-      versionPolicy = "odd-unstable";
-    };
-    networkManagerPlugin = "VPN/nm-fortisslvpn-service.name";
-    networkManagerTmpfilesRules = [
-      "d /var/lib/NetworkManager-fortisslvpn 0700 root root -"
-    ];
-  };
-
-  meta = {
-    description = "NetworkManager’s FortiSSL plugin";
-    inherit (networkmanager.meta) maintainers teams platforms;
-    license = lib.licenses.gpl2Plus;
-  };
-}
--- a/pkgs/by-name/ne/networkmanager-fortisslvpn/pppd-accept-remote.patch
+++ b/pkgs/by-name/ne/networkmanager-fortisslvpn/pppd-accept-remote.patch
@@ -1,32 +0,0 @@
-From cea75ece3eaecb17922feda81a4ee81718536d1a Mon Sep 17 00:00:00 2001
-From: Mikhail Novosyolov <m.novosyolov@rosalinux.ru>
-Date: Fri, 14 Mar 2025 07:14:43 +0300
-Subject: [PATCH] Fix routing with pppd 2.5
-
-Tested on ROSA 13 with pppd-2.5.2 and openfortivpn-1.23.1.
-Without this change, routes are not set up correctly and connection does not work properly.
-
-Solution is from https://aur.archlinux.org/packages/networkmanager-fortisslvpn (see PKGBLUILD and comments).
---
- src/nm-fortisslvpn-service.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
-diff --git a/src/nm-fortisslvpn-service.c b/src/nm-fortisslvpn-service.c
-index 8796ace..8f69333 100644
--- a/src/nm-fortisslvpn-service.c
-+++ b/src/nm-fortisslvpn-service.c
-@@ -225,7 +225,11 @@ run_openfortivpn (NMFortisslvpnPlugin *plugin, NMSettingVpn *s_vpn, GError **err
- 	g_ptr_array_add (argv, (gpointer) g_strdup ("-c"));
- 	g_ptr_array_add (argv, (gpointer) g_strdup (priv->config_file));
- 
-+#if WITH_PPP_VERSION >= PPP_VERSION(2,5,0)
-+	g_ptr_array_add (argv, (gpointer) g_strdup ("--pppd-accept-remote"));
-+#else
- 	g_ptr_array_add (argv, (gpointer) g_strdup ("--no-routes"));
-+#endif
- 	g_ptr_array_add (argv, (gpointer) g_strdup ("--no-dns"));
- 	ip4_config = nm_connection_get_setting_ip4_config (priv->connection);
- 	if (!nm_setting_ip_config_get_ignore_auto_dns (ip4_config)) {
-- 
-GitLab
-
--- a/pkgs/by-name/ne/networkmanager-fortisslvpn/support-ppp-2.5.0.patch
+++ b/pkgs/by-name/ne/networkmanager-fortisslvpn/support-ppp-2.5.0.patch
@@ -1,340 +0,0 @@
-From 084ef529c5fb816927ca54866f66b340265aa9f6 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Eivind=20N=C3=A6ss?= <eivnaes@yahoo.com>
-Date: Sat, 4 Mar 2023 21:20:43 +0000
-Subject: [PATCH] Adding support for compiling against pppd-2.5.0 (or master
- branch)
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Signed-off-by: Eivind Næss <eivnaes@yahoo.com>
---
- Makefile.am                                   |  5 +-
- configure.ac                                  | 37 +++++++-
- src/nm-fortisslvpn-pppd-compat.h              | 93 +++++++++++++++++++
- src/nm-fortisslvpn-pppd-plugin.c              | 24 ++---
- ...-status.h => nm-fortisslvpn-pppd-status.h} |  0
- src/nm-fortisslvpn-service.c                  |  2 +-
- 6 files changed, 145 insertions(+), 16 deletions(-)
- create mode 100644 src/nm-fortisslvpn-pppd-compat.h
- rename src/{nm-ppp-status.h => nm-fortisslvpn-pppd-status.h} (100%)
-
-diff --git a/Makefile.am b/Makefile.am
-index b2e5533..e1e5ec9 100644
--- a/Makefile.am
-+++ b/Makefile.am
-@@ -81,7 +81,7 @@ libexec_PROGRAMS += src/nm-fortisslvpn-service
- src_nm_fortisslvpn_service_SOURCES = \
- 	shared/nm-utils/nm-shared-utils.c \
- 	shared/nm-utils/nm-shared-utils.h \
-	src/nm-ppp-status.h \
-+	src/nm-fortisslvpn-pppd-status.h \
- 	src/nm-fortisslvpn-service.h \
- 	src/nm-fortisslvpn-service.c \
- 	shared/nm-fortissl-properties.c \
-@@ -106,7 +106,8 @@ src_nm_fortisslvpn_pppd_plugin_la_SOURCES = \
- 	shared/nm-utils/nm-shared-utils.c \
- 	shared/nm-utils/nm-shared-utils.h \
- 	src/nm-fortisslvpn-pppd-plugin.c \
-	src/nm-ppp-status.h
-+	src/nm-fortisslvpn-pppd-compat.h \
-+	src/nm-fortisslvpn-pppd-status.h
- nodist_src_nm_fortisslvpn_pppd_plugin_la_SOURCES = \
- 	src/nm-fortisslvpn-pppd-service-dbus.h
- src_nm_fortisslvpn_pppd_plugin_la_CPPFLAGS = $(src_cppflags)
-diff --git a/configure.ac b/configure.ac
-index a998707..877493e 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -19,7 +19,10 @@ AC_PROG_CC
- AM_PROG_CC_C_O
- AC_PROG_INSTALL
- AC_PROG_LIBTOOL
-+AC_PROG_CPP
-+AC_PROG_EGREP
- AC_PATH_PROG(GLIB_COMPILE_RESOURCES, glib-compile-resources)
-+PKG_PROG_PKG_CONFIG()
- 
- AC_GNU_SOURCE
- 
-@@ -37,20 +40,50 @@ dnl
- dnl Required headers
- dnl
- AC_HEADER_STDC
-AC_CHECK_HEADERS(fcntl.h paths.h sys/ioctl.h sys/time.h syslog.h unistd.h)
-+AC_CHECK_HEADERS(fcntl.h paths.h stdarg.h stdbool.h sys/ioctl.h sys/time.h syslog.h unistd.h)
- 
- AC_CHECK_HEADERS(pppd/pppd.h,,
-   AC_MSG_ERROR(couldn't find pppd.h. pppd development headers are required.))
- 
-+dnl
-+dnl Check the presense of other pppd/*.h files
-+AC_CHECK_HEADERS([
-+    pppd/chap.h
-+    pppd/chap-new.h
-+    pppd/chap_ms.h
-+    ])
-+
-+dnl
-+dnl Versions >= 2.5.0 will have pkg-config support
-+PKG_CHECK_EXISTS([pppd],
-+    [AS_VAR_SET([pppd_pkgconfig_support],[yes])])
-+
-+dnl
-+dnl Get the version of pppd using pkg-config, assume 2.4.9 if not present
-+PPPD_VERSION=2.4.5
-+if test x"$pppd_pkgconfig_support" = xyes; then
-+    PPPD_VERSION=`$PKG_CONFIG --modversion pppd`
-+fi
-+
-+
- AC_ARG_WITH([pppd-plugin-dir], AS_HELP_STRING([--with-pppd-plugin-dir=DIR], [path to the pppd plugins directory]))
- 
- if test -n "$with_pppd_plugin_dir" ; then
- 	PPPD_PLUGIN_DIR="$with_pppd_plugin_dir"
- else
-	PPPD_PLUGIN_DIR="${libdir}/pppd/2.4.5"
-+	PPPD_PLUGIN_DIR="${libdir}/pppd/$PPPD_VERSION"
- fi
- AC_SUBST(PPPD_PLUGIN_DIR)
- 
-+dnl The version of pppd dictates what code can be included, i.e. enable use of
-+dnl   #if WITH_PPP_VERSION >= PPP_VERSION(2,5,0) in the code
-+AC_DEFINE_UNQUOTED([PPP_VERSION(x,y,z)],
-+    [((x & 0xFF) << 16 | (y & 0xFF) << 8 | (z & 0xFF) << 0)],
-+    [Macro to help determine the particular version of pppd])
-+PPP_VERSION=$(echo $PPPD_VERSION | sed -e "s/\./\,/g")
-+AC_DEFINE_UNQUOTED(WITH_PPP_VERSION, PPP_VERSION($PPP_VERSION),
-+    [The real version of pppd represented as an int])
-+
- dnl
- dnl Checks for typedefs, structures, and compiler characteristics.
- dnl
-diff --git a/src/nm-fortisslvpn-pppd-compat.h b/src/nm-fortisslvpn-pppd-compat.h
-new file mode 100644
-index 0000000..9a02908
--- /dev/null
-+++ b/src/nm-fortisslvpn-pppd-compat.h
-@@ -0,0 +1,93 @@
-+/* -*- Mode: C; tab-width: 4; indent-tabs-mode: t; c-basic-offset: 4 -*- */
-+/* nm-sstp-service - sstp (and other pppd) integration with NetworkManager
-+ *
-+ * Copyright (C) Eivind Næss, eivnaes@yahoo.com
-+ *
-+ * This program is free software; you can redistribute it and/or modify
-+ * it under the terms of the GNU General Public License as published by
-+ * the Free Software Foundation; either version 2 of the License, or
-+ * (at your option) any later version.
-+ *
-+ * This program is distributed in the hope that it will be useful,
-+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
-+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-+ * GNU General Public License for more details.
-+ *
-+ * You should have received a copy of the GNU General Public License along
-+ * with this program; if not, write to the Free Software Foundation, Inc.,
-+ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
-+ *
-+ */
-+
-+#ifndef __NM_FORTISSLVPN_PPPD_COMPAT_H__
-+#define __NM_FORTISSLVPN_PPPD_COMPAT_H__
-+
-+#define INET6      1
-+
-+// PPP < 2.5.0 defines and exports VERSION which overlaps with current package VERSION define.
-+//   this silly macro magic is to work around that.
-+
-+#undef VERSION
-+#include <pppd/pppd.h>
-+
-+#ifndef PPPD_VERSION
-+#define PPPD_VERSION VERSION
-+#endif
-+
-+#include <pppd/fsm.h>
-+#include <pppd/ccp.h>
-+#include <pppd/eui64.h>
-+#include <pppd/ipcp.h>
-+#include <pppd/ipv6cp.h>
-+#include <pppd/eap.h>
-+#include <pppd/upap.h>
-+
-+#ifdef HAVE_PPPD_CHAP_H
-+ #include <pppd/chap.h>
-+#endif
-+
-+#ifdef HAVE_PPPD_CHAP_NEW_H
-+ #include <pppd/chap-new.h>
-+#endif
-+
-+#ifdef HAVE_PPPD_CHAP_MS_H
-+ #include <pppd/chap_ms.h>
-+#endif
-+
-+#ifndef PPP_PROTO_CHAP
-+#define PPP_PROTO_CHAP              0xc223
-+#endif 
-+
-+#ifndef PPP_PROTO_EAP
-+#define PPP_PROTO_EAP               0xc227
-+#endif
-+
-+#if WITH_PPP_VERSION < PPP_VERSION(2,5,0)
-+
-+static inline bool debug_on(void)
-+{
-+    return debug;
-+}
-+
-+static inline const char *ppp_ipparam(void)
-+{
-+    return ipparam;
-+}
-+
-+static inline int ppp_ifunit(void)
-+{
-+    return ifunit;
-+}
-+
-+static inline const char *ppp_ifname(void)
-+{
-+    return ifname;
-+}
-+
-+static inline int ppp_get_mtu(int idx)
-+{
-+    return netif_get_mtu(idx);
-+}
-+
-+#endif // #if WITH_PPP_VERSION < PPP_VERSION(2,5,0)
-+#endif // #ifdef __NM_FORTISSLVPN_PPPD_COMPAT_H__
-diff --git a/src/nm-fortisslvpn-pppd-plugin.c b/src/nm-fortisslvpn-pppd-plugin.c
-index f2ad262..c2efb9a 100644
--- a/src/nm-fortisslvpn-pppd-plugin.c
-+++ b/src/nm-fortisslvpn-pppd-plugin.c
-@@ -23,12 +23,6 @@
- #define ___CONFIG_H__
- #include <config.h>
- 
-#include <pppd/pppd.h>
-#include <pppd/fsm.h>
-#include <pppd/ipcp.h>
-
-#include "nm-default.h"
-
- #include <sys/types.h>
- #include <string.h>
- #include <sys/socket.h>
-@@ -42,10 +36,12 @@
- #include <grp.h>
- #include <glib/gstdio.h>
- 
-+#include "nm-fortisslvpn-pppd-status.h"
-+#include "nm-fortisslvpn-pppd-compat.h"
- #include "nm-fortisslvpn-pppd-service-dbus.h"
-#include "nm-fortisslvpn-service.h"
-#include "nm-ppp-status.h"
- 
-+#include "nm-default.h"
-+#include "nm-fortisslvpn-service.h"
- #include "nm-utils/nm-shared-utils.h"
- #include "nm-utils/nm-vpn-plugin-macros.h"
- 
-@@ -80,7 +76,7 @@ static struct {
- 
- int plugin_init (void);
- 
-char pppd_version[] = VERSION;
