Merge release-26.05 into staging-next-26.05

2026-09-29 19:30:11 +00:00 · 2026-09-29 00:30:07 +00:00
parent d258836952 7fc6f2c20a
commit decb995600
44 changed files with 1102 additions and 914 deletions
--- a/ci/github-script/reminders/docs-styleguide.md
+++ b/ci/github-script/reminders/docs-styleguide.md
@@ -1,6 +1,6 @@
 Thanks for contributing to the documentation

-Make sure you follow the [documentation styleguide](https://github.com/NixOS/nixpkgs/blob/master/doc/styleguide.md), most notably:
+Make sure you follow the [documentation style guide](https://github.com/NixOS/nixpkgs/blob/master/doc/styleguide.md), most notably:

 - Show, don't tell: lead with a minimal working example; explanation follows the code.
 - No meta-commentary: don't write "This section explains how to…", just do it.
--- a/nixos/modules/services/monitoring/glpi-agent.nix
+++ b/nixos/modules/services/monitoring/glpi-agent.nix
@@ -95,8 +95,8 @@ in

        DynamicUser = true;
        StateDirectory = "glpi-agent";
-        CapabilityBoundingSet = [ "CAP_SYS_ADMIN" ];
-        AmbientCapabilities = [ "CAP_SYS_ADMIN" ];
+        CapabilityBoundingSet = [ "CAP_DAC_READ_SEARCH" ];
+        AmbientCapabilities = [ "CAP_DAC_READ_SEARCH" ];

        LimitCORE = 0;
        LimitNOFILE = 65535;
@@ -104,7 +104,7 @@ in
        MemorySwapMax = 0;
        MemoryZSwapMax = 0;
        PrivateTmp = true;
-        ProcSubset = "pid";
+        ProcSubset = "all";
        ProtectClock = true;
        ProtectControlGroups = true;
        ProtectHome = true;
--- a/nixos/modules/services/web-apps/nextcloud.md
+++ b/nixos/modules/services/web-apps/nextcloud.md
@@ -5,8 +5,9 @@ self-hostable cloud platform. The server setup can be automated using
 [services.nextcloud](#opt-services.nextcloud.enable). A
 desktop client is packaged at `pkgs.nextcloud-client`.

-The current default by NixOS is `nextcloud35` which is also the latest
-major version available.
+The current default by NixOS 26.05 is `nextcloud33` which was the latest
+major version available at the time of release.
+The latest major version is also available as `nextcloud35`, upon explicit upgrade.

 ## Basic usage {#module-services-nextcloud-basic-usage}

--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -1230,9 +1230,7 @@ in
          ++ (lib.optional (lib.versionOlder cfg.package.version "30") (upgradeWarning 29 "24.11"))
          ++ (lib.optional (lib.versionOlder cfg.package.version "31") (upgradeWarning 30 "25.05"))
          ++ (lib.optional (lib.versionOlder cfg.package.version "32") (upgradeWarning 31 "25.11"))
-          ++ (lib.optional (lib.versionOlder cfg.package.version "33") (upgradeWarning 32 "26.05"))
-          ++ (lib.optional (lib.versionOlder cfg.package.version "34") (upgradeWarning 33 "26.05"))
-          ++ (lib.optional (lib.versionOlder cfg.package.version "35") (upgradeWarning 34 "26.05"));
+          ++ (lib.optional (lib.versionOlder cfg.package.version "33") (upgradeWarning 32 "26.05"));

        services.nextcloud.package = lib.mkDefault (
          if pkgs ? nextcloud then
--- a/nixos/tests/flaresolverr.nix
+++ b/nixos/tests/flaresolverr.nix
@@ -10,11 +10,30 @@
        enable = true;
        port = 8888;
      };
+
+      services.nginx = {
+        enable = true;
+        virtualHosts.localhost = {
+          locations."/" = {
+            return = "200 'hello world'";
+            extraConfig = ''
+              default_type text/plain;
+            '';
+          };
+        };
+      };
    };

-  testScript = ''
+  testScript = /* python */ ''
+    import json
+
    machine.wait_for_unit("flaresolverr.service")
    machine.wait_for_open_port(8888)
    machine.succeed("curl --fail http://localhost:8888/")
+
+    res = machine.succeed("""curl --fail http://localhost:8888/v1 -X POST --json '{ "cmd": "request.get", "url": "http://localhost/", "maxTimeout": 10000 }'""")
+    res = json.loads(res)
+    response = res["solution"]["response"]
+    assert "hello world" in response, f"Could not find 'hello world' in response: {response}"
  '';
 }
--- a/nixos/tests/matrix/continuwuity.nix
+++ b/nixos/tests/matrix/continuwuity.nix
@@ -1,4 +1,4 @@
-{ lib, ... }:
+{ lib, pkgs, ... }:
 let
  name = "continuwuity";
  user = "alice";
@@ -11,6 +11,7 @@ in
    continuwuity = {
      services.matrix-continuwuity = {
        enable = true;
+        package = pkgs.matrix-continuwuity_latest;
        settings.global = {
          server_name = name;
          address = [ "0.0.0.0" ];
@@ -20,61 +21,66 @@ in
      };
      networking.firewall.allowedTCPPorts = [ 6167 ];
    };
+
    client =
      { pkgs, ... }:
      {
        environment.systemPackages = [
-          (pkgs.writers.writePython3Bin "do_test" { libraries = [ pkgs.python3Packages.matrix-nio ]; } ''
+          (pkgs.writers.writePython3Bin "do_test" { libraries = [ pkgs.python3Packages.mautrix ]; } ''
            import asyncio
-            import nio
+
+            from mautrix.client import Client
+            from mautrix.types import EventType, RoomFilter, Filter


            async def main() -> None:
                # Connect to continuwuity
-                client = nio.AsyncClient("http://continuwuity:6167", "${user}")
+                client = Client(
+                    mxid="@${user}:${name}",
+                    base_url="http://continuwuity:6167",
+                )

                # Log in as user alice
-                response = await client.login("${pass}")
+                await client.login(password="${pass}")

                # Create a new room
-                response = await client.room_create(federate=False)
-                print("Matrix room create response:", response)
-                assert isinstance(response, nio.RoomCreateResponse)
-                room_id = response.room_id
+                room_id = await client.create_room()
+                print("Created room:", room_id)

                # Join the room
-                response = await client.join(room_id)
-                print("Matrix join response:", response)
-                assert isinstance(response, nio.JoinResponse)
+                await client.join_room_by_id(room_id)
+                print("Joined room")

                # Send a message to the room
-                response = await client.room_send(
-                    room_id=room_id,
-                    message_type="m.room.message",
-                    content={
-                        "msgtype": "m.text",
-                        "body": "Hello continuwuity!"
-                    }
-                )
-                print("Matrix room send response:", response)
-                assert isinstance(response, nio.RoomSendResponse)
+                received = asyncio.Event()
+                msg = "Hello continuwuity!"

-                # Sync responses
-                response = await client.sync(timeout=30000)
-                print("Matrix sync response:", response)
-                assert isinstance(response, nio.SyncResponse)
+                async def on_message(evt):
+                    if (
+                        evt.room_id != room_id
+                        or evt.sender != client.mxid
+                        or evt.type != EventType.ROOM_MESSAGE
+                    ):
+                        return

-                # Check the message was received by continuwuity
-                last_message = response.rooms.join[room_id].timeline.events[-1].body
-                assert last_message == "Hello continuwuity!"
+                    assert evt.content.body == msg
+                    received.set()
+
+                client.add_event_handler(EventType.ROOM_MESSAGE, on_message)
+                sync_task = client.start(Filter(room=RoomFilter(rooms=[room_id])))
+
+                await client.send_text(room_id, msg)
+
+                # Sync until message is received
+                await asyncio.wait_for(received.wait(), timeout=30)

                # Leave the room
-                response = await client.room_leave(room_id)
-                print("Matrix room leave response:", response)
-                assert isinstance(response, nio.RoomLeaveResponse)
+                await client.leave_room(room_id)
+                print("Left room")

                # Close the client
-                await client.close()
+                client.stop()
+                await sync_task


            if __name__ == "__main__":
@@ -96,6 +102,7 @@ in
  '';

  meta.maintainers = with lib.maintainers; [
+    bartoostveen
    nyabinary
    snaki
  ];
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-beta.nix
@@ -10,11 +10,11 @@
 buildMozillaMach rec {
  pname = "firefox-beta";
  binaryName = "firefox-beta";
-  version = "156.0b2";
+  version = "156.0b4";
  applicationName = "Firefox Beta";
  src = fetchurl {
    url = "mirror://mozilla/firefox/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "5b685f8b947af0b519c59a308fba6a41f9481df68b7fb6f4b395707653c3ef1822817d2f867d663081cd2d61c8fd4537f46b8002da84b5efa9b8a57ae9491164";
+    sha512 = "2aa751d66854145bf260dd04fe1473ca20275c02e51c07efdda769d7980cdaee6dc393cac32fe3bb4ed131249fde81e150c284ee38af5fc560da7704947a6453";
  };

  meta = {
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-devedition.nix
@@ -10,13 +10,13 @@
 buildMozillaMach rec {
  pname = "firefox-devedition";
  binaryName = "firefox-devedition";
-  version = "156.0b2";
+  version = "156.0b4";
  applicationName = "Firefox Developer Edition";
  requireSigning = false;
  branding = "browser/branding/aurora";
  src = fetchurl {
    url = "mirror://mozilla/devedition/releases/${version}/source/firefox-${version}.source.tar.xz";
-    sha512 = "683326ff4367f9b807c4c5b93f100970258ada9838da2c597358105a99ff4aa7e33269fe67d6c68d466e2f539d2bea3015457109516af19e1785588ce43426b5";
+    sha512 = "5ebdcd33004516625f90f1862b66198e80b906074371cfa2be22e44666fecbe5f93301290427f2860b45a94918d645ae0a26eed32c78b46136c745b1dcf89a1b";
  };

