From accb9be43e223016454ba7753d207c3b37397430 Mon Sep 17 00:00:00 2001
From: Johan Herland <johan@herland.net>
Date: Fri, 17 Jul 2026 12:51:05 +0000
Subject: [PATCH 01/53] porting-advisor-for-graviton: init at 1.1.1

Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .../porting-advisor-for-graviton/package.nix  | 69 +++++++++++++++++++
 1 file changed, 69 insertions(+)
 create mode 100644 pkgs/by-name/po/porting-advisor-for-graviton/package.nix

diff --git a/pkgs/by-name/po/porting-advisor-for-graviton/package.nix b/pkgs/by-name/po/porting-advisor-for-graviton/package.nix
new file mode 100644
index 000000000000..8d93548d55d2
--- /dev/null
+++ b/pkgs/by-name/po/porting-advisor-for-graviton/package.nix
@@ -0,0 +1,69 @@
+{
+  lib,
+  fetchFromGitHub,
+  python3,
+  versionCheckHook,
+}:
+
+let
+  inherit (python3.pkgs)
+    buildPythonApplication
+    jinja2
+    packaging
+    progressbar33
+    xlsxwriter
+    ;
+in
+buildPythonApplication (finalAttrs: {
+  pname = "porting-advisor-for-graviton";
+  version = "1.1.1";
+  format = "other"; # Only has a requirements.txt
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "aws";
+    repo = "porting-advisor-for-graviton";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-73XZXy9hCRFGHGAxjThLE5mAptQZpr1G/t1v2Fx3Bpg=";
+  };
+
+  dependencies = [
+    jinja2
+    packaging
+    progressbar33
+    xlsxwriter
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+    cp src/porting-advisor.py $out/bin/porting-advisor-graviton
+    chmod +x $out/bin/porting-advisor-graviton
+
+    # Install the advisor Python package
+    mkdir -p $out/${python3.sitePackages}
+    cp -r src/advisor $out/${python3.sitePackages}/
+
+    runHook postInstall
+  '';
+
+  # This automatically wraps Python programs with the right environment
+  postFixup = ''
+    wrapPythonPrograms
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  meta = {
+    description = "AWS Porting Advisor for Graviton helps customers assess and prepare their applications for migration to AWS Graviton processors";
+    homepage = "https://github.com/aws/porting-advisor-for-graviton";
+    changelog = "https://github.com/aws/porting-advisor-for-graviton/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ jherland ];
+    mainProgram = "porting-advisor-graviton";
+    platforms = lib.platforms.linux;
+  };
+})

From 4435c085fafbe09091f62f8b95d4b1883c1dfab6 Mon Sep 17 00:00:00 2001
From: Johan Herland <johan@herland.net>
Date: Tue, 2 Jun 2026 08:56:54 +0000
Subject: [PATCH 02/53] python3Packages.rapidyaml: init at 0.15.2

Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .../python-modules/rapidyaml/default.nix      | 60 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 62 insertions(+)
 create mode 100644 pkgs/development/python-modules/rapidyaml/default.nix

diff --git a/pkgs/development/python-modules/rapidyaml/default.nix b/pkgs/development/python-modules/rapidyaml/default.nix
new file mode 100644
index 000000000000..1992b336ce7e
--- /dev/null
+++ b/pkgs/development/python-modules/rapidyaml/default.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  swig,
+  cmake-build-extension,
+  setuptools,
+  setuptools-git,
+  setuptools-scm,
+  deprecation,
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "rapidyaml";
+  version = "0.15.2";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "biojppm";
+    repo = "rapidyaml-python";
+    fetchSubmodules = true;
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-lTLVcB6LJKY2gIg2l8/B/hrl0Cu2Ia5d/I1z6jyZ2KM=";
+  };
+
+  build-system = [
+    setuptools
+    cmake-build-extension
+    setuptools-scm
+    setuptools-git
+    swig
+  ];
+
+  postPatch = ''
+    # pyproject.toml lists "swig" as a Python build requirement (for PyPI installs),
+    # but in Nix swig is a system binary on PATH, not a Python package. Remove it so
+    # pypa/build's dependency check doesn't fail when using --no-isolation.
+    substituteInPlace pyproject.toml \
+      --replace-fail '"swig"' ""
+  '';
+
+  # cmake-build-extension drives the CMake configure step
+  dontUseCmakeConfigure = true;
+
+  dependencies = [ deprecation ];
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  pythonImportsCheck = [ "ryml" ];
+
+  meta = {
+    description = "Parse and emit YAML, and do it fast. Python wrapper for the C++ library";
+    homepage = "https://github.com/biojppm/rapidyaml-python";
+    changelog = "https://github.com/biojppm/rapidyaml-python/blob/master/changelog/${finalAttrs.version}.md";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jherland ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index a48c1f552066..14e45fe16238 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -17380,6 +17380,8 @@ self: super: with self; {
 
   rapidocr-onnxruntime = callPackage ../development/python-modules/rapidocr-onnxruntime { };
 
+  rapidyaml = callPackage ../development/python-modules/rapidyaml { };
+
   rapt-ble = callPackage ../development/python-modules/rapt-ble { };
 
   rarfile = callPackage ../development/python-modules/rarfile { inherit (pkgs) libarchive; };

From cf2e9829e411991aa53466da2d2ab571798d3a26 Mon Sep 17 00:00:00 2001
From: Aiden Schembri <aidsch0605@outlook.com>
Date: Thu, 10 Sep 2026 18:34:29 +0200
Subject: [PATCH 03/53] nextcloud-talk-desktop: 2.2.3 -> 2.2.4, fix screenshare
 issue

---
 pkgs/by-name/ne/nextcloud-talk-desktop/package.nix | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix b/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix
index 57fe460e8d54..2912d4f85ce4 100644
--- a/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix
+++ b/pkgs/by-name/ne/nextcloud-talk-desktop/package.nix
@@ -29,14 +29,15 @@
   undmg,
   makeWrapper,
   libpulseaudio,
+  pipewire,
 }:
 let
   pname = "nextcloud-talk-desktop";
-  version = "2.2.3"; # Ensure both hashes (Linux and Darwin) are updated!
+  version = "2.2.4"; # Ensure both hashes (Linux and Darwin) are updated!
 
   hashes = {
-    linux = "sha256-6YoAlMGKPeSJoXd211cufdE/XgroojH3djwaSEwlBjs=";
-    darwin = "sha256-BpyVJXyCYC1qH4ecDobHBVLLTeVDx/MPWBsnXgrnKhE=";
+    linux = "sha256-veIuQqxLxhvJuezJ1dL0+ranMrf9p3YEJ2hFhzuZj0I=";
+    darwin = "sha256-YLD4adfWlRRndQMjSXxERK1aCjLUVq0YoV9bJyu+0BA=";
   };
 
   # Only x86_64-linux is supported with Darwin support being universal
@@ -113,6 +114,9 @@ let
 
       # Fixes input/output audio device selection
       libpulseaudio
+
+      # Electron dynamically loads PipeWire for Wayland screen sharing.
+      pipewire
     ];
 
     desktopItems = [

From e1b0c4dfc58d4a208d3c00de97f56d0edbf8dbe1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jos=C3=A9=20Luis=20Lafuente?= <jl@lafuente.dev>
Date: Tue, 23 Jun 2026 12:48:12 +0200
Subject: [PATCH 04/53] civetweb: Add configurable build flags

---
 pkgs/by-name/ci/civetweb/package.nix | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ci/civetweb/package.nix b/pkgs/by-name/ci/civetweb/package.nix
index 13c996fddcbf..977cf226ccab 100644
--- a/pkgs/by-name/ci/civetweb/package.nix
+++ b/pkgs/by-name/ci/civetweb/package.nix
@@ -4,6 +4,11 @@
   fetchFromGitHub,
   fetchpatch,
   cmake,
+  zlib,
+
+  withZlib ? false,
+  withUnixSockets ? false,
+  withWebSockets ? false,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -32,11 +37,14 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   strictDeps = true;
+  __structuredAttrs = true;
 
   nativeBuildInputs = [
     cmake
   ];
 
+  buildInputs = lib.optional withZlib zlib;
+
   # The existence of the "build" script causes `mkdir -p build` to fail:
   #   mkdir: cannot create directory 'build': File exists
   preConfigure = ''
@@ -60,12 +68,22 @@ stdenv.mkDerivation (finalAttrs: {
 
     # Workaround CMake 4 compat
     (lib.cmakeFeature "CMAKE_POLICY_VERSION_MINIMUM" "3.5")
-  ];
+
+    (lib.cmakeBool "CIVETWEB_ENABLE_WEBSOCKETS" withWebSockets)
+
+    (lib.cmakeBool "CIVETWEB_ENABLE_ZLIB" withZlib)
+  ]
+
+  # Support for listening for HTTP requests on a Unix domain socket.
+  ++ lib.optional withUnixSockets "-DCMAKE_C_FLAGS=-DUSE_X_DOM_SOCKET";
+  # NOTE Once 1.17 is released, we can use a CMake flag:
+  # (lib.cmakeBool "CIVETWEB_ENABLE_X_DOM_SOCKET" withUnixSockets)
 
   meta = {
     description = "Embedded C/C++ web server";
     mainProgram = "civetweb";
     homepage = "https://github.com/civetweb/civetweb";
     license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jlesquembre ];
   };
 })

From c6211eb66e6cfd9729052068ef3f9b11612b1c38 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jos=C3=A9=20Luis=20Lafuente?= <jl@lafuente.dev>
Date: Thu, 10 Sep 2026 18:10:27 +0100
Subject: [PATCH 05/53] civetweb: use versionCheckHook at installCheckPhase

---
 pkgs/by-name/ci/civetweb/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/ci/civetweb/package.nix b/pkgs/by-name/ci/civetweb/package.nix
index 977cf226ccab..92957e569bd2 100644
--- a/pkgs/by-name/ci/civetweb/package.nix
+++ b/pkgs/by-name/ci/civetweb/package.nix
@@ -5,6 +5,7 @@
   fetchpatch,
   cmake,
   zlib,
+  versionCheckHook,
 
   withZlib ? false,
   withUnixSockets ? false,
@@ -39,6 +40,10 @@ stdenv.mkDerivation (finalAttrs: {
   strictDeps = true;
   __structuredAttrs = true;
 
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "-I";
+
   nativeBuildInputs = [
     cmake
   ];

From 410f5906b6f177f5e601d8801dbdc020536d9184 Mon Sep 17 00:00:00 2001
From: h7x4 <h7x4@nani.wtf>
Date: Mon, 14 Sep 2026 12:54:47 +0900
Subject: [PATCH 06/53] nixos/tests/docuum: init

---
 nixos/tests/all-tests.nix          |  1 +
 nixos/tests/docuum.nix             | 58 ++++++++++++++++++++++++++++++
 pkgs/by-name/do/docuum/package.nix |  6 +++-
 3 files changed, 64 insertions(+), 1 deletion(-)
 create mode 100644 nixos/tests/docuum.nix

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index f62042715f11..faa33fd59523 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -571,6 +571,7 @@ in
   documize = runTest ./documize.nix;
   docuseal-psql = runTest ./docuseal-postgres.nix;
   docuseal-sqlite = runTest ./docuseal-sqlite.nix;
+  docuum = runTestOn [ "x86_64-linux" "aarch64-linux" ] ./docuum.nix;
   doh-proxy-rust = runTest ./doh-proxy-rust.nix;
   dokuwiki = runTest ./dokuwiki.nix;
   dolibarr = runTest ./dolibarr.nix;
diff --git a/nixos/tests/docuum.nix b/nixos/tests/docuum.nix
new file mode 100644
index 000000000000..562bb9967701
--- /dev/null
+++ b/nixos/tests/docuum.nix
@@ -0,0 +1,58 @@
+{ pkgs, lib, ... }:
+{
+  name = "docuum";
+  meta.maintainers = [ lib.maintainers.h7x4 ];
+
+  containers.machine = {
+    virtualisation.docker.enable = true;
+
+    services.docuum = {
+      enable = true;
+      threshold = "5 MB";
+      keep = [ "^keep-me:" ];
+    };
+  };
+
+  testScript =
+    let
+      # Each image is 2 MB, so the third non-exempt image should be evicted.
+      imageSizeKb = 2 * 1024;
+
+      mkTestImage =
+        name:
+        pkgs.dockerTools.buildImage {
+          inherit name;
+          tag = "test";
+          copyToRoot = pkgs.runCommand "docuum-test-data-${name}" { } ''
+            mkdir -p $out
+            echo "${name}" > $out/name
+            dd if=/dev/zero of=$out/data bs=1024 count=${toString imageSizeKb}
+          '';
+        };
+
+      images = {
+        keepMe = mkTestImage "keep-me";
+        old = mkTestImage "old-image";
+        new = mkTestImage "new-image";
+      };
+    in
+    ''
+      start_all()
+
+      machine.wait_for_unit("docker.service")
+      machine.wait_for_unit("docuum.service")
+      machine.wait_until_succeeds("journalctl -u docuum --grep 'Listening for Docker events'")
+
+      machine.succeed(
+          "docker load < ${images.keepMe}",
+          "docker load < ${images.old}",
+          "docker load < ${images.new}",
+      )
+
+      machine.wait_until_fails("docker image inspect old-image:test")
+      machine.succeed(
+          "docker image inspect keep-me:test",
+          "docker image inspect new-image:test",
+      )
+    '';
+}
diff --git a/pkgs/by-name/do/docuum/package.nix b/pkgs/by-name/do/docuum/package.nix
index d6d61d9c1c14..c63ac2a2b4f2 100644
--- a/pkgs/by-name/do/docuum/package.nix
+++ b/pkgs/by-name/do/docuum/package.nix
@@ -4,6 +4,7 @@
   fetchFromGitHub,
   nix-update-script,
   versionCheckHook,
+  nixosTests,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
@@ -28,7 +29,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
   nativeInstallCheckInputs = [ versionCheckHook ];
   versionCheckProgramArg = "--version";
 
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    updateScript = nix-update-script { };
+    tests.nixos = nixosTests.docuum;
+  };
 
   meta = {
     description = "Least recently used (LRU) eviction of Docker images";

From 58c584a01eaa7bfd2b077754cb19ce3b643ea12e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 15 Sep 2026 15:53:06 +0000
Subject: [PATCH 07/53] python3Packages.tesla-fleet-api: 1.12.1 -> 1.13.0

---
 pkgs/development/python-modules/tesla-fleet-api/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tesla-fleet-api/default.nix b/pkgs/development/python-modules/tesla-fleet-api/default.nix
index bc70cc5d0ba4..d68382f29266 100644
--- a/pkgs/development/python-modules/tesla-fleet-api/default.nix
+++ b/pkgs/development/python-modules/tesla-fleet-api/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "tesla-fleet-api";
-  version = "1.12.1";
+  version = "1.13.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Teslemetry";
     repo = "python-tesla-fleet-api";
     tag = "v${version}";
-    hash = "sha256-w/yEfAM2NRxg5yXXPxuudAY1qRSZDgRX+GirIgMi3gY=";
+    hash = "sha256-MMbn/qjy9B5qDF1w1ckT06vz9GeU1Gy+NitnHl7uPk4=";
   };
 
   build-system = [ setuptools ];

From cb436d0761575deeaea87148b5d6cda99aadf5b4 Mon Sep 17 00:00:00 2001
From: rorosen <robert.rose@mailbox.org>
Date: Tue, 15 Sep 2026 22:51:51 +0200
Subject: [PATCH 08/53] k3s_1_37: init at 1.37.0+k3s1

https://github.com/k3s-io/k3s/releases/tag/v1.37.0%2Bk3s1
---
 .../cluster/k3s/1_37/chart-versions.nix       | 10 +++++++
 .../cluster/k3s/1_37/images-versions.json     | 26 +++++++++++++++++++
 .../networking/cluster/k3s/1_37/versions.nix  | 21 +++++++++++++++
 .../networking/cluster/k3s/default.nix        |  1 +
 pkgs/top-level/all-packages.nix               |  1 +
 5 files changed, 59 insertions(+)
 create mode 100644 pkgs/applications/networking/cluster/k3s/1_37/chart-versions.nix
 create mode 100644 pkgs/applications/networking/cluster/k3s/1_37/images-versions.json
 create mode 100644 pkgs/applications/networking/cluster/k3s/1_37/versions.nix

diff --git a/pkgs/applications/networking/cluster/k3s/1_37/chart-versions.nix b/pkgs/applications/networking/cluster/k3s/1_37/chart-versions.nix
new file mode 100644
index 000000000000..6c42c59cb24f
--- /dev/null
+++ b/pkgs/applications/networking/cluster/k3s/1_37/chart-versions.nix
@@ -0,0 +1,10 @@
+{
+  traefik-crd = {
+    url = "https://k3s.io/k3s-charts/assets/traefik-crd/traefik-crd-41.4.2+up41.4.0.tgz";
+    sha256 = "0dfvh65gilw4z3cyia8gq0hqgcp09cbdihq6g6n93af9lbpwysnf";
+  };
+  traefik = {
+    url = "https://k3s.io/k3s-charts/assets/traefik/traefik-41.4.2+up41.4.0.tgz";
+    sha256 = "1379f54pci4y41szpnw016wr6kkawyyr6sfzijdsz3f8fryhp3xp";
+  };
+}
diff --git a/pkgs/applications/networking/cluster/k3s/1_37/images-versions.json b/pkgs/applications/networking/cluster/k3s/1_37/images-versions.json
new file mode 100644
index 000000000000..bd3e07168bd3
--- /dev/null
+++ b/pkgs/applications/networking/cluster/k3s/1_37/images-versions.json
@@ -0,0 +1,26 @@
+{
+  "airgap-images-amd64-tar-gz": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.37.0%2Bk3s1/k3s-airgap-images-amd64.tar.gz",
+    "sha256": "936f0ef6acaacb1950367308fbbe0388244df2ffc2a80cbd99e1f01ddde413e7"
+  },
+  "airgap-images-amd64-tar-zst": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.37.0%2Bk3s1/k3s-airgap-images-amd64.tar.zst",
+    "sha256": "0b4ff0d6e233de54be4e16cb5aa298fd53ad88f66ad8ae31093b5ef4dcefcdd0"
+  },
+  "airgap-images-arm-tar-gz": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.37.0%2Bk3s1/k3s-airgap-images-arm.tar.gz",
+    "sha256": "b7d9f8e94a28d0f70b8b9d6782f3d3190fe94b0b19fca4554e41ad3dbdee1f3f"
+  },
+  "airgap-images-arm-tar-zst": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.37.0%2Bk3s1/k3s-airgap-images-arm.tar.zst",
+    "sha256": "be1628b6beb17937140171374beed94e550a9c3c8ea98eec23ae6f21ca8493f1"
+  },
+  "airgap-images-arm64-tar-gz": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.37.0%2Bk3s1/k3s-airgap-images-arm64.tar.gz",
+    "sha256": "d1b534c7b5b67e06fdea2231813b3adc596ba36d7a63699fec1eb23e3c0baf17"
+  },
+  "airgap-images-arm64-tar-zst": {
+    "url": "https://github.com/k3s-io/k3s/releases/download/v1.37.0%2Bk3s1/k3s-airgap-images-arm64.tar.zst",
+    "sha256": "b3bd28d3a20144927b25ebb1d255a16ce55bb050b9af5e63abd1bf91c0838fe5"
+  }
+}
diff --git a/pkgs/applications/networking/cluster/k3s/1_37/versions.nix b/pkgs/applications/networking/cluster/k3s/1_37/versions.nix
new file mode 100644
index 000000000000..c75fcb9cceba
--- /dev/null
+++ b/pkgs/applications/networking/cluster/k3s/1_37/versions.nix
@@ -0,0 +1,21 @@
+{
+  k3sVersion = "1.37.0+k3s1";
+  k3sCommit = "bb7cf0657bafdfbb4349d1740810442d09c2248a";
+  k3sRepoSha256 = "0glzg974w7f0jdaljr9bxw36qv53chii25rjbrvlbzlyzjq19wws";
+  k3sVendorHash = "sha256-AObmRWcIyFDy1aTA66LLFYnnUQzpf6+Ts6HQRA3i26A=";
+  chartVersions = import ./chart-versions.nix;
+  imagesVersions = builtins.fromJSON (builtins.readFile ./images-versions.json);
+  k3sRootVersion = "0.15.2";
+  k3sRootSha256 = "0yxq2jqqb7flm4rs9dl7fqxba3mmwkmjbc8rx7pgai4qa1lzyigy";
+  k3sCNIVersion = "1.9.1-k3s1";
+  k3sCNISha256 = "1ggaz0p1c2k94car9d89a05smz3zx32sxn197b1l5kmjcnzdwadh";
+  containerdVersion = "2.3.4-k3s1";
+  containerdSha256 = "18kci7drnlxkn4vk166jijavgwaml1vhlfqirhzljmb4g16ydrah";
+  containerdPackage = "github.com/k3s-io/containerd/v2";
+  criCtlVersion = "1.37.0-k3s1";
+  flannelVersion = "v0.28.4";
+  flannelPluginVersion = "v1.9.0-flannel1";
+  kubeRouterVersion = "v2.6.3-k3s1";
+  criDockerdVersion = "v0.3.19-k3s5";
+  helmJobVersion = "v0.13.3-build20260727";
+}
diff --git a/pkgs/applications/networking/cluster/k3s/default.nix b/pkgs/applications/networking/cluster/k3s/default.nix
index 9b8933ef3e99..ea201b770d30 100644
--- a/pkgs/applications/networking/cluster/k3s/default.nix
+++ b/pkgs/applications/networking/cluster/k3s/default.nix
@@ -15,4 +15,5 @@ in
   k3s_1_34 = forVersions ./1_34/versions.nix;
   k3s_1_35 = forVersions ./1_35/versions.nix;
   k3s_1_36 = forVersions ./1_36/versions.nix;
+  k3s_1_37 = forVersions ./1_37/versions.nix;
 }
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index ac01df0d1580..83a030c1f6c4 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8763,6 +8763,7 @@ with pkgs;
     k3s_1_34
     k3s_1_35
     k3s_1_36
+    k3s_1_37
     ;
   k3s = k3s_1_35;
 

From debd9e764e527a3bd3c3b3fa61759f862f201fb3 Mon Sep 17 00:00:00 2001
From: rorosen <robert.rose@mailbox.org>
Date: Tue, 15 Sep 2026 23:57:59 +0200
Subject: [PATCH 09/53] k3s: k3s_1_35 -> k3s_1_36

Stable version according to https://update.k3s.io/v1-release/channels
---
 pkgs/top-level/all-packages.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 83a030c1f6c4..1638208d76ab 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -8765,7 +8765,7 @@ with pkgs;
     k3s_1_36
     k3s_1_37
     ;
-  k3s = k3s_1_35;
+  k3s = k3s_1_36;
 
   kotatogram-desktop =
     callPackage ../applications/networking/instant-messengers/telegram/kotatogram-desktop

From e8e8643b0b0aca87db3d24b2da4bc6e9fbe3bdb9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Domen=20Ko=C5=BEar?= <domen@cachix.org>
Date: Tue, 15 Sep 2026 18:50:03 -0500
Subject: [PATCH 10/53] fetchCargoVendor: narrow the bootstrap Python override

Override charset-normalizer only through requests instead of creating a
separate Python package scope. This preserves the Cargo vendoring bootstrap
cycle break while allowing other Python dependencies to reuse their scope.

Paired evaluation samples reduce prek CPU time by about 20% and a two-hook
git-hooks/prek configuration by about 12%, with unchanged derivation paths
for the tested packages on Linux and aarch64-darwin.

Assisted-by: OpenAI Codex (GPT-6)
---
 pkgs/build-support/rust/fetch-cargo-vendor.nix | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/pkgs/build-support/rust/fetch-cargo-vendor.nix b/pkgs/build-support/rust/fetch-cargo-vendor.nix
index 37a37f7b7bd2..94fd3815e132 100644
--- a/pkgs/build-support/rust/fetch-cargo-vendor.nix
+++ b/pkgs/build-support/rust/fetch-cargo-vendor.nix
@@ -11,15 +11,13 @@
 }:
 
 let
-  python = python3.override {
-    self = python;
-    packageOverrides = final: prev: {
-      # The ast-serialize package, a dependency for mypy, depends on
-      # fetchCargoVendor and is part of the bootstrap chain for requests.
-      charset-normalizer = prev.charset-normalizer.override { withMypyc = false; };
+  python3Packages = python3.pkgs // {
+    # Break the requests -> charset-normalizer -> mypy -> ast-serialize ->
+    # fetchCargoVendor bootstrap cycle without overriding the whole Python scope.
+    requests = python3.pkgs.requests.override {
+      charset-normalizer = python3.pkgs.charset-normalizer.override { withMypyc = false; };
     };
   };
-  python3Packages = python.pkgs;
 
   replaceWorkspaceValues = writers.writePython3Bin "replace-workspace-values" {
     libraries = with python3Packages; [

From 232ad9f61696edf7c962744ca52c55940c041cba Mon Sep 17 00:00:00 2001
From: Johan Herland <johan.herland@tweag.io>
Date: Fri, 17 Jul 2026 10:09:46 +0200
Subject: [PATCH 11/53] python.mosek: init at 11.2.2

Assisted-by: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .../python-modules/mosek/default.nix          | 90 +++++++++++++++++++
 pkgs/top-level/python-packages.nix            |  2 +
 2 files changed, 92 insertions(+)
 create mode 100644 pkgs/development/python-modules/mosek/default.nix

diff --git a/pkgs/development/python-modules/mosek/default.nix b/pkgs/development/python-modules/mosek/default.nix
new file mode 100644
index 000000000000..e8d2cb3c9887
--- /dev/null
+++ b/pkgs/development/python-modules/mosek/default.nix
@@ -0,0 +1,90 @@
+{
+  autoPatchelfHook,
+  buildPythonPackage,
+  fetchurl,
+  lib,
+  numpy,
+  onetbb,
+  python,
+  pythonOlder,
+  setuptools,
+  stdenv,
+}:
+
+buildPythonPackage (
+  finalAttrs:
+  let
+    mosek-major-minor = lib.versions.majorMinor finalAttrs.version;
+    python-major-version = python.sourceVersion.major;
+
+    mosek-libs = stdenv.mkDerivation {
+      pname = "mosek-libs";
+      inherit (finalAttrs) version src;
+      nativeBuildInputs = [
+        onetbb
+        autoPatchelfHook
+      ];
+
+      # Copy the vendor mosek library, which will optionally use a tbb that
+      # is located next to it. We should use our own packaged one, even though
+      # that is 2021.11.0 (libtbb.so.12.11) instead of the packaged 2021.12.0 (libtbb.so.12.12).
+      # The packaged tbb would need to be patchelfed to find libstdc++ and would lead
+      # with clashes with other code using the nix based tbb, used in rtech for example.
+      installPhase = ''
+        mkdir -p $out/lib
+        cp ${mosek-major-minor}/tools/platform/linux64x86/bin/libmosek64.so.${mosek-major-minor} $out/lib/
+        ln -snf ${onetbb}/lib/libtbb.so.12 $out/lib/libtbb.so.12
+      '';
+    };
+  in
+  {
+    pname = "mosek";
+    version = "11.2.2";
+    pyproject = true;
+    build-system = [ setuptools ];
+
+    # MOSEK ships pre-built C extensions; minimum supported Python is 3.9
+    disabled = pythonOlder "3.9";
+
+    src = fetchurl {
+      url = "https://download.mosek.com/stable/${finalAttrs.version}/mosektoolslinux64x86.tar.bz2";
+      sha256 = "sha256-DVSZ+8ggmK7EyiaHYCUjxQ/3mY5GcUlgXVRfReiBkiw=";
+    };
+
+    # Move the source we want to the root
+    prePatch = ''
+      mv ${mosek-major-minor}/tools/platform/linux64x86/python/${python-major-version}/* .
+    '';
+
+    # Disable part of setup.py that 'fixes' library paths based on installation
+    # location (which it gets wrong for a Nix build). Rely on autoPatchelfHook
+    # instead. Also disable installation of _mskpreload.py, which tries to preload
+    # dependent libraries and again gets the location wrong, and seems dangerous
+    # anyway.
+    postPatch = ''
+      sed -i -e 's/^\(\s*\)#\?\(self.execute(self.install_\(libs\|preloader\),\)/\1#\2/' setup.py
+    '';
+
+    nativeBuildInputs = [
+      autoPatchelfHook
+    ];
+
+    propagatedBuildInputs = [
+      mosek-libs
+      numpy
+    ];
+
+    # No tests are supplied
+    doCheck = false;
+
+    pythonImportsCheck = [ "mosek" ];
+
+    meta = with lib; {
+      description = "Python interface for MOSEK - the package for large scale convex, conic and mixed-integer optimization.";
+      homepage = "https://www.mosek.com/";
+      changelog = "https://docs.mosek.com/${mosek-major-minor}/releasenotes/changes.html";
+      license = licenses.unfree;
+      maintainers = with maintainers; [ jherland ];
+    };
+  }
+)
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index c0bfde2d0bc2..f81afdaacc2d 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -11199,6 +11199,8 @@ self: super: with self; {
 
   mortgage = callPackage ../development/python-modules/mortgage { };
 
+  mosek = callPackage ../development/python-modules/mosek { };
+
   motionblinds = callPackage ../development/python-modules/motionblinds { };
 
   motionblindsble = callPackage ../development/python-modules/motionblindsble { };

From 71e8a8d49854391f0980bf4b5a74cb71847a7b8d Mon Sep 17 00:00:00 2001
From: Johannes Kirschbauer <hsjobeki@gmail.com>
Date: Thu, 16 Jul 2026 19:30:50 +0200
Subject: [PATCH 12/53] pkgs/nixos-render-docs: add 'nixdoc' collection to nav

the manuals needs a way to place generated pages that have no markdown
file behind them.

This pr adds a new nav entry of the shape: '{ collection, type }'

'type' selects the renderer, so other generated data such as options
can follow later.

Assisted-by: opus-4-8
---
 .../src/nixos_render_docs/manual.py           |  74 ++++++--
 .../src/nixos_render_docs/nixdoc.py           | 179 ++++++++++++++++++
 .../src/tests/test_manual.py                  | 112 +++++++++++
 .../src/tests/test_nixdoc.py                  | 165 ++++++++++++++++
 4 files changed, 519 insertions(+), 11 deletions(-)
 create mode 100644 pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/nixdoc.py
 create mode 100644 pkgs/by-name/ni/nixos-render-docs/src/tests/test_nixdoc.py

diff --git a/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py b/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py
index 9b8d419f2920..0f6d3dabf42b 100644
--- a/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py
+++ b/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/manual.py
@@ -11,7 +11,7 @@ from typing import Any, Callable, ClassVar, Generic, NamedTuple, cast, get_args
 
 from markdown_it.token import Token
 
-from . import md, options
+from . import md, nixdoc, options
 from .html import HTMLRenderer, UnresolvedXrefError
 from .manual_structure import (
     FragmentType,
@@ -637,7 +637,16 @@ class ConfigGroup:
     # id-prefix can only be set on a group, matching the legacy "includes" behavior
     id_prefix: str | None = None
 
-ConfigNode = ConfigLeaf | ConfigGroup
+# a collection expands to one page per group found in a generated data file.
+# 'nixdoc' renders a nixdoc manifest-mode export, other types may follow.
+COLLECTION_TYPES = ('nixdoc',)
+
+@dataclass
+class ConfigCollection:
+    collection: str
+    type: str
+
+ConfigNode = ConfigLeaf | ConfigGroup | ConfigCollection
 
 @dataclass
 class ConfigManifest:
@@ -720,12 +729,26 @@ class HTMLConverter(BaseConverter[ManualHTMLRenderer]):
         id_prefix = item.get('id-prefix')
         if id_prefix is not None and (not isinstance(id_prefix, str)):
             raise SrcError(src=src, description=f"{where}: 'id-prefix' must be a string when being set")
-        has_file, has_children = 'file' in item, 'children' in item
-        if has_file == has_children:
+        kinds = [k for k in ('file', 'children', 'collection') if k in item]
+        if len(kinds) != 1:
             raise SrcError(
                 src=src,
-                description=f"{where}: must have exactly one of 'file' or 'children'")
-        if has_file:
+                description=f"{where}: must have exactly one of 'file', 'children' or 'collection'")
+        if kinds[0] == 'collection':
+            if not isinstance(item['collection'], str):
+                raise SrcError(src=src, description=f"{where}: 'collection' must be a string")
+            typ = item.get('type')
+            if typ not in COLLECTION_TYPES:
+                raise SrcError(
+                    src=src,
+                    description=f"{where}: 'type' must be one of {list(COLLECTION_TYPES)}, got {typ!r}")
+            # a collection expands to many pages, so a single label or prefix cannot apply
+            if label is not None or id_prefix is not None:
+                raise SrcError(
+                    src=src,
+                    description=f"{where}: a collection accepts neither 'label' nor 'id-prefix'")
+            return ConfigCollection(collection=item['collection'], type=typ)
+        if kinds[0] == 'file':
             if not isinstance(item['file'], str):
                 raise SrcError(src=src, description=f"{where}: 'file' must be a string")
             return ConfigLeaf(file=item['file'], label=label, id_prefix=id_prefix)
@@ -750,13 +773,20 @@ class HTMLConverter(BaseConverter[ManualHTMLRenderer]):
         tokens[6:6] = [include]
 
     def _build_config_include(self, nodes: list[ConfigNode], config_file: Path, id_prefix: str | None = None) -> Token:
-        included = [self._build_config_item(node, config_file, id_prefix) for node in nodes]
+        included: list[tuple[list[Token], Path]] = []
+        for node in nodes:
+            included += self._build_config_item(node, config_file, id_prefix)
         token = Token('included_page', '', 0, map=[0, 1])
         token.meta['included'] = included
         token.meta['include-args'] = {}
         return token
 
-    def _build_config_item(self, node: ConfigNode, config_file: Path, id_prefix: str | None = None) -> tuple[list[Token], Path]:
+    # one node may expand to several pages, so this returns a list of fragments
+    def _build_config_item(self, node: ConfigNode, config_file: Path,
+                           id_prefix: str | None = None) -> list[tuple[list[Token], Path]]:
+        if isinstance(node, ConfigCollection):
+            return self._build_config_collection(node, config_file)
+
         if isinstance(node, ConfigLeaf):
             path = (config_file.parent / node.file).resolve()
             leaf_src = path.read_text()
@@ -772,7 +802,7 @@ class HTMLConverter(BaseConverter[ManualHTMLRenderer]):
                 self._base_paths.pop()
             if node.label is not None:
                 fragment[1].meta['toc-label'] = node.label
-            return fragment, path
+            return [(fragment, path)]
 
         # TocEntry._collect_entries reads nav-label and nav-id.
         # it builds the sidebar group from them.
@@ -785,7 +815,25 @@ class HTMLConverter(BaseConverter[ManualHTMLRenderer]):
         if node.id is not None:
             group.meta['nav-id'] = node.id
 
-        return [group], config_file
+        return [([group], config_file)]
+
+    def _build_config_collection(self, node: ConfigCollection,
+                                 config_file: Path) -> list[tuple[list[Token], Path]]:
+        path = (config_file.parent / node.collection).resolve()
+        try:
+            assert node.type == 'nixdoc', f"unhandled collection type {node.type!r}"
+            sections = nixdoc.render_sections(json.loads(path.read_text()), self._revision)
+        except (OSError, json.JSONDecodeError, nixdoc.NixdocExportError) as e:
+            raise RuntimeError(f"processing {node.type} collection {path}") from e
+        # the export file is the only "location" we can report errors against
+        self._base_paths.append(path)
+        self._current_type.append('page')
+        try:
+            return [(self._parse(src, auto_id_prefix=f"auto-generated-{group_id}"), path)
+                    for group_id, src in sections]
+        finally:
+            self._current_type.pop()
+            self._base_paths.pop()
 
     def _parse(self, src: str, *, auto_id_prefix: None | str = None) -> list[Token]:
         tokens = super()._parse(src,auto_id_prefix=auto_id_prefix)
@@ -975,7 +1023,11 @@ def _build_cli_html(p: argparse.ArgumentParser) -> None:
     p.add_argument('--sidebar-depth', default=2, type=int)
     p.add_argument('--experimental-config', type=Path, help="""
 JSON file of the following form
-{ items: [ { file, label? } | { label, children: [...], id? } ], open: [ id, ... ] }
+{ items: [ { file, label? } | { label, children: [...], id? } | { collection, type } ],
+  open: [ id, ... ] }
+
+A collection reads a generated data file and expands to one page per group in it.
+'type' selects the renderer; only 'nixdoc' exists so far.
 
