Merge master into staging-next

2026-07-18 14:41:18 +00:00 · 2026-07-16 12:33:46 +00:00
parent 0f44e46420 c1191de365
commit baab16d485
79 changed files with 1535 additions and 403 deletions
--- a/doc/build-helpers/fixed-point-arguments.chapter.md
+++ b/doc/build-helpers/fixed-point-arguments.chapter.md
@@ -143,3 +143,4 @@ lib.extendMkDerivation {
    });
 }
 ```
+:::
--- a/doc/build-helpers/trivial-build-helpers.chapter.md
+++ b/doc/build-helpers/trivial-build-helpers.chapter.md
@@ -165,7 +165,7 @@ They are useful for creating files from Nix expressions, and are all implemented
 Each of these functions will cause a derivation to be produced.
 When you coerce the result of each of these functions to a string with [string interpolation](https://nixos.org/manual/nix/stable/language/string-interpolation) or [`toString`](https://nixos.org/manual/nix/stable/language/builtins#builtins-toString), it will evaluate to the [store path](https://nixos.org/manual/nix/stable/store/store-path) of this derivation.

-:::: {.note}
+::: {.note}
 Some of these functions will put the resulting files within a directory inside the [derivation output](https://nixos.org/manual/nix/stable/language/derivations#attr-outputs).
 If you need to refer to the resulting files somewhere else in a Nix expression, append their path to the derivation's store path.

@@ -190,7 +190,7 @@ writeShellScript "evaluate-my-file.sh" ''
  cat ${my-file}/share/my-file
 ''
 ```
-::::
+:::

 ### `makeDesktopItem` {#trivial-builder-makeDesktopItem}

--- a/doc/languages-frameworks/rocq.section.md
+++ b/doc/languages-frameworks/rocq.section.md
@@ -59,7 +59,7 @@ The recommended way of defining a derivation for a Rocq library, is to use the `
 * `releaseRev` (optional, defaults to `(v: v)`), provides a default mapping from release names to revision hashes/branch names/tags,
 * `releaseArtifact` (optional, defaults to `(v: null)`), provides a default mapping from release names to artifact names (only works for github artifact for now),
 * `displayVersion` (optional), provides a way to alter the computation of `name` from `pname`, by explaining how to display version numbers,
-* `namePrefix` (optional, defaults to `[ "rocq-core" ]`), provides a way to alter the computation of `name` from `pname`, by explaining which dependencies must occur in `name`,
+* `namePrefix` (optional, defaults to `[ "rocq" ]`), provides a way to alter the computation of `name` from `pname`, by explaining which dependencies must occur in `name`,
 * `nativeBuildInputs` (optional), is a list of executables that are required to build the current derivation, in addition to the default ones (namely `which`, `dune` and `ocaml` depending on whether `useDune`, `useDuneifVersion` and `mlPlugin` are set).
 * `extraNativeBuildInputs` (optional, deprecated), an additional list of derivation to add to `nativeBuildInputs`,
 * `overrideNativeBuildInputs` (optional) replaces the default list of derivation to which `nativeBuildInputs` and `extraNativeBuildInputs` adds extra elements,
--- a/lib/attrsets.nix
+++ b/lib/attrsets.nix
@@ -1140,7 +1140,7 @@ rec {

    For a function that gives you control over what counts as a leaf, see `mapAttrsRecursiveCond`.

-    :::{#map-attrs-recursive-example .example}
+    ::: {.example #map-attrs-recursive-example}
    # Map over leaf attributes

    ```nix
@@ -1165,7 +1165,7 @@ rec {
    If the predicate returns false, `mapAttrsRecursiveCond` does not recurse, but instead applies the mapping function.
    If the predicate returns true, it does recurse, and does not apply the mapping function.

-    :::{#map-attrs-recursive-cond-example .example}
+    ::: {.example #map-attrs-recursive-cond-example}
    # Map over an leaf attributes defined by a condition

    Map derivations to their `name` attribute.
--- a/lib/customisation.nix
+++ b/lib/customisation.nix
@@ -564,7 +564,7 @@ rec {

    # Examples

-    :::{#ex-makeScope .example}
+    :::{.example #ex-makeScope}
    # Create an interdependent package set on top of `pkgs`

    The functions in `foo.nix` and `bar.nix` can depend on each other, in the sense that `foo.nix` can contain a function that expects `bar` as an attribute in its argument.
@@ -593,7 +593,7 @@ rec {
    ```
    :::

-    :::{#ex-makeScope-callPackage .example}
+    :::{.example #ex-makeScope-callPackage}
    # Using `callPackage` from a scope

    ```nix
--- a/lib/licenses/licenses.nix
+++ b/lib/licenses/licenses.nix
@@ -387,6 +387,13 @@ lib.mapAttrs mkLicense (
      free = false;
    };

+    cc-by-nc-30-igo = {
+      # Currently does not have a spdxID will get one in the future https://github.com/spdx/license-list-XML/issues/2845
+      # spdxId = "CC-BY-NC-3.0-IGO";
+      fullName = "Creative Commons Attribution Non Commercial 3.0 IGO";
+      free = false;
+    };
+
    cc-by-nc-40 = {
      spdxId = "CC-BY-NC-4.0";
      fullName = "Creative Commons Attribution Non Commercial 4.0 International";
@@ -931,6 +938,11 @@ lib.mapAttrs mkLicense (
      free = false;
    };

+    jpl-image = {
+      fullName = "JPL Image Use Policy";
+      spdxId = "JPL-image";
+    };
+
    knuth = {
      fullName = "Knuth CTAN License";
      spdxId = "Knuth-CTAN";
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -4438,6 +4438,12 @@
      { fingerprint = "8916 F727 734E 77AB 437F  A33A 19AB 76F5 CEE1 1392"; }
    ];
  };
+  caguiclajmg = {
+    email = "jmg.caguicla@guarandoo.me";
+    github = "caguiclajmg";
+    githubId = 32662060;
+    name = "John Mark Gabriel Caguicla";
+  };
  CaiqueFigueiredo = {
    email = "public@caiquefigueiredo.me";
    github = "caiquefigueiredo";
@@ -5613,6 +5619,11 @@
    githubId = 5953003;
    name = "Connor Nelson";
  };
+  conny = {
+    github = "ConstantConstantin";
+    githubId = 162139822;
+    name = "Constantin-Paul Hertel";
+  };
  conradmearns = {
    email = "conradmearns+github@pm.me";
    github = "ConradMearns";
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -142,6 +142,8 @@

 - The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`.

+- The `authelia` module now uses systemd's `LoadCredential` to load all files defined in `secrets`. As such, these files no longer need to be readable by the authelia user and group: they can for example be set to be only readable by the root user.
+
 - `zoneminder` has been updated to 1.38.x release. See [upstream release note](https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.0). While database migration should happen automatically, it's recommended that you make a backup of the database before upgrading your system.

 - The latest available version of Nextcloud is v34 (available as `pkgs.nextcloud34`). The installation logic is as follows:
--- a/nixos/modules/services/security/authelia.nix
+++ b/nixos/modules/services/security/authelia.nix
@@ -268,15 +268,6 @@ let
      };
    };

-  writeOidcJwksConfigFile =
-    oidcIssuerPrivateKeyFile:
-    pkgs.writeText "oidc-jwks.yaml" ''
-      identity_providers:
-        oidc:
-          jwks:
-            - key: {{ secret "${oidcIssuerPrivateKeyFile}" | mindent 10 "|" | msquote }}
-    '';
-
  # Remove an attribute in a nested set
  # https://discourse.nixos.org/t/modify-an-attrset-in-nix/29919/5
  removeAttrByPath =
@@ -362,7 +353,12 @@ in
          execCommand = "${instance.package}/bin/authelia";
          configFile = format.generate "config.yml" cleanedSettings;
          oidcJwksConfigFile = lib.optional (instance.secrets.oidcIssuerPrivateKeyFile != null) (
-            writeOidcJwksConfigFile instance.secrets.oidcIssuerPrivateKeyFile
+            pkgs.writeText "oidc-jwks.yaml" ''
+              identity_providers:
+                oidc:
+                  jwks:
+                    - key: {{ mustEnv "CREDENTIALS_DIRECTORY" | printf "%s/oidcIssuerPrivateKeyFile" | secret | mindent 10 "|" | msquote }}
+            ''
          );
          configArg = "--config ${
            builtins.concatStringsSep "," (
@@ -373,21 +369,25 @@ in
              ]
            )
          }";
+          # Mapping between the Authelia env variables and the secret keys defined in the module
+          envSecretsMap = {
+            AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE = "jwtSecretFile";
+            AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE = "storageEncryptionKeyFile";
+            AUTHELIA_SESSION_SECRET_FILE = "sessionSecretFile";
+            AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE = "oidcHmacSecretFile";
+          };
+          nonNullEnvSecretsMap = lib.filterAttrs (_: v: instance.secrets.${v} != null) envSecretsMap;
        in
        {
          description = "Authelia authentication and authorization server";
          wantedBy = [ "multi-user.target" ];
          after = [ "network-online.target" ]; # Checks SMTP notifier creds during startup
          wants = [ "network-online.target" ];
-          environment =
-            (lib.filterAttrs (_: v: v != null) {
-              X_AUTHELIA_CONFIG_FILTERS = lib.mkIf (oidcJwksConfigFile != [ ]) "template";
-              AUTHELIA_IDENTITY_VALIDATION_RESET_PASSWORD_JWT_SECRET_FILE = instance.secrets.jwtSecretFile;
-              AUTHELIA_STORAGE_ENCRYPTION_KEY_FILE = instance.secrets.storageEncryptionKeyFile;
-              AUTHELIA_SESSION_SECRET_FILE = instance.secrets.sessionSecretFile;
-              AUTHELIA_IDENTITY_PROVIDERS_OIDC_HMAC_SECRET_FILE = instance.secrets.oidcHmacSecretFile;
-            })
-            // instance.environmentVariables;
+          environment = {
+            X_AUTHELIA_CONFIG_FILTERS = lib.mkIf (oidcJwksConfigFile != [ ]) "template";
+          }
+          // lib.mapAttrs (_: v: "%d/${v}") nonNullEnvSecretsMap
+          // instance.environmentVariables;

          preStart = "${execCommand} ${configArg} validate-config";
          serviceConfig = {
@@ -399,6 +399,12 @@ in
            StateDirectory = autheliaName instance.name;
            StateDirectoryMode = "0700";

+            LoadCredential =
+              lib.optional (
+                instance.secrets.oidcIssuerPrivateKeyFile != null
+              ) "oidcIssuerPrivateKeyFile:${instance.secrets.oidcIssuerPrivateKeyFile}"
+              ++ lib.mapAttrsToList (_: v: "${v}:${instance.secrets.${v}}") nonNullEnvSecretsMap;
+
            # Security options:
            AmbientCapabilities = "";
            CapabilityBoundingSet = "";
--- a/nixos/tests/authelia.nix
+++ b/nixos/tests/authelia.nix
@@ -28,12 +28,10 @@
        # This is purely for testing purposes!
        environment.etc."authelia/storageEncryptionKeyFile" = {
          mode = "0400";
-          user = "authelia-testing";
          text = "you_must_generate_a_random_string_of_more_than_twenty_chars_and_configure_this";
        };
        environment.etc."authelia/jwtSecretFile" = {
          mode = "0400";
-          user = "authelia-testing";
          text = "a_very_important_secret";
        };
        environment.etc."authelia/users_database.yml" = {
--- a/pkgs/applications/editors/vscode/extensions/yoshi47.selection-path-copier/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/yoshi47.selection-path-copier/default.nix
@@ -8,8 +8,8 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
  mktplcRef = {
    publisher = "yoshi47";
    name = "selection-path-copier";
-    version = "1.5.0";
-    hash = "sha256-ip8dsU8B2vghINPSftvfC5OtM0bjIP0V3JAMt5skmdg=";
+    version = "1.6.0";
+    hash = "sha256-KnV9WariqK3GMjoQARtamxriBkL0Pi9y7+fhfwObCWE=";
  };
  meta = {
    description = "Copy file paths with line numbers, code snippets, and GitHub permalinks in multiple formats";
--- a/pkgs/applications/emulators/libretro/cores/dolphin.nix
+++ b/pkgs/applications/emulators/libretro/cores/dolphin.nix
@@ -20,13 +20,13 @@
 }:
 mkLibretroCore {
  core = "dolphin";
-  version = "0-unstable-2026-06-28";
+  version = "0-unstable-2026-07-12";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "dolphin";
-    rev = "894fdda35688f3ac33c680ef6fe17ce965a16bf1";
-    hash = "sha256-Dkvv8EgQjLjyt0muSVF0Cnex/3xUcZXvWTzgUw61Sv0=";
+    rev = "0b766a68cc835775b3216500bb9af2f5d4602b12";
+    hash = "sha256-JaUiDc4/vEWjEXe6H9+i6pft2DTsl5my5wyFmtbjdR0=";
    fetchSubmodules = true;
  };

--- a/pkgs/applications/office/beancount/bean-add.nix
+++ b/pkgs/applications/office/beancount/bean-add.nix
@@ -3,11 +3,12 @@
  stdenv,
  fetchFromGitHub,
  python3Packages,
+  installShellFiles,
 }:

 stdenv.mkDerivation {
  pname = "bean-add";
-  version = "unstable-2018-01-08";
+  version = "0-unstable-2018-01-08";

  src = fetchFromGitHub {
    owner = "simon-v";
@@ -18,10 +19,10 @@ stdenv.mkDerivation {

  propagatedBuildInputs = with python3Packages; [ python ];

-  installPhase = ''
-    mkdir -p $out/bin/
-    cp bean-add $out/bin/bean-add
-    chmod +x $out/bin/bean-add
+  nativeBuildInputs = [ installShellFiles ];
+
+  postInstall = ''
+    installBin bean-add
  '';

  meta = {
--- a/pkgs/applications/science/astronomy/celestia/default.nix
+++ b/pkgs/applications/science/astronomy/celestia/default.nix
@@ -1,78 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchpatch2,
-  pkg-config,
-  libglut,
-  gtk2,
-  gtkglext,
-  libjpeg_turbo,
-  libtheora,
-  libxmu,
-  lua,
-  libGLU,
-  libGL,
-  perl,
-  autoreconfHook,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "celestia";
-  version = "1.6.4";
-
-  src = fetchFromGitHub {
-    owner = "CelestiaProject";
-    repo = "Celestia";
-    rev = version;
-    sha256 = "sha256-MkElGo1ZR0ImW/526QlDE1ePd+VOQxwkX7l+0WyZ6Vs=";
-  };
-
-  patches = [
-    (fetchpatch2 {
-      url = "https://github.com/CelestiaProject/Celestia/commit/94894bed3bf98d41c5097e7829d491d8ff8d4a62.patch?full_index=1";
-      hash = "sha256-hEZ6BhSEx6Qm+fLisc63xSCDT6GX92AHD0BuldOhzFk=";
-    })
-  ];
-
-  postPatch = ''
-    substituteInPlace configure.ac \
-      --replace-fail "dnl AM_GNU_GETTEXT_VERSION([0.15])" "AM_GNU_GETTEXT_VERSION([0.15])"
-  '';
-
-  nativeBuildInputs = [
-    pkg-config
-    autoreconfHook
-  ];
-  buildInputs = [
-    libglut
-    gtk2
-    gtkglext
-    lua
-    perl
-    libjpeg_turbo
-    libtheora
-    libxmu
-    libGLU
-    libGL
-  ];
-
-  configureFlags = [
-    "--with-gtk"
-    "--with-lua=${lua}"
-  ];
-
-  enableParallelBuilding = true;
-
-  meta = {
-    homepage = "https://celestiaproject.space/";
-    description = "Real-time 3D simulation of space";
-    mainProgram = "celestia";
-    changelog = "https://github.com/CelestiaProject/Celestia/releases/tag/${version}";
-    license = lib.licenses.gpl2Plus;
-    maintainers = with lib.maintainers; [
-      returntoreality
-    ];
-    platforms = lib.platforms.linux;
-  };
-}
--- a/pkgs/build-support/rocq/default.nix
+++ b/pkgs/build-support/rocq/default.nix
@@ -55,7 +55,7 @@ in
  extraNativeBuildInputs ? [ ],
  overrideBuildInputs ? [ ],
  overrideNativeBuildInputs ? [ ],
-  namePrefix ? [ "rocq-core" ],
+  namePrefix ? null,
  enableParallelBuilding ? true,
  extraInstallFlags ? [ ],
  setROCQBIN ? true,
@@ -66,7 +66,7 @@ in
  dropDerivationAttrs ? [ ],
  useDuneifVersion ? (x: false),
  useDune ? false,
-  opam-name ? (concatStringsSep "-" (namePrefix ++ [ pname ])),
+  opam-name ? null,
  useCoq ? false,
  useCoqifVersion ? (x: false),
  ...
@@ -160,10 +160,17 @@ let
      ] ""
    )
    + optionalString (v == null) "-broken";
-  append-version = p: n: p + display-pkg n "" rocqPackages.${n}.version + "-";
-  prefix-name = foldl append-version "" namePrefix;
  useDune = args.useDune or (useDuneifVersion fetched.version);
  useCoq = args.useCoq or (useCoqifVersion fetched.version);
+  namePrefix = args.namePrefix or [ (if useCoq then "coq" else "rocq") ];
+  append-version =
+    p: n:
+    let
+      version = if n == "rocq" then rocqPackages.rocq-core.version else rocqPackages.${n}.version;
+    in
+    p + display-pkg n "" version + "-";
+  prefix-name = foldl append-version "" namePrefix;
+  opam-name = args.opam-name or (concatStringsSep "-" (namePrefix ++ [ pname ]));
  rocq-core = if useCoq then coq // { rocq-version = coq.coq-version; } else args0.rocq-core;
  rocqlib-flags = [
    "COQLIBINSTALL=$(out)/lib/coq/${rocq-core.rocq-version}/user-contrib"
--- a/pkgs/by-name/bu/budget-tracker-tui/package.nix
+++ b/pkgs/by-name/bu/budget-tracker-tui/package.nix
@@ -6,7 +6,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "budget-tracker-tui";
-  version = "1.4.0";
+  version = "1.4.1";

  __structuredAttrs = true;

@@ -14,9 +14,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "Feromond";
    repo = "budget_tracker_tui";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-rVNAYMfTGYRepeNSlm+d/bJq11lRNFZjpoQjQpclSzY=";
+    hash = "sha256-vNpnW9SIjuSnvNtBW8wzDNCCVpw3z/2nv9bremTMqww=";
  };
-  cargoHash = "sha256-u9XlckBJCRzpmY+Hs5x9cBWtxIN1zwMuIYMCuS7i6rQ=";
+  cargoHash = "sha256-eMzqi2uEaLmHEQtegiT2aWOJCq0tIdywtv1rl99kyys=";

