From 2922dea563aaaf43a034a842cf5cbedcafb175d1 Mon Sep 17 00:00:00 2001
From: Winter <winter@winter.cafe>
Date: Mon, 20 Jul 2026 20:23:26 -0400
Subject: [PATCH 01/51] nixos/lib/testing: `builtins.length (lib.attrNames ...)
 > 0 -> != to the empty set

(cherry picked from commit 244057cf9fe516aad51a689de8519daedf49dc97)
---
 nixos/lib/testing/run.nix | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/nixos/lib/testing/run.nix b/nixos/lib/testing/run.nix
index 0b35007f0c0b..b8a850489ffe 100644
--- a/nixos/lib/testing/run.nix
+++ b/nixos/lib/testing/run.nix
@@ -35,8 +35,7 @@ let
     options = {
       devnet = mkOption {
         type = types.bool;
-        default =
-          builtins.length (lib.attrNames containers) > 0 && builtins.length (lib.attrNames nodes) > 0;
+        default = containers != { } && nodes != { };
         defaultText = lib.literalMD "`true` if both VMs and containers are present.";
         description = ''
           This heuristic setting that assumes that the majority of tests requires VMs and containers
@@ -52,7 +51,7 @@ let
       };
       uid-range = mkOption {
         type = types.bool;
-        default = builtins.length (lib.attrNames containers) > 0;
+        default = containers != { };
         defaultText = lib.literalMD "`true` if containers are present.";
         description = "Containers use systemd-nspawn, which requires pid 0 inside of the sandbox. `uid-range` enables that.";
       };

From f4bd4ca5e66a7dec5ecb5ec52abd2613739a297a Mon Sep 17 00:00:00 2001
From: Winter <winter@winter.cafe>
Date: Fri, 3 Jul 2026 19:15:22 -0400
Subject: [PATCH 02/51] nixos/lib/testing: don't require kvm if only containers
 are specified

Allows containers to be run on systems that don't have the `kvm` feature enabled,
like VMs that don't support nested virt.

(cherry picked from commit bb3215658765d60e8086585dfbcd10038599bfdb)
---
 nixos/lib/testing/run.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/lib/testing/run.nix b/nixos/lib/testing/run.nix
index b8a850489ffe..f97489f67be5 100644
--- a/nixos/lib/testing/run.nix
+++ b/nixos/lib/testing/run.nix
@@ -57,8 +57,8 @@ let
       };
       kvm = mkOption {
         type = types.bool;
-        default = isLinux;
-        defaultText = lib.literalMD "`true` if built to run on Linux.";
+        default = isLinux && nodes != { };
+        defaultText = lib.literalMD "`true` if built to run on Linux and any virtual machines are specified.";
         description = "Whether Linux KVM virtualization is required when running this test. Can be disabled to allow emulated execution.";
       };
       apple-virt = mkOption {

From 3bcc29e753a40fc786f6dd785257e99e3c59f583 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Motiejus=20Jak=C5=A1tys?= <motiejus@jakstys.lt>
Date: Tue, 18 Aug 2026 23:29:20 +0300
Subject: [PATCH 03/51] undocker: fix upstream URL

I recently removed the "org" prefix from my git hosting suite and
maintain an override.

Let's switch to the correct url.

(cherry picked from commit b76af5e4313892122738b5a50f096414dd2d869b)
---
 pkgs/by-name/un/undocker/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/un/undocker/package.nix b/pkgs/by-name/un/undocker/package.nix
index f89745d4410a..a5786735ea41 100644
--- a/pkgs/by-name/un/undocker/package.nix
+++ b/pkgs/by-name/un/undocker/package.nix
@@ -7,7 +7,7 @@
 let
   version = "1.2.3";
   src = fetchgit {
-    url = "https://git.jakstys.lt/motiejus/undocker.git";
+    url = "https://git.jakstys.lt/undocker.git";
     rev = "v${version}";
     hash = "sha256-hyP85pYtXxucAliilUt9Y2qnrfPeSjeGsYEFJndJWyA=";
   };
@@ -25,7 +25,7 @@ buildGoModule {
   vendorHash = null;
 
   meta = {
-    homepage = "https://git.jakstys.lt/motiejus/undocker";
+    homepage = "https://git.jakstys.lt/undocker";
     description = "CLI tool to convert a Docker image to a flattened rootfs tarball";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [

From eecbb45da4b55592d2857df5b7de404dfd2cdf34 Mon Sep 17 00:00:00 2001
From: leigh capili <leigh@null.net>
Date: Tue, 25 Aug 2026 07:30:59 -0600
Subject: [PATCH 04/51] fluxcd-operator: 0.49.0 -> 0.50.0

(cherry picked from commit 9c99611268297f61959536213c486e8eafe77050)
Signed-off-by: leigh capili <leigh@null.net>
---
 pkgs/by-name/fl/fluxcd-operator/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fl/fluxcd-operator/package.nix b/pkgs/by-name/fl/fluxcd-operator/package.nix
index 167480bca502..127f93b5a779 100644
--- a/pkgs/by-name/fl/fluxcd-operator/package.nix
+++ b/pkgs/by-name/fl/fluxcd-operator/package.nix
@@ -9,16 +9,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "fluxcd-operator";
-  version = "0.49.0";
+  version = "0.50.0";
 
   src = fetchFromGitHub {
     owner = "controlplaneio-fluxcd";
     repo = "fluxcd-operator";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hWMXoJ47+kDmMGkGV9GOJ9ssdK6RVvcmxf3fiQYhvgM=";
+    hash = "sha256-4FIsad3/57KtyTVQE0T4jhQGEvuEw9/ZFWsriLyc6Ok=";
   };
 
-  vendorHash = "sha256-UANjDzaYJ5t10ZzG0a7oftKQVqj1HcE6/LmlnLapCPY=";
+  vendorHash = "sha256-DxXTepwTjgc+Xy3MAIFcYZ/XZZ3zGgyStmXN2/BqM74=";
 
   ldflags = [
     "-s"

From 1cc79e5f8ba2ccd7bff525afb73e80182de914c5 Mon Sep 17 00:00:00 2001
From: leigh capili <leigh@null.net>
Date: Tue, 25 Aug 2026 07:31:01 -0600
Subject: [PATCH 05/51] fluxcd-operator: 0.50.0 -> 0.52.0

(cherry picked from commit e0d8c9c45e3772435aa69d7235c5b5d7390fb34a)
Signed-off-by: leigh capili <leigh@null.net>
---
 pkgs/by-name/fl/fluxcd-operator/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fl/fluxcd-operator/package.nix b/pkgs/by-name/fl/fluxcd-operator/package.nix
index 127f93b5a779..6e6cf8bcd6b3 100644
--- a/pkgs/by-name/fl/fluxcd-operator/package.nix
+++ b/pkgs/by-name/fl/fluxcd-operator/package.nix
@@ -9,16 +9,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "fluxcd-operator";
-  version = "0.50.0";
+  version = "0.52.0";
 
   src = fetchFromGitHub {
     owner = "controlplaneio-fluxcd";
     repo = "fluxcd-operator";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4FIsad3/57KtyTVQE0T4jhQGEvuEw9/ZFWsriLyc6Ok=";
+    hash = "sha256-l+IJtFmVR3WZaFW4aaYjirTqj+X1FGLAVgbA21MHO1k=";
   };
 
-  vendorHash = "sha256-DxXTepwTjgc+Xy3MAIFcYZ/XZZ3zGgyStmXN2/BqM74=";
+  vendorHash = "sha256-DW+dnakqnpSiV7MlzshGEzoy3Osv93dAsJYe4cR0sJ4=";
 
   ldflags = [
     "-s"

From 73b9f2ada4b8071e5df5889d8d016c4139f4c80c Mon Sep 17 00:00:00 2001
From: leigh capili <leigh@null.net>
Date: Tue, 25 Aug 2026 07:31:01 -0600
Subject: [PATCH 06/51] treewide: follow some GitHub redirects for
 `fetchFromGitHub`

generated using https://git.kybe.xyz/2kybe3/nixpkgs-github-redirect

continuation of: #537889

(cherry picked from commit af24e675e55bc4a2e883e8ffd0f1129ab1db7baa)
[backport: restricted to pkgs/by-name/fl/fluxcd-operator]
Signed-off-by: leigh capili <leigh@null.net>
---
 pkgs/by-name/fl/fluxcd-operator/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/fl/fluxcd-operator/package.nix b/pkgs/by-name/fl/fluxcd-operator/package.nix
index 6e6cf8bcd6b3..532f254a30be 100644
--- a/pkgs/by-name/fl/fluxcd-operator/package.nix
+++ b/pkgs/by-name/fl/fluxcd-operator/package.nix
@@ -13,7 +13,7 @@ buildGoModule (finalAttrs: {
 
   src = fetchFromGitHub {
     owner = "controlplaneio-fluxcd";
-    repo = "fluxcd-operator";
+    repo = "flux-operator";
     tag = "v${finalAttrs.version}";
     hash = "sha256-l+IJtFmVR3WZaFW4aaYjirTqj+X1FGLAVgbA21MHO1k=";
   };

From 38b60f1a43b5d498b70ae47a560b4766b6dfacb7 Mon Sep 17 00:00:00 2001
From: leigh capili <leigh@null.net>
Date: Tue, 25 Aug 2026 07:31:03 -0600
Subject: [PATCH 07/51] fluxcd-operator: 0.52.0 -> 0.54.0

(cherry picked from commit 7c8da776237d9dfa5bc0996cbe616eb8f5dd7921)
Signed-off-by: leigh capili <leigh@null.net>
---
 pkgs/by-name/fl/fluxcd-operator/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fl/fluxcd-operator/package.nix b/pkgs/by-name/fl/fluxcd-operator/package.nix
index 532f254a30be..b952bde62d17 100644
--- a/pkgs/by-name/fl/fluxcd-operator/package.nix
+++ b/pkgs/by-name/fl/fluxcd-operator/package.nix
@@ -9,13 +9,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "fluxcd-operator";
-  version = "0.52.0";
+  version = "0.54.0";
 
   src = fetchFromGitHub {
     owner = "controlplaneio-fluxcd";
     repo = "flux-operator";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-l+IJtFmVR3WZaFW4aaYjirTqj+X1FGLAVgbA21MHO1k=";
+    hash = "sha256-Bxzqm4I+wTj1k8ppa4cohsowmgc7H76EuHCYlCiJ5Qk=";
   };
 
   vendorHash = "sha256-DW+dnakqnpSiV7MlzshGEzoy3Osv93dAsJYe4cR0sJ4=";

From c3200dc9672c572421d0d4af8d0ce95a0bd7b2e5 Mon Sep 17 00:00:00 2001
From: leigh capili <leigh@null.net>
Date: Tue, 25 Aug 2026 07:31:05 -0600
Subject: [PATCH 08/51] fluxcd-operator: 0.54.0 -> 0.55.0

(cherry picked from commit 3de3f9caeeba550e7b51143193f9f1ea87e5431d)
Signed-off-by: leigh capili <leigh@null.net>
---
 pkgs/by-name/fl/fluxcd-operator/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fl/fluxcd-operator/package.nix b/pkgs/by-name/fl/fluxcd-operator/package.nix
index b952bde62d17..9a34b5c495cb 100644
--- a/pkgs/by-name/fl/fluxcd-operator/package.nix
+++ b/pkgs/by-name/fl/fluxcd-operator/package.nix
@@ -9,13 +9,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "fluxcd-operator";
-  version = "0.54.0";
+  version = "0.55.0";
 
   src = fetchFromGitHub {
     owner = "controlplaneio-fluxcd";
     repo = "flux-operator";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Bxzqm4I+wTj1k8ppa4cohsowmgc7H76EuHCYlCiJ5Qk=";
+    hash = "sha256-MWtjoTQuB6G/f9MnKOkIKlbI5tvaP5TLb5PvEySNLFM=";
   };
 
   vendorHash = "sha256-DW+dnakqnpSiV7MlzshGEzoy3Osv93dAsJYe4cR0sJ4=";

From 3fed61f6d11cacd02e686db346761a7955be52db Mon Sep 17 00:00:00 2001
From: leigh capili <leigh@null.net>
Date: Tue, 25 Aug 2026 07:31:06 -0600
Subject: [PATCH 09/51] fluxcd-operator: 0.55.0 -> 0.56.0

(cherry picked from commit 8ef669b0c3561b978eec4ce443edd2a8a7c28a1e)
Signed-off-by: leigh capili <leigh@null.net>
---
 pkgs/by-name/fl/fluxcd-operator/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fl/fluxcd-operator/package.nix b/pkgs/by-name/fl/fluxcd-operator/package.nix
index 9a34b5c495cb..1b721c0119ac 100644
--- a/pkgs/by-name/fl/fluxcd-operator/package.nix
+++ b/pkgs/by-name/fl/fluxcd-operator/package.nix
@@ -9,16 +9,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "fluxcd-operator";
-  version = "0.55.0";
+  version = "0.56.0";
 
   src = fetchFromGitHub {
     owner = "controlplaneio-fluxcd";
     repo = "flux-operator";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-MWtjoTQuB6G/f9MnKOkIKlbI5tvaP5TLb5PvEySNLFM=";
+    hash = "sha256-wx6FI4X5kBtbz1ZWeF35RSNu/FP3y4pfLnnn7ltofRQ=";
   };
 
