From c1b5f25b6b107507e53d06fe73c96488a4f55a70 Mon Sep 17 00:00:00 2001
From: Nikolaos Karaolidis <nick@karaolidis.com>
Date: Thu, 9 Jul 2026 17:06:36 +0000
Subject: [PATCH 01/64] nixos/rpcbind: declare rpc user unconditionally to
 break recursion

rpcbind defined its rpc user inside config = mkIf cfg.enable {...}, making the presence of the rpc key in config.users.users depend on services.rpcbind.enable. Since users.users is an attrsOf submodule, reading one user's attribute forces the whole key set, forcing that guard, which nfs.nix derives from boot.supportedFilesystems <- config.fileSystems. A fileSystems entry referencing a user (home/uid/gid) therefore closed an infinite-recursion loop, i.e. you couldn't write fileSystems."${config.users.users.me.home}/data".

Fixes #24570.

Signed-off-by: Nikolaos Karaolidis <nick@karaolidis.com>
---
 nixos/modules/services/networking/rpcbind.nix | 47 ++++++++++---------
 1 file changed, 26 insertions(+), 21 deletions(-)

diff --git a/nixos/modules/services/networking/rpcbind.nix b/nixos/modules/services/networking/rpcbind.nix
index 8436ebb23658..2a742aec7f50 100644
--- a/nixos/modules/services/networking/rpcbind.nix
+++ b/nixos/modules/services/networking/rpcbind.nix
@@ -32,29 +32,34 @@ with lib;
 
   ###### implementation
 
-  config = mkIf config.services.rpcbind.enable {
-    environment.systemPackages = [ pkgs.rpcbind ];
+  config = mkMerge [
+    (mkIf config.services.rpcbind.enable {
+      environment.systemPackages = [ pkgs.rpcbind ];
 
-    systemd.packages = [ pkgs.rpcbind ];
+      systemd.packages = [ pkgs.rpcbind ];
 
-    systemd.services.rpcbind = {
-      wantedBy = [ "multi-user.target" ];
-      # rpcbind performs a check for /var/run/rpcbind.lock at startup
-      # and will crash if /var/run isn't present. In the stock NixOS
-      # var.conf tmpfiles configuration file, /var/run is symlinked to
-      # /run, so rpcbind can enter a race condition in which /var/run
-      # isn't symlinked yet but tries to interact with the path, so
-      # controlling the order explicitly here ensures that rpcbind can
-      # start successfully. The `wants` instead of `requires` should
-      # avoid creating a strict/brittle dependency.
-      wants = [ "systemd-tmpfiles-setup.service" ];
-      after = [ "systemd-tmpfiles-setup.service" ];
-    };
+      systemd.services.rpcbind = {
+        wantedBy = [ "multi-user.target" ];
+        # rpcbind performs a check for /var/run/rpcbind.lock at startup
+        # and will crash if /var/run isn't present. In the stock NixOS
+        # var.conf tmpfiles configuration file, /var/run is symlinked to
+        # /run, so rpcbind can enter a race condition in which /var/run
+        # isn't symlinked yet but tries to interact with the path, so
+        # controlling the order explicitly here ensures that rpcbind can
+        # start successfully. The `wants` instead of `requires` should
+        # avoid creating a strict/brittle dependency.
+        wants = [ "systemd-tmpfiles-setup.service" ];
+        after = [ "systemd-tmpfiles-setup.service" ];
+      };
+    })
 
-    users.users.rpc = {
-      group = "nogroup";
-      uid = config.ids.uids.rpc;
-    };
-  };
+    {
+      users.users.rpc = {
+        enable = config.services.rpcbind.enable;
+        group = "nogroup";
+        uid = config.ids.uids.rpc;
+      };
+    }
+  ];
 
 }

From 90c69965db7886edfe52a80ca6e8f92b7de115ca Mon Sep 17 00:00:00 2001
From: Nikolaos Karaolidis <nick@karaolidis.com>
Date: Sun, 13 Sep 2026 12:37:57 +0100
Subject: [PATCH 02/64] nixos/rpcbind: drop with lib

Signed-off-by: Nikolaos Karaolidis <nick@karaolidis.com>
---
 nixos/modules/services/networking/rpcbind.nix | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/nixos/modules/services/networking/rpcbind.nix b/nixos/modules/services/networking/rpcbind.nix
index 2a742aec7f50..f16d44af4816 100644
--- a/nixos/modules/services/networking/rpcbind.nix
+++ b/nixos/modules/services/networking/rpcbind.nix
@@ -5,8 +5,6 @@
   ...
 }:
 
-with lib;
-
 {
 
   ###### interface
@@ -15,8 +13,8 @@ with lib;
 
     services.rpcbind = {
 
-      enable = mkOption {
-        type = types.bool;
+      enable = lib.mkOption {
+        type = lib.types.bool;
         default = false;
         description = ''
           Whether to enable `rpcbind`, an ONC RPC directory service
@@ -32,8 +30,8 @@ with lib;
 
   ###### implementation
 
-  config = mkMerge [
-    (mkIf config.services.rpcbind.enable {
+  config = lib.mkMerge [
+    (lib.mkIf config.services.rpcbind.enable {
       environment.systemPackages = [ pkgs.rpcbind ];
 
       systemd.packages = [ pkgs.rpcbind ];

From a1cb45ba6c7173bfb5ce18f723ebdaebd2c70611 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 23 Sep 2026 14:22:59 +0000
Subject: [PATCH 03/64] kubectl-cnpg: 1.30.0 -> 1.30.1

---
 pkgs/by-name/ku/kubectl-cnpg/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ku/kubectl-cnpg/package.nix b/pkgs/by-name/ku/kubectl-cnpg/package.nix
index eb6a000dd6f2..6cb80600dd92 100644
--- a/pkgs/by-name/ku/kubectl-cnpg/package.nix
+++ b/pkgs/by-name/ku/kubectl-cnpg/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "kubectl-cnpg";
-  version = "1.30.0";
+  version = "1.30.1";
 
   src = fetchFromGitHub {
     owner = "cloudnative-pg";
     repo = "cloudnative-pg";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-UHgllbD2eNBVYrF5nPZhethZIyyBkEji1xf0okGshoI=";
+    hash = "sha256-ZtIUtp4KwSxpqh97Hi9/8MnZfH3sGj3gNa0bwHF0FhM=";
   };
 
-  vendorHash = "sha256-Eh057tW8NTCNVtgyeY4A+Cc8wQbRDpUYDFmj4l+pn8o=";
+  vendorHash = "sha256-ep8BezbZ/BM+s50v/sly+HotA9IHosHS6w3el0i4dps=";
 
   subPackages = [ "cmd/kubectl-cnpg" ];
 

From 96b3daaf8a576081578dadd950e3b3b4ab1f9269 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 25 Sep 2026 00:49:27 +0000
Subject: [PATCH 04/64] node-core-utils: 7.2.1 -> 7.3.1

---
 pkgs/by-name/no/node-core-utils/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/no/node-core-utils/package.nix b/pkgs/by-name/no/node-core-utils/package.nix
index 091781f0678e..4234a2eb47cc 100644
--- a/pkgs/by-name/no/node-core-utils/package.nix
+++ b/pkgs/by-name/no/node-core-utils/package.nix
@@ -9,16 +9,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "node-core-utils";
-  version = "7.2.1";
+  version = "7.3.1";
 
   src = fetchFromGitHub {
     owner = "nodejs";
     repo = "node-core-utils";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-5RY4hXGbGyyUptDZhNIO/cDm7c4w4JaWLUfqRppJsp8=";
+    hash = "sha256-JvZ6/S9QYDPMrPsCAET1Q6P8gwblDyDpKicsYulUg4Y=";
   };
 
-  npmDepsHash = "sha256-UTGun+Rt0wMCCtCjYzhYYLw9Y0XqEV93PuXnDwIg59k=";
+  npmDepsHash = "sha256-aE8KH+BQUu8D20DBvWJmr8RWCa85bHjAWEDNZ8l2okg=";
 
   dontNpmBuild = true;
   dontNpmPrune = true;

From 6b47e6f6e40a555f9dcefe4a72c4b4931e6cd369 Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Fri, 25 Sep 2026 06:36:40 +0200
Subject: [PATCH 05/64] ruff: 0.16.8 -> 0.16.9

Changelog: https://github.com/astral-sh/ruff/releases/tag/0.16.9
Diff: https://github.com/astral-sh/ruff/compare/0.16.8...0.16.9
---
 pkgs/by-name/ru/ruff/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ru/ruff/package.nix b/pkgs/by-name/ru/ruff/package.nix
index 427a3adacaae..19f4e3781a39 100644
--- a/pkgs/by-name/ru/ruff/package.nix
+++ b/pkgs/by-name/ru/ruff/package.nix
@@ -16,7 +16,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.16.8";
+  version = "0.16.9";
 
   __structuredAttrs = true;
 
@@ -24,12 +24,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-vfyEulokZqx5VyQA3jlKhQhgr/flLIGHcgC7CeegGl0=";
+    hash = "sha256-gxQXIlle9LGs1HcPiJn7KW0p21xsr62/FGypyqEfnSI=";
   };
 
   cargoBuildFlags = [ "--package=ruff" ];
 
-  cargoHash = "sha256-aX9Vu1egtvloe9dspXHR0Amc0mEuWG67EAOQU2b3oM0=";
+  cargoHash = "sha256-5ZolzeBEj6dolhObhWS/jMyB7KJPRSIbN0+zcG+0AGY=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From 159ea64de6409c3ad9032c8854775383a207e396 Mon Sep 17 00:00:00 2001
From: Valentin Gagarin <valentin.gagarin@tweag.io>
Date: Wed, 16 Sep 2026 16:05:34 +0200
Subject: [PATCH 06/64] nixos/qemu-vm: add option to set shared directory cache
 policy

This also sets the caching default to "auto", since this is probably what we want.
---
 nixos/modules/virtualisation/qemu-vm.nix   | 20 +++++++-
 nixos/tests/all-tests.nix                  |  1 +
 nixos/tests/qemu-vm-shared-directories.nix | 56 ++++++++++++++++++++++
 3 files changed, 76 insertions(+), 1 deletion(-)
 create mode 100644 nixos/tests/qemu-vm-shared-directories.nix

diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix
index 3afe34f0a2a7..8446861a4ea4 100644
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -337,7 +337,7 @@ let
             ${if share.writable then "--writeback" else "--readonly"} \
             --sandbox=none \
             --seccomp=none \
-            --cache=always \
+            --cache=${share.cache} \
             --no-announce-submounts \
             --translate-uid=host:65534:0:1 \
             --translate-gid=host:65534:0:1 \
@@ -585,6 +585,23 @@ in
           options.writable = lib.mkEnableOption "" // {
             description = "Whether the directory is writable on the host and guest.";
           };
+          options.cache = mkOption {
+            type = types.enum [
+              "auto"
+              "always"
+              "metadata"
+              "never"
+            ];
+            default = "auto";
+            description = ''
+              Cache policy for the virtiofs daemon.
+
+              For details refer to the [virtiofsd documentation](https://virtio-fs.gitlab.io/virtiofsd/doc/virtiofsd/passthrough/enum.CachePolicy.html).
+
+              Effective on Linux hosts only.
+              Ignored when using VirtFS (9P) (the default on non-Linux hosts).
+            '';
+          };
         }
       );
       default = { };
@@ -1227,6 +1244,7 @@ in
         # Always mount this to /nix/.ro-store because we never want to actually
         # write to the host Nix Store.
         target = "/nix/.ro-store";
+        cache = mkIf useVirtiofs "always";
       };
       xchg = {
         source = ''"$TMPDIR"/xchg'';
diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 7935904ddb11..15131bd4513e 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1578,6 +1578,7 @@ in
   qemu-firmware = runTestOn [ "x86_64-linux" ] ./qemu-firmware.nix;
   qemu-vm-external-disk-image = runTest ./qemu-vm-external-disk-image.nix;
   qemu-vm-restrictnetwork = handleTest ./qemu-vm-restrictnetwork.nix { };
+  qemu-vm-shared-directories = runTest ./qemu-vm-shared-directories.nix;
   qemu-vm-store = runTest ./qemu-vm-store.nix;
   qemu-vm-volatile-root = runTest ./qemu-vm-volatile-root.nix;
   qgis = handleTest ./qgis.nix { package = pkgs.qgis; };
diff --git a/nixos/tests/qemu-vm-shared-directories.nix b/nixos/tests/qemu-vm-shared-directories.nix
new file mode 100644
index 000000000000..e4286f3d95bb
--- /dev/null
+++ b/nixos/tests/qemu-vm-shared-directories.nix
@@ -0,0 +1,56 @@
+{
+  config,
+  lib,
+  ...
+}:
+{
+  name = "qemu-vm-shared-directories";
+
+  meta.maintainers = with lib.maintainers; [
+    fricklerhandwerk
+  ];
+
+  meta.platforms = lib.platforms.linux;
+
+  nodes = lib.listToAttrs (
+    map
+      (policy: {
+        name = policy;
+        value.virtualisation.sharedDirectories.test = {
+          source = "/tmp/${policy}";
+          target = "/mnt/test";
+          cache = policy;
+          writable = true;
+        };
+      })
+      [
+        "never"
+        "metadata"
+        "auto"
+        "always"
+      ]
+  );
+
+  testScript = ''
+    import os
+
+    for policy in ${with builtins; toJSON (attrNames config.nodes)}:
+        os.makedirs(f"/tmp/{policy}", exist_ok=True)
+        with open(f"/tmp/{policy}/hello.txt", "w") as f:
+            f.write("before")
+
+    start_all()
+
+    for machine, policy in [${
+      lib.concatMapStringsSep ", " (p: ''(${p}, "${p}")'') (builtins.attrNames config.nodes)
+    }]:
+        with subtest(f"cache={policy} propagates host file changes to the guest as expected"):
+            machine.succeed("grep before /mnt/test/hello.txt")
+            with open(f"/tmp/{policy}/hello.txt", "w") as f:
+                f.write("after")
+            if policy == "always":
+                always.succeed("grep before /mnt/test/hello.txt")
+            else:
+                machine.succeed("grep after /mnt/test/hello.txt")
+  '';
+}

From 2601e5fc56851fa026929c107d15c417ac1fa25d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 26 Sep 2026 21:47:02 +0000
Subject: [PATCH 07/64] libslirp: 4.9.3 -> 4.9.5

