From 4e795915a9c0802eab75669283d7e306973971b4 Mon Sep 17 00:00:00 2001
From: Fabio Batista <fabio@atelie.dev.br>
Date: Sun, 31 May 2026 17:02:37 -0300
Subject: [PATCH 01/50] =?UTF-8?q?gpaste:=2045.3=20=E2=86=92=2045.5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds GNOME 50 support.

(cherry picked from commit b88091931b9a6c2993cd8aa98051909b790421df)
---
 pkgs/by-name/gp/gpaste/package.nix | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/gp/gpaste/package.nix b/pkgs/by-name/gp/gpaste/package.nix
index f71819236b18..3935301cd1b7 100644
--- a/pkgs/by-name/gp/gpaste/package.nix
+++ b/pkgs/by-name/gp/gpaste/package.nix
@@ -20,11 +20,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gpaste";
-  version = "45.3";
+  version = "45.5";
 
   src = fetchurl {
     url = "https://www.imagination-land.org/files/gpaste/GPaste-${finalAttrs.version}.tar.xz";
-    hash = "sha256-UU8pw7bqEwg2Vh7S6GTx8swI/2IhlwjQgkGNZCzoMwc=";
+    hash = "sha256-seoPqmec9F4/zwmLjpAOUBBIVvLbFRMVPZ3jcloRrZE=";
   };
 
   patches = [
@@ -36,10 +36,6 @@ stdenv.mkDerivation (finalAttrs: {
   postPatch = ''
     substituteInPlace src/libgpaste/gpaste/gpaste-settings.c \
       --subst-var-by gschemasCompiled ${glib.makeSchemaPath (placeholder "out") "${finalAttrs.pname}-${finalAttrs.version}"}
-
-    substituteInPlace src/gnome-shell/metadata.json.in --replace-fail \
-      '"shell-version": [ "45", "46", "47", "48" ],' \
-      '"shell-version": [ "45", "46", "47", "48", "49" ],'
   '';
 
   nativeBuildInputs = [
@@ -90,5 +86,6 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.bsd2;
     platforms = lib.platforms.linux;
     teams = [ lib.teams.gnome ];
+    maintainers = with lib.maintainers; [ fabiob ];
   };
 })

From 5701c8c01e4893a17dcef2af0ed9a18cc7868532 Mon Sep 17 00:00:00 2001
From: Sizhe Zhao <prc.zhao@outlook.com>
Date: Wed, 17 Jun 2026 20:12:38 +0800
Subject: [PATCH 02/50] firewalld: remove -gui only files

These files refer to firewall-{applet,config} which are only present in
firewalld-gui.

(cherry picked from commit 31cd69e9e28204ce03a7e7b5692bdf43065169da)
---
 pkgs/by-name/fi/firewalld/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/fi/firewalld/package.nix b/pkgs/by-name/fi/firewalld/package.nix
index 0d7e5ea21f23..6e3e18fcb0d2 100644
--- a/pkgs/by-name/fi/firewalld/package.nix
+++ b/pkgs/by-name/fi/firewalld/package.nix
@@ -132,6 +132,9 @@ stdenv.mkDerivation (finalAttrs: {
   ''
   + lib.optionalString (!withGui) ''
     rm $out/bin/firewall-{applet,config}
+    rm $out/etc/xdg/autostart/firewall-applet.desktop
+    rm $out/share/applications/firewall-config.desktop
+    rm $out/share/metainfo/org.firewalld.firewall-config.metainfo.xml
   '';
 
   dontWrapGApps = true;

From 2818e459b76b3476b96d0938be0b602313a3efce Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 24 Jun 2026 20:41:45 +0000
Subject: [PATCH 03/50] firewalld: 2.4.2 -> 2.4.3

(cherry picked from commit fc77c504209c8552c846dc11ae2c42fe76962685)
---
 pkgs/by-name/fi/firewalld/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fi/firewalld/package.nix b/pkgs/by-name/fi/firewalld/package.nix
index 0d7e5ea21f23..cdb5b3cc206b 100644
--- a/pkgs/by-name/fi/firewalld/package.nix
+++ b/pkgs/by-name/fi/firewalld/package.nix
@@ -43,7 +43,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "firewalld";
-  version = "2.4.2";
+  version = "2.4.3";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "firewalld";
     repo = "firewalld";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-RUDDUvpGfWEKI+VtC4SBMLKsAHkStV1qAYpHLQbN5HM=";
+    hash = "sha256-S7E0szAZ2MEttL4PdBkoOcDGFVCVrwsTKr9xe+DPPgM=";
   };
 
   patches = [

From 58ddca0e1af00896d94b594d7b02b82b0d2fa89d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 26 Jun 2026 22:13:40 -0700
Subject: [PATCH 04/50] pnpm_8: mark insecure

(cherry picked from commit aa378c0be68ca966cf5cf9c51fc81271b35b3e49)
---
 pkgs/development/tools/pnpm/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index 4339c86d09cb..d89bd2034f84 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -9,6 +9,15 @@ let
     "8" = {
       version = "8.15.9";
       hash = "sha256-2qJ6C1QbxjUyP/lsLe2ZVGf/n+bWn/ZwIVWKqa2dzDY=";
+      knownVulnerabilities = [
+        "CVE-2026-48995"
+        "CVE-2026-50014"
+        "CVE-2026-50015"
+        "CVE-2026-50016"
+        "CVE-2026-50017"
+        "CVE-2026-50573"
+        "CVE-2026-55699"
+      ];
     };
     "9" = {
       version = "9.15.9";

From 2f77fad1216696c85cfb728f5e3284879216efa8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 26 Jun 2026 22:13:03 -0700
Subject: [PATCH 05/50] pnpm_9: mark insecure

(cherry picked from commit b0ed2e0e81db3459e16c7fdc9d1572092ac73573)
---
 pkgs/development/tools/pnpm/default.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index d89bd2034f84..bd06623361bb 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -22,6 +22,15 @@ let
     "9" = {
       version = "9.15.9";
       hash = "sha256-z4anrXZEBjldQoam0J1zBxFyCsxtk+nc6ax6xNxKKKc=";
+      knownVulnerabilities = [
+        "CVE-2026-48995"
+        "CVE-2026-50014"
+        "CVE-2026-50015"
+        "CVE-2026-50016"
+        "CVE-2026-50017"
+        "CVE-2026-50573"
+        "CVE-2026-55699"
+      ];
     };
     # 10.29.3 made a breaking change: https://github.com/pnpm/pnpm/issues/10601.
     # Pnpm packages that depend on electron builder must be upgraded to 26.8.2 or newer

From e61d51798421d6a9d2f9266d5adad3ffcd807dee Mon Sep 17 00:00:00 2001
From: Jeremy Fleischman <me@jfly.fyi>
Date: Sun, 5 Jul 2026 09:37:25 -0700
Subject: [PATCH 06/50] nixos/fish: `programs.fish.generateCompletions` fix
 spaces in filenames

`linux-manual` has this fun filename in it:

```console
$ find -L $(nix-build -A linux-manual) -name 'station table - introduction.9.gz'
/nix/store/q45mzaksp2ll04c363mxpyi252j6anrq-linux-manual-7.1.3/share/man/man9/station table - introduction.9.gz
```

Our `find ... | xargs ...` didn't handle this nicely, and would vomit in the
following way:

`repro.nix`:

```nix
$ cat repro.nix
let
  pkgs = import ./. { };
  nixosConfig = pkgs.nixos (
    { config, pkgs, ... }: {
      system.stateVersion = config.system.nixos.release;

      programs.fish.enable = true;
      programs.fish.generateCompletions = true;

      environment.systemPackages = [ pkgs.linux-manual ];
    }
  );
in
nixosConfig.config.environment.etc."fish/generated_completions".source
```

The crash:

```console
$ nix-build repro.nix
these 2 derivations will be built:
  /nix/store/qs213n0r723w59jdvfz5w87azd3wh405-linux-manual-7.1.3_fish-completions.drv
  /nix/store/1pwps30drz71icj5v4rdiaarmh37xcn8-system_fish-completions.drv
building '/nix/store/qs213n0r723w59jdvfz5w87azd3wh405-linux-manual-7.1.3_fish-completions.drv'...
usage: create_manpage_completions.py [-h] [-c CLEANUP_IN] [-d DIRECTORY] [-k]
                                     [-m] [-p] [-s] [-v {0,1,2}] [-z]
                                     [file_paths ...]
create_manpage_completions.py: error: unrecognized arguments: -introduction.9.gz /nix/store/q45mzaksp2ll04c363mxpyi252j6anrq-linux-manual-7.1.3/share/man/man9/DRBD State macros.9.gz /nix/store/q45mzaksp2ll04c363mxpyi252j6anrq-linux-manual-7.1.3/share/man/man9/DRM Client usage stats.9.gz /nix/store/q45mzaksp2ll04c363mxpyi252j6anrq-linux-manual-7.1.3/share/man/man9/DRM RAS Node Management.9.gz /nix/store/q45mzaksp2ll04c363mxpyi252j6anrq-linux-manual-7.1.3/share/man/man9/DRM_ACCEL_FOPS.9.gz
```

This fix is simple, use the `find -print0 ... | xargs -0 ...` pattern.

(cherry picked from commit 69b2e5e0b23098a36cd57ea11df7481291364307)
---
 nixos/modules/programs/fish.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/programs/fish.nix b/nixos/modules/programs/fish.nix
index 86c29477ebcc..43e968ccad07 100644
--- a/nixos/modules/programs/fish.nix
+++ b/nixos/modules/programs/fish.nix
@@ -298,7 +298,7 @@ in
                 ''
                   mkdir -p $out
                   if [ -d $package/share/man ]; then
-                    find -L $package/share/man -type f | xargs ${pkgs.python3.pythonOnBuildForHost.interpreter} ${patchedGenerator}/create_manpage_completions.py --directory $out >/dev/null
+                    find -L $package/share/man -type f -print0 | xargs -0 ${pkgs.python3.pythonOnBuildForHost.interpreter} ${patchedGenerator}/create_manpage_completions.py --directory $out >/dev/null
                   fi
                 '';
             packages =

From 0ec51ef662a06789f0e15cf8bc588008a62d4d17 Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Wed, 8 Jul 2026 10:12:45 +0200
Subject: [PATCH 07/50] nodejs_24: fix riscv64-linux build

(cherry picked from commit a6110e0e9fbb981b4c85fd5f65074eb304bfdd6b)
---
 pkgs/development/web/nodejs/nodejs.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/web/nodejs/nodejs.nix b/pkgs/development/web/nodejs/nodejs.nix
index 5fd5eeac6919..0b07ab24a688 100644
--- a/pkgs/development/web/nodejs/nodejs.nix
+++ b/pkgs/development/web/nodejs/nodejs.nix
@@ -529,6 +529,7 @@ let
               "test-fetch"
               "test-http2-allow-http1-upgrade-ws"
               "test-http-proxy-fetch"
+              "test-https-proxy-fetch"
               "test-http-set-global-proxy-from-env-fetch"
               "test-http-set-global-proxy-from-env-fetch-default"
               "test-http-set-global-proxy-from-env-fetch-empty"

From b126c5241dad85da7c124c2ec5a500d4f4c4239d Mon Sep 17 00:00:00 2001
From: Gabriel Soldani <gabriel@gabrielsoldani.com>
Date: Sat, 6 Jun 2026 15:07:43 -0300
Subject: [PATCH 08/50] discord: don't strip upstream binaries on darwin

(cherry picked from commit ff36900ebeebee157762ef16afe72aa3f3bd140d)
---
 .../networking/instant-messengers/discord/darwin.nix             | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/applications/networking/instant-messengers/discord/darwin.nix b/pkgs/applications/networking/instant-messengers/discord/darwin.nix
index 649dd753d9ff..c440becd5da4 100644
--- a/pkgs/applications/networking/instant-messengers/discord/darwin.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/darwin.nix
@@ -107,6 +107,7 @@ stdenv.mkDerivation {
   sourceRoot = ".";
 
   dontUnpack = true;
+  dontStrip = true;
 
   installPhase = ''
     runHook preInstall

From 8f8f97aac4b0d2ffa7bec836730bd202d166b554 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 10 Jul 2026 03:42:37 +0000
Subject: [PATCH 09/50] mailpit: 1.30.3 -> 1.30.4

(cherry picked from commit 1d91fb67ce09771a3f7263d377102666a963557e)
---
 pkgs/by-name/ma/mailpit/source.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ma/mailpit/source.nix b/pkgs/by-name/ma/mailpit/source.nix
index 16256eccff09..c20cf59126af 100644
--- a/pkgs/by-name/ma/mailpit/source.nix
+++ b/pkgs/by-name/ma/mailpit/source.nix
@@ -1,6 +1,6 @@
 {
-  version = "1.30.3";
-  hash = "sha256-6Vt1GpGWHfaYaORBFa/cB+AxYQxAdkGtGTsrvL08dsA=";
-  npmDepsHash = "sha256-vXAXuvKqLWbwCjSLNS8mLDA9AmaGSRsB67iKQMi+/No=";
-  vendorHash = "sha256-A/kef2PgrA0Jpb/o+f1nUeiwSibOgsnyYLOzJ/HB1Fo=";
+  version = "1.30.4";
+  hash = "sha256-qpwwCugg18cC4xbwmLKNM3c63z8k1FOoZlzpgvXp5BU=";
+  npmDepsHash = "sha256-urjsUXcEwMaaaSs0WdH+8/q3h7mr+/lKvXi9x21VYpU=";
+  vendorHash = "sha256-/0ddo1IwGeLyOQRqgqNmju3qOzwYQTwz4MDf2TBkUDU=";
 }

From c8b934ca9824cc2931a24ccf748c3eaff58a951c Mon Sep 17 00:00:00 2001
From: phanirithvij <phanirithvij2000@gmail.com>
Date: Fri, 10 Jul 2026 07:49:32 +0530
Subject: [PATCH 10/50] [Backport release-26.05] pdfding: 1.9.0 -> 1.10.0

Diff: https://github.com/mrmn2/PdfDing/compare/v1.9.0...v1.10.0
Changelog: https://github.com/mrmn2/PdfDing/releases/tag/v1.10.0

Not-cherry-picked-because: patch differs from master
Signed-off-by: phanirithvij <phanirithvij2000@gmail.com>
---
 pkgs/by-name/pd/pdfding/frontend.nix | 2 +-
 pkgs/by-name/pd/pdfding/package.nix  | 6 ++----
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/pd/pdfding/frontend.nix b/pkgs/by-name/pd/pdfding/frontend.nix
index 2f561bf59dd6..5a1c5566b523 100644
--- a/pkgs/by-name/pd/pdfding/frontend.nix
+++ b/pkgs/by-name/pd/pdfding/frontend.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
   npmDeps = fetchNpmDeps {
     inherit (finalAttrs) src;
     name = "pdfding-${finalAttrs.version}-npm-deps";
-    hash = "sha256-fxhDP/kyDfL1uiZCUNr2Cd6vDnyb9V+gTSNPyjSIm18=";
+    hash = "sha256-TDX2xoHj07aUeuLPt/TlgkdRdTiv3fNbriChzEB4EXk=";
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pd/pdfding/package.nix b/pkgs/by-name/pd/pdfding/package.nix
index 244d6d8e498b..fe8520ea6afb 100644
--- a/pkgs/by-name/pd/pdfding/package.nix
+++ b/pkgs/by-name/pd/pdfding/package.nix
@@ -12,12 +12,12 @@ let
 in
 python.pkgs.buildPythonPackage (finalAttrs: {
   pname = "pdfding";
-  version = "1.9.0";
+  version = "1.10.0";
   src = fetchFromGitHub {
     owner = "mrmn2";
     repo = "PdfDing";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-r3hO92iriQ/0KDl+D/0j5RoneTTCDmt8m4e7ugzyOPs=";
+    hash = "sha256-C1osj8V9+z3ahl4+zUtyI22GMtSgNLzfdGttL7gPDvY=";
   };
   pyproject = true;
 
@@ -132,13 +132,11 @@ python.pkgs.buildPythonPackage (finalAttrs: {
   '';
 
   pythonRelaxDeps = [
-    "django"
     "django-allauth"
     "gunicorn"
     "huey"
     "nh3"
     "psycopg2-binary"
-    "pypdf"
     "pypdfium2"
   ];
 

From 8918cbc3ae7a259094eafe70e32b36b39e317858 Mon Sep 17 00:00:00 2001
From: phanirithvij <phanirithvij2000@gmail.com>
Date: Fri, 10 Jul 2026 10:22:37 +0530
Subject: [PATCH 11/50] nixosTests.pdfding.s3-backup: fix test

Signed-off-by: phanirithvij <phanirithvij2000@gmail.com>
(cherry picked from commit 656f072b88e8f1c82b038265232bfade43ae8e97)
---
 nixos/tests/web-apps/pdfding/s3-backups.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/nixos/tests/web-apps/pdfding/s3-backups.nix b/nixos/tests/web-apps/pdfding/s3-backups.nix
index bb019681bc1a..df1beb5c7e6b 100644
--- a/nixos/tests/web-apps/pdfding/s3-backups.nix
+++ b/nixos/tests/web-apps/pdfding/s3-backups.nix
@@ -31,7 +31,7 @@ in
           backup.schedule = "*/1 * * * *";
           backup.endpoint = "[::]:3900";
           extraEnvironment.BACKUP_BUCKET_NAME = "pdfding-bucket";
-          extraEnvironment.BACKUP_REGION = "garage";
+          extraEnvironment.BACKUP_REGION = "us-east-1";
 
           envFiles = [ pdfding-s3-keys ];
           installTestHelpers = true;
@@ -48,7 +48,7 @@ in
             rpc_secret = "5c1915fa04d0b6739675c61bf5907eb0fe3d9c69850c83820f51b4d25d13868c";
 
             s3_api = {
-              s3_region = "garage";
+              s3_region = "us-east-1";
               api_bind_addr = "[::]:3900";
               root_domain = ".s3.garage";
             };
@@ -140,7 +140,7 @@ in
           -F "description=" \
           -F "collection=1" \
           -F "use_file_name=on" \
-          -F "name=test-upload" \
+          -F "name=dummy" \
           -F "file=@{test_pdf};type=application/pdf" \
           -F "csrfmiddlewaretoken=$csrf_token" \
           -H "Referer: {endpoint}/pdf/add" \

From a06848cb8c090599662179f53347e08d186c3beb Mon Sep 17 00:00:00 2001
From: phanirithvij <phanirithvij2000@gmail.com>
Date: Fri, 10 Jul 2026 10:21:14 +0530
Subject: [PATCH 12/50] nixosTests.pdfding: fix on aarch64-linux

Signed-off-by: phanirithvij <phanirithvij2000@gmail.com>
(cherry picked from commit 543ba03fed5bc945da716bfd816386668386296d)
---
 nixos/tests/web-apps/pdfding/basic.nix      |  6 ++++++
 nixos/tests/web-apps/pdfding/postgres.nix   | 10 ++++++++++
 nixos/tests/web-apps/pdfding/s3-backups.nix | 10 ++++++++++
 3 files changed, 26 insertions(+)

diff --git a/nixos/tests/web-apps/pdfding/basic.nix b/nixos/tests/web-apps/pdfding/basic.nix
index 3994a4adcf82..b4b6529127db 100644
--- a/nixos/tests/web-apps/pdfding/basic.nix
+++ b/nixos/tests/web-apps/pdfding/basic.nix
@@ -17,6 +17,11 @@
           secretKeyFile = pkgs.writeText "secretKeyFile" "test123";
         };
 
+        # NOTE: on aarch64-linux github actions runer due to lack of kvm, we need to delay pdfding start and give it more time to finish
+        systemd.services.pdfding.wantedBy = lib.mkIf pkgs.stdenv.hostPlatform.isAarch64 (lib.mkForce [ ]);
+        systemd.services.pdfding.serviceConfig.TimeoutStartSec =
+          lib.mkIf pkgs.stdenv.hostPlatform.isAarch64 "900";
+
         environment.systemPackages = with pkgs; [
           sqlite
         ];
@@ -60,6 +65,7 @@
 
       # create admin
       machine.wait_for_unit("multi-user.target")
+      machine.succeed("systemctl start pdfding.service")
       machine.wait_for_open_port(${toString port})
       machine.succeed("DJANGO_SUPERUSER_PASSWORD=admin pdfding-manage createsuperuser --no-input --username admin --email admin@localhost")
 
diff --git a/nixos/tests/web-apps/pdfding/postgres.nix b/nixos/tests/web-apps/pdfding/postgres.nix
index 46159b0e3bd1..ac668bcd48d8 100644
--- a/nixos/tests/web-apps/pdfding/postgres.nix
+++ b/nixos/tests/web-apps/pdfding/postgres.nix
@@ -22,6 +22,14 @@
           installTestHelpers = true;
         };
 
+        # NOTE: on aarch64-linux github actions runer due to lack of kvm, we need to delay pdfding start and give it more time to finish
+        systemd.services.pdfding.wantedBy = lib.mkIf pkgs.stdenv.hostPlatform.isAarch64 (lib.mkForce [ ]);
+        systemd.services.pdfding.serviceConfig.TimeoutStartSec =
+          lib.mkIf pkgs.stdenv.hostPlatform.isAarch64 "900";
+        systemd.services.pdfding-background.wantedBy = lib.mkIf pkgs.stdenv.hostPlatform.isAarch64 (
+          lib.mkForce [ ]
+        );
+
         environment.systemPackages = [
           config.services.postgresql.finalPackage
         ];
@@ -46,6 +54,8 @@
 
       # create admin
       machine.wait_for_unit("multi-user.target")
+      machine.succeed("systemctl start pdfding.service")
+      machine.succeed("systemctl start pdfding-background.service")
       machine.wait_for_open_port(${toString port})
 
       machine.succeed("DJANGO_SUPERUSER_PASSWORD=admin pdfding-manage createsuperuser --no-input --username admin --email admin@localhost")
diff --git a/nixos/tests/web-apps/pdfding/s3-backups.nix b/nixos/tests/web-apps/pdfding/s3-backups.nix
index df1beb5c7e6b..d931eebca174 100644
--- a/nixos/tests/web-apps/pdfding/s3-backups.nix
+++ b/nixos/tests/web-apps/pdfding/s3-backups.nix
@@ -37,6 +37,14 @@ in
           installTestHelpers = true;
         };
 
+        # NOTE: on aarch64-linux github actions runer due to lack of kvm, we need to delay pdfding start and give it more time to finish
+        systemd.services.pdfding.wantedBy = lib.mkIf pkgs.stdenv.hostPlatform.isAarch64 (lib.mkForce [ ]);
+        systemd.services.pdfding.serviceConfig.TimeoutStartSec =
+          lib.mkIf pkgs.stdenv.hostPlatform.isAarch64 "900";
+        systemd.services.pdfding-background.wantedBy = lib.mkIf pkgs.stdenv.hostPlatform.isAarch64 (
+          lib.mkForce [ ]
+        );
+
         # Setup a local garage service for the backup feature
         # taken from garage nixosTest
         services.garage = {
@@ -113,6 +121,8 @@ in
 
       # create admin
       machine.wait_for_unit("multi-user.target")
+      machine.succeed("systemctl start pdfding.service")
+      machine.succeed("systemctl start pdfding-background.service")
       machine.wait_for_open_port(${toString port})
       machine.succeed("DJANGO_SUPERUSER_PASSWORD=admin pdfding-manage createsuperuser --no-input --username admin --email admin@localhost")
 

From b6a63ad97d0e39b2ae47f9a65cdb2dd0819c2e01 Mon Sep 17 00:00:00 2001
From: Nick Novitski <git@nicknovitski.com>
Date: Thu, 9 Jul 2026 19:00:20 -0700
Subject: [PATCH 13/50] fluentd: 1.18.0 -> 1.19.3