-  vendorHash = "sha256-DW+dnakqnpSiV7MlzshGEzoy3Osv93dAsJYe4cR0sJ4=";
+  vendorHash = "sha256-sPAmFrB8Lxedsp1rmmsp2p4at0to7syxK9IR6Geh+ak=";
 
   ldflags = [
     "-s"

From 1ec3ba4daa18637aca32d4e4cc8362e2e083963a Mon Sep 17 00:00:00 2001
From: leigh capili <leigh@null.net>
Date: Tue, 25 Aug 2026 07:31:08 -0600
Subject: [PATCH 10/51] fluxcd-operator: 0.56.0 -> 0.57.0

(cherry picked from commit 7d8b1a135c5407907769f5ea2bbbe9e8b8603686)
Signed-off-by: leigh capili <leigh@null.net>
---
 pkgs/by-name/fl/fluxcd-operator/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fl/fluxcd-operator/package.nix b/pkgs/by-name/fl/fluxcd-operator/package.nix
index 1b721c0119ac..fcdafe3e6f35 100644
--- a/pkgs/by-name/fl/fluxcd-operator/package.nix
+++ b/pkgs/by-name/fl/fluxcd-operator/package.nix
@@ -9,16 +9,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "fluxcd-operator";
-  version = "0.56.0";
+  version = "0.57.0";
 
   src = fetchFromGitHub {
     owner = "controlplaneio-fluxcd";
     repo = "flux-operator";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wx6FI4X5kBtbz1ZWeF35RSNu/FP3y4pfLnnn7ltofRQ=";
+    hash = "sha256-qY+uxYGkeiffU5UTsh7oVL1Cp8uKMj4/F6+Y62BSUPY=";
   };
 
-  vendorHash = "sha256-sPAmFrB8Lxedsp1rmmsp2p4at0to7syxK9IR6Geh+ak=";
+  vendorHash = "sha256-uTj6P6UZtfFf7jBrRZMWJ3HObiSR/tPlFICk6Cw12WQ=";
 
   ldflags = [
     "-s"

From 47ce24574b978b257b5725b6cf90855fced60021 Mon Sep 17 00:00:00 2001
From: leigh capili <leigh@null.net>
Date: Tue, 25 Aug 2026 07:31:26 -0600
Subject: [PATCH 11/51] fluxcd-operator-mcp: 0.50.0 -> 0.52.0

(cherry picked from commit dddb0d1d8917210457daf44eb0629b3b88a37815)
Signed-off-by: leigh capili <leigh@null.net>
---
 pkgs/by-name/fl/fluxcd-operator-mcp/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fl/fluxcd-operator-mcp/package.nix b/pkgs/by-name/fl/fluxcd-operator-mcp/package.nix
index 2cfcd09beb1d..09e787515f45 100644
--- a/pkgs/by-name/fl/fluxcd-operator-mcp/package.nix
+++ b/pkgs/by-name/fl/fluxcd-operator-mcp/package.nix
@@ -9,16 +9,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "fluxcd-operator-mcp";
-  version = "0.50.0";
+  version = "0.52.0";
 
   src = fetchFromGitHub {
     owner = "controlplaneio-fluxcd";
     repo = "fluxcd-operator";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-4FIsad3/57KtyTVQE0T4jhQGEvuEw9/ZFWsriLyc6Ok=";
+    hash = "sha256-l+IJtFmVR3WZaFW4aaYjirTqj+X1FGLAVgbA21MHO1k=";
   };
 
-  vendorHash = "sha256-DxXTepwTjgc+Xy3MAIFcYZ/XZZ3zGgyStmXN2/BqM74=";
+  vendorHash = "sha256-DW+dnakqnpSiV7MlzshGEzoy3Osv93dAsJYe4cR0sJ4=";
 
   ldflags = [
     "-s"

From 205c157b3b91d78a8352ecd2b1271e4642dbd196 Mon Sep 17 00:00:00 2001
From: leigh capili <leigh@null.net>
Date: Tue, 25 Aug 2026 07:31:27 -0600
Subject: [PATCH 12/51] treewide: follow some GitHub redirects for
 `fetchFromGitHub`

generated using https://git.kybe.xyz/2kybe3/nixpkgs-github-redirect

continuation of: #537889

(cherry picked from commit af24e675e55bc4a2e883e8ffd0f1129ab1db7baa)
[backport: restricted to pkgs/by-name/fl/fluxcd-operator-mcp]
Signed-off-by: leigh capili <leigh@null.net>
---
 pkgs/by-name/fl/fluxcd-operator-mcp/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/fl/fluxcd-operator-mcp/package.nix b/pkgs/by-name/fl/fluxcd-operator-mcp/package.nix
index 09e787515f45..d47e5dfc5548 100644
--- a/pkgs/by-name/fl/fluxcd-operator-mcp/package.nix
+++ b/pkgs/by-name/fl/fluxcd-operator-mcp/package.nix
@@ -13,7 +13,7 @@ buildGoModule (finalAttrs: {
 
   src = fetchFromGitHub {
     owner = "controlplaneio-fluxcd";
-    repo = "fluxcd-operator";
+    repo = "flux-operator";
     tag = "v${finalAttrs.version}";
     hash = "sha256-l+IJtFmVR3WZaFW4aaYjirTqj+X1FGLAVgbA21MHO1k=";
   };

From 0b06df30e9ad06946990d99e47a20945cc695665 Mon Sep 17 00:00:00 2001
From: leigh capili <leigh@null.net>
Date: Tue, 25 Aug 2026 07:31:28 -0600
Subject: [PATCH 13/51] fluxcd-operator-mcp: 0.52.0 -> 0.58.0

(cherry picked from commit 8b420c4eadcb3093d22cfbeda23521fbf73c6bd2)
Signed-off-by: leigh capili <leigh@null.net>
---
 pkgs/by-name/fl/fluxcd-operator-mcp/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fl/fluxcd-operator-mcp/package.nix b/pkgs/by-name/fl/fluxcd-operator-mcp/package.nix
index d47e5dfc5548..77d9e170d96e 100644
--- a/pkgs/by-name/fl/fluxcd-operator-mcp/package.nix
+++ b/pkgs/by-name/fl/fluxcd-operator-mcp/package.nix
@@ -9,16 +9,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "fluxcd-operator-mcp";
-  version = "0.52.0";
+  version = "0.58.0";
 
   src = fetchFromGitHub {
     owner = "controlplaneio-fluxcd";
     repo = "flux-operator";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-l+IJtFmVR3WZaFW4aaYjirTqj+X1FGLAVgbA21MHO1k=";
+    hash = "sha256-2+/60Hp1OGvVJtFUFom1ax4ALdxXOoevEXt9oyUjazI=";
   };
 
-  vendorHash = "sha256-DW+dnakqnpSiV7MlzshGEzoy3Osv93dAsJYe4cR0sJ4=";
+  vendorHash = "sha256-uTj6P6UZtfFf7jBrRZMWJ3HObiSR/tPlFICk6Cw12WQ=";
 
   ldflags = [
     "-s"

From 6cf5de9c54cf7599dcc4bdb379318d412d45aabb Mon Sep 17 00:00:00 2001
From: leigh capili <leigh@null.net>
Date: Tue, 25 Aug 2026 23:01:14 -0600
Subject: [PATCH 14/51] fluxcd-operator: 0.57.0 -> 0.58.1

(cherry picked from commit 188a6d87daf9838b0a656d24a6bf1b13ebd50fb1)
Signed-off-by: leigh capili <leigh@null.net>
---
 pkgs/by-name/fl/fluxcd-operator/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fl/fluxcd-operator/package.nix b/pkgs/by-name/fl/fluxcd-operator/package.nix
index fcdafe3e6f35..3b1de7601c8e 100644
--- a/pkgs/by-name/fl/fluxcd-operator/package.nix
+++ b/pkgs/by-name/fl/fluxcd-operator/package.nix
@@ -9,16 +9,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "fluxcd-operator";
-  version = "0.57.0";
+  version = "0.58.1";
 
   src = fetchFromGitHub {
     owner = "controlplaneio-fluxcd";
     repo = "flux-operator";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qY+uxYGkeiffU5UTsh7oVL1Cp8uKMj4/F6+Y62BSUPY=";
+    hash = "sha256-XGjRP9JvEpuVNKcErTKmKi4TGBADpbI1DDXYDd0Bbb4=";
   };
 
-  vendorHash = "sha256-uTj6P6UZtfFf7jBrRZMWJ3HObiSR/tPlFICk6Cw12WQ=";
+  vendorHash = "sha256-9iDxoWnizmTQ4FqxjlGPQO8Au2FxIdcgggtP+3dTOaU=";
 
   ldflags = [
     "-s"

From 6e79ad9081ae9ee6a159a07069a5879bf009b0e6 Mon Sep 17 00:00:00 2001
From: leigh capili <leigh@null.net>
Date: Thu, 27 Aug 2026 12:30:59 -0600
Subject: [PATCH 15/51] fluxcd-operator-mcp: 0.58.0 -> 0.58.1

(cherry picked from commit 49c7875dacdd1671d48230d8ff182b0f3f55371c)
Signed-off-by: leigh capili <leigh@null.net>
---
 pkgs/by-name/fl/fluxcd-operator-mcp/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/fl/fluxcd-operator-mcp/package.nix b/pkgs/by-name/fl/fluxcd-operator-mcp/package.nix
index 77d9e170d96e..e5584d24e38a 100644
--- a/pkgs/by-name/fl/fluxcd-operator-mcp/package.nix
+++ b/pkgs/by-name/fl/fluxcd-operator-mcp/package.nix
@@ -9,16 +9,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "fluxcd-operator-mcp";
-  version = "0.58.0";
+  version = "0.58.1";
 
   src = fetchFromGitHub {
     owner = "controlplaneio-fluxcd";
     repo = "flux-operator";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2+/60Hp1OGvVJtFUFom1ax4ALdxXOoevEXt9oyUjazI=";
+    hash = "sha256-XGjRP9JvEpuVNKcErTKmKi4TGBADpbI1DDXYDd0Bbb4=";
   };
 
-  vendorHash = "sha256-uTj6P6UZtfFf7jBrRZMWJ3HObiSR/tPlFICk6Cw12WQ=";
+  vendorHash = "sha256-9iDxoWnizmTQ4FqxjlGPQO8Au2FxIdcgggtP+3dTOaU=";
 
   ldflags = [
     "-s"

From 2af66f94f0337f5e8e0f272f2f95b3cc3eaa3de2 Mon Sep 17 00:00:00 2001
From: Moraxyc <i@qaq.li>
Date: Wed, 2 Sep 2026 09:43:54 +0000
Subject: [PATCH 16/51] zinit: 3.14.0 -> 3.17.0

(cherry picked from commit 809497ec52315c80c5ea375eba94bbba0c442acf)
---
 pkgs/by-name/zi/zinit/package.nix | 26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/zi/zinit/package.nix b/pkgs/by-name/zi/zinit/package.nix
index a52156552a37..644a83527456 100644
--- a/pkgs/by-name/zi/zinit/package.nix
+++ b/pkgs/by-name/zi/zinit/package.nix
@@ -4,17 +4,18 @@
   fetchFromGitHub,
   installShellFiles,
   nix-update-script,
+  zsh,
 }:
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "zinit";
-  version = "3.14.0";
+  version = "3.17.0";
 
   src = fetchFromGitHub {
     owner = "zdharma-continuum";
     repo = "zinit";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cBMGmFrveBes30aCSLMBO8WrtoPZeMNjcEQoQEzBNvM=";
+    hash = "sha256-5QURQfU0J1zrnJFVlFYM3WNRbQPd5iWTX6MGxManDOs=";
   };
 
   outputs = [
@@ -34,7 +35,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
     # Source files
     mkdir -p $out/share/zinit
-    install -m0444 zinit{,-side,-install,-autoload,-additional}.zsh _zinit $out/share/zinit
+    install -m0444 zinit{,-side,-install,-autoload,-additional}.zsh _zinit VERSION $out/share/zinit
     mkdir $out/share/zinit/share
     install -m0555 share/git-process-output.zsh $out/share/zinit/share
     install -m0444 share/rpm2cpio.zsh $out/share/zinit/share
@@ -49,7 +50,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
     mkdir -p $doc/share/doc/zinit
     install -m0444 doc/zsdoc/*.adoc $doc/share/doc/zinit
-    install -m0444 doc/HACKING.md $doc/share/doc/zinit
+    install -m0444 CHANGELOG.md doc/HACKING.md $doc/share/doc/zinit
 
     runHook postInstall
   '';
@@ -61,6 +62,21 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       --replace-fail "ZINIT[MAN_DIR]:=\''${ZPFX}/man" "ZINIT[MAN_DIR]:=$man/share/man"
   '';
 