---
 pkgs/by-name/li/libslirp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libslirp/package.nix b/pkgs/by-name/li/libslirp/package.nix
index 2ab732529544..d531927e1799 100644
--- a/pkgs/by-name/li/libslirp/package.nix
+++ b/pkgs/by-name/li/libslirp/package.nix
@@ -10,14 +10,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libslirp";
-  version = "4.9.3";
+  version = "4.9.5";
 
   src = fetchFromGitLab {
     domain = "gitlab.freedesktop.org";
     owner = "slirp";
     repo = "libslirp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Spr3dO5ehuUlzx3EnJi8najANWOirwQcTsWTVRVXYuY=";
+    hash = "sha256-iWu3/Klsm8e9MH147BJhn9Vqyneq5ROqPvll1cnieL0=";
   };
 
   separateDebugInfo = true;

From 17b5a474f1f103ae00e9177ca4cab3d9810f7585 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 27 Sep 2026 15:11:26 +0000
Subject: [PATCH 08/64] material-symbols: 4.0.0-unstable-2026-06-12 ->
 4.0.0-unstable-2026-09-25

---
 pkgs/by-name/ma/material-symbols/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ma/material-symbols/package.nix b/pkgs/by-name/ma/material-symbols/package.nix
index e6cf43b8c55a..fb45becbb8db 100644
--- a/pkgs/by-name/ma/material-symbols/package.nix
+++ b/pkgs/by-name/ma/material-symbols/package.nix
@@ -7,13 +7,13 @@
 }:
 stdenvNoCC.mkDerivation {
   pname = "material-symbols";
-  version = "4.0.0-unstable-2026-06-12";
+  version = "4.0.0-unstable-2026-09-25";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "material-design-icons";
-    rev = "5d5d1fdd5476f3df3749e9fb872e32021ec7a750";
-    hash = "sha256-e0bxJpehssgnxigSgPt9qxMrKRZcvlVDyLu5DY6MkTA=";
+    rev = "bd8cb85bd4bad964fe6918f79665bb40c3a8efef";
+    hash = "sha256-JKGFoq2iZ1xzDGuxZERmDAP57+L75NltsLEc/l9+yd8=";
     sparseCheckout = [ "variablefont" ];
   };
 

From 1be4b4866ddcce77b58df3d99eea7d0cacd048f7 Mon Sep 17 00:00:00 2001
From: Grimmauld <Grimmauld@grimmauld.de>
Date: Mon, 28 Sep 2026 17:19:17 +0200
Subject: [PATCH 09/64] nixos/wrappers: enforce target executable is ELF

This *will* break some things, such as `nixosTests.espanso`.
This is intended: Loading bash, python or perl scripts via SUID or extensive capabilities is dangerous.
PERL5LIB, PYTHONPATH or BASH_ENV make these things trivial LPE primitives.

The mime types being matched include both static, non-static and pie ELFs.
This should be fine until we somehow get yet another type of magic and associated mime type.
---
 nixos/modules/security/wrappers/default.nix | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/nixos/modules/security/wrappers/default.nix b/nixos/modules/security/wrappers/default.nix
index 907b6ac01b21..7cc3a4f8e4b2 100644
--- a/nixos/modules/security/wrappers/default.nix
+++ b/nixos/modules/security/wrappers/default.nix
@@ -361,16 +361,19 @@ in
 
     ###### wrappers consistency checks
     system.checks = lib.singleton (
-      pkgs.runCommandLocal "ensure-all-wrappers-paths-exist"
+      pkgs.runCommandLocal "ensure-wrapper-integrity"
         {
-          nativeBuildInputs = [ pkgs.libcap-text-verifier ];
+          nativeBuildInputs = [
+            pkgs.libcap-text-verifier
+            pkgs.file
+          ];
           preferLocalBuild = true;
         }
         ''
           # make sure we produce output
           mkdir -p $out
 
-          echo -n "Checking that Nix store paths of all wrapped programs exist... "
+          echo -n "Checking that Nix store paths of all wrapped programs exist and are ELF executables... "
           ${lib.toShellVar "wrappers" (lib.mapAttrs (n: v: v.source) wrappers)}
           for name in "''${!wrappers[@]}"; do
             path="''${wrappers[$name]}"
@@ -382,6 +385,15 @@ in
               test -t 1 && echo -ne '\033[0m'
               exit 1
             fi
+            magic=$(file --mime --brief --dereference "$path")
+            if ! [[ "$magic" =~ application/x-executable || "$magic" =~ application/x-pie-executable ]]; then
+              test -t 1 && echo -ne '\033[1;31m'
+              echo "FAIL"
+              echo "The target executable $path is not an ELF! This is a security risk."
+              echo "Script wrappers (e.g. bash or python) are commonly susceptible to dangerous env var injections."
+              test -t 1 && echo -ne '\033[0m'
+              exit 1
+            fi
           done
           echo "OK"
 

From 3efabaf222168c30deaf850e650595d60da3e9fe Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 28 Sep 2026 19:05:41 +0000
Subject: [PATCH 10/64] python3Packages.jupyter-docprovider: 3.0.3 -> 3.0.4

---
 .../python-modules/jupyter-docprovider/default.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/jupyter-docprovider/default.nix b/pkgs/development/python-modules/jupyter-docprovider/default.nix
index 5f96d8e010f1..5589acdb03f7 100644
--- a/pkgs/development/python-modules/jupyter-docprovider/default.nix
+++ b/pkgs/development/python-modules/jupyter-docprovider/default.nix
@@ -14,14 +14,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "jupyter-docprovider";
-  version = "3.0.3";
+  version = "3.0.4";
   pyproject = true;
   __structuredAttrs = true;
 
   src = fetchPypi {
     pname = "jupyter_docprovider";
     inherit (finalAttrs) version;
-    hash = "sha256-bY6eQ5XdTj2WLM3oyN9s8pmnPQsMNbvlZKn+YaeVtWY=";
+    hash = "sha256-yO49NbuaWAOFZBPkR7G5vYDOF7J6xtLaYj4cpER/LIw=";
   };
 
   build-system = [

From 066568cb8719fc7df57ed42bad040a71ddc49c36 Mon Sep 17 00:00:00 2001
From: ooonea <35407790+ooonea@users.noreply.github.com>
Date: Mon, 28 Sep 2026 22:53:32 +0200
Subject: [PATCH 11/64] throttled: 0.11 -> 0.12.2

Use dbus-fast and install import-only helpers in site-packages. Preserve the service configuration argument and check the installed version without generating timestamp-dependent bytecode.

Assisted-by: Claude Code (Claude Fable 5)
Assisted-by: OpenAI Codex (GPT-6)
---
 pkgs/by-name/th/throttled/package.nix | 46 ++++++++++++---------------
 1 file changed, 21 insertions(+), 25 deletions(-)

diff --git a/pkgs/by-name/th/throttled/package.nix b/pkgs/by-name/th/throttled/package.nix
index 4d8736e28d0c..216073bde8c3 100644
--- a/pkgs/by-name/th/throttled/package.nix
+++ b/pkgs/by-name/th/throttled/package.nix
@@ -2,63 +2,59 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  gobject-introspection,
   python3Packages,
   pciutils,
-  wrapGAppsNoGuiHook,
+  versionCheckHook,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "throttled";
-  version = "0.11";
+  version = "0.12.2";
 
   src = fetchFromGitHub {
     owner = "erpalma";
     repo = "throttled";
-    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-+3ktDkr5hvOfHcch4+mjgJqcuw24UgWTkJqTyDQumyk=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-hwnJO9KEDOizpGcb9NYHYHoEEHKa3PkLt76cKpwgEUs=";
   };
 
-  nativeBuildInputs = [
-    gobject-introspection
-    python3Packages.wrapPython
-    wrapGAppsNoGuiHook
-  ];
+  nativeBuildInputs = [ python3Packages.wrapPython ];
 
-  pythonPath = with python3Packages; [
-    configparser
-    dbus-python
-    pygobject3
-  ];
+  pythonPath = [ python3Packages.dbus-fast ];
 
-  # The upstream unit both assumes the install location, and tries to run in a virtualenv
+  # The upstream unit assumes the /opt/throttled venv install location
   postPatch = ''
-    sed -e 's|ExecStart=.*|ExecStart=${placeholder "out"}/bin/throttled.py|' -i systemd/throttled.service
+    substituteInPlace systemd/throttled.service \
+      --replace-fail '/opt/throttled/venv/bin/throttled' \
+      '${placeholder "out"}/bin/throttled.py'
 
-    substituteInPlace throttled.py --replace "'setpci'" "'${pciutils}/bin/setpci'"
+    substituteInPlace throttled.py --replace-fail "'setpci'" "'${lib.getExe' pciutils "setpci"}'"
   '';
 
   installPhase = ''
     runHook preInstall
+
     install -D -m755 -t $out/bin throttled.py
-    install -D -t $out/bin throttled.py mmio.py
+    install -D -m644 -t $out/${python3Packages.python.sitePackages} mmio.py throttled_version.py
     install -D -m644 -t $out/etc etc/*
     install -D -m644 -t $out/lib/systemd/system systemd/*
+
     runHook postInstall
   '';
 
-  dontWrapGApps = true;
-
-  preFixup = ''
-    makeWrapperArgs+=("''${gappsWrapperArgs[@]}")
-  '';
-
   postFixup = "wrapPythonPrograms";
 
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+  env.PYTHONDONTWRITEBYTECODE = "1";
+  versionCheckKeepEnvironment = "PYTHONDONTWRITEBYTECODE";
+
   meta = {
     description = "Fix for Intel CPU throttling issues";
     homepage = "https://github.com/erpalma/throttled";
+    changelog = "https://github.com/erpalma/throttled/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.mit;
+    mainProgram = "throttled.py";
     platforms = [ "x86_64-linux" ];
     maintainers = [ ];
   };

From cdc2a3bb95eaa411b26587ea29facb7eec5754dd Mon Sep 17 00:00:00 2001
From: Felix Singer <felixsinger@posteo.net>
Date: Wed, 30 Sep 2026 21:39:10 +0200
Subject: [PATCH 12/64] jenkins: 2.568.3 -> 2.580.1

Signed-off-by: Felix Singer <felixsinger@posteo.net>
---
 pkgs/by-name/je/jenkins/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/je/jenkins/package.nix b/pkgs/by-name/je/jenkins/package.nix
index 1799e66d9777..ddebf75132c3 100644
--- a/pkgs/by-name/je/jenkins/package.nix
+++ b/pkgs/by-name/je/jenkins/package.nix
@@ -18,14 +18,14 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "jenkins";
-  version = "2.568.3";
+  version = "2.580.1";
 
   strictDeps = true;
   __structuredAttrs = true;
 
   src = fetchurl {
     url = "https://get.jenkins.io/war-stable/${finalAttrs.version}/jenkins.war";
-    hash = "sha256-zNv9zq3oNInjQoWk1XwSE0/+oKCcogBiKC5YDL+l8J4=";
+    hash = "sha256-OTvyR2NS3XJlGf0fks5m6sfSPAk25pZ0ILcXBgxMQNA=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From b90a5ab1f43eae64c789b4958fd28ff014a4f906 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 1 Oct 2026 07:23:48 +0000
Subject: [PATCH 13/64] fscan: 2.2.1 -> 2.2.2

---
 pkgs/by-name/fs/fscan/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fs/fscan/package.nix b/pkgs/by-name/fs/fscan/package.nix
index 35e62016dc78..1fe4156c87ae 100644
--- a/pkgs/by-name/fs/fscan/package.nix
+++ b/pkgs/by-name/fs/fscan/package.nix
@@ -6,13 +6,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "fscan";
-  version = "2.2.1";
+  version = "2.2.2";
 
   src = fetchFromGitHub {
     owner = "shadow1ng";
     repo = "fscan";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-awg6YqZyhlt04JobZXZx/PYuw2X7gsYKWb8480ymcN8=";
+    hash = "sha256-P3zgmjlBZCmeJxYy5SRPC9Bvl9O03LUJoeAFYhp8tGA=";
   };
 
   vendorHash = "sha256-IlGHY0KbYsy/5Yz11XhkcS9yS8byY3vhPZiTwnJM6/Q=";

From e746bfdc57ff384edb99555296373157f6474f86 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=CE=BBx=2Ex?= <44802527+corps-fini@users.noreply.github.com>
Date: Mon, 11 May 2026 18:49:04 +0200
Subject: [PATCH 14/64] ut2004: init at OldUnreal patch 3374-preview-23

---
 pkgs/by-name/ut/ut2004/data.nix     |  50 ++++++++
 pkgs/by-name/ut/ut2004/game.nix     | 173 ++++++++++++++++++++++++++++
 pkgs/by-name/ut/ut2004/image.nix    |  40 +++++++
 pkgs/by-name/ut/ut2004/package.nix  |   3 +
 pkgs/by-name/ut/ut2004/packages.nix |  10 ++
 pkgs/top-level/all-packages.nix     |   2 +
 6 files changed, 278 insertions(+)
 create mode 100644 pkgs/by-name/ut/ut2004/data.nix
 create mode 100644 pkgs/by-name/ut/ut2004/game.nix
 create mode 100644 pkgs/by-name/ut/ut2004/image.nix
 create mode 100644 pkgs/by-name/ut/ut2004/package.nix
 create mode 100644 pkgs/by-name/ut/ut2004/packages.nix