-+char pppd_version[] = PPPD_VERSION;
- 
- static void
- chroot_sandbox (void)
-@@ -296,7 +292,7 @@ get_ip4_routes (in_addr_t ouraddr)
- static void
- nm_ip_up (void *data, int arg)
- {
-	guint32 pppd_made_up_address = htonl (0x0a404040 + ifunit);
-+	guint32 pppd_made_up_address = htonl (0x0a404040 + ppp_ifunit());
- 	ipcp_options opts = ipcp_gotoptions[0];
- 	ipcp_options peer_opts = ipcp_hisoptions[0];
- 	GVariantBuilder builder;
-@@ -317,7 +313,7 @@ nm_ip_up (void *data, int arg)
- 
- 	g_variant_builder_add (&builder, "{sv}",
- 	                       NM_VPN_PLUGIN_IP4_CONFIG_TUNDEV,
-	                       g_variant_new_string (ifname));
-+	                       g_variant_new_string (ppp_ifname()));
- 
- 	str = g_getenv ("VPN_GATEWAY");
- 	if (str) {
-@@ -442,8 +438,14 @@ plugin_init (void)
- 		return -1;
- 	}
- 
-+#if WITH_PPP_VERSION < PPP_VERSION(2,5,0)
- 	add_notifier (&phasechange, nm_phasechange, NULL);
- 	add_notifier (&ip_up_notifier, nm_ip_up, NULL);
- 	add_notifier (&exitnotify, nm_exit_notify, NULL);
-+#else
-+	ppp_add_notify (NF_PHASE_CHANGE, nm_phasechange, NULL);
-+	ppp_add_notify (NF_IP_UP, nm_ip_up, NULL);
-+	ppp_add_notify (NF_EXIT, nm_exit_notify, NULL);
-+#endif	
- 	return 0;
- }
-diff --git a/src/nm-ppp-status.h b/src/nm-fortisslvpn-pppd-status.h
-similarity index 100%
-rename from src/nm-ppp-status.h
-rename to src/nm-fortisslvpn-pppd-status.h
-diff --git a/src/nm-fortisslvpn-service.c b/src/nm-fortisslvpn-service.c
-index 6c340d0..a8483c2 100644
--- a/src/nm-fortisslvpn-service.c
-+++ b/src/nm-fortisslvpn-service.c
-@@ -40,7 +40,7 @@
- #include <glib/gstdio.h>
- 
- #include "nm-fortissl-properties.h"
-#include "nm-ppp-status.h"
-+#include "nm-fortisslvpn-pppd-status.h"
- #include "nm-fortisslvpn-pppd-service-dbus.h"
- #include "nm-utils/nm-shared-utils.h"
- #include "nm-utils/nm-vpn-plugin-macros.h"
-- 
-GitLab
-
-
-
-From 8773f772d39f8eee6edc1fd2e5437c754ed41e1e Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?Eivind=20N=C3=A6ss?= <eivnaes@yahoo.com>
-Date: Sat, 4 Mar 2023 21:29:54 +0000
-Subject: [PATCH] Fixing configure.ac from previous change
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Signed-off-by: Eivind Næss <eivnaes@yahoo.com>
---
- configure.ac | 6 +-----
- 1 file changed, 1 insertion(+), 5 deletions(-)
-
-diff --git a/configure.ac b/configure.ac
-index 877493e..a5b4abb 100644
--- a/configure.ac
-+++ b/configure.ac
-@@ -47,11 +47,7 @@ AC_CHECK_HEADERS(pppd/pppd.h,,
- 
- dnl
- dnl Check the presense of other pppd/*.h files
-AC_CHECK_HEADERS([
-    pppd/chap.h
-    pppd/chap-new.h
-    pppd/chap_ms.h
-    ])
-+AC_CHECK_HEADERS(pppd/chap.h pppd/chap-new.h pppd/chap_ms.h)
- 
- dnl
- dnl Versions >= 2.5.0 will have pkg-config support
-- 
-GitLab
-
--- a/pkgs/by-name/ne/networkmanager-iodine/CVE-2026-91837.patch
+++ b/pkgs/by-name/ne/networkmanager-iodine/CVE-2026-91837.patch
@@ -0,0 +1,203 @@
+diff --git a/src/nm-iodine-service.c b/src/nm-iodine-service.c
+index 75a1610e4281588336985636a2dd4eda03575d3a..2cc74f6859304a895be0080dd50f72ddd29a8219 100644
+--- a/src/nm-iodine-service.c
+++ b/src/nm-iodine-service.c
+@@ -468,14 +468,58 @@ send_password(gint fd, NMSettingVpn *s_vpn)
+ }
+ 
+ 
+-static gint
+static gboolean
+label_is_valid (const gchar *label, gsize len)
+{
+	if (len == 0 || len > 63)
+		return FALSE;
+	if (label[0] == '-' || label[len - 1] == '-')
+		return FALSE;
+	for (gsize i = 0; i < len; i++)
+		if (!g_ascii_isalnum (label[i]) && label[i] != '-')
+			return FALSE;
+	return TRUE;
+}
+
+
+static gboolean
+domain_is_valid (const gchar *domain)
+{
+	g_autofree char *ascii = NULL;
+	g_auto (GStrv) labels = NULL;
+
+	if (domain == NULL || *domain == '\0')
+		return FALSE;
+
+	/* Normalizes IDN labels to punycode; NULL on malformed UTF-8/encoding */
+	ascii = g_hostname_to_ascii (domain);
+	if (ascii == NULL)
+		return FALSE;
+
+	if (strlen (ascii) > 253)
+		return FALSE;
+
+	labels = g_strsplit (ascii, ".", -1);
+	if (labels == NULL || labels[0] == NULL || labels[1] == NULL)
+		return FALSE;
+
+	for (int i = 0; labels[i] != NULL; i++) {
+		if (!label_is_valid (labels[i], -1))
+			return FALSE;
+	}
+
+	return TRUE;
+}
+
+
+static gboolean
+ nm_iodine_start_iodine_binary (NMIodinePlugin *plugin,
+                                NMSettingVpn *s_vpn,
+                                GError **error)
+ {
+ 	GPid pid;
+ 	const char **iodine_binary = NULL;
+-	GPtrArray *iodine_argv;
+	g_autoptr (GPtrArray) iodine_argv = g_ptr_array_new_full (12, NULL);
+ 	GSource *iodine_watch;
+ 	GIOChannel *stderr_channel;
+ 	gint stdin_fd, stderr_fd;
+@@ -491,27 +535,20 @@ nm_iodine_start_iodine_binary (NMIodinePlugin *plugin,
+ 	}
+ 
+ 	if (!*iodine_binary) {
+-		g_set_error (error,
+-		             NM_VPN_PLUGIN_ERROR,
+-		             NM_VPN_PLUGIN_ERROR_LAUNCH_FAILED,
+-		             "%s",
+-		             _("Could not find iodine binary."));
+-		return -1;
+		g_set_error_literal (error,
+							 NM_VPN_PLUGIN_ERROR,
+							 NM_VPN_PLUGIN_ERROR_LAUNCH_FAILED,
+							 _("Could not find iodine binary."));
+		return FALSE;
+ 	}
+ 
+ 	props_fragsize = nm_setting_vpn_get_data_item (s_vpn, NM_IODINE_KEY_FRAGSIZE);
+ 	props_nameserver = nm_setting_vpn_get_data_item (s_vpn, NM_IODINE_KEY_NAMESERVER);
+ 	props_topdomain = nm_setting_vpn_get_data_item (s_vpn, NM_IODINE_KEY_TOPDOMAIN);
+-	iodine_argv = g_ptr_array_new ();
+ 	g_ptr_array_add (iodine_argv, (gpointer) (*iodine_binary));
+ 	/* Run in foreground */
+ 	g_ptr_array_add (iodine_argv, (gpointer) "-f");
+ 
+-	if (props_fragsize && strlen(props_fragsize)) {
+-		g_ptr_array_add (iodine_argv, (gpointer) "-m");
+-		g_ptr_array_add (iodine_argv, (gpointer) props_fragsize);
+-	}
+-
+ 	if (has_user(NM_IODINE_USER)) {
+ 		g_ptr_array_add (iodine_argv, (gpointer) "-u");
+ 		g_ptr_array_add (iodine_argv, (gpointer) NM_IODINE_USER);
+@@ -524,11 +561,51 @@ nm_iodine_start_iodine_binary (NMIodinePlugin *plugin,
+ 	} else
+ 		g_warning("Not running chrooted");
+ 
+-	if (props_nameserver && strlen(props_nameserver))
+-		g_ptr_array_add (iodine_argv, (gpointer) props_nameserver);
+	if (props_fragsize && strlen(props_fragsize)) {
+		gchar *end = NULL;
+ 
+-	if (props_topdomain && strlen(props_topdomain))
+-		g_ptr_array_add (iodine_argv, (gpointer) props_topdomain);
+		(void)g_ascii_strtoll(props_fragsize, &end, 10);
+		if (end != props_fragsize || *end == '\0') {
+			g_ptr_array_add (iodine_argv, (gpointer) "-m");
+			g_ptr_array_add (iodine_argv, (gpointer) props_fragsize);
+		} else {
+			g_warning("Failed to parse fragment size");
+			g_set_error (error,
+						 NM_VPN_PLUGIN_ERROR,
+						 NM_VPN_PLUGIN_ERROR_LAUNCH_FAILED,
+						 _("Invalid fragment size '%s'"),
+						 props_fragsize);
+			return FALSE;
+		}
+	}
+
+	if (props_nameserver && strlen(props_nameserver)) {
+		g_autoptr (GInetAddress) addr = g_inet_address_new_from_string (props_nameserver);
+
+		if (addr) {
+			g_ptr_array_add (iodine_argv, (gpointer) props_nameserver);
+		} else {
+			g_set_error (error,
+						 NM_VPN_PLUGIN_ERROR,
+						 NM_VPN_PLUGIN_ERROR_LAUNCH_FAILED,
+						 _("Invalid nameserver '%s'"),
+						 props_nameserver);
+			return FALSE;
+		}
+	}
+
+	if (props_topdomain && strlen(props_topdomain)) {
+		if (domain_is_valid (props_topdomain))
+			g_ptr_array_add (iodine_argv, (gpointer) props_topdomain);
+		else {
+			g_set_error (error,
+						 NM_VPN_PLUGIN_ERROR,
+						 NM_VPN_PLUGIN_ERROR_LAUNCH_FAILED,
+						 _("Invalid domain '%s'"),
+						 props_topdomain);
+			return FALSE;
+		}
+	}
+ 
+ 	g_ptr_array_add (iodine_argv, NULL);
+ 
+@@ -536,11 +613,9 @@ nm_iodine_start_iodine_binary (NMIodinePlugin *plugin,
+ 	                               G_SPAWN_DO_NOT_REAP_CHILD,
+ 	                               NULL, NULL,
+ 	                               &pid, &stdin_fd, NULL, &stderr_fd, error)) {
+-		g_ptr_array_free (iodine_argv, TRUE);
+ 		g_warning ("iodine failed to start. error: '%s'", (*error)->message);
+-		return -1;
+		return FALSE;
+ 	}
+-	g_ptr_array_free (iodine_argv, TRUE);
+ 
+ 	g_message ("iodine started with pid %d", pid);
+ 
+@@ -556,13 +631,13 @@ nm_iodine_start_iodine_binary (NMIodinePlugin *plugin,
+ 	priv->pid = pid;
+ 	iodine_watch = g_child_watch_source_new (pid);
+ 	g_source_set_callback (iodine_watch,
+-	                       (GSourceFunc) iodine_watch_cb,
+	                       G_SOURCE_FUNC (iodine_watch_cb),
+ 	                       plugin,
+ 	                       NULL);
+ 	g_source_attach (iodine_watch, NULL);
+ 	g_source_unref (iodine_watch);
+ 
+-	return 0;
+	return TRUE;
+ }
+ 
+ static gboolean
+@@ -572,7 +647,7 @@ real_connect (NMVpnServicePlugin *plugin,
+ {
+ 	NMSettingVpn *s_vpn;
+ 	NMIodinePluginPrivate *priv = nm_iodine_plugin_get_instance_private (NM_IODINE_PLUGIN(plugin));
+-	gint ret = -1;
+	gboolean success;
+ 
+ 	g_variant_builder_init(&priv->ip4config, G_VARIANT_TYPE_VARDICT);
+ 
+@@ -584,8 +659,8 @@ real_connect (NMVpnServicePlugin *plugin,
+ 	if (!nm_iodine_secrets_validate (s_vpn, error))
+ 		goto out;
+ 
+-	ret = nm_iodine_start_iodine_binary (NM_IODINE_PLUGIN (plugin), s_vpn, error);
+-	if (!ret)
+	success = nm_iodine_start_iodine_binary (NM_IODINE_PLUGIN (plugin), s_vpn, error);
+	if (success)
+ 		return TRUE;
+ 
+  out:
--- a/pkgs/by-name/ne/networkmanager-iodine/package.nix
+++ b/pkgs/by-name/ne/networkmanager-iodine/package.nix
@@ -32,6 +32,10 @@ stdenv.mkDerivation {
    (replaceVars ./fix-paths.patch {
      inherit iodine;
    })
+
+    # https://gitlab.gnome.org/GNOME/network-manager-iodine/-/issues/4
+    # https://gitlab.gnome.org/GNOME/network-manager-iodine/-/merge_requests/6
+    ./CVE-2026-91837.patch
  ];