  # buildMozillaMach sets MOZ_APP_REMOTINGNAME during configuration, but
--- a/pkgs/applications/networking/cluster/rke2/1_34/images-versions.json
+++ b/pkgs/applications/networking/cluster/rke2/1_34/images-versions.json
@@ -1,138 +1,138 @@
 {
  "images-calico-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-calico.linux-amd64.tar.gz",
-    "sha256": "eca4b54a87b17ca7878a90322a76221cc14b0f191db24a88792a31a128444cb7"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-calico.linux-amd64.tar.gz",
+    "sha256": "bf01280d541d3b836a582313eac3d7657ea3d5102cbba829e153d9d73f68d9e1"
  },
  "images-calico-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-calico.linux-amd64.tar.zst",
-    "sha256": "914212fd8288f73361ef29d945b3a2102165df70153fc8c20c180f72704c4da2"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-calico.linux-amd64.tar.zst",
+    "sha256": "ad9f490fabd8686710221994f697a538f75c374d41198d8be4dddd2b8ab20964"
  },
  "images-calico-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-calico.linux-arm64.tar.gz",
-    "sha256": "34c6c98dd024ce7e5ffcc17112988be2ab703c3a8977f01312815bda38df11e5"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-calico.linux-arm64.tar.gz",
+    "sha256": "04a3b7c7d04597a892c693b46082220de96fe23c2ba08862ae99798aa3eaa68d"
  },
  "images-calico-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-calico.linux-arm64.tar.zst",
-    "sha256": "d1aac5a3f88163b5c0a6dd152be8e6e62b05b3fe85ebf9d6288b5de585d9e056"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-calico.linux-arm64.tar.zst",
+    "sha256": "0b5f3c70a24377ebc395676ed13bb7dc258c545f2ab7bdba0d74ed150ad7a5f8"
  },
  "images-canal-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-canal.linux-amd64.tar.gz",
-    "sha256": "9351ecae73961309c566991322839acb0df573f0e826cdeb278babe141357d8b"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-canal.linux-amd64.tar.gz",
+    "sha256": "2a934cd0eb1e736628c30722a514ece6c9c66dbc4463ee3e00392acd9316db26"
  },
  "images-canal-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-canal.linux-amd64.tar.zst",
-    "sha256": "1f2aeec78ca8380b55f8398905e9dbe4af5cbb8b3ae9cb4bdcc46b08dcb75c56"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-canal.linux-amd64.tar.zst",
+    "sha256": "4359b651bfdec8f3bcc01b351b33a55ff21f06b18a767366db6f3800d5750871"
  },
  "images-canal-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-canal.linux-arm64.tar.gz",
-    "sha256": "b52d98c63d46a8b908bbe3fa2a075fb5b7ea4dbb4325f3a9de63dcc4272f04ff"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-canal.linux-arm64.tar.gz",
+    "sha256": "21f22228f27848816c7f5fb21b078dfa842ac2e716a8310fb7a306218a8d79e4"
  },
  "images-canal-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-canal.linux-arm64.tar.zst",
-    "sha256": "3ce45e29db6ef82e475477dd1e4e58049917ffaef7e21b1d7c87b78a10864c48"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-canal.linux-arm64.tar.zst",
+    "sha256": "fdb78292756a38d2136fa2be014d77f29b06d5ffbdfe8e379d9688614abf89e2"
  },
  "images-cilium-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-cilium.linux-amd64.tar.gz",
-    "sha256": "a0acd19bcf7f99321635aaff76abf5b5ab256f31e71957dda22caf5ee97f383d"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-cilium.linux-amd64.tar.gz",
+    "sha256": "db9220609c897176878efe3aff65abc8b32a76ecaac5a80c1c7d61f8ec4f800d"
  },
  "images-cilium-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-cilium.linux-amd64.tar.zst",
-    "sha256": "ed1e42b4c1db97d65f5ab42faf443fd1786af092bd69b931811557beb17875fe"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-cilium.linux-amd64.tar.zst",
+    "sha256": "3f3835bd55f7b02b4365c12b69902fb6943cde22014ed9c91ebfce4386d4d458"
  },
  "images-cilium-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-cilium.linux-arm64.tar.gz",
-    "sha256": "55569b7c58a2cdb2194c14c9b1252fe4545c02c1c0df2e152cf2fa70c29e6e46"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-cilium.linux-arm64.tar.gz",
+    "sha256": "9ecf145d7ced82287354cab8313ee588bce98f81715eaf5e42c6fee1b1d40c0b"
  },
  "images-cilium-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-cilium.linux-arm64.tar.zst",
-    "sha256": "916bc0aac94e499bdd6015ca727b97c39da5c635ed87edfc5bff432e3b93bb6a"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-cilium.linux-arm64.tar.zst",
+    "sha256": "b97c53104b876a7494abd7108573000701766fc1ccfee779a47d021f879d349a"
  },
  "images-core-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-core.linux-amd64.tar.gz",
-    "sha256": "dbc4e96df1cf68bb1554dffcde377cafde6b58afc6a57ff627bffaaab9387c64"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-core.linux-amd64.tar.gz",
+    "sha256": "81945ab99e039dc5f78083b30ec79ad46503bf1897007cb297dc7dc72e0523d5"
  },
  "images-core-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-core.linux-amd64.tar.zst",
-    "sha256": "c98faf27f1867a21fd928185c5b3ce11e58576239724547b14dd714d2cf485f1"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-core.linux-amd64.tar.zst",
+    "sha256": "7a07540b2fa9cefd87ab9d2598e78ef7a7b8a2aa8e12dfb3bf34fa7aa7eedcbf"
  },
  "images-core-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-core.linux-arm64.tar.gz",
-    "sha256": "670909f4bbdf4cae8cd2cd289e127b62753a98a0dde17c94f8287c4f04edb631"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-core.linux-arm64.tar.gz",
+    "sha256": "d52a0baaa2fad9ea031b6a55231167a1cee0135df0d9e7ec456fcdd571db45b4"
  },
  "images-core-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-core.linux-arm64.tar.zst",
-    "sha256": "581e77dfad0c37c8ec8ce21aa62eb04e484476e25ee955e51f2e541bd41eb83e"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-core.linux-arm64.tar.zst",
+    "sha256": "276d52eb5d612558fb796d07a78d6a5acd994335be4c5273adc1b1e010feb5bd"
  },
  "images-flannel-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-flannel.linux-amd64.tar.gz",
-    "sha256": "990ea84921cb04bcc8c4b78e5ef2896a5c1cbc864ca7948af56179f46ea82aed"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-flannel.linux-amd64.tar.gz",
+    "sha256": "55b6af3347987a16d592b814790724c869663ec015088bc8aaaecc3732ee592e"
  },
  "images-flannel-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-flannel.linux-amd64.tar.zst",
-    "sha256": "1da33715d88f49ae0451aca366a7831b758800df23cb86b37798fb4e7893bbd5"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-flannel.linux-amd64.tar.zst",
+    "sha256": "8205dd4dc70b3f2fdb34f4e92c9c46b76ba33ab0953f3852518ee805fdbca905"
  },
  "images-flannel-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-flannel.linux-arm64.tar.gz",
-    "sha256": "b0736b431a1665687a5744307e62e34d98a739c9f28d1b51bbaa3b6d9db81aa7"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-flannel.linux-arm64.tar.gz",
+    "sha256": "15ae6906a8177b8b7829edf35f228fa5791e2993941d3335a59bb4ce985ea6fb"
  },
  "images-flannel-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-flannel.linux-arm64.tar.zst",
-    "sha256": "b3c9944442d8d8070a03349a2c14fea065107fc6fa31a5015d242ada7a11e170"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-flannel.linux-arm64.tar.zst",
+    "sha256": "d833c1d1e13063b25c3d0013a653b1f137b4a020fd97ccfa5519d251f158c69c"
  },
  "images-harvester-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-harvester.linux-amd64.tar.gz",
-    "sha256": "c8129804d926d6916dc17840239dc4ed00dd71dfb9431ef3a52b61e5f763fc9d"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-harvester.linux-amd64.tar.gz",
+    "sha256": "b72890e493a00eec15f2f041ac9285bd29a46f6fabb194e482f374202f3ebd1e"
  },
  "images-harvester-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-harvester.linux-amd64.tar.zst",
-    "sha256": "b0571922737f3b4794880a6a1ed36aecf863fa99756ac97dc3e47e2ba65d84b7"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-harvester.linux-amd64.tar.zst",
+    "sha256": "74a4b8fda0882d61859eb6fb0a4783f798f60d211e32dd2e4f75efc4fe8d805c"
  },
  "images-harvester-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-harvester.linux-arm64.tar.gz",
-    "sha256": "e78cfd46abc07c7330f1a99a2eb1b3b49aab0f4772c027e16e58fbeeabe26936"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-harvester.linux-arm64.tar.gz",
+    "sha256": "e1f0f5a57dc055fd8f7d49e196dbcd5cb1054dc8015fd2cfd5bc6f9946340320"
  },
  "images-harvester-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-harvester.linux-arm64.tar.zst",
-    "sha256": "004a123bc2ae8030a6a79f03a6f20d079f43d040b2730b6bfb573a1d105d89fe"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-harvester.linux-arm64.tar.zst",
+    "sha256": "3d034060ca80754c86ce34519682c5f6f69e28d5bdaedd81d33efbe714824142"
  },
  "images-multus-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-multus.linux-amd64.tar.gz",
-    "sha256": "f5bc06ea799a91fe0d74929f6882591d8b541d785f91959789b3a17fbcf6cfdd"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-multus.linux-amd64.tar.gz",
+    "sha256": "884ad55eb6d4d068ee1de58889f17b2a151bf1c18791c67fad22d0a84f16015b"
  },
  "images-multus-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-multus.linux-amd64.tar.zst",
