From e8f1d40affd6db5e9bf70775ced9924c263108e9 Mon Sep 17 00:00:00 2001
From: Ryan Omasta <git@ryand.ca>
Date: Mon, 1 Jun 2026 16:33:07 -0600
Subject: [PATCH 01/43] picocrypt-ng: 2.09 -> 2.10

https://github.com/Picocrypt-NG/Picocrypt-NG/releases/tag/2.10
Diff: https://github.com/Picocrypt-NG/Picocrypt-NG/compare/2.09...2.10

(cherry picked from commit c070f8595cb04a8e7a389210448ff3c3eabe8d19)
---
 pkgs/by-name/pi/picocrypt-ng/package.nix | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pi/picocrypt-ng/package.nix b/pkgs/by-name/pi/picocrypt-ng/package.nix
index db87aefd62e9..a8ebe6f82de0 100644
--- a/pkgs/by-name/pi/picocrypt-ng/package.nix
+++ b/pkgs/by-name/pi/picocrypt-ng/package.nix
@@ -16,18 +16,18 @@
 
 buildGoModule (finalAttrs: {
   pname = "picocrypt-ng";
-  version = "2.09";
+  version = "2.10";
 
   src = fetchFromGitHub {
     owner = "Picocrypt-NG";
     repo = "Picocrypt-NG";
     tag = finalAttrs.version;
-    hash = "sha256-s+93NoJ1O6/Af33pUobSA0kAhpw7W0IdA9H6CVxShQY=";
+    hash = "sha256-Rp7BgtJnV3fPed/QlWSxH8nL7cCTgMDpRGcgX5VI2l0=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/src";
 
-  vendorHash = "sha256-2c8Q7+97jSGo8lwWOYBg76K04+TFXG1DdQzVMR8G7ik=";
+  vendorHash = "sha256-yAM1jzebUlNkVWiY8lPtlelfqpFQonNcAqNmmghCdPU=";
 
   ldflags = [
     "-s"
@@ -50,6 +50,9 @@ buildGoModule (finalAttrs: {
     writableTmpDirAsHomeHook
   ];
 
+  # git ls-files doesn't work as source is not a git repo
+  checkFlags = [ "-skip=^TestOldVersionLiteralsAreAllowlisted$" ];
+
   env.CGO_ENABLED = 1;
 
   postInstall = ''

From 94d6d5caa2f12b99ad801467aa7f8a8e3556b7a3 Mon Sep 17 00:00:00 2001
From: Ryan Omasta <git@ryand.ca>
Date: Mon, 1 Jun 2026 17:18:09 -0600
Subject: [PATCH 02/43] picocrypt-ng: add ryand56 as maintainer

(cherry picked from commit 794d74dc72c8222a412c27ec2fdf3b8fa1d6a2be)
---
 pkgs/by-name/pi/picocrypt-ng/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/pi/picocrypt-ng/package.nix b/pkgs/by-name/pi/picocrypt-ng/package.nix
index a8ebe6f82de0..4ef584d36a41 100644
--- a/pkgs/by-name/pi/picocrypt-ng/package.nix
+++ b/pkgs/by-name/pi/picocrypt-ng/package.nix
@@ -76,7 +76,10 @@ buildGoModule (finalAttrs: {
     homepage = "https://github.com/Picocrypt-NG/Picocrypt-NG";
     changelog = "https://github.com/Picocrypt-NG/Picocrypt-NG/blob/${finalAttrs.version}/Changelog.md";
     license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [ tbutter ];
+    maintainers = with lib.maintainers; [
+      tbutter
+      ryand56
+    ];
     mainProgram = "picocrypt-ng-gui";
   };
 })

From 4bbd275267e8a0e1f2134278e926795a512c8d83 Mon Sep 17 00:00:00 2001
From: Ryan Omasta <git@ryand.ca>
Date: Fri, 5 Jun 2026 23:49:08 -0600
Subject: [PATCH 03/43] picocrypt-ng: 2.10 -> 2.17

https://github.com/Picocrypt-NG/Picocrypt-NG/releases/tag/2.17

(cherry picked from commit 8c4e70501b972f3ce3c7d3b0d6aec52c8b51ce7b)
---
 pkgs/by-name/pi/picocrypt-ng/package.nix | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/pi/picocrypt-ng/package.nix b/pkgs/by-name/pi/picocrypt-ng/package.nix
index 4ef584d36a41..15476f24b768 100644
--- a/pkgs/by-name/pi/picocrypt-ng/package.nix
+++ b/pkgs/by-name/pi/picocrypt-ng/package.nix
@@ -16,18 +16,19 @@
 
 buildGoModule (finalAttrs: {
   pname = "picocrypt-ng";
-  version = "2.10";
+  version = "2.17";
 
   src = fetchFromGitHub {
     owner = "Picocrypt-NG";
     repo = "Picocrypt-NG";
-    tag = finalAttrs.version;
-    hash = "sha256-Rp7BgtJnV3fPed/QlWSxH8nL7cCTgMDpRGcgX5VI2l0=";
+    # Rewritten git history many times
+    rev = "424db6105588e9fe6b929b6731ace4556a12f172";
+    hash = "sha256-Bj0LK6si1ocGriRJf5GHZ/Z2xVhtyCIiv7H5+h8Dong=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/src";
 
-  vendorHash = "sha256-yAM1jzebUlNkVWiY8lPtlelfqpFQonNcAqNmmghCdPU=";
+  vendorHash = "sha256-KaTatNjSUnQC44UsV3LFOlkad8WqLfTPFFff8Dn13DA=";
 
   ldflags = [
     "-s"
@@ -51,7 +52,14 @@ buildGoModule (finalAttrs: {
   ];
 
   # git ls-files doesn't work as source is not a git repo
-  checkFlags = [ "-skip=^TestOldVersionLiteralsAreAllowlisted$" ];
+  checkFlags =
+    let
+      skippedTests = [
+        "TestOldVersionLiteralsAreAllowlisted"
+        "TestLinuxAppIdentityContract"
+      ];
+    in
+    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];
 
   env.CGO_ENABLED = 1;
 

From 548dc51bd0e03f4310027b66700ce91c847f79ca Mon Sep 17 00:00:00 2001
From: Ryan Omasta <git@ryand.ca>
Date: Sun, 28 Jun 2026 17:46:06 -0600
Subject: [PATCH 04/43] picocrypt-ng: 2.17 -> 2.18

https://github.com/Picocrypt-NG/Picocrypt-NG/releases/tag/2.18
Diff: https://github.com/Picocrypt-NG/Picocrypt-NG/compare/2.17...2.18

(cherry picked from commit 03e36a44789195a1d5917db2ca6678eabeefe273)
---
 pkgs/by-name/pi/picocrypt-ng/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/pi/picocrypt-ng/package.nix b/pkgs/by-name/pi/picocrypt-ng/package.nix
index 15476f24b768..026dbbad8989 100644
--- a/pkgs/by-name/pi/picocrypt-ng/package.nix
+++ b/pkgs/by-name/pi/picocrypt-ng/package.nix
@@ -16,19 +16,19 @@
 
 buildGoModule (finalAttrs: {
   pname = "picocrypt-ng";
-  version = "2.17";
+  version = "2.18";
 
   src = fetchFromGitHub {
     owner = "Picocrypt-NG";
     repo = "Picocrypt-NG";
     # Rewritten git history many times
-    rev = "424db6105588e9fe6b929b6731ace4556a12f172";
-    hash = "sha256-Bj0LK6si1ocGriRJf5GHZ/Z2xVhtyCIiv7H5+h8Dong=";
+    rev = "3261587f8b10471a6ed3c5ad132ada0f7c06e4cf";
+    hash = "sha256-wjoYh6XWV4lJpSr9GQwPnlKGkbFH0YJOp1xVZJb5uOY=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/src";
 
-  vendorHash = "sha256-KaTatNjSUnQC44UsV3LFOlkad8WqLfTPFFff8Dn13DA=";
+  vendorHash = "sha256-pbldRarOQ44bE4FPUSHvk2Qk4WQ0zKU0Hd75E717mLI=";
 
   ldflags = [
     "-s"

From bfa7afb902d66c4eecad2a210d326de2a257db7a Mon Sep 17 00:00:00 2001
From: Holiu618 <165534185+Holiu618@users.noreply.github.com>
Date: Mon, 10 Aug 2026 22:46:24 +0800
Subject: [PATCH 05/43] steampipe: 2.3.6 -> 2.4.5

(cherry picked from commit f0708158fa29923ce0140d5515d054b35fbae531)
---
 pkgs/by-name/st/steampipe/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/st/steampipe/package.nix b/pkgs/by-name/st/steampipe/package.nix
index 5754d60bb87e..882c359d206c 100644
--- a/pkgs/by-name/st/steampipe/package.nix
+++ b/pkgs/by-name/st/steampipe/package.nix
@@ -11,7 +11,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "steampipe";
-  version = "2.3.6";
+  version = "2.4.5";
 
   env.CGO_ENABLED = 0;
 
@@ -19,10 +19,10 @@ buildGoModule (finalAttrs: {
     owner = "turbot";
     repo = "steampipe";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-b7F3Eo+/vJq8EqWig4O3y2UkqllWhUg38pend/JKeWA=";
+    hash = "sha256-xlMoDT91IrM1+sqAOqQ/Utzu2T0A7tJObCVzlxM9EsE=";
   };
 
-  vendorHash = "sha256-Xu5bxjmFRzABifA6GsvHbwh8CJgKrOlwfNXIH8XYz6s=";
+  vendorHash = "sha256-peqcrkRX6QlXnFl2V+e//ROmpT8HOtRbvzJM9zZUaT8=";
   proxyVendor = true;
 
   postPatch = ''