(cherry picked from commit c4c0fd0f81db9ffc02c6af25304d93bed73876cf)
---
 pkgs/by-name/fl/fluentd/Gemfile.lock | 170 +++++++----
 pkgs/by-name/fl/fluentd/gemset.nix   | 416 +++++++++++++++++++++------
 2 files changed, 439 insertions(+), 147 deletions(-)

diff --git a/pkgs/by-name/fl/fluentd/Gemfile.lock b/pkgs/by-name/fl/fluentd/Gemfile.lock
index 7f6bacc67594..f46cd8453ad2 100644
--- a/pkgs/by-name/fl/fluentd/Gemfile.lock
+++ b/pkgs/by-name/fl/fluentd/Gemfile.lock
@@ -1,72 +1,103 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    addressable (2.8.7)
-      public_suffix (>= 2.0.2, < 7.0)
-    aws-eventstream (1.3.2)
-    aws-partitions (1.1064.0)
-    aws-sdk-cloudwatchlogs (1.109.0)
-      aws-sdk-core (~> 3, >= 3.216.0)
+    addressable (2.9.0)
+      public_suffix (>= 2.0.2, < 8.0)
+    async (2.42.0)
+      console (~> 1.29)
+      fiber-annotation
+      io-event (~> 1.11)
+      metrics (~> 0.12)
+      traces (~> 0.18)
+    async-http (0.95.1)
+      async (>= 2.10.2)
+      async-pool (~> 0.11)
+      io-endpoint (~> 0.14)
+      io-stream (~> 0.6)
+      metrics (~> 0.12)
+      protocol-http (~> 0.62)
+      protocol-http1 (~> 0.39)
+      protocol-http2 (~> 0.26)
+      protocol-url (~> 0.2)
+      traces (~> 0.10)
+    async-pool (0.11.2)
+      async (>= 2.0)
+    aws-eventstream (1.4.0)
+    aws-partitions (1.1267.0)
+    aws-sdk-cloudwatchlogs (1.159.0)
+      aws-sdk-core (~> 3, >= 3.254.0)
       aws-sigv4 (~> 1.5)
-    aws-sdk-core (3.220.1)
+    aws-sdk-core (3.254.0)
       aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.992.0)
       aws-sigv4 (~> 1.9)
       base64
+      bigdecimal
       jmespath (~> 1, >= 1.6.1)
-    aws-sdk-firehose (1.89.0)
-      aws-sdk-core (~> 3, >= 3.216.0)
+      logger
+    aws-sdk-firehose (1.112.0)
+      aws-sdk-core (~> 3, >= 3.254.0)
       aws-sigv4 (~> 1.5)
-    aws-sdk-kinesis (1.74.0)
-      aws-sdk-core (~> 3, >= 3.216.0)
+    aws-sdk-kinesis (1.103.0)
+      aws-sdk-core (~> 3, >= 3.254.0)
       aws-sigv4 (~> 1.5)
-    aws-sdk-kms (1.99.0)
-      aws-sdk-core (~> 3, >= 3.216.0)
+    aws-sdk-kms (1.130.0)
+      aws-sdk-core (~> 3, >= 3.254.0)
       aws-sigv4 (~> 1.5)
-    aws-sdk-s3 (1.182.0)
-      aws-sdk-core (~> 3, >= 3.216.0)
+    aws-sdk-s3 (1.227.0)
+      aws-sdk-core (~> 3, >= 3.254.0)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.5)
-    aws-sdk-sqs (1.93.0)
-      aws-sdk-core (~> 3, >= 3.216.0)
+    aws-sdk-sqs (1.117.0)
+      aws-sdk-core (~> 3, >= 3.254.0)
       aws-sigv4 (~> 1.5)
-    aws-sigv4 (1.11.0)
+    aws-sigv4 (1.12.1)
       aws-eventstream (~> 1, >= 1.0.2)
-    base64 (0.2.0)
+    base64 (0.3.0)
+    bigdecimal (4.1.2)
     bson (4.15.0)
-    concurrent-ruby (1.3.5)
-    cool.io (1.9.0)
-    csv (3.3.2)
+    concurrent-ruby (1.3.7)
+    console (1.36.0)
+      fiber-annotation
+      fiber-local (~> 1.1)
+      json
+    cool.io (1.9.4)
+    csv (3.3.5)
     digest-crc (0.7.0)
       rake (>= 12.0.0, < 14.0.0)
-    drb (2.2.1)
-    elastic-transport (8.4.0)
+    drb (2.2.3)
+    elastic-transport (8.5.3)
       faraday (< 3)
       multi_json
-    elasticsearch (8.17.1)
+    elasticsearch (9.4.3)
       elastic-transport (~> 8.3)
-      elasticsearch-api (= 8.17.1)
-    elasticsearch-api (8.17.1)
+      elasticsearch-api (= 9.4.3)
+    elasticsearch-api (9.4.3)
+      base64
       multi_json
-    excon (1.2.5)
+    excon (1.5.0)
       logger
-    faraday (2.12.2)
+    faraday (2.14.3)
       faraday-net_http (>= 2.0, < 3.5)
       json
       logger
-    faraday-excon (2.3.0)
+    faraday-excon (2.4.0)
       excon (>= 1.0.0)
       faraday (>= 2.11.0, < 3)
-    faraday-net_http (3.4.0)
-      net-http (>= 0.5.0)
+    faraday-net_http (3.4.4)
+      net-http (~> 0.5)
+    fiber-annotation (0.2.0)
+    fiber-local (1.1.0)
+      fiber-storage
+    fiber-storage (1.0.1)
     fluent-config-regexp-type (1.0.0)
       fluentd (> 1.0.0, < 2)
-    fluent-plugin-cloudwatch-logs (0.14.3)
+    fluent-plugin-cloudwatch-logs (0.15.0)
       aws-sdk-cloudwatchlogs (~> 1.0)
       fluentd (>= 1.8.0)
-    fluent-plugin-concat (2.5.0)
+    fluent-plugin-concat (2.6.2)
       fluentd (>= 0.14.0, < 2)
-    fluent-plugin-elasticsearch (5.4.3)
+    fluent-plugin-elasticsearch (6.0.0)
       elasticsearch
       excon
       faraday (>= 2.0.0)
@@ -76,12 +107,13 @@ GEM
       fluentd (>= 0.10.58, < 2)
       ltsv
       ruby-kafka (>= 1.5.0, < 2)
-    fluent-plugin-kinesis (3.5.0)
+    fluent-plugin-kinesis (3.7.0)
       aws-sdk-firehose (~> 1, != 1.9, != 1.5, != 1.15)
       aws-sdk-kinesis (~> 1, != 1.5, != 1.4, != 1.14)
       fluentd (>= 0.14.22, < 2)
-      google-protobuf (~> 3)
-    fluent-plugin-mongo (1.6.0)
+      google-protobuf (~> 4)
+    fluent-plugin-mongo (1.6.3)
+      bigdecimal (~> 4.0)
       fluentd (>= 0.14.22, < 2)
       mongo (>= 2.15.0, < 2.19.0)
     fluent-plugin-record-reformer (0.9.1)
@@ -89,14 +121,15 @@ GEM
     fluent-plugin-rewrite-tag-filter (2.4.0)
       fluent-config-regexp-type
       fluentd (>= 0.14.2, < 2)
-    fluent-plugin-s3 (1.8.3)
+    fluent-plugin-s3 (1.8.5)
       aws-sdk-s3 (~> 1.60)
       aws-sdk-sqs (~> 1.23)
       fluentd (>= 0.14.22, < 2)
     fluent-plugin-webhdfs (1.6.0)
       fluentd (>= 0.14.22)
       webhdfs (>= 0.11.0)
-    fluentd (1.18.0)
+    fluentd (1.19.3)
+      async-http (~> 0.86)
       base64 (~> 0.2)
       bundler
       cool.io (>= 1.4.5, < 2.0.0)
@@ -105,31 +138,46 @@ GEM
       http_parser.rb (>= 0.5.1, < 0.9.0)
       logger (~> 1.6)
       msgpack (>= 1.3.1, < 2.0.0)
+      net-http (~> 0.8)
+      ostruct (~> 0.6)
       serverengine (>= 2.3.2, < 3.0.0)
       sigdump (~> 0.2.5)
       strptime (>= 0.2.4, < 1.0.0)
       tzinfo (>= 1.0, < 3.0)
       tzinfo-data (~> 1.0)
+      uri (~> 1.0)
       webrick (~> 1.4)
       yajl-ruby (~> 1.0)
-    google-protobuf (3.25.6)
-    google-protobuf (3.25.6-aarch64-linux)
-    google-protobuf (3.25.6-arm64-darwin)
-    google-protobuf (3.25.6-x86-linux)
-    google-protobuf (3.25.6-x86_64-darwin)
-    http_parser.rb (0.8.0)
+      zstd-ruby (~> 1.5)
+    google-protobuf (4.35.1)
+      bigdecimal
+      rake (~> 13.3)
+    http_parser.rb (0.8.1)
+    io-endpoint (0.17.2)
+    io-event (1.19.1)
+    io-stream (0.13.1)
     jmespath (1.6.2)
-    json (2.10.1)
-    logger (1.6.6)
+    json (2.20.0)
+    logger (1.7.0)
     ltsv (0.1.2)
+    metrics (0.15.0)
     mongo (2.18.3)
       bson (>= 4.14.1, < 5.0.0)
-    msgpack (1.8.0)
-    multi_json (1.15.0)
-    net-http (0.6.0)
-      uri
-    public_suffix (6.0.1)
-    rake (13.2.1)
+    msgpack (1.8.3)
+    multi_json (1.21.1)
+    net-http (0.9.1)
+      uri (>= 0.11.1)
+    ostruct (0.6.3)
+    protocol-hpack (1.5.1)
+    protocol-http (0.62.2)
+    protocol-http1 (0.39.0)
+      protocol-http (~> 0.62)
+    protocol-http2 (0.26.0)
+      protocol-hpack (~> 1.4)
+      protocol-http (~> 0.62)
+    protocol-url (0.4.0)
+    public_suffix (7.0.5)
+    rake (13.4.2)
     ruby-kafka (1.5.0)
       digest-crc
     serverengine (2.4.0)
@@ -138,22 +186,20 @@ GEM
       sigdump (~> 0.2.2)
     sigdump (0.2.5)
     strptime (0.2.5)
+    traces (0.18.2)
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
-    tzinfo-data (1.2025.1)
+    tzinfo-data (1.2026.3)
       tzinfo (>= 1.0.0)
-    uri (1.0.3)
+    uri (1.1.1)
     webhdfs (0.11.0)
       addressable
-    webrick (1.9.1)
+    webrick (1.9.2)
     yajl-ruby (1.4.3)
+    zstd-ruby (1.5.7.1)
 
 PLATFORMS
-  aarch64-linux
-  arm64-darwin
   ruby
-  x86-linux
-  x86_64-darwin
 
 DEPENDENCIES
   fluent-plugin-cloudwatch-logs
@@ -169,4 +215,4 @@ DEPENDENCIES
   fluentd
 
 BUNDLED WITH
-   2.6.2
+   2.7.2
diff --git a/pkgs/by-name/fl/fluentd/gemset.nix b/pkgs/by-name/fl/fluentd/gemset.nix
index a006d8c272f7..04551bd2d61e 100644
--- a/pkgs/by-name/fl/fluentd/gemset.nix
+++ b/pkgs/by-name/fl/fluentd/gemset.nix
@@ -5,30 +5,80 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0cl2qpvwiffym62z991ynks7imsm87qmgxf0yfsmlwzkgi9qcaa6";
+      sha256 = "1by7h2lwziiblizpd5yx87jsq8ppdhzvwf08ga34wzqgcv1nmpvz";
       type = "gem";
     };
-    version = "2.8.7";
+    version = "2.9.0";
+  };
+  async = {
+    dependencies = [
+      "console"
+      "fiber-annotation"
+      "io-event"
+      "metrics"
+      "traces"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1ik5p6pgx01mrg2c5pj6rmjwr2s5sbvip84zcysxb5cc7clphq2k";
+      type = "gem";
+    };
+    version = "2.42.0";
+  };
+  async-http = {
+    dependencies = [
+      "async"
+      "async-pool"
+      "io-endpoint"
+      "io-stream"
+      "metrics"
+      "protocol-http"
+      "protocol-http1"
+      "protocol-http2"
+      "protocol-url"
+      "traces"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0v3q2kn9j5vfag7b4zv2vc1i4jkrqjz1pc109df6vh04q9cd8g8c";
+      type = "gem";
+    };
+    version = "0.95.1";
+  };
+  async-pool = {
+    dependencies = [ "async" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1vg3lwb3yhq0rad3dm00vp35vrahkbxgl4kx3d2rqkdh09xs2hqa";
+      type = "gem";
+    };
+    version = "0.11.2";
   };
   aws-eventstream = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1mvjjn8vh1c3nhibmjj9qcwxagj6m9yy961wblfqdmvhr9aklb3y";
+      sha256 = "0fqqdqg15rgwgz3mn4pj91agd20csk9gbrhi103d20328dfghsqi";
       type = "gem";
     };
-    version = "1.3.2";
+    version = "1.4.0";
   };
   aws-partitions = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0jdajznsdc0niv68xqp9sv29l9piyn32grq1y367l14hbm17mnf2";
+      sha256 = "07i2n8f7cpbcckj6zqlivhw05khsrg77bijj2jdb00y3z2zcd90m";
       type = "gem";
     };
-    version = "1.1064.0";
+    version = "1.1267.0";
   };
   aws-sdk-cloudwatchlogs = {
     dependencies = [
@@ -39,10 +89,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1izd0al8i8wmi0cx18w4y8nriw623c21rb7c8vwpgk4mzd2kqxhw";
+      sha256 = "1ja3j4a3mvgcdrcpzisip40h5f4mix0724p14w8c1phxd794xz5r";
       type = "gem";
     };
-    version = "1.109.0";
+    version = "1.159.0";
   };
   aws-sdk-core = {
     dependencies = [
@@ -50,16 +100,18 @@
       "aws-partitions"
       "aws-sigv4"
       "base64"
+      "bigdecimal"
       "jmespath"
+      "logger"
     ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0cjdqmy5hjbgzc0iac1i143va76qgp7jc7hg1aviy1n8cgywq44y";
+      sha256 = "1zhj444iybzs1ikw1p4arv3zayw9xkk1ifnsb6g3r2j6p0h34gpf";
       type = "gem";
     };
-    version = "3.220.1";
+    version = "3.254.0";
   };
   aws-sdk-firehose = {
     dependencies = [
@@ -70,10 +122,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1sryh7fjg525ddwlbd37mi3ygjcc6qn9r0md64d6ssrvk2ah0v1i";
+      sha256 = "0sxr068m9fxw04m79ainsr3fniq7pxdwcp9syxbxxyq65bgq300g";
       type = "gem";
     };
-    version = "1.89.0";
+    version = "1.112.0";
   };
   aws-sdk-kinesis = {
     dependencies = [
@@ -84,10 +136,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1qfwsc373a674y8xcy8g1ykc84d21vbz0dqpbh1f1k2mny2cxz7s";
+      sha256 = "0g7m6ii4m03h6prd21z42yll259qlk08agfydkcikrixq1nlf3rz";
       type = "gem";
     };
-    version = "1.74.0";
+    version = "1.103.0";
   };
   aws-sdk-kms = {
     dependencies = [
@@ -98,10 +150,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1a3mh89kfh6flqxw48wfv9wfwkj2zxazw096mqm56wnnzz1jyads";
+      sha256 = "0jfpgjyhq3f7w67p3361f1racrc1m502zan934m7mdrir9i3ds52";
       type = "gem";
     };
-    version = "1.99.0";
+    version = "1.130.0";
   };
   aws-sdk-s3 = {
     dependencies = [
@@ -113,10 +165,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "03a55dbihv6xvgfwhx0f35rwc7q3rr0555vfpxlwpdjw75wkbz6h";
+      sha256 = "0fd9xq7xyadlldgd9l9iry3fi38wwr1iaag9ax4xpirpkazj6asm";
       type = "gem";
     };
-    version = "1.182.0";
+    version = "1.227.0";
   };
   aws-sdk-sqs = {
     dependencies = [
@@ -127,10 +179,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "16b5jdnmk93l86nnqpij4zac7srx8c2yvx07xxbazmkawcnrd27g";
+      sha256 = "0wj489w3v5canns7c5lnp38hjf954gxfvlva76vwrw9618cvzznd";
       type = "gem";
     };
-    version = "1.93.0";
+    version = "1.117.0";
   };
   aws-sigv4 = {
     dependencies = [ "aws-eventstream" ];
@@ -138,20 +190,30 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1nx1il781qg58nwjkkdn9fw741cjjnixfsh389234qm8j5lpka2h";
+      sha256 = "003ch8qzh3mppsxch83ns0jra8d222ahxs96p9cdrl0grfazywv9";
       type = "gem";
     };
-    version = "1.11.0";
+    version = "1.12.1";
   };
   base64 = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "01qml0yilb9basf7is2614skjp8384h2pycfx86cr8023arfj98g";
+      sha256 = "0yx9yn47a8lkfcjmigk79fykxvr80r4m1i35q82sxzynpbm7lcr7";
       type = "gem";
     };
-    version = "0.2.0";
+    version = "0.3.0";
+  };
+  bigdecimal = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1g9zi8c4i7g8zz0c3hxrw6mblrjvgn7akys60clb9si7c1k1gljk";
+      type = "gem";
+    };
+    version = "4.1.2";
   };
   bson = {
     groups = [ "default" ];
@@ -168,30 +230,45 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1ipbrgvf0pp6zxdk5ascp6i29aybz2bx9wdrlchjmpx6mhvkwfw1";
+      sha256 = "1c2i64xsd35vijnb50rxb70g508s0x674xi0qpyyb8jy7bncl4j4";
       type = "gem";
     };
-    version = "1.3.5";
+    version = "1.3.7";
+  };
+  console = {
+    dependencies = [
+      "fiber-annotation"
+      "fiber-local"
+      "json"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "01vg83f2q7n0q5dsq2sfjmm6mrizhyzkmw21i4ysg06g0slrwna5";
+      type = "gem";
+    };
+    version = "1.36.0";
   };
   "cool.io" = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0cl3ri6zsnpm3hixmlkrmyjir1w7m9szjfizwvccn05qb40a4apa";
+      sha256 = "0lzay9zxgf7j2avpl19334si092f3xyfd819wq75nmbrdwp4l0m5";
       type = "gem";
     };
-    version = "1.9.0";
+    version = "1.9.4";
   };
   csv = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0kmx36jjh2sahd989vcvw74lrlv07dqc3rnxchc5sj2ywqsw3w3g";
+      sha256 = "0gz7r2kazwwwyrwi95hbnhy54kwkfac5swh2gy5p5vw36fn38lbf";
       type = "gem";
     };
-    version = "3.3.2";
+    version = "3.3.5";
   };
   digest-crc = {
     dependencies = [ "rake" ];
@@ -209,10 +286,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0h5kbj9hvg5hb3c7l425zpds0vb42phvln2knab8nmazg2zp5m79";
+      sha256 = "0wrkl7yiix268s2md1h6wh91311w95ikd8fy8m5gx589npyxc00b";
       type = "gem";
     };
-    version = "2.2.1";
+    version = "2.2.3";
   };
   elastic-transport = {
     dependencies = [
@@ -223,10 +300,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0xz5q3zlbkwdb9zipallvqxdw6gnz8ljyz4w7b3pv1lar43f9sdm";
+      sha256 = "1i2qzvf40hvp1s0m44kvpzi9zsinsy7w8fsrj62saa07n6pkdw1v";
       type = "gem";
     };
-    version = "8.4.0";
+    version = "8.5.3";
   };
   elasticsearch = {
     dependencies = [
@@ -237,21 +314,24 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1nbwd1f5s060hiqcs2bmwzvsli3l3vcyyd3khxcxzzxvysqq0zb9";
+      sha256 = "0hpvj11mbn74z8ph17qjs1n7jkpjv5csr1x1nhrnk9zi04xnwjnw";
       type = "gem";
     };
-    version = "8.17.1";
+    version = "9.4.3";
   };
   elasticsearch-api = {
-    dependencies = [ "multi_json" ];
+    dependencies = [
+      "base64"
+      "multi_json"
+    ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1iwl70xid303nyhfv5342yj5kk37rjbgdzkjdi83fnvyhisi5166";
+      sha256 = "14n9mypalmi9f1gv9xkdirjxhihv3wiks2vsgdnl7q19wyfq2626";
       type = "gem";
     };
-    version = "8.17.1";
+    version = "9.4.3";
   };
   excon = {
     dependencies = [ "logger" ];
@@ -259,10 +339,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "17asr18vawi08g3wbif0wdi8bnyj01d125saydl9j1f03fv0n16a";
+      sha256 = "0l3dpg45i74ap1d7c4wyrdlc67l9vj4kgzv2l2r8mg1304fss0y5";
       type = "gem";
     };
-    version = "1.2.5";
+    version = "1.5.0";
   };
   faraday = {
     dependencies = [
@@ -274,10 +354,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1mls9g490k63rdmjc9shqshqzznfn1y21wawkxrwp2vvbk13jwqm";
+      sha256 = "0y7j6yzv07zggic6g0p2v1ivnvkzsbqjnfdl4215qqb6cxz290hq";
       type = "gem";
     };
-    version = "2.12.2";
+    version = "2.14.3";
   };
   faraday-excon = {
     dependencies = [
@@ -288,10 +368,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0xdmwnkkms7bnx0bpkdk52qcazjqa3skb7jmjr21cjr8mdsp3z65";
+      sha256 = "1xn867jjsy4dj0sxrrwd58l3kpdjs1in4p1jcbmni126hcszy1ra";
       type = "gem";
     };
-    version = "2.3.0";
+    version = "2.4.0";
   };
   faraday-net_http = {
     dependencies = [ "net-http" ];
@@ -299,10 +379,41 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0jp5ci6g40d6i50bsywp35l97nc2fpi9a592r2cibwicdb6y9wd1";
+      sha256 = "125m3qri52vwh5v9dhq0dkqxf8629cxrf99yyc01pva72wasyy0f";
       type = "gem";
     };
-    version = "3.4.0";
+    version = "3.4.4";
+  };
+  fiber-annotation = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "00vcmynyvhny8n4p799rrhcx0m033hivy0s1gn30ix8rs7qsvgvs";
+      type = "gem";
+    };
+    version = "0.2.0";
+  };
+  fiber-local = {
+    dependencies = [ "fiber-storage" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "01lz929qf3xa90vra1ai1kh059kf2c8xarfy6xbv1f8g457zk1f8";
+      type = "gem";
+    };
+    version = "1.1.0";
+  };
+  fiber-storage = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1qa0j9qjwav9xb0n3isx0rbh0942xrfback392n6vs8bidnmp3pl";
+      type = "gem";
+    };
+    version = "1.0.1";
   };
   fluent-config-regexp-type = {
     dependencies = [ "fluentd" ];
@@ -324,10 +435,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "139d7qv4my818mhjp0104ns9dlndlvrb6dgxa2rkv6jlzlamjpjb";
+      sha256 = "0d4vr7mkha72f65pnisqp26gppas0zhz4xvpyqk0ka9mkwyj2m2m";
       type = "gem";
     };
-    version = "0.14.3";
+    version = "0.15.0";
   };
   fluent-plugin-concat = {
     dependencies = [ "fluentd" ];
@@ -335,10 +446,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1b9z6hrjcsvccfimmgczzcbhvf2zwyqzvsdc29i2biqhk1mcwn3k";
+      sha256 = "18vsv1lh41hk12ji11zsf2ipqzw0l6isxw748yhrlzfz55lh2j99";
       type = "gem";
     };
-    version = "2.5.0";
+    version = "2.6.2";
   };
   fluent-plugin-elasticsearch = {
     dependencies = [
@@ -352,10 +463,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "19psa92z4zsmbwz8n4rizkwws58qlgb30325rhmqpnsp9h8b0cbb";
+      sha256 = "0lnz56kaxqp28dckn5f7xb6mywf5dr0v56lvskx5jr67z97wsich";
       type = "gem";
     };
-    version = "5.4.3";
+    version = "6.0.0";
   };
   fluent-plugin-kafka = {
     dependencies = [
@@ -383,13 +494,14 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "12wx84a9h1xjldxa3yxxsmkyn620m2knw47dmfnr9rvgw2s4dlrz";
+      sha256 = "0jq7ci8h243g23dhx9vbqz1sb2kipz7v7y318wvj4lnq2xgpmmj5";
       type = "gem";
     };
-    version = "3.5.0";
+    version = "3.7.0";
   };
   fluent-plugin-mongo = {
     dependencies = [
+      "bigdecimal"
       "fluentd"
       "mongo"
     ];
@@ -397,10 +509,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1m3fa6fwpzxw08lnczsif5c7v33yryyvgb1lbp7a7qjhipvb6jfm";
+      sha256 = "09h70j007gb7ia66fm67b9842vbdfp18h1bf8mgjxvhz4ylx4p26";
       type = "gem";
     };
-    version = "1.6.0";
+    version = "1.6.3";
   };
   fluent-plugin-record-reformer = {
     dependencies = [ "fluentd" ];
@@ -437,10 +549,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0c7l7y51j5fz99086ghj99rjv16frj5kl4wcclvfws1jc5c38mj9";
+      sha256 = "1r6vqs2zlsck2v6pd89g9s2mxk064y0pls0s3awbq4186a8kpn9r";
       type = "gem";
     };
-    version = "1.8.3";
+    version = "1.8.5";
   };
   fluent-plugin-webhdfs = {
     dependencies = [
@@ -458,6 +570,7 @@
   };
   fluentd = {
     dependencies = [
+      "async-http"
       "base64"
       "cool.io"
       "csv"
@@ -465,42 +578,80 @@
       "http_parser.rb"
       "logger"
       "msgpack"
+      "net-http"
+      "ostruct"
       "serverengine"
       "sigdump"
       "strptime"
       "tzinfo"
       "tzinfo-data"
+      "uri"
       "webrick"
       "yajl-ruby"
+      "zstd-ruby"
     ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "100fd0ihgpqddkdqmbvlp51v09rnr4xb25l5lq776ai21hc4gj8d";
+      sha256 = "1n2f3lfc99ry640i1j2xar2fp9yn6fhrbzdw0ilpdicrclnmb3y2";
       type = "gem";
     };
-    version = "1.18.0";
+    version = "1.19.3";
   };
   google-protobuf = {
+    dependencies = [
+      "bigdecimal"
+      "rake"
+    ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0g0h7rwiivx93jddfws5pdkcpnhma3694k2jfv2i1k80qkrqnrmv";
+      sha256 = "09ipzsijxkrgwnyic0l4yhnazw46ca7ll0adza6za66r649lg9m3";
       type = "gem";
     };
-    version = "3.25.6";
+    version = "4.35.1";
   };
   "http_parser.rb" = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1gj4fmls0mf52dlr928gaq0c0cb0m3aqa9kaa6l0ikl2zbqk42as";
+      sha256 = "0yh924g697spcv4hfigyxgidhyy6a7b9007rnac57airbcadzs4s";
       type = "gem";
     };
-    version = "0.8.0";
+    version = "0.8.1";
+  };
+  io-endpoint = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0f1kzf4d5qgqgfjh52a8pf3pii5dmav6ib0zq4wmicqnq5kggsiz";
+      type = "gem";
+    };
+    version = "0.17.2";
+  };
+  io-event = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1rkfxcydk07qa9zs2ll7fj9zhl374v6vb0m9m7dbz74832isj6l5";
+      type = "gem";
+    };
+    version = "1.19.1";
+  };
+  io-stream = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1pi0vr60l3ld4mlfrhgbiyvxkribi82258mlh1s7dg8gzd6pq3ap";
+      type = "gem";
+    };
+    version = "0.13.1";
   };
   jmespath = {
     groups = [ "default" ];
@@ -517,20 +668,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1p4l5ycdxfsr8b51gnvlvhq6s21vmx9z4x617003zbqv3bcqmj6x";
+      sha256 = "0ay31y1yl208xrpcsw6b0k4q309magq7q5prmdbb0lm9ampbqqlk";
       type = "gem";
     };
-    version = "2.10.1";
+    version = "2.20.0";
   };
   logger = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "05s008w9vy7is3njblmavrbdzyrwwc1fsziffdr58w9pwqj8sqfx";
+      sha256 = "00q2zznygpbls8asz5knjvvj2brr3ghmqxgr83xnrdj4rk3xwvhr";
       type = "gem";
     };
-    version = "1.6.6";
+    version = "1.7.0";
   };
   ltsv = {
     groups = [ "default" ];
@@ -542,6 +693,16 @@
     };
     version = "0.1.2";
   };
+  metrics = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0wlh0g4xmfqa41dsh4m3514q3jcvy6jx97mwn6ayj62ir6xdbpk1";
+      type = "gem";
+    };
+    version = "0.15.0";
+  };
   mongo = {
     dependencies = [ "bson" ];
     groups = [ "default" ];
@@ -558,20 +719,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0cnpnbn2yivj9gxkh8mjklbgnpx6nf7b8j2hky01dl0040hy0k76";
+      sha256 = "18g6ps30z6m365bly7sfialavnsf6m6qamdxsr84w96k51j4mnlb";
       type = "gem";
     };
-    version = "1.8.0";
+    version = "1.8.3";
   };
   multi_json = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0pb1g1y3dsiahavspyzkdy39j4q377009f6ix0bh1ag4nqw43l0z";
+      sha256 = "1040lr5y2phn7avdyam6zw6ikprlmk77biw3yhclsfwfh0qnl4p6";
       type = "gem";
     };
-    version = "1.15.0";
+    version = "1.21.1";
   };
   net-http = {
     dependencies = [ "uri" ];
@@ -579,30 +740,95 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1ysrwaabhf0sn24jrp0nnp51cdv0jf688mh5i6fsz63q2c6b48cn";
+      sha256 = "15k96fj6qwbaiv6g52l538ass95ds1qwgynqdridz29yqrkhpfi5";
       type = "gem";
     };
-    version = "0.6.0";
+    version = "0.9.1";
+  };
+  ostruct = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "04nrir9wdpc4izqwqbysxyly8y7hsfr4fsv69rw91lfi9d5fv8lm";
+      type = "gem";
+    };
+    version = "0.6.3";
+  };
+  protocol-hpack = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "14ddqg5mcs9ysd1hdzkm5pwil0660vrxcxsn576s3387p0wa5v3g";
+      type = "gem";
+    };
+    version = "1.5.1";
+  };
+  protocol-http = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0fvpza7nnbyd3nfxkn5gych6diwns386g2ib9s6azh99c3sz5hg1";
+      type = "gem";
+    };
+    version = "0.62.2";
+  };
+  protocol-http1 = {
+    dependencies = [ "protocol-http" ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1syqgaklsn9rf11xmll2s3ms7jvpd5zjng9jdb3r8pbgv963z6z4";
+      type = "gem";
+    };
+    version = "0.39.0";
+  };
+  protocol-http2 = {
+    dependencies = [
+      "protocol-hpack"
+      "protocol-http"
+    ];
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "11kl6768hpzgvvvlpyvmr74v0jqf2vslcwngs3643cl2h3brrj5s";
+      type = "gem";
+    };
+    version = "0.26.0";
+  };
+  protocol-url = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "1qd9vsn9sif58swfqsyj429aynqyv6hpgbzxqrd83baidcxw1m34";
+      type = "gem";
+    };
+    version = "0.4.0";
   };
   public_suffix = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0vqcw3iwby3yc6avs1vb3gfd0vcp2v7q310665dvxfswmcf4xm31";
+      sha256 = "08znfv30pxmdkjyihvbjqbvv874dj3nybmmyscl958dy3f7v12qs";
       type = "gem";
     };
-    version = "6.0.1";
+    version = "7.0.5";
   };
   rake = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "17850wcwkgi30p7yqh60960ypn7yibacjjha0av78zaxwvd3ijs6";
+      sha256 = "009p524zl0p0kfa65nii8wdmaigkmawv9pbvlcffky7islmmp0nb";
       type = "gem";
     };
-    version = "13.2.1";
+    version = "13.4.2";
   };
   ruby-kafka = {
     dependencies = [ "digest-crc" ];
@@ -650,6 +876,16 @@
     };
     version = "0.2.5";
   };
+  traces = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "05722prvh34n96irnxa762wz0yj2nyrz70ab2zby3b6snjf69wc0";
+      type = "gem";
+    };
+    version = "0.18.2";
+  };
   tzinfo = {
     dependencies = [ "concurrent-ruby" ];
     groups = [ "default" ];
@@ -667,20 +903,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "02yz3x0qxnnwbf7k18yck5pggbnyy43rq0d5w2r6rwlk3981m31d";
+      sha256 = "1ygpikd3hdqsi16gqh33r5al1b9xdwrv2wl3rw210g7iar9vr3s7";
       type = "gem";
     };
-    version = "1.2025.1";
+    version = "1.2026.3";
   };
   uri = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "04bhfvc25b07jaiaf62yrach7khhr5jlr5bx6nygg8pf11329wp9";
+      sha256 = "1ijpbj7mdrq7rhpq2kb51yykhrs2s54wfs6sm9z3icgz4y6sb7rp";
       type = "gem";
     };
-    version = "1.0.3";
+    version = "1.1.1";
   };
   webhdfs = {
     dependencies = [ "addressable" ];
@@ -698,10 +934,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "12d9n8hll67j737ym2zw4v23cn4vxyfkb6vyv1rzpwv6y6a3qbdl";
+      sha256 = "0ca1hr2rxrfw7s613rp4r4bxb454i3ylzniv9b9gxpklqigs3d5y";
       type = "gem";
     };
-    version = "1.9.1";
+    version = "1.9.2";
   };
   yajl-ruby = {
     groups = [ "default" ];
@@ -713,4 +949,14 @@
     };
     version = "1.4.3";
   };
+  zstd-ruby = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "08gxd4hm9qpiyf9bvwwxba75g70j8vascj44y89xccps7bwgplfy";
+      type = "gem";
+    };
+    version = "1.5.7.1";
+  };
 }

From caaf4fc57c4801fada673e8b60a809962dab38d6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 10 Jul 2026 11:22:46 +0000
Subject: [PATCH 14/50] .github: Bump cachix/install-nix-action from 31.10.6 to
 31.10.7

Bumps [cachix/install-nix-action](https://github.com/cachix/install-nix-action) from 31.10.6 to 31.10.7.
- [Release notes](https://github.com/cachix/install-nix-action/releases)
- [Changelog](https://github.com/cachix/install-nix-action/blob/master/RELEASE.md)
- [Commits](https://github.com/cachix/install-nix-action/compare/8aa03977d8d733052d78f4e008a241fd1dbf36b3...a49548c11d9846ad46ecc0115273879b045f001c)

---
updated-dependencies:
- dependency-name: cachix/install-nix-action
  dependency-version: 31.10.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
(cherry picked from commit 53c53d5d5b7e3992614b9de4509a73e2e539f93e)
---
 .github/workflows/build.yml | 2 +-
 .github/workflows/check.yml | 2 +-
 .github/workflows/eval.yml  | 8 ++++----
 .github/workflows/lint.yml  | 6 +++---
 4 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 2ced78e8360b..35717ef3f7f1 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -59,7 +59,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
+      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
         with:
           # Sandbox is disabled on MacOS by default.
           extra_nix_config: sandbox = true
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 4ca2db65c165..0965864220c6 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -147,7 +147,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
+      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
diff --git a/.github/workflows/eval.yml b/.github/workflows/eval.yml
index 0b576a464220..64a87a6f2b90 100644
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -139,7 +139,7 @@ jobs:
             core.info(`Found pinned.json commit: ${ciPinBumpCommit}`)
 
       - name: Install Nix
-        uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
+        uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
 
       - name: Load supported versions
         id: versions
@@ -187,7 +187,7 @@ jobs:
           target-as-trusted-at: ${{ inputs.targetSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
+        uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -277,7 +277,7 @@ jobs:
           merge-multiple: true
 
       - name: Install Nix
-        uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
+        uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
 
       - name: Combine all output paths and eval stats
         run: |
@@ -486,7 +486,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
       - name: Install Nix
-        uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
+        uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
 
       - name: Ensure flake outputs on all systems still evaluate
         run: nix flake check --all-systems --no-build './nixpkgs/untrusted?shallow=1'
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 0e0fcfc30d22..3b743fe2e53a 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -35,7 +35,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
+      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
 
       # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
       # because the cache would be invalidated on every commit - treefmt checks every file.
@@ -70,7 +70,7 @@ jobs:
         with:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
 
-      - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
+      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true
@@ -100,7 +100,7 @@ jobs:
           merged-as-untrusted-at: ${{ inputs.mergedSha }}
           target-as-trusted-at: ${{ inputs.targetSha }}
 
-      - uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
+      - uses: cachix/install-nix-action@a49548c11d9846ad46ecc0115273879b045f001c # v31.10.7
 
       - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
         continue-on-error: true

From 9a1741ac48eb4c3513f876de08361e5d4214739c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Fri, 10 Jul 2026 13:26:58 -0700
Subject: [PATCH 15/50] python3Packages.restrictedpython: 8.1 -> 8.4

Diff: https://github.com/zopefoundation/RestrictedPython/compare/8.1...8.4

Changelog: https://github.com/zopefoundation/RestrictedPython/blob/8.4/CHANGES.rst
(cherry picked from commit 80d63dc5743a047cf3c07a725bce92bba55f5118)
---
 .../development/python-modules/restrictedpython/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/restrictedpython/default.nix b/pkgs/development/python-modules/restrictedpython/default.nix
index 043c8047a3dc..9ca7e05e56c0 100644
--- a/pkgs/development/python-modules/restrictedpython/default.nix
+++ b/pkgs/development/python-modules/restrictedpython/default.nix
@@ -9,19 +9,19 @@
 
 buildPythonPackage rec {
   pname = "restrictedpython";
-  version = "8.1";
+  version = "8.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "zopefoundation";
     repo = "RestrictedPython";
     tag = version;
-    hash = "sha256-UcmH1I2p+XmQm4Y5M+Ms/LMSchor6GD6V9dxippa4HI=";
+    hash = "sha256-Ck5YDtjYs7rZk+MC+eKrQVCQX1EYlxC6m4kD5+QjfjE=";
   };
 
   postPatch = ''
     substituteInPlace pyproject.toml \
-      --replace-fail "setuptools >= 78.1.1,< 81" setuptools
+      --replace-fail "setuptools >= 78.1.1,< 82" setuptools
   '';
 
   build-system = [ setuptools ];

From 2d64c4dd3df31d4f6f6d2b933d76aae4ca8098eb Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Sat, 11 Jul 2026 02:20:23 +0200
Subject: [PATCH 16/50] bs-manager.depotdownloader: 2.7.4-unstable-2024-12-01
 -> 3.4.0-unstable-2026-05-14

(cherry picked from commit 7881b2b5bc6886aec6e99522e99266e3862dec5b)
---
 .../bs/bs-manager/depotdownloader/default.nix | 10 ++---
 .../bs/bs-manager/depotdownloader/deps.json   | 43 +++++++++++--------
 2 files changed, 29 insertions(+), 24 deletions(-)

diff --git a/pkgs/by-name/bs/bs-manager/depotdownloader/default.nix b/pkgs/by-name/bs/bs-manager/depotdownloader/default.nix
index da2e6bbea66c..8e8112ce33d7 100644
--- a/pkgs/by-name/bs/bs-manager/depotdownloader/default.nix
+++ b/pkgs/by-name/bs/bs-manager/depotdownloader/default.nix
@@ -7,19 +7,19 @@
 
 buildDotnetModule {
   pname = "depotdownloader";
-  version = "2.7.4-unstable-2024-12-01";
+  version = "3.4.0-unstable-2026-05-14";
 
   src = fetchFromGitHub {
     owner = "Iluhadesu";
     repo = "DepotDownloader";
-    rev = "a9f58e5513b72bd00b623a83e1460b3c5db49248";
-    hash = "sha256-+QfwKQJzyXqUvTn8kKP7lYHvbtRtdJ7jc/W7E87tV7w=";
+    rev = "0ab6676c51f27d3b9e63278e3c18484d4d2bf063";
+    hash = "sha256-qC9EakT1tu8NNwbmj7HmYgcIoEUlMRRHNGnKggVNDgk=";
   };
 
   projectFile = "DepotDownloader.sln";
   nugetDeps = ./deps.json;
-  dotnet-sdk = dotnetCorePackages.sdk_8_0;
-  dotnet-runtime = dotnetCorePackages.runtime_8_0;
+  dotnet-sdk = dotnetCorePackages.sdk_9_0;
+  dotnet-runtime = dotnetCorePackages.runtime_9_0;
 
   meta = {
     description = "Fork of DepotDownloader to be used by BSManager";
diff --git a/pkgs/by-name/bs/bs-manager/depotdownloader/deps.json b/pkgs/by-name/bs/bs-manager/depotdownloader/deps.json
index 85d09e76a9de..3acb3405227e 100644
--- a/pkgs/by-name/bs/bs-manager/depotdownloader/deps.json
+++ b/pkgs/by-name/bs/bs-manager/depotdownloader/deps.json
@@ -11,8 +11,8 @@
   },
   {
     "pname": "Microsoft.Windows.CsWin32",
-    "version": "0.3.106",
-    "hash": "sha256-S1uQa684taPb6uh69784ebVpXoirMoX+pxBRA+Rrzlg="
+    "version": "0.3.275",
+    "hash": "sha256-sqIFj1dNatchuS9R7sk0Os6vSoSXFjm20qppvnnw78c="
   },
   {
     "pname": "Microsoft.Windows.SDK.Win32Docs",
@@ -21,38 +21,38 @@
   },
   {
     "pname": "Microsoft.Windows.SDK.Win32Metadata",
-    "version": "60.0.34-preview",
-    "hash": "sha256-KdRe73sXipzMvm2BLmwwBZGh+l9isZDC9l8WFyUR1zM="
+    "version": "63.0.31-preview",
+    "hash": "sha256-MMvQoyVT15IU93EKZ46rhP/hyx3wV452vuFnf8OTd60="
+  },
+  {
+    "pname": "Microsoft.Windows.SDK.Win32Metadata",
+    "version": "70.0.11-preview",
+    "hash": "sha256-JRcTFlzV+sDfgUKPtn0oOn25SdNivmhbS8+0HcAozu8="
   },
   {
     "pname": "Microsoft.Windows.WDK.Win32Metadata",
-    "version": "0.11.4-experimental",
-    "hash": "sha256-b3oKUKbr+3Udfl7RWzUY9BR/XWNsN+VmEkBxk6KiFo0="
+    "version": "0.13.25-experimental",
+    "hash": "sha256-eQeaRJ2PYhBSvK8TA55BHRwbd67EqJzwTZZRjQphlhc="
   },
   {
     "pname": "protobuf-net",
-    "version": "3.2.30",
-    "hash": "sha256-keRy5OWT+/tlZt3D7x+9PEdjTvEJcZdYsf/i1ZBtciE="
+    "version": "3.2.56",
+    "hash": "sha256-KjwRHyGwflQDjVaudT+NjRnfGhHb4CpCfn9hHVixI+E="
   },
   {
     "pname": "protobuf-net.Core",
-    "version": "3.2.30",
-    "hash": "sha256-GMpJNecoBfrV2VgpYOhcZnKZaLFDObNLcX2LBTThrwY="
+    "version": "3.2.56",
+    "hash": "sha256-NVvLreCvvvnS/s0syL5/L3mRpXeswP7E71C6WP9f2Dc="
   },
   {
     "pname": "SteamKit2",
-    "version": "3.0.0-beta.4",
-    "hash": "sha256-7cXlpCuUD8ZuTMtqsT5MdklkZb+XIGBdoI28anjUXtg="
-  },
-  {
-    "pname": "System.Collections.Immutable",
-    "version": "7.0.0",
-    "hash": "sha256-9an2wbxue2qrtugYES9awshQg+KfJqajhnhs45kQIdk="
+    "version": "3.3.1",
+    "hash": "sha256-f6kc15RKNxCSIlynlVHU8fBqQ7N8nG1xV3DNbBlRmvo="
   },
   {
     "pname": "System.IO.Hashing",
-    "version": "8.0.0",
-    "hash": "sha256-szOGt0TNBo6dEdC3gf6H+e9YW3Nw0woa6UnCGGGK5cE="
+    "version": "9.0.8",
+    "hash": "sha256-Jj1XwumBjBa5LJqSVTN2naQJ0FM4wwPvZS8NxGd5Hnw="
   },
   {
     "pname": "System.Security.AccessControl",
@@ -63,5 +63,10 @@
     "pname": "System.Security.Principal.Windows",
     "version": "5.0.0",
     "hash": "sha256-CBOQwl9veFkrKK2oU8JFFEiKIh/p+aJO+q9Tc2Q/89Y="
+  },
+  {
+    "pname": "ZstdSharp.Port",
+    "version": "0.8.6",
+    "hash": "sha256-rc3YWP80fykqujDsD72SXOA1tBDoy2KrvVETOC8eTx8="
   }
 ]

From cf6748ee3d2741be24210bd7aefa7b706d374e7d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 17 Jun 2026 16:02:43 -0700
Subject: [PATCH 17/50] postfix: 3.11.3 -> 3.11.4

Changelog: https://www.postfix.org/announcements/postfix-3.11.4.html
(cherry picked from commit 22b901e6bdca3a571ba8fd24367d8909b6ff50e8)
---
 pkgs/by-name/po/postfix/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/po/postfix/package.nix b/pkgs/by-name/po/postfix/package.nix
index c92c8a00a086..0e10ca91a12f 100644
--- a/pkgs/by-name/po/postfix/package.nix
+++ b/pkgs/by-name/po/postfix/package.nix
@@ -78,11 +78,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "postfix";
-  version = "3.11.3";
+  version = "3.11.4";
 
   src = fetchurl {
     url = "http://ftp.porcupine.org/mirrors/postfix-release/official/postfix-${finalAttrs.version}.tar.gz";
-    hash = "sha256-vRHcxGPXBF5A8sEcwAIWSJxztYzECz0GxUJlsIihc+E=";
+    hash = "sha256-Im7FmhjkPid2kQBeMUlvdgi5upIQvmAKJn+yF6Smzuk=";
   };
 
   nativeBuildInputs = [

From 1da3faec1206250e725e7ce1363f99be2b85c4bf Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 10 Jul 2026 09:59:48 +0000
Subject: [PATCH 18/50] ghostfolio: 3.18.0 -> 3.22.0

(cherry picked from commit 36f4fbe4c5bc49269356ba9263b41a31777cb2c9)
---
 pkgs/by-name/gh/ghostfolio/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gh/ghostfolio/package.nix b/pkgs/by-name/gh/ghostfolio/package.nix
index 11b14a9bcb6d..8e3553840b3f 100644
--- a/pkgs/by-name/gh/ghostfolio/package.nix
+++ b/pkgs/by-name/gh/ghostfolio/package.nix
@@ -12,13 +12,13 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "ghostfolio";
-  version = "3.18.0";
+  version = "3.22.0";
 
   src = fetchFromGitHub {
     owner = "ghostfolio";
     repo = "ghostfolio";
     tag = finalAttrs.version;
-    hash = "sha256-BSH7NQV2iTmfGE6dHQEeObQQ5CkKZxsgHAbrjElHHHE=";
+    hash = "sha256-zKXq6juvxaPJ7h/2HDzh7lREFj0ni5HsAyhEbZ09K3M=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -28,7 +28,7 @@ buildNpmPackage (finalAttrs: {
     '';
   };
 
-  npmDepsHash = "sha256-0Si+3zHyGoMbgEpNWdZVp+obNE0oqM8ghYDZvloJU5g=";
+  npmDepsHash = "sha256-r/LaDTd4TvoPll2w0It0cVOBniMnlZf1jg5mL9wII7I=";
 
   postPatch = ''
     substituteInPlace replace.build.mjs \

From 885ed28bc48c396b578587f586ce90acf9e8d03e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 10 Jul 2026 17:36:16 +0000
Subject: [PATCH 19/50] nezha-theme-user: 2.3.1 -> 2.4.0

(cherry picked from commit 98aa7b619e5017509c6a2902a45036614cda1b49)
---
 pkgs/by-name/ne/nezha-theme-user/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ne/nezha-theme-user/package.nix b/pkgs/by-name/ne/nezha-theme-user/package.nix
index e230c6c10b85..ab249772459c 100644
--- a/pkgs/by-name/ne/nezha-theme-user/package.nix
+++ b/pkgs/by-name/ne/nezha-theme-user/package.nix
@@ -13,13 +13,13 @@ let
 in
 buildNpmPackage (finalAttrs: {
   pname = "nezha-theme-user";
-  version = "2.3.1";
+  version = "2.4.0";
 
   src = fetchFromGitHub {
     owner = "hamster1963";
     repo = "nezha-dash-v2";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/2G0KhlXIvVM8db4nATJHiwPsvKXh8SNE+9DpllfSTs=";
+    hash = "sha256-ikrRkYrJnTRaBk3u6Ju0csRW9K3Udydh/JFTi/GxVOs=";
   };
 
   postPatch = ''
@@ -37,7 +37,7 @@ buildNpmPackage (finalAttrs: {
     inherit (finalAttrs) pname version src;
     inherit pnpm;
     fetcherVersion = 4;
-    hash = "sha256-k/05ccqV72kC9E9MX+os8R0wmgIhnDYIwRNmIbedL1I=";
+    hash = "sha256-5lzMFY+PYHSQTWSewfLaspgeRq5PwWnU0ZzHYPzSMwE=";
   };
   npmConfigHook = pnpmConfigHook;
 

From eb9064090a3a260d7342ad29f65bae2232dbd5cf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Thu, 9 Jul 2026 17:24:42 -0700
Subject: [PATCH 20/50] postfix: 3.11.4 -> 3.11.5

Changelog: https://www.postfix.org/announcements/postfix-3.11.5.html
(cherry picked from commit f4d05ddae14c37880b8c45154f4aba4d41878cf0)
---
 pkgs/by-name/po/postfix/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/po/postfix/package.nix b/pkgs/by-name/po/postfix/package.nix
index 0e10ca91a12f..9ce23548cad4 100644
--- a/pkgs/by-name/po/postfix/package.nix
+++ b/pkgs/by-name/po/postfix/package.nix
@@ -78,11 +78,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "postfix";
-  version = "3.11.4";
+  version = "3.11.5";
 
   src = fetchurl {
     url = "http://ftp.porcupine.org/mirrors/postfix-release/official/postfix-${finalAttrs.version}.tar.gz";
-    hash = "sha256-Im7FmhjkPid2kQBeMUlvdgi5upIQvmAKJn+yF6Smzuk=";
+    hash = "sha256-Smqz0Ok5CYn6IB/GxEYEX8cCxOFueiR8OuJhyem+5hA=";
   };
 
   nativeBuildInputs = [

From caa7b7c19ac40d53a479f8b59416fce99f99852a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Jul 2026 00:25:34 +0000
Subject: [PATCH 21/50] limine-full: 12.4.0 -> 12.4.1

(cherry picked from commit 2d39918345fb02dc2095957242bc6cf61c74df55)
---
 pkgs/by-name/li/limine/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/limine/package.nix b/pkgs/by-name/li/limine/package.nix
index 92f2cddca229..7d96af03f96f 100644
--- a/pkgs/by-name/li/limine/package.nix
+++ b/pkgs/by-name/li/limine/package.nix
@@ -47,14 +47,14 @@ in
 # as bootloader for various platforms and corresponding binary and helper files.
 stdenv.mkDerivation (finalAttrs: {
   pname = "limine";
-  version = "12.4.0";
+  version = "12.4.1";
 
   # We don't use the Git source but the release tarball, as the source has a
   # `./bootstrap` script performing network access to download resources.
   # Packaging that in Nix is very cumbersome.
   src = fetchurl {
     url = "https://github.com/Limine-Bootloader/Limine/releases/download/v${finalAttrs.version}/limine-${finalAttrs.version}.tar.gz";
-    hash = "sha256-fDTQuY+WYhyJl5AqP4ZoJ1T7WXgCca35pXHAv/8CjlA=";
+    hash = "sha256-LcpQkn1WTYCiRvLEmk31ii1KN62jHINb0oAoiF9t5V8=";
   };
 
   enableParallelBuilding = true;

From e72c59fb2ec089ec8ca53622ed0d39ccc311881e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Jul 2026 12:03:11 +0000
Subject: [PATCH 22/50] matrix-synapse-unwrapped: 1.155.0 -> 1.156.0

(cherry picked from commit 3c12c0889ef9b784293943c61b18108a953c657b)
---
 pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix b/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
index b85e77bcebda..c4cce0f2767e 100644
--- a/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
+++ b/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
@@ -14,19 +14,19 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "matrix-synapse";
-  version = "1.155.0";
+  version = "1.156.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "synapse";
     rev = "v${version}";
-    hash = "sha256-ka92mJvm/7PaENPkQRWuw8c8BdzMvIuTsc3xSEmEms8=";
+    hash = "sha256-x3EVmNPqcxtvt6ZaPsDCCcr7Z0LIO257s2gO3HCNmKA=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit pname version src;
-    hash = "sha256-+Z2GyHlVothtcTKHjbr+iKQG8wi5tgtoZr8+FHYJEFk=";
+    hash = "sha256-N/JWRFz9OKcxigjp86AVVZGK63MdZmEzwHhBgBuWZcY=";
   };
 
   build-system =

From 1e22edf6470f731e6d99a0bdb7a567d26fc846e0 Mon Sep 17 00:00:00 2001
From: phanirithvij <phanirithvij2000@gmail.com>
Date: Sat, 11 Jul 2026 09:22:15 +0530
Subject: [PATCH 23/50] pdfding: fix build on darwin

Signed-off-by: phanirithvij <phanirithvij2000@gmail.com>
(cherry picked from commit 14be8178d92f3bb9ec2d0735d42c62293fa7ef37)
---
 pkgs/by-name/pd/pdfding/frontend.nix | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/pd/pdfding/frontend.nix b/pkgs/by-name/pd/pdfding/frontend.nix
index 5a1c5566b523..76090903d5e0 100644
--- a/pkgs/by-name/pd/pdfding/frontend.nix
+++ b/pkgs/by-name/pd/pdfding/frontend.nix
@@ -4,9 +4,7 @@
   fetchzip,
   npmHooks,
 
