Merge master into staging-next

2026-08-26 10:14:48 +00:00 · 2026-08-21 16:20:44 +00:00
parent 4b68493e38 ece2d49743
commit ce5cc9a4b0
59 changed files with 507 additions and 221 deletions
--- a/.mailmap
+++ b/.mailmap
@@ -6,6 +6,7 @@ Christina Sørensen <christina@cafkafk.com> <christinaafk@gmail.com>
 Christina Sørensen <christina@cafkafk.com> <89321978+cafkafk@users.noreply.github.com>
 Daniel Løvbrøtte Olsen <me@dandellion.xyz> <daniel.olsen99@gmail.com>
 Ethan Carter Edwards <ethan@ethancedwards.com> Ethan Edwards <ethancarteredwards@gmail.com>
+Ethan Carter Edwards <ethan@ethancedwards.com> <ethancedwards8@users.noreply.github.com>
 Fabian Affolter <mail@fabian-affolter.ch> <fabian@affolter-engineering.ch>
 Fiona Behrens <me@kloenk.dev>
 Fiona Behrens <me@kloenk.dev> <me@kloenk.de>
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -27393,12 +27393,6 @@
    name = "Steven Allen";
    keys = [ { fingerprint = "327B 20CE 21EA 68CF A774  8675 7C92 3221 5899 410C"; } ];
  };
-  steeleduncan = {
-    email = "steeleduncan@hotmail.com";
-    github = "steeleduncan";
-    githubId = 866573;
-    name = "Duncan Steele";
-  };
  steell = {
    email = "steve@steellworks.com";
    github = "Steell";
--- a/nixos/modules/i18n/input-method/fcitx5.nix
+++ b/nixos/modules/i18n/input-method/fcitx5.nix
@@ -9,6 +9,16 @@ let
  cfg = imcfg.fcitx5;
  fcitx5Package = pkgs.qt6Packages.fcitx5-with-addons.override { inherit (cfg) addons; };
  settingsFormat = pkgs.formats.ini { };
+  mkKeyValue = lib.generators.mkKeyValueDefault {
+    mkValueString =
+      v:
+      if true == v then
+        "True"
+      else if false == v then
+        "False"
+      else
+        lib.generators.mkValueStringDefault { } v;
+  } "=";
 in
 {
  options = {
@@ -131,10 +141,13 @@ in
          };
      in
      lib.attrsets.mergeAttrsList [
-        (optionalFile "config" (lib.generators.toINI { }) cfg.settings.globalOptions)
-        (optionalFile "profile" (lib.generators.toINI { }) cfg.settings.inputMethod)
+        (optionalFile "config" (lib.generators.toINI { inherit mkKeyValue; }) cfg.settings.globalOptions)
+        (optionalFile "profile" (lib.generators.toINI { inherit mkKeyValue; }) cfg.settings.inputMethod)
        (lib.concatMapAttrs (
-          name: value: optionalFile "conf/${name}.conf" (lib.generators.toINIWithGlobalSection { }) value
+          name: value:
+          optionalFile "conf/${name}.conf" (lib.generators.toINIWithGlobalSection {
+            inherit mkKeyValue;
+          }) value
        ) cfg.settings.addons)
      ];

--- a/nixos/modules/services/networking/crab-hole.nix
+++ b/nixos/modules/services/networking/crab-hole.nix
@@ -35,6 +35,12 @@ in

      package = lib.mkPackageOption pkgs "crab-hole" { };

+      openFirewall = lib.mkOption {
+        type = lib.types.bool;
+        default = false;
+        description = "Open ports in the firewall for crab-hole's DNS server.";
+      };
+
      supplementaryGroups = lib.mkOption {
        type = lib.types.listOf lib.types.str;
        default = [ ];
@@ -170,6 +176,11 @@ in
        RestartSec = 1;
      };
    };
+
+    networking.firewall = lib.mkIf cfg.openFirewall {
+      allowedUDPPorts = [ 53 ];
+      allowedTCPPorts = [ 53 ];
+    };
  };

  meta.maintainers = [
--- a/nixos/modules/services/security/tinyauth.nix
+++ b/nixos/modules/services/security/tinyauth.nix
@@ -149,6 +149,11 @@ in
      default = "tinyauth";
      description = "Group account under which Tinyauth runs.";
    };
+
+    enableUnixSocket = mkEnableOption (
+      "a UNIX domain socket at `/run/tinyauth/tinyauth.sock`"
+      + " instead of listening on an IP address and port."
+    );
  };

  config = mkIf cfg.enable {
@@ -174,6 +179,7 @@ in
        GIN_MODE = "release";
        TINYAUTH_DATABASE_PATH = "${cfg.dataDir}/tinyauth.db";
        TINYAUTH_RESOURCES_PATH = "${cfg.dataDir}/resources";
+        TINYAUTH_SERVER_SOCKETPATH = mkIf cfg.enableUnixSocket "%t/tinyauth/tinyauth.sock";
      };

      serviceConfig = {
@@ -181,6 +187,8 @@ in
        User = cfg.user;
        Group = cfg.group;
        WorkingDirectory = cfg.dataDir;
+        RuntimeDirectory = mkIf cfg.enableUnixSocket "tinyauth";
+        RuntimeDirectoryMode = mkIf cfg.enableUnixSocket "750";
        ExecStart = getExe cfg.package;
        Restart = "always";

@@ -224,7 +232,7 @@ in
          "~@privileged"
          "~@resources"
        ];
-        UMask = "0077";
+        UMask = if cfg.enableUnixSocket then "0007" else "0077";
      };
    };

--- a/nixos/modules/virtualisation/nixos-containers.nix
+++ b/nixos/modules/virtualisation/nixos-containers.nix
@@ -526,7 +526,7 @@ let

  # Parses an IP address with an optional prefix
  ipFromString =
-    str:
+    str: defaultPrefix:
    let
      segments = lib.splitString "/" str;
      prefix = lib.elemAt segments 1;
@@ -534,7 +534,7 @@ let
    in
    {
      address = lib.head segments;
-      prefixLength = if hasPrefix then builtins.fromJSON prefix else 32;
+      prefixLength = if hasPrefix then builtins.fromJSON prefix else defaultPrefix;
    };

 in
@@ -610,10 +610,10 @@ in
                                networking.interfaces = lib.mkIf config.privateNetwork (
                                  lib.mkMerge [
                                    (lib.mkIf (config.localAddress != null) {
-                                      eth0.ipv4.addresses = [ (ipFromString config.localAddress) ];
+                                      eth0.ipv4.addresses = [ (ipFromString config.localAddress 32) ];
                                    })
                                    (lib.mkIf (config.localAddress6 != null) {
-                                      eth0.ipv6.addresses = [ (ipFromString config.localAddress6) ];
+                                      eth0.ipv6.addresses = [ (ipFromString config.localAddress6 128) ];
                                    })
                                  ]
                                );
--- a/nixos/tests/fcitx5/default.nix
+++ b/nixos/tests/fcitx5/default.nix
@@ -37,7 +37,7 @@
        ];
        fcitx5.settings = {
          globalOptions = {
-            "Hotkey"."EnumerateSkipFirst" = "False";
+            "Hotkey"."EnumerateSkipFirst" = false;
            "Hotkey/TriggerKeys"."0" = "Control+space";
            "Hotkey/EnumerateForwardKeys"."0" = "Alt+Shift_L";
            "Hotkey/EnumerateBackwardKeys"."0" = "Alt+Shift_R";
--- a/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/anthropic.claude-code/default.nix
@@ -21,22 +21,22 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
      sources = {
        "x86_64-linux" = {
          arch = "linux-x64";
-          hash = "sha256-OkUNFovJqm/F65O9p47lPgne0mjXqMKVPpjSbP2vsHo=";
+          hash = "sha256-oOytttotGI7f4RlnNBRM6TvXaXUht6v99Kzxc9GP404=";
        };
        "aarch64-linux" = {
          arch = "linux-arm64";
-          hash = "sha256-oPEwnli4L0FB0G5aJFxqadfSfzfar5FAvR5B03PjQog=";
+          hash = "sha256-9Ne1PGz0k1E1wY/HhoR5mqB3SFQiFkHt236+L5jXE60=";
        };
        "aarch64-darwin" = {
          arch = "darwin-arm64";
-          hash = "sha256-WHZojtsjbDwo+VwCUhj6jJVmhT/WiPlE7WRr8DUq170=";
+          hash = "sha256-2nwDsS4tVRikMZWZW4TKshQE7HVeQ/yY7CxpGg0os7w=";
        };
      };
    in
    {
      name = "claude-code";
      publisher = "anthropic";
-      version = "2.1.237";
+      version = "2.1.238";
    }
    // sources.${stdenvNoCC.hostPlatform.system}
      or (throw "Unsupported system ${stdenvNoCC.hostPlatform.system}");
--- a/pkgs/applications/emulators/libretro/cores/snes9x.nix
+++ b/pkgs/applications/emulators/libretro/cores/snes9x.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "snes9x";
-  version = "0-unstable-2026-08-09";
+  version = "0-unstable-2026-08-17";

  src = fetchFromGitHub {
    owner = "snes9xgit";
    repo = "snes9x";
-    rev = "2ab06b3695bce429a074ced6f5193eb1c7acefaf";
-    hash = "sha256-L4j6wzYFiDQr+uKxLgPEEKecdeoPwED2U2TICZGvSuc=";
+    rev = "2971061cf07fdc6fc7d18883edf4e648eb16a6d2";
+    hash = "sha256-OX//MXLRWRWNhl5YOoL6VyzPxBu4pVkUz7BWXscuNXM=";
  };

  makefile = "Makefile";
--- a/pkgs/by-name/_9/_9base/package.nix
+++ b/pkgs/by-name/_9/_9base/package.nix
@@ -13,6 +13,8 @@ stdenv.mkDerivation {
  pname = "9base";
  version = "6-unstable-2019-09-13";

+  __structuredAttrs = true;
+
  src = fetchgit {
    url = "https://git.suckless.org/9base";
    rev = "63916da7bd6d73d9a405ce83fc4ca34845667cce";
--- a/pkgs/by-name/af/afetch/package.nix
+++ b/pkgs/by-name/af/afetch/package.nix
@@ -8,6 +8,10 @@ stdenv.mkDerivation (finalAttrs: {
  pname = "afetch";
  version = "2.2.0";

+  strictDeps = true;
+  __structuredAttrs = true;
+  enableParallelBuilding = true;
+
  src = fetchFromGitHub {
    owner = "13-CF";
    repo = "afetch";
--- a/pkgs/by-name/au/automatic-timezoned/package.nix
+++ b/pkgs/by-name/au/automatic-timezoned/package.nix
@@ -9,17 +9,18 @@ rustPlatform.buildRustPackage (finalAttrs: {
  pname = "automatic-timezoned";
  version = "2.0.156";