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/ce/celestia/content.nix
+++ b/pkgs/by-name/ce/celestia/content.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  gettext,
+  imagemagick,
+}:
+
+stdenv.mkDerivation {
+  pname = "celestia-content";
+  version = "0-unstable-2026-07-19";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "CelestiaProject";
+    repo = "CelestiaContent";
+    rev = "724b9545b72c56c1a9afeda35d48f611e4f0d20f";
+    hash = "sha256-4wicyDIvBK3gD6pAgFO0YH5gRT8E7/g9Qr3YDbRKHVw=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+    gettext
+    imagemagick
+  ];
+
+  meta = {
+    description = "Data files for Celestia space simulator";
+    maintainers = with lib.maintainers; [ pancaek ];
+    license =
+      with lib.licenses;
+      AND [
+        cc-by-30
+        cc-by-40
+        cc-by-nc-sa-30
+        # (unused according to upstream CI, at least for now)
+        # cc-by-sa-30
+        cc-by-sa-40
+        cc0
+        gpl2Plus
+        jpl-image
+        cc-by-nc-30-igo
+        # some files are unlicensed so far, so to be safe let's mark unfree also
+        unfree
+      ];
+  };
+}
--- a/pkgs/by-name/ce/celestia/package.nix
+++ b/pkgs/by-name/ce/celestia/package.nix
@@ -0,0 +1,103 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  pkg-config,
+  libglut,
+  libjpeg_turbo,
+  lua,
+  libGLU,
+  libGL,
+  perl,
+  eigen,
+  freetype,
+  cmake,
+  libepoxy,
+  libpng,
+  boost,
+  fmt,
+  libavif,
+  ffmpeg,
+  gperf,
+  gettext,
+  qt6Packages,
+  callPackage,
+  celestia-content ? callPackage ./content.nix { },
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "celestia";
+  version = "1.6.4-unstable-2026-07-02";
+
+  src = fetchFromGitHub {
+    owner = "CelestiaProject";
+    repo = "Celestia";
+    rev = "ded2c69ec7b819640a6c807fc7d4280bbf08e26b";
+    hash = "sha256-GDp31jwY9ifppUJ3Yy84E+x33O4+UmR/ODrHwH2HyeM=";
+    fetchSubmodules = true;
+  };
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+    gperf
+    gettext
+    qt6Packages.wrapQtAppsHook
+  ];
+
+  buildInputs = [
+    qt6Packages.qtbase
+    libglut
+    lua
+    perl
+    libjpeg_turbo
+    eigen
+    libepoxy
+    libpng
+    fmt
+    boost
+    libavif
+    ffmpeg
+    freetype
+    libGLU
+    libGL
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeFeature "ENABLE_QT6" "ON")
+    (lib.cmakeFeature "ENABLE_FFMPEG" "ON")
+    (lib.cmakeFeature "ENABLE_LIBAVIF" "ON")
+    (lib.cmakeFeature "GIT_COMMIT" "${finalAttrs.src.rev}")
+  ];
+
+  enableParallelBuilding = true;
+
+  qtWrapperArgs = [
+    "--unset"
+    "QT_QPA_PLATFORMTHEME"
+    "--unset"
+    "QT_STYLE_OVERRIDE"
+  ];
+
+  postInstall = ''
+    cp -r ${celestia-content}/share/celestia/* $out/share/celestia
+    cp -r ${celestia-content}/share/locale/* $out/share/locale
+  '';
+
+  meta = {
+    homepage = "https://celestiaproject.space/";
+    description = "Real-time 3D simulation of space";
+    mainProgram = "celestia";
+    # no tagged release for ages, remove this for now
+    # changelog = "https://github.com/CelestiaProject/Celestia/releases/tag/${version}";
+    license = lib.licenses.gpl2Plus;
+    maintainers = with lib.maintainers; [
+      returntoreality
+      pancaek
+    ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/cl/cloudquery/package.nix
+++ b/pkgs/by-name/cl/cloudquery/package.nix
@@ -9,19 +9,19 @@

 buildGoModule (finalAttrs: {
  pname = "cloudquery";
-  version = "6.36.1";
+  version = "6.41.0";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "cloudquery";
    repo = "cloudquery";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-D0gciTH5OwYXBPabOmn6bMHyWZwS6y5uAQIdNS+WugE=";
+    hash = "sha256-ybHyZnJTtOacywgjJ+PiH8KJNn1DgBNJ4yMMtu4y/vw=";
  };

  modRoot = "cli";

-  vendorHash = "sha256-gY/FQ71Nwk9i7QXgMmOVlJe9lEW9ViPZ3Eh1NusIizE=";
+  vendorHash = "sha256-zXYYheZtWFuOZ/9AH+h/Qjf4+UZ6RRb9grk/mrJZxTU=";

  subPackages = [
    "."
--- a/pkgs/by-name/cr/crowdin-cli/package.nix
+++ b/pkgs/by-name/cr/crowdin-cli/package.nix
@@ -14,11 +14,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "crowdin-cli";
-  version = "4.14.3";
+  version = "4.14.4";

  src = fetchurl {
    url = "https://github.com/crowdin/crowdin-cli/releases/download/${finalAttrs.version}/crowdin-cli.zip";
-    hash = "sha256-Jtj1WcKkJF0toa2/xK/cR0r4+lzzMFkoQnG6jCFSAM4=";
+    hash = "sha256-dHRFgAY+nWZq46VpC4tc/A2QR+f73ypn1aMxTI9g1F0=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/do/dovecot/fix-lua-build.patch
+++ b/pkgs/by-name/do/dovecot/fix-lua-build.patch
@@ -0,0 +1,28 @@
+diff --git a/src/auth/Makefile.am b/src/auth/Makefile.am
+index 7474e76fb6..e7fc4aad0f 100644
+--- a/src/auth/Makefile.am
+++ b/src/auth/Makefile.am
+@@ -21,12 +21,11 @@ LUA_LIB =
+ AUTH_LUA_LIBS =
+ AUTH_LUA_LDADD =
+ if HAVE_LUA
+-
+AUTH_LUA_LDADD += $(LUA_LIBS)
+ if AUTH_LUA_PLUGIN
+ LUA_LIB += libauthdb_lua.la
+ else
+ AUTH_LUA_LIBS += $(LIBDOVECOT_LUA)
+-AUTH_LUA_LDADD += $(LUA_LIBS)
+ endif
+ endif
+ 
+@@ -200,7 +199,7 @@ endif
+ endif
+ 
+ if HAVE_LUA
+-auth_libs += $(LIBDOVECOT_LUA) $(LUA_LIBS)
+auth_libs += $(LIBDOVECOT_LUA)
+ endif
+ 
+ if AUTH_LUA_PLUGIN
+
--- a/pkgs/by-name/do/dovecot/generic.nix
+++ b/pkgs/by-name/do/dovecot/generic.nix
@@ -78,9 +78,9 @@ stdenv.mkDerivation (finalAttrs: {
    bison
    perl
    pkg-config
+    autoreconfHook
  ]
  ++ lib.optionals (stdenv.hostPlatform.isLinux && !stdenv.hostPlatform.isDarwin) [ rpcsvc-proto ]
-  ++ lib.optionals (stdenv.hostPlatform.isDarwin) [ autoreconfHook ]
  ++ lib.optional (withMySQL && lib.versionOlder version "2.4") fake_mysql_config;

  buildInputs = [
@@ -125,7 +125,10 @@ stdenv.mkDerivation (finalAttrs: {

  enableParallelBuilding = true;

-  env.NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-liconv";
+  env = {
+    NIX_LDFLAGS = lib.optionalString stdenv.hostPlatform.isDarwin "-liconv";
+    LUA_PATH = lib.optionalString withLua "${lua5_3.pkgs.json}/share/lua/${lua5_3.luaversion}/?.lua";
+  };

  postPatch = ''
    sed -i -E \
--- a/pkgs/by-name/do/dovecot/package.nix
+++ b/pkgs/by-name/do/dovecot/package.nix
@@ -4,5 +4,6 @@ import ./generic.nix {
  patches = _: [
    # Fix loading extended modules.
    ./load-extended-modules.patch
+    ./fix-lua-build.patch
  ];
 }
--- a/pkgs/by-name/dr/draupnir/package.nix
+++ b/pkgs/by-name/dr/draupnir/package.nix
@@ -13,6 +13,7 @@
  cctools,
  nixosTests,
  nix-update-script,
+  fetchpatch2,
 }:
 let
  nodeSources = srcOnly nodejs_24;
@@ -36,7 +37,14 @@ buildNpmPackage (finalAttrs: {
  ]
  ++ lib.optional stdenv.hostPlatform.isDarwin cctools.libtool;

-  npmDepsHash = "sha256-DvQM9Kr9Hc7/1OEZadZ1GvpAjfRmbdIcA6UDuFBQ+vo=";
+  patches = [
+    (fetchpatch2 {
+      url = "https://github.com/the-draupnir-project/Draupnir/commit/4e63164046153c656050c6d0a325c79f1492153a.patch?full_index=1";
+      hash = "sha256-dVG0BAE8pATfGdcHvTV8jTC+OQP0gMB7v396MtJlG4o=";
+    })
+  ];
+
+  npmDepsHash = "sha256-7WAfSFfPQJ9d/U9hk5wypasSoU2JwkoCq/nKAnzFf1o=";

  preBuild = ''
    # install proper version and branch info
--- a/pkgs/by-name/ep/epson-202101w/package.nix
+++ b/pkgs/by-name/ep/epson-202101w/package.nix
@@ -0,0 +1,92 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  rpmextract,
+  autoreconfHook,
+  autoPatchelfHook,
+  file,
+  libjpeg,
+  cups,
+}:
+
+let
+  version = "1.0.2";
+in
+stdenv.mkDerivation {
+  pname = "epson-202101w";
+  inherit version;
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchurl {
+    # NOTE: Don't forget to update the webarchive link too!
+    urls = [
+      "https://download3.ebz.epson.net/dsc/f/03/00/15/15/02/f5cba2761f2f501363cdbf7e1b9b9879b0715aa5/epson-inkjet-printer-202101w-1.0.2-1.src.rpm"
+      "https://web.archive.org/web/20250609030209if_/https://download3.ebz.epson.net/dsc/f/03/00/15/15/02/f5cba2761f2f501363cdbf7e1b9b9879b0715aa5/epson-inkjet-printer-202101w-1.0.2-1.src.rpm"
+    ];
+    sha256 = "17lz5cccknabp8cbkplhv1sn92m5w5md01rhhycbngp10zdmyhcz";
+  };
+
+  nativeBuildInputs = [
+    rpmextract
+    autoreconfHook
+    autoPatchelfHook
+    file
+  ];
+
+  buildInputs = [
+    libjpeg
+    cups
+    (lib.getLib stdenv.cc.cc)
+  ];
+
+  unpackPhase = ''
+    rpmextract $src
+    tar -zxf epson-inkjet-printer-202101w-${version}.tar.gz
+    tar -zxf epson-inkjet-printer-filter-${version}.tar.gz
+    for ppd in epson-inkjet-printer-202101w-${version}/ppds/*; do
+      substituteInPlace $ppd --replace "/opt/epson-inkjet-printer-202101w" "$out"
+      substituteInPlace $ppd --replace "/cups/lib" "/lib/cups"
+    done
+    cd epson-inkjet-printer-filter-${version}
+  '';
+
+  preConfigure = ''
+    chmod +x configure
+  '';
+
+  postInstall = ''
+    cd ../epson-inkjet-printer-202101w-${version}
+    cp -a lib64 resource watermark $out
+    mkdir -p $out/share/cups/model/epson-inkjet-printer-202101w
+    cp -a ppds $out/share/cups/model/epson-inkjet-printer-202101w/
+    cp -a Manual.txt $out/doc/
+    cp -a README $out/doc/README.driver
+  '';
+
+  meta = {
+    homepage = "https://www.openprinting.org/driver/epson-202101w";
+    description = "Epson printer driver (L1210, L1250, L3200, L3210)";
+    longDescription = ''
+      This software is a filter program used with the Common UNIX Printing
+      System (CUPS) under Linux. It supplies high quality printing with
+      Seiko Epson Color Ink Jet Printers.
+
+      To use the driver adjust your configuration.nix file:
+        services.printing = {
+          enable = true;
+          drivers = [ pkgs.epson-202101w ];
+        };
+    '';
+    license = with lib.licenses; [
+      lgpl21
+      epson
+    ];
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [
+      caguiclajmg
+    ];
+  };
+}
--- a/pkgs/by-name/fa/fabric-ai/package.nix
+++ b/pkgs/by-name/fa/fabric-ai/package.nix
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "fabric-ai";
-  version = "1.4.455";
+  version = "1.4.459";

  src = fetchFromGitHub {
    owner = "danielmiessler";
    repo = "fabric";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-folZ+Y5l76SKo65RJAK7kZX6DJ/AL+iLkcV8NX+1DTA=";
+    hash = "sha256-HlOctDrdp1iksU2PU3LDDqaHdCtyTzJhToNkU7cqMPU=";
  };

-  vendorHash = "sha256-DfI0SYMX1wfJ8V0tFYpjzCgqhR7H/0J1p5R3aNcrXTw=";
+  vendorHash = "sha256-l7LeD4FV7TCuqek36R8FcrXcjHmTwGkQpJobp15Auts=";

  # Fabric introduced plugin tests that fail in the nix build sandbox.
  doCheck = false;
--- a/pkgs/by-name/fa/faust-benchmark-tools/package.nix
+++ b/pkgs/by-name/fa/faust-benchmark-tools/package.nix
@@ -0,0 +1,142 @@
+{
+  lib,
+  stdenv,
+  faust,
+  makeWrapper,
+  llvm,
+  ncurses,
+  zlib,
+  libxml2,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "faust-benchmark-tools";
+  inherit (faust) version src;
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  # The benchmark tools live in their own directory with their own Makefile,
+  # decoupled from the main CMake build.
+  sourceRoot = "${finalAttrs.src.name}/tools/benchmark";
+
+  nativeBuildInputs = [
+    makeWrapper
+  ];
+
+  buildInputs = [
+    # The benchmark binaries link ${faust}/lib/libfaust.a statically and
+    # include headers from ${faust}/include. The runtime scripts find `faust`,
+    # `faustpath`, and `faustoptflags` via the PATH wrap in postFixup.
+    faust
+    llvm
+    ncurses
+    zlib
+    libxml2
+  ];
+
+  postPatch = ''
+    # --build rather than --host: under strictDeps there is no host bash in
+    # scope, so --host silently leaves the shebangs alone. This package is
+    # native-only anyway (see meta).
+    patchShebangs --build faustbench faust2object faust-tester
+  '';
+
+  makeFlags = [
+    "FAUST=${faust}/bin/faust"
+    # Upstream's Makefile hardcodes ../../build on Darwin (they can't run an
+    # arm64 faust on their x86 CI runner) and only derives these from FAUST on
+    # other platforms. We build natively, so point them at the real faust
+    # output unconditionally.
+    "LIB=${faust}/lib"
+    "INC=${faust}/include"
+    "FARCH=${faust}/share/faust"
+    # The Makefile only shells out to `llvm-config` when LLVM is unset
+    # (`ifndef LLVM`), so setting it here avoids needing llvm-config on PATH.
+    "LLVM=$(shell ${lib.getDev llvm}/bin/llvm-config --link-static --ldflags --libs all --system-libs)"
+    # Restrict to the non-audio, non-GUI tools. Avoids pulling in
+    # gtk2/jack2/libsamplerate/liblo. The Makefile uses `TARGETS ?= …`.
+    "TARGETS=dynamic-faust faustbench-llvm faustbench-llvm-interp faustbench-interp interp-tracer"
+  ];
+
+  enableParallelBuilding = true;
+
+  # Upstream's `install` target doesn't create its target directories, and
+  # unconditionally installs the wasm/iOS tools and faustbench.cpp regardless
+  # of TARGETS, which would defeat the restriction above.
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 -t $out/bin \
+      dynamic-faust \
+      faustbench-llvm \
+      faustbench-llvm-interp \
+      faustbench-interp \
+      interp-tracer \
+      faustbench \
+      faust2object \
+      faust-tester
+
+    # faustbench reads this file at runtime to assemble its C++ test harness.
+    install -Dm644 faustbench.cpp $out/share/faust/faustbench.cpp
+
+    runHook postInstall
+  '';
+
+  postFixup = ''
+    # `faustbench` reads $FAUSTLIB/faustbench.cpp, but $FAUSTLIB is set by
+    # faustpath to ${faust}/share/faust which does not contain our copy.
+    # Redirect to the copy we just installed.
+    substituteInPlace $out/bin/faustbench \
+      --replace-fail '$FAUSTLIB/faustbench.cpp' "$out/share/faust/faustbench.cpp"
+
+    # Plain PATH wrap is enough for faust-tester (just calls faust2plot from
+    # faust). faustbench and faust2object compile C++ at runtime, so they need
+    # the build environment exported too.
+    wrapProgram $out/bin/faust-tester \
+      --prefix PATH : "$out/bin:${lib.makeBinPath [ faust ]}"
+
+    # Mirror what faust.wrapWithBuildEnv does for the two compile-driving
+    # scripts, so users get a working $CXX and friends without a dev shell.
+    # (wrapWithBuildEnv itself is a whole-derivation builder — dontBuild, its
+    # own installPhase copying from tools/faust2appls — so it can't wrap
+    # binaries we compile here.)
+    nix_cc_wrapper_target_host="$(printenv | grep ^NIX_CC_WRAPPER_TARGET_HOST | sed 's/=.*//')"
+    nix_bintools_wrapper_target_host="$(printenv | grep ^NIX_BINTOOLS_WRAPPER_TARGET_HOST | sed 's/=.*//')"
+    for s in faustbench faust2object; do
+      wrapProgram $out/bin/$s \
+        --prefix PATH : "$out/bin:${lib.makeBinPath [ faust ]}:$PATH" \
+        --prefix PKG_CONFIG_PATH : "$PKG_CONFIG_PATH" \
+        --set NIX_CFLAGS_COMPILE "$NIX_CFLAGS_COMPILE" \
+        --set NIX_LDFLAGS "$NIX_LDFLAGS -lpthread" \
+        --set "$nix_cc_wrapper_target_host" "''${!nix_cc_wrapper_target_host}" \
+        --set "$nix_bintools_wrapper_target_host" "''${!nix_bintools_wrapper_target_host}"
+    done
+  '';
+
+  # Version is inherited from `faust`; bumping faust auto-bumps this. No
+  # passthru.updateScript needed.
+
+  meta = {
+    description = "Benchmarking, tracing, and dynamic-compilation tools for the Faust compiler";
+    longDescription = ''
+      A subset of the tools from the upstream Faust `tools/benchmark/`
+      directory: dynamic-faust, faustbench-llvm, faustbench-llvm-interp,
+      faustbench-interp, interp-tracer (binaries built against libfaust.a),
+      plus the scripts faustbench, faust2object, and faust-tester.
+
+      This package intentionally excludes the JACK/GTK runners (dynamic-jack-gtk,
+      faust-osc-controller, signal-tester, box-tester) and the WASM bench
+      tools to keep the closure small. They can be packaged separately if
+      needed.
+    '';
+    homepage = "https://github.com/grame-cncm/faust/tree/master-dev/tools/benchmark";
+    changelog = "https://github.com/grame-cncm/faust/blob/${finalAttrs.version}/Changes.txt";
+    license = lib.licenses.gpl3Plus;
+    # Cross is not wired up: llvm-config is executed at build time from
+    # buildInputs, and faust2object invokes it again at runtime on the host.
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ magnetophon ];
+    mainProgram = "faustbench";
+  };
+})
--- a/pkgs/by-name/fe/feishu-cli/package.nix
+++ b/pkgs/by-name/fe/feishu-cli/package.nix
@@ -7,13 +7,13 @@

 buildGoModule (finalAttrs: {
  pname = "feishu-cli";
-  version = "1.34.0";
+  version = "1.35.0";

  src = fetchFromGitHub {
    owner = "riba2534";
    repo = "feishu-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-LyWUk64tt2mxs9+4U4BkF3Kb8O/B94iJqGLsTohOWNI=";
+    hash = "sha256-0FEVwpONZcN2DsYVzlY5EDsQwN81DjP9Xc857ro4quw=";
  };

  vendorHash = "sha256-vRefU38o9Q4Q96aXoUXUggcRsfQePjlUrSsNERJH3YU=";
--- a/pkgs/by-name/fz/fzf-git-sh/package.nix
+++ b/pkgs/by-name/fz/fzf-git-sh/package.nix
@@ -20,13 +20,13 @@

 stdenv.mkDerivation rec {
  pname = "fzf-git-sh";
-  version = "0-unstable-2026-06-16";
+  version = "0-unstable-2026-07-06";

  src = fetchFromGitHub {
    owner = "junegunn";
    repo = "fzf-git.sh";
-    rev = "d76cd4df21f2ca5aafeab8b31118c4df133472c0";
-    hash = "sha256-lK8rbwu5PhCOY3ODWW6U/R/O3AA4c4etxCQogHja9nA=";
+    rev = "fdf632c53262dfcc44fc09d591e462e9f8fcae83";
+    hash = "sha256-3ho7Kn84q36bj9N+Nj+5XEdkXIN4xwYk7h7g/ou3TRM=";
  };

  dontBuild = true;
--- a/pkgs/by-name/gl/glew/package.nix
+++ b/pkgs/by-name/gl/glew/package.nix
@@ -21,6 +21,15 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-tkeQ+UuSas1+j4TF1gAKhstDlnvR5oiwMIkHl5nJ6Ik=";
  };