diff --git a/pkgs/by-name/ut/ut2004/data.nix b/pkgs/by-name/ut/ut2004/data.nix
new file mode 100644
index 000000000000..05117acd2b9a
--- /dev/null
+++ b/pkgs/by-name/ut/ut2004/data.nix
@@ -0,0 +1,50 @@
+{
+  fetchurl,
+  lib,
+  libarchive,
+  stdenv,
+  unshield,
+  ut2004Packages,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  name = "ut2004-data";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    libarchive
+    unshield
+  ];
+
+  unpackPhase = ''
+    runHook preUnpack
+
+    mkdir cabs
+    bsdtar -xvf "${ut2004Packages.image}/ut2004.iso" -C cabs --strip-components 1 'Disk?/*.cab' 'Disk?/*.hdr'
+    unshield -d data x cabs/data1.cab
+
+    runHook postUnpack
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mv data $out
+
+    runHook preInstall
+  '';
+
+  meta = {
+    description = "Unreal Tournament 2004 CD content provided by OldUnreal";
+    homepage = "https://oldunreal.com/downloads/ut2004/";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ corps-fini ];
+    platforms = [
+      "aarch64-linux"
+      "x86_64-linux"
+    ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
diff --git a/pkgs/by-name/ut/ut2004/game.nix b/pkgs/by-name/ut/ut2004/game.nix
new file mode 100644
index 000000000000..5592495bc96d
--- /dev/null
+++ b/pkgs/by-name/ut/ut2004/game.nix
@@ -0,0 +1,173 @@
+{
+  autoPatchelfHook,
+  copyDesktopItems,
+  fetchurl,
+  imagemagick,
+  lib,
+  libGL,
+  libarchive,
+  makeDesktopItem,
+  openal,
+  sdl3,
+  stdenv,
+  ut2004Packages,
+}:
+
+let
+  gameData = ut2004Packages.data;
+  patch-version = "3374-preview-23";
+  systemDir =
+    {
+      aarch64-linux = "SystemARM64";
+      x86_64-linux = "System";
+    }
+    .${stdenv.hostPlatform.system} or (throw "Unsupported platform: ${stdenv.hostPlatform.system}");
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "ut2004";
+  version = patch-version;
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchurl {
+    url = "https://github.com/OldUnreal/UT2004Patches/releases/download/${patch-version}/OldUnreal-UT2004Patch3374-Linux-094b94dc.tar.bz2";
+    hash = "sha256-F56kPIgxv/FHAFhQzTc8DsK3Dc9vhBwhCcFSXvEa1NM=";
+  };
+
+  buildInputs = [
+    gameData
+    libGL
+    openal
+    sdl3
+  ];
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    copyDesktopItems
+    imagemagick
+    libarchive
+  ];
+
+  unpackPhase = ''
+    runHook preUnpack
+
+    # Install files to their (relative) final location.
+    # https://github.com/OldUnreal/FullGameInstallers/blob/748525188b80f47138f19af6c8c6899230cb214e/Linux/install-ut2004.sh#L2087-L2155.
+    mkdir -p ut2004/System
+
+    for folder in Animations Benchmark ForceFeedback Help KarmaData Maps Music StaticMeshes Textures Web; do
+      cp --no-preserve=mode -vrs ${gameData}/"All_$folder" ut2004/"$folder"
+    done
+
+    cp --no-preserve=mode -vrs ${gameData}/English_Manual ut2004/Manual
+    cp --no-preserve=mode -vrs ${gameData}/English_Sounds_Speech_System_Help/Sounds ut2004
+    cp --no-preserve=mode -vrs ${gameData}/English_Sounds_Speech_System_Help/Speech ut2004
+
+    cp --no-preserve=mode -vrs ${gameData}/All_UT2004.EXE/* ut2004/System
+    cp --no-preserve=mode -vrs ${gameData}/English_Sounds_Speech_System_Help/Help/* ut2004/Help
+    cp --no-preserve=mode -vrs ${gameData}/English_Sounds_Speech_System_Help/System/* ut2004/System
+    cp --no-preserve=mode -vrs ${gameData}/US_License.int ut2004/System
+
+    # Patch.
+    bsdtar --unlink-first -xf "$src" -C ut2004
+
+    # Remove files superseded by the patch.
+    # https://github.com/OldUnreal/FullGameInstallers/blob/748525188b80f47138f19af6c8c6899230cb214e/Linux/install-ut2004.sh#L2169-L2194
+    rm -v -- ut2004/System/{StreamLineFX,XVoting}.u
+
+    # Remove windows files.
+    # https://github.com/OldUnreal/FullGameInstallers/blob/748525188b80f47138f19af6c8c6899230cb214e/Linux/install-ut2004.sh#L2087-L2155.
+    rm -v -- ut2004/System/*.bat
+    rm -v -- ut2004/System/*.dll
+    rm -v -- ut2004/System/*.exe
+
+    # Remove unused architectures.
+    if [ "${systemDir}" != System ]; then
+        rm -v -- ut2004/System/*.so
+        rm -v -- ut2004/System/{UT2004,ut2004-bin,ut2004-bin-amd64}
+        rm -v -- ut2004/System/{UCC,ucc-bin,ucc-bin-amd64}
+    fi
+    for dir in SystemARM64 SystemPPC64LE; do
+      if [ "${systemDir}" != "$dir" ]; then
+        rm -rfv -- ut2004/"$dir"
+      fi
+    done
+
+    # Use system dependencies.
+    rm -v -- ut2004/${systemDir}/libopenal.so.1
+    rm -v -- ut2004/${systemDir}/libopenal.so.1.*
+    rm -v -- ut2004/${systemDir}/libSDL3.so.0
+    rm -v -- ut2004/${systemDir}/libSDL3.so.0.*
+
+    # Make icons.
+    # identify Unreal.ico
+    # Unreal.ico[0] ICO 48x48 48x48+0+0 4-bit sRGB 0.000u 0:00.000
+    # Unreal.ico[1] ICO 32x32 32x32+0+0 4-bit sRGB 0.000u 0:00.000
+    # Unreal.ico[2] ICO 16x16 16x16+0+0 4-bit sRGB 0.000u 0:00.000
+    # Unreal.ico[3] ICO 48x48 48x48+0+0 8-bit sRGB 0.000u 0:00.000
+    # Unreal.ico[4] ICO 32x32 32x32+0+0 8-bit sRGB 0.000u 0:00.000
+    # Unreal.ico[5] ICO 16x16 16x16+0+0 8-bit sRGB 0.000u 0:00.000
+    # Unreal.ico[6] ICO 48x48 48x48+0+0 8-bit sRGB 0.000u 0:00.000
+    # Unreal.ico[7] ICO 32x32 32x32+0+0 8-bit sRGB 24070B 0.000u 0:00.000
+    icon_src=ut2004/Help/Unreal.ico
+    mkdir -p icons/hicolor/{16x16,32x32,48x48}
+    magick -background none "$icon_src[5]" icons/hicolor/16x16/ut2004.png
+    magick -background none "$icon_src[7]" icons/hicolor/32x32/ut2004.png
+    magick -background none "$icon_src[6]" icons/hicolor/48x48/ut2004.png
+
+    runHook postUnpack
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    # Install game data.
+    mkdir -p "$out"/opt
+    mv ut2004 "$out"/opt
+
+    # Install icons.
+    mkdir -p "$out"/share
+    mv icons "$out"/share
+
+    # Install binaries.
+    mkdir -p "$out"/bin
+    ln -s "$out"/opt/ut2004/${systemDir}/ut2004-bin "$out"/bin/ut2004
+    ln -s "$out"/opt/ut2004/${systemDir}/ucc-bin "$out"/bin/ut2004-ucc
+
+    runHook postInstall
+  '';
+
+  appendRunpaths = [
+    "${placeholder "out"}/opt/ut2004/System"
+  ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = "ut2004";
+      desktopName = "Unreal Tournament 2004";
+      comment = "Unreal Tournament 2004 with OldUnreal patch ${patch-version}";
+      exec = "ut2004";
+      icon = "ut2004";
+      categories = [ "Game" ];
+    })
+  ];
+
+  meta = {
+    description = "First-person arena shooter";
+    longDescription = ''
+      Unreal Tournament 2004 with OldUnreal patch ${patch-version}.
+      Pin ut2004Packages.image to avoid downloading the disc image when build tools are updated (for example libarchive) at the cost of extra disk space.
+      To save disk space, pin ut2004Packages.data instead of ut2004Packages.image to avoid downloading the disc image when the patch is updated.
+    '';
+    homepage = "https://oldunreal.com/downloads/ut2004/";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ corps-fini ];
+    mainProgram = "ut2004";
+    platforms = [
+      "aarch64-linux"
+      "x86_64-linux"
+    ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
diff --git a/pkgs/by-name/ut/ut2004/image.nix b/pkgs/by-name/ut/ut2004/image.nix
new file mode 100644
index 000000000000..ed82a8326f49
--- /dev/null
+++ b/pkgs/by-name/ut/ut2004/image.nix
@@ -0,0 +1,40 @@
+{
+  fetchurl,
+  lib,
+  stdenvNoCC,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  name = "ut2004-image";
+
+  src = fetchurl {
+    urls = [
+      "https://files.oldunreal.net/UT2004.ISO"
+      "https://files2.oldunreal.net/UT2004.ISO"
+      "https://files3.oldunreal.net/UT2004.ISO"
+    ];
+    hash = "sha256-Q+kYKuILy8D29FiP7mwbM2wmHxRlQDEYoZc7CbGiJUE=";
+  };
+
+  dontUnpack = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -D $src $out/ut2004.iso
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "Unreal Tournament 2004 CD image provided by OldUnreal";
+    homepage = "https://oldunreal.com/downloads/ut2004/";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ corps-fini ];
+    platforms = [
+      "aarch64-linux"
+      "x86_64-linux"
+    ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+  };
+})
diff --git a/pkgs/by-name/ut/ut2004/package.nix b/pkgs/by-name/ut/ut2004/package.nix
new file mode 100644
index 000000000000..c8ef28de5614
--- /dev/null
+++ b/pkgs/by-name/ut/ut2004/package.nix
@@ -0,0 +1,3 @@
+{ ut2004Packages }:
+
+ut2004Packages.game
diff --git a/pkgs/by-name/ut/ut2004/packages.nix b/pkgs/by-name/ut/ut2004/packages.nix
new file mode 100644
index 000000000000..4a57e1792a11
--- /dev/null
+++ b/pkgs/by-name/ut/ut2004/packages.nix
@@ -0,0 +1,10 @@
+{
+  lib,
+  newScope,
+}:
+
+lib.makeScope newScope (self: {
+  image = self.callPackage ./image.nix { };
+  data = self.callPackage ./data.nix { };
+  game = self.callPackage ./game.nix { };
+})
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index a441717c2538..417e0c6d5479 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -9826,6 +9826,8 @@ with pkgs;
 
   ultrastar-manager = callPackage ../tools/misc/ultrastar-manager { };
 
+  ut2004Packages = recurseIntoAttrs (callPackage ../by-name/ut/ut2004/packages.nix { });
+
   # To ensure vdrift's code is built on hydra
   vdrift-bin = vdrift.bin;
 

From 4a765b8125f141d6508ad8c774d37e8bb8998843 Mon Sep 17 00:00:00 2001
From: Niklas Korz <niklas@niklaskorz.de>
Date: Wed, 30 Sep 2026 21:34:57 +0200
Subject: [PATCH 15/64] servo: fix darwin

---
 pkgs/by-name/se/servo/package.nix | 46 ++++++++++++++++++++-----------
 1 file changed, 30 insertions(+), 16 deletions(-)

diff --git a/pkgs/by-name/se/servo/package.nix b/pkgs/by-name/se/servo/package.nix
index 1f2b79ea74b1..907d8d3da0f3 100644
--- a/pkgs/by-name/se/servo/package.nix
+++ b/pkgs/by-name/se/servo/package.nix
@@ -101,6 +101,19 @@ rustPlatform.buildRustPackage (finalAttrs: {
     for mozjs_dir in $cargoDepsCopy/*/mozjs_*/; do
       cp Cargo.lock $mozjs_dir
     done
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    # The nix cc wrapper prints a warning to stderr when it receives a `--target`
+    # that differs from its default one.
+    # cc-rs probes whether a flag is supported by compiling a test file and
+    # treats any stderr output as unsupported, so every `flag_if_supported`
+    # flag is silently dropped, including `-fno-rtti` for mozjs-sys jsglue:
+    # https://github.com/servo/mozjs/blob/de3c7bdc1178274c31bedccf60ae04a3ff5c0619/mozjs-sys/build.rs#L572
+    # https://github.com/rust-lang/cc-rs/blob/c619f08c5f270c3f153fd3bce20540d2422d1356/src/lib.rs#L1748
+    # Compiling jsglue with RTTI while SpiderMonkey is built without results
+    # in a linker error.
+    substituteInPlace $cargoDepsCopy/*/cc-1.*/src/lib.rs \
+      --replace-fail '"--target={clang_target}"' '"--target=${stdenv.hostPlatform.config}"'
   '';
 
   # set `HOME` to a temp dir for write access
@@ -130,8 +143,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
     yasm
   ];
 
-  env.UV_PYTHON = customPython.interpreter;
-
   buildInputs = [
     fontconfig
     freetype
@@ -153,23 +164,28 @@ rustPlatform.buildRustPackage (finalAttrs: {
     vulkan-loader
   ];
 
-  env.NIX_CFLAGS_COMPILE = toString (
-    [
-      # mozjs-sys fails with:
-      #  cc1plus: error: '-Wformat-security' ignored without '-Wformat'
-      "-Wno-error=format-security"
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      "-I${lib.getInclude stdenv.cc.libcxx}/include/c++/v1"
-    ]
-  );
+  env = {
+    UV_PYTHON = customPython.interpreter;
+
+    NIX_CFLAGS_COMPILE = toString (
+      [
+        # mozjs-sys fails with:
+        #  cc1plus: error: '-Wformat-security' ignored without '-Wformat'
+        "-Wno-error=format-security"
+      ]
+      ++ lib.optionals stdenv.hostPlatform.isDarwin [
+        "-I${lib.getInclude stdenv.cc.libcxx}/include/c++/v1"
+      ]
+    );
+  };
 
   # copy resources into `$out` to be used during runtime
-  # link runtime libraries
   postFixup = ''
     mkdir -p $out/resources
     cp -r ./resources $out/
-
+  ''
+  # link runtime libraries
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
     wrapProgram $out/bin/servoshell \
       --prefix LD_LIBRARY_PATH : ${runtimePaths}
   '';
@@ -180,8 +196,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
   };
 
   meta = {
-    # undefined libmozjs_sys symbols during linking
-    broken = stdenv.hostPlatform.isDarwin;
     changelog = "https://github.com/servo/servo/releases/tag/${finalAttrs.src.tag}";
     description = "Embeddable, independent, memory-safe, modular, parallel web rendering engine";
     homepage = "https://servo.org";

From 1cef8d62a2832bf6f2423752cae85fa452a6faea Mon Sep 17 00:00:00 2001
From: Jost Alemann <alemann@posteo.com>
Date: Thu, 1 Oct 2026 21:32:36 +0200
Subject: [PATCH 16/64] ruff: 0.16.9 -> 0.16.10

Changelog: https://github.com/astral-sh/ruff/releases/tag/0.16.10
Diff: https://github.com/astral-sh/ruff/compare/0.16.9...0.16.10
---
 pkgs/by-name/ru/ruff/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ru/ruff/package.nix b/pkgs/by-name/ru/ruff/package.nix
index 19f4e3781a39..40b9ffbd359f 100644
--- a/pkgs/by-name/ru/ruff/package.nix
+++ b/pkgs/by-name/ru/ruff/package.nix
@@ -16,7 +16,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "ruff";
-  version = "0.16.9";
+  version = "0.16.10";
 
   __structuredAttrs = true;
 
@@ -24,12 +24,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "astral-sh";
     repo = "ruff";
     tag = finalAttrs.version;
-    hash = "sha256-gxQXIlle9LGs1HcPiJn7KW0p21xsr62/FGypyqEfnSI=";
+    hash = "sha256-k06KqlFRQju6bDbZboPaqEqzWY0Fw3BBKmzb8Vk4G24=";
   };
 
   cargoBuildFlags = [ "--package=ruff" ];
 