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ zsh ];
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    HOME="$TMPDIR" \
+      ZINIT_DIR="$out/share/zinit" \
+      zsh -dfc '
+        source "$ZINIT_DIR/zinit.zsh"
+        (( $+functions[zinit] ))
+      '
+
+    runHook postInstallCheck
+  '';
+
   passthru = {
     updateScript = nix-update-script { };
   };
@@ -68,7 +84,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   meta = {
     homepage = "https://github.com/zdharma-continuum/zinit";
     description = "Flexible zsh plugin manager";
-    changelog = "https://github.com/zdharma-continuum/zinit/blob/${finalAttrs.src.rev}/doc/CHANGELOG.md";
+    changelog = "https://github.com/zdharma-continuum/zinit/blob/${finalAttrs.src.rev}/CHANGELOG.md";
     license = lib.licenses.mit;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [

From 8b515aaef5483f32a6fd6efbac4438ba9af778f2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 5 Sep 2026 17:41:22 +0000
Subject: [PATCH 17/51] docker: 29.7.2 -> 29.8.0

(cherry picked from commit 11f732193b4933e13d3eaa690b144ab275ca72e3)
---
 .../applications/virtualization/docker/default.nix | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index 52b99ed04569..a402df867621 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -424,18 +424,18 @@ in
 
   docker_29 =
     let
-      version = "29.7.2";
+      version = "29.8.0";
     in
     callPackage dockerGen {
       inherit version;
       cliRev = "v${version}";
-      cliHash = "sha256-ZYXRX4IQfUbb21yk/NodO5NH5OeX/KFDL9UdFS1e5ng=";
+      cliHash = "sha256-HV4rdWGDtPoYIaGBnHZbYNKr2D6zk6sb9sA0tNbQce4=";
       mobyRev = "docker-v${version}";
-      mobyHash = "sha256-k28c4cwt+ASVj8FTvM8dgIOL3yqR5wbI21r3LtrVamU=";
-      runcRev = "v1.4.3";
-      runcHash = "sha256-I9DruagoSWjrEBB4n+w5rzali5wvD/q3tVQFWPDnLAI=";
-      containerdRev = "v2.3.3";
-      containerdHash = "sha256-wa9Pixaq5RRrJucWibbBe4n6s53Pdj+mr5gLoFmDgLU=";
+      mobyHash = "sha256-V8p+MDEEMERGqQ9sWKPE/jkUw43UcO0x3Z1XZ8DWM2E=";
+      runcRev = "v1.5.1";
+      runcHash = "sha256-N059CtWkenSXYksVu5Uh+sGodC+JHc91R56b+VoC96k=";
+      containerdRev = "v2.3.4";
+      containerdHash = "sha256-IGgToUpkbqtjGJD+GtCPSeHW9ZRnSS8NMfECok9HgjU=";
       tiniRev = "369448a167e8b3da4ca5bca0b3307500c3371828";
       tiniHash = "sha256-jCBNfoJAjmcTJBx08kHs+FmbaU82CbQcf0IVjd56Nuw=";
     };

From e695743e7858bf82f432e10bbce11670e7a80185 Mon Sep 17 00:00:00 2001
From: Tom Herbers <mail@tomherbers.de>
Date: Sun, 6 Sep 2026 22:06:26 +0200
Subject: [PATCH 18/51] garage_2: 2.3.0 -> 2.4.1

Changelogs:
- https://git.deuxfleurs.fr/Deuxfleurs/garage/releases/tag/v2.4.0
- https://git.deuxfleurs.fr/Deuxfleurs/garage/releases/tag/v2.4.1

(cherry picked from commit 778409072a5edcc5009e6a0bb27323e2ed304d01)
---
 pkgs/tools/filesystems/garage/default.nix | 13 +++----------
 1 file changed, 3 insertions(+), 10 deletions(-)

diff --git a/pkgs/tools/filesystems/garage/default.nix b/pkgs/tools/filesystems/garage/default.nix
index 12ce3e3c5353..9440190740ca 100644
--- a/pkgs/tools/filesystems/garage/default.nix
+++ b/pkgs/tools/filesystems/garage/default.nix
@@ -113,16 +113,9 @@ rec {
   };
 
   garage_2 = generic {
-    version = "2.3.0";
-    hash = "sha256-CqHcaVGgXL/jjqq7XN+kzEp6xoNgwBfGpMKYbTd78Ys=";
-    cargoHash = "sha256-ANh97G/2/KtCMN4gldteq6ROduk1AQJkI5zS9n97OJY=";
-    cargoPatches = [
-      (fetchpatch2 {
-        # fix: prevent depending on aws-lc via reqwest
-        url = "https://git.deuxfleurs.fr/Deuxfleurs/garage/commit/7c18abb664d891cdb696b478058b7506e3d53f44.patch";
-        hash = "sha256-f/+vDOC+kcmJVLtx1Y6OepoJBZhX30DULwSLnyQN5aI=";
-      })
-    ];
+    version = "2.4.1";
+    hash = "sha256-+3w4R0IGxc7GCVW3t7Izt6Y5PVUjxHsdLrr74ckR9Mg=";
+    cargoHash = "sha256-G928EsavtEgxugLzpBGSbo2RMHLzu9PZf9r3GqU5J3E=";
   };
 
   garage = garage_1;

From 6f282964f246d93a3dcebb2316441f61265fdf32 Mon Sep 17 00:00:00 2001
From: sterni <sternenseemann@systemli.org>
Date: Sat, 12 Sep 2026 12:45:51 +0200
Subject: [PATCH 19/51] ocamlPackages.mirage-crypto*: add knownVulnerabilities
 entries

This is a stop gap measure for now since we should be able to fix
these issues (i.e. fixes are available and have been released).

Unfortunately these fixes are spread across 2.2.0, 2.3.0, 2.4.0
which also contain breaking changes at time. See #562227. These
breaking changes require (breaking) updates for at least httpcats
and tls.

Reference #561924.
---
 pkgs/development/ocaml-modules/mirage-crypto/default.nix | 3 +++
 pkgs/development/ocaml-modules/mirage-crypto/ec.nix      | 5 +++++
 pkgs/development/ocaml-modules/mirage-crypto/pk.nix      | 3 +++
 3 files changed, 11 insertions(+)

diff --git a/pkgs/development/ocaml-modules/mirage-crypto/default.nix b/pkgs/development/ocaml-modules/mirage-crypto/default.nix
index 2dea0eb4c218..16854c5d9e5e 100644
--- a/pkgs/development/ocaml-modules/mirage-crypto/default.nix
+++ b/pkgs/development/ocaml-modules/mirage-crypto/default.nix
@@ -43,5 +43,8 @@ buildDunePackage (finalAttrs: {
       sternenseemann
       momeemt
     ];
+    knownVulnerabilities = [
+      "CVE-2026-87732" # fixed in 2.2.0
+    ];
   };
 })
diff --git a/pkgs/development/ocaml-modules/mirage-crypto/ec.nix b/pkgs/development/ocaml-modules/mirage-crypto/ec.nix
index 6699de8e39cc..accc17fc198a 100644
--- a/pkgs/development/ocaml-modules/mirage-crypto/ec.nix
+++ b/pkgs/development/ocaml-modules/mirage-crypto/ec.nix
@@ -43,5 +43,10 @@ buildDunePackage {
 
   meta = mirage-crypto.meta // {
     description = "Elliptic Curve Cryptography with primitives taken from Fiat";
+    knownVulnerabilities = [
+      "CVE-2026-87733" # fixed in 2.2.0
+      "CVE-2026-87736" # fixed in 2.3.0
+      "CVE-2026-87737" # fixed in 2.4.0
+    ];
   };
 }
diff --git a/pkgs/development/ocaml-modules/mirage-crypto/pk.nix b/pkgs/development/ocaml-modules/mirage-crypto/pk.nix
index 6700008e7a97..668cb95e74d4 100644
--- a/pkgs/development/ocaml-modules/mirage-crypto/pk.nix
+++ b/pkgs/development/ocaml-modules/mirage-crypto/pk.nix
@@ -30,5 +30,8 @@ buildDunePackage {
 
   meta = mirage-crypto.meta // {
     description = "Simple public-key cryptography for the modern age";
+    knownVulnerabilities = [
+      "CVE-2026-87735" # fixed in 2.3.0
+    ];
   };
 }

From dc225a5837c227fae94e893bb799c8ea43ec92b0 Mon Sep 17 00:00:00 2001
From: Ross Smyth <18294397+RossSmyth@users.noreply.github.com>
Date: Tue, 8 Sep 2026 23:25:14 -0400
Subject: [PATCH 20/51] bloodhound: mark as insecure

(cherry picked from commit 46485bd11107288bd242d34ec46f44e20ec9d4d8)
---
 pkgs/by-name/bl/bloodhound/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/bl/bloodhound/package.nix b/pkgs/by-name/bl/bloodhound/package.nix
index e9bac8137221..839abb971b87 100644
--- a/pkgs/by-name/bl/bloodhound/package.nix
+++ b/pkgs/by-name/bl/bloodhound/package.nix
@@ -138,5 +138,8 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [ akechishiro ];
     platforms = [ "x86_64-linux" ];
     mainProgram = "BloodHound";
+    knownVulnerabilities = [
+      "Upstream is deprecated, using Electron 11 which was EOL in 2021. Consider using bloodhound-ce instead."
+    ];
   };
 })

From 057f8c8f7e66c5ec23ea1203046873a066ec6a40 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Fri, 11 Sep 2026 11:54:30 +0000
Subject: [PATCH 21/51] pnpm_11: 11.25.0 -> 11.27.0

(cherry picked from commit 8331d3f1d011c42be347f3d852d5af00aa4e49f6)
---
 pkgs/development/tools/pnpm/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index 27a71f849f8d..4474934a9e52 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -53,8 +53,8 @@ let
       hash = "sha256-WOFDJYhx31FYm2UcBiBdq+xIdmpdu6PCWZm2m1C+WY4=";
     };
     "11" = {
-      version = "11.25.0";
-      hash = "sha256-M90HSPJ+eRbE8ci2lDRhmD40U7BrvaYxKmKAEwtIgeU=";
+      version = "11.27.0";
+      hash = "sha256-QKMlFaJVB/jyJt+74lOA4vBTlEwuzGTAwcuYtBy7ke8=";
     };
   };
 

From e92ef0ccb24b70eb41cbda1324098d6586b4c924 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 14 Sep 2026 15:17:59 +0000
Subject: [PATCH 22/51] jackett: 0.24.2527 -> 0.24.2586

(cherry picked from commit 7e99029c7180ce788c2032d906789f395c89872e)
---
 pkgs/by-name/ja/jackett/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ja/jackett/package.nix b/pkgs/by-name/ja/jackett/package.nix
index 1c9c6a2e72b8..62e44b97871b 100644
--- a/pkgs/by-name/ja/jackett/package.nix
+++ b/pkgs/by-name/ja/jackett/package.nix
@@ -12,13 +12,13 @@
 
 buildDotnetModule (finalAttrs: {
   pname = "jackett";
-  version = "0.24.2527";
+  version = "0.24.2586";
 
   src = fetchFromGitHub {
     owner = "jackett";
     repo = "jackett";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-IbSXGddfsD9r0ElsSToQ+n75F09WUnF2jHirFOAiu+Q=";
+    hash = "sha256-rYUkxFkMcClN+GFt/nFR/y+zLbgLF9CFQUvfwuwNpo0=";
   };
 
   projectFile = "src/Jackett.Server/Jackett.Server.csproj";

From 1e46ad61ee0a7d9780c5fcc42b22511d91370964 Mon Sep 17 00:00:00 2001
From: Lin Jian <me@linj.tech>
Date: Tue, 15 Sep 2026 22:30:28 +0800
Subject: [PATCH 23/51] emacs: patch CVE-2024-53920

https://www.openwall.com/lists/oss-security/2026/09/14/1

Not-cherry-picked-because: emacs30 was deleted from master
---
 pkgs/applications/editors/emacs/sources.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/applications/editors/emacs/sources.nix b/pkgs/applications/editors/emacs/sources.nix
index 71f888a3aa73..1af721f34947 100644
--- a/pkgs/applications/editors/emacs/sources.nix
+++ b/pkgs/applications/editors/emacs/sources.nix
@@ -141,6 +141,11 @@ in
         url = "https://gitweb.gentoo.org/proj/emacs-patches.git/plain/emacs/30.2/05_all_tramp.patch?id=2a6292f81affedcc468c594c60808e652ae87118";
         hash = "sha256-WMjTscIuOXakuTO2H+w/Hd61V61V6ZrLh9WPMd58l+M=";
       })
+      (fetchpatch {
+        name = "CVE-2024-53920.patch";
+        url = "https://cgit.git.savannah.gnu.org/cgit/emacs.git/patch/?id=abc802ee2eb0b1663349ddf22a461f8e54a383fb";
+        hash = "sha256-ViRD4E27WDs7lLO6YPNroMo3Zq5/ASqMlmNtVI1V/Lo=";
+      })
     ];
   });
 