-    "sha256": "6e5795d1367a04ca096cefaececa0f77b180bd343cd806727ce1712b1d28cc98"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-multus.linux-amd64.tar.zst",
+    "sha256": "1e107e9b71db928d4328332aeaf9ed760e43960839fbdb2a90499fcf6dbec27e"
  },
  "images-multus-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-multus.linux-arm64.tar.gz",
-    "sha256": "03d4f0ded6a8da7007c241cace1cc007c2074b92846e52c2a73f97e2d1c3ed82"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-multus.linux-arm64.tar.gz",
+    "sha256": "548d328ff86381c416dced6fad23f8ceb065d0eacc8815590bb84addf21cf377"
  },
  "images-multus-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-multus.linux-arm64.tar.zst",
-    "sha256": "4c4b241191ec370c9fc2c77ed2b319d8b094a7f4ca35d3a2a1563643865ae283"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-multus.linux-arm64.tar.zst",
+    "sha256": "ddd3887b811ded657376843714675a306b2036955d6106e996fd475a92a447ea"
  },
  "images-traefik-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-traefik.linux-amd64.tar.gz",
-    "sha256": "1febfa1c29687a343e0c6a829100a2e612ba4dbab4050a39d15fdd9706f0cff2"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-traefik.linux-amd64.tar.gz",
+    "sha256": "18506df7d42dee9215adb3e116c59202578e6ef75809a4abc7b42753bc2c7a90"
  },
  "images-traefik-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-traefik.linux-amd64.tar.zst",
-    "sha256": "6dabff733c90a3c2c7304bfe0c530cb6a2304c5a585b0de4fc5f46e700c5fcee"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-traefik.linux-amd64.tar.zst",
+    "sha256": "2734dba5228db1b23c73efef73a7e6a762a3135547a173b769a2060cafb277a2"
  },
  "images-traefik-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-traefik.linux-arm64.tar.gz",
-    "sha256": "705031339da6ff24d83e3cfcaeca01051055f06f125038cc397d753883f0af91"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-traefik.linux-arm64.tar.gz",
+    "sha256": "a4034ce89c2fa2dc0761db6453e063b4deb5b63ddade5a99c46a67a4c8e2402b"
  },
  "images-traefik-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-traefik.linux-arm64.tar.zst",
-    "sha256": "d71e455ce8358e31ed590a7a264d9a3ae212c955df8f36cea314243533fe4d83"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-traefik.linux-arm64.tar.zst",
+    "sha256": "de2bcbe1cbe5c2e55f2c23961d3f55017db04a99fc03da294f0a4c18860d14c2"
  },
  "images-vsphere-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.gz",
-    "sha256": "c1ee6654b45f0106e00aa4cd2b423c8b35c79964470419e4c012d963c72ed0f3"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.gz",
+    "sha256": "7074a9bae6fb6b0fa39099a8e31fe8d97daddc1b677a9bbec62132ecc8a5cf7a"
  },
  "images-vsphere-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.34.10%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.zst",
-    "sha256": "19afe144421cc7f430adb20a91e64ae91f0fac2ea6b7aeab6b480adee21f4fad"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.34.11%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.zst",
+    "sha256": "f5a6fd0224a60693fa23cb917fed3d2c9e8ef80dfb3d18b23b70077c007e9ead"
  }
 }
--- a/pkgs/applications/networking/cluster/rke2/1_34/versions.nix
+++ b/pkgs/applications/networking/cluster/rke2/1_34/versions.nix
@@ -1,13 +1,13 @@
 {
-  rke2Version = "1.34.10+rke2r1";
-  rke2Commit = "d419f09226d50a4777d348e5c53ea1bce3849b77";
-  rke2TarballHash = "sha256-upkkAdlrAkj6RLsIbkNB5KdQylxvb1P47x1AfDcpxfY=";
-  rke2VendorHash = "sha256-ep2qR8V3V1F7PHj9rU9hOZb0o4GQVUdtGHyAEWgpM2A=";
-  k8sImageTag = "v1.34.10-rke2r1-build20260723";
-  etcdVersion = "v3.6.14-k3s1-build20260723";
+  rke2Version = "1.34.11+rke2r1";
+  rke2Commit = "2506fee512985398ca0b50d875c3df73069763ce";
+  rke2TarballHash = "sha256-jrXi8KZmq+yGSKaVUUsZ+mNKzV1cSTOLPkPFye+OdpI=";
+  rke2VendorHash = "sha256-AYsoVlykxpyIeVpuXpEY4uKJ3NyzRlOdOiJJl22m8VA=";
+  k8sImageTag = "v1.34.11-rke2r1-build20260821";
+  etcdVersion = "v3.6.14-k3s1-build20260819";
  pauseVersion = "3.10.2";
-  ccmVersion = "v1.34.9-0.20260610230036-3060dff9c388-build20260710";
-  dockerizedVersion = "v1.34.10-rke2r1";
-  helmJobVersion = "v0.13.3-build20260727";
+  ccmVersion = "v1.34.11-0.20260817193950-75826e8afefa-build20260820";
+  dockerizedVersion = "v1.34.11-rke2r1";
+  helmJobVersion = "v0.13.3-build20260820";
  imagesVersions = with builtins; fromJSON (readFile ./images-versions.json);
 }
--- a/pkgs/applications/networking/cluster/rke2/1_35/images-versions.json
+++ b/pkgs/applications/networking/cluster/rke2/1_35/images-versions.json
@@ -1,138 +1,138 @@
 {
  "images-calico-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-calico.linux-amd64.tar.gz",
-    "sha256": "91e39707c7be99f988db35d2c9a203c2f7ccdfd8419c1a7e7cf9c869a44e82e0"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-calico.linux-amd64.tar.gz",
+    "sha256": "5f4fc4e757864e6e373815b68fcd579f845bff584ee0bc9f0dc97f9e260717d9"
  },
  "images-calico-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-calico.linux-amd64.tar.zst",
-    "sha256": "263eef9bc34b84d25f69d871c5c6b0d968f57b128501c56cd75be76fcd34a5ff"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-calico.linux-amd64.tar.zst",
+    "sha256": "87344e7c6eea1a2fe1ca029f307d04caece4fe40e7c50fb1ab16fa1d26b23f6b"
  },
  "images-calico-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-calico.linux-arm64.tar.gz",
-    "sha256": "fb88b8044e1143eb65d6d167917c3c5effb0ffbdc6dbc3d5bb87f7b9d73d91d5"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-calico.linux-arm64.tar.gz",
+    "sha256": "5ac774802ca0ac3471b2ae2a75e00c1f7a76d32df4e5a3bc18ba717ab2fcd69e"
  },
  "images-calico-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-calico.linux-arm64.tar.zst",
-    "sha256": "257222e58aa7429c53edc52f647a2c6ce3932b491b2943c3e726afe91219614f"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-calico.linux-arm64.tar.zst",
+    "sha256": "e21343847eeca388e8dcdf4d088578f232aba7a51e5c104f155d6a143a18111a"
  },
  "images-canal-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-canal.linux-amd64.tar.gz",
-    "sha256": "af9fe952ce6dcfb1192d40ca01d0d9a7f29477fef21bdae96490c2192f2ded74"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-canal.linux-amd64.tar.gz",
+    "sha256": "6f918827f8ab8d99573de7671649ccb405fe1826ebb9f4d3257e94468225b46d"
  },
  "images-canal-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-canal.linux-amd64.tar.zst",
-    "sha256": "9e89572eb2a5958b456dc1ca418bdbdbd694a176dd2cf41e6df55fe0488156ba"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-canal.linux-amd64.tar.zst",
+    "sha256": "4359b651bfdec8f3bcc01b351b33a55ff21f06b18a767366db6f3800d5750871"
  },
  "images-canal-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-canal.linux-arm64.tar.gz",
-    "sha256": "b52d98c63d46a8b908bbe3fa2a075fb5b7ea4dbb4325f3a9de63dcc4272f04ff"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-canal.linux-arm64.tar.gz",
+    "sha256": "aad7a91c4fdeb798d9d5f045536901269a07fb97fea2e87edf2d0c7959d00e5d"
  },
  "images-canal-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-canal.linux-arm64.tar.zst",
-    "sha256": "3ce45e29db6ef82e475477dd1e4e58049917ffaef7e21b1d7c87b78a10864c48"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-canal.linux-arm64.tar.zst",
+    "sha256": "fdb78292756a38d2136fa2be014d77f29b06d5ffbdfe8e379d9688614abf89e2"
  },
  "images-cilium-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-cilium.linux-amd64.tar.gz",
-    "sha256": "f943fd65168368d4b76ede3d809daad8733126df8d1bb809cf841b50b0402e94"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-cilium.linux-amd64.tar.gz",
+    "sha256": "2660b7803f26855083b72461ecea9489ab93d3f148ef38f0cadbf46555cc3799"
  },
  "images-cilium-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-cilium.linux-amd64.tar.zst",
-    "sha256": "dc9cb3d8af8db6a0a0312e3be3e31b1fa44a20731b8d3f7a1e30e8481940c12c"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-cilium.linux-amd64.tar.zst",
+    "sha256": "e474738e8dacad29c2b703e1745ad92ff746d1c2b10eecae726aedaffb904c72"
  },
  "images-cilium-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-cilium.linux-arm64.tar.gz",
-    "sha256": "bcfee32f8a9bc0c62ad2b747f4fb36bffbdb8cee5e6d4f93827325514ebd9f7d"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-cilium.linux-arm64.tar.gz",
+    "sha256": "0fec5acb8c9f5bd847a95b39175a901315228b98db1b4bbcfc766863cf10e282"
  },
  "images-cilium-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-cilium.linux-arm64.tar.zst",
-    "sha256": "61d4038542e15892ecb122d99cc22226fad4cf4877e6bba9d49406d514624a8d"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-cilium.linux-arm64.tar.zst",
+    "sha256": "1a1e4fc3017a203d1b1098aaee30a2dcf2afd1059b88ad1d4772531c8e4f97ad"
  },
  "images-core-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-core.linux-amd64.tar.gz",
-    "sha256": "606d9e6960cf1496668eab999a9bec2eee052027e90a750e2c99b4f185382c4a"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-core.linux-amd64.tar.gz",
+    "sha256": "b42c081fd85474f8f994089de514ccc9930d491671ed4dd2e25b65be3a3b1e02"
  },
