Merge master into staging-next

2026-07-21 08:01:31 +00:00 · 2026-06-28 17:10:52 +00:00
parent 67695b335b 6d72d15abb
commit ced89c7b32
76 changed files with 900 additions and 310 deletions
--- a/.github/ISSUE_TEMPLATE/04_build_failure.yml
+++ b/.github/ISSUE_TEMPLATE/04_build_failure.yml
@@ -56,12 +56,12 @@ body:
      description: |
        Can [Hydra](https://hydra.nixos.org), Nixpkgs' Continuous Integration system, reproduce this build failure?
        Please use the search function in the header bar to locate the last build job for the package in question.
-        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-red-x-274c.svg" width="20px" align="top" alt="Red X"> icon near the package entry, say '**Yes, Hydra can reproduce this build failure.**'
-        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-gray-x-2716.svg" width="20px" align="top" alt="Dark Gray X"> icon near the package entry, then the build failure occurs with another package, and you need to track the original failing package by going down the chain of 'Cached failures' until you reach the final package in the failing dependency chain. Once you locate the failing package, re-write this report against that package and say '**Yes, Hydra can reproduce this build failure.**'
-        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-check-2714.svg" width="20px" align="top" alt="Green Check Mark"> icon near the package entry, then it most likely means it's a local issue with your system. (Maybe you ran out of space?)
+        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/subprojects/hydra/root/static/images/emojione-red-x-274c.svg" width="20px" align="top" alt="Red X"> icon near the package entry, say '**Yes, Hydra can reproduce this build failure.**'
+        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/subprojects/hydra/root/static/images/emojione-gray-x-2716.svg" width="20px" align="top" alt="Dark Gray X"> icon near the package entry, then the build failure occurs with another package, and you need to track the original failing package by going down the chain of 'Cached failures' until you reach the final package in the failing dependency chain. Once you locate the failing package, re-write this report against that package and say '**Yes, Hydra can reproduce this build failure.**'
+        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/subprojects/hydra/root/static/images/emojione-check-2714.svg" width="20px" align="top" alt="Green Check Mark"> icon near the package entry, then it most likely means it's a local issue with your system. (Maybe you ran out of space?)
          You can still open a build failure report, but please say '**No, Hydra cannot reproduce this build failure.**' below.
-        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-question-2754.svg" width="20px" align="top" alt="Gray Question Mark"> icon near the package entry, say '**Hydra is currently rebuilding this package.**'
-        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/src/root/static/images/emojione-stopsign-1f6d1.svg" width="20px" align="top" alt="Red Stop Sign"> icon near the package entry, then the build job was stopped manually. If this occurs, please coordinate with the [Infrastructure Team](https://matrix.to/#/#infra:nixos.org), and say '**The last build job was manually cancelled.**'
+        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/subprojects/hydra/root/static/images/emojione-question-2754.svg" width="20px" align="top" alt="Gray Question Mark"> icon near the package entry, say '**Hydra is currently rebuilding this package.**'
+        - If there's a <img src="https://raw.githubusercontent.com/NixOS/hydra/refs/heads/master/subprojects/hydra/root/static/images/emojione-stopsign-1f6d1.svg" width="20px" align="top" alt="Red Stop Sign"> icon near the package entry, then the build job was stopped manually. If this occurs, please coordinate with the [Infrastructure Team](https://matrix.to/#/#infra:nixos.org), and say '**The last build job was manually cancelled.**'
        - If Hydra isn't supposed to build the package at all, say '**Hydra doesn’t try to build the package.**'
      options:
        - "Please select the Hydra Status."
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -214,6 +214,11 @@
    github = "2hexed";
    githubId = 54501296;
  };
+  _30350n = {
+    name = "Max Schlecht";
+    github = "30350n";
+    githubId = 34186858;
+  };
  _360ied = {
    name = "Brian Zhu";
    email = "therealbarryplayer@gmail.com";
@@ -28409,6 +28414,12 @@
    githubId = 5623227;
    name = "Quentin Boyer";
  };
+  tree-sapii = {
+    email = "supersapiiiiii@gmail.com";
+    github = "tree-sapii";
+    githubId = 144389458;
+    name = "sapii";
+  };
  treemo = {
    email = "matthieu.chevrier@treemo.fr";
    github = "treemo";
--- a/nixos/modules/services/networking/ntp/chrony.nix
+++ b/nixos/modules/services/networking/ntp/chrony.nix
@@ -300,6 +300,7 @@ in
      serviceConfig = {
        Type = "notify";
        ExecStart = "${chronyPkg}/bin/chronyd ${toString chronyFlags}";
+        Restart = "on-failure";

        # Proc filesystem
        ProcSubset = "pid";
--- a/nixos/tests/podman/tls-ghostunnel.nix
+++ b/nixos/tests/podman/tls-ghostunnel.nix
@@ -83,7 +83,7 @@ import ../make-test-python.nix (
    };

    testScript = ''
-      import os
+      import subprocess
      import shlex


@@ -93,7 +93,7 @@ import ../make-test-python.nix (

      def cmd(command):
        print(f"+{command}")
-        r = os.system(command)
+        r = subprocess.run(command, shell=True).returncode
        if r != 0:
          raise Exception(f"Command {command} failed with exit code {r}")

--- a/nixos/tests/your_spotify.nix
+++ b/nixos/tests/your_spotify.nix
@@ -6,6 +6,7 @@
  };

  nodes.machine = {
+    services.mongodb.package = pkgs.mongodb-ce;
    services.your_spotify = {
      enable = true;
      spotifySecretFile = pkgs.writeText "spotifySecretFile" "deadbeef";
--- a/pkgs/build-support/teleport/default.nix
+++ b/pkgs/build-support/teleport/default.nix
@@ -10,7 +10,7 @@
  nodejs,
  openssl,
  pkg-config,
-  pnpm_10_29_2,
+  pnpm_10,
  fetchPnpmDeps,
  pnpmConfigHook,
  rustc,
@@ -81,7 +81,7 @@ let
        pname
        version
        ;
-      pnpm = pnpm_10_29_2;
+      pnpm = pnpm_10;
      fetcherVersion = 3;
      hash = pnpmHash;
    };
@@ -91,7 +91,7 @@ let
      cargo
      nodejs
      pnpmConfigHook
-      pnpm_10_29_2
+      pnpm_10
      rustc
      rustc.llvmPackages.lld
      rustPlatform.cargoSetupHook
--- a/pkgs/by-name/bi/bitwarden-desktop/package.nix
+++ b/pkgs/by-name/bi/bitwarden-desktop/package.nix
@@ -21,19 +21,18 @@
 }:

 let
-  description = "Secure and free password manager for all of your devices";
  icon = "bitwarden";
  electron = electron_39;
 in
-buildNpmPackage rec {
+buildNpmPackage (finalAttrs: {
  pname = "bitwarden-desktop";
-  version = "2026.5.0";
+  version = "2026.6.0";

  src = fetchFromGitHub {
    owner = "bitwarden";
    repo = "clients";
-    rev = "desktop-v${version}";
-    hash = "sha256-R00wt5W4kKmFIODEaGoUqDwfGyHH/2PpiRaC8Gq3d88=";
+    tag = "desktop-v${finalAttrs.version}";
+    hash = "sha256-JIIis3wW0cU33ovRQfJi3HlB2YdLZ5IPvueq1dGFbas=";
  };

  patches = [
@@ -49,10 +48,6 @@ buildNpmPackage rec {
  ];

  postPatch = ''
-    # https://github.com/bitwarden/clients/pull/20480
-    substituteInPlace package-lock.json apps/desktop/desktop_native/napi/package.json \
-      --replace-fail '"@napi-rs/cli": "3.5.1"' '"@napi-rs/cli": "3.2.0"'
-
    # remove code under unfree license
    rm -r bitwarden_license

@@ -78,18 +73,18 @@ buildNpmPackage rec {
  ];

  npmWorkspace = "apps/desktop";
-  npmDepsFetcherVersion = 2;
-  npmDepsHash = "sha256-xmb3zwE8/nWpRlUOgTz2UhNRaUA8KW9sHQHA97pjjfg=";
+  npmDepsFetcherVersion = 3;
+  npmDepsHash = "sha256-mvFLZwWwIv4PbUwfTWvwZ9JyRoHJSwAA0cT4RXD0/YU=";

  cargoDeps = rustPlatform.fetchCargoVendor {
-    inherit
+    inherit (finalAttrs)
      pname
      version
      src
      cargoRoot
      patches
      ;
-    hash = "sha256-phvk4t1JKfSYGzm/vm1rT8A0fACHJF/C0WiZ2Lk3cV0=";
+    hash = "sha256-xyK3+z2yfCG9K5XAB6LNEeyqMRknONi6ZfY/3oko7Z8=";
  };
  cargoRoot = "apps/desktop/desktop_native";

@@ -169,7 +164,7 @@ buildNpmPackage rec {
  ];

  preCheck = ''
-    pushd ${cargoRoot}
+    pushd ${finalAttrs.cargoRoot}
    cargoCheckType=release
    HOME=$(mktemp -d)
  '';
@@ -223,7 +218,7 @@ buildNpmPackage rec {
      name = "bitwarden";
      exec = "bitwarden %U";
      inherit icon;
-      comment = description;
+      comment = finalAttrs.meta.description;
      desktopName = "Bitwarden";
      categories = [ "Utility" ];
      mimeTypes = [ "x-scheme-handler/bitwarden" ];
@@ -240,11 +235,14 @@ buildNpmPackage rec {
  };

  meta = {
-    changelog = "https://github.com/bitwarden/clients/releases/tag/${src.rev}";
-    inherit description;
+    changelog = "https://github.com/bitwarden/clients/releases/tag/${finalAttrs.src.tag}";
+    description = "Secure and free password manager for all of your devices";
    homepage = "https://bitwarden.com";
    license = lib.licenses.gpl3;
-    maintainers = with lib.maintainers; [ amarshall ];
+    maintainers = with lib.maintainers; [
+      tree-sapii
+      amarshall
+    ];
    platforms = [
      "x86_64-linux"
      "aarch64-linux"
@@ -253,4 +251,4 @@ buildNpmPackage rec {
    ];
    mainProgram = "bitwarden";
  };
-}
+})
--- a/pkgs/by-name/bo/bottom/package.nix
+++ b/pkgs/by-name/bo/bottom/package.nix
@@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "bottom";
-  version = "0.13.0";
+  version = "0.14.2";

  src = fetchFromGitHub {
    owner = "ClementTsang";
    repo = "bottom";
    tag = finalAttrs.version;
-    hash = "sha256-UlkdYrfIjZU6N9W3KSZj4Au333DdejQG3TPRu5CjuBE=";
+    hash = "sha256-0RaMkTmX6figTBjAxoH57330pHpVJJP8br33FxezqB0=";
  };