-  cargoHash = "sha256-5ZolzeBEj6dolhObhWS/jMyB7KJPRSIbN0+zcG+0AGY=";
+  cargoHash = "sha256-rwI+8VxGo7W5ol6FfhKaxRjogbwx6tcYlHEgEuMJXCs=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From 78afd0bafe2070471f87cfca06f997ecabdc31d2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 1 Oct 2026 20:42:40 +0000
Subject: [PATCH 17/64] roon-server: 2.71.1683 -> 2.73.1696

---
 pkgs/by-name/ro/roon-server/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ro/roon-server/package.nix b/pkgs/by-name/ro/roon-server/package.nix
index 5eef70809318..2383cf8dcf4d 100644
--- a/pkgs/by-name/ro/roon-server/package.nix
+++ b/pkgs/by-name/ro/roon-server/package.nix
@@ -16,7 +16,7 @@
   stdenv,
 }:
 let
-  version = "2.71.1683";
+  version = "2.73.1696";
   urlVersion = builtins.replaceStrings [ "." ] [ "0" ] version;
 in
 stdenv.mkDerivation {
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://download.roonlabs.com/updates/production/RoonServer_linuxx64_${urlVersion}.tar.bz2";
-    hash = "sha256-z/8rORTsDUhgh2hfep62jMVeAvX/c5HW4vBkVnvhcQc=";
+    hash = "sha256-BD8qBJCsmpx24k003t5QXC658p3ofOSZtQCZHKOypvg=";
   };
 
   dontConfigure = true;

From 3ddaa7aa1c5bb78567c20a51c809043ed3b85f51 Mon Sep 17 00:00:00 2001
From: Vinay Mehta <14790730+vimeh@users.noreply.github.com>
Date: Thu, 1 Oct 2026 12:35:14 -0700
Subject: [PATCH 18/64] herdr: 0.9.1 -> 0.9.3

Changelogs:
https://github.com/herdrdev/herdr/releases/tag/v0.9.2
https://github.com/herdrdev/herdr/releases/tag/v0.9.3

Assisted-by: Pi (OpenAI gpt-6-astra)
---
 pkgs/by-name/he/herdr/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/he/herdr/package.nix b/pkgs/by-name/he/herdr/package.nix
index b94140bb115e..760d1bc769ad 100644
--- a/pkgs/by-name/he/herdr/package.nix
+++ b/pkgs/by-name/he/herdr/package.nix
@@ -13,7 +13,7 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "herdr";
-  version = "0.9.1";
+  version = "0.9.3";
 
   __structuredAttrs = true;
 
@@ -21,10 +21,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "herdrdev";
     repo = "herdr";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-N6+kprfWRyh0AkAiopkGsNXUGGORyPVFHEaDHCpGQs8=";
+    hash = "sha256-uu452Xe23pSvFk7w7fKPjiaqY5QenUIljao2SFAxpc0=";
   };
 
-  cargoHash = "sha256-1VAmsDE3zeU0wMVQKleQcd/zq8/k/oor8tasrsRQfeY=";
+  cargoHash = "sha256-+gTWtEheyuI59yf2PqRbcbcFIW+/cYb7zZ2mPv2VN0Y=";
 
   zigDeps = zig_0_16.fetchDeps {
     inherit (finalAttrs) pname version;

From b1440fd8cbf4c95b62e820c3d752aa249aae7fb0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Sandro=20J=C3=A4ckel?= <sandro.jaeckel@gmail.com>
Date: Fri, 2 Oct 2026 00:05:20 +0200
Subject: [PATCH 19/64] engelsystem: 3.7.0 -> 3.7.1

Diff: https://github.com/engelsystem/engelsystem/compare/v3.7.0...v3.7.1

Changelog: https://github.com/engelsystem/engelsystem/releases/tag/v3.7.1
---
 pkgs/by-name/en/engelsystem/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/en/engelsystem/package.nix b/pkgs/by-name/en/engelsystem/package.nix
index e7c0a2bfd77f..b9b7547e8265 100644
--- a/pkgs/by-name/en/engelsystem/package.nix
+++ b/pkgs/by-name/en/engelsystem/package.nix
@@ -11,25 +11,25 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "engelsystem";
-  version = "3.7.0";
+  version = "3.7.1";
 
   src = fetchFromGitHub {
     owner = "engelsystem";
     repo = "engelsystem";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-hnTkeSqxkvO2Prop0VaBAV/4opr46wjEaJ5ptd5zQ34=";
+    hash = "sha256-G3Ejj/Hcxfd394sOlLy0Xk/CjKbJnTyUPQn5mNLH31I=";
   };
 
   inherit php;
 
   composerNoDev = true;
   composerStrictValidation = false;
-  vendorHash = "sha256-oGpgtkX0UVSdVceQ8pD3PuGBITifQzaMIb4QRdc7WeY=";
+  vendorHash = "sha256-Q1Vr8AywDAI6Apb4ShyV6DhSV3Fm0rX6X0uXlnO3CZo=";
 
   yarnOfflineCache = fetchYarnDeps {
     pname = "${finalAttrs.pname}-yarn-deps";
     yarnLock = "${finalAttrs.src}/yarn.lock";
-    hash = "sha256-IMg1AoqCiQEvMHeqXgonIY2J0nmBHLW2Drz/Vb0rD48=";
+    hash = "sha256-FRwmsnRsTVphSFurgaLcfNlNvxcC8fTR79G8r6RGB5A=";
   };
 
   strictDeps = true;

From 85b56ec3e01039d87a2281c379c32adbb10067a1 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 2 Oct 2026 02:00:00 +0000
Subject: [PATCH 20/64] reaper: 7.79 -> 7.81

---
 pkgs/by-name/re/reaper/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/re/reaper/package.nix b/pkgs/by-name/re/reaper/package.nix
index 7416c611b782..1f4ecf15feec 100644
--- a/pkgs/by-name/re/reaper/package.nix
+++ b/pkgs/by-name/re/reaper/package.nix
@@ -40,17 +40,17 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "reaper";
-  version = "7.79";
+  version = "7.81";
 
   src = fetchurl {
     url = url_for_platform finalAttrs.version stdenv.hostPlatform.qemuArch;
     hash =
       if stdenv.hostPlatform.isDarwin then
-        "sha256-JJPOo81hBdhLvwJxAoDXPqihGfBjcBUnc0g3Z/rehgI="
+        "sha256-z3ym5rqsymPBNbKdfifrqC2KSuRnwOR/VpGBSKc91iQ="
       else
         {
-          x86_64-linux = "sha256-pCC0f8WhvvK6bsv0k3u2ewlDM/Daoxjf5wLV/NqjiEY=";
-          aarch64-linux = "sha256-5kQrlvyKsTxBErhcPH1niS7mKDuIP7dOPG2JoRYWcr4=";
+          x86_64-linux = "sha256-1WVIaKD08xowslG1T//DLKmsV42ZgV6HwAkD1Ln3iLk=";
+          aarch64-linux = "sha256-Bb/IVY1uundgUBytGvl9MtUZ5l7TWCbaw0MUIwYvBb4=";
         }
         .${stdenv.hostPlatform.system};
   };

From 1c4a5b8c798e5b456da7a984e8eb129547aff28c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 2 Oct 2026 09:13:57 +0000
Subject: [PATCH 21/64] postgresqlPackages.pg_ivm: 1.15 -> 1.16

---
 pkgs/servers/sql/postgresql/ext/pg_ivm.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/sql/postgresql/ext/pg_ivm.nix b/pkgs/servers/sql/postgresql/ext/pg_ivm.nix
index 349367f08d64..695e09584e85 100644
--- a/pkgs/servers/sql/postgresql/ext/pg_ivm.nix
+++ b/pkgs/servers/sql/postgresql/ext/pg_ivm.nix
@@ -7,13 +7,13 @@
 
 postgresqlBuildExtension (finalAttrs: {
   pname = "pg_ivm";
-  version = "1.15";
+  version = "1.16";
 
   src = fetchFromGitHub {
     owner = "sraoss";
     repo = "pg_ivm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-8JQ7r/e5FRAWsshTcTmPnVnbwjXkshP4yaulYS7Zse4=";
+    hash = "sha256-mSyi8k1j8rIf9TIKkpL1oFlDQYlvp1PUAtcarjeGVVg=";
   };
 
   meta = {

From 2ea951b53ef8b82f128c65125e8f122df776cb9b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 2 Oct 2026 14:27:58 +0000
Subject: [PATCH 22/64] azure-cli-extensions.confcom: 2.1.1 -> 2.3.0

---
 pkgs/by-name/az/azure-cli/extensions-manual.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/az/azure-cli/extensions-manual.nix b/pkgs/by-name/az/azure-cli/extensions-manual.nix
index b4d83d80b028..350f95d5fb60 100644
--- a/pkgs/by-name/az/azure-cli/extensions-manual.nix
+++ b/pkgs/by-name/az/azure-cli/extensions-manual.nix
@@ -174,9 +174,9 @@
 
   confcom = mkAzExtension rec {
     pname = "confcom";
-    version = "2.1.1";
+    version = "2.3.0";
     url = "https://azcliprod.blob.core.windows.net/cli-extensions/confcom-${version}-py3-none-any.whl";
-    hash = "sha256-e8nZmjSoEuU3mjQdFfQlHjHuglNk/YTgVmj40+A40E8=";
+    hash = "sha256-HJ9AlRjBZoYEbuiT19N1UYrHoMzYDKS/NKyLoxhut10=";
     description = "Microsoft Azure Command-Line Tools Confidential Container Security Policy Generator Extension";
     nativeBuildInputs = [ autoPatchelfHook ];
     buildInputs = [ openssl ];

From 649dde4905ccd7a9712d68f18452f795db75fd41 Mon Sep 17 00:00:00 2001
From: Marcel <me@m4rc3l.de>
Date: Fri, 2 Oct 2026 18:38:43 +0200
Subject: [PATCH 23/64] nextcloud*Packages.apps.bbb: init at 2.9.4

---
 pkgs/servers/nextcloud/packages/33.json             | 10 ++++++++++
 pkgs/servers/nextcloud/packages/34.json             | 10 ++++++++++
 pkgs/servers/nextcloud/packages/35.json             | 10 ++++++++++
 pkgs/servers/nextcloud/packages/nextcloud-apps.json |  1 +
 4 files changed, 31 insertions(+)

diff --git a/pkgs/servers/nextcloud/packages/33.json b/pkgs/servers/nextcloud/packages/33.json
index 105aca716144..0059f7ad91b5 100644
--- a/pkgs/servers/nextcloud/packages/33.json
+++ b/pkgs/servers/nextcloud/packages/33.json
@@ -1,4 +1,14 @@
 {
+  "bbb": {
+    "hash": "sha256-EKmoxRj0Ctua51PnYQUKC04Z40S7bdzBUBgY3bYJ4iM=",
+    "url": "https://github.com/littleredbutton/cloud_bbb/releases/download/v2.9.4/bbb-v2.9.4.tar.gz",
+    "version": "2.9.4",
+    "description": "This app allows to create meetings with an external installation of [BigBlueButton](https://bigbluebutton.org).\n\n* **Room setup** Create multiple room configurations with name, welcome message …\n* **Share guest link** Share the room link with all your guests\n* **Share moderator link** Invite moderators to the room\n* **Share rooms** Share rooms with members, groups or circles\n* **Custom presentation** Start a room with a selected presentation from your file browser\n* **Manage recordings** View, share and delete recordings for your rooms\n* **Restrictions** Restrict room creation to certain groups\n* **Activities** Get an overview of your room activities\n\nQuick start guide and further information in our [readme](https://github.com/littleredbutton/cloud_bbb).\nDo you like this application? Give something back to the open source community and checkout our\n[ways to contribute](https://github.com/littleredbutton/cloud_bbb/blob/master/.github/contributing.md).\n\nContributors are welcome! If you have time it would be awesome if you could help to enhance this application.\n\n*This app integrates BigBlueButton and is not endorsed or certified by BigBlueButton Inc. BigBlueButton and the BigBlueButton Logo are trademarks of BigBlueButton Inc.*",
+    "homepage": "https://github.com/littleredbutton/cloud_bbb/",
+    "licenses": [
+      "agpl"
+    ]
+  },
   "bookmarks": {
     "hash": "sha256-Oirgd5ffDvvWG4yoZB/3r7+npLqNqe8joZfJBTxqFXE=",
     "url": "https://github.com/nextcloud/bookmarks/releases/download/v16.2.7/bookmarks-16.2.7.tar.gz",
diff --git a/pkgs/servers/nextcloud/packages/34.json b/pkgs/servers/nextcloud/packages/34.json
index 2ba5d3938cb0..4ed255e8d1b0 100644
--- a/pkgs/servers/nextcloud/packages/34.json
+++ b/pkgs/servers/nextcloud/packages/34.json
@@ -1,4 +1,14 @@
 {
+  "bbb": {
+    "hash": "sha256-EKmoxRj0Ctua51PnYQUKC04Z40S7bdzBUBgY3bYJ4iM=",
+    "url": "https://github.com/littleredbutton/cloud_bbb/releases/download/v2.9.4/bbb-v2.9.4.tar.gz",
+    "version": "2.9.4",
+    "description": "This app allows to create meetings with an external installation of [BigBlueButton](https://bigbluebutton.org).\n\n* **Room setup** Create multiple room configurations with name, welcome message …\n* **Share guest link** Share the room link with all your guests\n* **Share moderator link** Invite moderators to the room\n* **Share rooms** Share rooms with members, groups or circles\n* **Custom presentation** Start a room with a selected presentation from your file browser\n* **Manage recordings** View, share and delete recordings for your rooms\n* **Restrictions** Restrict room creation to certain groups\n* **Activities** Get an overview of your room activities\n\nQuick start guide and further information in our [readme](https://github.com/littleredbutton/cloud_bbb).\nDo you like this application? Give something back to the open source community and checkout our\n[ways to contribute](https://github.com/littleredbutton/cloud_bbb/blob/master/.github/contributing.md).\n\nContributors are welcome! If you have time it would be awesome if you could help to enhance this application.\n\n*This app integrates BigBlueButton and is not endorsed or certified by BigBlueButton Inc. BigBlueButton and the BigBlueButton Logo are trademarks of BigBlueButton Inc.*",
+    "homepage": "https://github.com/littleredbutton/cloud_bbb/",
+    "licenses": [
+      "agpl"
+    ]
+  },
   "bookmarks": {
     "hash": "sha256-Oirgd5ffDvvWG4yoZB/3r7+npLqNqe8joZfJBTxqFXE=",
     "url": "https://github.com/nextcloud/bookmarks/releases/download/v16.2.7/bookmarks-16.2.7.tar.gz",
diff --git a/pkgs/servers/nextcloud/packages/35.json b/pkgs/servers/nextcloud/packages/35.json
index 0502e2c4d354..5981e6b7e462 100644
--- a/pkgs/servers/nextcloud/packages/35.json
+++ b/pkgs/servers/nextcloud/packages/35.json
@@ -1,4 +1,14 @@
 {
+  "bbb": {
+    "hash": "sha256-EKmoxRj0Ctua51PnYQUKC04Z40S7bdzBUBgY3bYJ4iM=",
+    "url": "https://github.com/littleredbutton/cloud_bbb/releases/download/v2.9.4/bbb-v2.9.4.tar.gz",
+    "version": "2.9.4",
+    "description": "This app allows to create meetings with an external installation of [BigBlueButton](https://bigbluebutton.org).\n\n* **Room setup** Create multiple room configurations with name, welcome message …\n* **Share guest link** Share the room link with all your guests\n* **Share moderator link** Invite moderators to the room\n* **Share rooms** Share rooms with members, groups or circles\n* **Custom presentation** Start a room with a selected presentation from your file browser\n* **Manage recordings** View, share and delete recordings for your rooms\n* **Restrictions** Restrict room creation to certain groups\n* **Activities** Get an overview of your room activities\n\nQuick start guide and further information in our [readme](https://github.com/littleredbutton/cloud_bbb).\nDo you like this application? Give something back to the open source community and checkout our\n[ways to contribute](https://github.com/littleredbutton/cloud_bbb/blob/master/.github/contributing.md).\n\nContributors are welcome! If you have time it would be awesome if you could help to enhance this application.\n\n*This app integrates BigBlueButton and is not endorsed or certified by BigBlueButton Inc. BigBlueButton and the BigBlueButton Logo are trademarks of BigBlueButton Inc.*",
+    "homepage": "https://github.com/littleredbutton/cloud_bbb/",
+    "licenses": [
+      "agpl"
+    ]
+  },
   "bookmarks": {
     "hash": "sha256-YdFpK2RSNkIzOuiveHmlidsaxWjm1fS++pFkO9pWsCM=",
     "url": "https://github.com/nextcloud/bookmarks/releases/download/v17.0.0/bookmarks-17.0.0.tar.gz",
diff --git a/pkgs/servers/nextcloud/packages/nextcloud-apps.json b/pkgs/servers/nextcloud/packages/nextcloud-apps.json
index 41d222b8e4dc..7ec2c221bb82 100644
--- a/pkgs/servers/nextcloud/packages/nextcloud-apps.json
+++ b/pkgs/servers/nextcloud/packages/nextcloud-apps.json
@@ -1,5 +1,6 @@
 {
   "app_api" : "agpl3Plus"
+, "bbb" : "agpl3Plus"
 , "bookmarks": "agpl3Plus"
 , "calendar": "agpl3Plus"
 , "calendar_resource_management": "agpl3Only"