  "images-core-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-core.linux-amd64.tar.zst",
-    "sha256": "f7d4aad521229dfa820a3dea2365582681aa1aa4a076bd02122b0ac0eb79e265"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-core.linux-amd64.tar.zst",
+    "sha256": "1fe8f2b57142713b545c94586833088eed92fdd2782046bd9e71fff0e7aafa93"
  },
  "images-core-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-core.linux-arm64.tar.gz",
-    "sha256": "5d3ee44b2d6e3d50258b5f99fdc8356dd7b1eb00198fee429bebe4881375861c"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-core.linux-arm64.tar.gz",
+    "sha256": "4cc17307f939be90df7a978045d51247f39e7bb4e8ad491b0735eebd9c92a64d"
  },
  "images-core-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-core.linux-arm64.tar.zst",
-    "sha256": "87fe42d4052ad62cf25d0cd6bd23a9e8e2adf36961583c25a48d10dac8f39d4e"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-core.linux-arm64.tar.zst",
+    "sha256": "85116f76f82643bd13ddf09a69a00aaa16e73d7b94be41c20cf69ef403e314da"
  },
  "images-flannel-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-flannel.linux-amd64.tar.gz",
-    "sha256": "eda0f523a6b5021bf9a59f7e9e9c0d564f472c22615e83f101ea68027478007c"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-flannel.linux-amd64.tar.gz",
+    "sha256": "4bd430fdf2faa193a584fb0b083b937d297506515117c149623a07eab373f370"
  },
  "images-flannel-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-flannel.linux-amd64.tar.zst",
-    "sha256": "1da33715d88f49ae0451aca366a7831b758800df23cb86b37798fb4e7893bbd5"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-flannel.linux-amd64.tar.zst",
+    "sha256": "775d3fc9f321380e01810e13c66d9c974307f70ca18af9bec2d75a86eb5c4d33"
  },
  "images-flannel-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-flannel.linux-arm64.tar.gz",
-    "sha256": "49a0914944127d296890d86686642392f6ceb7d220d05412954aea136d019227"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-flannel.linux-arm64.tar.gz",
+    "sha256": "24a5c8e92a3743ea9d0a776e5011ed41eb3885e3f1c85381ca794abb656e966a"
  },
  "images-flannel-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-flannel.linux-arm64.tar.zst",
-    "sha256": "b3c9944442d8d8070a03349a2c14fea065107fc6fa31a5015d242ada7a11e170"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-flannel.linux-arm64.tar.zst",
+    "sha256": "d833c1d1e13063b25c3d0013a653b1f137b4a020fd97ccfa5519d251f158c69c"
  },
  "images-harvester-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-harvester.linux-amd64.tar.gz",
-    "sha256": "dc8586e214ac70a896fa4aab6392ea20e44b0ba078f059fea7470c055558682d"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-harvester.linux-amd64.tar.gz",
+    "sha256": "006d72a46bfe1e703c16bab8740a961ad965f673eff98d4625006294f7294a3a"
  },
  "images-harvester-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-harvester.linux-amd64.tar.zst",
-    "sha256": "fcb029dd456d0a9137714aae73d0b3edcbd400955425a5b9df1c8e7cedc06154"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-harvester.linux-amd64.tar.zst",
+    "sha256": "20c0651a945543f61115f862288baf4ea8c7dd79973dfab6146a4883ea83f15e"
  },
  "images-harvester-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-harvester.linux-arm64.tar.gz",
-    "sha256": "3b543d0099c5e4b42c5a8db5610a620e25f554027fea964ad31f3011125d81ed"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-harvester.linux-arm64.tar.gz",
+    "sha256": "b0436e330f1c898ef63d12160eeadb49db725c809ad3046d37f67121a3311a45"
  },
  "images-harvester-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-harvester.linux-arm64.tar.zst",
-    "sha256": "b55b3c2f9c36a3a9907bf7338eaf83803cb8a851ab18475fa3f9b31262f8c3d2"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-harvester.linux-arm64.tar.zst",
+    "sha256": "8c2809abe3fad464db1d0c24549f6278ddfdf362c6180d33f612003196f3da8f"
  },
  "images-multus-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-multus.linux-amd64.tar.gz",
-    "sha256": "712a02ff2e07b34ac0f720126d235b4cb86eacac9ede923922f43db696890280"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-multus.linux-amd64.tar.gz",
+    "sha256": "77c59e9f0c7cb58eef1f7f2dd505bb71f432433ee11b52d28c7db3dc24c2af5e"
  },
  "images-multus-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-multus.linux-amd64.tar.zst",
-    "sha256": "d29151e7c0fc86483bea1e146ea3e0186a6356f46757849fa67bd4e372d11268"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-multus.linux-amd64.tar.zst",
+    "sha256": "392fb8a1c17ffe909f8a17d05c4e624bae74a73fde220bc19c8d105f51f30b27"
  },
  "images-multus-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-multus.linux-arm64.tar.gz",
-    "sha256": "e13eddf16db1f7d1ccdf98b12df763bdebe89c10201ab1e824038406464e0706"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-multus.linux-arm64.tar.gz",
+    "sha256": "ae44bccc910e9978d53583c139ec9d6c5ca5c3a4210f91228e3e9bc341a16f14"
  },
  "images-multus-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-multus.linux-arm64.tar.zst",
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-multus.linux-arm64.tar.zst",
    "sha256": "4c17856eccd8855f8dc5f9b2d34b8d24e2f650c6894f19d6bb3f0c5a7c46f052"
  },
  "images-traefik-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-traefik.linux-amd64.tar.gz",
-    "sha256": "acf5461ddaf78e88fd10d1a8897836298d68f3b1a765e1c4ef02e0b5701d7e55"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-traefik.linux-amd64.tar.gz",
+    "sha256": "e711fb5cf94a24b67febd46d9ea3ea477d95212adbefa43056e25685aacd12ec"
  },
  "images-traefik-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-traefik.linux-amd64.tar.zst",
-    "sha256": "6dabff733c90a3c2c7304bfe0c530cb6a2304c5a585b0de4fc5f46e700c5fcee"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-traefik.linux-amd64.tar.zst",
+    "sha256": "2734dba5228db1b23c73efef73a7e6a762a3135547a173b769a2060cafb277a2"
  },
  "images-traefik-linux-arm64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-traefik.linux-arm64.tar.gz",
-    "sha256": "f52d58a9d3926ee719ddd26f20c683b5584c6b5debdca085224d492ff7cf959b"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-traefik.linux-arm64.tar.gz",
+    "sha256": "a4034ce89c2fa2dc0761db6453e063b4deb5b63ddade5a99c46a67a4c8e2402b"
  },
  "images-traefik-linux-arm64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-traefik.linux-arm64.tar.zst",
-    "sha256": "d71e455ce8358e31ed590a7a264d9a3ae212c955df8f36cea314243533fe4d83"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-traefik.linux-arm64.tar.zst",
+    "sha256": "de2bcbe1cbe5c2e55f2c23961d3f55017db04a99fc03da294f0a4c18860d14c2"
  },
  "images-vsphere-linux-amd64-tar-gz": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.gz",
-    "sha256": "9ccc00fd7c728f9db168a70c8ee25875c7122e101adcd089876345f8963f7331"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.gz",
+    "sha256": "bcec731e66b1300ca93a1b6786af5fc49f2f749d6f8de92fd20271c4235b0e75"
  },
  "images-vsphere-linux-amd64-tar-zst": {
-    "url": "https://github.com/rancher/rke2/releases/download/v1.35.7%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.zst",
-    "sha256": "75becdf7144effe5894eef6423f2e6ea8c8549bfdf315bdff1a2cb64c41c2b2d"
+    "url": "https://github.com/rancher/rke2/releases/download/v1.35.8%2Brke2r1/rke2-images-vsphere.linux-amd64.tar.zst",
+    "sha256": "13d4620f5dbb820ad09a910fdb6186db9c9ba0a51e335e6fe0f27b2fbd7d9416"
  }
 }
--- a/pkgs/applications/networking/cluster/rke2/1_35/versions.nix
+++ b/pkgs/applications/networking/cluster/rke2/1_35/versions.nix
@@ -1,13 +1,13 @@
 {
-  rke2Version = "1.35.7+rke2r1";
-  rke2Commit = "382a8b31a8fd78e376ab6f02c4bb0ec5592aada2";
-  rke2TarballHash = "sha256-+GGX3vfd3JwT+i1ilNx1K4CJV9qlTy9kuOfvA9k21a4=";
-  rke2VendorHash = "sha256-OR3BT9/n/LDn9Ngt0/eF2rNfvJmShvTVcWVBVYy2a+Q=";
-  k8sImageTag = "v1.35.7-rke2r1-build20260723";
-  etcdVersion = "v3.6.14-k3s1-build20260723";
+  rke2Version = "1.35.8+rke2r1";
+  rke2Commit = "0fec82ea2fa6c7b25b7a3fe3cd990fbecc07e1bb";
+  rke2TarballHash = "sha256-WtdKeJ/AbUJaY+ovYZAEpDpWNXYFvJwkPf2V533cIn8=";
+  rke2VendorHash = "sha256-+OaVavHIG6Xx3bOBi90PXKI28dSQWtKHV8A+7EbbF7E=";
+  k8sImageTag = "v1.35.8-rke2r1-build20260821";
+  etcdVersion = "v3.6.14-k3s1-build20260819";
  pauseVersion = "3.10.2";
-  ccmVersion = "v1.35.6-0.20260610221957-158346759a70-build20260710";
-  dockerizedVersion = "v1.35.7-rke2r1";
-  helmJobVersion = "v0.13.3-build20260727";
+  ccmVersion = "v1.35.8-0.20260817193936-20fc9c33a412-build20260820";
+  dockerizedVersion = "v1.35.8-rke2r1";
+  helmJobVersion = "v0.13.3-build20260820";
  imagesVersions = with builtins; fromJSON (readFile ./images-versions.json);
 }
--- a/pkgs/applications/networking/cluster/rke2/default.nix
+++ b/pkgs/applications/networking/cluster/rke2/default.nix
@@ -5,7 +5,9 @@ let
  extraArgs = removeAttrs args [ "callPackage" ];
 in
 rec {
-  rke2_1_33 = common (import ./1_33/versions.nix) extraArgs;
+  rke2_1_33 = (common (import ./1_33/versions.nix) extraArgs).overrideAttrs {
+    meta.knownVulnerabilities = [ "rke2_1_33 has reached end-of-life on 2026-06-28" ];
+  };