From dddac856846eba7ac4cbb6ae55f3e7baeced1dd9 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 15 Aug 2026 09:32:47 +0000
Subject: [PATCH 06/43] python3Packages.hiredis: 3.4.0 -> 3.4.1

(cherry picked from commit fcc4e93ba9b71edb00a6050c020b673d4df8b0d9)
---
 pkgs/development/python-modules/hiredis/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/hiredis/default.nix b/pkgs/development/python-modules/hiredis/default.nix
index b83ac28068a4..3370bc6f0510 100644
--- a/pkgs/development/python-modules/hiredis/default.nix
+++ b/pkgs/development/python-modules/hiredis/default.nix
@@ -12,7 +12,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "hiredis";
-  version = "3.4.0";
+  version = "3.4.1";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -20,7 +20,7 @@ buildPythonPackage (finalAttrs: {
     repo = "hiredis-py";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-TXhl9ny6hdd4n/hHfTAL0ewGcnjZ1vvNwovklSgzkKk=";
+    hash = "sha256-mdiOt+LkdcpjA30dEQffAQY7GmL69hp1E7s4Bu9uoFE=";
   };
 
   build-system = [ setuptools ];

From 7e9d8e29b735cb1399b492096ee80803f87d05d4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 28 Jul 2026 06:07:13 +0000
Subject: [PATCH 07/43] btrbk: 0.32.6 -> 0.32.7

(cherry picked from commit 9e7ce790b4d6756ad5a0ff1c1ef125b846e804a1)
---
 pkgs/by-name/bt/btrbk/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/bt/btrbk/package.nix b/pkgs/by-name/bt/btrbk/package.nix
index 9673585883d4..a92344935f3b 100644
--- a/pkgs/by-name/bt/btrbk/package.nix
+++ b/pkgs/by-name/bt/btrbk/package.nix
@@ -19,11 +19,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "btrbk";
-  version = "0.32.6";
+  version = "0.32.7";
 
   src = fetchurl {
     url = "https://digint.ch/download/btrbk/releases/btrbk-${finalAttrs.version}.tar.xz";
-    sha256 = "AuKsZHyRhGMgLL5ge7lVV6T3/SNwaRJDM8VNpbK7t2s=";
+    sha256 = "f1PPVaAHVwyd5aHE+UbKc3L61eBXyLHJ16/CF2zDLNM=";
   };
 
   nativeBuildInputs = [

From 31e4bd2ad799626ab94ea4af9d8887f2a34fbd10 Mon Sep 17 00:00:00 2001
From: Kasifrasi <ardit.abrashi03@gmail.com>
Date: Mon, 8 Jun 2026 21:12:20 +0200
Subject: [PATCH 08/43] readest: 0.11.1 -> 0.11.4

- Upgrade pnpm dependency from pnpm_10 to pnpm_11
- Add jq step to update package.json version during build

(cherry picked from commit 890c3e0ba087cb499042da39d48ef78c631a8c58)
---
 pkgs/by-name/re/readest/package.nix | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/re/readest/package.nix b/pkgs/by-name/re/readest/package.nix
index f470a6f0b4c8..6c5ce29cd413 100644
--- a/pkgs/by-name/re/readest/package.nix
+++ b/pkgs/by-name/re/readest/package.nix
@@ -1,7 +1,7 @@
 {
   stdenv,
   rustPlatform,
-  pnpm_10,
+  pnpm_11,
   fetchPnpmDeps,
   pnpmConfigHook,
   cargo-tauri,
@@ -23,13 +23,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "readest";
-  version = "0.11.1";
+  version = "0.11.4";
 
   src = fetchFromGitHub {
     owner = "readest";
     repo = "readest";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-VS1YpSy9dw0Z6hOZRKhq/3Yl2+x+jxQf7VWXeDs2HIg=";
+    hash = "sha256-tudx4LLRZXjA5wgfnA7+pBgBIUv1ZOYl2DZbsx7sWr0=";
     fetchSubmodules = true;
   };
 
@@ -44,13 +44,13 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pnpmRoot = "../..";
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
-    pnpm = pnpm_10;
+    pnpm = pnpm_11;
     fetcherVersion = 3;
-    hash = "sha256-AnCxGeYaA5pY3tXA8e03fAXvU/mj4mBP0ZA3MUkodNo=";
+    hash = "sha256-K6KQfXKBopTFJ4LKbFYSe0wVtwWkkhj40nMzYosBeGw=";
   };
 
   cargoRoot = "../..";
-  cargoHash = "sha256-BGI1C8SSDjkqhkBhos1GVXMaIUpYmSmPgb6lTuZJSQs=";
+  cargoHash = "sha256-HQ7nQvxpfGTudOTGVaXRPqaxFrAOA2HnIcgFpmJsgDI=";
 
   buildAndTestSubdir = "src-tauri";
 
@@ -63,6 +63,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail "autoCheckUpdates: true" "autoCheckUpdates: false" \
       --replace-fail "telemetryEnabled: true" "telemetryEnabled: false"
 
+    jq '.version = "${finalAttrs.version}"' package.json | sponge package.json
+
     mkdir -p src-tauri/plugins/tauri-plugin-turso/dist-js
     cp -r ${finalAttrs.passthru.tursoPlugin} src-tauri/plugins/tauri-plugin-turso/dist-js
     jq '.scripts.build = "true"' \
@@ -74,7 +76,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     cargo-tauri.hook
     nodejs
     pnpmConfigHook
-    pnpm_10
+    pnpm_11
     pkg-config
     wrapGAppsHook3
     autoPatchelfHook
@@ -115,9 +117,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     pname = "tauri-plugin-turso";
     version = finalAttrs.version;
     src = "${finalAttrs.src}/apps/readest-app/src-tauri/plugins/tauri-plugin-turso";
-    pnpm = pnpm_10;
+    pnpm = pnpm_11;
     fetcherVersion = 3;
-    hash = "sha256-Jf/UaEaLUg/v9ZRInBCEfkDY4d6nwyAIegCMKZe0iAQ=";
+    hash = "sha256-NEnZYXN83zYkkIJ5ZjzPqaaee+GE5jYGNGcaxzY9ae8=";
   };
 
   passthru.tursoPlugin = stdenv.mkDerivation {
@@ -126,7 +128,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     src = "${finalAttrs.src}/apps/readest-app/src-tauri/plugins/tauri-plugin-turso";
 
     nativeBuildInputs = [
-      pnpm_10
+      pnpm_11
       pnpmConfigHook
       nodejs
     ];

From 72e8fc940ec2097c118a7ffd57dda0db668df932 Mon Sep 17 00:00:00 2001
From: eljamm <fedi.jamoussi@protonmail.ch>
Date: Thu, 11 Jun 2026 08:43:29 +0200
Subject: [PATCH 09/43] readest: fix hash

(cherry picked from commit eded827eec40980c559882dfa917b4e371a84e7a)
---
 pkgs/by-name/re/readest/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/re/readest/package.nix b/pkgs/by-name/re/readest/package.nix
index 6c5ce29cd413..a0b70812e9c5 100644
--- a/pkgs/by-name/re/readest/package.nix
+++ b/pkgs/by-name/re/readest/package.nix
@@ -119,7 +119,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     src = "${finalAttrs.src}/apps/readest-app/src-tauri/plugins/tauri-plugin-turso";
     pnpm = pnpm_11;
     fetcherVersion = 3;
-    hash = "sha256-NEnZYXN83zYkkIJ5ZjzPqaaee+GE5jYGNGcaxzY9ae8=";
+    hash = "sha256-RIoTkX0ivaM9EJt3fsLpZhHd2lE4ZtDnAi9syONXUus=";
   };
 
   passthru.tursoPlugin = stdenv.mkDerivation {

From 2c49e43669c77c4ecfd0f904179f6a98ef11b628 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 21 Jun 2026 21:44:53 +0000
Subject: [PATCH 10/43] readest: 0.11.4 -> 0.11.12

(cherry picked from commit fa9c5fe9772103a03dcdc3c35abf8f55c7a1cc69)
---
 pkgs/by-name/re/readest/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/re/readest/package.nix b/pkgs/by-name/re/readest/package.nix
index a0b70812e9c5..81f1b00c7297 100644
--- a/pkgs/by-name/re/readest/package.nix
+++ b/pkgs/by-name/re/readest/package.nix
@@ -23,13 +23,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "readest";
-  version = "0.11.4";
+  version = "0.11.12";
 
   src = fetchFromGitHub {
     owner = "readest";
     repo = "readest";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-tudx4LLRZXjA5wgfnA7+pBgBIUv1ZOYl2DZbsx7sWr0=";
+    hash = "sha256-3nUmizE5g2ICWd/1rpsq35w8VzKEg8OMuIceNULR6SM=";
     fetchSubmodules = true;
   };
 
@@ -46,11 +46,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_11;
     fetcherVersion = 3;
-    hash = "sha256-K6KQfXKBopTFJ4LKbFYSe0wVtwWkkhj40nMzYosBeGw=";
+    hash = "sha256-dxcQmbJHWwkPOR9JYMSL8x3Fb4Z65lhVVF5DUDHPOtk=";
   };
 
   cargoRoot = "../..";
-  cargoHash = "sha256-HQ7nQvxpfGTudOTGVaXRPqaxFrAOA2HnIcgFpmJsgDI=";
+  cargoHash = "sha256-t7pP3VP80/ex4iKwa0/ogEppeE6zPjEvZp53VwPg/Iw=";
 
   buildAndTestSubdir = "src-tauri";
 

From f6f55b5b9a49946395f82eab0d44f045fcfe76cc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 30 Jun 2026 04:38:52 +0000
Subject: [PATCH 11/43] readest: 0.11.12 -> 0.11.17