+  patches = [
+    # Allow a single GLEW build to support both EGL and GLX.
+    #
+    # Originally developed for the AUR glew-egl-glx package and later adopted by
+    # Arch Linux. Carry an updated copy in-tree after it was removed from Arch's
+    # packaging repository.
+    ./patches/egl+glx.patch
+  ];
+
  outputs = [
    "bin"
    "out"
--- a/pkgs/by-name/gl/glew/patches/egl+glx.patch
+++ b/pkgs/by-name/gl/glew/patches/egl+glx.patch
@@ -0,0 +1,172 @@
+--- a/src/glew.c
+++ b/src/glew.c
+@@ -36,6 +36,10 @@
+ #  include GLEW_INCLUDE
+ #endif
+ 
+#if defined(GLEW_EGL)
+#  include <GL/eglew.h>
+#endif
+
+ #if defined(GLEW_OSMESA)
+ #  define GLAPI extern
+ #  ifndef APIENTRY
+@@ -47,8 +51,6 @@
+ #    undef APIENTRY
+ #    undef GLEW_APIENTRY_DEFINED
+ #  endif
+-#elif defined(GLEW_EGL)
+-#  include <GL/eglew.h>
+ #elif defined(_WIN32)
+ /*
+  * If NOGDI is defined, wingdi.h won't be included by windows.h, and thus
+@@ -65,8 +67,7 @@
+ 
+ #include <stddef.h>  /* For size_t */
+ 
+-#if defined(GLEW_EGL)
+-#elif defined(GLEW_REGAL)
+#if defined(GLEW_REGAL)
+ 
+ /* In GLEW_REGAL mode we call directly into the linked
+    libRegal.so glGetProcAddressREGAL for looking up
+@@ -167,23 +168,37 @@ void* NSGLGetProcAddress (const GLubyte *name)
+  * Define glewGetProcAddress.
+  */
+ #if defined(GLEW_REGAL)
+-#  define glewGetProcAddress(name) regalGetProcAddress((const GLchar *)name)
+#  define _glewGetProcAddress(name) regalGetProcAddress((const GLchar *)name)
+ #elif defined(GLEW_OSMESA)
+-#  define glewGetProcAddress(name) OSMesaGetProcAddress((const char *)name)
+-#elif defined(GLEW_EGL)
+-#  define glewGetProcAddress(name) eglGetProcAddress((const char *)name)
+#  define _glewGetProcAddress(name) OSMesaGetProcAddress((const char *)name)
+ #elif defined(_WIN32)
+-#  define glewGetProcAddress(name) wglGetProcAddress((LPCSTR)name)
+#  define _glewGetProcAddress(name) wglGetProcAddress((LPCSTR)name)
+ #elif defined(__APPLE__) && !defined(GLEW_APPLE_GLX)
+-#  define glewGetProcAddress(name) NSGLGetProcAddress(name)
+#  define _glewGetProcAddress(name) NSGLGetProcAddress(name)
+ #elif defined(__sgi) || defined(__sun) || defined(__HAIKU__)
+-#  define glewGetProcAddress(name) dlGetProcAddress(name)
+#  define _glewGetProcAddress(name) dlGetProcAddress(name)
+ #elif defined(__ANDROID__)
+-#  define glewGetProcAddress(name) NULL /* TODO */
+#  define _glewGetProcAddress(name) NULL /* TODO */
+ #elif defined(__native_client__)
+-#  define glewGetProcAddress(name) NULL /* TODO */
+#  define _glewGetProcAddress(name) NULL /* TODO */
+ #else /* __linux */
+-#  define glewGetProcAddress(name) (*glXGetProcAddressARB)(name)
+#  define _glewGetProcAddress(name) (*glXGetProcAddressARB)(name)
+#endif
+
+#if defined(GLEW_EGL)
+static GLboolean _EGL_available = GL_FALSE;
+static void (*glewGetProcAddress (const GLubyte *name)) (void)
+{
+  void (*addr)(void);
+  if (_EGL_available)
+  {
+    addr = eglGetProcAddress((const char *)name);
+    if (addr) return addr;
+  }
+  return _glewGetProcAddress(name);
+}
+#else
+#  define glewGetProcAddress(name) _glewGetProcAddress(name)
+ #endif
+ 
+ /*
+@@ -19783,9 +19798,7 @@ GLenum GLEWAPIENTRY glewContextInit (void)
+ }
+ 
+ 
+-#if defined(GLEW_OSMESA)
+-
+-#elif defined(GLEW_EGL)
+#if defined(GLEW_EGL)
+ 
+ PFNEGLCHOOSECONFIGPROC __eglewChooseConfig = NULL;
+ PFNEGLCOPYBUFFERSPROC __eglewCopyBuffers = NULL;
+@@ -21074,8 +21087,8 @@ GLenum eglewInit (EGLDisplay display)
+   PFNEGLQUERYSTRINGPROC queryString = NULL;
+ 
+   /* Load necessary entry points */
+-  initialize = (PFNEGLINITIALIZEPROC)   glewGetProcAddress("eglInitialize");
+-  queryString = (PFNEGLQUERYSTRINGPROC) glewGetProcAddress("eglQueryString");
+  initialize = (PFNEGLINITIALIZEPROC)   eglGetProcAddress("eglInitialize");
+  queryString = (PFNEGLQUERYSTRINGPROC) eglGetProcAddress("eglQueryString");
+   if (!initialize || !queryString)
+     return 1;
+ 
+@@ -21669,7 +21682,9 @@ GLenum eglewInit (EGLDisplay display)
+   return GLEW_OK;
+ }
+ 
+-#elif defined(_WIN32)
+#endif
+
+#if defined(_WIN32)
+ 
+ PFNWGLSETSTEREOEMITTERSTATE3DLPROC __wglewSetStereoEmitterState3DL = NULL;
+ 
+@@ -23750,13 +23765,26 @@ GLenum GLEWAPIENTRY glewInit (void)
+   GLenum r;
+ #if defined(GLEW_EGL)
+   PFNEGLGETCURRENTDISPLAYPROC getCurrentDisplay = NULL;
+  EGLDisplay display;
+ #endif
+   r = glewContextInit();
+   if ( r != 0 ) return r;
+ #if defined(GLEW_EGL)
+-  getCurrentDisplay = (PFNEGLGETCURRENTDISPLAYPROC) glewGetProcAddress("eglGetCurrentDisplay");
+-  return eglewInit(getCurrentDisplay());
+-#elif defined(GLEW_OSMESA) || defined(__ANDROID__) || defined(__native_client__) || defined(__HAIKU__)
+  getCurrentDisplay = (PFNEGLGETCURRENTDISPLAYPROC) eglGetProcAddress("eglGetCurrentDisplay");
+  if (getCurrentDisplay)
+    display = getCurrentDisplay();
+  else
+    display = EGL_NO_DISPLAY;
+  if (display != EGL_NO_DISPLAY)
+  {
+    r = eglewInit(display);
+    if ( r == 0 ) {
+      _EGL_available = GL_TRUE;
+      return r;
+    }
+  }
+#endif
+#if defined(GLEW_OSMESA) || defined(__ANDROID__) || defined(__native_client__) || defined(__HAIKU__)
+   return r;
+ #elif defined(_WIN32)
+   return wglewInit();
+@@ -30675,7 +30703,7 @@ GLboolean GLEWAPIENTRY glewIsSupported (const char* name)
+   return ret;
+ }
+ 
+-#if defined(_WIN32) && !defined(GLEW_EGL) && !defined(GLEW_OSMESA)
+#if defined(_WIN32) && !defined(GLEW_OSMESA)
+ 
+ GLboolean GLEWAPIENTRY wglewIsSupported (const char* name)
+ {
+@@ -31118,7 +31146,7 @@ GLboolean GLEWAPIENTRY wglewIsSupported (const char* name)
+   return ret;
+ }
+ 
+-#elif !defined(GLEW_OSMESA) && !defined(GLEW_EGL) && !defined(__ANDROID__) && !defined(__native_client__) && !defined(__HAIKU__) && !defined(__APPLE__) || defined(GLEW_APPLE_GLX)
+#elif !defined(GLEW_OSMESA) && !defined(__ANDROID__) && !defined(__native_client__) && !defined(__HAIKU__) && !defined(__APPLE__) || defined(GLEW_APPLE_GLX)
+ 
+ GLboolean glxewIsSupported (const char* name)
+ {
+@@ -31702,7 +31730,9 @@ GLboolean glxewIsSupported (const char* name)
+   return ret;
+ }
+ 
+-#elif defined(GLEW_EGL)
+#endif
+
+#if defined(GLEW_EGL)
+ 
+ GLboolean eglewIsSupported (const char* name)
+ {
--- a/pkgs/by-name/ib/ibm-plex/fonts.nix
+++ b/pkgs/by-name/ib/ibm-plex/fonts.nix
@@ -6,10 +6,10 @@
    version = "1.1.0";
  };
  mono = {
-    hash = "sha256-OwUmrPfEehLDz0fl2ChYLK8FQM2p0G1+EMrGsYEq+6g=";
+    hash = "sha256-GK9KStu5KQ5g5+IUwJq4L+a5gOwzsNXH80OOIbyvOnM=";
    name = "IBM Plex Mono";
-    url = "https://github.com/IBM/plex/releases/download/@ibm/plex-mono@1.1.0/ibm-plex-mono.zip";
-    version = "1.1.0";
+    url = "https://github.com/IBM/plex/releases/download/%40ibm/plex-mono%402.5.0/ibm-plex-mono.zip";
+    version = "2.5.0";
  };
  sans = {
    hash = "sha256-mK+8GGl2ugF2+fS6yd3p5NWPHHcKEJWiShDS3lihOlI=";
--- a/pkgs/by-name/ib/ibm-plex/package.nix
+++ b/pkgs/by-name/ib/ibm-plex/package.nix
@@ -62,7 +62,7 @@ in
 assert lib.assertMsg (unknownFamilies == [ ]) "Unknown font(s): ${toString unknownFamilies}";
 symlinkJoin {
  pname = "ibm-plex";
-  version = "0-unstable-2026-02-12";
+  version = "0-unstable-2026-05-26";
  paths = lib.attrValues fontDerivations;
  passthru = fontDerivations // {
    updateScript = ./update.py;
--- a/pkgs/by-name/ku/kubectl-gadget/package.nix
+++ b/pkgs/by-name/ku/kubectl-gadget/package.nix
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "kubectl-gadget";
-  version = "0.54.0";
+  version = "0.54.1";

  src = fetchFromGitHub {
    owner = "inspektor-gadget";
    repo = "inspektor-gadget";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-T0UywAmNHk+tmE2eHnxHPpOulNAa+juEMqA2Bth044I=";
+    hash = "sha256-eG316yAUxW6w5kn53szdgcd3q4czkrLWgG953gNYPsg=";
  };

  vendorHash = "sha256-35bloouMwEuaZOC7ygz3sOJqoJoldDD4XHeCdBxx56U=";
--- a/pkgs/by-name/me/meshlab/package.nix
+++ b/pkgs/by-name/me/meshlab/package.nix
@@ -76,12 +76,7 @@ stdenv.mkDerivation (finalAttrs: {
    bzip2
    muparser
    eigen
-    # MeshLab renders through Qt's xcb platform, which creates a GLX context,
-    # and calls glewInit() against it. The default EGL-enabled glew is built
-    # EGL-only (no GLX dispatch table), so glewInit can't read GL_VERSION and
-    # the app fails to launch with "GLEW initialization failed: Missing GL
-    # version". See https://github.com/NixOS/nixpkgs/issues/531470
-    (glew.override { enableEGL = false; })
+    glew
    gmp
    levmar
    qhull
--- a/pkgs/by-name/mp/mpc-qt/package.nix
+++ b/pkgs/by-name/mp/mpc-qt/package.nix
@@ -13,13 +13,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "mpc-qt";
-  version = "26.01";
+  version = "26.07";

  src = fetchFromGitHub {
    owner = "mpc-qt";
    repo = "mpc-qt";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-tgCdPzolUlp3Cy1ZbDlMQvl/4WcTl86QTZ8F18f0JME=";
+    hash = "sha256-1tm/Sw/6szY4k2ObFnOsXfffIJ31eokjqkOt90DquWE=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/no/nono/package.nix
+++ b/pkgs/by-name/no/nono/package.nix
@@ -9,11 +9,13 @@
  dbus,

  writableTmpDirAsHomeHook,
+  gitMinimal,
+  nix-update-script,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "nono";
-  version = "0.61.1";
+  version = "0.68.0";

  __darwinAllowLocalNetworking = true; # required for tests

@@ -21,9 +23,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "always-further";
    repo = "nono";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-y5oMR5Vawf/1QUj3ACDdqAjKT+Q2gizRfKkal340EP8=";
+    hash = "sha256-RxVYatzKjv6LJ+M4Js+sTvg0hMnovXxtr6WxwFYF16Y=";
  };
-  cargoHash = "sha256-Oy/IqAK5ml1vu0eee+pF5pRjzk0Na/Fb04e1Mx0d924=";
+  cargoHash = "sha256-9gMhW2qt5gbf6x/uPLc4vl3rn6UdneoxRmWpeRqI4V0=";

  nativeBuildInputs = [
    pkg-config
@@ -35,12 +37,14 @@ rustPlatform.buildRustPackage (finalAttrs: {

  nativeCheckInputs = [
    writableTmpDirAsHomeHook
+    gitMinimal
  ];

  checkFlags = map (t: "--skip=${t}") (
    [
      # fails to initialize the sandbox under '/build'
      "test_all_profiles_signal_mode_resolves"
+      "test_restrict_execute_does_not_break_rename_into_new_subdir"
      # panic
      "build_run_profile_patch_adds_override_deny_for_sensitive_file"
      "build_run_profile_patch_merges_read_and_write_to_allow_file"
@@ -55,7 +59,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      "rollback_signed_session_verifies_from_audit_dir_bundle"

      # nono-cli
-      # wants a script `cripts/test-list-aliases.sh`, `git`, and `.git` history
+      # wants a script `scripts/test-list-aliases.sh`, `git`, and `.git` history
      "alias_inventory_script_passes"
      # fails to initialize the sandbox under '/build'
      # has also failed due to running on darwin despite testing the linux only
@@ -69,6 +73,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
      "alias_inventory_rejects_unapproved_deprecated_module_reach_in"
      "lint_docs_accepts_clean_tree"
      "lint_docs_rejects_quoted_override_deny_outside_allowlist"
+      # need /bin/cat
+      "granted_path_exits_zero"
+      "env_credentials_with_command_policies_non_shim_entry_succeeds"

      # nono-proxy
      # fails to prepare TLS bundle inside build sandbox
@@ -76,6 +83,18 @@ rustPlatform.buildRustPackage (finalAttrs: {
      "server::tests::test_route_diagnostics_summarises_each_route"
      "tls_intercept::bundle::tests::bundle_contains_ephemeral_and_system_roots"
      "tls_intercept::bundle::tests::bundle_file_has_restrictive_permissions"
+      # fail due to credential capture not configured
+      "proxy_runtime::tests::capture_helper_with_interaction_stdin_true_inherits_terminal_stdin"
+      "proxy_runtime::tests::capture_helper_with_stdio_true_receives_null_not_terminal_stdin"
+      "proxy_runtime::tests::proxy_credential_capture_backend_captures_and_caches"
+      "proxy_runtime::tests::proxy_credential_capture_backend_parses_json_headers"
+      "proxy_runtime::tests::proxy_credential_capture_backend_rejects_empty_stdout"
+      "proxy_runtime::tests::proxy_credential_capture_backend_sends_request_json_stdin"
+      "proxy_runtime::tests::proxy_credential_capture_backend_uses_path_cache_scope"
+      # panic
+      "server::tests::reactive_proxy_auth_retry_answered_after_407"
+      "server::tests::test_oauth_capture_routes_activate_intercept"
+      "server::tests::test_route_diagnostics_groups_credential_and_endpoint_routes"
    ]
    ++ lib.optionals stdenv.hostPlatform.isDarwin [
      # panics with "exact-path fallback must not recursively cover descendants"
@@ -109,9 +128,18 @@ rustPlatform.buildRustPackage (finalAttrs: {
      "environment_allow_vars_default_allows_all"
      "environment_allow_vars_prefix_patterns"
      "environment_allow_vars_with_profile"
+
+      "tool_sandbox::macos::tests::executable_shape_baseline_grants_env_shebang_target_interpreter"
+      "tool_sandbox::macos::tests::macos_runtime_baseline_does_not_grant_system_volumes_data"
+      "env_nono_capability_elevation_accepts_truthy"
+      "env_nono_trust_override_accepts_truthy"
+      "env_nono_trust_proxy_ca_accepts_truthy"
+      "dry_run_does_not_modify_workspace"
+      "rollback_restores_file_after_write"
    ]
  );

+  passthru.updateScript = nix-update-script { };
  meta = {
    description = "Secure, kernel-enforced sandbox for AI agents, MCP and LLM workloads";
    homepage = "https://github.com/always-further/nono";
--- a/pkgs/by-name/oh/oh-my-posh/package.nix
+++ b/pkgs/by-name/oh/oh-my-posh/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "oh-my-posh";
-  version = "29.26.1";
+  version = "29.28.0";

  src = fetchFromGitHub {
    owner = "jandedobbeleer";
    repo = "oh-my-posh";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-hE3L7emTk7MxzBUqSUDNKYiA2H1w9mcGhPYiR1OhYxg=";
+    hash = "sha256-8V1Wu3wqakwSVNb/WPlxRy9KL33frb8nqWeorHuIuzI=";
  };

  vendorHash = "sha256-6DX/x9uWUbwXy9ccB6NIVRKsOc1nJXtctItONAI7zPQ=";
--- a/pkgs/by-name/op/openscad/package.nix
+++ b/pkgs/by-name/op/openscad/package.nix
@@ -127,9 +127,7 @@ stdenv.mkDerivation (finalAttrs: {
  buildInputs = [
    eigen
    boost
-    # OpenSCAD's GLX offscreen renderer needs GLEW's GLXEW symbols (`__GLXEW_SGIX_pbuffer`, `__GLXEW_SGIX_fbconfig`)
-    # which are not found in the default EGL-enabled glew and causes the build failure in https://github.com/NixOS/nixpkgs/issues/530529
-    (glew.override { enableEGL = false; })
+    glew
    opencsg
    cgal_5
    mpfr
--- a/pkgs/by-name/ou/outline/missing-hashes.json
+++ b/pkgs/by-name/ou/outline/missing-hashes.json
@@ -31,79 +31,102 @@
  "@msgpackr-extract/msgpackr-extract-linux-arm@npm:3.0.3": "115f627bcd7c290ddfa1d16405cc1ce388be0b295a26adb1ee2d774133a77809aa0bae83775d3c11f220544e77d34c01d607037bf9dfc6aaac67329cb5fe2818",
  "@msgpackr-extract/msgpackr-extract-linux-x64@npm:3.0.3": "ab74755aa2afd27ad8f5277c7cb7a0c721028ba63c3e3109458689340d76ed4c901aa2c71ae5950f3a2149ae9e835e711a12842db219864107cc0c5c1fbdc0da",
  "@msgpackr-extract/msgpackr-extract-win32-x64@npm:3.0.3": "edfea4f5455f71f608c15163467b98245d46fbd6078019347418e193968431afe632a11e8729ec39755a54563d86940899e2fe8f3d124393f91855956bd1d745",
-  "@oxc-parser/binding-android-arm-eabi@npm:0.121.0": "bca1043494dacc0b7b5de15ae18605faaf7bcc35bdebb3d7de3b6ca092b7b0813148a487e80910541f3f6dc8c95e833beff653b6cff2503f45f78982711fd69c",
-  "@oxc-parser/binding-android-arm64@npm:0.121.0": "ceceedd4695fed202d87c9b2b09107ac1fac6b64ac6f7299e78827920ce915ae6684434c730d95d07cd05d998a862477f6d21d2f3ee5a68e80b4000a890a6e1c",
-  "@oxc-parser/binding-darwin-arm64@npm:0.121.0": "6bc756fe6874ea0c9f2e4a717b32f3297a3368330ea9a41774a0ebd4b9ad95e021d393d556fd1f7f8dac9c3093c373f4a495dc3249e4de4e5ef05f788cd4c304",
-  "@oxc-parser/binding-darwin-x64@npm:0.121.0": "7733902e1cab1a17b79c52dc1d934900438343e3eed0357fbd088f39a52ab6ddf25d31b3214134ba0e0e0e486ff1735da0bbc5142cc91d1aca69d073dc43c290",
-  "@oxc-parser/binding-freebsd-x64@npm:0.121.0": "019c17c3a5bd4d419a5e378d3c401735e9f9c5f0d34b3f31f3c18cf37b7a5004e15c39326b47b8e5bd74bf74355709d524747f3b16252898759f20c2d0d2ceba",
-  "@oxc-parser/binding-linux-arm-gnueabihf@npm:0.121.0": "5562174d8fa0a5665934bcd8d65f5895b9d03a79e502ed823bb47b14edd57c6f997da22cfbf7caa122a02a3c527b09947ad06d39ad1f3b9f30a23f4edae3432b",
-  "@oxc-parser/binding-linux-arm-musleabihf@npm:0.121.0": "1ca1d1ba6897cd67c33561199805dfe8cf709eac9ccfa9fd7a9127daf6b57157a1141c88c5c5c822800b57d2abc8bc9344408fc5d6890c1e6d78d820aa011e81",
-  "@oxc-parser/binding-linux-arm64-gnu@npm:0.121.0": "5aea47f9b977d5004ce697a0b13b519183198cc63c074a4ec932e61398851639bcaa3b44a98226e8b644c89114654b70a70356c199badfa0491c04c4460ac925",
-  "@oxc-parser/binding-linux-arm64-musl@npm:0.121.0": "4212fdfb73d16be3c60feaf2548060e85f17b807933bb81426578fd0bc5a89ac1e7b77b594b5c9a3b60daf0ee3ad9594a61554f3f9aac35e219cec7cece07f2e",
-  "@oxc-parser/binding-linux-ppc64-gnu@npm:0.121.0": "6c4ad09387ee66b0ead91f5632bcecd78297d4be50f3e17e2b16f460c877552d1943c8fd6648e3ac1d9806870c91c2bffd088fa9b368119b8d4b1dc2cbc08d95",
-  "@oxc-parser/binding-linux-riscv64-gnu@npm:0.121.0": "d41cdce188365392bd52852a3309d92daa203f240da0e5e7217aa9805fcb0db5ac8a10a26ab48570e16af9daa46622b19a89410e8cbec1d064c931f785225d22",
-  "@oxc-parser/binding-linux-riscv64-musl@npm:0.121.0": "6ae9ade15ea6ff648569d2f83e857c92873e90eb5649f62e0cf000213873b549a2dd4bb4547358f20776aa2f912fd9495721bcce429ad4c02742fffae2d92d47",
-  "@oxc-parser/binding-linux-s390x-gnu@npm:0.121.0": "14ba521e885676eb8e05cb6173d5071505e9a3798f9cb19f45fb3383eefb6def2c0e7cccea43a62eab8d73e22bb3f66143d82355e0e5ef3b8a388e4301b4d9a4",
-  "@oxc-parser/binding-linux-x64-gnu@npm:0.121.0": "0e56d93be40652b0916aa6505de2978b17949665dc4d98e2420d667f6aa8c26437b0137c909124d6adfbfc1e2ff0eb3f31cf93c7ec6e5580dd3b88cfdcb75367",
-  "@oxc-parser/binding-linux-x64-musl@npm:0.121.0": "b1c30cded47edc8ce76dc5c80e5dc70c3bbdbc09505a0f70a4f16b6f55fad7eb3e67b381556d92b883272cbf530dfb8b69cafee06e380a5a47c0debd378b1494",
-  "@oxc-parser/binding-openharmony-arm64@npm:0.121.0": "b4cc609840cc2bd914ab142ebf2404d24452a54d6673469289c100bf1af40dbd1cdfebba1b8c7804a7b285a8f2293ab748da6ebc059ab2043216af069e9ecd2f",
-  "@oxc-parser/binding-wasm32-wasi@npm:0.121.0": "20d260df5bda2e225d7253049890d99ac2a3ce8ad5df8d0f6cec9f23cda9dfd2ddbfc87457fde3e8613109868d4f885beee9df6fcb8f267adb08ed2ab5303bc0",
-  "@oxc-parser/binding-win32-arm64-msvc@npm:0.121.0": "ffb3ae5443b87baa932316bc4bf2fe92d3d67299ec16e06270047fdb6d8c5d33b19f76e486ad6dc5f7cdc3e038bde8c8cdcc3e316007f1bfdac393136f372170",
-  "@oxc-parser/binding-win32-ia32-msvc@npm:0.121.0": "768d242e04f4809101d00a383d05e47a8e90852b65f342861266910e0912eee814e6f5b2b92fa82d7712c15424f63c6a877005c2375083aa5734d7a55d83ab8b",
-  "@oxc-parser/binding-win32-x64-msvc@npm:0.121.0": "03daa39843f83f963eae2a1151029887e9c5449cf3da8dd32588c45045be53ce1d8f1b0699abfff05fc1a49911b4eafbdac1b76696ad23dd3f67bfe685acc8f9",
-  "@oxlint-tsgolint/darwin-arm64@npm:0.22.1": "7c744e93b68ce39cefc63c4ba5efe5084f96f7607eea1efe3559c3e0cac1dd6f2983f1342e4ca23660980094dd4ffcb131b299347d8fcb8f72ebff8e21ae7ab7",
-  "@oxlint-tsgolint/darwin-x64@npm:0.22.1": "bae78458587b8323484bb2ae67c1059c08ee58325e136a901e954734bf702fb7c3d2e1a08c5ce9bc72d9285d976a7813cf838f1ab8a83a9076ad6809a28bbb91",
-  "@oxlint-tsgolint/linux-arm64@npm:0.22.1": "f660bdef1eb9a27ba41d5fdeb43fd82d59b1531c266b8d2ca36c3163fccab0ea58af9de35086de0335259b4e4c59d592088abcda100dfde0b96a5d867bee8b2e",
-  "@oxlint-tsgolint/linux-x64@npm:0.22.1": "96c6b63e3b83440550de9bc2fcc85f1cda460139d9f8b7f82705aab944d85c27a79d2d95d28d3a0d6f31cd25fc668e74319f014ff1a655c3035468c841045e0d",
-  "@oxlint-tsgolint/win32-arm64@npm:0.22.1": "e4d5c1190579523aa93055307b8bbc9725898ddebfcd54746fa65bc93ef2a7d0a152acbd3f987ea75ea93d2788f8e868b003f9ed281780995f9c81210079f9cc",
-  "@oxlint-tsgolint/win32-x64@npm:0.22.1": "cc330b9096c50b579fa822952684a92fd10264d12ca13a4668e2fdfbfb5fdde1332e10668e42ecf64fb747707bddd76116ec083f7b4e9da6021b7412afbbfe1a",
-  "@oxlint/binding-android-arm-eabi@npm:1.66.0": "9e77e0b30de606bff3a4f6c3de7105aaf1aad43d3058e111d3c50bfb1e567bbee807d19a3d0285320edb9783c9ed5bb44fada8de0549788614787b4bfee2c607",
-  "@oxlint/binding-android-arm64@npm:1.66.0": "fa2aabcc7efd43adf725a15b645963f885442ed6fcceceb25158eb0f33bad84446cf2f70f604451ea1be4e4725a71e7a285f0debbf2f7e80a6acaaf5ca4e4302",
-  "@oxlint/binding-darwin-arm64@npm:1.66.0": "ec3904a64891c175271e15de0a5e5080ab68dd5add9511e0ee245a71de16bfe42e361ece4d60f049cf6ac5cc0ce637c94a71d4cb13b29d4356d811bec11f4eac",
-  "@oxlint/binding-darwin-x64@npm:1.66.0": "bbd31bffefc6fe77fcdf47717c9adc0523fa553a3bd7938a6b7394fac5115945db8ec5f6e7a5364b7987502699d33313176324e4a509f08720a919578b6aad59",
-  "@oxlint/binding-freebsd-x64@npm:1.66.0": "612a97b0a27b68e60107c5daac10e34beb1004c107cfd21bac81d4dc1b326361462ce8d34a916ee7568494e5fe7eb1b50275512559c640951ff46fc0a3688168",
-  "@oxlint/binding-linux-arm-gnueabihf@npm:1.66.0": "030fb03f14ec63cf486e4a690762dfe9d2e7e84af102cd57a0425c9654bf9e5908dc9b755d874aadc8fe8eb96fd43aa73e8fe346c06ab6ce12a352710cd28405",
-  "@oxlint/binding-linux-arm-musleabihf@npm:1.66.0": "9313ab7f453bb907c40f53fe1f452da4b3ca3f3adfa663dade5d78b6e7f9bac59897bafdc9b0ad3554db20b923bb42b00e304225f73fb5d6ac6925ad950788f3",
-  "@oxlint/binding-linux-arm64-gnu@npm:1.66.0": "f6de4fb2596095b14fb66d8a0423723f1293ffe31a0d7dfca210b851e8f96ec263600b6cbb9afbb6e3340d094b96fb9c745a56e0b70c09f5d466574ca1b6cf6a",
-  "@oxlint/binding-linux-arm64-musl@npm:1.66.0": "0959431b2b29796082f194a658b50bd66a6816451c2670f92d34f271abb538cf1c574dd423d648068e8d17bff0e98373b93bbc2883aad2f36945d9d84715f845",
-  "@oxlint/binding-linux-ppc64-gnu@npm:1.66.0": "becb9b048dcedd3f883d113898ed1d9ed674467263c37aae1cb19f3c4475eb5cc94a4f89ab57c89514de5418d8c0547ef712d117c49a2edcde77162a556fc4f2",
-  "@oxlint/binding-linux-riscv64-gnu@npm:1.66.0": "65b5bbc84bd2289c2a1974ba2274b9c8b38046ba22f8e8821d0197ff097c66578b7ce53a46985e554953c5a14f07f38fd173e2c8fbf22c8a0548953cc6dbacff",
-  "@oxlint/binding-linux-riscv64-musl@npm:1.66.0": "80486e2482f66517af323ae6b616f08dd78367cc07f53b40eb3c636a540127f07929d7aaaf67fd046f9e47c7cb9378fdf9da468637e11bc742962f4fffec7aee",
-  "@oxlint/binding-linux-s390x-gnu@npm:1.66.0": "0d0fa2dba19d7aee4fb9817bf2266fbfd32fc1eeed0786f668df269a116cdcf42a92be94170989239c5867f8ba98554124df5c3f398381e485ab00486fcba200",
-  "@oxlint/binding-linux-x64-gnu@npm:1.66.0": "d0297d2bb4bf4669caca2b6b0e7def92749cbcf85b27cca9d4530b49fa54fc009f8981dac99dfabfd8472b9e4a5b74ac9009f8659e73bd1fb3386c48f80c636e",
-  "@oxlint/binding-linux-x64-musl@npm:1.66.0": "c5a9efc367a811b68131a991132002c5fe0c8cb534543374f8f5eb6e595199fe6d4c241eea9c1fa71f9fe20685233ed199cc6574bc5d5ec274ec2d7524f50233",
-  "@oxlint/binding-openharmony-arm64@npm:1.66.0": "13424a0403b7b9feeaf578d716d0d0dcb23654c389e2c82c8b23d6f72e0eae818533f900e0716d58d6649b7b19c4a3d59004cc778225172b426dd5865f2aed12",
-  "@oxlint/binding-win32-arm64-msvc@npm:1.66.0": "77d14ced247fa9cb20104bf50ade58e085a141232ec5cfc44dfc6ee5d098fcaf2d6da96db94adaeb09e507b0cfe254abf155e79c2e4d8c4b4fca240446383ea8",
-  "@oxlint/binding-win32-ia32-msvc@npm:1.66.0": "2943723b356ad6a0a4f9a3ce16f362261d79481dbced24d9447611cc3a7ac99c844d6dbecc76eb04e2eb462ed77d6da495f8a09ad0f64bdfef8f1a3b2a35f283",
-  "@oxlint/binding-win32-x64-msvc@npm:1.66.0": "9c9a8691b2d5a64b1ab5c4798269db89e6432fd870f213e7e16a3fc04a150b9ff0371e5d4e1d4ebc8fbabd278c9aceeb053fcc60bd0b2c6341d8055359d68050",
-  "@rolldown/binding-android-arm64@npm:1.0.0-beta.53": "e2972fe9399066bb418f659c24e7589e87d8373a3b4ec7dd01c06f516c90cd04ea2dc801f2739f05e714f002bd4ef8d505dabbb9ab55437ed3d5f8395db91df5",
-  "@rolldown/binding-android-arm64@npm:1.0.0-rc.17": "7c821eb984e2dd03b05979be3116d927326a1752e7d04462f6c78721fc47fb33d1a584e8c739b181dbfb5c28170541d05f775ada38e81bb685e43d03d974abe3",
-  "@rolldown/binding-darwin-arm64@npm:1.0.0-beta.53": "79587c0686dc0ee54368e4eeb0b8e8cc6f5786c3d55c3b0acd2ccea067b6ba21faffe82140268e7de7126192c3e54fa33742346d82ceaebf5d4c33a94c3575fc",
-  "@rolldown/binding-darwin-arm64@npm:1.0.0-rc.17": "ddedec6840b8e32b7c45a4afe9d797bb24ea74ef222a1b443161045f0b53ec3a5752b108552fe6c99182e2553dd53498d96d3b30551cd3f1e8057559f23b1ed7",
-  "@rolldown/binding-darwin-x64@npm:1.0.0-beta.53": "4b855c7208400453f29aac138c8c050fee3e3f08ff7d36afb3efd705abfc67b11e55bb12ead5d845ae9c464b9855c02380772592ed09e43434ade8dd4e32f703",
-  "@rolldown/binding-darwin-x64@npm:1.0.0-rc.17": "b66ce82e3162261c045027b3aa061cd735c9b1395e77756e06b973f8d0e4256247ddfdb7ee8134363dfcd9d83e665b647b45b666a65c8454babdee19f6d57b40",
-  "@rolldown/binding-freebsd-x64@npm:1.0.0-beta.53": "98672b2ececbcab5bf8732033b9e38553f75a37d0c8198762af5609ea57b9809bc8d9c8ec3e5cc6df7c9535c1a08d063d106b984fa1dfda066dc71ae6e70350d",
-  "@rolldown/binding-freebsd-x64@npm:1.0.0-rc.17": "87b9045771edda717c7d66df105bba2c22c88214254eae48d54ca641f79b4558c2d1ae3db27d8e36b230728263d539c5f6e03e895dbed6e08afa495f634eb42d",
-  "@rolldown/binding-linux-arm-gnueabihf@npm:1.0.0-beta.53": "0760612704b1381580c337eef6b0ef096902b81dca1ff2b536a8a4f529335465d9739ea3c0883d3f7b1548089d237e18a485f0ee2e3d2d9191b0a788f95c81f9",
-  "@rolldown/binding-linux-arm-gnueabihf@npm:1.0.0-rc.17": "43e60168d359a5edae352d948a6515c40a8e047fef7541693cbf18a09d80076efb9308a804c5ea7f645883f8f6b7b43e0e14ea677df63fb4016a55ba6f63b947",
-  "@rolldown/binding-linux-arm64-gnu@npm:1.0.0-beta.53": "a4e4e59a5d316f72c691360027e4a843db4fad1ccf9ddac736890f4182f59612c5bcb4286420b88454658a0735ca63d0692fbba93c2fcc8009e15b3126e62266",
-  "@rolldown/binding-linux-arm64-gnu@npm:1.0.0-rc.17": "d6bfe49089d598886e8c9c92e45240a2404e9594c4abc25f303c8655b859e0f0b67c18947e23177ccc5fb81c9b22a1bd32f2ed052531cc41491b4261ed728342",
-  "@rolldown/binding-linux-arm64-musl@npm:1.0.0-beta.53": "4f465651c516cc78513fa2b6685667acf248b076a19809252063644512ad7949faf46a64738024c266a39c411cb4be15142aa4a352dcd01e1c65486f9f623578",
-  "@rolldown/binding-linux-arm64-musl@npm:1.0.0-rc.17": "be5459bf78de0931993158783af8e349a68d03610876eb131f48fa51414a45683047cd9b4ad7631f385fedc9bb89677e8d12e874104a038b63932aaa1d7bceb3",
-  "@rolldown/binding-linux-ppc64-gnu@npm:1.0.0-rc.17": "e36194c8a39afc6522ca71c2ebf4c038792bf2c0141da76e8a385bebdda077a52f95ece9bd0a3818d5c0023e7e8ce708566d42ecd2ff31296a26a41ed6847aa4",
-  "@rolldown/binding-linux-s390x-gnu@npm:1.0.0-rc.17": "288ce91c69b13e37b2106fcfb663a981aba9de65d3bb4d3cd8c17b9e8193f3de44d08d1201c4d3a18fdeec5a89256d5b3b4d5bb913ff023cb577c403f8889917",
-  "@rolldown/binding-linux-x64-gnu@npm:1.0.0-beta.53": "702a095a2c4b59a48da26be306172585ee01d284900984c56e663cd15b82748e90b7fa96c0d894651d98ca456ac59fe3e70ff88680a636b6c23353919a04d762",
-  "@rolldown/binding-linux-x64-gnu@npm:1.0.0-rc.17": "d532e43e02e0a84c71ff9be34791d7b32b71786bac4921f9e4f92da39a7d5daeabeb4188c7cc088a8a80ab0691dcf1cc9d414396ce7ff6a970b1374e033df8f6",
-  "@rolldown/binding-linux-x64-musl@npm:1.0.0-beta.53": "b410d862c88ec59e8e8a31934ab78ed81b31ed00ed69057038a232d44ee9b7942d1f29ee48991e3a0b2fbcbec889d7819166f77679c907271e7f9a381414d1db",
-  "@rolldown/binding-linux-x64-musl@npm:1.0.0-rc.17": "56aecbe0a2aeaedd558c62a5057a7f915ecada0528a27b5edd80478d948c3645104a56c88121c71edefe9a6af7500f053724103099a90764eb8b84c3ee1f9536",
-  "@rolldown/binding-openharmony-arm64@npm:1.0.0-beta.53": "3dd98fa2c676472bfcf825ee561ac3e8046d48d87d4beab5cc312c871be65387e5b527977b9ac7e2c2d4c8f0e7249d2d536c7cd5124b5550e37bf295cb91729d",
-  "@rolldown/binding-openharmony-arm64@npm:1.0.0-rc.17": "cc7a806e106f4c0d24400af42155b8b396f712e25d76e13b033895b3b635e21edb2246d3c8592c86989c7aaae1ded1708d36516472555bbed3ccaffc939403a4",
-  "@rolldown/binding-wasm32-wasi@npm:1.0.0-beta.53": "3645fc9eac2f4e8b6f5f1552154a8ae1ed5c1975a37f0da22bb4ec9d8dcd4b8d346feb013a927e9254c33bea7b2b4fc2ff5cfebe3c791f215663ac983bf03306",
-  "@rolldown/binding-wasm32-wasi@npm:1.0.0-rc.17": "e6fb0aff901de475a4874af6b0473b396bf1bddf6cbb9acbdb6d4c9318ab2fa3e09d80435ecaeb7866b03effea79c57db9a271b5c720007341949e06828c8385",
-  "@rolldown/binding-win32-arm64-msvc@npm:1.0.0-beta.53": "d0ecd1a1fe4388ae11d7bacace91694ad0135cf25a0200f7b7ae3ce9fac637ff079c5140a680288d3f7fc35eea0100d1a176ed43db4d88c86429804cb6a800e1",
-  "@rolldown/binding-win32-arm64-msvc@npm:1.0.0-rc.17": "d3724ce9f4117d28f903ae1bfc34e3a3efac853691577e511cef91259eb8355dc24f2f27a832bbbd9ad3323dc1b0c3ddbdc4c791ae2a6dd5e5b0c9051384d4d0",
-  "@rolldown/binding-win32-x64-msvc@npm:1.0.0-beta.53": "bbc80dbfb97a1780f0666ffd111f1fbe2b6b2cc1d60102cf41bb0fd03788e020552c94a5e82f95dc75b3696fe0f986a1a362fc7c62bcd899892986a4391fc63a",
-  "@rolldown/binding-win32-x64-msvc@npm:1.0.0-rc.17": "6f4a348202955f74481ccf1c0ec5fa96671507353b6a7f680b920c773f0dda4ebd46c1561428efcefacb9b4d279cd550c80a79fa261f8db173b527ae9a671eca",
+  "@napi-rs/nice-android-arm-eabi@npm:1.1.1": "a1f8caf7bba36f2131303d7bee53e98f46521e499f4b1ba25f5ab770d8acea36abc1792c53e5c6db4235ff1873ee7c94d2ab2f38c8d492ddbdf47fbc6e92c423",
+  "@napi-rs/nice-android-arm64@npm:1.1.1": "5f623438ee64b9e9df5fa8f7b6533776e9774e8edd2aca6945f85869a4f3232c2f30d3a69ad1ce54e775e4747085e57ab473c8421551bda65d809ab65332a8bd",
+  "@napi-rs/nice-darwin-arm64@npm:1.1.1": "733a2d0b606efb52d5532c9a00c54e8c664ecb794fba302c14055d0145baa02b5a50459ef07c171416a5f941e2779cef7406181df7e7969f978ee1d1fdcf2b5f",
+  "@napi-rs/nice-darwin-x64@npm:1.1.1": "f99af3768f04db9fb91d54e460e4e315242d3d8ff3ab0d013c56f4bdf62497d223459cf41554dc0914d11e97f39c2b154c517c3d5996c0ef0297d18702c51b29",
+  "@napi-rs/nice-freebsd-x64@npm:1.1.1": "0d317f65d4d07ae3c8d5d6a424b6b10c599728eef8d58f89ceef2491dffb849bf5744b0eb59c0feeea461b1fd4959db676dc471cdff10ce1304d06246178ce0e",
+  "@napi-rs/nice-linux-arm-gnueabihf@npm:1.1.1": "ed67fd70224048f84401cc1167210d2ab306eac252a83eed96357c49499029205b83e1cfdc606427c46edafb113c0c17613a5de7f122947d4ed6bf3cd7663287",
+  "@napi-rs/nice-linux-arm64-gnu@npm:1.1.1": "9477d397afb1df69647adb449c0d05300a99abf6038a3e2eb63307908375b9a6fa271fe5f7ed211b1b55e87dd9c6ce25f41a6f0f270fa45af13a3a84f546be72",
+  "@napi-rs/nice-linux-arm64-musl@npm:1.1.1": "a754ae5275a306f70eb621e855f234318c9b4db323e10dac3d180c1e66953cb5505e8a1ef13677492839f160c28cc14583b22b3953a061d5b42a7cb7b0dcf42e",
+  "@napi-rs/nice-linux-ppc64-gnu@npm:1.1.1": "91c96752d3b0c57156dfe0885b8124e933197a3a84d4f312986721b37abc1f129f9f071b73142c2074d7e848bab8b8a16e6d246e8c355fda9ed6817ea6450330",
+  "@napi-rs/nice-linux-riscv64-gnu@npm:1.1.1": "e898401c486a5b637426562bb93b12609349119812273b5c19ebc565e516c1246043888ee2c5d24c6178c93288a761284813e495c026c74466f832ef5d63d906",
+  "@napi-rs/nice-linux-s390x-gnu@npm:1.1.1": "0ef13c6beca52613a76c38f70e60ac4959ad08f9d898f64036be8d45ad8266e1f4fc64cf1ba669e55a5869c64a3c2c9a9ea4d4d3836a5b6941fb147a7ee0abd7",
+  "@napi-rs/nice-linux-x64-gnu@npm:1.1.1": "d5ce16822498a12d29c59d5aaa5af4346bb9394d45342706392c2e27915dea9cb37692f0c7fc69dab8c65d31556dec851d631a8d557598bc32d57c3788835dc6",
+  "@napi-rs/nice-linux-x64-musl@npm:1.1.1": "debb8a7067c1d20ce4c29c897e470ef84fa8f66014c0c8e7fe66d6676d6e9199a0936ec3cf3098f89ca1fa1f2628c27d32991f933a7a33da304f1baa45af0eb9",
+  "@napi-rs/nice-openharmony-arm64@npm:1.1.1": "086899cc30d453380399afea4e827cca1428f9cdfc7e253289b0fd41a84c76850315f0070432a00c3c9f80608ac42d638ad836fcad742f437c1fd9465d8a83c4",
+  "@napi-rs/nice-win32-arm64-msvc@npm:1.1.1": "653a7b04d9caa311d793f12d2c2323830a0863737fa4e0cf4ceb5adbb85d30b29d02fb59e5d513e5375273054a965777c83732b25592e80a574f15114bdf96c2",
+  "@napi-rs/nice-win32-ia32-msvc@npm:1.1.1": "f32fcebde27d2e8022e6ea2c8a4fad0676b59c24373c8f7e6fafe3711932a743798909122937278f94c42cba952f5403ed1dc1879544e508299af88ecbbbd68c",
+  "@napi-rs/nice-win32-x64-msvc@npm:1.1.1": "657bf5caa5b07b16f39b3fca7d7f99a0609a01ffbb620ff167652145c0e5c3ee1bbc19f4ed09b9e4373da8a1f84870b58152bb6c44288a3e9cb46ca8a236cec8",
+  "@oxc-parser/binding-android-arm-eabi@npm:0.132.0": "11d7e411090bbec8d07a867a7954aee5417c0ee9a985f1bb217aa6ff12e53d0a6919fc06e27c2d091dbfd02ffbf74edfcee0224b38e642a4138c4a522a1a861b",
+  "@oxc-parser/binding-android-arm64@npm:0.132.0": "dc00b1c88ef74c101af44aa62f54659a720e169339ef0971df70ffe32ff2e768051c24e1038d087fe2f9733045f213fd806bd73f3493280f1c170a1bfd04cea6",
+  "@oxc-parser/binding-darwin-arm64@npm:0.132.0": "8705914f91d01f534bf61cebead3e90cb4497787292faf46e5d198093a9500a2466a74a00f5efd204a1d329ff7da4b7329ef4b8840ba2e378a98872a0e21a3d3",
+  "@oxc-parser/binding-darwin-x64@npm:0.132.0": "4b90b26f7a997556e89c7d4648ee845f5e502dabbfbd2b330cccad756dd7b322e9a6195fdd1f33e278059a40292f754b7da7dd15db4baafb441c304e4cafc7eb",
+  "@oxc-parser/binding-freebsd-x64@npm:0.132.0": "60c04e9f3dd5f3addecdf85873ccc8a79d880e0237be07a597c1fff980e0cfe60d3b0a6b9400a89323c8fd48776a7e172a58b6bde9e3bff781ab5e4d80f2def0",
+  "@oxc-parser/binding-linux-arm-gnueabihf@npm:0.132.0": "eba579d9c7444748f9e82aad19accb80dfbff7ab66dc7f3766da790f97abc190dec8fe430a3af97d4c0f34c9353bb0563094f91efe7f893083a80f2f7ca4dbc8",
+  "@oxc-parser/binding-linux-arm-musleabihf@npm:0.132.0": "03765d72b81dacfd98c46c40fbdddff3361b92cf65e55176886780f158d563a18800bd744c374db28b3664c5eb1b14cd71b1a84cafc64e93d291ec226ed77a7c",
+  "@oxc-parser/binding-linux-arm64-gnu@npm:0.132.0": "aa9f9386d334953839bf0febb457c670f29b2545fba81c957efbf5701600c8f7024ac69f97a8d76de28609f00ffb2488be5c47907328f96c11d4d544c8c55277",
+  "@oxc-parser/binding-linux-arm64-musl@npm:0.132.0": "3f7037a6d4c81816509944a316f239ba7d233a099608ee08f882160067b4542570625bd81ac4029060da1f48a1ca12de74a049c6dfe84f6215d8fb8d77d06bc0",
+  "@oxc-parser/binding-linux-ppc64-gnu@npm:0.132.0": "63937000054bd2a986ebdaf6a92c6bdab926b52744b2e805727503f785eef692a3e1fa1fc85163f63020c6222107ce7fc4c97b4175a847c3774b67a1a904d1ba",
+  "@oxc-parser/binding-linux-riscv64-gnu@npm:0.132.0": "ce3c1c0f048d93fb75399f82bebb97f8c6079e3811bc9a741709906dee379a57660e45d379471beb4b52bd84223750acbdc4a52d34d0a0b6d9b49db5aa1f6ea6",
+  "@oxc-parser/binding-linux-riscv64-musl@npm:0.132.0": "f0eee8f514ae5906981594566180b11e5a8eff72840b3219493ce9bcb0ece6f7e69e37ca3e98b0e228a3a175b65a9730573be1e567652bd91875137a03a42aba",
+  "@oxc-parser/binding-linux-s390x-gnu@npm:0.132.0": "99988465bd899276e9e1c89715080493b91d5096e2a76433b44ee5225a761d77ce932ccd5c47ec16f2c259a11e6ee34e0074334e437774dde6ab74c4637bba07",
+  "@oxc-parser/binding-linux-x64-gnu@npm:0.132.0": "c4416d3014931b1831bf9cd11eaeafd44876a3dcf56f45c052a6d8f634b047f5851a0b822ac1621d1fe185a0109f2acefcd10507c51c2845c219cac08a16e185",
+  "@oxc-parser/binding-linux-x64-musl@npm:0.132.0": "4b45901795cf1eb2f53617e0619fca45b6efb52690ef1d77b3fcad07dbb25f854e7eb2c6317883ba6895521ec38828655ac9cf77fab2d2b27e4a59e7b14abcb5",
+  "@oxc-parser/binding-openharmony-arm64@npm:0.132.0": "46b3d666749e0e66e46810fcfbda37b65196fbedb31ffb9461bda2881f007a233f1c360d533d692f5789864ea99f842f1101edc4dd85e929cb64ef3a8f4c0684",
+  "@oxc-parser/binding-wasm32-wasi@npm:0.132.0": "63c0ca72ad2439c46212687caa3ca77f79312382d313c492b4f940edf71eecb14057325c4bfc78614f66579813add04aad8409ff32a684dcba7e32888d93d5e7",
+  "@oxc-parser/binding-win32-arm64-msvc@npm:0.132.0": "1c8db4cddad78adf0d5113047e7d85ca99ee6cf24db0b5cf143cc30461620e141cc42038928903c3d605e7dd449bb9a48030d15bfdcbccdd648c86e80f6316ce",
+  "@oxc-parser/binding-win32-ia32-msvc@npm:0.132.0": "38d5fe8cd2c5c0d2b3761fcc33062945e030951507b2d434ae060f9363686f267560ddad79e693d56cc9a784d74f5721eae019b18b283ae4f3651215a0a64aca",
+  "@oxc-parser/binding-win32-x64-msvc@npm:0.132.0": "3730b86c60ecc874a4c084cf7b020d7290996360bab49d669e2a931f999d53d9fecf9fda9b64fcfcaae34a08dbb41f6088ba10b03f1557f97dc8d91f67aa4074",
+  "@oxfmt/binding-android-arm-eabi@npm:0.55.0": "db8a91daa54aefc35d0df1514e1e62aa3e2c91e9de8aa8ed7405ca5c156265b99b07013b36739605283d4156a2aef76ef09d0958c4d81a3be54a0cbbfef4335d",
+  "@oxfmt/binding-android-arm64@npm:0.55.0": "8da5bc33f3e9a1ab77ff6e605b4f0a552caf0e1a25d01d0283751be241895aee803813a01b4f0afad0eefcec6617cbc22231907911d305f613f2af7ae0bc4b30",
+  "@oxfmt/binding-darwin-arm64@npm:0.55.0": "ecb275e4cecdab5a662b447f47e4543cfefa2a80fcca5866495059588e1b501ac9ca43d3dfedbc4c1c575c89bc28ceba861e6fbbd46b0a348e57a7a6e02267ab",
+  "@oxfmt/binding-darwin-x64@npm:0.55.0": "8f26b824c2e45346b3fdb2b3b9077a0a23248c30a0c658a4b7fdba96d241ff6dec9b5ae1cc194ccd237da6f0ff728cfd0c7a93536735d94f50ed6fbbeeeeb3a1",
+  "@oxfmt/binding-freebsd-x64@npm:0.55.0": "06893834ac0a8b260395124da57202a7064bd663b7cc573273e92695169f01c68250c4d6a6654e19ff59ae9cd47e56294da053a792a7433637174ade3db10430",
+  "@oxfmt/binding-linux-arm-gnueabihf@npm:0.55.0": "95b008c5eb6853a955ef3d12ed8def4be2527dd1b16bc27df739e6673f6eec4ffe5ce534bd5330b9211e85a6c12efa40c19d6676001dddf83aebc0c8edd28451",
+  "@oxfmt/binding-linux-arm-musleabihf@npm:0.55.0": "37ce178c61351907abafc8a7ca3502f884f9a01a07c89f0ab8b4fd7e585f7993beb391f7c334a59195b61c976fd3827896a8a6beb41302cde57f0d09991d1ee6",
+  "@oxfmt/binding-linux-arm64-gnu@npm:0.55.0": "bf70fd44e3b78e27dec4a9b8af1b5490131edee6e6a634a9eae5459dc57c23b05eb1b749777b640ea3f6a71841ad99e4528a5868ebe21afceea79e8dbf1c58a3",
+  "@oxfmt/binding-linux-arm64-musl@npm:0.55.0": "f86c290c3af1009cbf1961fd6069859a2611b3da7ce8ba445a30b981d561883f744b485be49b9aa9edb9b3da3e27cbf641ea55ecd8cb38e4693326e8b79a4aa8",
+  "@oxfmt/binding-linux-ppc64-gnu@npm:0.55.0": "dee16ab629f31db5f0158d2f444776373a8e27f8640b72e03286beb3b5ba250d1fcd0f10f2c3d14e81d2817fc48bf5a5ae67899ee372d76f9df62db997dff69a",
+  "@oxfmt/binding-linux-riscv64-gnu@npm:0.55.0": "2903deed7cd31924a98e40bf1ceec4607c95cfc5780264646b0e598fc26a1141febf2fdb154dfff9b49a7be7856bd4bd67a7c59a3f0e3e07903067e1d51373da",
+  "@oxfmt/binding-linux-riscv64-musl@npm:0.55.0": "5c64f07da7847c745872fe837e393222a1e8827f292dfffef4217e42cb8a0b41b81a0bede62173508528b3d8a0fb4dc4eedb319d9406c87d412589d4496a47da",
+  "@oxfmt/binding-linux-s390x-gnu@npm:0.55.0": "8e484ececcc25fbd5379c31f8599af97929e9a2baa46731e351b757df3b0df50cd7e04dd9a28317b2b148cb18c720409712f7b8c0f42b2fd5b18123e3c509369",
+  "@oxfmt/binding-linux-x64-gnu@npm:0.55.0": "4040e25bfa22475c2fefb47dafacaad9cb0c97845c0b541aa3730e4fcd83ef03da815d5116d04364cea111941670000423689b08b8dacb9fc3699d2cb55a2466",
+  "@oxfmt/binding-linux-x64-musl@npm:0.55.0": "85ea999af23c3b1e5ddf8f06aeb619895328475d1824eec599f6de408ef7ad9f917513329ed47e0867aa606b4718d451699a393a7f23f3c45950199a0bd20da5",
+  "@oxfmt/binding-openharmony-arm64@npm:0.55.0": "e23c4e65a7dfe5cae461972ac944e25a567b03a4e8ae04f19ffc79b6e97d222b4c52616cd66ae476f67e3837dfb53d8ff5e01ce96446875874a1a2f3a39004a2",
+  "@oxfmt/binding-win32-arm64-msvc@npm:0.55.0": "6b60e8f6d17b613fb4c0972562cc30fb52848f432d93053933e2b308a1ca6b278ef76512cb7f9fd6b1f91bd4d09f682fa30a84a04b6efeab18868b9d13c57f3d",
+  "@oxfmt/binding-win32-ia32-msvc@npm:0.55.0": "e62d050b0bd25ff69a0e05871748a0f1ecbab6422d316011dde1ee7282b3aa486b935b696c227f1974213cf694a2ddf990612d60397082be980e8baec4e91ef0",
+  "@oxfmt/binding-win32-x64-msvc@npm:0.55.0": "0253d8ba81515c47cb3f1e50a41f47b57c6bf8ec547f9c8a95195e109f9478beb37a69a304663499a610514c4f2f778f91be9b62a6bdb953e1b85a8430ceee9d",
+  "@oxlint-tsgolint/darwin-arm64@npm:0.23.0": "e17e81055c2182b06ec51766941d1ae6a0381b4a1e052b026d2f592e6da3880258ab19e064bd118dcc48f86b60a18c33b4c8abaced11370da3ee0c4ca00e3e5b",
+  "@oxlint-tsgolint/darwin-x64@npm:0.23.0": "37cc945adfc7b647880f76bc67d51eac57a99cac22a096338eaebd1e2f37b1553124f244bee52e7f8434820dfd909a2ea95c383091f6d3b5e79636c6cf09b660",
+  "@oxlint-tsgolint/linux-arm64@npm:0.23.0": "8e86218c4d947affa90b2fd148d75899f88fad013cafadfd7f3e7d780230f23af982502c4e3c28c418ac39b3ecb1e19bb9e00011176950c93ecc7a95b95df307",
+  "@oxlint-tsgolint/linux-x64@npm:0.23.0": "6bf6a5ff95c7bc92a6a6590db83f9b6dc595b60cc5237aa4262f7c9c5ee025b351a6b541bd01f7c9ef5d5e48e636d758e3e23242197a7d7181c42e99bb101879",
+  "@oxlint-tsgolint/win32-arm64@npm:0.23.0": "19d0e140073c7bb4b0df1845df03b33fde14889331c99978d4052aeae8ae288fbd1e968ab7ac163f39d0fef35ac026f27f049eabfa713f69a8bdad5416ff509e",
+  "@oxlint-tsgolint/win32-x64@npm:0.23.0": "c4cc0d3155382b81e6949297b993db383b37130dae254aaa450e72d5991b7d8ef9d34dde95e86f42297ad896c276eb2a5b1cd54da101dcec09153e99a8fa8e0f",
+  "@oxlint/binding-android-arm-eabi@npm:1.70.0": "576c756510ae4141c731669f45d89d4e66b80c40e094c492d5a96f6f6fe8e91af7010ff3760199a305cf788310692f832dc059ef38ccfbc74ebcfdb7afe6ab55",
+  "@oxlint/binding-android-arm64@npm:1.70.0": "85bbf851de0860fb18bb8c839ef50edfe95a2eae9e59a393055f1ece175e5b5324193c9be6c784e5d97ec300e7dcab4f83a29c7e50346b36efd7c16d8a901a19",
+  "@oxlint/binding-darwin-arm64@npm:1.70.0": "1b80940373898596c5fcfba65815581ea34ad916d41c97894f626abce094acac8555bf416e308b46ae81afdf42623618cb7463863a159c000ab130dd25bfdfd5",
+  "@oxlint/binding-darwin-x64@npm:1.70.0": "c84cdc76878cd085c2a2a963e5fac7d2e07fc7601e747404710e074a3766ac438438a047c48745ace76eb59f92cc8ab72036868af10068a549ed694301d55978",
+  "@oxlint/binding-freebsd-x64@npm:1.70.0": "9f76aa70ca71851978a9461f2d2bb3b009bde4a06f930b3f59e35a803c4718961cd7cc64b6d20996832529fe99f5d47a0c8a9fe5137ce18b7e9c879a0f721b0d",
+  "@oxlint/binding-linux-arm-gnueabihf@npm:1.70.0": "0755e542d531ff5a282714bfe6b207cd787f959952bd7cc3dca1567dbbe414cea6e50a99a1e83950b2e2ac4909c8191206cb7f592636dd332f0e69c90e2af641",
+  "@oxlint/binding-linux-arm-musleabihf@npm:1.70.0": "116fae450766a6d935c1ea72cab0ae34b07a0131bc81aa40741c506c682392d6f988fb4674aec9d27e43f3621df6d3a7c6621226d2884b26540db9cba289fa90",
+  "@oxlint/binding-linux-arm64-gnu@npm:1.70.0": "078d14a8c161453c885f85a96d8ca65875d2010decbd53dee97ed5b2e36df6a2bb4e49e5a8877ffafcdcae87442af560579be2bc504689d422b6bb6e1223ab04",
+  "@oxlint/binding-linux-arm64-musl@npm:1.70.0": "bf470dcc1fe242e2dba012a78cbd9aadda938e3864125df407457ae8a3d6372768b3107018ed935e994d567660d65b114f8125a29cb6aeaa28cd0c3c9be1ce8b",
+  "@oxlint/binding-linux-ppc64-gnu@npm:1.70.0": "c2c6e315722208d0a5b69b6914123879fb575d1a47114b86b6bc642978305302e4a442065eba68613870d262f37bce4d76f94f2e33ffbfa009cdacc7d911b3c3",
+  "@oxlint/binding-linux-riscv64-gnu@npm:1.70.0": "281cb6a85618c8d18416976627f5aad57efe9c6f9bc4a3f9846832616d38aff1811018575aa4e86446d54eb56bfa9a50f3fab50b79ed3fe342cff3e02894ec97",
+  "@oxlint/binding-linux-riscv64-musl@npm:1.70.0": "c583ba96d48900d3d62aaf9399fed3b1d4c0f6310883192c5dc1624baa6ab80428453eeb56452cbfd636359b853b5582895e7075d844235d79d3f8227a606910",
+  "@oxlint/binding-linux-s390x-gnu@npm:1.70.0": "a831b82844d8de4d9914c8a7083f65460309a00f2cd06e01b5b4b5709bca10261143c8742c5f332e76a477a9f49706d91ba03700f68ca973a689226509d1345a",
+  "@oxlint/binding-linux-x64-gnu@npm:1.70.0": "8aec65aa456257f37462083fa532b7fac14956320dc5e59d94b7fa2bf38783ffb30e0b1d01ed86f097bffc922f4e0ee7b5381aa17e3e31342c30191dc91944cb",
+  "@oxlint/binding-linux-x64-musl@npm:1.70.0": "cbfe64382cd29e256146e03aa7d424ba52d6cd097f413abf4e905b4eebe8b1a71aade73a09fe4afe7b1a43be3709161c0d0fede9042678eabf406dcffac9fd33",
+  "@oxlint/binding-openharmony-arm64@npm:1.70.0": "f0138fe9858816026bc50a84332a53d9c9c7121b621539a1d3de87eddadb2c5c8fb387ebbb4cc6676e99a9b16921db9d6138570d43c217d41c215751f1ac357b",
+  "@oxlint/binding-win32-arm64-msvc@npm:1.70.0": "338873a04a5c00ff76be3bcdc1991cfe65c35257f1703b984da009c6e0abf31d06a6b3b3943d76db4c1423116299d6f29a1c0485c4f528cc24b49b3ef1302103",
+  "@oxlint/binding-win32-ia32-msvc@npm:1.70.0": "3149d183b7f4d8c90348a24521d0a442d3673b55e4e0a6d2bc26e618e57a33f24cc76492156254d79acaf986803ebdec8d7f310db1547802a49c5e0a4a0fa593",
+  "@oxlint/binding-win32-x64-msvc@npm:1.70.0": "bc410bfd875fe7e677bed2c8c90a5380155543136130dbc363a72c796c84926e1e79cf072da040ba82c87f5d1ed616e71a17caebf876a76d880217d22760a698",
+  "@rolldown/binding-android-arm64@npm:1.0.3": "35e2b7f9e54c526cee5433351b0ef376dd1657d8a6eecf00512dec4720bb02594268bf8d3b661199917bdd286d4370bf3c3461b08eb74f0eae77bd13585e260a",
+  "@rolldown/binding-darwin-arm64@npm:1.0.3": "7e7d168d091053100a785c0240d6d6134039bf0fb7a658624fa33426b148e9b8131d1690729b32a7b1e65329879c15601b7afd576e149ca6feb6302c530ed860",
+  "@rolldown/binding-darwin-x64@npm:1.0.3": "0721c045d1446138e49dca250c8716c1b2eb4f1595bf1226a2c273befa063f91c4623e4cd5d338e969626e4281541b958c4a3d4649c0c553da0ec42292450a8d",
+  "@rolldown/binding-freebsd-x64@npm:1.0.3": "faa48a73ac1b1a4af8ed7b67932a59b62f139d76f21d1ccbe5efb5ab8a5a61e1f5de0b5d9367a9ecd8759bdab3aa1734aefd2214bbe2cfc4b0cb119f6e5391da",
+  "@rolldown/binding-linux-arm-gnueabihf@npm:1.0.3": "fab607d7639bf6d3393f6e0da0c9680e2d357b550abc50d7dc60cd45e25c788cddee38deac074d9c987e22532d83dcd8a76564710654663bd65622a190548c72",
+  "@rolldown/binding-linux-arm64-gnu@npm:1.0.3": "a067fc8d80a6af88893010abb55d697221afa8f9d3f468082bc759305f2decbf16f8655a5313e6e608d1b2f103d28922607290ab85d575b78930bc9daa777204",
+  "@rolldown/binding-linux-arm64-musl@npm:1.0.3": "b1264d8302780c991260991733cf156c1ed43fed66fce60e5a265577aced196b92907cfcbe8d3262621b8e08106f1f555743c601fe60676c08ffae0edd821128",
+  "@rolldown/binding-linux-ppc64-gnu@npm:1.0.3": "82f33061f5003b99bac68a0637bf7665f6fb2b22cfc025e4d7762afefe703af2acc1cd2df8ff07bb000b0eecd3e59959992481a5b03794604af090eaa843c70f",
+  "@rolldown/binding-linux-s390x-gnu@npm:1.0.3": "a6a3811352aa5db6a793879bf405bb98eaeca06cfd1aae959a9ed70db39b28e0a022ca50524cdd26d0447fa7b9c5ef913281cf543f816ac6e3ea6b6d620af88a",
+  "@rolldown/binding-linux-x64-gnu@npm:1.0.3": "13ece4e580f022a1a70031da2036448097bc38d040d1e87ee81cffd9e1ab8b64673e92843718470e3d07ea664171dc2c20d766cbafbb0ca8774e3c4f0b122c7d",
+  "@rolldown/binding-linux-x64-musl@npm:1.0.3": "6beeffe835e820679868021e01fb629fe124813911dd625bd3d24b1592450c06131b360e284396aca04798e6a85f988917ea00e95b3ea087a32a45441bad3235",
+  "@rolldown/binding-openharmony-arm64@npm:1.0.3": "f8e8352edde4d2345e3e360bb050915daf0d9ee4c491024a08e56088801994f2cbdf0152f81115a089c1870863e6384135765126114cf8481933bc15678e1dde",
+  "@rolldown/binding-wasm32-wasi@npm:1.0.3": "3f73081fc41cbd8c117183fecb0f491a71278472c0640b54e57a3a6705005f54d7997c610244d2ff651d5d688a20596ab1119e3dccf607f59fdea4ec0621da49",
+  "@rolldown/binding-win32-arm64-msvc@npm:1.0.3": "a29f05721b276acdeb7f00b43b9c6241f9c4cc60b820d6b9217d205cfd0ee66a82a29da501e60163c66ce7cc8cb6362f88933b466dea66e3219b38d15954873e",
+  "@rolldown/binding-win32-x64-msvc@npm:1.0.3": "d6afa484d89c9479561a0621709dfc9737584515f87e96fa74f7d153bbde74f81b6ba7aac92187189ffb4dd1795fa152c596a04ae9a41ffab7437babc5a15838",
  "@rollup/rollup-android-arm-eabi@npm:4.60.4": "713883389421bcaea56b37c79e624da343aeaa28812de226542407bb1e62c3593c24b0b94ee2fa74893963b124b1d6a6eac4b10bbd54c1736923dc67a953b3de",
  "@rollup/rollup-android-arm64@npm:4.60.4": "04117967684c227a7d764e13f85c66093619ff8a800a2004138a258cbfeb4748db8bc477496e0c9421c1cbb1ad5ca92e2665a143c6cdba33502aa59cd2c04ffe",
  "@rollup/rollup-darwin-arm64@npm:4.60.4": "3e7fe7279af3981c4e9b5cc4ca3099ff403545a1b63e2e66c2f5fae400fdd05c82ec430d087c0f444b59fb56a23a5ac3b802129d99c9e13be4a299aa8d2cf538",
--- a/pkgs/by-name/ou/outline/package.nix
+++ b/pkgs/by-name/ou/outline/package.nix
@@ -3,7 +3,6 @@
  lib,
  fetchFromGitHub,
  makeWrapper,
-  nix-update-script,
  nodejs,
  nixosTests,
  yarn-berry_4,
@@ -11,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "outline";
-  version = "1.8.1";
+  version = "1.9.1";

  src = fetchFromGitHub {
    owner = "outline";
    repo = "outline";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-jdG1sIJN1UiajsZ86+ztY3uXZgdS5MxjaPaKw/Glepo=";
+    hash = "sha256-F9JdeCuzmYeV2hxk0b1thQgo4cRl+aeUbBjK0MLzKH8=";
  };

  patches = [
@@ -36,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {

  offlineCache = yarn-berry_4.fetchYarnBerryDeps {
    inherit (finalAttrs) src missingHashes patches;
-    hash = "sha256-uSXw/x+4d22ow7QE3nduTUDNlZebCrnW6OIzhSugcXw=";
+    hash = "sha256-xj6IBvANRQr2C/R47KrsSacPXqwtrAGv4ZeidJ4T5Hc=";
  };

  buildPhase = ''
@@ -70,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
    tests = {
      basic-functionality = nixosTests.outline;
    };
-    updateScript = nix-update-script { };
+    updateScript = ./update.sh;
    # alias for nix-update to be able to find and update this attribute
    inherit (finalAttrs) offlineCache;
  };
@@ -78,7 +77,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    description = "Fastest wiki and knowledge base for growing teams. Beautiful, feature rich, and markdown compatible";
    homepage = "https://www.getoutline.com/";
-    changelog = "https://github.com/outline/outline/releases";
+    changelog = "https://github.com/outline/outline/releases/v${finalAttrs.version}";
    license = lib.licenses.bsl11;
    maintainers = with lib.maintainers; [
      cab404
--- a/pkgs/by-name/ou/outline/update.sh
+++ b/pkgs/by-name/ou/outline/update.sh
@@ -0,0 +1,41 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p common-updater-scripts coreutils curl git gnused jq nix-prefetch-github yarn-berry.yarn-berry-fetcher
+
+set -o errexit -o nounset -o pipefail
+
+package="outline"
+owner="outline"
+repo="outline"
+package_dir="pkgs/by-name/${package::2}/${package}"
+
+#
+# package
+#
+
+current_version=$(nix-instantiate --eval --expr "with import ./. {}; ${package}.version" --raw)
+echo "Current version: ${current_version}"
+
+latest_version=$(curl --silent "https://api.github.com/repos/${owner}/${repo}/releases" | jq '.[0].tag_name' --raw-output | sed 's/^v//')
+echo "Latest version: ${latest_version}"
+
+if [[ "${current_version}" == "${latest_version}" ]]; then
+  echo "${package} is up to date: ${current_version}"
+  exit 0
+fi
+
+echo "Updating ${package} from ${current_version} to ${latest_version}…"
+
+update-source-version "${package}" "${latest_version}"
+
+#
+# yarn deps
+#
+
+echo "Regenerating missing-hashes.json…"
+src_path=$(nix-build --attr "${package}.src" --no-link)
+yarn-berry-fetcher missing-hashes "${src_path}/yarn.lock" >"${package_dir}/missing-hashes.json"
+
+echo "Updating offline cache hash…"
+update-source-version "${package}" --ignore-same-version --source-key=offlineCache
+
+echo "Done."
--- a/pkgs/by-name/pr/prometheus-squid-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-squid-exporter/package.nix
@@ -20,6 +20,7 @@ buildGoModule (finalAttrs: {
  meta = {
    description = "Squid Prometheus exporter";
    homepage = "https://github.com/boynux/squid-exporter";
+    mainProgram = "squid-exporter";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ srhb ];
  };
--- a/pkgs/by-name/re/recoll-kio/package.nix
+++ b/pkgs/by-name/re/recoll-kio/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  stdenv,
+  cmake,
+  kdePackages,
+  recoll,
+  xapian,
+}:
+
+stdenv.mkDerivation {
+  pname = "recoll-kio";
+  version = recoll.version;
+
+  src = recoll.src;
+
+  strictDeps = true;
+  buildInputs = [
+    kdePackages.kio
+    recoll
+    xapian
+  ];
+
+  postPatch = ''
+    cp ./kde/kioslave/kio_recoll/CMakeLists-KF6.txt ./kde/kioslave/kio_recoll/CMakeLists.txt
+  '';
+
+  dontWrapQtApps = true;
+
+  nativeBuildInputs = [ cmake ];
+
+  cmakeDir = "../kde/kioslave/kio_recoll";
+
+  __structuredAttrs = true;
+  meta = {
+    homepage = recoll.meta.homepage;
+    description = "Plasma KIO worker for recoll";
+    license = recoll.meta.license;
+    maintainers = with lib.maintainers; [ numkem ];
+    platforms = lib.platforms.linux;
+  };
+}
--- a/pkgs/by-name/re/resterm/package.nix
+++ b/pkgs/by-name/re/resterm/package.nix
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "resterm";
-  version = "0.44.6";
+  version = "0.46.4";

  src = fetchFromGitHub {
    owner = "unkn0wn-root";
    repo = "resterm";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-J8lvI5h3K7Ny8jkoBBLJX4qCSHkByDGWKHxDkVjAzUI=";
+    hash = "sha256-Fpt/ZYdLC4OVA9Aj8NXJ76TY1ofxifXfjqD6irVV6cM=";
  };

-  vendorHash = "sha256-AjckKD6NScBa8w9nWMdVExuNadz3vHnK854XXg3nj84=";
+  vendorHash = "sha256-K6edyYLkVQwEZBAfRwgckUJI8dmo/ZxFRjEkExtyLxY=";

  # modernc.org/libc (via modernc.org/sqlite) tries to read /etc/protocols
  modPostBuild = ''
--- a/pkgs/by-name/rp/rpcs3/package.nix
+++ b/pkgs/by-name/rp/rpcs3/package.nix
@@ -117,9 +117,7 @@ stdenv.mkDerivation (finalAttrs: {
    qtbase
    qtmultimedia
    openal
-    # RPCS3's X11 swap-interval path uses GLEW's GLXEW symbols, which
-    # are not provided in the default EGL-enabled GLEW build.
-    (glew.override { enableEGL = false; })
+    glew
    vulkan-headers
    vulkan-loader
    libpng
--- a/pkgs/by-name/se/sequoia-sq/package.nix
+++ b/pkgs/by-name/se/sequoia-sq/package.nix
@@ -10,20 +10,24 @@
  openssl,
  cacert,
  sqlite,
+  versionCheckHook,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "sequoia-sq";
-  version = "1.3.1";
+  version = "1.4.0";

  src = fetchFromGitLab {
    owner = "sequoia-pgp";
    repo = "sequoia-sq";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-lM+j1KtH3U/lbPXnKALAP75YokDufbdz8s8bjb0VXUY=";
+    hash = "sha256-+6QVRp0zDJIIv23YlAI/cspHuGc+YcWdPfJZIOxQRW8=";
  };

-  cargoHash = "sha256-3z1Qm/eeVlH0/x3C8PSSPIlQaRKk1U6mRlEiKk0AaVQ=";
+  cargoHash = "sha256-I6hPpRpILV+iU9erfVBQOXuICx4IvWvGyHWdep7jRm4=";
+
+  strictDeps = true;
+  __structuredAttrs = true;

  nativeBuildInputs = [
    pkg-config
@@ -45,17 +49,23 @@ rustPlatform.buildRustPackage (finalAttrs: {
    export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
  '';

-  env.ASSET_OUT_DIR = "/tmp/";
+  env.ASSET_OUT_DIR = "target";
+
+  # key store daemon binds a loopback socket
+  __darwinAllowLocalNetworking = true;

  doCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+  versionCheckProgramArg = "version";

  postInstall = ''
-    installManPage /tmp/man-pages/*.*
+    installManPage ${finalAttrs.env.ASSET_OUT_DIR}/man-pages/*.*
    installShellCompletion \
      --cmd sq \
-      --bash /tmp/shell-completions/sq.bash \
-      --fish /tmp/shell-completions/sq.fish \
-      --zsh /tmp/shell-completions/_sq
+      --bash ${finalAttrs.env.ASSET_OUT_DIR}/shell-completions/sq.bash \
+      --fish ${finalAttrs.env.ASSET_OUT_DIR}/shell-completions/sq.fish \
+      --zsh ${finalAttrs.env.ASSET_OUT_DIR}/shell-completions/_sq
  '';

  passthru.updateScript = nix-update-script { };
@@ -69,6 +79,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      minijackson
      doronbehar
      dvn0
+      anish
    ];
    mainProgram = "sq";
  };
--- a/pkgs/by-name/ss/sshified/package.nix
+++ b/pkgs/by-name/ss/sshified/package.nix
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "sshified";
-  version = "1.2.6";
+  version = "1.2.7";

  src = fetchFromGitHub {
    owner = "hoffie";
    repo = "sshified";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-YY9ZFIH4ST9xQRD7IkjC9rm+QTlfde5+2qR/reH9oHU=";
+    hash = "sha256-yeG0LqgRknAnN4rLV/659YJpxk3hBxDKX1BIioJ9P2M=";
  };

  vendorHash = null;
--- a/pkgs/by-name/sy/syncthing/package.nix
+++ b/pkgs/by-name/sy/syncthing/package.nix
@@ -119,6 +119,7 @@ buildGoModule (finalAttrs: {
    license = lib.licenses.mpl20;
    maintainers = with lib.maintainers; [
      joko
+      noahbiewesch
      peterhoeg
      zainkergaye
    ];
--- a/pkgs/by-name/te/termsvg/package.nix
+++ b/pkgs/by-name/te/termsvg/package.nix
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "termsvg";
-  version = "0.10.0";
+  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "MrMarble";
    repo = "termsvg";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-tNvr8ptMortP7iI6GwT4AGbqTvNFposca8I2JribGnk=";
+    hash = "sha256-wV5b0HXf+DVSn5FbPU9/AXTaNKyenbxEGB9yI29e/cc=";
  };

-  vendorHash = "sha256-BoXRLWhQmfvMIN658MiXGCFMbnvuXfv/H/jCE6h4aWk=";
+  vendorHash = "sha256-6cXckWJFc/nYlz0HeLHXaXWNFR7HLEfU10gd2K2zgq0=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/to/toolhive/package.nix
+++ b/pkgs/by-name/to/toolhive/package.nix
@@ -9,16 +9,16 @@

 buildGoModule (finalAttrs: {
  pname = "toolhive";
-  version = "0.29.1";
+  version = "0.34.0";

  src = fetchFromGitHub {
    owner = "stacklok";
    repo = "toolhive";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-gep1QAHl7de67xS+T42/LHH4fdy670OGguwp41jgAjE=";
+    hash = "sha256-GMzCXAottmusxLeZDScn1dUX/b46ocBbemFIzRIi1Eo=";
  };

-  vendorHash = "sha256-ooPLPnGqyqi8e+zzu2MVjS+v7LgTfvdXbbuUp1asRNQ=";
+  vendorHash = "sha256-CTQkjxEZCyE2ouuilCSTEaxW4TimHf+5I5cnfQFz2i4=";

  # Build only the main CLI and operator binaries
  subPackages = [
--- a/pkgs/by-name/wh/whitesur-gtk-theme/package.nix
+++ b/pkgs/by-name/wh/whitesur-gtk-theme/package.nix
@@ -94,13 +94,13 @@ lib.checkListOfEnum "${pname}: window control buttons variants" [ "normal" "alt"
  stdenv.mkDerivation
  rec {
    pname = "whitesur-gtk-theme";
-    version = "2025-07-24";
+    version = "2026-07-07";

    src = fetchFromGitHub {
      owner = "vinceliuice";
      repo = "whitesur-gtk-theme";
      rev = version;
-      hash = "sha256-tuon9XxMdrz9XNTp50sbss2gtx6H9hEZh8t2jSoqx28=";
+      hash = "sha256-Um+OAg8fz5d/IXNHF6R6ECDealZKzgyBRODuyinujNc=";
    };

    nativeBuildInputs = [
--- a/pkgs/by-name/ze/zenroom/package.nix
+++ b/pkgs/by-name/ze/zenroom/package.nix
@@ -0,0 +1,109 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  nix-update-script,
+
+  # build-time
+  cmake,
+  xxd,
+  which,
+
+  # run-time
+  readline,
+
+  # tests
+  callPackage,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "zenroom";
+  version = "5.37.2";
+
+  __structuredAttrs = true;
+  dontUseCmakeConfigure = true; # cmake is a dependency, but we use make to build
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "dyne";
+    repo = "Zenroom";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-gNUclaXF7C2yBywo1TAwHOfB9Pe17g6fCLhEcFq8JL0=";
+    postFetch = ''
+      # conflict on case-insensitive filesystems
+      pushd $out/docs/examples/zencode_cookbook/cookbook_when
+      rm *_move_as.out.json *_move_to.out.json
+      popd
+    '';
+  };
+
+  postPatch = ''
+    patchShebangs build/embed-lualibs
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    which # ar
+    xxd
+  ];
+
+  buildInputs = [
+    readline
+  ];
+
+  buildFlags =
+    with stdenv.hostPlatform;
+    lib.optionals (isLinux && !isMusl) [
+      "linux-lib"
+      "linux-exe"
+    ]
+    ++ lib.optionals (isLinux && isMusl) [
+      "musl"
+    ]
+    ++ lib.optionals isDarwin [
+      "osx-lib"
+      "osx-exe"
+    ]
+    ++ lib.optionals (isUnix && !isLinux && !isDarwin) [
+      "posix-lib"
+      "posix-exe"
+    ];
+
+  hardeningDisable = [ "format" ]; # -Werror=format-security
+
+  env.PREFIX = "";
+  env.DESTDIR = placeholder "out";
+
+  preInstall = ''
+    mkdir -p $out/{bin,share}
+  '';
+
+  postInstall = ''
+    install -D libzenroom${stdenv.hostPlatform.extensions.sharedLibrary} -t $out/lib
+  '';
+
+  passthru.updateScript = nix-update-script { };
+  passthru.tests = callPackage ./tests { zenroom = finalAttrs.finalPackage; };
+
+  meta = {
+    description = "no-code cryptographic virtual machine";
+    longDescription = ''
+      Zenroom is a tiny, portable, and fully isolated crypto VM for building
+      privacy-preserving applications, smart contracts, and secure data
+      workflows.
+    '';
+    homepage = "https://github.com/dyne/Zenroom";
+    changelog = "https://github.com/dyne/Zenroom/blob/${finalAttrs.src.rev}/ChangeLog.md";
+    mainProgram = "zenroom";
+    platforms = lib.platforms.unix;
+    license = with lib.licenses; [
+      agpl3Plus
+      asl20 # lib/milagro-crypto-c, lib/mlkem, lib/longfellow-zk, lib/mayo
+      bsd3 # lib/zstd
+      cc0 # lib/pqclean, lib/ed25519-donna
+      mit # lib/lua54, src/varint.*, lib/mayo
+    ];
+    maintainers = with lib.maintainers; [ eljamm ];
+    teams = with lib.teams; [ ngi ];
+  };
+})
--- a/pkgs/by-name/ze/zenroom/tests/arrayGenerator.zen
+++ b/pkgs/by-name/ze/zenroom/tests/arrayGenerator.zen
@@ -0,0 +1,3 @@
+Given nothing
+When I create the random array with '16' elements each of '32' bits
+Then print all data
--- a/pkgs/by-name/ze/zenroom/tests/arrayGenerator2.zen
+++ b/pkgs/by-name/ze/zenroom/tests/arrayGenerator2.zen
@@ -0,0 +1,8 @@
+Given nothing
+When I create the random array with '2' elements each of '8' bits
+And I rename the 'random array' to 'myTinyArray'
+And I create the random array with '4' elements each of '32' bits
+And I rename the 'random array' to 'myAverageArray'
+And I create the random array with '8' elements each of '128' bits
+And I rename the 'random array' to 'myBigFatArray'
+Then print all data
--- a/pkgs/by-name/ze/zenroom/tests/default.nix
+++ b/pkgs/by-name/ze/zenroom/tests/default.nix
@@ -0,0 +1,18 @@
+{
+  runCommand,
+  zenroom,
+}:
+runCommand "basic-tests"
+  {
+    nativeBuildInputs = [ zenroom ];
+  }
+  ''
+    mkdir -p $out
+
+    TEST_DIR="${./.}"
+
+    for test in "$TEST_DIR"/*.zen; do
+      TEST_NAME="$(basename $test .zen)"
+      zenroom -z $test > "$out/$TEST_NAME".json
+    done
+  ''
--- a/pkgs/by-name/zs/zsign/package.nix
+++ b/pkgs/by-name/zs/zsign/package.nix
@@ -12,13 +12,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "zsign";
-  version = "1.0.4";
+  version = "1.0.8";

  src = fetchFromGitHub {
    owner = "zhlynn";
    repo = "zsign";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-NuwV8s+rzsXBha/vqnemvUo6Etm70ZVYL/CZKBJ1szA=";
+    hash = "sha256-zyywaE87HcGZ5QV6tFsCn9j+mAD1/ENVxZ22E/ItlSA=";
  };

  sourceRoot = "${finalAttrs.src.name}/build/${platformName}";
--- a/pkgs/development/compilers/ecl/default.nix
+++ b/pkgs/development/compilers/ecl/default.nix
@@ -18,6 +18,7 @@
  useBoehmgc ? false,
  boehmgc,
  sbcl,
+  fixDarwinDylibNames,
 }:

 let
@@ -38,7 +39,11 @@ stdenv.mkDerivation rec {
    automake
    texinfo
    makeWrapper
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    fixDarwinDylibNames
  ];
+
  propagatedBuildInputs = [
    libffi
    gmp
--- a/pkgs/development/coq-modules/smtcoq/default.nix
+++ b/pkgs/development/coq-modules/smtcoq/default.nix
@@ -6,6 +6,7 @@
  zchaff,
  cvc5,
  stdlib,
+  trakt,
  version ? null,
 }:

@@ -21,81 +22,72 @@
 #   };
 # in

-mkCoqDerivation {
-  pname = "smtcoq";
-  owner = "smtcoq";
+let
+  derivation = mkCoqDerivation {
+    pname = "smtcoq";
+    owner = "smtcoq";
+    opam-name = "rocq-smtcoq";

-  release."SMTCoq-2.2+8.19".hash = "sha256-9Wv8AXRRyOHG/cjA/V9tSK55R/bofDMLTkDpuwYWkks=";
-  release."SMTCoq-2.2+8.18".hash = "sha256-1iJAruI5Qn9nTZcUDjk8t/1Q+eFkYLOe9Ee0DmK03w8=";
-  release."SMTCoq-2.2+8.17".hash = "sha256-kaodsyVUl1+QQagzoBTIjxbdD4X3IaaH0x2AsVUL+Z0=";
-  release."SMTCoq-2.2+8.16".hash = "sha256-Hwm8IFlw97YiOY6H63HyJlwIXvQHr9lqc1+PgTnBtkw=";
-  release."SMTCoq-2.2+8.15".hash = "sha256-+GYOasJ32KJyOfqJlTtFmsJ2exd6gdueKwHdeMPErTo=";
-  release."SMTCoq-2.2+8.14".hash = "sha256-jqnF33E/4CqR1HSrLmUmLVCKslw9h3bbWi4YFmFYrhY=";
-  release."SMTCoq-2.2+8.13".hash = "sha256-AVpKU/SLaLYnCnx6GOEPGJjwbRrp28Fs5O50kJqdclI=";
-  release."SMTCoq-2.1+8.16".rev = "4996c00b455bfe98400e96c954839ceea93efdf7";
-  release."SMTCoq-2.1+8.16".hash = "sha256-k53e+frUjwq+ZZKbbOKd/EfVC40QeAzB2nCsGkCKnHA=";
-  release."SMTCoq-2.1+8.14".rev = "e11d9b424b0113f32265bcef0ddc962361da4dae";
-  release."SMTCoq-2.1+8.14".hash = "sha256-4a01/CRHUon2OfpagAnMaEVkBFipPX3MCVmSFS1Bnt4=";
-  release."SMTCoq-2.1+8.13".rev = "d02269c43739f4559d83873563ca00daad9faaf1";
-  release."SMTCoq-2.1+8.13".hash = "sha256-VZetGghdr5uJWDwZWSlhYScoNEoRHIbwqwJKSQyfKKg=";
+    release."SMTCoq-2.3+8.20".hash = "sha256-ScWtdwSpFBf/PryPuvI/SkhgqWyYhcX3FCOqoXNho7Q=";
+    release."SMTCoq-2.2+8.19".hash = "sha256-9Wv8AXRRyOHG/cjA/V9tSK55R/bofDMLTkDpuwYWkks=";
+    release."SMTCoq-2.2+8.18".hash = "sha256-1iJAruI5Qn9nTZcUDjk8t/1Q+eFkYLOe9Ee0DmK03w8=";
+    release."SMTCoq-2.2+8.17".hash = "sha256-kaodsyVUl1+QQagzoBTIjxbdD4X3IaaH0x2AsVUL+Z0=";
+    release."SMTCoq-2.2+8.16".hash = "sha256-Hwm8IFlw97YiOY6H63HyJlwIXvQHr9lqc1+PgTnBtkw=";
+    release."SMTCoq-2.2+8.15".hash = "sha256-+GYOasJ32KJyOfqJlTtFmsJ2exd6gdueKwHdeMPErTo=";
+    release."SMTCoq-2.2+8.14".hash = "sha256-jqnF33E/4CqR1HSrLmUmLVCKslw9h3bbWi4YFmFYrhY=";
+    release."SMTCoq-2.2+8.13".hash = "sha256-AVpKU/SLaLYnCnx6GOEPGJjwbRrp28Fs5O50kJqdclI=";
+    release."SMTCoq-2.1+8.16".rev = "4996c00b455bfe98400e96c954839ceea93efdf7";
+    release."SMTCoq-2.1+8.16".hash = "sha256-k53e+frUjwq+ZZKbbOKd/EfVC40QeAzB2nCsGkCKnHA=";
+    release."SMTCoq-2.1+8.14".rev = "e11d9b424b0113f32265bcef0ddc962361da4dae";
+    release."SMTCoq-2.1+8.14".hash = "sha256-4a01/CRHUon2OfpagAnMaEVkBFipPX3MCVmSFS1Bnt4=";
+    release."SMTCoq-2.1+8.13".rev = "d02269c43739f4559d83873563ca00daad9faaf1";
+    release."SMTCoq-2.1+8.13".hash = "sha256-VZetGghdr5uJWDwZWSlhYScoNEoRHIbwqwJKSQyfKKg=";

-  releaseRev = v: v;
+    releaseRev = v: v;

-  inherit version;
-  defaultVersion =
-    with lib.versions;
-    lib.switch coq.version [
-      {
-        case = isEq "8.19";
-        out = "SMTCoq-2.2+8.19";
-      }
-      {
-        case = isEq "8.18";
-        out = "SMTCoq-2.2+8.18";
-      }
-      {
-        case = isEq "8.17";
-        out = "SMTCoq-2.2+8.17";
-      }
-      {
-        case = isEq "8.16";
-        out = "SMTCoq-2.2+8.16";
-      }
-      {
-        case = isEq "8.15";
-        out = "SMTCoq-2.2+8.15";
-      }
-      {
-        case = isEq "8.14";
-        out = "SMTCoq-2.2+8.14";
-      }
-      {
-        case = isEq "8.13";
-        out = "SMTCoq-2.2+8.13";
-      }
-    ] null;
+    inherit version;
+    defaultVersion =
+      let
+        case = case: out: { inherit case out; };
+      in
+      with lib.versions;
+      lib.switch coq.coq-version [
+        (case (isEq "8.20") "SMTCoq-2.3+${coq.coq-version}")
+        (case (range "8.13" "8.19") "SMTCoq-2.2+${coq.coq-version}")
+      ] null;