From 23abe90e685c9982a6b69a3aebe4df2b243f8666 Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Mon, 14 Sep 2026 10:17:36 -0400
Subject: [PATCH 24/51] victoriametrics: 1.151.0 -> 1.152.0

Changelog: https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.152.0
(cherry picked from commit f045d6ab34b08351b2f258c2f7a242aee384b701)
---
 pkgs/by-name/vi/victoriametrics/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/vi/victoriametrics/package.nix b/pkgs/by-name/vi/victoriametrics/package.nix
index c03666eef1af..647399a8cad2 100644
--- a/pkgs/by-name/vi/victoriametrics/package.nix
+++ b/pkgs/by-name/vi/victoriametrics/package.nix
@@ -1,6 +1,6 @@
 {
   lib,
-  buildGoModule,
+  buildGo127Module,
   fetchFromGitHub,
   nix-update-script,
   nixosTests,
@@ -12,15 +12,15 @@
   withVmctl ? true, # vmctl is used to migrate time series
 }:
 
-buildGoModule (finalAttrs: {
+buildGo127Module (finalAttrs: {
   pname = "VictoriaMetrics";
-  version = "1.151.0";
+  version = "1.152.0";
 
   src = fetchFromGitHub {
     owner = "VictoriaMetrics";
     repo = "VictoriaMetrics";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-LMilqB2enkzZr3zLcwnDLojtFV/lcOsXA9EhjiFarqE=";
+    hash = "sha256-3PDFQbVJhwyMUvA/ToXJKBOIN9xKoBGp/YjHntjwKr4=";
   };
 
   vendorHash = null;

From c307fc1c22f77f0bff684e56298c55de9ced8846 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 10 Sep 2026 12:40:34 +0000
Subject: [PATCH 25/51] upower: 1.91.3 -> 1.91.4

(cherry picked from commit a8b1e967c2d55289ad0eead170989711abde063f)
---
 pkgs/by-name/up/upower/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/up/upower/package.nix b/pkgs/by-name/up/upower/package.nix
index a317da29cb3c..b07dec539ee2 100644
--- a/pkgs/by-name/up/upower/package.nix
+++ b/pkgs/by-name/up/upower/package.nix
@@ -38,7 +38,7 @@ assert withDocs -> withIntrospection;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "upower";
-  version = "1.91.3";
+  version = "1.91.4";
 
   outputs = [
     "out"
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "upower";
     repo = "upower";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-QdAJxaua43iGovQeRg+n1MypS5CS0Ro3gqF9Tv8eMBg=";
+    hash = "sha256-B/gfrXPLYwOGyheTLP/sEH5RakLUm4OiRAV+U2wL9V0=";
   };
 
   patches =

From cf37b3ba3d79fce96443e480e42aee18b407ed81 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 12 Sep 2026 00:29:13 +0000
Subject: [PATCH 26/51] fluxcd: 2.9.4 -> 2.9.5

(cherry picked from commit 78826a1371eb1a22d18b1d539329bcce6fc78d92)
---
 pkgs/by-name/fl/fluxcd/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/fl/fluxcd/package.nix b/pkgs/by-name/fl/fluxcd/package.nix
index 4982c3c558b8..d87fbdbe31b6 100644
--- a/pkgs/by-name/fl/fluxcd/package.nix
+++ b/pkgs/by-name/fl/fluxcd/package.nix
@@ -9,10 +9,10 @@
 }:
 
 let
-  version = "2.9.4";
-  srcHash = "sha256-7Suhsg1tWn6gzkPDQT4BII0hTCM3HCCZTTtFVNumA9A=";
-  vendorHash = "sha256-3CMj5MI5cILnyWoWkcBzD5X626nsQ6nfipeqN35IQEk=";
-  manifestsHash = "sha256-+187K4w//AxtSYcrA3NoVCSFpTkjNqZmfOlbdzD9YmI=";
+  version = "2.9.5";
+  srcHash = "sha256-XHK9GkKyLLogtvahcf+hOvfyk2Bxp6kpWN977gOOkHM=";
+  vendorHash = "sha256-NRt/exSNjgBdFtj6ZsPk0ounwQGKZ4Ndpx8FsupdVNo=";
+  manifestsHash = "sha256-CncxZ/ADsKlLbCHI5kxcUT/WHlv3hYCfFFoqDIuqvMY=";
 
   manifests = fetchzip {
     url = "https://github.com/fluxcd/flux2/releases/download/v${version}/manifests.tar.gz";

From 13faf6a5267e080193bd10e063cfb31705705f46 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 3 Jul 2026 06:04:48 +0000
Subject: [PATCH 27/51] usbvfiod: 0.1.0 -> 0.2.0

(cherry picked from commit 3be6deec5e0610f92ecea64dd082fc6f960c2b0e)
---
 pkgs/by-name/us/usbvfiod/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/us/usbvfiod/package.nix b/pkgs/by-name/us/usbvfiod/package.nix
index 240990a780b0..5547c1948b70 100644
--- a/pkgs/by-name/us/usbvfiod/package.nix
+++ b/pkgs/by-name/us/usbvfiod/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "usbvfiod";
-  version = "0.1.0";
+  version = "0.2.0";
 
   src = fetchFromGitHub {
     owner = "cyberus-technology";
     repo = "usbvfiod";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-SG5S0wRue/G31XuR2D8xFrbAIhWG3rl+aNjEnhZ7dmI=";
+    hash = "sha256-gus0Bdsd0zUuhsAQ4I1Z/BphKOjAlmbpqND6W+6cNbg=";
   };
 
-  cargoHash = "sha256-nTNUC7Tiib2wWYC1g7S1W7wgIkqZLTN8aKUKjpgZlqo=";
+  cargoHash = "sha256-7RTaWi93WJV2HEVyljSzRVG+eCwo6+Ywq4Y+ng1UMww=";
 
   nativeInstallCheckInputs = [
     versionCheckHook

From d0370e7edc84e6f573a0b8480eeadd537c093027 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Sep 2026 03:15:58 +0000
Subject: [PATCH 28/51] usbvfiod: 0.2.0 -> 0.3.0

(cherry picked from commit 4f0ae3f517111024ebaedd4cd85535772466c379)
---
 pkgs/by-name/us/usbvfiod/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/us/usbvfiod/package.nix b/pkgs/by-name/us/usbvfiod/package.nix
index 5547c1948b70..706b04da98aa 100644
--- a/pkgs/by-name/us/usbvfiod/package.nix
+++ b/pkgs/by-name/us/usbvfiod/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "usbvfiod";
-  version = "0.2.0";
+  version = "0.3.0";
 
   src = fetchFromGitHub {
     owner = "cyberus-technology";
     repo = "usbvfiod";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-gus0Bdsd0zUuhsAQ4I1Z/BphKOjAlmbpqND6W+6cNbg=";
+    hash = "sha256-gYKWmUaB7c5netQjR7qHKuBq82X3J+o4gQCsB/3cq50=";
   };
 
-  cargoHash = "sha256-7RTaWi93WJV2HEVyljSzRVG+eCwo6+Ywq4Y+ng1UMww=";
+  cargoHash = "sha256-B4iyADjXjX7VdGaTIdCKUalwJt6vMVnqqUCyLsu5wUI=";
 
   nativeInstallCheckInputs = [
     versionCheckHook

From ad99acaa74005f8ae3dc8e45c432d256e46f1036 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Wed, 16 Sep 2026 07:36:44 +1000
Subject: [PATCH 29/51] linux/common-config: fix MEMORY_HOTPLUG_DEFAULT_ONLINE
 on 6.12

https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/mm/Kconfig?id=f7c7d3cc8417f8579b5a90e3f6319703951070c2

> Existing users of CONFIG_MEMORY_HOTPLUG_DEFAULT_ONLINE=y should use
> CONFIG_MHP_DEFAULT_ONLINE_TYPE_ONLINE_AUTO.

was backported in https://cdn.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.12.110

(cherry picked from commit 6dc4fd392217a9802cfcf8a5deb717ec5520f9ca)
---
 pkgs/os-specific/linux/kernel/common-config.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/common-config.nix b/pkgs/os-specific/linux/kernel/common-config.nix
index 3965a361637b..94d9f55743a1 100644
--- a/pkgs/os-specific/linux/kernel/common-config.nix
+++ b/pkgs/os-specific/linux/kernel/common-config.nix
@@ -1498,8 +1498,8 @@ let
             ACPI_HOTPLUG_CPU = yes;
             ACPI_HOTPLUG_MEMORY = yes;
             MEMORY_HOTPLUG = yes;
-            MEMORY_HOTPLUG_DEFAULT_ONLINE = whenOlder "6.14" yes;
-            MHP_DEFAULT_ONLINE_TYPE_ONLINE_AUTO = whenAtLeast "6.14" yes;
+            MEMORY_HOTPLUG_DEFAULT_ONLINE = whenOlder "6.12" yes;
+            MHP_DEFAULT_ONLINE_TYPE_ONLINE_AUTO = whenAtLeast "6.12" yes;
             MEMORY_HOTREMOVE = lib.mkIf (
               with stdenv.hostPlatform;
               isLoongArch64

From c1cbe0cb6b78a6b3a11805f600b9b3d16c2f0f0b Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Mon, 10 Aug 2026 20:16:56 -0400
Subject: [PATCH 30/51] vikunja: build veans package

(cherry picked from commit 2280f2bb2a14b3b6448f7df9ad66f3e06d1ab22b)
---
 pkgs/by-name/vi/vikunja/package.nix | 16 +++++++--
 pkgs/by-name/vi/vikunja/update.sh   | 53 -----------------------------
 pkgs/by-name/vi/vikunja/veans.nix   | 34 ++++++++++++++++++
 3 files changed, 47 insertions(+), 56 deletions(-)
 delete mode 100755 pkgs/by-name/vi/vikunja/update.sh
 create mode 100644 pkgs/by-name/vi/vikunja/veans.nix

diff --git a/pkgs/by-name/vi/vikunja/package.nix b/pkgs/by-name/vi/vikunja/package.nix
index 684b72a32d15..676747e6b222 100644
--- a/pkgs/by-name/vi/vikunja/package.nix
+++ b/pkgs/by-name/vi/vikunja/package.nix
@@ -1,5 +1,6 @@
 {
   lib,
+  callPackage,
   fetchFromGitHub,
   stdenv,
   nodejs_24,
@@ -11,6 +12,7 @@
   dart-sass,
   writeShellScriptBin,
   nixosTests,
+  nix-update-script,
 }:
 
 let
@@ -82,7 +84,7 @@ let
       }' ${file}
     '';
 in
-buildGoModule {
+buildGoModule (finalAttrs: {
   inherit src version;
   pname = "vikunja";
 
@@ -105,6 +107,7 @@ buildGoModule {
   vendorHash = "sha256-bn+bcGzeB0/KkhPNkbjK/EgKQG3iqVlJxtt6betGUNE=";
 
   inherit frontend;
+  veans = callPackage ./veans.nix { inherit (finalAttrs) src version meta; };
 
   prePatch = ''
     cp -r ${frontend} frontend/dist
@@ -143,7 +146,14 @@ buildGoModule {
   passthru = {
     tests.vikunja = nixosTests.vikunja;
     frontend = frontend;
-    updateScript = ./update.sh;
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--subpackage"
+        "frontend"
+        "--subpackage"
+        "veans"
+      ];
+    };
   };
 