-  tailwindcss_4,
   nodejs,
-
   pdfding,
 }:
 let
@@ -39,8 +37,6 @@ stdenv.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     nodejs
     npmHooks.npmConfigHook
-    # it is in package.json and thus node_modules but no cli executable
-    tailwindcss_4
   ];
 
   strictDeps = true;
@@ -53,7 +49,12 @@ stdenv.mkDerivation (finalAttrs: {
     cp -r --no-preserve=mode pdfding/static $out/pdfding/static
     cp -r --no-preserve=mode ${finalAttrs.passthru.pdfjs} $out/pdfding/static/pdfjs
 
-    tailwindcss -i $out/pdfding/static/css/input.css -o $out/pdfding/static/css/tailwind.css --minify
+    # NOTE: Directly using tailwindcss package from nixpkgs gave a `Trace/BPT trap: 5` error on darwin
+    # Trace/BPT trap: 5 tailwindcss -i $out/pdfding/static/css/input.css -o $out/pdfding/static/css/tailwind.css --minify
+    # It didn't occur when building the package in an interactive ssh session but on nixpkgs-review-gha it failed consistently
+    # https://github.com/NixOS/nixpkgs/pull/540436#issuecomment-4942029413
+
+    node node_modules/@tailwindcss/cli/dist/index.mjs -i pdfding/static/css/input.css -o $out/pdfding/static/css/tailwind.css --minify
     rm $out/pdfding/static/css/input.css
 
     for i in build/pdf.mjs build/pdf.sandbox.mjs build/pdf.worker.mjs web/viewer.mjs;

From 7a4e858cb34aaa6013a6b60313de6f0a07bd42e0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 10 Jul 2026 18:54:08 +0000
Subject: [PATCH 24/50] tui-journal: 0.16.1 -> 0.17.0

(cherry picked from commit 5151988682746c61f11a9909ea81ae95ba834ed1)
---
 pkgs/by-name/tu/tui-journal/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/tu/tui-journal/package.nix b/pkgs/by-name/tu/tui-journal/package.nix
index 1f8c85e31b3b..c9e4fc9b535a 100644
--- a/pkgs/by-name/tu/tui-journal/package.nix
+++ b/pkgs/by-name/tu/tui-journal/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tui-journal";
-  version = "0.16.1";
+  version = "0.17.0";
 
   src = fetchFromGitHub {
     owner = "AmmarAbouZor";
     repo = "tui-journal";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-crrh7lV5ZMKaxsrFmhXsUgBMbN5nmbf8wQ6croTqUKI=";
+    hash = "sha256-ahjCfSodq4foBV3aBbU0FsSUrEo3wgvFYSBr/OClmpc=";
   };
 
-  cargoHash = "sha256-PmQDLGOXvI0OJ+gMsYa/XLc0WgSH6++23X/b1+iU3JQ=";
+  cargoHash = "sha256-hbRSQ9iVmp0oKEK53y4IuU34WNgq+pRefNxFbP1DPVQ=";
 
   nativeBuildInputs = [
     pkg-config

From 19bb828e4815ba475fce2bcb09caae5aa00fcd38 Mon Sep 17 00:00:00 2001
From: phanirithvij <phanirithvij2000@gmail.com>
Date: Sat, 11 Jul 2026 13:19:31 +0530
Subject: [PATCH 25/50] tui-journal: fix changelog link

Signed-off-by: phanirithvij <phanirithvij2000@gmail.com>
(cherry picked from commit 2f9abaa7c9557db96b55109013f47e32ec378a89)
---
 pkgs/by-name/tu/tui-journal/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/tu/tui-journal/package.nix b/pkgs/by-name/tu/tui-journal/package.nix
index 1f8c85e31b3b..0b75d2e92259 100644
--- a/pkgs/by-name/tu/tui-journal/package.nix
+++ b/pkgs/by-name/tu/tui-journal/package.nix
@@ -34,9 +34,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
   nativeInstallCheckInputs = [ versionCheckHook ];
 
   meta = {
+    changelog = "https://github.com/AmmarAbouZor/tui-journal/blob/${finalAttrs.src.rev}/CHANGELOG.md";
     description = "Your journal app if you live in a terminal";
     homepage = "https://github.com/AmmarAbouZor/tui-journal";
-    changelog = "https://github.com/AmmarAbouZor/tui-journal/blob/${finalAttrs.src.rev}/CHANGELOG.ron";
     license = lib.licenses.mit;
     mainProgram = "tjournal";
     maintainers = with lib.maintainers; [ phanirithvij ];

From ad901f6443c7d5c89cff0fdbf03f0a8cf3c516a0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 7 Jul 2026 10:56:22 +0000
Subject: [PATCH 26/50] pnpm: 11.9.0 -> 11.10.0

(cherry picked from commit cf8d36f7a2ce3f64305e165381249c549206c651)
---
 pkgs/development/tools/pnpm/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index 49ab2f14ee5e..cd8cde38a654 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -35,8 +35,8 @@ let
       hash = "sha256-WOFDJYhx31FYm2UcBiBdq+xIdmpdu6PCWZm2m1C+WY4=";
     };
     "11" = {
-      version = "11.9.0";
-      hash = "sha256-K1Z6pmAmI4B4rC4KM77D/r1g6WKYeqxpdFbzGAgZsoc=";
+      version = "11.10.0";
+      hash = "sha256-YgtmBepPYvxWptCphzP0eQcdAyHgPkhrUix+mnRhdDE=";
     };
   };
 

From 5d9a1a757788f223a15cbdbd25769de0ab1cc495 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Jul 2026 06:24:04 +0000
Subject: [PATCH 27/50] chhoto-url: 7.4.1 -> 7.4.10

(cherry picked from commit d17f2ee9696f4ffcbb9a79f766ecdc12cc62d2a1)
---
 pkgs/by-name/ch/chhoto-url/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ch/chhoto-url/package.nix b/pkgs/by-name/ch/chhoto-url/package.nix
index 36218ff6c94e..a860045cb091 100644
--- a/pkgs/by-name/ch/chhoto-url/package.nix
+++ b/pkgs/by-name/ch/chhoto-url/package.nix
@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "chhoto-url";
-  version = "7.4.1";
+  version = "7.4.10";
 
   src = fetchFromGitHub {
     owner = "SinTan1729";
     repo = "chhoto-url";
     tag = finalAttrs.version;
-    hash = "sha256-1kPXsN5gOfY8JyaV6J5X2cEH00Xm06nsU5GNuVDxBJo=";
+    hash = "sha256-iZQFH+WoGu91DJT7X8FTs1qktf/SSrh6F9U4/OQWZiI=";
     fetchLFS = true;
   };
 
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail 'rust-version = "1.96"' 'rust-version = "1.95"'
   '';
 
-  cargoHash = "sha256-H3HrHu1y8wIc0j3cCIPOUnFe1jzpx1vCSfZvushIf70=";
+  cargoHash = "sha256-1q5WWNnqDILgDbd9Wztvm0pYDDtaufqOxixwHb4VifY=";
 
   postInstall = ''
     mkdir -p $out/share/chhoto-url

From 909d3cca2b5a7fb5d8963e39f196a5ace3561c42 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 10 Jul 2026 14:53:52 +0000
Subject: [PATCH 28/50] jackett: 0.24.2151 -> 0.24.2200

(cherry picked from commit 0882535f660ad2785840b9fcdfcd6f9869fbe1a9)
---
 pkgs/by-name/ja/jackett/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ja/jackett/package.nix b/pkgs/by-name/ja/jackett/package.nix
index d94c61242a64..1bf8590d5df0 100644
--- a/pkgs/by-name/ja/jackett/package.nix
+++ b/pkgs/by-name/ja/jackett/package.nix
@@ -12,13 +12,13 @@
 
 buildDotnetModule (finalAttrs: {
   pname = "jackett";
-  version = "0.24.2151";
+  version = "0.24.2200";
 
   src = fetchFromGitHub {
     owner = "jackett";
     repo = "jackett";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-V4oBku723EWLTBBjFVkAJTBdhXYTs3Vx98YDinTr5Kc=";
+    hash = "sha256-hmgv17zju1BnT6eapTUhY+3Do/lr2+Cu/ejlU0/vF/I=";
   };
 
   projectFile = "src/Jackett.Server/Jackett.Server.csproj";

From 94954ea21f8f8b1a2cb4e1146fb4ca38859a4485 Mon Sep 17 00:00:00 2001
From: faukah <fau@faukah.com>
Date: Tue, 7 Jul 2026 21:40:58 +0200
Subject: [PATCH 29/50] nh-unwrapped: 4.4.0 -> 4.4.1

(cherry picked from commit 322b2a5a7f55eb85a66392ed9813d50503b4fc2b)
---
 pkgs/by-name/nh/nh-unwrapped/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/nh/nh-unwrapped/package.nix b/pkgs/by-name/nh/nh-unwrapped/package.nix
index 351c1797e2b4..9248f024bf81 100644
--- a/pkgs/by-name/nh/nh-unwrapped/package.nix
+++ b/pkgs/by-name/nh/nh-unwrapped/package.nix
@@ -11,12 +11,12 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "nh-unwrapped";
-  version = "4.4.0";
+  version = "4.4.1";
   src = fetchFromGitHub {
     owner = "nix-community";
     repo = "nh";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ebAi5ODaNRfhKISPPchWoI6FZNO2v+lEyvua7e5OOZo=";
+    hash = "sha256-4B/32NPGtc07kuT/zTeIrQjxCdiLRN8tmQHahwq/R7g=";
   };
 
   strictDeps = true;
@@ -100,7 +100,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       rm $out/bin/xtask
     '';
 
-  cargoHash = "sha256-dRSueVz0BeWwYpMBO1KUUeRoa/CdCWsKPRw0Zeulfe8=";
+  cargoHash = "sha256-pGtYqdAszaHpQ8eoh15S8hB6kO6iqB7O1p+fZUbwxuU=";
 
   passthru.updateScript = nix-update-script { };
 

From bf93e6c808cbe76305f0debc206d45b308640577 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=A9clairevoyant?=
 <848000+eclairevoyant@users.noreply.github.com>
Date: Fri, 10 Jul 2026 23:17:05 -0400
Subject: [PATCH 30/50] librewolf-bin-unwrapped: 152.0.4-1 -> 152.0.5-1

(cherry picked from commit ed2e3f583eeeaf6b234035916147a07250b1607b)
---
 pkgs/by-name/li/librewolf-bin-unwrapped/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix b/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
index 6a545c1b71f1..efd707669374 100644
--- a/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
+++ b/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
@@ -36,7 +36,7 @@ let
 
   pname = "librewolf-bin-unwrapped";
 
-  version = "152.0.4-1";
+  version = "152.0.5-1";
 in
 
 stdenv.mkDerivation {
@@ -46,8 +46,8 @@ stdenv.mkDerivation {
     url = "https://codeberg.org/api/packages/librewolf/generic/librewolf/${version}/librewolf-${version}-${arch}-package.tar.xz";
     hash =
       {
-        x86_64-linux = "sha256-4vmsv93ENtteE18uGJF2ZEhaRA3nGJg//WYYdBREIig=";
-        aarch64-linux = "sha256-Q1vT/9qOs2AiMRsLcofF7F2Y+5QJJloI/QSVZwA9gC8=";
+        x86_64-linux = "sha256-9Y0n3UHRK9WgKhKFIMB3CLmh1Gp5aHoIiKxlKNKe5gc=";
+        aarch64-linux = "sha256-x9vUXaEtjnY6+mOLbLiXmBr5c7ZmEYRTJK9fDIpfgVs=";
       }
       .${stdenv.hostPlatform.system} or throwSystem;
   };

From 01589bdb4b05dd510627e8e309f5077a553fdb8e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 30 Jun 2026 03:25:59 +0000
Subject: [PATCH 31/50] shaka-packager: 3.7.2 -> 3.8.0

(cherry picked from commit 9cbf39435569deee9d104021f550c95e52b88684)
---
 pkgs/by-name/sh/shaka-packager/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sh/shaka-packager/package.nix b/pkgs/by-name/sh/shaka-packager/package.nix
index b4f01d912c02..b78af624674c 100644
--- a/pkgs/by-name/sh/shaka-packager/package.nix
+++ b/pkgs/by-name/sh/shaka-packager/package.nix
@@ -22,13 +22,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "shaka-packager";
-  version = "3.7.2";
+  version = "3.8.0";
 
   src = fetchFromGitHub {
     owner = "shaka-project";
     repo = "shaka-packager";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-E493sleVbsuytneK51lxuQnaEzvAEJwAXYmsxcaOXSs=";
+    hash = "sha256-GdBNysDHDWy1Zgtf+gfKtyvqCiPFJeA3K1mErK/GoRk=";
   };
 
   nativeBuildInputs = [

From a7134f9a3888ab2f08faf2f628c72b9d87df2e2c Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Wed, 10 Jun 2026 11:20:41 +0200
Subject: [PATCH 32/50] nextcloud34: init at 34.0.1

Co-authored-by: Jonas Heinrich <757752+onny@users.noreply.github.com>
Co-Authored-By: Joseph Price <joe@pricey.uk>
(cherry picked from commit 052cec991b12827c83b9e7fb170c885a53614190)
---
 nixos/modules/services/web-apps/nextcloud.md | 2 +-
 nixos/tests/nextcloud/default.nix            | 1 +
 pkgs/servers/nextcloud/default.nix           | 7 +++++++
 pkgs/top-level/all-packages.nix              | 2 ++
 4 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/web-apps/nextcloud.md b/nixos/modules/services/web-apps/nextcloud.md
index 69d7053d1adc..ad2b66ec941c 100644
--- a/nixos/modules/services/web-apps/nextcloud.md
+++ b/nixos/modules/services/web-apps/nextcloud.md
@@ -5,7 +5,7 @@ self-hostable cloud platform. The server setup can be automated using
 [services.nextcloud](#opt-services.nextcloud.enable). A
 desktop client is packaged at `pkgs.nextcloud-client`.
 
-The current default by NixOS is `nextcloud33` which is also the latest
+The current default by NixOS is `nextcloud34` which is also the latest
 major version available.
 
 ## Basic usage {#module-services-nextcloud-basic-usage}
diff --git a/nixos/tests/nextcloud/default.nix b/nixos/tests/nextcloud/default.nix
index 9a3785f89627..2cb226e353da 100644
--- a/nixos/tests/nextcloud/default.nix
+++ b/nixos/tests/nextcloud/default.nix
@@ -149,5 +149,6 @@ listToAttrs (
   concatMap genTests [
     32
     33
+    34
   ]
 )
diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix
index 392485f78891..71964c995439 100644
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@@ -5,6 +5,7 @@
   nixosTests,
   nextcloud32Packages,
   nextcloud33Packages,
+  nextcloud34Packages,
 }:
 
 let
@@ -64,6 +65,12 @@ in
     packages = nextcloud33Packages;
   };
 
+  nextcloud34 = generic {
+    version = "34.0.1";
+    hash = "sha256-BOnDL8P+Ofa2qKGJFe9a/SgKVrSn90Thj1+i7/+8SmM=";
+    packages = nextcloud34Packages;
+  };
+
   # tip: get the sha with:
   # curl 'https://download.nextcloud.com/server/releases/nextcloud-${version}.tar.bz2.sha256'
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b70b8212d637..d0e90d3fff8a 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2765,10 +2765,12 @@ with pkgs;
   inherit (callPackages ../servers/nextcloud { })
     nextcloud32
     nextcloud33
+    nextcloud34
     ;
 
   nextcloud32Packages = callPackage ../servers/nextcloud/packages { ncVersion = "32"; };
   nextcloud33Packages = callPackage ../servers/nextcloud/packages { ncVersion = "33"; };
+  nextcloud34Packages = callPackage ../servers/nextcloud/packages { ncVersion = "34"; };
 
   nextcloud-notify_push = callPackage ../servers/nextcloud/notify_push.nix { };
 

From f78d741c3ad06cc28bf68934cbecc69e3587542b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Fri, 10 Jul 2026 15:33:16 +0200
Subject: [PATCH 33/50] nextcloudPackages: update

Co-authored-by: Jonas Heinrich <757752+onny@users.noreply.github.com>
Co-authored-by: Joseph Price <1044068+JoePricey@users.noreply.github.com>
(cherry picked from commit 3af0f0adf80314aac25c8e129e5c1ef0a46f6b36)
---
 pkgs/servers/nextcloud/packages/32.json |  60 +--
 pkgs/servers/nextcloud/packages/33.json |  60 +--
 pkgs/servers/nextcloud/packages/34.json | 482 ++++++++++++++++++++++++
 3 files changed, 542 insertions(+), 60 deletions(-)
 create mode 100644 pkgs/servers/nextcloud/packages/34.json