From cf9fd2c4b03582d77164b1f59688d5b132254a44 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 2 Oct 2026 18:43:05 +0200
Subject: [PATCH 24/64] python3Packages.astropy-helpers: add
 pkg-resources-backport

---
 pkgs/development/python-modules/astropy-helpers/default.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/astropy-helpers/default.nix b/pkgs/development/python-modules/astropy-helpers/default.nix
index f0938e83a7ab..2b0539e5cf73 100644
--- a/pkgs/development/python-modules/astropy-helpers/default.nix
+++ b/pkgs/development/python-modules/astropy-helpers/default.nix
@@ -3,6 +3,7 @@
   buildPythonPackage,
   fetchFromGitHub,
   setuptools,
+  pkg-resources-backport,
 }:
 
 buildPythonPackage rec {
@@ -22,7 +23,10 @@ buildPythonPackage rec {
     ./python-imp.patch
   ];
 
-  build-system = [ setuptools ];
+  build-system = [
+    setuptools
+    pkg-resources-backport
+  ];
 
   pythonImportsCheck = [ "astropy_helpers" ];
 

From a79be6b13441efde23c3577cd0d3c01f4b02ffd1 Mon Sep 17 00:00:00 2001
From: Zexin Yuan <git@yzx9.xyz>
Date: Sat, 3 Oct 2026 01:38:53 +0800
Subject: [PATCH 25/64] aider-chat: fix build with litellm 1.102.1

litellm >= 1.101.0 exports a new top-level VectorStoreSearchError
exception (BerriAI/litellm#39516). aider's LiteLLMExceptions._load()
audits every top-level "*Error" name in litellm against a hardcoded
list and raises

  ValueError: VectorStoreSearchError is in litellm but not in
  aider's exceptions list

on every LLM send, which broke the build (25 test failures) after
litellm 1.100.1 -> 1.102.1 in #568471. Add the exception to the
list, like the earlier backports for BadGatewayError/ImageFetchError
and PermissionDeniedError. Not yet fixed upstream.

Assisted-by: Claude-Code:GLM-5.3
---
 .../ai/aider-chat/add-vector-store-search-error.patch | 11 +++++++++++
 pkgs/by-name/ai/aider-chat/package.nix                |  5 +++++
 2 files changed, 16 insertions(+)
 create mode 100644 pkgs/by-name/ai/aider-chat/add-vector-store-search-error.patch

diff --git a/pkgs/by-name/ai/aider-chat/add-vector-store-search-error.patch b/pkgs/by-name/ai/aider-chat/add-vector-store-search-error.patch
new file mode 100644
index 000000000000..76394dd4bde6
--- /dev/null
+++ b/pkgs/by-name/ai/aider-chat/add-vector-store-search-error.patch
@@ -0,0 +1,11 @@
+diff --git a/aider/exceptions.py b/aider/exceptions.py
+--- a/aider/exceptions.py
++++ b/aider/exceptions.py
+@@ -49,6 +49,7 @@
+     ExInfo("ServiceUnavailableError", True, "The API provider's servers are down or overloaded."),
+     ExInfo("UnprocessableEntityError", True, None),
+     ExInfo("UnsupportedParamsError", True, None),
++    ExInfo("VectorStoreSearchError", False, None),
+     ExInfo(
+         "Timeout",
+         True,
diff --git a/pkgs/by-name/ai/aider-chat/package.nix b/pkgs/by-name/ai/aider-chat/package.nix
index f81abd03ec89..cb33860f3073 100644
--- a/pkgs/by-name/ai/aider-chat/package.nix
+++ b/pkgs/by-name/ai/aider-chat/package.nix
@@ -173,6 +173,11 @@ let
         url = "https://github.com/Aider-AI/aider/commit/38716cc5a2621499c50454aa77ee379aa2b0c590.patch";
         hash = "sha256-uDIUHbauAmzCfaqx6aswnkUHcmgJi4X2OdMPyn4NeYU=";
       })
+
+      # litellm >= 1.101.0 exports the new VectorStoreSearchError exception at
+      # top level, which trips the strict audit in LiteLLMExceptions._load()
+      # (same failure mode as the two patches above)
+      ./add-vector-store-search-error.patch
     ];
 
     disabledTestPaths = [

From 8c528189a3fba5598861dff6f2d67e1d6f027bce Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 2 Oct 2026 18:32:34 +0000
Subject: [PATCH 26/64] wastebin: 3.7.2 -> 3.8.0

---
 pkgs/by-name/wa/wastebin/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/wa/wastebin/package.nix b/pkgs/by-name/wa/wastebin/package.nix
index 6e00e9b415f5..71bcec3ca17d 100644
--- a/pkgs/by-name/wa/wastebin/package.nix
+++ b/pkgs/by-name/wa/wastebin/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "wastebin";
-  version = "3.7.2";
+  version = "3.8.0";
 
   src = fetchFromGitHub {
     owner = "matze";
     repo = "wastebin";
     rev = finalAttrs.version;
-    hash = "sha256-IzrwFiLJfvFKHdYaDmaYYwdBUlQed9WEy/7OBvlAUTQ=";
+    hash = "sha256-ybKa6ZkQek9S0Zjz/lRODzjWvzTTu+PtfMrnYu+Nzrs=";
   };
 
-  cargoHash = "sha256-tq2Hc5CAp5Cp6AYS/NGb0HEtvm+lH8qak+M8toksDF4=";
+  cargoHash = "sha256-hdu+t3xdS7KYcos6N1EkygCoAdaUOowldb0NGEOPtSQ=";
 
   nativeBuildInputs = [
     pkg-config

From 214336c4a71f83da27ffd36e99eb2c652e4c6869 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 2 Oct 2026 19:56:09 +0000
Subject: [PATCH 27/64] luwen: 0.9.0 -> 0.10.0

---
 pkgs/by-name/lu/luwen/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/lu/luwen/package.nix b/pkgs/by-name/lu/luwen/package.nix
index 706f584d8d59..a91d05c01838 100644
--- a/pkgs/by-name/lu/luwen/package.nix
+++ b/pkgs/by-name/lu/luwen/package.nix
@@ -6,21 +6,21 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "luwen";
-  version = "0.9.0";
+  version = "0.10.0";
   __structuredAttrs = true;
 
   src = fetchFromGitHub {
     owner = "tenstorrent";
     repo = "luwen";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pc/7G9YxBTg2uYn47ONxI7zsfdK3Ex4zndLASRtDQyk=";
+    hash = "sha256-J0SvCBsDi3GMvnwqgqGMUDvrSO+baznDhsfuvF44Ens=";
   };
 
   nativeBuildInputs = [
     protobuf
   ];
 
-  cargoHash = "sha256-2ibAZnfv++eyCB57F0uD7XFJ3MP9SnAApOn6uelo3Po=";
+  cargoHash = "sha256-vEuVxBGIJAyc8POy3EPTzTK5g5SE3QDZcnTnAb3b5k0=";
 
   meta = {
     description = "Tenstorrent system interface tools";

From dd79ab9bf2f8ecc90a973555de1382013ead1064 Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Tue, 29 Sep 2026 23:04:02 +0000
Subject: [PATCH 28/64] python3Packages.cuda-cccl: 1.2.0 -> 1.2.1

Diff: https://github.com/NVIDIA/cccl/compare/python-1.2.0...python-1.2.1

Changelog: https://github.com/NVIDIA/cccl/releases/tag/python-1.2.1
---
 pkgs/development/python-modules/cuda-cccl/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/cuda-cccl/default.nix b/pkgs/development/python-modules/cuda-cccl/default.nix
index 92785a0ea478..fc6d067b7a45 100644
--- a/pkgs/development/python-modules/cuda-cccl/default.nix
+++ b/pkgs/development/python-modules/cuda-cccl/default.nix
@@ -30,7 +30,7 @@
 
 buildPythonPackage.override { stdenv = cudaPackages.backendStdenv; } (finalAttrs: {
   pname = "cuda-cccl";
-  version = "1.2.0";
+  version = "1.2.1";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -38,7 +38,7 @@ buildPythonPackage.override { stdenv = cudaPackages.backendStdenv; } (finalAttrs
     owner = "NVIDIA";
     repo = "cccl";
     tag = "python-${finalAttrs.version}";
-    hash = "sha256-0Qsf3l9VvSxYVVWQG0ST7S33s7LdsNyWoV6Q2f0Ru6o=";
+    hash = "sha256-GyZD6YGqZNS3HDuhv0Y286LtisqqxHLr8SlGee5rXlw=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/python/cuda_cccl";

From 6d9db8c1b8aa74579291d18952e1bb09fd36e46f Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Fri, 2 Oct 2026 21:02:59 +0000
Subject: [PATCH 29/64] python3Packages.mhcflurry: 2.3.8 -> 2.3.13

Diff: https://github.com/openvax/mhcflurry/compare/2.3.8...2.3.13

Changelog: https://github.com/openvax/mhcflurry/releases/tag/2.3.13
---
 pkgs/development/python-modules/mhcflurry/default.nix | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mhcflurry/default.nix b/pkgs/development/python-modules/mhcflurry/default.nix
index c83aee4678b2..d8f9f2d27455 100644
--- a/pkgs/development/python-modules/mhcflurry/default.nix
+++ b/pkgs/development/python-modules/mhcflurry/default.nix
@@ -29,7 +29,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "mhcflurry";
-  version = "2.3.8";
+  version = "2.3.13";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -37,7 +37,7 @@ buildPythonPackage (finalAttrs: {
     owner = "openvax";
     repo = "mhcflurry";
     tag = finalAttrs.version;
-    hash = "sha256-W9tNI1MC1SJ5RUT/Ahc/NOycU7p04+MeKazt+G8e3qg=";
+    hash = "sha256-G0lgTdeBVE1+ZTAJyP8XpYLkTZoKQGs2h/pVVkxsGOA=";
   };
 
   build-system = [
@@ -118,6 +118,10 @@ buildPythonPackage (finalAttrs: {
     # (`#!/usr/bin/env python3` shebang)
     "test_eval_paper_figures_external_predictors_adds_columns"
 
+    # Flaky: relies on `os.utime(path, None)` producing a strictly newer mtime than a file
+    # written just before, which fails with coarse filesystem timestamps (seen on aarch64-linux)
+    "test_interrupted_dual_format_calibration_loads_the_newer_file"
+
     # Release tooling: requires the source tree to be a git checkout
     "test_brev_postprocess_archive_includes_release_holdout"
     "test_deploy_creates_draft_noninteractively_with_release_notes"

From e9160deb46327eb8ff444679085c96a181c37201 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 3 Oct 2026 00:56:57 +0000
Subject: [PATCH 30/64] kdePackages.kirigami-app-components: 1.0.2 -> 1.1.0

---
 pkgs/kde/misc/kirigami-app-components/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/kde/misc/kirigami-app-components/default.nix b/pkgs/kde/misc/kirigami-app-components/default.nix
index 6b64d4082d9d..a4719a7775bd 100644
--- a/pkgs/kde/misc/kirigami-app-components/default.nix
+++ b/pkgs/kde/misc/kirigami-app-components/default.nix
@@ -5,11 +5,11 @@
 }:
 mkKdeDerivation rec {
   pname = "kirigami-app-components";
-  version = "1.0.2";
+  version = "1.1.0";
 
   src = fetchurl {
     url = "mirror://kde/stable/kirigami-app-components/kirigami-app-components-${version}.tar.xz";
-    hash = "sha256-a/2eCjpLfRdQXww8DDlWKBZZc7b0zx5Keh8zQoc7RNA=";
+    hash = "sha256-+D+S7Pq4n6i3WGfEfCkfFhnho5cK/DBDezN0qnX2Uw8=";
   };
 
   meta.license = with lib.licenses; [

From 16eab5b66055b1c3dec269a622c94c38b8732516 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 3 Oct 2026 02:07:21 +0000
Subject: [PATCH 31/64] oauth2l: 1.3.5 -> 1.3.6