  nativeBuildInputs = [
--- a/pkgs/by-name/ne/networkmanager-libreswan/fix-paths.patch
+++ b/pkgs/by-name/ne/networkmanager-libreswan/fix-paths.patch
@@ -0,0 +1,48 @@
+diff --git a/properties/nm-libreswan-editor-plugin.c b/properties/nm-libreswan-editor-plugin.c
+index 6a178af..787e183 100644
+--- a/properties/nm-libreswan-editor-plugin.c
+++ b/properties/nm-libreswan-editor-plugin.c
+@@ -96,7 +96,7 @@ export_to_file(NMVpnEditorPlugin *self, const char *path, NMConnection *connecti
+ 
+ 	openswan = nm_streq(nm_setting_vpn_get_service_type(s_vpn), NM_VPN_SERVICE_TYPE_OPENSWAN);
+ 
+-	nm_libreswan_detect_version(nm_libreswan_find_helper_bin("ipsec", NULL),
+	nm_libreswan_detect_version("@ipsec@",
+ 	                            &is_openswan,
+ 	                            &version,
+ 	                            NULL);
+diff --git a/src/nm-libreswan-service.c b/src/nm-libreswan-service.c
+index 0458d4e..e0add02 100644
+--- a/src/nm-libreswan-service.c
+++ b/src/nm-libreswan-service.c
+@@ -1820,7 +1820,7 @@ connect_step(NMLibreswanPlugin *self, GError **error)
+ 		if (!priv->openswan) {
+ 			const char *stackman_path;
+ 
+-			stackman_path = nm_libreswan_find_helper_libexec("_stackmanager", error);
+			stackman_path = "@libreswan@/libexec/_stackmanager";
+ 			if (!stackman_path)
+ 				return FALSE;
+ 
+@@ -1977,7 +1977,7 @@ _connect_common(NMVpnServicePlugin *plugin,
+ 		return FALSE;
+ 	}
+ 
+-	priv->ipsec_path = nm_libreswan_find_helper_bin("ipsec", error);
+	priv->ipsec_path = "@ipsec@";
+ 	if (!priv->ipsec_path)
+ 		return FALSE;
+ 
+@@ -1988,10 +1988,10 @@ _connect_common(NMVpnServicePlugin *plugin,
+ 	      priv->openswan ? "Openswan" : "Libreswan");
+ 
+ 	if (!priv->openswan) {
+-		priv->pluto_path = nm_libreswan_find_helper_libexec("pluto", error);
+		priv->pluto_path = "@libreswan@/libexec/pluto";
+ 		if (!priv->pluto_path)
+ 			return FALSE;
+-		priv->whack_path = nm_libreswan_find_helper_libexec("whack", error);
+		priv->whack_path = "@libreswan@/libexec/whack";
+ 		if (!priv->whack_path)
+ 			return FALSE;
+ 	}
--- a/pkgs/by-name/ne/networkmanager-libreswan/package.nix
+++ b/pkgs/by-name/ne/networkmanager-libreswan/package.nix
@@ -0,0 +1,85 @@
+{
+  dieHook,
+  fetchpatch,
+  fetchurl,
+  glib,
+  gnome,
+  gtk3,
+  gtk4,
+  intltool,
+  lib,
+  libnl,
+  libnma,
+  libnma-gtk4,
+  libreswan,
+  libsecret,
+  networkmanager,
+  pkg-config,
+  replaceVars,
+  stdenv,
+  withGnome ? true,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "NetworkManager-libreswan";
+  version = "1.2.31";
+
+  src = fetchurl {
+    url = "mirror://gnome/sources/NetworkManager-libreswan/${lib.versions.majorMinor finalAttrs.version}/NetworkManager-libreswan-${finalAttrs.version}.tar.xz";
+    hash = "sha256-5xq3zWruZoOqlDQusm5hQzv/3y2ml4LsptHCmdzDp28=";
+  };
+
+  patches = [
+    (replaceVars ./fix-paths.patch {
+      ipsec = lib.getExe' libreswan "ipsec";
+      inherit libreswan;
+    })
+  ];
+
+  nativeBuildInputs = [
+    dieHook
+    glib
+    intltool
+    pkg-config
+  ];
+
+  buildInputs = [
+    libnl
+    networkmanager
+  ]
+  ++ lib.optionals withGnome [
+    gtk3
+    gtk4
+    libnma
+    libnma-gtk4
+    libsecret
+  ];
+
+  configureFlags = [
+    "--with-gnome=${lib.boolToYesNo withGnome}"
+    "--with-gtk4=${lib.boolToYesNo withGnome}"
+    "--enable-absolute-paths"
+  ];
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  postPatch = ''
+    echo "Ensuring that all helper paths lookups were replaced"
+    ! grep -lr nm_libreswan_find_helper --exclude 'utils.[ch]' || die "^ Found non-replaced helper lookup"
+  '';
+
+  passthru = {
+    updateScript = gnome.updateScript {
+      packageName = "NetworkManager-libreswan";
+      attrPath = "networkmanager-libreswan";
+    };
+    networkManagerPlugin = "VPN/nm-libreswan-service.name";
+  };
+
+  meta = {
+    description = "NetworkManager's libreswan plugin";
+    inherit (networkmanager.meta) maintainers teams platforms;
+    license = lib.licenses.gpl2Plus;
+  };
+})
--- a/pkgs/by-name/ne/networkmanager-sstp/package.nix
+++ b/pkgs/by-name/ne/networkmanager-sstp/package.nix
@@ -78,6 +78,9 @@ stdenv.mkDerivation rec {
  meta = {
    description = "NetworkManager's sstp plugin";
    inherit (networkmanager.meta) maintainers teams platforms;
+    knownVulnerabilities = [
+      "CVE-2026-91838"
+    ];
    license = lib.licenses.gpl2Plus;
  };
 }
--- a/pkgs/by-name/ne/networkmanager-vpnc/export_nm_vpn_editor_factory_vpnc.patch
+++ b/pkgs/by-name/ne/networkmanager-vpnc/export_nm_vpn_editor_factory_vpnc.patch
@@ -1,46 +0,0 @@
-commit 4c9e26cdc9f58f0e35aa345ae3bb643bea139608
-Author: Christian Krause <chkr@plauener.de>
-Date:   Tue May 6 00:33:39 2025 +0200
-
-    Export nm_vpn_editor_factory_vpnc properly
-    
-    - commit e2fc231149165cb37a25362b85cbcd58b15a2a11 removed
-      libnm-glib version
-    - after that commit, nm_vpn_editor_factory_vpnc was not correctly
-      exported anymore which caused the settings editor be missing
-      when adding or editing a vnpc connection in gnome-control-center
-    - this commit re-adds the removed G_MODULE_EXPORT declaration
-
-diff --git a/properties/nm-vpnc-editor.c b/properties/nm-vpnc-editor.c
-index a06807d..0c8081d 100644
--- a/properties/nm-vpnc-editor.c
-+++ b/properties/nm-vpnc-editor.c
-@@ -27,7 +27,6 @@
- #include "nm-default.h"
- 
- #include "nm-vpnc-editor.h"
-#include "nm-vpnc-editor-plugin.h"
- 
- #include <nma-cert-chooser.h>
- #include <netinet/in.h>
-@@ -1130,3 +1129,20 @@ vpnc_editor_interface_init (NMVpnEditorInterface *iface)
- 	iface->get_widget = get_widget;
- 	iface->update_connection = update_connection;
- }
-+
-+/*****************************************************************************/
-+
-+#ifndef NM_VPN_OLD
-+
-+#include "nm-vpnc-editor-plugin.h"
-+
-+G_MODULE_EXPORT NMVpnEditor *
-+nm_vpn_editor_factory_vpnc (NMVpnEditorPlugin *editor_plugin,
-+                            NMConnection *connection,
-+                            GError **error)
-+{
-+       g_return_val_if_fail (!error || !*error, NULL);
-+
-+       return nm_vpnc_editor_new (connection, error);
-+}
-+#endif
--- a/pkgs/by-name/ne/networkmanager-vpnc/fix-paths.patch
+++ b/pkgs/by-name/ne/networkmanager-vpnc/fix-paths.patch
@@ -1,31 +0,0 @@
--- a/properties/nm-vpnc-editor-plugin.c
-+++ b/properties/nm-vpnc-editor-plugin.c
-@@ -161,7 +161,7 @@
- 	GError *error = NULL;
- 
- 	const char *decrypt_possible_paths[] = {
-		"/usr/lib/vpnc/cisco-decrypt",
-+		"@vpnc@/bin/cisco-decrypt",
- 		"/usr/bin/cisco-decrypt",
- 		NULL
- 	};
--- a/src/nm-vpnc-service.c
-+++ b/src/nm-vpnc-service.c
-@@ -610,7 +610,7 @@
- find_vpnc (void)
- {
- 	static const char *vpnc_paths[] = {
-		"/usr/sbin/vpnc",
-+		"@vpnc@/bin/vpnc",
- 		"/sbin/vpnc",
- 		"/usr/local/sbin/vpnc",
- 		NULL
-@@ -1308,7 +1308,7 @@
- 	_LOGD ("   vpnc interactive mode is %s", interactive_available ? "enabled" : "disabled");
- 	_LOGD ("   uses%s --bus-name \"%s\"", bus_name_free ? "" : " default", bus_name);
- 
-	if (system ("/sbin/modprobe tun") == -1)
-+	if (system ("@kmod@/bin/modprobe tun") == -1)
- 		exit (EXIT_FAILURE);
- 
- 	plugin = nm_vpnc_plugin_new (bus_name);
--- a/pkgs/by-name/ne/networkmanager-vpnc/package.nix
+++ b/pkgs/by-name/ne/networkmanager-vpnc/package.nix
@@ -1,79 +0,0 @@
-{
-  stdenv,
-  lib,
-  fetchpatch,
-  fetchurl,
-  replaceVars,
-  vpnc,
-  pkg-config,
-  networkmanager,
-  libsecret,
-  gtk3,
-  gtk4,
-  withGnome ? true,
-  gnome,
-  glib,
-  kmod,
-  file,
-  libnma,
-  libnma-gtk4,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "NetworkManager-vpnc";
-  version = "1.4.0";
-
-  src = fetchurl {
-    url = "mirror://gnome/sources/NetworkManager-vpnc/${lib.versions.majorMinor version}/NetworkManager-vpnc-${version}.tar.xz";
-    sha256 = "47KpiIAnWht1FUvDF6eGQ8/fnqfnDfTu2WSPKeolNzA=";
-  };
-
-  patches = [
-    (replaceVars ./fix-paths.patch {
-      inherit vpnc kmod;
-    })
-    # https://gitlab.gnome.org/GNOME/NetworkManager-vpnc/-/merge_requests/19
-    ./export_nm_vpn_editor_factory_vpnc.patch
-  ];
-
-  nativeBuildInputs = [
-    pkg-config
-    file
-    glib
-  ];
-
-  buildInputs = [
-    vpnc
-    networkmanager
-  ]
-  ++ lib.optionals withGnome [
-    gtk3
-    gtk4
-    libsecret
-    libnma
-    libnma-gtk4
-  ];
-
-  configureFlags = [
-    "--with-gnome=${lib.boolToYesNo withGnome}"
-    "--with-gtk4=${lib.boolToYesNo withGnome}"
-    "--enable-absolute-paths"
-  ];
-
-  strictDeps = true;
-
-  passthru = {
-    updateScript = gnome.updateScript {
-      packageName = pname;
-      attrPath = "networkmanager-vpnc";
-      versionPolicy = "odd-unstable";
-    };
-    networkManagerPlugin = "VPN/nm-vpnc-service.name";
-  };
-
-  meta = {
-    description = "NetworkManager's VPNC plugin";
-    inherit (networkmanager.meta) maintainers teams platforms;
-    license = lib.licenses.gpl2Plus;
-  };
-}
--- a/pkgs/by-name/no/nordpass/package.nix
+++ b/pkgs/by-name/no/nordpass/package.nix
@@ -155,7 +155,7 @@ let
      description = "Secure and simple password manager for a stress-free online experience";
      license = lib.licenses.unfree;
      mainProgram = "nordpass";
-      maintainers = with lib.maintainers; [ coconnor ];
+      maintainers = [ ];
      platforms = [ "x86_64-linux" ];
      sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
    };
--- a/pkgs/by-name/nv/nvc/package.nix
+++ b/pkgs/by-name/nv/nvc/package.nix
@@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "nvc";
-  version = "1.22.1";
+  version = "1.23.0";