   meta = {
@@ -158,4 +168,4 @@ buildGoModule {
     mainProgram = "vikunja";
     platforms = lib.platforms.linux;
   };
-}
+})
diff --git a/pkgs/by-name/vi/vikunja/update.sh b/pkgs/by-name/vi/vikunja/update.sh
deleted file mode 100755
index 1c09f61cb0f6..000000000000
--- a/pkgs/by-name/vi/vikunja/update.sh
+++ /dev/null
@@ -1,53 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p nix wget jq nurl
-
-# shellcheck shell=bash
-
-set -euo pipefail
-
-if [[ $# -gt 1 || "${1:-}" == -* ]]; then
-    echo "Regenerates packaging data for the vikunja package."
-    echo "Usage: $0 [version]"
-    exit 1
-fi
-
-version="${1:-}"
-
-NIXPKGS_ROOT="$(git rev-parse --show-toplevel)"
-
-if [ -z "$version" ]; then
-    TOKEN_ARGS=()
-    if [ -n "${GITHUB_TOKEN:-}" ]; then
-        TOKEN_ARGS=(--header "Authorization: token $GITHUB_TOKEN")
-    fi
-    version="$(wget -q -O- ${TOKEN_ARGS[@]+"${TOKEN_ARGS[@]}"} "https://api.github.com/repos/go-vikunja/vikunja/releases?per_page=10" | jq -r '[.[] | select(.prerelease == false)][0].tag_name')"
-fi
-
-# strip leading "v"
-version="${version#v}"
-
-cd "$(dirname "$0")"
-
-# Update version, blank out all hashes so nurl can recompute them
-sed -i -E 's#version = ".*"#version = "'"$version"'"#' package.nix
-sed -i -E '/fetchFromGitHub \{/,/\};/ s#hash = ".*"#hash = ""#' package.nix
-sed -i -E '/fetchPnpmDeps \{/,/\};/ s#hash = ".*"#hash = ""#' package.nix
-sed -i -E 's#vendorHash = ".*"#vendorHash = ""#' package.nix
-
-# Source hash (must be computed first, pnpm and vendor depend on it)
-src_hash=$(nurl -e "(import $NIXPKGS_ROOT/. { }).vikunja.src")
-sed -i -E '/fetchFromGitHub \{/,/\};/ s#hash = ".*"#hash = "'"$src_hash"'"#' package.nix
-
-# pnpm dependencies hash for frontend
-pnpm_hash=$(nurl -e "(import $NIXPKGS_ROOT/. { }).vikunja.frontend.pnpmDeps")
-sed -i -E '/fetchPnpmDeps \{/,/\};/ s#hash = ".*"#hash = "'"$pnpm_hash"'"#' package.nix
-
-# Go modules vendor hash
-vendor_hash=$(nurl -e "(import $NIXPKGS_ROOT/. { }).vikunja.goModules")
-sed -i -E 's#vendorHash = ".*"#vendorHash = "'"$vendor_hash"'"#' package.nix
-
-echo "Update complete!"
-echo "Version: $version"
-echo "Source hash: $src_hash"
-echo "Frontend pnpm hash: $pnpm_hash"
-echo "Go vendor hash: $vendor_hash"
diff --git a/pkgs/by-name/vi/vikunja/veans.nix b/pkgs/by-name/vi/vikunja/veans.nix
new file mode 100644
index 000000000000..a5092462871c
--- /dev/null
+++ b/pkgs/by-name/vi/vikunja/veans.nix
@@ -0,0 +1,34 @@
+{
+  meta,
+  src,
+  version,
+
+  buildGoModule,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "veans";
+  inherit src version;
+
+  __structuredAttrs = true;
+
+  modRoot = "veans";
+
+  vendorHash = "sha256-4Ayug+r7sWL/JZI8fGCyDZ1SaTwCvSWrQpqv7uYCHhc=";
+
+  env.CGO_ENABLED = 0;
+
+  ldflags = [
+    "-s"
+    "-X main.version=v${finalAttrs.version}"
+  ];
+
+  # needs a running vikunja instance
+  doCheck = false;
+
+  meta = meta // {
+    description = "A beans-shaped CLI for Vikunja";
+    homepage = "https://vikunja.io/docs/veans/";
+    mainProgram = "veans";
+  };
+})

From 9823eb6af07dfe4cb8b837e238fda469396d89bf Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Mon, 31 Aug 2026 22:27:43 -0400
Subject: [PATCH 31/51] vikunja: 2.5.0 -> 2.6.0

Changelog: https://github.com/go-vikunja/vikunja/blob/v2.6.0/CHANGELOG.md
(cherry picked from commit af7a99386b78c55d803e285bef8cd357cb6bd3da)
---
 pkgs/by-name/vi/vikunja/frontend.nix |  68 +++++++++++++++++
 pkgs/by-name/vi/vikunja/package.nix  | 107 +++++++++------------------
 pkgs/by-name/vi/vikunja/veans.nix    |   2 +-
 3 files changed, 104 insertions(+), 73 deletions(-)
 create mode 100644 pkgs/by-name/vi/vikunja/frontend.nix

diff --git a/pkgs/by-name/vi/vikunja/frontend.nix b/pkgs/by-name/vi/vikunja/frontend.nix
new file mode 100644
index 000000000000..96ee618d35ed
--- /dev/null
+++ b/pkgs/by-name/vi/vikunja/frontend.nix
@@ -0,0 +1,68 @@
+{
+  src,
+  version,
+
+  lib,
+  stdenv,
+  nodejs_24,
+  pnpm_10,
+  fetchPnpmDeps,
+  pnpmConfigHook,
+  dart-sass,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "vikunja-frontend";
+  inherit version src;
+
+  sourceRoot = "${finalAttrs.src.name}/frontend";
+
+  pnpmDeps = fetchPnpmDeps {
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      sourceRoot
+      ;
+    pnpm = pnpm_10;
+    fetcherVersion = 3;
+    hash = "sha256-aQWTzJZU6NJrZxuoCeQDJjujPq+niixmFvqtPdWS4wk=";
+  };
+
+  nativeBuildInputs = [
+    nodejs_24
+    dart-sass
+    pnpmConfigHook
+    pnpm_10
+  ];
+
+  postPatch = ''
+    substituteInPlace src/version.json \
+      --replace-fail '"dev"' '"${finalAttrs.version}"'
+  '';
+
+  postBuild = ''
+    # Force sass-embedded to use our dart-sass instead of bundled binaries.
+    substituteInPlace node_modules/sass-embedded/dist/lib/src/compiler-path.js \
+      --replace-fail 'compilerCommand = (() => {' 'compilerCommand = (() => { return ["${lib.getExe dart-sass}"];'
+    pnpm run build
+  '';
+
+  doCheck = true;
+
+  checkPhase = ''
+    runHook preCheck
+
+    pnpm run test:unit --run
+
+    runHook postCheck
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    cp -r dist/ $out
+
+    runHook postInstall
+  '';
+})
diff --git a/pkgs/by-name/vi/vikunja/package.nix b/pkgs/by-name/vi/vikunja/package.nix
index 676747e6b222..2d838dd52a0a 100644
--- a/pkgs/by-name/vi/vikunja/package.nix
+++ b/pkgs/by-name/vi/vikunja/package.nix
@@ -2,75 +2,16 @@
   lib,
   callPackage,
   fetchFromGitHub,
-  stdenv,
-  nodejs_24,
-  pnpm_10,
-  fetchPnpmDeps,
-  pnpmConfigHook,
-  buildGoModule,
+  buildGo127Module,
   mage,
-  dart-sass,
+  writableTmpDirAsHomeHook,
   writeShellScriptBin,
   nixosTests,
   nix-update-script,
 }:
 
 let
-  version = "2.5.0";
-  src = fetchFromGitHub {
-    owner = "go-vikunja";
-    repo = "vikunja";
-    rev = "v${version}";
-    hash = "sha256-qI4mkgcN9yYRmh5V+KzIHupX7uWsszV4Xb31OYvukxQ=";
-  };
-
-  frontend = stdenv.mkDerivation (finalAttrs: {
-    pname = "vikunja-frontend";
-    inherit version src;
-
-    sourceRoot = "${finalAttrs.src.name}/frontend";
-
-    pnpmDeps = fetchPnpmDeps {
-      inherit (finalAttrs)
-        pname
-        version
-        src
-        sourceRoot
-        ;
-      pnpm = pnpm_10;
-      fetcherVersion = 3;
-      hash = "sha256-xZBgE4GM59Ihl5a3qgcmkjR4Q3wYlcsiDapiNEzBQOg=";
-    };
-
-    nativeBuildInputs = [
-      nodejs_24
-      dart-sass
-      pnpmConfigHook
-      pnpm_10
-    ];
-
-    postPatch = ''
-      substituteInPlace src/version.json \
-        --replace-fail '"dev"' '"${finalAttrs.version}"'
-    '';
-
-    doCheck = true;
-
-    postBuild = ''
-      # Force sass-embedded to use our dart-sass instead of bundled binaries.
-      substituteInPlace node_modules/sass-embedded/dist/lib/src/compiler-path.js \
-        --replace-fail 'compilerCommand = (() => {' 'compilerCommand = (() => { return ["${lib.getExe dart-sass}"];'
-      pnpm run build
-    '';
-
-    checkPhase = ''
-      pnpm run test:unit --run
-    '';
-
-    installPhase = ''
-      cp -r dist/ $out
-    '';
-  });
+  buildGoModule = buildGo127Module;
 
   # Injects a `t.Skip()` into a given test since there's apparently no other way to skip tests here.
   skipTest =
@@ -85,14 +26,21 @@ let
     '';
 in
 buildGoModule (finalAttrs: {
-  inherit src version;
   pname = "vikunja";
+  version = "2.6.0";
+
+  src = fetchFromGitHub {
+    owner = "go-vikunja";
+    repo = "vikunja";
+    rev = "v${finalAttrs.version}";
+    hash = "sha256-Xh1ozUTOVqywk0i8xQWkG/bPRgPH9EABjRW8p4do1mE=";
+  };
 
   nativeBuildInputs =
     let
       fakeGit = writeShellScriptBin "git" ''
         if [[ $@ = "describe --tags --always --abbrev=10" ]]; then
-            echo "${version}"
+            echo "${finalAttrs.version}"
         else
             >&2 echo "Unknown command: $@"
             exit 1
@@ -102,15 +50,23 @@ buildGoModule (finalAttrs: {
     [
       fakeGit
       mage
+      # mage wants to write some files to HOME
+      writableTmpDirAsHomeHook
     ];
 
-  vendorHash = "sha256-bn+bcGzeB0/KkhPNkbjK/EgKQG3iqVlJxtt6betGUNE=";
+  vendorHash = "sha256-R6M5UyF10pIdoAvjWnS6Dqe/U6LTxmS6OwRTgmxfU4g=";
 
-  inherit frontend;
-  veans = callPackage ./veans.nix { inherit (finalAttrs) src version meta; };
+  frontend = callPackage ./frontend.nix {
+    inherit (finalAttrs) src version;
+  };
+
+  veans = callPackage ./veans.nix {
+    inherit (finalAttrs) src version meta;
+    inherit buildGoModule;
+  };
 
   prePatch = ''
-    cp -r ${frontend} frontend/dist
+    cp -r ${finalAttrs.frontend} frontend/dist
   '';
 
   postConfigure = ''
@@ -125,27 +81,34 @@ buildGoModule (finalAttrs: {
   buildPhase = ''
     runHook preBuild
 
-    # Fixes "mkdir /homeless-shelter: permission denied" - "Error: error compiling magefiles" during build
-    export HOME=$(mktemp -d)
     mage build:build
 
     runHook postBuild
   '';
 
   checkPhase = ''
+    runHook preCheck
+
     mage test:feature
     mage test:web
+
+    runHook postCheck
   '';
 
   installPhase = ''
     runHook preInstall
+
     install -Dt $out/bin vikunja
+
     runHook postInstall
   '';
 
   passthru = {
+    # used by vikunja-desktop
+    inherit (finalAttrs) frontend;
+
     tests.vikunja = nixosTests.vikunja;
-    frontend = frontend;
+
     updateScript = nix-update-script {
       extraArgs = [
         "--subpackage"
@@ -157,7 +120,7 @@ buildGoModule (finalAttrs: {
   };
 
   meta = {
-    changelog = "https://github.com/go-vikunja/vikunja/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/go-vikunja/vikunja/blob/v${finalAttrs.version}/CHANGELOG.md";
     description = "Todo-app to organize your life";
     homepage = "https://vikunja.io/";
     license = lib.licenses.agpl3Plus;
diff --git a/pkgs/by-name/vi/vikunja/veans.nix b/pkgs/by-name/vi/vikunja/veans.nix
index a5092462871c..d5917a71d603 100644
--- a/pkgs/by-name/vi/vikunja/veans.nix
+++ b/pkgs/by-name/vi/vikunja/veans.nix
@@ -14,7 +14,7 @@ buildGoModule (finalAttrs: {
 
   modRoot = "veans";
 
-  vendorHash = "sha256-4Ayug+r7sWL/JZI8fGCyDZ1SaTwCvSWrQpqv7uYCHhc=";
+  vendorHash = "sha256-ac2M7wNlOn6ku8sn/rZmPCSGPodw88ufR8tr1lh54II=";
 
   env.CGO_ENABLED = 0;
 

From 81f242c184f9a337efccfc149f720e88a43365e4 Mon Sep 17 00:00:00 2001
From: mfukuba <12195032+mfukuba@users.noreply.github.com>
Date: Tue, 14 Jul 2026 15:52:01 +0900
Subject: [PATCH 32/51] ruby_4_0: 4.0.5 -> 4.0.6

https://github.com/ruby/ruby/releases/tag/v4.0.6
(cherry picked from commit b1811846e82b31ddaf7d385634b0619b942ac868)
---
 pkgs/development/interpreters/ruby/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index e6eae5b7f7d2..87565c7fb650 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -411,8 +411,8 @@ in
   };
 
   ruby_4_0 = generic {
-    version = rubyVersion "4" "0" "5" "";
-    hash = "sha256-fWFJB5pj+K4dMmyfplxgGbotwxVerns5FZgXkRyIlY4=";
+    version = rubyVersion "4" "0" "6" "";
+    hash = "sha256-g30pno993yvjGiKaen4BnTVJeYJRF5iayzsysam+Jio=";
     cargoHash = "sha256-z7NwWc4TaR042hNx0xgRkh/BQEpEJtE53cfrN0qNiE0=";
   };
 