  rke2_1_34 = common (import ./1_34/versions.nix) extraArgs;

--- a/pkgs/by-name/co/cockpit-files/package.nix
+++ b/pkgs/by-name/co/cockpit-files/package.nix
@@ -11,13 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cockpit-files";
-  version = "40";
+  version = "45";

  src = fetchFromGitHub {
    owner = "cockpit-project";
    repo = "cockpit-files";
    tag = finalAttrs.version;
-    hash = "sha256-Mofw8hn/+NtkqFqe2MDI+hp/MyTwXDteY/hv3GofIPs=";
+    hash = "sha256-+ubt2tROkxpuWMIwUD81EhBJyGfG1+a5QLf3G5P8G9Y=";

    fetchSubmodules = true;
    postFetch = "cp $out/node_modules/.package-lock.json $out/package-lock.json";
--- a/pkgs/by-name/co/cockpit-machines/package.nix
+++ b/pkgs/by-name/co/cockpit-machines/package.nix
@@ -13,13 +13,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cockpit-machines";
-  version = "352";
+  version = "357";

  src = fetchFromGitHub {
    owner = "cockpit-project";
    repo = "cockpit-machines";
    tag = finalAttrs.version;
-    hash = "sha256-wDDskuvGVq5MWvi+3+3OXpaswPvea8+NDcic70GiYkg=";
+    hash = "sha256-RuMmBqx+Fm+qHLxFct5Kc2zW98EBHQpK77zvCkAQ+24=";

    fetchSubmodules = true;
    postFetch = "cp $out/node_modules/.package-lock.json $out/package-lock.json";
--- a/pkgs/by-name/co/cockpit-podman/package.nix
+++ b/pkgs/by-name/co/cockpit-podman/package.nix
@@ -12,13 +12,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "cockpit-podman";
-  version = "125";
+  version = "131";

  src = fetchFromGitHub {
    owner = "cockpit-project";
    repo = "cockpit-podman";
    tag = finalAttrs.version;
-    hash = "sha256-8YKqcm+IEhZwCPdNrMceAXdoBRS5xyRxrQM1FDNCANk=";
+    hash = "sha256-+djsTOaE8tY2pn5O7KWNHdtqEogDEPUETNeWt3bzdhU=";

    fetchSubmodules = true;
    postFetch = "cp $out/node_modules/.package-lock.json $out/package-lock.json";
--- a/pkgs/by-name/co/cockpit/package.nix
+++ b/pkgs/by-name/co/cockpit/package.nix
@@ -54,13 +54,13 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "cockpit";
-  version = "362";
+  version = "368";

  src = fetchFromGitHub {
    owner = "cockpit-project";
    repo = "cockpit";
    tag = finalAttrs.version;
-    hash = "sha256-Aos7jQ9T8q/ZYZZGXZrSQzTWXXIrAcu3OorJ/Utkq28=";
+    hash = "sha256-2bFQwK5L0S84nLSkUeHmbNgBkjBJIxR88t/21h5jmps=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/el/element-desktop/package.nix
+++ b/pkgs/by-name/el/element-desktop/package.nix
@@ -30,13 +30,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "element-desktop";
-  version = "1.12.28";
+  version = "1.12.29";

  src = fetchFromGitHub {
    owner = "element-hq";
    repo = "element-web";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-goP/f1Go7227R2euXu8aJrwHeUp84DQ+18ztyf4uXhM=";
+    hash = "sha256-0LiasFrVMnMX1Z4TcP+Eti58X7+ICksqKnerQKj2ayI=";
  };

  pnpmDeps = fetchPnpmDeps {
@@ -155,7 +155,7 @@ stdenv.mkDerivation (finalAttrs: {
  '';

  # The desktop item properties should be kept in sync with data from upstream:
-  # https://github.com/element-hq/element-desktop/blob/develop/package.json
+  # https://github.com/element-hq/element-web/blob/develop/apps/desktop/package.json
  desktopItems = [
    (makeDesktopItem {
      name = "element-desktop";
--- a/pkgs/by-name/el/element-web-unwrapped/package.nix
+++ b/pkgs/by-name/el/element-web-unwrapped/package.nix
@@ -25,13 +25,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "element-web";
-  version = "1.12.28";
+  version = "1.12.29";

  src = fetchFromGitHub {
    owner = "element-hq";
    repo = "element-web";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-goP/f1Go7227R2euXu8aJrwHeUp84DQ+18ztyf4uXhM=";
+    hash = "sha256-0LiasFrVMnMX1Z4TcP+Eti58X7+ICksqKnerQKj2ayI=";
  };

  pnpmDeps = fetchPnpmDeps {
--- a/pkgs/by-name/fl/flake-checker/package.nix
+++ b/pkgs/by-name/fl/flake-checker/package.nix
@@ -6,16 +6,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "flake-checker";
-  version = "0.2.13";
+  version = "0.2.14";

  src = fetchFromGitHub {
    owner = "DeterminateSystems";
    repo = "flake-checker";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-QE/Druzo/EDiuh7Vb+kipPgUxkIRPLsHFMSpSRMFIVw=";
+    hash = "sha256-MUbF2mOrcoODe26j0OaXHLk73yFhB+0/d2yPaeBEi6M=";
  };

-  cargoHash = "sha256-kKEHYKXtccXRsa1cON0oMHOWagi3mVdnf3pEgkoNn/k=";
+  cargoHash = "sha256-toC9qMq06Grh6NJZZUb7cbQdNeI7lwqDqbJO85a3zwk=";

  meta = {
    description = "Health checks for your Nix flakes";
--- a/pkgs/by-name/hu/hugo/package.nix
+++ b/pkgs/by-name/hu/hugo/package.nix
@@ -1,7 +1,7 @@
 {
  stdenv,
  lib,
-  buildGoModule,
+  buildGo127Module,
  fetchFromGitHub,
  installShellFiles,
  buildPackages,
@@ -9,18 +9,18 @@
  nix-update-script,
 }:

-buildGoModule (finalAttrs: {
+buildGo127Module (finalAttrs: {
  pname = "hugo";
-  version = "0.163.3";
+  version = "0.166.0";

  src = fetchFromGitHub {
    owner = "gohugoio";
    repo = "hugo";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-o8MoGrdOXBN/HkcuRsHyyyFLvPvNo3PI0oWBlO6Xfpw=";
+    hash = "sha256-IzkwqfoqIscUI3EboIE3zHd0CsEUfa9JnoQ4yk6oIOg=";
  };

-  vendorHash = "sha256-Bn+RA+EHd3gAKL4N/ibydX7yWNKOSYnIl2pfecfOu1k=";
+  vendorHash = "sha256-lqhBX8lmDHHCgjqdyQ6lAl6yHOZR0j04QJi5OkB5VKA=";

  checkFlags =
    let
@@ -73,7 +73,7 @@ buildGoModule (finalAttrs: {
    versionCheckHook
  ];
  doInstallCheck = true;
-  versionCheckProgram = "${placeholder "out"}/bin/hugo";
+  versionCheckProgram = "${placeholder "out"}/bin/${finalAttrs.meta.mainProgram}";
  versionCheckProgramArg = "version";

  passthru.updateScript = nix-update-script { };
--- a/pkgs/by-name/ma/mago/package.nix
+++ b/pkgs/by-name/ma/mago/package.nix
@@ -11,17 +11,17 @@

 rustPackages_1_97.rustPlatform.buildRustPackage (finalAttrs: {
  pname = "mago";
-  version = "1.47.6";
+  version = "1.50.0";

  src = fetchFromGitHub {
    owner = "carthage-software";
    repo = "mago";
    tag = finalAttrs.version;
-    hash = "sha256-stb+grYjtflzM90qCK8S/uIQVnOuenhIsQlN+zBhm0g=";
+    hash = "sha256-Dk92uB9+y/E0l9Et2RbxH/u7rk5owyEYJbIFUWnko8I=";
    forceFetchGit = true; # Does not download all files otherwise
  };

-  cargoHash = "sha256-f+EjMcImL5hwN06/hUn0Y3jlk1vxcxqqNwyrpGxL3T8=";
+  cargoHash = "sha256-oIxNpmw3q1DvBlaURUl8+AKud+gbGk8jD9Vw8utVRO4=";

  env = {
    # Get openssl-sys to use pkg-config
--- a/pkgs/by-name/ma/masterpdfeditor/package.nix
+++ b/pkgs/by-name/ma/masterpdfeditor/package.nix
@@ -21,11 +21,15 @@ stdenv.mkDerivation (finalAttrs: {
  src =
    let
      selectSystem = attrs: attrs.${stdenv.hostPlatform.system};
+      makeUrls = url: [
+        url
+        "https://web.archive.org/web/${url}"
+      ];
    in
    fetchurl {
-      url = selectSystem {
-        x86_64-linux = "https://code-industry.net/public/master-pdf-editor-${finalAttrs.version}-qt5.x86_64-qt_include.tar.gz";
-        aarch64-linux = "https://code-industry.net/public/master-pdf-editor-${finalAttrs.version}-qt5.arm64.tar.gz";
+      urls = selectSystem {
+        x86_64-linux = makeUrls "https://code-industry.net/public/master-pdf-editor-${finalAttrs.version}-qt5.x86_64-qt_include.tar.gz";
+        aarch64-linux = makeUrls "https://code-industry.net/public/master-pdf-editor-${finalAttrs.version}-qt5.arm64.tar.gz";
      };
      hash = selectSystem {
        x86_64-linux = "sha256-ksVuJyuImstESVwHUmOUv6aERosg6g5bSsRvPSf5EVM=";
--- a/pkgs/by-name/ma/matrix-continuwuity/package.nix
+++ b/pkgs/by-name/ma/matrix-continuwuity/package.nix
@@ -100,5 +100,18 @@ rustPlatform.buildRustPackage (finalAttrs: {
    ];
    # Not a typo, continuwuity is a drop-in replacement for conduwuit.
    mainProgram = "conduwuit";
+    knownVulnerabilities = [
+      ''
+        Continuwuity 0.5.10 can no longer be securely ran, as it contains a critical security-related bug that is currently embargoed at the time of writing.
+        Continuwuity internally tracks this as SEC8, see also: https://forgejo.ellis.link/continuwuation/continuwuity/releases/tag/v26.9.1
+
+        The latest version of Continuwuity has been moved to `matrix-continuwuity_latest` as to not introduce breaking changes.
+        It is highly advisable to upgrade to this version as fast as possible. When deploying Continuwuity using the NixOS module, you may do so using:
+
+        `services.matrix-continuwuity.package = pkgs.matrix-continuwuity_latest`.
+
+        The most notable breaking change of the 26.x release is the removal of LDAP.
+      ''
+    ];
  };
 })
--- a/pkgs/by-name/ma/matrix-continuwuity_latest/package.nix
+++ b/pkgs/by-name/ma/matrix-continuwuity_latest/package.nix
@@ -0,0 +1,80 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitea,
+  pkg-config,
+  bzip2,
+  zstd,
+  stdenv,
+  callPackage,
+  nix-update-script,
+  testers,
+  matrix-continuwuity_latest,
+  rust-jemalloc-sys-unprefixed,
+  liburing,
+  nixosTests,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "matrix-continuwuity";
+  version = "26.9.1";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitea {
+    domain = "forgejo.ellis.link";
+    owner = "continuwuation";
+    repo = "continuwuity";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-z9iOdSjTvv+kDJaoAyKTzrY0ge2KM90H4tM8ir52RMQ=";
+  };
+
+  cargoHash = "sha256-dbTrgE0+OzHhD3rjQciZfRIBivvZa0YZyKpTP8XOzZI=";
+
+  nativeBuildInputs = [
+    pkg-config
+    rustPlatform.bindgenHook
+  ];
+
+  buildInputs = [
+    bzip2
+    zstd
+    rust-jemalloc-sys-unprefixed
+    liburing
+  ];
+
+  env = {
+    ZSTD_SYS_USE_PKG_CONFIG = true;
+    ROCKSDB_INCLUDE_DIR = "${finalAttrs.rocksdb}/include";
+    ROCKSDB_LIB_DIR = "${finalAttrs.rocksdb}/lib";
+  };
+
+  rocksdb = callPackage ./rocksdb.nix { }; # make used rocksdb version available (e.g., for backup scripts)
+
+  passthru = {
+    updateScript = nix-update-script { };
+    tests = {
+      version = testers.testVersion {
+        inherit (finalAttrs) version;
+        package = matrix-continuwuity_latest;
+      };
+    }
+    // lib.optionalAttrs stdenv.hostPlatform.isLinux {
+      inherit (nixosTests) matrix-continuwuity;
+    };
+  };
+
+  meta = {
+    description = "Matrix homeserver written in Rust, forked from conduwuit";
+    homepage = "https://continuwuity.org/";
+    changelog = "https://forgejo.ellis.link/continuwuation/continuwuity/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [
+      bartoostveen
+      nyabinary
+      snaki
+    ];
+    # Not a typo, continuwuity is a drop-in replacement for conduwuit.
+    mainProgram = "conduwuit";
+  };
+})
--- a/pkgs/by-name/ma/matrix-continuwuity_latest/rocksdb.nix
+++ b/pkgs/by-name/ma/matrix-continuwuity_latest/rocksdb.nix
@@ -0,0 +1,26 @@
+{
+  stdenv,
+  fetchFromGitea,
+  rocksdb,
+  rust-jemalloc-sys-unprefixed,
+}:
+
+(rocksdb.override {
+  # rocksdb does not support prefixed jemalloc, which is required on darwin
+  enableJemalloc = !stdenv.hostPlatform.isDarwin;
+  jemalloc = rust-jemalloc-sys-unprefixed;
+}).overrideAttrs
+  (
+    final: old: {
+      version = "11.1.1";
+      src = fetchFromGitea {
+        domain = "forgejo.ellis.link";
+        owner = "continuwuation";
+        repo = "rocksdb";
+        rev = "3756b2b905e13216d8b56bcc783d814e7b073aff";
+        hash = "sha256-rSv4fr2bf9JJwdodgeuPCuceeh7k97KVxrAOC0wyPQY=";
+      };
+
+      patches = [ ];
+    }
+  )
--- a/pkgs/by-name/ma/mattermostLatest/package.nix
+++ b/pkgs/by-name/ma/mattermostLatest/package.nix
@@ -15,10 +15,10 @@ mattermost.override (
      # and make sure the version regex is up to date here.
      # Ensure you also check ../mattermost/package.nix for ESR releases.
      regex = "^v(11\\.[0-9]+\\.[0-9]+)$";
-      version = "11.10.2";
-      srcHash = "sha256-d4sOH9L2vawyiRLXIhZLzEqExiYbrdy/h0v4GZW7DNc=";
-      vendorHash = "sha256-k3JPDzrZzLeKb20o2aLZR/TX7dN7nhpQs6UZ5olvV94=";
-      npmDepsHash = "sha256-jDGUbBwxjZ50bbbnUJVMCzKJMlHYhUKy7Be9zsWjMqg=";
+      version = "11.11.0";
+      srcHash = "sha256-QB7C3TCmrUgTUST6hUEIM143cUfiORyaYnP6I2t37b8=";
+      vendorHash = "sha256-FNZ6030d8Tro06ZlycN9lU9gd+7oxfuFciJOeLv+enQ=";
+      npmDepsHash = "sha256-5Bl+enzE3i8GBPjTtudvrOM9DjfNHL3CkMbNMXSH4AU=";
      autoUpdate = ./package.nix;
    };
  }
--- a/pkgs/by-name/ne/nezha/package.nix
+++ b/pkgs/by-name/ne/nezha/package.nix
@@ -49,13 +49,13 @@ let
 in
 buildGoModule (finalAttrs: {
  pname = "nezha";
-  version = "2.3.12";
+  version = "2.3.14";

  src = fetchFromGitHub {
    owner = "nezhahq";
    repo = "nezha";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-XgTbDpfGYbpiFseJjwraDg3svyT0EpgvoY2dvLbtZtQ=";
+    hash = "sha256-xWJfTop9U3Ms5oeTD4Sdn6ZmESjrx5H9WnAn9KJq608=";
  };

  proxyVendor = true;
--- a/pkgs/by-name/op/openbao/package.nix
+++ b/pkgs/by-name/op/openbao/package.nix
@@ -14,16 +14,16 @@

 buildGoModule (finalAttrs: {
  pname = "openbao";
-  version = "2.6.2";
+  version = "2.6.3";

  src = fetchFromGitHub {
    owner = "openbao";
    repo = "openbao";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-iFOah7LkuiL4MGhi6ANpgCYDYQl33gF+F4agdKLEFTk=";
+    hash = "sha256-YqrwQQYfJzd3YaQx4ic7nE3/td/R+V0z32uxdL0oSIc=";
  };

-  vendorHash = "sha256-gORWU9Yn+AX00mQD5uq9k7ksbkLVWv8W2N4IxEOsE88=";
+  vendorHash = "sha256-v2UbwSsH6jgxFmXcoSbynD/iB2+4JFw3B0lcztXfmcc=";

  proxyVendor = true;

--- a/pkgs/by-name/pg/pgschema/package.nix
+++ b/pkgs/by-name/pg/pgschema/package.nix
@@ -10,14 +10,14 @@

 buildGoModule (finalAttrs: {
  pname = "pgschema";
-  version = "1.13.0";
+  version = "1.13.1";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "pgplex";
    repo = "pgschema";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-w1MLl9NFAS+7a1CzS5IMQUw6BzL8sifNPdnStLySFVg=";
+    hash = "sha256-hSS+S16LidfSEaSJPkJiaDTdtjaJS1h3wORqpZYyT44=";
  };

  # Adapted from $src/nix/pgschema.nix
--- a/pkgs/by-name/po/poco/package.nix
+++ b/pkgs/by-name/po/poco/package.nix
@@ -20,12 +20,12 @@
 stdenv.mkDerivation rec {
  pname = "poco";