 Files added through this flag prepend '--infile'
 
diff --git a/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/nixdoc.py b/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/nixdoc.py
new file mode 100644
index 000000000000..063fb9d40b11
--- /dev/null
+++ b/pkgs/by-name/ni/nixos-render-docs/src/nixos_render_docs/nixdoc.py
@@ -0,0 +1,179 @@
+# Render a nixdoc export v1 collection
+#
+# Takes json of v1 export schema
+# https://github.com/nix-community/nixdoc/blob/554a2e2676548f58f85d76b69308447a4e60450d/src/export.rs#L101
+#
+# Returns a commonmark flavour that nixos-render-docs can process
+#
+
+import re
+from typing import Any, NamedTuple
+
+# html anchors only allow certain anchors
+_ANCHOR_HOSTILE = re.compile(r"[^A-Za-z0-9._-]")
+
+def _anchor_id(s: str) -> str:
+    return _ANCHOR_HOSTILE.sub("", s)
+
+_SCHEMA_VERSION = 1
+
+
+class NixdocExportError(Exception):
+    pass
+
+class Source(NamedTuple):
+    file: str
+    line: int
+
+
+class Group(NamedTuple):
+    id: str
+    description: str
+
+
+class Entry(NamedTuple):
+    id: str
+    attr_path: str
+    groups: list[str]
+    description: str
+    source: Source
+
+
+class Export(NamedTuple):
+    groups: list[Group]
+    entries: list[Entry]
+
+
+def _require(obj: dict[str, Any], key: str, ctx: str) -> Any:
+    try:
+        return obj[key]
+    except (KeyError, TypeError) as e:
+        raise NixdocExportError(f"{ctx}: missing required field {key!r}") from e
+
+
+def _parse_group(raw: dict[str, Any]) -> Group:
+    group_id = _require(raw, "id", "group")
+    return Group(id=group_id, description=(raw.get("description") or "").strip())
+
+
+def _parse_entry(raw: dict[str, Any]) -> Entry:
+    entry_id = _require(raw, "id", "entry")
+    ctx = f"entry {entry_id!r}"
+    source = _require(raw, "source", ctx)
+    return Entry(
+        id=entry_id,
+        attr_path=_require(raw, "attrPath", ctx),
+        groups=_require(raw, "groups", ctx),
+        description=_require(raw, "description", ctx),
+        source=Source(file=_require(source, "file", ctx), line=_require(source, "line", ctx)),
+    )
+
+
+def parse_export(data: dict[str, Any]) -> Export:
+    schema = data.get("schemaVersion") if isinstance(data, dict) else None
+    if schema != _SCHEMA_VERSION:
+        raise NixdocExportError(
+            f"unsupported nixdoc export schemaVersion {schema!r}; "
+            f"this renderer supports version {_SCHEMA_VERSION}"
+        )
+    return Export(
+        groups=[_parse_group(g) for g in _require(data, "groups", "export")],
+        entries=[_parse_entry(e) for e in _require(data, "entries", "export")],
+    )
+
+
+def _trim_leading_whitespace(line: str, max_count: int) -> str:
+    count = 0
+    i = 0
+    for ch in line:
+        if ch.isspace() and count < max_count:
+            count += 1
+            i += 1
+        else:
+            break
+    return line[i:]
+
+
+def _get_fence(line: str, allow_info: bool) -> tuple[int, str] | None:
+    if not line:
+        return None
+    first = line[0]
+    if first not in ('`', '~'):
+        return None
+    count = 1
+    for ch in line[1:]:
+        if ch == first:
+            count += 1
+        else:
+            if not allow_info and ch != '\n':
+                return None
+            return (count, first)
+    return (count, first)
+
+
+def _handle_heading(line: str, levels: int) -> str:
+    hashes = 0
+    for ch in line:
+        if ch == '#':
+            hashes += 1
+        else:
+            break
+    rest = line[hashes:]
+    new_hashes = min(hashes + levels, 6)
+    return f"{'#' * new_hashes}{rest}"
+
+
+def shift_headings(text: str, levels: int) -> str:
+    result: list[str] = []
+    curr_fence: tuple[int, str] | None = None
+    for raw_line in text.splitlines(keepends=True):
+        line = _trim_leading_whitespace(raw_line, 3)
+        if line.startswith("```") or line.startswith("~~~"):
+            if curr_fence is None:
+                curr_fence = _get_fence(line, True)
+            else:
+                end = _get_fence(line, False)
+                if end is not None:
+                    start_count, start_char = curr_fence
+                    end_count, end_char = end
+                    if start_char == end_char and start_count <= end_count:
+                        curr_fence = None
+
+        if curr_fence is None and line.startswith('#'):
+            result.append(_handle_heading(line, levels))
+        else:
+            result.append(raw_line)
+    return "".join(result)
+
+
+def _located_at(source: Source, revision: str) -> str:
+    url = f"https://github.com/NixOS/nixpkgs/blob/{revision}/{source.file}#L{source.line}"
+    return f"Located at [{source.file}:{source.line}]({url}) in `<nixpkgs>`."
+
+
+def render_group(group: Group, entries: list[Entry], revision: str) -> str:
+    parts = [f"# {group.id} {{#sec-functions-library-{_anchor_id(group.id)}}}\n"]
+    if group.description:
+        parts.append(shift_headings(group.description, 1) + "\n")
+
+    for entry in entries:
+        parts.append(f"## `{entry.attr_path}` {{#function-library-{_anchor_id(entry.id)}}}\n")
+        body = shift_headings(entry.description.strip(), 2)
+        if body:
+            parts.append(body + "\n")
+        parts.append(_located_at(entry.source, revision) + "\n")
+
+    return "\n".join(parts)
+
+
+def render_sections(data: dict[str, Any], revision: str) -> list[tuple[str, str]]:
+    export = parse_export(data)
+    by_group: dict[str, list[Entry]] = {group.id: [] for group in export.groups}
+    for entry in export.entries:
+        for group_id in entry.groups:
+            if group_id in by_group:
+                by_group[group_id].append(entry)
+    return [
+        (group.id, render_group(group, by_group[group.id], revision))
+        for group in export.groups
+    ]
diff --git a/pkgs/by-name/ni/nixos-render-docs/src/tests/test_manual.py b/pkgs/by-name/ni/nixos-render-docs/src/tests/test_manual.py
index bc004fc13a4e..11cea023eb72 100644
--- a/pkgs/by-name/ni/nixos-render-docs/src/tests/test_manual.py
+++ b/pkgs/by-name/ni/nixos-render-docs/src/tests/test_manual.py
@@ -518,3 +518,115 @@ def test_config_id_prefix_fails(tmp_path: Path) -> None:
             {"asserts.md": _NIXDOC_SNIPPET1},
         )
     assert "heading does not have an id" in str(excinfo.value.__cause__)
+
+
+_NIXDOC_EXPORT = {
+    "schemaVersion": 1,
+    "groups": [
+        {"id": "asserts", "description": "assertion functions"},
+        {"id": "attrsets", "description": "attribute set functions"},
+    ],
+    "entries": [
+        {
+            "id": "lib.asserts.assertMsg",
+            "attrPath": "lib.asserts.assertMsg",
+            "description": "Throw if pred is false.\n\n# Inputs\n\n`pred`\n",
+            "groups": ["asserts"],
+            "source": {"file": "lib/asserts.nix", "line": 21},
+        },
+        {
+            "id": "lib.attrsets.mapAttrs-prime",
+            "attrPath": "lib.attrsets.mapAttrs'",
+            "description": "Maps over attrs.",
+            "groups": ["attrsets"],
+            "source": {"file": "lib/attrsets.nix", "line": 42},
+        },
+    ],
+}
+
+
+def _render_with_collection(tmp_path: Path, export: object, **kwargs: object) -> str:
+    return _render_with_config(
+        tmp_path,
+        {"items": [{"collection": "lib-functions.json", "type": "nixdoc"}]},
+        {"lib-functions.json": json.dumps(export)},
+        **kwargs,  # type: ignore[arg-type]
+    )
+
+
+def test_config_collection_renders_one_page_per_group(tmp_path: Path) -> None:
+    html = _render_with_collection(tmp_path, _NIXDOC_EXPORT)
+    # groups become pages, so their headings sit at the level of a config leaf
+    assert '<h2 id="sec-functions-library-asserts" class="title"' in html
+    assert '<h2 id="sec-functions-library-attrsets" class="title"' in html
+    assert "assertion functions" in html
+    # entries nest below their group
+    assert '<h3 id="function-library-lib.asserts.assertMsg" class="title"' in html
+    assert '<h3 id="function-library-lib.attrsets.mapAttrs-prime" class="title"' in html
+    assert "lib.attrsets.mapAttrs&#x27;" in html
+
+
+def test_config_collection_keeps_group_order(tmp_path: Path) -> None:
+    html = _render_with_collection(tmp_path, _NIXDOC_EXPORT)
+    ids = [id for id in _heading_ids(html) if id.startswith("sec-functions-library-")]
+    assert ids == ["sec-functions-library-asserts", "sec-functions-library-attrsets"]
+
+
+def test_config_collection_pages_are_sidebar_siblings(tmp_path: Path) -> None:
+    html = _render_with_collection(tmp_path, _NIXDOC_EXPORT)
+    assert 'href="#sec-functions-library-asserts"' in html
+    assert 'href="#sec-functions-library-attrsets"' in html
+
+
+def test_config_collection_prefixes_generated_ids_per_group(tmp_path: Path) -> None:
+    html = _render_with_collection(tmp_path, _NIXDOC_EXPORT)
+    # '# Inputs' in the doc comment has no authored anchor, so it gets one
+    generated = [id for id in _heading_ids(html) if id.startswith("auto-generated-")]
+    assert generated and all(id.startswith("auto-generated-asserts-") for id in generated)
+
+
+def test_config_collection_links_source_to_revision(tmp_path: Path) -> None:
+    html = _render_with_collection(tmp_path, _NIXDOC_EXPORT)
+    assert 'href="https://github.com/NixOS/nixpkgs/blob/1.0.0/lib/asserts.nix#L21"' in html
+
+
+def test_config_collection_renders_before_manual(tmp_path: Path) -> None:
+    html = _render_with_collection(tmp_path, _NIXDOC_EXPORT)
+    assert html.index("assertion functions") < html.index("Manual body.")
+
+
+def test_config_collection_rejects_unknown_type(tmp_path: Path) -> None:
+    with pytest.raises(RuntimeError) as excinfo:
+        _render_with_config(
+            tmp_path,
+            {"items": [{"collection": "lib-functions.json", "type": "options"}]},
+            {"lib-functions.json": json.dumps(_NIXDOC_EXPORT)},
+        )
+    assert "'type' must be one of ['nixdoc']" in str(excinfo.value.__cause__)
+
+
+def test_config_collection_rejects_label_and_id_prefix(tmp_path: Path) -> None:
+    for extra in ({"label": "Library"}, {"id-prefix": "auto-generated"}):
+        with pytest.raises(RuntimeError) as excinfo:
+            _render_with_config(
+                tmp_path,
+                {"items": [{"collection": "lib-functions.json", "type": "nixdoc"} | extra]},
+                {"lib-functions.json": json.dumps(_NIXDOC_EXPORT)},
+            )
+        assert "neither 'label' nor 'id-prefix'" in str(excinfo.value.__cause__)
+
+
+def test_config_collection_excludes_file_and_children(tmp_path: Path) -> None:
+    with pytest.raises(RuntimeError) as excinfo:
+        _render_with_config(
+            tmp_path,
+            {"items": [{"collection": "lib-functions.json", "type": "nixdoc", "file": "x.md"}]},
+            {"x.md": "# X {#x}\n\nB.\n"},
+        )
+    assert "exactly one of 'file', 'children' or 'collection'" in str(excinfo.value.__cause__)
+
+
+def test_config_collection_rejects_unsupported_export(tmp_path: Path) -> None:
+    with pytest.raises(RuntimeError) as excinfo:
+        _render_with_collection(tmp_path, _NIXDOC_EXPORT | {"schemaVersion": 2})
+    assert "nixdoc collection" in str(excinfo.value.__cause__)
diff --git a/pkgs/by-name/ni/nixos-render-docs/src/tests/test_nixdoc.py b/pkgs/by-name/ni/nixos-render-docs/src/tests/test_nixdoc.py
new file mode 100644
index 000000000000..a4f2f3fd7446
--- /dev/null
+++ b/pkgs/by-name/ni/nixos-render-docs/src/tests/test_nixdoc.py
@@ -0,0 +1,165 @@
+import pytest
+
+from nixos_render_docs import nixdoc
+
+
+def test_shift_headings_basic() -> None:
+    assert nixdoc.shift_headings("# H1", 2) == "### H1"
+    assert nixdoc.shift_headings("## H2", 2) == "#### H2"
+
+
+def test_shift_headings_caps_at_h6() -> None:
+    assert nixdoc.shift_headings("###### H6", 2) == "###### H6"
+    assert nixdoc.shift_headings("##### H5", 2) == "###### H5"
+
+
+def test_shift_headings_preserves_multiline_and_endings() -> None:
+    src = "# One\n\nbody\n\n## Two\n"
+    assert nixdoc.shift_headings(src, 2) == "### One\n\nbody\n\n#### Two\n"
+
+
+def test_shift_headings_ignores_fenced_nix_comments() -> None:
+    src = "# Real heading\n\n```nix\n# not a heading\nfoo = 1;\n```\n"
+    out = nixdoc.shift_headings(src, 2)
+    assert out == "### Real heading\n\n```nix\n# not a heading\nfoo = 1;\n```\n"
+
+
+def test_shift_headings_tilde_fence() -> None:
+    src = "~~~\n# fenced\n~~~\n# heading\n"
+    out = nixdoc.shift_headings(src, 2)
+    assert out == "~~~\n# fenced\n~~~\n### heading\n"
+
+
+def test_shift_headings_indented_heading_shifted() -> None:
+    # up to 3 leading spaces is still a heading
+    assert nixdoc.shift_headings("   # H1", 2) == "### H1"
+
+
+def test_shift_headings_four_space_indent_not_a_heading() -> None:
+    # 4+ spaces is an indented code block, not a heading
+    assert nixdoc.shift_headings("    # code", 2) == "    # code"
+
+
+_REVISION = "abc123revision"
+
+
+def _export() -> dict[str, object]:
+    return {
+        "schemaVersion": 1,
+        "groups": [
+            {"id": "strings", "description": "string manipulation functions"},
+            {
+                "id": "fileset",
+                "description": (
+                    "[]{#sec-anchor-compat}\n\n"
+                    "Intro prose for the file set library.\n\n"
+                    "# Overview {#sec-fileset-overview}\n\n"
+                    "Some overview text.\n"
+                ),
+            },
+        ],
+        "entries": [
+            {
+                "id": "lib.attrsets.mapAttrs-prime",
+                "attrPath": "lib.attrsets.mapAttrs'",
+                "description": "Maps over attrs.\n\n# Example\n\n```nix\n# a comment\nmapAttrs' f s\n```\n",
+                "groups": ["strings"],
+                "source": {"file": "lib/attrsets.nix", "line": 42, "column": 3},
+            },
+            {
+                "id": "lib.strings.optionalString",
+                "attrPath": "lib.strings.optionalString",
+                "description": "Return a string if a condition holds.",
+                "groups": ["strings"],
+                "source": {"file": "lib/strings.nix", "line": 238, "column": 3},
+            },
+            {
+                "id": "lib.fileset.toSource",
+                "attrPath": "lib.fileset.toSource",
+                "description": "Add files to the store.",
+                "groups": ["fileset"],
+                "source": {"file": "lib/fileset/default.nix", "line": 10, "column": 3},
+            },
+        ],
+    }
+
+
+def _sections() -> dict[str, str]:
+    return dict(nixdoc.render_sections(_export(), _REVISION))
+
+
+def test_one_section_per_group_in_declared_order() -> None:
+    sections = nixdoc.render_sections(_export(), _REVISION)
+    assert [group_id for group_id, _src in sections] == ["strings", "fileset"]
+
+
+def test_group_heading_carries_anchor() -> None:
+    assert _sections()["strings"].startswith(
+        "# strings {#sec-functions-library-strings}\n")
+
+
+def test_group_description_headings_are_shifted() -> None:
+    fileset = _sections()["fileset"]
+    # authored anchors survive, the authored '# Overview' becomes a subheading
+    assert "[]{#sec-anchor-compat}" in fileset
+    assert "## Overview {#sec-fileset-overview}" in fileset
+
+
+def test_entry_heading_carries_attr_path_and_anchor() -> None:
+    assert (
+        "## `lib.strings.optionalString` {#function-library-lib.strings.optionalString}"
+        in _sections()["strings"]
+    )
+
+
+def test_entry_anchor_drops_characters_an_anchor_cannot_hold() -> None:
+    # lib.trivial."or" is a real attribute. an unescaped quote would break the anchor
+    # syntax and leak the literal '{#...}' into the heading text.
+    export = _export()
+    export["entries"] = [{
+        "id": 'lib.trivial."or"',
+        "attrPath": 'lib.trivial."or"',
+        "description": "Boolean or.",
+        "groups": ["strings"],
+        "source": {"file": "lib/trivial.nix", "line": 212},
+    }]
+    section = dict(nixdoc.render_sections(export, _REVISION))["strings"]
+    assert '## `lib.trivial."or"` {#function-library-lib.trivial.or}' in section
+
+
+def test_entry_description_headings_are_shifted_below_entry() -> None:
+    # the entry heading is h2, so an authored '# Example' must land on h3
+    assert "### Example" in _sections()["strings"]
+
+
+def test_fenced_nix_comment_is_not_shifted() -> None:
+    assert "```nix\n# a comment\nmapAttrs' f s\n```" in _sections()["strings"]
+
+
+def test_entries_are_grouped_by_declared_group() -> None:
+    sections = _sections()
+    assert "lib.fileset.toSource" in sections["fileset"]
+    assert "lib.fileset.toSource" not in sections["strings"]
+
+
+def test_located_at_links_to_the_revision() -> None:
+    assert (
+        "Located at [lib/strings.nix:238]"
+        f"(https://github.com/NixOS/nixpkgs/blob/{_REVISION}/lib/strings.nix#L238)"
+        " in `<nixpkgs>`."
+    ) in _sections()["strings"]
+
+
+def test_unsupported_schema_version_raises() -> None:
+    export = _export() | {"schemaVersion": 2}
+    with pytest.raises(nixdoc.NixdocExportError) as excinfo:
+        nixdoc.render_sections(export, _REVISION)
+    assert "schemaVersion 2" in str(excinfo.value)
+
+
+def test_missing_required_field_raises() -> None:
+    export = _export()
+    del export["entries"][0]["attrPath"]  # type: ignore[index]
+    with pytest.raises(nixdoc.NixdocExportError) as excinfo:
+        nixdoc.render_sections(export, _REVISION)
+    assert "missing required field 'attrPath'" in str(excinfo.value)

From a694fdc604123cf9a350b7fc2e9a94c660d7384e Mon Sep 17 00:00:00 2001
From: Johannes Kirschbauer <hsjobeki@gmail.com>
Date: Thu, 16 Jul 2026 19:30:50 +0200
Subject: [PATCH 13/53] doc/functions: use manifest mode from nixdoc

This simplifies the tooling and produces a structured data-asset that can
be exposed for nixos-search and docs.nixos.org.
---
 doc/doc-support/lib-function-docs.nix       | 142 ++------------------
 doc/doc-support/lib-function-locations.nix  |  82 -----------
 doc/doc-support/package.nix                 |   4 +-
 doc/function-catalog.json                   | 124 +++++++++++++++++
 doc/functions/{library.md.in => library.md} |   2 -
 doc/nav.json                                |   5 +-
 6 files changed, 139 insertions(+), 220 deletions(-)
 delete mode 100644 doc/doc-support/lib-function-locations.nix
 create mode 100644 doc/function-catalog.json
 rename doc/functions/{library.md.in => library.md} (64%)

diff --git a/doc/doc-support/lib-function-docs.nix b/doc/doc-support/lib-function-docs.nix
index bb81b50fddef..855cd6d0e3da 100644
--- a/doc/doc-support/lib-function-docs.nix
+++ b/doc/doc-support/lib-function-docs.nix
@@ -1,151 +1,27 @@
 # Generates the documentation for library functions via nixdoc.
 # To build this derivation, run `nix-build -A nixpkgs-manual.lib-docs`
 {
-  lib,
   stdenvNoCC,
   nixdoc,
-  nix,
-  nixpkgs ? { },
-  libsets ? [
-    {
-      name = "asserts";
-      description = "assertion functions";
-    }
-    {
-      name = "attrsets";
-      description = "attribute set functions";
-    }
-    {
-      name = "strings";
-      description = "string manipulation functions";
-    }
-    {
-      name = "versions";
-      description = "version string functions";
-    }
-    {
-      name = "trivial";
-      description = "miscellaneous functions";
-    }
-    {
-      name = "fixedPoints";
-      baseName = "fixed-points";
-      description = "explicit recursion functions";
-    }
-    {
-      name = "lists";
-      description = "list manipulation functions";
-    }
-    {
-      name = "debug";
-      description = "debugging functions";
-    }
-    {
-      name = "options";
-      description = "NixOS / nixpkgs option handling";
-    }
-    {
-      name = "path";
-      description = "path functions";
-    }
-    {
-      name = "fetchers";
-      description = "functions which can be reused across fetchers";
-    }
-    {
-      name = "filesystem";
-      description = "filesystem functions";
-    }
-    {
-      name = "fileset";
-      description = "file set functions";
-    }
-    {
-      name = "sources";
-      description = "source filtering functions";
-    }
-    {
-      name = "cli";
-      description = "command-line serialization functions";
-    }
-    {
-      name = "generators";
-      description = "functions that create file formats from nix data structures";
-    }
-    {
-      name = "gvariant";
-      description = "GVariant formatted string serialization functions";
-    }
-    {
-      name = "customisation";
-      description = "Functions to customise (derivation-related) functions, derivations, or attribute sets";
-    }
-    {
-      name = "meta";
-      description = "functions for derivation metadata";
-    }
-    {
-      name = "derivations";
-      description = "miscellaneous derivation-specific functions";
-    }
-  ],
 }:
-
 stdenvNoCC.mkDerivation {
   name = "nixpkgs-lib-docs";
 
   src = ../../lib;
 