  src = fetchFromGitHub {
    owner = "nickg";
    repo = "nvc";
    tag = "r${finalAttrs.version}";
-    hash = "sha256-FA9GzfwsQRI3OOJQ54H8+JbgVtIz2F4xncVDUHRzgRA=";
+    hash = "sha256-1L7IdncoQ1H6e51Bikmjnw8XLse+ttUgrI/0/h+Q56Q=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ob/obscura/package.nix
+++ b/pkgs/by-name/ob/obscura/package.nix
@@ -5,6 +5,9 @@
  rustPlatform,
  openssl,
  pkg-config,
+  cmake,
+  perl,
+  git,
  nix-update-script,
  versionCheckHook,
  _experimental-update-script-combinators,
@@ -27,8 +30,24 @@ rustPlatform.buildRustPackage rec {

  cargoHash = "sha256-YUKy5m6gOHD62kcOuk/o3oj1MfudeetBQV4q5asaOqQ=";

+  # Enable the `render` (HTML rendering/PDF) and `stealth` (anti-bot
+  # evasion) features.
+  buildFeatures = [
+    "render"
+    "stealth"
+  ];
+
  nativeBuildInputs = [
    pkg-config
+    # Sets LIBCLANG_PATH/BINDGEN_EXTRA_CLANG_ARGS for crates using the
+    # `bindgen` crate at build time (e.g. boringssl's rust bindings).
+    rustPlatform.bindgenHook
+    # btls-sys (pulled in via the `render` feature) builds its bundled
+    # BoringSSL checkout with CMake during the build.
+    cmake
+    perl
+    # btls-sys also runs `git init` on the BoringSSL checkout.
+    git
  ];

  buildInputs = [
--- a/pkgs/by-name/on/oniux/package.nix
+++ b/pkgs/by-name/on/oniux/package.nix
@@ -7,17 +7,17 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "oniux";
-  version = "0.12.0";
+  version = "0.13.0";

  src = fetchFromGitLab {
    domain = "gitlab.torproject.org";
    owner = "tpo/core";
    repo = "oniux";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-04JywbJ//qgA56/5C4DZOliryZCnO0K3/0lyevFz7hk=";
+    hash = "sha256-0XmgaNDob+e5yCEFaySj++6M0uJFmP5aQjjnLJDRx14=";
  };

-  cargoHash = "sha256-a0hV4q288IWFC1a1jTvgkXAVyKGm8OnsRHwShnQjywI=";
+  cargoHash = "sha256-zNo7HI+p5grdTayXDehMwAeEq4aOPYGSPb06c4ib95s=";

  nativeBuildInputs = [
    perl
--- a/pkgs/by-name/op/openslide/package.nix
+++ b/pkgs/by-name/op/openslide/package.nix
@@ -9,7 +9,6 @@
  cairo,
  doxygen,
  glib,
-  gdk-pixbuf,
  libdicom,
  libjpeg,
  libpng,
@@ -23,13 +22,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "openslide";
-  version = "4.0.0";
+  version = "4.0.1";

  src = fetchFromGitHub {
    owner = "openslide";
    repo = "openslide";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-9LvQ7FG/0E0WpFyIUyrL4Fvn60iYWejjbgdKHMVOFdI=";
+    hash = "sha256-9OrPdhO6ysDL6xSzCGv6IYWvYErZeMwb/VkU9YZp5Zg=";
  };

  depsBuildBuild = [
@@ -43,10 +42,12 @@ stdenv.mkDerivation (finalAttrs: {
    doxygen
  ];

+  # The upstream developer test suite creates a virtualenv and downloads dependencies.
+  mesonFlags = [ "-Dtest=disabled" ];
+
  buildInputs = [
    cairo
    glib
-    gdk-pixbuf
    libdicom
    libjpeg
    libpng
--- a/pkgs/by-name/op/openspec/package.nix
+++ b/pkgs/by-name/op/openspec/package.nix
@@ -13,7 +13,7 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "openspec";
-  version = "1.13.0";
+  version = "1.13.1";
  __structuredAttrs = true;
  strictDeps = true;