-  cargoHash = "sha256-bQOhLlnMHFq5O5OUPWGmt00miKJTycBdhDUnfuUWPVk=";
+  cargoHash = "sha256-wCcc0t8MA0koeGdqVcz4uYKChU7gtHTQ8yqZGNigSxA=";

  nativeBuildInputs = [
    autoAddDriverRunpath
--- a/pkgs/by-name/bo/box-cli/package.nix
+++ b/pkgs/by-name/bo/box-cli/package.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  stdenv,
+  fetchurl,
+  installShellFiles,
+}:
+
+let
+  sources = lib.importJSON ./sources.json;
+  platform =
+    sources.platforms.${stdenv.hostPlatform.system}
+      or (throw "Unsupported platform: ${stdenv.hostPlatform.system}");
+in
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "box-cli";
+  inherit (sources) version;
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchurl {
+    url = "https://github.com/ariana-dot-dev/agent-server/releases/download/${sources.tag}/${platform.filename}";
+    inherit (platform) hash;
+  };
+
+  dontUnpack = true;
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 $src $out/bin/box
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "CLI for Ascii Box cloud sandboxes";
+    homepage = "https://ascii.dev";
+    license = lib.licenses.unfree;
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+    maintainers = with lib.maintainers; [ pwnwriter ];
+    mainProgram = "box";
+    platforms = lib.attrNames sources.platforms;
+  };
+})
--- a/pkgs/by-name/bo/box-cli/sources.json
+++ b/pkgs/by-name/bo/box-cli/sources.json
@@ -0,0 +1,22 @@
+{
+  "version": "0.1.112",
+  "tag": "box-cli-v0.1.112-ascii-prod1",
+  "platforms": {
+    "x86_64-linux": {
+      "filename": "box-linux-x64",
+      "hash": "sha256-DWQNenz/pmFVH5QM554lBk6+RwgOCjCBe7p+ZkHADTI="
+    },
+    "aarch64-linux": {
+      "filename": "box-linux-arm64",
+      "hash": "sha256-V2Sk6C1ZTRWlYQ2bVQTvK6PU8BkBPkmJMjUAo2Ul6+Q="
+    },
+    "x86_64-darwin": {
+      "filename": "box-darwin-x64",
+      "hash": "sha256-QI+ecq0O4dkKqdIvkONcYdXsS+EQLFIU35ulKGNSCRE="
+    },
+    "aarch64-darwin": {
+      "filename": "box-darwin-arm64",
+      "hash": "sha256-cyjMUGkWfNOggvtBfVqCijmcAj0P2SuFQORwg9EWbn0="
+    }
+  }
+}
--- a/pkgs/by-name/bo/box-cli/update.sh
+++ b/pkgs/by-name/bo/box-cli/update.sh
@@ -0,0 +1,57 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p curl jq nix
+
+set -euo pipefail
+
+cd "$(dirname "$0")"
+
+channel="ascii-prod"
+repo="ariana-dot-dev/agent-server"
+
+old_version=$(jq -r ".version" sources.json)
+
+tag=$(curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} \
+  "https://api.github.com/repos/${repo}/git/refs/tags/box-cli-v" \
+  | jq -r --arg channel "$channel" \
+    '[.[].ref | select(test($channel)) | ltrimstr("refs/tags/")] | sort_by(split(".")[2] | tonumber) | last')
+
+if [[ -z "$tag" || "$tag" == "null" ]]; then
+    echo "No box-cli release found for channel $channel"
+    exit 1
+fi
+
+version=$(echo "$tag" | sed -n 's/^box-cli-v\([0-9.]*\)-.*/\1/p')
+
+if [[ "$old_version" == "$version" ]]; then
+    echo "box-cli is already up to date at $version"
+    exit 0
+fi
+
+echo "Updating box-cli from $old_version to $version"
+
+declare -A platforms=(
+    [x86_64-linux]="box-linux-x64"
+    [aarch64-linux]="box-linux-arm64"
+    [x86_64-darwin]="box-darwin-x64"
+    [aarch64-darwin]="box-darwin-arm64"
+)
+
+sources_tmp="$(mktemp)"
+jq -n --arg v "$version" --arg t "$tag" '{version: $v, tag: $t, platforms: {}}' > "$sources_tmp"
+
+for platform in "${!platforms[@]}"; do
+    filename="${platforms[$platform]}"
+    url="https://github.com/${repo}/releases/download/${tag}/${filename}"
+    echo "Fetching hash for $platform ($filename)..."
+    sha256hash="$(nix-prefetch-url --type sha256 "$url")"
+    hash="$(nix hash convert --to sri --hash-algo sha256 "$sha256hash")"
+    jq --arg platform "$platform" \
+       --arg filename "$filename" \
+       --arg hash "$hash" \
+       '.platforms += {($platform): {filename: $filename, hash: $hash}}' \
+       "$sources_tmp" > "${sources_tmp}.tmp" && mv "${sources_tmp}.tmp" "$sources_tmp"
+done
+
+mv "$sources_tmp" sources.json
+
+echo "Updated box-cli to $version (tag: $tag)"
--- a/pkgs/by-name/br/brutus/package.nix
+++ b/pkgs/by-name/br/brutus/package.nix
@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "brutus";
-  version = "1.5.1";
+  version = "1.6.0";

  src = fetchFromGitHub {
    owner = "praetorian-inc";
    repo = "brutus";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Jk4O0euYvW7e8iwS0zmKAmw4yXMNU0ABovznzv5tXVM=";
+    hash = "sha256-Kb5+ue83YEHUG6Ezi7e7WmljHUPRXXD7/bT2ypTZVg4=";
  };

-  vendorHash = "sha256-YdnKRxPagV6h22QEEOpC/HNUGfyFyWwIsh2LxMUmMrk=";
+  vendorHash = "sha256-XpwwFz8PfyTksLD0SomC5BE0tzUL9D/qtBSed4mrsXQ=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/ca/camera-streamer/package.nix
+++ b/pkgs/by-name/ca/camera-streamer/package.nix
@@ -0,0 +1,80 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  cmake,
+  makeWrapper,
+  pkg-config,
+  which,
+  xxd,
+  ffmpeg,
+  libcamera,
+  live555,
+  openssl,
+  v4l-utils,
+}:
+stdenv.mkDerivation rec {
+  pname = "camera-streamer";
+  version = "0.4.2";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "ayufan";
+    repo = "camera-streamer";
+    tag = "v${version}";
+    hash = "sha256-umU8Rp8+wUvQCNK8OpgND/6gPD013SB6sdXSLy5UGAQ=";
+    fetchSubmodules = true;
+  };
+
+  # not sure why the -Werror isn't being an issue for the project maintainer
+  # my best guess is it's because the project README specifices
+  # "Debian Bookworm" as a requirement which provides gcc12 by default
+  postPatch = ''
+    sed -i 's|git submodule update.*||' Makefile
+    substituteInPlace Makefile --replace-warn "-Werror" ""
+  '';
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+    makeWrapper
+    pkg-config
+    which
+    xxd
+  ];
+
+  buildInputs = [
+    ffmpeg
+    libcamera
+    live555
+    openssl
+  ];
+
+  dontUseCmakeConfigure = true;
+
+  makeFlags = [
+    "GIT_VERSION=${src.tag}"
+    "GIT_REVISION=${src.rev}"
+  ];
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D camera-streamer $out/bin/camera-streamer
+    wrapProgram $out/bin/camera-streamer --prefix PATH : ${lib.makeBinPath [ v4l-utils ]}
+
+    runHook postInstall
+  '';
+
+  meta = {
+    homepage = "https://github.com/ayufan/camera-streamer";
+    changelog = "https://github.com/ayufan/camera-streamer/releases/tag/v${version}";
+    description = "High-performance low-latency camera streamer for Raspberry PI's";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ _30350n ];
+    platforms = lib.platforms.linux;
+    mainProgram = "camera-streamer";
+  };
+}
--- a/pkgs/by-name/ce/cedar/package.nix
+++ b/pkgs/by-name/ce/cedar/package.nix
@@ -9,16 +9,27 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cedar";
-  version = "4.5.1";
+  version = "4.11.0";

  src = fetchFromGitHub {
    owner = "cedar-policy";
    repo = "cedar";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-f8d7KL1DzEfJqEJ5uwwOJCgePE/frOXIFcXuoybIp2U=";
+    hash = "sha256-9IJ/AMWOtkNAoBbzTKqUZI87MvHPihdhNBwsmn0qpDA=";
  };

-  cargoHash = "sha256-MK6Zcpf12mGzntEv632kQjH7YOx31QBCmSJHxjE3l1c=";
+  cargoHash = "sha256-sinfwdi3/ZFmdbxRiUbtmhsVGcJenn82HFu8mJz415I=";
+
+  cargoBuildFlags = [
+    "--bin"
+    "cedar"
+  ];
+
+  cargoTestFlags = finalAttrs.cargoBuildFlags;
+
+  preCheck = ''
+    export TMPDIR="/tmp"
+  '';

  passthru = {
    tests.version = testers.testVersion { package = cedar; };
--- a/pkgs/by-name/ch/chisel/package.nix
+++ b/pkgs/by-name/ch/chisel/package.nix
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "chisel";
-  version = "1.11.6";
+  version = "1.11.7";

  src = fetchFromGitHub {
    owner = "jpillora";
    repo = "chisel";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-3pLqTOVJfp9MiorObS8I1KHB0MthzzK3oLFz+5emqxE=";
+    hash = "sha256-VLQsYxd7wMRTrmqO5dGgqmhL/oOQULEIMo4xUaKXG5I=";
  };

  vendorHash = "sha256-hqHd+62csVjHY2oAvi5fwlI0LbjR/LSDg6b1SMwe8Fw=";
--- a/pkgs/by-name/ch/chromium-hsts-preload-list/package.nix
+++ b/pkgs/by-name/ch/chromium-hsts-preload-list/package.nix
@@ -0,0 +1,37 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "chromium-hsts-preload-list";
+  version = "151.0.7891.2";
+
+  src = fetchurl {
+    url = "https://raw.github.com/chromium/chromium/${finalAttrs.version}/net/http/transport_security_state_static.json";
+    hash = "sha256-YuiotSk0Lf3IHz/UjgCmU/brdB1lszob6DN4DXyjiWU=";
+  };
+
+  dontUnpack = true;
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm444 $src $out/share/chromium-hsts-preload-list/transport_security_state_static.json
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = ./update.sh;
+
+  meta = {
+    description = "Chromium HSTS preload list";
+    homepage = "https://www.chromium.org/hsts/";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ schembriaiden ];
+    platforms = lib.platforms.all;
+  };
+})
--- a/pkgs/by-name/ch/chromium-hsts-preload-list/update.sh
+++ b/pkgs/by-name/ch/chromium-hsts-preload-list/update.sh
@@ -0,0 +1,17 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p common-updater-scripts curl jq nix
+
+set -euo pipefail
+
+latest_version=$(
+    curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://api.github.com/repos/chromium/chromium/tags" \
+        | jq -r 'map(select(.prerelease | not)) | .[1].name'
+)
+
+hash=$(
+    nix-prefetch-url "https://raw.github.com/chromium/chromium/$latest_version/net/http/transport_security_state_static.json"
+)
+sri_hash=$(nix hash convert --hash-algo sha256 --to sri "$hash")
+
+cd "$(dirname "$0")/../../../.."
+update-source-version chromium-hsts-preload-list "$latest_version" "$sri_hash"
--- a/pkgs/by-name/de/deskflow/package.nix
+++ b/pkgs/by-name/de/deskflow/package.nix
@@ -58,6 +58,7 @@ stdenv.mkDerivation (finalAttrs: {

  cmakeFlags = [
    "-DCMAKE_SKIP_RPATH=ON" # Avoid generating incorrect RPATH
+    "-DSKIP_BUILD_TESTS=ON" # Perform unit tests in `checkPhase` manually, with one job at a time.
  ];

  strictDeps = true;
@@ -99,6 +100,7 @@ stdenv.mkDerivation (finalAttrs: {
    runHook preCheck

    export QT_QPA_PLATFORM=offscreen
+    ctest --test-dir  "src/unittests" --output-on-failure
    ./bin/legacytests

    runHook postCheck
--- a/pkgs/by-name/ev/everforest-gtk-theme/gtk3-remove-border-spacing.patch
+++ b/pkgs/by-name/ev/everforest-gtk-theme/gtk3-remove-border-spacing.patch
@@ -0,0 +1,12 @@
+diff --git a/themes/src/sass/gtk/_common-3.0.scss b/themes/src/sass/gtk/_common-3.0.scss
+index 4148a1b4..735905e9 100644
+--- a/themes/src/sass/gtk/_common-3.0.scss
+++ b/themes/src/sass/gtk/_common-3.0.scss
+@@ -1119,7 +1119,6 @@ dropdown {
+ 
+ 	> button > box {
+ 		border-radius: 0 $modal-radius $modal-radius 0;
+-		border-spacing: $space-size;
+ 
+ 		> stack > row.activatable {
+ 			&:hover,
--- a/pkgs/by-name/ev/everforest-gtk-theme/package.nix
+++ b/pkgs/by-name/ev/everforest-gtk-theme/package.nix
@@ -23,6 +23,9 @@ stdenvNoCC.mkDerivation {
    # remove when merged
    # https://github.com/Fausto-Korpsvart/Everforest-GTK-Theme/pull/34
    ./fix-install-script.patch
+    # remove when merged
+    # https://github.com/Fausto-Korpsvart/Everforest-GTK-Theme/pull/35
+    ./gtk3-remove-border-spacing.patch
  ];

  propagatedUserEnvPkgs = [
--- a/pkgs/by-name/ga/garage-webui/package.nix
+++ b/pkgs/by-name/ga/garage-webui/package.nix
@@ -1,75 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  buildGoModule,
-  nodejs,
-  pnpm_9,
-  fetchPnpmDeps,
-  pnpmConfigHook,
-  nix-update-script,
-}:
-buildGoModule (finalAttrs: {
-  pname = "garage-webui";
-  version = "1.1.0";
-
-  src = fetchFromGitHub {
-    owner = "khairul169";
-    repo = "garage-webui";
-    tag = finalAttrs.version;
-    hash = "sha256-bqUAhZBSQkWZ1QsgPslEUDwt8NOg25Os0NGlPoyjPL4=";
-  };
-
-  frontend = stdenv.mkDerivation (finalAttrs': {
-    pname = "${finalAttrs.pname}-frontend";
-    inherit (finalAttrs) version src;
-
-    nativeBuildInputs = [
-      nodejs
-      pnpmConfigHook
-      pnpm_9
-    ];
-
-    pnpmDeps = fetchPnpmDeps {
-      inherit (finalAttrs') pname version src;
-      pnpm = pnpm_9;
-      fetcherVersion = 3;
-      hash = "sha256-z/Y9q/SE2c/KYzIOAfATlprjr6NjmmUHQB+ZbO39OK4=";
-    };
-
-    buildPhase = ''
-      runHook preBuild
-      pnpm run build
-      runHook postBuild
-    '';
-
-    installPhase = ''
-      runHook preInstall
-      cp -r dist $out/
-      runHook postInstall
-    '';
-  });
-
-  preBuild = ''
-    cp -r ${finalAttrs.frontend} ./ui/dist
-  '';
-
-  modRoot = "./backend";
-  tags = [ "prod" ];
-  env.CGO_ENABLED = 0;
-  vendorHash = "sha256-7z6r6w/SbBlYYHMxm11xFl/QEYZc2KebnOJZRgYRUYk=";
-
-  passthru = {
-    updateScript = nix-update-script { };
-  };
-
-  meta = {
-    description = "Simple admin web UI for Garage";
-    homepage = "https://github.com/khairul169/garage-webui";
-    changelog = "https://github.com/khairul169/garage-webui/releases/tag/${finalAttrs.version}";
-    mainProgram = "garage-webui";
-    license = lib.licenses.mit;
-    platforms = lib.platforms.all;
-    maintainers = with lib.maintainers; [ griffi-gh ];
-  };
-})
--- a/pkgs/by-name/gh/gh-aw/package.nix
+++ b/pkgs/by-name/gh/gh-aw/package.nix
@@ -6,7 +6,7 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "gh-aw";
-  version = "0.79.8";
+  version = "0.80.9";

  __structuredAttrs = true;

@@ -14,10 +14,10 @@ buildGoModule (finalAttrs: {
    owner = "github";
    repo = "gh-aw";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-n1w235wCvHZs48PWIu3v4qob3SQPt1kMLszHe/7Rcwg=";
+    hash = "sha256-2BGFKy/X8j0jYQc+W2rLZmZmPgCvZ+QOZweQaAQQJLM=";
  };

-  vendorHash = "sha256-GgDf2Ly8Vs/FTqk3w5yNYn/X1bWyfUBWhfl8QH2WFVg=";
+  vendorHash = "sha256-jxh8R/X12/QHxZOIKsTvS6FcDQSmJ7RJEvDnJuUr93A=";

  subPackages = [ "cmd/gh-aw" ];

--- a/pkgs/by-name/gl/glaze/package.nix
+++ b/pkgs/by-name/gl/glaze/package.nix
@@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "glaze";
-  version = "7.8.2";
+  version = "7.8.3";

  src = fetchFromGitHub {
    owner = "stephenberry";
    repo = "glaze";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-T0oYGqmF+0gXT4VESN4h1P/rUfV9BGmpvLWp+6BKiFI=";
+    hash = "sha256-WqtaZ3AVDs1oIfAVQuU63eg+0753LoYfv/pRyG9OMnM=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/gu/guile-hoot/package.nix
+++ b/pkgs/by-name/gu/guile-hoot/package.nix
@@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "guile-hoot";
-  version = "0.8.0";
+  version = "0.9.0";

  src = fetchFromCodeberg {
    owner = "spritely";
    repo = "hoot";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-b372dMUsDTa+hYrOwvj+/YcwVP52BCJxwSGRaqSSWZs=";
+    hash = "sha256-ZzWGdLKiJF9lBKrlX7jCKnPlmWRi1dDB4zrfkIOMpQU=";
  };

  nativeBuildInputs = [
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
      libs = [ "$out" ] ++ finalAttrs.propagatedBuildInputs;
    in
    ''
-      cp ./repl/repl.js $out/share/guile-hoot/0.8.0/repl/repl.js
+      cp ./repl/repl.js $out/share/guile-hoot/${finalAttrs.version}/repl/repl.js
      wrapProgram $out/bin/hoot \
        --prefix GUILE_LOAD_PATH : ${lib.makeSearchPath guile.siteDir libs} \
        --prefix GUILE_LOAD_COMPILED_PATH : ${lib.makeSearchPath guile.siteCcacheDir libs}
@@ -62,7 +62,10 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    description = "Scheme to WebAssembly compiler backend for GNU Guile and a general purpose WASM toolchain";
    homepage = "https://codeberg.org/spritely/hoot";
-    license = lib.licenses.asl20;
+    license = with lib.licenses; [
+      asl20
+      lgpl3Plus
+    ];
    maintainers = with lib.maintainers; [ jinser ];
    platforms = lib.platforms.unix;
    mainProgram = "hoot";
--- a/pkgs/by-name/he/heroic-unwrapped/package.nix
+++ b/pkgs/by-name/he/heroic-unwrapped/package.nix
@@ -4,7 +4,7 @@
  stdenv,
  fetchFromGitHub,
  # Pinned, because our FODs are not guaranteed to be stable between major versions.
-  pnpm_10_29_2,
+  pnpm_10,
  fetchPnpmDeps,
  pnpmConfigHook,
  nodejs,
@@ -21,7 +21,7 @@
 }:

 let
-  pnpm = pnpm_10_29_2;
+  pnpm = pnpm_10;

  legendary = callPackage ./legendary.nix { };
  epic-integration = callPackage ./epic-integration.nix { };
--- a/pkgs/by-name/in/inter/package.nix
+++ b/pkgs/by-name/in/inter/package.nix
@@ -2,8 +2,8 @@
  lib,
  stdenvNoCC,
  fetchzip,
+  installFonts,
 }:
-
 stdenvNoCC.mkDerivation rec {
  pname = "inter";
  version = "4.1";
@@ -14,15 +14,13 @@ stdenvNoCC.mkDerivation rec {
    hash = "sha256-5vdKKvHAeZi6igrfpbOdhZlDX2/5+UvzlnCQV6DdqoQ=";
  };

-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/share/fonts/truetype
-    cp Inter.ttc InterVariable*.ttf $out/share/fonts/truetype
-
-    runHook postInstall
+  nativeBuildInputs = [ installFonts ];
+  postPatch = ''
+    rm extras/ -rf
  '';

+  dontInstallWebfonts = true;
+
  meta = {
    homepage = "https://rsms.me/inter/";
    description = "Typeface specially designed for user interfaces";
--- a/pkgs/by-name/jo/john/package.nix
+++ b/pkgs/by-name/jo/john/package.nix
@@ -95,6 +95,10 @@ stdenv.mkDerivation {
      scapy
      lxml
    ])
+    # For office2john.py
+    ++ (with python3Packages; [
+      olefile
+    ])
    ++ (with perlPackages; [
      # For pass_gen.pl
      DigestMD4
--- a/pkgs/by-name/ka/karakeep/package.nix
+++ b/pkgs/by-name/ka/karakeep/package.nix
@@ -52,18 +52,13 @@ stdenv.mkDerivation (finalAttrs: {
  ];

  pnpmDeps = fetchPnpmDeps {
-    inherit (finalAttrs) pname version;
+    inherit (finalAttrs)
+      pname
+      version
+      src
+      patches
+      ;
    pnpm = pnpm_9;
-
-    # We need to pass the patched source code, so pnpm sees the patched version
-    src = stdenv.mkDerivation {
-      name = "${finalAttrs.pname}-patched-source";
-      inherit (finalAttrs) src patches;
-      installPhase = ''
-        cp -pr --reflink=auto -- . $out
-      '';
-    };
-
    fetcherVersion = 3;
    hash = "sha256-aT4JPx3iYw4kw8GHXKWMnelSVT0q2S3PK8DgSCQCyKQ=";
  };
--- a/pkgs/by-name/kc/kcl/package.nix
+++ b/pkgs/by-name/kc/kcl/package.nix
@@ -11,16 +11,16 @@

 buildGoModule (finalAttrs: {
  pname = "kcl";
-  version = "0.12.3";
+  version = "0.12.4";

  src = fetchFromGitHub {
    owner = "kcl-lang";
    repo = "cli";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-vOdL+It8wY+U0Jt68KPAxMe3th0muaCXlEkuEphCVVY=";
+    hash = "sha256-jtAfFwgtIP2sJRH4RcGTgVn/S5yvA15q3u2xeWus/8s=";
  };

-  vendorHash = "sha256-NfRVgGtm8w/K0utb3/AlBfT71txpmJlOaFrdqGC8Dkg=";
+  vendorHash = "sha256-aKXfVDu3uTEeSzs4nVWQMUj+HaVkzk+iTr+lti+Yb6E=";

  subPackages = [ "cmd/kcl" ];

@@ -51,7 +51,7 @@ buildGoModule (finalAttrs: {
    runHook preInstallCheck
    set -o pipefail
    $out/bin/kcl --version | grep $version
-    $out/bin/kcl <(echo 'hello = "KCL"') | grep "hello: KCL"
+    $out/bin/kcl run <(echo 'hello = "KCL"') | grep "hello: KCL"
    runHook postInstallCheck
  '';

--- a/pkgs/by-name/ku/kulala-core/package.nix
+++ b/pkgs/by-name/ku/kulala-core/package.nix
@@ -116,7 +116,7 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  meta = {
-    description = "Core parser and runner for kulala.nvim";
+    description = "HTTP client library powering the Kulala toolchain";
    homepage = "https://github.com/mistweaverco/kulala-core";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ khaneliman ];
--- a/pkgs/by-name/la/ladybird/package.nix
+++ b/pkgs/by-name/la/ladybird/package.nix
@@ -7,6 +7,7 @@
  unicode-character-database,
  unicode-idna,
  publicsuffix-list,
+  chromium-hsts-preload-list,
  cmake,
  ninja,
  pkg-config,
@@ -14,6 +15,7 @@
  libavif,
  angle, # libEGL
  libjxl,
+  libedit,
  libpulseaudio,
  libwebp,
  libxcrypt,
@@ -34,6 +36,8 @@
  skia,
  nixosTests,
  unstableGitUpdater,
+  _experimental-update-script-combinators,
+  common-updater-scripts,
  libtommath,
  sdl3,
  icu78,
@@ -42,18 +46,18 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ladybird";
-  version = "0-unstable-2026-05-04";
+  version = "0-unstable-2026-06-05";

  src = fetchFromGitHub {
    owner = "LadybirdBrowser";
    repo = "ladybird";
-    rev = "90b790f8702a5d5c5a66ef02f8669da2838ca6e3";
-    hash = "sha256-BdJ24YtKMv8B6Vvequf9b5qr0S3FfFuphFo78mCIaN4=";
+    rev = "02b205361dd239e134f434e484b609d1fa5f1938";
+    hash = "sha256-+CVJjrL1kqT2A7r89F+riiHpMa39rcggqG9SByidUY4=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) src;
-    hash = "sha256-sbNYOdY56+waCVQHbGuvV5jT9EawV2IiGmL1e/O6ZRc=";
+    hash = "sha256-n0ACVH8NXwe7SIaGFoJ20WIGGR3XjcuLTwPSKGJpT5s=";
  };

  postPatch = ''
@@ -85,6 +89,9 @@ stdenv.mkDerivation (finalAttrs: {

    mkdir build/Caches/PublicSuffix
    cp ${publicsuffix-list}/share/publicsuffix/public_suffix_list.dat build/Caches/PublicSuffix
+
+    mkdir build/Caches/HSTSPreload
+    cp ${chromium-hsts-preload-list}/share/chromium-hsts-preload-list/transport_security_state_static.json build/Caches/HSTSPreload
  '';

  nativeBuildInputs = [
@@ -109,6 +116,7 @@ stdenv.mkDerivation (finalAttrs: {
    libavif
    angle # libEGL
    libjxl
+    libedit
    libwebp
    libxcrypt
    mimalloc
@@ -176,7 +184,25 @@ stdenv.mkDerivation (finalAttrs: {
    nixosTest = nixosTests.ladybird;
  };

-  passthru.updateScript = unstableGitUpdater { };
+  passthru.updateScript =
+    let
+      updateSource = unstableGitUpdater {
+        hardcodeZeroVersion = true;
+      };
+
+      updateCargoDeps = {
+        command = [
+          (lib.getExe' common-updater-scripts "update-source-version")
+          "ladybird"
+          "--ignore-same-version"
+          "--source-key=cargoDeps.vendorStaging"
+        ];
+      };
+    in
+    _experimental-update-script-combinators.sequence [
+      updateSource
+      updateCargoDeps
+    ];

  meta = {
    description = "Browser using the SerenityOS LibWeb engine with a Qt or Cocoa GUI";
--- a/pkgs/by-name/le/level-zero/package.nix
+++ b/pkgs/by-name/le/level-zero/package.nix
@@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "level-zero";
-  version = "1.29.0";
+  version = "1.31.0";

  src = fetchFromGitHub {
    owner = "oneapi-src";
    repo = "level-zero";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-2OtJoVO8C9E1bf2uQv01O99wtuguINRSX4dCM6S93ns=";
+    hash = "sha256-/3HVvivHKSwvrrFEU7LHP2H/6bHDBDyI1SVr/3A6Ie0=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/li/libhsts/package.nix
+++ b/pkgs/by-name/li/libhsts/package.nix
@@ -2,21 +2,12 @@
  lib,
  stdenv,
  fetchFromGitLab,
-  fetchurl,
+  chromium-hsts-preload-list,
  autoconf-archive,
  autoreconfHook,
  pkg-config,
  python3,
 }:
-let
-  chromium_version = "151.0.7891.2";
-
-  hsts_list = fetchurl {
-    url = "https://raw.github.com/chromium/chromium/${chromium_version}/net/http/transport_security_state_static.json";
-    hash = "sha256-YuiotSk0Lf3IHz/UjgCmU/brdB1lszob6DN4DXyjiWU=";
-  };
-
-in
 stdenv.mkDerivation rec {
  pname = "libhsts";
  version = "0.1.0";
@@ -39,7 +30,7 @@ stdenv.mkDerivation rec {

  postPatch = ''
    pushd tests
-    cp ${hsts_list} transport_security_state_static.json
+    cp ${chromium-hsts-preload-list}/share/chromium-hsts-preload-list/transport_security_state_static.json .
    # strip comments from json
    sed 's/^ *\/\/.*$//g' transport_security_state_static.json >hsts.json
    popd
@@ -53,8 +44,6 @@ stdenv.mkDerivation rec {
    python3
  ];

-  passthru.updateScript = ./update.sh;
-
  meta = {
    description = "Library to easily check a domain against the Chromium HSTS Preload list";
    mainProgram = "hsts";
--- a/pkgs/by-name/li/libhsts/update.sh
+++ b/pkgs/by-name/li/libhsts/update.sh
@@ -1,14 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p curl jq
-
-set -euo pipefail -x
-
-cd "$(dirname "$0")"
-
-chromium_version=$(curl -s ${GITHUB_TOKEN:+-u ":$GITHUB_TOKEN"} "https://api.github.com/repos/chromium/chromium/tags" | jq -r 'map(select(.prerelease | not)) | .[1].name')
-sha256=$(nix-prefetch-url "https://raw.github.com/chromium/chromium/$chromium_version/net/http/transport_security_state_static.json")
-hash=$(nix hash convert --to sri "$sha256")
-
-sed -e "0,/chromium_version/s/chromium_version = \".*\"/chromium_version = \"$chromium_version\"/" \
-    -e "0,/hash/s/hash = \".*\"/sha256 = \"$hash\"/" \
-  --in-place ./default.nix
--- a/pkgs/by-name/li/lightworks/package.nix
+++ b/pkgs/by-name/li/lightworks/package.nix
@@ -27,6 +27,7 @@
  gmp,
  libdrm,
  libpulseaudio,
+  sndio,
 }:
 let
  fullPath = lib.makeLibraryPath [
@@ -53,18 +54,19 @@ let
    gmp
    libdrm
    libpulseaudio
+    sndio
  ];

  lightworks = stdenv.mkDerivation rec {
-    version = "2025.1";
-    rev = "148287";
+    version = "2025.2";
+    rev = "56356";
    pname = "lightworks";

    src =
      if stdenv.hostPlatform.system == "x86_64-linux" then
        fetchurl {
-          url = "https://cdn.lwks.com/releases/${version}/lightworks_${version}_r${rev}.deb";
-          sha256 = "sha256-opYbWzZYim5wqSaxDeGmc10XxFkkE521PDB8OULh7Jc=";
+          url = "https://cdn.lwks.com/releases/${version}/Lightworks-${version}-${rev}.deb";
+          sha256 = "sha256-MQsXl10I85qHiOosBEpdrLPq3iIiFlzumQv2R2sXNn8=";
        }
      else
        throw "${pname}-${version} is not supported on ${stdenv.hostPlatform.system}";
@@ -125,6 +127,7 @@ buildFHSEnv {
      antonxy
      vojta001
      kashw2
+      tombert
    ];
    platforms = [ "x86_64-linux" ];
  };
--- a/pkgs/by-name/ma/matterjs-server/package.nix
+++ b/pkgs/by-name/ma/matterjs-server/package.nix
@@ -12,7 +12,7 @@

 buildNpmPackage (finalAttrs: {
  pname = "matterjs-server";
-  version = "1.1.1";
+  version = "1.1.2";
  __structuredAttrs = true;
  strictDeps = true;

@@ -20,10 +20,10 @@ buildNpmPackage (finalAttrs: {
    owner = "matter-js";
    repo = "matterjs-server";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-1BbAPTu9YFSYuZh7sIa1mpAGJtyWB3NWxls8zindmso=";
+    hash = "sha256-+ICWKZAcKwfd72eWUwmM7XmCwC4F6P+o1JsHNK2+ROE=";
  };

-  npmDepsHash = "sha256-FcGjEOpXMaB4GQGcFfOgFwXrkbGKb8q55j95x+m+lxQ=";
+  npmDepsHash = "sha256-L1G8/Y23deIjA4azMFLn+ZS95sKoRPSR1O7R8kZF5MU=";

  nativeBuildInputs = [
    makeBinaryWrapper
--- a/pkgs/by-name/mc/mcp-grafana/package.nix
+++ b/pkgs/by-name/mc/mcp-grafana/package.nix
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "mcp-grafana";
-  version = "0.16.0";
+  version = "0.17.0";

  src = fetchFromGitHub {
    owner = "grafana";
    repo = "mcp-grafana";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-/K7m+VexScHppGuxKsGpz18WmJ3Xphmk2/nCHphwL1o=";
+    hash = "sha256-uAVqmLGZzD1CMXIw/eYGh/15W2jDS8Iwr5jClRSuCyQ=";
  };

  vendorHash = "sha256-E7Uh5nG6elUhEa+4RCtgGrle0Py6TjRc+OOvjtik1D8=";
--- a/pkgs/by-name/ne/nextcloud-client/package.nix
+++ b/pkgs/by-name/ne/nextcloud-client/package.nix
@@ -23,7 +23,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "nextcloud-client";
-  version = "33.0.5";
+  version = "33.0.6";

  outputs = [
    "out"
@@ -34,7 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "nextcloud-releases";
    repo = "desktop";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-YRaND3JdZQZGtuNfthliyqcPvpC742h4C6l3HBbYorI=";
+    hash = "sha256-jIK8LszlX19KrhP0u1BNwBxujMg2/lEuYqWWNRMkoiE=";
  };

  patches = [
--- a/pkgs/by-name/ns/nsd/package.nix
+++ b/pkgs/by-name/ns/nsd/package.nix
@@ -2,9 +2,12 @@
  lib,
  stdenv,
  fetchurl,
+  fstrm,
  libevent,
  openssl,
  pkg-config,
+  protobuf,
+  protobufc,
  systemdMinimal,
  nixosTests,
  config,
@@ -14,37 +17,42 @@
  bind8Stats ? config.nsd.bind8Stats or false,
  checking ? config.nsd.checking or false,
  ipv6 ? config.nsd.ipv6 or true,
-  mmap ? config.nsd.mmap or false,
  minimalResponses ? config.nsd.minimalResponses or true,
+  mmap ? config.nsd.mmap or false,
  nsec3 ? config.nsd.nsec3 or true,
  ratelimit ? config.nsd.ratelimit or false,
  recvmmsg ? config.nsd.recvmmsg or false,
  rootServer ? config.nsd.rootServer or false,
  rrtypes ? config.nsd.rrtypes or false,
  zoneStats ? config.nsd.zoneStats or false,
+  withDnstap ? true,
  withSystemd ? config.nsd.withSystemd or (lib.meta.availableOn stdenv.hostPlatform systemdMinimal),
  configFile ? config.nsd.configFile or "/etc/nsd/nsd.conf",
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "nsd";
-  version = "4.12.0";
+  version = "4.14.3";

  src = fetchurl {
    url = "https://www.nlnetlabs.nl/downloads/nsd/nsd-${finalAttrs.version}.tar.gz";
-    hash = "sha256-+ezCz3m6UFgPLfYpGO/EQAhMW/EQV9tEwZqpZDzUteg=";
+    hash = "sha256-limtZNnBsBm74iKW1RSNeuZfWIziZaZCR1B0DwUrsSs=";
  };

  nativeBuildInputs = [
    pkg-config
-  ];
+  ]
+  ++ lib.optionals withDnstap [ protobuf ];

  buildInputs = [
    libevent
    openssl
  ]
-  ++ lib.optionals withSystemd [
-    systemdMinimal
+  ++ lib.optionals withSystemd [ systemdMinimal ]
+  ++ lib.optionals withDnstap [
+    fstrm
+    # NSD links against libprotobuf-c, it's not just a build-time dependency.
+    protobufc
  ];

  enableParallelBuilding = true;
@@ -73,6 +81,7 @@ stdenv.mkDerivation (finalAttrs: {
    ++ edf rootServer "root-server"
    ++ edf rrtypes "draft-rrtypes"
    ++ edf zoneStats "zone-stats"
+    ++ edf withDnstap "dnstap"
    ++ edf withSystemd "systemd"
    ++ [
      "--with-ssl=${openssl.dev}"
--- a/pkgs/by-name/nv/nvidia-container-toolkit/0001-Add-dlopen-discoverer.patch
+++ b/pkgs/by-name/nv/nvidia-container-toolkit/0001-Add-dlopen-discoverer.patch
@@ -1,20 +1,20 @@
-From e4449f06a8989ff22947309151855b388c311aed Mon Sep 17 00:00:00 2001
+From 0db315c9ca1e8f2144edf020aa4dd309e889d4d1 Mon Sep 17 00:00:00 2001
 From: Jared Baur <jaredbaur@fastmail.com>
 Date: Mon, 22 Jan 2024 20:42:48 -0800
 Subject: [PATCH] Add dlopen discoverer

 ---
- internal/lookup/dlopen.go  | 57 ++++++++++++++++++++++++++++++++++++++
- internal/lookup/library.go |  3 ++
- 2 files changed, 60 insertions(+)
- create mode 100644 internal/lookup/dlopen.go
+ pkg/lookup/dlopen.go  | 63 +++++++++++++++++++++++++++++++++++++++++++
+ pkg/lookup/library.go |  1 +
+ 2 files changed, 64 insertions(+)
+ create mode 100644 pkg/lookup/dlopen.go

-diff --git a/internal/lookup/dlopen.go b/internal/lookup/dlopen.go
+diff --git a/pkg/lookup/dlopen.go b/pkg/lookup/dlopen.go
 new file mode 100644
-index 00000000..7cd84522
+index 0000000..7af8ca0
 --- /dev/null
-+++ b/internal/lookup/dlopen.go
-@@ -0,0 +1,57 @@
+++ b/pkg/lookup/dlopen.go
+@@ -0,0 +1,63 @@
 +package lookup
 +
 +// #cgo LDFLAGS: -ldl
@@ -35,11 +35,17 @@ index 00000000..7cd84522
 +	file
 +}
 +
-+// NewDlopenLocator creats a locator that can be used for locating libraries
+// NewDlopenLocator creates a locator that can be used for locating libraries
 +// through the dlopen mechanism.
 +func NewDlopenLocator(opts ...Option) Locator {
-+	f := newFileLocator(opts...)
-+	d := dlopenLocator{file: *f}
+	o := NewFactory(opts...)
+	f := file{
+		logger:   o.logger,
+		filter:   o.filter,
+		count:    o.count,
+		prefixes: getSearchPrefixes(o.root, o.searchPaths...),
+	}
+	d := dlopenLocator{file: f}
 +	return &d
 +}
 +
@@ -72,19 +78,18 @@ index 00000000..7cd84522
 +
 +	return []string{libAbsolutePath}, nil
 +}
-diff --git a/internal/lookup/library.go b/internal/lookup/library.go
-index 7f5cf7c8..916edde2 100644
--- a/internal/lookup/library.go
-+++ b/internal/lookup/library.go
-@@ -61,7 +61,10 @@ func NewLibraryLocator(opts ...Option) Locator {
- 	// We construct a symlink locator for expected library locations.
- 	symlinkLocator := NewSymlinkLocator(opts...)
- 
-+	dlopenLocator := NewDlopenLocator(opts...)
-+
- 	l := First(
-+		dlopenLocator,
- 		symlinkLocator,
- 		newLdcacheLocator(opts...),
+diff --git a/pkg/lookup/library.go b/pkg/lookup/library.go
+index e57bd0e..adeff77 100644
+--- a/pkg/lookup/library.go
+++ b/pkg/lookup/library.go
+@@ -51,6 +51,7 @@ func NewLibraryLocator(opts ...Option) Locator {
+ 		}...),
 	)
--
+ 	l := First(
+		NewDlopenLocator(opts...),
+ 		NewSymlinkLocator(opts...),
+ 		f.newLdcacheLocator(),
+ 	)
+-- 
+2.54.0
+
--- a/pkgs/by-name/nv/nvidia-container-toolkit/package.nix
+++ b/pkgs/by-name/nv/nvidia-container-toolkit/package.nix
@@ -13,13 +13,13 @@ let
 in
 buildGoModule (finalAttrs: {
  pname = "nvidia-container-toolkit";
-  version = "1.18.2";
+  version = "1.19.1";

  src = fetchFromGitHub {
    owner = "NVIDIA";
    repo = "nvidia-container-toolkit";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-OMM7IQ65jPr9I5YUwVR3SXbuARnLjS2GSVq2j4J8uFY=";
+    hash = "sha256-0ivgJA5JY/17FIoOrOvUF7NjMMu7aXfh39sMQcabCm8=";

  };

@@ -33,11 +33,15 @@ buildGoModule (finalAttrs: {
  patches = [
    # This patch causes library lookups to first attempt loading via dlopen
    # before falling back to the regular symlink location and ldcache location.
+    # Required on NixOS, where the driver libraries live outside the ldcache and
+    # the FHS paths that the upstream locators search. Upstream tried to add an
+    # equivalent locator but reverted it; tracked in
+    # https://github.com/NVIDIA/nvidia-container-toolkit/issues/1677
    ./0001-Add-dlopen-discoverer.patch
  ];

  postPatch = ''
-    substituteInPlace internal/config/config.go \
+    substituteInPlace api/config/v1/config.go \
      --replace-fail '/usr/bin/nvidia-container-runtime-hook' "$tools/bin/nvidia-container-runtime-hook" \
      --replace-fail '/sbin/ldconfig' '${lib.getBin glibc}/sbin/ldconfig'

--- a/pkgs/by-name/op/open-stage-control-headless/package.nix
+++ b/pkgs/by-name/op/open-stage-control-headless/package.nix
@@ -0,0 +1,56 @@
+{
+  lib,
+  stdenv,
+  fetchzip,
+  unzip,
+  makeWrapper,
+  nodejs,
+  python3,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "open-stage-control-headless";
+  version = "1.30.3";
+
+  src = fetchzip {
+    url = "https://openstagecontrol.ammd.net/packages/open-stage-control_${finalAttrs.version}_node.zip";
+    hash = "sha256-ef9433pG+eMFc+7pReE2qA3hK27y5KyiRTPQ2h6Ir8A=";
+  };
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  buildInputs = [
+    python3.pkgs.python-rtmidi
+  ];
+
+  dontConfigure = true;
+  dontBuild = true;
+  sourceRoot = ".";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p "$out/lib/open-stage-control"
+    cp -r ./source/* "$out/lib/open-stage-control/"
+
+    mkdir -p "$out/bin"
+    makeWrapper ${nodejs}/bin/node "$out/bin/open-stage-control" \
+      --prefix PYTHONPATH : "$PYTHONPATH" \
+      --prefix PATH : ${lib.makeBinPath [ python3 ]} \
+      --add-flags "$out/lib/open-stage-control"
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Libre and modular OSC / MIDI controller";
+    homepage = "https://openstagecontrol.ammd.net/";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ eymeric ];
+    platforms = nodejs.meta.platforms;
+    mainProgram = "open-stage-control";
+  };
+})
--- a/pkgs/by-name/op/opencloud/idp-web.nix
+++ b/pkgs/by-name/op/opencloud/idp-web.nix
@@ -20,7 +20,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    pnpm = pnpm_11;
    sourceRoot = "${finalAttrs.src.name}/${finalAttrs.pnpmRoot}";
    fetcherVersion = 4;
-    hash = "sha256-NN5MmWYQgaG4s8+mnLWo8EzOobACOnYhdwt4+/4kz9o=";
+    hash = "sha256-pQ01vBvC29B5oxDWtt7anI5QtFbvQFFBVamQtA2WTNo=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/op/opencloud/package.nix
+++ b/pkgs/by-name/op/opencloud/package.nix
@@ -28,13 +28,13 @@ let
 in
 buildGoModule (finalAttrs: {
  pname = "opencloud";
-  version = "7.1.0";
+  version = "7.2.0";

  src = fetchFromGitHub {
    owner = "opencloud-eu";
    repo = "opencloud";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Lr/YF+vuaBIe6sQ+CeVuqV6BDe9jAIQLTZbCKyvn6As=";
+    hash = "sha256-GAoDEXk7sBN7N0V/msi/fcJS72RqqlF6Qb5B9hArmvk=";
  };

  postPatch = ''
--- a/pkgs/by-name/op/opencloud/web.nix
+++ b/pkgs/by-name/op/opencloud/web.nix
@@ -10,20 +10,20 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "opencloud-web";
-  version = "7.1.0";
+  version = "7.1.2";

  src = fetchFromGitHub {
    owner = "opencloud-eu";
    repo = "web";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-awEGCmdauqHkigXqumOYs8woOyY8gIccmzKOyrZ7SwQ=";
+    hash = "sha256-zwD/Mn7jL960EVaG3gVqFo6FPPMhQTMz3LKy8ZnOObk=";
  };

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
    pnpm = pnpm_11;
    fetcherVersion = 4;
-    hash = "sha256-oIVbhvFiVu0S7sSs5u14M0A1+Q1WmiAsyoBt8QtojyE=";
+    hash = "sha256-YEdZ5B11I6U140qam7e1TMOacRqUeINhr/TI13ddAa0=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/op/openlinkhub/package.nix
+++ b/pkgs/by-name/op/openlinkhub/package.nix
@@ -37,10 +37,12 @@ buildGoModule (finalAttrs: {
    runHook preInstall

    install -Dm 644 -t $out/etc/udev/rules.d 99-openlinkhub.rules
-    install -Dm 755 -t $out/bin $GOPATH/bin/OpenLinkHub
+    install -Dm 755 -t $out/opt/OpenLinkHub $GOPATH/bin/OpenLinkHub

-    mkdir -p $out/opt/OpenLinkHub
-    cp -r {database,static,web} $out/opt/OpenLinkHub
+    cp -rt $out/opt/OpenLinkHub database static web
+
+    mkdir -p $out/bin
+    ln -st $out/bin $out/opt/OpenLinkHub/OpenLinkHub

    runHook postInstall
  '';
--- a/pkgs/by-name/pi/pipeweaver/package.nix
+++ b/pkgs/by-name/pi/pipeweaver/package.nix
@@ -0,0 +1,126 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+  rustPlatform,
+  pkg-config,
+  pipewire,
+  nix-update-script,
+  stdenv,
+}:
+
+rustPlatform.buildRustPackage (
+  finalAttrs:
+  let
+    web = buildNpmPackage {
+      pname = "${finalAttrs.pname}-web";
+      inherit (finalAttrs) version src;
+
+      sourceRoot = "${finalAttrs.src.name}/web";
+
+      npmDepsHash = "sha256-ZX/3H/VdRdWC2j+mPA/0rZflDhslqTN1mqA9vvQRQG0=";
+
+      installPhase = ''
+        runHook preInstall
+        cp -r dist $out
+        runHook postInstall
+      '';
+    };
+  in
+  {
+    pname = "pipeweaver";
+    version = "0.1.6";
+
+    __structuredAttrs = true;
+
+    src = fetchFromGitHub {
+      owner = "pipeweaver";
+      repo = "pipeweaver";
+      tag = "v${finalAttrs.version}";
+      hash = "sha256-wf3gxCLT5vOz+5+CpfmkX0stKoAOpQ6KIoW6xBNV1xk=";
+    };
+
+    cargoHash = "sha256-Jv0fF6keg2NcUnCJhCId7rwPVZK1/Q9+otQNjp54RCI=";
+
+    nativeBuildInputs = [
+      pkg-config
+      rustPlatform.bindgenHook
+    ];
+
+    buildInputs = [
+      pipewire
+    ];
+
+    cargoBuildFlags = [
+      "--workspace"
+      "--exclude"
+      "pipeweaver-app"
+      "--all-features"
+    ];
+
+    cargoTestFlags = [
+      "--workspace"
+      "--exclude"
+      "pipeweaver-app"
+      "--all-features"
+    ];
+
+    postPatch = ''
+      # Prevent daemon/build.rs from running to prevent impure git and npm calls.
+      rm daemon/build.rs
+      substituteInPlace daemon/Cargo.toml --replace-fail 'build = "build.rs"' ""
+
+      mkdir -p daemon/web-content
+      cp -r ${web}/* daemon/web-content/
+    '';
+
+    # Provide GIT_HASH that build.rs would have set
+    env.GIT_HASH = finalAttrs.src.tag;
+
+    installPhase = ''
+      runHook preInstall
+
+      releaseDir=target/${stdenv.hostPlatform.rust.cargoShortTarget}/release
+
+      install -Dm755 $releaseDir/pipeweaver-daemon -t $out/bin
+      install -Dm755 $releaseDir/pipeweaver-client -t $out/bin
+
+      install -Dm644 daemon/resources/icons/pipeweaver.png \
+        $out/share/icons/hicolor/48x48/apps/pipeweaver.png
+      install -Dm644 daemon/resources/icons/pipeweaver.svg \
+        $out/share/icons/hicolor/scalable/apps/pipeweaver.svg
+      install -Dm644 daemon/resources/icons/pipeweaver-large.png \
+        $out/share/pixmaps/pipeweaver.png
+      install -Dm644 daemon/resources/desktop/pipeweaver.desktop \
+        $out/share/applications/pipeweaver.desktop
+
+      substituteInPlace $out/share/applications/pipeweaver.desktop \
+        --replace-fail "Path=/usr/bin" "Path=$out/bin" \
+        --replace-fail "Exec=/usr/bin/pipeweaver-daemon" "Exec=$out/bin/pipeweaver-daemon"
+
+      install -Dm644 README.md $out/share/doc/pipeweaver/README.md
+      install -Dm644 LICENSE $out/share/licenses/pipeweaver/LICENSE
+
+      runHook postInstall
+    '';
+
+    passthru = {
+      inherit web;
+      updateScript = nix-update-script {
+        extraArgs = [
+          "--subpackage"
+          "web"
+        ];
+      };
+    };
+
+    meta = {
+      description = "Manage streaming audio on Linux through PipeWire with virtual channels, mixing, and routing";
+      homepage = "https://github.com/pipeweaver/pipeweaver";
+      license = lib.licenses.mit;
+      mainProgram = "pipeweaver-daemon";
+      platforms = lib.platforms.linux;
+      maintainers = with lib.maintainers; [ saadndm ];
+    };
+  }
+)
--- a/pkgs/by-name/po/podman/package.nix
+++ b/pkgs/by-name/po/podman/package.nix
@@ -42,13 +42,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "podman";
-  version = "5.8.3";
+  version = "5.8.4";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "podman";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-MS5eaGTcCAtEvoQUhGlX8UfoOqNOv0VAoeFxfAvB3Zs=";
+    hash = "sha256-zhEtMZVKiv1L72EMlwgz8sHpmvhejGp98oW63aPj+rQ=";
  };

  patches = [
@@ -204,5 +204,6 @@ buildGoModule (finalAttrs: {
    license = lib.licenses.asl20;
    teams = [ lib.teams.podman ];
    mainProgram = "podman";
+    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/by-name/pr/project-graph/package.nix
+++ b/pkgs/by-name/pr/project-graph/package.nix
@@ -16,11 +16,14 @@
  jq,
  versionCheckHook,
  nix-update-script,
+  libGL,
+  gst_all_1,
+  qt6,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "project-graph";
-  version = "3.0.7";
+  version = "3.0.8";

  __structuredAttrs = true;

@@ -28,18 +31,25 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "graphif";
    repo = "project-graph";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-QC1YTcyH7q+TJiGLF7zjKTe1OcfFd74fSFr+23iYMyQ=";
+    hash = "sha256-VI2elNYYDPJVLE0LIaUJHLeemUHokqHob5oB7jgQOL4=";
  };

-  cargoHash = "sha256-bsRX+iVo2jInWZvrX1fVE2oAqM8L/5zNzjRwtoviQN0=";
+  cargoHash = "sha256-RFYDFZ3NKr/7OxwgApexGnxR8ZQn09DFYNzhnqVYEzE=";

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
    pnpm = pnpm_10;
    fetcherVersion = 3;
-    hash = "sha256-sTThym++UWKpKFZqhQJCewRKtdYe1tKNcESrxyxpLmY=";
+    hash = "sha256-6s5mv6hcpZUz/N5QNqUC8NamGT/B5Wv7DfY4Jte9jiQ=";
  };

+  preFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
+    gappsWrapperArgs+=(
+      --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath [ libGL ]}"
+      --prefix XDG_DATA_DIRS : "$XDG_ICON_DIRS:$GSETTINGS_SCHEMAS_PATH"
+    )
+  '';
+
  postPatch = ''
    TAURI_CONFIG="app/src-tauri/tauri.conf.json"
    if [ -f "$TAURI_CONFIG" ]; then
@@ -53,6 +63,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  '';

  preBuild = ''
+    export NIX_CFLAGS_COMPILE="$NIX_CFLAGS_COMPILE $(pkg-config --cflags Qt6WebEngineWidgets)"
    pnpm run build
  '';

@@ -66,10 +77,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
    wrapGAppsHook4
  ];

+  dontWrapQtApps = true;
+
  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
    glib-networking
    openssl
    webkitgtk_4_1
+    libGL
+    gst_all_1.gst-plugins-base
+    gst_all_1.gst-plugins-good
+    qt6.qtbase
+    qt6.qtwebengine
  ];

  cargoRoot = "app/src-tauri";
--- a/pkgs/by-name/r2/r2modman/package.nix
+++ b/pkgs/by-name/r2/r2modman/package.nix
@@ -56,6 +56,11 @@ stdenv.mkDerivation (finalAttrs: {
    ELECTRON_SKIP_BINARY_DOWNLOAD = true;
  };

+  postPatch = ''
+    # Hide update banner
+    echo "<template></template>" > src/components/banner/ManagerUpdateBanner.vue
+  '';
+
  buildPhase = ''
    runHook preBuild

--- a/pkgs/by-name/rs/rs-lxmf/package.nix
+++ b/pkgs/by-name/rs/rs-lxmf/package.nix
@@ -9,14 +9,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rs-lxmf";
-  version = "1.0.0";
+  version = "1.0.1";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "ratspeak";
    repo = "rsLXMF";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-fqSd+XZayW8mYdUF3MY/KjclvhfHtO1I4y1ot3EbdnA=";
+    hash = "sha256-VxtuDM34EnDya/OPA9H+ihrAdueczqjXsjQZMYenDIE=";
  };

  postPatch = ''
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    done
  '';

-  cargoHash = "sha256-Lv+mxsAtpzjd9tbMioZEH+7rvYVRiPYfD3icgQc+BrU=";
+  cargoHash = "sha256-qMDqCH2oCZDJ8TQTDtgxooL1Ltn4khVyXr186NfWtKY=";

  doInstallCheck = true;
  nativeInstallCheckInputs = [ versionCheckHook ];
--- a/pkgs/by-name/rt/rtk/package.nix
+++ b/pkgs/by-name/rt/rtk/package.nix
@@ -12,17 +12,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rtk";
-  version = "0.42.4";
+  version = "0.43.0";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "rtk-ai";
    repo = "rtk";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-8nLJ5PVefXmoXQyw6HERfCP06C+l4I+7XLwKFNVNpew=";
+    hash = "sha256-n5bkPPsrdM4fE5ltocTjlq+JwRgp39yib6S79fci4m4=";
  };

-  cargoHash = "sha256-YsKOyEZ281ojqiitnvCFGy/MzHMyr4hlxqMnvrQwguQ=";
+  cargoHash = "sha256-XKUKdhxfnwUCOx9slqx4oUFa09HcosPLVh5Xkh87oSk=";

  nativeBuildInputs = [
    makeWrapper
--- a/pkgs/by-name/s7/s7/package.nix
+++ b/pkgs/by-name/s7/s7/package.nix
@@ -26,14 +26,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "s7";
-  version = "11.8-unstable-2026-05-22";
+  version = "11.9-unstable-2026-06-27";

  src = fetchFromGitLab {
    domain = "cm-gitlab.stanford.edu";
    owner = "bil";
    repo = "s7";
-    rev = "d8791be9964708ccb98c7cabb39acd2b8f97fdbb";
-    hash = "sha256-kT2zFadlKc0JWqxnuoQ9hVinGhZb0XOwC3WEVeYcLPw=";
+    rev = "1416ca232c9154e47235be2378151f9f2beea278";
+    hash = "sha256-lA4nLtJ6+O5Cn7TQRzZCPhk3oB8qHdpewZE5yM8z4iw=";
  };

  buildInputs =
--- a/pkgs/by-name/sm/smartgit/package.nix
+++ b/pkgs/by-name/sm/smartgit/package.nix
@@ -1,5 +1,6 @@
 {
  lib,
+  git,
  stdenv,
  fetchurl,
  makeDesktopItem,
@@ -16,13 +17,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "smartgit";
-  version = "24.1.5";
+  version = "26.1.038";

  src = fetchurl {
-    url = "https://www.syntevo.com/downloads/smartgit/smartgit-linux-${
+    url = "https://download.smartgit.dev/smartgit/smartgit-${
      builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version
-    }.tar.gz";
-    hash = "sha256-YqueTbwA9KcXEJG5TeWkPzzNyAnnJQ1+VQYsqZKS2/I=";
+    }-no-git-linux-amd64.tar.gz";
+    hash = "sha256-XyMdojfyaTS3S3felGRvOOazx1mym/wE3j4GyCU9crc=";
  };

  nativeBuildInputs = [ wrapGAppsHook3 ];
@@ -37,6 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
    gappsWrapperArgs+=( \
      --prefix PATH : ${
        lib.makeBinPath [
+          git
          jre
          which
        ]
@@ -103,11 +105,11 @@ stdenv.mkDerivation (finalAttrs: {
      SmartGit is a multi-platform Git GUI client, free to use for active Open Source developers and users from academic institutions.
      Command line Git is required.
    '';
-    homepage = "https://www.syntevo.com/smartgit/";
-    changelog = "https://www.syntevo.com/smartgit/changelog-${lib.versions.majorMinor finalAttrs.version}.txt";
+    homepage = "https://www.smartgit.dev/";
+    changelog = "https://www.smartgit.dev/changelogs/changelog-${lib.versions.majorMinor finalAttrs.version}.txt";
    license = lib.licenses.unfree;
    mainProgram = "smartgit";
-    platforms = lib.platforms.linux;
+    platforms = [ "x86_64-linux" ];
    maintainers = with lib.maintainers; [
      jraygauthier
      tmssngr
--- a/pkgs/by-name/te/terraform-mcp-server/package.nix
+++ b/pkgs/by-name/te/terraform-mcp-server/package.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "terraform-mcp-server";
-  version = "0.5.2";
+  version = "1.0.0";

  src = fetchFromGitHub {
    owner = "hashicorp";
    repo = "terraform-mcp-server";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-4NUSMNLWn5Pmwq//M0yHn7qw9oUI4Q3MDXeQ8xBLLSI=";
+    hash = "sha256-0+TjwCDiuNAM6MkGTxw7cigwp1EaDmSFkyMYS+XwC1E=";
  };