-  nativeBuildInputs = [
-    nixdoc
-    nix
-  ];
+  nativeBuildInputs = [ nixdoc ];
+
+  buildPhase = ''
+    mkdir -p src
+    cp -r ${../../lib} src/lib
+
+    mkdir -p $out
+    nixdoc --manifest ${../function-catalog.json} --root src --output $out/lib-functions.json
+  '';
 
   installPhase = ''
     runHook preInstall
 
-    cd ..
-
-    export NIX_STATE_DIR=$(mktemp -d)
-    nix-instantiate --eval --strict --json ${./lib-function-locations.nix} \
-      --arg nixpkgsPath "./." \
-      --argstr revision ${nixpkgs.rev or "master"} \
-      --argstr libsetsJSON ${lib.escapeShellArg (builtins.toJSON libsets)} \
-      --store $(mktemp -d) \
-      > locations.json
-
-    function docgen {
-      name=$1
-      baseName=$2
-      description=$3
-      # TODO: wrap lib.$name in <literal>, make nixdoc not escape it
-      if [[ -e "lib/$baseName.nix" ]]; then
-        nixdoc -c "$name" -d "lib.$name: $description" -l locations.json -f "lib/$baseName.nix" > "$out/$name.md"
-      else
-        nixdoc -c "$name" -d "lib.$name: $description" -l locations.json -f "lib/$baseName/default.nix" > "$out/$name.md"
-      fi
-      echo "$out/$name.md" >> "$out/index.md"
-    }
-
-    mkdir -p "$out"
-
-    cat > "$out/index.md" << 'EOF'
-    ```{=include=} sections auto-id-prefix=auto-generated
-    EOF
-
-    ${lib.concatMapStrings (
-      {
-        name,
-        baseName ? name,
-        description,
-      }:
-      ''
-        docgen ${name} ${baseName} ${lib.escapeShellArg description}
-      ''
-    ) libsets}
-
-    echo '```' >> "$out/index.md"
-
     runHook postInstall
   '';
 }
diff --git a/doc/doc-support/lib-function-locations.nix b/doc/doc-support/lib-function-locations.nix
deleted file mode 100644
index 64a320f3f0cc..000000000000
--- a/doc/doc-support/lib-function-locations.nix
+++ /dev/null
@@ -1,82 +0,0 @@
-{
-  nixpkgsPath,
-  revision,
-  libsetsJSON,
-}:
-let
-  lib = import (nixpkgsPath + "/lib");
-  libsets = builtins.fromJSON libsetsJSON;
-
-  libDefPos =
-    prefix: set:
-    builtins.concatMap (
-      name:
-      [
-        {
-          name = builtins.concatStringsSep "." (prefix ++ [ name ]);
-          location = builtins.unsafeGetAttrPos name set;
-        }
-      ]
-      ++ lib.optionals (builtins.length prefix == 0 && builtins.isAttrs set.${name}) (
-        libDefPos (prefix ++ [ name ]) set.${name}
-      )
-    ) (builtins.attrNames set);
-
-  libset =
-    toplib:
-    map (subsetname: {
-      subsetname = subsetname;
-      functions = libDefPos [ ] toplib.${subsetname};
-    }) (map (x: x.name) libsets);
-
-  flattenedLibSubset =
-    { subsetname, functions }:
-    map (fn: {
-      name = "lib.${subsetname}.${fn.name}";
-      value = fn.location;
-    }) functions;
-
-  locatedlibsets = libs: map flattenedLibSubset (libset libs);
-  removeFilenamePrefix =
-    prefix: filename:
-    let
-      prefixLen = (builtins.stringLength prefix) + 1; # +1 to remove the leading /
-      filenameLen = builtins.stringLength filename;
-      substr = builtins.substring prefixLen filenameLen filename;
-    in
-    substr;
-
-  removeNixpkgs = removeFilenamePrefix (toString nixpkgsPath);
-
-  liblocations = builtins.filter (elem: elem.value != null) (lib.lists.flatten (locatedlibsets lib));
-
-  fnLocationRelative =
-    { name, value }:
-    {
-      inherit name;
-      value = value // {
-        file = removeNixpkgs value.file;
-      };
-    };
-
-  relativeLocs = (map fnLocationRelative liblocations);
-  sanitizeId = builtins.replaceStrings [ "'" ] [ "-prime" ];
-
-  urlPrefix = "https://github.com/NixOS/nixpkgs/blob/${revision}";
-  jsonLocs = builtins.listToAttrs (
-    map (
-      { name, value }:
-      {
-        name = sanitizeId name;
-        value =
-          let
-            text = "${value.file}:${toString value.line}";
-            target = "${urlPrefix}/${value.file}#L${toString value.line}";
-          in
-          "[${text}](${target}) in `<nixpkgs>`";
-      }
-    ) relativeLocs
-  );
-
-in
-jsonLocs
diff --git a/doc/doc-support/package.nix b/doc/doc-support/package.nix
index 0c9c5c6b8807..5533a4ca38c9 100644
--- a/doc/doc-support/package.nix
+++ b/doc/doc-support/package.nix
@@ -91,7 +91,7 @@ stdenvNoCC.mkDerivation (
       substituteInPlace ./languages-frameworks/python.section.md \
         --subst-var-by python-interpreter-table "$(<"${pythonInterpreterTable}")"
 
-      cat ./functions/library.md.in ${lib-docs}/index.md > ./functions/library.md
+      cp ${lib-docs}/lib-functions.json ./lib-functions.json
 
       substitute ./manual.md.in ./manual.md \
         --replace-fail '@MANUAL_VERSION@' '${lib.version}'
@@ -147,7 +147,7 @@ stdenvNoCC.mkDerivation (
     '';
 
     passthru = {
-      lib-docs = callPackage ./lib-function-docs.nix { inherit nixpkgs; };
+      lib-docs = callPackage ./lib-function-docs.nix { };
 
       epub = callPackage ./epub.nix { };
 
diff --git a/doc/function-catalog.json b/doc/function-catalog.json
new file mode 100644
index 000000000000..c8e419a285cd
--- /dev/null
+++ b/doc/function-catalog.json
@@ -0,0 +1,124 @@
+{
+  "version": 1,
+  "groups": [
+    { "id": "asserts", "description": "assertion functions" },
+    { "id": "attrsets", "description": "attribute set functions" },
+    { "id": "strings", "description": "string manipulation functions" },
+    { "id": "versions", "description": "version string functions" },
+    { "id": "trivial", "description": "miscellaneous functions" },
+    { "id": "fixedPoints", "description": "explicit recursion functions" },
+    { "id": "lists", "description": "list manipulation functions" },
+    { "id": "debug", "description": "debugging functions" },
+    { "id": "options", "description": "NixOS / nixpkgs option handling" },
+    { "id": "path", "description": "path functions" },
+    {
+      "id": "fetchers",
+      "description": "functions which can be reused across fetchers"
+    },
+    { "id": "filesystem", "description": "filesystem functions" },
+    { "id": "fileset" },
+    { "id": "sources", "description": "source filtering functions" },
+    { "id": "cli", "description": "command-line serialization functions" },
+    {
+      "id": "generators",
+      "description": "functions that create file formats from nix data structures"
+    },
+    {
+      "id": "gvariant",
+      "description": "GVariant formatted string serialization functions"
+    },
+    {
+      "id": "customisation",
+      "description": "Functions to customise (derivation-related) functions, derivations, or attribute sets"
+    },
+    { "id": "meta", "description": "functions for derivation metadata" },
+    {
+      "id": "derivations",
+      "description": "miscellaneous derivation-specific functions"
+    }
+  ],
+  "sources": [
+    { "path": "lib.trivial", "file": "lib/trivial.nix", "groups": ["trivial"] },
+    {
+      "path": "lib.fixedPoints",
+      "file": "lib/fixed-points.nix",
+      "groups": ["fixedPoints"]
+    },
+    {
+      "path": "lib.attrsets",
+      "file": "lib/attrsets.nix",
+      "groups": ["attrsets"]
+    },
+    { "path": "lib.lists", "file": "lib/lists.nix", "groups": ["lists"] },
+    { "path": "lib.strings", "file": "lib/strings.nix", "groups": ["strings"] },
+    {
+      "path": "lib.customisation",
+      "file": "lib/customisation.nix",
+      "groups": ["customisation"]
+    },
+    {
+      "path": "lib.derivations",
+      "file": "lib/derivations.nix",
+      "groups": ["derivations"]
+    },
+    { "path": "lib.meta", "file": "lib/meta.nix", "groups": ["meta"] },
+    {
+      "path": "lib.versions",
+      "file": "lib/versions.nix",
+      "groups": ["versions"]
+    },
+    { "path": "lib.cli", "file": "lib/cli.nix", "groups": ["cli"] },
+    {
+      "path": "lib.gvariant",
+      "file": "lib/gvariant.nix",
+      "groups": ["gvariant"]
+    },
+    {
+      "path": "lib.generators",
+      "file": "lib/generators.nix",
+      "groups": ["generators"]
+    },
+    { "path": "lib.asserts", "file": "lib/asserts.nix", "groups": ["asserts"] },
+    { "path": "lib.debug", "file": "lib/debug.nix", "groups": ["debug"] },
+    {
+      "path": "lib.fetchers",
+      "file": "lib/fetchers.nix",
+      "groups": ["fetchers"]
+    },
+    { "path": "lib.path", "file": "lib/path/default.nix", "groups": ["path"] },
+    {
+      "path": "lib.filesystem",
+      "file": "lib/filesystem.nix",
+      "groups": ["filesystem"]
+    },
+    {
+      "path": "lib.fileset",
+      "file": "lib/fileset/default.nix",
+      "groups": ["fileset"]
+    },
+    {
+      "path": "lib.sources",
+      "file": "lib/sources.nix",
+      "groups": ["sources"],
+      "mode": "deep",
+      "include": [
+        "pathIsGitRepo",
+        "commitIdFromGitRepo",
+        "cleanSource",
+        "cleanSourceWith",
+        "cleanSourceFilter",
+        "pathHasContext",
+        "canCleanSource",
+        "urlToName",
+        "shortRev",
+        "revOrTag",
+        "repoRevToName",
+        "sourceByRegex",
+        "sourceFilesBySuffices",
+        "sourceByGlobs",
+        "trace"
+      ]
+    },
+    { "path": "lib.options", "file": "lib/options.nix", "groups": ["options"] }
+  ]
+}
diff --git a/doc/functions/library.md.in b/doc/functions/library.md
similarity index 64%
rename from doc/functions/library.md.in
rename to doc/functions/library.md
index e17de86feb8a..c2f32e059794 100644
--- a/doc/functions/library.md.in
+++ b/doc/functions/library.md
@@ -1,5 +1,3 @@
 # Nixpkgs Library Functions {#sec-functions-library}
 
 Nixpkgs provides a standard library at `pkgs.lib`, or through `import <nixpkgs/lib>`.
-
-<!-- nixdoc-generated documentation must be appended here during build! -->
diff --git a/doc/nav.json b/doc/nav.json
index 791cb3eb4b1e..cc361e87593f 100644
--- a/doc/nav.json
+++ b/doc/nav.json
@@ -628,9 +628,12 @@
           "file": "functions.md"
         },
         {
-          "id-prefix": "auto-generated",
           "file": "functions/library.md"
         },
+        {
+          "collection": "lib-functions.json",
+          "type": "nixdoc"
+        },
         {
           "file": "functions/generators.section.md"
         },

From 81e31c1760a13536bb749ca40a5e89b7b3392dbb Mon Sep 17 00:00:00 2001
From: loner <2788892716@qq.com>
Date: Tue, 15 Sep 2026 19:08:54 +0800
Subject: [PATCH 14/53] qwen-code: 0.16.0 -> 0.23.4

---
 pkgs/by-name/qw/qwen-code/package.nix | 138 +++++++++++++++++---------
 1 file changed, 91 insertions(+), 47 deletions(-)

diff --git a/pkgs/by-name/qw/qwen-code/package.nix b/pkgs/by-name/qw/qwen-code/package.nix
index a4e253da3cb3..6cca7f70800b 100644
--- a/pkgs/by-name/qw/qwen-code/package.nix
+++ b/pkgs/by-name/qw/qwen-code/package.nix
@@ -1,39 +1,91 @@
 {
   lib,
+  stdenv,
   buildNpmPackage,
-  nodejs_22,
   fetchFromGitHub,
   nix-update-script,
-  jq,
   git,
   ripgrep,
   pkg-config,
   glib,
   libsecret,
+  versionCheckHook,
+  clang_20,
+  makeSetupHook,
+  writeText,
 }:
 
+let
+  # https://github.com/numtide/llm-agents.nix/blob/main/packages/darwinOpenptyHook/package.nix
+  darwinOpenptyHook =
+    let
+      header = writeText "darwin-openpty-shim.h" ''
+        #ifndef DARWIN_OPENPTY_SHIM_H
+        #define DARWIN_OPENPTY_SHIM_H
+        /*
+         * https://github.com/NixOS/nixpkgs/issues/457238
+         *
+         * macOS node-gyp builds sometimes see src/util.h from Node.js instead of
+         * the SDK's util.h. That header does not declare openpty(3)/forkpty(3),
+         * which causes node-pty (and other consumers) to fail to build. Including
+         * this shim restores the missing declarations without depending on the
+         * system header lookup.
+         */
+        #include <sys/types.h>
+        struct termios;
+        struct winsize;
+        #ifdef __cplusplus
+        extern "C" {
+        #endif
+        int openpty(int *, int *, char *, struct termios *, struct winsize *);
+        pid_t forkpty(int *, char *, struct termios *, struct winsize *);
+        #ifdef __cplusplus
+        }
+        #endif
+        #endif /* DARWIN_OPENPTY_SHIM_H */
+      '';
+      hookScript = writeText "darwin-openpty-hook.sh" ''
+        # shellcheck shell=bash
+        if [ -z "''${darwinOpenptyHookApplied-}" ]; then
+          export NIX_CFLAGS_COMPILE="''${NIX_CFLAGS_COMPILE-} -include ${header}"
+          darwinOpenptyHookApplied=1
+        fi
+      '';
+    in
+    makeSetupHook {
+      name = "darwin-openpty-hook";
+      meta = {
+        description = "Setup hook that injects openpty/forkpty prototypes on Darwin";
+        platforms = lib.platforms.darwin;
+      };
+      passthru = {
+        hideFromDocs = true;
+      };
+    } hookScript;
+in
 buildNpmPackage (finalAttrs: {
   pname = "qwen-code";
-  version = "0.16.0";
+  version = "0.23.4";
 
   src = fetchFromGitHub {
     owner = "QwenLM";
     repo = "qwen-code";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-XWhQ5GlAGW0WAyiPwBULLz1yQps2IdjVkusQ0a88tCs=";
+    hash = "sha256-AWmZhul7/p1atYkLZd/pojGaO80gydGfx+mnSP9SHnY=";
   };
 
   npmDepsFetcherVersion = 2;
-  npmDepsHash = "sha256-2vr8Yspm6CCVnO6Jf8B3wiL6X+Tp6hZZEPr+WC/Dcak=";
+  npmDepsHash = "sha256-tyLLtckMO/jFQHvdhHBWIE2Gx5vdHJBYHssVdq/abBU=";
 
-  # npm 11 incompatible with fetchNpmDeps
-  # https://github.com/NixOS/nixpkgs/issues/474535
-  nodejs = nodejs_22;
+  makeCacheWritable = true;
 
   nativeBuildInputs = [
-    jq
     pkg-config
     git
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    clang_20 # Works around node-addon-api constant expression issue with clang 21+ (keytar)
+    darwinOpenptyHook
   ];
 
   buildInputs = [
@@ -42,48 +94,26 @@ buildNpmPackage (finalAttrs: {
     libsecret
   ];
 
-  postPatch = ''
-    # patches below remove node-pty and keytar dependencies which cause build fail on Darwin
-    # should be conditional on platform but since package-lock.json is patched it changes its hash
-    # though seems like these dependencies are not really required by the package
-    ${jq}/bin/jq '
-      del(.packages."node_modules/node-pty") |
-      del(.packages."node_modules/@lydell/node-pty") |
-      del(.packages."node_modules/@lydell/node-pty-darwin-arm64") |
-      del(.packages."node_modules/@lydell/node-pty-darwin-x64") |
-      del(.packages."node_modules/@lydell/node-pty-linux-arm64") |
-      del(.packages."node_modules/@lydell/node-pty-linux-x64") |
-      del(.packages."node_modules/@lydell/node-pty-win32-arm64") |
-      del(.packages."node_modules/@lydell/node-pty-win32-x64") |
-      del(.packages."node_modules/keytar") |
-      walk(
-        if type == "object" and has("dependencies") then
-          .dependencies |= with_entries(select(.key | (contains("node-pty") | not) and (contains("keytar") | not)))
-        elif type == "object" and has("optionalDependencies") then
-          .optionalDependencies |= with_entries(select(.key | (contains("node-pty") | not) and (contains("keytar") | not)))
-        else .
-        end
-      ) |
-      walk(
-        if type == "object" and has("peerDependencies") then
-          .peerDependencies |= with_entries(select(.key | (contains("node-pty") | not) and (contains("keytar") | not)))
-        else .
-        end
-      )
-    ' package-lock.json > package-lock.json.tmp && mv package-lock.json.tmp package-lock.json
-  '';
-
   buildPhase = ''
     runHook preBuild
 
-    # Build several internal packages first (required by main bundle)
-    npm run build --workspace=@qwen-code/channel-base
-    npm run build --workspace=@qwen-code/channel-telegram
-    npm run build --workspace=@qwen-code/channel-weixin
-    npm run build --workspace=@qwen-code/channel-dingtalk
-    npm run build --workspace=@qwen-code/web-templates
+    # Increase Node.js heap size on Darwin to prevent OOM during
+    ${lib.optionalString stdenv.hostPlatform.isDarwin ''
+      export NODE_OPTIONS="--max-old-space-size=8192"
+    ''}
+
+    # npmConfigHook only patches the root node_modules. Workspaces with
+    # nested .bin (web-shell's vite) keep /usr/bin/env otherwise.
+    patchShebangs packages/*/node_modules
 
     npm run generate
+
+    # The CLI esbuild bundle resolves imports against workspace dist/ output.
+    # Use upstream's --cli-only build order so every workspace the bundle pulls
+    # in (core, channels, acp-bridge, sdk-typescript, ...) is built, without
+    # us having to track the dependency list by hand across releases.
+    node scripts/build.js --cli-only
+
     npm run bundle
 
     runHook postBuild
@@ -93,18 +123,32 @@ buildNpmPackage (finalAttrs: {
     runHook preInstall
 
     mkdir -p $out/bin $out/share/qwen-code
+
     cp -r dist/* $out/share/qwen-code/
+
+    # The bundled dist/cli.js has no shebang; upstream ships a bin wrapper
+    # (scripts/cli-entry.js) that relaunches cli.js with node --expose-gc and
+    # reads package.json for the reported version. Install both next to cli.js.
+    cp scripts/cli-entry.js $out/share/qwen-code/cli-entry.js
+    cp package.json $out/share/qwen-code/package.json
+
     # Install production dependencies only
     npm prune --production
     cp -r node_modules $out/share/qwen-code/
+
     # Remove broken symlinks that cause issues in Nix environment
     find $out/share/qwen-code/node_modules -type l -delete || true
+
     patchShebangs $out/share/qwen-code
-    ln -s $out/share/qwen-code/cli.js $out/bin/qwen
+
+    ln -s $out/share/qwen-code/cli-entry.js $out/bin/qwen
 
     runHook postInstall
   '';
 
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
   passthru.updateScript = nix-update-script { };
 
   meta = {

From c9cb78f47082c0c8c65c93e0b97e425988563416 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Mon, 14 Sep 2026 21:32:01 +0000
Subject: [PATCH 15/53] python3Packages.langchain-protocol: 0.0.18 -> 0.0.19

---
 .../langchain-protocol/default.nix            | 20 +++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/langchain-protocol/default.nix b/pkgs/development/python-modules/langchain-protocol/default.nix
index 9a028ecdd2bc..c952473f1b96 100644
--- a/pkgs/development/python-modules/langchain-protocol/default.nix
+++ b/pkgs/development/python-modules/langchain-protocol/default.nix
@@ -1,24 +1,32 @@
 {
   lib,
   buildPythonPackage,
-  fetchPypi,
+  fetchFromGitHub,
   hatchling,
   typing-extensions,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "langchain-protocol";
-  version = "0.0.18";
+  version = "0.0.19";
   pyproject = true;
   __structuredAttrs = true;
 
   # Not available vis Github yet; required by langchain-core
-  src = fetchPypi {
-    pname = "langchain_protocol";
-    inherit (finalAttrs) version;
-    hash = "sha256-7D4ReC8e0MnbOOWp7QGw56DT+6QG+qiu9llLc8VqY+Y=";
+  src = fetchFromGitHub {
+    owner = "langchain-ai";
+    repo = "agent-protocol";
+    tag = "langchain-protocol==${finalAttrs.version}";
+    hash = "sha256-RiTuadwE3IMhlsFzEZkVlIKMU8/c9uTTDWrXpptriGI=";
   };
 
+  sourceRoot = "${finalAttrs.src.name}/streaming/py";
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail "hatchling>=1.26,<1.30" "hatchling"
+  '';
+
   build-system = [
     hatchling
   ];

From 5bec716bc83e77980f301da07fbc0a844510de31 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Mon, 14 Sep 2026 21:32:01 +0000
Subject: [PATCH 16/53] python3Packages.langchain-core: 1.5.4 -> 1.6.3

---
 pkgs/development/python-modules/langchain-core/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/langchain-core/default.nix b/pkgs/development/python-modules/langchain-core/default.nix
index a28455666371..eed448bf929a 100644
--- a/pkgs/development/python-modules/langchain-core/default.nix
+++ b/pkgs/development/python-modules/langchain-core/default.nix
@@ -37,7 +37,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langchain-core";
-  version = "1.5.4";
+  version = "1.6.3";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -45,7 +45,7 @@ buildPythonPackage (finalAttrs: {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-core==${finalAttrs.version}";
-    hash = "sha256-5aH12hWxnYlRYIa3UT5Z8JycL5ipRNg9KS9h4H2uKA4=";
+    hash = "sha256-IOi1Yw1cYdsLogr/xrECYIlfDdHqZzCUz27ubK1QrSQ=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/core";

From 25cb81b38648ca2cf920b38ca8fac176066c96e7 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Mon, 14 Sep 2026 21:31:32 +0000
Subject: [PATCH 17/53] python3Packages.langchain-aws: 1.6.4 -> 1.7.6

---
 .../python-modules/langchain-aws/default.nix          | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/langchain-aws/default.nix b/pkgs/development/python-modules/langchain-aws/default.nix
index 29a60272aa50..058ebc953b51 100644
--- a/pkgs/development/python-modules/langchain-aws/default.nix
+++ b/pkgs/development/python-modules/langchain-aws/default.nix
@@ -20,6 +20,7 @@
   langchain-anthropic,
 
   # tests
+  langchain-openai,
   langchain-tests,
   pytest-asyncio,
   pytest-cov-stub,
@@ -31,7 +32,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langchain-aws";
-  version = "1.6.4";
+  version = "1.7.6";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -39,7 +40,7 @@ buildPythonPackage (finalAttrs: {
     owner = "langchain-ai";
     repo = "langchain-aws";
     tag = "langchain-aws==${finalAttrs.version}";
-    hash = "sha256-7qg2cUjlFEo6ekK269Ew0wmmSx+1BwUdTJZCMPd2tBU=";
+    hash = "sha256-Lw23OAHSEqf7NAgzSzWqgsb8ZV7Ir1KR0lULIE7TYVU=";
   };
 
   postPatch = ''
@@ -72,6 +73,7 @@ buildPythonPackage (finalAttrs: {
   nativeCheckInputs = [
     anthropic
     langchain
+    langchain-openai
     langchain-tests
     pytest-asyncio
     pytest-cov-stub
@@ -84,6 +86,11 @@ buildPythonPackage (finalAttrs: {
   disabledTests = [
     # Fails when langchain-core gets ahead of this package
     "test_serdes"
+    # Requires aws-bedrock-token-generator (not packaged)
+    "test_bedrock_api_key_provider"
+    "test_installed_provider_mints_token_when_called"
+    # botocore added new content block keys
+    "test__bedrock_content_block_keys_match_botocore"
   ];
 
   pythonImportsCheck = [ "langchain_aws" ];

From 701c6e3fce65be0fc9ba18bdd258a2ed49f5cc62 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Mon, 14 Sep 2026 21:31:41 +0000
Subject: [PATCH 18/53] python3Packages.langchain-anthropic: 1.5.2 -> 1.7.2

---
 .../python-modules/langchain-anthropic/default.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/langchain-anthropic/default.nix b/pkgs/development/python-modules/langchain-anthropic/default.nix
index eef3bd1f0400..2f34adba6f95 100644
--- a/pkgs/development/python-modules/langchain-anthropic/default.nix
+++ b/pkgs/development/python-modules/langchain-anthropic/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langchain-anthropic";
-  version = "1.5.2";
+  version = "1.7.2";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -32,7 +32,7 @@ buildPythonPackage (finalAttrs: {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-anthropic==${finalAttrs.version}";
-    hash = "sha256-mk0Cx1rYO1sPbFJdpqVs+hCvLkV7u1WrHOIkTW5ewDE=";
+    hash = "sha256-2hswfwhRt+P+kF5n80zLLbjbC7wadgfgOCy+v0nLnLs=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/partners/anthropic";

From d6ec3795f59793e5860bfe5ba4a61877490425c7 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Mon, 14 Sep 2026 21:31:49 +0000
Subject: [PATCH 19/53] python3Packages.langchain-fireworks: 1.4.4 -> 1.6.1

---
 .../python-modules/langchain-fireworks/default.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/langchain-fireworks/default.nix b/pkgs/development/python-modules/langchain-fireworks/default.nix
index f597d65d9109..d25019a8950d 100644
--- a/pkgs/development/python-modules/langchain-fireworks/default.nix
+++ b/pkgs/development/python-modules/langchain-fireworks/default.nix
@@ -24,7 +24,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langchain-fireworks";
-  version = "1.4.4";
+  version = "1.6.1";
   pyproject = true;
   __structuredAttrs = true;
   strictDeps = true;
@@ -33,7 +33,7 @@ buildPythonPackage (finalAttrs: {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-fireworks==${finalAttrs.version}";
-    hash = "sha256-O63UohmChFeeQZH7G1iYDwNdvJapVEnHlkGHdGxIDjE=";
+    hash = "sha256-tJduBjY+JcG9bhZYsOi7+2TdR4DTi/ZCTIaNZ87R8JM=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/partners/fireworks";

From 02cdafaa37371110de43a57480b60b414d131668 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Mon, 14 Sep 2026 21:32:09 +0000
Subject: [PATCH 20/53] python3Packages.langgraph: 1.2.10 -> 1.2.11

---
 pkgs/development/python-modules/langgraph/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/langgraph/default.nix b/pkgs/development/python-modules/langgraph/default.nix
index e6dd0c785eb9..949133e39f9f 100644
--- a/pkgs/development/python-modules/langgraph/default.nix
+++ b/pkgs/development/python-modules/langgraph/default.nix
@@ -41,7 +41,7 @@
 }:
 buildPythonPackage (finalAttrs: {
   pname = "langgraph";
-  version = "1.2.10";
+  version = "1.2.11";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -49,7 +49,7 @@ buildPythonPackage (finalAttrs: {
     owner = "langchain-ai";
     repo = "langgraph";
     tag = finalAttrs.version;
-    hash = "sha256-2P/JsZYQyXIselQaJVuyWTdkRQN7K1TW7w28D7BecRk=";
+    hash = "sha256-5CUQh9KNYQ0HBIuREOP0MxZgn5Z1MxMuqB9Be4e6AJo=";
   };
 
   postgresqlTestSetupPost = ''

From bdbdb40e403dbea5f9c6b713312c458c6f9dfdc8 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Mon, 14 Sep 2026 21:32:13 +0000
Subject: [PATCH 21/53] python3Packages.langchain-openai: 1.4.1 -> 1.6.2

---
 pkgs/development/python-modules/langchain-openai/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/langchain-openai/default.nix b/pkgs/development/python-modules/langchain-openai/default.nix
index a837c7c55cf2..a2f001d06322 100644
--- a/pkgs/development/python-modules/langchain-openai/default.nix
+++ b/pkgs/development/python-modules/langchain-openai/default.nix
@@ -33,7 +33,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langchain-openai";
-  version = "1.4.1";
+  version = "1.6.2";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -41,7 +41,7 @@ buildPythonPackage (finalAttrs: {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-openai==${finalAttrs.version}";
-    hash = "sha256-ELiQJQ8tuQX246ZOr/+iYj/vJRtIX5Cr5PIn4Ul0E8c=";
+    hash = "sha256-VCob54ZCetohK8ZvgAHPdExr2UPgD4vxGCXM0pKW3hQ=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/partners/openai";

From 5ae3d457b00971c14719fef020ccd591e1745280 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Mon, 14 Sep 2026 21:32:15 +0000
Subject: [PATCH 22/53] python3Packages.langgraph-checkpoint-mongodb: 0.4.0 ->
 0.5.0

---
 .../python-modules/langgraph-checkpoint-mongodb/default.nix   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/langgraph-checkpoint-mongodb/default.nix b/pkgs/development/python-modules/langgraph-checkpoint-mongodb/default.nix
index a55c9368db9b..46e36454f9ab 100644
--- a/pkgs/development/python-modules/langgraph-checkpoint-mongodb/default.nix
+++ b/pkgs/development/python-modules/langgraph-checkpoint-mongodb/default.nix
@@ -15,14 +15,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langgraph-checkpoint-mongodb";
-  version = "0.4.0";
+  version = "0.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain-mongodb";
     tag = "libs/langgraph-checkpoint-mongodb/v${finalAttrs.version}";
-    hash = "sha256-AdTAyMHNzkuvNB7DsbWxAxNKNqSxdgYwIB5UHBAAxZc=";
+    hash = "sha256-0cL28QpwcvjOQmaH1lpZZpqcThGN2fZVryWEzrN9Mrc=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/langgraph-checkpoint-mongodb";

From 9af4ec55c456ff99fa7989ca0b1f72ee6cf35555 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Mon, 14 Sep 2026 21:32:23 +0000
Subject: [PATCH 23/53] python3Packages.langgraph-runtime-inmem: 0.32.3 ->
 0.34.1

---
 .../python-modules/langgraph-runtime-inmem/default.nix        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/langgraph-runtime-inmem/default.nix b/pkgs/development/python-modules/langgraph-runtime-inmem/default.nix
index 48f64d24b0ca..c905520fb806 100644
--- a/pkgs/development/python-modules/langgraph-runtime-inmem/default.nix
+++ b/pkgs/development/python-modules/langgraph-runtime-inmem/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langgraph-runtime-inmem";
-  version = "0.32.3";
+  version = "0.34.1";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -22,7 +22,7 @@ buildPythonPackage (finalAttrs: {
   src = fetchPypi {
     pname = "langgraph_runtime_inmem";
     inherit (finalAttrs) version;
-    hash = "sha256-k5ATRuxkds7dDZx3lxGJUL+vUgVFHe8/BaAZqoaaxd4=";
+    hash = "sha256-DgyDoLsWDpnSF8CBPLRtQtpQ5LazZrSozkrbRIOX4xo=";
   };
 
   build-system = [ hatchling ];

From 2ad51ef94b04f2ea26431e73c4599dc29af17cb9 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Mon, 14 Sep 2026 21:32:24 +0000
Subject: [PATCH 24/53] python3Packages.langchain: 1.3.14 -> 1.4.0

---
 pkgs/development/python-modules/langchain/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/langchain/default.nix b/pkgs/development/python-modules/langchain/default.nix
index c9d9bae39985..9a2a3e63f29a 100644
--- a/pkgs/development/python-modules/langchain/default.nix
+++ b/pkgs/development/python-modules/langchain/default.nix
@@ -46,7 +46,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langchain";
-  version = "1.3.14";
+  version = "1.4.0";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -54,7 +54,7 @@ buildPythonPackage (finalAttrs: {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain==${finalAttrs.version}";
-    hash = "sha256-SmbqK8/AmUYfp+hUEnuwl18K+A/6csLxMUTv0oQHhEs=";
+    hash = "sha256-p4YqDRa37QC0diLMUPUX1J8Rc3q+DFxjPU+w8M0EJtY=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/langchain_v1";

From d138a99dc7fa866b45ec52d619e9ae44a8f16130 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Tue, 15 Sep 2026 13:45:07 -0700
Subject: [PATCH 25/53] python3Packages.langchain: disable tests that depend on
 new langchain-mcp

langchain-mcp depends on fastapi 4.x which is being packaged in PR #563493.
---
 pkgs/development/python-modules/langchain/default.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/python-modules/langchain/default.nix b/pkgs/development/python-modules/langchain/default.nix
index 9a2a3e63f29a..0fe400edda28 100644
--- a/pkgs/development/python-modules/langchain/default.nix
+++ b/pkgs/development/python-modules/langchain/default.nix
@@ -128,9 +128,15 @@ buildPythonPackage (finalAttrs: {
     # AttributeError: 'ImportErrorProfileModel' object has no attribute 'profile'
     # https://github.com/langchain-ai/langchain/issues/36312
     "test_summarization_middleware_missing_profile"
+    # langchain.mcp requires fastmcp>=4 (nixpkgs has 3.x) and jsonschema
+    "test_import_all"
+    "test_import_all_using_dir"
   ];
 
   disabledTestPaths = [
+    # Requires fastmcp>=4 (nixpkgs has 3.x) and jsonschema
+    "tests/unit_tests/mcp"
+
     # Their configuration tests don't place nicely with nixpkgs
     "tests/unit_tests/test_pytest_config.py"
 

From 0abd8e911efdc736124c3087306637fea1ec9c34 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Mon, 14 Sep 2026 21:32:28 +0000
Subject: [PATCH 26/53] python3Packages.langgraph-sdk: 0.4.2 -> 0.4.4

---
 pkgs/development/python-modules/langgraph-sdk/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/langgraph-sdk/default.nix b/pkgs/development/python-modules/langgraph-sdk/default.nix
index ef2243288a6d..1504b27ee1f2 100644
--- a/pkgs/development/python-modules/langgraph-sdk/default.nix
+++ b/pkgs/development/python-modules/langgraph-sdk/default.nix
@@ -21,7 +21,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langgraph-sdk";
-  version = "0.4.2";
+  version = "0.4.4";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -29,7 +29,7 @@ buildPythonPackage (finalAttrs: {
     owner = "langchain-ai";
     repo = "langgraph";
     tag = "sdk==${finalAttrs.version}";
-    hash = "sha256-30BY7f8m3YiqEBhb3+TQYTW0N40xI9kTQbMTh4BwcyU=";
+    hash = "sha256-kKIk0vt+2HXpSqW0RVt3cqpdmdf5NOWtXlkSkrogNWs=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/sdk-py";

From 3d6dc4b7a05d8467a678a24f6412e2cfac046d51 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Mon, 14 Sep 2026 21:32:28 +0000
Subject: [PATCH 27/53] python3Packages.langgraph-store-mongodb: 0.3.0 -> 0.4.0

---
 .../python-modules/langgraph-store-mongodb/default.nix        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/langgraph-store-mongodb/default.nix b/pkgs/development/python-modules/langgraph-store-mongodb/default.nix
index fcae0393fe2a..c4533c3a4cfc 100644
--- a/pkgs/development/python-modules/langgraph-store-mongodb/default.nix
+++ b/pkgs/development/python-modules/langgraph-store-mongodb/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langgraph-store-mongodb";
-  version = "0.3.0";
+  version = "0.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain-mongodb";
     tag = "libs/langgraph-store-mongodb/v${finalAttrs.version}";
-    hash = "sha256-uivrfCTUu7Pq/ncAGH6HUzgyOGRcOzsQ+SVN6wW33tQ=";
+    hash = "sha256-0cL28QpwcvjOQmaH1lpZZpqcThGN2fZVryWEzrN9Mrc=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/langgraph-store-mongodb";

From 3413a96f0e05945abc19d0bfed66569d8a3ed82e Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Mon, 14 Sep 2026 21:32:35 +0000
Subject: [PATCH 28/53] python3Packages.langsmith: 0.8.18 -> 0.12.4

---
 .../python-modules/langsmith/default.nix      | 54 ++++++++++++++++---
 1 file changed, 48 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/langsmith/default.nix b/pkgs/development/python-modules/langsmith/default.nix
index d38621e26cf3..af264722b262 100644
--- a/pkgs/development/python-modules/langsmith/default.nix
+++ b/pkgs/development/python-modules/langsmith/default.nix
@@ -8,11 +8,15 @@
   hatchling,
 
   # dependencies
-  httpx,
+  anyio,
+  distro,
+  httpx2,
   orjson,
   pydantic,
   requests,
   requests-toolbelt,
+  sniffio,
+  typing-extensions,
   uuid-utils,
   websockets,
   xxhash,
@@ -20,7 +24,7 @@
 
   # tests
   anthropic,
-  attrs,
+  cachetools,
   dataclasses-json,
   multipart,
   opentelemetry-sdk,
@@ -29,18 +33,19 @@
   pytest-socket,
   pytest-vcr,
   pytestCheckHook,
+  rich,
 }:
 
 buildPythonPackage (finalAttrs: {
   pname = "langsmith";
-  version = "0.8.18";
+  version = "0.12.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langsmith-sdk";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-YQ49pg0+RepwlEHtu8GDUpfnXQF3yFiz6ZeRcnHXSWU=";
+    hash = "sha256-e5+lttn90eBL4xkvxN9oH3aPp1wRBfy5Q0pS8LDCiq8=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/python";
@@ -50,11 +55,15 @@ buildPythonPackage (finalAttrs: {
   build-system = [ hatchling ];
 
   dependencies = [
-    httpx
+    anyio
+    distro
+    httpx2
     orjson
     pydantic
     requests
     requests-toolbelt
+    sniffio
+    typing-extensions
     uuid-utils
     websockets
     xxhash
@@ -63,7 +72,7 @@ buildPythonPackage (finalAttrs: {
 
   nativeCheckInputs = [
     anthropic
-    attrs
+    cachetools
     dataclasses-json
     multipart
     opentelemetry-sdk
@@ -72,6 +81,7 @@ buildPythonPackage (finalAttrs: {
     pytest-socket
     pytest-vcr
     pytestCheckHook
+    rich
   ];
 
   # evaluation and external tests require OpenAPI key
@@ -106,6 +116,38 @@ buildPythonPackage (finalAttrs: {
 
     # strands-agents isn't packaged
     "tests/unit_tests/wrappers/test_strands_agents.py"
+
+    # require network access to external test servers
+    "tests/unit_tests/test_async_client.py::test_arequest_with_retries_retries_on_502"
+    "tests/unit_tests/test_async_client.py::test_async_create_feedback_retries_on_not_found"
+    "tests/unit_tests/test_async_client.py::test_create_feedback_retries_on_not_found"
+    "tests/unit_tests/sandbox/test_async_client.py::TestAsyncConnectionErrors"
+    "tests/unit_tests/sandbox/test_async_client.py::TestAsyncSandboxOperations"
+    "tests/unit_tests/sandbox/test_async_client.py::TestAsyncSnapshotTags"
+    "tests/unit_tests/sandbox/test_async_client.py::TestGenerateDownloadURL"
+    "tests/unit_tests/sandbox/test_async_client.py::TestService"
+    "tests/unit_tests/sandbox/test_async_sandbox.py::TestAsyncSandboxContextManager"
+    "tests/unit_tests/sandbox/test_async_sandbox.py::TestAsyncSandboxRead"
+    "tests/unit_tests/sandbox/test_async_sandbox.py::TestAsyncSandboxRun"
+    "tests/unit_tests/sandbox/test_async_sandbox.py::TestAsyncSandboxStatusFields"
+    "tests/unit_tests/sandbox/test_async_sandbox.py::TestAsyncSandboxWrite"
+    "tests/unit_tests/sandbox/test_client.py::TestConnectionErrors"
+    "tests/unit_tests/sandbox/test_client.py::TestGenerateDownloadURL"
+    "tests/unit_tests/sandbox/test_client.py::TestRegistries"
+    "tests/unit_tests/sandbox/test_client.py::TestSandboxOperations"
+    "tests/unit_tests/sandbox/test_client.py::TestService"
+    "tests/unit_tests/sandbox/test_client.py::TestSnapshotOperations"
+    "tests/unit_tests/sandbox/test_client.py::TestStartStopOperations"
+    "tests/unit_tests/sandbox/test_proxy_config.py::test_create_sandbox_expands_mount_config"
+    "tests/unit_tests/sandbox/test_proxy_config.py::test_create_sandbox_forwards_composed_proxy_config"
+    "tests/unit_tests/sandbox/test_proxy_config.py::test_create_sandbox_preserves_mount_config_and_proxy_config_separately"
+    "tests/unit_tests/sandbox/test_sandbox.py::TestSandboxContextManager"
+    "tests/unit_tests/sandbox/test_sandbox.py::TestSandboxRead"
+    "tests/unit_tests/sandbox/test_sandbox.py::TestSandboxRun"
+    "tests/unit_tests/sandbox/test_sandbox.py::TestSandboxStatusFields"
+    "tests/unit_tests/sandbox/test_sandbox.py::TestSandboxWrite"
+    "tests/unit_tests/sandbox/test_transport.py::TestAsyncRetryTransport"
+    "tests/unit_tests/sandbox/test_transport.py::TestRetryTransport"
   ];
 
   pythonImportsCheck = [ "langsmith" ];

From cc6bd4b42823dbc01fd17ca58d1802904bd92c31 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Mon, 14 Sep 2026 21:32:43 +0000
Subject: [PATCH 29/53] python3Packages.langchain-xai: 1.2.2 -> 1.3.0

---
 pkgs/development/python-modules/langchain-xai/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/langchain-xai/default.nix b/pkgs/development/python-modules/langchain-xai/default.nix
index 905ad7dbf3cb..3e47005c8449 100644
--- a/pkgs/development/python-modules/langchain-xai/default.nix
+++ b/pkgs/development/python-modules/langchain-xai/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langchain-xai";
-  version = "1.2.2";
+  version = "1.3.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-xai==${finalAttrs.version}";
-    hash = "sha256-RUklm627HiwMcpKkm+0uWZgHp4iDtSsmEpLb9MxumqI=";
+    hash = "sha256-5eUyYr+xyEiHZgMKXW6jQhabVdSZTDT2e93Fy7RwUGM=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/libs/partners/xai";

From 4d666bc09a832ef82494a2f36fd528a0f666d3b9 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Mon, 14 Sep 2026 21:32:48 +0000
Subject: [PATCH 30/53] python3Packages.langgraph-checkpoint-postgres: 3.1.0 ->
 3.1.2

---
 .../langgraph-checkpoint-postgres/default.nix            | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/langgraph-checkpoint-postgres/default.nix b/pkgs/development/python-modules/langgraph-checkpoint-postgres/default.nix
index f6871fcefe6b..58dfc1f90254 100644
--- a/pkgs/development/python-modules/langgraph-checkpoint-postgres/default.nix
+++ b/pkgs/development/python-modules/langgraph-checkpoint-postgres/default.nix
@@ -26,7 +26,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "langgraph-checkpoint-postgres";
-  version = "3.1.0";
+  version = "3.1.2";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -34,7 +34,7 @@ buildPythonPackage (finalAttrs: {
     owner = "langchain-ai";
     repo = "langgraph";
     tag = "checkpointpostgres==${finalAttrs.version}";
-    hash = "sha256-xSYJ9D86GuaJEgQYk+pkJ4O7HK6HXfAOGBv4f1CBY5g=";
+    hash = "sha256-7UJh+ObKOdU5QlGOlvF/8uHd+uOfiAjuGAkIVdEBLHQ=";
   };
 
   postgresqlTestSetupPost = ''
@@ -90,6 +90,11 @@ buildPythonPackage (finalAttrs: {
     "test_store_ttl"
   ];
 
+  disabledTestPaths = [
+    # Imports langgraph.checkpoint.conformance (not mature enough to package)
+    "tests/test_conformance_delta.py"
+  ];
+
   pythonImportsCheck = [ "langgraph.checkpoint.postgres" ];
 
   passthru = {

From 4207fd0fcf46c2e0db2702c89cbdb983d68e4c37 Mon Sep 17 00:00:00 2001
From: Sarah Clark <seclark@nextquestion.net>
Date: Wed, 16 Sep 2026 10:16:33 -0700
Subject: [PATCH 31/53] python3Packages.langgraph-store-mongodb: 0.3.0 -> 0.4.0

Fixes CVE-2026-55253.
---
 .../python-modules/langgraph-store-mongodb/default.nix        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/langgraph-store-mongodb/default.nix b/pkgs/development/python-modules/langgraph-store-mongodb/default.nix
index c4533c3a4cfc..6d5299896bd9 100644
--- a/pkgs/development/python-modules/langgraph-store-mongodb/default.nix
+++ b/pkgs/development/python-modules/langgraph-store-mongodb/default.nix
@@ -46,8 +46,8 @@ buildPythonPackage (finalAttrs: {
     skipBulkUpdate = true;
     updateScript = nix-update-script {
       extraArgs = [
-        "-vr"
-        "libs/langgraph-store-mongodb/v(.*)"
+        "--version-regex"
+        "libs/langgraph-store-mongodb/v(.+)"
       ];
     };
   };

From b1073569732bf2f50c340b7a9100edf247e4b189 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Wed, 16 Sep 2026 19:55:09 +0200
Subject: [PATCH 32/53] python3Packages.tesla-fleet-api: migrate to finalAttrs

---
 .../python-modules/tesla-fleet-api/default.nix            | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/tesla-fleet-api/default.nix b/pkgs/development/python-modules/tesla-fleet-api/default.nix
index d68382f29266..0fd290070927 100644
--- a/pkgs/development/python-modules/tesla-fleet-api/default.nix
+++ b/pkgs/development/python-modules/tesla-fleet-api/default.nix
@@ -14,7 +14,7 @@
   typing-extensions,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "tesla-fleet-api";
   version = "1.13.0";
   pyproject = true;
@@ -22,7 +22,7 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "Teslemetry";
     repo = "python-tesla-fleet-api";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-MMbn/qjy9B5qDF1w1ckT06vz9GeU1Gy+NitnHl7uPk4=";
   };
 
@@ -48,8 +48,8 @@ buildPythonPackage rec {
   meta = {
     description = "Python library for Tesla Fleet API and Teslemetry";
     homepage = "https://github.com/Teslemetry/python-tesla-fleet-api";
-    changelog = "https://github.com/Teslemetry/python-tesla-fleet-api/releases/tag/${src.tag}";
+    changelog = "https://github.com/Teslemetry/python-tesla-fleet-api/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

From da8396c48b49e6e4d6abc1cf426cb0b348f18389 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Sep 2026 19:31:57 +0000
Subject: [PATCH 33/53] ocamlPackages.spdx_licenses: 1.5.0 -> 1.6.0

---
 pkgs/development/ocaml-modules/spdx_licenses/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/ocaml-modules/spdx_licenses/default.nix b/pkgs/development/ocaml-modules/spdx_licenses/default.nix
index 82bf90aa0c88..c414856541b4 100644
--- a/pkgs/development/ocaml-modules/spdx_licenses/default.nix
+++ b/pkgs/development/ocaml-modules/spdx_licenses/default.nix
@@ -7,11 +7,11 @@
 
 buildDunePackage (finalAttrs: {
   pname = "spdx_licenses";
-  version = "1.5.0";
+  version = "1.6.0";
 
   src = fetchurl {
     url = "https://github.com/kit-ty-kate/spdx_licenses/releases/download/v${finalAttrs.version}/spdx_licenses-${finalAttrs.version}.tar.gz";
-    hash = "sha256-Q+z+B/2yHiiulK/FY75fd4+Lyt5fTcJgZwBWdzgy4EQ=";
+    hash = "sha256-ciUka6XWRg2bYqzXWOGsNc62J5OshtXNSDCqbPooGVA=";
   };
 
   doCheck = true;

From 5036aeb14e98d51d4f2a2208971c74282cce7e0f Mon Sep 17 00:00:00 2001
From: Bart Oostveen <bart@bartoostveen.nl>
Date: Wed, 16 Sep 2026 22:29:30 +0200
Subject: [PATCH 34/53] matrix-continuwuity: 26.8.1 -> 26.9.0

Release notes: https://forgejo.ellis.link/continuwuation/continuwuity/releases/tag/v26.9.0
Changelog: https://forgejo.ellis.link/continuwuation/continuwuity/src/commit/v26.9.0/CHANGELOG.md
Diff: https://forgejo.ellis.link/continuwuation/continuwuity/compare/v26.8.1...v26.9.0
---
 pkgs/by-name/ma/matrix-continuwuity/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ma/matrix-continuwuity/package.nix b/pkgs/by-name/ma/matrix-continuwuity/package.nix
index 69a3fa5879e4..5c6bb38e10a9 100644
--- a/pkgs/by-name/ma/matrix-continuwuity/package.nix
+++ b/pkgs/by-name/ma/matrix-continuwuity/package.nix
@@ -17,17 +17,17 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "matrix-continuwuity";
-  version = "26.8.1";
+  version = "26.9.0";
 
   src = fetchFromGitea {
     domain = "forgejo.ellis.link";
     owner = "continuwuation";
     repo = "continuwuity";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-slwfK5aEIFjIue01L4nVUHaLx/2j3nRKrmkNkfPPZXE=";
+    hash = "sha256-w/sFqEbvzNTbvR8eTeVT0qo/t0p/vlQUna1bPOqJs7E=";
   };
 
-  cargoHash = "sha256-s87vdh+5rMNIXDWt2dZZvqSY9dJzEHuvEhJLG1HvphY=";
+  cargoHash = "sha256-ubIQNgn/FM++WkmnfDOVUpxfBCElIYJxvNMipwXbmIc=";
 
   nativeBuildInputs = [
     pkg-config

From f9f733e5b001653a5a4a118670ba4fa2387122ae Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 16 Sep 2026 23:12:28 +0000
Subject: [PATCH 35/53] python3Packages.icalendar-compatibility: 0.1.4 -> 0.1.5

---
 .../python-modules/icalendar-compatibility/default.nix        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/icalendar-compatibility/default.nix b/pkgs/development/python-modules/icalendar-compatibility/default.nix
index fdbfe2ad54a4..8db36d809ef2 100644
--- a/pkgs/development/python-modules/icalendar-compatibility/default.nix
+++ b/pkgs/development/python-modules/icalendar-compatibility/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "icalendar-compatibility";
-  version = "0.1.4";
+  version = "0.1.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "niccokunzmann";
     repo = "icalendar_compatibility";
     tag = "v${version}";
-    hash = "sha256-h9rpbltNEPMteicPJ6oC32NsZS8QXQphLbC0Qiu7j5Q=";
+    hash = "sha256-rHx4wuLKSBI3/3ShxtpyyuK+iWULpbzfDN8DCNUryHg=";
   };
 
   # hatch-vcs tries to read the current git commit hash

From fca81862520044fef0ab390ff9a614c0924ae347 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 17 Sep 2026 00:21:44 +0000
Subject: [PATCH 36/53] rusthound-ce: 2.5.9 -> 2.5.13

---
 pkgs/by-name/ru/rusthound-ce/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ru/rusthound-ce/package.nix b/pkgs/by-name/ru/rusthound-ce/package.nix
index d8db4231d6e7..8e747c46d392 100644
--- a/pkgs/by-name/ru/rusthound-ce/package.nix
+++ b/pkgs/by-name/ru/rusthound-ce/package.nix
@@ -10,14 +10,14 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rusthound-ce";
-  version = "2.5.9";
+  version = "2.5.13";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-VJFgUKsmOD0pt2GABeSufWBaE+3zr0q5bv2h7f6opNg=";
+    hash = "sha256-YDW7tL37rKOm+PU98NhtimirVLla40dLx2VGOLfDVho=";
   };
 
-  cargoHash = "sha256-dHJawFfPnU80aocE1oHqdOzX48WgiIz+qknTq9Mt3Ks=";
+  cargoHash = "sha256-5z7VBRua+plcMOf1kY8MxYKPbmKlo4yVEz8WzX6oVWA=";
 
   nativeBuildInputs = [
     pkg-config

From cd1fdc1df90c4bf24bc2399d714b3e7d703c44a3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 16 Sep 2026 14:22:24 -0700
Subject: [PATCH 37/53] nixos/printers: assert that each class contains at
 least one printer or class

---
 nixos/modules/hardware/printers.nix | 25 ++++++++-----------------
 1 file changed, 8 insertions(+), 17 deletions(-)

diff --git a/nixos/modules/hardware/printers.nix b/nixos/modules/hardware/printers.nix
index 1d18a96fb1cd..f24ca2c358f4 100644
--- a/nixos/modules/hardware/printers.nix
+++ b/nixos/modules/hardware/printers.nix
@@ -78,11 +78,6 @@ in
                 config.hardware.printers.ensurePrinters. Specifying a symblic
                 name here that does not match any of those printers is
                 considered a hard error.
-
-                ::: {.warning}
-                Print jobs to this class will quietly fail if there are no
-                printers in this class. CUPS reports them as pending
-                :::
               '';
             };
             classes = mkOption {
@@ -267,7 +262,14 @@ in
           '';
         }
       )
-    ];
+    ]
+    ++ map (class: {
+      assertion = cfg.ensureClasses.${class}.printers != [ ] || cfg.ensureClasses.${class}.classes != [ ];
+      message = ''
+        At least one of the lists `config.hardware.printers.ensureClasses.${class}.printers`
+        and `config.hardware.printers.ensureClasses.${class}.classes` has to be non-empty.
+      '';
+    }) (builtins.attrNames cfg.ensureClasses);
 
     systemd.services.cups = {
       postStart =
@@ -333,17 +335,6 @@ in
             d = cfg.ensureDefaultPrinter;
           })}
 
-          #### CLASS DEFINITIONS ####
-          lpadmin -p _tmp -v file:/dev/null
-          ${lib.concatMapStringsSep "\n" (
-            className:
-            lpadmin {
-              p = "_tmp";
-              c = className;
-            }
-          ) classNames}
-          lpadmin -x _tmp
-
           #### ADDING PRINTERS TO CLASSES ####
           ${lib.concatMapStringsSep "\n" (
             className:

From 5c0edaf955073f9decf7f1600d98e1163188bc42 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 17 Sep 2026 00:43:55 +0000
Subject: [PATCH 38/53] libretro.genesis-plus-gx: 0-unstable-2026-08-28 ->
 0-unstable-2026-09-12

---
 pkgs/by-name/li/libretroPackages/cores/genesis-plus-gx.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/libretroPackages/cores/genesis-plus-gx.nix b/pkgs/by-name/li/libretroPackages/cores/genesis-plus-gx.nix
index 82d2dae72efd..db1b512dc0c7 100644
--- a/pkgs/by-name/li/libretroPackages/cores/genesis-plus-gx.nix
+++ b/pkgs/by-name/li/libretroPackages/cores/genesis-plus-gx.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
   core = "genesis-plus-gx";
-  version = "0-unstable-2026-08-28";
+  version = "0-unstable-2026-09-12";
 
   src = fetchFromGitHub {
     owner = "libretro";
     repo = "Genesis-Plus-GX";
-    rev = "a7985a9c4278ac352f8ca7bb4d3cc6b36e9e3e7d";
-    hash = "sha256-uG4bGYsl4ZisaO7ICg/QdLv6CfV5cB4T56MMpLuu9QQ=";
+    rev = "c2838c7dc4236fc2fe94e5dbd08b41486067918e";
+    hash = "sha256-sqic7mFeuhmW8fPB2WaEE1CJxSxB0pgFzoWX+DPirqM=";
   };
 
   meta = {

From 447ddca1163cc253686a3e4cc3a2facc89ddac1c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 17 Sep 2026 02:00:27 +0000
Subject: [PATCH 39/53] ggml: 0.23.0 -> 0.24.0

---
 pkgs/by-name/gg/ggml/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gg/ggml/package.nix b/pkgs/by-name/gg/ggml/package.nix
index 6b3cbf69a58c..c4fe5307a53d 100644
--- a/pkgs/by-name/gg/ggml/package.nix
+++ b/pkgs/by-name/gg/ggml/package.nix
@@ -7,7 +7,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ggml";
-  version = "0.23.0";
+  version = "0.24.0";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "ggml-org";
     repo = "ggml";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QArqnQ5//Ft9Knm1Caqz68t4ikNQnk+O+OZUTfZlVCk=";
+    hash = "sha256-wSI0GnSFoMyBKuzIrelURzaIaSIS/eIAwG4etmy9XUo=";
   };
 
   # The cmake package does not handle absolute CMAKE_INSTALL_LIBDIR and CMAKE_INSTALL_INCLUDEDIR

From 6b2341231784b39fd8bbaa6e8f951186d4099c2d Mon Sep 17 00:00:00 2001
From: Muhammad Falak R Wani <falakreyaz@gmail.com>
Date: Thu, 17 Sep 2026 07:36:46 +0530
Subject: [PATCH 40/53] dust: 1.2.5 -> 1.2.6

Diff: https://github.com/bootandy/dust/compare/v1.2.5...v1.2.6
Changelog: https://github.com/bootandy/dust/releases/tag/v1.2.6
Signed-off-by: Muhammad Falak R Wani <falakreyaz@gmail.com>
---
 pkgs/by-name/du/dust/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/du/dust/package.nix b/pkgs/by-name/du/dust/package.nix
index f1d80ab9e7e0..63fc5dddf7f8 100644
--- a/pkgs/by-name/du/dust/package.nix
+++ b/pkgs/by-name/du/dust/package.nix
@@ -12,13 +12,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
   # Since then, `dust` has been freed up, allowing this package to take that attribute.
   # However in order for tools like `nix-env` to detect package updates, keep `du-dust` for pname.
   pname = "du-dust";
-  version = "1.2.5";
+  version = "1.2.6";
 
   src = fetchFromGitHub {
     owner = "bootandy";
     repo = "dust";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tK7cAckvRmWcaDTd92+XccswKHLAr4r8IzYYzcZYu/g=";
+    hash = "sha256-BHlasERvwS/mr6EUfgItvrL/oozFta4/XwwI3hYyMGo=";
     # Remove unicode file names which leads to different checksums on HFS+
     # vs. other filesystems because of unicode normalisation.
     postFetch = ''
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     '';
   };
 
-  cargoHash = "sha256-KQPCRQLTmltoJTgbA3ri5U/w+JJb/J+iclK7Mcb4hfU=";
+  cargoHash = "sha256-oIR10K/vn9sexW+m9vOuGJDqXRk2gjB0WoPj71cT+eg=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From 3974bcd925eff72f88bfe006b6dcf25c8ec01115 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 17 Sep 2026 02:34:49 +0000
Subject: [PATCH 41/53] src-cli: 7.6.0 -> 8.0.0

---
 pkgs/by-name/sr/src-cli/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sr/src-cli/package.nix b/pkgs/by-name/sr/src-cli/package.nix
index 6799f0f663dc..dd1240523e25 100644
--- a/pkgs/by-name/sr/src-cli/package.nix
+++ b/pkgs/by-name/sr/src-cli/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule rec {
   pname = "src-cli";
-  version = "7.6.0";
+  version = "8.0.0";
 
   src = fetchFromGitHub {
     owner = "sourcegraph";
     repo = "src-cli";
     rev = version;
-    hash = "sha256-a6F4r5pVJvkQUyUpmqwjyQKfU3KAx9S61+0hnodqlHk=";
+    hash = "sha256-22UlYQxxtInPYgj4rsu07MvusjoW4BoqCW6fbgwQ9Lc=";
   };
 
   vendorHash = "sha256-+phJFHid2ytXeLrvGMGTXplDAcN9YEDhRrO9ax/d8R8=";

From 662aa62411e99df042624eaf58410a79ff905e08 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 17 Sep 2026 04:55:00 +0000
Subject: [PATCH 42/53] ocamlPackages.ocaml-version: 4.1.2 -> 4.1.4

---
 pkgs/development/ocaml-modules/ocaml-version/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/ocaml-modules/ocaml-version/default.nix b/pkgs/development/ocaml-modules/ocaml-version/default.nix
index 323894c0e9eb..25373a90c918 100644
--- a/pkgs/development/ocaml-modules/ocaml-version/default.nix
+++ b/pkgs/development/ocaml-modules/ocaml-version/default.nix
@@ -7,11 +7,11 @@
 
 buildDunePackage (finalAttrs: {
   pname = "ocaml-version";
-  version = "4.1.2";
+  version = "4.1.4";
 
   src = fetchurl {
     url = "https://github.com/ocurrent/ocaml-version/releases/download/v${finalAttrs.version}/ocaml-version-${finalAttrs.version}.tbz";
-    hash = "sha256-+NqijIAmedHTU9/5ZfZojwr0vQZ0onS6lBWIrnBqPAc=";
+    hash = "sha256-Iiik1STIuLd1639h99JE64H/2sowC3jCnY/drKWkPbI=";
   };
 
   checkInputs = [ alcotest ];

From d4e27aed768d6c7797cdb530591b30ef92cf5d73 Mon Sep 17 00:00:00 2001
From: Marek Fajkus <marek.faj@gmail.com>
Date: Wed, 16 Sep 2026 10:12:12 +0200
Subject: [PATCH 43/53] elmPackages.elm-analyse: drop package

---
 pkgs/development/compilers/elm/default.nix    |   3 +-
 .../elm/packages/elm-analyse/default.nix      |  58 -------
 .../elm/packages/elm-analyse/elm-srcs.nix     | 152 ------------------
 .../elm/packages/elm-analyse/registry.dat     | Bin 887 -> 0 bytes
 .../elm/packages/elm-analyse/update.sh        |  17 --
 5 files changed, 1 insertion(+), 229 deletions(-)
 delete mode 100644 pkgs/development/compilers/elm/packages/elm-analyse/default.nix
 delete mode 100644 pkgs/development/compilers/elm/packages/elm-analyse/elm-srcs.nix
 delete mode 100644 pkgs/development/compilers/elm/packages/elm-analyse/registry.dat
 delete mode 100755 pkgs/development/compilers/elm/packages/elm-analyse/update.sh

diff --git a/pkgs/development/compilers/elm/default.nix b/pkgs/development/compilers/elm/default.nix
index 6bfc64302fa4..9c07aa4261de 100644
--- a/pkgs/development/compilers/elm/default.nix
+++ b/pkgs/development/compilers/elm/default.nix
@@ -35,8 +35,6 @@ lib.makeScope pkgs.newScope (
         inherit (self) elm;
       };
 
-      elm-analyse = callPackage ./packages/elm-analyse { };
-
       elm-doc-preview = callPackage ./packages/elm-doc-preview { };
 
       elm-git-install = callPackage ./packages/elm-git-install { };
@@ -70,6 +68,7 @@ lib.makeScope pkgs.newScope (
       elm-wrap = callPackage ./packages/elm-wrap { };
     }
     // lib.optionalAttrs config.allowAliases {
+      elm-analyse = throw "elmPackages.elm-analyse has not be released since May 2019 so it has been removed."; # Added 2026-09-16
       create-elm-app = throw "'elmPackages.create-elm-app' has not had a release since December 2020, so it was removed."; # Added 2025-11-15
       elm-pages = throw "'elmPackages.elm-pages' has been removed, as it was broken in nixpkgs and was not maintained."; # Added 2025-11-15
     }
diff --git a/pkgs/development/compilers/elm/packages/elm-analyse/default.nix b/pkgs/development/compilers/elm/packages/elm-analyse/default.nix
deleted file mode 100644
index 6f8a5376b9bc..000000000000
--- a/pkgs/development/compilers/elm/packages/elm-analyse/default.nix
+++ /dev/null
@@ -1,58 +0,0 @@
-{
-  lib,
-  buildNpmPackage,
-  fetchFromGitHub,
-  elmPackages,
-}:
-
-buildNpmPackage (finalAttrs: {
-  pname = "elm-analyse";
-  version = "0.16.5";
-
-  src = fetchFromGitHub {
-    owner = "stil4m";
-    repo = "elm-analyse";
-    tag = finalAttrs.version;
-    hash = "sha256-GFHhHf+JOXGcm0CZEDGMuuTR3CXBdSkYDGRHZ63pE64=";
-  };
-
-  npmDepsHash = "sha256-B/PzGOaxdKSt82ax0izeadsMsz+I0v4wkye3zgNxMF8=";
-
-  npmFlags = [ "--ignore-scripts" ];
-
-  nativeBuildInputs = [
-    elmPackages.elm
-  ];
-
-  postConfigure =
-    (elmPackages.fetchElmDeps {
-      elmPackages = import ./elm-srcs.nix;
-      elmVersion = elmPackages.elm.version;
-      registryDat = ./registry.dat;
-    })
-    + ''
-      ln -sf ${lib.getExe elmPackages.elm} node_modules/.bin/elm
-    '';
-
-  buildPhase = ''
-    runHook preBuild
-
-    make
-
-    runHook postBuild
-  '';
-
-  postInstall = ''
-    rm -rf $out/lib/node_modules/elm-analyse/node_modules/.bin/
-  '';
-
-  passthru.updateScript = ./update.sh;
-
-  meta = {
-    description = "Analyse your Elm code, identify deficiencies and apply best practices";
-    homepage = "https://stil4m.github.io/elm-analyse/";
-    license = lib.licenses.mit;
-    maintainers = [ ];
-    mainProgram = "elm-analyse";
-  };
-})
diff --git a/pkgs/development/compilers/elm/packages/elm-analyse/elm-srcs.nix b/pkgs/development/compilers/elm/packages/elm-analyse/elm-srcs.nix
deleted file mode 100644
index 2d7cbc52f144..000000000000
--- a/pkgs/development/compilers/elm/packages/elm-analyse/elm-srcs.nix
+++ /dev/null
@@ -1,152 +0,0 @@
-{
-
-  "alex-tan/elm-dialog" = {
-    sha256 = "13dfpzrdi69jaj0hj2cnwg3g6wafhszg0grjw4z3imd0b9avz1hk";
-    version = "1.0.0";
-  };
-
-  "elm-community/dict-extra" = {
-    sha256 = "05ll04wf03m8ic109dz2dbq6pah23m70c4wwyr35026dhmws35n0";
-    version = "2.4.0";
-  };
-
-  "elm-community/graph" = {
-    sha256 = "1rwsq2126q0rb4vmy95ajxfm3m063d6lw0p90d510nzcrbm9bxbc";
-    version = "6.0.0";
-  };
-
-  "elm-community/intdict" = {
-    sha256 = "09i1fk63gp6sr6kc6ccs8g0kxvqhw5czghi9cl8flizanrgcmva1";
-    version = "3.0.0";
-  };
-
-  "elm-community/list-extra" = {
-    sha256 = "06ddwrc0ai0pn5mw99a1d9xnihkliyvq0qvzn32z1l88msflrib7";
-    version = "8.2.2";
-  };
-
-  "elm-community/maybe-extra" = {
-    sha256 = "10jykkdmqpvhbcm50867a894272j4z6jc9r5jy35cz8jfi9j8xv9";
-    version = "5.0.0";
-  };
-
-  "elm-explorations/markdown" = {
-    sha256 = "0k3110ixa4wwf3vkkdplagwah9ypr965qxr1y147rnsc1xsxmr6y";
-    version = "1.0.0";
-  };
-
-  "elm/browser" = {
-    sha256 = "1zlmx672glg7fdgkvh5jm47y85pv7pdfr5mkhg6x7ar6k000vyka";
-    version = "1.0.1";
-  };
-
-  "elm/core" = {
-    sha256 = "1l0qdbczw91kzz8sx5d5zwz9x662bspy7p21dsr3f2rigxiix2as";
-    version = "1.0.2";
-  };
-
-  "elm/html" = {
-    sha256 = "1n3gpzmpqqdsldys4ipgyl1zacn0kbpc3g4v3hdpiyfjlgh8bf3k";
-    version = "1.0.0";
-  };
-
-  "elm/http" = {
-    sha256 = "1igmm89ialzrjib1j8xagkxalq1x2gj4l0hfxcd66mpwmvg7psl8";
-    version = "1.0.0";
-  };
-
-  "elm/json" = {
-    sha256 = "0kjwrz195z84kwywaxhhlnpl3p251qlbm5iz6byd6jky2crmyqyh";
-    version = "1.1.3";
-  };
-
-  "elm/parser" = {
-    sha256 = "0a3cxrvbm7mwg9ykynhp7vjid58zsw03r63qxipxp3z09qks7512";
-    version = "1.1.0";
-  };
-
-  "elm/project-metadata-utils" = {
-    sha256 = "1d4rd4grrnbdvj9gf00h7dr6hbkjzawgkzpizfrkp1z1pyr3mvq9";
-    version = "1.0.0";
-  };
-
-  "elm/regex" = {
-    sha256 = "0lijsp50w7n1n57mjg6clpn9phly8vvs07h0qh2rqcs0f1jqvsa2";
-    version = "1.0.0";
-  };
-
-  "elm/time" = {
-    sha256 = "0vch7i86vn0x8b850w1p69vplll1bnbkp8s383z7pinyg94cm2z1";
-    version = "1.0.0";
-  };
-
-  "elm/url" = {
-    sha256 = "0av8x5syid40sgpl5vd7pry2rq0q4pga28b4yykn9gd9v12rs3l4";
-    version = "1.0.0";
-  };
-
-  "krisajenkins/remotedata" = {
-    sha256 = "0sjrgpsy4aci0h6qndqx70cnfd065hlkh1rxk0lc93z22sdj4knl";
-    version = "5.0.0";
-  };
-
-  "rundis/elm-bootstrap" = {
-    sha256 = "155rqa2hh9h5s0ryqv4pn40vwl2klk3zg8b2xf48z5ky8fdrr31c";
-    version = "5.2.0";
-  };
-
-  "stil4m/elm-syntax" = {
-    sha256 = "182fz12a115j3wz3fkc209mq8rbbqmvl237pmrvygmvbxwv4ix37";
-    version = "7.1.1";
-  };
-
-  "avh4/elm-color" = {
-    sha256 = "0n16wnvp87x9az3m5qjrl6smsg7051m719xn5d244painx8xmpzq";
-    version = "1.0.0";
-  };
-
-  "avh4/elm-fifo" = {
-    sha256 = "1ka0iz2psr75h4qz7hh5z1prclah1nais9aaycaxapfd7inqmrrc";
-    version = "1.0.4";
-  };
-
-  "elm-community/json-extra" = {
-    sha256 = "0hwlhdlvd5xi866m9bpnabcg2qrgcvfj34p1x1mhx85ymr3gv9mv";
-    version = "4.2.0";
-  };
-
-  "elm/virtual-dom" = {
-    sha256 = "0q1v5gi4g336bzz1lgwpn5b1639lrn63d8y6k6pimcyismp2i1yg";
-    version = "1.0.2";
-  };
-
-  "etaque/elm-response" = {
-    sha256 = "0vydmczvlxkvbjsjpfwad5m77y3155dp8wx648xf1ya3vsy4m5kf";
-    version = "3.1.0";
-  };
-
-  "rtfeldman/elm-hex" = {
-    sha256 = "1y0aa16asvwdqmgbskh5iba6psp43lkcjjw9mgzj3gsrg33lp00d";
-    version = "1.0.0";
-  };
-
-  "rtfeldman/elm-iso8601-date-strings" = {
-    sha256 = "1fa5sslklldy0dq8bm0zdkb9ni50yxhb09xb6lgk00x55bmza9ik";
-    version = "1.1.3";
-  };
-
-  "stil4m/structured-writer" = {
-    sha256 = "0xr95m8k42vwyff91vfd4q59fhnmhywyj20nzxqhl7blk82hnwj0";
-    version = "1.0.2";
-  };
-
-  "elm-explorations/test" = {
-    sha256 = "1fsd7bajm7qa93r5pn3mdafqh3blpzya601jbs9l238p0hmvh576";
-    version = "1.2.2";
-  };
-
-  "elm/random" = {
-    sha256 = "138n2455wdjwa657w6sjq18wx2r0k60ibpc4frhbqr50sncxrfdl";
-    version = "1.0.0";
-  };
-}
diff --git a/pkgs/development/compilers/elm/packages/elm-analyse/registry.dat b/pkgs/development/compilers/elm/packages/elm-analyse/registry.dat
deleted file mode 100644
index ff41075cf05baeac0d56fce1e7c16166493c6f85..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 887
zcmZWo+it=z3{9bw+a_%<)1LT)N}GhH{f?og4dl`}E|kAtQdnBLyhQRjK0bCFA-c1<
zU1GBUg>BAYR;YAdNKm#+?x4R?I9J<cfc92d8Y7E<9OS_!BK=F6`q+F&_Ttd<V@3$4
zdrO#z$&i{>tW{(Q(eWzgdK^1CYm#I-%*|?`P^G7a?6;ci5%-*HWGH|kZ&)hVle!ui
zfhnvWMQ4O1wxeLmQhVF+gd)?1#;(_AN!)<SJK5OevuFG1Y26sf*Ht0CGi;e)5=SN;
zIkS?WuCiEf1ka`6pb|$RMub%u)vZPvZHzfey1S3XB$6I|tTkMBcoUlSZeBt|*w%g@
zfTcBVp@B|?y_ms_{*h8f$4Or*^N;h>;8PGIbhX#PX)o|}BI)3W<|K_<5o*gA-g4k$
zNqj(6XfX32Qa!v|555ObI{W?g@tJ!G%pH?7r5h|$MvW<?>)PL0%bo%CERIEF&Tr6G
ecYnlP4MRKcm+lU}`lM#h4PlXANOIWzsPGH?62-&-

diff --git a/pkgs/development/compilers/elm/packages/elm-analyse/update.sh b/pkgs/development/compilers/elm/packages/elm-analyse/update.sh
deleted file mode 100755
index 2bc827f3c5ca..000000000000
--- a/pkgs/development/compilers/elm/packages/elm-analyse/update.sh
+++ /dev/null
@@ -1,17 +0,0 @@
-#!/usr/bin/env nix-shell
-#! nix-shell -i bash -p nix-update elm2nix nixfmt
-
-set -eu -o pipefail
-
-PACKAGE_DIR=$(realpath "$(dirname "$0")")
-
-# Update version, src and npm deps
-nix-update "$UPDATE_NIX_ATTR_PATH"
-
-# Update elm deps
-cp "$(nix-build -A "$UPDATE_NIX_ATTR_PATH".src)/elm.json" elm.json
-trap 'rm -rf elm.json registry.dat &> /dev/null' EXIT
-elm2nix convert >"$PACKAGE_DIR/elm-srcs.nix"
-nixfmt "$PACKAGE_DIR/elm-srcs.nix"
-elm2nix snapshot
-cp registry.dat "$PACKAGE_DIR/registry.dat"

From 8bb8c426db17fe66550f3be88c54901fe9a2320f Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Thu, 17 Sep 2026 06:51:06 +0000
Subject: [PATCH 44/53] uutils-coreutils: 0.11.0 -> 0.12.0

Diff: https://github.com/uutils/coreutils/compare/0.11.0...0.12.0

Changelog: https://github.com/uutils/coreutils/releases/tag/0.12.0
---
 pkgs/by-name/uu/uutils-coreutils/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/uu/uutils-coreutils/package.nix b/pkgs/by-name/uu/uutils-coreutils/package.nix
index 13da77cf7c21..41a7573ef6a0 100644
--- a/pkgs/by-name/uu/uutils-coreutils/package.nix
+++ b/pkgs/by-name/uu/uutils-coreutils/package.nix
@@ -19,14 +19,14 @@ assert selinuxSupport -> lib.meta.availableOn stdenv.hostPlatform libselinux;
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "uutils-coreutils";
-  version = "0.11.0";
+  version = "0.12.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "uutils";
     repo = "coreutils";
     tag = finalAttrs.version;
-    hash = "sha256-ghOUqC5U7L16k7mFxtgNeQssA/OU9MJ6fIK2G17QrhI=";
+    hash = "sha256-/Zi7/vh8hwniMxa+keYjW7KBeq3Xg2rqDlqyN2GOZN4=";
   };
 
   # error: linker `aarch64-linux-gnu-gcc` not found
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname src version;
-    hash = "sha256-b9J6BnwnM/4I5xUkkUPTPzTVfDQ+Cfc7KqTLuZpFvu0=";
+    hash = "sha256-aLnQOXiQD9IL6ZiBi/ENF0aHud0kCyHZrnetkV+ZTFE=";
   };
 
   buildInputs = lib.optionals selinuxSupport [

From 8c7d584fe6283cba7952b2c430781459e5f4ddbf Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 17 Sep 2026 07:30:16 +0000
Subject: [PATCH 45/53] exa-agent-skills: 2026.09.11-e7de871 ->
 2026.09.16-73cc4b0

---
 pkgs/by-name/ex/exa-agent-skills/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ex/exa-agent-skills/package.nix b/pkgs/by-name/ex/exa-agent-skills/package.nix
index 1effed515d47..4638ff04b437 100644
--- a/pkgs/by-name/ex/exa-agent-skills/package.nix
+++ b/pkgs/by-name/ex/exa-agent-skills/package.nix
@@ -7,7 +7,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "exa-agent-skills";
-  version = "2026.09.11-e7de871";
+  version = "2026.09.16-73cc4b0";
 
   strictDeps = true;
   __structuredAttrs = true;
@@ -16,7 +16,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     owner = "exa-labs";
     repo = "agent-skills";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-v8iHcDvKe7Ls1P7V0izJneyo3vYyW4dSzgUdmWeAP7o=";
+    hash = "sha256-cQMUDaHTHgwMjq1P6pMdulhADNAO78S+9WuyA7kssrg=";
   };
 
   nativeBuildInputs = [ installAgentSkills ];

From 65b0971f90310799db192e72d29713a008514d77 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 17 Sep 2026 07:42:00 +0000
Subject: [PATCH 46/53] terraform-providers.hashicorp_tfe: 0.80.0 -> 0.81.0

---
 .../networking/cluster/terraform-providers/providers.json   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index 01f304b09b5b..e1bd78ab184a 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -670,13 +670,13 @@
     "vendorHash": "sha256-CwTlb0QTq0lpZK90IL6mBLoarFYFLsjiLYauGEaR1Rk="
   },
   "hashicorp_tfe": {
-    "hash": "sha256-0cDJS89LsTuE2MJoNCnG8Xy7pJYisOggKrqQlK4OeAw=",
+    "hash": "sha256-gEzX7Q/8OMNb3jOf7E9bph6qactFdZHmITr1l/I9kSc=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/tfe",
     "owner": "hashicorp",
     "repo": "terraform-provider-tfe",
-    "rev": "v0.80.0",
+    "rev": "v0.81.0",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-O+UMVIed8JEwjaXGTewOY6Vk+MopCQSx+qyMvJW7bkI="
+    "vendorHash": "sha256-hfSLa5MrrQ0JFZntykbU33TQnuAoYYFasOzUOzi1RV8="
   },
   "hashicorp_time": {
     "hash": "sha256-kdCdph+H3fWizMh+7AGBEscKpCwP7naj+3NSmPK25Us=",

From 4f520099ae52bfaa69faaf8453b90607f86bdf84 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Thu, 17 Sep 2026 07:13:15 +0000
Subject: [PATCH 47/53] python3Packages.borb_2: init at 2.1.25

Co-authored-by: Samuel Ainsworth <skainsworth@gmail.com>
---
 pkgs/development/python-modules/borb/2.nix | 57 ++++++++++++++++++++++
 pkgs/top-level/python-packages.nix         |  2 +
 2 files changed, 59 insertions(+)
 create mode 100644 pkgs/development/python-modules/borb/2.nix

diff --git a/pkgs/development/python-modules/borb/2.nix b/pkgs/development/python-modules/borb/2.nix
new file mode 100644
index 000000000000..01a6d8a218eb
--- /dev/null
+++ b/pkgs/development/python-modules/borb/2.nix
@@ -0,0 +1,57 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  cryptography,
+  fonttools,
+  lxml,
+  pillow,
+  python-barcode,
+  qrcode,
+  requests,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "borb";
+  version = "2.1.25";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchPypi {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-gTolInuW9HHSkkS/PAens9821h1ivL7PRbFJRLgBHvQ=";
+  };
+
+  build-system = [ setuptools ];
+
+  dependencies = [
+    cryptography
+    fonttools
+    lxml
+    pillow
+    python-barcode
+    qrcode
+    requests
+  ];
+
+  # Tests are not included in the PyPI source distribution.
+  doCheck = false;
+
+  pythonImportsCheck = [
+    "borb.pdf"
+    "borb.pdf.canvas.layout.table.fixed_column_width_table"
+  ];
+
+  meta = {
+    description = "Library for reading, creating and manipulating PDF files";
+    homepage = "https://borbpdf.com/";
+    changelog = "https://github.com/jorisschellekens/borb/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.agpl3Plus;
+    maintainers = [ lib.maintainers.samuela ];
+  };
+})
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index ad1c1a89e21d..544c16a329cc 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -2602,6 +2602,8 @@ self: super: with self; {
 
   borb = callPackage ../development/python-modules/borb { };
 
+  borb_2 = callPackage ../development/python-modules/borb/2.nix { };
+
   bork = callPackage ../development/python-modules/bork { };
 
   bosch-alarm-mode2 = callPackage ../development/python-modules/bosch-alarm-mode2 { };

From b7b20140c23442e319603e5ab37c1a710018b77c Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Thu, 17 Sep 2026 07:14:15 +0000
Subject: [PATCH 48/53] vastai: init at 1.5.6

Co-authored-by: Samuel Ainsworth <skainsworth@gmail.com>
---
 pkgs/by-name/va/vastai/package.nix | 156 +++++++++++++++++++++++++++++
 1 file changed, 156 insertions(+)
 create mode 100644 pkgs/by-name/va/vastai/package.nix

diff --git a/pkgs/by-name/va/vastai/package.nix b/pkgs/by-name/va/vastai/package.nix
new file mode 100644
index 000000000000..5719427d8cc7
--- /dev/null
+++ b/pkgs/by-name/va/vastai/package.nix
@@ -0,0 +1,156 @@
+{
+  lib,
+  python3Packages,
+  fetchFromGitHub,
+  fetchpatch2,
+
+  # wrapper
+  openssh,
+  rsync,
+
+  # tests
+  versionCheckHook,
+  writableTmpDirAsHomeHook,
+
+  # passthru
+  nix-update-script,
+}:
+
+python3Packages.buildPythonApplication (finalAttrs: {
+  pname = "vastai";
+  version = "1.5.6";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "vast-ai";
+    repo = "vast-cli";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ovxFLPBPHJi/DMauS0Yuk9HWfcS+K/gJTAwPf/MLdoA=";
+  };
+
+  patches = [
+    (fetchpatch2 {
+      # Upstream credential hardening: https://github.com/vast-ai/vast-cli/pull/505
+      url = "https://github.com/vast-ai/vast-cli/commit/0889fe32e5bf3228074436dd9688f6a1fdc649e8.patch";
+      hash = "sha256-g3Nje1M1SnXK3eJ26XE13+/Wdg0pv63AKU5wbgZacMM=";
+    })
+  ];
+
+  # distutils was removed from Python 3.12. Use setuptools' maintained copy.
+  # The borb 2.x Document class lives in the document submodule.
+  postPatch = ''
+    substituteInPlace vastai/serverless/server/lib/backend.py \
+      --replace-fail \
+        "from distutils.util import strtobool" \
+        "from setuptools._distutils.util import strtobool"
+
+    substituteInPlace vastai/pdf/vast_pdf.py \
+      --replace-fail \
+        "from borb.pdf.document import Document" \
+        "from borb.pdf.document.document import Document"
+  '';
+
+  build-system = with python3Packages; [
+    poetry-core
+    poetry-dynamic-versioning
+  ];
+
+  pythonRelaxDeps = [
+    "cryptography"
+    "pillow"
+    "pycares"
+  ];
+  dependencies = with python3Packages; [
+    aiodns
+    aiohttp
+    anyio
+    argcomplete
+    borb_2
+    cryptography
+    curlify
+    pillow
+    psutil
+    pycares
+    pycryptodome
+    pyparsing
+    python-dateutil
+    requests
+    rich
+    setuptools
+    typing-extensions
+    urllib3
+    xdg
+  ];
+
+  makeWrapperArgs = [
+    "--prefix"
+    "PATH"
+    ":"
+    (lib.makeBinPath [
+      openssh
+      rsync
+    ])
+    "--set-default"
+    "VASTAI_NO_UPDATE_CHECK"
+    "1"
+  ];
+
+  pythonImportsCheck = [
+    "vastai"
+    "vastai.cli.main"
+    "vastai.pdf.vast_pdf"
+    "vastai.serverless.remote.serve_deployment"
+    "vastai_sdk"
+  ];
+
+  nativeCheckInputs = [
+    versionCheckHook
+    writableTmpDirAsHomeHook
+  ]
+  ++ (with python3Packages; [
+    pyopenssl
+    pytest-asyncio
+    pytestCheckHook
+  ]);
+  versionCheckProgramArg = "--version";
+  versionCheckKeepEnvironment = [ "HOME" ];
+
+  enabledTestPaths = [ "tests" ];
+  disabledTestMarks = [
+    "integration"
+    "live"
+  ];
+  disabledTests = [
+    # These tests target a removed `compress` argument; 1.5.6 always creates
+    # gzip-compressed deployment archives.
+    "test_contains_config_json"
+    "test_module_becomes_deployment_py"
+    "test_package_becomes_deployment_dir"
+    "test_extra_files_absolute_dest_paths"
+    "test_extra_files_relative_dest_paths"
+    "test_compressed_tarball_is_valid"
+    "test_uncompressed_tarball_is_valid"
+    "test_tar_extract_module_deployment"
+    "test_tar_extract_package_deployment"
+    "test_tar_extract_absolute_extra_files"
+    "test_tar_extract_relative_extra_files"
+    "test_tar_extract_compressed"
+  ];
+
+  postCheck = ''
+    $out/bin/vastai --help >/dev/null
+    test -x $out/bin/serve-vast-deployment
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "CLI and SDK for the Vast.ai GPU cloud service";
+    homepage = "https://vast.ai/";
+    changelog = "https://github.com/vast-ai/vast-cli/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.samuela ];
+    mainProgram = "vastai";
+  };
+})

From eee3c9e4d7bc75520ac204f02ec8762633bd75b6 Mon Sep 17 00:00:00 2001
From: Marek Fajkus <marek.faj@gmail.com>
Date: Tue, 15 Sep 2026 16:24:30 +0200
Subject: [PATCH 49/53] elmPackages.elm-verify-examples: fix build with 0.19.2

use more recent upstream commit that implements support for elm 0.19.2
---
 .../elm/packages/elm-verify-examples/default.nix         | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/compilers/elm/packages/elm-verify-examples/default.nix b/pkgs/development/compilers/elm/packages/elm-verify-examples/default.nix
index 5a25df2e6cf7..4952acad516d 100644
--- a/pkgs/development/compilers/elm/packages/elm-verify-examples/default.nix
+++ b/pkgs/development/compilers/elm/packages/elm-verify-examples/default.nix
@@ -3,6 +3,7 @@
   buildNpmPackage,
   fetchFromGitHub,
   elmPackages,
+  fetchpatch,
 }:
 
 buildNpmPackage (finalAttrs: {
@@ -12,11 +13,13 @@ buildNpmPackage (finalAttrs: {
   src = fetchFromGitHub {
     owner = "stoeffel";
     repo = "elm-verify-examples";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-HUmIrwmJyGvkCRHRiA069Aj25WBIGtJ7DJxwwF6OvWU=";
+    # Using more recent commit to fix elm 0.19.2 support
+    # tag = "v${finalAttrs.version}";
+    rev = "63b84eca9642f6d0de37d6e35e0d8bc6edca19c6";
+    hash = "sha256-tZ/XT/gZKu8iDmJPxYlLXCRCeOs7ZZiqWpYcyScfqVg=";
   };
 
-  npmDepsHash = "sha256-frNCo97GOwiClzQwRXHpqqjimJrmipsBebAshJqGZco=";
+  npmDepsHash = "sha256-Puz7AVXaUy/7wflTcqbrQhTwSeeiG3jkfXYJ7NXhXQ0=";
 
   nativeBuildInputs = [
     elmPackages.elm

From d294ad3f8dd4296e3f09580e1faaf6f034f25e5e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E5=A4=9C=E5=9D=82=E9=9B=85?=
 <23130178+ShadowRZ@users.noreply.github.com>
Date: Thu, 17 Sep 2026 17:26:55 +0800
Subject: [PATCH 50/53] keeweb: drop

---
 pkgs/by-name/ke/keeweb/package.nix | 135 -----------------------------
 pkgs/top-level/aliases.nix         |   1 +
 2 files changed, 1 insertion(+), 135 deletions(-)
 delete mode 100644 pkgs/by-name/ke/keeweb/package.nix

diff --git a/pkgs/by-name/ke/keeweb/package.nix b/pkgs/by-name/ke/keeweb/package.nix
deleted file mode 100644
index 81a5e2511523..000000000000
--- a/pkgs/by-name/ke/keeweb/package.nix
+++ /dev/null
@@ -1,135 +0,0 @@
-{
-  lib,
-  libGL,
-  stdenv,
-  fetchurl,
-  undmg,
-  dpkg,
-  autoPatchelfHook,
-  wrapGAppsHook3,
-  alsa-lib,
-  at-spi2-atk,
-  gdk-pixbuf,
-  nss,
-  udev,
-  gnome-keyring,
-  libgbm,
-  gtk3,
-  libusb1,
-  libsecret,
-  libappindicator,
-  xdotool,
-  libx11,
-  libxcomposite,
-  libxext,
-  libxrandr,
-  libxscrnsaver,
-  libxtst,
-  libxshmfence,
-}:
-let
-  pname = "keeweb";
-  version = "1.18.7";
-
-  srcs = {
-    x86_64-linux = fetchurl {
-      url = "https://github.com/keeweb/keeweb/releases/download/v${version}/KeeWeb-${version}.linux.x64.deb";
-      hash = "sha256-/U+vn5TLIU9/J6cRFjuAdyGzlwC04mp4L2X2ETp+ZSE=";
-    };
-    aarch64-darwin = fetchurl {
-      url = "https://github.com/keeweb/keeweb/releases/download/v${version}/KeeWeb-${version}.mac.arm64.dmg";
-      hash = "sha256-bkhwsWYLkec16vMOfXUce7jfrmI9W2xHiZvU1asebK4=";
-    };
-  };
-  src =
-    srcs.${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-
-  libraries = [
-    alsa-lib
-    at-spi2-atk
-    gdk-pixbuf
-    libGL
-    nss
-    udev
-    libx11
-    libxcomposite
-    libxext
-    libxrandr
-    libxscrnsaver
-    libxtst
-    libxshmfence
-    gnome-keyring
-    libgbm
-    gtk3
-    libusb1
-    libsecret
-    libappindicator
-    xdotool
-  ];
-
-  meta = {
-    description = "Free cross-platform password manager compatible with KeePass";
-    mainProgram = "keeweb";
-    homepage = "https://keeweb.info/";
-    changelog = "https://github.com/keeweb/keeweb/blob/v${version}/release-notes.md";
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ sikmir ];
-    platforms = builtins.attrNames srcs;
-    knownVulnerabilities = [
-      "Uses Electron 12, EOL on November 16 2012. Has many known CVEs"
-    ];
-  };
-in
-if stdenv.hostPlatform.isDarwin then
-  stdenv.mkDerivation {
-    inherit
-      pname
-      version
-      src
-      meta
-      ;
-
-    nativeBuildInputs = [ undmg ];
-
-    sourceRoot = ".";
-
-    installPhase = ''
-      mkdir -p $out/Applications
-      cp -r *.app $out/Applications
-    '';
-  }
-else
-  stdenv.mkDerivation {
-    inherit
-      pname
-      version
-      src
-      meta
-      ;
-
-    nativeBuildInputs = [
-      autoPatchelfHook
-      wrapGAppsHook3
-      dpkg
-    ];
-
-    buildInputs = libraries;
-
-    installPhase = ''
-      runHook preInstall
-
-      mkdir -p $out/bin
-      cp -r usr/share $out/share
-
-      runHook postInstall
-    '';
-
-    postFixup = ''
-      makeWrapper $out/share/keeweb-desktop/keeweb $out/bin/keeweb \
-        --argv0 "keeweb" \
-        --add-flags "$out/share/keeweb-desktop/resources/app.asar" \
-        --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath libraries}" \
-        ''${gappsWrapperArgs[@]}
-    '';
-  }
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 10043dd8b5d0..f6a1f7348b8b 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1263,6 +1263,7 @@ mapAliases {
   kdesvn = throw "'kdesvn' has been removed due to outdated KF5 dependencies."; # Added 2026-05-01
   keepkey-agent = throw "keepkey-agent has been removed because upstream dropped KeepKey support"; # Added 2026-03-11
   keepkey_agent = throw "keepkey-agent has been removed because upstream dropped KeepKey support"; # Added 2026-03-11
+  keeweb = throw "'keeweb' has been removed because it was using an EOL electron version"; # Added 2026-09-17
   keydb = throw "'keydb' has been removed as it was broken, vulnerable, and unmaintained upstream"; # Added 2025-11-08
   kgraphviewer = throw "'kgraphviewer' has been removed due to outdated KF5 dependencies."; # Added 2026-05-01
   kgx = throw "'kgx' has been renamed to/replaced by 'gnome-console'"; # Converted to throw 2025-10-27

From 381239a90d16a7827cd60289c0152b8c346bcf94 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Thu, 17 Sep 2026 20:14:06 +1000
Subject: [PATCH 51/53] nix-eval-jobs: 2.35.3 -> 2.35.4

Diff: https://github.com/NixOS/nix-eval-jobs/compare/v2.35.3...v2.35.4
---
 pkgs/tools/package-management/nix-eval-jobs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/tools/package-management/nix-eval-jobs/default.nix b/pkgs/tools/package-management/nix-eval-jobs/default.nix
index 46c271efe841..364f4824e2a1 100644
--- a/pkgs/tools/package-management/nix-eval-jobs/default.nix
+++ b/pkgs/tools/package-management/nix-eval-jobs/default.nix
@@ -13,13 +13,13 @@
 }:
 stdenv.mkDerivation rec {
   pname = "nix-eval-jobs";
-  version = "2.35.3";
+  version = "2.35.4";
 
   src = fetchFromGitHub {
     owner = "NixOS";
     repo = "nix-eval-jobs";
     tag = "v${version}";
-    hash = "sha256-Ig1h/+qL5sj60fWiy44kQkXjapuff7vJXC9N0Ak8EkY=";
+    hash = "sha256-t1FbcjvTWQ1WO3hJNKN+viNXuz4BX9Pte5K4F+IJLDk=";
   };
 
   buildInputs = [

From ab8c88ee743314c5c748c59aa001e7e00e3d6581 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Thu, 17 Sep 2026 10:59:49 +0000
Subject: [PATCH 52/53] nix-eval-jobs: modernize

---
 pkgs/tools/package-management/nix-eval-jobs/default.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/package-management/nix-eval-jobs/default.nix b/pkgs/tools/package-management/nix-eval-jobs/default.nix
index 364f4824e2a1..06f532992b1d 100644
--- a/pkgs/tools/package-management/nix-eval-jobs/default.nix
+++ b/pkgs/tools/package-management/nix-eval-jobs/default.nix
@@ -11,14 +11,17 @@
   stdenv,
   nixComponents,
 }:
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "nix-eval-jobs";
   version = "2.35.4";
 
+  __structuredAttrs = true;
+  strictDeps = true;
+
   src = fetchFromGitHub {
     owner = "NixOS";
     repo = "nix-eval-jobs";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-t1FbcjvTWQ1WO3hJNKN+viNXuz4BX9Pte5K4F+IJLDk=";
   };
 
@@ -66,4 +69,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.unix;
     mainProgram = "nix-eval-jobs";
   };
-}
+})

From 9e0f3c11077cc2dfa5255a8ce4db59bd9e208dc8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 17 Sep 2026 11:32:00 +0000
Subject: [PATCH 53/53] radicle-explorer: 0-unstable-2026-09-03 ->
 0-unstable-2026-09-14

---
 pkgs/by-name/ra/radicle-explorer/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ra/radicle-explorer/package.nix b/pkgs/by-name/ra/radicle-explorer/package.nix
index ee5db482ec2d..1107a148070b 100644
--- a/pkgs/by-name/ra/radicle-explorer/package.nix
+++ b/pkgs/by-name/ra/radicle-explorer/package.nix
@@ -10,16 +10,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "radicle-explorer";
-  version = "0-unstable-2026-09-03";
+  version = "0-unstable-2026-09-14";
 
   src = fetchFromRadicle {
     seed = "seed.radicle.dev";
     repo = "z4V1sjrXqjvFdnCUbxPFqd5p4DtH5";
-    rev = "fb11e4d9c2c758468b9dca5c615f2392fb011c6e";
-    hash = "sha256-X8YRmyK8VyhmRMnKEiIhbiNyQ/fy4U9FgcIARDz+MfI=";
+    rev = "f1ee718886061b90fac69c53000613eeccbab09f";
+    hash = "sha256-BeZ5xtJVkoSXYggiT/tmJPUcPQoQMQg2FkCkuQvHZC0=";
   };
 
-  npmDepsHash = "sha256-m+md3XIjn4SpZ3vp5STDFAKU3QSs0maFUm3Ll5DLghc=";
+  npmDepsHash = "sha256-Bwlrh4DivqWhxuHcbJGJtatsGRI0V8BwTT3RtqoJ7lU=";
 
   preBuild = ''
     if [[ $configFile ]]; then