+  __structuredAttrs = true;
+
  src = fetchFromGitHub {
    owner = "maxbrunet";
    repo = "automatic-timezoned";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-s/VUlcMxveeYN9PUg7fWd9HFGbwkcYeN3s4nKhehYhY=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-s/VUlcMxveeYN9PUg7fWd9HFGbwkcYeN3s4nKhehYhY=";
  };

  cargoHash = "sha256-PcdNomx0ZwdmPWORbIayeFLWbyrmWdl9EO2P7GC25B4=";

  nativeInstallCheckInputs = [ versionCheckHook ];
-
  doInstallCheck = true;

  meta = {
--- a/pkgs/by-name/aw/aws-cdk-cli/missing-hashes.json
+++ b/pkgs/by-name/aw/aws-cdk-cli/missing-hashes.json
@@ -1,30 +1,56 @@
 {
  "@esbuild/aix-ppc64@npm:0.28.1": "9b01eaa9c57542436436de762466b9a348b4596aa53dffa6e7034e4180691e1948d33fe34ec302239ab04c280e5166248880f24531011ff419fbec6986a265f3",
+  "@esbuild/aix-ppc64@npm:0.28.2": "532f5b55262aef55e92cc60014f5dbb016122d84c85a5369d715035f1d18e47d916a292cb63673e52aca3c463b3829ad6adb257d5f7d7228a6fb55ed144fdf00",
  "@esbuild/android-arm64@npm:0.28.1": "7c977c8d4cea5126df4b298d5c31c3df8d14aa05d7477aa11c4147ec7baff17d25542234eea0134f279191b59cb1af18fee49c6916afda554484464129e4f9c3",
+  "@esbuild/android-arm64@npm:0.28.2": "3cac1f07c479ac5fc35406e208189734c997253a1cbce64112549ce766ae884f10ea5b2bcddf9932c8f8f61f7eb7904c74f49444c4e58d1bf9e76d389227a26c",
  "@esbuild/android-arm@npm:0.28.1": "44baed9765216202f71b6aae8d9ddb930efa671d34f63f4220d980662b3df4da7972e965c0a0f12922147aa8428083686f6cb23cd9a4f140eaf922ae0b59c2a0",
+  "@esbuild/android-arm@npm:0.28.2": "e72d53f09d78b28cff55dbafb5635fa1c9327047cff9218991be2869f2adcfbee9d405109b66411ca2b6501273002ed2c41e2c82c985aec72b4dd6ddc755090f",
  "@esbuild/android-x64@npm:0.28.1": "1b8183640bef23f41a91598d898a04a6a8e3ca31d0100207c7e75928ee885878c04e3bcf31f27ed9c655d6d8a7c08e35e3afef035aee649488cb2d68e51abf1e",
+  "@esbuild/android-x64@npm:0.28.2": "a42c252316c4750d622781e313065bff9da6924a98fba8e9e70aacd043387bc445115bf2d0dfa8176253ab7033e40597114b86c5794135aef9d96bfe2058e799",
  "@esbuild/darwin-arm64@npm:0.28.1": "8ed80a99836df196c2b7996448eabb2d503ec8c71d0a8be59af4eed457b858fa5fd9292528b1967f0e106d2a045387e375207a2cc262cd45f89596681e94e7fd",
+  "@esbuild/darwin-arm64@npm:0.28.2": "eaddd98934ea667dd0573a87376a77ed38d5256e8976a9f9d2612c22d795b08dc08015fe5b57dccca67b91578a7defd27bad1864a6feb4b39e1773dd837033a6",
  "@esbuild/darwin-x64@npm:0.28.1": "952b23f33c24aea13f5a78fd41731e06e8c7fa732e10995327fa1289115da6b4123899ca0cdb0cf0a56add29efcb9f7891ad6fda0bfb94541347275537a71e77",
+  "@esbuild/darwin-x64@npm:0.28.2": "7e10c00ebd47ae17987f09f0c95e7a98306f9fff19277d9755e2d808c4a83055a624e9c71b8672dac4373effb0f20f3548e877a2f2b44af4de0af72c036cdb0a",
  "@esbuild/freebsd-arm64@npm:0.28.1": "cc2c4f1f13230607807c3f128680d789e85d4b93309501c4f8d84ed0674f4a2a3e60e279e3b997ee9f797047c1c5b906b25e4fe37de62d19634e4470bcb16f32",
+  "@esbuild/freebsd-arm64@npm:0.28.2": "f17cdd3604a23e9dcb486a80fd4f197f57d9870e78d9c2b255a0b74bff3c624b4811dd9b18db0be43543c99d503069b51932c16dc70d001672f8117905f3e514",
  "@esbuild/freebsd-x64@npm:0.28.1": "5b99b980599567ee931520a019beaeea4c7ae2874d0bfab79ee4bd6373a869251d2175946478c527490ce155d10a5bcc795e8c986dceb4a36fb6e813513fc54c",
+  "@esbuild/freebsd-x64@npm:0.28.2": "e01ca12c86ff619cd3eae254ace2c8ce49d11cd879a2e77db1cc4e4b1419f84c8f9e887e6607f41349169fa23825c3406559547b95b2fef3f422658f028da4aa",
  "@esbuild/linux-arm64@npm:0.28.1": "9348c6bfc2d878e6213cffe482d4455d817b9e56b3c581a9f68b94aac720cddea5733d963dec57ca273039f3a7ca1714f1ac8e39e2e0f85f1af42f5d05e3ed00",
+  "@esbuild/linux-arm64@npm:0.28.2": "2a9c1a66a43bfcf36105f7dac5f9c169237b3b18463d822d7278c52b8414483e66f9ea669f8c49dab39af2dd91dfefa8c93943fc7e91c770d44dda09f6824923",
  "@esbuild/linux-arm@npm:0.28.1": "654d7af59b4be40f585455e42ecb389657c6f11b1f2be2d5ab04caeac0514574d8b2a28b9f0f9805d92e266a44a5627c5acc8151b0d0379f75ac1490fecc013d",
+  "@esbuild/linux-arm@npm:0.28.2": "5a913524b3b36063d37af3757f8b74f3b8528c82949c6595dd2a951650d5b69f04552362c3e32b546e851e84129df2a311815844efbf37b60dae47f92374c998",
  "@esbuild/linux-ia32@npm:0.28.1": "cce27fbd8d74f34bb5507a5db8c0119aa377c7a070fd0be3881a8efddcdb8adeebe24dc97d55784d74a8bf4a60fb55b48899f41b5e931acaa3eb9f90ecc94a01",
+  "@esbuild/linux-ia32@npm:0.28.2": "e68de896188c417a0582117919b1bed47b2b235358ed1836fb8c17a214afb178d4f54dbdbe724eed990d8d2d2c1c391088cfd6637cdd0432062d2c3981b49213",
  "@esbuild/linux-loong64@npm:0.28.1": "47c3215d378f5da750300694b273b83db26d3e9ed36553696a1769da6d467e7557e289b46d211c93ab7a2978348b7415b66c7fec31658622f5bd356332b9d5b0",
+  "@esbuild/linux-loong64@npm:0.28.2": "1adac09caf8ba573fa2fd4eaa34e720e439df0d17d2805d5c57fcafc01ab9e94a14d3457eafbe306629cd027028dafacc77e25a4f2730ae0602664ef5ef92695",
  "@esbuild/linux-mips64el@npm:0.28.1": "166d8888e731bdeba0c657382d429c0a979af2136100ee2491ec47b2e2ec55f6924fe2045880b48a6cdaeb3dcc44fc495f3f4b9a5aa3bb8c418d1f53f86b2ba1",
+  "@esbuild/linux-mips64el@npm:0.28.2": "6ce3422c183387a9126138f11d8143cdb94056658e4c007168e7801d5bda1947500fc9b6f671416e68e13afb762033021ec76b16fbdb9d75730593784d5b0229",
  "@esbuild/linux-ppc64@npm:0.28.1": "a8eecb9e43a26dcb70a9805e685dec9f0caff0a8bac691b06a6db7c14ba0a69980ef0c01cb3fc1377ad63e2c4945f396fbbeaf008588bb232e9c0c37dcdb557b",
+  "@esbuild/linux-ppc64@npm:0.28.2": "4d772c34b72c5a5f35635204dd630ea560fc5a4ac06c5c0de247472adb8e6cfa170da0de9cc02421608d6c36463826097ea5630c2d66964ef4d49b3e7d918b62",
  "@esbuild/linux-riscv64@npm:0.28.1": "cfde883f336e1811fee019a1df402000c7a8e6dc5a2b3577679fd0d9711d1a774c1faa194cc8954b18ca11f3a380ef32905ea90c241803831b61017d8a667c3b",
+  "@esbuild/linux-riscv64@npm:0.28.2": "3b2c61ec50b9af8079e72ba68cd130aa67113bbb039ae0bd07451ab34ca07cbfdc7175fea4ed3b8918fbce36f5a49056d8c1683f36e66aa3d884f4eb0159c116",
  "@esbuild/linux-s390x@npm:0.28.1": "ea121d2fb6c8f6161312e0239258b584c431b4d23f320ace7cbc18da77034aac5ed383658d2a48fdfa32e38be07126a14aa26802b8e04d0e958e82646fb87f41",
+  "@esbuild/linux-s390x@npm:0.28.2": "ee2520a6dee59461cd71f94b5ffbf238283e850defdfe4c25cdee3600e8c728f88d886233d92f3cac2371f647cb519a62af30899848ff0a9e4df3525a85d00b5",
  "@esbuild/linux-x64@npm:0.28.1": "9b5458cf012247e31c6bf465e37553f2fc5aef3fccc6593bb30fee0c547958f9f00fbedd44e5bc076cf68d6791a4af2ce8714260fe341cb16843a78643773e3d",
+  "@esbuild/linux-x64@npm:0.28.2": "5e2ebf6534f2eaba70d67906aedc59ae84d763b07af9738a2a45adb44bd51ec2298dc94d2447e9d60dee8f6e2d58e137bd0f7e53435436f123bda1cfcf2fd0ce",
  "@esbuild/netbsd-arm64@npm:0.28.1": "86b5cf33fbad27ea5e7345601e711a26717bdf5ad119efa0b1bb9ad6a75f7cb2658c57ffb80f19491e3c7105f4698e76358ee2b6d57f48c9a230de9f588589c7",
+  "@esbuild/netbsd-arm64@npm:0.28.2": "f4559f1abcb85732d71b6f123555eec54373cabfc2ed7c4d56ea9c10b6c262d30f1a1867ddb55e1b6f77414ee85594768e3d243f9d57eec09c72b67d6a37cd4c",
  "@esbuild/netbsd-x64@npm:0.28.1": "ff24c209715f7f122c711d3c51af099de27659837d3f7bd4cbea9a8868fa99a10b7af785058d18a1e32b2132989d1d1d82b8768df77ff25ab6cf19d58be3697d",
+  "@esbuild/netbsd-x64@npm:0.28.2": "852010db3be0e867a556f156f9fea93f33d9bf2b53164a584d212cbb972fda18b6f094f7886f08b68c66958909dccf3ef33e5f70cfe6cc71cc17ee3a92015ad0",
  "@esbuild/openbsd-arm64@npm:0.28.1": "fe6590621116132baa0a2b9c2dc95c6342f146170ec1ffb343c29936580c369a69061676bef4e654ee27bad6491f531af3ba985aed7133eb16b758fffae6a445",
+  "@esbuild/openbsd-arm64@npm:0.28.2": "cc528c9b126d8aa3633faf07f796b9e380d85d309f5499d3f075a9da86a60a2a61c73f42dcdb5577442a4d9af07d22ed7f6b844665c1f6373a15730c75b68c90",
  "@esbuild/openbsd-x64@npm:0.28.1": "2600c51c394945654f99b096fccba95e1d34fa3ecf4e78f40a7aee4573bf21dd955c274e0586768e9ebef3bff145ffe30231f1cb281ef5e679f7aa78dcc86687",
+  "@esbuild/openbsd-x64@npm:0.28.2": "ede88d45016e3dd3c77a49657c5608feb1331bcf1e0b7bfb2bfd87d07b687e5d687ffce962ac7e55a5a29b83e5824c91611406e3cd9317b6efed53b6e8f442bc",
  "@esbuild/openharmony-arm64@npm:0.28.1": "be9e1d1e4af478778ce847e28809fba0b754340a699e37ec03bc1a3cd4e84e4fde30ffea62099757877229b024d50331efd6270580492aa6be38eb2353ef5646",
+  "@esbuild/openharmony-arm64@npm:0.28.2": "7b8b3c8baf73151a473878b9d40fdd87f86bee4a9b28325f4f0ece236a0f98fad7b393d1b5f12268b7c122fbcfb3872c1467cabd4745cf8698a78b60241138cc",
  "@esbuild/sunos-x64@npm:0.28.1": "349b9c7d879496456b2eb28f7bb3decc12a906007bb7fb24cb2b269f6b3e5138af109045b216bd0396762e63b802f0233408cc3dce802be5fcf242d4835b6bc8",
+  "@esbuild/sunos-x64@npm:0.28.2": "f70b672bb0c8179d92e87077fcfea60b0971f8071830f574c85ef1706a6770deaa31f28adf3c1a08506403e9735d81a4e28e5d2ad1c3cbc15af2433112dceb4b",
  "@esbuild/win32-arm64@npm:0.28.1": "551ada5396e1f10e3d3592dd60a148a7257af1ab2317bba09e9ed18a6d7ee7e5961c68eb1fbaee4e8c1961b504807493e1b8f5c700dd1fb990f0cb36b240ad57",
+  "@esbuild/win32-arm64@npm:0.28.2": "9aa6841164e80b4d77fd267a9cd160be46586ea561fcb6d99507989856682dbdc007ab2d3c320787ea50ec0a2c1802395dc6c3cd4b254eb5ddac8a3a7705c319",
  "@esbuild/win32-ia32@npm:0.28.1": "2676ace6b4d63721da34873974152e869aed9fc8bd9fdff4b8df14a3a3e68b78a9b4566e643b90b948b4e85773cbf288a33a59d13979caaadd43b5adad68312c",
+  "@esbuild/win32-ia32@npm:0.28.2": "51d216d2a9cdc1ae2407ac88c4ea02be5b5cc9c618cfd846946b5691f9513de762e6a718222c3de02b14426b4939e040c98de7d424994837bed6ecbb1347b9ff",
  "@esbuild/win32-x64@npm:0.28.1": "8d658b74ed9b7494b3799093551d4c928a7916865ed42d00a135156cbd08612b53072e9e424f0687c10a93a444d30d6b0294b6a1d5fdba78078d706646ba558f",
+  "@esbuild/win32-x64@npm:0.28.2": "b109c1080e6ff5fcd9da0c61a6915d296837702234609b737284c01c38cc3a245caa351702da27114ae9cd17c4a577a5674375c4138269f63a578e46f6686066",
  "@nx/nx-darwin-arm64@npm:22.7.8": "bc5e8ec97a136e6fd83fe76d0ab88689d4e17b89b57bec271b37802453522cc43fcd87eb3c4cf5096b566e579004f088d08824d75215a45498fef045edc5562f",
  "@nx/nx-darwin-x64@npm:22.7.8": "b7020ed4326892493d0cd0aa1239612e16c1f60272ae2ed7f3a5b2b3d2baa936554f96bcaceb2feeb1e7050cf2c043ab8749cb2d3350b92c08435347fbfcd66e",
  "@nx/nx-freebsd-x64@npm:22.7.8": "6fa3b5386476a80a6f16bd386299d60f4ec333ac05eb6fae8d75d116a380cfc32b901feeaf88e153100db56f66aefdf8a5875abfc3d5e895e916de7a9b0a283e",
--- a/pkgs/by-name/aw/aws-cdk-cli/package.nix
+++ b/pkgs/by-name/aw/aws-cdk-cli/package.nix
@@ -17,19 +17,19 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "aws-cdk-cli";
-  version = "2.1135.0";
+  version = "2.1138.0";

  src = fetchFromGitHub {
    owner = "aws";
    repo = "aws-cdk-cli";
    tag = "cdk@v${finalAttrs.version}";
-    hash = "sha256-NF80AuuizRMjD0z127mWFUJGAg6hzjHcLCGdJEaOc/s=";
+    hash = "sha256-dbmzhgRiFmj48X3WlR7UDvq80+K3yc9WrkC/AzCvjmc=";
  };

  missingHashes = ./missing-hashes.json;
  offlineCache = yarn-berry.fetchYarnBerryDeps {
    inherit (finalAttrs) src missingHashes;
-    hash = "sha256-H/jpxsSTA5LFgDz2f2oaLgdB/ITs3hmSJGznqanuS34=";
+    hash = "sha256-rT4GqlZdVuat3Jz95g6Lyy3donWKNbCwmemhvvRBbTY=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/be/beekeeper-studio/package.nix
+++ b/pkgs/by-name/be/beekeeper-studio/package.nix
@@ -40,7 +40,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "beekeeper-studio";
-  version = "6.0.0";
+  version = "6.0.4";

  src =
    let
@@ -54,9 +54,9 @@ stdenv.mkDerivation (finalAttrs: {
    fetchurl {
      url = "https://github.com/beekeeper-studio/beekeeper-studio/releases/download/v${finalAttrs.version}/${asset}";
      hash = selectSystem {
-        x86_64-linux = "sha256-mTS5elz54AbbYF6AtPaeZvbR7ysB6a6iu+lbaTrwv5k=";
-        aarch64-linux = "sha256-KSz60oSR5UcVM5p8swRqBCZknGob7/MEMtAI2UmN2Q0=";
-        aarch64-darwin = "sha256-71xe4uWRb83WgvZvwqv52tubZ+8CKKuU1/zQnV0aSGw=";
+        x86_64-linux = "sha256-smRbK5CxvpB/8kq3WqjBnpI229ygHUTElOadDi8Njsk=";
+        aarch64-linux = "sha256-bL/oCoyIVbC0J1wXcHo5a/flzOGuNIZkIJPOHbv9EKQ=";
+        aarch64-darwin = "sha256-DClBYrXriZXnOkSTXygLZ3tSnr6hin5CRF+OjFNQ+jQ=";
      };
    };

--- a/pkgs/by-name/bi/bisq1/sources.nix
+++ b/pkgs/by-name/bi/bisq1/sources.nix
@@ -1,8 +1,8 @@
 # Generated by ./update.sh
 {
-  version = "1.10.4";
-  deb-hash = "sha256-rOFbiuEbeO2qZntUhO+LNhwX6XlvWRU9v0HIAjyHwd8=";
-  sig-hash = "sha256-3fAGauXHA8S+XIuHeOIFxp7TsXd1LdqFg8hpWIU4P7k=";
+  version = "1.10.5";
+  deb-hash = "sha256-ekTpewjaCD5Nq44vkB59dqhWuRRXORZh2DEJrfGlsUM=";
+  sig-hash = "sha256-JeFMg0CeKxM2J0bi99zlznNRKnAKglYrSkXQtKBClNI=";
  key-E222AA02-hash = "sha256-Ue/UmS6F440/ybEEIAR+pdPEIksAt6QSMN6G5TZVWzc=";
  key-4A133008-hash = "sha256-UijG3DkJNNTakVJd2wl30mDepa27n6R/Xxfl4sjt0sk=";
  key-387C8307-hash = "sha256-PrRYZLT0xv82dUscOBgQGKNf6zwzWUDhriAffZbNpmI=";
--- a/pkgs/by-name/cl/claude-code/manifest.json
+++ b/pkgs/by-name/cl/claude-code/manifest.json
@@ -1,53 +1,51 @@
 {
-  "version": "2.1.237",
-  "commit": "45590910f0b746ddad3fe7d8135c5c29b33ccf88",
-  "buildDate": "2026-08-19T22:55:17Z",
+  "version": "2.1.238",
+  "commit": "46283063a4c23f7afadb8440f549264ad93b7c06",
+  "buildDate": "2026-08-20T15:26:31Z",
  "platforms": {
    "darwin-arm64": {
      "binary": "claude",
-      "checksum": "338901351d4ff17495738c67fc3e12a32c1b506738ac5e012eb782d3d8b5be43",
-      "size": 317110288
+      "checksum": "1c196c456373b57818ae87df84aecee96cb659448c0d6a6bbb401ac5758431b2",
+      "size": 321263536
    },
    "darwin-x64": {
      "binary": "claude",
-      "checksum": "9f00789754a7b95febc6d4e37a3b6523d4d9c4c2333a2ce4bd596ad82186224e",
-      "size": 325793008
+      "checksum": "d10bc7bb1720435f8830aa3ee74085f09348d2b1a2a152bdee251b770d76cc73",
+      "size": 329970544
    },
    "linux-arm64": {
      "binary": "claude",
-      "checksum": "a701cfb6bb4703abc6f3ce47508c878ca8158ebdbeacd5c35c7d510c7bc70177",
-      "size": 331864296
+      "checksum": "28d736120a6b14c5eae1ad1470e73371818c9c2fa41e0b3c7040207aa2d4edee",
+      "size": 335993064
    },
    "linux-x64": {
      "binary": "claude",
-      "checksum": "73975167f0108693cf6fd6614994781657ebb8456ebef5d247458734abfb3916",
-      "size": 334715184
+      "checksum": "0933b286cf94e1b2504b35ac165ab76b8f822735d53371c56393988c23040d58",
+      "size": 338860336
    },
    "linux-arm64-musl": {
      "binary": "claude",
-      "checksum": "60d832e81dd5076333e9f91286f660f2aaacc630079863599555caa8fe134eba",
-      "size": 325009176
+      "checksum": "a47d45149ea7c74e4474bce3c7628c4643b0541801b42053d6e26fd5e3203fdd",
+      "size": 329137944
    },
    "linux-x64-musl": {
      "binary": "claude",
-      "checksum": "b2c81ba8f2b0086b2536a56bf074bbf643043c2bd1aeea6ac8905709ae296168",
-      "size": 328843232
+      "checksum": "33546c2f7947bbfdb46a969123c5329e607c414045cd3645a29aa3cfe023c6ab",
+      "size": 332988384
    },
    "win32-x64": {
      "binary": "claude.exe",
-      "checksum": "406167231b3636e55a01d0ce93567256c61e7973489e645883302f14808ae668",
-      "size": 330167456
+      "checksum": "223bc058b5aef48138876e28de5d00387e4fd7362a18e733143bf00819c01aab",
+      "size": 334150816
    },
    "win32-arm64": {
      "binary": "claude.exe",
-      "checksum": "35978113ca98721cbf14c3abac90482d467419b9669d849c89d91c5664a5f95d",
-      "size": 318066848
+      "checksum": "645800d24201c93e5fd6f4308e0292bba9a75900693667401cdffb4361f8e616",
+      "size": 322051744
    }
  },
  "sdkCompat": {
    "testedWrapperVersions": [
-      "0.3.199",
-      "0.3.200",
      "0.3.201",
      "0.3.202",
      "0.3.204",
@@ -68,6 +66,7 @@
      "0.3.220",
      "0.3.221",
      "0.3.222",
+      "0.3.223",
      "0.3.226",
      "0.3.227"
    ],
--- a/pkgs/by-name/cr/crc/package.nix
+++ b/pkgs/by-name/cr/crc/package.nix
@@ -8,16 +8,16 @@
 }:

 let
-  openShiftVersion = "4.22.1";
-  okdVersion = "4.21.0-okd-scos.8";
+  openShiftVersion = "4.22.7";
+  okdVersion = "4.22.0-okd-scos.6";
  microshiftVersion = "4.22.0";
  writeKey = "$(MODULEPATH)/pkg/crc/segment.WriteKey=cvpHsNcmGCJqVzf6YxrSnVlwFSAZaYtp";
-  gitCommit = "70f0c9879a8812cdd6ae19c059ca5816d8de7900";
-  gitHash = "sha256-TRqKCsHHc2+dpsLJ7t9apPvaR0jf/1xQrYV9swpk3RA=";
+  gitCommit = "3a67a3687c5e9013e09a316991f92ef419841481";
+  gitHash = "sha256-gLDRnt0yVUe4OJU+LVpFA+7U0VnlXkmkcQVcB72ULqQ=";
 in
 buildGoModule (finalAttrs: {
  pname = "crc";
-  version = "2.62.0";
+  version = "2.63.0";

  src = fetchFromGitHub {
    owner = "crc-org";
--- a/pkgs/by-name/dr/drawio/package.nix
+++ b/pkgs/by-name/dr/drawio/package.nix
@@ -14,14 +14,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "drawio";
-  version = "31.1.8";
+  version = "31.3.1";

  src = fetchFromGitHub {
    owner = "jgraph";
    repo = "drawio-desktop";
    rev = "v${finalAttrs.version}";
    fetchSubmodules = true;
-    hash = "sha256-tVGBZ+zMl/co0l5oOp78GJG0kexgaiPx7f03WaNHxoY=";
+    hash = "sha256-7Wtmh6K9qLkSUjiZI2/+Z+AoD0oHJKq6nlO7kHUcj9s=";
  };

  # `@electron/fuses` tries to run `codesign` and fails. Disable and use autoSignDarwinBinariesHook instead
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {

  offlineCache = fetchNpmDeps {
    src = finalAttrs.src;
-    hash = "sha256-Yh8j7KDzsWpGIpYM/NuikPoNDiodJZZUTNqFOThmOXQ=";
+    hash = "sha256-mG2FsdxXC+VTRHLgAsx9h2qCyrkSway8W/D4Eipp+go=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/en/endless-sky/package.nix
+++ b/pkgs/by-name/en/endless-sky/package.nix
@@ -34,6 +34,9 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-v+0RrZqIkF849D8rmOhYS1kqeeCPRcBED+3VPSuhGF0=";
  };

+  __structuredAttrs = true;
+  strictDeps = true;
+
  patches = lib.optionals stdenv.hostPlatform.isLinux [
    ./fixes.patch
  ];
--- a/pkgs/by-name/fa/fairywren/package.nix
+++ b/pkgs/by-name/fa/fairywren/package.nix
@@ -22,13 +22,13 @@ lib.checkListOfEnum "${pname}: colorVariants" colorVariantList colorVariants
  stdenvNoCC.mkDerivation
  {
    inherit pname;
-    version = "0-unstable-2026-07-21";
+    version = "0-unstable-2026-08-21";

    src = fetchFromGitLab {
      owner = "FreshDoctor";
      repo = "FairyWren-Icons";
-      rev = "6d578aac69b897ca4afa3bc0981cb93fa0e0df4c";
-      hash = "sha256-vvE5p8l7K2jI5tw8tfX3WnjGSCVElZHB5PFX3gdT3lk=";
+      rev = "2c392591baf49fc27b964a00d96f3c7fd240dc1f";
+      hash = "sha256-zuWa6QkwiLUZg2n0oqKB6RM3oXOliWL/w72hWXvcqwU=";
    };

    propagatedBuildInputs = [
--- a/pkgs/by-name/ka/karakeep/package.nix
+++ b/pkgs/by-name/ka/karakeep/package.nix
@@ -4,7 +4,7 @@
  fetchFromGitHub,
  nix-update-script,
  nixosTests,
-  nodejs,
+  nodejs_22,
  node-gyp,
  gnutar,
  inter,
@@ -41,7 +41,9 @@ stdenv.mkDerivation (finalAttrs: {

  nativeBuildInputs = [
    python3
-    nodejs
+    # nodejs 22 avoids a worker crash on 24.19+ while waiting for a proper fix to https://github.com/karakeep-app/karakeep/issues/2989
+    # should be safe to revert after seeing forward movement at https://github.com/karakeep-app/karakeep/blob/main/docker/Dockerfile#L13
+    nodejs_22
    node-gyp
    pnpmConfigHook
    pnpm_11
@@ -67,8 +69,8 @@ stdenv.mkDerivation (finalAttrs: {

    # Based on matrix-appservice-discord
    pushd node_modules/better-sqlite3
-    npm run build-release --offline "--nodedir=${srcOnly nodejs}"
-    find build -type f -exec ${removeReferencesTo}/bin/remove-references-to -t "${srcOnly nodejs}" {} \;
+    npm run build-release --offline "--nodedir=${srcOnly nodejs_22}"
+    find build -type f -exec ${removeReferencesTo}/bin/remove-references-to -t "${srcOnly nodejs_22}" {} \;
    popd

    export CI=true
@@ -124,7 +126,7 @@ stdenv.mkDerivation (finalAttrs: {
      substituteInPlace "$KARAKEEP_LIB_PATH/$HELPER_SCRIPT_NAME" \
        --subst-var-by KARAKEEP_LIB_PATH "$KARAKEEP_LIB_PATH" \
        --subst-var-by VERSION "${finalAttrs.version}" \
-        --subst-var-by NODEJS "${nodejs}"
+        --subst-var-by NODEJS "${nodejs_22}"
      chmod +x "$KARAKEEP_LIB_PATH/$HELPER_SCRIPT_NAME"
      patchShebangs "$KARAKEEP_LIB_PATH/$HELPER_SCRIPT_NAME"
    done
--- a/pkgs/by-name/li/liborigin/001-fix-pkg-config-file.patch
+++ b/pkgs/by-name/li/liborigin/001-fix-pkg-config-file.patch
@@ -0,0 +1,14 @@
+diff --git a/liborigin.pc.in b/liborigin.pc.in
+index 80cd898..69d6b8f 100644
+--- a/liborigin.pc.in
+++ b/liborigin.pc.in
+@@ -1,7 +1,7 @@
+ prefix=@CMAKE_INSTALL_PREFIX@
+ exec_prefix=${prefix}
+-libdir=${prefix}/@CMAKE_INSTALL_LIBDIR@
+-includedir=${prefix}/@CMAKE_INSTALL_INCLUDEDIR@
+libdir=@CMAKE_INSTALL_FULL_LIBDIR@
+includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@
+ 
+ Name: liborigin
+ Description: Library for reading OriginLab files
--- a/pkgs/by-name/li/liborigin/package.nix
+++ b/pkgs/by-name/li/liborigin/package.nix
@@ -0,0 +1,38 @@
+{
+  stdenv,
+  fetchurl,
+  cmake,
+  lib,
+}:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "liborigin";
+  version = "3.0.4";
+
+  src = fetchurl {
+    url = "https://sourceforge.net/projects/liborigin/files/liborigin/3.0/liborigin-${finalAttrs.version}.tar.gz";
+    hash = "sha256-sb819y45iSrTUb7Uo+ckrubPpnMoHeoseMzrkEKnTlc=";
+  };
+
+  nativeBuildInputs = [
+    cmake
+  ];
+
+  patches = [
+    ./001-fix-pkg-config-file.patch
+  ];
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  meta = {
+    description = "Library for reading OriginLab OPJ project files";
+    homepage = "https://sourceforge.net/projects/liborigin";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [
+      AhmedAmr
+    ];
+    teams = with lib.teams; [ ngi ];
+    platforms = lib.platforms.all;
+    sourceProvenance = [ lib.sourceTypes.fromSource ];
+  };
+})
--- a/pkgs/by-name/ln/lnd/package.nix
+++ b/pkgs/by-name/ln/lnd/package.nix
@@ -23,16 +23,16 @@

 buildGoModule (finalAttrs: {
  pname = "lnd";
-  version = "0.21.1-beta";
+  version = "0.21.2-beta";

  src = fetchFromGitHub {
    owner = "lightningnetwork";
    repo = "lnd";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-LOP5vyffwxzXRI16Jgfjb+JykHcNWrGApM27frYUoPw=";
+    hash = "sha256-8HSKntW0cLkJi4You8gJgXaUoQoevl2zY+mji3fprJI=";
  };

-  vendorHash = "sha256-7fssqutcagEv6JKxwaAp9g3TtxHnQ34Kyln4DIhxjSQ=";
+  vendorHash = "sha256-YdrgmzTbxrsW/smmxFBiHQ1jB+cxNgNxPAsrPPS61AU=";

  subPackages = [
    "cmd/lncli"
--- a/pkgs/by-name/lu/luanti/package.nix
+++ b/pkgs/by-name/lu/luanti/package.nix
@@ -43,13 +43,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "luanti";
-  version = "5.16.1";
+  version = "5.17.0";

  src = fetchFromGitHub {
    owner = "luanti-org";
    repo = "luanti";
    tag = finalAttrs.version;
-    hash = "sha256-EzLjLkN/3BdcpWJ92QnrdhxKmY6Bz2JkOC0oX0TrUtI=";
+    hash = "sha256-PieiiJTpgUK7q0WiUY2EAp72ywHkDR2Mba1DCDkvCaY=";
  };

  patches = [
--- a/pkgs/by-name/lu/lukesmithxyz-bible-kjv/package.nix
+++ b/pkgs/by-name/lu/lukesmithxyz-bible-kjv/package.nix
@@ -7,7 +7,7 @@

 stdenv.mkDerivation {
  pname = "lukesmithxyz-bible-kjv";
-  version = "unstable-2022-06-01";
+  version = "0-unstable-2022-06-01";

  src = fetchFromGitHub {
    owner = "lukesmithxyz";
--- a/pkgs/by-name/ma/matrix-authentication-service/package.nix
+++ b/pkgs/by-name/ma/matrix-authentication-service/package.nix
@@ -21,21 +21,21 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "matrix-authentication-service";
-  version = "1.22.0";
+  version = "1.23.0";

  src = fetchFromGitHub {
    owner = "element-hq";
    repo = "matrix-authentication-service";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-vy9eZYtlAMPXh+xvgAOEeJd7jZirX5Y4sXmNbYLBYGI=";
+    hash = "sha256-DnaVIMp+pRRsNlyBZiTiqXajOgGFBT38sNLmC+IF8pU=";
  };

-  cargoHash = "sha256-3MDbg+vfLIqSDiRqBVZs2zbrg9UUpe4Vx+Ze656yOdE=";
+  cargoHash = "sha256-3fBikvSbPTiIYXk7TQKoQ/YqjF5ZCoN0xQRSqCmHF9Q=";

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
    fetcherVersion = 4;
-    hash = "sha256-9a62WlBQW8lgXluMh+DM21CkFCqFYd7yUz220G1uTIY=";
+    hash = "sha256-8dPqsa1/D4q7hdntV1AmbRxQyZgAf7Q/z+etj+R/jIE=";
  };

  pnpmRoot = "frontend";
--- a/pkgs/by-name/mu/music-assistant/package.nix
+++ b/pkgs/by-name/mu/music-assistant/package.nix
@@ -191,6 +191,7 @@ pythonPackages.buildPythonApplication (finalAttrs: {
    ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies
    ++ (lib.concatMap (provider: providerPackages.${provider} pythonPackages) [
      "acoustid_lookup"
+      "apple_music"
      "audible"
      "dlna"
      "fastmcp_server"
@@ -224,7 +225,6 @@ pythonPackages.buildPythonApplication (finalAttrs: {
    # "OSError: [Errno 19] No such device"
    "tests/core/test_genres.py"
    # provider is missing dependencies
-    "tests/providers/apple_music"
    "tests/providers/bandcamp"
    "tests/providers/hue_entertainment"
    "tests/providers/kion_music"
--- a/pkgs/by-name/mu/music-assistant/providers.nix
+++ b/pkgs/by-name/mu/music-assistant/providers.nix
@@ -32,8 +32,10 @@
      ps: with ps; [
        alexapy
      ];
-    apple_music = ps: [
-    ]; # missing pywidevine
+    apple_music =
+      ps: with ps; [
+        pywidevine
+      ];
    ard_audiothek =
      ps: with ps; [
        gql
--- a/pkgs/by-name/no/noctalia/package.nix
+++ b/pkgs/by-name/no/noctalia/package.nix
@@ -115,7 +115,7 @@ stdenv.mkDerivation (finalAttrs: {

  mesonBuildType = "release";

-  postInstall = ''
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
    installShellCompletion --cmd noctalia \
      --bash <($out/bin/noctalia completions bash) \
      --fish <($out/bin/noctalia completions fish) \
--- a/pkgs/by-name/ob/objfw/package.nix
+++ b/pkgs/by-name/ob/objfw/package.nix
@@ -45,7 +45,7 @@ clangStdenv.mkDerivation (finalAttrs: {
    description = "Portable framework for the Objective-C language";
    homepage = "https://objfw.nil.im";
    license = lib.licenses.lgpl3;
-    maintainers = [ lib.maintainers.steeleduncan ];
+    maintainers = [ ];
    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -111,12 +111,12 @@ let
  # vendored in-tree. Pre-stage the pin (tracks upstream's
  # `LLAMA_CPP_VERSION` file) so the FetchContent step uses our copy
  # instead of trying to clone over the network in the sandbox.
-  llamaCppVersion = "b10380";
+  llamaCppVersion = "b10434";
  llamaCppSrc = fetchFromGitHub {
    owner = "ggml-org";
    repo = "llama.cpp";
    tag = llamaCppVersion;
-    hash = "sha256-HT0QuIFJz5cgH2qinxhtyLEL/RrUpziZuntj/EDQtzI=";
+    hash = "sha256-Sz0kW1q91YzdrKbZUqMbFJ0DLZrzARSGheUrtCKcoQo=";
  };

  wrapperOptions = [
@@ -152,13 +152,13 @@ let
 in
 goBuild (finalAttrs: {
  pname = "ollama";
-  version = "0.32.13";
+  version = "0.32.14";

  src = fetchFromGitHub {
    owner = "ollama";
    repo = "ollama";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-KSvw7LsvpUVeSm9BKJ4wIp/fWGHjMp8bOTMUpFJCDmw=";
+    hash = "sha256-wvEG7L61gYI63pfHZ9UnTVQh8QMG3wHMfxEBeshtIKQ=";
  };

  vendorHash = "sha256-HMwoaFBMbpoy8f0I+O+i7kIa9BslLu3FcVWeaIOkpvs=";
--- a/pkgs/by-name/op/open-scq30/package.nix
+++ b/pkgs/by-name/op/open-scq30/package.nix
@@ -9,8 +9,7 @@
  dbus,
  gdk-pixbuf,
  glib,
-  gtk4,
-  libadwaita,
+  cosmic-icons,
  pango,
  just,
  sqlite,
@@ -48,8 +47,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
    dbus
    gdk-pixbuf
    glib
-    gtk4
-    libadwaita
    pango
    sqlite
    libxkbcommon
@@ -67,8 +64,6 @@ rustPlatform.buildRustPackage (finalAttrs: {

  cargoHash = "sha256-/dj2LBNcYcewt3Rhz82lZuoyCzaa/QC49CxfKoGfF6w=";

-  env.INSTALL_PREFIX = placeholder "out";
-
  # Requires headphones
  doCheck = false;

@@ -85,6 +80,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
    just install ${placeholder "out"}
  '';

+  # fix missing icons
+  preFixup = ''
+    gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "${cosmic-icons}/share")
+  '';
+
  passthru.updateScript = nix-update-script { };
  meta = {
    description = "Cross platform application for controlling settings of Soundcore headphones";
--- a/pkgs/by-name/si/signal-desktop/libsignal-node.nix
+++ b/pkgs/by-name/si/signal-desktop/libsignal-node.nix
@@ -15,23 +15,23 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "libsignal-node";
-  version = "0.97.3";
+  version = "0.99.3";

  src = fetchFromGitHub {
    owner = "signalapp";
    repo = "libsignal";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-mRhArmrrbnAfj4JS4OqWA+FEC57Sf/BEqb95KL3JXp0=";
+    hash = "sha256-/DoQZv5tB1q1Zah/sr/pv5bBvM5PQsZH/OWzgkjP0Z4=";
  };

-  cargoHash = "sha256-obv5XcGD4kkgTPShszxJRTFsOeig9UWyxdE8cyjbsCY=";
+  cargoHash = "sha256-WRHlUnQSrJ5VHfeqzTp6x3fKIFlOPtusAkRJRKvdYb8=";

  npmRoot = "node";
  npmDeps = fetchNpmDeps {
    name = "${finalAttrs.pname}-npm-deps";
    inherit (finalAttrs) version src;
    sourceRoot = "${finalAttrs.src.name}/${finalAttrs.npmRoot}";
-    hash = "sha256-jTyEnJBEuL8RXT29VYsRW797FPgINm8BvVBmt3m13EA=";
+    hash = "sha256-K/iINhZBBGtquEchcwOniYNz5fNcAux6/eOY8RJUrqA=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/si/signal-desktop/package.nix
+++ b/pkgs/by-name/si/signal-desktop/package.nix
@@ -45,13 +45,13 @@ let
  webrtc = callPackage ./webrtc.nix { };
  ringrtc = callPackage ./ringrtc.nix { inherit webrtc; };

-  version = "8.21.0";
+  version = "8.24.0";

  src = fetchFromGitHub {
    owner = "signalapp";
    repo = "Signal-Desktop";
    tag = "v${version}";
-    hash = "sha256-RuGq8ygiZewKqtKQattlqU0pcMMlgdFOJAhmN4J/8Tw=";
+    hash = "sha256-z5Z0ujG2AQvmrrdmJxOAnhi56ISSlGoI4kdMcZMpZzY=";
    # Emoji font files will be added in `postFetch` if `withAppleEmojis` is enabled. They
    # are fetched separately below.
    postFetch = ''
@@ -81,7 +81,7 @@ let
        ;
      inherit pnpm;
      fetcherVersion = 4;
-      hash = "sha256-1n+u0mcZJwjkdKmNY6KE6tk6/UPYuya5WqLrKRJimGw=";
+      hash = "sha256-3hwxTcxVzD5as6WcI3batU1DBKNeEDvGRn+lfSjrJBM=";
    };

    strictDeps = true;
@@ -185,13 +185,13 @@ stdenv.mkDerivation (finalAttrs: {
      ;
    inherit pnpm;
    fetcherVersion = 4;
-    hash = "sha256-1n+u0mcZJwjkdKmNY6KE6tk6/UPYuya5WqLrKRJimGw=";
+    hash = "sha256-3hwxTcxVzD5as6WcI3batU1DBKNeEDvGRn+lfSjrJBM=";
  };

  env = {
    ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
    SIGNAL_ENV = "production";
-    SOURCE_DATE_EPOCH = 1785418091;
+    SOURCE_DATE_EPOCH = 1787172744;
  };

  preBuild = ''
--- a/pkgs/by-name/si/signal-desktop/ringrtc.nix
+++ b/pkgs/by-name/si/signal-desktop/ringrtc.nix
@@ -19,16 +19,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ringrtc";
-  version = "2.70.0";
+  version = "2.70.2";

  src = fetchFromGitHub {
    owner = "signalapp";
    repo = "ringrtc";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-5RPX1SZhVJaSIDjdY2IvInwSI4YHs0y7TK1b9ixaeZc=";
+    hash = "sha256-mHve5E7i9uwx4cZbgRWm8J7+zJbgB6KIw2JqAhjxgoE=";
  };

-  cargoHash = "sha256-tztNtAGYHp+Kh98efwtt51yhRwhqDKeT06Q4B/HrHfQ=";
+  cargoHash = "sha256-Yz8CXMvKunM8u940vWK1M7X6DrPXCGWV9gQ+cv/81LY=";

  preConfigure = ''
    # Check for matching webrtc version
--- a/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix
+++ b/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix
@@ -16,13 +16,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "node-sqlcipher";
-  version = "3.3.9";
+  version = "4.0.3";

  src = fetchFromGitHub {
    owner = "signalapp";
    repo = "node-sqlcipher";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-eddDeNK8UA6CW1qXZtgS8QpuXVjFO6tVwpFDyYDnX+U=";
+    hash = "sha256-pqb/MhDZxkQDUgs/eP+cRL8b3dfN8VLJo+H8Td9mWoc=";
  };

  pnpmDeps = fetchPnpmDeps {
@@ -36,7 +36,7 @@ stdenv.mkDerivation (finalAttrs: {
  cargoDeps = rustPlatform.fetchCargoVendor {
    name = "sqlcipher-signal-exentsion";
    inherit (finalAttrs) src cargoRoot;
-    hash = "sha256-NtJPwRvjU1WsOxgb2vpokes9eL4DkEcbDaEmML7zsqQ=";
+    hash = "sha256-ChIzjkjIl663lNnOd5oLM1mc5CpLBZS/l82ikyXe/Ac=";
  };

  strictDeps = true;
--- a/pkgs/by-name/si/signal-desktop/webrtc-sources.json
+++ b/pkgs/by-name/si/signal-desktop/webrtc-sources.json
@@ -1,10 +1,10 @@
 {
    "src": {
        "args": {
-            "hash": "sha256-icy7lsgHBofHMJg6Eo2jxkuo9vHVw6P8TXsti2416bg=",
+            "hash": "sha256-UbMIbMpzNmZ1VsCjyGD1SRuBJQEH56peH1GhivHZroM=",
            "owner": "signalapp",
            "repo": "webrtc",
-            "tag": "7871d"
+            "tag": "7871e"
        },
        "fetcher": "fetchFromGitHub"
    },
@@ -26,10 +26,10 @@
    },
    "src/ringrtc/opus/src": {
        "args": {
-            "hash": "sha256-I1f+J//ZJBMj88+PQhsYBjz3fm4Ll3ckZD+fYa6/3Y0=",
+            "hash": "sha256-VdJhdy9ZwWP0oxoz6OfjCpgYaEkrEH2Y78/TT2VNPYU=",
            "owner": "xiph",
            "repo": "opus",
-            "rev": "22244de5a79bd1d6d623c32e72bf1954b56235be"
+            "rev": "3da9f7a6db1c05c3996cb363a9d1931a978bf1be"
        },
        "fetcher": "fetchFromGitHub"
    },
--- a/pkgs/by-name/te/teams-for-linux/package.nix
+++ b/pkgs/by-name/te/teams-for-linux/package.nix
@@ -19,16 +19,16 @@ let
 in
 buildNpmPackage rec {
  pname = "teams-for-linux";
-  version = "2.15.0";
+  version = "2.17.1";

  src = fetchFromGitHub {
    owner = "IsmaelMartinez";
    repo = "teams-for-linux";
    tag = "v${version}";
-    hash = "sha256-PYRl0Q7vsx7nKz7pkoCg3f3rRIcgCAvGiALQxHEOIjE=";
+    hash = "sha256-qI8+QqnrkGmQGweMcfyaXQnjNMf4htJAF9Gk97zL9jg=";
  };

-  npmDepsHash = "sha256-FPnkCO1zf5Ts2arOa0InC7l4esRs4AuXYlVF/OYR6AI=";
+  npmDepsHash = "sha256-wPHap85tS3JrN4ei/HRYyzwFfVFcPkBdbY5ViEk4bwE=";

  nativeBuildInputs = [
    makeWrapper
--- a/pkgs/by-name/ti/tirith/package.nix
+++ b/pkgs/by-name/ti/tirith/package.nix
@@ -8,15 +8,15 @@
 }:
 rustPlatform.buildRustPackage (final: {
  pname = "tirith";
-  version = "0.3.1";
+  version = "0.3.3";
  src = fetchFromGitHub {
    owner = "sheeki03";
    repo = "tirith";
    tag = "v${final.version}";
-    hash = "sha256-RdStW5ubqypdmFqNk9DHtUp5jHnZdXiWW/lAlSaBb3c=";
+    hash = "sha256-kU/HeCW4QNS1Ica69YZkdSgL3gsbDOJVGTyINZOnHUQ=";
  };

-  cargoHash = "sha256-/V2vv02x0zSsJCcJMSttG9eekRZMK7KTk6m2VYePFa8=";
+  cargoHash = "sha256-r13gquMmfJhR5N8Vu3/R+3SWUyVWyJFE6fiJbqbE5n4=";

  cargoBuildFlags = [
    "-p"
@@ -30,8 +30,18 @@ rustPlatform.buildRustPackage (final: {

  checkFlags = [
    # requires a fully functional shell environment, generating init scripts needs a patch under nix to work at build time
+    "--skip=bash_capability_cache_steers_default_mode"
+    "--skip=bash_enter_degradation_is_visible_not_silent"
+    "--skip=cli::clipboard::tests::copy_path_does_not_consult_sidecar"
+    "--skip=clipboard_watch_exits_when_stdout_pipe_closed"
    "--skip=init_bash_output"
+    "--skip=init_prompt_status_emits_marker_wrapped_snippet_zsh"
+    "--skip=init_prompt_status_is_idempotent_when_run_twice"
+    "--skip=init_prompt_status_supports_bash_and_fish_and_powershell"
+    "--skip=init_without_prompt_status_does_not_emit_snippet"
    "--skip=init_zsh_output"
+    # fails with: no such file or directory
+    "--skip=cli::checkpoint::tests::restore_checkpoint_nonzero_on_partial_failure"
  ];

  nativeBuildInputs = lib.optionals (stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
--- a/pkgs/by-name/ud/udpipe1/package.nix
+++ b/pkgs/by-name/ud/udpipe1/package.nix
@@ -0,0 +1,69 @@
+# https://github.com/apertium/packaging/blob/main/tools/udpipe/debian
+{
+  callPackage,
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  testers,
+  versionCheckHook,
+  udpipe1,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "udpipe1";
+  version = "1.4.0";
+
+  src = fetchFromGitHub {
+    owner = "ufal";
+    repo = "udpipe";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-ekRuaQlNGv+7eFtwqbs6d6hy/b8uZpHq2ffcKPcre7U=";
+  };
+
+  doCheck = true;
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
+  sourceRoot = "${finalAttrs.src.name}/src";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  makeFlags = [
+    "VERBOSE=1"
+    "MODE=release"
+  ];
+  buildFlags = [
+    "exe"
+    "server"
+    "lib"
+  ];
+  enableParallelBuilding = true;
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/{bin,lib}
+    cp -v udpipe $out/bin
+    cp -v rest_server/udpipe_server $out/bin
+    cp -v libudpipe.a $out/lib/
+    runHook postInstall
+  '';
+
+  passthru.tests = {
+    version = testers.testVersion { package = udpipe1; };
+    run = callPackage ./test.nix { udpipe1 = finalAttrs.finalPackage; };
+  };
+
+  meta = {
+    description = "Trainable pipeline for tokenizing, tagging, lemmatizing and parsing Universal Treebanks and other CoNLL-U files";
+    homepage = "https://github.com/ufal/udpipe";
+    changelog = "https://github.com/ufal/udpipe/blob/${finalAttrs.version}/CHANGES.md";
+    license = lib.licenses.mpl20;
+    maintainers = with lib.maintainers; [ unhammer ];
+    mainProgram = "udpipe";
+    platforms = lib.platforms.all;
+    badPlatforms = [ "aarch64-linux" ]; # until https://github.com/ufal/cpp_builtem/pull/2 is merged
+  };
+})
--- a/pkgs/by-name/ud/udpipe1/test.nix
+++ b/pkgs/by-name/ud/udpipe1/test.nix
@@ -0,0 +1,10 @@
+{ runCommand, udpipe1 }:
+
+runCommand "udpipe1-test-run"
+  {
+    nativeBuildInputs = [ udpipe1 ];
+  }
+  ''
+    diff -U3 --color=auto <(udpipe --version|head -n1) <(echo 'UDPipe version 1.3.1 (using UniLib 3.3.1,')
+    touch $out
+  ''
--- a/pkgs/by-name/ul/ultrastardx/package.nix
+++ b/pkgs/by-name/ul/ultrastardx/package.nix
@@ -46,13 +46,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "ultrastardx";
-  version = "2026.8.0";
+  version = "2026.8.1";

  src = fetchFromGitHub {
    owner = "UltraStar-Deluxe";
    repo = "USDX";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-dtZrVsXXpy70aJvMqs/IUPsvRd52FKpm9I5XuZSLwCY=";
+    hash = "sha256-z6gEjXZwq4jSUEjhECo4E5AI3bMETilmvYzTW6OXN2M=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/wa/warmup-s3-archives/package.nix
+++ b/pkgs/by-name/wa/warmup-s3-archives/package.nix
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "warmup-s3-archives";
-  version = "1.2.2";
+  version = "1.3.0";

  src = fetchFromGitLab {
    owner = "philipmw";
    repo = "warmup-s3-archives";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-B/8OSqKA3tJhjdShiqAqJrTOc8OuSBLfZ1U9xvvP6vQ=";
+    hash = "sha256-5lPwhN2lbnU+QpB3ou7M3EKrinn99uz9DKqVLqohATc=";
  };

-  cargoHash = "sha256-31p6IfX5VFSz4tNrjgFigsuTsPA3iO6m3QV6KOb2GKQ=";
+  cargoHash = "sha256-ToZ9hZjW6tvUUsmvU5lkDLbQ2at7Scn6w+jXJupxA84=";

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/xh/xhosts/package.nix
+++ b/pkgs/by-name/xh/xhosts/package.nix
@@ -6,7 +6,7 @@

 rustPlatform.buildRustPackage {
  pname = "nss-xhosts";
-  version = "unstable-2023-12-30";
+  version = "0-unstable-2023-12-30";

  src = fetchFromGitHub {
    owner = "dvob";
--- a/pkgs/development/compilers/microhs/common.nix
+++ b/pkgs/development/compilers/microhs/common.nix
@@ -54,10 +54,7 @@ let
      homepage = "https://github.com/augustss/MicroHs";
      license = lib.licensesSpdx."Apache-2.0";
      mainProgram = "mhs";
-      maintainers = with lib.maintainers; [
-        AlexandreTunstall
-        steeleduncan
-      ];
+      maintainers = with lib.maintainers; [ AlexandreTunstall ];
      platforms = lib.platforms.all;
    };
  };
--- a/pkgs/development/python-modules/pyimouapi/default.nix
+++ b/pkgs/development/python-modules/pyimouapi/default.nix
@@ -12,14 +12,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "pyimouapi";
-  version = "1.3.4";
+  version = "1.3.5";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Imou-OpenPlatform";
    repo = "Py-Imou-Open-Api";
    tag = finalAttrs.version;
-    hash = "sha256-rX6BQFxUktrlZAhjRySheQRbEu6TFKxZwpjIi1wx85I=";
+    hash = "sha256-fcM0yIZoKkAGhags0UH6mKntgpGkuX1kzf+57okOvq4=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/pyinstaller/default.nix
+++ b/pkgs/development/python-modules/pyinstaller/default.nix
@@ -19,17 +19,16 @@
  # tests
  binutils,
  glibc,
-  pyinstaller,
-  testers,
+  versionCheckHook,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "pyinstaller";
  version = "6.22.2";
  pyproject = true;

  src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
    hash = "sha256-ibZaOtB9ndWDIlPje8RfMYctENf51cn9D91giKg4Kd0=";
  };

@@ -56,14 +55,12 @@ buildPythonPackage rec {

  pythonImportsCheck = [ "PyInstaller" ];

-  passthru.tests.version = testers.testVersion {
-    package = pyinstaller;
-  };
+  nativeCheckInputs = [ versionCheckHook ];

  meta = {
    description = "Tool to bundle a python application with dependencies into a single package";
    homepage = "https://pyinstaller.org/";
-    changelog = "https://pyinstaller.org/en/v${version}/CHANGES.html";
+    changelog = "https://pyinstaller.org/en/v${finalAttrs.version}/CHANGES.html";
    downloadPage = "https://pypi.org/project/pyinstaller/";
    license = with lib.licenses; [
      mit
@@ -73,4 +70,4 @@ buildPythonPackage rec {
    maintainers = with lib.maintainers; [ h7x4 ];
    mainProgram = "pyinstaller";
  };
-}
+})
--- a/pkgs/development/python-modules/pywidevine/construct-2.10-compatibility.patch
+++ b/pkgs/development/python-modules/pywidevine/construct-2.10-compatibility.patch
@@ -0,0 +1,20 @@
+--- a/pywidevine/device.py
+++ b/pywidevine/device.py
+@@ -33,7 +33,7 @@ class _Structures:
+     # - Removed vmp and vmp_len as it should already be within the Client ID
+     v2 = Struct(
+         "signature" / magic,
+-        "version" / Const(Int8ub, 2),
+        "version" / Const(2, Int8ub),
+         "type_" / CEnum(
+             Int8ub,
+             **{t.name: t.value for t in DeviceTypes}
+@@ -50,7 +50,7 @@ class _Structures:
+     # - Removed system_id as it can be retrieved from the Client ID's DRM Certificate
+     v1 = Struct(
+         "signature" / magic,
+-        "version" / Const(Int8ub, 1),
+        "version" / Const(1, Int8ub),
+         "type_" / CEnum(
+             Int8ub,
+             **{t.name: t.value for t in DeviceTypes}
--- a/pkgs/development/python-modules/pywidevine/default.nix
+++ b/pkgs/development/python-modules/pywidevine/default.nix
@@ -0,0 +1,51 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchPypi,
+  poetry-core,
+  pycryptodome,
+  protobuf,
+  requests,
+  pyyaml,
+  unidecode,
+  click,
+  pymp4,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "pywidevine";
+  version = "1.9.0";
+  pyproject = true;
+
+  src = fetchPypi {
+    inherit (finalAttrs) pname version;
+    hash = "sha256-Z0La9f15fFpIE+sTAO+zGB/83dDIxHjuKMfFNqoOUbI=";
+  };
+
+  patches = [
+    ./construct-2.10-compatibility.patch
+  ];
+
+  build-system = [ poetry-core ];
+
+  dependencies = [
+    click
+    protobuf
+    pycryptodome
+    pymp4
+    pyyaml
+    requests
+    unidecode
+  ];
+
+  pythonImportsCheck = [ "pywidevine" ];
+
+  meta = {
+    description = "Python implementation of Google's Widevine CDM";
+    homepage = "https://github.com/devine-dl/pywidevine";
+    changelog = "https://github.com/devine-dl/pywidevine/blob/v${finalAttrs.version}/CHANGELOG.md";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ bdim404 ];
+    mainProgram = "pywidevine";
+  };
+})
--- a/pkgs/development/tools/electron/binary/info.json
+++ b/pkgs/development/tools/electron/binary/info.json
@@ -21,32 +21,32 @@
    },
    "41": {
        "hashes": {
-            "aarch64-darwin": "8961cdb57c95c073ff4770bc9309953832f447575f1a91127010f7b4870884b3",
-            "aarch64-linux": "1c18f4e9a67a6b5affb33596d8c886f35063e0439cbef79a6fc7037d147d1bbb",
-            "armv7l-linux": "1f1d6a5aab2f23be9485a90b4ad11d9a22d251fc1c913897d7d0f8359c918123",
-            "headers": "1y047hd1yhm4iv8rng1q89fd3x4ry07lfljcbdd5vjfzcnqmgmmr",
-            "x86_64-linux": "333c08c551387056966838a9f55cb10cf8203e68ca99e83982ce53ddd40383e9"
+            "aarch64-darwin": "659ba4253ca14f0bd8e74d5a2da2d6da3e73e44c0209d2c3b5e6ca65ac40558a",
+            "aarch64-linux": "9dbb040d575c33f8b2d2ab944e429979b01b5261c0240cff4749892be1bc56ea",
+            "armv7l-linux": "c96c2107073136a1fe7619e09dab07a14d7f4acde9a28d04993e67e69a156d15",
+            "headers": "1nvq3xvz38xr64r1z7xa6wdmf6zykdsbl7angmy7bvr5rw4pi897",
+            "x86_64-linux": "a27291d502b16170fe49d14beab68c4d9a1040192500e1643a9ab0b11274f075"
        },
-        "version": "41.10.3"
+        "version": "41.10.6"
    },
    "42": {
        "hashes": {
-            "aarch64-darwin": "13b7c3782ac73ba64410542410a2d06f022c515730e97c5149aff2190a6c8e80",
-            "aarch64-linux": "ba1f8055a6b601e9cd771a7c750ed37b912c486a51f51e58654ed9414bc898ba",
-            "armv7l-linux": "32d446a7a8f1f430c2030a1b2cd4220e52f95d24a607db28539b00ac6141c1d5",
-            "headers": "1aidb6q7hfz0569qm8ah77dgw2zzp157ls1kbs0ylsifgvxc0zkd",
-            "x86_64-linux": "e85b28245deaa75c3c4f2cf5da084f4c7fbedd5af1630c59a827c41ac1f5e1af"
+            "aarch64-darwin": "ea14213b15708bf571f4685772fb562a6469bcb9c49f4148077727d681e82e57",
+            "aarch64-linux": "1064e5cc5aa6490bb094b5e665cad4c8d520dcd4d52581ad68877793199fb903",
+            "armv7l-linux": "41439e99891463e9bca4799e13ad636d8ecc81afc05bb6ac616b12747ab01bb7",
+            "headers": "1hjq26ssigp2dnfgg0wspsabvgpgm0cb63m5xkji9gsm2vf35rg1",
+            "x86_64-linux": "46fc1cd5d70de57c372fbc0f36870c4c4d80b127a0d452d80bd577c5a7d39b7d"
        },
-        "version": "42.7.1"
+        "version": "42.9.3"
    },
    "43": {
        "hashes": {
-            "aarch64-darwin": "ad4a0ae3c37ee05aa06c7e2ed0627608389790f0505a2b0d20319efbe33ffe28",
-            "aarch64-linux": "50e1cdefbf8590e0d89b0276314a99c7b98e8eed732204c6f1a1c2a38376ed87",
-            "armv7l-linux": "e5cf445bda3ef071bbe9f16dfbabbca61b24b528f2dcbdff227e98fb349c99e8",
-            "headers": "0jxrbsi1ipzkq3ah7vbqd3glzd423603ii1d1i7kabirxmxra5kk",
-            "x86_64-linux": "f77ca6ed67bbc68702b69b56ad499bca6ae090705ade7d04f0ac545e409dec68"
+            "aarch64-darwin": "fe3cac8cbfd9ba1739fac6c69166cf30848741f93cbe251d800ae6ef7cebb64b",
+            "aarch64-linux": "9e2b5cfbd387e138f06c7bb19b399bb3ee487dbb4110215df097d94e80431892",
+            "armv7l-linux": "2875860d6b7cb2e8a0142fb87f9f7be50a382a87a24bf15a0861f20ba53dc400",
+            "headers": "0q7l48q2l4srmkw67l1bhk3qbybnqamcr5z8yrsnbxk8aazqjshv",
+            "x86_64-linux": "79d4efd69f0ccf1fc11891ea5075329c7b3faddad79a08d9fb395bbd63169acf"
        },
-        "version": "43.2.0"
+        "version": "43.4.1"
    }
 }
--- a/pkgs/development/tools/electron/chromedriver/info.json
+++ b/pkgs/development/tools/electron/chromedriver/info.json
@@ -21,32 +21,32 @@
    },
    "41": {
        "hashes": {
-            "aarch64-darwin": "b15b61d91c8d02a9f6a8ba8ec943736103aa0158f61220cda3d51867e72de9ea",
-            "aarch64-linux": "210abfcb3e3c4ab1ebd2eeae6312ecd5fb04c91563df9aa35ab8e2110ea9e6cb",
-            "armv7l-linux": "f5e1aeeb9bbdfa698efc60b44c4e4e0fd0addb52746416789f079889f3da3295",
-            "headers": "1y047hd1yhm4iv8rng1q89fd3x4ry07lfljcbdd5vjfzcnqmgmmr",
-            "x86_64-linux": "ffd42b9ed6809e993e82ea967817b02257c8ca5ff522d6da7c87744aa243658c"
+            "aarch64-darwin": "1b61cc5f26ca9d329f1502697dc3e1f00fd92b593f6b1688acebd33279854d1b",
+            "aarch64-linux": "8676949b061c58d5e4454f392d5f91206f807f556d993c5ac2c58ab0dc53f372",
+            "armv7l-linux": "e7191ce892fad4cca3c302faa389e1e469402765b58ce5508969f8a5ee813b48",
+            "headers": "1nvq3xvz38xr64r1z7xa6wdmf6zykdsbl7angmy7bvr5rw4pi897",
+            "x86_64-linux": "652465ce0057fb670c5e7d4ee126fb5d6043d1c1bf9152901ac85231a5ffdbbb"
        },
-        "version": "41.10.3"
+        "version": "41.10.6"
    },
    "42": {
        "hashes": {
-            "aarch64-darwin": "86a51e959895606faea4d49e206cb343d61542f40a5814d636221176948e1054",
-            "aarch64-linux": "46f9a12160a0ddba75746a5d8e4d508a98a1ba757cd89dfa65a618805d5abc91",
-            "armv7l-linux": "ecdbdf8fa23e71c060e9bb0acab16e7887299b9a9534e43e1ffbfc7c308f0a9a",
-            "headers": "1aidb6q7hfz0569qm8ah77dgw2zzp157ls1kbs0ylsifgvxc0zkd",
-            "x86_64-linux": "3135cb825075c02456e05d45bf463284f79065002770ad00d2046c431fda1e77"
+            "aarch64-darwin": "68923728c4a777c64a7f4ea90f950c9859d981be341de75e8ee67265ebba28c9",
+            "aarch64-linux": "fdd4e11784b695bd0152b0aefb1262539ac763ec684cf8a3c50bb20ebcd2b084",
+            "armv7l-linux": "3cba937b4ccbe6d0409ed3064c1e126043e96160ac81183140eddfbb69366a07",
+            "headers": "1hjq26ssigp2dnfgg0wspsabvgpgm0cb63m5xkji9gsm2vf35rg1",
+            "x86_64-linux": "9abaadfe6c446613d3623ffb5de743aefba1afe4f8cb5928f293b330b0a7f2e6"
        },
-        "version": "42.7.1"
+        "version": "42.9.3"
    },
    "43": {
        "hashes": {
-            "aarch64-darwin": "a171d9b03328faf922a1046d822a7a318e8c5409932f16784e4df50c561ed867",
-            "aarch64-linux": "e065867528f16c723ba0eeedefb8b5bdacf3c18f083424bb9dbb2efb443807d6",
-            "armv7l-linux": "5c77f04d36705f8cc554aa83faa0187c6e181471e62d28713576dafb08b7742a",
-            "headers": "0jxrbsi1ipzkq3ah7vbqd3glzd423603ii1d1i7kabirxmxra5kk",
-            "x86_64-linux": "a7b40eb8e0dfcc98f0e9e08a62b769fe8a191990e263929b98e1b565ba44f06e"
+            "aarch64-darwin": "5facb44cd08b2d84054ec42ce9ef2d9ea9763bd081e93e04b835c82c6ea8ab49",
+            "aarch64-linux": "c9f666e0a2736378273545277e3fe00decfa856ff4701928c51adfeacd81b5a4",
+            "armv7l-linux": "2aaefcc5bd00d2ce61378c9f064e83f03177848526a057922dfef0cddbb0d49c",
+            "headers": "0q7l48q2l4srmkw67l1bhk3qbybnqamcr5z8yrsnbxk8aazqjshv",
+            "x86_64-linux": "7d66ef37dd8ac3dd9a80baf28193e686d97abddcd7229a47f021ec824259679e"
        },
-        "version": "43.2.0"
+        "version": "43.4.1"
    }
 }
--- a/pkgs/development/tools/electron/info.json
+++ b/pkgs/development/tools/electron/info.json
@@ -56,10 +56,10 @@
            },
            "src/electron": {
                "args": {
-                    "hash": "sha256-5dxL/+24XgRtShYUYDPEiTEWWSs4fRAZGs9KbwHepYw=",
+                    "hash": "sha256-cl0QDTNyO+hXh/B3uTUTK3UgwszIKd96+H64hn8RKuM=",
                    "owner": "electron",
                    "repo": "electron",
-                    "tag": "v41.10.3"
+                    "tag": "v41.10.6"
                },
                "fetcher": "fetchFromGitHub"
            },
@@ -1403,7 +1403,7 @@
        },
        "modules": "145",
        "node": "24.18.0",
-        "version": "41.10.3"
+        "version": "41.10.6"
    },
    "42": {
        "chrome": "148.0.7778.280",
@@ -1462,10 +1462,10 @@
            },
            "src/electron": {
                "args": {
-                    "hash": "sha256-1EUoEiND6qF+Lj+SEXvJe5zP5uLnvGEU7GRATk4h1J4=",
+                    "hash": "sha256-RGgR1Gi8EtRfuNQ86Q3y0a+ys0Um3ilmuykKtq6BHVI=",
                    "owner": "electron",
                    "repo": "electron",
-                    "tag": "v42.7.1"
+                    "tag": "v42.9.3"
                },
                "fetcher": "fetchFromGitHub"
            },
@@ -1815,10 +1815,10 @@
            },
            "src/third_party/electron_node": {
                "args": {
-                    "hash": "sha256-jlyRCBNU4YV5NKwsibJFcp7dRerfDlNFoCjWU1H1aqE=",
+                    "hash": "sha256-Pecc7wFTAcQmeCsXN6RGTuO1Wqyei+ChbpsJ7yBRHJI=",
                    "owner": "nodejs",
                    "repo": "node",
-                    "tag": "v24.18.0"
+                    "tag": "v24.18.1"
                },
                "fetcher": "fetchFromGitHub"
            },
@@ -2816,11 +2816,11 @@
            }
        },
        "modules": "146",
-        "node": "24.18.0",
-        "version": "42.7.1"
+        "node": "24.18.1",
+        "version": "42.9.3"
    },
    "43": {
-        "chrome": "150.0.7871.129",
+        "chrome": "150.0.7871.224",
        "chromium": {
            "deps": {
                "gn": {
@@ -2829,15 +2829,15 @@
                    "version": "0-unstable-2026-05-27"
                }
            },
-            "version": "150.0.7871.129"
+            "version": "150.0.7871.224"
        },
        "chromium_npm_hash": "sha256-pF0JtwFpPC4/fodbhSJnQKkczA9WlDg4VqEAy9aDVLg=",
        "deps": {
            "src": {
                "args": {
-                    "hash": "sha256-vO2/UI0MPa8Kpkr+hv4nABmzSwSkQO+Tq+eWPFCzd88=",
+                    "hash": "sha256-xlUNimJaRCiZKGaj3YtbVp2v8/jxbPiQHeSwX7o9ILQ=",
                    "postFetch": "rm -rf $(find $out/third_party/blink/web_tests ! -name BUILD.gn -mindepth 1 -maxdepth 1); rm -r $out/content/test/data; rm -rf $out/courgette/testdata; rm -r $out/extensions/test/data; rm -r $out/media/test/data; ",
-                    "tag": "150.0.7871.129",
+                    "tag": "150.0.7871.224",
                    "url": "https://chromium.googlesource.com/chromium/src.git"
                },
                "fetcher": "fetchFromGitiles"
@@ -2884,10 +2884,10 @@
            },
            "src/electron": {
                "args": {
-                    "hash": "sha256-Cv3XspF5/A4HCeSB+r3yilO9fMBtf5TBekG1ZM7eej8=",
+                    "hash": "sha256-sZMQ9KBxmW9xv5CiBgy0YBrxV2xlwrOWXR+f3YEp0H0=",
                    "owner": "electron",
                    "repo": "electron",
-                    "tag": "v43.2.0"
+                    "tag": "v43.4.1"
                },
                "fetcher": "fetchFromGitHub"
            },
@@ -2917,8 +2917,8 @@
            },
            "src/third_party/angle": {
                "args": {
-                    "hash": "sha256-fbjREn3D+quRRADGwR7V65BZt5b+1DgnsG4ZMhwGq6o=",
-                    "rev": "13e691adf3d4d3ebee2f7239731a07d3b9704956",
+                    "hash": "sha256-JzxdmLqaXc5vmaiXjVnatgXzKF1MmT1gBoQ/iTjjggU=",
+                    "rev": "674c1eb24c1250ddf5911ac46b5373cd084d4e78",
                    "url": "https://chromium.googlesource.com/angle/angle.git"
                },
                "fetcher": "fetchFromGitiles"
@@ -3117,8 +3117,8 @@
            },
            "src/third_party/dawn": {
                "args": {
-                    "hash": "sha256-tzomo+GTec2zixxk61gtlma/sjcBImgbLMwA+mIp1LM=",
-                    "rev": "01249a97332468dbdd6cf5edb8dd7bae77875de5",
+                    "hash": "sha256-ZcfSMBvdAdEJQv+qfwAe8EFHPAfPtuKLTIR5lDRKP3Q=",
+                    "rev": "d089fc91e7e4881362463faf8efe9ae435e34660",
                    "url": "https://dawn.googlesource.com/dawn.git"
                },
                "fetcher": "fetchFromGitiles"
@@ -3229,10 +3229,10 @@
            },
            "src/third_party/electron_node": {
                "args": {
-                    "hash": "sha256-jlyRCBNU4YV5NKwsibJFcp7dRerfDlNFoCjWU1H1aqE=",
+                    "hash": "sha256-Pecc7wFTAcQmeCsXN6RGTuO1Wqyei+ChbpsJ7yBRHJI=",
                    "owner": "nodejs",
                    "repo": "node",
-                    "tag": "v24.18.0"
+                    "tag": "v24.18.1"
                },
                "fetcher": "fetchFromGitHub"
            },
@@ -3728,8 +3728,8 @@
            },
            "src/third_party/openh264/src": {
                "args": {
-                    "hash": "sha256-tf0lnxATCkoq+xRti6gK6J47HwioAYWnpEsLGSA5Xdg=",
-                    "rev": "652bdb7719f30b52b08e506645a7322ff1b2cc6f",
+                    "hash": "sha256-KMn8T8jCs4tdsmrU/fEBd0IWnBdD702x9JdJ0p98ZGk=",
+                    "rev": "fca40fc19f5fb854609d297ae4bde71df72787c9",
                    "url": "https://chromium.googlesource.com/external/github.com/cisco/openh264"
                },
                "fetcher": "fetchFromGitiles"
@@ -3872,8 +3872,8 @@
            },
            "src/third_party/skia": {
                "args": {
-                    "hash": "sha256-SWmoX+sNaw4KnlTBPt63uBSYfQavJejB3+Vlw/gtWX8=",
-                    "rev": "bee4c917220040e147f14964635ff92ce6c5a3f6",
+                    "hash": "sha256-Aux2Gp3Fgu5me3jZbwRAouGpEPIMzo/dQGkQLZJNf2Y=",
+                    "rev": "a81173f17b197686dc1e6c78515de86e92ddc861",
                    "url": "https://skia.googlesource.com/skia.git"
                },
                "fetcher": "fetchFromGitiles"
@@ -4195,8 +4195,8 @@
            },
            "src/v8": {
                "args": {
-                    "hash": "sha256-bqzCZSpKdXgKv3O1I7ck1PEXCa/2jBT7hpBEKW0LgTA=",
-                    "rev": "2b2f69158528fdd9d86b778cfcc2d0a1c4f8c59f",
+                    "hash": "sha256-KCZnCIH6a9oAqMXZDsTuRQZv/JmdhasjlrQ5aYk/el4=",
+                    "rev": "17700469f857c3aaf7e2803a9b77b7b25ced9399",
                    "url": "https://chromium.googlesource.com/v8/v8.git"
                },
                "fetcher": "fetchFromGitiles"
@@ -4246,7 +4246,7 @@
            }
        },
        "modules": "148",
-        "node": "24.18.0",
-        "version": "43.2.0"
+        "node": "24.18.1",
+        "version": "43.4.1"
    }
 }
--- a/pkgs/os-specific/linux/amneziawg/sk-715.patch
+++ b/pkgs/os-specific/linux/amneziawg/sk-715.patch
@@ -27,10 +27,10 @@ index 3be1113..f5437cc 100644
 +
 #endif /* _WG_COMPAT_H */
 diff --git a/device.c b/device.c
-index c8f4312..4e7848e 100644
+index c8f4312..011e718 100644
 --- a/device.c
 +++ b/device.c
-@@ -379,12 +379,12 @@ static int wg_newlink(struct net_device *dev,
+@@ -379,7 +379,7 @@ static int wg_newlink(struct net_device *dev,
 #endif
 
 	wg->handshake_receive_wq = alloc_workqueue("wg-kex-%s",
@@ -39,12 +39,15 @@ index c8f4312..4e7848e 100644
 	if (!wg->handshake_receive_wq)
 		goto err_free_tstats;
 
- 	wg->handshake_send_wq = alloc_workqueue("wg-kex-%s",
-			WQ_UNBOUND | WQ_FREEZABLE, 0, dev->name);
-+			WQ_UNBOUND | WQ_FREEZABLE | WQ_PERCPU, 0, dev->name);
- 	if (!wg->handshake_send_wq)
+@@ -389,7 +389,7 @@ static int wg_newlink(struct net_device *dev,
 		goto err_destroy_handshake_receive;
 
+ 	wg->packet_crypt_wq = alloc_workqueue("wg-crypt-%s",
+-			WQ_CPU_INTENSIVE | WQ_MEM_RECLAIM, 0, dev->name);
+			WQ_CPU_INTENSIVE | WQ_MEM_RECLAIM | WQ_PERCPU, 0, dev->name);
+ 	if (!wg->packet_crypt_wq)
+ 		goto err_destroy_handshake_send;
+ 
 diff --git a/netlink.c b/netlink.c
 index b1da877..28f1efa 100644
 --- a/netlink.c
--- a/pkgs/servers/http/nginx/mainline.nix
+++ b/pkgs/servers/http/nginx/mainline.nix
@@ -1,6 +1,6 @@
 { callPackage, ... }@args:

 callPackage ./generic.nix args {
-  version = "1.31.3";
-  hash = "sha256-p2V8UIEcLZLZiVOV6Lhz72A5gULE2yHrZHgRw49t1SU=";
+  version = "1.31.4";
+  hash = "sha256-5vILZEoXpkPwWa5kZ6GXH+KBFYfQJeBxBodTofHjs8M=";
 }
--- a/pkgs/servers/klipper/klipper-flash.nix
+++ b/pkgs/servers/klipper/klipper-flash.nix
@@ -63,7 +63,11 @@ writeShellApplication {
  text =
    # generic USB script for most things with serial and bootloader (see MCU_TYPES in scripts/flash_usb.py)
    if flashDevice != null then
-      if (builtins.elem matchBoard flashUsbSupportedBoards) && matchPlatform != null then
+      if
+        matchBoard != null
+        && lib.any (prefix: lib.hasPrefix prefix matchBoard) flashUsbSupportedBoards
+        && matchPlatform != null
+      then
        ''
          ${klipper}/lib/scripts/flash_usb.py -t ${matchBoard} -d ${flashDevice} ${klipper-firmware}/klipper.bin "$@"
        ''
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -15880,20 +15880,23 @@ with self;

  HashSharedMem = buildPerlModule {
    pname = "Hash-SharedMem";
-    version = "0.005";
+    version = "0.006";
    src = fetchurl {
-      url = "mirror://cpan/authors/id/Z/ZE/ZEFRAM/Hash-SharedMem-0.005.tar.gz";
-      hash = "sha256-Mkd2gIYC973EStqpN4lTZUVAKakm+mEfMhyb9rlAu14=";
+      url = "mirror://cpan/authors/id/K/KS/KSTAR/Hash-SharedMem-0.006.tar.gz";
+      hash = "sha256-6gA2LUokkXUFYvJFHK61l0eDXZxWcthGPNlhwz7jh2E=";
    };
    env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isAarch64 "-mno-outline-atomics";
    buildInputs = [ ScalarString ];
+    # Project uses ExtUtils::MakeMaker, can use default `make` targets
+    buildPhase = null;
+    checkPhase = null;
+    installPhase = null;
    meta = {
      description = "Efficient shared mutable hash";
      license = with lib.licenses; [
        artistic1
        gpl1Plus
      ];
-      broken = stdenv.hostPlatform.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/staging-next/perl534Packages.HashSharedMem.x86_64-darwin
    };
  };

--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -17454,6 +17454,10 @@ self: super: with self; {

  pywfa = callPackage ../development/python-modules/pywfa { };

+  pywidevine = callPackage ../development/python-modules/pywidevine {
+    protobuf = protobuf6;
+  };
+
  pywikibot = callPackage ../development/python-modules/pywikibot { };

  pywilight = callPackage ../development/python-modules/pywilight { };