---
 pkgs/by-name/oa/oauth2l/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/oa/oauth2l/package.nix b/pkgs/by-name/oa/oauth2l/package.nix
index 654e560f468e..61300fb377b2 100644
--- a/pkgs/by-name/oa/oauth2l/package.nix
+++ b/pkgs/by-name/oa/oauth2l/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "oauth2l";
-  version = "1.3.5";
+  version = "1.3.6";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "oauth2l";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-oRiR5x+9AGFeua4DvtNJQQ9DeuPSiNT6zUI91h4FdaI=";
+    hash = "sha256-d7TqolbWVoOw8caTyyPTW0S5AbC6YayDh/2LsjhB+SI=";
   };
 
   vendorHash = null;

From 8bd10beeffe2974d36b8eb17119080b32da78c7a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 3 Oct 2026 03:50:12 +0000
Subject: [PATCH 32/64] tombi: 1.5.2 -> 1.7.1

---
 pkgs/by-name/to/tombi/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/to/tombi/package.nix b/pkgs/by-name/to/tombi/package.nix
index f488c823fbaf..6753e994a974 100644
--- a/pkgs/by-name/to/tombi/package.nix
+++ b/pkgs/by-name/to/tombi/package.nix
@@ -9,7 +9,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tombi";
-  version = "1.5.2";
+  version = "1.7.1";
 
   __structuredAttrs = true;
 
@@ -17,7 +17,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "tombi-toml";
     repo = "tombi";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-HMAyzISP/q+eBAPPg/8FHa6eQ4xbA8sHne1dm+veUyo=";
+    hash = "sha256-eeBtmMrkDWOADw7FMLLD8hYq5WYg/aFyATtYIMFYFk0=";
   };
 
   # Tests relies on the presence of network
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     "--package"
     "tombi-cli"
   ];
-  cargoHash = "sha256-9x7Qesl6OsiN79b1MqP5BMF/0VOymER57ijwHzs0Taw=";
+  cargoHash = "sha256-YJLhWIwB3Y8836Rq4ahRzBSnhp7bH8w2/oXfRVTOPXg=";
 
   postPatch = ''
     substituteInPlace Cargo.toml \

From f71476e8faba8240824d77877d2da77cc42e6d00 Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Sat, 3 Oct 2026 00:03:03 -0400
Subject: [PATCH 33/64] victoriametrics: enable cgo to fix zstd decompression
 crash

---
 pkgs/by-name/vi/victoriametrics/package.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/vi/victoriametrics/package.nix b/pkgs/by-name/vi/victoriametrics/package.nix
index 4bbb48639808..c57e0e2cc8ac 100644
--- a/pkgs/by-name/vi/victoriametrics/package.nix
+++ b/pkgs/by-name/vi/victoriametrics/package.nix
@@ -24,7 +24,8 @@ buildGo127Module (finalAttrs: {
   };
 
   vendorHash = null;
-  env.CGO_ENABLED = 0;
+  # cgo enabled to work around https://github.com/VictoriaMetrics/VictoriaMetrics/issues/11683
+  env.CGO_ENABLED = 1;
 
   subPackages =
     lib.optionals withServer [

From 6d47aded0205146db162533f67abbe45bee42af2 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 3 Oct 2026 04:29:04 +0000
Subject: [PATCH 34/64] python3Packages.disposable-email-domains: 0.0.242 ->
 0.0.272

---
 .../python-modules/disposable-email-domains/default.nix       | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/disposable-email-domains/default.nix b/pkgs/development/python-modules/disposable-email-domains/default.nix
index 1ae2b137caf7..2944a38fdaa0 100644
--- a/pkgs/development/python-modules/disposable-email-domains/default.nix
+++ b/pkgs/development/python-modules/disposable-email-domains/default.nix
@@ -8,7 +8,7 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "disposable-email-domains";
-  version = "0.0.242";
+  version = "0.0.272";
   pyproject = true;
   __structuredAttrs = true;
 
@@ -16,7 +16,7 @@ buildPythonPackage (finalAttrs: {
   src = fetchPypi {
     pname = "disposable_email_domains";
     inherit (finalAttrs) version;
-    hash = "sha256-nQyqKT6x72UgI/1HeWD/9bl16IHPH286ZGk9Mr2LEto=";
+    hash = "sha256-qB7Cr2PN4tj90mrWp5zazAXQb/sWfz4ySSKkQ4zen2c=";
   };
 
   build-system = [

From 7f5ce524a6121d2ef93ffe09bd909225117a5767 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 3 Oct 2026 04:43:06 +0000
Subject: [PATCH 35/64] silverbullet: 2.11.0 -> 2.11.1

---
 pkgs/by-name/si/silverbullet/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/si/silverbullet/package.nix b/pkgs/by-name/si/silverbullet/package.nix
index b445e8420889..869105dadb39 100644
--- a/pkgs/by-name/si/silverbullet/package.nix
+++ b/pkgs/by-name/si/silverbullet/package.nix
@@ -9,13 +9,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "silverbullet";
-  version = "2.11.0";
+  version = "2.11.1";
 
   src = fetchFromGitHub {
     owner = "silverbulletmd";
     repo = "silverbullet";
     rev = finalAttrs.version;
-    hash = "sha256-aEqmvxtWzvXM8Cv8YrHK9o0G2jlbeqqahAveKr6M+Ps=";
+    hash = "sha256-+8q0gQ4pRdGHPE7woH/+cteLoUQ5qhEIGI+AhwkXN5E=";
   };
 
   cargoHash = "sha256-t2RDrdZsCMReDGUUu3r59OAosZNY3TMlvjo/uM2xL8g=";
@@ -30,7 +30,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     pname = "silverbullet-frontend";
     inherit (finalAttrs) version src;
 
-    npmDepsHash = "sha256-EseKAqUJbpIAfJhG1hNlvLgMie/jsXbbVqwea8bEuJQ=";
+    npmDepsHash = "sha256-IALStufO5TwhQbkIgSqwTYcQAL7Q+vmLDjlVYzMTyCA=";
 
     patches = [
       (replaceVars ./override-version.patch { inherit (finalAttrs) version; })

From 17f79a8c720790f8f15532fe9be855f575236a31 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 3 Oct 2026 04:57:16 +0000
Subject: [PATCH 36/64] rqlite: 10.3.6 -> 10.5.1

---
 pkgs/by-name/rq/rqlite/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/rq/rqlite/package.nix b/pkgs/by-name/rq/rqlite/package.nix
index 23f2e2227a5d..87a50140c2ef 100644
--- a/pkgs/by-name/rq/rqlite/package.nix
+++ b/pkgs/by-name/rq/rqlite/package.nix
@@ -12,13 +12,13 @@ buildGoModule (
   in
   {
     pname = "rqlite";
-    version = "10.3.6";
+    version = "10.5.1";
 
     src = fetchFromGitHub {
       owner = "rqlite";
       repo = "rqlite";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-ePOEmCXlkaAzWI8pWUohhnf5/1UAOqvAwfNZZ6UyXPI=";
+      hash = "sha256-XVAhhYhnRebtkJWqrXGRIPa0W5A36M92nSKGITnPt1s=";
     };
 
     vendorHash = "sha256-TgmFYhUUC391JA2Na7k+fUlhSIABMmBQjyJsB5326VI=";

From 6d979b2c393750b3a129afe8b17c5f0216a0f0f7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 3 Oct 2026 05:35:13 +0000
Subject: [PATCH 37/64] conduit: 0.9.8 -> 0.9.9

---
 pkgs/by-name/co/conduit/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/co/conduit/package.nix b/pkgs/by-name/co/conduit/package.nix
index bd2e23fdca72..7f36ac55f470 100644
--- a/pkgs/by-name/co/conduit/package.nix
+++ b/pkgs/by-name/co/conduit/package.nix
@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "conduit";
-  version = "0.9.8";
+  version = "0.9.9";
 
   __structuredAttrs = true;
   strictDeps = true;
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
     repo = "conduit";
     tag = "v${finalAttrs.version}";
     fetchSubmodules = true;
-    hash = "sha256-uGHOz15jv8RHM2JTuJpzppMBKCqMqoWX7w0QZqJ+h8c=";
+    hash = "sha256-l3fBK20AqNmdOfFtZ+wburekv/+A1VGSQM+V47h/DBI=";
   };
 
   nativeBuildInputs = [

From afc6f9e3ebd7e43d7d43379170379cb692c3e986 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 3 Oct 2026 05:47:14 +0000
Subject: [PATCH 38/64] python3Packages.awsiotpythonsdk: 1.6.1 -> 1.6.2

---
 pkgs/development/python-modules/awsiotpythonsdk/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/awsiotpythonsdk/default.nix b/pkgs/development/python-modules/awsiotpythonsdk/default.nix
index fe2062ff4b63..a413c43669a6 100644
--- a/pkgs/development/python-modules/awsiotpythonsdk/default.nix
+++ b/pkgs/development/python-modules/awsiotpythonsdk/default.nix
@@ -7,14 +7,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "awsiotpythonsdk";
-  version = "1.6.1";
+  version = "1.6.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "aws";
     repo = "aws-iot-device-sdk-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-AppoO/9OZxcGUUivbV++pr0QfDLrteSO3cRMj8Gvmk8=";
+    hash = "sha256-attzolHwUbAc6JBVmG0i16lwf3i6K1n/TufgnJgT1U0=";
   };
 
   postPatch = ''

From bfba0b6778467020eaebece88ab2c5e16fa17448 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 3 Oct 2026 06:14:47 +0000
Subject: [PATCH 39/64] fulcrum: 2.1.2 -> 2.1.3

---
 pkgs/by-name/fu/fulcrum/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fu/fulcrum/package.nix b/pkgs/by-name/fu/fulcrum/package.nix
index 4c3ac6fc6ba8..96e9bdcdd920 100644
--- a/pkgs/by-name/fu/fulcrum/package.nix
+++ b/pkgs/by-name/fu/fulcrum/package.nix
@@ -13,13 +13,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "fulcrum";
-  version = "2.1.2";
+  version = "2.1.3";
 
   src = fetchFromGitHub {
     owner = "cculianu";
     repo = "Fulcrum";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-a2i6tG2PFV0nXmy5Hx17Brwe/hRSpFs3DKtEB1uy/Wk=";
+    hash = "sha256-bqT2KBZKVPykRZ4/EsV3idzSkcj+1Fh59ODUJ3Zs0po=";
   };
 
   nativeBuildInputs = [

From ec5dad12cc6fbc2d621fc4060cc55038ab8ca06e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 3 Oct 2026 06:35:47 +0000
Subject: [PATCH 40/64] cargo-insta: 1.48.0 -> 1.49.0

---
 pkgs/by-name/ca/cargo-insta/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ca/cargo-insta/package.nix b/pkgs/by-name/ca/cargo-insta/package.nix
index 0a5e2cbf29ac..0af71db732c5 100644
--- a/pkgs/by-name/ca/cargo-insta/package.nix
+++ b/pkgs/by-name/ca/cargo-insta/package.nix
@@ -8,16 +8,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "cargo-insta";
-  version = "1.48.0";
+  version = "1.49.0";
 
   src = fetchFromGitHub {
     owner = "mitsuhiko";
     repo = "insta";
     tag = finalAttrs.version;
-    hash = "sha256-xIveukm1BsvY6z6bCsV4L9RZGIalspFEYFthE4hCaH8=";
+    hash = "sha256-mw+qpTc+J6xjirjxRAhbIF0Nw/lkpnEtTaIxDOWqFmc=";
   };
 
-  cargoHash = "sha256-OlCNm4N+cLreN7iR25cD06vsGnE+IWo5T15h3I6tCa8=";
+  cargoHash = "sha256-s1BLfuBOfjuP+TnmPC9h5OnUCSLGA0TCZrn8Qb/ZCk8=";
 
   nativeCheckInputs = [
     # used by test_binary_accept_missing_old_binary

From fc3ad5ca051bf7b290108fa7d640897c2d7910be Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 3 Oct 2026 09:40:42 +0200
Subject: [PATCH 41/64] python3Packages.iamdata: 0.1.202610011 -> 0.1.202610031

Diff: https://github.com/cloud-copilot/iam-data-python/compare/v0.1.202610011...v0.1.202610031

Changelog: https://github.com/cloud-copilot/iam-data-python/releases/tag/v0.1.202610031
---
 pkgs/development/python-modules/iamdata/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/iamdata/default.nix b/pkgs/development/python-modules/iamdata/default.nix
index b4cdbb0db95d..0c82c258f573 100644
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "iamdata";
-  version = "0.1.202610011";
+  version = "0.1.202610031";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "cloud-copilot";
     repo = "iam-data-python";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wWSTLmp3jc7SiuefXUKPXLlOiIXgqtG1puaBkh/fr34=";
+    hash = "sha256-x3AUWiWjXLYl/lLpMPBqc/Vyh8CZzZJSQHElLhutIXc=";
   };
 
   __darwinAllowLocalNetworking = true;

From e2fcc424f4ce4914461b91cf04605b30143fbc84 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 3 Oct 2026 09:42:23 +0200
Subject: [PATCH 42/64] python3Packages.publicsuffixlist: 1.0.2.20260925 ->
 1.0.2.20261002

Changelog: https://github.com/ko-zu/psl/blob/v1.0.2.20261002-gha/CHANGES.md
---
 pkgs/development/python-modules/publicsuffixlist/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/publicsuffixlist/default.nix b/pkgs/development/python-modules/publicsuffixlist/default.nix
index bc4ed18d6ac1..7ae28c1a1797 100644
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@@ -11,12 +11,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "publicsuffixlist";
-  version = "1.0.2.20260925";
+  version = "1.0.2.20261002";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-K6zWHIs2H/P6oR+YSjVU8qMEcyeQlGfLnL06Ep2AZfg=";
+    hash = "sha256-PYFP9esMpLuKLJ1+n9ApSFqc12EQp/N9rTm1k26HZMw=";
   };
 
   postPatch = ''

From 2338241c3efce9026baa67b699d5636dba93f65f Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 3 Oct 2026 09:42:54 +0200
Subject: [PATCH 43/64] python3Packages.mypy-boto3-cognito-idp: 1.43.83 ->
 1.43.108