(cherry picked from commit 416ad80f7520cfbe37eab2ac67366d2c5c14d833)
---
 pkgs/by-name/re/readest/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/re/readest/package.nix b/pkgs/by-name/re/readest/package.nix
index 81f1b00c7297..84fd224871ca 100644
--- a/pkgs/by-name/re/readest/package.nix
+++ b/pkgs/by-name/re/readest/package.nix
@@ -23,13 +23,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "readest";
-  version = "0.11.12";
+  version = "0.11.17";
 
   src = fetchFromGitHub {
     owner = "readest";
     repo = "readest";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3nUmizE5g2ICWd/1rpsq35w8VzKEg8OMuIceNULR6SM=";
+    hash = "sha256-vueP/UGu1G+DnwqJ7GhcYIxIsyTeFGYIiz7Iu0fs3NA=";
     fetchSubmodules = true;
   };
 
@@ -46,11 +46,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_11;
     fetcherVersion = 3;
-    hash = "sha256-dxcQmbJHWwkPOR9JYMSL8x3Fb4Z65lhVVF5DUDHPOtk=";
+    hash = "sha256-Kw3GLCPM/WeY9tQ7oAzj9PZIrX4DfudrAnYh92+5hbs=";
   };
 
   cargoRoot = "../..";
-  cargoHash = "sha256-t7pP3VP80/ex4iKwa0/ogEppeE6zPjEvZp53VwPg/Iw=";
+  cargoHash = "sha256-QxsiYl7mG+kS35pcU8/WLQA+f3gepe7qrHelhUzONbY=";
 
   buildAndTestSubdir = "src-tauri";
 

From 17e94d48e43661f81022d3b376c39dead06138e7 Mon Sep 17 00:00:00 2001
From: eljamm <fedi.jamoussi@protonmail.ch>
Date: Mon, 22 Jun 2026 18:15:44 +0200
Subject: [PATCH 12/43] readest: increase pnpm fetch retries

to work around timeout issues and switch to `fetcherVersion` 4.

(cherry picked from commit 3545da6278fc1f465a8be96e7131165543c17a9b)
---
 pkgs/by-name/re/readest/package.nix | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/re/readest/package.nix b/pkgs/by-name/re/readest/package.nix
index 84fd224871ca..0e3e461d9f79 100644
--- a/pkgs/by-name/re/readest/package.nix
+++ b/pkgs/by-name/re/readest/package.nix
@@ -45,8 +45,17 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_11;
-    fetcherVersion = 3;
-    hash = "sha256-Kw3GLCPM/WeY9tQ7oAzj9PZIrX4DfudrAnYh92+5hbs=";
+    fetcherVersion = 4;
+    hash = "sha256-wtWYdIfqytwn8PNahbQ/WxJuhhH1lbgNshQy6V0vvcA=";
+    pnpmInstallFlags = [
+      # Increase number of fetch attempts to work around timeout issues on slow
+      # networks: "TimeoutError: The operation was aborted due to timeout".
+      #
+      # If this still happens on your network, consider changing some of the
+      # fetch setting and opening a pull request:
+      # https://pnpm.io/settings#request-settings
+      "--fetch-retries=5"
+    ];
   };
 
   cargoRoot = "../..";
@@ -118,8 +127,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
     version = finalAttrs.version;
     src = "${finalAttrs.src}/apps/readest-app/src-tauri/plugins/tauri-plugin-turso";
     pnpm = pnpm_11;
-    fetcherVersion = 3;
-    hash = "sha256-RIoTkX0ivaM9EJt3fsLpZhHd2lE4ZtDnAi9syONXUus=";
+    fetcherVersion = 4;
+    hash = "sha256-quVUYsT3u4UBhuJ75QQ4SEuW8MhGQ0vGhtwtUj/eKHs=";
   };
 
   passthru.tursoPlugin = stdenv.mkDerivation {

From e03007bb466b45f3e667423eb90a6ae204126d3e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 9 Jul 2026 02:56:35 +0000
Subject: [PATCH 13/43] readest: 0.11.17 -> 0.11.18

(cherry picked from commit c09d1cf154813422c2a76b0ed643d47ce1e8b474)
---
 pkgs/by-name/re/readest/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/re/readest/package.nix b/pkgs/by-name/re/readest/package.nix
index 0e3e461d9f79..e91306f477b1 100644
--- a/pkgs/by-name/re/readest/package.nix
+++ b/pkgs/by-name/re/readest/package.nix
@@ -23,13 +23,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "readest";
-  version = "0.11.17";
+  version = "0.11.18";
 
   src = fetchFromGitHub {
     owner = "readest";
     repo = "readest";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vueP/UGu1G+DnwqJ7GhcYIxIsyTeFGYIiz7Iu0fs3NA=";
+    hash = "sha256-ate2vEYdE121wy3WUautpbIzfejbcaBZr/CnA6rf2Zw=";
     fetchSubmodules = true;
   };
 
@@ -59,7 +59,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   };
 
   cargoRoot = "../..";
-  cargoHash = "sha256-QxsiYl7mG+kS35pcU8/WLQA+f3gepe7qrHelhUzONbY=";
+  cargoHash = "sha256-RgqkTttEScAp1R+CWE1ItD5yCDMtJ5tb3fjgkMi3x9E=";
 
   buildAndTestSubdir = "src-tauri";
 

From da88b2cd0b1da1c63058d9b31a3d03c73e67882a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 27 Aug 2026 10:09:31 +0000
Subject: [PATCH 14/43] n8n: 2.34.6 -> 2.36.7

(cherry picked from commit 5dd241d39f372ed7f6d42f7b288700e30dacdf15)
---
 pkgs/by-name/n8/n8n/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/n8/n8n/package.nix b/pkgs/by-name/n8/n8n/package.nix
index a712630b45fc..2ea41e448730 100644
--- a/pkgs/by-name/n8/n8n/package.nix
+++ b/pkgs/by-name/n8/n8n/package.nix
@@ -27,20 +27,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "n8n";
-  version = "2.34.6";
+  version = "2.36.7";
 
   src = fetchFromGitHub {
     owner = "n8n-io";
     repo = "n8n";
     tag = "n8n@${finalAttrs.version}";
-    hash = "sha256-xB5ChOrcno5rCjWYrGtdNrqkwBtMeYCqml8xfrUAgEM=";
+    hash = "sha256-g0cIcvs3HMypQ0Y52R27GUGH03r6U4p0htLHUh5CIOA=";
   };
 
   pnpmDeps = fetchPnpmDeps {
     inherit (finalAttrs) pname version src;
     pnpm = pnpm_10;
     fetcherVersion = 4;
-    hash = "sha256-35nNgdoQwZlIZCzlWxC5eLKdyXAWWyBoIaa1B9zPEfY=";
+    hash = "sha256-bzYKeZ5ruIef62FnCG0mtnT9ssn/EETmUqGCA8GhkxQ=";
   };
 
   nativeBuildInputs = [

From 1703b88b79eeb28f91ce809976fe85ae84955e9c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 8 Aug 2026 14:19:28 +0000
Subject: [PATCH 15/43] plexRaw: 1.43.2.10687-563d026ea ->
 1.43.3.10861-07dfddaeb

(cherry picked from commit ed41a93b7da5580756b6e75565bdc3ec5e09b291)
---
 pkgs/by-name/pl/plexRaw/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pl/plexRaw/package.nix b/pkgs/by-name/pl/plexRaw/package.nix
index bdfef5bca9d1..08a8cd046236 100644
--- a/pkgs/by-name/pl/plexRaw/package.nix
+++ b/pkgs/by-name/pl/plexRaw/package.nix
@@ -14,7 +14,7 @@
 # server, and the FHS userenv and corresponding NixOS module should
 # automatically pick up the changes.
 stdenv.mkDerivation rec {
-  version = "1.43.2.10687-563d026ea";
+  version = "1.43.3.10861-07dfddaeb";
   pname = "plexmediaserver";
 
   # Fetch the source
@@ -22,12 +22,12 @@ stdenv.mkDerivation rec {
     if stdenv.hostPlatform.system == "aarch64-linux" then
       fetchurl {
         url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_arm64.deb";
-        sha256 = "188xk00gdd0ya7c2n26f4n6zpkndmmswbz23dl33zwcf14275hbz";
+        sha256 = "1bhm5y803ggzhss4va9hfkal7f91vf1yr2idr0h3kkam1q8hch1d";
       }
     else
       fetchurl {
         url = "https://downloads.plex.tv/plex-media-server-new/${version}/debian/plexmediaserver_${version}_amd64.deb";
-        sha256 = "13mfmlwvpimyrm3dkdlsr0b9qpbyy5l62q2ckh1xvzgj978j62bn";
+        sha256 = "0cnk5zqiyq59z5xc8p0hj33ikfzagc56n6c4f6kxhzfbnh8akhxk";
       };
   outputs = [
     "out"

From 680d184eaf9a76e5817a7e53287287b1f0c69ea4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 4 Sep 2026 03:00:05 +0000
Subject: [PATCH 16/43] xfr: 0.9.25 -> 0.10.0

(cherry picked from commit 0a29a8f4e44a9f73b865a14b30d0008110cf866c)
---
 pkgs/by-name/xf/xfr/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/xf/xfr/package.nix b/pkgs/by-name/xf/xfr/package.nix
index 8cfeb57c35cb..ba5d3a914e7a 100644
--- a/pkgs/by-name/xf/xfr/package.nix
+++ b/pkgs/by-name/xf/xfr/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "xfr";
-  version = "0.9.25";
+  version = "0.10.0";
 
   src = fetchFromGitHub {
     owner = "lance0";
     repo = "xfr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-3yL8N3pjU6//joBs8Js/fsQtNJBkIyuBdG0GiR9F608=";
+    hash = "sha256-pUMNnioPDUdZ2V7Y5cLH153cgaL+X8FnzRNOZ2w2bzc=";
   };
 
-  cargoHash = "sha256-Za00+UJEKtpybAJoIhK1Xb6N4OQY+c7Jb/CO5SVFGW8=";
+  cargoHash = "sha256-smiGRXzI6bFgXKCFuqbFGY9yPMskXymEKbXlFPO+O6A=";
 
   nativeBuildInputs = [
     installShellFiles

From 6c78724ae39afc6b766bc3fb419fa3de34c030b4 Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Sat, 5 Sep 2026 13:40:28 -0400
Subject: [PATCH 17/43] node-red: 4.1.13 -> 4.1.14

Changelog: https://github.com/node-red/node-red/blob/4.1.14/CHANGELOG.md
---
 pkgs/by-name/no/node-red/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/no/node-red/package.nix b/pkgs/by-name/no/node-red/package.nix
index 8c5de834e61f..17868e13a5a5 100644
--- a/pkgs/by-name/no/node-red/package.nix
+++ b/pkgs/by-name/no/node-red/package.nix
@@ -9,16 +9,16 @@
 
 buildNpmPackage rec {
   pname = "node-red";
-  version = "4.1.13";
+  version = "4.1.14";
 
   src = fetchFromGitHub {
     owner = "node-red";
     repo = "node-red";
     tag = version;
-    hash = "sha256-t4//qvmD39lYZAZVd76T1v2+XBB70AnzIMhLhFqyZ5U=";
+    hash = "sha256-Ed0JQ3GP0HuMFXNQb6a8JuPr5ka7KwKTP5D/YmVOah4=";
   };
 
-  npmDepsHash = "sha256-jlqbNsI8RdhpS5ZYw3hFnjFTRNs+aZc83OKGgVvSOBk=";
+  npmDepsHash = "sha256-/W9xrdvPbpxJmrYwoKTESiFTnsbt+LK1X3vTgKKeubE=";
 
   postPatch =
     let

From 4e464867df1ac4e8675f33db5a2d0565d0e3fd4a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Fri, 4 Sep 2026 22:23:34 +0200
Subject: [PATCH 18/43] rclone: 1.75.0 -> 1.75.1

Diff: https://github.com/rclone/rclone/compare/v1.75.0...v1.75.1

Changelog: https://github.com/rclone/rclone/blob/v1.75.1/docs/content/changelog.md
(cherry picked from commit fdd5372e156cb6ed2c25464a1c51dfb59defca20)
---
 pkgs/by-name/rc/rclone/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/rc/rclone/package.nix b/pkgs/by-name/rc/rclone/package.nix
index 12a0f918b981..4909ad91c9a2 100644
--- a/pkgs/by-name/rc/rclone/package.nix
+++ b/pkgs/by-name/rc/rclone/package.nix
@@ -17,7 +17,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "rclone";
-  version = "1.75.0";
+  version = "1.75.1";
 
   outputs = [
     "out"
@@ -28,10 +28,10 @@ buildGoModule (finalAttrs: {
     owner = "rclone";
     repo = "rclone";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8Al3jB+R8U68TuIfDQ+q9V/OjIed176csajwiSljwZU=";
+    hash = "sha256-d2WGx9Rplf7nrUZbYRYJffPKB7Fk0OZc9o3TUVoaG50=";
   };
 
-  vendorHash = "sha256-jjbDyZwHCx9oeFuMVMY5sJeRNlCUyU9quO/aqzxeJnU=";
+  vendorHash = "sha256-3HkOymYmr3JFG/Cs8GKHImRioQaHbiI3MEJR1ZPhbu8=";
 
   subPackages = [ "." ];
 

From bad7f20813ed581214c0e91912cb6415010e6e0e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 3 Aug 2026 11:23:54 +0000
Subject: [PATCH 19/43] python3Packages.rarfile: 4.2 -> 4.5

Backport reason: sabnzbd 5.1.2 requires rarfile >= 4.3 (it calls
rarfile.rar5_s2k at import time, so the service fails to start with
rarfile 4.2). 4.3 through 4.5 also carry security fixes:
- 4.3: disallow extraction outside the extraction path via an existing
  symlink (markokr/rarfile#114)
- 4.4: excessive allocation from an unchecked size field
  (GHSA-v5rw-pq35-5xw4)
- 4.5: unbounded read with comments (GHSA-94vx-95fq-wwvp)

Changelog: https://github.com/markokr/rarfile/blob/v4.5/doc/news.rst

(cherry picked from commit 601183cab00345214a4d15ba1a4bb608558c0bdd)
Assisted-by: Claude Code (Claude Fable 5.1)
---
 pkgs/development/python-modules/rarfile/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/rarfile/default.nix b/pkgs/development/python-modules/rarfile/default.nix
index 255fe5bd30bf..cd5e4f0a6702 100644
--- a/pkgs/development/python-modules/rarfile/default.nix
+++ b/pkgs/development/python-modules/rarfile/default.nix
@@ -15,14 +15,14 @@ assert !useUnrar -> libarchive != null;
 
 buildPythonPackage rec {
   pname = "rarfile";
-  version = "4.2";
+  version = "4.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "markokr";
     repo = "rarfile";
     tag = "v${version}";
-    hash = "sha256-ZiwD2LG25fMd4Z+QWsh/x3ceG5QRBH4s/TZDwMnfpNI=";
+    hash = "sha256-QhNzpNKOuBF/QEQ9XBXwKudcq4VqJyN/0chT+9uCcKg=";
   };
 
   prePatch = ''

From 367a0f25396c0b1a208d056db0d370a574812358 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 28 Aug 2026 12:26:28 +0000
Subject: [PATCH 20/43] sabnzbd: 5.0.4 -> 5.1.2

(cherry picked from commit 242eeefc2e971f2850538df867d32dd7027f4f7a)
Assisted-by: Claude Code (Claude Fable 5.1)
---
 pkgs/by-name/sa/sabnzbd/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/sa/sabnzbd/package.nix b/pkgs/by-name/sa/sabnzbd/package.nix
index 0ffa4d855104..667f786d9584 100644
--- a/pkgs/by-name/sa/sabnzbd/package.nix
+++ b/pkgs/by-name/sa/sabnzbd/package.nix
@@ -15,8 +15,8 @@
 }:
 
 let
-  sabctoolsVersion = "9.4.0";
-  sabctoolsHash = "sha256-JkRRtZnzp83dMKXiuqOXaTm8UOpkkhmjH2ysS8TY0DI=";
+  sabctoolsVersion = "9.6.3";
+  sabctoolsHash = "sha256-+qzSDV7JER45yBMmyh5Jor4rJLlcE8KPguPnrBmMkSk=";
 
   pythonEnv = python3.withPackages (
     ps: with ps; [
@@ -73,14 +73,14 @@ let
   ];
 in
 stdenv.mkDerivation rec {
-  version = "5.0.4";
+  version = "5.1.2";
   pname = "sabnzbd";
 
   src = fetchFromGitHub {
     owner = "sabnzbd";
     repo = "sabnzbd";
     rev = version;
-    hash = "sha256-Fi42ctRVNv3fJwNF/5CW/EJjdrjgotJS5sD2jHoc7/I=";
+    hash = "sha256-7U9SbvA3AGQmx99ayiBrPxx4HrCpKCSc6Qz/zpPFd0E=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 0d4e56df9f455326e3cba4091b37d0c7f474042b Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Fri, 28 Aug 2026 16:47:51 -0400
Subject: [PATCH 21/43] sabnzbd: fix missing dep hachoir

(cherry picked from commit 35b908558f59fe4e3254b2f334201b9ef7dfe9aa)
Assisted-by: Claude Code (Claude Fable 5.1)
---
 pkgs/by-name/sa/sabnzbd/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/sa/sabnzbd/package.nix b/pkgs/by-name/sa/sabnzbd/package.nix
index 667f786d9584..87c15793ac72 100644
--- a/pkgs/by-name/sa/sabnzbd/package.nix
+++ b/pkgs/by-name/sa/sabnzbd/package.nix
@@ -31,6 +31,7 @@ let
       cryptography
       feedparser
       guessit
+      hachoir
       jaraco-classes
       jaraco-collections
       jaraco-context

From b849c13a145849bec182c3be7fca922ff9676b22 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 30 Jun 2026 12:32:41 +0000
Subject: [PATCH 22/43] unrar: 7.2.6 -> 7.2.7

Backport reason: 7.2.7 carries the WinRAR 7.23 security fixes:
- CVE-2026-14191: out-of-bounds heap write in the RAR5 recovery volume
  parser (RecVolumes5::ReadHeader, recvol5.cpp)
- symbolic link pointing outside of the destination folder could be
  created even without -ola (extinfo.cpp)

Changelog: https://www.rarlab.com/rarnew.htm

(cherry picked from commit 96ffdab3729e3532081d34f8826e1cd519f7350d)
Assisted-by: Claude Code (Claude Fable 5.1)
---
 pkgs/by-name/un/unrar/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/un/unrar/package.nix b/pkgs/by-name/un/unrar/package.nix
index 5d4eebee8bd4..8023aefa4ae7 100644
--- a/pkgs/by-name/un/unrar/package.nix
+++ b/pkgs/by-name/un/unrar/package.nix
@@ -6,12 +6,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "unrar";
-  version = "7.2.6";
+  version = "7.2.7";
 
   src = fetchzip {
     url = "https://www.rarlab.com/rar/unrarsrc-${finalAttrs.version}.tar.gz";
     stripRoot = false;
-    hash = "sha256-rYW8ytF/eyhlgmQugbPXSyaQOPu+UmP6A6xmKh80iuE=";
+    hash = "sha256-X0MOIbsIL5iczClCLSj8UX0ofLHBu1Asap4EKKbLVnw=";
   };
 
   sourceRoot = finalAttrs.src.name;

From 9eb66d21be42b44bff007c84095e508c7fd00b94 Mon Sep 17 00:00:00 2001
From: Manuel Hutter <manuel@hutter.io>
Date: Thu, 3 Sep 2026 16:37:05 +0200
Subject: [PATCH 23/43] omnissa-horizon-client: 2605 -> 2606

- Update to the latest version
- Add some previously-missing libraries (some are now required to even
  connect properly)
- Remove the now-obsolete libxml2 (the package ships its own)

Signed-off-by: Manuel Hutter <manuel@hutter.io>
(cherry picked from commit 803e919a0e230d0661234e56b83acb832584007b)
---
 .../om/omnissa-horizon-client/package.nix     | 24 ++++++++++++-------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/om/omnissa-horizon-client/package.nix b/pkgs/by-name/om/omnissa-horizon-client/package.nix
index bcc6acb420eb..bee428334191 100644
--- a/pkgs/by-name/om/omnissa-horizon-client/package.nix
+++ b/pkgs/by-name/om/omnissa-horizon-client/package.nix
@@ -12,7 +12,7 @@
   configText ? "",
 }:
 let
-  version = "2605";
+  version = "2606";
 
   sysArch =
     if stdenv.hostPlatform.system == "x86_64-linux" then
@@ -39,8 +39,8 @@ let
     pname = "omnissa-horizon-files";
     inherit version;
     src = fetchurl {
-      url = "https://download3.omnissa.com/software/CART27FQ1_LIN_2603_TARBALL/Omnissa-Horizon-Client-Linux-2603-8.18.0-24120621798.tar.gz";
-      hash = "sha256:acd30479cec91ee693bbd685880fa3834f3678f8dd336511bb9d732f134f71d7";
+      url = "https://download3.omnissa.com/software/CART27FQ2_LIN_2606_TARBALL/Omnissa-Horizon-Client-Linux-2606-8.19.0-32216036411.tar.gz";
+      hash = "sha256-5kpZAPeiY4R3a8WRLLjWLndWXGhqrg7rC4d6EBoC2Ao=";
     };
     nativeBuildInputs = [ makeWrapper ];
     installPhase = ''
@@ -86,10 +86,14 @@ let
           freetype
           gdk-pixbuf
           glib
+          gst_all_1.gst-plugins-base
+          gst_all_1.gstreamer
           gtk2
           gtk3-x11
           harfbuzz
           liberation_ttf
+          libgbm
+          libglvnd
           libjpeg
           libpng
           libpulseaudio
@@ -97,13 +101,11 @@ let
           libudev0-shim
           libuuid
           libv4l
-          pango
-          pcsclite
-          pixman
-          udev
-          omnissaHorizonClientFiles
+          libva
+          libvdpau
           libx11
           libxau
+          libxcb
           libxcursor
           libxext
           libxi
@@ -113,8 +115,12 @@ let
           libxrender
           libxscrnsaver
           libxtst
+          omnissaHorizonClientFiles
+          pango
+          pcsclite
+          pixman
+          udev
           zlib
-          libxml2_13
 
           (writeTextDir "etc/omnissa/config" configText)
         ];

From 6d2e45417d486ae1a8cb4f63576502e51ff5ae93 Mon Sep 17 00:00:00 2001
From: Manuel Hutter <manuel@hutter.io>
Date: Thu, 3 Sep 2026 16:43:40 +0200
Subject: [PATCH 24/43] omnissa-horizon-client: Rename horizon-eucusbarbitrator
 to match upstream

This binary has been renamed by upstream back in 2024, but the nix
package was never properly updated.

This commit should restore the functionality of the usbarbitrator.

Signed-off-by: Manuel Hutter <manuel@hutter.io>
(cherry picked from commit 13393bfef8a4d20fc0c9ae9c126b1ba2b2e4bcf1)
---
 pkgs/by-name/om/omnissa-horizon-client/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/om/omnissa-horizon-client/package.nix b/pkgs/by-name/om/omnissa-horizon-client/package.nix
index bee428334191..aaebcdf51776 100644
--- a/pkgs/by-name/om/omnissa-horizon-client/package.nix
+++ b/pkgs/by-name/om/omnissa-horizon-client/package.nix
@@ -22,7 +22,7 @@ let
   # The downloaded archive also contains ARM binaries, but these have not been tested.
 
   # For USB support, ensure that /var/run/omnissa/<YOUR-UID>
-  # exists and is owned by you. Then run omnissa-usbarbitrator as root.
+  # exists and is owned by you. Then run horizon-eucusbarbitrator as root.
 
   mainProgram = "horizon-client";
 
@@ -152,7 +152,7 @@ stdenv.mkDerivation {
     runHook preInstall
     mkdir -p $out/bin
     ln -s ${omnissaFHSUserEnv "horizon-client"}/bin/horizon-client $out/bin/
-    ln -s ${omnissaFHSUserEnv "omnissa-usbarbitrator"}/bin/omnissa-usbarbitrator $out/bin/
+    ln -s ${omnissaFHSUserEnv "horizon-eucusbarbitrator"}/bin/horizon-eucusbarbitrator $out/bin/
     runHook postInstall
   '';
 

From 14d1048f0332a75e7ab74c8b0c1f2d6f05de338d Mon Sep 17 00:00:00 2001
From: sh0uv1 <mirantuten@yandex.com>
Date: Sat, 5 Sep 2026 20:16:05 +0000
Subject: [PATCH 25/43] ntopng: apply patch for CVE-2026-86091 CVE-2026-86090

(cherry picked from commit 98df70349e72dfba2fc16dbd9d6c70a15d2e35bc)
---
 pkgs/by-name/nt/ntopng/package.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/by-name/nt/ntopng/package.nix b/pkgs/by-name/nt/ntopng/package.nix
index fad390040f40..66925afc51a2 100644
--- a/pkgs/by-name/nt/ntopng/package.nix
+++ b/pkgs/by-name/nt/ntopng/package.nix
@@ -24,6 +24,7 @@
   which,
   zeromq,
   cmake,
+  fetchpatch,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -38,6 +39,15 @@ stdenv.mkDerivation (finalAttrs: {
     fetchSubmodules = true;
   };
 
+  patches = [
+    # Fix CVE-2026-86091 CVE-2026-86090
+    (fetchpatch {
+      name = "CVE-2026-86090-CVE-2026-86091.patch";
+      url = "https://github.com/ntop/ntopng/commit/7d830f31af367745431c5d92e2e82fc432f6bdd8.patch";
+      hash = "sha256-8N0q/Ekd5ni1jxZh8Jatipz+z57r1jqu/77o/oI/FuE=";
+    })
+  ];
+
   preConfigure = ''
     substituteInPlace Makefile.in \
       --replace "/bin/rm" "rm"

From 30cee4f875a5388ec4db10aa9f456570afd3d77f Mon Sep 17 00:00:00 2001
From: sh0uv1 <mirantuten@yandex.com>
Date: Sat, 5 Sep 2026 22:17:59 +0000
Subject: [PATCH 26/43] prevail: 0.2.0 -> 0.2.6

(cherry picked from commit 07a9b5ebc4e02a37da018115634f37c5577b92c4)
---
 pkgs/by-name/pr/prevail/package.nix                     | 4 ++--
 pkgs/by-name/pr/prevail/remove-fetchcontent-usage.patch | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/pr/prevail/package.nix b/pkgs/by-name/pr/prevail/package.nix
index dc0228506381..ad82e878dd69 100644
--- a/pkgs/by-name/pr/prevail/package.nix
+++ b/pkgs/by-name/pr/prevail/package.nix
@@ -13,14 +13,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "prevail";
-  version = "0.2.0";
+  version = "0.2.6";
 
   src = fetchFromGitHub {
     owner = "vbpf";
     repo = "prevail";
     rev = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-qlQSoz9GE2Z2rzmrPIj+HnIQmNxiBSgvR40FR9psuDc=";
+    hash = "sha256-c4km7WO9K0Hb0mTOkilXLwpFC8pJ8MEIqqlpBLJoC10=";
   };
 
   patches = [
diff --git a/pkgs/by-name/pr/prevail/remove-fetchcontent-usage.patch b/pkgs/by-name/pr/prevail/remove-fetchcontent-usage.patch
index 84827c87db01..6658e260df63 100644
--- a/pkgs/by-name/pr/prevail/remove-fetchcontent-usage.patch
+++ b/pkgs/by-name/pr/prevail/remove-fetchcontent-usage.patch
@@ -6,7 +6,7 @@ diff --git a/CMakeLists.txt b/CMakeLists.txt
  
  FetchContent_Declare(GSL
 -  GIT_REPOSITORY "https://github.com/microsoft/GSL"
--  GIT_TAG "v4.2.0"
+-  GIT_TAG "v4.2.2"
 -  GIT_SHALLOW ON
 +  SOURCE_DIR "@gslSrc@"
  )
@@ -17,7 +17,7 @@ diff --git a/CMakeLists.txt b/CMakeLists.txt
  if (prevail_ENABLE_TESTS)
    FetchContent_Declare(Catch2
 -    GIT_REPOSITORY "https://github.com/catchorg/Catch2.git"
--    GIT_TAG "v3.13.0"
+-    GIT_TAG "v3.15.3"
 -    GIT_SHALLOW ON
 +    SOURCE_DIR "@catch2Src@"
    )

From 56fbd033c8c901a3dd18ee7c336009a960dabcfc Mon Sep 17 00:00:00 2001
From: Sean Buckley <sean.bck@gmail.com>
Date: Sun, 6 Sep 2026 03:27:13 -0400
Subject: [PATCH 27/43] brave: 1.94.117 -> 1.94.121

https://community.brave.app/t/release-channel-1-94-121/657778

Not-cherry-picked-because: stable branch still requires x86_64-darwin
---
 pkgs/by-name/br/brave/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/br/brave/package.nix b/pkgs/by-name/br/brave/package.nix
index c35d66a308a6..b31e657a18f0 100644
--- a/pkgs/by-name/br/brave/package.nix
+++ b/pkgs/by-name/br/brave/package.nix
@@ -3,24 +3,24 @@
 
 let
   pname = "brave";
-  version = "1.94.117";
+  version = "1.94.121";
 
   allArchives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-4LTeb3BOBv+oRzC409UmSnFQDC3XRtKWmkPUcHOTkuM=";
+      hash = "sha256-7Cp4SGDpEszD32iHovx6VEJzIc2qhPHmF0UL1x7g7Hs=";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-ZAAX6ZNZS0ogFRjDfmyAoWo4NbXckswHY7Amfh3skyQ=";
+      hash = "sha256-IdesNrZKQI3FmLtuw9uEsHssvKhU0msoBVovtblKLnc=";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-OHPEARZoRW1/svXUTP+5rWTyNu6xOYisBkSJy+Z4Vzo=";
+      hash = "sha256-qSu42vwCvThmVOAUnjhsgWR0t+QL31Kx1NlyORHfCN8=";
     };
     x86_64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-x64.zip";
-      hash = "sha256-1CSLU2aM1076Yl1sp8w/TSpKiqHMJ6F7qICX7/bO8+E=";
+      hash = "sha256-Oqi+/TFSmj314DnIFj8W6aVBLitGinuKTTVznTzl6Bs=";
     };
   };
 

From e02d0efa69fe61041c3c25d094344f070c543ac1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 28 Apr 2026 02:02:54 +0000
Subject: [PATCH 28/43] hockeypuck: 2.3.2 -> 2.3.3

(cherry picked from commit 413e978af330e66e290afa5d7b036d0692612817)
---
 pkgs/by-name/ho/hockeypuck/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ho/hockeypuck/package.nix b/pkgs/by-name/ho/hockeypuck/package.nix
index 095d6d02990f..703373980d6b 100644
--- a/pkgs/by-name/ho/hockeypuck/package.nix
+++ b/pkgs/by-name/ho/hockeypuck/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "hockeypuck";
-  version = "2.3.2";
+  version = "2.3.3";
 
   src = fetchFromGitHub {
     owner = "hockeypuck";
     repo = "hockeypuck";
     rev = finalAttrs.version;
-    sha256 = "sha256-m1PI6YRFf2ZKvtsGtmTcERiB/7aZdhAcQODREb2K7ro=";
+    sha256 = "sha256-1AOvtAvx2OFxjJE5YhZwqdm9G8mWgS0hKPdTctU2MV4=";
   };
 
   modRoot = "src/hockeypuck/";

From ac14dcdeaa64d08a69cb5b441cc288f8f72f83f0 Mon Sep 17 00:00:00 2001
From: eljamm <fedi.jamoussi@protonmail.ch>
Date: Thu, 29 Jan 2026 10:25:17 +0100
Subject: [PATCH 29/43] hockeypuck: add NGI team

(cherry picked from commit 928065b6a678a28fb4ef59ced6757496eb4bb290)
---
 nixos/modules/services/security/hockeypuck.nix | 2 +-
 nixos/tests/hockeypuck.nix                     | 2 +-
 pkgs/by-name/ho/hockeypuck-web/package.nix     | 1 +
 pkgs/by-name/ho/hockeypuck/package.nix         | 1 +
 4 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/security/hockeypuck.nix b/nixos/modules/services/security/hockeypuck.nix
index 785dc15393f9..b021eac7d463 100644
--- a/nixos/modules/services/security/hockeypuck.nix
+++ b/nixos/modules/services/security/hockeypuck.nix
@@ -10,7 +10,7 @@ let
   settingsFormat = pkgs.formats.toml { };
 in
 {
-  meta.maintainers = [ ];
+  meta.maintainers = lib.teams.ngi.members;
 
   options.services.hockeypuck = {
     enable = lib.mkEnableOption "Hockeypuck OpenPGP Key Server";
diff --git a/nixos/tests/hockeypuck.nix b/nixos/tests/hockeypuck.nix
index ba6549f6cdf4..2b43ef5eaf3b 100644
--- a/nixos/tests/hockeypuck.nix
+++ b/nixos/tests/hockeypuck.nix
@@ -25,7 +25,7 @@ let
 in
 {
   name = "hockeypuck";
-  meta.maintainers = [ ];
+  meta.maintainers = lib.teams.ngi.members;
 
   nodes.machine =
     { ... }:
diff --git a/pkgs/by-name/ho/hockeypuck-web/package.nix b/pkgs/by-name/ho/hockeypuck-web/package.nix
index d267bba0f1f4..7e2abda87e2f 100644
--- a/pkgs/by-name/ho/hockeypuck-web/package.nix
+++ b/pkgs/by-name/ho/hockeypuck-web/package.nix
@@ -26,5 +26,6 @@ stdenv.mkDerivation {
     homepage = "https://github.com/hockeypuck/hockeypuck";
     license = lib.licenses.gpl3Plus;
     maintainers = [ ];
+    teams = with lib.teams; [ ngi ];
   };
 }
diff --git a/pkgs/by-name/ho/hockeypuck/package.nix b/pkgs/by-name/ho/hockeypuck/package.nix
index 095d6d02990f..d3ce5fda14d2 100644
--- a/pkgs/by-name/ho/hockeypuck/package.nix
+++ b/pkgs/by-name/ho/hockeypuck/package.nix
@@ -27,5 +27,6 @@ buildGoModule (finalAttrs: {
     homepage = "https://github.com/hockeypuck/hockeypuck";
     license = lib.licenses.agpl3Plus;
     maintainers = [ ];
+    teams = with lib.teams; [ ngi ];
   };
 })

From b032fd271587a991e4e937628d79b38671bdca39 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 6 Sep 2026 11:28:27 +0000
Subject: [PATCH 30/43] tui-journal: 0.17.0 -> 0.18.0

(cherry picked from commit 1f6ea975a408a5ede20a80c24d9820bda8095d78)
---
 pkgs/by-name/tu/tui-journal/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/tu/tui-journal/package.nix b/pkgs/by-name/tu/tui-journal/package.nix
index b66f07a69ec2..b05e2c58f80d 100644
--- a/pkgs/by-name/tu/tui-journal/package.nix
+++ b/pkgs/by-name/tu/tui-journal/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tui-journal";
-  version = "0.17.0";
+  version = "0.18.0";
 
   src = fetchFromGitHub {
     owner = "AmmarAbouZor";
     repo = "tui-journal";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ahjCfSodq4foBV3aBbU0FsSUrEo3wgvFYSBr/OClmpc=";
+    hash = "sha256-WcWHWJUhv5tCyac1Gdw+4ijIWYKgCWmUbK1tH/QCEMs=";
   };
 
-  cargoHash = "sha256-hbRSQ9iVmp0oKEK53y4IuU34WNgq+pRefNxFbP1DPVQ=";
+  cargoHash = "sha256-MVY9xanWaEzvwwlhM/EJk7qGkmGIjzxh4WTuyv4mQGo=";
 
   nativeBuildInputs = [
     pkg-config

From b640d49fdac8015a42351d1e7b4565f3efd68631 Mon Sep 17 00:00:00 2001
From: Gerhard Schwanzer <geri@sdf.org>
Date: Sun, 6 Sep 2026 17:03:27 +0200
Subject: [PATCH 31/43] freeipmi: 1.6.18 -> 1.6.19

https://www.openwall.com/lists/oss-security/2026/08/28/5

(cherry picked from commit 58ce81ca2d8eeb2864ced2bdf59c7787aaba055c)

Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol)
---
 pkgs/by-name/fr/freeipmi/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fr/freeipmi/package.nix b/pkgs/by-name/fr/freeipmi/package.nix
index 90131d86d1ca..590fa84be642 100644
--- a/pkgs/by-name/fr/freeipmi/package.nix
+++ b/pkgs/by-name/fr/freeipmi/package.nix
@@ -10,12 +10,12 @@
 }:
 
 stdenv.mkDerivation (finalAttrs: {
-  version = "1.6.18";
+  version = "1.6.19";
   pname = "freeipmi";
 
   src = fetchurl {
     url = "mirror://gnu/freeipmi/freeipmi-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-gJiyOCADitCqOavw+aAS4kaD04TZ+R52CssqaLRl4P4=";
+    sha256 = "sha256-+Vwrc3l8SgNBpCp7PEPvtglUxBMNCCrTSP1A2lVLToU=";
   };
 
   postPatch = lib.optionalString stdenv.cc.isClang ''

From 713d95d877b15a2224dff0be0962b85d3fb6c149 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 19 Jun 2026 21:46:43 +0000
Subject: [PATCH 32/43] kimai: 2.59.0 -> 2.60.0

(cherry picked from commit f5860b7cf142cca8eceeefeaf4a8d4897213aaee)
---
 pkgs/by-name/ki/kimai/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ki/kimai/package.nix b/pkgs/by-name/ki/kimai/package.nix
index 883f0a4c5bab..a35072984522 100644
--- a/pkgs/by-name/ki/kimai/package.nix
+++ b/pkgs/by-name/ki/kimai/package.nix
@@ -7,13 +7,13 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "kimai";
-  version = "2.59.0";
+  version = "2.60.0";
 
   src = fetchFromGitHub {
     owner = "kimai";
     repo = "kimai";
     tag = finalAttrs.version;
-    hash = "sha256-tOybMpMe8pc2PAPUd5JGwqx6Qo6ZjeDX9UvP6i6BPDM=";
+    hash = "sha256-TdeoFbgLXbLsBeMK8YUKimRyx+nJ4QMigY9YxicmPDA=";
   };
 
   php = php.buildEnv {
@@ -38,7 +38,7 @@ php.buildComposerProject2 (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-rhuj+7RsS9vngfKeUZiKIYHed0+5QN1JDrDc4YCJYDk=";
+  vendorHash = "sha256-0byb0lsi9nU1qKksU6BeBB/JCXoHSaliLyErz6Z14QQ=";
 
   composerNoPlugins = false;
   postInstall = ''

From 395048de4653935478d2a1de23923b6bb48cff83 Mon Sep 17 00:00:00 2001
From: Daniel McCarney <daniel@binaryparadox.net>
Date: Fri, 4 Sep 2026 11:10:20 -0400
Subject: [PATCH 33/43] hickory-dns: 0.26.1 -> 0.26.2

Fixes a number of security issues. See the upstream release notes for
more information:
  https://github.com/hickory-dns/hickory-dns/releases/tag/v0.26.2

(cherry picked from commit 36b8fda00b618569a50f2239c8ef8a8a7b422d70)
---
 pkgs/by-name/hi/hickory-dns/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/hi/hickory-dns/package.nix b/pkgs/by-name/hi/hickory-dns/package.nix
index 48c1d31fc580..793837cb7a53 100644
--- a/pkgs/by-name/hi/hickory-dns/package.nix
+++ b/pkgs/by-name/hi/hickory-dns/package.nix
@@ -9,16 +9,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "hickory-dns";
-  version = "0.26.1";
+  version = "0.26.2";
 
   src = fetchFromGitHub {
     owner = "hickory-dns";
     repo = "hickory-dns";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jRcq9b409O5bjta8hFLFBFC6ILf8QA2EZ8tQqk2m1Rk=";
+    hash = "sha256-qwyMfjo3LTyvxwRlQ/4Odc3yZsSuA4cn7zj/KLCfRSs=";
   };
 
-  cargoHash = "sha256-zszSkclNCLGVchWiNdtNLJeY2j5CmubjMjhwVwsvRP8=";
+  cargoHash = "sha256-TsawTK+MaQ8isxa+/lROTgnA2u26XKjZCtRFUKLRbrw=";
 
   buildFeatures = [
     "blocklist"

From 0595c34a8b041b360a405a032cc5745051c2ee8b Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Thu, 3 Sep 2026 23:26:06 -0400
Subject: [PATCH 34/43] ci/github-script/bot.js: make llm-assisted label sticky

By popular demand, this patch lets folks manually label PRs with the
label and make it stick, even if auto-labeler wouldn't label it itself
(presumably because the author didn't mark their commits according to
automation policy).

Assisted-by: Codex gpt-5.6-sol medium
(cherry picked from commit 9686621d1b8e00ecd3000e7a79165ac006f06529)
---
 ci/github-script/bot.js | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/ci/github-script/bot.js b/ci/github-script/bot.js
index c1fba12c00c4..e262a7082cc5 100644
--- a/ci/github-script/bot.js
+++ b/ci/github-script/bot.js
@@ -397,11 +397,11 @@ export default async ({ github, context, core, dry }) => {
         per_page: 100,
       })
 
-      // label llm-assisted PRs accordingly
+      // label llm-assisted PRs accordingly, retaining it if manually set
       const assistedByPattern = /Assisted-by: (?!nix-init)/i
-      evalLabels['llm-assisted'] = prCommits.some((c) =>
-        assistedByPattern.test(c.commit.message),
-      )
+      if (prCommits.some((c) => assistedByPattern.test(c.commit.message))) {
+        evalLabels['llm-assisted'] = true
+      }
 
       const commitSubjects = prCommits.map(
         (c) => c.commit.message.split('\n')[0],

From 5b763ff7f50eec23cbabbbb36549c159c3ae49f8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 28 Jun 2026 07:24:30 +0000
Subject: [PATCH 35/43] kimai: 2.60.0 -> 2.61.0

(cherry picked from commit 21ae749caec2b4e5edeab35fd8d74323f9daecbc)
---
 pkgs/by-name/ki/kimai/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ki/kimai/package.nix b/pkgs/by-name/ki/kimai/package.nix
index a35072984522..2766a5417924 100644
--- a/pkgs/by-name/ki/kimai/package.nix
+++ b/pkgs/by-name/ki/kimai/package.nix
@@ -7,13 +7,13 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "kimai";
-  version = "2.60.0";
+  version = "2.61.0";
 
   src = fetchFromGitHub {
     owner = "kimai";
     repo = "kimai";
     tag = finalAttrs.version;
-    hash = "sha256-TdeoFbgLXbLsBeMK8YUKimRyx+nJ4QMigY9YxicmPDA=";
+    hash = "sha256-T/eHJeEosRRWPSxvDpBkeGEx8zwqFz/v2CflhjLqpO4=";
   };
 
   php = php.buildEnv {
@@ -38,7 +38,7 @@ php.buildComposerProject2 (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-0byb0lsi9nU1qKksU6BeBB/JCXoHSaliLyErz6Z14QQ=";
+  vendorHash = "sha256-rwCLPLJwVaykWimmuZ7wM2KLZqDE1YIhMbD7q86w0OE=";
 
   composerNoPlugins = false;
   postInstall = ''

From 4718cfb0447e8c3ba5413275dcbcc1faaa2b9646 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Sun, 6 Sep 2026 19:27:18 +0200
Subject: [PATCH 36/43] pfetch: use `finalAttrs` pattern

(cherry picked from commit 5f5c0d4c794c3ff4ed1dffd2f5d3d9c4e5e06450)
---
 pkgs/by-name/pf/pfetch/package.nix | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/pf/pfetch/package.nix b/pkgs/by-name/pf/pfetch/package.nix
index 9be219f4eb87..8a214851da80 100644
--- a/pkgs/by-name/pf/pfetch/package.nix
+++ b/pkgs/by-name/pf/pfetch/package.nix
@@ -2,25 +2,30 @@
   lib,
   stdenvNoCC,
   fetchFromGitHub,
-  gitUpdater,
+  nix-update-script,
   versionCheckHook,
 }:
 
-stdenvNoCC.mkDerivation rec {
+stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "pfetch";
   version = "1.11.0";
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "Un1q32";
     repo = "pfetch";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-QxHbk27A45awUqLGS/HZmOLOi0sQ1DVfwCFhyOlSCKk=";
   };
 
   dontBuild = true;
 
   installPhase = ''
+    runHook preInstall
+
     install -Dm755 -t $out/bin pfetch
+
+    runHook postInstall
   '';
 
   nativeInstallCheckInputs = [
@@ -29,13 +34,13 @@ stdenvNoCC.mkDerivation rec {
   doInstallCheck = true;
 
   passthru = {
-    updateScript = gitUpdater { };
+    updateScript = nix-update-script { };
   };
 
   meta = {
     description = "Pretty system information tool written in POSIX sh";
     homepage = "https://github.com/Un1q32/pfetch";
-    changelog = "https://github.com/Un1q32/pfetch/releases/tag/${version}";
+    changelog = "https://github.com/Un1q32/pfetch/releases/tag/${finalAttrs.version}";
     license = lib.licenses.mit;
     platforms = lib.platforms.all;
     maintainers = with lib.maintainers; [
@@ -44,4 +49,4 @@ stdenvNoCC.mkDerivation rec {
     ];
     mainProgram = "pfetch";
   };
-}
+})

From 3e122e27ae643980b00f3aa34f3263ecf5922795 Mon Sep 17 00:00:00 2001
From: Pol Dellaiera <pol.dellaiera@protonmail.com>
Date: Sun, 6 Sep 2026 19:33:25 +0200
Subject: [PATCH 37/43] pfetch-rs: add `versionCheckHook`

(cherry picked from commit b479b2f494e131fb327a4bbc46b3831db26a61cf)
---
 pkgs/by-name/pf/pfetch-rs/package.nix | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/pf/pfetch-rs/package.nix b/pkgs/by-name/pf/pfetch-rs/package.nix
index 91881e17ad69..eda0ab1a9cc4 100644
--- a/pkgs/by-name/pf/pfetch-rs/package.nix
+++ b/pkgs/by-name/pf/pfetch-rs/package.nix
@@ -2,21 +2,33 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "pfetch-rs";
   version = "2.11.1";
+  __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "Gobidev";
     repo = "pfetch-rs";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-Kgoo8piv4pNqzw9zQSEj7POSK6l+0KMvaNbvMp+bpF8=";
   };
 
   cargoHash = "sha256-36MjBzSzEOVaSnd6dTqYnV+Pi+5EDoUskkYsvYMGrgg=";
 
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+  doInstallCheck = true;
+
+  passthru = {
+    updateScript = nix-update-script { };
+  };
+
   meta = {
     description = "Rewrite of the pfetch system information tool in Rust";
     homepage = "https://github.com/Gobidev/pfetch-rs";

From a125a8be8760a8bd979124d90f9e164925616f7e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 16 Jul 2026 02:49:31 +0000
Subject: [PATCH 38/43] kimai: 2.61.0 -> 2.62.0

(cherry picked from commit b4ac441b773702a96304e28b4e3b9cb4d3074018)
---
 pkgs/by-name/ki/kimai/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ki/kimai/package.nix b/pkgs/by-name/ki/kimai/package.nix
index 2766a5417924..0bb42234493a 100644
--- a/pkgs/by-name/ki/kimai/package.nix
+++ b/pkgs/by-name/ki/kimai/package.nix
@@ -7,13 +7,13 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "kimai";
-  version = "2.61.0";
+  version = "2.62.0";
 
   src = fetchFromGitHub {
     owner = "kimai";
     repo = "kimai";
     tag = finalAttrs.version;
-    hash = "sha256-T/eHJeEosRRWPSxvDpBkeGEx8zwqFz/v2CflhjLqpO4=";
+    hash = "sha256-IN9AnyN04inRK43YbMas6rUtDhSXCtbEkP6vv+yZREc=";
   };
 
   php = php.buildEnv {
@@ -38,7 +38,7 @@ php.buildComposerProject2 (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-rwCLPLJwVaykWimmuZ7wM2KLZqDE1YIhMbD7q86w0OE=";
+  vendorHash = "sha256-MkQlK3DUbLBkkwZkxzGdR98NTHx/o5KD9D194Dg2F38=";
 
   composerNoPlugins = false;
   postInstall = ''

From 9b567351012c1b81c47db4ea914c726fd8b6afa6 Mon Sep 17 00:00:00 2001
From: Gerhard Schwanzer <geri@sdf.org>
Date: Sun, 16 Aug 2026 07:16:44 +0200
Subject: [PATCH 39/43] rubyPackages.loofah: 2.24.1 -> 2.25.2

https://redirect.github.com/flavorjones/loofah/releases/tag/v2.25.2

Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol)
(cherry picked from commit 3ef8579a062fd01334834030715109d2ef877852)
---
 pkgs/top-level/ruby-packages.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/top-level/ruby-packages.nix b/pkgs/top-level/ruby-packages.nix
index 4bde8c97213f..74855d05e61e 100644
--- a/pkgs/top-level/ruby-packages.nix
+++ b/pkgs/top-level/ruby-packages.nix
@@ -2755,10 +2755,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0dx316q03x6rpdbl610rdaj2vfd5s8fanixk21j4gv3h5f230nk5";
+      sha256 = "062r891hxis58j5q735kk9sj5srxx0rv813f8m95bilsjm3gf1r0";
       type = "gem";
     };
-    version = "2.24.1";
+    version = "2.25.2";
   };
   mab = {
     groups = [ "default" ];

From 3148de19e39fc5c1843aa12414604c1e095d6b78 Mon Sep 17 00:00:00 2001
From: Gerhard Schwanzer <geri@sdf.org>
Date: Tue, 18 Aug 2026 16:12:39 +0200
Subject: [PATCH 40/43] perlPackages.Imager: 1.031 -> 1.034

https://metacpan.org/release/TONYC/Imager-1.034/source/Changes

The release fixes CVE-2026-13705, CVE-2026-14454 and CVE-2026-19082.
Backport two post-release 32-bit EXIF bounds-check fixes as well.

Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol)
(cherry picked from commit 9f6a05bb915019109f3ed3204fd24cf68629bc5e)
---
 pkgs/top-level/perl-packages.nix | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 7b8da85adab3..818bc05a361b 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -17198,11 +17198,26 @@ with self;
 
   Imager = buildPerlPackage rec {
     pname = "Imager";
-    version = "1.031";
+    version = "1.034";
     src = fetchurl {
       url = "mirror://cpan/authors/id/T/TO/TONYC/Imager-${version}.tar.gz";
-      hash = "sha256-kL59G9/F7bfxfPgreeamYUxbAuv+Mm67b2afzaeRNAE=";
+      hash = "sha256-hrWizXGna4QJJJFSGl1WI4Qo8sN1AYMsmVxaMxJg+AM=";
     };
+    # Remove when updating to the first release containing both fixes.
+    patches = [
+      (fetchpatch2 {
+        name = "fix-32-bit-exif-ifd-offset-checks.patch";
+        url = "https://github.com/tonycoz/imager/commit/48ba8ac0749f89466b6e6681fb88cbdb51086ebd.patch?full_index=1";
+        includes = [ "imexif.c" ];
+        hash = "sha256-rpUeTsgSkCdzJsy3Ny0rU+KNL6xkSosfkDqzFb813Wo=";
+      })
+      (fetchpatch2 {
+        name = "fix-32-bit-exif-limit-checks.patch";
+        url = "https://github.com/tonycoz/imager/commit/6f1fd003a8e48c7e6e58b7019a04cc71bbfec2c3.patch?full_index=1";
+        includes = [ "imexif.c" ];
+        hash = "sha256-Ct7T/JHuxAIAjjuzoUhdAPlp0qPYKRQQqejsrcGXPko=";
+      })
+    ];
     buildInputs = [
       pkgs.freetype
       pkgs.fontconfig

From ee358bf6a1bedabb14c46844995550f18902765a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 12 Aug 2026 01:51:51 +0000
Subject: [PATCH 41/43] kimai: 2.62.0 -> 2.65.0

(cherry picked from commit 94d6f987b00447b86068e6530ee9651bfbad9733)
---
 pkgs/by-name/ki/kimai/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ki/kimai/package.nix b/pkgs/by-name/ki/kimai/package.nix
index 0bb42234493a..c319d03ad7da 100644
--- a/pkgs/by-name/ki/kimai/package.nix
+++ b/pkgs/by-name/ki/kimai/package.nix
@@ -7,13 +7,13 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "kimai";
-  version = "2.62.0";
+  version = "2.65.0";
 
   src = fetchFromGitHub {
     owner = "kimai";
     repo = "kimai";
     tag = finalAttrs.version;
-    hash = "sha256-IN9AnyN04inRK43YbMas6rUtDhSXCtbEkP6vv+yZREc=";
+    hash = "sha256-lqKHXf5pksyZpKEf3ZIey2ub/3Q9b/Gik7NH+B2ZgAE=";
   };
 
   php = php.buildEnv {
@@ -38,7 +38,7 @@ php.buildComposerProject2 (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-MkQlK3DUbLBkkwZkxzGdR98NTHx/o5KD9D194Dg2F38=";
+  vendorHash = "sha256-0nOmdnpGzUszBiAYH0sdkT4UCJc8Sd8eihBQE5Vo4Lo=";
 
   composerNoPlugins = false;
   postInstall = ''

From 4be9fcde21f8c793c64fb979f6661a7f3d12c15d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 6 Sep 2026 03:34:59 +0000
Subject: [PATCH 42/43] cargo-zigbuild: 0.23.2 -> 0.23.4

(cherry picked from commit 435b653851dc94245bedf6f5a76a5b9147ef1c38)
---
 pkgs/by-name/ca/cargo-zigbuild/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ca/cargo-zigbuild/package.nix b/pkgs/by-name/ca/cargo-zigbuild/package.nix
index afaf16c272a6..4b590293e41b 100644
--- a/pkgs/by-name/ca/cargo-zigbuild/package.nix
+++ b/pkgs/by-name/ca/cargo-zigbuild/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-zigbuild";
-  version = "0.23.2";
+  version = "0.23.4";
 
   src = fetchFromGitHub {
     owner = "rust-cross";
     repo = "cargo-zigbuild";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Woa8lcx9D5U2NyxHqLE9nIkgtvLc35lo+H+Cp+NOHKg=";
+    hash = "sha256-vJLRjqcakU8E2aL3SAyi0twLZ765BYS/nVKDKYQ6eWo=";
   };
 
-  cargoHash = "sha256-Q/Hf9fHxA/3EhnbWapyMak4nyZt/5HTL8osE7Nit6g0=";
+  cargoHash = "sha256-ARFcXDd2uv8e7rO01wfWONOFT3eN2SCGd1g727tgn8s=";
 
   nativeBuildInputs = [ makeWrapper ];
 

From f41d7f335578cbef1c1d76193cc9f47526e6507f Mon Sep 17 00:00:00 2001
From: Gerhard Schwanzer <geri@sdf.org>
Date: Mon, 17 Aug 2026 21:08:29 +0200
Subject: [PATCH 43/43] perlPackages.NetOAuth: 0.28 -> 0.33

Fixes CVE-2025-22376, CVE-2026-72887, CVE-2026-72888,
CVE-2026-72889 and CVE-2026-75589.

Version 0.33 requires callers that verify messages to configure
allowed_signature_methods.

Changelog: https://metacpan.org/dist/Net-OAuth/changes

The Nixpkgs 26.11 release-note entry is intentionally omitted because this
backport targets release-26.05.

(cherry picked from commit 4222e966acfffe88f0b650e6c7d50644568205cb)

Assisted-by: pi coding agent / Mika (OpenAI gpt-5.6-sol)
---
 pkgs/top-level/perl-packages.nix | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index 818bc05a361b..80754256cb66 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -25991,19 +25991,18 @@ with self;
     };
   };
 
-  NetOAuth = buildPerlModule {
+  NetOAuth = buildPerlPackage {
     pname = "Net-OAuth";
-    version = "0.28";
+    version = "0.33";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/K/KG/KGRENNAN/Net-OAuth-0.28.tar.gz";
-      hash = "sha256-e/wxnaCsV44Ali81o1DPUREKOjEwFtH9wwciAooikEw=";
+      url = "mirror://cpan/authors/id/R/RR/RRWO/Net-OAuth-0.33.tar.gz";
+      hash = "sha256-BqKQwTvBycKs7jOnkImzLzBHlkkl1OqZLrbBzD2N9sE=";
     };
     buildInputs = [ TestWarn ];
     propagatedBuildInputs = [
       ClassAccessor
       ClassDataInheritable
-      DigestHMAC
-      DigestSHA1
+      CryptSysRandom
       LWP
     ];
     meta = {