-  version = "1.15.3";
+  version = "1.15.4";

  src = fetchFromGitHub {
    owner = "pocoproject";
    repo = "poco";
-    hash = "sha256-mUONqjbKHvdsTM6zk9/QLEr1lVV6f9I/shLW2B8iqMk=";
+    hash = "sha256-IpBwGwPY873EqWXOYFOBiuNrJBu1r+dBTOByHZ9Lnhg=";
    tag = "poco-${version}-release";
  };

--- a/pkgs/by-name/ve/vencord/package.nix
+++ b/pkgs/by-name/ve/vencord/package.nix
@@ -22,13 +22,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "vencord";
-  version = "1.15.6";
+  version = "1.15.7";

  src = fetchFromGitHub {
    owner = "Vendicated";
    repo = "Vencord";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-bsTw8F6bBJFZWzOYV84VMtrMMj0fHId9BKCxrFUQYxM=";
+    hash = "sha256-Ioj8Ng5dpO54R298LUZ1EB91PTESIWKlWPn3B/cKNrg=";
  };

  patches = [ ./fix-deps.patch ];
--- a/pkgs/by-name/vi/victoriametrics/package.nix
+++ b/pkgs/by-name/vi/victoriametrics/package.nix
@@ -14,13 +14,13 @@

 buildGo127Module (finalAttrs: {
  pname = "VictoriaMetrics";
-  version = "1.152.0";
+  version = "1.153.0";

  src = fetchFromGitHub {
    owner = "VictoriaMetrics";
    repo = "VictoriaMetrics";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-3PDFQbVJhwyMUvA/ToXJKBOIN9xKoBGp/YjHntjwKr4=";
+    hash = "sha256-mp6BEoTsG0MJMOEUOVX0NcNlQRYNBKdGADTIlkWfexw=";
  };

  vendorHash = null;
--- a/pkgs/by-name/xw/xwayland-satellite/package.nix
+++ b/pkgs/by-name/xw/xwayland-satellite/package.nix
@@ -13,13 +13,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "xwayland-satellite";
-  version = "0.8.2";
+  version = "0.8.3";

  src = fetchFromGitHub {
    owner = "Supreeeme";
    repo = "xwayland-satellite";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Mb7jpqnrcYCfNSItIkkHpuR3YxWFxPuIBfcwNKlRBkk=";
+    hash = "sha256-eFEjCCniMCKeWU0PcZNv+tDYe08SLFPjRplyPY8OFt4=";
  };

  postPatch = ''
@@ -27,7 +27,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      --replace-fail '/usr/local/bin' "$out/bin"
  '';

-  cargoHash = "sha256-Saa3SRsQuY6u6pfBGezaEExOt/ReblnrG7pAXjA6Dk8=";
+  cargoHash = "sha256-gMGFvnbxM3hD5fmkSimaFd87GEf6BXFe/MGjoS6VNVU=";

  nativeBuildInputs = [
    installShellFiles
@@ -78,6 +78,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      if-loop69420
      sodiboo
      getchoo
+      mithicspirit
    ];
    mainProgram = "xwayland-satellite";
    platforms = lib.platforms.linux;
--- a/pkgs/servers/web-apps/discourse/default.nix
+++ b/pkgs/servers/web-apps/discourse/default.nix
@@ -54,13 +54,13 @@
 }:

 let
-  version = "2026.8.0";
+  version = "2026.9.0";

  src = fetchFromGitHub {
    owner = "discourse";
    repo = "discourse";
    tag = "v${version}";
-    hash = "sha256-UUDPZVBQXG6kfW8+TFFDHsNMdH8WLxsgva4jSdZWsC8=";
+    hash = "sha256-xOZyoDA+/UPV/art5z8lNSM7RfNejeYcZAL+JzrPk7A=";
  };

  pnpm = pnpm_10;
@@ -180,8 +180,8 @@ let
  rubyEnv =
    let
      # these hashes are auto-updated by update.py
-      dart-x64-hash = "sha256-2rnqNeEr8PFMuFa4IhutxxXui1dCw3XQVqCV5ZwsUR8=";
-      dart-arm64-hash = "sha256-8sgc9IaeWSRnURFtMuSOqnKACkDc5WynmLIboYWwoSM=";
+      dart-x64-hash = "sha256-pNK3ekjTYP/FCInhtb5uxDBDP/yA79fnE76avxoHt9k=";
+      dart-arm64-hash = "sha256-B6OWLvW7dM6DIeO5A6WbpQ0IHJca54HZCRLyAn2XKK0=";
    in
    bundlerEnv rec {
      name = "discourse-ruby-env-${version}";
@@ -274,7 +274,7 @@ let
              unpackPhase
              nativeBuildInputs
              ;
-            hash = "sha256-OIkSavAjja1atbeyPAKFXsXoYI3nUk9c5G3RFBj53Uk=";
+            hash = "sha256-2OITwITCGoAIahIXpemWP38iFGSlrycUV319pmdD1dY=";
          };

          dontBuild = false;
@@ -350,7 +350,7 @@ let
      pname = "discourse-assets";
      inherit version src pnpm;
      fetcherVersion = 3;
-      hash = "sha256-fm6hboG2Bjq0HUnbwdLiC1FpoWRZvq+1bN5SupQ2P2k=";
+      hash = "sha256-oahr5SJzHfIfcB7NFxeeEYDf3Q4m/iC/JMpNjlEWgSE=";
    };

    nativeBuildInputs = runtimeDeps ++ [
@@ -471,6 +471,8 @@ let
    dontCheckForBrokenSymlinks = true;
  };

+  voiceAssets = rubyEnv.gems.discourse_voice_assets;
+
  discourse = stdenv.mkDerivation {
    pname = "discourse";
    inherit version src;
@@ -520,6 +522,9 @@ let

      # in the imagemagick sandbox, symlinks permissions are checked (as you would hope) but this causes other problems..
      ./optimize-image-fix.patch
+
+      # Skip voice plugin asset symlink removal/recreation at runtime.
+      ./voice-plugin-assets.patch
    ];

    postPatch = ''
@@ -565,6 +570,14 @@ let
        p: "ln -sf ${p} $out/share/discourse/plugins/${p.pluginName or ""}"
      ) plugins}

+      # The voice plugin creates its asset symlink below its source tree. That
+      # works during the asset build, but the package source tree is read-only
+      # at runtime..
+      mkdir -p $out/share/discourse/plugins/voice/public/javascripts
+      ln -sf \
+        ${voiceAssets}/lib/ruby/gems/${rubyEnv.ruby.version.libDir}/gems/discourse_voice_assets-${voiceAssets.version}/vendor \
+        $out/share/discourse/plugins/voice/public/javascripts/${voiceAssets.version}
+
      runHook postInstall
    '';

--- a/pkgs/servers/web-apps/discourse/include-precompiled-bundles.patch
+++ b/pkgs/servers/web-apps/discourse/include-precompiled-bundles.patch
@@ -1,5 +1,5 @@
 diff --git a/lib/asset_processor.rb b/lib/asset_processor.rb
-index 0c602a85220..be1e22061b0 100644
+index 95b1245391e..adff8527457 100644
 --- a/lib/asset_processor.rb
 +++ b/lib/asset_processor.rb
@@ -5,7 +5,7 @@ class AssetProcessor
@@ -11,16 +11,16 @@ index 0c602a85220..be1e22061b0 100644
       filename_prefix: "asset-processor",
       dependency_globs: %w[
         node_modules/.pnpm/lock.yaml
-diff --git a/lib/pretty_text.rb b/lib/pretty_text.rb
-index 6f176324799..9815f579212 100644
--- a/lib/pretty_text.rb
-+++ b/lib/pretty_text.rb
-@@ -54,7 +54,7 @@ module PrettyText
+diff --git a/lib/pretty_text/core_bundle.rb b/lib/pretty_text/core_bundle.rb
+index 963dfb1ac6b..97b717e7569 100644
+--- a/lib/pretty_text/core_bundle.rb
+++ b/lib/pretty_text/core_bundle.rb
+@@ -21,7 +21,7 @@ module PrettyText
 
-   CORE_BUNDLE =
-     PrecompiledBundle.new(
-      dir: "tmp/pretty-text-processor",
-+      dir: "frontend/pretty-text-processor.build",
-       filename_prefix: "pretty-text",
-       dependency_globs:
-         %w[
+     BUNDLE =
+       PrecompiledBundle.new(
+-        dir: "tmp/pretty-text-processor",
+        dir: "frontend/pretty-text-processor.build",
+         filename_prefix: "pretty-text",
+         dependency_globs:
+           %w[
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-docs/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-docs/default.nix
@@ -9,8 +9,8 @@ mkDiscoursePlugin {
  src = fetchFromGitHub {
    owner = "discourse";
    repo = "discourse-docs";
-    rev = "0796384551e3f9d328c57e88577098be05d816c7";
-    sha256 = "sha256-lZ8BlFaQcd9H+bom2igbJl4Ty7qmqtpbOpGbqIF8nEo=";
+    rev = "89bae0e929387ed5697fd3c5eedf9b3dbe85bead";
+    sha256 = "sha256-ycDyYRi7uab4vxHY8K2kUytWBmTuFTFHYGD1AHpzC+0=";
  };
  meta = {
    homepage = "https://github.com/discourse/discourse-docs";
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-yearly-review/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-yearly-review/default.nix
@@ -9,8 +9,8 @@ mkDiscoursePlugin {
  src = fetchFromGitHub {
    owner = "discourse";
    repo = "discourse-yearly-review";
-    rev = "97720c573f04ce32544ef1e9353b12005de0bdec";
-    sha256 = "sha256-ZhkrPYFjhtNoh6jQhqPTMZJqHMyZo3tdbtSl3MuOJz0=";
+    rev = "a4e9ee393de923332609d0436e3c1c8757f6cb1c";
+    sha256 = "sha256-WHU7vYTnavX3waJWjHn11kg70TCoFH9cdmdPRSsNZO4=";
  };
  meta = {
    homepage = "https://github.com/discourse/discourse-yearly-review";
--- a/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile
+++ b/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile
@@ -8,13 +8,13 @@ source "https://rubygems.org"