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index a9e736b8ed66..88297c3fd61d 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -311,8 +311,8 @@ in
       "sha256-CavBKgp+dEMR2poR+bG2PgZb+wX1zlNmuOyJsV3LfVM=";
 
   mypy-boto3-cognito-idp =
-    buildMypyBoto3Package "cognito-idp" "1.43.83"
-      "sha256-M48OOjCyaCfwjFOIkxhae9E7ZOVf+1MeikfNqsxtuOY=";
+    buildMypyBoto3Package "cognito-idp" "1.43.108"
+      "sha256-eHDyQQSd8cgHsQrAbWL9dRSDgCFyQ14pejbIl7fe4d4=";
 
   mypy-boto3-cognito-sync =
     buildMypyBoto3Package "cognito-sync" "1.43.0"

From bcb1b1287f911061de9aa6e45f425a49f272ffbb Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 3 Oct 2026 09:43:12 +0200
Subject: [PATCH 44/64] python3Packages.mypy-boto3-glue: 1.43.106 -> 1.43.108

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 88297c3fd61d..d194f5835cef 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -571,8 +571,8 @@ in
       "sha256-wf3aeGNU4zu7+6Y3ajm2y8gqRcVaWkZHk/QVK2/1TW0=";
 
   mypy-boto3-glue =
-    buildMypyBoto3Package "glue" "1.43.106"
-      "sha256-pp5S3LCMmBwXzr2Gqj7cPlVTT4bD5U1w4LvmwTckzIA=";
+    buildMypyBoto3Package "glue" "1.43.108"
+      "sha256-U3Q3+vxDO30yAzQuKypqcXuCl0UKEilMm0ZCUweU3+M=";
   mypy-boto3-grafana =
     buildMypyBoto3Package "grafana" "1.43.11"
       "sha256-XJOSLyL1+uEweZ9zER7IhH3DFLaLtpJKvuRIn8Ri+P4=";

From 6425774f4b872dcdf43d3a1cfcc15ccef77fd1fb Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 3 Oct 2026 09:43:31 +0200
Subject: [PATCH 45/64] python3Packages.mypy-boto3-mediapackagev2: 1.43.101 ->
 1.43.108

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index d194f5835cef..0c8177e014e9 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -874,8 +874,8 @@ in
       "sha256-5AqWiNGz9jemWb8dZkuGQXxPXIruMdDWcoRzbT+ZGro=";
 
   mypy-boto3-mediapackagev2 =
-    buildMypyBoto3Package "mediapackagev2" "1.43.101"
-      "sha256-s7g2wMW/bOBSKKe7q0S7cSgWnHWNVYO46PQREUAqkZc=";
+    buildMypyBoto3Package "mediapackagev2" "1.43.108"
+      "sha256-Hb05g605ESaacKl15tTze8j8r9pDgMu5+e5xI7/qLHI=";
 
   mypy-boto3-mediastore =
     buildMypyBoto3Package "mediastore" "1.43.0"

From 0d8d66df51b716d258f36c943c4247c1fd607c33 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 3 Oct 2026 09:43:42 +0200
Subject: [PATCH 46/64] python3Packages.mypy-boto3-pinpoint-sms-voice-v2:
 1.43.90 -> 1.43.108

---
 pkgs/development/python-modules/mypy-boto3/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mypy-boto3/default.nix b/pkgs/development/python-modules/mypy-boto3/default.nix
index 0c8177e014e9..c3aabb1f4cc1 100644
--- a/pkgs/development/python-modules/mypy-boto3/default.nix
+++ b/pkgs/development/python-modules/mypy-boto3/default.nix
@@ -1038,8 +1038,8 @@ in
       "sha256-A8/WYxFn06rUXtcIHsKfs7HxvOBges0wDGskm31NIyw=";
 
   mypy-boto3-pinpoint-sms-voice-v2 =
-    buildMypyBoto3Package "pinpoint-sms-voice-v2" "1.43.90"
-      "sha256-5Rakqq71ubU/k3/AhzIjCh6o9pkBAdzTT//33Xe6o94=";
+    buildMypyBoto3Package "pinpoint-sms-voice-v2" "1.43.108"
+      "sha256-5oAvQe+OTzfBAMyP3Mp/hFcF5rAuy2hXdhX+s43FtuU=";
 
   mypy-boto3-pipes =
     buildMypyBoto3Package "pipes" "1.43.0"

From 0811a344d18ed07adc63da3d0aa1b864611dcdba Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 3 Oct 2026 09:44:11 +0200
Subject: [PATCH 47/64] python3Packages.boto3-stubs: 1.43.107 -> 1.43.108

---
 pkgs/development/python-modules/boto3-stubs/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/boto3-stubs/default.nix b/pkgs/development/python-modules/boto3-stubs/default.nix
index 506a8718cd69..f4d1c1b98b87 100644
--- a/pkgs/development/python-modules/boto3-stubs/default.nix
+++ b/pkgs/development/python-modules/boto3-stubs/default.nix
@@ -358,13 +358,13 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "boto3-stubs";
-  version = "1.43.107";
+  version = "1.43.108";
   pyproject = true;
 
   src = fetchPypi {
     pname = "boto3_stubs";
     inherit (finalAttrs) version;
-    hash = "sha256-+MPGb7uDgyVMTnbfcWS4MBdPVPQKdAZqtjjd7rBynWM=";
+    hash = "sha256-oe0ptMeVdWjmJh/DbUxZAlwASZeiKejwGUDCBfISjko=";
   };
 
   build-system = [ setuptools ];

From 4d65e1fff68ab9b7f00082597e002b53f0f7004c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 3 Oct 2026 08:13:38 +0000
Subject: [PATCH 48/64] texlyre: 0.12.0 -> 0.13.0

---
 pkgs/by-name/te/texlyre/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/te/texlyre/package.nix b/pkgs/by-name/te/texlyre/package.nix
index e6177983f10b..c931b775ac4c 100644
--- a/pkgs/by-name/te/texlyre/package.nix
+++ b/pkgs/by-name/te/texlyre/package.nix
@@ -13,16 +13,16 @@
 
 buildNpmPackage (finalAttrs: {
   pname = "texlyre";
-  version = "0.12.0";
+  version = "0.13.0";
 
   src = fetchFromGitHub {
     owner = "TeXlyre";
     repo = "texlyre";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lMXnlH54V2DEDV23TCSebh+xCzTZHqy5PtIj1FYbRWA=";
+    hash = "sha256-oYt+DG8lTAOY8MEZsJw2nkg7LGE/hEY7nw5UT9EQfZU=";
   };
 
-  npmDepsHash = "sha256-Dvw4RSEWlTJfrNL+pgMsX1a0yihM+bKnRqFqeSSR454=";
+  npmDepsHash = "sha256-MlxMej9huxgC73FUG8iifkxUnJHFWS9y50NaZ4C+aBE=";
 
   postPatch = ''
     sed -i 's/"version": ".*"/"version": "${finalAttrs.version}"/' package.json
@@ -71,12 +71,12 @@ buildNpmPackage (finalAttrs: {
     updateScript = ./update.sh;
     drawioEmbed = stdenvNoCC.mkDerivation (finalAttrs: {
       pname = "drawio-embed";
-      version = "31.4.4";
+      version = "31.6.1";
       src = fetchFromGitHub {
         owner = "TeXlyre";
         repo = "drawio-embed-mirror";
         tag = "v${finalAttrs.version}";
-        hash = "sha256-RcaoHnzXJq5ayL6e7vWPECjNbavDvKcRbLmToxsyz8E=";
+        hash = "sha256-lcttcu7N61ZoKGQgUPn7l7yRF8MXmO0tD9uzJ1V9Z94=";
       };
       dontBuild = true;
       installPhase = "cp -a . $out";

From 9b336e5b2da61a78972a7c9069fc736f808351b4 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 3 Oct 2026 08:47:55 +0000
Subject: [PATCH 49/64] terraform-providers.hashicorp_local: 2.9.0 -> 2.9.1

---
 .../networking/cluster/terraform-providers/providers.json   | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index c2a7bc6c26bd..c9831a629f85 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -634,13 +634,13 @@
     "vendorHash": "sha256-GyuSdDpsOqd1ntwAm09AKCoxeFOLhXo0jPTTxYZC+vg="
   },
   "hashicorp_local": {
-    "hash": "sha256-qntV0gfxEVV24gqiVOvUai+pai4vvU+KtLmLBqOBQbY=",
+    "hash": "sha256-oq1Nc03xfoDajrj0CVAO41embDGQ5cKJ8QbUZfaJv/M=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/local",
     "owner": "hashicorp",
     "repo": "terraform-provider-local",
-    "rev": "v2.9.0",
+    "rev": "v2.9.1",
     "spdx": "MPL-2.0",
-    "vendorHash": "sha256-qvJSzqGUHw1/Lu4XO7LWssA+TN8pCyTbzh6t1bz+y1g="
+    "vendorHash": "sha256-CukYk/fYz/7NSo4B92ZM04Wkbtiobq7kETMXPvgs4mg="
   },
   "hashicorp_nomad": {
     "hash": "sha256-O3dtOB+irsUeDq1yXxfqDSyz2jfPXS1UgiL+B4RFsW4=",

From 6184046353357233a1bfa23168d09eef5c7caea6 Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Sat, 3 Oct 2026 11:07:30 +0200
Subject: [PATCH 50/64] webkitgtk_6_0: add update script

---
 pkgs/by-name/we/webkitgtk_6_0/package.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/we/webkitgtk_6_0/package.nix b/pkgs/by-name/we/webkitgtk_6_0/package.nix
index 925c2df29d72..97c0e4671c3b 100644
--- a/pkgs/by-name/we/webkitgtk_6_0/package.nix
+++ b/pkgs/by-name/we/webkitgtk_6_0/package.nix
@@ -72,6 +72,7 @@
   withLibsecret ? true,
   systemdSupport ? lib.meta.availableOn clangStdenv.hostPlatform systemdLibs,
   testers,
+  directoryListingUpdater,
   fetchpatch,
 }:
 
@@ -261,7 +262,10 @@ clangStdenv.mkDerivation (finalAttrs: {
 
   requiredSystemFeatures = [ "big-parallel" ];
 
-  passthru.tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+  passthru = {
+    tests.pkg-config = testers.testMetaPkgConfig finalAttrs.finalPackage;
+    updateScript = directoryListingUpdater { };
+  };
 
   meta = {
     description = "Web content rendering engine, GTK port";

From 03c321ac5653650b2d2c1f25fa510cd7802ff72d Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Sat, 3 Oct 2026 09:07:58 +0000
Subject: [PATCH 51/64] webkitgtk_6_0: 2.54.0 -> 2.54.1

https://github.com/WebKit/WebKit/compare/webkitgtk-2.54.0...webkitgtk-2.54.1
---
 pkgs/by-name/we/webkitgtk_6_0/package.nix | 13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/we/webkitgtk_6_0/package.nix b/pkgs/by-name/we/webkitgtk_6_0/package.nix
index 97c0e4671c3b..71d9fa3be1d0 100644
--- a/pkgs/by-name/we/webkitgtk_6_0/package.nix
+++ b/pkgs/by-name/we/webkitgtk_6_0/package.nix
@@ -83,7 +83,7 @@ in
 # https://webkitgtk.org/2024/10/04/webkitgtk-2.46.html recommends building with clang.
 clangStdenv.mkDerivation (finalAttrs: {
   pname = "webkitgtk";
-  version = "2.54.0";
+  version = "2.54.1";
   name = "webkitgtk-${finalAttrs.version}+abi=${abiVersion}";
 
   outputs = [
@@ -98,7 +98,7 @@ clangStdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "https://webkitgtk.org/releases/webkitgtk-${finalAttrs.version}.tar.xz";
-    hash = "sha256-hG/RnM7brh2/6QTybb8taKgAozpQyvKtUiLI3LPyVoI=";
+    hash = "sha256-6gu7AtvbxZaHSk5601tmZFs+CiMr0OQIHeXtkusKOX0=";
   };
 
   patches = lib.optionals clangStdenv.hostPlatform.isLinux [
@@ -115,15 +115,6 @@ clangStdenv.mkDerivation (finalAttrs: {
       hash = "sha256-MgaSpXq9l6KCLQdQyel6bQFHG53l3GY277WePpYXdjA=";
       name = "fix_ftbfs_riscv64.patch";
     })
-
-    # Fix https://bugs.webkit.org/show_bug.cgi?id=322394
-    # Upstream PR: https://github.com/WebKit/WebKit/pull/74512
-    # Fetching the patch vendored by gnome-build-meta because the upstream
-    # patch doesn't apply.
-    (fetchpatch {
-      url = "https://gitlab.gnome.org/GNOME/gnome-build-meta/-/raw/7e4afe649fa1acbe9203004ad8fe1749c26e619d/patches/webkitgtk/main-thread.patch";
-      hash = "sha256-Dm6Yytt4mQy7qxSWiudGBqfQUVJRhNAc1n+o/NMR1cg=";
-    })
   ];
 
   nativeBuildInputs = [

From ff2ff6a90bfc3ad4cc2235065996d55c10964b23 Mon Sep 17 00:00:00 2001
From: Colin <colin@uninsane.org>
Date: Fri, 29 May 2026 05:52:43 +0000
Subject: [PATCH 52/64] diffutils: fix gnu -> musl cross build

fixes `nix-build -A pkgsCross.musl64.diffutils`
---
 pkgs/by-name/di/diffutils/package.nix | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/di/diffutils/package.nix b/pkgs/by-name/di/diffutils/package.nix
index ad36dd91eed9..7fba0dc6df86 100644
--- a/pkgs/by-name/di/diffutils/package.nix
+++ b/pkgs/by-name/di/diffutils/package.nix
@@ -72,8 +72,10 @@ stdenv.mkDerivation (finalAttrs: {
     # "pr" need not be on the PATH as a run-time dep, so we need to tell
     # configure where it is. Covers the cross and native case alike.
     lib.optional (coreutils != null) "PR_PROGRAM=${coreutils}/bin/pr"
-    ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+    ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform && stdenv.hostPlatform.isGnu) [
       "gl_cv_func_getopt_gnu=yes"
+    ]
+    ++ lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
       "gl_cv_func_strcasecmp_works=yes"
     ];
 

From 214068de1f050f96e947f508135eb67589d67185 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Thu, 17 Sep 2026 02:09:55 +0200
Subject: [PATCH 53/64] pnpm_12: 12.3.4 -> 12.9.0

Changes:
- https://github.com/pnpm/pnpm/releases/tag/v12.4.0
- https://github.com/pnpm/pnpm/releases/tag/v12.4.1
- https://github.com/pnpm/pnpm/releases/tag/v12.4.2
- https://github.com/pnpm/pnpm/releases/tag/v12.5.0
- https://github.com/pnpm/pnpm/releases/tag/v12.5.1
- https://github.com/pnpm/pnpm/releases/tag/v12.6.0
- https://github.com/pnpm/pnpm/releases/tag/v12.7.0
- https://github.com/pnpm/pnpm/releases/tag/v12.8.0
- https://github.com/pnpm/pnpm/releases/tag/v12.8.1
- https://github.com/pnpm/pnpm/releases/tag/v12.8.2
- https://github.com/pnpm/pnpm/releases/tag/v12.9.0

Signed-off-by: Sefa Eyeoglu <contact@scrumplex.net>
---
 pkgs/development/tools/pnpm/default.nix      | 6 +++---
 pkgs/development/tools/pnpm/generic-rust.nix | 6 ++++++
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/tools/pnpm/default.nix b/pkgs/development/tools/pnpm/default.nix
index 2f1e42419e25..6789c094cf3c 100644
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -53,9 +53,9 @@ let
       hash = "sha256-QKMlFaJVB/jyJt+74lOA4vBTlEwuzGTAwcuYtBy7ke8=";
     };
     "12" = {
-      version = "12.3.4";
-      srcHash = "sha256-EAF5ZeABBX4Wdn08OVria9zKcTIJ8i9EIjb9gsaCAo4=";
-      cargoHash = "sha256-I54W1Ig6mn3/BsBiL5qc8aUZmSY2IGEY2QSXG0V1W1w=";
+      version = "12.9.0";
+      srcHash = "sha256-lcs9nh9GIKfy5QYabUCj/pIpePAjLeeKBlu4UKm8zgM=";
+      cargoHash = "sha256-NGefDu4dGMC2RGrTPeYBuRrG+Gb8jnx9+SbyK8WPd9E=";
     };
   };
 
diff --git a/pkgs/development/tools/pnpm/generic-rust.nix b/pkgs/development/tools/pnpm/generic-rust.nix
index e0fc23def387..97338a80de6c 100644
--- a/pkgs/development/tools/pnpm/generic-rust.nix
+++ b/pkgs/development/tools/pnpm/generic-rust.nix
@@ -34,6 +34,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
     makeWrapper
   ];
 
+  postPatch = ''
+    # upstream duplicates some sources in .cargo/config.toml
+    # that's also defined in Cargo.toml, cargo fails with duplicate definitions
+    sed -i '/# >>> pnpm-managed cargo sources >>>/,/# <<< pnpm-managed cargo sources <<</d' .cargo/config.toml
+  '';
+
   cargoBuildFlags = [
     "--bin=pnpm"
   ];

From 07a6420b12187fab5b6421df2700f742ce1face8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 3 Oct 2026 10:31:59 +0000
Subject: [PATCH 54/64] terraform-providers.hashicorp_azuread: 3.9.0 -> 3.10.0

---
 .../networking/cluster/terraform-providers/providers.json     | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/networking/cluster/terraform-providers/providers.json b/pkgs/applications/networking/cluster/terraform-providers/providers.json
index c2a7bc6c26bd..81154b70a88f 100644
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -535,11 +535,11 @@
     "vendorHash": "sha256-JEPUJRuVkvZe6XEQWAe++4eUGE8/q3kMzr85LLR9qsE="
   },
   "hashicorp_azuread": {
-    "hash": "sha256-mEYEZIztDjyqWSJFoJPXtV0E9YikumtwGVtZA4Jfw3U=",
+    "hash": "sha256-dS5MlFTNQ1vMbOK5bW7VgeU+dPLONnN7jTobWMKwtw8=",
     "homepage": "https://registry.terraform.io/providers/hashicorp/azuread",
     "owner": "hashicorp",
     "repo": "terraform-provider-azuread",
-    "rev": "v3.9.0",
+    "rev": "v3.10.0",
     "spdx": "MPL-2.0",
     "vendorHash": null
   },

From 8b777949c5901c723a49683d9714a33ac01da2cc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 3 Oct 2026 10:47:04 +0000
Subject: [PATCH 55/64] antigravity-cli: 1.2.9 -> 1.2.16

---
 pkgs/by-name/an/antigravity-cli/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/an/antigravity-cli/package.nix b/pkgs/by-name/an/antigravity-cli/package.nix
index b85c46b5d762..83889ebbc360 100644
--- a/pkgs/by-name/an/antigravity-cli/package.nix
+++ b/pkgs/by-name/an/antigravity-cli/package.nix
@@ -6,8 +6,8 @@
   versionCheckHook,
 }:
 let
-  version = "1.2.9";
-  buildId = "6237955799515136";
+  version = "1.2.16";
+  buildId = "5594158052802560";
   wholeVersion = "${version}-${buildId}";
 
   throwSystem = throw "Unsupported system: ${stdenvNoCC.hostPlatform.system}";
@@ -15,15 +15,15 @@ let
   sourceData = {
     x86_64-linux = fetchurl {
       url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/${wholeVersion}/linux-x64/cli_linux_x64.tar.gz";
-      hash = "sha256-TleXrQChVKEkYr0V7a6mMFRAE8q5fj/6kjUz7qCj284=";
+      hash = "sha256-1CR0MOBM69vhypPZzLSDzS89rrTNsKzlpxzRMOC9q4Q=";
     };
     aarch64-linux = fetchurl {
       url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/${wholeVersion}/linux-arm/cli_linux_arm64.tar.gz";
-      hash = "sha256-bq1XoRRtIy6SYTl82dfHpfwgiFlGcuMJbPyezyS8F2c=";
+      hash = "sha256-ptJp0nZOVjarK82nO3jFh/6dAOrXZ6o5dFdCKVhe4NM=";
     };
     aarch64-darwin = fetchurl {
       url = "https://storage.googleapis.com/antigravity-public/antigravity-cli/${wholeVersion}/darwin-arm/cli_mac_arm64.tar.gz";
-      hash = "sha256-7kPA1JzN4giRClGq9AObYIM+KkYdq0U5F+mK2PF70U4=";
+      hash = "sha256-l7A+o+kJFuDIpJ7ephVAb47GkEfd4XIopHjBhURF0yo=";
     };
   };
 in

From ded22b564fc9d571e5bb67280eb243e2db007e9e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 3 Oct 2026 11:10:21 +0000
Subject: [PATCH 56/64] gitlab-ci-verify: 2.11.8 -> 2.11.9

---
 pkgs/by-name/gi/gitlab-ci-verify/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gi/gitlab-ci-verify/package.nix b/pkgs/by-name/gi/gitlab-ci-verify/package.nix
index 398e5ce36f3b..7dd741d5d395 100644
--- a/pkgs/by-name/gi/gitlab-ci-verify/package.nix
+++ b/pkgs/by-name/gi/gitlab-ci-verify/package.nix
@@ -9,7 +9,7 @@
 
 buildGoModule (finalAttrs: {
   pname = "gitlab-ci-verify";
-  version = "2.11.8";
+  version = "2.11.9";
   __structuredAttrs = true;
   __darwinAllowLocalNetworking = true;
 
@@ -17,7 +17,7 @@ buildGoModule (finalAttrs: {
     owner = "timo-reymann";
     repo = "gitlab-ci-verify";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-/HzVfaRBPfG+YjHHzwE5ROYBjR+8Lqxusku7l46oXaM=";
+    hash = "sha256-91MLZji9AKlHb6G/Qs0t8QTFD5D57bFROrAyI5NWKGU=";
     fetchSubmodules = true;
     leaveDotGit = true;
     postFetch = ''
@@ -28,7 +28,7 @@ buildGoModule (finalAttrs: {
     '';
   };
 
-  vendorHash = "sha256-o7NL6Ijh+ZEUhEYlzypM0KPh8XtMXeTzB9VBB7bPlco=";
+  vendorHash = "sha256-5QtbZt4qg10aoznIILokaJbQx2tTTIKaNbc08i5G5GU=";
 
   ldflags = [
     "-s"

From c9bc02b0402bc2eed16af34cedd037bb27e67f43 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sat, 3 Oct 2026 11:50:21 +0000
Subject: [PATCH 57/64] linux_7_2: 7.2.8 -> 7.2.9

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index e236f273cbd4..42f1da0b5eda 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -35,8 +35,8 @@
         "lts": true
     },
     "7.2": {
-        "version": "7.2.8",
-        "hash": "sha256:0h8rwp1zipb0szf3y05pbmqyscdi4902x239bid7rbfifflxbs0j",
+        "version": "7.2.9",
+        "hash": "sha256:1fnqp28vrikz9gqhb42k0dsggqf8i07j0s9qy33scr53a6zdzidl",
         "lts": false
     }
 }

From 876aae2fbb274c6603f2ee1c0fb35dddc20f69fb Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sat, 3 Oct 2026 11:50:24 +0000
Subject: [PATCH 58/64] linux_6_18: 6.18.54 -> 6.18.55

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 42f1da0b5eda..0a172857afe5 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -30,8 +30,8 @@
         "lts": true
     },
     "6.18": {
-        "version": "6.18.54",
-        "hash": "sha256:1b5c7v7vxl27z3xrdnqxgyzdv2b8xy464majpv8bn0l1vl10pwwx",
+        "version": "6.18.55",
+        "hash": "sha256:1yadaa2gz74nh3pawpwv6lamalnd7wpiv1xb88pw2rd1c606647l",
         "lts": true
     },
     "7.2": {

From d97b7c19a49a122bae4d129785d746a96066c467 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sat, 3 Oct 2026 11:50:27 +0000
Subject: [PATCH 59/64] linux_6_12: 6.12.111 -> 6.12.112

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 0a172857afe5..ec56601ce6c3 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -25,8 +25,8 @@
         "lts": true
     },
     "6.12": {
-        "version": "6.12.111",
-        "hash": "sha256:044qhkby6dgrb4mmggk6j0m6dmlw96c9a7v0lq9gm221c9kxqncy",
+        "version": "6.12.112",
+        "hash": "sha256:00zd1219cw9l4bkwqsf42wmpyilv6x41q1qzbshn2g69yv8wjk8n",
         "lts": true
     },
     "6.18": {

From 92748a1026984dfa6b157acfd58eef6fabe8b65c Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sat, 3 Oct 2026 11:50:29 +0000
Subject: [PATCH 60/64] linux_6_6: 6.6.157 -> 6.6.158

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index ec56601ce6c3..481ffc758944 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -20,8 +20,8 @@
         "lts": true
     },
     "6.6": {
-        "version": "6.6.157",
-        "hash": "sha256:0c4c42qzr2vcbqglb9vq5q5vqv4mbqasq1n93j3vf288cg846jmp",
+        "version": "6.6.158",
+        "hash": "sha256:0krapcaaz0ny4drh1spjzpiijvpf8y6cg1qm8f6qjkp0n1rk3cwy",
         "lts": true
     },
     "6.12": {

From 5da483e45351442e292aec0c7d92da0ea9b36e8c Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sat, 3 Oct 2026 11:50:31 +0000
Subject: [PATCH 61/64] linux_6_1: 6.1.188 -> 6.1.189

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 481ffc758944..04d9893ce4fe 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -5,8 +5,8 @@
         "lts": false
     },
     "6.1": {
-        "version": "6.1.188",
-        "hash": "sha256:0fm3048h1c98gxhpwjprjc2jkrhhwaac1vw91hikbhh72g5hlkgd",
+        "version": "6.1.189",
+        "hash": "sha256:0fclbhzzzjs98lxxc0bgvdih3ldcswjkb69gqsm0i6pwzsi39j1y",
         "lts": true
     },
     "5.15": {

From 1a6f01d1b18da1eb64a256dbf793f4c1788dd309 Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sat, 3 Oct 2026 11:50:33 +0000
Subject: [PATCH 62/64] linux_5_15: 5.15.221 -> 5.15.222

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 04d9893ce4fe..0e7de20b2e5e 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -10,8 +10,8 @@
         "lts": true
     },
     "5.15": {
-        "version": "5.15.221",
-        "hash": "sha256:130ll4gnj2779kpx8x4r6v28vnwjn4qdw9ksaq3f5vr8wphq4y60",
+        "version": "5.15.222",
+        "hash": "sha256:116zkhjvjsgc4cy9bcvqcdn6863022bpbdhw74j8a05xg5vc0vjd",
         "lts": true
     },
     "5.10": {

From b6903de31eca5e9f5e83fd28c73d19a6ed6395da Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Sat, 3 Oct 2026 11:50:35 +0000
Subject: [PATCH 63/64] linux_5_10: 5.10.270 -> 5.10.271

---
 pkgs/os-specific/linux/kernel/kernels-org.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/kernels-org.json b/pkgs/os-specific/linux/kernel/kernels-org.json
index 0e7de20b2e5e..365c49400366 100644
--- a/pkgs/os-specific/linux/kernel/kernels-org.json
+++ b/pkgs/os-specific/linux/kernel/kernels-org.json
@@ -15,8 +15,8 @@
         "lts": true
     },
     "5.10": {
-        "version": "5.10.270",
-        "hash": "sha256:1rzb9ms2v04gwwka7d8byaxrcfymlikslq36p1p1zsabn0ldawyy",
+        "version": "5.10.271",
+        "hash": "sha256:0br5rj6b8rj2pl4b2al3ws0jg6a7xrn1bsyafka98djk1jydzf51",
         "lts": true
     },
     "6.6": {

From 769f7e7374b87ebd761da5654429265a59440231 Mon Sep 17 00:00:00 2001
From: eljamm <fedi.jamoussi@protonmail.ch>
Date: Sat, 3 Oct 2026 11:57:29 +0000
Subject: [PATCH 64/64] linux_zen: 7.2.8 -> 7.2.9

---
 pkgs/os-specific/linux/kernel/zen-kernels.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/os-specific/linux/kernel/zen-kernels.nix b/pkgs/os-specific/linux/kernel/zen-kernels.nix
index 64aae9d5864b..35902549d4fd 100644
--- a/pkgs/os-specific/linux/kernel/zen-kernels.nix
+++ b/pkgs/os-specific/linux/kernel/zen-kernels.nix
@@ -18,7 +18,7 @@ in
 buildLinux (
   args
   // rec {
-    version = "7.2.8";
+    version = "7.2.9";
     pname = "linux-zen";
     modDirVersion = lib.versions.pad 3 "${version}-${suffix}";
     isZen = true;
@@ -27,7 +27,7 @@ buildLinux (
       owner = "zen-kernel";
       repo = "zen-kernel";
       rev = "v${version}-${suffix}";
-      sha256 = "0v4av56ybv7pv9dfwxn63xd3iiciqxx2h5x4vh88zcrqw3r095p6";
+      sha256 = "0w3x2hb4f27kiblq91gf12i823mlrk7ijjnj23csarjf4cg0bffr";
     };
 
     # This is based on the following source: