From a916c01d87ffa06b36c0382a975a8172369921b5 Mon Sep 17 00:00:00 2001
From: Lemon Lam <alemonmk@users.noreply.github.com>
Date: Sun, 4 Jan 2026 19:32:03 +0800
Subject: [PATCH 01/51] warpgate: 0.18.0 -> 0.19.0

Upstream fixed dependency issue, nodejs v22 still works fine, so removing the fix from npmFlags.

(cherry picked from commit 51d26cc134a74881200e613d2df82affca637d20)
---
 pkgs/by-name/wa/warpgate/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/wa/warpgate/package.nix b/pkgs/by-name/wa/warpgate/package.nix
index c48ec8265167..581f563e04e6 100644
--- a/pkgs/by-name/wa/warpgate/package.nix
+++ b/pkgs/by-name/wa/warpgate/package.nix
@@ -20,7 +20,7 @@ rustPlatform.buildRustPackage (
 
       patches = [ ./web-ui-package-json.patch ];
 
-      npmDepsHash = "sha256-jgsNF93DkEVgPGzdi192HKoSHPYhdrtog28jZvOLK6E=";
+      npmDepsHash = "sha256-bsVlE0uOJu3JRAn5Hjt2PUhpgJXbQBUKO+6nl0EZkyc=";
 
       nativeBuildInputs = [ openapi-generator-cli ];
 
@@ -35,16 +35,16 @@ rustPlatform.buildRustPackage (
   in
   {
     pname = "warpgate";
-    version = "0.18.0";
+    version = "0.19.0";
 
     src = fetchFromGitHub {
       owner = "warp-tech";
       repo = "warpgate";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-GLY/VGEKB6gFNTbBlbhpmqQZ62pk2wd6JwWwy4Tz0FE=";
+      hash = "sha256-PBDAZDoCFwrO1/zfQwy1MOhDDx4xHHOSvKsIYk2ayM8=";
     };
 
-    cargoHash = "sha256-hwAtj8tTDsYgzuDobMg97wepKKIpohSVClyRiaDd+8w=";
+    cargoHash = "sha256-8m2NznKIME1UywQxmaQm+TJhhro095oU0WM7JxIyMxU=";
 
     patches = [
       (replaceVars ./hardcode-version.patch { inherit (finalAttrs) version; })

From cfbd5b34b73a41037fa71ace78998138f393e17e Mon Sep 17 00:00:00 2001
From: Lemon Lam <alemonmk@users.noreply.github.com>
Date: Sun, 4 Jan 2026 19:59:44 +0800
Subject: [PATCH 02/51] nixos/warpgate: add `settings.log.format`

(cherry picked from commit 147c25bcef02bfb19af23b7604b46588599cb3e6)
---
 nixos/modules/services/security/warpgate.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/nixos/modules/services/security/warpgate.nix b/nixos/modules/services/security/warpgate.nix
index a52d0eefcb42..7d6f2ca2596c 100644
--- a/nixos/modules/services/security/warpgate.nix
+++ b/nixos/modules/services/security/warpgate.nix
@@ -283,6 +283,14 @@ in
               };
             };
             log = {
+              format = mkOption {
+                description = "The format Warpgate emits logs in.";
+                default = "text";
+                type = enum [
+                  "text"
+                  "json"
+                ];
+              };
               retention = mkOption {
                 description = "How long Warpgate keep its logs.";
                 default = "7days";

From e73f0239962028d3685c2079d53a4d5aae6901c1 Mon Sep 17 00:00:00 2001
From: Lemon Lam <alemonmk@users.noreply.github.com>
Date: Sun, 4 Jan 2026 20:06:23 +0800
Subject: [PATCH 03/51] nixos/warpgate: drop `settings.config_provider`

Actually it ceased to exist since 0.14.0

(cherry picked from commit 174c6333d15e8179dc6b65e257cdc414afcdbb1c)
---
 nixos/modules/services/security/warpgate.nix | 15 ++++-----------
 1 file changed, 4 insertions(+), 11 deletions(-)

diff --git a/nixos/modules/services/security/warpgate.nix b/nixos/modules/services/security/warpgate.nix
index 7d6f2ca2596c..a9fb7ed438f6 100644
--- a/nixos/modules/services/security/warpgate.nix
+++ b/nixos/modules/services/security/warpgate.nix
@@ -305,17 +305,6 @@ in
                 type = nullOr str;
               };
             };
-            config_provider = mkOption {
-              description = ''
-                Source of truth of users.
-                DO NOT change this, Warpgate only implemented database provider.
-              '';
-              default = "database";
-              type = enum [
-                "file"
-                "database"
-              ];
-            };
           };
         };
         default = { };
@@ -380,6 +369,10 @@ in
           assertion = !((cfg.databaseUrlFile == null) && (cfg.settings.database_url == null));
           message = "Either databaseUrlFile or settings.database_url must be set; Set the other to null.";
         }
+        {
+          assertion = !(lib.hasAttr "config_provider" cfg.settings);
+          message = "`services.warpgate.settings.config_provider` is a legacy option that has been removed since 0.14.0. Please do not set this option.";
+        }
       ];
 
       environment.systemPackages = [ cfg.package ];

From 9464e94996f31ce05b5786eb21fc39f27f2eca46 Mon Sep 17 00:00:00 2001
From: Lemon Lam <alemonmk@users.noreply.github.com>
Date: Tue, 6 Jan 2026 13:48:16 +0800
Subject: [PATCH 04/51] warpgate: 0.19.0 -> 0.19.1

(cherry picked from commit fd31a55c2e6fbc6625d4d12ab8f2933e55604c33)
---
 pkgs/by-name/wa/warpgate/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/wa/warpgate/package.nix b/pkgs/by-name/wa/warpgate/package.nix
index 581f563e04e6..e20b8e7d7f5b 100644
--- a/pkgs/by-name/wa/warpgate/package.nix
+++ b/pkgs/by-name/wa/warpgate/package.nix
@@ -20,7 +20,7 @@ rustPlatform.buildRustPackage (
 
       patches = [ ./web-ui-package-json.patch ];
 
-      npmDepsHash = "sha256-bsVlE0uOJu3JRAn5Hjt2PUhpgJXbQBUKO+6nl0EZkyc=";
+      npmDepsHash = "sha256-0AhbX+NhKGvWbOHwkIGE1pwJbD/ZLrOJCoWnCm8lYoY=";
 
       nativeBuildInputs = [ openapi-generator-cli ];
 
@@ -35,16 +35,16 @@ rustPlatform.buildRustPackage (
   in
   {
     pname = "warpgate";
-    version = "0.19.0";
+    version = "0.19.1";
 
     src = fetchFromGitHub {
       owner = "warp-tech";
       repo = "warpgate";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-PBDAZDoCFwrO1/zfQwy1MOhDDx4xHHOSvKsIYk2ayM8=";
+      hash = "sha256-0eaN91Uu1kCOZLblXmY9qLP8L8+UBlZWuArICQkBBk4=";
     };
 
-    cargoHash = "sha256-8m2NznKIME1UywQxmaQm+TJhhro095oU0WM7JxIyMxU=";
+    cargoHash = "sha256-w6VMtqmo5TiMHY3x77UPXn0TJUT62/gBIVkjZ/WxgaE=";
 
     patches = [
       (replaceVars ./hardcode-version.patch { inherit (finalAttrs) version; })

From 8232c5e99536c85daba48f923925e7676183c8b8 Mon Sep 17 00:00:00 2001
From: Lemon Lam <alemonmk@users.noreply.github.com>
Date: Sat, 7 Mar 2026 23:35:52 +0800
Subject: [PATCH 05/51] warpgate: 0.19.1 -> 0.21.1

(cherry picked from commit bcb4fb4c35e25e4f4a08afbb062314074a4df3d4)
---
 pkgs/by-name/wa/warpgate/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/wa/warpgate/package.nix b/pkgs/by-name/wa/warpgate/package.nix
index e20b8e7d7f5b..98afa711a0b9 100644
--- a/pkgs/by-name/wa/warpgate/package.nix
+++ b/pkgs/by-name/wa/warpgate/package.nix
@@ -20,7 +20,7 @@ rustPlatform.buildRustPackage (
 
       patches = [ ./web-ui-package-json.patch ];
 
-      npmDepsHash = "sha256-0AhbX+NhKGvWbOHwkIGE1pwJbD/ZLrOJCoWnCm8lYoY=";
+      npmDepsHash = "sha256-MwcQL4nLN0kCMSubHbgtX3rGcA4xJjUuGv6nFgDXQtw=";
 
       nativeBuildInputs = [ openapi-generator-cli ];
 
@@ -35,16 +35,16 @@ rustPlatform.buildRustPackage (
   in
   {
     pname = "warpgate";
-    version = "0.19.1";
+    version = "0.21.1";
 
     src = fetchFromGitHub {
       owner = "warp-tech";
       repo = "warpgate";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-0eaN91Uu1kCOZLblXmY9qLP8L8+UBlZWuArICQkBBk4=";
+      hash = "sha256-j2F+Y3rEiAOybiNXD0vdo1kSdJQs78wnKD8n4JuR9VA=";
     };
 
-    cargoHash = "sha256-w6VMtqmo5TiMHY3x77UPXn0TJUT62/gBIVkjZ/WxgaE=";
+    cargoHash = "sha256-HQdBBd+XX+7OgYrxuP+scmnG2unBVryPfA5/inflqMw=";
 
     patches = [
       (replaceVars ./hardcode-version.patch { inherit (finalAttrs) version; })

From 03e39b1d21a740f822a8afc6bc3e52efa460abd6 Mon Sep 17 00:00:00 2001
From: Lemon Lam <alemonmk@users.noreply.github.com>
Date: Sat, 7 Mar 2026 23:34:56 +0800
Subject: [PATCH 06/51] nixos/warpgate: add options for Kubernetes listener

(cherry picked from commit ee57154a67a835d09aaea385f6e5c9acba7ad3ab)
---
 nixos/modules/services/security/warpgate.nix | 32 ++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/nixos/modules/services/security/warpgate.nix b/nixos/modules/services/security/warpgate.nix
index a9fb7ed438f6..b7b7a886e9f9 100644
--- a/nixos/modules/services/security/warpgate.nix
+++ b/nixos/modules/services/security/warpgate.nix
@@ -282,6 +282,38 @@ in
                 type = str;
               };
             };
+            kubernetes = {
+              enable = mkOption {
+                description = "Whether to enable Kubernetes listener.";
+                default = false;
+                type = bool;
+              };
+              listen = mkOption {
+                description = "Listen endpoint of Kubernetes listener.";
+                default = "[::]:8443";
+                type = str;
+              };
+              external_port = mkOption {
+                description = "The Kubernetes listener is reachable via this port externally.";
+                default = null;
+                type = nullOr str;
+              };
+              certificate = mkOption {
+                description = "Path to Kubernetes listener certificate.";
+                default = "/var/lib/warpgate/tls.certificate.pem";
+                type = str;
+              };
+              key = mkOption {
+                description = "Path to Kubernetes listener private key.";
+                default = "/var/lib/warpgate/tls.key.pem";
+                type = str;
+              };
+              session_max_age = mkOption {
+                description = "How long until a logged in session expires.";
+                default = "30m";
+                type = str;
+              };
+            };
             log = {
               format = mkOption {
                 description = "The format Warpgate emits logs in.";

From eb4e24f39997bb9f5141c96c6b9ccb35a9061e6f Mon Sep 17 00:00:00 2001
From: Lemon Lam <alemonmk@users.noreply.github.com>
Date: Tue, 21 Apr 2026 11:41:52 +0800
Subject: [PATCH 07/51] warpgate: 0.21.1 -> 0.23.1

(cherry picked from commit 4296b8f8db26648a75ed006d75788a6cbe044c43)
---
 .../wa/warpgate/hardcode-version.patch        |  4 +--
 pkgs/by-name/wa/warpgate/package.nix          |  9 ++++---
 .../warpgate/remove-nightly-rustflags.patch   | 26 +++++++++++++++++++
 3 files changed, 33 insertions(+), 6 deletions(-)
 create mode 100644 pkgs/by-name/wa/warpgate/remove-nightly-rustflags.patch

diff --git a/pkgs/by-name/wa/warpgate/hardcode-version.patch b/pkgs/by-name/wa/warpgate/hardcode-version.patch
index a23cd10b01a8..8adadc7971dc 100644
--- a/pkgs/by-name/wa/warpgate/hardcode-version.patch
+++ b/pkgs/by-name/wa/warpgate/hardcode-version.patch
@@ -1,11 +1,11 @@
 diff --git a/warpgate-common/src/version.rs b/warpgate-common/src/version.rs
-index 07db547..2a7967f 100644
+index 0e7985a..62c2b67 100644
 --- a/warpgate-common/src/version.rs
 +++ b/warpgate-common/src/version.rs
 @@ -1,8 +1,3 @@
 -use git_version::git_version;
 -
- pub fn warpgate_version() -> &'static str {
+ pub const fn warpgate_version() -> &'static str {
 -    git_version!(
 -        args = ["--tags", "--always", "--dirty=-modified"],
 -        fallback = "unknown"
diff --git a/pkgs/by-name/wa/warpgate/package.nix b/pkgs/by-name/wa/warpgate/package.nix
index 98afa711a0b9..9e994b4eae2c 100644
--- a/pkgs/by-name/wa/warpgate/package.nix
+++ b/pkgs/by-name/wa/warpgate/package.nix
@@ -20,7 +20,7 @@ rustPlatform.buildRustPackage (
 
       patches = [ ./web-ui-package-json.patch ];
 
-      npmDepsHash = "sha256-MwcQL4nLN0kCMSubHbgtX3rGcA4xJjUuGv6nFgDXQtw=";
+      npmDepsHash = "sha256-jRY3vR9rwqQc1WjxIuPb797ZXXrgDYNZ947fERxJ0zA=";
 
       nativeBuildInputs = [ openapi-generator-cli ];
 
@@ -35,19 +35,20 @@ rustPlatform.buildRustPackage (
   in
   {
     pname = "warpgate";
-    version = "0.21.1";
+    version = "0.23.1";
 
     src = fetchFromGitHub {
       owner = "warp-tech";
       repo = "warpgate";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-j2F+Y3rEiAOybiNXD0vdo1kSdJQs78wnKD8n4JuR9VA=";
+      hash = "sha256-GayjhHkD9LtuR7dz7tw1smz4fPwOl8R9X9QTgx9snnM=";
     };
 
-    cargoHash = "sha256-HQdBBd+XX+7OgYrxuP+scmnG2unBVryPfA5/inflqMw=";
+    cargoHash = "sha256-Y3oVvQkZDmGmmxUYrWSP6qKZ4hgjly+t98PRmi88oaY=";
 
     patches = [
       (replaceVars ./hardcode-version.patch { inherit (finalAttrs) version; })
+      ./remove-nightly-rustflags.patch
     ];
 
     RUSTFLAGS = "--cfg tokio_unstable";
diff --git a/pkgs/by-name/wa/warpgate/remove-nightly-rustflags.patch b/pkgs/by-name/wa/warpgate/remove-nightly-rustflags.patch
new file mode 100644
index 000000000000..8046dce16f9e
--- /dev/null
+++ b/pkgs/by-name/wa/warpgate/remove-nightly-rustflags.patch
@@ -0,0 +1,26 @@
+diff --git a/Cargo.toml b/Cargo.toml
+index 0e92acb..d187ebc 100644
+--- a/Cargo.toml
++++ b/Cargo.toml
+@@ -100,21 +100,3 @@ strip = "debuginfo"
+ [profile.coverage]
+ inherits = "dev"
+ # rustflags = ["-Cinstrument-coverage"]
+-
+-[profile.dev.package.aws-sdk-ec2]
+-rustflags = ["-Zhint-mostly-unused"]
+-
+-[profile.release.package.aws-sdk-ec2]
+-rustflags = ["-Zhint-mostly-unused"]
+-
+-[profile.dev.package.aws-sdk-rds]
+-rustflags = ["-Zhint-mostly-unused"]
+-
+-[profile.release.package.aws-sdk-rds]
+-rustflags = ["-Zhint-mostly-unused"]
+-
+-[profile.dev.package.aws-sdk-eks]
+-rustflags = ["-Zhint-mostly-unused"]
+-
+-[profile.release.package.aws-sdk-eks]
+-rustflags = ["-Zhint-mostly-unused"]

From ab55872df1c1d5b716d975699b84397d358d1f7c Mon Sep 17 00:00:00 2001
From: Lemon Lam <alemonmk@users.noreply.github.com>
Date: Tue, 21 Apr 2026 12:17:00 +0800
Subject: [PATCH 08/51] nixos/warpgate: add protocol specific `external_host`

(cherry picked from commit 36fa9a857f3f7d425f63009cf8c48219103a1508)
---
 nixos/modules/services/security/warpgate.nix | 26 ++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/nixos/modules/services/security/warpgate.nix b/nixos/modules/services/security/warpgate.nix
index b7b7a886e9f9..2cb9d44e92a0 100644
--- a/nixos/modules/services/security/warpgate.nix
+++ b/nixos/modules/services/security/warpgate.nix
@@ -105,6 +105,7 @@ in
               description = ''
                 Configure the domain name of this Warpgate instance.
                 See [HTTP domain binding](https://warpgate.null.page/http-domain-binding/).
+                This option is considered legacy, please use protocol specific `external_host` instead.
               '';
               default = null;
               type = nullOr str;
@@ -128,6 +129,11 @@ in
                 default = "[::]:2222";
                 type = str;
               };
+              external_host = mkOption {
+                description = "The SSH listener is reachable via this domain name externally.";
+                default = null;
+                type = nullOr str;
+              };
               external_port = mkOption {
                 description = "The SSH listener is reachable via this port externally.";
                 default = null;
@@ -164,6 +170,11 @@ in
                 default = "[::]:8888";
                 type = str;
               };
+              external_host = mkOption {
+                description = "The HTTP listener is reachable via this domain name externally.";
+                default = null;
+                type = nullOr str;
+              };
               external_port = mkOption {
                 description = "The HTTP listener is reachable via this port externally.";
                 default = null;
@@ -239,6 +250,11 @@ in
                 default = "[::]:33306";
                 type = str;
               };
+              external_host = mkOption {
+                description = "The MySQL listener is reachable via this domain name externally.";
+                default = null;
+                type = nullOr str;
+              };
               external_port = mkOption {
                 description = "The MySQL listener is reachable via this port externally.";
                 default = null;
@@ -266,6 +282,11 @@ in
                 default = "[::]:55432";
                 type = str;
               };
+              external_host = mkOption {
+                description = "The PostgreSQL listener is reachable via this domain name externally.";
+                default = null;
+                type = nullOr str;
+              };
               external_port = mkOption {
                 description = "The PostgreSQL listener is reachable via this port externally.";
                 default = null;
@@ -293,6 +314,11 @@ in
                 default = "[::]:8443";
                 type = str;
               };
+              external_host = mkOption {
+                description = "The Kubernetes listener is reachable via this domain name externally.";
+                default = null;
+                type = nullOr str;
+              };
               external_port = mkOption {
                 description = "The Kubernetes listener is reachable via this port externally.";
                 default = null;

From d2414a45a6f3668dbdfe5544f904a1b6010b4fa9 Mon Sep 17 00:00:00 2001
From: Lemon Lam <alemonmk@users.noreply.github.com>
Date: Tue, 21 Apr 2026 12:18:18 +0800
Subject: [PATCH 09/51] nixos/warpgate: add `log.audit_retention`

... and clarify what `log.retention` does

(cherry picked from commit 7688f7f735ca862264bcb4d8327170e67fb89782)
---
 nixos/modules/services/security/warpgate.nix | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/security/warpgate.nix b/nixos/modules/services/security/warpgate.nix
index 2cb9d44e92a0..4ca994e70f31 100644
--- a/nixos/modules/services/security/warpgate.nix
+++ b/nixos/modules/services/security/warpgate.nix
@@ -349,8 +349,13 @@ in
                   "json"
                 ];
               };
+              audit_retention = mkOption {
+                description = "How long Warpgate keeps its audit logs.";
+                default = "1year";
+                type = str;
+              };
               retention = mkOption {
-                description = "How long Warpgate keep its logs.";
+                description = "How long Warpgate keeps its non-audit logs and session recordings.";
                 default = "7days";
                 type = str;
               };

From a88809b315ccb079202dbfc9d645d7a29e37766b Mon Sep 17 00:00:00 2001
From: Lemon Lam <alemonmk@users.noreply.github.com>
Date: Tue, 21 Apr 2026 12:25:28 +0800
Subject: [PATCH 10/51] nixos/warpgate: align `sso_providers` with config
 schema

`default_credential_policy` is left out because it's not well defined in schema.

(cherry picked from commit 09e9c0110c0b8ed78aa9e33198a7323d298c52d1)
---
 nixos/modules/services/security/warpgate.nix | 37 ++++++++++++++++++--
 1 file changed, 34 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/services/security/warpgate.nix b/nixos/modules/services/security/warpgate.nix
index 4ca994e70f31..3547d199cae0 100644
--- a/nixos/modules/services/security/warpgate.nix
+++ b/nixos/modules/services/security/warpgate.nix
@@ -51,7 +51,10 @@ in
           freeformType = yaml.type;
           options = {
             sso_providers = mkOption {
-              description = "Configure OIDC single sign-on providers.";
+              description = ''
+                Configure OIDC single sign-on providers.
+                Main documentation can be found [here](https://warpgate.null.page/sso).
+              '';
               default = [ ];
               type = listOf (submodule {
                 freeformType = yaml.type;
@@ -62,12 +65,40 @@ in
                   };
                   label = mkOption {
                     description = "SSO provider name displayed on login page.";
-                    type = str;
+                    default = null;
+                    type = nullOr str;
+                  };
+                  auto_create_users = mkOption {
+                    description = "Whether to create user automatically at first SSO login.";
+                    default = false;
+                    type = bool;
                   };
                   provider = mkOption {
-                    description = "SSO provider configurations.";
+                    description = ''
+                      SSO provider configurations.
+                      See [here](https://github.com/warp-tech/warpgate/blob/ffc755f0137944bd39cf4cbce90f4279da500943/config-schema.json#L430) for all acceptable options.
+                    '';
                     type = attrsOf yaml.type;
                   };
+                  return_domain_whitelist = mkOption {
+                    description = ''
+                      Controls the SSO return URL supplied to SSO provider.
+                      This will also required you to connect to this instance via whitelisted domain when doing SSO login.
+                    '';
+                    default = null;
+                    type = nullOr (listOf str);
+                  };
+                  return_url_prefix = mkOption {
+                    description = ''
+                      Controls the SSO return URL supplied to SSO provider.
+                      Useful for providers that do not allow the @ sign in the URL (e.g. Azure).
+                    '';
+                    default = "@";
+                    type = enum [
+                      "@"
+                      "_"
+                    ];
+                  };
                 };
               });
               example = literalExpression ''

From 0494f347f0133e86da8bd54bc845f46b5296eb41 Mon Sep 17 00:00:00 2001
From: Lemon Lam <alemonmk@users.noreply.github.com>
Date: Thu, 14 May 2026 22:48:53 +0800
Subject: [PATCH 11/51] warpgate: 0.23.1 -> 0.23.4

(cherry picked from commit a69e459d2b4eca23a2210a5e3026cb0b06189982)
---
 pkgs/by-name/wa/warpgate/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/wa/warpgate/package.nix b/pkgs/by-name/wa/warpgate/package.nix
index 9e994b4eae2c..dad4192177fa 100644
--- a/pkgs/by-name/wa/warpgate/package.nix
+++ b/pkgs/by-name/wa/warpgate/package.nix
@@ -20,7 +20,7 @@ rustPlatform.buildRustPackage (
 
       patches = [ ./web-ui-package-json.patch ];
 
-      npmDepsHash = "sha256-jRY3vR9rwqQc1WjxIuPb797ZXXrgDYNZ947fERxJ0zA=";
+      npmDepsHash = "sha256-JW3nibMIETj5PQcaNRS5UVZgguSvGd9Bw8uGD3kb5uM=";
 
       nativeBuildInputs = [ openapi-generator-cli ];
 
@@ -35,16 +35,16 @@ rustPlatform.buildRustPackage (
   in
   {
     pname = "warpgate";
-    version = "0.23.1";
+    version = "0.23.4";
 
     src = fetchFromGitHub {
       owner = "warp-tech";
       repo = "warpgate";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-GayjhHkD9LtuR7dz7tw1smz4fPwOl8R9X9QTgx9snnM=";
+      hash = "sha256-/IhnDBQq7Ed5vaGiCHNTcE7Uu9b9VrBN1ipCd2Tai1o=";
     };
 
-    cargoHash = "sha256-Y3oVvQkZDmGmmxUYrWSP6qKZ4hgjly+t98PRmi88oaY=";
+    cargoHash = "sha256-PRR+bzvmWcWUVdV1HqDqD08SwvDCvGXMvkIVoFEnaQI=";
 
     patches = [
       (replaceVars ./hardcode-version.patch { inherit (finalAttrs) version; })

From 33ea111a4beac27058312a2cb03ddf6e1db127c3 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 7 Apr 2026 00:46:33 +0000
Subject: [PATCH 12/51] distribution: 3.0.0 -> 3.1.0

(cherry picked from commit 346b301b5db560714dccf5f222884e0f56e2d73b)
---
 pkgs/by-name/di/distribution/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/di/distribution/package.nix b/pkgs/by-name/di/distribution/package.nix
index 438b99c542ed..551c2e1284ae 100644
--- a/pkgs/by-name/di/distribution/package.nix
+++ b/pkgs/by-name/di/distribution/package.nix
@@ -9,13 +9,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "distribution";
-  version = "3.0.0";
+  version = "3.1.0";
 
   src = fetchFromGitHub {
     owner = "distribution";
     repo = "distribution";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-myezQTEdH7kkpCoAeZMf5OBxT4Bz8Qx6vCnwim230RY=";
+    hash = "sha256-r0J1zsj4Qioe8+dByqzOgJypW+A06P2uIjetPu7w+24=";
   };
 
   vendorHash = null;

From 73861f9f97465303dcf359ea9619300b84007634 Mon Sep 17 00:00:00 2001
From: Paul Meyer <katexochen0@gmail.com>
Date: Fri, 17 Apr 2026 12:36:12 +0200
Subject: [PATCH 13/51] libsolv: 0.7.35 -> 0.7.36

Signed-off-by: Paul Meyer <katexochen0@gmail.com>
(cherry picked from commit 88bc5dadf1577d56ab1d19064e473e32982ee038)
---
 pkgs/by-name/li/libsolv/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/li/libsolv/package.nix b/pkgs/by-name/li/libsolv/package.nix
index 5424338c08f3..32a17dfcf222 100644
--- a/pkgs/by-name/li/libsolv/package.nix
+++ b/pkgs/by-name/li/libsolv/package.nix
@@ -17,15 +17,15 @@
   withConda ? true,
 }:
 
-stdenv.mkDerivation rec {
-  version = "0.7.35";
+stdenv.mkDerivation (finalAttrs: {
+  version = "0.7.36";
   pname = "libsolv";
 
   src = fetchFromGitHub {
     owner = "openSUSE";
     repo = "libsolv";
-    rev = version;
-    hash = "sha256-DHECjda7s12hSysbaXK2+wM/nXpAOpTn+eSf9XGC3z0=";
+    rev = finalAttrs.version;
+    hash = "sha256-7a/vAdgW7ma2GHqv1LaQNFA7w1Hmzm6Q/HriNN6hlpE=";
   };
 
   cmakeFlags = [
@@ -68,4 +68,4 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.linux ++ lib.platforms.darwin;
     maintainers = [ ];
   };
-}
+})

From c0ec54b02edb287fa7005aaf950897097f590bd7 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Thu, 21 May 2026 16:22:20 +0200
Subject: [PATCH 14/51] libsolv: 0.7.36 -> 0.7.37

changelog: https://github.com/openSUSE/libsolv/blob/0.7.37/NEWS

diff: https://github.com/openSUSE/libsolv/compare/0.7.36...0.7.37
(cherry picked from commit 82679a6d3f3c4fb869fffb73d6340d428bff81a3)
---
 pkgs/by-name/li/libsolv/package.nix | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libsolv/package.nix b/pkgs/by-name/li/libsolv/package.nix
index 32a17dfcf222..63a1ac4e31d6 100644
--- a/pkgs/by-name/li/libsolv/package.nix
+++ b/pkgs/by-name/li/libsolv/package.nix
@@ -2,6 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch,
   cmake,
   ninja,
   pkg-config,
@@ -18,16 +19,24 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "0.7.36";
+  version = "0.7.37";
   pname = "libsolv";
 
   src = fetchFromGitHub {
     owner = "openSUSE";
     repo = "libsolv";
     rev = finalAttrs.version;
-    hash = "sha256-7a/vAdgW7ma2GHqv1LaQNFA7w1Hmzm6Q/HriNN6hlpE=";
+    hash = "sha256-hiumMnTJ3eP+acH2V0eNTM71Fw//IWQPechCA0+kH1s=";
   };
 
+  patches = [
+    (fetchpatch {
+      name = "CVE-2026-9149";
+      url = "https://github.com/openSUSE/libsolv/commit/210386037c892a720972ad35a3d8f7073b4d763b.patch";
+      hash = "sha256-ju3xn78UGMR5usq1e1ovFTWnKW1TPDA77sNGx8yc8Z8=";
+    })
+  ];
+
   cmakeFlags = [
     "-DENABLE_COMPLEX_DEPS=true"
     (lib.cmakeBool "ENABLE_CONDA" withConda)

From b9f1a50bca2121f7d3fa64c75137a41e1ee235d8 Mon Sep 17 00:00:00 2001
From: teutat3s <10206665+teutat3s@users.noreply.github.com>
Date: Mon, 18 May 2026 17:05:03 +0200
Subject: [PATCH 15/51] docker_25: 25.0.13 -> 25.0.16

https://github.com/moby/moby/milestone/212?closed=1
https://github.com/moby/moby/milestone/215?closed=1
https://github.com/moby/moby/milestone/237?closed=1

Upstream did not tag a new release for docker/cli, and there are no new
commits in the 25.0 branch:
https://github.com/docker/cli/compare/43987fca488a535d810c429f75743d8c7b63bf4f...25.0

https://github.com/moby/moby/compare/v25.0.13...v25.0.16
(cherry picked from commit ff2f4a4013d8e7534c516bd1e1363c130a6131b9)
---
 pkgs/applications/virtualization/docker/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index 2bee66bc58f2..788ef0c328ce 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -396,7 +396,7 @@ in
   # https://github.com/moby/moby/tree/${mobyRev}/Dockerfile
   docker_25 =
     let
-      version = "25.0.13";
+      version = "25.0.16";
     in
     callPackage dockerGen {
       inherit version;
@@ -405,7 +405,7 @@ in
       cliRev = "43987fca488a535d810c429f75743d8c7b63bf4f";
       cliHash = "sha256-OwufdfuUPbPtgqfPeiKrQVkOOacU2g4ommHb770gV40=";
       mobyRev = "v${version}";
-      mobyHash = "sha256-X+1QG/toJt+VNLktR5vun8sG3PRoTVBAcekFXxocJdU=";
+      mobyHash = "sha256-St5yLoxo8QUTu7PjNcblS/EzZm98T189RPl1y+pAyHA=";
       runcRev = "v1.2.5";
       runcHash = "sha256-J/QmOZxYnMPpzm87HhPTkYdt+fN+yeSUu2sv6aUeTY4=";
       containerdRev = "v1.7.27";

From b933b0d074fb0d4d98653cd559e876992e3fbad1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 27 Jan 2026 02:10:38 +0000
Subject: [PATCH 16/51] gitoxide: 0.45.0 -> 0.50.0

(cherry picked from commit 475e90c01b44db3b901709131ce69e18fcd5336a)
---
 pkgs/by-name/gi/gitoxide/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gi/gitoxide/package.nix b/pkgs/by-name/gi/gitoxide/package.nix
index d5b49da99050..1c7768233016 100644
--- a/pkgs/by-name/gi/gitoxide/package.nix
+++ b/pkgs/by-name/gi/gitoxide/package.nix
@@ -18,16 +18,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gitoxide";
-  version = "0.45.0";
+  version = "0.50.0";
 
   src = fetchFromGitHub {
     owner = "GitoxideLabs";
     repo = "gitoxide";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-mMmyFFEVvzI5UmpA10XxnfYZiCg3tizplqFVUND/wQc=";
+    hash = "sha256-TUBBt0RxmyXjBF4fKG6slfU19DjbWkPsaUww0ILz8/k=";
   };
 
-  cargoHash = "sha256-JMpNe8jg52wDTJkPy4ZnNcLqjH6K1tXo5SFVPJdITdo=";
+  cargoHash = "sha256-CLFDZ/fv0FLcbWvF8LN8dTOKeRCsVy2Ff2kqqWk0LLM=";
 
   nativeBuildInputs = [
     cmake

From eb3960b0fac276960cc4659746d3b2b9a3122154 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Sat, 7 Mar 2026 18:24:40 +0100
Subject: [PATCH 17/51] maintainers: remove syberant

(cherry picked from commit 34921867b261c52a1018bcad93ac59cbac07db43)
---
 maintainers/maintainer-list.nix      | 6 ------
 pkgs/by-name/gi/gitoxide/package.nix | 2 +-
 2 files changed, 1 insertion(+), 7 deletions(-)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 1fec20b6b6e1..021e93dc1f2c 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -25528,12 +25528,6 @@
     githubId = 127287939;
     name = "Syed Sumairul Hasan";
   };
-  syberant = {
-    email = "sybrand@neuralcoding.com";
-    github = "syberant";
-    githubId = 20063502;
-    name = "Sybrand Aarnoutse";
-  };
   syboxez = {
     email = "syboxez@gmail.com";
     matrix = "@syboxez:matrix.org";
diff --git a/pkgs/by-name/gi/gitoxide/package.nix b/pkgs/by-name/gi/gitoxide/package.nix
index 1c7768233016..5db21594e1a6 100644
--- a/pkgs/by-name/gi/gitoxide/package.nix
+++ b/pkgs/by-name/gi/gitoxide/package.nix
@@ -60,7 +60,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       mit # or
       asl20
     ];
-    maintainers = with lib.maintainers; [ syberant ];
+    maintainers = [ ];
     # NB: `ein` is also provided by this package, but `nix run
     # nixpkgs#gitoxide` doesn't work at all without this set.
     mainProgram = "gix";

From 259d2614a3cdb6fd4f351612868bb22ae7cc9b0f Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Tue, 17 Mar 2026 16:11:47 +0100
Subject: [PATCH 18/51] gitoxide: 0.50.0 -> 0.52.0

(cherry picked from commit b2b8110884c17c80e537b1f1474f2113152ec318)
---
 pkgs/by-name/gi/gitoxide/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gi/gitoxide/package.nix b/pkgs/by-name/gi/gitoxide/package.nix
index 5db21594e1a6..faf95b3ccc90 100644
--- a/pkgs/by-name/gi/gitoxide/package.nix
+++ b/pkgs/by-name/gi/gitoxide/package.nix
@@ -18,16 +18,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gitoxide";
-  version = "0.50.0";
+  version = "0.52.0";
 
   src = fetchFromGitHub {
     owner = "GitoxideLabs";
     repo = "gitoxide";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-TUBBt0RxmyXjBF4fKG6slfU19DjbWkPsaUww0ILz8/k=";
+    hash = "sha256-nOpe+w0ILxS2f7EdDo1gg31eaESobKHdQ1F4pzpxsfE=";
   };
 
-  cargoHash = "sha256-CLFDZ/fv0FLcbWvF8LN8dTOKeRCsVy2Ff2kqqWk0LLM=";
+  cargoHash = "sha256-z/aytFu8b23cVsZuIBcjbNUhsvoWi5saQKVgrCEq5+s=";
 
   nativeBuildInputs = [
     cmake

From 5bc7529fb8359552ccf9d9633656a5f2b5a18749 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Tue, 17 Mar 2026 16:13:00 +0100
Subject: [PATCH 19/51] gitoxide: add hythera as maintainer

(cherry picked from commit 13f55e7bdd59d09482def68a1d2c1a563650786c)
---
 pkgs/by-name/gi/gitoxide/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/gi/gitoxide/package.nix b/pkgs/by-name/gi/gitoxide/package.nix
index faf95b3ccc90..c92640cb6bcd 100644
--- a/pkgs/by-name/gi/gitoxide/package.nix
+++ b/pkgs/by-name/gi/gitoxide/package.nix
@@ -60,7 +60,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       mit # or
       asl20
     ];
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ hythera ];
     # NB: `ein` is also provided by this package, but `nix run
     # nixpkgs#gitoxide` doesn't work at all without this set.
     mainProgram = "gix";

From 9d72afdcadad80ada143b08a9cc3d1f9d42fe42c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 24 Apr 2026 13:20:22 +0000
Subject: [PATCH 20/51] gitoxide: 0.52.0 -> 0.52.1

(cherry picked from commit c126268cb458f052d59a68d69dec30199823e573)
---
 pkgs/by-name/gi/gitoxide/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gi/gitoxide/package.nix b/pkgs/by-name/gi/gitoxide/package.nix
index c92640cb6bcd..3ad33e30d2da 100644
--- a/pkgs/by-name/gi/gitoxide/package.nix
+++ b/pkgs/by-name/gi/gitoxide/package.nix
@@ -18,16 +18,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gitoxide";
-  version = "0.52.0";
+  version = "0.52.1";
 
   src = fetchFromGitHub {
     owner = "GitoxideLabs";
     repo = "gitoxide";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nOpe+w0ILxS2f7EdDo1gg31eaESobKHdQ1F4pzpxsfE=";
+    hash = "sha256-PcRX5k4rqi61VnEpbKR2avChLBhPNSEsUjvul2myWOY=";
   };
 
-  cargoHash = "sha256-z/aytFu8b23cVsZuIBcjbNUhsvoWi5saQKVgrCEq5+s=";
+  cargoHash = "sha256-zeT+2gIJbRqVtAiulccRoczd+xdYBkcWWYzbk/bRtXA=";
 
   nativeBuildInputs = [
     cmake

From e9651e2fd46844c539057769c2b261d0d05bed26 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 3 May 2026 09:49:44 +0000
Subject: [PATCH 21/51] gitoxide: 0.52.1 -> 0.53.0

(cherry picked from commit 7b27780780a780c5f4c2461983f961d63edcb35e)
---
 pkgs/by-name/gi/gitoxide/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gi/gitoxide/package.nix b/pkgs/by-name/gi/gitoxide/package.nix
index 3ad33e30d2da..6988a6080c37 100644
--- a/pkgs/by-name/gi/gitoxide/package.nix
+++ b/pkgs/by-name/gi/gitoxide/package.nix
@@ -18,16 +18,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gitoxide";
-  version = "0.52.1";
+  version = "0.53.0";
 
   src = fetchFromGitHub {
     owner = "GitoxideLabs";
     repo = "gitoxide";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-PcRX5k4rqi61VnEpbKR2avChLBhPNSEsUjvul2myWOY=";
+    hash = "sha256-fg5Y2WYlDqcV2OIVHUWMMP2e/gz2FNBUd0AmZzKUVx8=";
   };
 
-  cargoHash = "sha256-zeT+2gIJbRqVtAiulccRoczd+xdYBkcWWYzbk/bRtXA=";
+  cargoHash = "sha256-i48mE6PJTDeT+xOwljKxXZiSDvHPON+ysMptm8obIUU=";
 
   nativeBuildInputs = [
     cmake

From 88d3a55756b87dffbef8003971f5a621b21de0a5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 26 May 2026 07:36:42 +0000
Subject: [PATCH 22/51] gitoxide: 0.53.0 -> 0.54.0

(cherry picked from commit 1aac3e5113cad165fef919f3051c839b52d94f04)
---
 pkgs/by-name/gi/gitoxide/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gi/gitoxide/package.nix b/pkgs/by-name/gi/gitoxide/package.nix
index 6988a6080c37..b857ac360b24 100644
--- a/pkgs/by-name/gi/gitoxide/package.nix
+++ b/pkgs/by-name/gi/gitoxide/package.nix
@@ -18,16 +18,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "gitoxide";
-  version = "0.53.0";
+  version = "0.54.0";
 
   src = fetchFromGitHub {
     owner = "GitoxideLabs";
     repo = "gitoxide";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-fg5Y2WYlDqcV2OIVHUWMMP2e/gz2FNBUd0AmZzKUVx8=";
+    hash = "sha256-MkOmxvACroJAB1nQZT1pcJ/Fn9gWNFwKiwVNb9iUlgY=";
   };
 
-  cargoHash = "sha256-i48mE6PJTDeT+xOwljKxXZiSDvHPON+ysMptm8obIUU=";
+  cargoHash = "sha256-bYgGQa8Gym4dzkuTrOSu3NwUhYdZNtq7ACwVwhdKQRI=";
 
   nativeBuildInputs = [
     cmake

From 317248efcde9139003b98fecbadeb01e56512369 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Wed, 27 May 2026 08:53:19 +0200
Subject: [PATCH 23/51] thunderbird-esr: 140.7.2esr -> 140.11.1esr

Uh, I'm sorry.  I forgot to keep updating after r-ryantm
stopped doing so unexpectedly (because this upstream bug).
There are basically no changes beyond security improvements.

(further info composed by mweinelt)
https://www.thunderbird.net/en-US/thunderbird/140.8.0esr/releasenotes/
https://www.thunderbird.net/en-US/thunderbird/140.8.1esr/releasenotes/
https://www.thunderbird.net/en-US/thunderbird/140.9.0esr/releasenotes/
https://www.thunderbird.net/en-US/thunderbird/140.9.1esr/releasenotes/
https://www.thunderbird.net/en-US/thunderbird/140.10.0esr/releasenotes/
https://www.thunderbird.net/en-US/thunderbird/140.10.1esr/releasenotes/
https://www.thunderbird.net/en-US/thunderbird/140.10.2esr/releasenotes/
https://www.thunderbird.net/en-US/thunderbird/140.11.0esr/releasenotes/
https://www.thunderbird.net/en-US/thunderbird/140.11.1esr/releasenotes/

Fixes:
CVE-2025-59375, CVE-2026-2757, CVE-2026-2758, CVE-2026-2759,
CVE-2026-2760, CVE-2026-2761, CVE-2026-2762, CVE-2026-2763,
CVE-2026-2764, CVE-2026-2765, CVE-2026-2766, CVE-2026-2767,
CVE-2026-2768, CVE-2026-2769, CVE-2026-2770, CVE-2026-2771,
CVE-2026-2772, CVE-2026-2773, CVE-2026-2774, CVE-2026-2775,
CVE-2026-2776, CVE-2026-2777, CVE-2026-2778, CVE-2026-2779,
CVE-2026-2780, CVE-2026-2781, CVE-2026-2782, CVE-2026-2783,
CVE-2026-2784, CVE-2026-2785, CVE-2026-2786, CVE-2026-2787,
CVE-2026-2788, CVE-2026-2789, CVE-2026-2790, CVE-2026-2791,
CVE-2026-2792, CVE-2026-2793, CVE-2026-3889, CVE-2026-4371,
CVE-2026-4684, CVE-2026-4685, CVE-2026-4686, CVE-2026-4687,
CVE-2026-4688, CVE-2026-4689, CVE-2026-4690, CVE-2026-4691,
CVE-2026-4692, CVE-2026-4693, CVE-2026-4694, CVE-2026-4695,
CVE-2026-4696, CVE-2026-4697, CVE-2026-4698, CVE-2026-4699,
CVE-2026-4700, CVE-2026-4701, CVE-2026-4702, CVE-2026-4704,
CVE-2026-4705, CVE-2026-4706, CVE-2026-4707, CVE-2026-4708,
CVE-2026-4709, CVE-2026-4710, CVE-2026-4711, CVE-2026-4712,
CVE-2026-4713, CVE-2026-4714, CVE-2026-4715, CVE-2026-4716,
CVE-2026-4717, CVE-2026-4718, CVE-2026-4719, CVE-2026-4720,
CVE-2026-4721, CVE-2026-5731, CVE-2026-5732, CVE-2026-5734,
CVE-2026-6746, CVE-2026-6747, CVE-2026-6748, CVE-2026-6749,
CVE-2026-6750, CVE-2026-6751, CVE-2026-6752, CVE-2026-6753,
CVE-2026-6754, CVE-2026-6757, CVE-2026-6759, CVE-2026-6761,
CVE-2026-6762, CVE-2026-6763, CVE-2026-6764, CVE-2026-6765,
CVE-2026-6766, CVE-2026-6767, CVE-2026-6769, CVE-2026-6770,
CVE-2026-6771, CVE-2026-6772, CVE-2026-6776, CVE-2026-6785,
CVE-2026-6786, CVE-2026-7320, CVE-2026-7321, CVE-2026-7322,
CVE-2026-7323, CVE-2026-8090, CVE-2026-8091, CVE-2026-8092,
CVE-2026-8094, CVE-2026-8388, CVE-2026-8391, CVE-2026-8401,
CVE-2026-8946, CVE-2026-8947, CVE-2026-8949, CVE-2026-8950,
CVE-2026-8953, CVE-2026-8954, CVE-2026-8955, CVE-2026-8956,
CVE-2026-8957, CVE-2026-8958, CVE-2026-8959, CVE-2026-8961,
CVE-2026-8962, CVE-2026-8968, CVE-2026-8970, CVE-2026-8974,
CVE-2026-8975

(cherry picked from commit ecd827db1f2fd41e347fb72ef1accd67df6aa896)
---
 .../mailreaders/thunderbird/packages.nix        | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
index 8a78d99b79c8..71d6cb7a2fa6 100644
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -32,11 +32,14 @@ let
       # FIXME: let's hope that upstream will fix this soon and we can drop this hack again.
       # https://bugzilla.mozilla.org/show_bug.cgi?id=2040877
       extraPostPatch =
-        lib.optionalString (lib.versionAtLeast version "151" && lib.versionOlder version "152")
-          ''
-            echo https://hg.mozilla.org/releases/comm-release/rev/becfb8fb2c70f1603882a2787e2170d5d8013949 >> sourcestamp.txt
-            echo https://hg.mozilla.org/releases/mozilla-release/rev/fc12dc911f904307729760a817deb829cbf8feb4 >> sourcestamp.txt
-          '';
+        lib.optionalString (lib.versionAtLeast version "151" && lib.versionOlder version "152") ''
+          echo https://hg.mozilla.org/releases/comm-release/rev/becfb8fb2c70f1603882a2787e2170d5d8013949 >> sourcestamp.txt
+          echo https://hg.mozilla.org/releases/mozilla-release/rev/fc12dc911f904307729760a817deb829cbf8feb4 >> sourcestamp.txt
+        ''
+        # https://bugzilla.mozilla.org/show_bug.cgi?id=2006630
+        + lib.optionalString (lib.versionAtLeast version "140.8" && lib.versionOlder version "151") ''
+          find . -name .cargo-checksum.json | xargs sed 's/"[^"]*\.gitmodules":"[a-z0-9]*",//g' -i
+        '';
 
       meta = {
         changelog = "https://www.thunderbird.net/en-US/thunderbird/${version}/releasenotes/";
@@ -88,8 +91,8 @@ rec {
   thunderbird-140 = common {
     applicationName = "Thunderbird ESR";
 
-    version = "140.7.2esr";
-    sha512 = "513bcaa496f987d0f3906aeb6fe3ea651331470646b0c58479c91bb2c8eb52e389bc8aa646437a03b611ab78bda1df7252545960ffe38086d1fc462e65421819";
+    version = "140.11.1esr";
+    sha512 = "93dfdd26e6f4c7dd2f7dcc2e4994980d017868341c60c93775721467abd9192b815f2de63928e7d10c965fc045ed72ca5b49ed6502a61e50104ee5cd00941d1e";
 
     updateScript = callPackage ./update.nix {
       attrPath = "thunderbirdPackages.thunderbird-140";

From ed94b9f74695d952bc486146c18fccf7a74a45a2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 27 May 2026 13:28:38 +0000
Subject: [PATCH 24/51] matrix-authentication-service: 1.16.0 -> 1.17.0

(cherry picked from commit e5d373f0e5dcc593a8f0417d35b159f9408aa4d4)
---
 pkgs/by-name/ma/matrix-authentication-service/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ma/matrix-authentication-service/package.nix b/pkgs/by-name/ma/matrix-authentication-service/package.nix
index 035ffce4f31a..f82e05e0674a 100644
--- a/pkgs/by-name/ma/matrix-authentication-service/package.nix
+++ b/pkgs/by-name/ma/matrix-authentication-service/package.nix
@@ -18,16 +18,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "matrix-authentication-service";
-  version = "1.16.0";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "matrix-authentication-service";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pyL2QhvycaGBYgelsHK5Ces195Z1aY2XZyecsPXO/X4=";
+    hash = "sha256-/3NgMZ0B+B0BHPBi/vuiCS6xi70wgNKCZH0hTpkWi+U=";
   };
 
-  cargoHash = "sha256-gvG6+strULIewJgFdGg3fJ2mjUVjgi9/Q7pDredYuiU=";
+  cargoHash = "sha256-aZSnQmOwqo0OG3XXM5eups0cKNs80j/nAsZB5tnWUrY=";
 
   npmDeps = fetchNpmDeps {
     name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";

From 193351585c5ee25fc9acced7d75a017677338eb8 Mon Sep 17 00:00:00 2001
From: Eric Roberts <eric@ericroberts.dev>
Date: Wed, 27 May 2026 11:00:02 +0000
Subject: [PATCH 25/51] karakeep: 0.31.0 -> 0.32.0

(cherry picked from commit 4dc5ccb246ee1718497b1c2caccef06b1005e252)
---
 pkgs/by-name/ka/karakeep/package.nix                      | 6 +++---
 .../ka/karakeep/patches/dont-lock-pnpm-version.patch      | 8 +-------
 2 files changed, 4 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/ka/karakeep/package.nix b/pkgs/by-name/ka/karakeep/package.nix
index 4c1d8abf4a43..d1bf44061f19 100644
--- a/pkgs/by-name/ka/karakeep/package.nix
+++ b/pkgs/by-name/ka/karakeep/package.nix
@@ -19,13 +19,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "karakeep";
-  version = "0.31.0";
+  version = "0.32.0";
 
   src = fetchFromGitHub {
     owner = "karakeep-app";
     repo = "karakeep";
     tag = "cli/v${finalAttrs.version}";
-    hash = "sha256-++aNTkLOkwgkzRxg/WdrHfchXQwUUir0qqmb7WfdZJ0=";
+    hash = "sha256-P88DQi0T7tmBH7cjs8/Hz77bU0oG7u67XPoLsdePNhI=";
   };
 
   patches = [
@@ -66,7 +66,7 @@ stdenv.mkDerivation (finalAttrs: {
     };
 
     fetcherVersion = 3;
-    hash = "sha256-+MbKG0h3cD0kZua0OkdQsUeTjAY4ysK41KXUSaOSKHA=";
+    hash = "sha256-aT4JPx3iYw4kw8GHXKWMnelSVT0q2S3PK8DgSCQCyKQ=";
   };
   buildPhase = ''
     runHook preBuild
diff --git a/pkgs/by-name/ka/karakeep/patches/dont-lock-pnpm-version.patch b/pkgs/by-name/ka/karakeep/patches/dont-lock-pnpm-version.patch
index 43a546386af8..b9e5609b33f0 100644
--- a/pkgs/by-name/ka/karakeep/patches/dont-lock-pnpm-version.patch
+++ b/pkgs/by-name/ka/karakeep/patches/dont-lock-pnpm-version.patch
@@ -5,12 +5,6 @@ requirement.
 ---
 --- a/package.json
 +++ b/package.json
-@@ -32,7 +32,7 @@
-     "turbo": "^2.1.2"
-   },
-   "prettier": "@karakeep/prettier-config",
+@@ -40 +40 @@
 -  "packageManager": "pnpm@9.15.9",
 +  "packageManager": "pnpm",
-   "pnpm": {
-     "patchedDependencies": {
-       "xcode@3.0.1": "patches/xcode@3.0.1.patch"

From 37c00e907b600140a965af696afcc0693e13d718 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 14 Jan 2026 20:14:27 +0000
Subject: [PATCH 26/51] gh: 2.83.2 -> 2.85.0

(cherry picked from commit 6cb8d37fc203440c4a8a045b95bc3060353b20f4)
---
 pkgs/by-name/gh/gh/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gh/gh/package.nix b/pkgs/by-name/gh/gh/package.nix
index 6d5177d70182..d7f8e3c8f2ef 100644
--- a/pkgs/by-name/gh/gh/package.nix
+++ b/pkgs/by-name/gh/gh/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "gh";
-  version = "2.83.2";
+  version = "2.85.0";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-YpbxdD+83pK326EmwLCzUh+wASdOjuCqSP2eXIJndxI=";
+    hash = "sha256-XngvPEVrUNKuNs+9/osXEagwqe0KW25xFwEjcPfMO0M=";
   };
 
-  vendorHash = "sha256-AkcbtVR1+uYy2AtRl1hvUBBF8vI3hH4NXznmgwmAzmw=";
+  vendorHash = "sha256-pBHEqMgEoR3sWNbQjGBNso7WLP9Rz2gu89Bzu+7jz5c=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From 8742b7d8e23d7391110d285d5f398d8dd5a421c1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 21 Jan 2026 20:05:15 +0000
Subject: [PATCH 27/51] gh: 2.85.0 -> 2.86.0

(cherry picked from commit 6c8eefec604f137e524e5448c7c5f8687092abc9)
---
 pkgs/by-name/gh/gh/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gh/gh/package.nix b/pkgs/by-name/gh/gh/package.nix
index d7f8e3c8f2ef..27436f623268 100644
--- a/pkgs/by-name/gh/gh/package.nix
+++ b/pkgs/by-name/gh/gh/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "gh";
-  version = "2.85.0";
+  version = "2.86.0";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-XngvPEVrUNKuNs+9/osXEagwqe0KW25xFwEjcPfMO0M=";
+    hash = "sha256-+MPhDgXIVfYGp5ALI5GjRoeLRRUtNgpzUawxoqR76iE=";
   };
 
   vendorHash = "sha256-pBHEqMgEoR3sWNbQjGBNso7WLP9Rz2gu89Bzu+7jz5c=";

From 955fb8ebd2775404e59f7541621ac531cb69e5d8 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Sun, 22 Feb 2026 13:23:37 +0000
Subject: [PATCH 28/51] gh: 2.86.0 -> 2.87.2

Changes: https://github.com/cli/cli/releases/tag/v2.87.2
(cherry picked from commit 2d44cedc3a912dbc490afb1a5b108f50f98ae6e6)
---
 pkgs/by-name/gh/gh/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gh/gh/package.nix b/pkgs/by-name/gh/gh/package.nix
index 27436f623268..10da34cd3734 100644
--- a/pkgs/by-name/gh/gh/package.nix
+++ b/pkgs/by-name/gh/gh/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule rec {
   pname = "gh";
-  version = "2.86.0";
+  version = "2.87.2";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-+MPhDgXIVfYGp5ALI5GjRoeLRRUtNgpzUawxoqR76iE=";
+    hash = "sha256-QPQVsdZy17rNX5ACoKHiJG+f/2CAiBfO3B1ucton0tw=";
   };
 
-  vendorHash = "sha256-pBHEqMgEoR3sWNbQjGBNso7WLP9Rz2gu89Bzu+7jz5c=";
+  vendorHash = "sha256-POrm4lHEO2Eti7dbohKBwXW+DTs22EUZX+tMNUCL3lg=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From 1929b51983b4be2b3b3c5200edbef9287dfe44b7 Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Tue, 24 Feb 2026 19:31:14 -0500
Subject: [PATCH 29/51] gh: 2.87.2 -> 2.87.3

Diff: https://github.com/cli/cli/compare/v2.87.2...v2.87.3

Changelog: https://github.com/cli/cli/releases/tag/v2.87.3
(cherry picked from commit 7168aba5148eaa03b8ea3d1b6edf4e0133e82d09)
---
 pkgs/by-name/gh/gh/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gh/gh/package.nix b/pkgs/by-name/gh/gh/package.nix
index 10da34cd3734..558acdc40960 100644
--- a/pkgs/by-name/gh/gh/package.nix
+++ b/pkgs/by-name/gh/gh/package.nix
@@ -10,13 +10,13 @@
 
 buildGoModule rec {
   pname = "gh";
-  version = "2.87.2";
+  version = "2.87.3";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-QPQVsdZy17rNX5ACoKHiJG+f/2CAiBfO3B1ucton0tw=";
+    hash = "sha256-F4xUwj/krB5vjIfnvmwySlztBrcxJ+k1GvXb2gs7eXY=";
   };
 
   vendorHash = "sha256-POrm4lHEO2Eti7dbohKBwXW+DTs22EUZX+tMNUCL3lg=";

From ee26e2beae74b93a165ea31a69465aeb67a2af60 Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Sat, 14 Mar 2026 13:45:56 -0400
Subject: [PATCH 30/51] gh: 2.87.3 -> 2.88.1

Diff: https://github.com/cli/cli/compare/v2.87.3...v2.88.1

Release notes:
* https://github.com/cli/cli/releases/tag/v2.88.0
* https://github.com/cli/cli/releases/tag/v2.88.1

(cherry picked from commit ccd7c69f9670f35704dbc86de3970efdd1e6c9c8)
---
 pkgs/by-name/gh/gh/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/gh/gh/package.nix b/pkgs/by-name/gh/gh/package.nix
index 558acdc40960..6adc74325d39 100644
--- a/pkgs/by-name/gh/gh/package.nix
+++ b/pkgs/by-name/gh/gh/package.nix
@@ -1,25 +1,25 @@
 {
   lib,
   fetchFromGitHub,
-  buildGoModule,
+  buildGo126Module,
   installShellFiles,
   stdenv,
   testers,
   gh,
 }:
 
-buildGoModule rec {
+buildGo126Module rec {
   pname = "gh";
-  version = "2.87.3";
+  version = "2.88.1";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-F4xUwj/krB5vjIfnvmwySlztBrcxJ+k1GvXb2gs7eXY=";
+    hash = "sha256-aM5hpkI4MTQ6eNUB4FVNQRSNUmwI84dTdVMUANtrnJk=";
   };
 
-  vendorHash = "sha256-POrm4lHEO2Eti7dbohKBwXW+DTs22EUZX+tMNUCL3lg=";
+  vendorHash = "sha256-RD40Lqg6EF0T12JJ7Y4B5L2KIvwRHcgGRU1UMiU3qTo=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From 89eeb0b04b968bbcb56f90902a3a1ded64e0b692 Mon Sep 17 00:00:00 2001
From: Sav Tripodi <sav@sanico.com.au>
Date: Tue, 24 Mar 2026 11:57:10 +0100
Subject: [PATCH 31/51] gh: add maintainer savtrip

(cherry picked from commit 7901d8a6cf82aaa56fb3cda297376a65b578a634)
---
 pkgs/by-name/gh/gh/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/gh/gh/package.nix b/pkgs/by-name/gh/gh/package.nix
index 6adc74325d39..58f861be76c9 100644
--- a/pkgs/by-name/gh/gh/package.nix
+++ b/pkgs/by-name/gh/gh/package.nix
@@ -63,6 +63,7 @@ buildGo126Module rec {
     maintainers = with lib.maintainers; [
       mdaniels5757
       zowoq
+      savtrip
     ];
   };
 }

From d3b4bee0a59d578f5235ffbc538ee89f2dbd347c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 26 Mar 2026 22:42:33 +0000
Subject: [PATCH 32/51] gh: 2.88.1 -> 2.89.0

(cherry picked from commit f33adc6b7bd4fb92014a60851f83097e33cb70b6)
---
 pkgs/by-name/gh/gh/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gh/gh/package.nix b/pkgs/by-name/gh/gh/package.nix
index 58f861be76c9..8b594e9c7877 100644
--- a/pkgs/by-name/gh/gh/package.nix
+++ b/pkgs/by-name/gh/gh/package.nix
@@ -10,16 +10,16 @@
 
 buildGo126Module rec {
   pname = "gh";
-  version = "2.88.1";
+  version = "2.89.0";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-aM5hpkI4MTQ6eNUB4FVNQRSNUmwI84dTdVMUANtrnJk=";
+    hash = "sha256-SiPcji8CbJd6GwWmsIFWq3874Mr9/VggOATX9yKYjow=";
   };
 
-  vendorHash = "sha256-RD40Lqg6EF0T12JJ7Y4B5L2KIvwRHcgGRU1UMiU3qTo=";
+  vendorHash = "sha256-Sko+jTkGUTiR66Mv/p5INv/CLID1EK2v9fY0GfIeckg=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From 2dc04799ed878dfa374e281834267c62547e5d1f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 16 Apr 2026 20:05:27 +0000
Subject: [PATCH 33/51] gh: 2.89.0 -> 2.90.0

(cherry picked from commit 35174fd4edf93c9ddfa9467fadb7bfcd023f535f)
---
 pkgs/by-name/gh/gh/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gh/gh/package.nix b/pkgs/by-name/gh/gh/package.nix
index 8b594e9c7877..b766194bfc28 100644
--- a/pkgs/by-name/gh/gh/package.nix
+++ b/pkgs/by-name/gh/gh/package.nix
@@ -10,16 +10,16 @@
 
 buildGo126Module rec {
   pname = "gh";
-  version = "2.89.0";
+  version = "2.90.0";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-SiPcji8CbJd6GwWmsIFWq3874Mr9/VggOATX9yKYjow=";
+    hash = "sha256-yVc4UvC+CsW+pP/BJRjcOGX7h8zO2M8yM0m57Mr89JY=";
   };
 
-  vendorHash = "sha256-Sko+jTkGUTiR66Mv/p5INv/CLID1EK2v9fY0GfIeckg=";
+  vendorHash = "sha256-hz6oMLTibnSLB11vEWsO0O5ZFGKYJaVce6POqINObnI=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From 848cbe5f0a92489ae9e8575da51e7910b2a1fe7c Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Wed, 22 Apr 2026 17:17:11 -0400
Subject: [PATCH 34/51] gh: 2.90.0 -> 2.91.0

Diff: https://github.com/cli/cli/compare/v2.90.0...v2.91.0

Changelog: https://github.com/cli/cli/releases/tag/v2.91.0
(cherry picked from commit e13ba8eaf22ff3abc78b3c379cc88ad0fdbdc077)
---
 pkgs/by-name/gh/gh/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gh/gh/package.nix b/pkgs/by-name/gh/gh/package.nix
index b766194bfc28..92eaa12d4f22 100644
--- a/pkgs/by-name/gh/gh/package.nix
+++ b/pkgs/by-name/gh/gh/package.nix
@@ -10,16 +10,16 @@
 
 buildGo126Module rec {
   pname = "gh";
-  version = "2.90.0";
+  version = "2.91.0";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-yVc4UvC+CsW+pP/BJRjcOGX7h8zO2M8yM0m57Mr89JY=";
+    hash = "sha256-2ggQd2sCybdtNGwiP7+GqB1CwZDNA/bDq24NC5btNFU=";
   };
 
-  vendorHash = "sha256-hz6oMLTibnSLB11vEWsO0O5ZFGKYJaVce6POqINObnI=";
+  vendorHash = "sha256-4xZAcwn9/vUTkahIlqwyGb/2SYYGusdXY4nye8ldp/g=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From c33441ba73b22f085abd2445f4319a744c041ed1 Mon Sep 17 00:00:00 2001
From: Benedikt Ritter <beneritter@gmail.com>
Date: Thu, 30 Apr 2026 14:31:33 +0200
Subject: [PATCH 35/51] gh: opt out of telemetry collection by default

Starting with release 2.91.0 gh sends pseudonymized telemetry data to
GitHub. Disabling it requires and explicit opt-out.

Context: https://github.blog/changelog/2026-04-22-github-cli-opt-out-usage-telemetry/

This changes makes telemetry collection opt in. If users really want to
share data with GitHub, they can `overrideAttrs` and explicitly set the
new `enableTelemetry` parameter to `true`.

(cherry picked from commit ec7f8fa48004f7f425fc79c0ec823d16938bd261)
---
 pkgs/by-name/gh/gh/package.nix | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/gh/gh/package.nix b/pkgs/by-name/gh/gh/package.nix
index 92eaa12d4f22..d5c5d4ceb6f5 100644
--- a/pkgs/by-name/gh/gh/package.nix
+++ b/pkgs/by-name/gh/gh/package.nix
@@ -6,6 +6,8 @@
   stdenv,
   testers,
   gh,
+  makeWrapper,
+  enableTelemetry ? false,
 }:
 
 buildGo126Module rec {
@@ -21,7 +23,10 @@ buildGo126Module rec {
 
   vendorHash = "sha256-4xZAcwn9/vUTkahIlqwyGb/2SYYGusdXY4nye8ldp/g=";
 
-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [
+    installShellFiles
+    makeWrapper
+  ];
 
   # N.B.: using the Makefile is intentional.
   # We pass "nixpkgs" for build.Date to avoid `gh --version` reporting a very old date.
@@ -35,6 +40,10 @@ buildGo126Module rec {
     runHook preInstall
     install -Dm755 bin/gh -t $out/bin
   ''
+  + lib.optionalString (!enableTelemetry) ''
+    wrapProgram $out/bin/gh \
+      --set GH_TELEMETRY false
+  ''
   + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installManPage share/man/*/*.[1-9]
 

From d954bef262d815e159d06e7d575a778f7c8ee2bd Mon Sep 17 00:00:00 2001
From: 2kybe3 <kybe@kybe.xyz>
Date: Thu, 30 Apr 2026 18:27:01 +0200
Subject: [PATCH 36/51] gh: 2.91.0 -> 2.92.0

Diff: https://github.com/cli/cli/compare/v2.91.0...v2.92.0
Changelog: https://github.com/cli/cli/releases/tag/v2.92.0
(cherry picked from commit 5437e4e34975239bb726b2720777eeb24597e8b7)
---
 pkgs/by-name/gh/gh/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gh/gh/package.nix b/pkgs/by-name/gh/gh/package.nix
index d5c5d4ceb6f5..fae593b8bc79 100644
--- a/pkgs/by-name/gh/gh/package.nix
+++ b/pkgs/by-name/gh/gh/package.nix
@@ -12,16 +12,16 @@
 
 buildGo126Module rec {
   pname = "gh";
-  version = "2.91.0";
+  version = "2.92.0";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-2ggQd2sCybdtNGwiP7+GqB1CwZDNA/bDq24NC5btNFU=";
+    hash = "sha256-/7EiX4ZZPhSNgY/D5OVOako/c0ujHq05GMj3UB11bqQ=";
   };
 
-  vendorHash = "sha256-4xZAcwn9/vUTkahIlqwyGb/2SYYGusdXY4nye8ldp/g=";
+  vendorHash = "sha256-pBLRCIRjN3VoXbTFSq+R9/N3uAUCEjvPtk8LKKKS51s=";
 
   nativeBuildInputs = [
     installShellFiles

From bd623dbb5e418717c7704b56edaa284b59b2f6b9 Mon Sep 17 00:00:00 2001
From: Marie Ramlow <me@nycode.dev>
Date: Thu, 30 Apr 2026 20:32:28 +0200
Subject: [PATCH 37/51] gh: use --set-default for GH_TELEMETRY env var

(cherry picked from commit b120931e5797238f36faa9c78c6b15fc540569c2)
---
 pkgs/by-name/gh/gh/package.nix | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/pkgs/by-name/gh/gh/package.nix b/pkgs/by-name/gh/gh/package.nix
index fae593b8bc79..2dd9cc03dfd4 100644
--- a/pkgs/by-name/gh/gh/package.nix
+++ b/pkgs/by-name/gh/gh/package.nix
@@ -7,7 +7,6 @@
   testers,
   gh,
   makeWrapper,
-  enableTelemetry ? false,
 }:
 
 buildGo126Module rec {
@@ -39,10 +38,8 @@ buildGo126Module rec {
   installPhase = ''
     runHook preInstall
     install -Dm755 bin/gh -t $out/bin
-  ''
-  + lib.optionalString (!enableTelemetry) ''
     wrapProgram $out/bin/gh \
-      --set GH_TELEMETRY false
+      --set-default GH_TELEMETRY false
   ''
   + lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
     installManPage share/man/*/*.[1-9]

From 8ce8853ff1385ca3f7a78b73081f1cbe356cbe47 Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Wed, 27 May 2026 17:50:52 -0400
Subject: [PATCH 38/51] gh: 2.92.0 -> 2.93.0

Diff: https://github.com/cli/cli/compare/v2.92.0...v2.93.0

Changelog: https://github.com/cli/cli/releases/tag/v2.93.0
(cherry picked from commit 3b0e4f9cbdbddc848cab70d0849dc7c9e3dcef51)
---
 pkgs/by-name/gh/gh/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gh/gh/package.nix b/pkgs/by-name/gh/gh/package.nix
index 2dd9cc03dfd4..a705898acfe5 100644
--- a/pkgs/by-name/gh/gh/package.nix
+++ b/pkgs/by-name/gh/gh/package.nix
@@ -11,16 +11,16 @@
 
 buildGo126Module rec {
   pname = "gh";
-  version = "2.92.0";
+  version = "2.93.0";
 
   src = fetchFromGitHub {
     owner = "cli";
     repo = "cli";
     tag = "v${version}";
-    hash = "sha256-/7EiX4ZZPhSNgY/D5OVOako/c0ujHq05GMj3UB11bqQ=";
+    hash = "sha256-r/+JFdMOUIb32St+VkUw+Q7Lb2L6IiPczmONFE4hwDw=";
   };
 
-  vendorHash = "sha256-pBLRCIRjN3VoXbTFSq+R9/N3uAUCEjvPtk8LKKKS51s=";
+  vendorHash = "sha256-eMPcla1XKfq+zBb633Zz4cn820FWuEaRrXQJ1TQ8Lkg=";
 
   nativeBuildInputs = [
     installShellFiles

From 0269512e789f6fdb7b2321225ace23a690f01847 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 18 Mar 2026 19:55:27 +0000
Subject: [PATCH 39/51] libredwg: 0.13.3 -> 0.13.4

(cherry picked from commit 34faa0cb06a071038a4ca4fdb978aae3eae878b6)
---
 pkgs/by-name/li/libredwg/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libredwg/package.nix b/pkgs/by-name/li/libredwg/package.nix
index 121508c79ade..ddfbca9c4992 100644
--- a/pkgs/by-name/li/libredwg/package.nix
+++ b/pkgs/by-name/li/libredwg/package.nix
@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "libredwg";
-  version = "0.13.3";
+  version = "0.13.4";
 
   src = fetchFromGitHub {
     owner = "LibreDWG";
     repo = "libredwg";
     tag = version;
-    hash = "sha256-FlBHwNsqVSBE8dTDewoKkCbs8Jd/4d69MPpEFzg6Ruc=";
+    hash = "sha256-FeDQCByFGKfHJDOPQA92GslXZ33nhGfB6/63t2TeugE=";
     fetchSubmodules = true;
   };
 

From 85ca4154fdbb254cc5fd04dec31683146f2a673d Mon Sep 17 00:00:00 2001
From: Thorsten Weber <cpt.chaos83@googlemail.com>
Date: Wed, 27 May 2026 20:35:18 +0200
Subject: [PATCH 40/51] libredwg: 0.13.4 -> 0.13.4.8200

Update to latest pre-release to fix multiple security vulnerabilities:

- CVE-2026-9500: heap-buffer-overflow in decode.c (decompress_R2004_section)
- CVE-2026-9501: heap-buffer-overflow in decode.c (read_2004_compressed_section)
- CVE-2026-9502: heap-buffer-overflow in decode.c (decompress_R2004_section)
- CVE-2026-9503: heap-buffer-overflow in decode.c (decompress_R2004_section)
- CVE-2026-9504: null pointer dereference in dwggrep.c (main)
- CVE-2026-9529: heap-buffer-overflow in decode.c (decompress_R2004_section)
- CVE-2026-9530: heap-buffer-overflow in decode.c (decompress_R2004_section)
- CVE-2026-9605: heap-buffer-overflow in decode.c (decompress_R2004_section)

Individual backports were not feasible as the decompressor was significantly
refactored on upstream's main branch between 0.13.4 and the fixes.

(cherry picked from commit b27ee09e7d0dc21a216ccdb0a866619046e3e993)
---
 pkgs/by-name/li/libredwg/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libredwg/package.nix b/pkgs/by-name/li/libredwg/package.nix
index ddfbca9c4992..03b0b3bd6b01 100644
--- a/pkgs/by-name/li/libredwg/package.nix
+++ b/pkgs/by-name/li/libredwg/package.nix
@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation rec {
   pname = "libredwg";
-  version = "0.13.4";
+  version = "0.13.4.8200";
 
   src = fetchFromGitHub {
     owner = "LibreDWG";
     repo = "libredwg";
     tag = version;
-    hash = "sha256-FeDQCByFGKfHJDOPQA92GslXZ33nhGfB6/63t2TeugE=";
+    hash = "sha256-HaQvJyuEeaTfuUJbmlV4qcfXiLdHJ2vO4EGInwAKJYk=";
     fetchSubmodules = true;
   };
 

From 67b1d435f324270ea9f6022234086c23dc47e953 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Wed, 27 May 2026 07:25:59 -0700
Subject: [PATCH 41/51] python3Packages.vllm: mark insecure

(cherry picked from commit 1d8573f85ce60fcbd715f66d63b8f1a95ca8ebd2)
---
 pkgs/development/python-modules/vllm/default.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/python-modules/vllm/default.nix b/pkgs/development/python-modules/vllm/default.nix
index fb030ed2665b..e248fc4806df 100644
--- a/pkgs/development/python-modules/vllm/default.nix
+++ b/pkgs/development/python-modules/vllm/default.nix
@@ -536,5 +536,10 @@ buildPythonPackage rec {
       # find_isa
       "x86_64-darwin"
     ];
+    knownVulnerabilities = [
+      "CVE-2026-27893"
+      "CVE-2026-44222"
+      "CVE-2026-44223"
+    ];
   };
 }

From 29f7f59f2368918a67aa9b5f785d50d2a9614d79 Mon Sep 17 00:00:00 2001
From: NTBBloodbath <bloodbathalchemist@protonmail.com>
Date: Tue, 26 May 2026 22:24:40 -0400
Subject: [PATCH 42/51] penpot-desktop: 0.23.0 -> 0.23.1

(cherry picked from commit 599cef92f59fa5548d11140f7fab72ea4f97efd1)
---
 pkgs/by-name/pe/penpot-desktop/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/pe/penpot-desktop/package.nix b/pkgs/by-name/pe/penpot-desktop/package.nix
index d0ef0a17bc81..664a74686731 100644
--- a/pkgs/by-name/pe/penpot-desktop/package.nix
+++ b/pkgs/by-name/pe/penpot-desktop/package.nix
@@ -2,7 +2,7 @@
   lib,
   buildNpmPackage,
   copyDesktopItems,
-  electron_39,
+  electron_41,
   fetchFromGitHub,
   jq,
   makeDesktopItem,
@@ -15,17 +15,17 @@ let
   description = "Unofficial desktop application for the open-source design tool, Penpot";
   icon = "penpot";
   nodejs = nodejs_24;
-  electron = electron_39;
+  electron = electron_41;
 in
 buildNpmPackage rec {
   pname = "penpot-desktop";
-  version = "0.23.0";
+  version = "0.23.1";
 
   src = fetchFromGitHub {
     owner = "author-more";
     repo = "penpot-desktop";
     tag = "v${version}";
-    hash = "sha256-2thLD8ECfHZMD3Yw/lQgnCqqEGxCE1AXsHGP9JKof+Q=";
+    hash = "sha256-/vRF5eqtjdmd2Qmb+OAgKfLJmh78S0WrLWA94SeOJQA=";
   };
 
   makeCacheWritable = true;
@@ -33,7 +33,7 @@ buildNpmPackage rec {
     "--engine-strict"
     "--legacy-peer-deps"
   ];
-  npmDepsHash = "sha256-uyt9gmmytDwSCnXk9HUBwJoPMcqMt2wLwHHmY2Kx0yk=";
+  npmDepsHash = "sha256-hu2v2Dw2SRs4Egmsi5hb81vgnZDjQahLXyAYm/uaMao=";
   # Do not run the default build script as it leads to errors caused by the electron-builder configuration
   dontNpmBuild = true;
 

From 2f31d1a6457ab781a2dabe871c4ff21ba3b2d786 Mon Sep 17 00:00:00 2001
From: Sergei Trofimovich <slyich@gmail.com>
Date: Wed, 27 May 2026 21:45:00 +0100
Subject: [PATCH 43/51] liferea: 1.16.9 -> 1.16.10

Changes: https://github.com/lwindolf/liferea/releases/tag/v1.16.10
(cherry picked from commit 7a5669f0f2dfe5c5cc70e262c5b8fa5ac23d4ede)
---
 pkgs/by-name/li/liferea/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/liferea/package.nix b/pkgs/by-name/li/liferea/package.nix
index da8adc78009e..494f4b65d837 100644
--- a/pkgs/by-name/li/liferea/package.nix
+++ b/pkgs/by-name/li/liferea/package.nix
@@ -26,11 +26,11 @@
 
 stdenv.mkDerivation rec {
   pname = "liferea";
-  version = "1.16.9";
+  version = "1.16.10";
 
   src = fetchurl {
     url = "https://github.com/lwindolf/${pname}/releases/download/v${version}/${pname}-${version}.tar.bz2";
-    hash = "sha256-c4ySTlAfL1Ebs1+pLZd5KidO3UcF9HKhV/RpGLRSlcY=";
+    hash = "sha256-4cprlrp/vCaoUN4HwZFa+H1DW1S5q/byQcd+g/g427g=";
   };
 
   nativeBuildInputs = [

From ca49d349d853c01d1d9a6c3d4531b2ce2fb68010 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kristoffer=20Plagborg=20Bak=20S=C3=B8rensen?=
 <kristoffer.plagborgbak.soerensen@beumer.com>
Date: Thu, 28 May 2026 13:40:06 +0200
Subject: [PATCH 44/51] git-absorb: install nushell completion

(cherry picked from commit 4b43c64139a50f349ecc3ce22070fd870c449fa2)
---
 pkgs/by-name/gi/git-absorb/package.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/gi/git-absorb/package.nix b/pkgs/by-name/gi/git-absorb/package.nix
index 45946deb11e1..827fd5884dfc 100644
--- a/pkgs/by-name/gi/git-absorb/package.nix
+++ b/pkgs/by-name/gi/git-absorb/package.nix
@@ -42,7 +42,8 @@ rustPlatform.buildRustPackage rec {
     installShellCompletion --cmd git-absorb \
       --bash <($out/bin/git-absorb --gen-completions bash) \
       --fish <($out/bin/git-absorb --gen-completions fish) \
-      --zsh <($out/bin/git-absorb --gen-completions zsh)
+      --zsh <($out/bin/git-absorb --gen-completions zsh) \
+      --nushell <($out/bin/git-absorb --gen-completions nushell)
   '';
 
   meta = {

From c1c813b80d94de59c4bf66821bf5f1b2c62791b6 Mon Sep 17 00:00:00 2001
From: teutat3s <10206665+teutat3s@users.noreply.github.com>
Date: Sun, 17 May 2026 19:19:31 +0200
Subject: [PATCH 45/51] electron-source.electron_39: remove

(cherry picked from commit 65b67d5ec15dd75a7fa3a4251e2f324f0921c70c)
---
 pkgs/development/tools/electron/info.json | 1350 ---------------------
 pkgs/top-level/all-packages.nix           |    5 +-
 2 files changed, 1 insertion(+), 1354 deletions(-)

diff --git a/pkgs/development/tools/electron/info.json b/pkgs/development/tools/electron/info.json
index 0fc383df7911..3ea459f02d53 100644
--- a/pkgs/development/tools/electron/info.json
+++ b/pkgs/development/tools/electron/info.json
@@ -1,1354 +1,4 @@
 {
-    "39": {
-        "chrome": "142.0.7444.265",
-        "chromium": {
-            "deps": {
-                "gn": {
-                    "hash": "sha256-sm5GWbkm3ua7EkCWTuY4TG6EXKe3asXTrH1APnNARJQ=",
-                    "rev": "81b24e01531ecf0eff12ec9359a555ec3944ec4e",
-                    "version": "0-unstable-2025-09-18"
-                }
-            },
-            "version": "142.0.7444.265"
-        },
-        "chromium_npm_hash": "sha256-i1eQ4YlrWSgY522OlFtGDDPmxE2zd1hDM03AzR8RafE=",
-        "deps": {
-            "src": {
-                "args": {
-                    "hash": "sha256-VJKx61JTIGg4j/kNqtOWkYOsy0xYYZbuyoiKFVcbZgc=",
-                    "postFetch": "rm -rf $(find $out/third_party/blink/web_tests ! -name BUILD.gn -mindepth 1 -maxdepth 1); rm -r $out/content/test/data; rm -rf $out/courgette/testdata; rm -r $out/extensions/test/data; rm -r $out/media/test/data; ",
-                    "tag": "142.0.7444.265",
-                    "url": "https://chromium.googlesource.com/chromium/src.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/chrome/test/data/perf/canvas_bench": {
-                "args": {
-                    "hash": "sha256-svOuyBGKloBLM11xLlWCDsB4PpRjdKTBdW2UEW4JQjM=",
-                    "rev": "a7b40ea5ae0239517d78845a5fc9b12976bfc732",
-                    "url": "https://chromium.googlesource.com/chromium/canvas_bench.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/chrome/test/data/perf/frame_rate/content": {
-                "args": {
-                    "hash": "sha256-t4kcuvH0rkPBkcdiMsoNQaRwU09eU+oSvyHDiAHrKXo=",
-                    "rev": "c10272c88463efeef6bb19c9ec07c42bc8fe22b9",
-                    "url": "https://chromium.googlesource.com/chromium/frame_rate/content.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/chrome/test/data/xr/webvr_info": {
-                "args": {
-                    "hash": "sha256-BsAPwc4oEWri0TlqhyxqFNqKdfgVSrB0vQyISmYY4eg=",
-                    "rev": "c58ae99b9ff9e2aa4c524633519570bf33536248",
-                    "url": "https://chromium.googlesource.com/external/github.com/toji/webvr.info.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/docs/website": {
-                "args": {
-                    "hash": "sha256-+2OBUpLLVPB/fDlF/9mEwTsvH2Una3ZYKUJY06nZauo=",
-                    "rev": "3913dbd6fdde06b914d0e1119fcc884f8115e4f8",
-                    "url": "https://chromium.googlesource.com/website.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/electron": {
-                "args": {
-                    "hash": "sha256-7hMzrFN/W37fq4bNPk5910UHy/ItMkHol/SmK1Uip6c=",
-                    "owner": "electron",
-                    "repo": "electron",
-                    "tag": "v39.8.10"
-                },
-                "fetcher": "fetchFromGitHub"
-            },
-            "src/media/cdm/api": {
-                "args": {
-                    "hash": "sha256-voZaq/OiP5/QSSZmBx1ifriBc6HQ9+m4pUz0o9+O9x8=",
-                    "rev": "a4cbc4325e6de42ead733f2af43c08292d0e65a8",
-                    "url": "https://chromium.googlesource.com/chromium/cdm.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/net/third_party/quiche/src": {
-                "args": {
-                    "hash": "sha256-ACXkivQ4tqePgNIg2hpl4DQFa8n0CUkCOqPlgh56oLs=",
-                    "rev": "c0df0d316bd7e4ddf44e5ba094b5c5b061d94b0c",
-                    "url": "https://quiche.googlesource.com/quiche.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/testing/libfuzzer/fuzzers/wasm_corpus": {
-                "args": {
-                    "hash": "sha256-gItDOfNqm1tHlmelz3l2GGdiKi9adu1EpPP6U7+8EQY=",
-                    "rev": "1df5e50a45db9518a56ebb42cb020a94a090258b",
-                    "url": "https://chromium.googlesource.com/v8/fuzzer_wasm_corpus.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/angle": {
-                "args": {
-                    "hash": "sha256-CCjQue8xv/t81I3ncqS6Ib3hjcs+FKCB+yvNUE+A+Dc=",
-                    "rev": "7628a2726022fc768f2464ed5060bbc97e13f77a",
-                    "url": "https://chromium.googlesource.com/angle/angle.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/angle/third_party/VK-GL-CTS/src": {
-                "args": {
-                    "hash": "sha256-VYROUPvcpkV+skw3RKXoCpB+4xVA2Qem+15YKjV7pMg=",
-                    "rev": "c67cffddd65aba724950e062343fa1cc89560b33",
-                    "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/VK-GL-CTS"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/angle/third_party/glmark2/src": {
-                "args": {
-                    "hash": "sha256-VebUALLFKwEa4+oE+jF8mBSzhJd6aflphPmcK1Em8bw=",
-                    "rev": "6edcf02205fd1e8979dc3f3964257a81959b80c8",
-                    "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/angle/third_party/rapidjson/src": {
-                "args": {
-                    "hash": "sha256-btUl1a/B0sXwf/+hyvCvVJjWqIkXfVYCpHm3TeBuOxk=",
-                    "rev": "781a4e667d84aeedbeb8184b7b62425ea66ec59f",
-                    "url": "https://chromium.googlesource.com/external/github.com/Tencent/rapidjson"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/anonymous_tokens/src": {
-                "args": {
-                    "hash": "sha256-jwfszvnWRtTmzPm5x/lyceX1Y0G0hyIATcKlYkKj/SY=",
-                    "rev": "50e04fb27eacd49a5e2bfde5977ac689e13ebeeb",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/anonymous-tokens.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/boringssl/src": {
-                "args": {
-                    "hash": "sha256-rhUF9fuWbiAkaGbHnhANZxCYEhkkoMQoiYzn1EfR270=",
-                    "rev": "91f3df0a20f6d3dd3e2f749b4a2730b68c3d585e",
-                    "url": "https://boringssl.googlesource.com/boringssl.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/breakpad/breakpad": {
-                "args": {
-                    "hash": "sha256-jGdQyM3+p3qt+Hjt44Wpg7XKiUt7kz9Lv1xRG7vp+dM=",
-                    "rev": "a1220f673dc44632e821bd1a217089e5a159a203",
-                    "url": "https://chromium.googlesource.com/breakpad/breakpad.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/cast_core/public/src": {
-                "args": {
-                    "hash": "sha256-yQxm1GMMne80bLl1P7OAN3bJLz1qRNAvou2/5MKp2ig=",
-                    "rev": "f5ee589bdaea60418f670fa176be15ccb9a34942",
-                    "url": "https://chromium.googlesource.com/cast_core/public"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/catapult": {
-                "args": {
-                    "hash": "sha256-Is8yDmTyNyseTBPIDwIlhRthqfkFPgQIvu3b6u5c0m0=",
-                    "rev": "04c85a1d0e324464c6be4b3d193b47cb6177d03a",
-                    "url": "https://chromium.googlesource.com/catapult.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/ced/src": {
-                "args": {
-                    "hash": "sha256-ySG74Rj2i2c/PltEgHVEDq+N8yd9gZmxNktc56zIUiY=",
-                    "rev": "ba412eaaacd3186085babcd901679a48863c7dd5",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/compact_enc_det.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/clang-format/script": {
-                "args": {
-                    "hash": "sha256-d9uweklBffiuCWEb03ti1eFLnMac2qRtvggzXY1n/RU=",
-                    "rev": "37f6e68a107df43b7d7e044fd36a13cbae3413f2",
-                    "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/clang/tools/clang-format.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/cld_3/src": {
-                "args": {
-                    "hash": "sha256-C3MOMBUy9jgkT9BAi/Fgm2UH4cxRuwSBEcRl3hzM2Ss=",
-                    "rev": "b48dc46512566f5a2d41118c8c1116c4f96dc661",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/cld_3.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/colorama/src": {
-                "args": {
-                    "hash": "sha256-6ZTdPYSHdQOLYMSnE+Tp7PgsVTs3U2awGu9Qb4Rg/tk=",
-                    "rev": "3de9f013df4b470069d03d250224062e8cf15c49",
-                    "url": "https://chromium.googlesource.com/external/colorama.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/compiler-rt/src": {
-                "args": {
-                    "hash": "sha256-XTPhIXHzTW4EjyER/49mKJVDQQVNGuyLu2OBAxSt+CQ=",
-                    "rev": "05f2a5dd0d1386777ae9d7fac9da776f82e7e0f2",
-                    "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/content_analysis_sdk/src": {
-                "args": {
-                    "hash": "sha256-f5Jmk1MiGjaRdLun+v/GKVl8Yv9hOZMTQUSxgiJalcY=",
-                    "rev": "9a408736204513e0e95dd2ab3c08de0d95963efc",
-                    "url": "https://chromium.googlesource.com/external/github.com/chromium/content_analysis_sdk.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/cpu_features/src": {
-                "args": {
-                    "hash": "sha256-E8LoVzhe+TAmARWZTSuINlsVhzpUJMxPPCGe/dHZcyA=",
-                    "rev": "936b9ab5515dead115606559502e3864958f7f6e",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/cpu_features.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/cpuinfo/src": {
-                "args": {
-                    "hash": "sha256-JW83AgI1cWv4TSpXNe9sv/hNYAA7MOdUeTHY8+0lHgc=",
-                    "rev": "877328f188a3c7d1fa855871a278eb48d530c4c0",
-                    "url": "https://chromium.googlesource.com/external/github.com/pytorch/cpuinfo.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/crabbyavif/src": {
-                "args": {
-                    "hash": "sha256-HUGkuQWfUGsE6crsluI7l5H2DYalruoDKqBjbVfE7BM=",
-                    "rev": "3ba05863e84fd3acb4f4af2b4545221b317a2e55",
-                    "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/crc32c/src": {
-                "args": {
-                    "hash": "sha256-KBraGaO5LmmPP+p8RuDogGldbTWdNDK+WzF4Q09keuE=",
-                    "rev": "d3d60ac6e0f16780bcfcc825385e1d338801a558",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/crc32c.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/cros-components/src": {
-                "args": {
-                    "hash": "sha256-g7LzBd2V21AaLdSdCw65WGYvKfrbtpRXsYc+3ILdiKs=",
-                    "rev": "7ccdbf60606671c2c057628125908fbfef9bd0c8",
-                    "url": "https://chromium.googlesource.com/external/google3/cros_components.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/cros_system_api": {
-                "args": {
-                    "hash": "sha256-N8/0tVMBi6yFe9HkR5wxDJ1+QAP1IV1Bz99Il3RZNFU=",
-                    "rev": "c33ff08e2b27ddaed22c8799fefd3a4b7d3c49a9",
-                    "url": "https://chromium.googlesource.com/chromiumos/platform2/system_api.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/crossbench": {
-                "args": {
-                    "hash": "sha256-JbgzTTFEFuA8ZyRLih3T/Fa3RhcOK4fi+9RuzZioiPI=",
-                    "rev": "f6e9d3627685e3bcb82d5a24c1f075b8dd0d881c",
-                    "url": "https://chromium.googlesource.com/crossbench.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/crossbench-web-tests": {
-                "args": {
-                    "hash": "sha256-yJmi1IpUiKhdoHAXyazkpm+Ezuc4Hp8pOIBntG5hN+U=",
-                    "rev": "3c76c8201f0732fe9781742229ab8ac43bf90cbf",
-                    "url": "https://chromium.googlesource.com/chromium/web-tests.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/dav1d/libdav1d": {
-                "args": {
-                    "hash": "sha256-dPVDZ4SyrHWsRWERUl6UKbbdUG/5dC/UTte6sItMYxg=",
-                    "rev": "af5cf2b1e7f03d6f6de84477e1ca8eed1f3eb03d",
-                    "url": "https://chromium.googlesource.com/external/github.com/videolan/dav1d.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/dawn": {
-                "args": {
-                    "hash": "sha256-BFJsVt7hkSyyPQiX7QCN7Fu6CgTF/2xwAQbWCkJVq6M=",
-                    "rev": "95f9c2b375395cc82941babdf1e9f0cf60a32831",
-                    "url": "https://dawn.googlesource.com/dawn.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/dawn/third_party/dxc": {
-                "args": {
-                    "hash": "sha256-kcmuSCdAAzyQrg33b3dlkUErd0x5TDZkE8iXMEYW8wo=",
-                    "rev": "2b58d6d865832f7146d6e22e2106e562458bbd0a",
-                    "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectXShaderCompiler"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/dawn/third_party/dxheaders": {
-                "args": {
-                    "hash": "sha256-0Miw1Cy/jmOo7bLFBOHuTRDV04cSeyvUEyPkpVsX9DA=",
-                    "rev": "980971e835876dc0cde415e8f9bc646e64667bf7",
-                    "url": "https://chromium.googlesource.com/external/github.com/microsoft/DirectX-Headers"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/dawn/third_party/glfw": {
-                "args": {
-                    "hash": "sha256-E1zXIDiw87badrLOZTvV+Wh9NZHu51nb70ZK9vlAlqE=",
-                    "rev": "b35641f4a3c62aa86a0b3c983d163bc0fe36026d",
-                    "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/dawn/third_party/khronos/EGL-Registry": {
-                "args": {
-                    "hash": "sha256-Z6DwLfgQ1wsJXz0KKJyVieOatnDmx3cs0qJ6IEgSq1A=",
-                    "rev": "7dea2ed79187cd13f76183c4b9100159b9e3e071",
-                    "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/EGL-Registry"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/dawn/third_party/khronos/OpenGL-Registry": {
-                "args": {
-                    "hash": "sha256-K3PcRIiD3AmnbiSm5TwaLs4Gu9hxaN8Y91WMKK8pOXE=",
-                    "rev": "5bae8738b23d06968e7c3a41308568120943ae77",
-                    "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/OpenGL-Registry"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/dawn/third_party/webgpu-cts": {
-                "args": {
-                    "hash": "sha256-lZgUbs1+6+tLeHmJTIWMbpT6oSVzC3A9/J3vKONgxSs=",
-                    "rev": "18f1cc77dea7254258eeee21839d1c249b506576",
-                    "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/dawn/third_party/webgpu-headers/src": {
-                "args": {
-                    "hash": "sha256-V/JhZyjLNSElllXbLduqyNjJqjrxB4SwwPpRHIcfIis=",
-                    "rev": "53a87a3d8cb4c32ec026978ce003020741df6f53",
-                    "url": "https://chromium.googlesource.com/external/github.com/webgpu-native/webgpu-headers"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/depot_tools": {
-                "args": {
-                    "hash": "sha256-oL/WjK90HWqtyE0sJhDUp3UxlC8jr4dZfp+Q80xu3sM=",
-                    "rev": "675a3a9ccd7cf9367bb4caa58c30f08b56d45ef5",
-                    "url": "https://chromium.googlesource.com/chromium/tools/depot_tools.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/devtools-frontend/src": {
-                "args": {
-                    "hash": "sha256-4SIqiDQtelkjdzTSDfB5GCymh+24MoiN77NNCxTV6qU=",
-                    "rev": "747b0d1aebe33e5fc3d32677eb88315ab000eb5e",
-                    "url": "https://chromium.googlesource.com/devtools/devtools-frontend"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/dom_distiller_js/dist": {
-                "args": {
-                    "hash": "sha256-yuEBD2XQlV3FGI/i7lTmJbCqzeBiuG1Qow8wvsppGJw=",
-                    "rev": "199de96b345ada7c6e7e6ba3d2fa7a6911b8767d",
-                    "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/domato/src": {
-                "args": {
-                    "hash": "sha256-fYxoA0fxKe9U23j+Jp0MWj4m7RfsRpM0XjF6/yOhX1I=",
-                    "rev": "053714bccbda79cf76dac3fee48ab2b27f21925e",
-                    "url": "https://chromium.googlesource.com/external/github.com/googleprojectzero/domato.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/dragonbox/src": {
-                "args": {
-                    "hash": "sha256-AOniXMPgwKpkJqivRd+GazEnhdw53FzhxKqG+GdU+cc=",
-                    "rev": "6c7c925b571d54486b9ffae8d9d18a822801cbda",
-                    "url": "https://chromium.googlesource.com/external/github.com/jk-jeon/dragonbox.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/eigen3/src": {
-                "args": {
-                    "hash": "sha256-ZXDzAuvTu46YhieLIQ7MSQ0os+v2RF+KBtFuKU9fCWE=",
-                    "rev": "430e35fbd15d3c946d2d2ba19ec41c16ba217cb3",
-                    "url": "https://chromium.googlesource.com/external/gitlab.com/libeigen/eigen.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/electron_node": {
-                "args": {
-                    "hash": "sha256-LP43+y5UC91tisM8EHj8l27El403k7kOVJeFqpZCgfQ=",
-                    "owner": "nodejs",
-                    "repo": "node",
-                    "tag": "v22.22.1"
-                },
-                "fetcher": "fetchFromGitHub"
-            },
-            "src/third_party/emoji-segmenter/src": {
-                "args": {
-                    "hash": "sha256-KdQdKBBipEBRT8UmNGao6yCB4m2CU8/SrMVvcXlb5qE=",
-                    "rev": "955936be8b391e00835257059607d7c5b72ce744",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/emoji-segmenter.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/engflow-reclient-configs": {
-                "args": {
-                    "hash": "sha256-aZXYPj9KYBiZnljqOLlWJWS396Fg3EhjiQLZmkwCBsY=",
-                    "owner": "EngFlow",
-                    "repo": "reclient-configs",
-                    "rev": "955335c30a752e9ef7bff375baab5e0819b6c00d"
-                },
-                "fetcher": "fetchFromGitHub"
-            },
-            "src/third_party/expat/src": {
-                "args": {
-                    "hash": "sha256-qe8O7otL6YcDDBx2DS/+c5mWIS8Rf8RQXVtLFMIAeyk=",
-                    "rev": "69d6c054c1bd5258c2a13405a7f5628c72c177c2",
-                    "url": "https://chromium.googlesource.com/external/github.com/libexpat/libexpat.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/farmhash/src": {
-                "args": {
-                    "hash": "sha256-5n58VEUxa/K//jAfZqG4cXyfxrp50ogWDNYcgiXVHdc=",
-                    "rev": "816a4ae622e964763ca0862d9dbd19324a1eaf45",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/farmhash.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/fast_float/src": {
-                "args": {
-                    "hash": "sha256-CG5je117WYyemTe5PTqznDP0bvY5TeXn8Vu1Xh5yUzQ=",
-                    "rev": "cb1d42aaa1e14b09e1452cfdef373d051b8c02a4",
-                    "url": "https://chromium.googlesource.com/external/github.com/fastfloat/fast_float.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/federated_compute/src": {
-                "args": {
-                    "hash": "sha256-5kuTp0TXOUCQQ7XcnwBRsQRxugl869hZhx8MbxDLwYk=",
-                    "rev": "e51058dfe7888094ecc09cda38bfceffd4d4664b",
-                    "url": "https://chromium.googlesource.com/external/github.com/google-parfait/federated-compute.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/ffmpeg": {
-                "args": {
-                    "hash": "sha256-ZeFzrCE9LkDcp3VTMJkm5ypX29RGZCyZkp3tEr7yFKU=",
-                    "rev": "9e751092c9498b84bbb77e2e0689ef9f50fe608f",
-                    "url": "https://chromium.googlesource.com/chromium/third_party/ffmpeg.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/flac": {
-                "args": {
-                    "hash": "sha256-Y5TXyJ8lVh8TaVC5S4BVxOmFxySBzPbJYEe8YJS6ZR4=",
-                    "rev": "807e251d9f8c5dd6059e547931e9c6a4251967af",
-                    "url": "https://chromium.googlesource.com/chromium/deps/flac.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/flatbuffers/src": {
-                "args": {
-                    "hash": "sha256-u5AVjbep3iWwGNXLrkPJUnF8SbmIXlHOYoy3NIlUl/E=",
-                    "rev": "1c514626e83c20fffa8557e75641848e1e15cd5e",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/flatbuffers.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/fontconfig/src": {
-                "args": {
-                    "hash": "sha256-2h0dWn7MxAX+4o2tMZLyjRFAES+FTMaGaf8M7ySkSV8=",
-                    "rev": "f0ed9c3f43161d3555f6f7a5234b22fe7ca60727",
-                    "url": "https://chromium.googlesource.com/external/fontconfig.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/fp16/src": {
-                "args": {
-                    "hash": "sha256-CR7h1d9RFE86l6btk4N8vbQxy0KQDxSMvckbiO87JEg=",
-                    "rev": "3d2de1816307bac63c16a297e8c4dc501b4076df",
-                    "url": "https://chromium.googlesource.com/external/github.com/Maratyszcza/FP16.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/freetype/src": {
-                "args": {
-                    "hash": "sha256-b74O5i4xhHq8y0qepP8Wup2nuj9LFzBX7ahMCCVhc98=",
-                    "rev": "d3668e00da732654b50e4e81f982544ed6e26390",
-                    "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/fuzztest/src": {
-                "args": {
-                    "hash": "sha256-gMIDf/Alh9BCk0Gm0m+mmhHoKreHCiN7/WOomcMbS/k=",
-                    "rev": "e101ca021a40733d0fa76a3bd9b49b5f76da4f8a",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/fuzztest.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/fxdiv/src": {
-                "args": {
-                    "hash": "sha256-LjX5kivfHbqCIA5pF9qUvswG1gjOFo3CMpX0VR+Cn38=",
-                    "rev": "63058eff77e11aa15bf531df5dd34395ec3017c8",
-                    "url": "https://chromium.googlesource.com/external/github.com/Maratyszcza/FXdiv.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/gemmlowp/src": {
-                "args": {
-                    "hash": "sha256-e6AeRhZioIiTG5R+IA9g2GBqI4o74wijJYmqINLOtQs=",
-                    "rev": "16e8662c34917be0065110bfcd9cc27d30f52fdf",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/gemmlowp.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/glslang/src": {
-                "args": {
-                    "hash": "sha256-/DwdyuSGCx22zsXZrcZGTECfsIqvzPQzTZ2mU8EkjxY=",
-                    "rev": "a57276bf558f5cf94d3a9854ebdf5a2236849a5a",
-                    "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/glslang"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/google_benchmark/src": {
-                "args": {
-                    "hash": "sha256-cH8s1gP6kCcojAAfTt5iQCVqiAaSooNk4BdaILujM3w=",
-                    "rev": "761305ec3b33abf30e08d50eb829e19a802581cc",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/benchmark.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/googletest/src": {
-                "args": {
-                    "hash": "sha256-A3kDQbt9ITaxCjl/tJtwySsPUyH+NNb8erdjBzq81o8=",
-                    "rev": "244cec869d12e53378fa0efb610cd4c32a454ec8",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/googletest.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/harfbuzz-ng/src": {
-                "args": {
-                    "hash": "sha256-gUUXBd2/di6MYhUzo0QkGQvRY6KLcy7qdDlSClnmnL8=",
-                    "rev": "7d936359a27abb2d7cb14ecc102463bb15c11843",
-                    "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/highway/src": {
-                "args": {
-                    "hash": "sha256-HNrlqtAs1vKCoSJ5TASs34XhzjEbLW+ISco1NQON+BI=",
-                    "rev": "84379d1c73de9681b54fbe1c035a23c7bd5d272d",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/highway.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/hunspell_dictionaries": {
-                "args": {
-                    "hash": "sha256-67mvpJRFFa9eMfyqFMURlbxOaTJBICnk+gl0b0mEHl8=",
-                    "rev": "41cdffd71c9948f63c7ad36e1fb0ff519aa7a37e",
-                    "url": "https://chromium.googlesource.com/chromium/deps/hunspell_dictionaries.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/icu": {
-                "args": {
-                    "hash": "sha256-k3z31DhDPoqjcZdUL4vjyUMVpUiNk44+7rCMTDVPH8Q=",
-                    "rev": "1b2e3e8a421efae36141a7b932b41e315b089af8",
-                    "url": "https://chromium.googlesource.com/chromium/deps/icu.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/ink/src": {
-                "args": {
-                    "hash": "sha256-SVwZWhM63iN2ajTMldgug0mfJV1rdvxTZwj/zyLe4WA=",
-                    "rev": "4e6081ad7052f97df7d77e1d87cea2d70c18a47b",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/ink.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/ink_stroke_modeler/src": {
-                "args": {
-                    "hash": "sha256-4iXoBgCCbWCqGbpchiAYQhKBK9rO1Xb6wP98iMd06cY=",
-                    "rev": "fe79520c9ad7d2d445d26d3c59fda6fc54eb4d5c",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/ink-stroke-modeler.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/instrumented_libs": {
-                "args": {
-                    "hash": "sha256-8kokdsnn5jD9KgM/6g0NuITBbKkGXWEM4BMr1nCrfdU=",
-                    "rev": "69015643b3f68dbd438c010439c59adc52cac808",
-                    "url": "https://chromium.googlesource.com/chromium/third_party/instrumented_libraries.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/jetstream/main": {
-                "args": {
-                    "hash": "sha256-jn6Twi+fc/qKjsqLqkrWxhQ677wY3rSCx3JfWCGhxr0=",
-                    "rev": "b400dd340af3457890ec7b4a903fefb02fcf2dc6",
-                    "url": "https://chromium.googlesource.com/external/github.com/WebKit/JetStream.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/jetstream/v2.2": {
-                "args": {
-                    "hash": "sha256-zucA2tqNOsvjhwYQKZ5bFUC73ZF/Fu7KpBflSelvixw=",
-                    "rev": "2145cedef4ca2777b792cb0059d3400ee2a6153c",
-                    "url": "https://chromium.googlesource.com/external/github.com/WebKit/JetStream.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/jsoncpp/source": {
-                "args": {
-                    "hash": "sha256-bSLNcoYBz3QCt5VuTR056V9mU2PmBuYBa0W6hFg2m8Q=",
-                    "rev": "42e892d96e47b1f6e29844cc705e148ec4856448",
-                    "url": "https://chromium.googlesource.com/external/github.com/open-source-parsers/jsoncpp.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/leveldatabase/src": {
-                "args": {
-                    "hash": "sha256-ANtMVRZmW6iOjDVn2y15ak2fTagFTTaz1Se6flUHL8w=",
-                    "rev": "4ee78d7ea98330f7d7599c42576ca99e3c6ff9c5",
-                    "url": "https://chromium.googlesource.com/external/leveldb.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libFuzzer/src": {
-                "args": {
-                    "hash": "sha256-TDi1OvYClJKmEDikanKVTmy8uxUXJ95nuVKo5u+uFPM=",
-                    "rev": "bea408a6e01f0f7e6c82a43121fe3af4506c932e",
-                    "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/compiler-rt/lib/fuzzer.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libaddressinput/src": {
-                "args": {
-                    "hash": "sha256-6h4/DQUBoBtuGfbaTL5Te1Z+24qjTaBuIydcTV18j80=",
-                    "rev": "2610f7b1043d6784ada41392fc9392d1ea09ea07",
-                    "url": "https://chromium.googlesource.com/external/libaddressinput.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libaom/source/libaom": {
-                "args": {
-                    "hash": "sha256-RWm/xaX3WGgCy6o4lM5g6j0vS6mc6ZbDAhRw6OQgJlU=",
-                    "rev": "2a70ad7bee390757eaa83aff12f310ba53915e9f",
-                    "url": "https://aomedia.googlesource.com/aom.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libc++/src": {
-                "args": {
-                    "hash": "sha256-IemCFOw1X+Kcna6cuj9e29FUhitqvVGn1DeMCShkbOs=",
-                    "rev": "b77132b512d5411f8393fd3decb3abaeaf1d3ec8",
-                    "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libc++abi/src": {
-                "args": {
-                    "hash": "sha256-7TUY05CW5OCyd1C1oq69rptr1RkvOMS+1CAJc7yKRFQ=",
-                    "rev": "864f61dc9253d56586ada34c388278565ef513f6",
-                    "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libdrm/src": {
-                "args": {
-                    "hash": "sha256-woSYEDUfcEBpYOYnli13wLMt754A7KnUbmTEcFQdFGw=",
-                    "rev": "ad78bb591d02162d3b90890aa4d0a238b2a37cde",
-                    "url": "https://chromium.googlesource.com/chromiumos/third_party/libdrm.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libgav1/src": {
-                "args": {
-                    "hash": "sha256-BgTfWmbcMvJB1KewJpRcMtbOd2FVuJ+fi1zAXBXfkrg=",
-                    "rev": "c05bf9be660cf170d7c26bd06bb42b3322180e58",
-                    "url": "https://chromium.googlesource.com/codecs/libgav1.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libipp/libipp": {
-                "args": {
-                    "hash": "sha256-gxU92lHLd6uxO8T3QWhZIK0hGy97cki705DV0VimCPY=",
-                    "rev": "2209bb84a8e122dab7c02fe66cc61a7b42873d7f",
-                    "url": "https://chromium.googlesource.com/chromiumos/platform2/libipp.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libjpeg_turbo": {
-                "args": {
-                    "hash": "sha256-Ig+tmprZDvlf/M72/DTar2pbxat9ZElgSqdXdoM0lPs=",
-                    "rev": "e14cbfaa85529d47f9f55b0f104a579c1061f9ad",
-                    "url": "https://chromium.googlesource.com/chromium/deps/libjpeg_turbo.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/liblouis/src": {
-                "args": {
-                    "hash": "sha256-EI/uaHXe0NlqdEw764q0SjerThYEVLRogUlmrsZwXnY=",
-                    "rev": "9700847afb92cb35969bdfcbbfbbb74b9c7b3376",
-                    "url": "https://chromium.googlesource.com/external/liblouis-github.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libpfm4/src": {
-                "args": {
-                    "hash": "sha256-awpZ22rovLZWQkX/qog93vL4u2gJ+F3w5IGFNlZ0heQ=",
-                    "rev": "964baf9d35d5f88d8422f96d8a82c672042e7064",
-                    "url": "https://chromium.googlesource.com/external/git.code.sf.net/p/perfmon2/libpfm4.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libphonenumber/dist": {
-                "args": {
-                    "hash": "sha256-ZbuDrZEUVp/ekjUP8WO/FsjAomRjeDBptT4nQZvTVi4=",
-                    "rev": "9d46308f313f2bf8dbce1dfd4f364633ca869ca7",
-                    "url": "https://chromium.googlesource.com/external/libphonenumber.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libprotobuf-mutator/src": {
-                "args": {
-                    "hash": "sha256-EaEC6R7SzqLw4QjEcWXFXhZc84lNBp6RSa9izjGnWKE=",
-                    "rev": "7bf98f78a30b067e22420ff699348f084f802e12",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/libprotobuf-mutator.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libsrtp": {
-                "args": {
-                    "hash": "sha256-bkG1+ss+1a2rCHGwZjhvf5UaNVbPPZJt9HZSIPBKGwM=",
-                    "rev": "a52756acb1c5e133089c798736dd171567df11f5",
-                    "url": "https://chromium.googlesource.com/chromium/deps/libsrtp.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libsync/src": {
-                "args": {
-                    "hash": "sha256-Mkl6C1LxF3RYLwYbxiSfoQPt8QKFwQWj/Ati2sNJ32E=",
-                    "rev": "f4f4387b6bf2387efbcfd1453af4892e8982faf6",
-                    "url": "https://chromium.googlesource.com/aosp/platform/system/core/libsync.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libunwind/src": {
-                "args": {
-                    "hash": "sha256-veSxr/ICnBsdP+3vWjCbPxduHiEzbT0DUdwfo0xcM30=",
-                    "rev": "322be580a5a193a921c349a15747eeeb9a716ad1",
-                    "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libunwind.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libva-fake-driver/src": {
-                "args": {
-                    "hash": "sha256-em/8rNqwv6szlxyji7mnYr3nObSW/x3OzEEnkiLuqpI=",
-                    "rev": "a9bcab9cd6b15d4e3634ca44d5e5f7652c612194",
-                    "url": "https://chromium.googlesource.com/chromiumos/platform/libva-fake-driver.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libvpx/source/libvpx": {
-                "args": {
-                    "hash": "sha256-44k28SJ7AbcABv1YV1tICtJ1II4AXTuvcAELSTUht6c=",
-                    "rev": "8d00aca60b951444582b1373e4e47f0ca6e0871c",
-                    "url": "https://chromium.googlesource.com/webm/libvpx.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libwebm/source": {
-                "args": {
-                    "hash": "sha256-SxDGt7nPVkSxwRF/lMmcch1h+C2Dyh6GZUXoZjnXWb4=",
-                    "rev": "f2a982d748b80586ae53b89a2e6ebbc305848b8c",
-                    "url": "https://chromium.googlesource.com/webm/libwebm.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libwebp/src": {
-                "args": {
-                    "hash": "sha256-yKVLUxzIK5ybYM/22fVaQlqSCG5Hx4Notxj+3kI2LCg=",
-                    "rev": "b0e8039062eedbcb20ebb1bad62bfeaee2b94ec6",
-                    "url": "https://chromium.googlesource.com/webm/libwebp.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/libyuv": {
-                "args": {
-                    "hash": "sha256-8sxr0TMQaCzBqQ39FADqWTATcmQlL6TOV3nFM/YySyY=",
-                    "rev": "94417b9d213364905ce849c25719b819b8dbbaaa",
-                    "url": "https://chromium.googlesource.com/libyuv/libyuv.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/llvm-libc/src": {
-                "args": {
-                    "hash": "sha256-U/ToyQwIzZlaPic6LAnR17ySrZ6eGhReJ6iKVFrIHPg=",
-                    "rev": "0c61a55402c6a0d9d6ca2aeb3c6a2613a8bc8c55",
-                    "url": "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/lss": {
-                "args": {
-                    "hash": "sha256-rhp4EcZYdgSfu9cqn+zxxGx6v2IW8uX8V+iA0UfZhFY=",
-                    "rev": "ed31caa60f20a4f6569883b2d752ef7522de51e0",
-                    "url": "https://chromium.googlesource.com/linux-syscall-support.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/material_color_utilities/src": {
-                "args": {
-                    "hash": "sha256-Y85XU+z9W6tvmDNHJ/dXQnUKXvvDkO3nH/kUJRLqbc4=",
-                    "rev": "13434b50dcb64a482cc91191f8cf6151d90f5465",
-                    "url": "https://chromium.googlesource.com/external/github.com/material-foundation/material-color-utilities.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/minigbm/src": {
-                "args": {
-                    "hash": "sha256-9HwvjTETerbQ7YKXH9kUB2eWa8PxGWMAJfx1jAluhrs=",
-                    "rev": "3018207f4d89395cc271278fb9a6558b660885f5",
-                    "url": "https://chromium.googlesource.com/chromiumos/platform/minigbm.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/nan": {
-                "args": {
-                    "hash": "sha256-cwti+BWmF/l/dqa/cN0C587EK4WwRWcWy6gjFVkaMTg=",
-                    "owner": "nodejs",
-                    "repo": "nan",
-                    "rev": "e14bdcd1f72d62bca1d541b66da43130384ec213"
-                },
-                "fetcher": "fetchFromGitHub"
-            },
-            "src/third_party/nasm": {
-                "args": {
-                    "hash": "sha256-TxzAcp+CoKnnM0lCGjm+L3h6M30vYHjM07vW6zUe/vY=",
-                    "rev": "e2c93c34982b286b27ce8b56dd7159e0b90869a2",
-                    "url": "https://chromium.googlesource.com/chromium/deps/nasm.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/nearby/src": {
-                "args": {
-                    "hash": "sha256-Mwuo2RlKweqZPkDw4OcJDD+QNRiXVysSyzLdjHsG1mA=",
-                    "rev": "0bad8b0c9877f92eeeb550654f1ea51a71a085e4",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/nearby-connections.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/neon_2_sse/src": {
-                "args": {
-                    "hash": "sha256-AkDAHOPO5NdXXk0hETS5D67mzw0RVXwPDDKqM0XXo5g=",
-                    "rev": "eb8b80b28f956275e291ea04a7beb5ed8289e872",
-                    "url": "https://chromium.googlesource.com/external/github.com/intel/ARM_NEON_2_x86_SSE.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/oak/src": {
-                "args": {
-                    "hash": "sha256-+ouwII+i5CbWoJ3NAxQPmczofzkPwtZTtjIPaXyyXt8=",
-                    "rev": "96c00a6c99ac382f3f3a8f376bc7a70890d1adaa",
-                    "url": "https://chromium.googlesource.com/external/github.com/project-oak/oak.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/openh264/src": {
-                "args": {
-                    "hash": "sha256-tf0lnxATCkoq+xRti6gK6J47HwioAYWnpEsLGSA5Xdg=",
-                    "rev": "652bdb7719f30b52b08e506645a7322ff1b2cc6f",
-                    "url": "https://chromium.googlesource.com/external/github.com/cisco/openh264"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/openscreen/src": {
-                "args": {
-                    "hash": "sha256-gg9PtdIuCN3eQJhutbBz411zIsyCpagb5BARGdCWLMA=",
-                    "rev": "4654d7968ac1a1e825a84bd4d85acadd7993c49a",
-                    "url": "https://chromium.googlesource.com/openscreen"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/openscreen/src/buildtools": {
-                "args": {
-                    "hash": "sha256-WnbgaCzZ/BJli6M60kP9e4mVPFDx0yu3eCac5wmQ7iM=",
-                    "rev": "077a66f30fcf281b066fafb6dfc60818c238efb6",
-                    "url": "https://chromium.googlesource.com/chromium/src/buildtools"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/openscreen/src/third_party/tinycbor/src": {
-                "args": {
-                    "hash": "sha256-fMKBFUSKmODQyg4hKIa1hwnEKIV6WBbY1Gb8DOSnaHA=",
-                    "rev": "d393c16f3eb30d0c47e6f9d92db62272f0ec4dc7",
-                    "url": "https://chromium.googlesource.com/external/github.com/intel/tinycbor.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/ots/src": {
-                "args": {
-                    "hash": "sha256-kiUXrXsaGOzPkKh0dVmU1I13WHt0Stzj7QLMqHN9FbU=",
-                    "rev": "46bea9879127d0ff1c6601b078e2ce98e83fcd33",
-                    "url": "https://chromium.googlesource.com/external/github.com/khaledhosny/ots.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/pdfium": {
-                "args": {
-                    "hash": "sha256-tZXu+3w+CplXbP8TgRetyl1Q2gacAqWtP9uJ6XZchHk=",
-                    "rev": "e95c6ead2f97716c98526ec42d5fd9ebb50e6e23",
-                    "url": "https://pdfium.googlesource.com/pdfium.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/perfetto": {
-                "args": {
-                    "hash": "sha256-FfOCX3Z7aKGkMAf8hK5itt7+8N5kBRd9NJGjOLiUjQs=",
-                    "rev": "d5bbee7afdf259af4212929ccbff467dd5349953",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/protobuf-javascript/src": {
-                "args": {
-                    "hash": "sha256-1o6N9+1wsQSu1B4w5LlGlwzIUmuPCIYHPqwOyt234ZM=",
-                    "rev": "e6d763860001ba1a76a63adcff5efb12b1c96024",
-                    "url": "https://chromium.googlesource.com/external/github.com/protocolbuffers/protobuf-javascript"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/pthreadpool/src": {
-                "args": {
-                    "hash": "sha256-M9uMq/ZkvrWNep+CIFzx6xLfepLkfY8tjgL7ed2vjU0=",
-                    "rev": "f5a07eddbf4be8f23e29e60a2ccf66b78b71f119",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/pthreadpool.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/pyelftools": {
-                "args": {
-                    "hash": "sha256-I/7p3IEvfP/gkes4kx18PvWwhAKilQKb67GXoW4zFB4=",
-                    "rev": "19b3e610c86fcadb837d252c794cb5e8008826ae",
-                    "url": "https://chromium.googlesource.com/chromiumos/third_party/pyelftools.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/pywebsocket3/src": {
-                "args": {
-                    "hash": "sha256-WEqqu2/7fLqcf/2/IcD7/FewRSZ6jTgVlVBvnihthYQ=",
-                    "rev": "50602a14f1b6da17e0b619833a13addc6ea78bc2",
-                    "url": "https://chromium.googlesource.com/external/github.com/GoogleChromeLabs/pywebsocket3.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/quic_trace/src": {
-                "args": {
-                    "hash": "sha256-vbXqddDgwqetU0bDYn3qo7OBqT5eG926/MbA1hKkCT0=",
-                    "rev": "ed3deb8a056b260c59f2fd42af6dfa3db48a8cad",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/quic-trace.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/re2/src": {
-                "args": {
-                    "hash": "sha256-YXYRgSWUrX+tkaMiRpaCFrrP3vyhzGIP9ApsxWX08VQ=",
-                    "rev": "cd7b2823a8375371f7efe6dae17837c9ab407693",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/re2.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/readability/src": {
-                "args": {
-                    "hash": "sha256-liNoIZreSx/RgL5/oSKyzOuqChAgDwTtViNq0KiY0R0=",
-                    "rev": "1f0ec42686c89a4a1c71789849f7ffde349ab197",
-                    "url": "https://chromium.googlesource.com/external/github.com/mozilla/readability.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/ruy/src": {
-                "args": {
-                    "hash": "sha256-fV0El2ZgjxLqstKVN35SL72+diHNK0FkBmG5UwVZFrk=",
-                    "rev": "9940fbf1e0c0863907e77e0600b99bb3e2bc2b9f",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/ruy.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/search_engines_data/resources": {
-                "args": {
-                    "hash": "sha256-WWkOOnOI3ohPuO+M9/x53hyDO11P6E6Z6ZZvKmQEyjI=",
-                    "rev": "94eb2a9a225078cb5f40e82fd890bce387c8121a",
-                    "url": "https://chromium.googlesource.com/external/search_engines_data.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/securemessage/src": {
-                "args": {
-                    "hash": "sha256-GS4ccnuiqxMs/LVYAtvSlVAYFp4a5GoZsxcriTX3k78=",
-                    "rev": "fa07beb12babc3b25e0c5b1f38c16aa8cb6b8f84",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/securemessage.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/skia": {
-                "args": {
-                    "hash": "sha256-7dpaRB/du2Y13BV3K7/Zx6lQwMtgtF17oKPoBtyEc64=",
-                    "rev": "f4ed99d2443962782cf5f8b4dd27179f131e7cbe",
-                    "url": "https://skia.googlesource.com/skia.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/smhasher/src": {
-                "args": {
-                    "hash": "sha256-OgZQwkQcVgRMf62ROGuY+3zQhBoWuUSP4naTmSKdq8s=",
-                    "rev": "0ff96f7835817a27d0487325b6c16033e2992eb5",
-                    "url": "https://chromium.googlesource.com/external/smhasher.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/snappy/src": {
-                "args": {
-                    "hash": "sha256-jUwnjbaqXz7fgI2TPRK7SlUPQUVzcpjp4ZlFbEzwA+o=",
-                    "rev": "32ded457c0b1fe78ceb8397632c416568d6714a0",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/snappy.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/speedometer/main": {
-                "args": {
-                    "hash": "sha256-3TlVewJ9C3MXvlIudzLHshQZOCAmUkMYsZzAazSbMLY=",
-                    "rev": "06449bdc34789a7459393405dd777e02d78a3743",
-                    "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/speedometer/v2.0": {
-                "args": {
-                    "hash": "sha256-p7WUS8gZUaS+LOm7pNmRkwgxjx+V8R6yy7bbaEHaIs4=",
-                    "rev": "732af0dfe867f8815e662ac637357e55f285dbbb",
-                    "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/speedometer/v2.1": {
-                "args": {
-                    "hash": "sha256-0z5tZlz32fYh9I1ALqfLm2WWO8HiRBwt0hcmgKQhaeM=",
-                    "rev": "8bf7946e39e47c875c00767177197aea5727e84a",
-                    "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/speedometer/v3.0": {
-                "args": {
-                    "hash": "sha256-qMQ4naX+4uUu3vtzzinjkhxX9/dNoTwj6vWCu4FdQmU=",
-                    "rev": "8d67f28d0281ac4330f283495b7f48286654ad7d",
-                    "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/speedometer/v3.1": {
-                "args": {
-                    "hash": "sha256-G89mrrgRaANT1vqzhKPQKemHbz56YwR+oku7rlRoCHw=",
-                    "rev": "1386415be8fef2f6b6bbdbe1828872471c5d802a",
-                    "url": "https://chromium.googlesource.com/external/github.com/WebKit/Speedometer.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/spirv-cross/src": {
-                "args": {
-                    "hash": "sha256-H43M9DXfEuyKuvo6rjb5k0KEbYOSFodbPJh8ZKY4PQg=",
-                    "rev": "b8fcf307f1f347089e3c46eb4451d27f32ebc8d3",
-                    "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Cross"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/spirv-headers/src": {
-                "args": {
-                    "hash": "sha256-gewCQvcVRw+qdWPWRlYUMTt/aXrZ7Lea058WyqL5c08=",
-                    "rev": "01e0577914a75a2569c846778c2f93aa8e6feddd",
-                    "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Headers"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/spirv-tools/src": {
-                "args": {
-                    "hash": "sha256-wP/ZjSXXB1NrRVmtaqxoJ+jdHlRNsXg7dRxYp9zfKKc=",
-                    "rev": "d5d5b61e2d5ae9b98ef403b3f3f922711812888a",
-                    "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/SPIRV-Tools"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/sqlite/src": {
-                "args": {
-                    "hash": "sha256-13HMEpzzcFx/UKqt4V68619R+0j4B/GOl6NYlhpBk0c=",
-                    "rev": "7d348fc79216a09b864ff881d8561a6222301666",
-                    "url": "https://chromium.googlesource.com/chromium/deps/sqlite.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/squirrel.mac": {
-                "args": {
-                    "hash": "sha256-4GfKQg0u3c9GI+jl3ixESNqWXQJKRMi+00QT0s2Shqw=",
-                    "owner": "Squirrel",
-                    "repo": "Squirrel.Mac",
-                    "rev": "0e5d146ba13101a1302d59ea6e6e0b3cace4ae38"
-                },
-                "fetcher": "fetchFromGitHub"
-            },
-            "src/third_party/squirrel.mac/vendor/Mantle": {
-                "args": {
-                    "hash": "sha256-ogFkMJybf2Ue606ojXJu6Gy5aXSi1bSKm60qcTAIaPk=",
-                    "owner": "Mantle",
-                    "repo": "Mantle",
-                    "rev": "78d3966b3c331292ea29ec38661b25df0a245948"
-                },
-                "fetcher": "fetchFromGitHub"
-            },
-            "src/third_party/squirrel.mac/vendor/ReactiveObjC": {
-                "args": {
-                    "hash": "sha256-/MCqC1oFe3N9TsmfVLgl+deR6qHU6ZFQQjudb9zB5Mo=",
-                    "owner": "ReactiveCocoa",
-                    "repo": "ReactiveObjC",
-                    "rev": "74ab5baccc6f7202c8ac69a8d1e152c29dc1ea76"
-                },
-                "fetcher": "fetchFromGitHub"
-            },
-            "src/third_party/swiftshader": {
-                "args": {
-                    "hash": "sha256-raNaqoF6CYdBowrQOGRZk6vDdpr/2xAXR2+RaDF0ypk=",
-                    "rev": "5f1c459a11bb4899301e89609cbf7547f9f31e20",
-                    "url": "https://swiftshader.googlesource.com/SwiftShader.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/text-fragments-polyfill/src": {
-                "args": {
-                    "hash": "sha256-4rW2u1cQAF4iPWHAt1FvVXIpz2pmI901rEPks/w/iFA=",
-                    "rev": "c036420683f672d685e27415de0a5f5e85bdc23f",
-                    "url": "https://chromium.googlesource.com/external/github.com/GoogleChromeLabs/text-fragments-polyfill.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/tflite/src": {
-                "args": {
-                    "hash": "sha256-9RWrxIDA2vvobr9Cg13SkwfScw+Lk/NCeaPVIXTCKmY=",
-                    "rev": "313f58ae85278ced9ccc7f90ee630bdf8735c52f",
-                    "url": "https://chromium.googlesource.com/external/github.com/tensorflow/tensorflow.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/ukey2/src": {
-                "args": {
-                    "hash": "sha256-aaLs6ZS+CdBlCJ6ZhsmdAPFxiBIij6oufsDcNeRSV1E=",
-                    "rev": "0275885d8e6038c39b8a8ca55e75d1d4d1727f47",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/ukey2.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/vulkan-deps": {
-                "args": {
-                    "hash": "sha256-zziYZlVaxG5UQPm/SlodT85f+pAoGwuAO9FKnkSN53E=",
-                    "rev": "02470a3c2773a9fa236c7e8dacd72deb4b5131e3",
-                    "url": "https://chromium.googlesource.com/vulkan-deps"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/vulkan-headers/src": {
-                "args": {
-                    "hash": "sha256-Sg/zp6UhRC5wqBS3vdfs0sQL8cBgLiwvfG0oY0v9MWU=",
-                    "rev": "a4f8ada9f4f97c45b8c89c57997be9cebaae65d2",
-                    "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Headers"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/vulkan-loader/src": {
-                "args": {
-                    "hash": "sha256-3BBltVh3M9OnBk1uf+xpaaJaaF9QP9DHeX7tu6ET05Y=",
-                    "rev": "f703f919c30c5b67958d35d40a4297cb3823ed78",
-                    "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Loader"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/vulkan-tools/src": {
-                "args": {
-                    "hash": "sha256-E8VEn0s/ZuIIx4sH9ItLx+3+FOPi8gbQ0Ht7iIyYBUU=",
-                    "rev": "d643b80d6ba8c191bc289fdda52867c3bb3c190b",
-                    "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Tools"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/vulkan-utility-libraries/src": {
-                "args": {
-                    "hash": "sha256-qcCATZWM0YJ02Dl5VxjvbFYoE2b0r7Ku+ELr2is2VIg=",
-                    "rev": "4322db5906e67b57ec9c327e6afe3d98ed893df7",
-                    "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-Utility-Libraries"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/vulkan-validation-layers/src": {
-                "args": {
-                    "hash": "sha256-ugV2Gwgrerbqbtc5SgKN5wm4eT4JbXRCiryu1bLGR+M=",
-                    "rev": "83d96b88de7b85c3f29545170857e54e348421b2",
-                    "url": "https://chromium.googlesource.com/external/github.com/KhronosGroup/Vulkan-ValidationLayers"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/vulkan_memory_allocator": {
-                "args": {
-                    "hash": "sha256-yBCs3zfqs/60htsZAOscjcyKhVbAWE6znweuXcs1oKo=",
-                    "rev": "cb0597213b0fcb999caa9ed08c2f88dc45eb7d50",
-                    "url": "https://chromium.googlesource.com/external/github.com/GPUOpen-LibrariesAndSDKs/VulkanMemoryAllocator.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/wayland-protocols/gtk": {
-                "args": {
-                    "hash": "sha256-75XNnLkF5Lt1LMRGT+T61k0/mLa3kkynfN+QWvZ0LiQ=",
-                    "rev": "40ebed3a03aef096addc0af09fec4ec529d882a0",
-                    "url": "https://chromium.googlesource.com/external/github.com/GNOME/gtk.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/wayland-protocols/kde": {
-                "args": {
-                    "hash": "sha256-Dmcp/2ms/k7NxPPmPkp0YNfM9z2Es1ZO0uX10bc7N2Y=",
-                    "rev": "0b07950714b3a36c9b9f71fc025fc7783e82926e",
-                    "url": "https://chromium.googlesource.com/external/github.com/KDE/plasma-wayland-protocols.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/wayland-protocols/src": {
-                "args": {
-                    "hash": "sha256-tdpEK7soY0aKSk6VD4nulH7ORubX8RfjXYmNAd/cWKY=",
-                    "rev": "efbc060534be948b63e1f395d69b583eebba3235",
-                    "url": "https://chromium.googlesource.com/external/anongit.freedesktop.org/git/wayland/wayland-protocols.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/wayland/src": {
-                "args": {
-                    "hash": "sha256-oK0Z8xO2ILuySGZS0m37ZF0MOyle2l8AXb0/6wai0/w=",
-                    "rev": "a156431ea66fe67d69c9fbba8a8ad34dabbab81c",
-                    "url": "https://chromium.googlesource.com/external/anongit.freedesktop.org/git/wayland/wayland.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/webdriver/pylib": {
-                "args": {
-                    "hash": "sha256-k5qx4xyO83jPtHaMh6aMigMJ3hsytFdFQOcZLmwPEYo=",
-                    "rev": "1e954903022e9386b9acf452c24f4458dd4c4fc1",
-                    "url": "https://chromium.googlesource.com/external/github.com/SeleniumHQ/selenium/py.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/webgl/src": {
-                "args": {
-                    "hash": "sha256-mSketnpcDtz3NnhPkXMpMpq8MWcFiSviJbK6h06fcnw=",
-                    "rev": "c01b768bce4a143e152c1870b6ba99ea6267d2b0",
-                    "url": "https://chromium.googlesource.com/external/khronosgroup/webgl.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/webgpu-cts/src": {
-                "args": {
-                    "hash": "sha256-L3DuBVH7x1vxpDp/wrykcyPCjVLJr4ox4gEl76f320A=",
-                    "rev": "b62c3fc76c9c644a8597399b0d23f7032cabb366",
-                    "url": "https://chromium.googlesource.com/external/github.com/gpuweb/cts.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/webpagereplay": {
-                "args": {
-                    "hash": "sha256-W/f+vYNC9xiCPVvHezlVPFAze77OTCMMj7PgNN5ixaw=",
-                    "rev": "9057e5d942f2bfcee71cc20415a7f86c966241f8",
-                    "url": "https://chromium.googlesource.com/webpagereplay.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/webrtc": {
-                "args": {
-                    "hash": "sha256-kVzks2ncpgd+aQ7JT2pAV/WJXxFIE7Es5Yzd/XGgm4w=",
-                    "rev": "29d6eabaf0b5c1a62af6e7fd03adebf5e1a446e8",
-                    "url": "https://webrtc.googlesource.com/src.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/weston/src": {
-                "args": {
-                    "hash": "sha256-o49a3sp+D9FycxeB+uMcKouVvlKWoWpfws7FLEGJ/V8=",
-                    "rev": "bdba2f9adaca673fd58339d8140bc04727ee279d",
-                    "url": "https://chromium.googlesource.com/external/anongit.freedesktop.org/git/wayland/weston.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/wuffs/src": {
-                "args": {
-                    "hash": "sha256-373d2F/STcgCHEq+PO+SCHrKVOo6uO1rqqwRN5eeBCw=",
-                    "rev": "e3f919ccfe3ef542cfc983a82146070258fb57f8",
-                    "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/xdg-utils": {
-                "args": {
-                    "hash": "sha256-WuQ9uDq+QD17Y20ACFGres4nbkeOiTE2y+tY1avAT5U=",
-                    "rev": "cb54d9db2e535ee4ef13cc91b65a1e2741a94a44",
-                    "url": "https://chromium.googlesource.com/chromium/deps/xdg-utils.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/xnnpack/src": {
-                "args": {
-                    "hash": "sha256-oxpMzIFwJ3L5cYLkwcSL7a8XS1AGHXKQjwtHoe/2mZw=",
-                    "rev": "4d098efeac50c44a7c03e6feb1794908db4c3158",
-                    "url": "https://chromium.googlesource.com/external/github.com/google/XNNPACK.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/third_party/zstd/src": {
-                "args": {
-                    "hash": "sha256-xFObjxA4LKOnCugxaYek3cU4ld3JwLj5jFoRJ20hje4=",
-                    "rev": "89d685e42dbcf815a16ed0fcd7d050ef74ccad96",
-                    "url": "https://chromium.googlesource.com/external/github.com/facebook/zstd.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            },
-            "src/v8": {
-                "args": {
-                    "hash": "sha256-FNEyH9sT59A0SFRloRMbK1YOy/slwtAz2/+T4mlCdWs=",
-                    "rev": "8fa4e7c7469cd4d321e2241b86f684d52197a615",
-                    "url": "https://chromium.googlesource.com/v8/v8.git"
-                },
-                "fetcher": "fetchFromGitiles"
-            }
-        },
-        "electron_yarn_data": {
-            "hash": "sha256-ZaVee6smW2Gf4tkC1xTTl4a4fBDXaeT7Mtt7del6l8o="
-        },
-        "modules": "140",
-        "node": "22.22.1",
-        "version": "39.8.10"
-    },
     "40": {
         "chrome": "144.0.7559.236",
         "chromium": {
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index dfa56dfa88b4..94d9832346d3 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -6112,10 +6112,7 @@ with pkgs;
       {
         electron_37 = electron_37-bin;
         electron_38 = electron_38-bin;
-        electron_39 = getElectronPkg {
-          src = electron-source.electron_39;
-          bin = electron_39-bin;
-        };
+        electron_39 = electron_39-bin;
         electron_40 = getElectronPkg {
           src = electron-source.electron_40;
           bin = electron_40-bin;

From 7632d65175381c1a4567ece03a94a3be13841e9a Mon Sep 17 00:00:00 2001
From: teutat3s <10206665+teutat3s@users.noreply.github.com>
Date: Sun, 17 May 2026 19:20:11 +0200
Subject: [PATCH 46/51] electron_39-bin: mark as insecure

(cherry picked from commit 4e2f3b4904cb4f51b86405b3daff33a53f485ca3)
---
 pkgs/development/tools/electron/binary/generic.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/tools/electron/binary/generic.nix b/pkgs/development/tools/electron/binary/generic.nix
index e6fc47a1a780..5354a52e63a3 100644
--- a/pkgs/development/tools/electron/binary/generic.nix
+++ b/pkgs/development/tools/electron/binary/generic.nix
@@ -54,7 +54,7 @@ let
     ];
     sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
     # https://www.electronjs.org/docs/latest/tutorial/electron-timelines
-    knownVulnerabilities = lib.optional (lib.versionOlder version "39.0.0") "Electron version ${version} is EOL";
+    knownVulnerabilities = lib.optional (lib.versionOlder version "40.0.0") "Electron version ${version} is EOL";
   };
 
   fetcher =

From 7ec241eecfe990ffa5ea3afab49b14989ab3850c Mon Sep 17 00:00:00 2001
From: yaya <github@uwu.is>
Date: Thu, 28 May 2026 13:02:21 +0200
Subject: [PATCH 47/51] gitlab: 18.11.3 -> 18.11.4

https://gitlab.com/gitlab-org/gitlab/-/blob/v18.11.4-ee/CHANGELOG.md
(cherry picked from commit cec4baa1d74f371e7c0b7a9f150d3d3a8e75c3a6)
---
 pkgs/by-name/gi/gitaly/package.nix             |  6 +++---
 .../gitlab-elasticsearch-indexer/package.nix   |  6 +++---
 pkgs/by-name/gi/gitlab-pages/package.nix       |  4 ++--
 pkgs/by-name/gi/gitlab-shell/package.nix       |  6 +++---
 pkgs/by-name/gi/gitlab/data.json               | 18 +++++++++---------
 .../gi/gitlab/gitlab-workhorse/default.nix     |  2 +-
 pkgs/by-name/gi/gitlab/rubyEnv/Gemfile         |  3 +++
 pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock    |  2 ++
 pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix      | 10 ++++++++++
 9 files changed, 36 insertions(+), 21 deletions(-)

diff --git a/pkgs/by-name/gi/gitaly/package.nix b/pkgs/by-name/gi/gitaly/package.nix
index 1edeea3f7662..b046c246b31f 100644
--- a/pkgs/by-name/gi/gitaly/package.nix
+++ b/pkgs/by-name/gi/gitaly/package.nix
@@ -7,7 +7,7 @@
 }:
 
 let
-  version = "18.11.3";
+  version = "18.11.4";
   package_version = "v${lib.versions.major version}";
   gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";
 
@@ -21,10 +21,10 @@ let
       owner = "gitlab-org";
       repo = "gitaly";
       rev = "v${version}";
-      hash = "sha256-oFQevVXbxu9G4LF3BrC0EUUviypSwB4cKRjipdiO3jU=";
+      hash = "sha256-YQpNsSCjcMC1tpwLVN0fCB9T3vBFxp0TyrvxzJfTnFg=";
     };
 
-    vendorHash = "sha256-123WUtoUaPIyDywcTKEhiZP2SYYHxAQoOPyCebsHYRI=";
+    vendorHash = "sha256-/RJnCcmUoqGy08MSGEVM/taV1qZK65kiZw19n6S3ZQ0=";
 
     ldflags = [
       "-X ${gitaly_package}/internal/version.version=${version}"
diff --git a/pkgs/by-name/gi/gitlab-elasticsearch-indexer/package.nix b/pkgs/by-name/gi/gitlab-elasticsearch-indexer/package.nix
index 521cd63c003d..0f4dfc132367 100644
--- a/pkgs/by-name/gi/gitlab-elasticsearch-indexer/package.nix
+++ b/pkgs/by-name/gi/gitlab-elasticsearch-indexer/package.nix
@@ -11,17 +11,17 @@ let
 in
 buildGoModule (finalAttrs: {
   pname = "gitlab-elasticsearch-indexer";
-  version = "5.14.1";
+  version = "5.14.7";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-elasticsearch-indexer";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-yYl2cSPY5hn1GSda5ioMD3rEectNMtYGstVpz73pi3Y=";
+    hash = "sha256-1fVBCem23X8u1NQ6ph37EiXRvMpzF/8Yac+VefAe9Yg=";
   };
 
-  vendorHash = "sha256-yeVEQEXHGAkdkfcnjok8iOvVRxucObVAxhuACmyFDJw=";
+  vendorHash = "sha256-cUHXrUd+pSMiS6iSwKKA+o1B6ZHbaQYHYPeVk1Y6wYM=";
 
   buildInputs = [ icu ];
   nativeBuildInputs = [ pkg-config ];
diff --git a/pkgs/by-name/gi/gitlab-pages/package.nix b/pkgs/by-name/gi/gitlab-pages/package.nix
index 37f07212cec5..e4e6cce3ddf7 100644
--- a/pkgs/by-name/gi/gitlab-pages/package.nix
+++ b/pkgs/by-name/gi/gitlab-pages/package.nix
@@ -6,14 +6,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "gitlab-pages";
-  version = "18.11.3";
+  version = "18.11.4";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-pages";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-ozkrU3QF/LK0uqfF52dnm2MCga+vRD8dGsLNnze6E+Y=";
+    hash = "sha256-tE2PHWk12S482TjNhI0u7Afm0mPAgJWqcJiU5dgqN60=";
   };
 
   vendorHash = "sha256-PUW4cgAiM1GTtvja894OZ4pe0SWChf5JsL4/fkns2kI=";
diff --git a/pkgs/by-name/gi/gitlab-shell/package.nix b/pkgs/by-name/gi/gitlab-shell/package.nix
index db0386899d74..eab9023fe3f8 100644
--- a/pkgs/by-name/gi/gitlab-shell/package.nix
+++ b/pkgs/by-name/gi/gitlab-shell/package.nix
@@ -8,14 +8,14 @@
 
 buildGoModule (finalAttrs: {
   pname = "gitlab-shell";
-  version = "14.49.0";
+  version = "14.50.0";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
     owner = "gitlab-org";
     repo = "gitlab-shell";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-8PnFRwP5vctnOh6t45crxkoVF6Z03bfYry24KfFHCww=";
+    hash = "sha256-a9s+TCm5yKPjNh+BD9fm6iVA4H9KJiMyWNulY+7BKZo=";
   };
 
   buildInputs = [
@@ -27,7 +27,7 @@ buildGoModule (finalAttrs: {
     ./remove-hardcoded-locations.patch
   ];
 
-  vendorHash = "sha256-JBKU134/Yyz49HWfU9Dw/EC4bI/o3Hs56Ou7wtzp5qM=";
+  vendorHash = "sha256-ceSnQQTtGdLb0QGR9fDbGC0NtRPGqkyXJ6b0TRXkjQM=";
 
   subPackages = [
     "cmd/gitlab-shell"
diff --git a/pkgs/by-name/gi/gitlab/data.json b/pkgs/by-name/gi/gitlab/data.json
index 3472cc5bcb94..8eb34219cfc9 100644
--- a/pkgs/by-name/gi/gitlab/data.json
+++ b/pkgs/by-name/gi/gitlab/data.json
@@ -1,17 +1,17 @@
 {
-  "version": "18.11.3",
-  "repo_hash": "sha256-QxaLdWErE+b4SpwHtxnCa2tqheWUfEixRcQwYD/A9s8=",
+  "version": "18.11.4",
+  "repo_hash": "sha256-ThtRXdUreorOIea5Izd+zKb88cC4nhitkzqT+Yf5UtU=",
   "yarn_hash": "sha256-k8JHi0f/XfSV4kICyPW01Erk3YnKw33yeUWYrOaPdTM=",
   "frontend_islands_yarn_hash": "sha256-EvGQin+5DqqIgM36jlVkVI49WcJzVvceYnkSS9ybfcY=",
   "owner": "gitlab-org",
   "repo": "gitlab",
-  "rev": "v18.11.3-ee",
+  "rev": "v18.11.4-ee",
   "passthru": {
-    "GITALY_SERVER_VERSION": "18.11.3",
-    "GITLAB_KAS_VERSION": "18.11.3",
-    "GITLAB_PAGES_VERSION": "18.11.3",
-    "GITLAB_SHELL_VERSION": "14.49.0",
-    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.14.1",
-    "GITLAB_WORKHORSE_VERSION": "18.11.3"
+    "GITALY_SERVER_VERSION": "18.11.4",
+    "GITLAB_KAS_VERSION": "18.11.4",
+    "GITLAB_PAGES_VERSION": "18.11.4",
+    "GITLAB_SHELL_VERSION": "14.50.0",
+    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.14.7",
+    "GITLAB_WORKHORSE_VERSION": "18.11.4"
   }
 }
diff --git a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
index 786e922b88f2..225ca96ae836 100644
--- a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
@@ -10,7 +10,7 @@ in
 buildGoModule rec {
   pname = "gitlab-workhorse";
 
-  version = "18.11.3";
+  version = "18.11.4";
 
   # nixpkgs-update: no auto update
   src = fetchFromGitLab {
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
index 705e6ba9ffe6..51ab15115117 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
@@ -765,3 +765,6 @@ gem "gitlab-cloud-connector", "~> 1.45", require: 'gitlab/cloud_connector', feat
 gem "gvltools", "~> 0.4.0", feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 
 gem 'gitlab_query_language', '~> 0.26.0', feature_category: :integrations
+
+# standard Gem, version increase to resolve vulnerabilities
+gem "zlib", "~> 3.2", ">= 3.2.3", feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/work_items/596593
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
index 28e0d494d85c..f3e631d33ddb 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
@@ -2174,6 +2174,7 @@ GEM
     yard-solargraph (0.1.0)
       yard (~> 0.9)
     zeitwerk (2.6.18)
+    zlib (3.2.3)
 
 PLATFORMS
   ruby
@@ -2553,6 +2554,7 @@ DEPENDENCIES
   yajl-ruby (~> 1.4.3)
   yard (~> 0.9)
   zeitwerk (= 2.6.18)
+  zlib (~> 3.2, >= 3.2.3)
 
 BUNDLED WITH
    2.7.1
diff --git a/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix b/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
index d800df27924b..c1e273bbf27b 100644
--- a/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
@@ -10473,4 +10473,14 @@ src: {
     };
     version = "2.6.18";
   };
+  zlib = {
+    groups = [ "default" ];
+    platforms = [ ];
+    source = {
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "084w64p55s3l2rmbs6x84qbclhi451n8n2limdj1mwrjidlidlsv";
+      type = "gem";
+    };
+    version = "3.2.3";
+  };
 }

From 14c799ab6137a75bc6451e808a4a14639ea51159 Mon Sep 17 00:00:00 2001
From: emilylange <git@emilylange.de>
Date: Thu, 28 May 2026 16:13:26 +0200
Subject: [PATCH 48/51] chromium,chromedriver: 148.0.7778.178 -> 148.0.7778.216

https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html
(cherry picked from commit ffc6db2fe636876d807219623773c13eeac522eb)
---
 .../networking/browsers/chromium/info.json    | 52 +++++++++----------
 1 file changed, 26 insertions(+), 26 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index df0ff8f96188..80ae82050867 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -1,10 +1,10 @@
 {
   "chromium": {
-    "version": "148.0.7778.178",
+    "version": "148.0.7778.215",
     "chromedriver": {
-      "version": "148.0.7778.179",
-      "hash_darwin": "sha256-jDw+ON0X8rePW1HLBZ5FVKMibImBuW/Tp0EDZ/UjJlw=",
-      "hash_darwin_aarch64": "sha256-hNaaKMVy8sKNU444Uf78YI3ayUATrTBAr6/7Z3jewv0="
+      "version": "148.0.7778.216",
+      "hash_darwin": "sha256-gsK7Q3rwfQQ0iE5e/st/3gGtU+D8dGsTycffpEejmhw=",
+      "hash_darwin_aarch64": "sha256-zHASbRPnYf2q1qq8FsKnYrLwPjzoGk0tzLxB9SdTXFw="
     },
     "deps": {
       "depot_tools": {
@@ -21,8 +21,8 @@
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "d096af1c9e98c45c3596e59620622b1a049bfecb",
-        "hash": "sha256-XRalekzeALnDh9KiGqhYdhXvkGkjO3TOIZeqwpPLO+U=",
+        "rev": "7c855c70efe3f6ade6663c1520913fa7f63a0b2b",
+        "hash": "sha256-uDVYgSjxQ+xw8DHVd5UNkqnUrJ6P5ZWxL2tZToBhgQg=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -92,8 +92,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "50fd896fb21cca91f325812d01d1e971593efc73",
-        "hash": "sha256-HcfKm7UQmg3wMDOytmaYzm7Z7gRdOrRoqAKaE0ZdI4E="
+        "rev": "a101e2d1db6da927325273566fe8f5404fa3a9bd",
+        "hash": "sha256-uIqodvHxEY9xNse2IHNns2Mz9zLAUZSSIN7pAXB8cPs="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -132,8 +132,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "19696dd088b8ed5804e2f02a8f83f5afdb3e99e3",
-        "hash": "sha256-ihnVPCk9412UzCmoABWVUhiGaIdIYxiYMkk43KDqpg8="
+        "rev": "78a9030d63048d832c4b822839bffe38ad4f20e5",
+        "hash": "sha256-ZknkLN64TYAN5j9WsgtKlRBrAc3iCM084zpc8Zui8Ts="
       },
       "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -267,8 +267,8 @@
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "6efd6eb1d85fd67fdcc2385c54fa56c524bec3f7",
-        "hash": "sha256-1pr3+RK519m+wtcacJB3PcDTL+qSHlOn1ctxpoLzTf8="
+        "rev": "1fb83ff123c44ab59a480056c8c1ba3d33c2caf0",
+        "hash": "sha256-S6agM7HMZ2g2W6e9tYdLSXr0Lc6zeQF9hAYLIeImAYQ="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -332,8 +332,8 @@
       },
       "src/third_party/freetype/src": {
         "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git",
-        "rev": "99b479dc34728936b006679a31e12b8cf432fc55",
-        "hash": "sha256-H5RzBFYWIp/QYKyeBM2wfuX7FvXHPbhCAp7qne5Zvhw="
+        "rev": "6d9fc45fc4bca8aef0b8f65592520673638c3334",
+        "hash": "sha256-A21ONLz8HxoBkOL/jHfs5YwePmOnFyNdlNYSJa9wers="
       },
       "src/third_party/fxdiv/src": {
         "url": "https://chromium.googlesource.com/external/github.com/Maratyszcza/FXdiv.git",
@@ -342,8 +342,8 @@
       },
       "src/third_party/harfbuzz/src": {
         "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git",
-        "rev": "f027b8e9039f73bf803eae684fee2eb2d30e4180",
-        "hash": "sha256-HWb3QbPl+RE2oI/Jwv5BjKwv9UnJ8VcJvk+uGy9cAqM="
+        "rev": "67bb413f586f36ba44d740319cb7a28b3d283ea6",
+        "hash": "sha256-WCPEkbiiU8dENM+ik0KokW9Uxmz0xlsRFVVPPOEOZXw="
       },
       "src/third_party/ink/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/ink.git",
@@ -432,8 +432,8 @@
       },
       "src/third_party/libaom/source/libaom": {
         "url": "https://aomedia.googlesource.com/aom.git",
-        "rev": "b63f30b6d30028a3d7d9c5223def8f3ad97dcc4c",
-        "hash": "sha256-LaBEcVcSB8WB9ZNRgPSiGaKdQL5f3wll2sPb9OhN5SE="
+        "rev": "343cee0a952f8c7d329e59ff3ac2c8bdbe70ec6a",
+        "hash": "sha256-H8Eu3BiUIiZcyReGDyFq9UvjdMJOX00ERjru8+I0zL8="
       },
       "src/third_party/crabbyavif/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git",
@@ -612,8 +612,8 @@
       },
       "src/third_party/pdfium": {
         "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "a78c62d93a8f514ea2cd98a70bd1d21226be9d93",
-        "hash": "sha256-qd3Oa/JFzoI5hKDY2/OQAzdr2z9srUj0H6oKz0R516U="
+        "rev": "72ea487e4399c44c3a53a48b104f9612ca772008",
+        "hash": "sha256-0VgmDPyF5k81nBXdo88CcIIbz6XRhaiADnG8gwDGZZk="
       },
       "src/third_party/perfetto": {
         "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
@@ -662,8 +662,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "a2888b27a98e4ff30085d4d2dba8a1a99baf6dfb",
-        "hash": "sha256-eOjFuMmXr9YtZ0e4yDB8JMjTrNWEg5OlTkAMGuHZIWE="
+        "rev": "03c3234e64f9fbbbcf6a7b9c79e94059df49dbfe",
+        "hash": "sha256-e0MSCbqv4u4995nowzipKorkn6mPpO7tf8+ygj3/nFY="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -797,8 +797,8 @@
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "9a7f650bcd14f241d20f88f4e1ea3b7300de72ac",
-        "hash": "sha256-k5cHE4XURJQrPURmXk4MMNV5k8+ryKfjmsVTzARRro4="
+        "rev": "e3ee86921c57b9f8921045e77f098604803cb66c",
+        "hash": "sha256-n39HENOXmatsZLF6jdYRsb+wl2cM0i6ngT4Zbyu5ayE="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -822,8 +822,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "ad6e4525c418a92147c8247ef9d144ce4c242a38",
-        "hash": "sha256-+cQdsWTgIohd3yOCsNCprSr4Ctes77fWGdmPxN2tQlM="
+        "rev": "5e24a1fd6ffb840b93ee90a800897fcb4d60eeab",
+        "hash": "sha256-JcBGaXhqNRIA4NPPV4eANVM93wsQ9QxSLO/Ecz3wklU="
       }
     }
   },

From 469854aaeefc072b7005183f7033c498f808dc07 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 28 May 2026 16:34:26 +0000
Subject: [PATCH 49/51] docker: 29.5.1 -> 29.5.2

(cherry picked from commit e5b4a4fa185d517a972f0a0bd195ce30289277ca)
---
 pkgs/applications/virtualization/docker/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/virtualization/docker/default.nix b/pkgs/applications/virtualization/docker/default.nix
index 788ef0c328ce..c4242ca604ab 100644
--- a/pkgs/applications/virtualization/docker/default.nix
+++ b/pkgs/applications/virtualization/docker/default.nix
@@ -434,14 +434,14 @@ in
 
   docker_29 =
     let
-      version = "29.5.1";
+      version = "29.5.2";
     in
     callPackage dockerGen {
       inherit version;
       cliRev = "v${version}";
-      cliHash = "sha256-oobGr0UaeJL800hHx3K0tQs50HZbOn559WcLnSRiRhU=";
+      cliHash = "sha256-kHgDZVr6mAyCtZ6bSG9FWV0GhWDfXLXzHYFrmjFzO9w=";
       mobyRev = "docker-v${version}";
-      mobyHash = "sha256-ghYEOWr5RUDm0YLyupaDSpLd+8gFqxp3VjCt+3lztcA=";
+      mobyHash = "sha256-lux7tTyF6vm5wuIXs+z3Ygd2v4JjgHbRvOXNA4kjNtg=";
       runcRev = "v1.3.5";
       runcHash = "sha256-Swphxbu/OLkUrfRjLMZIVGwYb7AN0xHdyxm0ysAVam0=";
       containerdRev = "v2.2.3";

From cfb61937460b6cd8091a52f6130c91b78fa65bff Mon Sep 17 00:00:00 2001
From: Ryan Omasta <git@ryand.ca>
Date: Thu, 28 May 2026 13:49:59 -0600
Subject: [PATCH 50/51] wireshark{,-cli}: 4.6.5 -> 4.6.6

https://www.wireshark.org/docs/relnotes/wireshark-4.6.6.html
Diff: https://gitlab.com/wireshark/wireshark/-/compare/v4.6.5...v4.6.6
(cherry picked from commit 1c88add0ef81da90c7e773ffb1ddbab4d0493e98)
---
 pkgs/by-name/wi/wireshark/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/wi/wireshark/package.nix b/pkgs/by-name/wi/wireshark/package.nix
index 8d9cd1a9e6b8..90fdcd58816d 100644
--- a/pkgs/by-name/wi/wireshark/package.nix
+++ b/pkgs/by-name/wi/wireshark/package.nix
@@ -59,7 +59,7 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "wireshark-${if withQt then "qt" else "cli"}";
-  version = "4.6.5";
+  version = "4.6.6";
 
   outputs = [
     "out"
@@ -70,7 +70,7 @@ stdenv.mkDerivation (finalAttrs: {
     repo = "wireshark";
     owner = "wireshark";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Zvrwxjp4LK2J3QnxmPxKKrU01YHQvPyp54UWzeGNCjA=";
+    hash = "sha256-ysSfCLnCakxsjLKt+UxzrcPWNXiqdvTlI/1dq56lMfA=";
   };
 
   patches = [

From a7624781771d5b05a0360a4c55471ac4df3b52e6 Mon Sep 17 00:00:00 2001
From: networkException <git@nwex.de>
Date: Fri, 29 May 2026 02:00:11 +0200
Subject: [PATCH 51/51] ungoogled-chromium: 148.0.7778.178-1 ->
 148.0.7778.215-1

https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html

This update includes 151 security fixes.

CVEs:
CVE-2026-9872 CVE-2026-9873 CVE-2026-9874 CVE-2026-9875 CVE-2026-9876
CVE-2026-9877 CVE-2026-9878 CVE-2026-9879 CVE-2026-9880 CVE-2026-9881
CVE-2026-9882 CVE-2026-9883 CVE-2026-9884 CVE-2026-9885 CVE-2026-9886
CVE-2026-9887 CVE-2026-9888 CVE-2026-9889 CVE-2026-9890 CVE-2026-9891
CVE-2026-9892 CVE-2026-9893 CVE-2026-9894 CVE-2026-9895 CVE-2026-9896
CVE-2026-9897 CVE-2026-9898 CVE-2026-9899 CVE-2026-9900 CVE-2026-9901
CVE-2026-9902 CVE-2026-9903 CVE-2026-9904 CVE-2026-9905 CVE-2026-9906
CVE-2026-9907 CVE-2026-9908 CVE-2026-9909 CVE-2026-9910 CVE-2026-9911
CVE-2026-9912 CVE-2026-9913 CVE-2026-9914 CVE-2026-9915 CVE-2026-9916
CVE-2026-9917 CVE-2026-9918 CVE-2026-9919 CVE-2026-9920 CVE-2026-9921
CVE-2026-9922 CVE-2026-9923 CVE-2026-9924 CVE-2026-9925 CVE-2026-9926
CVE-2026-9927 CVE-2026-9928 CVE-2026-9929 CVE-2026-9930 CVE-2026-9931
CVE-2026-9932 CVE-2026-9933 CVE-2026-9934 CVE-2026-9935 CVE-2026-9936
CVE-2026-9937 CVE-2026-9938 CVE-2026-9939 CVE-2026-9940 CVE-2026-9941
CVE-2026-9942 CVE-2026-9943 CVE-2026-9944 CVE-2026-9945 CVE-2026-9946
CVE-2026-9947 CVE-2026-9948 CVE-2026-9949 CVE-2026-9950 CVE-2026-9951
CVE-2026-9952 CVE-2026-9953 CVE-2026-9954 CVE-2026-9955 CVE-2026-9956
CVE-2026-9957 CVE-2026-9958 CVE-2026-9959 CVE-2026-9960 CVE-2026-9961
CVE-2026-9962 CVE-2026-9963 CVE-2026-9964 CVE-2026-9965 CVE-2026-9966
CVE-2026-9967 CVE-2026-9968 CVE-2026-9969 CVE-2026-9970 CVE-2026-9971
CVE-2026-9972 CVE-2026-9973 CVE-2026-9974 CVE-2026-9975 CVE-2026-9976
CVE-2026-9977 CVE-2026-9978 CVE-2026-9979 CVE-2026-9980 CVE-2026-9981
CVE-2026-9982 CVE-2026-9983 CVE-2026-9984 CVE-2026-9985 CVE-2026-9986
CVE-2026-9987 CVE-2026-9988 CVE-2026-9989 CVE-2026-9990 CVE-2026-9991
CVE-2026-9992 CVE-2026-9993 CVE-2026-9994 CVE-2026-9995 CVE-2026-9996
CVE-2026-9997 CVE-2026-9998 CVE-2026-9999 CVE-2026-10000 CVE-2026-10001
CVE-2026-10002 CVE-2026-10003 CVE-2026-10004 CVE-2026-10005
CVE-2026-10006 CVE-2026-10007 CVE-2026-10008 CVE-2026-10009
CVE-2026-10010 CVE-2026-10011 CVE-2026-10012 CVE-2026-10013
CVE-2026-10014 CVE-2026-10015 CVE-2026-10016 CVE-2026-10017
CVE-2026-10018 CVE-2026-10019 CVE-2026-10020 CVE-2026-10021
CVE-2026-10022

(cherry picked from commit 86522e097a4e8c4a31a2be13f3a66727a29e6c43)
---
 .../networking/browsers/chromium/info.json    | 50 +++++++++----------
 1 file changed, 25 insertions(+), 25 deletions(-)

diff --git a/pkgs/applications/networking/browsers/chromium/info.json b/pkgs/applications/networking/browsers/chromium/info.json
index 80ae82050867..c8de6d799966 100644
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -828,7 +828,7 @@
     }
   },
   "ungoogled-chromium": {
-    "version": "148.0.7778.178",
+    "version": "148.0.7778.215",
     "deps": {
       "depot_tools": {
         "rev": "41c40cfaec7ee3bf0423c59925d8b23982a601f1",
@@ -840,16 +840,16 @@
         "hash": "sha256-BTPD8WM1pVAMkFDlHekMdWFGyf63KdhKkKwsqikqoBQ="
       },
       "ungoogled-patches": {
-        "rev": "148.0.7778.178-1",
-        "hash": "sha256-s4zTU4rQUcrfpg7CWFdvEn3JYNqhHGsAFcYmQGS64fc="
+        "rev": "148.0.7778.215-1",
+        "hash": "sha256-Rp+PuyOQ26Cqiu+8sNlJkjp/3bO968NYNX1AgHOyYOA="
       },
       "npmHash": "sha256-JuVcY8iFRDWcPcP4Pg+qm5rnTXkiVfNsqSkXbDWqsE8="
     },
     "DEPS": {
       "src": {
         "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "d096af1c9e98c45c3596e59620622b1a049bfecb",
-        "hash": "sha256-XRalekzeALnDh9KiGqhYdhXvkGkjO3TOIZeqwpPLO+U=",
+        "rev": "7c855c70efe3f6ade6663c1520913fa7f63a0b2b",
+        "hash": "sha256-uDVYgSjxQ+xw8DHVd5UNkqnUrJ6P5ZWxL2tZToBhgQg=",
         "recompress": true
       },
       "src/third_party/clang-format/script": {
@@ -919,8 +919,8 @@
       },
       "src/third_party/angle": {
         "url": "https://chromium.googlesource.com/angle/angle.git",
-        "rev": "50fd896fb21cca91f325812d01d1e971593efc73",
-        "hash": "sha256-HcfKm7UQmg3wMDOytmaYzm7Z7gRdOrRoqAKaE0ZdI4E="
+        "rev": "a101e2d1db6da927325273566fe8f5404fa3a9bd",
+        "hash": "sha256-uIqodvHxEY9xNse2IHNns2Mz9zLAUZSSIN7pAXB8cPs="
       },
       "src/third_party/angle/third_party/glmark2/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glmark2/glmark2",
@@ -959,8 +959,8 @@
       },
       "src/third_party/dawn": {
         "url": "https://dawn.googlesource.com/dawn.git",
-        "rev": "19696dd088b8ed5804e2f02a8f83f5afdb3e99e3",
-        "hash": "sha256-ihnVPCk9412UzCmoABWVUhiGaIdIYxiYMkk43KDqpg8="
+        "rev": "78a9030d63048d832c4b822839bffe38ad4f20e5",
+        "hash": "sha256-ZknkLN64TYAN5j9WsgtKlRBrAc3iCM084zpc8Zui8Ts="
       },
       "src/third_party/dawn/third_party/glfw3/src": {
         "url": "https://chromium.googlesource.com/external/github.com/glfw/glfw",
@@ -1094,8 +1094,8 @@
       },
       "src/third_party/devtools-frontend/src": {
         "url": "https://chromium.googlesource.com/devtools/devtools-frontend",
-        "rev": "6efd6eb1d85fd67fdcc2385c54fa56c524bec3f7",
-        "hash": "sha256-1pr3+RK519m+wtcacJB3PcDTL+qSHlOn1ctxpoLzTf8="
+        "rev": "1fb83ff123c44ab59a480056c8c1ba3d33c2caf0",
+        "hash": "sha256-S6agM7HMZ2g2W6e9tYdLSXr0Lc6zeQF9hAYLIeImAYQ="
       },
       "src/third_party/dom_distiller_js/dist": {
         "url": "https://chromium.googlesource.com/chromium/dom-distiller/dist.git",
@@ -1159,8 +1159,8 @@
       },
       "src/third_party/freetype/src": {
         "url": "https://chromium.googlesource.com/chromium/src/third_party/freetype2.git",
-        "rev": "99b479dc34728936b006679a31e12b8cf432fc55",
-        "hash": "sha256-H5RzBFYWIp/QYKyeBM2wfuX7FvXHPbhCAp7qne5Zvhw="
+        "rev": "6d9fc45fc4bca8aef0b8f65592520673638c3334",
+        "hash": "sha256-A21ONLz8HxoBkOL/jHfs5YwePmOnFyNdlNYSJa9wers="
       },
       "src/third_party/fxdiv/src": {
         "url": "https://chromium.googlesource.com/external/github.com/Maratyszcza/FXdiv.git",
@@ -1169,8 +1169,8 @@
       },
       "src/third_party/harfbuzz/src": {
         "url": "https://chromium.googlesource.com/external/github.com/harfbuzz/harfbuzz.git",
-        "rev": "f027b8e9039f73bf803eae684fee2eb2d30e4180",
-        "hash": "sha256-HWb3QbPl+RE2oI/Jwv5BjKwv9UnJ8VcJvk+uGy9cAqM="
+        "rev": "67bb413f586f36ba44d740319cb7a28b3d283ea6",
+        "hash": "sha256-WCPEkbiiU8dENM+ik0KokW9Uxmz0xlsRFVVPPOEOZXw="
       },
       "src/third_party/ink/src": {
         "url": "https://chromium.googlesource.com/external/github.com/google/ink.git",
@@ -1259,8 +1259,8 @@
       },
       "src/third_party/libaom/source/libaom": {
         "url": "https://aomedia.googlesource.com/aom.git",
-        "rev": "b63f30b6d30028a3d7d9c5223def8f3ad97dcc4c",
-        "hash": "sha256-LaBEcVcSB8WB9ZNRgPSiGaKdQL5f3wll2sPb9OhN5SE="
+        "rev": "343cee0a952f8c7d329e59ff3ac2c8bdbe70ec6a",
+        "hash": "sha256-H8Eu3BiUIiZcyReGDyFq9UvjdMJOX00ERjru8+I0zL8="
       },
       "src/third_party/crabbyavif/src": {
         "url": "https://chromium.googlesource.com/external/github.com/webmproject/CrabbyAvif.git",
@@ -1439,8 +1439,8 @@
       },
       "src/third_party/pdfium": {
         "url": "https://pdfium.googlesource.com/pdfium.git",
-        "rev": "a78c62d93a8f514ea2cd98a70bd1d21226be9d93",
-        "hash": "sha256-qd3Oa/JFzoI5hKDY2/OQAzdr2z9srUj0H6oKz0R516U="
+        "rev": "72ea487e4399c44c3a53a48b104f9612ca772008",
+        "hash": "sha256-0VgmDPyF5k81nBXdo88CcIIbz6XRhaiADnG8gwDGZZk="
       },
       "src/third_party/perfetto": {
         "url": "https://chromium.googlesource.com/external/github.com/google/perfetto.git",
@@ -1489,8 +1489,8 @@
       },
       "src/third_party/skia": {
         "url": "https://skia.googlesource.com/skia.git",
-        "rev": "a2888b27a98e4ff30085d4d2dba8a1a99baf6dfb",
-        "hash": "sha256-eOjFuMmXr9YtZ0e4yDB8JMjTrNWEg5OlTkAMGuHZIWE="
+        "rev": "03c3234e64f9fbbbcf6a7b9c79e94059df49dbfe",
+        "hash": "sha256-e0MSCbqv4u4995nowzipKorkn6mPpO7tf8+ygj3/nFY="
       },
       "src/third_party/smhasher/src": {
         "url": "https://chromium.googlesource.com/external/smhasher.git",
@@ -1624,8 +1624,8 @@
       },
       "src/third_party/webrtc": {
         "url": "https://webrtc.googlesource.com/src.git",
-        "rev": "9a7f650bcd14f241d20f88f4e1ea3b7300de72ac",
-        "hash": "sha256-k5cHE4XURJQrPURmXk4MMNV5k8+ryKfjmsVTzARRro4="
+        "rev": "e3ee86921c57b9f8921045e77f098604803cb66c",
+        "hash": "sha256-n39HENOXmatsZLF6jdYRsb+wl2cM0i6ngT4Zbyu5ayE="
       },
       "src/third_party/wuffs/src": {
         "url": "https://skia.googlesource.com/external/github.com/google/wuffs-mirror-release-c.git",
@@ -1649,8 +1649,8 @@
       },
       "src/v8": {
         "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "ad6e4525c418a92147c8247ef9d144ce4c242a38",
-        "hash": "sha256-+cQdsWTgIohd3yOCsNCprSr4Ctes77fWGdmPxN2tQlM="
+        "rev": "5e24a1fd6ffb840b93ee90a800897fcb4d60eeab",
+        "hash": "sha256-JcBGaXhqNRIA4NPPV4eANVM93wsQ9QxSLO/Ecz3wklU="
       }
     }
   }