-  propagatedBuildInputs = [
-    cvc5
-    # veriT'  # c.f. comment above
-    zchaff
-    stdlib
-  ]
-  ++ (with coq.ocamlPackages; [
-    findlib
-    num
-    zarith
-  ]);
-  mlPlugin = true;
-  nativeBuildInputs = (with pkgs; [ gnumake42 ]) ++ (with coq.ocamlPackages; [ ocamlbuild ]);
+    propagatedBuildInputs = [
+      cvc5
+      # veriT'  # c.f. comment above
+      zchaff
+      stdlib
+    ]
+    ++ (with coq.ocamlPackages; [
+      findlib
+      num
+      zarith
+    ]);
+    useDuneifVersion = v: v != null && (v == "dev" || lib.versions.isGt "SMTCoq-2.3+8.20" v);
+    mlPlugin = true;
+    nativeBuildInputs = (with pkgs; [ gnumake42 ]) ++ (with coq.ocamlPackages; [ ocamlbuild ]);

-  # This is meant to ease future troubleshooting of cvc5 build failures
-  passthru = { inherit cvc5; };
+    # This is meant to ease future troubleshooting of cvc5 build failures
+    passthru = { inherit cvc5; };

-  meta = {
-    description = "Communication between Coq and SAT/SMT solvers";
-    maintainers = with lib.maintainers; [ siraben ];
-    license = lib.licenses.cecill-b;
-    platforms = lib.platforms.unix;
+    meta = {
+      description = "Communication between Coq and SAT/SMT solvers";
+      maintainers = with lib.maintainers; [ siraben ];
+      license = lib.licenses.cecill-b;
+      platforms = lib.platforms.unix;
+    };
  };
-}
+  patched-derivation1 = derivation.overrideAttrs (
+    o:
+    lib.optionalAttrs
+      (o.version != null && (o.version == "dev" || lib.versions.isGt "SMTCoq-2.3+8.20" o.version))
+      {
+        propagatedBuildInputs = o.propagatedBuildInputs ++ [ trakt ];
+      }
+  );
+in
+patched-derivation1
--- a/pkgs/development/lua-modules/json/default.nix
+++ b/pkgs/development/lua-modules/json/default.nix
@@ -0,0 +1,34 @@
+{
+  buildLuaPackage,
+  fetchFromGitHub,
+  lib,
+  lua,
+}:
+
+buildLuaPackage rec {
+  pname = "json";
+  version = "0.1.2";
+  src = fetchFromGitHub {
+    owner = "rxi";
+    repo = "json.lua";
+    rev = "v${version}";
+    hash = "sha256-JSKMxF5NSHW3QaELFPWm1sx7kHmOXEPsUkM3i/px7Gk=";
+  };
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/share/lua/${lua.luaversion}
+    cp -r json.lua $out/share/lua/${lua.luaversion}
+
+    runHook postInstall
+  '';
+
+  meta = {
+    homepage = "https://github.com/rxi/json.lua";
+    description = "A lightweight JSON library for Lua";
+    license = lib.licenses.mit;
+  };
+}
--- a/pkgs/development/ocaml-modules/ocsigen-start/default.nix
+++ b/pkgs/development/ocaml-modules/ocsigen-start/default.nix
@@ -12,6 +12,7 @@
  eliom,
  resource-pooling,
  ocsigen-ppx-rpc,
+  js_of_ocaml-ppx_deriving_json,
 }:

 stdenv.mkDerivation {
@@ -23,7 +24,10 @@ stdenv.mkDerivation {
    findlib
    eliom
  ];
-  buildInputs = [ ocsigen-ppx-rpc ];
+  buildInputs = [
+    ocsigen-ppx-rpc
+    js_of_ocaml-ppx_deriving_json
+  ];
  propagatedBuildInputs = [
    pgocaml_ppx
    safepass
--- a/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix
+++ b/pkgs/development/ocaml-modules/ocsigen-toolkit/default.nix
@@ -1,57 +1,41 @@
 {
-  stdenv,
  lib,
+  buildDunePackage,
  fetchFromGitHub,
-  ocaml,
-  findlib,
-  opaline,
  calendar,
+  cmdliner,
  eliom,
  js_of_ocaml-ppx_deriving_json,
+  ocsigen-ppx-rpc,
 }:

-stdenv.mkDerivation rec {
+buildDunePackage (finalAttrs: {
  pname = "ocsigen-toolkit";
-  name = "ocaml${ocaml.version}-${pname}-${version}";
-  version = "4.2.0";
-
-  propagatedBuildInputs = [
-    calendar
-    js_of_ocaml-ppx_deriving_json
-    eliom
-  ];
-  nativeBuildInputs = [
-    ocaml
-    findlib
-    opaline
-    eliom
-  ];
-
-  strictDeps = true;
-
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $OCAMLFIND_DESTDIR
-    export OCAMLPATH=$out/lib/ocaml/${ocaml.version}/site-lib/:$OCAMLPATH
-    make install
-    opaline -prefix $out
-    runHook postInstall
-  '';
+  version = "4.3.0";

  src = fetchFromGitHub {
    owner = "ocsigen";
    repo = "ocsigen-toolkit";
-    tag = version;
-    hash = "sha256-wken+5hUewE0Nktl2PY1xMmVveSs8X0ihWD+MK4pzRQ=";
+    tag = finalAttrs.version;
+    hash = "sha256-q6e8pacQ/F2vJeI4IqgyWI68J8qKq1vk3yRpI09BjLU=";
  };

+  buildInputs = [
+    cmdliner
+    js_of_ocaml-ppx_deriving_json
+    ocsigen-ppx-rpc
+  ];
+
+  propagatedBuildInputs = [
+    calendar
+    eliom
+  ];
+
  meta = {
    homepage = "http://ocsigen.org/ocsigen-toolkit/";
    description = "User interface widgets for Ocsigen applications";
    license = lib.licenses.lgpl21;
    maintainers = [ lib.maintainers.gal_bolle ];
-    inherit (ocaml.meta) platforms;
-    broken = true;
  };

-}
+})
--- a/pkgs/development/python-modules/datalab-platform/default.nix
+++ b/pkgs/development/python-modules/datalab-platform/default.nix
@@ -1,5 +1,6 @@
 {
  lib,
+  stdenv,
  buildPythonPackage,
  fetchFromGitHub,

@@ -72,6 +73,9 @@ buildPythonPackage (finalAttrs: {

  buildInputs = [
    qt5.qtbase
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    qt5.qtwayland
  ];

  build-system = [
@@ -136,6 +140,7 @@ buildPythonPackage (finalAttrs: {

  pythonRelaxDeps = [
    "guidata"
+    "numpy"
    "plotpy"
    "scipy"
  ];
--- a/pkgs/development/python-modules/derivative/default.nix
+++ b/pkgs/development/python-modules/derivative/default.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  fetchFromGitHub,
+  buildPythonPackage,
+
+  # build-system
+  poetry-core,
+
+  # dependencies
+  numpy,
+  scipy,
+  scikit-learn,
+  spectral-derivatives,
+  importlib-metadata,
+
+  # tests
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "derivative";
+  version = "0.6.3";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "andgoldschmidt";
+    repo = "derivative";
+    tag = "v${version}";
+    hash = "sha256-vsN1zlD9x0CEOtRIwr/DrtkV+OjiyrI8QL9Z8pB3wrY=";
+  };
+
+  build-system = [ poetry-core ];
+
+  dependencies = [
+    numpy
+    scipy
+    scikit-learn
+    spectral-derivatives
+    importlib-metadata
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  meta = {
+    description = "Numerical differentiation of noisy time series data";
+    license = lib.licenses.mit;
+    homepage = "https://derivative.readthedocs.io/en/latest/";
+    maintainers = with lib.maintainers; [ conny ];
+  };
+}
--- a/pkgs/development/python-modules/liger-kernel/default.nix
+++ b/pkgs/development/python-modules/liger-kernel/default.nix
@@ -0,0 +1,45 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  setuptools-scm,
+  torch,
+  triton,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "liger-kernel";
+  version = "0.8.0";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "linkedin";
+    repo = "liger-kernel";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-MAJ0goMxi8qA+ODd/kLIO7hp4dmNIOPLpSdkrm7hnnQ=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = [
+    torch
+    triton
+  ];
+
+  # Requires NVIDIA driver.
+  doCheck = false;
+
+  pythonImportsCheck = [ "liger_kernel" ];
+
+  meta = {
+    description = "Efficient Triton Kernels for LLM Training";
+    homepage = "https://github.com/linkedin/liger-kernel";
+    changelog = "https://github.com/linkedin/liger-kernel/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ jherland ];
+  };
+})
--- a/pkgs/development/python-modules/pysindy/default.nix
+++ b/pkgs/development/python-modules/pysindy/default.nix
@@ -0,0 +1,52 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+
+  # build-system
+  setuptools,
+  setuptools-scm,
+
+  # dependencies
+  scikit-learn,
+  numpy,
+  derivative,
+  scipy,
+  typing-extensions,
+}:
+
+buildPythonPackage rec {
+  pname = "pysindy";
+  version = "2.1.0";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit pname version;
+    sha256 = "sha256-NpZZ22MucuZwtkz9ef08C578jjo28MNfTxG4ROhjuwg=";
+  };
+
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = [
+    scikit-learn
+    numpy
+    derivative
+    scipy
+    typing-extensions
+  ];
+
+  # Tests require optional dependencies like jax
+  doCheck = false;
+
+  pythonImportsCheck = [ "pysindy" ];
+
+  meta = {
+    description = "Sparse identification of nonlinear dynamical systems";
+    license = lib.licenses.mit;
+    homepage = "https://pysindy.readthedocs.io/en/latest/";
+    maintainers = with lib.maintainers; [ conny ];
+  };
+}
--- a/pkgs/development/python-modules/sigima/default.nix
+++ b/pkgs/development/python-modules/sigima/default.nix
@@ -119,6 +119,7 @@ buildPythonPackage (finalAttrs: {
  ];

  pythonRelaxDeps = [
+    "numpy"
    "scipy"
  ];

--- a/pkgs/development/python-modules/snuggs/default.nix
+++ b/pkgs/development/python-modules/snuggs/default.nix
@@ -2,38 +2,29 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
-  fetchpatch,
-  click,
  numpy,
+  setuptools,
  pyparsing,
  pytestCheckHook,
  hypothesis,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "snuggs";
  version = "1.4.7";
-  format = "setuptools";
+  pyproject = true;

  # Pypi doesn't ship the tests, so we fetch directly from GitHub
  src = fetchFromGitHub {
    owner = "mapbox";
    repo = "snuggs";
-    rev = version;
-    sha256 = "1p3lh9s2ylsnrzbs931y2vn7mp2y2xskgqmh767c9l1a33shfgwf";
+    tag = finalAttrs.version;
+    hash = "sha256-jj8H9Rgq0MSOObDiN3UXXtx67BY+jKTXz1ZTL3SCdNw=";
  };

-  patches = [
-    # Use non-strict xfail for failing tests
-    # https://github.com/mapbox/snuggs/pull/28
-    (fetchpatch {
-      url = "https://github.com/sebastic/snuggs/commit/3b8e04a35ed33a7dd89f0194542b22c7bde867f4.patch";
-      hash = "sha256-SfW4l4BH94rPdskRVHEsZM0twmlV9IPftRU/BBZsjBU=";
-    })
-  ];
+  build-system = [ setuptools ];

-  propagatedBuildInputs = [
-    click
+  dependencies = [
    numpy
    pyparsing
  ];
@@ -49,4 +40,4 @@ buildPythonPackage rec {
    homepage = "https://github.com/mapbox/snuggs";
    maintainers = [ ];
  };
-}
+})
--- a/pkgs/development/python-modules/spectral-derivatives/default.nix
+++ b/pkgs/development/python-modules/spectral-derivatives/default.nix
@@ -0,0 +1,48 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  numpy,
+  scipy,
+  matplotlib,
+
+  # tests
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "spectral_derivatives";
+  version = "0.10";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "pavelkomarov";
+    repo = "spectral-derivatives";
+    tag = "v${version}";
+    hash = "sha256-KSx3aW2DgVr1nhtGqIO85s6c5p+1rjnrpMY4e63LLiE=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    numpy
+    scipy
+    matplotlib
+  ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "specderiv" ];
+
+  meta = {
+    description = "Derivatives by spectral methods";
+    license = lib.licenses.bsd3;
+    homepage = "https://pavelkomarov.com/spectral-derivatives/specderiv.html";
+    maintainers = with lib.maintainers; [ conny ];
+  };
+}
--- a/pkgs/development/python-modules/swi-tools/default.nix
+++ b/pkgs/development/python-modules/swi-tools/default.nix
@@ -0,0 +1,71 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  pytestCheckHook,
+  versionCheckHook,
+  hatchling,
+  cryptography,
+  jsonschema,
+  pyparsing,
+  pyyaml,
+  typer,
+  zip,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "swi-tools";
+  version = "1.6";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "aristanetworks";
+    repo = "swi-tools";
+    # master branch is at 1.6, they don't have a v1.6 branch/tag
+    rev = "6db86f5983426d272e541a61e0add79b3fec5b1e";
+    hash = "sha256-enWxDrTFWxJCwHF8NjH2UvZ/cxJnldF5nxm+Xzmu4xY=";
+  };
+
+  build-system = [
+    hatchling
+  ];
+
+  dependencies = [
+    cryptography
+    jsonschema
+    pyparsing
+    pyyaml
+    typer
+    zip
+  ];
+
+  # verify.py uses importlib.resources.files(__name__) but __name__ is
+  # "switools.verify" (a module, not a package).  The cert lives in the
+  # "switools" package directory, so we need to reference that instead.
+  postPatch = ''
+    substituteInPlace src/switools/verify.py \
+      --replace-fail 'import importlib' 'import importlib, importlib.resources' \
+      --replace-fail 'importlib.resources.files(__name__)' 'importlib.resources.files("switools")'
+  '';
+
+  # Importing verify triggers the importlib.resources cert load,
+  # so this catches the exact bug we patched above.
+  pythonImportsCheck = [
+    "switools"
+    "switools.verify"
+  ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    zip
+    versionCheckHook
+  ];
+
+  meta = {
+    description = "Scripts for operating on an Arista SWI or SWIX";
+    homepage = "https://github.com/aristanetworks/swi-tools";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ jherland ];
+    mainProgram = "swi-tools";
+  };
+})
--- a/pkgs/development/rocq-modules/mathcomp-analysis/default.nix
+++ b/pkgs/development/rocq-modules/mathcomp-analysis/default.nix
@@ -85,7 +85,7 @@ let
          ;

        namePrefix = [
-          "rocq-core"
+          "rocq"
          "mathcomp"
        ];

--- a/pkgs/development/rocq-modules/mathcomp-bigenough/default.nix
+++ b/pkgs/development/rocq-modules/mathcomp-bigenough/default.nix
@@ -9,7 +9,7 @@
 mkRocqDerivation {

  namePrefix = [
-    "rocq-core"
+    "rocq"
    "mathcomp"
  ];
  pname = "bigenough";
--- a/pkgs/development/rocq-modules/mathcomp-finmap/default.nix
+++ b/pkgs/development/rocq-modules/mathcomp-finmap/default.nix
@@ -9,7 +9,7 @@
 mkRocqDerivation {

  namePrefix = [
-    "rocq-core"
+    "rocq"
    "mathcomp"
  ];
  pname = "finmap";
--- a/pkgs/development/rocq-modules/mathcomp-real-closed/default.nix
+++ b/pkgs/development/rocq-modules/mathcomp-real-closed/default.nix
@@ -10,7 +10,7 @@
 mkRocqDerivation {

  namePrefix = [
-    "rocq-core"
+    "rocq"
    "mathcomp"
  ];
  pname = "real-closed";
--- a/pkgs/servers/http/nginx/mainline.nix
+++ b/pkgs/servers/http/nginx/mainline.nix
@@ -1,6 +1,6 @@
 { callPackage, ... }@args:

 callPackage ./generic.nix args {
-  version = "1.31.2";
-  hash = "sha256-ryqVfEHaY23cT4g+RSPG0UC0eE285CAAw2SuUJKqRzw=";
+  version = "1.31.3";
+  hash = "sha256-p2V8UIEcLZLZiVOV6Lhz72A5gULE2yHrZHgRw49t1SU=";
 }
--- a/pkgs/servers/http/nginx/stable.nix
+++ b/pkgs/servers/http/nginx/stable.nix
@@ -1,6 +1,6 @@
 { callPackage, ... }@args:

 callPackage ./generic.nix args {
-  version = "1.30.3";
-  hash = "sha256-5YI9xvRWEJk975Pr9s/OaCZK9JWMd+h0t9IPNwkAG48=";
+  version = "1.30.4";
+  hash = "sha256-QmHckOnkfBxAQSdumqo9SOvi5mT3KOFPqVrmxn1XoIs=";
 }
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10567,10 +10567,6 @@ with pkgs;

  boinc-headless = boinc.override { headless = true; };

-  celestia = callPackage ../applications/science/astronomy/celestia {
-    inherit (gnome2) gtkglext;
-  };
-
  faissWithCuda = faiss.override {
    cudaSupport = true;
  };
--- a/pkgs/top-level/lua-packages.nix
+++ b/pkgs/top-level/lua-packages.nix
@@ -113,6 +113,8 @@ rec {

  image-nvim = callPackage ../development/lua-modules/image-nvim { };

+  json = callPackage ../development/lua-modules/json { };
+
  lua-https = callPackage ../development/lua-modules/lua-https { };

  lua-pam = callPackage (
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -4238,6 +4238,8 @@ self: super: with self; {

  depyf = callPackage ../development/python-modules/depyf { };

+  derivative = callPackage ../development/python-modules/derivative { };
+
  derpconf = callPackage ../development/python-modules/derpconf { };

  desktop-entry-lib = callPackage ../development/python-modules/desktop-entry-lib { };
@@ -9496,6 +9498,8 @@ self: super: with self; {

  lifx-emulator-core = callPackage ../development/python-modules/lifx-emulator-core { };

+  liger-kernel = callPackage ../development/python-modules/liger-kernel { };
+
  lightgbm = callPackage ../development/python-modules/lightgbm { };

  lightify = callPackage ../development/python-modules/lightify { };
@@ -15816,6 +15820,8 @@ self: super: with self; {

  pysimplesoap = callPackage ../development/python-modules/pysimplesoap { };

+  pysindy = callPackage ../development/python-modules/pysindy { };
+
  pysingleton = callPackage ../development/python-modules/pysingleton { };

  pyskyqhub = callPackage ../development/python-modules/pyskyqhub { };
@@ -19035,6 +19041,8 @@ self: super: with self; {

  spectral-cube = callPackage ../development/python-modules/spectral-cube { };

+  spectral-derivatives = callPackage ../development/python-modules/spectral-derivatives { };
+
  speechbrain = callPackage ../development/python-modules/speechbrain { };

  speechrecognition = callPackage ../development/python-modules/speechrecognition { };
@@ -19774,6 +19782,8 @@ self: super: with self; {

  swh-web-client = callPackage ../development/python-modules/swh-web-client { };

+  swi-tools = callPackage ../development/python-modules/swi-tools { };
+
  swift = callPackage ../development/python-modules/swift { };

  swifter = callPackage ../development/python-modules/swifter { };