From eed2bfa1efc1005c958e682c917dbcad7f21f6fb Mon Sep 17 00:00:00 2001
From: mfukuba <12195032+mfukuba@users.noreply.github.com>
Date: Tue, 15 Sep 2026 10:07:28 +0900
Subject: [PATCH 33/51] ruby_4_0: 4.0.6 -> 4.0.7

https://github.com/ruby/ruby/releases/tag/v4.0.7
(cherry picked from commit 588b7f927a51848e0119ec2a5b43830d98d97082)
---
 pkgs/development/interpreters/ruby/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/ruby/default.nix b/pkgs/development/interpreters/ruby/default.nix
index 87565c7fb650..4d8406f5f113 100644
--- a/pkgs/development/interpreters/ruby/default.nix
+++ b/pkgs/development/interpreters/ruby/default.nix
@@ -411,8 +411,8 @@ in
   };
 
   ruby_4_0 = generic {
-    version = rubyVersion "4" "0" "6" "";
-    hash = "sha256-g30pno993yvjGiKaen4BnTVJeYJRF5iayzsysam+Jio=";
+    version = rubyVersion "4" "0" "7" "";
+    hash = "sha256-kRrOIPkNBoyg5N2m0OTw+B5S5S8t1PQATHIeJTQS6C0=";
     cargoHash = "sha256-z7NwWc4TaR042hNx0xgRkh/BQEpEJtE53cfrN0qNiE0=";
   };
 

From b241cff1a82f1afe4d6e7b64077ae169e7d1e467 Mon Sep 17 00:00:00 2001
From: Kerstin Humm <kerstin@erictapen.name>
Date: Wed, 16 Sep 2026 11:04:08 +0200
Subject: [PATCH 34/51] vouch-proxy: patch CVE-2026-55149

Closes https://github.com/NixOS/nixpkgs/issues/563819
---
 pkgs/by-name/vo/vouch-proxy/package.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/vo/vouch-proxy/package.nix b/pkgs/by-name/vo/vouch-proxy/package.nix
index a61b99f7790f..b88fe8d4b7e3 100644
--- a/pkgs/by-name/vo/vouch-proxy/package.nix
+++ b/pkgs/by-name/vo/vouch-proxy/package.nix
@@ -2,6 +2,7 @@
   lib,
   buildGoModule,
   fetchFromGitHub,
+  fetchpatch,
 }:
 
 buildGoModule (finalAttrs: {
@@ -15,6 +16,14 @@ buildGoModule (finalAttrs: {
     hash = "sha256-xI9xucRb2D2a1Fvp5DetB4ln3C020qSGEVnuIpy1TMI=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2026-55149.patch";
+      url = "https://github.com/vouch/vouch-proxy/commit/fa18ce30ba50a4863a436acad044c22965329c4f.patch";
+      hash = "sha256-hhjqt23BIF4ZU1GswRRDnWNbSV0Wa1wpboYRfRyaaco=";
+    })
+  ];
+
   vendorHash = "sha256-hieN3RJA0eBqlYxJj6hKgpQhq8s3vg/fPzxW0XSrlPA=";
 
   ldflags = [

From dc3a73752b24e5c204ed635cc9b6898a35bacc8c Mon Sep 17 00:00:00 2001
From: BatteredBunny <ayes2022@protonmail.com>
Date: Mon, 14 Sep 2026 21:02:06 +0300
Subject: [PATCH 35/51] python3Packages.exllamav3: 1.4.8 -> 1.5.0

(cherry picked from commit 5c7097d108c626b1866208fba429482f86bf2f4f)
---
 .../python-modules/exllamav3/default.nix      | 24 +++++++++++++------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/pkgs/development/python-modules/exllamav3/default.nix b/pkgs/development/python-modules/exllamav3/default.nix
index 6ec0b3169923..59301c5686e0 100644
--- a/pkgs/development/python-modules/exllamav3/default.nix
+++ b/pkgs/development/python-modules/exllamav3/default.nix
@@ -22,18 +22,28 @@
   typing-extensions,
 }:
 let
-  newerThanTuring = lib.filter (version: lib.versionOlder "7.9" version) torch.cudaCapabilities;
+  # https://github.com/turboderp-org/exllamav3/blob/master/.github/workflows/build.yml#L55
+  # https://github.com/turboderp-org/exllamav3/issues/44
+  # Using unsupported platforms the build will fail
+  cudaCapabilities = lib.intersectLists torch.cudaCapabilities [
+    "8.0"
+    "8.6"
+    "8.9"
+    "9.0"
+    "10.0"
+    "12.0"
+  ];
 in
 buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
   pname = "exllamav3";
-  version = "1.4.8";
+  version = "1.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "turboderp-org";
     repo = "exllamav3";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-CnbJR5rsHzNEeQBJLdD7LGrrTgy+GKpvop1R4uY4d8U=";
+    hash = "sha256-gW6A2nWx3lumnJz7r7vxQyC1qM9Agqdr0DiL68yJvAI=";
   };
 
   pythonRelaxDeps = [
@@ -57,7 +67,7 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
   ];
 
   dependencies = [
-    flash-linear-attention
+    flash-linear-attention # Upstream vendors it instead
     llguidance
     marisa-trie
     numpy
@@ -73,9 +83,9 @@ buildPythonPackage.override { inherit (torch) stdenv; } (finalAttrs: {
 
   env = lib.optionalAttrs torch.cudaSupport {
     CUDA_HOME = lib.getDev cudaPackages.cuda_nvcc;
-    # exllamav3 only supports turing or newer GPUs
-    # https://github.com/turboderp-org/exllamav3/issues/44
-    TORCH_CUDA_ARCH_LIST = lib.concatStringsSep ";" newerThanTuring;
+    TORCH_CUDA_ARCH_LIST = lib.concatStringsSep ";" (
+      cudaCapabilities ++ [ "${lib.last cudaCapabilities}+PTX" ]
+    );
   };
 
   pythonImportsCheck = [ "exllamav3" ];

From 0a1db4059c8e01c9570ac6cfdb1d0b8800feddb9 Mon Sep 17 00:00:00 2001
From: BatteredBunny <ayes2022@protonmail.com>
Date: Mon, 14 Sep 2026 21:02:26 +0300
Subject: [PATCH 36/51] tabbyapi: 0-unstable-2026-09-07 ->
 0-unstable-2026-09-14

(cherry picked from commit 6be6cc9ccfba4fb83d2ce2e9bee280117a06ef0a)
---
 pkgs/by-name/ta/tabbyapi/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ta/tabbyapi/package.nix b/pkgs/by-name/ta/tabbyapi/package.nix
index 74fcf6722359..58a6e39e1a23 100644
--- a/pkgs/by-name/ta/tabbyapi/package.nix
+++ b/pkgs/by-name/ta/tabbyapi/package.nix
@@ -7,14 +7,14 @@
 }:
 python3Packages.buildPythonApplication {
   pname = "tabbyapi";
-  version = "0-unstable-2026-09-07";
+  version = "0-unstable-2026-09-14";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "theroyallab";
     repo = "tabbyAPI";
-    rev = "92198cca1aa48f83121027f5b9058c24d7c2d894";
-    hash = "sha256-IQDsfTnIcaVmxk58Q8StEPS4O7LQwPVie6b04BWoeeQ=";
+    rev = "53da7919d4e45c63f4acbcbbc00cbe0f60a1ce65";
+    hash = "sha256-oKVxMoyMWZCuwLbsimTXO05Hdsw/2u2SVeYSFm1XsFg=";
   };
 
   build-system = with python3Packages; [

From 84be6735ebd2920deadfcb2945c696fb8d027557 Mon Sep 17 00:00:00 2001
From: BatteredBunny <ayes2022@protonmail.com>
Date: Mon, 14 Sep 2026 20:50:08 +0300
Subject: [PATCH 37/51] feishin: 1.15.1 -> 1.17.0

(cherry picked from commit f302f038e18197322dd02877e1d02d36f3d1cd20)
---
 pkgs/by-name/fe/feishin/package.nix | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/fe/feishin/package.nix b/pkgs/by-name/fe/feishin/package.nix
index 094111c60555..07763edfe439 100644
--- a/pkgs/by-name/fe/feishin/package.nix
+++ b/pkgs/by-name/fe/feishin/package.nix
@@ -8,7 +8,6 @@
   fetchPnpmDeps,
   pnpmConfigHook,
   pnpm_11,
-  nodejs-slim_latest,
   darwin,
   actool,
   copyDesktopItems,
@@ -20,18 +19,17 @@
 let
   electron = electron_43;
 
-  # Fix pnpm issue on darwin https://github.com/NixOS/nixpkgs/issues/525627
-  pnpm = pnpm_11.override { nodejs-slim = nodejs-slim_latest; };
+  pnpm = pnpm_11;
 in
 buildNpmPackage (finalAttrs: {
   pname = "feishin";
-  version = "1.15.1";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "jeffvli";
     repo = "feishin";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-2UKJBUZNUpUUZIG1JFXok7YJdzqt+Ge0ykHUm8BeNcw=";
+    hash = "sha256-1ZIw5XiN+2EhpHmdvN0HxgMSvn4QvN9B+ZJ3RlPXhLw=";
   };
 
   __structuredAttrs = true;
@@ -48,7 +46,7 @@ buildNpmPackage (finalAttrs: {
       src
       ;
     fetcherVersion = 4;
-    hash = "sha256-9uG0AxIBAmuIPywg3p9fFCXmRvM9zDLhWfluSLRnUXY=";
+    hash = "sha256-ltpz4e5Vv2vxt/93M4+vHUFJZjwTRwb2zrwvl1Lqjo8=";
   };
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
@@ -65,7 +63,7 @@ buildNpmPackage (finalAttrs: {
   postPatch = ''
     # release/app dependencies are installed on preConfigure
     substituteInPlace package.json \
-      --replace-fail '"postinstall": "electron-builder install-app-deps",' ""
+      --replace-fail '"postinstall": "install-electron && electron-builder install-app-deps",' ""
   '';
 
   postBuild = lib.optionalString (!webVersion) ''

From d29060a149078ab43c4389460c5cd2feec2dc090 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 14 Sep 2026 20:54:48 +0000
Subject: [PATCH 38/51] turtle-build: 0.4.9 -> 0.5.1

(cherry picked from commit e0e203e09c6e73f81364a0629e8611dcd094b025)
---
 pkgs/by-name/tu/turtle-build/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/tu/turtle-build/package.nix b/pkgs/by-name/tu/turtle-build/package.nix
index 03962bdf8073..65ce7f1146a9 100644
--- a/pkgs/by-name/tu/turtle-build/package.nix
+++ b/pkgs/by-name/tu/turtle-build/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "turtle-build";
-  version = "0.4.9";
+  version = "0.5.1";
 
   src = fetchFromGitHub {
     owner = "raviqqe";
     repo = "turtle-build";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-sbYDp4r/M6GvCYEshccJ331mVNeN85wwf9TKHiYFv7I=";
+    hash = "sha256-0WqFflD6WgCyKREOfAdx+NDrFhQlGMhNmEjf9dBdtNo=";
   };
 
-  cargoHash = "sha256-JZU0Xam4NPiOHdXDtJsTBjOQnaDWReSZMD33sQxeUzQ=";
+  cargoHash = "sha256-DCZZHkg+mk10aGpgz/XvE1hyl+qDR2KELqxxjVeP0ps=";
 
   doInstallCheck = true;
   nativeInstallCheckInputs = [ versionCheckHook ];

From ad9bf6ee59ebee7ded24f758f2c82713b4e0db4d Mon Sep 17 00:00:00 2001
From: fliiiix <hi@l33t.name>
Date: Fri, 14 Aug 2026 09:12:51 +0200
Subject: [PATCH 39/51] qtcreator: 19.0.1 -> 20.0.1

(cherry picked from commit bb2d51d1d6ace75f4c953b080bd2d31e7e04dff0)
---
 pkgs/by-name/qt/qtcreator/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/qt/qtcreator/package.nix b/pkgs/by-name/qt/qtcreator/package.nix
index 1eb30a7702cc..332dc2b396a9 100644
--- a/pkgs/by-name/qt/qtcreator/package.nix
+++ b/pkgs/by-name/qt/qtcreator/package.nix
@@ -21,10 +21,10 @@
 }:
 let
   pname = "qtcreator";
-  version = "19.0.1";
+  version = "20.0.1";
   src = fetchurl {
     url = "mirror://qt/official_releases/${pname}/${lib.versions.majorMinor version}/${version}/qt-creator-opensource-src-${version}.tar.xz";
-    hash = "sha256-IAVmOmlQOyQETf7QdwajTETKvBn0dqwcEUTe8cSr+r4=";
+    hash = "sha256-XsO8zwbumhkFqHYKyfunoShWcvFAqX4MUsniSNkFGrg=";
   };
   goModules =
     (buildGoModule {
@@ -130,6 +130,7 @@ stdenv'.mkDerivation {
     maintainers = with lib.maintainers; [
       wineee
       zatm8
+      l33tname
     ];
     platforms = lib.platforms.linux;
     mainProgram = "qtcreator";

From d5f2775d6a32b1a3728be801534352a45e339efd Mon Sep 17 00:00:00 2001
From: emilylange <git@emilylange.de>
Date: Tue, 15 Sep 2026 23:30:36 +0200
Subject: [PATCH 40/51] chromium,chromedriver: 153.0.8010.36 -> 153.0.8010.47

https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html

This update includes 42 security fixes.

CVEs:
CVE-2026-91726 CVE-2026-91721 CVE-2026-91749 CVE-2026-91724
CVE-2026-91728 CVE-2026-91734 CVE-2026-91727 CVE-2026-91743
CVE-2026-91744 CVE-2026-91712 CVE-2026-91748 CVE-2026-91720
CVE-2026-91731 CVE-2026-91747 CVE-2026-91733 CVE-2026-91741
CVE-2026-91709 CVE-2026-91717 CVE-2026-91735 CVE-2026-91708
CVE-2026-91736 CVE-2026-91740 CVE-2026-91710 CVE-2026-91718
CVE-2026-91716 CVE-2026-91746 CVE-2026-91729 CVE-2026-91737
CVE-2026-91711 CVE-2026-91715 CVE-2026-91745 CVE-2026-91723
CVE-2026-91732 CVE-2026-91742 CVE-2026-91714 CVE-2026-91725
CVE-2026-91739 CVE-2026-91713 CVE-2026-91738 CVE-2026-91730
CVE-2026-91722 CVE-2026-91719

(cherry picked from commit 37e4c5dee5ef9042ce225d1800a0e7808a8aeece)
---
 .../networking/browsers/chromium/info.json    | 32 +++++++++----------
 1 file changed, 16 insertions(+), 16 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index 2cb44de16b16..4884943dedfe 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -1,10 +1,10 @@
 {
   "chromium": {
-    "version": "153.0.8010.36",
+    "version": "153.0.8010.47",
     "chromedriver": {
-      "version": "153.0.8010.37",
-      "hash_darwin": "sha256-IMyEnUmK3slNB/QDZ+vtUyzHyU0AB+L6+BMbpCRluYA=",
-      "hash_darwin_aarch64": "sha256-cd1ZWatLQFIkPtCdVacrxFaFfj3rjG9qJ7kGlL3C6OA="
+      "version": "153.0.8010.48",
+      "hash_darwin": "sha256-/4yv3KWuvKNAro9oeK+PFsTOrg878yS11aDYSX5S890=",
+      "hash_darwin_aarch64": "sha256-5eO1WwJ8iQrXUjHb776Z1YahR/A8aCoX7JrJXQEcIQ8="
     },
     "deps": {
       "depot_tools": {
@@ -21,8 +21,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "507c6ee3e2f3b2ca0e660547e5b9ea4820c67f4c",
-        "hash": "sha256-q29a3PWQ7wMG4/JL9EyCK7EaDCeG+4Q/ruemOvvgeZM=",
+        "rev": "73934a44f61e6b3878d1943064c141a5a820f5f7",
+        "hash": "sha256-D7Oqukze3CzYVWN9AQq9zN6HN2GcZ6b7ZSqhM5bjvUU=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -92,8 +92,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "fca5efdfeff5daf430bc4458375c8d6b7e457400",
-        "hash": "sha256-IoHQfdjZ6TV03VVzHZcxhPqGmNYNhKZrPG4BvQQfC7c="
+        "rev": "ed04c8113c6538f3e1264042da8cb4afd100369b",
+        "hash": "sha256-mZrVJ/P3tPoiSkGBH4fEjNAexLsjAzts8jjkCQZ4kOs="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -132,8 +132,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "225a7ba1bcb997d26de3e894e04fb341638e8c5a",
-        "hash": "sha256-/ic1j1gu2wl5wCLCESfEcsLAPU5Dmsx8oKFb6RhYzg4="
+        "rev": "28ffc61fc935c599677cff4dddfa4a12209ce500",
+        "hash": "sha256-6ySDyyQs/nfFF9AeoUY57GYDx7V8b0GQ17PCwQkzZVk="
       },
       "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -632,8 +632,8 @@
       },
       "src/third_party/pthreadpool/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/pthreadpool.git",
-        "rev": "02460584c6092e527c8b89f7df4de143d70e801f",
-        "hash": "sha256-4EHJzZT+Gbhs8SkOhjSvDIPEqIQU93oJmtF3c/T+qjw="
+        "rev": "15a6644ba1c45f1acc16ac1e883efc3e56c6bed2",
+        "hash": "sha256-YJD9n8cxoqTrTQJHKuZFW2qnlNcNmh5rQlBpnlF46to="
       },
       "src/third_party/pyelftools": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git",
@@ -672,8 +672,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "4f574af2444846ceca4d277a8095c5d4229d175f",
-        "hash": "sha256-HrpA4labNWXPWj/yiS9O8KjdQPwJOllmR5r66TwCjB0="
+        "rev": "fca11a08da7c1ed3777b40b31611961c85c63c43",
+        "hash": "sha256-iQNNgvRVUuyAcSVE+pNJWrWz0NJd/MZLxd9vbYztong="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -842,8 +842,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "f343157cebb388bfa416baccb5d35507e6fe8cc7",
-        "hash": "sha256-zSCyFQpDMNygmV6N4TajL8VB5+VRynrMPV/wAiWsJO4="
+        "rev": "6b96683d44174e78ff4e65cb274bad56dc108231",
+        "hash": "sha256-Oa1wzIbWVPX0x7adJVPUxQocK5gofG0vE56QTg0XKCs="
       },
       "src/agents/shared": {
         "url": "https://chromium.googlesource.com/chromium/agents.git",

From c2d641dd31e9fbe3b4d23a7fdadcf1646f92c2ff Mon Sep 17 00:00:00 2001
From: emilylange <git@emilylange.de>
Date: Wed, 16 Sep 2026 02:05:39 +0200
Subject: [PATCH 41/51] ungoogled-chromium: 153.0.8010.36-1 -> 153.0.8010.47-1

https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0541751186.html

This update includes 42 security fixes.

CVEs:
CVE-2026-91726 CVE-2026-91721 CVE-2026-91749 CVE-2026-91724
CVE-2026-91728 CVE-2026-91734 CVE-2026-91727 CVE-2026-91743
CVE-2026-91744 CVE-2026-91712 CVE-2026-91748 CVE-2026-91720
CVE-2026-91731 CVE-2026-91747 CVE-2026-91733 CVE-2026-91741
CVE-2026-91709 CVE-2026-91717 CVE-2026-91735 CVE-2026-91708
CVE-2026-91736 CVE-2026-91740 CVE-2026-91710 CVE-2026-91718
CVE-2026-91716 CVE-2026-91746 CVE-2026-91729 CVE-2026-91737
CVE-2026-91711 CVE-2026-91715 CVE-2026-91745 CVE-2026-91723
CVE-2026-91732 CVE-2026-91742 CVE-2026-91714 CVE-2026-91725
CVE-2026-91739 CVE-2026-91713 CVE-2026-91738 CVE-2026-91730
CVE-2026-91722 CVE-2026-91719

(cherry picked from commit 885ed3ec18a9ef2706abe0be3fd3b0becd6294e7)
---
 .../networking/browsers/chromium/info.json    | 30 +++++++++----------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index 4884943dedfe..3641623861a7 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -853,7 +853,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "153.0.8010.36",
+    "version": "153.0.8010.47",
     "deps": {
       "depot_tools": {
         "rev": "6411ed52842756261c66b6b8ece6b53ade2570f1",
@@ -865,16 +865,16 @@
         "hash": "sha256-qvQ13Ws2tb4i2Hdu34kBHivYPAn8w06zjLdQgK4BIJg="
       },
       "ungoogled-patches": {
-        "rev": "153.0.8010.36-1",
-        "hash": "sha256-JyvizS0oJC8J6VhtnpTKUGVbc31KCvTvwa4TmO+CHaY="
+        "rev": "153.0.8010.47-1",
+        "hash": "sha256-J/IiNmqJzL35TfiGbsqrXnI8lUizCWuxzVBHgo7cG80="
       },
       "npmHash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "507c6ee3e2f3b2ca0e660547e5b9ea4820c67f4c",
-        "hash": "sha256-q29a3PWQ7wMG4/JL9EyCK7EaDCeG+4Q/ruemOvvgeZM=",
+        "rev": "73934a44f61e6b3878d1943064c141a5a820f5f7",
+        "hash": "sha256-D7Oqukze3CzYVWN9AQq9zN6HN2GcZ6b7ZSqhM5bjvUU=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -944,8 +944,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "fca5efdfeff5daf430bc4458375c8d6b7e457400",
-        "hash": "sha256-IoHQfdjZ6TV03VVzHZcxhPqGmNYNhKZrPG4BvQQfC7c="
+        "rev": "ed04c8113c6538f3e1264042da8cb4afd100369b",
+        "hash": "sha256-mZrVJ/P3tPoiSkGBH4fEjNAexLsjAzts8jjkCQZ4kOs="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -984,8 +984,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "225a7ba1bcb997d26de3e894e04fb341638e8c5a",
-        "hash": "sha256-/ic1j1gu2wl5wCLCESfEcsLAPU5Dmsx8oKFb6RhYzg4="
+        "rev": "28ffc61fc935c599677cff4dddfa4a12209ce500",
+        "hash": "sha256-6ySDyyQs/nfFF9AeoUY57GYDx7V8b0GQ17PCwQkzZVk="
       },
       "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1484,8 +1484,8 @@
       },
       "src/third_party/pthreadpool/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/pthreadpool.git",
-        "rev": "02460584c6092e527c8b89f7df4de143d70e801f",
-        "hash": "sha256-4EHJzZT+Gbhs8SkOhjSvDIPEqIQU93oJmtF3c/T+qjw="
+        "rev": "15a6644ba1c45f1acc16ac1e883efc3e56c6bed2",
+        "hash": "sha256-YJD9n8cxoqTrTQJHKuZFW2qnlNcNmh5rQlBpnlF46to="
       },
       "src/third_party/pyelftools": {
         "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git",
@@ -1524,8 +1524,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "4f574af2444846ceca4d277a8095c5d4229d175f",
-        "hash": "sha256-HrpA4labNWXPWj/yiS9O8KjdQPwJOllmR5r66TwCjB0="
+        "rev": "fca11a08da7c1ed3777b40b31611961c85c63c43",
+        "hash": "sha256-iQNNgvRVUuyAcSVE+pNJWrWz0NJd/MZLxd9vbYztong="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1694,8 +1694,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "f343157cebb388bfa416baccb5d35507e6fe8cc7",
-        "hash": "sha256-zSCyFQpDMNygmV6N4TajL8VB5+VRynrMPV/wAiWsJO4="
+        "rev": "6b96683d44174e78ff4e65cb274bad56dc108231",
+        "hash": "sha256-Oa1wzIbWVPX0x7adJVPUxQocK5gofG0vE56QTg0XKCs="
       },
       "src/agents/shared": {
         "url": "https://chromium.googlesource.com/chromium/agents.git",

From c4cd623d327c9ddf9343608c9da9a0185e440738 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Tue, 15 Sep 2026 21:37:28 +0200
Subject: [PATCH 42/51] mastodon: 4.6.7 -> 4.6.8

(cherry picked from commit 1408d54b029dbbc4040ccc87ea9d3e6c485a9dc8)
---
 pkgs/by-name/ma/mastodon/source.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ma/mastodon/source.nix b/pkgs/by-name/ma/mastodon/source.nix
index cf938f6c2ade..318078c1d8f7 100644
--- a/pkgs/by-name/ma/mastodon/source.nix
+++ b/pkgs/by-name/ma/mastodon/source.nix
@@ -5,14 +5,14 @@
   patches ? [ ],
 }:
 let
-  version = "4.6.7";
+  version = "4.6.8";
 in
 applyPatches {
   src = fetchFromGitHub {
     owner = "mastodon";
     repo = "mastodon";
     rev = "v${version}";
-    hash = "sha256-gSJXe4/uRYYKQTmjMirD2uFA7ymRl2LQP6VHt8nBD9k=";
+    hash = "sha256-fDbQunhcpnMnIufEX2oRH9vulsHjtlR95boj0M2O3CQ=";
     passthru = {
       inherit version;
       yarnHash = "sha256-VlOG91ZuO+1UXTbtwIrYUbqHjmSfPSfLhrf4TxCJqJ0=";

From d3973baf0a5244c8e203f08131919f2bf99a7868 Mon Sep 17 00:00:00 2001
From: Benjamin Sparks <b.sparks@alugha.com>
Date: Fri, 28 Aug 2026 14:09:31 +0200
Subject: [PATCH 43/51] pgschema: skip tests on darwin

Using `__darwinAllowLocalNetworking` allows binding to port 0, but
darwin's sandbox blocks a required syscall

(cherry picked from commit a44863928ae35247b635c5f2ef83d74a7a9c8a41)
---
 pkgs/by-name/pg/pgschema/package.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/pg/pgschema/package.nix b/pkgs/by-name/pg/pgschema/package.nix
index 397d3bb6a2c7..066faae02adb 100644
--- a/pkgs/by-name/pg/pgschema/package.nix
+++ b/pkgs/by-name/pg/pgschema/package.nix
@@ -1,4 +1,5 @@
 {
+  stdenv,
   lib,
   buildGoModule,
   fetchFromGitHub,
@@ -33,11 +34,15 @@ buildGoModule (finalAttrs: {
     "github.com/pgplex/pgschema/internal/postgres.binariesPath=${postgresql}"
   ];
 
+  # Tests fail in sandbox on darwin, with:
+  # Could not create shared memory segment: Cannot allocate memory
+  # Failed system call was shmget(key=18446744072262306125, size=56, 03600)
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
   doInstallCheck = true;
   nativeInstallCheckInputs = [
     versionCheckHook
   ];
-  versionCheckProgramArg = "--help"; # there is no -v/--version
 
   passthru.updateScript = nix-update-script { };
 

From 8b20b47052a095e6db906c12e335460916c7f712 Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Tue, 15 Sep 2026 09:14:53 -0400
Subject: [PATCH 44/51] tor-browser: 15.0.22 -> 15.0.23

changelog: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/raw/tbb-15.0.23-build1/projects/browser/Bundle-Data/Docs-TBB/ChangeLog.txt
firefox esr: https://www.firefox.com/en-US/firefox/140.16.0/releasenotes/
firefox security advisories: https://www.mozilla.org/en-US/security/advisories/mfsa2026-92/

(cherry picked from commit 9dfab98dffc52166d20186924970be08cddc902a)
---
 pkgs/by-name/to/tor-browser/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/to/tor-browser/package.nix b/pkgs/by-name/to/tor-browser/package.nix
index 25ce90f671a4..b6f801ce4acb 100644
--- a/pkgs/by-name/to/tor-browser/package.nix
+++ b/pkgs/by-name/to/tor-browser/package.nix
@@ -102,7 +102,7 @@ let
     ++ lib.optionals mediaSupport [ ffmpeg_7 ]
   );
 
-  version = "15.0.22";
+  version = "15.0.23";
 
   sources = {
     x86_64-linux = fetchurl {
@@ -112,7 +112,7 @@ let
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
       ];
-      hash = "sha256-wizrBGx5zl57M7obg3iUr9Y7P/H8ckwCPbVL2BNWZFc=";
+      hash = "sha256-D2L41lx/w03UuGy6t/yq7HOBVz3aNGrHsX5WjiK0vzk=";
     };
 
     i686-linux = fetchurl {
@@ -122,7 +122,7 @@ let
         "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
       ];
-      hash = "sha256-1J82ddE8DqVSOnS4yI4ayLyx3MBP++TOonLulGsBz4E=";
+      hash = "sha256-EXCHkprnH1ylopayMN/kckEpYJAePWnzmUlldSqVswk=";
     };
   };
 

From b3bc2141051a95f5dd3e6d763eecac444f548f80 Mon Sep 17 00:00:00 2001
From: whispers <whispersofthedawn@duck.com>
Date: Tue, 15 Sep 2026 09:18:07 -0400
Subject: [PATCH 45/51] mullvad-browser: 15.0.21 -> 15.0.23

changelog: https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/raw/mb-15.0.23-build1/projects/browser/Bundle-Data/Docs-MB/ChangeLog.txt
firefox esr: https://www.firefox.com/en-US/firefox/140.16.0/releasenotes/
firefox security advisories: https://www.mozilla.org/en-US/security/advisories/mfsa2026-92/

(cherry picked from commit 58b12ab110e4bf19d86be5180fa27473dd005936)
---
 pkgs/by-name/mu/mullvad-browser/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mu/mullvad-browser/package.nix b/pkgs/by-name/mu/mullvad-browser/package.nix
index 3423f0c606ed..7278216666bd 100644
--- a/pkgs/by-name/mu/mullvad-browser/package.nix
+++ b/pkgs/by-name/mu/mullvad-browser/package.nix
@@ -97,7 +97,7 @@ let
     ++ lib.optionals mediaSupport [ ffmpeg_7 ]
   );
 
-  version = "15.0.21";
+  version = "15.0.23";
 
   sources = {
     x86_64-linux = fetchurl {
@@ -109,7 +109,7 @@ let
         "https://tor.eff.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
         "https://tor.calyxinstitute.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
       ];
-      hash = "sha256-LHv/hY/abmy7/8nsNkKiwJh+SvRLzEO97fNNvPuYXQo=";
+      hash = "sha256-Bzd0atOeqHFhmIlpN3cbGogkwg6SwpNhn5m4yscpIzo=";
     };
   };
 

From ee77c58467f3054dea6284e49f68bf0758897b17 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 5 Sep 2026 19:03:01 +0000
Subject: [PATCH 46/51] easycrypt: 2026.07 -> 2026.09

(cherry picked from commit c8d05a035b0221a8dfcbb25fc85f180e3655ac7b)
---
 pkgs/applications/science/logic/easycrypt/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/science/logic/easycrypt/default.nix b/pkgs/applications/science/logic/easycrypt/default.nix
index 494b6c7f3ceb..ea82adf13444 100644
--- a/pkgs/applications/science/logic/easycrypt/default.nix
+++ b/pkgs/applications/science/logic/easycrypt/default.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "easycrypt";
-  version = "2026.07";
+  version = "2026.09";
 
   src = fetchFromGitHub {
     owner = "easycrypt";
     repo = "easycrypt";
     tag = "r${finalAttrs.version}";
-    hash = "sha256-ZJRvMdIv75BcU9r8kJdOF7XtTL5dFNycDMSnZjuSp3I=";
+    hash = "sha256-7ZnGZOZyV5znDGzg0c3XSsliQyOFOwJp2iyAzJtDNwk=";
   };
 
   nativeBuildInputs =

From 2c116702b34931df61075388ca37fe55d53d4f37 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 27 Aug 2026 16:40:18 +0000
Subject: [PATCH 47/51] pgschema: 1.12.3 -> 1.12.4

(cherry picked from commit 7fc76fc492b0d93e7a8c6cc4c1dd383c846ab651)
---
 pkgs/by-name/pg/pgschema/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pg/pgschema/package.nix b/pkgs/by-name/pg/pgschema/package.nix
index 066faae02adb..4ece50ce711a 100644
--- a/pkgs/by-name/pg/pgschema/package.nix
+++ b/pkgs/by-name/pg/pgschema/package.nix
@@ -10,14 +10,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "pgschema";
-  version = "1.12.3";
+  version = "1.12.4";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "pgplex";
     repo = "pgschema";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zfG87Uc5bx14zhYnuT3CF+sW5EEQLBRRMyBe57FBHJ4=";
+    hash = "sha256-xURQHIkvEWaYko9RvEhYl1TPqc5ABx9WTMVKuWYGfwE=";
   };
 
   # Adapted from $src/nix/pgschema.nix

From 9f4f51c3a1b2f2492bcca43ae3edf0d95033f1e0 Mon Sep 17 00:00:00 2001
From: staticdev <staticdev-support@proton.me>
Date: Tue, 15 Sep 2026 13:00:45 +0200
Subject: [PATCH 48/51] aurral: 2.8.0 -> 2.9.0

(cherry picked from commit f3ae27e1026c035fc9e1bd85eaeb5b48d847ae14)
---
 pkgs/by-name/au/aurral/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/au/aurral/package.nix b/pkgs/by-name/au/aurral/package.nix
index efb66d38fc35..abb0bee3628a 100644
--- a/pkgs/by-name/au/aurral/package.nix
+++ b/pkgs/by-name/au/aurral/package.nix
@@ -16,7 +16,7 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "aurral";
-  version = "2.8.0";
+  version = "2.9.0";
 
   __structuredAttrs = true;
 
@@ -24,7 +24,7 @@ buildNpmPackage (finalAttrs: {
     owner = "lklynet";
     repo = "aurral";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Ceo5CHIGa+98XFLazqmAyAV64rzDYqB0gvJ95AKwfUk=";
+    hash = "sha256-pwk+efWL0dfvKiobRmGXgPtvunpRDOVbtxohbJamVqY=";
   };
 
   # Specifies files to package leveraging npm & nix hooks. Not used by upstream.
@@ -33,7 +33,7 @@ buildNpmPackage (finalAttrs: {
     ./package.json.patch
   ];
 
-  npmDepsHash = "sha256-Qa/TcKzMEY/w8FWKMiHUeqVB9cMxxWtEwF30y0nndkg=";
+  npmDepsHash = "sha256-NVz5eqDDtMBKiTDl3aX0pHBYGTcYal8lmCf8mbKu31I=";
 
   nodejs = nodejs_26;
 

From af725a32881310f7673b7914ad8d4b43b3e5b769 Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 16 Sep 2026 20:29:45 +0300
Subject: [PATCH 49/51] linux-firmware: 20260910 -> 20260916

Diff: https://gitlab.com/kernel-firmware/linux-firmware/-/compare/20260910...20260916
(cherry picked from commit 0edb33d27a7ef5d0f60c64c9c6979301520dca74)
---
 pkgs/by-name/li/linux-firmware/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/linux-firmware/package.nix b/pkgs/by-name/li/linux-firmware/package.nix
index 8a4d77a32889..0919d3131dbd 100644
--- a/pkgs/by-name/li/linux-firmware/package.nix
+++ b/pkgs/by-name/li/linux-firmware/package.nix
@@ -23,13 +23,13 @@ let
 in
 stdenvNoCC.mkDerivation rec {
   pname = "linux-firmware";
-  version = "20260910";
+  version = "20260916";
 
   src = fetchFromGitLab {
     owner = "kernel-firmware";
     repo = "linux-firmware";
     tag = version;
-    hash = "sha256-gT9XYrQk5oZvbJgp4u8xkGWR4NdDomx5tzLmB4V52H8=";
+    hash = "sha256-VbDTRN/i+a1BrKnDtdDFxanp3BQujBhe9CyWay9GTXY=";
   };
 
   postUnpack = ''

From 197f1078aca71a2a10d3e920bf8e615ba3e8d5f4 Mon Sep 17 00:00:00 2001
From: Antoine du Hamel <duhamelantoine1995@gmail.com>
Date: Wed, 16 Sep 2026 20:17:10 +0200
Subject: [PATCH 50/51] nodejs_26: 26.8.2 -> 26.9.0

(cherry picked from commit 0f6531efa2a7fd0df616c2160370e845ea6536d8)
---
 pkgs/development/web/nodejs/v26.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/web/nodejs/v26.nix b/pkgs/development/web/nodejs/v26.nix
index c6e7ed20dab4..e204d6b3e4b6 100644
--- a/pkgs/development/web/nodejs/v26.nix
+++ b/pkgs/development/web/nodejs/v26.nix
@@ -23,8 +23,8 @@ let
       [ ];
 in
 buildNodejs {
-  version = "26.8.2";
-  sha256 = "36b37bf5ee4d092b9d9dff2d1a90b1444f8b453eddf6ff96cabdebb97d32f41d";
+  version = "26.9.0";
+  sha256 = "47b970d88511b429e587b740fa733176909d2a2005a29662f01b05205f58468b";
   patches =
     (lib.optional (!(stdenv.hostPlatform.emulatorAvailable buildPackages)) (fetchpatch2 {
       url = "https://raw.githubusercontent.com/buildroot/buildroot/2f0c31bffdb59fb224387e35134a6d5e09a81d57/package/nodejs/nodejs-src/0003-include-obj-name-in-shared-intermediate.patch";

From 16bab780fb1755d602e0a2045e9c0f3f5c8bde57 Mon Sep 17 00:00:00 2001
From: Carl Richard Theodor Schneider <dev.github@crtified.me>
Date: Wed, 16 Sep 2026 18:24:51 +0200
Subject: [PATCH 51/51] rlottie: 0.2-unstable-2026-09-01 ->
 0.2-unstable-2026-09-11

(cherry picked from commit f68cde7e9495dd92b4cde2d6b5d1e0a3ab46ec85)
---
 pkgs/by-name/rl/rlottie/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/rl/rlottie/package.nix b/pkgs/by-name/rl/rlottie/package.nix
index ee883a52fc86..fb0031f3a7a2 100644
--- a/pkgs/by-name/rl/rlottie/package.nix
+++ b/pkgs/by-name/rl/rlottie/package.nix
@@ -11,13 +11,13 @@
 
 stdenv.mkDerivation {
   pname = "rlottie";
-  version = "0.2-unstable-2026-09-01";
+  version = "0.2-unstable-2026-09-11";
 
   src = fetchFromGitHub {
     owner = "Samsung";
     repo = "rlottie";
-    rev = "25648aef19187b3f87f4d9420b8d761453ad4630";
-    hash = "sha256-sLjunpnQh1HCy5VLB8EpCTaGuBRPGCLhDovTzAAjAK0=";
+    rev = "683bbaa39dd0d366cf6b4bc300b4dfbee677ea6b";
+    hash = "sha256-4XP/bqMWgJW/XbR0rb8N3U5YMpXhwaQ6oQG9+7Jw5bs=";
   };
 
   nativeBuildInputs = [