diff --git a/pkgs/servers/nextcloud/packages/32.json b/pkgs/servers/nextcloud/packages/32.json
index 1f2d453165f6..5a5083ef47d5 100644
--- a/pkgs/servers/nextcloud/packages/32.json
+++ b/pkgs/servers/nextcloud/packages/32.json
@@ -40,9 +40,9 @@
     ]
   },
   "contacts": {
-    "hash": "sha256-+13qOi3veMZ+QUN8G78a073u8MDgMfaR3HBu6eiEWYQ=",
-    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v8.3.14/contacts-v8.3.14.tar.gz",
-    "version": "8.3.14",
+    "hash": "sha256-rFKmEZtyQgFjGBN44H167hGQP+n72uhUEiXlD7OguTI=",
+    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v8.3.15/contacts-v8.3.15.tar.gz",
+    "version": "8.3.15",
     "description": "The Nextcloud contacts app is a user interface for Nextcloud's CardDAV server. Easily sync contacts from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Mail and Calendar – more to come.\n* 🎉 **Never forget a birthday!** You can sync birthdays and other recurring events with your Nextcloud Calendar.\n* 👥 **Sharing of Adressbooks!** You want to share your contacts with your friends or coworkers? No problem!\n* 🙈 **We’re not reinventing the wheel!** Based on the great and open SabreDAV library.",
     "homepage": "https://github.com/nextcloud/contacts#readme",
     "licenses": [
@@ -50,9 +50,9 @@
     ]
   },
   "cookbook": {
-    "hash": "sha256-Xn2yvgVL7XPIN8awCaH5mznRMW9Jcr0s2E19D13Hm8I=",
-    "url": "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.7/cookbook-0.11.7.tar.gz",
-    "version": "0.11.7",
+    "hash": "sha256-eOB04pPqR5rthxK+yrpxuxgZes9chxjRKhy2yd+kIME=",
+    "url": "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.8/cookbook-0.11.8.tar.gz",
+    "version": "0.11.8",
     "description": "A library for all your recipes. It uses JSON files following the schema.org recipe format. To add a recipe to the collection, you can paste in the URL of the recipe, and the provided web page will be parsed and downloaded to whichever folder you specify in the app settings.",
     "homepage": "https://github.com/nextcloud/cookbook/",
     "licenses": [
@@ -150,9 +150,9 @@
     ]
   },
   "groupfolders": {
-    "hash": "sha256-/29wB6jwECzMsRvp5dXNuKodoMmYjD2gO9xiQX3Bg18=",
-    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v20.1.15/groupfolders-v20.1.15.tar.gz",
-    "version": "20.1.15",
+    "hash": "sha256-rOa82k/IwJdAweCzkZKLLqiOtP63eRdq98zxlnttFzc=",
+    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v20.1.16/groupfolders-v20.1.16.tar.gz",
+    "version": "20.1.16",
     "description": "Team Folders (formerly \"Group Folders\") allows administrators to create and manage shared\nfolders for selected teams within Nextcloud.\n\nAdmins can grant one or more teams access to a folder, configure permissions (such as read,\nwrite, and sharing rights), and assign storage quotas from the Team Folders section (under\nadmin settings). The app also supports advanced permissions and integration with Nextcloud’s\ntrash and versioning systems.\n\nAs of Hub 10 / Nextcloud 31, admins must be members of a team to assign that team to a Team\nFolder.",
     "homepage": "https://github.com/nextcloud/groupfolders",
     "licenses": [
@@ -160,9 +160,9 @@
     ]
   },
   "guests": {
-    "hash": "sha256-w1uPtTZEQFJlhfobGflHf17GEYF3oBPwhieumWfYaDk=",
-    "url": "https://github.com/nextcloud-releases/guests/releases/download/v4.7.5/guests-v4.7.5.tar.gz",
-    "version": "4.7.5",
+    "hash": "sha256-MK3P6fMKYWgKkYTPy9oQFTea/B2iJoZANVVT/HFEnKI=",
+    "url": "https://github.com/nextcloud-releases/guests/releases/download/v4.8.0/guests-v4.8.0.tar.gz",
+    "version": "4.8.0",
     "description": "👥 Allows for better collaboration with external users by allowing users to create guests account.\n\nGuests accounts can be created from the share menu by entering either the recipients email or name and choosing \"create guest account\", once the share is created the guest user will receive an email notification about the mail with a link to set their password.\n\nGuests users can only access files shared to them and cannot create any files outside of shares, additionally, the apps accessible to guest accounts are whitelisted.",
     "homepage": "https://github.com/nextcloud/guests/",
     "licenses": [
@@ -210,9 +210,9 @@
     ]
   },
   "mail": {
-    "hash": "sha256-GkLTk3Q1mSUGhU6lsNHmHGkwW6u4XoDCOj405vi8xuY=",
-    "url": "https://github.com/nextcloud-releases/mail/releases/download/v5.10.3/mail-v5.10.3.tar.gz",
-    "version": "5.10.3",
+    "hash": "sha256-c0pMd+A2Fbxa/20BAkg3lPeVRIdu0XRTbAGJxb/9NT0=",
+    "url": "https://github.com/nextcloud-releases/mail/releases/download/v5.10.7/mail-v5.10.7.tar.gz",
+    "version": "5.10.7",
     "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://www.horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** 🟢/🟡/🟠/🔴\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
     "homepage": "https://github.com/nextcloud/mail#readme",
     "licenses": [
@@ -270,9 +270,9 @@
     ]
   },
   "oidc": {
-    "hash": "sha256-CTnFegGasnG+2MPK6c0H01OjrEKSM0WALwns9nJySaA=",
-    "url": "https://github.com/H2CK/oidc/releases/download/1.17.0/oidc-1.17.0.tar.gz",
-    "version": "1.17.0",
+    "hash": "sha256-5CJjNvbZHuadT+7IHMNJSp8r47kZqzQwMey7ccpe/4Y=",
+    "url": "https://github.com/H2CK/oidc/releases/download/2.0.3/oidc-2.0.3.tar.gz",
+    "version": "2.0.3",
     "description": "Nextcloud as OpenID Connect Identity Provider\n\nWith this app you can use Nextcloud as OpenID Connect Identity Provider. If other services\nare configured correctly, you are able to access those services with your Nextcloud login.\n\nFull documentation can be found at:\n\n- [User Documentation](https://github.com/H2CK/oidc/wiki#user-documentation)\n- [Developer Documentation](https://github.com/H2CK/oidc/wiki#developer-documentation)",
     "homepage": "https://github.com/H2CK/oidc",
     "licenses": [
@@ -390,9 +390,9 @@
     ]
   },
   "spreed": {
-    "hash": "sha256-uBvz8qpJ/PDseSDLp4aWAmTlDIOtoGWAXRouYdqU3Yc=",
-    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v22.0.14/spreed-v22.0.14.tar.gz",
-    "version": "22.0.14",
+    "hash": "sha256-Px8WFUNSRRWMcR/keUhoss7sjOUfXB9IAKdFKPzuSqs=",
+    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v22.0.15/spreed-v22.0.15.tar.gz",
+    "version": "22.0.15",
     "description": "Chat, video & audio-conferencing using WebRTC\n\n* 💬 **Chat** Nextcloud Talk comes with a simple text chat, allowing you to share or upload files from your Nextcloud Files app or local device and mention other participants.\n* 👥 **Private, group, public and password protected calls!** Invite someone, a whole group or send a public link to invite to a call.\n* 🌐 **Federated chats** Chat with other Nextcloud users on their servers\n* 💻 **Screen sharing!** Share your screen with the participants of your call.\n* 🚀 **Integration with other Nextcloud apps** like Files, Calendar, User status, Dashboard, Flow, Maps, Smart picker, Contacts, Deck, and many more.\n* 🌉 **Sync with other chat solutions** With [Matterbridge](https://github.com/42wim/matterbridge/) being integrated in Talk, you can easily sync a lot of other chat solutions to Nextcloud Talk and vice-versa.",
     "homepage": "https://github.com/nextcloud/spreed",
     "licenses": [
@@ -410,9 +410,9 @@
     ]
   },
   "tasks": {
-    "hash": "sha256-nJFU65dthPRWd/SClKM/suZdYU3ic3QsIcXiPzUkQ6c=",
-    "url": "https://github.com/nextcloud/tasks/releases/download/v0.18.0/tasks.tar.gz",
-    "version": "0.18.0",
+    "hash": "sha256-DJiNUFMcm/okbmwx8/lTaa3eFim6cNFRlJFatW4kaHs=",
+    "url": "https://github.com/nextcloud/tasks/releases/download/v0.18.1/tasks.tar.gz",
+    "version": "0.18.1",
     "description": "Once enabled, a new Tasks menu will appear in your Nextcloud apps menu. From there you can add and delete tasks, edit their title, description, start and due dates and mark them as important. Tasks can be shared between users. Tasks can be synchronized using CalDav (each task list is linked to an Nextcloud calendar, to sync it to your local client: Thunderbird, Evolution, KDE Kontact, iCal … - just add the calendar as a remote calendar in your client). You can download your tasks as ICS files using the download button for each calendar.",
     "homepage": "https://github.com/nextcloud/tasks/",
     "licenses": [
@@ -430,9 +430,9 @@
     ]
   },
   "twofactor_admin": {
-    "hash": "sha256-dx8bEsC/rSAKN9rwP2hf3d8G3f3J1RzCrSqU6BbcvRY=",
-    "url": "https://github.com/nextcloud-releases/twofactor_admin/releases/download/v4.11.1/twofactor_admin-v4.11.1.tar.gz",
-    "version": "4.11.1",
+    "hash": "sha256-IkHzIqRBhG6zr+8y5ifrRfsKl9TyMDx7G1JGogbQrDM=",
+    "url": "https://github.com/nextcloud-releases/twofactor_admin/releases/download/v4.12.0/twofactor_admin-v4.12.0.tar.gz",
+    "version": "4.12.0",
     "description": "This two-factor auth (2FA) provider for Nextcloud allows admins to generate a one-time\n\t\tcode for users to log into a 2FA protected account. This is helpful in situations where\n\t\tusers have lost access to their other 2FA methods or mandatory 2FA without any previously\n\t\tenabled 2FA provider.",
     "homepage": "",
     "licenses": [
@@ -480,9 +480,9 @@
     ]
   },
   "user_saml": {
-    "hash": "sha256-rEeaUUYhsTVLZDo11Xh/wGI3k97Tq5J0Jn18QY1M1Xs=",
-    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v8.1.2/user_saml-v8.1.2.tar.gz",
-    "version": "8.1.2",
+    "hash": "sha256-LDiWtEaVJbNECJkcn80L4behkUyUsRlDFDd2lk2g+pE=",
+    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v8.1.4/user_saml-v8.1.4.tar.gz",
+    "version": "8.1.4",
     "description": "Using the SSO & SAML app of your Nextcloud you can make it easily possible to integrate your existing Single-Sign-On solution with Nextcloud. In addition, you can use the Nextcloud LDAP user provider to keep the convenience for users. (e.g. when sharing)\nThe following providers are supported and tested at the moment:\n\n* **SAML 2.0**\n\t* OneLogin\n\t* Shibboleth\n\t* Active Directory Federation Services (ADFS)\n\t* Authentik\n\n* **Authentication via Environment Variable**\n\t* Kerberos (mod_auth_kerb)\n\t* Any other provider that authenticates using the environment variable\n\nWhile theoretically any other authentication provider implementing either one of those standards is compatible, we like to note that they are not part of any internal test matrix.",
     "homepage": "https://github.com/nextcloud/user_saml",
     "licenses": [
diff --git a/pkgs/servers/nextcloud/packages/33.json b/pkgs/servers/nextcloud/packages/33.json
index 3de3fbb4b9cb..a075bf2f9b1d 100644
--- a/pkgs/servers/nextcloud/packages/33.json
+++ b/pkgs/servers/nextcloud/packages/33.json
@@ -40,9 +40,9 @@
     ]
   },
   "contacts": {
-    "hash": "sha256-L0ro4VoU1GDMcs1m7qGns+S8y5+n1Q0oQ5EO1ojdLr0=",
-    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v8.7.2/contacts-v8.7.2.tar.gz",
-    "version": "8.7.2",
+    "hash": "sha256-Lgw+wF40FlZTlbw5IXG/eUW8Chaw5Cm1i9f2R8YyPRU=",
+    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v8.7.3/contacts-v8.7.3.tar.gz",
+    "version": "8.7.3",
     "description": "The Nextcloud contacts app is a user interface for Nextcloud's CardDAV server. Easily sync contacts from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Mail and Calendar – more to come.\n* 🎉 **Never forget a birthday!** You can sync birthdays and other recurring events with your Nextcloud Calendar.\n* 👥 **Sharing of Adressbooks!** You want to share your contacts with your friends or coworkers? No problem!\n* 🙈 **We’re not reinventing the wheel!** Based on the great and open SabreDAV library.",
     "homepage": "https://github.com/nextcloud/contacts#readme",
     "licenses": [
@@ -50,9 +50,9 @@
     ]
   },
   "cookbook": {
-    "hash": "sha256-Xn2yvgVL7XPIN8awCaH5mznRMW9Jcr0s2E19D13Hm8I=",
-    "url": "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.7/cookbook-0.11.7.tar.gz",
-    "version": "0.11.7",
+    "hash": "sha256-eOB04pPqR5rthxK+yrpxuxgZes9chxjRKhy2yd+kIME=",
+    "url": "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.8/cookbook-0.11.8.tar.gz",
+    "version": "0.11.8",
     "description": "A library for all your recipes. It uses JSON files following the schema.org recipe format. To add a recipe to the collection, you can paste in the URL of the recipe, and the provided web page will be parsed and downloaded to whichever folder you specify in the app settings.",
     "homepage": "https://github.com/nextcloud/cookbook/",
     "licenses": [
@@ -150,9 +150,9 @@
     ]
   },
   "groupfolders": {
-    "hash": "sha256-2jy9p4pu2OXdi8JENFCBcPSDHnGIQkpzuyKkjxALAE4=",
-    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v21.0.8/groupfolders-v21.0.8.tar.gz",
-    "version": "21.0.8",
+    "hash": "sha256-2LlfB3hCX2RvIxG6W0LY4vz9833C/TX8rI0/Ab3jiiE=",
+    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v21.0.9/groupfolders-v21.0.9.tar.gz",
+    "version": "21.0.9",
     "description": "Team Folders (formerly \"Group Folders\") allows administrators to create and manage shared\nfolders for selected teams within Nextcloud.\n\nAdmins can grant one or more teams access to a folder, configure permissions (such as read,\nwrite, and sharing rights), and assign storage quotas from the Team Folders section (under\nadmin settings). The app also supports advanced permissions and integration with Nextcloud’s\ntrash and versioning systems.\n\nAs of Hub 10 / Nextcloud 31, admins must be members of a team to assign that team to a Team\nFolder.",
     "homepage": "https://github.com/nextcloud/groupfolders",
     "licenses": [
@@ -160,9 +160,9 @@
     ]
   },
   "guests": {
-    "hash": "sha256-w1uPtTZEQFJlhfobGflHf17GEYF3oBPwhieumWfYaDk=",
-    "url": "https://github.com/nextcloud-releases/guests/releases/download/v4.7.5/guests-v4.7.5.tar.gz",
-    "version": "4.7.5",
+    "hash": "sha256-MK3P6fMKYWgKkYTPy9oQFTea/B2iJoZANVVT/HFEnKI=",
+    "url": "https://github.com/nextcloud-releases/guests/releases/download/v4.8.0/guests-v4.8.0.tar.gz",
+    "version": "4.8.0",
     "description": "👥 Allows for better collaboration with external users by allowing users to create guests account.\n\nGuests accounts can be created from the share menu by entering either the recipients email or name and choosing \"create guest account\", once the share is created the guest user will receive an email notification about the mail with a link to set their password.\n\nGuests users can only access files shared to them and cannot create any files outside of shares, additionally, the apps accessible to guest accounts are whitelisted.",
     "homepage": "https://github.com/nextcloud/guests/",
     "licenses": [
@@ -210,9 +210,9 @@
     ]
   },
   "mail": {
-    "hash": "sha256-GkLTk3Q1mSUGhU6lsNHmHGkwW6u4XoDCOj405vi8xuY=",
-    "url": "https://github.com/nextcloud-releases/mail/releases/download/v5.10.3/mail-v5.10.3.tar.gz",
-    "version": "5.10.3",
+    "hash": "sha256-c0pMd+A2Fbxa/20BAkg3lPeVRIdu0XRTbAGJxb/9NT0=",
+    "url": "https://github.com/nextcloud-releases/mail/releases/download/v5.10.7/mail-v5.10.7.tar.gz",
+    "version": "5.10.7",
     "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://www.horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** 🟢/🟡/🟠/🔴\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
     "homepage": "https://github.com/nextcloud/mail#readme",
     "licenses": [
@@ -270,9 +270,9 @@
     ]
   },
   "oidc": {
-    "hash": "sha256-CTnFegGasnG+2MPK6c0H01OjrEKSM0WALwns9nJySaA=",
-    "url": "https://github.com/H2CK/oidc/releases/download/1.17.0/oidc-1.17.0.tar.gz",
-    "version": "1.17.0",
+    "hash": "sha256-5CJjNvbZHuadT+7IHMNJSp8r47kZqzQwMey7ccpe/4Y=",
+    "url": "https://github.com/H2CK/oidc/releases/download/2.0.3/oidc-2.0.3.tar.gz",
+    "version": "2.0.3",
     "description": "Nextcloud as OpenID Connect Identity Provider\n\nWith this app you can use Nextcloud as OpenID Connect Identity Provider. If other services\nare configured correctly, you are able to access those services with your Nextcloud login.\n\nFull documentation can be found at:\n\n- [User Documentation](https://github.com/H2CK/oidc/wiki#user-documentation)\n- [Developer Documentation](https://github.com/H2CK/oidc/wiki#developer-documentation)",
     "homepage": "https://github.com/H2CK/oidc",
     "licenses": [
@@ -390,9 +390,9 @@
     ]
   },
   "spreed": {
-    "hash": "sha256-1oIezD9c7DPPGlFXfKrt/+3ohQpcD+JiKKArRXiDRYM=",
-    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v23.0.7/spreed-v23.0.7.tar.gz",
-    "version": "23.0.7",
+    "hash": "sha256-/katcYNLcsdnjHA+4ES+kdvhzuPNdDSv5Ann7X0+5xI=",
+    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v23.0.8/spreed-v23.0.8.tar.gz",
+    "version": "23.0.8",
     "description": "Chat, video & audio-conferencing using WebRTC\n\n* 💬 **Chat** Nextcloud Talk comes with a simple text chat, allowing you to share or upload files from your Nextcloud Files app or local device and mention other participants.\n* 👥 **Private, group, public and password protected calls!** Invite someone, a whole group or send a public link to invite to a call.\n* 🌐 **Federated chats** Chat with other Nextcloud users on their servers\n* 💻 **Screen sharing!** Share your screen with the participants of your call.\n* 🚀 **Integration with other Nextcloud apps** like Files, Calendar, User status, Dashboard, Flow, Maps, Smart picker, Contacts, Deck, and many more.\n* 🌉 **Sync with other chat solutions** With [Matterbridge](https://github.com/42wim/matterbridge/) being integrated in Talk, you can easily sync a lot of other chat solutions to Nextcloud Talk and vice-versa.",
     "homepage": "https://github.com/nextcloud/spreed",
     "licenses": [
@@ -410,9 +410,9 @@
     ]
   },
   "tasks": {
-    "hash": "sha256-nJFU65dthPRWd/SClKM/suZdYU3ic3QsIcXiPzUkQ6c=",
-    "url": "https://github.com/nextcloud/tasks/releases/download/v0.18.0/tasks.tar.gz",
-    "version": "0.18.0",
+    "hash": "sha256-DJiNUFMcm/okbmwx8/lTaa3eFim6cNFRlJFatW4kaHs=",
+    "url": "https://github.com/nextcloud/tasks/releases/download/v0.18.1/tasks.tar.gz",
+    "version": "0.18.1",
     "description": "Once enabled, a new Tasks menu will appear in your Nextcloud apps menu. From there you can add and delete tasks, edit their title, description, start and due dates and mark them as important. Tasks can be shared between users. Tasks can be synchronized using CalDav (each task list is linked to an Nextcloud calendar, to sync it to your local client: Thunderbird, Evolution, KDE Kontact, iCal … - just add the calendar as a remote calendar in your client). You can download your tasks as ICS files using the download button for each calendar.",
     "homepage": "https://github.com/nextcloud/tasks/",
     "licenses": [
@@ -430,9 +430,9 @@
     ]
   },
   "twofactor_admin": {
-    "hash": "sha256-dx8bEsC/rSAKN9rwP2hf3d8G3f3J1RzCrSqU6BbcvRY=",
-    "url": "https://github.com/nextcloud-releases/twofactor_admin/releases/download/v4.11.1/twofactor_admin-v4.11.1.tar.gz",
-    "version": "4.11.1",
+    "hash": "sha256-IkHzIqRBhG6zr+8y5ifrRfsKl9TyMDx7G1JGogbQrDM=",
+    "url": "https://github.com/nextcloud-releases/twofactor_admin/releases/download/v4.12.0/twofactor_admin-v4.12.0.tar.gz",
+    "version": "4.12.0",
     "description": "This two-factor auth (2FA) provider for Nextcloud allows admins to generate a one-time\n\t\tcode for users to log into a 2FA protected account. This is helpful in situations where\n\t\tusers have lost access to their other 2FA methods or mandatory 2FA without any previously\n\t\tenabled 2FA provider.",
     "homepage": "",
     "licenses": [
@@ -480,9 +480,9 @@
     ]
   },
   "user_saml": {
-    "hash": "sha256-rEeaUUYhsTVLZDo11Xh/wGI3k97Tq5J0Jn18QY1M1Xs=",
-    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v8.1.2/user_saml-v8.1.2.tar.gz",
-    "version": "8.1.2",
+    "hash": "sha256-LDiWtEaVJbNECJkcn80L4behkUyUsRlDFDd2lk2g+pE=",
+    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v8.1.4/user_saml-v8.1.4.tar.gz",
+    "version": "8.1.4",
     "description": "Using the SSO & SAML app of your Nextcloud you can make it easily possible to integrate your existing Single-Sign-On solution with Nextcloud. In addition, you can use the Nextcloud LDAP user provider to keep the convenience for users. (e.g. when sharing)\nThe following providers are supported and tested at the moment:\n\n* **SAML 2.0**\n\t* OneLogin\n\t* Shibboleth\n\t* Active Directory Federation Services (ADFS)\n\t* Authentik\n\n* **Authentication via Environment Variable**\n\t* Kerberos (mod_auth_kerb)\n\t* Any other provider that authenticates using the environment variable\n\nWhile theoretically any other authentication provider implementing either one of those standards is compatible, we like to note that they are not part of any internal test matrix.",
     "homepage": "https://github.com/nextcloud/user_saml",
     "licenses": [
diff --git a/pkgs/servers/nextcloud/packages/34.json b/pkgs/servers/nextcloud/packages/34.json
new file mode 100644
index 000000000000..eceff77f9f7f
--- /dev/null
+++ b/pkgs/servers/nextcloud/packages/34.json
@@ -0,0 +1,482 @@
+{
+  "bookmarks": {
+    "hash": "sha256-8F+sNG/+M8Ed/q5dcxW95KS5ZBNsEeZNR0P2OIe/HqQ=",
+    "url": "https://github.com/nextcloud/bookmarks/releases/download/v16.2.2/bookmarks-16.2.2.tar.gz",
+    "version": "16.2.2",
+    "description": "- 📂 Sort bookmarks into folders\n- 🏷 Add tags and personal notes\n- ☠ Find broken links and duplicates\n- 📲 Synchronize with all your browsers and devices\n- 📔 Store archived versions of your links in case they are depublished\n- 🔍 Full-text search on site contents\n- 👪 Share bookmarks with other users, groups and teams or via public links\n- ⚛ Generate RSS feeds of your collections\n- 📈 Stats on how often you access which links\n- 🔒 Automatic backups of your bookmarks collection\n- 💼 Built-in Dashboard widgets for frequent and recent links\n\nRequirements:\n - PHP extensions:\n   - intl: *\n   - mbstring: *\n - when using MySQL, use at least v8.0",
+    "homepage": "https://github.com/nextcloud/bookmarks",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "calendar": {
+    "hash": "sha256-k7A38geyX6PS2j2t5iIXMMZMJsPKIiySVRKxcPAj+pM=",
+    "url": "https://github.com/nextcloud-releases/calendar/releases/download/v6.5.0/calendar-v6.5.0.tar.gz",
+    "version": "6.5.0",
+    "description": "A Calendar app for Nextcloud. Easily sync events from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Like Contacts, Talk, Tasks, Deck and Circles\n* 🌐 **WebCal Support!** Want to see your favorite team's matchdays in your calendar? No problem!\n* 🙋 **Attendees!** Invite people to your events\n* ⌚ **Free/Busy!** See when your attendees are available to meet\n* ⏰ **Reminders!** Get alarms for events inside your browser and via email\n* 🔍 **Search!** Find your events at ease\n* ☑️ **Tasks!** See tasks or Deck cards with a due date directly in the calendar\n* 🔈 **Talk rooms!** Create an associated Talk room when booking a meeting with just one click\n* 📆 **Appointment booking** Send people a link so they can book an appointment with you [using this app](https://apps.nextcloud.com/apps/appointments)\n* 📎 **Attachments!** Add, upload and view event attachments\n* 🙈 **We’re not reinventing the wheel!** Based on the great [c-dav library](https://github.com/nextcloud/cdav-library), [ical.js](https://github.com/mozilla-comm/ical.js) and [fullcalendar](https://github.com/fullcalendar/fullcalendar) libraries.",
+    "homepage": "https://github.com/nextcloud/calendar/",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "checksum": {
+    "hash": "sha256-6qPZvsml3LBYuuDnMwHg4WssxyQjr6op3AKlsMBLCGk=",
+    "url": "https://github.com/westberliner/checksum/releases/download/v2.1.2/checksum.tar.gz",
+    "version": "2.1.2",
+    "description": "Allows users to create a hash checksum of a file.\n        Possible algorithms are md5, sha1, sha256, sha384, sha512, sha3-256, sha3-512 and crc32.\n\n        Just open the details view of the file (Sidebar). There should be a new tab called \"Checksum\".\n        Select a algorithm and it will try to generate a hash.\n        If you want an other algorithm, just click on the reload button.",
+    "homepage": "https://github.com/westberliner/checksum/",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "collectives": {
+    "hash": "sha256-/MGwV78AAzsoAvI11JeodQsbiMZs1J58NzsGrEIv5EA=",
+    "url": "https://github.com/nextcloud/collectives/releases/download/v4.4.2/collectives-4.4.2.tar.gz",
+    "version": "4.4.2",
+    "description": "Your space to collaboratively write and organize. Collectives is designed for groups and communities\nto structure shared knowledge and cultivate trust.\n\n* **👥 Non-hierarchical at its core**: Each collective is backed by a\n  [Nextcloud Team](https://docs.nextcloud.com/server/latest/user_manual/en/groupware/contacts.html#teams) - its\n  content is owned by the group, not a single user.\n* **📝 Collaborative page editing** thanks to the [Text app](https://github.com/nextcloud/text).\n* **🔤 Well-known [Markdown](https://en.wikipedia.org/wiki/Markdown) syntax** for page formatting.\n* **🔎 Full-text search** to find content straight away.",
+    "homepage": "https://collectives.cloud/",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "contacts": {
+    "hash": "sha256-Lgw+wF40FlZTlbw5IXG/eUW8Chaw5Cm1i9f2R8YyPRU=",
+    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v8.7.3/contacts-v8.7.3.tar.gz",
+    "version": "8.7.3",
+    "description": "The Nextcloud contacts app is a user interface for Nextcloud's CardDAV server. Easily sync contacts from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Mail and Calendar – more to come.\n* 🎉 **Never forget a birthday!** You can sync birthdays and other recurring events with your Nextcloud Calendar.\n* 👥 **Sharing of Adressbooks!** You want to share your contacts with your friends or coworkers? No problem!\n* 🙈 **We’re not reinventing the wheel!** Based on the great and open SabreDAV library.",
+    "homepage": "https://github.com/nextcloud/contacts#readme",
+    "licenses": [
+      "AGPL-3.0-or-later"
+    ]
+  },
+  "cookbook": {
+    "hash": "sha256-eOB04pPqR5rthxK+yrpxuxgZes9chxjRKhy2yd+kIME=",
+    "url": "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.8/cookbook-0.11.8.tar.gz",
+    "version": "0.11.8",
+    "description": "A library for all your recipes. It uses JSON files following the schema.org recipe format. To add a recipe to the collection, you can paste in the URL of the recipe, and the provided web page will be parsed and downloaded to whichever folder you specify in the app settings.",
+    "homepage": "https://github.com/nextcloud/cookbook/",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "cospend": {
+    "hash": "sha256-3uphQHtKlW8kXeLA5hMDpT14lEf+tnJyy4hfKioBDSw=",
+    "url": "https://github.com/julien-nc/cospend-nc/releases/download/v4.0.2/cospend-4.0.2.tar.gz",
+    "version": "4.0.2",
+    "description": "# Nextcloud Cospend 💰\n\nNextcloud Cospend is a group/shared budget manager. It was inspired by the great [IHateMoney](https://github.com/spiral-project/ihatemoney/).\n\nYou can use it when you share a house, when you go on vacation with friends, whenever you share expenses with a group of people.\n\nIt lets you create projects with members and bills. Each member has a balance computed from the project bills. Balances are not an absolute amount of money at members disposal but rather a relative information showing if a member has spent more for the group than the group has spent for her/him, independently of exactly who spent money for whom. This way you can see who owes the group and who the group owes. Ultimately you can ask for a settlement plan telling you which payments to make to reset members balances.\n\nProject members are independent from Nextcloud users. Projects can be shared with other Nextcloud users or via public links.\n\n[MoneyBuster](https://gitlab.com/eneiluj/moneybuster) Android client is [available in F-Droid](https://f-droid.org/packages/net.eneiluj.moneybuster/) and on the [Play store](https://play.google.com/store/apps/details?id=net.eneiluj.moneybuster).\n\n[PayForMe](https://github.com/mayflower/PayForMe) iOS client is currently under developpement!\n\nThe private and public APIs are documented using [the Nextcloud OpenAPI extractor](https://github.com/nextcloud/openapi-extractor/). This documentation can be accessed directly in Nextcloud. All you need is to install Cospend (>= v1.6.0) and use the [the OCS API Viewer app](https://apps.nextcloud.com/apps/ocs_api_viewer) to browse the OpenAPI documentation.\n\n## Features\n\n* ✎ Create/edit/delete projects, members, bills, bill categories, currencies\n* ⚖ Check member balances\n* 🗠 Display project statistics\n* ♻ Display settlement plan\n* Move bills from one project to another\n* Move bills to trash before actually deleting them\n* Archive old projects before deleting them\n* 🎇 Automatically create reimbursement bills from settlement plan\n* 🗓 Create recurring bills (day/week/month/year)\n* 📊 Optionally provide custom amount for each member in new bills\n* 🔗 Link personal files to bills (picture of physical receipt for example)\n* 👩 Public links for people outside Nextcloud (can be password protected)\n* 👫 Share projects with Nextcloud users/groups/circles\n* 🖫 Import/export projects as csv (compatible with csv files from IHateMoney and SplitWise)\n* 🔗 Generate link/QRCode to easily add projects in MoneyBuster\n* 🗲 Implement Nextcloud notifications and activity stream\n\nThis app usually support the 2 or 3 last major versions of Nextcloud.\n\nThis app is under development.\n\n🌍 Help us to translate this app on [Nextcloud-Cospend/MoneyBuster Crowdin project](https://crowdin.com/project/moneybuster).\n\n⚒ Check out other ways to help in the [contribution guidelines](https://github.com/julien-nc/cospend-nc/blob/master/CONTRIBUTING.md).\n\n## Documentation\n\n* [User documentation](https://github.com/julien-nc/cospend-nc/blob/master/docs/user.md)\n* [Admin documentation](https://github.com/julien-nc/cospend-nc/blob/master/docs/admin.md)\n* [Developer documentation](https://github.com/julien-nc/cospend-nc/blob/master/docs/dev.md)\n* [CHANGELOG](https://github.com/julien-nc/cospend-nc/blob/master/CHANGELOG.md#change-log)\n* [AUTHORS](https://github.com/julien-nc/cospend-nc/blob/master/AUTHORS.md#authors)\n\n## Known issues\n\n* It does not make you rich\n\nAny feedback will be appreciated.\n\n\n\n## Donation\n\nI develop this app during my free time.\n\n* [Donate with Paypal](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=66PALMY8SF5JE) (you don't need a paypal account)\n* [Donate with Liberapay : ![Donate using Liberapay](https://liberapay.com/assets/widgets/donate.svg)](https://liberapay.com/eneiluj/donate)",
+    "homepage": "https://github.com/julien-nc/cospend-nc",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "dav_push": {
+    "hash": "sha256-OafUgG58+LsxibS/9aZjiOkdQcBV34xE6cmO9IkHMUo=",
+    "url": "https://github.com/bitfireAT/nc_ext_dav_push/releases/download/v1.0.2/dav_push.tar.gz",
+    "version": "1.0.2",
+    "description": "In proprietary environments, changes in events and contacts are nowadays usually pushed to other clients so that they can update their views almost in real-time.\n\nWebDAV however (and in this context, especially CalDAV and CardDAV) doesn't currently support push notifications of clients when a collection has changed. So clients have to periodically ask the server for changes. This causes unnecessary delays and battery usage.\n\nThe WebDAV-Push standard, which is currently in development, wants to solve this problem with an open protocol, too.\n\nThis is the server part of these efforts to draft a standard and provide a working implementation (server + client) in order to demonstrate it.\n\n\nThe current WebDAV-Push draft is provided by [@bitfireAT](https://github.com/bitfireAT).\n          \nThis Nextcloud extension has been developed by [@verdigado](https://github.com/verdigado).",
+    "homepage": "",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "deck": {
+    "hash": "sha256-xbXx5NDVnR/qFk+29yrWTfsZL/NTKfvLd1D0IGf9Ie4=",
+    "url": "https://github.com/nextcloud-releases/deck/releases/download/v1.18.2/deck-v1.18.2.tar.gz",
+    "version": "1.18.2",
+    "description": "Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud.\n\n\n- 📥 Add your tasks to cards and put them in order\n- 📄 Write down additional notes in Markdown\n- 🔖 Assign labels for even better organization\n- 👥 Share with your team, friends or family\n- 📎 Attach files and embed them in your Markdown description\n- 💬 Discuss with your team using comments\n- ⚡ Keep track of changes in the activity stream\n- 🚀 Get your project organized",
+    "homepage": "https://github.com/nextcloud/deck",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "end_to_end_encryption": {
+    "hash": "sha256-Z6MyXz//LNVy7Mt+yFbHIY5zGEMfsdwnAEDFsIcrs1M=",
+    "url": "https://github.com/nextcloud-releases/end_to_end_encryption/releases/download/v2.2.0/end_to_end_encryption-v2.2.0.tar.gz",
+    "version": "2.2.0",
+    "description": "## **End-to-End Encryption**\n\n### For End Users\n\n**Protect your most sensitive files with strong encryption.**\n\nThe End-to-End Encryption app gives you complete control over your data privacy.\nWith this app, you can encrypt specific folders so that only you (and those you trust) can access their contents.\nYour files are encrypted on your device before they reach the server, ensuring that no one—not even the server administrator—can read them.\n\n**Benefits:**\n- 🔒 **True privacy**: Files are encrypted on your device and can only be decrypted by you\n- 📱 **Works across all platforms**: Fully supported on desktop, Android, iOS clients, and as you wish even in the browser\n- 🎯 **Selective encryption**: Choose which folders to encrypt\n- 🛡️ **Secure sharing**: Share encrypted files with other users or even secure public upload using the encrypted file drop\n\n---\n\n### For Administrators\n\n**Enterprise-ready end-to-end encryption infrastructure for your Nextcloud instance.**\n\nThis app provides all the necessary server-side APIs and infrastructure to enable End-to-End encryption (E2EE) for your users.\nIt ensures that encrypted data remains secure throughout its lifecycle on your server.\n\n**Technical highlights:**\n- 🔐 **Complete API suite**: Provides all client-side APIs needed for E2EE implementation\n- 🔒 **Secure FileDrop integration**: Enables secure file sharing with encryption\n- 🛡️ **Zero-knowledge architecture**: Server never has access to encryption keys\n- ⚙️ **Group restrictions**: Limit app usage to specific user groups if needed\n- 🔄 **Background job management**: Automatic rollback handling for failed operations\n\n### Setup\nThis application provides the server-side infrastructure for end-to-end encryption, but it requires client support to function.\nTo enable end-to-end encryption, users will need to install the corresponding client-side app on their devices (desktop, Android, iOS) or use the web client.\n\nUsing the web interface, after enabling it in the personal settings, allows you to encrypt files and folders directly in the browser,\nproviding a seamless experience without needing additional software. But also requires some kind of trust in the server as the code is delivered by the server and could be manipulated.\n\nOnce enable through clients or the web interface, you can create encrypted folders and upload or move files into them.\nThe clients and the web interface will handle the encryption and decryption processes automatically.\n\n⚠️ This comes with some limitations and caveats, as only normal file operations can be handled.\nMeaning that some apps in the web interface do not work with encrypted files.",
+    "homepage": "https://github.com/nextcloud/end_to_end_encryption",
+    "licenses": [
+      "AGPL-3.0-or-later"
+    ]
+  },
+  "files_automatedtagging": {
+    "hash": "sha256-3lsRT8oZ4lP1Kngl8E47rc/7FJmiaXv/x3BfGMfHcC8=",
+    "url": "https://github.com/nextcloud-releases/files_automatedtagging/releases/download/v5.0.0/files_automatedtagging-v5.0.0.tar.gz",
+    "version": "5.0.0",
+    "description": "An app for Nextcloud that automatically assigns tags to newly uploaded files based on some conditions.\n\nThe tags can later be used to control retention, file access, automatic script execution and more.\n\n## How it works\nTo define tags, administrators can create and manage a set of rule groups. Each rule group consists of one or more rules combined through operators. Rules can include criteria like file type, size, time and more. A request matches a group if all rules evaluate to true. On uploading a file all defined groups are evaluated and when matching, the given tags are assigned to the file.",
+    "homepage": "https://github.com/nextcloud/files_automatedtagging",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "files_linkeditor": {
+    "hash": "sha256-WIOLA1J2aqMr5v3bZB3pRnF9bH1V0asGsMNTcetRsx8=",
+    "url": "https://github.com/te-online/nextcloud-app-releases/raw/main/files_linkeditor/v1.1.25/files_linkeditor.tar.gz",
+    "version": "1.1.25",
+    "description": "### External web links in Nextcloud!\n* ✍️ **create and edit** .URL and .webloc links in the file view\n* 🌍 **open links** by clicking them and confirming you want to go to the external site\n* 📤 **works in public shares** so you can share links easily with others\n* 🔄 **sync your links** as .URL and .webloc are web links as created on most operating systems.\n\n_[View changelog](https://github.com/te-online/files_linkeditor/blob/main/CHANGELOG.md)_",
+    "homepage": "https://github.com/te-online/files_linkeditor",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "files_retention": {
+    "hash": "sha256-aHcg9eKEd/4CXNUy5rrWmw9pP/mf54wp/PVQfqrHSM0=",
+    "url": "https://github.com/nextcloud-releases/files_retention/releases/download/v5.0.0/files_retention-v5.0.0.tar.gz",
+    "version": "5.0.0",
+    "description": "An app for Nextcloud to control automatic deletion of files after a given time.\nOptionally the users can be informed the day before.",
+    "homepage": "https://github.com/nextcloud/files_retention",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "forms": {
+    "hash": "sha256-r570gxd4j/AEMzT3vul6qxJsJ/bTEW459LONUOYA8ZM=",
+    "url": "https://github.com/nextcloud-releases/forms/releases/download/v5.3.2/forms-v5.3.2.tar.gz",
+    "version": "5.3.2",
+    "description": "**Simple surveys and questionnaires, self-hosted!**\n\n- **📝 Simple design:** No mass of options, only the essentials. Works well on mobile of course.\n- **📊 View & export results:** Results are visualized and can also be exported as CSV in the same format used by Google Forms.\n- **🔒 Data under your control!** Unlike in Google Forms, Typeform, Doodle and others, the survey info and responses are kept private on your instance.\n- **🧑‍💻 Connect to your software:** Easily integrate Forms into your service with our full-fledged [REST-API](https://github.com/nextcloud/forms/blob/main/docs/API_v3.md).\n- **🙋 Get involved!** We have lots of stuff planned like more question types, collaboration on forms, [and much more](https://github.com/nextcloud/forms/milestones)!",
+    "homepage": "https://github.com/nextcloud/forms",
+    "licenses": [
+      "AGPL-3.0-or-later"
+    ]
+  },
+  "gpoddersync": {
+    "hash": "sha256-V4iJr1p5uqxdrvE50bjyNTiHdsZATewaBXKQ8Ma0dHg=",
+    "url": "https://github.com/thrillfall/nextcloud-gpodder/releases/download/3.17.0/gpoddersync.tar.gz",
+    "version": "3.17.0",
+    "description": "Expose GPodder API to sync podcast consumer apps like AntennaPod",
+    "homepage": "https://github.com/thrillfall/nextcloud-gpodder",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "groupfolders": {
+    "hash": "sha256-zyN6n2oSeO+I2wyc2Q9l1TUumdVmEThvERGC7xBkm3s=",
+    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v22.0.2/groupfolders-v22.0.2.tar.gz",
+    "version": "22.0.2",
+    "description": "Team Folders (formerly \"Group Folders\") allows administrators to create and manage shared\nfolders for selected teams within Nextcloud.\n\nAdmins can grant one or more teams access to a folder, configure permissions (such as read,\nwrite, and sharing rights), and assign storage quotas from the Team Folders section (under\nadmin settings). The app also supports advanced permissions and integration with Nextcloud’s\ntrash and versioning systems.\n\nAs of Hub 10 / Nextcloud 31, admins must be members of a team to assign that team to a Team\nFolder.",
+    "homepage": "https://github.com/nextcloud/groupfolders",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "guests": {
+    "hash": "sha256-MK3P6fMKYWgKkYTPy9oQFTea/B2iJoZANVVT/HFEnKI=",
+    "url": "https://github.com/nextcloud-releases/guests/releases/download/v4.8.0/guests-v4.8.0.tar.gz",
+    "version": "4.8.0",
+    "description": "👥 Allows for better collaboration with external users by allowing users to create guests account.\n\nGuests accounts can be created from the share menu by entering either the recipients email or name and choosing \"create guest account\", once the share is created the guest user will receive an email notification about the mail with a link to set their password.\n\nGuests users can only access files shared to them and cannot create any files outside of shares, additionally, the apps accessible to guest accounts are whitelisted.",
+    "homepage": "https://github.com/nextcloud/guests/",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "impersonate": {
+    "hash": "sha256-6bhdZIlDSvLQXxYYg5vP2YWdvGt75YAUhZL1EaRI7WY=",
+    "url": "https://github.com/nextcloud-releases/impersonate/releases/download/v5.0.0/impersonate-v5.0.0.tar.gz",
+    "version": "5.0.0",
+    "description": "By installing the impersonate app of your Nextcloud you enable administrators to impersonate other users on the Nextcloud server. This is especially useful for debugging issues reported by users.\n\nTo impersonate a user an administrator has to simply follow the following four steps:\n\n1. Login as administrator to Nextcloud.\n2. Open users administration interface.\n3. Select the impersonate button on the affected user.\n4. Confirm the impersonation.\n\nThe administrator is then logged-in as the user, to switch back to the regular user account they simply have to press the logout button.\n\n**Note:**\n\n- This app is not compatible with instances that have encryption enabled.\n- While impersonate actions are logged note that actions performed impersonated will be logged as the impersonated user.\n- Impersonating a user is only possible after their first login.\n- You can limit which users/groups can use impersonation in Administration settings > Additional settings.",
+    "homepage": "https://github.com/nextcloud/impersonate",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "integration_deepl": {
+    "hash": "sha256-RHYxxZw/2/uDdZdf8kGYgGBlBi1rfgXUtTtr9lgr/20=",
+    "url": "https://github.com/nextcloud-releases/integration_deepl/releases/download/v2.2.0/integration_deepl-v2.2.0.tar.gz",
+    "version": "2.2.0",
+    "description": "Deepl integration providing an translations through deepl.com with Nextcloud\n\nThis app integrates with [Nextcloud Assistant](https://apps.nextcloud.com/apps/assistant) to offer translation services We recommend to install Assistant additionally and activate Deepl as translation provider in the Artifical Intelligence admin settings.\n\nThis app also integrates with the translation API of Nextcloud server to offer translation services without Assistant. Currently this is available in Text and Talk.\n\nTo run translations and any other Task Processing tasks synchronously, run the following command in a background process (10 is the interval in seconds when the process should relaunch to use the latest php changes):\n\n```sh\nset -e; while true; do occ background-job:worker -v -t 10 \"OC\\TaskProcessing\\SynchronousBackgroundJob\"; done\n```\n\n## Ethical AI Rating\n### Rating: 🔴\n\nNegative:\n* the software for training and inferencing of this model is proprietary, limiting running it locally or training by yourself\n* the trained model is not freely available, so the model can not be ran on-premises\n* the training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
+    "homepage": "https://github.com/nextcloud/integration_deepl",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "integration_openai": {
+    "hash": "sha256-vt2td3UDJMm1g3BbnV3x/pf92hhuYppk95IFygRxHFY=",
+    "url": "https://github.com/nextcloud-releases/integration_openai/releases/download/v4.5.1/integration_openai-v4.5.1.tar.gz",
+    "version": "4.5.1",
+    "description": "⚠️ The smart pickers have been removed from this app\nas they are now included in the [Assistant app](https://apps.nextcloud.com/apps/assistant).\n\nThis app implements:\n\n* Text generation providers: Free prompt, Summarize, Headline, Context Write, Chat, and Reformulate (using any available large language model)\n* A Translation provider (using any available language model)\n* A SpeechToText provider (using Whisper)\n* An image generation provider\n\n⚠️ Context Write, Summarize, Headline and Reformulate have mainly been tested with OpenAI.\nThey might work when connecting to other services, without any guarantee.\n\nInstead of connecting to the OpenAI API for these, you can also connect to a self-hosted [LocalAI](https://localai.io) instance or [Ollama](https://ollama.com/) instance\nor to any service that implements an API similar to the OpenAI one, for example:\n[IONOS AI Model Hub](https://docs.ionos.com/cloud/ai/ai-model-hub), [Plusserver](https://www.plusserver.com/en/ai-platform/) or [MistralAI](https://mistral.ai).\n\n⚠️ This app is mainly tested with OpenAI. We do not guarantee it works perfectly\nwith other services that implement OpenAI-compatible APIs with slight differences.\n\n## Improve AI task pickup speed\n\nTo avoid task processing execution delay, setup at 4 background job workers in the main server (where Nextcloud is installed). The setup process is documented here: https://docs.nextcloud.com/server/latest/admin_manual/ai/overview.html#improve-ai-task-pickup-speed\n\n## Ethical AI Rating\n### Rating for Text generation using ChatGPT via the OpenAI API: 🔴\n\nNegative:\n* The software for training and inference of this model is proprietary, limiting running it locally or training by yourself\n* The trained model is not freely available, so the model can not be run on-premises\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model's performance and CO2 usage.\n\n\n### Rating for Translation using ChatGPT via the OpenAI API: 🔴\n\nNegative:\n* The software for training and inference of this model is proprietary, limiting running it locally or training by yourself\n* The trained model is not freely available, so the model can not be run on-premises\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model's performance and CO2 usage.\n\n### Rating for Image generation using DALL·E via the OpenAI API: 🔴\n\nNegative:\n* The software for training and inferencing of this model is proprietary, limiting running it locally or training by yourself\n* The trained model is not freely available, so the model can not be ran on-premises\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\n\n### Rating for Speech-To-Text using Whisper via the OpenAI API: 🟡\n\nPositive:\n* The software for training and inferencing of this model is open source\n* The trained model is freely available, and thus can run on-premise\n\nNegative:\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\n### Rating for Text-To-Speech via the OpenAI API: 🔴\n\nNegative:\n* The software for training and inferencing of this model is proprietary, limiting running it locally or training by yourself\n* The trained model is not freely available, so the model can not be ran on-premises\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\n### Rating for Text generation via LocalAI: 🟢\n\nPositive:\n* The software for training and inferencing of this model is open source\n* The trained model is freely available, and thus can be ran on-premises\n* The training data is freely available, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n\n### Rating for Image generation using Stable Diffusion via LocalAI : 🟡\n\nPositive:\n* The software for training and inferencing of this model is open source\n* The trained model is freely available, and thus can be ran on-premises\n\nNegative:\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\n\n### Rating for Speech-To-Text using Whisper via LocalAI: 🟡\n\nPositive:\n* The software for training and inferencing of this model is open source\n* The trained model is freely available, and thus can be ran on-premises\n\nNegative:\n* The training data is not freely available, limiting the ability of external parties to check and correct for bias or optimise the model’s performance and CO2 usage.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
+    "homepage": "https://github.com/nextcloud/integration_openai",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "integration_paperless": {
+    "hash": "sha256-euTLlCwXSo23aPfhW1Xn0sxjVvc9u2626NJm0ob1W8o=",
+    "url": "https://github.com/nextcloud-releases/integration_paperless/releases/download/v1.0.13/integration_paperless-v1.0.13.tar.gz",
+    "version": "1.0.13",
+    "description": "Integration with the [Paperless](https://docs.paperless-ngx.com) Document Management System.\nIt adds a file action menu item that can be used to upload a file from your Nextcloud Files to Paperless.",
+    "homepage": "",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "mail": {
+    "hash": "sha256-c0pMd+A2Fbxa/20BAkg3lPeVRIdu0XRTbAGJxb/9NT0=",
+    "url": "https://github.com/nextcloud-releases/mail/releases/download/v5.10.7/mail-v5.10.7.tar.gz",
+    "version": "5.10.7",
+    "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://www.horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** 🟢/🟡/🟠/🔴\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
+    "homepage": "https://github.com/nextcloud/mail#readme",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "maps": {
+    "hash": "sha256-Rwtzouz4NEFZVO6V8YvIc9Cyn/KBZ+gAYy5CcFDvRvc=",
+    "url": "https://github.com/nextcloud-releases/maps/releases/download/v1.7.1/maps-v1.7.1.tar.gz",
+    "version": "1.7.1",
+    "description": "**The whole world fits inside your cloud!**\n\n- **🗺 Beautiful map:** Using [OpenStreetMap](https://www.openstreetmap.org) and [Leaflet](https://leafletjs.com), you can choose between standard map, satellite, topographical, dark mode or even watercolor! 🎨\n- **⭐ Favorites:** Save your favorite places, privately! Sync with [GNOME Maps](https://github.com/nextcloud/maps/issues/30) and mobile apps is planned.\n- **🧭 Routing:** Possible using either [OSRM](http://project-osrm.org), [GraphHopper](https://www.graphhopper.com) or [Mapbox](https://www.mapbox.com).\n- **🖼 Photos on the map:** No more boring slideshows, just show directly where you were!\n- **🙋 Contacts on the map:** See where your friends live and plan your next visit.\n- **📱 Devices:** Lost your phone? Check the map!\n- **〰 Tracks:** Load GPS tracks or past trips. Recording with [PhoneTrack](https://f-droid.org/en/packages/net.eneiluj.nextcloud.phonetrack/) or [OwnTracks](https://owntracks.org) is planned.",
+    "homepage": "https://github.com/nextcloud/maps",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "music": {
+    "hash": "sha256-bQ9NBo5R/en3f68ag+mAsVWuhREjr/ajlKrfLn4Tvtg=",
+    "url": "https://github.com/nc-music/music/releases/download/v3.1.0/nc-music-3.1.0.tar.gz",
+    "version": "3.1.0",
+    "description": "A stand-alone music player app and a \"lite\" player for the Files app\n\n- On modern browsers, supports audio types .mp3, .ogg, .m4a, .m4b, .flac, .wav, and more\n- Playlist support with import from .m3u, .m3u8, .pls, and .wpl files\n- Show lyrics from the file metadata or .lrc files\n- Browse by artists, albums, genres, or folders\n- Gapless play\n- Filter the shown content with the search function\n- Advanced search to freely use and combine dozens of search criteria\n- Play internet radio and podcast channels\n- Setup Last.fm connection to scrobble plays and/or see background information on artists, albums, and songs\n- Control with media control keys on the keyboard or OS\n- The app can handle libraries consisting of thousands of albums and tens of thousands of songs\n- Includes a server backend compatible with the Subsonic and Ampache protocols, allowing playback and browsing of your library on dozens of external apps on Android, iOS, Windows, Linux, etc.\n- Widget for the Nextcloud Dashboard",
+    "homepage": "https://github.com/nc-music/music",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "news": {
+    "hash": "sha256-25VyIvV7d5/hvWuT0IXzpgygLYHRrmqHg2pa+QQpK90=",
+    "url": "https://github.com/nextcloud/news/releases/download/28.6.0/news.tar.gz",
+    "version": "28.6.0",
+    "description": "📰 A RSS/Atom Feed reader App for Nextcloud\n\n- 📲 Synchronize your feeds with multiple mobile or desktop [clients](https://nextcloud.github.io/news/clients/)\n- 🔄 Automatic updates of your news feeds\n- 🆓 Free and open source under AGPLv3, no ads or premium functions\n\n**System Cron is currently required for this app to work**\n\nRequirements can be found [here](https://nextcloud.github.io/news/install/#dependencies)\n\nThe Changelog is available [here](https://github.com/nextcloud/news/blob/master/CHANGELOG.md)\n\nCreate a [bug report](https://github.com/nextcloud/news/issues/new/choose)\n\nCreate a [feature request](https://github.com/nextcloud/news/discussions/new)\n\nReport a [feed issue](https://github.com/nextcloud/news/discussions/new)",
+    "homepage": "https://github.com/nextcloud/news",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "nextpod": {
+    "hash": "sha256-a/wnfpIBTTqLB18p0afhncMgD8x7UNYmjwv3LqcTd9o=",
+    "url": "https://github.com/pbek/nextcloud-nextpod/releases/download/v0.7.11/nextpod-nc.tar.gz",
+    "version": "0.7.11",
+    "description": "This Nextcloud app lets you visualize your podcast subscriptions and episode downloads from\n[GPodderSync](https://apps.nextcloud.com/apps/gpoddersync), which acts as a basic gpodder.net\napi to sync podcast consumer apps (podcatchers) like AntennaPod.\n\nYou need to have [GPodderSync](https://apps.nextcloud.com/apps/gpoddersync) installed to use this app!",
+    "homepage": "https://github.com/pbek/nextcloud-nextpod",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "notes": {
+    "hash": "sha256-/54d/UfkYLSPt8Coi4/zcheZx8mKXW34CIrvFEfYFLI=",
+    "url": "https://github.com/nextcloud-releases/notes/releases/download/v6.0.1/notes-v6.0.1.tar.gz",
+    "version": "6.0.1",
+    "description": "The Notes app is a distraction free notes taking app for [Nextcloud](https://www.nextcloud.com/). It provides categories for better organization and supports formatting using [Markdown](https://en.wikipedia.org/wiki/Markdown) syntax. Notes are saved as files in your Nextcloud, so you can view and edit them with every Nextcloud client. Furthermore, a separate [REST API](https://github.com/nextcloud/notes/blob/master/docs/api/README.md) allows for an easy integration into apps ([Android](https://github.com/nextcloud/notes-android), [iOS](https://github.com/nextcloud/notes-ios), as well as [3rd-party apps](https://github.com/nextcloud/notes/wiki#3rd-party-clients) which allow convenient access to your Nextcloud notes). Further features include marking notes as favorites.",
+    "homepage": "https://github.com/nextcloud/notes",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "oidc": {
+    "hash": "sha256-5CJjNvbZHuadT+7IHMNJSp8r47kZqzQwMey7ccpe/4Y=",
+    "url": "https://github.com/H2CK/oidc/releases/download/2.0.3/oidc-2.0.3.tar.gz",
+    "version": "2.0.3",
+    "description": "Nextcloud as OpenID Connect Identity Provider\n\nWith this app you can use Nextcloud as OpenID Connect Identity Provider. If other services\nare configured correctly, you are able to access those services with your Nextcloud login.\n\nFull documentation can be found at:\n\n- [User Documentation](https://github.com/H2CK/oidc/wiki#user-documentation)\n- [Developer Documentation](https://github.com/H2CK/oidc/wiki#developer-documentation)",
+    "homepage": "https://github.com/H2CK/oidc",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "onlyoffice": {
+    "hash": "sha256-QaohaMbw7bncBqreb5W8XngzqqwqALnsGgT494xfr/E=",
+    "url": "https://github.com/ONLYOFFICE/onlyoffice-nextcloud/releases/download/v10.1.2/onlyoffice.tar.gz",
+    "version": "10.1.2",
+    "description": "The ONLYOFFICE app for Nextcloud brings powerful document editing and collaboration tools directly to your Nextcloud environment. With this integration, you can seamlessly create, edit, and co-author text documents, spreadsheets, presentations, and PDFs, as well as build and fill out PDF forms.\n\nCollaborate with your team in real time, make use of Track Changes, version history, comments, integrated chat, and more. Work together on files with federated cloud sharing. Flexible access permissions allow you to control who can view, edit, or comment, ensuring secure role-based collaboration tailored to your needs. Documents can also be protected with watermarks, password settings, and encryption for added security.\n\nThe app offers support for over 50 file formats, including DOCX, XLSX, PPTX, PDF, RTF, TXT, CSV, ODT, ODS, ODP, EPUB, FB2, HTML, HWP, HWPX, Pages, Numbers, Keynote, etc. Seamless desktop and mobile app integration means you'll have access to your Nextcloud files wherever you go.\n\nFurthermore, you can seamlessly connect any AI assistant, including local ones, directly to the editors to work faster and more efficient. This allows you to leverage various AI models for tasks like chatbot interactions, translations, OCR, and more.\n\nWhether you’re working with internal teams or external collaborators, the ONLYOFFICE app for Nextcloud enhances productivity, simplifies workflows, and ensures your files remain secure.",
+    "homepage": "https://www.onlyoffice.com",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "phonetrack": {
+    "hash": "sha256-d6vPKCJ1Us0zQIFkIlSQ5cmEgO1zXGtdDniIjfqGh28=",
+    "url": "https://github.com/julien-nc/phonetrack/releases/download/v1.2.0/phonetrack-1.2.0.tar.gz",
+    "version": "1.2.0",
+    "description": "# PhoneTrack Nextcloud application\n\n📱 PhoneTrack is a Nextcloud application to track and store mobile device's locations.\n\n🗺 It receives information from mobile phone's logging apps and displays it dynamically on a map.\n\n🌍 Help us to translate this app on [PhoneTrack Crowdin project](https://crowdin.com/project/phonetrack).\n\n⚒ Check out other ways to help in the [contribution guidelines](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/CONTRIBUTING.md).\n\nHow to use PhoneTrack :\n\n- Create a tracking session.\n- Give the logging link\\* to the mobile devices. Choose the [logging method](https://github.com/julien-nc/phonetrack/blob/main/doc/user.md#logging-methods) you prefer.\n- Watch the session's devices location in real time (or not) in PhoneTrack or share it with public pages.\n\n(\\*) Don't forget to set the device name in the link (rather than in the logging app settings). Replace \"yourname\" with the desired device name.\nSetting the device name in logging app settings only works with Owntracks, Traccar and OpenGTS.\n\nOn PhoneTrack main page, while watching a session, you can :\n\n- 📍 Display location history\n- ⛛ Filter points\n- ✎ Manually edit/add/delete points\n- ✎ Edit devices (rename, change colour/shape, move to another session)\n- ⛶ Define geofencing zones for devices\n- ⚇ Define proximity alerts for device pairs\n- 🖧 Share a session to other Nextcloud users or with a public link (read-only)\n- 🔗 Generate public share links with optional restrictions (filters, device name, last positions only, geofencing simplification)\n- 🖫 Import/export a session in GPX format (one file with one track per device or one file per device)\n- 🗠 Display sessions statistics\n- 🔒 [Reserve a device name](https://github.com/julien-nc/phonetrack/blob/main/doc/user.md#device-name-reservation) to make sure only authorized user can log with this name\n- 🗓 Toggle session auto export and auto purge (daily/weekly/monthly)\n- ◔ Choose what to do when point number quota is reached (block logging or delete oldest point)\n\nPublic page and public filtered page work like main page except there is only one session displayed, everything is read-only and there is no need to be logged in.\n\nThis app is under development.\n\n## Install\n\nSee the [AdminDoc](https://gitlab.com/eneiluj/phonetrack-oc/wikis/admindoc) for installation details.\n\nCheck [CHANGELOG](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/CHANGELOG.md#change-log) file to see what's new and what's coming in next release.\n\nCheck [AUTHORS](https://gitlab.com/eneiluj/phonetrack-oc/blob/master/AUTHORS.md#authors) file to see complete list of authors.\n\n## Known issues\n\n- PhoneTrack **now works** with Nextcloud group restriction activated. See [admindoc](https://github.com/julien-nc/phonetrack/blob/main/doc/admin.md#issue-with-phonetrack-restricted-to-some-groups-in-nextcloud).\n\nAny feedback will be appreciated.\n\n\n\n## Donation\n\nI develop this app during my free time.\n\n* [Donate with Paypal](https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=66PALMY8SF5JE) (you don't need a paypal account)\n* [Donate with Liberapay : ![Donate using Liberapay](https://liberapay.com/assets/widgets/donate.svg)](https://liberapay.com/eneiluj/donate)",
+    "homepage": "https://github.com/julien-nc/phonetrack",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "polls": {
+    "hash": "sha256-FstOtAaGr3rvv5nmBUVlKlDm8QxxAjJHFdwMbCQywL4=",
+    "url": "https://github.com/nextcloud-releases/polls/releases/download/v9.1.4/polls-v9.1.4.tar.gz",
+    "version": "9.1.4",
+    "description": "A polls app, similar to Doodle/DuD-Poll with the possibility to restrict access (members, certain groups/users, hidden and public).",
+    "homepage": "https://github.com/nextcloud/polls",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "previewgenerator": {
+    "hash": "sha256-ip4gqIP2ciT45zlHr7R22YCb15kawM2S1/r87b5lyoc=",
+    "url": "https://github.com/nextcloud-releases/previewgenerator/releases/download/v5.14.0/previewgenerator-v5.14.0.tar.gz",
+    "version": "5.14.0",
+    "description": "The Preview Generator app allows admins to pre-generate previews. The app listens to edit events and stores this information. Once a cron job is triggered it will generate start preview generation. This means that you can better utilize your system by pre-generating previews when your system is normally idle and thus putting less load on your machine when the requests are actually served.\n\nThe app does not replace on demand preview generation so if a preview is requested before it is pre-generated it will still be shown.\nThe first time you install this app, before using a cron job, you properly want to generate all previews via:\n**occ preview:generate-all -vvv**\n\nThe preview queue will be processed automatically by a background job if the system cron background job mode is configured in Nextcloud. Additionally, you may run **occ preview:pre-generate -vvv** to a process the queue of pending previews immediately.",
+    "homepage": "https://github.com/nextcloud/previewgenerator",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "qownnotesapi": {
+    "hash": "sha256-5ikl+SNEstpWy+uBKNE/bU0klBo3tr2Ylclq6szxHEM=",
+    "url": "https://github.com/pbek/qownnotesapi/releases/download/v26.5.0/qownnotesapi-nc.tar.gz",
+    "version": "26.5.0",
+    "description": "QOwnNotesAPI is the Nextcloud/ownCloud API for [QOwnNotes](http://www.qownnotes.org), the open source notepad for Linux, macOS and Windows, that works together with the notes application of Nextcloud/ownCloud.\n\nThe only purpose of this App is to provide API access to your Nextcloud/ownCloud server for your QOwnNotes desktop installation, you cannot use this App for anything else, if you don't have QOwnNotes installed on your desktop computer!",
+    "homepage": "https://github.com/pbek/qownnotesapi",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "quota_warning": {
+    "hash": "sha256-bX9f6Zu53lZfG8zpfEwRxvIFVxARs4y6NLNNAK3DhUI=",
+    "url": "https://github.com/nextcloud-releases/quota_warning/releases/download/v1.24.0/quota_warning-v1.24.0.tar.gz",
+    "version": "1.24.0",
+    "description": "This app sends notifications to users when they reached 85, 90 and 95% of their quota (checked once a day).\nIn addition an email can be sent to the users. The three percentages can be changed in the admin settings.\nIt is also possible to have a link in the email and the notification for upsell options.",
+    "homepage": "https://github.com/nextcloud/quota_warning",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "registration": {
+    "hash": "sha256-mXsG5SfMrOp/G/4w9dbcwk41bLRUyrzWGTkoNeE0E88=",
+    "url": "https://github.com/nextcloud-releases/registration/releases/download/v3.0.0/registration-v3.0.0.tar.gz",
+    "version": "3.0.0",
+    "description": "User registration\n\nThis app allows users to register a new account.\n\n# Features\n\n- Add users to a given group\n- Allow-list with email domains (including wildcard) to register with\n- Administrator will be notified via email for new user creation or require approval\n- Supports Nextcloud's Client Login Flow v1 and v2 - allowing registration in the mobile Apps and Desktop clients\n\n# Web form registration flow\n\n1. User enters their email address\n2. Verification link is sent to the email address\n3. User clicks on the verification link\n4. User is lead to a form where they can choose their username and password\n5. New account is created and is logged in automatically",
+    "homepage": "https://github.com/nextcloud/registration",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "repod": {
+    "hash": "sha256-wLglJfhATgmHjagwClZHtXm8HQ8vSE0DUG4KXTHRapI=",
+    "url": "https://git.crystalyx.net/Xefir/repod/releases/download/4.2.1/repod.tar.gz",
+    "version": "4.2.1",
+    "description": "## Features\n- 🔍 Browse and subscribe huge collection of podcasts\n- 🔊 Listen to episodes directly in Nextcloud\n- 🌐 Sync your activity with [AntennaPod](https://antennapod.org/) and [other apps](https://git.crystalyx.net/Xefir/repod#clients-supporting-sync-of-gpoddersync)\n- 📱 Mobile friendly interface\n- 📡 Import and export your subscriptions\n- ➡️ Full features comparison [here](https://git.crystalyx.net/Xefir/repod#comparaison-with-similar-apps-for-nextcloud)\n\n## Requirements\nYou need to have [GPodderSync](https://apps.nextcloud.com/apps/gpoddersync) installed to use this app!",
+    "homepage": "https://git.crystalyx.net/Xefir/repod",
+    "licenses": [
+      "AGPL-3.0-or-later"
+    ]
+  },
+  "richdocuments": {
+    "hash": "sha256-uGoXL/LnFaWlLRDdx95qmhD4HIW3p51CWlpKiWTScYg=",
+    "url": "https://github.com/nextcloud-releases/richdocuments/releases/download/v11.0.0/richdocuments-v11.0.0.tar.gz",
+    "version": "11.0.0",
+    "description": "This application can connect to a Collabora Online (or other) server (WOPI-like Client). Nextcloud is the WOPI Host. Please read the documentation to learn more about that.\n\nYou can also edit your documents off-line with the Collabora Office app from the **[Android](https://play.google.com/store/apps/details?id=com.collabora.libreoffice)** and **[iOS](https://apps.apple.com/us/app/collabora-office/id1440482071)** store.",
+    "homepage": "https://collaboraoffice.com/",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "sociallogin": {
+    "hash": "sha256-8yB+PFGi9+bUjiEEHBJxAyySMluPO/1m3sPUThe5+t0=",
+    "url": "https://github.com/zorn-v/nextcloud-social-login/releases/download/v6.5.2/release.tar.gz",
+    "version": "6.5.2",
+    "description": "# Social Login\n\nMake it possible to create users and log in via Telegram, OAuth, or OpenID.\n\nFor OAuth, you must create an app with certain providers. Login buttons will appear on the login page if an app ID is specified. Settings are located in the \"Social login\" section of the settings page.\n\n## Installation\n\nLog in to your Nextcloud installation as an administrator. Under \"Apps\", click \"Download and enable\" next to the \"Social Login\" app.\n\nSee below for setup and configuration instructions.\n\n## Custom OAuth2/OIDC Groups\n\nYou can use groups from your custom provider. For this, specify the \"Groups claim\" in the custom OAuth2/OIDC provider settings. This claim should be returned from the provider in the `id_token` or at the user info endpoint. Multiple claims (comma separated) also supported - groups will be merged.\nThe format should be an `array` or a comma-separated string. E.g., (with a claim named `roles`):\n\n```json\n{\"roles\": [\"admin\", \"user\"]}\n```\nor\n```json\n{\"roles\": \"admin,user\"}\n```\n\nNested claims are also supported. For example, `resource_access.client-id.roles` for:\n\n```json\n\"resource_access\": {\n   \"client-id\": {\n     \"roles\": [\n       \"client-role-1\",\n       \"client-role-2\"\n     ]\n   }\n}\n```\n\n**DisplayName** support is also available:\n```json\n{\"roles\": [{\"gid\": 1, \"displayName\": \"admin\"}, {\"gid\": 2, \"displayName\": \"user\"}]}\n```\n\nYou can use provider groups in two ways:\n\n1. Map provider groups to existing Nextcloud groups.\n2. Create provider groups in Nextcloud and associate them with users (if the appropriate option is enabled).\n\nTo sync groups on every login, ensure the \"Update user profile every login\" setting is checked.\n\n## Examples for Groups\n\n* Configure WSO2IS to return a roles claim with OIDC [here](https://medium.com/@dewni.matheesha/claim-mapping-and-retrieving-end-user-information-in-wso2is-cffd5f3937ff).\n* [GitLab OIDC configuration to allow specific GitLab groups](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/gitlab.md).\n\n## Built-in OAuth Providers\n\nCopy the link from a specific login button to get the correct \"redirect URL\" for OAuth app settings.\n\n* [Amazon](https://developer.amazon.com/loginwithamazon/console/site/lwa/overview.html)\n* [Apple](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/apple.md)\n* [Codeberg](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/codeberg.md)\n* [Discord](#configure-discord)\n* [Facebook](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/facebook.md)\n* [GitHub](https://github.com/settings/developers)\n* [GitLab](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/gitlab.md)\n* [Google](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/google.md)\n* [Keycloak](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/keycloak.md)\n* [Mail.ru](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/mailru.md)\n* **PlexTv**: Use any title as the app ID.\n* [Telegram](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/telegram.md)\n* [Twitter](https://github.com/zorn-v/nextcloud-social-login/blob/master/docs/sso/twitter.md)\n\nFor details about Google's \"Allow login only from specified domain\" setting, see [#44](https://github.com/zorn-v/nextcloud-social-login/issues/44). Use a comma-separated list for multiple domains.\n\n## Configuration\n\nAdd `'social_login_auto_redirect' => true` to `config.php` to automatically redirect unauthorized users to social login if only one provider is configured. To temporarily disable this (e.g., for local admin login), add `noredir=1` to the login URL: `https://cloud.domain.com/login?noredir=1`.\n\nConfigure HTTP client options using:\n```php\n  'social_login_http_client' => [\n    'timeout' => 45,\n    'proxy' => 'socks4://127.0.0.1:9050', // See <https://curl.se/libcurl/c/CURLOPT_PROXY.html> for allowed formats\n  ],\n```\nin `config.php`.\n\n### Configure a Provider via CLI\n\nUse the `occ` utility to configure providers via the command line. Replace variables and URLs with your deployment values:\n```bash\nphp occ config:app:set sociallogin custom_providers --value='{\"custom_oidc\": [{\"name\": \"gitlab_oidc\", \"title\": \"Gitlab\", \"authorizeUrl\": \"https://gitlab.my-domain.org/oauth/authorize\", \"tokenUrl\": \"https://gitlab.my-domain.org/oauth/token\", \"userInfoUrl\": \"https://gitlab.my-domain.org/oauth/userinfo\", \"logoutUrl\": \"\", \"clientId\": \"$my_application_id\", \"clientSecret\": \"$my_super_secret_secret\", \"scope\": \"openid\", \"groupsClaim\": \"groups\", \"style\": \"gitlab\", \"defaultGroup\": \"\"}]}'\n```\nFor Docker, prepend `docker exec -t -uwww-data CONTAINER_NAME` to the command or run interactively via `docker exec -it -uwww-data CONTAINER_NAME sh`.\n\nTo inspect configurations:\n```sql\nmysql -u nextcloud -p nextcloud\nPassword: <yourpassword>\n\n> SELECT * FROM oc_appconfig WHERE appid='sociallogin';\n```\nOr run:\n```bash\ndocker exec -t -uwww-data CONTAINER_NAME php occ config:app:get sociallogin custom_providers\n```\n\n### Configure Discord\n\n1. Create a Discord application at [Discord Developer Portal](https://discord.com/developers/applications).\n2. Navigate to `Settings > OAuth2 > General`. Add a redirect URL: `https://nextcloud.mydomain.com/apps/sociallogin/oauth/discord`.\n3. Copy the `CLIENT ID` and generate a `CLIENT SECRET`.\n4. In Nextcloud, go to `Settings > Social Login`. Paste the `CLIENT ID` into \"App id\" and `CLIENT SECRET` into \"Secret\".\n5. Select a default group for new users.\n6. For group mapping, see [#395](https://github.com/zorn-v/nextcloud-social-login/pull/395).\n\n## Hint\n\n### Callback (Reply) URL\nCopy the link from a login button on the Nextcloud login page and use it as the callback URL on your provider's site. To make the button visible temporarily, fill provider settings with placeholder data and update later.\n\nIf you encounter callback URL errors despite correct settings, ensure your Nextcloud server generates HTTPS URLs by adding `'overwriteprotocol' => 'https'` to `config.php`.",
+    "homepage": "https://github.com/zorn-v/nextcloud-social-login",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "spreed": {
+    "hash": "sha256-Mh59Quq8LORxUb2tZsKDxx+zz7HeSl+1lAFrnGf54Wc=",
+    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v24.0.2/spreed-v24.0.2.tar.gz",
+    "version": "24.0.2",
+    "description": "Chat, video & audio-conferencing using WebRTC\n\n* 💬 **Chat** Nextcloud Talk comes with a simple text chat, allowing you to share or upload files from your Nextcloud Files app or local device and mention other participants.\n* 👥 **Private, group, public and password protected calls!** Invite someone, a whole group or send a public link to invite to a call.\n* 🌐 **Federated chats** Chat with other Nextcloud users on their servers\n* 💻 **Screen sharing!** Share your screen with the participants of your call.\n* 🚀 **Integration with other Nextcloud apps** like Files, Calendar, User status, Dashboard, Flow, Maps, Smart picker, Contacts, Deck, and many more.\n* 🌉 **Sync with other chat solutions** With [Matterbridge](https://github.com/42wim/matterbridge/) being integrated in Talk, you can easily sync a lot of other chat solutions to Nextcloud Talk and vice-versa.",
+    "homepage": "https://github.com/nextcloud/spreed",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "tables": {
+    "hash": "sha256-ZAvytGd4S5dMNLbWi2bURaBOZRGNk5F+vjqKmRfYSL0=",
+    "url": "https://github.com/nextcloud-releases/tables/releases/download/v2.2.0/tables-v2.2.0.tar.gz",
+    "version": "2.2.0",
+    "description": "Manage data the way you need it.\n\nWith this app you are able to create your own tables with individual columns. You can start with a template or from scratch and add your wanted columns.\nYou can choose from the following column types:\n- Text line or rich text\n- Link to urls or other nextcloud resources\n- Numbers\n- Progress bar\n- Stars rating\n- Yes/No tick\n- Date and/or time\n- (Multi) selection\n- Users, groups and teams\n\nShare your tables and views with users and groups within your cloud.\n\nHave a good time and manage whatever you want.",
+    "homepage": "https://github.com/nextcloud/tables",
+    "licenses": [
+      "AGPL-3.0-or-later"
+    ]
+  },
+  "tasks": {
+    "hash": "sha256-DJiNUFMcm/okbmwx8/lTaa3eFim6cNFRlJFatW4kaHs=",
+    "url": "https://github.com/nextcloud/tasks/releases/download/v0.18.1/tasks.tar.gz",
+    "version": "0.18.1",
+    "description": "Once enabled, a new Tasks menu will appear in your Nextcloud apps menu. From there you can add and delete tasks, edit their title, description, start and due dates and mark them as important. Tasks can be shared between users. Tasks can be synchronized using CalDav (each task list is linked to an Nextcloud calendar, to sync it to your local client: Thunderbird, Evolution, KDE Kontact, iCal … - just add the calendar as a remote calendar in your client). You can download your tasks as ICS files using the download button for each calendar.",
+    "homepage": "https://github.com/nextcloud/tasks/",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "twofactor_admin": {
+    "hash": "sha256-IkHzIqRBhG6zr+8y5ifrRfsKl9TyMDx7G1JGogbQrDM=",
+    "url": "https://github.com/nextcloud-releases/twofactor_admin/releases/download/v4.12.0/twofactor_admin-v4.12.0.tar.gz",
+    "version": "4.12.0",
+    "description": "This two-factor auth (2FA) provider for Nextcloud allows admins to generate a one-time\n\t\tcode for users to log into a 2FA protected account. This is helpful in situations where\n\t\tusers have lost access to their other 2FA methods or mandatory 2FA without any previously\n\t\tenabled 2FA provider.",
+    "homepage": "",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "twofactor_webauthn": {
+    "hash": "sha256-cpjn8Md2MaVv063A2HwklgtGtPIkzyF/KgE/OzzP0bA=",
+    "url": "https://github.com/nextcloud-releases/twofactor_webauthn/releases/download/v2.7.0/twofactor_webauthn-v2.7.0.tar.gz",
+    "version": "2.7.0",
+    "description": "A two-factor provider for WebAuthn devices",
+    "homepage": "https://github.com/nextcloud/twofactor_webauthn#readme",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "unroundedcorners": {
+    "hash": "sha256-RCnXfnl2dJ0NpcNJ+0+jcSsp/h4hHemPg3fkjkFoGl0=",
+    "url": "https://github.com/OliverParoczai/nextcloud-unroundedcorners/releases/download/v1.1.6/unroundedcorners-v1.1.6.tar.gz",
+    "version": "1.1.6",
+    "description": "# Unrounded Corners\nA Nextcloud app that restores the corners of buttons and widgets to their original looks by unrounding them.",
+    "homepage": "https://github.com/OliverParoczai/nextcloud-unroundedcorners",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "uppush": {
+    "hash": "sha256-5+Knec2Ix8291UcQFipmqh3C9wheYH4+Smmmt3q3wFE=",
+    "url": "https://codeberg.org/NextPush/uppush/archive/2.5.0.tar.gz",
+    "version": "2.5.0",
+    "description": "Once the mobile phone is connected with NextPush, push notifications can be forwarded to applications implementing UnifiedPush.\n\nMore information about UnifiedPush at https://unifiedpush.org",
+    "homepage": "",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "user_oidc": {
+    "hash": "sha256-Sc7R/hkjAvRUC4aUOLbMucoNabcXt27XB1pwqlz2Zv0=",
+    "url": "https://github.com/nextcloud-releases/user_oidc/releases/download/v8.10.1/user_oidc-v8.10.1.tar.gz",
+    "version": "8.10.1",
+    "description": "Allows flexible configuration of an OIDC server as Nextcloud login user backend.",
+    "homepage": "https://github.com/nextcloud/user_oidc",
+    "licenses": [
+      "agpl"
+    ]
+  },
+  "user_saml": {
+    "hash": "sha256-LDiWtEaVJbNECJkcn80L4behkUyUsRlDFDd2lk2g+pE=",
+    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v8.1.4/user_saml-v8.1.4.tar.gz",
+    "version": "8.1.4",
+    "description": "Using the SSO & SAML app of your Nextcloud you can make it easily possible to integrate your existing Single-Sign-On solution with Nextcloud. In addition, you can use the Nextcloud LDAP user provider to keep the convenience for users. (e.g. when sharing)\nThe following providers are supported and tested at the moment:\n\n* **SAML 2.0**\n\t* OneLogin\n\t* Shibboleth\n\t* Active Directory Federation Services (ADFS)\n\t* Authentik\n\n* **Authentication via Environment Variable**\n\t* Kerberos (mod_auth_kerb)\n\t* Any other provider that authenticates using the environment variable\n\nWhile theoretically any other authentication provider implementing either one of those standards is compatible, we like to note that they are not part of any internal test matrix.",
+    "homepage": "https://github.com/nextcloud/user_saml",
+    "licenses": [
+      "AGPL-3.0-or-later"
+    ]
+  },
+  "whiteboard": {
+    "hash": "sha256-GV5dCxn7t+F2vSyJur/VUUrvAiSv5dDvI5ME6EBGof4=",
+    "url": "https://github.com/nextcloud-releases/whiteboard/releases/download/v1.5.9/whiteboard-v1.5.9.tar.gz",
+    "version": "1.5.9",
+    "description": "The official whiteboard app for Nextcloud. It allows users to create and share whiteboards with other users and collaborate in real-time.\n\n**Whiteboard requires a separate collaboration server to work.** Please see the [documentation](https://github.com/nextcloud/whiteboard?tab=readme-ov-file#backend) on how to install it.\n\n- 🎨 Drawing shapes, writing text, connecting elements\n- 📝 Real-time collaboration\n- 🖼️ Add images with drag and drop\n- 📊 Easily add mermaid diagrams\n- ✨ Use the Smart Picker to embed other elements from Nextcloud\n- 📦 Image export\n- 💪 Strong foundation: We use Excalidraw as our base library",
+    "homepage": "https://github.com/nextcloud/whiteboard",
+    "licenses": [
+      "agpl"
+    ]
+  }
+}