-  vendorHash = "sha256-FuAt2epg4wH7oNa0nvQMWZZwOL1YtpSVdEBxkeY2Heg=";
+  vendorHash = "sha256-6azUKwzkVg68SvuVlse5ljB2H49tRUWgDasLjEl8KKw=";

  ldflags = [
    "-X main.version=${finalAttrs.version}"
--- a/pkgs/by-name/uv/uv/package.nix
+++ b/pkgs/by-name/uv/uv/package.nix
@@ -18,17 +18,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "uv";
-  version = "0.11.22";
+  version = "0.11.25";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "astral-sh";
    repo = "uv";
    tag = finalAttrs.version;
-    hash = "sha256-/MDEo86070RYMxaZ/whXWIiI2hxt3b5eTYSb43RB5Vg=";
+    hash = "sha256-MtfaDZ6dDuTTBus9KKj5r03IHo48AmEcsU+VlAW3l68=";
  };

-  cargoHash = "sha256-zStSTwpFWWc4sC59VPK7wYjQl77B+FvY/4E3zlppQjo=";
+  cargoHash = "sha256-dtkGj/de34HbdFPQbSWBHZGZmif2xQmUS8qqEyFTnmc=";

  buildInputs = [
    rust-jemalloc-sys
--- a/pkgs/by-name/ve/veilid/package.nix
+++ b/pkgs/by-name/ve/veilid/package.nix
@@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "veilid";
-  version = "0.5.3";
+  version = "0.5.5";

  src = fetchFromGitLab {
    owner = "veilid";
    repo = "veilid";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-qPV5kVp/1ZTLzo8i3DkGLxuoOaMJxZJUEzYGNReJyHY=";
+    hash = "sha256-14jRIs2iE5JH1ZmC/1DGcg6cejsnmhUTkquXNmOEuQA=";
  };

-  cargoHash = "sha256-LjysGZihXoE82224nXNrRWIMe6/POXDqjMO29zg+MMI=";
+  cargoHash = "sha256-xuIw/RRKydanStS7dw1jK96bgEH0U5TDbayaBZq/OCg=";

  nativeBuildInputs = [
    capnproto
--- a/pkgs/by-name/vo/voicevox/package.nix
+++ b/pkgs/by-name/vo/voicevox/package.nix
@@ -13,7 +13,7 @@
  nodejs,
  fetchPnpmDeps,
  pnpmConfigHook,
-  pnpm_10_29_2,
+  pnpm_10,

  _7zz,
  electron,
@@ -58,7 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
      postPatch
      ;

-    pnpm = pnpm_10_29_2;
+    pnpm = pnpm_10;

    # let's just be safe and add these explicitly to nativeBuildInputs
    # even though the fetcher already uses them in its implementation
@@ -78,7 +78,7 @@ stdenv.mkDerivation (finalAttrs: {
    moreutils
    nodejs
    pnpmConfigHook
-    pnpm_10_29_2
+    pnpm_10
  ]
  ++ lib.optionals stdenv.hostPlatform.isLinux [
    copyDesktopItems
--- a/pkgs/by-name/yo/your_spotify/client.nix
+++ b/pkgs/by-name/yo/your_spotify/client.nix
@@ -6,7 +6,7 @@
  pnpmDeps,
  apiEndpoint ? "http://localhost:3000",
  pnpmConfigHook,
-  pnpm_9,
+  pnpm_11,
  nodejs,
 }:

@@ -16,7 +16,7 @@ stdenv.mkDerivation {

  nativeBuildInputs = [
    pnpmConfigHook
-    pnpm_9
+    pnpm_11
    nodejs
  ];

--- a/pkgs/by-name/yo/your_spotify/package.nix
+++ b/pkgs/by-name/yo/your_spotify/package.nix
@@ -4,14 +4,13 @@
  fetchFromGitHub,
  fetchPnpmDeps,
  pnpmConfigHook,
-  pnpm_9,
+  pnpm_11,
  nodejs,
  makeWrapper,
  callPackage,
  nixosTests,
  nix-update-script,
 }:
-
 stdenv.mkDerivation (finalAttrs: {
  pname = "your_spotify_server";
  version = "1.20.0";
@@ -25,15 +24,15 @@ stdenv.mkDerivation (finalAttrs: {

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
-    pnpm = pnpm_9;
-    fetcherVersion = 3;
-    hash = "sha256-j6COg8Q0uj+5TjN/BUVst2UMhXLT3drLWUzdG/x51rk=";
+    pnpm = pnpm_11;
+    fetcherVersion = 4;
+    hash = "sha256-eUAzQ+LV+RZs/QEb5r7l9cisBjjWU8eGMm2r9ZNXmX8=";
  };

  nativeBuildInputs = [
    makeWrapper
    pnpmConfigHook
-    pnpm_9
+    pnpm_11
    nodejs
  ];

--- a/pkgs/desktops/lxqt/lxqt-wayland-session/default.nix
+++ b/pkgs/desktops/lxqt/lxqt-wayland-session/default.nix
@@ -20,13 +20,13 @@

 stdenv.mkDerivation rec {
  pname = "lxqt-wayland-session";
-  version = "0.4.0";
+  version = "0.4.1";

  src = fetchFromGitHub {
    owner = "lxqt";
    repo = "lxqt-wayland-session";
    rev = version;
-    hash = "sha256-QmknSFJLmAy3OxU9jv6xMAAxQXlWuUcuPNHDs8r2/ls=";
+    hash = "sha256-7wNp1a+JCnFu2h391KUeNRlZqybA5gY3ZCciYbIx5Rs=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/libraries/qwt/0001-pkgconfig-for-Qt-5-6-adjustments.patch
+++ b/pkgs/development/libraries/qwt/0001-pkgconfig-for-Qt-5-6-adjustments.patch
@@ -0,0 +1,49 @@
+From b225ea23753ce35356ad1b53c0854813004bb605 Mon Sep 17 00:00:00 2001
+From: rathmann <Uwe.Rathmann@tigertal.de>
+Date: Thu, 22 May 2025 15:33:04 +0200
+Subject: [PATCH] pkgconfig for Qt 5/6 adjustments
+
+---
+ src/src.pro | 15 ++++++++++-----
+ 1 file changed, 10 insertions(+), 5 deletions(-)
+
+diff --git a/src/src.pro b/src/src.pro
+index 96e0624..8990ece 100644
+--- a/src/src.pro
+++ b/src/src.pro
+@@ -81,22 +81,27 @@ contains(QWT_CONFIG, QwtPkgConfig) {
+ 
+     greaterThan(QT_MAJOR_VERSION, 4) {
+ 
+-        QMAKE_PKGCONFIG_FILE = Qt$${QT_MAJOR_VERSION}$${QMAKE_PKGCONFIG_NAME}
+-        QMAKE_PKGCONFIG_REQUIRES = Qt5Widgets Qt5Concurrent Qt5PrintSupport
+        QTLIB_PREFIX = Qt$${QT_MAJOR_VERSION}  # e.g., "Qt5"
+        QMAKE_PKGCONFIG_FILE = $${QTLIB_PREFIX}$${QMAKE_PKGCONFIG_NAME}  # e.g., "Qt5Qwt6"
+
+        # Base Qt library requirements
+        QMAKE_PKGCONFIG_REQUIRES = $${QTLIB_PREFIX}Widgets
+        QMAKE_PKGCONFIG_REQUIRES += $${QTLIB_PREFIX}Concurrent
+        QMAKE_PKGCONFIG_REQUIRES += $${QTLIB_PREFIX}PrintSupport
+ 
+         contains(QWT_CONFIG, QwtSvg) {
+-            QMAKE_PKGCONFIG_REQUIRES += Qt5Svg
+            QMAKE_PKGCONFIG_REQUIRES += $${QTLIB_PREFIX}Svg
+         }
+ 
+         contains(QWT_CONFIG, QwtOpenGL) {
+-            QMAKE_PKGCONFIG_REQUIRES += Qt5OpenGL
+            QMAKE_PKGCONFIG_REQUIRES += $${QTLIB_PREFIX}OpenGL
+         }
+ 
+         QMAKE_DISTCLEAN += $${DESTDIR}/$${QMAKE_PKGCONFIG_DESTDIR}/$${QMAKE_PKGCONFIG_FILE}.pc
+     }
+     else {
+ 
+-        # there is no QMAKE_PKGCONFIG_FILE fo Qt4
+        # there is no QMAKE_PKGCONFIG_FILE for Qt4
+         QMAKE_PKGCONFIG_REQUIRES = QtGui 
+ 
+         contains(QWT_CONFIG, QwtSvg) {
+-- 
+2.54.0
+
--- a/pkgs/development/libraries/qwt/default.nix
+++ b/pkgs/development/libraries/qwt/default.nix
@@ -23,6 +23,19 @@ stdenv.mkDerivation rec {
    sha256 = "sha256-3LCFiWwoquxVGMvAjA7itOYK2nrJKdgmOfYYmFGmEpo=";
  };

+  patches = [
+    # Fix the generated pkg-config file when built against Qt6.
+    # The file wrongly pulled in an unsatisfied dependency to Qt5.
+    #
+    # When building Qwt using Qt6, the constructed pkgconfig .pc file was
+    # previously set up to only look for Qt5 libraries. This fix now matches
+    # the library dependency to the Qt version used in building Qwt.
+    #
+    # See upstream commit b225ea23753ce35356ad1b53c0854813004bb605.
+    # https://sourceforge.net/p/qwt/git/ci/b225ea23753ce35356ad1b53c0854813004bb605/basic
+    ./0001-pkgconfig-for-Qt-5-6-adjustments.patch
+  ];
+
  propagatedBuildInputs = [
    qtbase
    qtsvg
--- a/pkgs/development/octave-modules/control/default.nix
+++ b/pkgs/development/octave-modules/control/default.nix
@@ -6,17 +6,19 @@
  lapack,
  blas,
  autoreconfHook,
+  nix-update-script,
 }:

 buildOctavePackage rec {
  pname = "control";
-  version = "3.6.1";
+  version = "4.2.1";

  src = fetchFromGitHub {
    owner = "gnu-octave";
    repo = "pkg-control";
-    tag = "control-${version}";
-    sha256 = "sha256-7beEsdrne50NY4lGCotxGXwwWnMzUR2CKCc20OCjd0g=";
+    tag = "${pname}-${version}";
+    fetchSubmodules = true;
+    sha256 = "sha256-NOZi003brDQ5nVyP7w5n7hxhafbiBwMPErhhTQhn2bw=";
  };

  # Running autoreconfHook inside the src directory fixes a compile issue about
@@ -41,6 +43,13 @@ buildOctavePackage rec {
    blas
  ];

+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "control-(.*)"
+    ];
+  };
+
  meta = {
    homepage = "https://gnu-octave.github.io/packages/control/";
    license = lib.licenses.gpl3Plus;
--- a/pkgs/development/python-modules/afdko/0001-addfeatures-hmtx-avoid-unsigned-integer-underflow.patch
+++ b/pkgs/development/python-modules/afdko/0001-addfeatures-hmtx-avoid-unsigned-integer-underflow.patch
@@ -0,0 +1,34 @@
+From 91833ab6c1a769f82f30dbf126362d079905bfc6 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?=C3=A9clairevoyant?=
+ <848000+eclairevoyant@users.noreply.github.com>
+Date: Fri, 26 Jun 2026 21:28:41 -0400
+Subject: [PATCH] addfeatures/hmtx: avoid unsigned integer underflow
+
+---
+ c/addfeatures/hotconv/hmtx.cpp | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+diff --git a/c/addfeatures/hotconv/hmtx.cpp b/c/addfeatures/hotconv/hmtx.cpp
+index 9336c986..2d8ca98e 100644
+--- a/c/addfeatures/hotconv/hmtx.cpp
+++ b/c/addfeatures/hotconv/hmtx.cpp
+@@ -52,12 +52,12 @@ int hmtxFill(hotCtx g) {
+     /* Optimize metrics */
+     FWord width = hmtx.advanceWidth.back();
+     size_t i;
+-    for (i = hmtx.advanceWidth.size() - 2; i >= 0; i--) {
+-        if (hmtx.advanceWidth[i] != width)
+    for (i = hmtx.advanceWidth.size(); i >= 2; i--) {
+        if (hmtx.advanceWidth[i-2] != width)
+             break;
+     }
+-    if (i + 2 != hmtx.advanceWidth.size())
+-        hmtx.advanceWidth.resize(i+2);
+    if (i != hmtx.advanceWidth.size())
+        hmtx.advanceWidth.resize(i);
+ 
+     return hmtx.Fill();
+ }
+-- 
+2.54.0
+
--- a/pkgs/development/python-modules/afdko/default.nix
+++ b/pkgs/development/python-modules/afdko/default.nix
@@ -69,6 +69,10 @@ buildPythonPackage (finalAttrs: {

    # Use antlr4 runtime from nixpkgs and link it dynamically
    ./use-dynamic-system-antlr4-runtime.patch
+
+    # integer underflow causes incorrect behavior
+    # patch submitted upstream as https://github.com/adobe-type-tools/afdko/pull/1843
+    ./0001-addfeatures-hmtx-avoid-unsigned-integer-underflow.patch
  ];

  env = {
--- a/pkgs/development/python-modules/aioimmich/default.nix
+++ b/pkgs/development/python-modules/aioimmich/default.nix
@@ -14,14 +14,14 @@

 buildPythonPackage rec {
  pname = "aioimmich";
-  version = "0.15.0";
+  version = "0.15.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "mib1185";
    repo = "aioimmich";
    tag = "v${version}";
-    hash = "sha256-lsxN4gl1t7za/0ac6fXZysEeXSQtNAvQCMN/eqRvWoQ=";
+    hash = "sha256-2WdQnK25vrBtNKzkgpSaWcdkrfEggtBhe3DI7DuMS8k=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/cutlass/default.nix
+++ b/pkgs/development/python-modules/cutlass/default.nix
@@ -19,14 +19,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "cutlass";
-  version = "0.4.0";
+  version = "0.5.0";
  pyproject = true;
  __structuredAttrs = true;

  # No tags on GitHub
  src = fetchPypi {
    inherit (finalAttrs) pname version;
-    hash = "sha256-+9Y7twguzeqGJP9813hAStzjLVlTeLD+JHrHndzA9AM=";
+    hash = "sha256-dAxt/1EROwJix/Sz889XJ9MXfN1FBFQYSNeB3H43g7E=";
  };

  build-system = [
--- a/pkgs/development/python-modules/ggml-python/default.nix
+++ b/pkgs/development/python-modules/ggml-python/default.nix
@@ -2,6 +2,7 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+  nix-update-script,

  # build-system
  cmake,
@@ -34,7 +35,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "ggml-python";
-  version = "0.0.42";
+  version = "0.0.44";
  pyproject = true;
  __structuredAttrs = true;

@@ -44,7 +45,7 @@ buildPythonPackage (finalAttrs: {
    tag = "v${finalAttrs.version}";
    # ggml-python expects an older version of ggml than pkgs.ggml's
    fetchSubmodules = true;
-    hash = "sha256-dbYxAropTT8h1BnMg4Ua1hY/IUYWHaZcS0ckj38UoO4=";
+    hash = "sha256-Pjc91nKBAdmEg8TmirWdD1AcKlY+BCDAoHzL6mTE2SM=";
  };

  build-system = [
@@ -92,6 +93,13 @@ buildPythonPackage (finalAttrs: {
    pytestCheckHook
  ];

+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "^v([0-9.]+)$"
+    ];
+  };
+
  meta = {
    description = "Python bindings for ggml";
    homepage = "https://github.com/abetlen/ggml-python";
--- a/pkgs/development/python-modules/oelint-data/default.nix
+++ b/pkgs/development/python-modules/oelint-data/default.nix
@@ -8,7 +8,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "oelint-data";
-  version = "1.5.6";
+  version = "1.5.8";
  pyproject = true;
  __structuredAttrs = true;

@@ -16,7 +16,7 @@ buildPythonPackage (finalAttrs: {
    owner = "priv-kweihmann";
    repo = "oelint-data";
    tag = finalAttrs.version;
-    hash = "sha256-JkH8y3FzpMMIIv/42c+WzqJtA63SVQ/1v6ZE/5ybYR8=";
+    hash = "sha256-cjQAJtslRGZ7FwjlVoxgGVoPmdx6J8qlHcxbl/auf0I=";
  };

  build-system = [
--- a/pkgs/development/python-modules/pyatv/default.nix
+++ b/pkgs/development/python-modules/pyatv/default.nix
@@ -29,14 +29,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "pyatv";
-  version = "0.17.0";
+  version = "0.18.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "postlund";
    repo = "pyatv";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-wsLqG1yJf5A3BMgpbQMrXn6NzpcF4BU1TD+0NJ6Nt7c=";
+    hash = "sha256-UNBpVB2H+xr0ijdlfK/Hrh6k3lhRSqHkthjWp/WZsaQ=";
  };

  pythonRelaxDeps = [
--- a/pkgs/development/python-modules/pysigma-backend-elasticsearch/default.nix
+++ b/pkgs/development/python-modules/pysigma-backend-elasticsearch/default.nix
@@ -12,14 +12,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "pysigma-backend-elasticsearch";
-  version = "2.0.3";
+  version = "2.1.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "SigmaHQ";
    repo = "pySigma-backend-elasticsearch";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-54AxC3cK8Vh/cT2LjYzbgQFJrgoSxFU2QbsML3YUCHs=";
+    hash = "sha256-eSf0uhjhO1Bc63EBy505tTGASTNJ/mK0943vBXAT9As=";
  };

  build-system = [ poetry-core ];
--- a/pkgs/development/python-modules/xstatic-bootbox/default.nix
+++ b/pkgs/development/python-modules/xstatic-bootbox/default.nix
@@ -2,26 +2,33 @@
  buildPythonPackage,
  lib,
  fetchPypi,
+  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "xstatic-bootbox";
  version = "5.5.1.1";
-  format = "setuptools";
+  pyproject = true;
+
+  __structuredAttrs = true;

  src = fetchPypi {
    pname = "XStatic-Bootbox";
-    inherit version;
-    sha256 = "4b2120bb33a1d8ada8f9e0532ad99987aa03879b17b08bfdc6b8326d6eb7c205";
+    inherit (finalAttrs) version;
+    hash = "sha256-SyEguzOh2K2o+eBTKtmZh6oDh5sXsIv9xrgybW63wgU=";
  };

+  build-system = [ setuptools ];
+
  # no tests implemented
  doCheck = false;

+  pythonImportsCheck = [ "xstatic.pkg.bootbox" ];
+
  meta = {
    homepage = "https://bootboxjs.com";
    description = "Bootboxjs packaged static files for python";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ makefu ];
  };
-}
+})
--- a/pkgs/development/python-modules/xstatic-jquery/default.nix
+++ b/pkgs/development/python-modules/xstatic-jquery/default.nix
@@ -2,22 +2,29 @@
  buildPythonPackage,
  lib,
  fetchPypi,
+  setuptools,
 }:

 buildPythonPackage (finalAttrs: {
  pname = "xstatic-jquery";
  version = "3.5.1.1";
-  format = "setuptools";
+  pyproject = true;
+
+  __structuredAttrs = true;

  src = fetchPypi {
    pname = "XStatic-jQuery";
    inherit (finalAttrs) version;
-    sha256 = "e0ae8f8ec5bbd28045ba4bca06767a38bd5fc27cf9b71f434589f59370dcd323";
+    hash = "sha256-4K6PjsW70oBFukvKBnZ6OL1fwnz5tx9DRYn1k3Dc0yM=";
  };

+  build-system = [ setuptools ];
+
  # no tests implemented
  doCheck = false;

+  pythonImportsCheck = [ "xstatic.pkg.jquery" ];
+
  meta = {
    homepage = "https://jquery.org";
    description = "jquery packaged static files for python";
--- a/pkgs/development/python-modules/yara-x/default.nix
+++ b/pkgs/development/python-modules/yara-x/default.nix
@@ -9,21 +9,21 @@

 buildPythonPackage rec {
  pname = "yara-x";
-  version = "1.18.0";
+  version = "1.19.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "VirusTotal";
    repo = "yara-x";
    tag = "v${version}";
-    hash = "sha256-4cHCBSmBhjuk8otOB+ykiviaHVDmrguIVCLCRMcq7L4=";
+    hash = "sha256-CokjFTQoFT9k/2/MuQSbfzHonW4V0F8hskhqDvpCesM=";
  };

  buildAndTestSubdir = "py";

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit pname src version;
-    hash = "sha256-MMERL3DcOlTEa2S6BMboFi8MfKC8ah2wZtOQRbO6ADg=";
+    hash = "sha256-wMh8F++16tQ0IUhacBPb4rDcydmDKZKzQf8EK/qDJXo=";
  };

  nativeBuildInputs = [
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -862,6 +862,7 @@ mapAliases {
  gamecube-tools = throw "gamecube-tools was removed due to numerous vulnerabilities in freeimage"; # Added 2025-10-23
  gamehub = throw "'gamehub' has been removed as it was archived upstream and depended on webkitgtk 4.0"; # Added 2026-06-07
  gandi-cli = throw "'gandi-cli' has been removed as it is unmaintained upstream"; # Added 2026-01-11
+  garage-webui = throw "'garage-webui' has been removed as it is unmaintained upstream"; # Added 2026-06-23
  garage_0_8 = throw "'garage_0_8' has been removed as it is unmaintained upstream"; # Added 2025-06-23
  garage_0_8_7 = throw "'garage_0_8_7' has been removed as it is unmaintained upstream"; # Added 2025-06-23
  garage_0_9 = throw "'garage_0_9' has been removed as it is unmaintained upstream"; # Added 2025-09-16
@@ -1683,7 +1684,7 @@ mapAliases {
  onscripter-en = throw "onscripter-en has been removed due to lack of maintenance in both upstream and Nixpkgs; onscripter is available instead"; # Added 2025-10-17
  onthespot = throw "onethespot has been removed due to lack of upstream maintenance"; # Added 2025-09-26
  opae = throw "opae has been removed because it has been marked as broken since June 2023."; # Added 2025-10-11
-  open-stage-control = throw "'open-stage-control' has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-05-04
+  open-stage-control = throw "'open-stage-control' has been removed due to being broken for more than a year; see RFC 180. Consider using open-stage-control-headless instead."; # Added 2026-05-04
  open-timeline-io = warnAlias "'open-timeline-io' has been renamed to 'opentimelineio'" opentimelineio; # Added 2025-08-10
  openafs_1_8 = throw "'openafs_1_8' has been renamed to/replaced by 'openafs'"; # Converted to throw 2025-10-27
  openai = throw "'openai' has been removed, since upstream removed the legacy CLI in v2.35.0; use 'python3Packages.openai' instead"; # Added 2026-06-10