 gem "bootsnap", require: false, platform: :mri

-gem "actionmailer", "~> 8.0.0"
-gem "actionpack", "~> 8.0.0"
-gem "actionview", "~> 8.0.0"
-gem "activemodel", "~> 8.0.0"
-gem "activerecord", "~> 8.0.0"
-gem "activesupport", "~> 8.0.0"
-gem "railties", "~> 8.0.0"
+gem "actionmailer", "~> 8.1.0"
+gem "actionpack", "~> 8.1.0"
+gem "actionview", "~> 8.1.0"
+gem "activemodel", "~> 8.1.0"
+gem "activerecord", "~> 8.1.0"
+gem "activesupport", "~> 8.1.0"
+gem "railties", "~> 8.1.0"

 gem "propshaft"
 gem "json"
@@ -60,6 +60,8 @@ gem "message_bus"
 gem "rails_multisite"

 gem "fastimage"
+gem "msgpack"
+gem "ruby-vips", "~> 2.3", require: false

 gem "aws-sdk-s3", require: false
 gem "aws-sdk-sns", require: false
@@ -80,13 +82,13 @@ gem "loofah"
 gem "css_parser", require: false

 gem "omniauth"
-gem "omniauth-facebook"
-gem "omniauth-twitter"
-gem "omniauth-github"
+gem "omniauth-facebook", require: false
+gem "omniauth-twitter", require: false
+gem "omniauth-github", require: false

 gem "omniauth-oauth2", require: false

-gem "omniauth-google-oauth2"
+gem "omniauth-google-oauth2", require: false

 gem "oj"

@@ -114,7 +116,7 @@ gem "rack-protection" # security
 gem "cbor", require: false
 gem "cose", require: false
 gem "addressable"
-gem "json_schemer"
+gem "json_schemer", require: false

 gem "net-smtp", require: false
 gem "net-pop", require: false
@@ -126,37 +128,36 @@ group :test do
  gem "capybara", require: false
  gem "webmock", require: false
  gem "simplecov", require: false
-  gem "test-prof"
+  gem "test-prof", require: false
  gem "rails-dom-testing", require: false
-  gem "minio_runner", require: false
-  gem "capybara-playwright-driver"
+  gem "capybara-playwright-driver", require: false
  gem "puma", require: false
 end

 group :test, :development do
-  gem "rspec"
+  gem "rspec", require: false
  gem "listen", require: false
  gem "certified", require: false
  gem "fabrication", require: false
  gem "mocha", require: false

-  gem "rb-fsevent", require: RUBY_PLATFORM =~ /darwin/i ? "rb-fsevent" : false
+  gem "rb-fsevent", require: false

-  gem "rspec-rails"
+  gem "rspec-rails", require: false

  gem "shoulda-matchers", require: false
-  gem "rspec-html-matchers"
+  gem "rspec-html-matchers", require: false
  gem "debug", ">= 1.0.0", require: "debug/prelude"
  gem "rubocop-discourse", require: false
-  gem "parallel_tests"
+  gem "parallel_tests", require: false

-  gem "rswag-specs"
+  gem "rswag-specs", require: false

-  gem "annotaterb"
+  gem "annotaterb", require: false

-  gem "syntax_tree"
+  gem "syntax_tree", require: false

-  gem "rspec-multi-mock"
+  gem "rspec-multi-mock", require: false
 end

 group :development do
@@ -175,8 +176,8 @@ if ENV["ALLOW_DEV_POPULATE"] == "1"
  gem "faker"
 else
  group :development, :test do
-    gem "discourse_dev_assets"
-    gem "faker"
+    gem "discourse_dev_assets", require: false
+    gem "faker", require: false
  end
 end

@@ -224,7 +225,7 @@ gem "sassc-embedded"

 gem "rotp", require: false

-gem "rqrcode"
+gem "rqrcode", require: false

 gem "rubyzip", require: false

@@ -232,10 +233,10 @@ gem "landlock", require: false

 gem "sshkey", require: false

-gem "rchardet", require: false
 gem "lz4-ruby", require: false, platform: :ruby

 gem "sanitize"
+gem "reverse_markdown", "3.0.2", require: false

 if ENV["IMPORT"] == "1"
  gem "mysql2"
@@ -244,7 +245,6 @@ if ENV["IMPORT"] == "1"
  # NOTE: in import mode the version of sqlite can matter a lot, so we stick it to a specific one
  gem "sqlite3", "~> 1.3", ">= 1.3.13"
  gem "ruby-bbcode-to-md", git: "https://github.com/nlalonde/ruby-bbcode-to-md"
-  gem "reverse_markdown"
  gem "tiny_tds"
  gem "csv"
 end
@@ -273,6 +273,9 @@ gem "cgi", ">= 0.3.6", require: false
 gem "tzinfo-data"
 gem "csv", require: false

+# Rails 8.1 drops its own dependency on `benchmark`.
+gem "benchmark", require: false
+
 # dependencies for the automation plugin
 gem "iso8601"
 gem "rrule"
@@ -308,6 +311,9 @@ gem "tiktoken_ruby", require: false
 gem "smarter_json", require: false
 gem "json_completer", require: false
 gem "discourse_ai-tokenizers", require: false
+
+# for the voice plugin
+gem "discourse_voice_assets", require: false
 gem "ed25519" # TODO: remove this as existing ssl gem should handle this
 gem "Ascii85", require: false
 gem "ruby-rc4", require: false
--- a/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
+++ b/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
--- a/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix
+++ b/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix
--- a/pkgs/servers/web-apps/discourse/sass_embedded_vendored_dart_sass.patch
+++ b/pkgs/servers/web-apps/discourse/sass_embedded_vendored_dart_sass.patch
@@ -1,21 +1,19 @@
 diff --git a/ext/sass/Rakefile b/ext/sass/Rakefile
-index d542efd..93f97cf 100644
+index a36b11a..93f97cf 100644
 --- a/ext/sass/Rakefile
 +++ b/ext/sass/Rakefile
-@@ -84,11 +84,18 @@ file File.absolute_path('node_modules/sass', ARCHDIR) do
+@@ -84,10 +84,18 @@ file File.absolute_path('node_modules/sass', ARCHDIR) do
 end
 
 task 'dart-sass' => (
-  begin
-    SassConfig.dart_sass
+-  if SassConfig.dart_support?
 -    File.absolute_path('dart-sass/sass', ARCHDIR)
-  rescue NotImplementedError
-    File.absolute_path('node_modules/sass', ARCHDIR)
 +  p ENV
 +  if ENV.has_key?('DART_SASS_VENDORED')
 +    mkdir_p ARCHDIR
 +    cp_r ENV.fetch('DART_SASS_VENDORED'), File.absolute_path('dart-sass', ARCHDIR)
-+  else
+   else
+-    File.absolute_path('node_modules/sass', ARCHDIR)
 +    raise Errno::EINVAL, "no vendored SASS"
 +    begin
 +      SassConfig.dart_sass
--- a/pkgs/servers/web-apps/discourse/voice-plugin-assets.patch
+++ b/pkgs/servers/web-apps/discourse/voice-plugin-assets.patch
@@ -0,0 +1,38 @@
+diff --git a/plugins/voice/plugin.rb b/plugins/voice/plugin.rb
+index a715e9364e0..29b7eeb3c72 100644
+--- a/plugins/voice/plugin.rb
+++ b/plugins/voice/plugin.rb
+@@ -15,18 +15,22 @@ require "discourse_voice_assets"
+ # immutable, so the versioned URL is what busts caches on a gem bump. The
+ # client learns the current base path from the site serializer.
+ voice_javascripts_dir = File.join(__dir__, "public", "javascripts")
+-FileUtils.mkdir_p(voice_javascripts_dir)
+-Dir
+-  .children(voice_javascripts_dir)
+-  .each do |entry|
+-    if entry != DiscourseVoiceAssets::VERSION
+-      FileUtils.rm_rf(File.join(voice_javascripts_dir, entry))
+-    end
+-  end
+-Discourse::Utils.atomic_ln_s(
+-  DiscourseVoiceAssets.vendor_path,
+-  File.join(voice_javascripts_dir, DiscourseVoiceAssets::VERSION),
+unless File.symlink?(
+  File.join(voice_javascripts_dir, DiscourseVoiceAssets::VERSION)
+ )
+  FileUtils.mkdir_p(voice_javascripts_dir)
+  Dir
+    .children(voice_javascripts_dir)
+    .each do |entry|
+      if entry != DiscourseVoiceAssets::VERSION
+        FileUtils.rm_rf(File.join(voice_javascripts_dir, entry))
+      end
+    end
+  Discourse::Utils.atomic_ln_s(
+    DiscourseVoiceAssets.vendor_path,
+    File.join(voice_javascripts_dir, DiscourseVoiceAssets::VERSION),
+  )
+end
+ 
+ enabled_site_setting :voice_enabled
+ 
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -1785,10 +1785,10 @@ with self;

  ArchiveTar = buildPerlPackage {
    pname = "Archive-Tar";
-    version = "3.10";
+    version = "3.12";
    src = fetchurl {
-      url = "mirror://cpan/authors/id/B/BI/BINGOS/Archive-Tar-3.10.tar.gz";
-      hash = "sha256-irvDaMxHIwjiqWDEpOi258pJJFefxGPH+oemplbITlY=";
+      url = "mirror://cpan/authors/id/B/BI/BINGOS/Archive-Tar-3.12.tar.gz";
+      hash = "sha256-ARTvObZfSfiWgoOrR3Gdfoj5jXNg/jZJvjMcf1PVgyw=";
    };
    meta = {
      description = "Manipulates TAR archives";