From 3c770842698d6a8f629bb30ea520ab4d808637a1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Wed, 8 Jul 2026 14:59:49 +0200
Subject: [PATCH 34/50] nextcloud33Packages.apps.memories: 8.0.1 -> 8.1.0, add
 support for nextcloud 34

Changelog: https://github.com/pulsejet/memories/releases/tag/v8.1.0
(cherry picked from commit a9f6c5d0ad111f05376d54ad2364c6c00e91c32b)
---
 pkgs/servers/nextcloud/packages/apps/memories.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/servers/nextcloud/packages/apps/memories.nix b/pkgs/servers/nextcloud/packages/apps/memories.nix
index e49f1e45ccf4..671462f80cf6 100644
--- a/pkgs/servers/nextcloud/packages/apps/memories.nix
+++ b/pkgs/servers/nextcloud/packages/apps/memories.nix
@@ -18,10 +18,11 @@ let
       srcHash = "sha256-KyUfrKHnRO3lMin0seSNFRnRRTPo12NbbvbkSpxSMQE=";
     };
     "33" = {
-      version = "8.0.1";
-      appHash = "sha256-B+O78qjBQbmMnFAvH/5a+YBive+rkBG9AKTX7G3qNR0=";
-      srcHash = "sha256-t/DiGJzSey9YpV5GkepKSGjr5gXc9KWDBtSY5UPRlEU=";
+      version = "8.1.0";
+      appHash = "sha256-SQ1gPdfICFqNBJM0dJOfKIJ/E1tBBcBQOjRdb/mKb04=";
+      srcHash = "sha256-T0oz5d4kPX/Pm06vKGTrltUFd1pKccsz5IDjv/Vmuz0=";
     };
+    "34" = latestVersionForNc."33";
   };
   currentVersionInfo =
     latestVersionForNc.${ncVersion}

From dd06b07608b7b75d923749ac4703f04ed7226dc6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Fri, 10 Jul 2026 15:31:26 +0200
Subject: [PATCH 35/50] nextcloud34Packages.apps.recognize: init at 12.0.0

Co-authored-by: Joseph Price <1044068+JoePricey@users.noreply.github.com>
(cherry picked from commit 666f49bbeb4074bba7bb60935ba001ed53fa0973)
---
 pkgs/servers/nextcloud/packages/apps/recognize.nix | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/pkgs/servers/nextcloud/packages/apps/recognize.nix b/pkgs/servers/nextcloud/packages/apps/recognize.nix
index 336e86dfbd2d..e58bc33e66fb 100644
--- a/pkgs/servers/nextcloud/packages/apps/recognize.nix
+++ b/pkgs/servers/nextcloud/packages/apps/recognize.nix
@@ -27,6 +27,11 @@ let
       appHash = "sha256-x3LXZKDWmzCYLTaNqSvgu4Gvrn6w2c/jifNCx1oaw1U=";
       modelHash = "sha256-Yx/NJwtD4ltETpkzlcadZsFKqEmMneoZaXiHVSB1WoE=";
     };
+    "34" = {
+      version = "12.0.0";
+      appHash = "sha256-1TpfDRMmJ7d5MPp0iTr/RpZHAG7LDsXof9u35O3+5Mg=";
+      modelHash = "sha256-+ec7kRPyWPVTk2wgRKMOP5mdmSnpv9mZmiRicEDKD6A=";
+    };
   };
   currentVersionInfo =
     latestVersionForNc.${ncVersion}
@@ -74,7 +79,9 @@ stdenv.mkDerivation rec {
     substituteInPlace recognize/lib/**/*.php \
       --replace-quiet "\$this->settingsService->getSetting('node_binary')" "'${lib.getExe nodejs}'" \
       --replace-quiet "\$this->config->getAppValueString('node_binary', '""')" "'${lib.getExe nodejs}'" \
-      --replace-quiet "\$this->config->getAppValueString('node_binary')" "'${lib.getExe nodejs}'"
+      --replace-quiet "\$this->config->getAppValueString('node_binary')" "'${lib.getExe nodejs}'" \
+      --replace-quiet "\$this->config->getAppValueString('node_binary', ''', lazy: true)" "'${lib.getExe nodejs}'" \
+      --replace-quiet "\$this->config->getAppValueString('node_binary', lazy: true)" "'${lib.getExe nodejs}'"
     test "$(grep "get[a-zA-Z]*('node_binary'" recognize/lib/**/*.php | wc -l)" -eq 0
 
     # Skip trying to install it... (less warnings in the log)

From 8cf31eeaf96ea6de550113f164def03fb5fa25aa Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Jul 2026 05:44:22 +0000
Subject: [PATCH 36/50] archon-lite: 9.3.85 -> 9.3.172

(cherry picked from commit d526ecb286c01fa0dab3febffbcb2ac11d1dcb6a)
---
 pkgs/by-name/ar/archon-lite/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ar/archon-lite/package.nix b/pkgs/by-name/ar/archon-lite/package.nix
index 059315879d8c..d5177c4a810d 100644
--- a/pkgs/by-name/ar/archon-lite/package.nix
+++ b/pkgs/by-name/ar/archon-lite/package.nix
@@ -6,10 +6,10 @@
 }:
 let
   pname = "archon-lite";
-  version = "9.3.85";
+  version = "9.3.172";
   src = fetchurl {
     url = "https://github.com/RPGLogs/Uploaders-archon-lite/releases/download/v${version}/archon-lite-v${version}.AppImage";
-    hash = "sha256-ooNvgbtV6HKgzRLgHZul92NLnEB8oX6fHL6iwfHajVA=";
+    hash = "sha256-Jl1/40jtdG9acb2SSef4G91hs/b1UdOp6gPnoGPnQ60=";
   };
 
   extracted = appimageTools.extractType2 { inherit pname version src; };