@@ -21,14 +21,14 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    owner = "Fission-AI";
    repo = "OpenSpec";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-LXZ6MBhP9QhdvT3VbI9uwXluYlJaIqenEgedTWwE6nY=";
+    hash = "sha256-4iWzhVhTmBeKwTGA0W3Ss1VgChOXzZ9gYalwBBhxJa4=";
  };

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
    pnpm = pnpm_10;
    fetcherVersion = 3;
-    hash = "sha256-hET2NApPPSep8v59HcVGk3jfWLssaBnQisJF0Gx7ZE8=";
+    hash = "sha256-oz4tsfu05IPDMaBBp5jLbfsxvTmw1oVtNFtpvudCOPE=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/pc/pcsx2/package.nix
+++ b/pkgs/by-name/pc/pcsx2/package.nix
@@ -17,6 +17,7 @@
  lz4,
  pkg-config,
  qt6,
+  rapidyaml,
  shaderc,
  soundtouch,
  strip-nondeterminism,
@@ -35,8 +36,8 @@ let
  pcsx2_patches = fetchFromGitHub {
    owner = "PCSX2";
    repo = "pcsx2_patches";
-    rev = "39c64ed2151155a9e7b9cc41129618c1ba0ad04f";
-    hash = "sha256-C5diPrIXvzOvskKQFjYWOfjQUkb/Omw2IN3K4b3nsK4=";
+    rev = "57e7089511430020ad9a8b22c6d27a593057d50a";
+    hash = "sha256-tua44ywpqCsbMMhS8G5K4nJJyQNIUvB35EBkTf7WurI=";
  };

  inherit (qt6)
@@ -49,13 +50,13 @@ let
 in
 llvmPackages.stdenv.mkDerivation (finalAttrs: {
  pname = "pcsx2";
-  version = "2.6.3";
+  version = "2.8.2";
  src = fetchFromGitHub {
    pname = "pcsx2-source";
    owner = "PCSX2";
    repo = "pcsx2";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-85PZ7ZDoannmwoFeKM7hm7fQS1X2MPxAwm6k+Sa+bGc=";
+    hash = "sha256-sXVeOTVkd/c04M6BduPl34inqSUoJwfJoWCvpFdR4VQ=";
  };

  patches = [
@@ -102,6 +103,7 @@ llvmPackages.stdenv.mkDerivation (finalAttrs: {
    plutovg
    plutosvg
    kddockwidgets
+    rapidyaml
    shaderc
    soundtouch
    vulkan-headers
--- a/pkgs/by-name/pi/pi-coding-agent/package.nix
+++ b/pkgs/by-name/pi/pi-coding-agent/package.nix
@@ -13,16 +13,16 @@
 }:
 buildNpmPackage (finalAttrs: {
  pname = "pi-coding-agent";
-  version = "0.86.0";
+  version = "0.86.1";

  src = fetchFromGitHub {
    owner = "earendil-works";
    repo = "pi";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-HmLJPuhCoeK+aidnRoc5huCMPVAMpTbXcrETPuNCSxE=";
+    hash = "sha256-/7+VoRfXdeOwtiNXQYOKg5OHeKuNLIHfODGDNBhWop0=";
  };

-  npmDepsHash = "sha256-CYVYDdDzfl1VD3EA3FDKf4iDR1Y6wwmrqwGiXJVm40w=";
+  npmDepsHash = "sha256-VxjYw4lN/w0sDboihHAKEhdJFzJa09qZo7vavkTkBuw=";

  # The provider model catalog (packages/ai/src/providers/data/) is generated by
  # a network fetch (models.dev plus provider APIs) and is gitignored upstream,
@@ -31,7 +31,7 @@ buildNpmPackage (finalAttrs: {
  # under dist/providers/data/. Bump this hash alongside version.
  modelData = fetchurl {
    url = "https://registry.npmjs.org/@earendil-works/pi-ai/-/pi-ai-${finalAttrs.version}.tgz";
-    hash = "sha256-1SRIyCenLI/c+fDJbJlmcEqFJaagrhgfS9iGxYTXJ+M=";
+    hash = "sha256-88Nb88YGsJ9iupLSx8ieY+DKGAdUcBAtVWVoTFJLfv0=";
  };

  preConfigure = ''
--- a/pkgs/by-name/po/pokego/package.nix
+++ b/pkgs/by-name/po/pokego/package.nix
@@ -54,6 +54,6 @@ buildGo127Module (finalAttrs: {
    license = lib.licenses.gpl3Only;
    mainProgram = "pokego";
    platforms = lib.platforms.linux;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ yvnth ];
  };
 })
--- a/pkgs/by-name/pr/prosody-filer/package.nix
+++ b/pkgs/by-name/pr/prosody-filer/package.nix
@@ -1,30 +0,0 @@
-{
-  lib,
-  buildGoModule,
-  fetchFromGitHub,
-}:
-
-buildGoModule {
-  pname = "prosody-filer";
-  version = "unstable-2021-05-24";
-
-  src = fetchFromGitHub {
-    owner = "ThomasLeister";
-    repo = "prosody-filer";
-    rev = "c65edd199b47dc505366c85b3702230fda797cd6";
-    hash = "sha256-HrCJjsa3cYK1g7ylkDiCikgxJzbuGg1/5Zz4R12520A=";
-  };
-
-  vendorHash = "sha256-bbkCxS0UU8PIg/Xjo2X1Mia3WHjtBxYGmwj1c/ScVxc=";
-
-  doCheck = false;
-
-  meta = {
-    homepage = "https://github.com/ThomasLeister/prosody-filer";
-    maintainers = [ ];
-    license = lib.licenses.mit;
-    platforms = lib.platforms.linux;
-    description = "Simple file server for handling XMPP http_upload requests";
-    mainProgram = "prosody-filer";
-  };
-}
--- a/pkgs/by-name/sc/scenefx/package.nix
+++ b/pkgs/by-name/sc/scenefx/package.nix
@@ -68,7 +68,10 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = finalAttrs.src.meta.homepage;
    license = lib.licenses.mit;
    mainProgram = "scenefx";
-    maintainers = with lib.maintainers; [ swarsel ];
+    maintainers = with lib.maintainers; [
+      swarsel
+      yvnth
+    ];
    pkgConfigModules = [ "scenefx-${lib.versions.majorMinor finalAttrs.version}" ];
    platforms = lib.platforms.all;
  };
--- a/pkgs/by-name/sc/schemesh/package.nix
+++ b/pkgs/by-name/sc/schemesh/package.nix
@@ -11,20 +11,15 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "schemesh";
-  version = "1.0.1";
+  version = "1.0.2";

  src = fetchFromGitHub {
    owner = "cosmos72";
    repo = "schemesh";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Sk2AZXd5kBR3Er8GeVm+10BaLwFL9k0v5Uk5CmuWv6o=";
+    hash = "sha256-EeFj2//vqYFwiFxK1NSoK1t49i0i7W3MMWLr2Dk5oSk=";
  };

-  postPatch = ''
-    # https://github.com/cosmos72/schemesh/commit/696ba7c24737cd436bb4d8bfa9ec1ea517681403
-    substituteInPlace c/dir.c --replace-fail PATH_MAX 1024
-  '';
-
  preBuild = lib.optionalString stdenv.hostPlatform.isDarwin ''
    # error initializing POSIX subsystem: dup2(0, tty_fd) failed with error Bad file descriptor
    ulimit -n 128
--- a/pkgs/by-name/se/selenium-server-standalone/package.nix
+++ b/pkgs/by-name/se/selenium-server-standalone/package.nix
@@ -42,9 +42,7 @@ stdenv.mkDerivation rec {
    description = "Selenium Server for remote WebDriver";
    sourceProvenance = with lib.sourceTypes; [ binaryBytecode ];
    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [
-      coconnor
-    ];
+    maintainers = [ ];
    mainProgram = "selenium-server";
    platforms = lib.platforms.all;
  };
--- a/pkgs/by-name/so/sof-firmware/package.nix
+++ b/pkgs/by-name/so/sof-firmware/package.nix
@@ -39,7 +39,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    maintainers = with lib.maintainers; [
      lblasc
      evenbrenden
-      hmenke
    ];
    platforms = with lib.platforms; linux;
    sourceProvenance = with lib.sourceTypes; [ binaryFirmware ];
--- a/pkgs/by-name/st/static-server/package.nix
+++ b/pkgs/by-name/st/static-server/package.nix
@@ -3,6 +3,7 @@
  buildGoModule,
  fetchFromGitHub,
  curl,
+  openssl,
  stdenv,
  testers,
  static-server,
@@ -11,13 +12,13 @@

 buildGoModule (finalAttrs: {
  pname = "static-server";
-  version = "1.2.1";
+  version = "1.4.0";

  src = fetchFromGitHub {
    owner = "eliben";
    repo = "static-server";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-AZcNh/kF6IdAceA7qe+nhRlwU4yGh19av/S1Zt7iKIs=";
+    hash = "sha256-4VfysN1VVMKXgtnQGCluvAKrdOpFeccIl+OiWF9T/Uw=";
  };

  vendorHash = "sha256-1p3dCLLo+MTPxf/Y3zjxTagUi+tq7nZSj4ZB/aakJGY=";
@@ -31,8 +32,17 @@ buildGoModule (finalAttrs: {

  nativeCheckInputs = [
    curl
+    openssl
  ];

+  # the certificate bundled with the tests expired in 2025, so regenerate it
+  preCheck = ''
+    openssl ecparam -name prime256v1 -genkey -noout -out testdata/datafiles/key.pem
+    openssl req -x509 -new -key testdata/datafiles/key.pem -sha256 -days 36500 \
+      -subj "/O=Acme Co" -addext "subjectAltName=IP:127.0.0.1" \
+      -out testdata/datafiles/cert.pem
+  '';
+
  ldflags = [
    "-s"
    "-w"
--- a/pkgs/by-name/st/stress-ng/package.nix
+++ b/pkgs/by-name/st/stress-ng/package.nix
@@ -17,13 +17,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "stress-ng";
-  version = "0.22.00";
+  version = "0.22.01";

  src = fetchFromGitHub {
    owner = "ColinIanKing";
    repo = "stress-ng";
    tag = "V${finalAttrs.version}";
-    hash = "sha256-A0I/kU7pmr2ppoHl+4JN2ayuShFyWN5cv/ZZmZy6Hts=";
+    hash = "sha256-PzHHc7ku4B1b+ksFj/A4nJwzf9LLcglFnXwUS3jOSi4=";
  };

  postPatch = ''
--- a/pkgs/by-name/te/terminus-rs/package.nix
+++ b/pkgs/by-name/te/terminus-rs/package.nix
@@ -0,0 +1,46 @@
+{
+  lib,
+  fetchFromGitHub,
+  nix-update-script,
+  pkg-config,
+  rustPlatform,
+  sqlite,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "terminus-rs";
+  version = "3.8.0";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "gbiagomba";
+    repo = "Terminus";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-i0hIZUV4EryduZvs56fu1pQDs8QIy5s1zBOF1m/gmwk=";
+  };
+
+  cargoHash = "sha256-bru1S9hzdrQ2XqFvBIbDMEQ6778ZmWlOrfLIdvyJWYw=";
+
+  nativeBuildInputs = [ pkg-config ];
+
+  buildInputs = [ sqlite ];
+
+  env = {
+    LIBSQLITE3_SYS_USE_PKG_CONFIG = true;
+    # reqwest's http3 feature is unstable and requires an explicit opt-in
+    RUSTFLAGS = "--cfg reqwest_unstable";
+  };
+
+  __darwinAllowLocalNetworking = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Command-line tool for auditing web accessibility";
+    homepage = "https://github.com/gbiagomba/Terminus";
+    changelog = "https://github.com/gbiagomba/Terminus/blob/${finalAttrs.src.rev}/CHANGELOG.MD";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "terminus";
+  };
+})
--- a/pkgs/by-name/te/tether/package.nix
+++ b/pkgs/by-name/te/tether/package.nix
@@ -7,21 +7,22 @@
  pkg-config,
  wrapGAppsHook3,
  avahi,
-  bluez,
  gettext,
  glib,
  gtest,
  gtk-layer-shell,
  gtk3,
  libnotify,
+  libsecret,
  nlohmann_json,
  openssl,
+  procps,
  wayland,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "tether";
-  version = "0.2.19";
+  version = "0.2.34";

  __structuredAttrs = true;
  strictDeps = true;
@@ -30,12 +31,12 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "zackb";
    repo = "tether";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-3184+dHzgqh+QrdaCCBtQEzNmoJq03rl6wf0FTK1TTc=";
+    hash = "sha256-j75CGrGtoLYTJXsZ/dgBQU1x3Avq2SdJVNvBx9ycQ3w=";
  };

  postPatch = ''
-    substituteInPlace CMakeLists.txt \
-      --replace-fail '"''${PROJECT_VERSION}-unknown"' '"${finalAttrs.version}"'
+    substituteInPlace packaging/systemd/tetherd.service.in \
+      --replace-fail /usr/bin/pkill ${lib.getExe' procps "pkill"}
  '';

  nativeBuildInputs = [
@@ -51,6 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
    gtk-layer-shell
    gtk3
    libnotify
+    libsecret
    openssl
    wayland
  ];
@@ -59,14 +61,13 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.cmakeBool "FETCHCONTENT_FULLY_DISCONNECTED" true)
    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_JSON" "${nlohmann_json.src}")
    (lib.cmakeFeature "FETCHCONTENT_SOURCE_DIR_GOOGLETEST" "${gtest.src}")
+    (lib.cmakeFeature "TETHER_VERSION" finalAttrs.version)
    (lib.cmakeFeature "CHROME_MESSAGING_DIR" "etc/chromium/native-messaging-hosts")
    (lib.cmakeFeature "GOOGLE_CHROME_MESSAGING_DIR" "etc/opt/chrome/native-messaging-hosts")
-    (lib.cmakeFeature "BLUETOOTHD_PATH" "${bluez}/libexec/bluetooth/bluetoothd")
    (lib.cmakeBool "TETHER_BUILD_EXTENSIONS" false)
  ];

  doCheck = true;
-  enableParallelChecking = false;

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/th/thelounge/package.nix
+++ b/pkgs/by-name/th/thelounge/package.nix
@@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "thelounge";
-  version = "4.5.0";
+  version = "4.5.2";

  src = fetchFromGitHub {
    owner = "thelounge";
    repo = "thelounge";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-I+ITSEm/FCI4omeBM8BCowI6hXBYriJfZ0vP27771Ms=";
+    hash = "sha256-E3QDmvUQlzmVCWUgzwVpWddFklWqywZG3/WAr1uVf0U=";
  };

  # Allow setting package path for the NixOS module.
@@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {

  offlineCache = fetchYarnDeps {
    yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-wgG5AGZvMzdw4QnTNOzAfQGB//VWlV403AgWv4TceGQ=";
+    hash = "sha256-dIE6Dqg9npistgmSRQ5vD96YtDtRveTgLXyF+omtH2s=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/tr/tranquil-pds-frontend/package.nix
+++ b/pkgs/by-name/tr/tranquil-pds-frontend/package.nix
@@ -12,12 +12,12 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "tranquil-frontend";
-  version = "0.6.6";
+  version = "0.6.7";

  src = fetchFromTangled {
    did = "did:plc:jj6ajj6duxnlthwtnob4qyuv";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-cfTsjmK/IMqT5kMKOGpwwWbBlvtrCDOerUJJ8AVI3kY=";
+    hash = "sha256-bhG5ydQZ9nHXQSlrM2jZaUpEP8ZW3Xx6r5O83vLDf8k=";
  };
  sourceRoot = "${finalAttrs.src.name}/frontend";

--- a/pkgs/by-name/tr/tranquil-pds/package.nix
+++ b/pkgs/by-name/tr/tranquil-pds/package.nix
@@ -10,15 +10,15 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "tranquil-pds";
-  version = "0.6.6";
+  version = "0.6.7";

  src = fetchFromTangled {
    did = "did:plc:jj6ajj6duxnlthwtnob4qyuv";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-cfTsjmK/IMqT5kMKOGpwwWbBlvtrCDOerUJJ8AVI3kY=";
+    hash = "sha256-bhG5ydQZ9nHXQSlrM2jZaUpEP8ZW3Xx6r5O83vLDf8k=";
  };

-  cargoHash = "sha256-5TcKzwcElPweuWqVh7qWvCkzA021AYRuRafNDlXbffw=";
+  cargoHash = "sha256-kdmWV4O8iP6TLwZYH8oQvndQsB9nOlkLzYAgertiXOw=";

  __structuredAttrs = true;

--- a/pkgs/by-name/tr/traverso/package.nix
+++ b/pkgs/by-name/tr/traverso/package.nix
@@ -68,6 +68,6 @@ stdenv.mkDerivation {
    ];
    platforms = lib.platforms.all;
    broken = stdenv.hostPlatform.isDarwin || stdenv.hostPlatform.isAarch64;
-    maintainers = with lib.maintainers; [ coconnor ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/by-name/uh/uhhyou-plugins/package.nix
+++ b/pkgs/by-name/uh/uhhyou-plugins/package.nix
@@ -24,12 +24,12 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "uhhyou-plugins";
-  version = "0.70.0";
+  version = "0.71.0";
  src = fetchFromGitHub {
    owner = "ryukau";
    repo = "VSTPlugins";
    rev = "UhhyouPlugins${finalAttrs.version}";
-    hash = "sha256-NkNP7kmOBLcXBA65PEwC0I/NIGzZm8wnAvDM74Cfsws=";
+    hash = "sha256-2Y6zcX8OqW97ryuC0oqToychBzv/R7hSizbj8Xma3u8=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/we/webdav/package.nix
+++ b/pkgs/by-name/we/webdav/package.nix
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "webdav";
-  version = "5.15.1";
+  version = "5.16.0";

  src = fetchFromGitHub {
    owner = "hacdias";
    repo = "webdav";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-XN4GTerwdjJNmAf1gLjl/q+rmT2nBeQk3c6kX25Ij3Q=";
+    hash = "sha256-cqjHh+eHBH1F715xfnDK3FEPaRDVP3+g7/w98rhzing=";
  };

-  vendorHash = "sha256-k3616W8xjTCNZLCL38J4CcX272BhgpC59mUAWderIFM=";
+  vendorHash = "sha256-nS4RFmiMdHxGW1kStVTzMLRZ21q9IMaxHOF1HQ6jYQA=";

  __darwinAllowLocalNetworking = true;

--- a/pkgs/by-name/we/wezterm/package.nix
+++ b/pkgs/by-name/we/wezterm/package.nix
@@ -169,6 +169,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
    homepage = "https://wezterm.org";
    license = lib.licenses.mit;
    mainProgram = "wezterm";
-    maintainers = with lib.maintainers; [ SuperSandro2000 ];
+    maintainers = with lib.maintainers; [
+      SuperSandro2000
+      yvnth
+    ];
  };
 })
--- a/pkgs/by-name/xi/xinetd/package.nix
+++ b/pkgs/by-name/xi/xinetd/package.nix
@@ -31,5 +31,6 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://github.com/openSUSE/xinetd";
    license = lib.licenses.xinetd;
    maintainers = with lib.maintainers; [ fgaz ];
+    mainProgram = "xinetd";
  };
 })
--- a/pkgs/by-name/ze/zeekscript/package.nix
+++ b/pkgs/by-name/ze/zeekscript/package.nix
@@ -4,7 +4,7 @@
  fetchFromGitHub,
 }:

-python3.pkgs.buildPythonApplication rec {
+python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "zeekscript";
  version = "1.3.6";
  pyproject = true;
@@ -12,10 +12,12 @@ python3.pkgs.buildPythonApplication rec {
  src = fetchFromGitHub {
    owner = "zeek";
    repo = "zeekscript";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-yky9w1G4e/dfzOGHXqKGxRgD8Uw9X8oJDjT4avJ9wKM=";
  };

+  pythonRelaxDeps = [ "tree-sitter-zeek" ];
+
  build-system = with python3.pkgs; [ setuptools ];

  dependencies = with python3.pkgs; [
@@ -25,20 +27,17 @@ python3.pkgs.buildPythonApplication rec {
  ];

  nativeCheckInputs = with python3.pkgs; [
-    pytestCheckHook
    pytest-cov-stub
+    pytestCheckHook
+    syrupy
  ];

-  checkInputs = with python3.pkgs; [ syrupy ];
-
-  pythonImportsCheck = [
-    "zeekscript"
-  ];
+  pythonImportsCheck = [ "zeekscript" ];

  meta = {
    description = "Zeek script formatter and analyzer";
    homepage = "https://github.com/zeek/zeekscript";
-    changelog = "https://github.com/zeek/zeekscript/blob/${src.rev}/CHANGES";
+    changelog = "https://github.com/zeek/zeekscript/blob/${finalAttrs.src.rev}/CHANGES";
    license = lib.licenses.bsd3;
    maintainers = with lib.maintainers; [
      fab
@@ -46,4 +45,4 @@ python3.pkgs.buildPythonApplication rec {
      mdaniels5757
    ];
  };
-}
+})
--- a/pkgs/development/compilers/gcc/patches/default.nix
+++ b/pkgs/development/compilers/gcc/patches/default.nix
@@ -120,6 +120,17 @@ optionals noSysDirs (
  hash = "sha256-UYekGGOkYdBNJEp48QFPFadf3wPFJZL2t3D+iwUeGJA=";
 })

+## AArch64
+
+# Fix an ICE when a function type carries a C++11 attribute without a namespace.
+# Fixed in GCC 15, never backported to the GCC 14 branch:
+# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116598
++ optional (is14 && targetPlatform.isAarch64) (fetchpatch {
+  name = "aarch64-fix-ice-in-lookup-shared-state-flags.patch";
+  url = "https://github.com/gcc-mirror/gcc/commit/1247fa6e95cdf4a6422ec802f733f1f7ecaa3557.patch";
+  hash = "sha256-p8fyIcAx8CvLtQboXPevw/J3LsvkSZp36bHtGHjxsiQ=";
+})
+
 ## Darwin

 # Here we apply patches by Iains (https://github.com/iains)
--- a/pkgs/development/compilers/llvm/common/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/common/llvm/default.nix
@@ -361,6 +361,11 @@ stdenv.mkDerivation (
          lib.optionalString (stdenv.hostPlatform.isx86 && lib.versionOlder release_version "19") ''
            rm test/tools/dsymutil/ARM/obfuscated.test
          ''
+        +
+          # Requires a version of `codesign` that supports signing bundles, which sigtool does not support.
+          lib.optionalString (lib.versionAtLeast release_version "23") ''
+            rm test/tools/dsymutil/codesign.test
+          ''
      )

      +
--- a/pkgs/development/cuda-modules/_cuda/manifests/cuda/redistrib_12.8.2.json
+++ b/pkgs/development/cuda-modules/_cuda/manifests/cuda/redistrib_12.8.2.json
@@ -1,6 +1,6 @@
 {
-    "release_date": "2025-03-06",
-    "release_label": "12.8.1",
+    "release_date": "2026-04-21",
+    "release_label": "12.8.2",
    "release_product": "cuda",
    "cuda_cccl": {
        "name": "CXX Core Compute Libraries",
@@ -558,78 +558,78 @@
        "name": "NVIDIA Driver Assistant",
        "license": "MIT",
        "license_path": "driver_assistant/LICENSE.txt",
-        "version": "0.20.124.06",
+        "version": "0.20.211.01",
        "linux-all": {
-            "relative_path": "driver_assistant/source/driver_assistant-0.20.124.06-archive.tar.xz",
-            "sha256": "bcf33756abe82800cc3dbca9580a91a1289704c99601ce1b987bbd5011c96c21",
-            "md5": "f330b55a1482efa011f991d1a4458461",
-            "size": "38472"
+            "relative_path": "driver_assistant/source/driver_assistant-0.20.211.01-archive.tar.xz",
+            "sha256": "7cc629e29f71d3513ebe042e8f85b242cf80295214451b87e2a804f687212bc1",
+            "md5": "4eadd40bccaa640acf3266a978602cc7",
+            "size": "38748"
        }
    },
    "fabricmanager": {
        "name": "NVIDIA Fabric Manager",
        "license": "NVIDIA Driver",
        "license_path": "fabricmanager/LICENSE.txt",
-        "version": "570.124.06",
+        "version": "570.211.01",
        "linux-x86_64": {
-            "relative_path": "fabricmanager/linux-x86_64/fabricmanager-linux-x86_64-570.124.06-archive.tar.xz",
-            "sha256": "e2d359986ca733c568f5a21fd7686f1b002b09637bf1b3a596333bd5ffbc3edb",
-            "md5": "464b2abdc3e8241029ad100ab4c82d9e",
-            "size": "8066240"
+            "relative_path": "fabricmanager/linux-x86_64/fabricmanager-linux-x86_64-570.211.01-archive.tar.xz",
+            "sha256": "ca18525b22546e26e26687637b87e492c6dab6477df681abbb6be942f9e5e944",
+            "md5": "648409fa2f68cf579f383ec06d666ed6",
+            "size": "8178396"
        },
        "linux-sbsa": {
-            "relative_path": "fabricmanager/linux-sbsa/fabricmanager-linux-sbsa-570.124.06-archive.tar.xz",
-            "sha256": "a7e0ebba25d85aa2211b20f9c4097e426d3a196d3748c03f13c432d7b3bc2cc9",
-            "md5": "2fac7d61d1af5296dd4ab973e2e50bb3",
-            "size": "7321304"
+            "relative_path": "fabricmanager/linux-sbsa/fabricmanager-linux-sbsa-570.211.01-archive.tar.xz",
+            "sha256": "38ba0d26e2c02db349e858164455d916cc09d51a728accefe71413547efc0278",
+            "md5": "c324bc15d9bec385ac950029868cc2ef",
+            "size": "7420840"
        }
    },
    "imex": {
        "name": "Nvidia-Imex",
        "license": "NVIDIA Proprietary",
        "license_path": "imex/LICENSE.txt",
-        "version": "570.124.06",
+        "version": "570.211.01",
        "linux-x86_64": {
-            "relative_path": "imex/linux-x86_64/nvidia-imex-linux-x86_64-570.124.06-archive.tar.xz",
-            "sha256": "b2ed7086793ec6d99adaa766daeda2baca6c1ac4002ee916f0e6acd4a47a6ffb",
-            "md5": "a6261cc90db45fa4ead7a8349077e9c2",
-            "size": "9670448"
+            "relative_path": "imex/linux-x86_64/nvidia-imex-linux-x86_64-570.211.01-archive.tar.xz",
+            "sha256": "0a70d814d309d1967b86d99e2042b4ef1959168ce5e2c9e33e97089c18a7afef",
+            "md5": "6c0d596b1229dda0e40e163c23da915f",
+            "size": "8128408"
        },
        "linux-sbsa": {
-            "relative_path": "imex/linux-sbsa/nvidia-imex-linux-sbsa-570.124.06-archive.tar.xz",
-            "sha256": "55d1f5c2960305fad129df567e85be9431412e5ac5814740b368f8acd5ff8a04",
-            "md5": "3b7c19eaf4cad5e6bc36948d466dc4c2",
-            "size": "8771664"
+            "relative_path": "imex/linux-sbsa/nvidia-imex-linux-sbsa-570.211.01-archive.tar.xz",
+            "sha256": "bba5c931ceedc365cf79bd2c0d1d5303cdee5fffaec617ecbeb3f6708667b065",
+            "md5": "45995a92cc2b0374832e409821e36aaf",
+            "size": "7568272"
        }
    },
    "libcublas": {
        "name": "CUDA cuBLAS",
        "license": "CUDA Toolkit",
        "license_path": "libcublas/LICENSE.txt",
-        "version": "12.8.4.1",
+        "version": "12.8.5.5",
        "linux-x86_64": {
-            "relative_path": "libcublas/linux-x86_64/libcublas-linux-x86_64-12.8.4.1-archive.tar.xz",
-            "sha256": "21718957c2cf000bacd69d36c95708a2319199e39e056f8b4f0f68e3b9f323bb",
-            "md5": "5d17d588c1d645140127ea8033d9606f",
-            "size": "938651324"
+            "relative_path": "libcublas/linux-x86_64/libcublas-linux-x86_64-12.8.5.5-archive.tar.xz",
+            "sha256": "f732baf6e55de1844f9bea6646ceae13f30b10592f87b12406bf4713b7f67521",
+            "md5": "cfa9c9e21cac8ab7bc407f471461c531",
+            "size": "949754460"
        },
        "linux-sbsa": {
-            "relative_path": "libcublas/linux-sbsa/libcublas-linux-sbsa-12.8.4.1-archive.tar.xz",
-            "sha256": "429803c0ea8aec1db0050f7bfd807d519e22c9bf223c19000d6018d930741028",
-            "md5": "11208a797fce647fb34902a6e63f0629",
-            "size": "937337100"
+            "relative_path": "libcublas/linux-sbsa/libcublas-linux-sbsa-12.8.5.5-archive.tar.xz",
+            "sha256": "17f56c9b89e9cc71e0738a874d9a0c98cfe224119b475b16c6ccd07fc3ded74b",
+            "md5": "0c1e1a1695cc0a684a943f9d66f79e95",
+            "size": "948745504"
        },
        "windows-x86_64": {
-            "relative_path": "libcublas/windows-x86_64/libcublas-windows-x86_64-12.8.4.1-archive.zip",
-            "sha256": "57a470112cec7e112c95253dde8b3c7184d795dbd92b0bde77a4cb7f8c94c8aa",
-            "md5": "5982188f53c503844f6cb86606b6b696",
-            "size": "563660944"
+            "relative_path": "libcublas/windows-x86_64/libcublas-windows-x86_64-12.8.5.5-archive.zip",
+            "sha256": "0a2beedd7c1203cb9de5e5ab11943d27e41ee5d18dc3810b21bcd75be7e57a05",
+            "md5": "863045666c56d1d663ffc869c7c635dd",
+            "size": "563633310"
        },
        "linux-aarch64": {
-            "relative_path": "libcublas/linux-aarch64/libcublas-linux-aarch64-12.8.4.1-archive.tar.xz",
-            "sha256": "d3c3f32be793fbc995754acf12f94fcec5afc8d85d860875b38eed3ff6f97804",
-            "md5": "056caa43ee8df05c58b8d30bc4a8814e",
-            "size": "513261552"
+            "relative_path": "libcublas/linux-aarch64/libcublas-linux-aarch64-12.8.5.5-archive.tar.xz",
+            "sha256": "8d0e5bc5fb58419593a6452766e35bccf3773c713e1a0eca4103f6a73eb2c796",
+            "md5": "4965f266447810aebed43119738c4dc5",
+            "size": "514418300"
        }
    },
    "libcudla": {
@@ -852,18 +852,18 @@
        "name": "NVIDIA NSCQ API",
        "license": "NVIDIA Driver",
        "license_path": "libnvidia_nscq/LICENSE.txt",
-        "version": "570.124.06",
+        "version": "570.211.01",
        "linux-x86_64": {
-            "relative_path": "libnvidia_nscq/linux-x86_64/libnvidia_nscq-linux-x86_64-570.124.06-archive.tar.xz",
-            "sha256": "8af30cdb8883a358a456566ee18c34e6e3b1eb166f8bc005b2f018da9a8c920a",
-            "md5": "ee67378b27d02fd5fdd5f93771f91a8c",
-            "size": "455616"
+            "relative_path": "libnvidia_nscq/linux-x86_64/libnvidia_nscq-linux-x86_64-570.211.01-archive.tar.xz",
+            "sha256": "935a24b4a421430c69accb0314e6777e647f946e50057f8142d5283fc9a7d0c8",
+            "md5": "c71a685191fd4a12d28bf91aedcb2130",
+            "size": "357180"
        },
        "linux-sbsa": {
-            "relative_path": "libnvidia_nscq/linux-sbsa/libnvidia_nscq-linux-sbsa-570.124.06-archive.tar.xz",
-            "sha256": "15ea42d7c3282b27e2e37efe8f59ee499f5ab40fc9e76f8295775ea1a3d5c139",
-            "md5": "7eca835f610eec5e70b571794be25057",
-            "size": "447036"
+            "relative_path": "libnvidia_nscq/linux-sbsa/libnvidia_nscq-linux-sbsa-570.211.01-archive.tar.xz",
+            "sha256": "01752f9fd0af7e8aec21168d759243b23716e6f970789f3ba19aeefe12d12493",
+            "md5": "490a6e7459d4ea540bf09f70798085f3",
+            "size": "350888"
        }
    },
    "libnvjitlink": {
@@ -930,12 +930,12 @@
        "name": "LIBNVSDM",
        "license": "NVIDIA",
        "license_path": "libnvsdm/LICENSE.txt",
-        "version": "570.124.06",
+        "version": "570.211.01",
        "linux-x86_64": {
-            "relative_path": "libnvsdm/linux-x86_64/libnvsdm-linux-x86_64-570.124.06-archive.tar.xz",
-            "sha256": "d3e36b09ad7fbe48ebc9e1df0cf6f022e6e92ddaa0d927d06539c1bcaef04e2e",
-            "md5": "67c17ab3e6456cbd628a5588baaa674d",
-            "size": "488944"
+            "relative_path": "libnvsdm/linux-x86_64/libnvsdm-linux-x86_64-570.211.01-archive.tar.xz",
+            "sha256": "a4b5d5f76de3a450218f381e113ef937529859b865eed9341e247f8f40f0fdbf",
+            "md5": "023a523dbddf6f74cb67109ecca83993",
+            "size": "491744"
        }
    },
    "nsight_compute": {
@@ -1008,18 +1008,18 @@
        "name": "NVIDIA Linux Driver",
        "license": "NVIDIA Driver",
        "license_path": "nvidia_driver/LICENSE.txt",
-        "version": "570.124.06",
+        "version": "570.211.01",
        "linux-x86_64": {
-            "relative_path": "nvidia_driver/linux-x86_64/nvidia_driver-linux-x86_64-570.124.06-archive.tar.xz",
-            "sha256": "0fcaa9b47c124cca981df5155e2826615de3f28e31a27e139af8901e92d38b34",
-            "md5": "b8fc22d07fd46760c7fc01f2836bc862",
-            "size": "445113608"
+            "relative_path": "nvidia_driver/linux-x86_64/nvidia_driver-linux-x86_64-570.211.01-archive.tar.xz",
+            "sha256": "7b3dcdd6beb6abbc8e88e872a7276cbcf7d48d0aeabc6a9cf249f897096dfb09",
+            "md5": "1fb59df62e2827283163a4797f3b684b",
+            "size": "450164200"
        },
        "linux-sbsa": {
-            "relative_path": "nvidia_driver/linux-sbsa/nvidia_driver-linux-sbsa-570.124.06-archive.tar.xz",
-            "sha256": "0edad79f9f52818d4b03bcc06ee4ef2ea81136330381347696fd3f804087f54b",
-            "md5": "efc8ddc7039ddbb30928f83b98b91fea",
-            "size": "344090356"
+            "relative_path": "nvidia_driver/linux-sbsa/nvidia_driver-linux-sbsa-570.211.01-archive.tar.xz",
+            "sha256": "e1553b67794a01b56cca657ec201dd223d0e1c522d3d637a4d9166f17a9584d1",
+            "md5": "aabc2e2726b7f39f0e456af4545b00c2",
+            "size": "349387888"
        }
    },
    "nvidia_fs": {
@@ -1058,4 +1058,4 @@
            "size": "863828"
        }
    }
-}
+}
--- a/pkgs/development/cuda-modules/_cuda/manifests/cuda/redistrib_12.9.2.json
+++ b/pkgs/development/cuda-modules/_cuda/manifests/cuda/redistrib_12.9.2.json
@@ -1,6 +1,6 @@
 {
-    "release_date": "2025-06-05",
-    "release_label": "12.9.1",
+    "release_date": "2026-05-14",
+    "release_label": "12.9.2",
    "release_product": "cuda",
    "collectx_bringup": {
        "name": "UFM telemetry CollectX Bringup",
@@ -624,30 +624,30 @@
        "name": "CUDA cuBLAS",
        "license": "CUDA Toolkit",
        "license_path": "libcublas/LICENSE.txt",
-        "version": "12.9.1.4",
+        "version": "12.9.2.10",
        "linux-x86_64": {
-            "relative_path": "libcublas/linux-x86_64/libcublas-linux-x86_64-12.9.1.4-archive.tar.xz",
-            "sha256": "546addc4a9d82b8f23aa9ba9274b6bc0429a63008a31c759884ac24880796057",
-            "md5": "9b07f0c3d94534e56e003c6016b9771c",
-            "size": "933611504"
+            "relative_path": "libcublas/linux-x86_64/libcublas-linux-x86_64-12.9.2.10-archive.tar.xz",
+            "sha256": "c80a724aafa1ee49110b0d3385316ea54d418b03e796e91e8f0b47d52f8022fd",
+            "md5": "655b16ec86c0525b0d7e280cdf43ece9",
+            "size": "944339140"
        },
        "linux-sbsa": {
-            "relative_path": "libcublas/linux-sbsa/libcublas-linux-sbsa-12.9.1.4-archive.tar.xz",
-            "sha256": "e99b074e6f66034e563508118804599d7579f73afc8424c55ad5fd8d12e085a5",
-            "md5": "4c7cdc43283c0ba62e665b02e9ec7540",
-            "size": "932528492"
+            "relative_path": "libcublas/linux-sbsa/libcublas-linux-sbsa-12.9.2.10-archive.tar.xz",
+            "sha256": "da12f27cc758a5bfcc98dba81670eb67e4a10e994587a1183879c96726009a49",
+            "md5": "a22a3d34c2e0edb18c63ce6850f6749b",
+            "size": "940215464"
        },
        "windows-x86_64": {
-            "relative_path": "libcublas/windows-x86_64/libcublas-windows-x86_64-12.9.1.4-archive.zip",
-            "sha256": "d534d98b0b453a98914dbf3adf47d7e84b55037abf02f87466439e1dcef581ed",
-            "md5": "3f092963b0767968fe6f02febc1b0cbf",
-            "size": "549755186"
+            "relative_path": "libcublas/windows-x86_64/libcublas-windows-x86_64-12.9.2.10-archive.zip",
+            "sha256": "62782c354e1536118caab8fe5fd295ac5fd9076e4814aba0bdaf032fe2b833ae",
+            "md5": "08f474ec4bc1a0b3bcd54078bb66abdf",
+            "size": "549731131"
        },
        "linux-aarch64": {
-            "relative_path": "libcublas/linux-aarch64/libcublas-linux-aarch64-12.9.1.4-archive.tar.xz",
-            "sha256": "f75938d72153902cf08d1666311f35851e7eb6a16af743b2346bc68d7ba6b341",
-            "md5": "15f6396431885647e961af811a90cc06",
-            "size": "493899648"
+            "relative_path": "libcublas/linux-aarch64/libcublas-linux-aarch64-12.9.2.10-archive.tar.xz",
+            "sha256": "e3fbb04bead0dc536879956061d307eb0c870d36026742d5a548c084b633afdc",
+            "md5": "a7bc52d3393f7970004d45def584e1ce",
+            "size": "495495400"
        }
    },
    "libcudla": {
@@ -1148,4 +1148,4 @@
            "size": "864204"
        }
    }
-}
+}
--- a/pkgs/development/cuda-modules/_cuda/manifests/cuda/redistrib_13.1.2.json
+++ b/pkgs/development/cuda-modules/_cuda/manifests/cuda/redistrib_13.1.2.json
@@ -1,6 +1,6 @@
 {
-    "release_date": "2026-01-12",
-    "release_label": "13.1.1",
+    "release_date": "2026-04-30",
+    "release_label": "13.1.2",
    "release_product": "cuda",
    "collectx_bringup": {
        "name": "UFM telemetry CollectX Bringup",
@@ -589,24 +589,24 @@
        "name": "CUDA cuBLAS",
        "license": "CUDA Toolkit",
        "license_path": "libcublas/LICENSE.txt",
-        "version": "13.2.1.1",
+        "version": "13.2.2.2",
        "linux-x86_64": {
-            "relative_path": "libcublas/linux-x86_64/libcublas-linux-x86_64-13.2.1.1-archive.tar.xz",
-            "sha256": "b1cde2e14d1547f575f61f9b90dc91e9b80991d114971d50d535dd8bd72b5466",
-            "md5": "8bef35503ab216f323ae3dff15bada55",
-            "size": "798288312"
+            "relative_path": "libcublas/linux-x86_64/libcublas-linux-x86_64-13.2.2.2-archive.tar.xz",
+            "sha256": "fd2747cbe678120a5beeb5b2a3a9cb07c1b5b9a820a0f6869ea46e53d03b1af2",
+            "md5": "73939d09cba3fe383894293d4539810b",
+            "size": "798274192"
        },
        "linux-sbsa": {
-            "relative_path": "libcublas/linux-sbsa/libcublas-linux-sbsa-13.2.1.1-archive.tar.xz",
-            "sha256": "693cc5b991a374bf28917b4e957248e93d86c2d57c92652de2cb7967d1179a71",
-            "md5": "8e67338e0a13ded2db61cfa1fce2fd46",
-            "size": "1005398628"
+            "relative_path": "libcublas/linux-sbsa/libcublas-linux-sbsa-13.2.2.2-archive.tar.xz",
+            "sha256": "450bb08a97528a553a89291420cc41dba29917e3820dd9440e18e455a663908c",
+            "md5": "7958155436c837c477fe53236544b99d",
+            "size": "1005318480"
        },
        "windows-x86_64": {
-            "relative_path": "libcublas/windows-x86_64/libcublas-windows-x86_64-13.2.1.1-archive.zip",
-            "sha256": "b00be5cda504da494a5f6b72a24f53254f97d4d47e8933ecc3993ad58b6b2ad2",
-            "md5": "da242891250d139f2ed33da156edada2",
-            "size": "384768814"
+            "relative_path": "libcublas/windows-x86_64/libcublas-windows-x86_64-13.2.2.2-archive.zip",
+            "sha256": "98db841fedf0ce2f723ec559fdf78bf3704d2691c5f427d2f112d223b28d3782",
+            "md5": "14bffab8e6e15167dcea70da014bb0bf",
+            "size": "384716797"
        }
    },
    "libcufft": {
@@ -1095,4 +1095,4 @@
            "size": "888959"
        }
    }
-}
+}
--- a/Show More
+++ b/Show More