From a26dae7e713a856387f3be40b2be06abc99c44ca Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Wed, 8 Jul 2026 13:53:18 +0200
Subject: [PATCH 37/50] wget: add patches for several CVEs

(cherry picked from commit 50001e14af6aa3bd2ab3def894e74ec7123d3b00)
---
 pkgs/by-name/wg/wget/package.nix | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/pkgs/by-name/wg/wget/package.nix b/pkgs/by-name/wg/wget/package.nix
index f49dbaa45108..c5435366569a 100644
--- a/pkgs/by-name/wg/wget/package.nix
+++ b/pkgs/by-name/wg/wget/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchurl,
+  fetchpatch,
 
   gettext,
   pkg-config,
@@ -32,6 +33,29 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-GSJcx1awoIj8gRSNxqQKDI8ymvf9hIPxx7L+UPTgih8=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "fix-cve-2026-58471";
+      url = "https://gitlab.com/gnuwget/wget/-/commit/c2640fe5171c59f87c58dc9fcb195b2d18b010ee.patch";
+      hash = "sha256-ZnCLK9ILpHMqpmI39sBl3Q3NRNc/H8jukvBrECqJ6OI=";
+    })
+    (fetchpatch {
+      name = "fix-cve-2026-58470";
+      url = "https://gitlab.com/gnuwget/wget/-/commit/43d3ba9336bc94937e6fae2365c6ffd30c34ffcf.patch";
+      hash = "sha256-aR5lW8t6ME2Os/NPXjFaUbNr3QuiUSQKsa2Zk292mrk=";
+    })
+    (fetchpatch {
+      name = "fix-cve-2026-58469";
+      url = "https://gitlab.com/gnuwget/wget/-/commit/37a40fcb450153f69537c7cbc2a7a4fb0b6f7826.patch";
+      hash = "sha256-lkHQufl8XFZ1Ig8EoRUw3JuCgDPQod9PKAIsTBWzvm4=";
+    })
+    (fetchpatch {
+      name = "fix-cve-2026-58472";
+      url = "https://gitlab.com/gnuwget/wget/-/commit/dd692d9cea5335b181d877ae917fe6e75587a812.patch";
+      hash = "sha256-FAlglKTZili9Y4ivSRLOEaOgektFmq4u6yyH+8WzQao=";
+    })
+  ];
+
   preConfigure = ''
     patchShebangs doc
   '';

From d97c3cd4ab8739b80b633ac2ef0e19c0e7b68ad7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Jul 2026 17:37:32 +0000
Subject: [PATCH 38/50] terraform-config-inspect: 0-unstable-2026-02-24 ->
 0-unstable-2026-07-09

(cherry picked from commit 4fb7d5e459a5de43fd9674a9a498aa4375aff91d)
---
 pkgs/by-name/te/terraform-config-inspect/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/te/terraform-config-inspect/package.nix b/pkgs/by-name/te/terraform-config-inspect/package.nix
index 302b1d434ae5..073b95d91a27 100644
--- a/pkgs/by-name/te/terraform-config-inspect/package.nix
+++ b/pkgs/by-name/te/terraform-config-inspect/package.nix
@@ -7,13 +7,13 @@
 }:
 buildGoModule {
   pname = "terraform-config-inspect";
-  version = "0-unstable-2026-02-24";
+  version = "0-unstable-2026-07-09";
 
   src = fetchFromGitHub {
     owner = "hashicorp";
     repo = "terraform-config-inspect";
-    rev = "813a9753022088a8e29290e3ba8806131a3329c2";
-    hash = "sha256-kjX7tSU5p5kssqIDnxuLyfmUul8UH83Aeq7ftN0HJCM=";
+    rev = "2fb54c236733ee65ee877105d595c124c993c64d";
+    hash = "sha256-f8DyPP0XhOlgVdp0yjjFVyjaO2+ypfMfEEv6lwA8u3M=";
   };
 
   vendorHash = "sha256-iYrSk9JqxvhYSJuSv/nhZep41gRr644ZzGFWXMGQgyc=";

From b56b614426689d4e1c9f585fefa90974a6dee1b6 Mon Sep 17 00:00:00 2001
From: Joseph Price <joe@pricey.uk>
Date: Mon, 29 Jun 2026 18:01:27 +0100
Subject: [PATCH 39/50] nextcloud*: enable structuredAttrs, strictDeps

Fixes:
```
- Attribute `pkgs.nextcloud34` is a new package with `strictDeps` unset or set to `false`.
  Please enable `strictDeps = true;` in pkgs/top-level/all-packages.nix.
 (https://github.com/NixOS/nixpkgs-vet/wiki/NPV-164)
- Attribute `pkgs.nextcloud34` is a new package with `__structuredAttrs` unset or set to `false`.
  Please enable `__structuredAttrs = true;` in pkgs/top-level/all-packages.nix.
 (https://github.com/NixOS/nixpkgs-vet/wiki/NPV-166)
```

(cherry picked from commit 9a795032e623e730a7cf50168f9d6e73a2ca7af6)
---
 pkgs/servers/nextcloud/default.nix | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/pkgs/servers/nextcloud/default.nix b/pkgs/servers/nextcloud/default.nix
index 71964c995439..fe58b505b210 100644
--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@@ -21,18 +21,14 @@ let
       pname = "nextcloud";
       inherit version;
 
+      __structuredAttrs = true;
+      strictDeps = true;
+
       src = fetchurl {
         url = "https://download.nextcloud.com/server/releases/nextcloud-${version}.tar.bz2";
         inherit hash;
       };
 
-      passthru = {
-        tests = lib.filterAttrs (
-          key: _: (lib.hasSuffix (lib.versions.major version) key)
-        ) nixosTests.nextcloud;
-        inherit packages;
-      };
-
       installPhase = ''
         runHook preInstall
         mkdir -p $out/
@@ -40,6 +36,13 @@ let
         runHook postInstall
       '';
 
+      passthru = {
+        tests = lib.filterAttrs (
+          key: _: (lib.hasSuffix (lib.versions.major version) key)
+        ) nixosTests.nextcloud;
+        inherit packages;
+      };
+
       meta = {
         changelog = "https://nextcloud.com/changelog/#${lib.replaceStrings [ "." ] [ "-" ] version}";
         description = "Sharing solution for files, calendars, contacts and more";

From a42237acb2083f03755840d2cee79435b81ce3de Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 11 Jul 2026 15:43:35 +0000
Subject: [PATCH 40/50] openlinkhub: 0.8.8 -> 0.8.9

(cherry picked from commit 9c478074234c3a5ca66413c517340491141e412c)
---
 pkgs/by-name/op/openlinkhub/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/op/openlinkhub/package.nix b/pkgs/by-name/op/openlinkhub/package.nix
index 067c2d28ddfc..d056564f6c43 100644
--- a/pkgs/by-name/op/openlinkhub/package.nix
+++ b/pkgs/by-name/op/openlinkhub/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "openlinkhub";
-  version = "0.8.8";
+  version = "0.8.9";
 
   src = fetchFromGitHub {
     owner = "jurkovic-nikola";
     repo = "OpenLinkHub";
     tag = finalAttrs.version;
-    hash = "sha256-uYuhmvdHNVs19egakwDOvIJ2IEAeZEAV6qgMYEl+Ie4=";
+    hash = "sha256-g8ZdiBaEelS+LhnOA23mMR+irN1wKD6Rp66sCnSD2tU=";
   };
 
   proxyVendor = true;

From 443481a2f20d7c38d3daf6fe77c894d4ec9dbb64 Mon Sep 17 00:00:00 2001
From: Harish Rajagopal <harish.rajagopals@gmail.com>
Date: Sat, 4 Jul 2026 02:21:36 +0200
Subject: [PATCH 41/50] feishin: add override for web version

(cherry picked from commit a9b06ca330b2c6f3c4dd206d5eb0c6f80e5fd539)
---
 pkgs/by-name/fe/feishin/package.nix | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/fe/feishin/package.nix b/pkgs/by-name/fe/feishin/package.nix
index f8a1a7ee214c..242b0cfa105b 100644
--- a/pkgs/by-name/fe/feishin/package.nix
+++ b/pkgs/by-name/fe/feishin/package.nix
@@ -14,6 +14,7 @@
   copyDesktopItems,
   makeDesktopItem,
   nix-update-script,
+  webVersion ? false,
 }:
 let
   pname = "feishin";
@@ -34,6 +35,7 @@ buildNpmPackage {
   inherit src;
 
   npmConfigHook = pnpmConfigHook;
+  npmBuildScript = if webVersion then "build:web" else "build";
 
   npmDeps = null;
   pnpmDeps = fetchPnpmDeps {
@@ -52,8 +54,8 @@ buildNpmPackage {
   nativeBuildInputs = [
     pnpm_10
   ]
-  ++ lib.optionals (stdenv.hostPlatform.isLinux) [ copyDesktopItems ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+  ++ lib.optionals (stdenv.hostPlatform.isLinux && !webVersion) [ copyDesktopItems ]
+  ++ lib.optionals (stdenv.hostPlatform.isDarwin && !webVersion) [
     darwin.autoSignDarwinBinariesHook
     actool
   ];
@@ -73,7 +75,7 @@ buildNpmPackage {
     ln -s ${dart-sass}/bin/dart-sass "$dir"/sass
   '';
 
-  postBuild = ''
+  postBuild = lib.optionalString (!webVersion) ''
     cp -r ${electron.dist} electron-dist
     chmod -R u+w electron-dist
 
@@ -88,14 +90,18 @@ buildNpmPackage {
   installPhase = ''
     runHook preInstall
   ''
-  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+  + lib.optionalString webVersion ''
+    mkdir -p $out
+    cp -r out/web/* $out
+  ''
+  + lib.optionalString (stdenv.hostPlatform.isDarwin && !webVersion) ''
     mkdir -p $out/{Applications,bin}
     cp -r dist/**/Feishin.app $out/Applications/
     makeWrapper $out/Applications/Feishin.app/Contents/MacOS/Feishin $out/bin/feishin \
       --prefix PATH : "${lib.makeBinPath [ mpv-unwrapped ]}" \
       --set DISABLE_AUTO_UPDATES 1
   ''
-  + lib.optionalString stdenv.hostPlatform.isLinux ''
+  + lib.optionalString (stdenv.hostPlatform.isLinux && !webVersion) ''
     mkdir -p $out/share/feishin
 
     pushd dist/*-unpacked/
@@ -126,7 +132,7 @@ buildNpmPackage {
     runHook postInstall
   '';
 
-  desktopItems = [
+  desktopItems = lib.optionals (!webVersion) [
     (makeDesktopItem {
       name = "feishin";
       desktopName = "Feishin";
@@ -152,11 +158,11 @@ buildNpmPackage {
     sourceProvenance = with lib.sourceTypes; [ fromSource ];
     license = lib.licenses.gpl3Plus;
     platforms = lib.platforms.unix;
-    mainProgram = "feishin";
     maintainers = with lib.maintainers; [
       BatteredBunny
       onny
       jlbribeiro
     ];
-  };
+  }
+  // lib.optionalAttrs (!webVersion) { mainProgram = "feishin"; };
 }

From 219caa76f22d3a4a6a93a1937ff60d3c13c2ef11 Mon Sep 17 00:00:00 2001
From: Harish Rajagopal <harish.rajagopals@gmail.com>
Date: Sat, 11 Jul 2026 14:35:49 +0200
Subject: [PATCH 42/50] feishin-web: init at 1.13.0

(cherry picked from commit 93de10dc0d3b4ee080f1cdb70da6cc9bdf10883a)
---
 pkgs/by-name/fe/feishin/package.nix | 2 ++
 pkgs/top-level/all-packages.nix     | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/pkgs/by-name/fe/feishin/package.nix b/pkgs/by-name/fe/feishin/package.nix
index 242b0cfa105b..ba20d7cc33bd 100644
--- a/pkgs/by-name/fe/feishin/package.nix
+++ b/pkgs/by-name/fe/feishin/package.nix
@@ -34,6 +34,8 @@ buildNpmPackage {
 
   inherit src;
 
+  __structuredAttrs = true;
+
   npmConfigHook = pnpmConfigHook;
   npmBuildScript = if webVersion then "build:web" else "build";
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index b70b8212d637..c4086f2ee2f3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11692,4 +11692,6 @@ with pkgs;
   gpac-unstable = callPackage ../by-name/gp/gpac/package.nix {
     releaseChannel = "unstable";
   };
+
+  feishin-web = feishin.override { webVersion = true; };
 }

From e5267851e8ddff318acb4c0ea087a85265f8724a Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Sat, 11 Jul 2026 10:14:40 +0200
Subject: [PATCH 43/50] angle: add riscv64-linux support

(cherry picked from commit a5e3ebaefd56aa0de33c63d3596458bb89189647)
---
 pkgs/by-name/an/angle/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/an/angle/package.nix b/pkgs/by-name/an/angle/package.nix
index a7920e4b0e94..97dbd2b1ee73 100644
--- a/pkgs/by-name/an/angle/package.nix
+++ b/pkgs/by-name/an/angle/package.nix
@@ -26,6 +26,7 @@ let
   triplet = lib.getAttr arch {
     "x86_64" = "x86_64-unknown-linux-gnu";
     "aarch64" = "aarch64-unknown-linux-gnu";
+    "riscv64" = "riscv64-unknown-linux-gnu";
   };
 
   clang = symlinkJoin {
@@ -98,6 +99,10 @@ stdenv.mkDerivation (finalAttrs: {
     # On darwin during linking:
     # clang++: error: argument unused during compilation: '-stdlib=libc++'
     "treat_warnings_as_errors=false"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isRiscV64 [
+    # Force clang on riscv64 because default gcc toolchain is unavailable.
+    "is_clang=true"
   ];
 
   patches = [

From 493608d8a88e229dc0bec442e3514dc187412fe4 Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Sat, 11 Jul 2026 10:36:54 +0200
Subject: [PATCH 44/50] libuv: fix riscv64-linux build

(cherry picked from commit cd38ee6784e7cd8c785c5dcd2fe42b10aa70bbc1)
---
 pkgs/by-name/li/libuv/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/li/libuv/package.nix b/pkgs/by-name/li/libuv/package.nix
index 187b1ed148c7..e4a48ee8cd04 100644
--- a/pkgs/by-name/li/libuv/package.nix
+++ b/pkgs/by-name/li/libuv/package.nix
@@ -129,6 +129,10 @@ stdenv.mkDerivation (finalAttrs: {
         # https://github.com/libuv/libuv/issues/1871
         "shutdown_close_pipe"
       ]
+      ++ lib.optionals stdenv.hostPlatform.isRiscV64 [
+        # Aborts (SIGABRT, exit 134)
+        "poll_nested_epoll"
+      ]
       ++ lib.optionals stdenv.hostPlatform.isFreeBSD [
         # ENETUNREACH when performed in jailed build env
         "tcp_connect"

From eddcf3acbe30624168efa62c03f487a6ee59156f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sat, 4 Jul 2026 22:52:45 -0700
Subject: [PATCH 45/50] nixos/nfsd: allow exports to be an attrset

This is in the spirit of RFC 42.

(cherry picked from commit 7053e317be40117eb5b44087b2cad49131fa5625)
---
 .../services/network-filesystems/nfsd.nix     | 24 ++++++++++++++++++-
 nixos/tests/nfs/kerberos.nix                  | 13 +++++++---
 nixos/tests/nfs/simple.nix                    | 13 +++++++---
 3 files changed, 43 insertions(+), 7 deletions(-)

diff --git a/nixos/modules/services/network-filesystems/nfsd.nix b/nixos/modules/services/network-filesystems/nfsd.nix
index 9d3c3f9e4188..38986dcd85f8 100644
--- a/nixos/modules/services/network-filesystems/nfsd.nix
+++ b/nixos/modules/services/network-filesystems/nfsd.nix
@@ -6,6 +6,14 @@
 }:
 let
 
+  attrsToExports = lib.concatMapAttrsStringSep "\n" (
+    exportPoint: clientsAndOptions:
+    exportPoint
+    + lib.concatMapAttrsStringSep "" (
+      client: options: " ${client}(${lib.concatStringsSep "," options})"
+    ) clientsAndOptions
+  );
+
   cfg = config.services.nfs.server;
 
   exports = pkgs.writeText "exports" cfg.exports;
@@ -48,12 +56,26 @@ in
         };
 
         exports = lib.mkOption {
-          type = lib.types.lines;
+          type = with lib.types; coercedTo (attrsOf (attrsOf (listOf str))) attrsToExports lines;
           default = "";
           description = ''
             Contents of the /etc/exports file.  See
             {manpage}`exports(5)` for the format.
           '';
+          example = {
+            "/usr" = {
+              "*.local.domain" = [ "ro" ];
+              "@trusted" = [ "rw" ];
+            };
+            "/home/joe" = {
+              "pc001" = [
+                "rw"
+                "all_squash"
+                "anonuid=150"
+                "anongid=100"
+              ];
+            };
+          };
         };
 
         hostName = lib.mkOption {
diff --git a/nixos/tests/nfs/kerberos.nix b/nixos/tests/nfs/kerberos.nix
index f9720cfb87e2..ae787f8b7436 100644
--- a/nixos/tests/nfs/kerberos.nix
+++ b/nixos/tests/nfs/kerberos.nix
@@ -83,9 +83,16 @@ import ../make-test-python.nix (
 
           services.nfs.server.enable = true;
           services.nfs.server.createMountPoints = true;
-          services.nfs.server.exports = ''
-            /data *(rw,no_root_squash,fsid=0,sec=krb5p)
-          '';
+          services.nfs.server.exports = {
+            "/data" = {
+              "*" = [
+                "rw"
+                "no_root_squash"
+                "fsid=0"
+                "sec=krb5p"
+              ];
+            };
+          };
         };
     };
 
diff --git a/nixos/tests/nfs/simple.nix b/nixos/tests/nfs/simple.nix
index 3f2b8d3bbb1c..eebcb36cc0a5 100644
--- a/nixos/tests/nfs/simple.nix
+++ b/nixos/tests/nfs/simple.nix
@@ -37,9 +37,16 @@ import ../make-test-python.nix (
         { ... }:
         {
           services.nfs.server.enable = true;
-          services.nfs.server.exports = ''
-            /data 192.168.1.0/255.255.255.0(rw,no_root_squash,no_subtree_check,fsid=0)
-          '';
+          services.nfs.server.exports = {
+            "/data" = {
+              "192.168.1.0/255.255.255.0" = [
+                "rw"
+                "no_root_squash"
+                "no_subtree_check"
+                "fsid=0"
+              ];
+            };
+          };
           services.nfs.server.createMountPoints = true;
           networking.firewall.enable = false; # FIXME: figure out what ports need to be allowed
         };

From 9bca71489c8e771af94f33c1c24b0799a166f6e0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Thu, 11 Jun 2026 01:09:10 +0200
Subject: [PATCH 46/50] emmet-language-server: use pnpmBuildHook

(cherry picked from commit 1895e86a06399b28b134ef3e6705e7801077fe8d)
---
 pkgs/by-name/em/emmet-language-server/package.nix | 11 ++---------
 1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/em/emmet-language-server/package.nix b/pkgs/by-name/em/emmet-language-server/package.nix
index 98573d93e361..e0355d68f2e4 100644
--- a/pkgs/by-name/em/emmet-language-server/package.nix
+++ b/pkgs/by-name/em/emmet-language-server/package.nix
@@ -5,6 +5,7 @@
   pnpm_9,
   fetchPnpmDeps,
   pnpmConfigHook,
+  pnpmBuildHook,
   fetchFromGitHub,
   nix-update-script,
 }:
@@ -29,18 +30,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   nativeBuildInputs = [
     nodejs
     pnpmConfigHook
+    pnpmBuildHook
     pnpm_9
   ];
 
-  buildPhase = ''
-    runHook preBuild
-
-    # TODO: use deploy after resolved https://github.com/pnpm/pnpm/issues/5315
-    pnpm build
-
-    runHook postBuild
-  '';
-
   # remove unnecessary and non-deterministic files
   preInstall = ''
     CI=true pnpm --ignore-scripts --prod prune

From d4c82d1800739704de7c07849ebe738b855219a8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Thu, 11 Jun 2026 01:14:48 +0200
Subject: [PATCH 47/50] emmet-language-server: migrate from pnpm_9 to pnpm_11

(cherry picked from commit 951614f1a7f5400aa3f8660e63c186e157316b10)
---
 pkgs/by-name/em/emmet-language-server/package.nix | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/em/emmet-language-server/package.nix b/pkgs/by-name/em/emmet-language-server/package.nix
index e0355d68f2e4..57b57c82ee7b 100644
--- a/pkgs/by-name/em/emmet-language-server/package.nix
+++ b/pkgs/by-name/em/emmet-language-server/package.nix
@@ -2,13 +2,16 @@
   lib,
   stdenvNoCC,
   nodejs,
-  pnpm_9,
+  pnpm_11,
   fetchPnpmDeps,
   pnpmConfigHook,
   pnpmBuildHook,
   fetchFromGitHub,
   nix-update-script,
 }:
+let
+  pnpm = pnpm_11;
+in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "emmet-language-server";
   version = "2.8.0";
@@ -22,16 +25,16 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
-    pnpm = pnpm_9;
-    fetcherVersion = 3;
-    hash = "sha256-livnY/iwd7gqy6SKFBMF2MSIs7LVFec4BFqMBVasGWE=";
+    inherit pnpm;
+    fetcherVersion = 4;
+    hash = "sha256-FbwciSGn/W8xQhTU2rHdYIX01wUAqcgY67za8n5AMcM=";
   };
 
   nativeBuildInputs = [
     nodejs
     pnpmConfigHook
     pnpmBuildHook
-    pnpm_9
+    pnpm
   ];
 
   # remove unnecessary and non-deterministic files

From 9e72436441fe352903ffb8808b927abfc4cef4fd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Thu, 11 Jun 2026 01:24:20 +0200
Subject: [PATCH 48/50] emmet-language-server: switch to nodejs-slim

(cherry picked from commit fa91e7ca72f9570a08b1217ce56f96ef966a9096)
---
 pkgs/by-name/em/emmet-language-server/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/em/emmet-language-server/package.nix b/pkgs/by-name/em/emmet-language-server/package.nix
index 57b57c82ee7b..cb4eb5393f93 100644
--- a/pkgs/by-name/em/emmet-language-server/package.nix
+++ b/pkgs/by-name/em/emmet-language-server/package.nix
@@ -1,7 +1,7 @@
 {
   lib,
   stdenvNoCC,
-  nodejs,
+  nodejs-slim,
   pnpm_11,
   fetchPnpmDeps,
   pnpmConfigHook,
@@ -31,7 +31,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   };
 
   nativeBuildInputs = [
-    nodejs
+    nodejs-slim
     pnpmConfigHook
     pnpmBuildHook
     pnpm

From feaebe9d26e47aa026b165d596e6d4f55f255d60 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Thu, 11 Jun 2026 01:33:51 +0200
Subject: [PATCH 49/50] emmet-language-server: add smoke test

This was taken from vtsls.

(cherry picked from commit 888551d011f058cfa314db0307fbc805e71f6214)
---
 .../em/emmet-language-server/package.nix      | 21 ++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/em/emmet-language-server/package.nix b/pkgs/by-name/em/emmet-language-server/package.nix
index cb4eb5393f93..a8cc88056844 100644
--- a/pkgs/by-name/em/emmet-language-server/package.nix
+++ b/pkgs/by-name/em/emmet-language-server/package.nix
@@ -8,6 +8,8 @@
   pnpmBuildHook,
   fetchFromGitHub,
   nix-update-script,
+  runCommand,
+  emmet-language-server,
 }:
 let
   pnpm = pnpm_11;
@@ -60,7 +62,24 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    updateScript = nix-update-script { };
+
+    tests.smoke = runCommand "emmet-language-server-smoke-test" { } ''
+      INIT_REQUEST='{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"processId":null,"rootUri":"file:///tmp","workspaceFolders":[{"uri":"file:///tmp","name":"test"}],"capabilities":{}}}'
+      CONTENT_LENGTH=''${#INIT_REQUEST}
+
+      RESPONSE=$(
+        {
+          printf "Content-Length: %d\r\n\r\n%s" "$CONTENT_LENGTH" "$INIT_REQUEST"
+          sleep 1
+        } | timeout 3  ${lib.getExe emmet-language-server} --stdio 2>&1 | head -c 1000
+      ) || true
+
+      echo "$RESPONSE" | grep -q '"capabilities"'
+      touch $out
+    '';
+  };
 
   meta = {
     description = "Language server for emmet.io";

From 4b9584ca2317dabe7d4599eb671bd4d329e6cee1 Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Sat, 11 Jul 2026 13:36:53 -0400
Subject: [PATCH 50/50] workflows/{check,lint}: prevent git timeouts

(cherry picked from commit 1402b5012c2870f01b43b3a8a279eebeb001d857)
---
 .github/workflows/check.yml | 4 ++--
 .github/workflows/lint.yml  | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 0965864220c6..da635f56c3c1 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -92,8 +92,8 @@ jobs:
     if: inputs.baseBranch && inputs.headBranch
     permissions:
       pull-requests: write
-    runs-on: ubuntu-slim
-    timeout-minutes: 3
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 8
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 3b743fe2e53a..b68b8738f13f 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -131,8 +131,8 @@ jobs:
     # Luckily there's no need to lint commit messages in the Merge Queue, because
     # changes to the target branch can't change commit messages on the base branch.
     if: ${{ github.event.pull_request.number }}
-    runs-on: ubuntu-slim
-    timeout-minutes: 5
+    runs-on: ubuntu-24.04-arm
+    timeout-minutes: 8
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with: