Merge staging-next into staging

2026-10-02 04:50:21 +00:00 · 2025-09-02 00:17:06 +00:00
parent 539c5a97d8 46b1f8a0ce
commit e1c60bb263
84 changed files with 827 additions and 364 deletions
--- a/nixos/modules/services/networking/headscale.nix
+++ b/nixos/modules/services/networking/headscale.nix
@@ -406,6 +406,31 @@ in
                '';
                example = [ "alice@example.com" ];
              };
+
+              pkce = {
+                enabled = lib.mkOption {
+                  type = lib.types.bool;
+                  default = false;
+                  description = ''
+                    Enable or disable PKCE (Proof Key for Code Exchange) support.
+                    PKCE adds an additional layer of security to the OAuth 2.0
+                    authorization code flow by preventing authorization code
+                    interception attacks
+                    See https://datatracker.ietf.org/doc/html/rfc7636
+                  '';
+                  example = true;
+                };
+
+                method = lib.mkOption {
+                  type = lib.types.str;
+                  default = "S256";
+                  description = ''
+                    PKCE method to use:
+                      - plain: Use plain code verifier
+                      - S256: Use SHA256 hashed code verifier (default, recommended)
+                  '';
+                };
+              };
            };

            tls_letsencrypt_hostname = lib.mkOption {
--- a/nixos/modules/services/networking/pihole-ftl.nix
+++ b/nixos/modules/services/networking/pihole-ftl.nix
@@ -53,7 +53,7 @@ in
        query logging.
      '';
      default = 0;
-      example = "3";
+      example = 3;
    };

    openFirewallDNS = mkOption {
@@ -240,7 +240,7 @@ in
      (mkDefaults {
        misc.readOnly = true; # Prevent config changes via API or CLI by default
        webserver.port = ""; # Disable the webserver by default
-        misc.privacyLevel = cfg.privacyLevel;
+        misc.privacylevel = cfg.privacyLevel;
      })

      # Move state files to cfg.stateDirectory
--- a/nixos/modules/services/web-apps/kanboard.nix
+++ b/nixos/modules/services/web-apps/kanboard.nix
@@ -157,7 +157,6 @@ in
          locations."~ \\.(js|css|ttf|woff2?|png|jpe?g|svg)$".extraConfig = ''
            add_header Cache-Control "public, max-age=15778463";
            add_header X-Content-Type-Options nosniff;
-            add_header X-XSS-Protection "1; mode=block";
            add_header X-Robots-Tag none;
            add_header X-Download-Options noopen;
            add_header X-Permitted-Cross-Domain-Policies none;
--- a/nixos/tests/headscale.nix
+++ b/nixos/tests/headscale.nix
@@ -45,6 +45,13 @@ in
              };
              dns = {
                base_domain = "tailnet";
+                extra_records = [
+                  {
+                    name = "foo.bar";
+                    type = "A";
+                    value = "100.64.0.2";
+                  }
+                ];
                override_local_dns = false;
              };
            };
@@ -90,5 +97,6 @@ in
    # Check that they are reachable from the tailnet
    peer1.wait_until_succeeds("tailscale ping peer2")
    peer2.wait_until_succeeds("tailscale ping peer1.tailnet")
+    assert (res := peer1.wait_until_succeeds("${lib.getExe pkgs.dig} +short foo.bar").strip()) == "100.64.0.2", f"Domain {res} did not match 100.64.0.2"
  '';
 }
--- a/nixos/tests/openvswitch.nix
+++ b/nixos/tests/openvswitch.nix
@@ -56,7 +56,7 @@
      node2.wait_for_unit("ovsdb.service")
      node2.wait_for_unit("ovs-vswitchd.service")

-      node1.succeed("ping -c3 10.0.0.2")
-      node2.succeed("ping -c3 10.0.0.1")
+      node1.wait_until_succeeds("ping -c1 10.0.0.2", timeout=30)
+      node2.wait_until_succeeds("ping -c1 10.0.0.1", timeout=30)
    '';
 }
--- a/pkgs/applications/science/logic/klee/default.nix
+++ b/pkgs/applications/science/logic/klee/default.nix
@@ -21,7 +21,7 @@
  includeDebugInfo ? true,

  # Enable KLEE asserts. Defaults to true, since LLVM is built with them.
-  asserts ? true,
+  asserts ? false,

  # Build the KLEE runtime in debug mode. Defaults to true, as this improves
  # stack traces of the software under test.
@@ -37,13 +37,6 @@
  extraKleeuClibcConfig ? { },
 }:

-# Klee supports these LLVM versions.
-let
-  llvmVersion = llvmPackages.llvm.version;
-  inherit (lib.strings) versionAtLeast versionOlder;
-in
-assert versionAtLeast llvmVersion "11" && versionOlder llvmVersion "17";
-
 let
  # The chosen version of klee-uclibc.
  chosenKleeuClibc =
@@ -60,13 +53,13 @@ let
 in
 llvmPackages.stdenv.mkDerivation rec {
  pname = "klee";
-  version = "3.1";
+  version = "3.1-unstable-2025-07-11";

  src = fetchFromGitHub {
    owner = "klee";
    repo = "klee";
-    rev = "v${version}";
-    hash = "sha256-5js1N8qVF0lCkahSU3ojT7+p/a9IaUpPWhIyFHEzqto=";
+    rev = "1c9fbc1013a6000b39615cc9a5aba83e43a4bf75";
+    hash = "sha256-D93T0mBBrIhQTS42ScUHPrMoqCI55Y6Yp7snLmlriQM=";
  };

  nativeBuildInputs = [ cmake ];
@@ -111,6 +104,7 @@ llvmPackages.stdenv.mkDerivation rec {
      "-DENABLE_POSIX_RUNTIME=${onOff true}"
      "-DENABLE_UNIT_TESTS=${onOff true}"
      "-DENABLE_SYSTEM_TESTS=${onOff true}"
+      "-DLIT_ARGS=--verbose"
      "-DGTEST_SRC_DIR=${gtest.src}"
      "-DGTEST_INCLUDE_DIR=${gtest.src}/googletest/include"
      "-Wno-dev"
@@ -119,6 +113,107 @@ llvmPackages.stdenv.mkDerivation rec {
  # Silence various warnings during the compilation of fortified bitcode.
  env.NIX_CFLAGS_COMPILE = toString [ "-Wno-macro-redefined" ];

+  env.FILECHECK_OPTS = "--dump-input-filter=all";
+
+  env.LIT_XFAIL = lib.concatStringsSep ";" [
+    "KLEE :: ArrayOpt/test_expr_arbitrary.c"
+    "KLEE :: CXX/SimpleVirtual.cpp"
+    "KLEE :: CXX/StaticConstructor.cpp"
+    "KLEE :: CXX/StaticDestructor.cpp"
+    "KLEE :: Concrete/ConstantExpr.ll"
+    "KLEE :: Concrete/OverlappingPhiNodes.ll"
+    "KLEE :: Concrete/UnorderedPhiNodes.ll"
+    "KLEE :: DeterministicAllocation/nullpage-read.c"
+    "KLEE :: DeterministicAllocation/nullpage-write.c"
+    "KLEE :: DeterministicAllocation/use-after-free-loh.c"
+    "KLEE :: DeterministicAllocation/use-after-free.c"
+    "KLEE :: Dogfood/ImmutableSet.cpp"
+    "KLEE :: Feature/Atomic.c"
+    "KLEE :: Feature/DivCheck.c"
+    "KLEE :: Feature/ExtCall.c"
+    "KLEE :: Feature/ExtCallWarnings.c"
+    "KLEE :: Feature/FunctionAlias.c"
+    "KLEE :: Feature/FunctionAliasExit.c"
+    "KLEE :: Feature/LargeArrayBecomesSym.c"
+    "KLEE :: Feature/LowerSwitch.c"
+    "KLEE :: Feature/MakeSymbolicName.c"
+    "KLEE :: Feature/NoExternalCallsAllowed.c"
+    "KLEE :: Feature/Optimize.c"
+    "KLEE :: Feature/OvershiftCheck.c"
+    "KLEE :: Feature/ReadStringAtAddress.c"
+    "KLEE :: Feature/SeedConcretizeExternalCall.c"
+    "KLEE :: Feature/ShiftCheck.c"
+    "KLEE :: Feature/consecutive_divide_by_zero.c"
+    "KLEE :: Feature/srem.c"
+    "KLEE :: InlineAsm/RaiseAsm.c"
+    "KLEE :: InlineAsm/asm_lifting.ll"
+    "KLEE :: Intrinsics/IntrinsicTrap.ll"
+    "KLEE :: Intrinsics/IsConstant.ll"
+    "KLEE :: Intrinsics/Missing.ll"
+    "KLEE :: Intrinsics/Overflow.ll"
+    "KLEE :: Intrinsics/OverflowMul.ll"
+    "KLEE :: Intrinsics/Saturating.ll"
+    "KLEE :: Intrinsics/noalias-scope-decl.ll"
+    "KLEE :: Intrinsics/objectsize.ll"
+    "KLEE :: Replay/klee-replay/KleeZesti.c"
+    "KLEE :: Replay/libkleeruntest/replay_posix_runtime.c"
+    "KLEE :: Runtime/FreeStanding/memcpy_chk_err.c"
+    "KLEE :: Runtime/POSIX/CanonicalizeFileName.c"
+    "KLEE :: Runtime/POSIX/DirConsistency.c"
+    "KLEE :: Runtime/POSIX/DirSeek.c"
+    "KLEE :: Runtime/POSIX/Envp.c"
+    "KLEE :: Runtime/POSIX/FDNumbers.c"
+    "KLEE :: Runtime/POSIX/FD_Fail.c"
+    "KLEE :: Runtime/POSIX/FD_Fail2.c"
+    "KLEE :: Runtime/POSIX/Fcntl.c"
+    "KLEE :: Runtime/POSIX/FilePerm.c"
+    "KLEE :: Runtime/POSIX/FreeArgv.c"
+    "KLEE :: Runtime/POSIX/Futimesat.c"
+    "KLEE :: Runtime/POSIX/Getenv.c"
+    "KLEE :: Runtime/POSIX/Ioctl.c"
+    "KLEE :: Runtime/POSIX/Isatty.c"
+    "KLEE :: Runtime/POSIX/MixedConcreteSymbolic.c"
+    "KLEE :: Runtime/POSIX/Openat.c"
+    "KLEE :: Runtime/POSIX/PrgName.c"
+    "KLEE :: Runtime/POSIX/Read1.c"
+    "KLEE :: Runtime/POSIX/Replay.c"
+    "KLEE :: Runtime/POSIX/SeedAndFail.c"
+    "KLEE :: Runtime/POSIX/Stdin.c"
+    "KLEE :: Runtime/POSIX/SymFileConsistency.c"
+    "KLEE :: Runtime/POSIX/TestMain.c"
+    "KLEE :: Runtime/POSIX/Usage.c"
+    "KLEE :: Runtime/POSIX/Write1.c"
+    "KLEE :: Runtime/POSIX/Write2.c"
+    "KLEE :: Runtime/POSIX/_exit.c"
+    "KLEE :: Runtime/Uclibc/2007-10-08-optimization-calls-wrong-libc-functions.c"
+    "KLEE :: Runtime/klee-libc/mempcpy.c"
+    "KLEE :: Solver/Z3ConstantArray.c"
+    "KLEE :: UBSan/ubsan_alignment-type-mismatch.c"
+    "KLEE :: UBSan/ubsan_array_bounds.c"
+    "KLEE :: UBSan/ubsan_pointer_overflow-pointer_arithmetic.c"
+    "KLEE :: UBSan/ubsan_signed_integer_overflow.c"
+    "KLEE :: UBSan/ubsan_unsigned_integer_overflow.c"
+    "KLEE :: UBSan/ubsan_unsigned_shift_base.c"
+    "KLEE :: UBSan/ubsan_vla_bound.c"
+    "KLEE :: VarArgs/FunctionAliasVarArg.c"
+    "KLEE :: VarArgs/VarArg.c"
+    "KLEE :: VarArgs/VarArgAlignment.c"
+    "KLEE :: VarArgs/VarArgByVal.c"
+    "KLEE :: VarArgs/VarArgByValReported.c"
+    "KLEE :: VarArgs/VarArgLongDouble.c"
+    "KLEE :: VectorInstructions/floating_point_ops_constant.c"
+    "KLEE :: VectorInstructions/integer_ops_constant.c"
+    "KLEE :: VectorInstructions/integer_ops_signed_symbolic.c"
+    "KLEE :: VectorInstructions/integer_ops_unsigned_symbolic.c"
+    "KLEE :: VectorInstructions/memset.c"
+    "KLEE :: VectorInstructions/oob-write.c"
+    "KLEE :: VectorInstructions/shuffle_element.c"
+    "KLEE :: klee-stats/KleeStatsTermClasses.c"
+    "KLEE :: regression/2008-03-11-free-of-malloc-zero.c"
+    "KLEE :: regression/2014-07-04-unflushed-error-report.c"
+    "KLEE :: regression/2016-11-24-bitcast-weak-alias.c"
+  ];
+
  prePatch = ''
    patchShebangs --build .
  '';
@@ -140,6 +235,8 @@ llvmPackages.stdenv.mkDerivation rec {
    uclibc = chosenKleeuClibc;
  };

+  __structuredAttrs = true;
+
  meta = with lib; {
    mainProgram = "klee";
    description = "Symbolic virtual machine built on top of LLVM";
@@ -166,5 +263,19 @@ llvmPackages.stdenv.mkDerivation rec {
    license = licenses.ncsa;
    platforms = [ "x86_64-linux" ];
    maintainers = with maintainers; [ numinit ];
+    # Upstream is still working on support for LLVM ≥ 16; see:
+    #
+    # * <https://github.com/klee/klee/pull/1664>
+    # * <https://github.com/klee/klee/pull/1745>
+    # * <https://github.com/klee/klee/pull/1751>
+    # * <https://github.com/klee/klee/issues/1754>
+    #
+    # The package builds with LLVM 18 but 23% of the tests unexpectedly
+    # fail due to missing functionality for newer LLVM versions. We
+    # mark them as expected failures above to allow the package to
+    # build for those who want to experiment with KLEE, but mark it
+    # broken to avoid giving the impression that this is the expected
+    # user experience and level of support.
+    broken = true;
  };
 }
--- a/pkgs/by-name/an/android-translation-layer/add-gio-unix-dep.patch
+++ b/pkgs/by-name/an/android-translation-layer/add-gio-unix-dep.patch
@@ -1,13 +1,13 @@
 diff --git a/meson.build b/meson.build
-index 8f525118..658cd9e5 100644
+index ba8027c2..fb21e317 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -178,7 +178,7 @@ libtranslationlayer_so = shared_library('translation_layer_main', [
+@@ -171,7 +171,7 @@ libtranslationlayer_so = shared_library('translation_layer_main', [
                                                                         extra_deps,
                                                                   	dependency('gtk4', version: '>=4.14'), dependency('gl'), dependency('egl'), dependency('wayland-client'), dependency('jni'),
                                                                   	dependency('libportal'), dependency('sqlite3'), dependency('libavcodec', version: '>=59'), dependency('libdrm'),
 -                                                                  	dependency('gudev-1.0'), dependency('libswscale'), dependency('webkitgtk-6.0'),
 +                                                                  	dependency('gudev-1.0'), dependency('libswscale'), dependency('webkitgtk-6.0'), dependency('gio-unix-2.0'),
-                                                                   	libandroidfw_dep, wayland_protos_dep
+                                                                         libart_dep, wayland_protos_dep
                                                                   ],
                                                                   link_with: [ libandroid_so ],
--- a/pkgs/by-name/an/android-translation-layer/configure-art-path.patch
+++ b/pkgs/by-name/an/android-translation-layer/configure-art-path.patch
@@ -1,25 +1,26 @@
 diff --git a/meson.build b/meson.build
-index 8f525118..c1761a2d 100644
+index 8f525118..ba8027c2 100644
 --- a/meson.build
 +++ b/meson.build
-@@ -11,8 +11,8 @@ dir_base = meson.current_source_dir()
+@@ -9,22 +9,15 @@ add_project_dependencies(incdir_dep, language: 'c')
+ cc = meson.get_compiler('c')
+ dir_base = meson.current_source_dir()
 builddir_base = meson.current_build_dir()
- # FIXME: make art install a pkgconfig file
- libart_dep = [
+-# FIXME: make art install a pkgconfig file
+-libart_dep = [
 -	cc.find_library('art', dirs : [ '/usr' / get_option('libdir') / 'art', '/usr/local' / get_option('libdir') / 'art', get_option('prefix') / get_option('libdir') / 'art' ]),
 -     	cc.find_library('nativebridge', dirs : [ '/usr' / get_option('libdir') / 'art', '/usr/local' / get_option('libdir') / 'art', get_option('prefix') / get_option('libdir') / 'art' ])
-+	cc.find_library('art', dirs : [ '/usr' / get_option('libdir') / 'art', '/usr/local' / get_option('libdir') / 'art', get_option('prefix') / get_option('libdir') / 'art', '@artStandalonePackageDir@' / get_option('libdir') / 'art' ]),
-+     	cc.find_library('nativebridge', dirs : [ '/usr' / get_option('libdir') / 'art', '/usr/local' / get_option('libdir') / 'art', get_option('prefix') / get_option('libdir') / 'art', '@artStandalonePackageDir@' / get_option('libdir') / 'art' ])
- ]
+-]
+libart_dep = dependency('art-standalone')
 libdl_bio_dep = [
 	cc.find_library('dl_bio')
-@@ -21,10 +21,10 @@ libc_bio_dep = [
+ ]
+ libc_bio_dep = [
 	cc.find_library('c_bio')
 ]
- libandroidfw_dep = [
+-libandroidfw_dep = [
 -	cc.find_library('androidfw', dirs : [ '/usr' / get_option('libdir') / 'art', '/usr/local' / get_option('libdir') / 'art', get_option('prefix') / get_option('libdir') / 'art' ]),
-+	cc.find_library('androidfw', dirs : [ '/usr' / get_option('libdir') / 'art', '/usr/local' / get_option('libdir') / 'art', get_option('prefix') / get_option('libdir') / 'art', '@artStandalonePackageDir@' / 'lib' / 'art' ]),
- ]
+-]
 -if fs.is_file('/usr' / get_option('libdir') / 'java/core-all_classes.jar')
 -  bootclasspath_dir = '/usr' / get_option('libdir') / 'java'
 +if fs.is_file('@artStandalonePackageDir@' / get_option('libdir') / 'java/core-all_classes.jar')
@@ -27,3 +28,12 @@ index 8f525118..c1761a2d 100644
 elif fs.is_file('/usr/local' / get_option('libdir') / 'java/core-all_classes.jar')
   bootclasspath_dir = '/usr/local' / get_option('libdir') / 'java'
 elif fs.is_file(get_option('prefix') / get_option('libdir') / 'java/core-all_classes.jar')
+@@ -179,7 +172,7 @@ libtranslationlayer_so = shared_library('translation_layer_main', [
+                                                                   	dependency('gtk4', version: '>=4.14'), dependency('gl'), dependency('egl'), dependency('wayland-client'), dependency('jni'),
+                                                                   	dependency('libportal'), dependency('sqlite3'), dependency('libavcodec', version: '>=59'), dependency('libdrm'),
+                                                                   	dependency('gudev-1.0'), dependency('libswscale'), dependency('webkitgtk-6.0'),
+-                                                                  	libandroidfw_dep, wayland_protos_dep
+                                                                        libart_dep, wayland_protos_dep
+                                                                   ],
+                                                                   link_with: [ libandroid_so ],
+                                                                   link_args: [
--- a/pkgs/by-name/an/android-translation-layer/package.nix
+++ b/pkgs/by-name/an/android-translation-layer/package.nix
@@ -25,20 +25,23 @@
  makeWrapper,
  replaceVars,
  nixosTests,
+  bintools,
 }:

 stdenv.mkDerivation {
  pname = "android-translation-layer";
-  version = "0-unstable-2025-07-14";
+  version = "0-unstable-2025-08-06";

  src = fetchFromGitLab {
    owner = "android_translation_layer";
    repo = "android_translation_layer";
-    rev = "828f779c4f7170f608047c500d6d3b64b480df7f";
-    hash = "sha256-1KYZWlzES3tbskqvA8qSQCegE0uLTLCq4q2CX6uix4o=";
+    rev = "d52985a6df81d73a8f6dfbdee337f7ff90b724cb";
+    hash = "sha256-fJ8S04YucoCzHiIQdiQd+Il0YGNFsOkSiGWjZKNMTIM=";
  };

  patches = [
+    # meson: use pkg-config from art-standalone instead of manual library search
+    # See: https://gitlab.com/android_translation_layer/android_translation_layer/-/merge_requests/164
    (replaceVars ./configure-art-path.patch {
      artStandalonePackageDir = "${art-standalone}";
    })
@@ -84,7 +87,8 @@ stdenv.mkDerivation {

  postFixup = ''
    wrapProgram $out/bin/android-translation-layer \
-      --prefix LD_LIBRARY_PATH : ${art-standalone}/lib/art
+      --prefix LD_LIBRARY_PATH : ${art-standalone}/lib/art \
+      --prefix PATH : ${lib.makeBinPath [ bintools ]}
  '';

  passthru.tests = {
--- a/pkgs/by-name/ar/art-standalone/package.nix
+++ b/pkgs/by-name/ar/art-standalone/package.nix
@@ -35,6 +35,10 @@ stdenv.mkDerivation (finalAttrs: {
  patches = [
    # Do not hardocde addr2line binary path
    ./no-hardcode-path-addr2line.patch
+
+    # Add support for pkg-config
+    # See: https://gitlab.com/android_translation_layer/art_standalone/-/merge_requests/37
+    ./pkg-config-support.patch
  ];

  postPatch = ''
@@ -68,6 +72,14 @@ stdenv.mkDerivation (finalAttrs: {
      configureFlags = oldAttrs.configureFlags ++ [
        "--enable-jni"
      ];
+      # Disable failing tests when jni enabled
+      postPatch = oldAttrs.postPatch or "" + ''
+        sed -i '/TEST_DECL(test_wolfSSL_Tls13_ECH)/d;
+                /TEST_DECL(test_wolfSSL_Tls13_ECH_HRR)/d;
+                /TEST_DECL(test_TLSX_CA_NAMES_bad_extension)/d' tests/api.c
+        sed -i '/quic/d' tests/include.am
+        sed -i '300,305d' tests/unit.c
+      '';
    }))
    xz
    zlib
--- a/pkgs/by-name/ar/art-standalone/pkg-config-support.patch
+++ b/pkgs/by-name/ar/art-standalone/pkg-config-support.patch
@@ -0,0 +1,45 @@
+diff --git a/Makefile b/Makefile
+index 42df5b18..3321adae 100644
+--- a/Makefile
+++ b/Makefile
+@@ -32,6 +32,8 @@ ____dalvikvm_bin_64 := $(____TOPDIR)/out/host/linux-x86/bin/dalvikvm64
+ __RPATH_BIN := \$${ORIGIN}/../$(____LIBDIR)/art/:\$${ORIGIN}/../$(____LIBDIR)/java/dex/art/natives
+ __RPATH_LIB := \$${ORIGIN}
+ 
+__VERSION ?= 0.0.0
+
+ # Jack compiler was google's first attempt at a solution for desugaring Java 8 and newer bytecode into bytecode compatible with older dex file formats.
+ # Thankfully, google realized that this was a bad idea, and in a typical google fashion, axed the project.
+ # They experimented with other approaches, but currently (2022) the way to do this is to use d8/r8 instead of dx;
+@@ -112,6 +114,15 @@ install:
+ # our stable C API for libandroidfw, used by ATL
+ 	install -Dt $(____INSTALL_INCLUDEDIR)/androidfw $(____TOPDIR)/libandroidfw/include/androidfw/androidfw_c_api.h
+ 
+	# install pkg-config file
+	mkdir -p $(____INSTALL_LIBDIR)/pkgconfig
+	sed -e 's|@prefix@|$(____PREFIX)|g' \
+	    -e 's|@libdir@|$(____LIBDIR)|g' \
+	    -e 's|@includedir@|$(____INCLUDEDIR)|g' \
+	    -e 's|@version@|$(__VERSION)|g' \
+	    art-standalone.pc.in > $(____INSTALL_LIBDIR)/pkgconfig/art-standalone.pc
+
+
+ # TODO: figure out sharing dependencies and have this in a separate repo
+ install_adbd:
+ 	install -Dt $(____INSTALL_BINDIR) $(____TOPDIR)/out/host/linux-x86/bin/adbd
+diff --git a/art-standalone.pc.in b/art-standalone.pc.in
+new file mode 100644
+index 00000000..210cd031
+--- /dev/null
+++ b/art-standalone.pc.in
+@@ -0,0 +1,10 @@
+prefix=@prefix@
+exec_prefix=${prefix}
+libdir=${prefix}/@libdir@
+includedir=${prefix}/@includedir@
+
+Name: art-standalone
+Description: Android ART runtime (standalone build, minimal ATL deps)
+Version: @version@
+Libs: -L${libdir}/art -lart -lnativebridge -landroidfw
+Cflags: -I${includedir} -I${includedir}/androidfw
--- a/pkgs/by-name/ba/bandwidth/package.nix
+++ b/pkgs/by-name/ba/bandwidth/package.nix
@@ -1,65 +0,0 @@
-{
-  lib,
-  stdenv,
-  requireFile,
-  nasm,
-}:
-
-let
-  arch = "bandwidth${toString stdenv.hostPlatform.parsed.cpu.bits}";
-in
-stdenv.mkDerivation (finalAttrs: {
-  pname = "bandwidth";
-  version = "1.11.2d";
-
-  src = requireFile {
-    message = "This file does not have a valid url.";
-    name = "bandwidth-${finalAttrs.version}.tar.gz";
-    hash = "sha256-7IrNiCXKf1vyRGl73Ccu3aYMqPVc4PpEr6lnSqIa4Q8=";
-  };
-
-  postPatch = ''
-    sed -i 's,ar ,$(AR) ,g' OOC/Makefile
-    # Remove unnecessary -m32 for 32-bit targets
-    sed -i 's,-m32,,g' OOC/Makefile
-    # Replace arm64 with aarch64
-    sed -i 's#,arm64#,aarch64#g' Makefile
-    # Fix wrong comment character
-    sed -i 's,# 32,; 32,g' routines-x86-32bit.asm
-    # Fix missing symbol exports for macOS clang
-    echo global _VectorToVector128 >> routines-x86-64bit.asm
-    echo global _VectorToVector256 >> routines-x86-64bit.asm
-    # Fix unexpected token on macOS
-    sed -i '/.section .note.GNU-stack/d' *-64bit.asm
-    sed -i '/.section code/d' *-arm-64bit.asm
-    sed -i 's#-Wl,-z,noexecstack##g' Makefile-arm64
-  '';
-
-  nativeBuildInputs = [ nasm ];
-
-  buildFlags = [
-    "AR=${stdenv.cc.targetPrefix}ar"
-    "CC=${stdenv.cc.targetPrefix}cc"
-    "ARM_AS=${stdenv.cc.targetPrefix}as"
-    "ARM_CC=$(CC)"
-    "UNAMEPROC=${stdenv.hostPlatform.parsed.cpu.name}"
-    "UNAMEMACHINE=${stdenv.hostPlatform.parsed.cpu.name}"
-    arch
-  ];
-
-  installPhase = ''
-    runHook preInstall
-
-    install -Dm755 ${arch} $out/bin/bandwidth
-
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "Artificial benchmark for identifying weaknesses in the memory subsystem";
-    license = lib.licenses.gpl2Plus;
-    platforms = lib.platforms.x86 ++ lib.platforms.arm ++ lib.platforms.aarch64;
-    maintainers = with lib.maintainers; [ r-burns ];
-    mainProgram = "bandwidth";
-  };
-})
--- a/pkgs/by-name/bi/binary-object-scanner/deps.json
+++ b/pkgs/by-name/bi/binary-object-scanner/deps.json
@@ -0,0 +1,87 @@
+[
+  {
+    "pname": "Blake3",
+    "version": "1.1.0",
+    "hash": "sha256-gSXmXolZOlon1UG2miI9bdS1542vGR8EyukwIkqXdoE="
+  },
+  {
+    "pname": "Newtonsoft.Json",
+    "version": "13.0.3",
+    "hash": "sha256-hy/BieY4qxBWVVsDqqOPaLy1QobiIapkbrESm6v2PHc="
+  },
+  {
+    "pname": "OpenMcdf",
+    "version": "2.3.1",
+    "hash": "sha256-7Mjp7oAQCy+X/UG/40NzzDdYho3CbOd0HW2w0bE21QI="
+  },
+  {
+    "pname": "SabreTools.ASN1",
+    "version": "1.5.1",
+    "hash": "sha256-J6Iw44x6DGSAWmo4q1+sTrkcIc41eEBjChYNdazhvwM="
+  },
+  {
+    "pname": "SabreTools.Compression",
+    "version": "0.6.3",
+    "hash": "sha256-ZgoJzy7QpIl5Qqlk8O4DYXpV6kIaf04zStaV8SvzJNE="
+  },
+  {
+    "pname": "SabreTools.Hashing",
+    "version": "1.4.1",
+    "hash": "sha256-tCOMMhRtdW16NWi7fCkqXWls5Tb108LawDjWAqBIaLg="
+  },
+  {
+    "pname": "SabreTools.IO",
+    "version": "1.6.2",
+    "hash": "sha256-RrSr9yGfqUGIu5iG0AAv0MwZ2/+9a/2XNYaPOPFsNzM="
+  },
+  {
+    "pname": "SabreTools.Matching",
+    "version": "1.5.1",
+    "hash": "sha256-YrcdBXJKFfoD3+S4XkoAUH4LhN1rPk5DMY6z9UwTXQ8="
+  },
+  {
+    "pname": "SabreTools.Models",
+    "version": "1.5.8",
+    "hash": "sha256-6Erd8nBwLVK3KVmZPAH2P58NQbinCMW98gveqoo1WL8="
+  },
+  {
+    "pname": "SabreTools.Serialization",
+    "version": "1.8.4",
+    "hash": "sha256-LjtX79eJGeD1Bz+SWeZP/8BMGo+ZEHNnLEa3MQ2d3rU="
+  },
+  {
+    "pname": "SabreTools.Serialization",
+    "version": "1.8.6",
+    "hash": "sha256-zJRpTturGPiFSm05XMxOEg5G1gdT05VhuLgNyikXLBM="
+  },
+  {
+    "pname": "SharpCompress",
+    "version": "0.38.0",
+    "hash": "sha256-bQL3kazuqbuqn+Csy9RYMMUsNMtqkGXF7x32s787UBM="
+  },
+  {
+    "pname": "System.IO.Hashing",
+    "version": "8.0.0",
+    "hash": "sha256-szOGt0TNBo6dEdC3gf6H+e9YW3Nw0woa6UnCGGGK5cE="
+  },
+  {
+    "pname": "System.Text.Encoding.CodePages",
+    "version": "8.0.0",
+    "hash": "sha256-fjCLQc1PRW0Ix5IZldg0XKv+J1DqPSfu9pjMyNBp7dE="
+  },
+  {
+    "pname": "UnshieldSharp",
+    "version": "1.9.4",
+    "hash": "sha256-ie1OBWmOYoAx0u8gzUj+ay/K/h96XessaGMsxRlI6WM="
+  },
+  {
+    "pname": "WiseUnpacker",
+    "version": "1.5.6",
+    "hash": "sha256-zsAEUN1/4mdl+J2Vk8kA/1XXzomiMQ72hjHgndB6ZrY="
+  },
+  {
+    "pname": "ZstdSharp.Port",
+    "version": "0.8.1",
+    "hash": "sha256-PeQvyz3lUrK+t+n1dFtNXCLztQtAfkqUuM6mOqBZHLg="
+  }
+]
--- a/pkgs/by-name/bi/binary-object-scanner/package.nix
+++ b/pkgs/by-name/bi/binary-object-scanner/package.nix
@@ -0,0 +1,41 @@
+{
+  lib,
+  buildDotnetModule,
+  dotnetCorePackages,
+  fetchFromGitHub,
+}:
+
+buildDotnetModule rec {
+  pname = "BinaryObjectScanner";
+  version = "3.3.4";
+
+  src = fetchFromGitHub {
+    owner = "SabreTools";
+    repo = "BinaryObjectScanner";
+    tag = version;
+    hash = "sha256-FiSBJO4ic/KjokUEP0uB1WNfFRcOWH/x0y9yJMKnl4Q=";
+  };
+
+  dotnet-sdk = dotnetCorePackages.sdk_9_0;
+  dotnet-runtime = dotnetCorePackages.runtime_9_0;
+  dotnetFlags = [ "-p:TargetFramework=net9.0" ];
+  nugetDeps = ./deps.json;
+
+  projectFile = [
+    "ProtectionScan/ProtectionScan.csproj"
+    "ExtractionTool/ExtractionTool.csproj"
+  ];
+  executables = [
+    "ProtectionScan"
+    "ExtractionTool"
+  ];
+
+  meta = {
+    homepage = "https://github.com/SabreTools/BinaryObjectScanner";
+    description = "C# protection, packer, and archive scanning library. Provides ProtectionScan and ExtractionTool";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ hughobrien ];
+    platforms = lib.platforms.unix ++ lib.platforms.windows;
+    mainProgram = "ProtectionScan";
+  };
+}
--- a/pkgs/by-name/ch/cherry-studio/package.nix
+++ b/pkgs/by-name/ch/cherry-studio/package.nix
@@ -19,13 +19,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "cherry-studio";
-  version = "1.5.6";
+  version = "1.5.7";

  src = fetchFromGitHub {
    owner = "CherryHQ";
    repo = "cherry-studio";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-OstKirf8rOlGodoMkjQHcSPOWuZx/n2EApHdN+4NpUE=";
+    hash = "sha256-wC4fNDG5xx4uBiBZu7KjuATlSpESwI0dRO/8nZ7DXas=";
  };

  postPatch = ''
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {

  offlineCache = yarn-berry.fetchYarnBerryDeps {
    inherit (finalAttrs) src missingHashes;
-    hash = "sha256-w1EfJ9N0V2aresLLGcpM2l3L/wajn3rNgljzcGHkIFs=";
+    hash = "sha256-hNgiqU4pM0xEBAK6HGArMhAD8My2qIh5gyPV9sDnoeg=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ch/chhoto-url/package.nix
+++ b/pkgs/by-name/ch/chhoto-url/package.nix
@@ -8,13 +8,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "chhoto-url";
-  version = "6.3.0";
+  version = "6.3.1";

  src = fetchFromGitHub {
    owner = "SinTan1729";
    repo = "chhoto-url";
    tag = finalAttrs.version;
-    hash = "sha256-y7koflkcQv9JsTqbUzyK0S3lClU9188532J5UVWrM4g=";
+    hash = "sha256-ks/jfqtU/R3i6LHZtWr0gY3zuElxABtvygCIbK9GYng=";
  };

  sourceRoot = "${finalAttrs.src.name}/actix";
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      --replace-fail "./resources/" "${placeholder "out"}/share/chhoto-url/resources/"
  '';

-  cargoHash = "sha256-eB56ZEWAp5RBY4EFyuGzwamDRxDz0Ip3mzuzLwyZR/I=";
+  cargoHash = "sha256-9KLpI9CM5LDsZCRGgcvHvbt7Q6yIAQuMR2SpN5uBTOE=";

  postInstall = ''
    mkdir -p $out/share/chhoto-url
--- a/pkgs/by-name/ch/chrony/package.nix
+++ b/pkgs/by-name/ch/chrony/package.nix
@@ -14,11 +14,11 @@

 stdenv.mkDerivation rec {
  pname = "chrony";
-  version = "4.7";
+  version = "4.8";

  src = fetchurl {
    url = "https://chrony-project.org/releases/${pname}-${version}.tar.gz";
-    hash = "sha256-wN5BqMBR5dMrEBtfcBS5jKl4sY5ZLzDOaEC21GAtlHs=";
+    hash = "sha256-M+qOsqTa6qUG6Pyv1dbYkCftby8GCWRcbxSbVg0wFwY=";
  };

  outputs = [
--- a/pkgs/by-name/co/codeql/package.nix
+++ b/pkgs/by-name/co/codeql/package.nix
@@ -11,7 +11,7 @@

 stdenv.mkDerivation rec {
  pname = "codeql";
-  version = "2.22.3";
+  version = "2.22.4";

  dontConfigure = true;
  dontBuild = true;
@@ -19,7 +19,7 @@ stdenv.mkDerivation rec {

  src = fetchzip {
    url = "https://github.com/github/codeql-cli-binaries/releases/download/v${version}/codeql.zip";
-    hash = "sha256-75ayL/TftTM1nfwIFsVOhfqFi//ts6o8GeK/mYez04k=";
+    hash = "sha256-g1544Y+TiJE814HaneTDOuRTAux9RWsLgMRruI/CVTg=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/db/dbeaver-bin/package.nix
+++ b/pkgs/by-name/db/dbeaver-bin/package.nix
@@ -18,7 +18,7 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "dbeaver-bin";
-  version = "25.1.5";
+  version = "25.2.0";

  src =
    let
@@ -31,10 +31,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
        aarch64-darwin = "macos-aarch64.dmg";
      };
      hash = selectSystem {
-        x86_64-linux = "sha256-kyZi24hcHgpW5Hcp3bjU1fTHeo2sXnZV9DFiYyZCqJM=";
-        aarch64-linux = "sha256-CVMUkpjAvWnphsxTXXu/0N2k8o5gDX4KH+PXneOXlFw=";
-        x86_64-darwin = "sha256-SxlMSCXC3gCKC0MuKvyHg4iLRVm/c4COjmpJzySD/a0=";
-        aarch64-darwin = "sha256-0m26hOqmmqAPutMx0rQsenM8vNRjUvP/ZkIPuH6U7/A=";
+        x86_64-linux = "sha256-JGqzoqCkZjrV1SNrJSXNotd3YaOUtqXJYhHDy7/xZSU=";
+        aarch64-linux = "sha256-+byvDpqaijxt0LnGJuWg1ooVnb1bLdaFfvEmlaEmBCA=";
+        x86_64-darwin = "sha256-59mrDs00XxIjfiqm3OsoHqbuNQI3VdB1ff3l/51lzEg=";
+        aarch64-darwin = "sha256-jUWZr5DwUv6aFfGEox62r+PRoEqZIvdP6YHCsWshYJA=";
      };
    in
    fetchurl {
--- a/pkgs/by-name/ea/easyrsa/package.nix
+++ b/pkgs/by-name/ea/easyrsa/package.nix
@@ -9,13 +9,13 @@

 stdenv.mkDerivation rec {
  pname = "easyrsa";
-  version = "3.2.3";
+  version = "3.2.4";

  src = fetchFromGitHub {
    owner = "OpenVPN";
    repo = "easy-rsa";
    rev = "v${version}";
-    hash = "sha256-TAJAwvcIkAB4YShK9NItw14UTvuxtNd/OxLDkO8p0d0=";
+    hash = "sha256-X/EXiiSLDSxxSSNnb6lkPsvdA0vSp/zPN+wSNuUMzrg=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/eq/equibop/package.nix
+++ b/pkgs/by-name/eq/equibop/package.nix
@@ -17,19 +17,16 @@
  nix-update-script,
  withTTS ? true,
  withMiddleClickScroll ? false,
-  # Enables the use of Equicord from nixpkgs instead of
-  # letting Equibop manage it's own version
-  withSystemEquicord ? false,
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "equibop";
-  version = "2.1.5";
+  version = "2.1.6";

  src = fetchFromGitHub {
    owner = "Equicord";
    repo = "Equibop";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-uod94pP261Alq+dby+/diiLT0KFjXswVapwXYAAAkbs=";
+    hash = "sha256-0OtCxz7g1xMmnkDke34deaS3dx5b8bGOC0Vbq6BIObg=";
  };

  pnpmDeps = pnpm_10.fetchDeps {
@@ -40,7 +37,7 @@ stdenv.mkDerivation (finalAttrs: {
      patches
      ;
    fetcherVersion = 1;
-    hash = "sha256-0UNScJAdpcMOcBHGGG+SeGQon89qLXTCNmaxEswNFBI=";
+    hash = "sha256-MDqAncWdU2rIQAGF/wx2gWxDf74P3fp3w4nA8b6AITw=";
  };

  nativeBuildInputs = [
@@ -65,12 +62,7 @@ stdenv.mkDerivation (finalAttrs: {

  patches = [
    ./disable_update_checking.patch
-  ]
-  ++ lib.optional withSystemEquicord (
-    replaceVars ./use_system_equicord.patch {
-      inherit equicord;
-    }
-  );
+  ];

  env = {
    ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
--- a/pkgs/by-name/eq/equibop/use_system_equicord.patch
+++ b/pkgs/by-name/eq/equibop/use_system_equicord.patch
@@ -1,17 +0,0 @@
-diff --git i/src/main/constants.ts w/src/main/constants.ts
-index afb171f..c6a014e 100644
--- i/src/main/constants.ts
-+++ w/src/main/constants.ts
-@@ -30,10 +30,7 @@ export const VENCORD_THEMES_DIR = join(DATA_DIR, "themes");
- 
- // needs to be inline require because of circular dependency
- // as otherwise "DATA_DIR" (which is used by ./settings) will be uninitialised
-export const VENCORD_DIR = (() => {
-    const { State } = require("./settings") as typeof import("./settings");
-    return State.store.equicordDir ? join(State.store.equicordDir, "equibop") : join(SESSION_DATA_DIR, "equicord.asar");
-})();
-+export const VENCORD_DIR = "@equicord@";
- 
- export const USER_AGENT = `Equibop/${app.getVersion()} (https://github.com/Equicord/Equibop)`;
- 
-
--- a/pkgs/by-name/et/etherpad-lite/package.nix
+++ b/pkgs/by-name/et/etherpad-lite/package.nix
@@ -13,13 +13,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "etherpad-lite";
-  version = "2.4.2";
+  version = "2.5.0";

  src = fetchFromGitHub {
    owner = "ether";
    repo = "etherpad-lite";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-BUgWx6SVpQ6qIJnb6EoiogRXuKo9uDRrl7bPuXTGQy8=";
+    hash = "sha256-11fNDAR6zmHv1O5nL0GhGJj6eHwDc8zT0Tvrba7qBpw=";
  };

  patches = [
@@ -32,7 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
  pnpmDeps = pnpm.fetchDeps {
    inherit (finalAttrs) pname version src;
    fetcherVersion = 1;
-    hash = "sha256-/o2WaB63lcWbbe8nCwMSYhGr9zra7QPL1Er78vW8Kjw=";
+    hash = "sha256-PZD55V/3dvNLx39tD4I00IzURhuyqMX4uObnQfnSBtk=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/fi/firebase-tools/package.nix
+++ b/pkgs/by-name/fi/firebase-tools/package.nix
@@ -10,16 +10,16 @@

 buildNpmPackage rec {
  pname = "firebase-tools";
-  version = "14.13.0";
+  version = "14.15.1";

  src = fetchFromGitHub {
    owner = "firebase";
    repo = "firebase-tools";
    tag = "v${version}";
-    hash = "sha256-3nDile9gDnaCLWqUYiK3TdiPF2gXzurphHawVO3ZQE8=";
+    hash = "sha256-+wYvxsBnZBvCh98E6Th+uEnxnKnZTKv807mqST8wbJo=";
  };

-  npmDepsHash = "sha256-+T2zfUs8vvHnFtBimQtF4UUyLVwp+RpeklcZQxfHxHM=";
+  npmDepsHash = "sha256-EhUJj1kSMslCXhgzCEiVn+4DSmRfvj/nh3OmaZCh/bk=";

  postPatch = ''
    ln -s npm-shrinkwrap.json package-lock.json
--- a/pkgs/by-name/fr/freenet/package.nix
+++ b/pkgs/by-name/fr/freenet/package.nix
@@ -26,8 +26,8 @@ let
    name = "freenet-seednodes";
    owner = "hyphanet";
    repo = "seedrefs";
-    rev = "9df1bf93ab64aba634bdfc5f4d0e960571ce4ba5";
-    hash = "sha256-nvwJvKw5IPhItPe4k/jnOGaa8H4DtOi8XxKFOKFMAuY=";
+    rev = "8e8b3574b63e649e03f67d23d3dfa461b7a0ba4a";
+    hash = "sha256-OCXBfhgheOH8XZjUhvJpNQ1I73rCwUfgyl/xkZt3JeM=";
    postFetch = ''
      cat $out/* > $out/seednodes.fref
    '';
@@ -36,13 +36,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "freenet";
-  version = "01501";
+  version = "01503";

  src = fetchFromGitHub {
    owner = "freenet";
    repo = "fred";
    tag = "build${version}";
-    hash = "sha256-XtcTQlgUNv6IQD89oelCyjb9r6wIbT3hCH+QHkjtgP8=";
+    hash = "sha256-SjHQssCwPjSoaxsLmaov4bRoz+6XSlHfiOoxWxlRn60=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/gl/glitchtip/frontend.nix
+++ b/pkgs/by-name/gl/glitchtip/frontend.nix
@@ -9,18 +9,18 @@

 buildNpmPackage (finalAttrs: {
  pname = "glitchtip-frontend";
-  version = "5.1.0";
+  version = "5.1.1";

  src = fetchFromGitLab {
    owner = "glitchtip";
    repo = "glitchtip-frontend";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-8l/V2u/j3nF6GqFlQwK33pQuRAPXmqitmrNq6Z8p7ZQ=";
+    hash = "sha256-WKh5w6AVyKhkGvGsy2Wv4Z01UaKTctDSfEhOek2Y84w=";
  };

  npmDeps = fetchNpmDeps {
    inherit (finalAttrs) src;
-    hash = "sha256-Lvhf80O/UTFABIGHjSVz4olBkEMUoE7XX66PD6P/FiA=";
+    hash = "sha256-G2DZhHfTWi0qCAMs+IP7T2XEecBwTX12Dk3O0pD8ZJw=";
  };

  postPatch = ''
--- a/pkgs/by-name/gl/glitchtip/package.nix
+++ b/pkgs/by-name/gl/glitchtip/package.nix
@@ -84,14 +84,14 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "glitchtip";
-  version = "5.1.0";
+  version = "5.1.1";
  pyproject = true;

  src = fetchFromGitLab {
    owner = "glitchtip";
    repo = "glitchtip-backend";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-okX/bWZNe5ypkfUYm7usNXa7HpBgZoj2vLEq+oGHKiM=";
+    hash = "sha256-P5J4nFXQHt+vP2W1bzdw4V9Pq+YnYsjgJPnU89RYofI=";
  };

  propagatedBuildInputs = pythonPackages;
--- a/pkgs/by-name/ja/jan/package.nix
+++ b/pkgs/by-name/ja/jan/package.nix
@@ -6,10 +6,10 @@

 let
  pname = "Jan";
-  version = "0.6.8";
+  version = "0.6.9";
  src = fetchurl {
    url = "https://github.com/menloresearch/jan/releases/download/v${version}/jan_${version}_amd64.AppImage";
-    hash = "sha256-JCG4ONJ4Ym/jMJnPJYYk0b+IYKtmWfrk8JxPy2k73hM=";
+    hash = "sha256-633tZXjKWwXW7VZoHz8GpGX5GWsEoZM3FbfjUJdntOs=";
  };

  appimageContents = appimageTools.extractType2 { inherit pname version src; };
--- a/pkgs/by-name/ja/jasmin-compiler/package.nix
+++ b/pkgs/by-name/ja/jasmin-compiler/package.nix
@@ -9,11 +9,11 @@

 stdenv.mkDerivation rec {
  pname = "jasmin-compiler";
-  version = "2025.06.0";
+  version = "2025.06.1";

  src = fetchurl {
    url = "https://github.com/jasmin-lang/jasmin/releases/download/v${version}/jasmin-compiler-v${version}.tar.bz2";
-    hash = "sha256-VjWNvg/aF+omobF8b4YpRwVYM5K/b0GLoe1P/83ilk8=";
+    hash = "sha256-6StC+mnafHMLDCbaz4QqcrT+vK9PIVeh3BizzOH4Wfo=";
  };

  nativeBuildInputs = with ocamlPackages; [
@@ -47,15 +47,9 @@ stdenv.mkDerivation rec {
    "out"
  ];

-  installPhase = ''
-    runHook preInstall
-    pushd compiler
-    dune build @install
-    dune install --prefix=$bin --libdir=$out/lib/ocaml/${ocamlPackages.ocaml.version}/site-lib
-    popd
-    mkdir -p $lib/lib/jasmin/easycrypt
-    cp eclib/*.ec $lib/lib/jasmin/easycrypt
-    runHook postInstall
+  preInstall = ''
+    export PREFIX=$lib
+    export DUNE_OPTS="--prefix=$bin --libdir=$out/lib/ocaml/${ocamlPackages.ocaml.version}/site-lib"
  '';

  meta = {
--- a/pkgs/by-name/jp/jp-zip-codes/package.nix
+++ b/pkgs/by-name/jp/jp-zip-codes/package.nix
@@ -7,15 +7,15 @@

 stdenvNoCC.mkDerivation {
  pname = "jp-zip-code";
-  version = "0-unstable-2025-08-01";
+  version = "0-unstable-2025-09-01";

  # This package uses a mirror as the source because the
  # original provider uses the same URL for updated content.
  src = fetchFromGitHub {
    owner = "musjj";
    repo = "jp-zip-codes";
-    rev = "e3f5e6c1509e2dc5f2e60c88324a72635923fcbc";
-    hash = "sha256-bGBQ/S6U6agVxlKk3ZZ2ffiO1JipzQt+ctpLt6laLPk=";
+    rev = "87a760cee8a6b103d834197caca72c3392ccbcde";
+    hash = "sha256-7vOcScEk4fKIeUa+FGCnBczlAwUC00E7EKQq7wQ2bUI=";
  };

  installPhase = ''
--- a/pkgs/by-name/li/libwebp/package.nix
+++ b/pkgs/by-name/li/libwebp/package.nix
@@ -29,6 +29,8 @@
  opencv,
  python3,
  vips,
+  testers,
+  libwebp,
 }:

 stdenv.mkDerivation rec {
@@ -79,6 +81,7 @@ stdenv.mkDerivation rec {
      ;
    inherit (python3.pkgs) pillow imread;
    haskell-webp = haskellPackages.webp;
+    pkg-config = testers.hasPkgConfigModules { package = libwebp; };
  };

  meta = with lib; {
@@ -87,5 +90,15 @@ stdenv.mkDerivation rec {
    license = licenses.bsd3;
    platforms = platforms.all;
    maintainers = with maintainers; [ ajs124 ];
+    pkgConfigModules = [
+      # configure_pkg_config() calls for these are unconditional
+      "libwebp"
+      "libwebpdecoder"
+      "libwebpdemux"
+      "libsharpyuv"
+    ]
+    ++ lib.optionals libwebpmuxSupport [
+      "libwebpmux"
+    ];
  };
 }
--- a/pkgs/by-name/lm/lmstudio/package.nix
+++ b/pkgs/by-name/lm/lmstudio/package.nix
@@ -7,10 +7,10 @@
 let
  pname = "lmstudio";

-  version_aarch64-darwin = "0.3.23-3";
-  hash_aarch64-darwin = "sha256-Jfx4Fx9mlrdGckE2ML3eTQHfgglEELOYJYxibRiAB7c=";
-  version_x86_64-linux = "0.3.23-3";
-  hash_x86_64-linux = "sha256-FG3CzD6UjuPYXImjTkKTozpTQVGk8JLqxhJxTS9qjuo=";
+  version_aarch64-darwin = "0.3.24-6";
+  hash_aarch64-darwin = "sha256-1SNiyxpjEaxzlIcotgNiCW3LLIqRI55jTKzj2T9PtNs=";
+  version_x86_64-linux = "0.3.24-6";
+  hash_x86_64-linux = "sha256-TjfrNPr8xRUOmRRx2rLJEh3D/kV3OOfqgRTVstOd6AE=";

  meta = {
    description = "LM Studio is an easy to use desktop app for experimenting with local and open-source Large Language Models (LLMs)";
--- a/pkgs/by-name/lu/lune/package.nix
+++ b/pkgs/by-name/lu/lune/package.nix
@@ -7,17 +7,17 @@
 }:
 rustPlatform.buildRustPackage rec {
  pname = "lune";
-  version = "0.10.1";
+  version = "0.10.2";

  src = fetchFromGitHub {
    owner = "filiptibell";
    repo = "lune";
    tag = "v${version}";
-    hash = "sha256-Kk3ZIF+kQzsg/ApUm12bbWlIthj5cpVefAqEGhgxb3w=";
+    hash = "sha256-td+rzfM4MtvuwnxDZbJOJAFMPzc/KzTWsHSiqJg2+a4=";
    fetchSubmodules = true;
  };

-  cargoHash = "sha256-zGXxck/cH8nIS1B/bPTJf1LLCl1viOGSDL0TRQSNaRk=";
+  cargoHash = "sha256-vgnt76GyKYJhrnMqJNKj5YMXubDzSgsab07nd5Y8+qY=";

  # error: linker `aarch64-linux-gnu-gcc` not found
  postPatch = ''
--- a/pkgs/by-name/op/openttd-ttf/package.nix
+++ b/pkgs/by-name/op/openttd-ttf/package.nix
@@ -7,13 +7,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "openttd-ttf";
-  version = "0.7";
+  version = "0.8";

  src = fetchFromGitHub {
    owner = "zephyris";
    repo = "openttd-ttf";
    tag = finalAttrs.version;
-    hash = "sha256-HKOG3Ov0LBCW7Z0FK5BrZRycn2S5gVRnwyU9fM3hb5M=";
+    hash = "sha256-ZV74ZQ4Z4jw2tjG3kXj4Vo1J+W3BF0SJIFIae9DWLAc=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/pr/proton-pass/package.nix
+++ b/pkgs/by-name/pr/proton-pass/package.nix
@@ -9,11 +9,11 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "proton-pass";
-  version = "1.32.3";
+  version = "1.32.5";

  src = fetchurl {
    url = "https://proton.me/download/pass/linux/x64/proton-pass_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-tVjiY+AwzCTPAb9rB7/gnRjElf2vhHRcX3kLUj6lwIg=";
+    hash = "sha256-nf24oCLeJ0FoWPCB1NKFEDfzLkRWvvgzMFItFw4dikY=";
  };

  dontConfigure = true;
--- a/pkgs/by-name/rc/rcu/Port-to-paramiko-4.x.patch
+++ b/pkgs/by-name/rc/rcu/Port-to-paramiko-4.x.patch
@@ -1,17 +1,15 @@
-From aad61b320d65953fddec10b019a186fc67f57a5d Mon Sep 17 00:00:00 2001
-From: OPNA2608 <opna2608@protonmail.com>
-Date: Sat, 10 Feb 2024 12:20:29 +0100
-Subject: [PATCH] src/model/transport.py: Port to paramiko 3.x
-
---
- src/model/transport.py | 19 +++++++++----------
- 1 file changed, 9 insertions(+), 10 deletions(-)
-
-diff --git a/src/model/transport.py b/src/model/transport.py
-index 0c2ee16..5a2bd22 100644
--- a/src/model/transport.py
-+++ b/src/model/transport.py
-@@ -117,7 +117,6 @@ from paramiko.kex_gss import KexGSSGex, KexGSSGroup1, KexGSSGroup14
+diff '--color=auto' -ruN a/src/model/transport.py b/src/model/transport.py
+--- a/src/model/transport.py	2025-08-27 17:12:23.761436314 +0200
+++ b/src/model/transport.py	2025-08-27 17:17:35.723006746 +0200
+@@ -105,7 +105,6 @@
+     MSG_NAMES,
+ )
+ from paramiko.compress import ZlibCompressor, ZlibDecompressor
+-from paramiko.dsskey import DSSKey
+ from paramiko.ed25519key import Ed25519Key
+ from paramiko.kex_curve25519 import KexCurve25519
+ from paramiko.kex_gex import KexGex, KexGexSHA256
+@@ -117,7 +116,6 @@
 from paramiko.message import Message
 from paramiko.packet import Packetizer, NeedRekeyException
 from paramiko.primes import ModulusPack
@@ -19,7 +17,7 @@ index 0c2ee16..5a2bd22 100644
 from paramiko.rsakey import RSAKey
 from paramiko.ecdsakey import ECDSAKey
 from paramiko.server import ServerInterface
-@@ -128,7 +127,7 @@ from paramiko.ssh_exception import (
+@@ -128,7 +126,7 @@
     ChannelException,
     ProxyCommandFailure,
 )
@@ -28,7 +26,24 @@ index 0c2ee16..5a2bd22 100644
 
 
 # for thread cleanup
-@@ -396,7 +395,7 @@ class Transport(threading.Thread, ClosingContextManager):
+@@ -192,7 +190,6 @@
+         "ecdsa-sha2-nistp384",
+         "ecdsa-sha2-nistp521",
+         "ssh-rsa",
+-        "ssh-dss",
+     )
+     _preferred_kex = (
+         "ecdh-sha2-nistp256",
+@@ -273,8 +270,6 @@
+     _key_info = {
+         "ssh-rsa": RSAKey,
+         "ssh-rsa-cert-v01@openssh.com": RSAKey,
+-        "ssh-dss": DSSKey,
+-        "ssh-dss-cert-v01@openssh.com": DSSKey,
+         "ecdsa-sha2-nistp256": ECDSAKey,
+         "ecdsa-sha2-nistp256-cert-v01@openssh.com": ECDSAKey,
+         "ecdsa-sha2-nistp384": ECDSAKey,
+@@ -396,7 +391,7 @@
         self.active = False
         self.hostname = None
 
@@ -37,7 +52,7 @@ index 0c2ee16..5a2bd22 100644
             # convert "host:port" into (host, port)
             hl = sock.split(":", 1)
             self.hostname = hl[0]
-@@ -419,7 +418,7 @@ class Transport(threading.Thread, ClosingContextManager):
+@@ -419,7 +414,7 @@
                     sock = socket.socket(af, socket.SOCK_STREAM)
                     sock.settimeout(1)
                     try:
@@ -46,7 +61,7 @@ index 0c2ee16..5a2bd22 100644
                     except socket.error as e:
                         reason = str(e)
                     else:
-@@ -542,7 +541,7 @@ class Transport(threading.Thread, ClosingContextManager):
+@@ -542,7 +537,7 @@
         """
         Returns a string representation of this object, for debugging.
         """
@@ -55,7 +70,31 @@ index 0c2ee16..5a2bd22 100644
         out = "<paramiko.Transport at {}".format(id_)
         if not self.active:
             out += " (unconnected)"
-@@ -1123,7 +1122,7 @@ class Transport(threading.Thread, ClosingContextManager):
+@@ -749,11 +744,11 @@
+         as a server, the host key is used to sign certain packets during the
+         SSH2 negotiation, so that the client can trust that we are who we say
+         we are.  Because this is used for signing, the key must contain private
+-        key info, not just the public half.  Only one key of each type (RSA or
+-        DSS) is kept.
+        key info, not just the public half.  Only one key of each type (i.e.
+        RSA) is kept.
+ 
+         :param .PKey key:
+-            the host key to add, usually an `.RSAKey` or `.DSSKey`.
+            the host key to add, usually an `.RSAKey`.
+         """
+         self.server_key_dict[key.get_name()] = key
+ 
+@@ -763,7 +758,7 @@
+         client, this method will return the negotiated host key.  If only one
+         type of host key was set with `add_server_key`, that's the only key
+         that will ever be returned.  But in cases where you have set more than
+-        one type of host key (for example, an RSA key and a DSS key), the key
+        one type of host key (for example, an RSA key and another key), the key
+         type will be negotiated by the client, and this method will return the
+         key of the type agreed on.  If the host key has not been negotiated
+         yet, ``None`` is returned.  In client mode, the behavior is undefined.
+@@ -1123,7 +1118,7 @@
         m = Message()
         m.add_byte(cMSG_IGNORE)
         if byte_count is None:
@@ -64,7 +103,7 @@ index 0c2ee16..5a2bd22 100644
         m.add_bytes(os.urandom(byte_count))
         self._send_user_message(m)
 
-@@ -1802,7 +1801,7 @@ class Transport(threading.Thread, ClosingContextManager):
+@@ -1802,7 +1797,7 @@
     def stop_thread(self):
         self.active = False
         self.packetizer.close()
@@ -73,7 +112,7 @@ index 0c2ee16..5a2bd22 100644
             # Original join logic; #520 doesn't appear commonly present under
             # Python 2.
             while self.is_alive() and self is not threading.current_thread():
-@@ -1909,7 +1908,7 @@ class Transport(threading.Thread, ClosingContextManager):
+@@ -1909,7 +1904,7 @@
         m = Message()
         m.add_mpint(self.K)
         m.add_bytes(self.H)
@@ -82,7 +121,7 @@ index 0c2ee16..5a2bd22 100644
         m.add_bytes(self.session_id)
         # Fallback to SHA1 for kex engines that fail to specify a hex
         # algorithm, or for e.g. transport tests that don't run kexinit.
-@@ -2037,14 +2036,14 @@ class Transport(threading.Thread, ClosingContextManager):
+@@ -2037,14 +2032,14 @@
 
         # active=True occurs before the thread is launched, to avoid a race
         _active_threads.append(self)
@@ -99,6 +138,3 @@ index 0c2ee16..5a2bd22 100644
                 self._log(
                     DEBUG,
                     "Local version/idstring: {}".format(self.local_version),
-- 
-2.42.0
-
--- a/pkgs/by-name/rc/rcu/package.nix
+++ b/pkgs/by-name/rc/rcu/package.nix
@@ -23,7 +23,7 @@ let
 in
 python3Packages.buildPythonApplication rec {
  pname = "rcu";
-  version = "4.0.24";
+  version = "4.0.26";

  format = "other";

@@ -31,7 +31,7 @@ python3Packages.buildPythonApplication rec {
    let
      src-tarball = requireFile {
        name = "rcu-${version}-source.tar.gz";
-        hash = "sha256-3rZiqg8Uuta3kI2m+2rBZ1XzN9bFds+emhivH5X7sJg=";
+        hash = "sha256-yY3OFZVHxhVurfjSEeR+UUNHQdpc08jhgaDEvMWRsLA=";
        url = "https://www.davisr.me/projects/rcu/";
      };
    in
@@ -42,7 +42,7 @@ python3Packages.buildPythonApplication rec {
    '';

  patches = [
-    ./Port-to-paramiko-3.x.patch
+    ./Port-to-paramiko-4.x.patch
  ];

  postPatch = ''
--- a/pkgs/by-name/sc/sct/package.nix
+++ b/pkgs/by-name/sc/sct/package.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation {
      raskin
      somasis
    ];
-    license = licenses.publicDomain;
+    license = licenses.isc;
    platforms = with platforms; linux ++ freebsd ++ openbsd;
  };
 }
--- a/pkgs/by-name/so/socklog/package.nix
+++ b/pkgs/by-name/so/socklog/package.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
  meta = {
    description = "System and kernel logging services";
    homepage = "https://smarden.org/socklog/";
-    license = lib.licenses.publicDomain;
+    license = lib.licenses.bsd3;
    platforms = lib.platforms.unix;
    maintainers = with lib.maintainers; [ joachifm ];
  };
--- a/pkgs/by-name/so/sope/package.nix
+++ b/pkgs/by-name/so/sope/package.nix
@@ -80,7 +80,7 @@ clangStdenv.mkDerivation rec {

  meta = {
    description = "Extensive set of frameworks which form a complete Web application server environment";
-    license = lib.licenses.publicDomain;
+    license = lib.licenses.lgpl2Plus;
    homepage = "https://github.com/Alinto/sope";
    platforms = lib.platforms.linux;
    maintainers = with lib.maintainers; [ jceb ];
--- a/pkgs/by-name/st/starpls/package.nix
+++ b/pkgs/by-name/st/starpls/package.nix
@@ -7,12 +7,12 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "starpls";
-  version = "0.1.22-unstable-2025-12-30";
+  version = "0.1.22";

  src = fetchFromGitHub {
    owner = "withered-magic";
    repo = "starpls";
-    rev = "db21acd3cb24893315dd601484c7d40689589e9a";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-t9kdpBKyGM61CKhtfO5urVVzyKpL0bX0pZuf0djDdCw=";
  };

@@ -30,9 +30,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    tests.version = testers.testVersion {
      package = finalAttrs.finalPackage;
      command = "starpls version";
-      version = "v${
-        lib.strings.substring 0 (builtins.stringLength finalAttrs.version - 6) finalAttrs.version
-      }";
+      version = "v${finalAttrs.version}";
    };
  };

--- a/pkgs/by-name/st/stb/package.nix
+++ b/pkgs/by-name/st/stb/package.nix
@@ -44,7 +44,11 @@ stdenv.mkDerivation rec {
  meta = with lib; {
    description = "Single-file public domain libraries for C/C++";
    homepage = "https://github.com/nothings/stb";
-    license = licenses.publicDomain;
+    license = with licenses; [
+      mit
+      # OR
+      unlicense
+    ];
    platforms = platforms.all;
    maintainers = [ ];
  };
--- a/pkgs/by-name/su/super-productivity/package.nix
+++ b/pkgs/by-name/su/super-productivity/package.nix
@@ -14,13 +14,13 @@

 buildNpmPackage rec {
  pname = "super-productivity";
-  version = "14.3.3";
+  version = "14.4.1";

  src = fetchFromGitHub {
    owner = "johannesjo";
    repo = "super-productivity";
    tag = "v${version}";
-    hash = "sha256-gJ6hG5nAzT708GFMjArN/F1Mz/K4gg1R0QeHmM6jc0c=";
+    hash = "sha256-TW3HbwNIrcfA1W+fmBMfD0NGKBF/vTKJFuCzzaVfX6I=";

    postFetch = ''
      find $out -name package-lock.json -exec ${lib.getExe npm-lockfile-fix} -r {} \;
@@ -63,7 +63,7 @@ buildNpmPackage rec {
      dontInstall = true;

      outputHashMode = "recursive";
-      hash = "sha256-+e53npbip3BGdw4S6mpkxc9g6AVc+QbJxfPYK6IglSA=";
+      hash = "sha256-AYbvyqvKmhP+2NHxzzcSZFiPBgeh0YOQ2a6t+3fZwYk=";
    }
  );

--- a/pkgs/by-name/tl/tlsx/package.nix
+++ b/pkgs/by-name/tl/tlsx/package.nix
@@ -6,16 +6,16 @@

 buildGoModule rec {
  pname = "tlsx";
-  version = "1.2.0";
+  version = "1.2.1";

  src = fetchFromGitHub {
    owner = "projectdiscovery";
    repo = "tlsx";
    tag = "v${version}";
-    hash = "sha256-5ffJ7UzIP3qZoEAxJFGce5BaWHnkqtPnQOHpuJmQC50=";
+    hash = "sha256-VpdAf2oe7X8NldZ033BPxyl0ra5HGAfeqtxI5beSXi8=";
  };

-  vendorHash = "sha256-hSCzpvciuI8zJgD2xgWTK+UiVthXgrPl6AeU/7QLg4c=";
+  vendorHash = "sha256-EzTz8WP3Sadg6Tu8Tf0n2s+YOJqRVbPQrkW3JEntwBg=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/un/unifi/package.nix
+++ b/pkgs/by-name/un/unifi/package.nix
@@ -10,12 +10,12 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "unifi-controller";
-  version = "9.3.45";
+  version = "9.4.19";

  # see https://community.ui.com/releases / https://www.ui.com/download/unifi
  src = fetchurl {
    url = "https://dl.ui.com/unifi/${finalAttrs.version}/unifi_sysvinit_all.deb";
-    hash = "sha256-9gpXY9+XiUnpyRuMdvXGkbiqJ3SlJ6PZ7k1Rj5pbFqs=";
+    hash = "sha256-lbveHJjORpARa+EU54OtvIk7x1WFGKrwFWL3b+A35XA=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/vi/vital/package.nix
+++ b/pkgs/by-name/vi/vital/package.nix
@@ -73,8 +73,7 @@ stdenv.mkDerivation (finalAttrs: {
    homepage = "https://vital.audio/";
    sourceProvenance = with sourceTypes; [ binaryNativeCode ];
    license = with licenses; [
-      unfree
-      gpl3Plus
+      unfree # https://vital.audio/eula/
    ];
    platforms = [ "x86_64-linux" ];
    maintainers = with maintainers; [ PowerUser64 ];
--- a/pkgs/by-name/wa/warp-plus/fix-endpoints.patch
+++ b/pkgs/by-name/wa/warp-plus/fix-endpoints.patch
@@ -0,0 +1,95 @@
+From b1bc81051810899189b071349443d82fdc1caebe Mon Sep 17 00:00:00 2001
+From: NImaism <nima.gholamyy@gmail.com>
+Date: Sat, 16 Aug 2025 22:20:15 +0330
+Subject: [PATCH] fix: warp endpoints issues
+
+---
+ app/app.go               | 18 ++++++++++++++----
+ cmd/warp-plus/rootcmd.go | 10 ----------
+ 2 files changed, 14 insertions(+), 14 deletions(-)
+
+diff --git a/app/app.go b/app/app.go
+index 770c58b536e11be3ebdb098c54cf74228139cb51..0197655d681539ed1dd1915ed65107cb7c007b17 100644
+--- a/app/app.go
+++ b/app/app.go
+@@ -56,6 +56,16 @@ func RunWarp(ctx context.Context, l *slog.Logger, opts WarpOptions) error {
+ 		return errors.New("must provide country for psiphon")
+ 	}
+ 
+	if opts.Endpoint == "" {
+		ident, err := warp.LoadOrCreateIdentity(l, path.Join(opts.CacheDir, "primary"), opts.License)
+		if err != nil {
+			l.Error("failed to load or create primary warp identity")
+			return err
+		}
+
+		opts.Endpoint = ident.Config.Peers[0].Endpoint.V4[:len(ident.Config.Peers[0].Endpoint.V4)-2] + ":500"
+	}
+
+ 	// Decide Working Scenario
+ 	endpoints := []string{opts.Endpoint, opts.Endpoint}
+ 
+@@ -96,7 +106,7 @@ func RunWarp(ctx context.Context, l *slog.Logger, opts WarpOptions) error {
+ 	case opts.Gool:
+ 		l.Info("running in warp-in-warp (gool) mode")
+ 		// run warp in warp
+-		warpErr = runWarpInWarp(ctx, l, opts, endpoints)
+		warpErr = runWarpInWarp(ctx, l, opts, endpoints[0])
+ 	default:
+ 		l.Info("running in normal warp mode")
+ 		// just run primary warp on bindAddress
+@@ -237,7 +247,7 @@ func runWarp(ctx context.Context, l *slog.Logger, opts WarpOptions, endpoint str
+ 	return nil
+ }
+ 
+-func runWarpInWarp(ctx context.Context, l *slog.Logger, opts WarpOptions, endpoints []string) error {
+func runWarpInWarp(ctx context.Context, l *slog.Logger, opts WarpOptions, endpoint string) error {
+ 	// make primary identity
+ 	ident1, err := warp.LoadOrCreateIdentity(l, path.Join(opts.CacheDir, "primary"), opts.License)
+ 	if err != nil {
+@@ -254,7 +264,7 @@ func runWarpInWarp(ctx context.Context, l *slog.Logger, opts WarpOptions, endpoi
+ 
+ 	// Enable trick and keepalive on all peers in config
+ 	for i, peer := range conf.Peers {
+-		peer.Endpoint = endpoints[0]
+		peer.Endpoint = endpoint
+ 		peer.Trick = true
+ 		peer.KeepAlive = 5
+ 
+@@ -297,7 +307,7 @@ func runWarpInWarp(ctx context.Context, l *slog.Logger, opts WarpOptions, endpoi
+ 	}
+ 
+ 	// Create a UDP port forward between localhost and the remote endpoint
+-	addr, err := wiresocks.NewVtunUDPForwarder(ctx, netip.MustParseAddrPort("127.0.0.1:0"), endpoints[0], tnet1, singleMTU)
+	addr, err := wiresocks.NewVtunUDPForwarder(ctx, netip.MustParseAddrPort("127.0.0.1:0"), endpoint, tnet1, singleMTU)
+ 	if err != nil {
+ 		return err
+ 	}
+diff --git a/cmd/warp-plus/rootcmd.go b/cmd/warp-plus/rootcmd.go
+index 87642c3708d5084d89771808c0ff7e96f6da1014..87eec817a35390cae4b66ad51fd152fce55670f6 100644
+--- a/cmd/warp-plus/rootcmd.go
+++ b/cmd/warp-plus/rootcmd.go
+@@ -13,7 +13,6 @@ import (
+ 	"github.com/adrg/xdg"
+ 	"github.com/bepass-org/warp-plus/app"
+ 	p "github.com/bepass-org/warp-plus/psiphon"
+-	"github.com/bepass-org/warp-plus/warp"
+ 	"github.com/bepass-org/warp-plus/wiresocks"
+ 	"github.com/peterbourgon/ff/v4"
+ 	"github.com/peterbourgon/ff/v4/ffval"
+@@ -205,15 +204,6 @@ func (c *rootConfig) exec(ctx context.Context, args []string) error {
+ 		opts.Scan = &wiresocks.ScanOptions{V4: c.v4, V6: c.v6, MaxRTT: c.rtt}
+ 	}
+ 
+-	// If the endpoint is not set, choose a random warp endpoint
+-	if opts.Endpoint == "" {
+-		addrPort, err := warp.RandomWarpEndpoint(c.v4, c.v6)
+-		if err != nil {
+-			fatal(l, err)
+-		}
+-		opts.Endpoint = addrPort.String()
+-	}
+-
+ 	go func() {
+ 		if err := app.RunWarp(ctx, l, opts); err != nil {
+ 			fatal(l, err)
--- a/pkgs/by-name/wa/warp-plus/package.nix
+++ b/pkgs/by-name/wa/warp-plus/package.nix
@@ -10,16 +10,16 @@

 buildGoModule rec {
  pname = "warp-plus";
-  version = "1.2.6";
+  version = "1.2.6-unstable-2025-08-13";

  src = fetchFromGitHub {
    owner = "bepass-org";
    repo = "warp-plus";
-    rev = "v${version}";
-    hash = "sha256-Zi428QI0DBIPEywXPi0TwDQWJuQyQcB6N5nqtYkkpHk=";
+    rev = "08d43e9e4c079534e47ba19fb2965c968c9621b2";
+    hash = "sha256-MHz8b1whSzUJO0YogxMPuXMaQRfR+xxSYhFxq412EmE=";
  };

-  vendorHash = "sha256-cCMbda2dVZypGqy9zoh0D3lVHWw/HNbCaSe0Nj5wL6s=";
+  vendorHash = "sha256-GmxiQk50iQoH2J/qUVvl9RBz6aIQp8RURqTzrl6NdCY=";

  ldflags = [
    "-s"
@@ -27,10 +27,16 @@ buildGoModule rec {
    "-X main.version=${version}"
  ];

+  patches = [
+    # https://github.com/bepass-org/warp-plus/pull/291
+    ./fix-endpoints.patch
+  ];
+
  checkFlags =
    let
      # Skip tests that require network access
      skippedTests = [
+        "TestStdNetBindReceiveFuncAfterClose"
        "TestConcurrencySafety"
        "TestNoiseHandshake"
        "TestTwoDevicePing"
@@ -39,18 +45,18 @@ buildGoModule rec {
    [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];

  passthru = {
-    updateScript = nix-update-script { };
-    tests.version = testers.testVersion { package = warp-plus; };
+    updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
+    tests.version = testers.testVersion {
+      package = warp-plus;
+      command = "warp-plus version";
+    };
  };

  meta = {
    description = "Warp + Psiphon, an anti censorship utility for Iran";
    homepage = "https://github.com/bepass-org/warp-plus";
    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ ];
+    maintainers = with lib.maintainers; [ phanirithvij ];
    mainProgram = "warp-plus";
-    # Doesn't work with Go toolchain >1.22, runtime error:
-    # 'panic: tls.ConnectionState doesn't match'
-    broken = true;
  };
 }
--- a/pkgs/by-name/wg/wgetpaste/package.nix
+++ b/pkgs/by-name/wg/wgetpaste/package.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
    description = "Command-line interface to various pastebins";
    mainProgram = "wgetpaste";
    homepage = "https://github.com/zlin/wgetpaste";
-    license = lib.licenses.publicDomain;
+    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [
      qknight
    ];
--- a/pkgs/by-name/wy/wyoming-piper/package.nix
+++ b/pkgs/by-name/wy/wyoming-piper/package.nix
@@ -21,6 +21,7 @@ python3Packages.buildPythonApplication rec {
  ];

  pythonRelaxDeps = [
+    "regex"
    "wyoming"
  ];

--- a/pkgs/by-name/xe/xe/package.nix
+++ b/pkgs/by-name/xe/xe/package.nix
@@ -20,7 +20,7 @@ stdenv.mkDerivation rec {
  meta = {
    description = "Simple xargs and apply replacement";
    homepage = "https://github.com/leahneukirchen/xe";
-    license = lib.licenses.publicDomain;
+    license = lib.licenses.cc0;
    platforms = lib.platforms.all;
    maintainers = [ lib.maintainers.pbsds ];
    mainProgram = "xe";
--- a/pkgs/by-name/zi/zigbee2mqtt/package.nix
+++ b/pkgs/by-name/zi/zigbee2mqtt/package.nix
@@ -16,19 +16,19 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "zigbee2mqtt";
-  version = "2.6.0";
+  version = "2.6.1";

  src = fetchFromGitHub {
    owner = "Koenkk";
    repo = "zigbee2mqtt";
    tag = finalAttrs.version;
-    hash = "sha256-syzrH3hJinAcpdyVlwEevqzi0LZ+gBMvJOXncuafzjE=";
+    hash = "sha256-rf6Y3d0Yg4jQiPLFgSGj4JtB/XJ5lQYx4kkGpOvEdFU=";
  };

  pnpmDeps = pnpm.fetchDeps {
    inherit (finalAttrs) pname version src;
    fetcherVersion = 1;
-    hash = "sha256-EJgR1xjQJGKBdgJ2BGFiumVwZViXn7GJNa4GPkkscDg=";
+    hash = "sha256-mgaZSN4SDjQBAeevFglh2ZV+RLsiBdzrjz8QRx8qMnA=";
  };

  nativeBuildInputs = [
--- a/pkgs/development/haskell-modules/configuration-nix.nix
+++ b/pkgs/development/haskell-modules/configuration-nix.nix
@@ -507,24 +507,21 @@ builtins.intersectAttrs super {
  # LLVM input that llvm-ffi declares.
  llvm-ffi =
    let
-      chosenLlvmVersion = 20;
-      nextLlvmAttr = "llvmPackages_${toString (chosenLlvmVersion + 1)}";
-      shouldUpgrade =
-        pkgs ? ${nextLlvmAttr} && (lib.strings.match ".+rc.+" pkgs.${nextLlvmAttr}.llvm.version) == null;
+      currentDefaultVersion = lib.versions.major pkgs.llvmPackages.llvm.version;
+      latestSupportedVersion = lib.versions.major super.llvm-ffi.version;
    in
-    lib.warnIf shouldUpgrade
-      "haskellPackages.llvm-ffi: ${nextLlvmAttr} is available in Nixpkgs, consider updating."
-      lib.pipe
-      super.llvm-ffi
+    lib.pipe super.llvm-ffi (
      [
-        # ATTN: There is no matching flag for the latest supported LLVM version,
-        # so you may need to remove this when updating chosenLlvmVersion
-        (enableCabalFlag "LLVM${toString chosenLlvmVersion}00")
        (addBuildDepends [
-          pkgs."llvmPackages_${toString chosenLlvmVersion}".llvm.lib
-          pkgs."llvmPackages_${toString chosenLlvmVersion}".llvm.dev
+          pkgs.llvmPackages.llvm.lib
+          pkgs.llvmPackages.llvm.dev
        ])
-      ];
+      ]
+      # There is no matching flag for the latest supported LLVM version.
+      ++ lib.optional (currentDefaultVersion != latestSupportedVersion) (
+        enableCabalFlag "LLVM${currentDefaultVersion}00"
+      )
+    );

  # Needs help finding LLVM.
  spaceprobe = addBuildTool self.buildHaskellPackages.llvmPackages.llvm super.spaceprobe;
--- a/pkgs/development/php-packages/grumphp/default.nix
+++ b/pkgs/development/php-packages/grumphp/default.nix
@@ -7,16 +7,16 @@

 php.buildComposerProject2 (finalAttrs: {
  pname = "grumphp";
-  version = "2.14.0";
+  version = "2.15.0";

  src = fetchFromGitHub {
    owner = "phpro";
    repo = "grumphp";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-p8xhfu1tjSvGybA9QuqiduPS6loaWTZN5zKrcrtc4h0=";
+    hash = "sha256-48seCSiYvlNWPu9xP1kGKNwK+98F6wf602dxMjYLVio=";
  };

-  vendorHash = "sha256-5h+7yw6S2T9HehdO91TojjoCRIrACRRhan6cvJo6pcY=";
+  vendorHash = "sha256-1sDvUuB5XsCqD23IDI4kVFZUiYhaqrwDg4xQgb2kC38=";

  doInstallCheck = true;
  nativeInstallCheckInputs = [ versionCheckHook ];
--- a/pkgs/development/python-modules/certomancer/default.nix
+++ b/pkgs/development/python-modules/certomancer/default.nix
@@ -29,7 +29,7 @@

 buildPythonPackage rec {
  pname = "certomancer";
-  version = "0.12.3";
+  version = "0.13.0";
  pyproject = true;

  disabled = pythonOlder "3.7";
@@ -38,7 +38,7 @@ buildPythonPackage rec {
    owner = "MatthiasValvekens";
    repo = "certomancer";
    tag = "v${version}";
-    hash = "sha256-2BjLoGUWU0RaWVI9JA3s/Hf5aVtmv8hn+fB2jkWdQNY=";
+    hash = "sha256-2/qTTN/UuSMHjkSsOs/KbfzKLBjJSLHY51XtgQ6x1Wo=";
  };

  build-system = [
--- a/pkgs/development/python-modules/jproperties/default.nix
+++ b/pkgs/development/python-modules/jproperties/default.nix
@@ -6,24 +6,33 @@
  six,
  pytest-cov-stub,
  pytest-datadir,
+  setuptools,
  setuptools-scm,
 }:

 buildPythonPackage rec {
  pname = "jproperties";
-  version = "2.1.1";
-  format = "setuptools";
+  version = "2.1.2";
+  pyproject = true;

  src = fetchFromGitHub {
    owner = "Tblue";
    repo = "python-jproperties";
-    rev = "v${version}";
-    hash = "sha256-O+ALeGHMNjW1dc9IRyLzO81k8DW2vbGjuZqXxgrhYjo=";
+    tag = "v${version}";
+    hash = "sha256-wnhEcPWAFUXR741/LZT3TXqxrU70JZe+90AkVEA3A+k=";
  };

-  nativeBuildInputs = [ setuptools-scm ];
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace "setuptools_scm ~= 3.3" "setuptools_scm"
+  '';

-  propagatedBuildInputs = [ six ];
+  build-system = [
+    setuptools
+    setuptools-scm
+  ];
+
+  dependencies = [ six ];

  nativeCheckInputs = [
    pytest-cov-stub
@@ -31,11 +40,6 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace "setuptools_scm ~= 3.3" "setuptools_scm"
-  '';
-
  disabledTestPaths = [
    # TypeError: 'PosixPath' object...
    "tests/test_simple_utf8.py"
@@ -45,9 +49,9 @@ buildPythonPackage rec {

  meta = with lib; {
    description = "Java Property file parser and writer for Python";
-    mainProgram = "propconv";
    homepage = "https://github.com/Tblue/python-jproperties";
-    license = with licenses; [ bsd3 ];
+    license = licenses.bsd3;
    maintainers = with maintainers; [ fab ];
+    mainProgram = "propconv";
  };
 }
--- a/pkgs/development/python-modules/kanidm/default.nix
+++ b/pkgs/development/python-modules/kanidm/default.nix
@@ -2,10 +2,9 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
-  pythonOlder,

  # build
-  poetry-core,
+  pdm-backend,

  # propagates
  aiohttp,
@@ -19,28 +18,23 @@
  pytestCheckHook,
 }:

-let
-  pname = "kanidm";
-  version = "1.0.0-2024-04-22";
-in
 buildPythonPackage rec {
-  inherit pname version;
+  pname = "kanidm";
+  version = "1.2.0";
  pyproject = true;

-  disabled = pythonOlder "3.9";
-
  src = fetchFromGitHub {
    owner = "kanidm";
    repo = "kanidm";
-    rev = "a0f743d8c8e7a6b6b0775e64774fc5175464cab6";
-    hash = "sha256-W2v3/osDrjRQqz2DqoG90SGcu4K6G2ypMTfE6Xq5qNI=";
+    rev = "1774f9428ccdc357d514652acbcae49f6b16687a";
+    hash = "sha256-SE3b9Ug0EZFygGf9lsmVsQzmop9qOMiCUsbO//1QWF8=";
  };

  sourceRoot = "${src.name}/pykanidm";

-  nativeBuildInputs = [ poetry-core ];
+  build-system = [ pdm-backend ];

-  propagatedBuildInputs = [
+  dependencies = [
    aiohttp
    authlib
    pydantic
--- a/pkgs/development/python-modules/langgraph-sdk/default.nix
+++ b/pkgs/development/python-modules/langgraph-sdk/default.nix
@@ -18,14 +18,14 @@

 buildPythonPackage rec {
  pname = "langgraph-sdk";
-  version = "0.2.3";
+  version = "0.2.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "langchain-ai";
    repo = "langgraph";
    tag = "sdk==${version}";
-    hash = "sha256-X8ysXd5CwMiJMZ6GdiPjjjlm6x88Ibub04fhjDzi59M=";
+    hash = "sha256-CBX9tDYDrLCe/q+QS6ze4B6E5dVJhfsd6QB4U6kObTM=";
  };

  sourceRoot = "${src.name}/libs/sdk-py";
--- a/pkgs/development/python-modules/langsmith/default.nix
+++ b/pkgs/development/python-modules/langsmith/default.nix
@@ -31,14 +31,14 @@

 buildPythonPackage rec {
  pname = "langsmith";
-  version = "0.4.14";
+  version = "0.4.20";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "langchain-ai";
    repo = "langsmith-sdk";
    tag = "v${version}";
-    hash = "sha256-9CBEVe3FCpqUMtoTQKikgDmSvqqppTPWYrhElPh6UcA=";
+    hash = "sha256-XAN0DTKZcT8SAwPNI6lDrpmgvr1a5KsTAeRvw7OYVCo=";
  };

  sourceRoot = "${src.name}/python";
--- a/pkgs/development/python-modules/netbox-contextmenus/default.nix
+++ b/pkgs/development/python-modules/netbox-contextmenus/default.nix
@@ -0,0 +1,33 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  setuptools,
+  netbox,
+  python,
+}:
+
+buildPythonPackage rec {
+  pname = "netbox-contextmenus";
+  version = "1.4.8";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "PieterL75";
+    repo = "netbox_contextmenus";
+    tag = "v${version}";
+    hash = "sha256-wK8IQ+vYFP9cWcazTOzP1eoKBU0YXwbQrtfM7tGNTXI=";
+  };
+
+  build-system = [ setuptools ];
+
+  # pythonImportsCheck fails due to improperly configured django app
+
+  meta = {
+    description = "Netbox plugin to add context buttons to the links, making navigating less clicky";
+    homepage = "https://github.com/PieterL75/netbox_contextmenus/";
+    changelog = "https://github.com/PieterL75/netbox_contextmenus/releases/tag/${src.tag}";
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ felbinger ];
+  };
+}
--- a/pkgs/development/python-modules/optuna-dashboard/default.nix
+++ b/pkgs/development/python-modules/optuna-dashboard/default.nix
@@ -24,14 +24,14 @@

 buildPythonPackage rec {
  pname = "optuna-dashboard";
-  version = "0.19.0";
+  version = "0.20.0b1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "optuna";
    repo = "optuna-dashboard";
    tag = "v${version}";
-    hash = "sha256-UTl3X0laEHyc9YjL2RPBeCle0WRKjOU7Bt58BMRXIlU=";
+    hash = "sha256-+mS9D71cwVkO0AqtU0pxK0PBvwCOxA6dPJyTVps4X+g=";
  };

  dependencies = [
--- a/pkgs/development/python-modules/osc-sdk-python/default.nix
+++ b/pkgs/development/python-modules/osc-sdk-python/default.nix
@@ -44,6 +44,6 @@ buildPythonPackage rec {
    description = "SDK to perform actions on Outscale API";
    homepage = "https://github.com/outscale/osc-sdk-python";
    license = licenses.bsd3;
-    maintainers = with maintainers; [ nicolas-goudry ];
+    maintainers = [ ];
  };
 }
--- a/pkgs/development/python-modules/pyezvizapi/default.nix
+++ b/pkgs/development/python-modules/pyezvizapi/default.nix
@@ -12,14 +12,14 @@

 buildPythonPackage rec {
  pname = "pyezvizapi";
-  version = "1.0.1.6";
+  version = "1.0.1.7";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "RenierM26";
    repo = "pyEzvizApi";
    tag = version;
-    hash = "sha256-3HiL/l4fYb1T2JSuUgMdws3ae2YofzqDCF4zkmRY2+c=";
+    hash = "sha256-bcgy8NBW+AQDYHYo+E+7studQK6/6UgjkT75URyzSi0=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/pyomo/default.nix
+++ b/pkgs/development/python-modules/pyomo/default.nix
@@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "pyomo";
-  version = "6.9.3";
+  version = "6.9.4";
  pyproject = true;

  disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
    repo = "pyomo";
    owner = "pyomo";
    tag = version;
-    hash = "sha256-lKjxPYlVCRew1SHYvehcGWKlLz6DsCG9Bocg6G+491c=";
+    hash = "sha256-iH6vxxA/CdPCXqiw3BUmhUwhS2hfwaJy5jIic4id0Jw=";
  };

  build-system = [
--- a/pkgs/development/python-modules/segments/default.nix
+++ b/pkgs/development/python-modules/segments/default.nix
@@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "segments";
-  version = "2.2.1";
+  version = "2.3.0";
  pyproject = true;
  disabled = isPy27;

@@ -22,7 +22,7 @@ buildPythonPackage rec {
    owner = "cldf";
    repo = "segments";
    rev = "v${version}";
-    sha256 = "sha256-Z9AQnsK/0HUCZDzdpQKNfSBWxfAOjWNBytcfI6yBY84=";
+    sha256 = "sha256-5VgjaWeinXimpoCBhKBvVOmvcCIWrOqYMQegVDGJAKo=";
  };

  nativeBuildInputs = [ setuptools ];
--- a/pkgs/development/python-modules/sphinx-hoverxref/default.nix
+++ b/pkgs/development/python-modules/sphinx-hoverxref/default.nix
@@ -20,8 +20,9 @@

 buildPythonPackage rec {
  pname = "sphinx-hoverxref";
-  version = "1.3.0";
-  format = "pyproject";
+  version = "1.5.0";
+  pyproject = true;
+
  outputs = [
    "out"
    "doc"
@@ -31,35 +32,37 @@ buildPythonPackage rec {
    owner = "readthedocs";
    repo = "sphinx-hoverxref";
    rev = version;
-    hash = "sha256-DJ+mHu9IeEYEyf/SD+nDNtWpTf6z7tQzG0ogaECDpkU=";
+    hash = "sha256-JHNJGUkO/HXnnnROYBd1pAcoAEYo6b7eK4tyC+ujc+A=";
  };

  postPatch = ''
    substituteInPlace docs/conf.py --replace-fail "sphinx-prompt" "sphinx_prompt"
  '';

-  nativeBuildInputs = [
+  build-system = [
    flit-core
+  ];

+  nativeBuildInputs = [
    sphinxHook
-    sphinx-notfound-page
-    sphinx-prompt
+    sphinx-autoapi
    sphinx-rtd-theme
    sphinx-tabs
+    sphinx-prompt
    sphinx-version-warning
-    sphinx-autoapi
+    sphinx-notfound-page
    sphinxcontrib-bibtex
    sphinxemoji
  ];

-  propagatedBuildInputs = [
+  dependencies = [
    sphinx
    sphinxcontrib-jquery
  ];

  pythonImportsCheck = [ "hoverxref" ];

-  meta = with lib; {
+  meta = {
    description = "Sphinx extension for creating tooltips on the cross references of the documentation";
    longDescription = ''
      sphinx-hoverxref is a Sphinx extension to show a floating window
@@ -70,7 +73,7 @@ buildPythonPackage rec {
      in there.
    '';
    homepage = "https://github.com/readthedocs/sphinx-hoverxref";
-    license = licenses.mit;
-    maintainers = with maintainers; [ kaction ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ kaction ];
  };
 }
--- a/pkgs/development/python-modules/stups-cli-support/default.nix
+++ b/pkgs/development/python-modules/stups-cli-support/default.nix
@@ -12,7 +12,7 @@

 buildPythonPackage rec {
  pname = "stups-cli-support";
-  version = "1.1.20";
+  version = "1.1.22";
  pyproject = true;
  disabled = !isPy3k;

@@ -20,7 +20,7 @@ buildPythonPackage rec {
    owner = "zalando-stups";
    repo = "stups-cli-support";
    rev = version;
-    sha256 = "1r6g29gd009p87m8a6wv4rzx7f0564zdv67qz5xys4wsgvc95bx0";
+    sha256 = "sha256-/UsQzV1Ljd+K8AIj55UmiVXAshX+rUbYxFeSK7YGgn8=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/telethon/default.nix
+++ b/pkgs/development/python-modules/telethon/default.nix
@@ -2,6 +2,7 @@
  lib,
  buildPythonPackage,
  fetchFromGitHub,
+  fetchpatch,
  openssl,
  rsa,
  pyaes,
@@ -14,7 +15,7 @@

 buildPythonPackage rec {
  pname = "telethon";
-  version = "1.37.0";
+  version = "1.40.0";
  pyproject = true;

  disabled = pythonOlder "3.5";
@@ -23,10 +24,26 @@ buildPythonPackage rec {
    owner = "LonamiWebs";
    repo = "Telethon";
    tag = "v${version}";
-    hash = "sha256-P7FP+Wqi3dqbBCFpI9aCDvK4k3mWv8076RO6MXg+jFQ=";
+    hash = "sha256-y8nMh2dAy5ixATYGjH04FtfpvhO2HU5HRTXBr7Z+Dds=";
  };

-  patchPhase = ''
+  patches = [
+    # https://github.com/LonamiWebs/Telethon/pull/4670
+    (fetchpatch {
+      url = "https://github.com/LonamiWebs/Telethon/commit/8e2a46568ef9193f5887aea1abf919ac4ca6d31e.patch";
+      name = "fix_async_test.patch";
+      hash = "sha256-oVpLnO4OxNam/mq945OskVEHkbS5TDSUXk/0xPHVv3I=";
+    })
+  ]
+  ++ lib.optionals (lib.versionOlder version "1.40.1") [
+    (fetchpatch {
+      url = "https://github.com/LonamiWebs/Telethon/commit/ae9c798e2c3648ff40dee1b3f371f5d66851642e.patch";
+      name = "fix_test_messages_test.patch";
+      hash = "sha256-8SJm8EE6w7zRQxt1NuTX6KP1MTYPiYO/maJ5tOA2I9w=";
+    })
+  ];
+
+  postPatch = ''
    substituteInPlace telethon/crypto/libssl.py --replace-fail \
      "ctypes.util.find_library('ssl')" "'${lib.getLib openssl}/lib/libssl.so'"
  '';
@@ -49,16 +66,11 @@ buildPythonPackage rec {
    pytestCheckHook
  ];

-  disabledTests = [
-    # https://github.com/LonamiWebs/Telethon/issues/4254
-    "test_all_methods_present"
-    "test_private_get_extension"
-  ];
-
  meta = {
    homepage = "https://github.com/LonamiWebs/Telethon";
    description = "Full-featured Telegram client library for Python 3";
    license = lib.licenses.mit;
+    changelog = "https://github.com/LonamiWebs/Telethon/blob/${src.tag}/readthedocs/misc/changelog.rst";
    maintainers = with lib.maintainers; [ nyanloutre ];
  };
 }
--- a/pkgs/development/python-modules/ttfautohint-py/default.nix
+++ b/pkgs/development/python-modules/ttfautohint-py/default.nix
@@ -13,23 +13,19 @@

 buildPythonPackage rec {
  pname = "ttfautohint-py";
-  version = "0.5.1";
+  version = "0.6.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "fonttools";
    repo = "ttfautohint-py";
    tag = "v${version}";
-    hash = "sha256-NTog461RpyHKo/Qpicj3tflehaKj9LlZEN9qeCMM6JQ=";
+    hash = "sha256-wA8su7HEQnDbCShrX9fiP/VKNMtMqeayHbQXHqy8iOA=";
  };

  postPatch = ''
    substituteInPlace src/python/ttfautohint/__init__.py \
-      --replace-fail 'find_library("ttfautohint")' '"${lib.getLib ttfautohint}/lib/libttfautohint${stdenv.hostPlatform.extensions.sharedLibrary}"'
-  ''
-  + lib.optionalString stdenv.hostPlatform.isLinux ''
-    substituteInPlace src/python/ttfautohint/memory.py \
-      --replace-fail 'find_library("c")' '"${lib.getLib stdenv.cc.libc}/lib/libc.so.6"'
+      --replace-fail '_exe_full_path = None' '_exe_full_path = "${lib.getExe ttfautohint}"'
  '';

  env.TTFAUTOHINTPY_BUNDLE_DLL = false;
@@ -56,7 +52,7 @@ buildPythonPackage rec {
  meta = {
    description = "Python wrapper for ttfautohint, a free auto-hinter for TrueType fonts";
    homepage = "https://github.com/fonttools/ttfautohint-py";
-    changelog = "https://github.com/fonttools/ttfautohint-py/releases/tag/v${version}";
+    changelog = "https://github.com/fonttools/ttfautohint-py/releases/tag/${src.tag}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ jopejoe1 ];
  };
--- a/pkgs/development/python-modules/typer-shell/default.nix
+++ b/pkgs/development/python-modules/typer-shell/default.nix
@@ -1,11 +1,11 @@
 {
  lib,
  buildPythonPackage,
-  click,
  click-shell,
+  click,
  fetchFromGitHub,
+  hatchling,
  iterfzf,
-  poetry-core,
  pythonOlder,
  pyyaml,
  rich,
@@ -14,7 +14,7 @@

 buildPythonPackage rec {
  pname = "typer-shell";
-  version = "0.2.1";
+  version = "1.0.3";
  pyproject = true;

  disabled = pythonOlder "3.9";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
    owner = "FergusFettes";
    repo = "typer-shell";
    tag = "v${version}";
-    hash = "sha256-ch5xElSIIIYNtE1Wb6aWUvbV0gT5MU1sLIY+suYzjHE=";
+    hash = "sha256-vjinzBCaEPWbroxT7OmUQIvtwlPivYO0soGqvyRXVc4=";
  };

  pythonRelaxDeps = [
@@ -32,7 +32,7 @@ buildPythonPackage rec {
    "typer"
  ];

-  build-system = [ poetry-core ];
+  build-system = [ hatchling ];

  dependencies = [
    click
--- a/pkgs/development/python-modules/webdataset/default.nix
+++ b/pkgs/development/python-modules/webdataset/default.nix
@@ -22,14 +22,14 @@
 }:
 buildPythonPackage rec {
  pname = "webdataset";
-  version = "0.2.107";
+  version = "0.3.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "webdataset";
    repo = "webdataset";
    tag = "v${version}";
-    hash = "sha256-L9RUQItmW/7O/eTst2Sl/415EP4Jo662bKWbYA6p5bk=";
+    hash = "sha256-gjZTLf0MqSNCxyAd0H1vCF4ZptIRlY2G3l6KGTwp/Ek=";
  };

  build-system = [
--- a/pkgs/development/web/nodejs/gyp-patches.nix
+++ b/pkgs/development/web/nodejs/gyp-patches.nix
@@ -1,13 +1,19 @@
 {
  lib,
+  stdenv,
  fetchpatch2,
  patch_npm ? true,
  patch_tools ? true,
+  patch_npm_catch_oserror ? patch_npm,
+  patch_tools_catch_oserror ? patch_tools,
+  patch_npm_regex_handling ? patch_npm && stdenv.buildPlatform.isDarwin,
+  patch_tools_regex_handling ? patch_tools && stdenv.buildPlatform.isDarwin,
 }:
 let
  url = "https://github.com/nodejs/gyp-next/commit/8224deef984add7e7afe846cfb82c9d3fa6da1fb.patch?full_index=1";
+  url_regex_handling = "https://github.com/nodejs/gyp-next/commit/b21ee3150eea9fc1a8811e910e5ba64f42e1fb77.patch?full_index=1";
 in
-lib.optionals patch_tools ([
+lib.optionals patch_tools_catch_oserror ([
  # Fixes builds with Nix sandbox on Darwin for gyp.
  (fetchpatch2 {
    inherit url;
@@ -16,7 +22,7 @@ lib.optionals patch_tools ([
    extraPrefix = "tools/gyp/";
  })
 ])
-++ lib.optionals patch_npm ([
++ lib.optionals patch_npm_catch_oserror ([
  (fetchpatch2 {
    inherit url;
    hash = "sha256-cXTwmCRHrNhuY1+3cD/EvU0CJ+1Nk4TRh6c3twvfaW8=";
@@ -24,3 +30,20 @@ lib.optionals patch_tools ([
    extraPrefix = "deps/npm/node_modules/node-gyp/gyp/";
  })
 ])
++ lib.optionals patch_tools_regex_handling ([
+  # Fixes builds with Nix sandbox on Darwin for gyp.
+  (fetchpatch2 {
+    url = url_regex_handling;
+    hash = "sha256-xDZO8GgZLPvCeTrCu6RVVFV5bmbuz9UPgHiaAJE6im0=";
+    stripLen = 1;
+    extraPrefix = "tools/gyp/";
+  })
+])
++ lib.optionals patch_npm_regex_handling ([
+  (fetchpatch2 {
+    url = url_regex_handling;
+    hash = "sha256-fW5kQh+weCK0g3wzTJLZgAuXxetb14UAf6yxW6bIgbU=";
+    stripLen = 1;
+    extraPrefix = "deps/npm/node_modules/node-gyp/gyp/";
+  })
+])
--- a/pkgs/development/web/nodejs/v24.nix
+++ b/pkgs/development/web/nodejs/v24.nix
@@ -17,7 +17,7 @@ let

  gypPatches =
    if stdenv.buildPlatform.isDarwin then
-      callPackage ./gyp-patches.nix { patch_tools = false; }
+      callPackage ./gyp-patches.nix { patch_tools_catch_oserror = false; }
      ++ [
        ./gyp-patches-set-fallback-value-for-CLT.patch
      ]
--- a/pkgs/games/papermc/versions.json
+++ b/pkgs/games/papermc/versions.json
@@ -84,7 +84,7 @@
        "version": "1.21.7-32"
    },
    "1.21.8": {
-        "hash": "sha256-t2t9DU2NiUY4WUepUj4BnVbhKEIGxxvHjCy1BoX0gjI=",
-        "version": "1.21.8-40"
+        "hash": "sha256-F5jeXV+B9qpN7t+DcjJuF3lqJWbUalVIa/vJ+8R8c5Q=",
+        "version": "1.21.8-56"
    }
 }
--- a/pkgs/servers/monitoring/grafana/plugins/grafana-lokiexplore-app/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/grafana-lokiexplore-app/default.nix
@@ -2,8 +2,8 @@

 grafanaPlugin {
  pname = "grafana-lokiexplore-app";
-  version = "1.0.25";
-  zipHash = "sha256-aSwuzg3Y4/swz+AAf4dAH15Vr1sr7vxRyBIeCWpOnrU=";
+  version = "1.0.26";
+  zipHash = "sha256-7EztpeZIpDu/ner9EOiOjoh3J/GBgYWpZoh3usXyPqo=";
  meta = with lib; {
    description = "Browse Loki logs without the need for writing complex queries";
    license = licenses.agpl3Only;
--- a/pkgs/servers/monitoring/grafana/plugins/grafana-oncall-app/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/grafana-oncall-app/default.nix
@@ -2,8 +2,8 @@

 grafanaPlugin {
  pname = "grafana-oncall-app";
-  version = "1.16.4";
-  zipHash = "sha256-sz8jdUBEUpvfvYo0dZU1KVW/65MI5rcheTCia2m4cjU=";
+  version = "1.16.5";
+  zipHash = "sha256-SKekXNYI00M/2f2/iX6+G3B30C1gwpUFa7zzlv8d92Q=";
  meta = with lib; {
    description = "Developer-friendly incident response for Grafana";
    license = licenses.agpl3Only;
--- a/pkgs/servers/monitoring/grafana/plugins/grafana-pyroscope-app/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/grafana-pyroscope-app/default.nix
@@ -2,8 +2,8 @@

 grafanaPlugin {
  pname = "grafana-pyroscope-app";
-  version = "1.7.0";
-  zipHash = "sha256-lLzOV3pTjdW5thOTX0t+OwpxXqFJNlF5db0xpmw3fd8=";
+  version = "1.8.1";
+  zipHash = "sha256-dAjvcWUtk518lx4eHalJJxUVSna9+A/Ow9mmsrBX+nQ=";
  meta = with lib; {
    description = "Integrate seamlessly with Pyroscope, the open-source continuous profiling platform, providing a smooth, query-less experience for browsing and analyzing profiling data";
    license = licenses.agpl3Only;
--- a/pkgs/servers/monitoring/nagios-plugins/check_systemd/default.nix
+++ b/pkgs/servers/monitoring/nagios-plugins/check_systemd/default.nix
@@ -6,14 +6,14 @@

 python3Packages.buildPythonApplication rec {
  pname = "check-systemd";
-  version = "4.1.0";
+  version = "5.0.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "Josef-Friedrich";
    repo = "check_systemd";
    tag = "v${version}";
-    hash = "sha256-1e1WtWRTmOxozuOP2ndfsozuiy9LCT/Lsvb+yKH+8eY=";
+    hash = "sha256-i9lMF8SZwTxVCQaHQcEWqdKiOQ4ghcp5H/S+frfZXRw=";
  };

  postPatch = ''
--- a/pkgs/servers/sql/postgresql/ext/pgddl.nix
+++ b/pkgs/servers/sql/postgresql/ext/pgddl.nix
@@ -8,13 +8,13 @@
 }:
 postgresqlBuildExtension (finalAttrs: {
  pname = "pgddl";
-  version = "0.29";
+  version = "0.30";

  src = fetchFromGitHub {
    owner = "lacanoid";
    repo = "pgddl";
    tag = finalAttrs.version;
-    hash = "sha256-W3G6TGtkj+zXXdGZZR0bmZhsLuFJvuGTlDoo8kL8sf0=";
+    hash = "sha256-w08IgnobIhlwRGrz+feEnZbI1KrWrMRI4BvNVUZFSSg=";
  };

  nativeBuildInputs = [
--- a/pkgs/tools/misc/steampipe-packages/steampipe-plugin-aws/default.nix
+++ b/pkgs/tools/misc/steampipe-packages/steampipe-plugin-aws/default.nix
@@ -8,16 +8,16 @@

 buildGoModule rec {
  pname = "steampipe-plugin-aws";
-  version = "1.22.0";
+  version = "1.23.0";

  src = fetchFromGitHub {
    owner = "turbot";
    repo = "steampipe-plugin-aws";
    tag = "v${version}";
-    hash = "sha256-KnKcrbvLf8pX6Jj+HUq+VQTFKOUTFb2kq9z4YWJPPx4=";
+    hash = "sha256-T4Qew3GgJbgyNrx5oSXLtfA8ilfegybJqJ+zx0jLf7E=";
  };

-  vendorHash = "sha256-8hqesnVwLA0dX70/xQvSSz3fpZKiCpNifEL1YUpbHnM=";
+  vendorHash = "sha256-9Kl4aTQQNQVIkFTLnXVEyN5WYxgihSeYlnL/r/vsGKU=";

  ldflags = [
    "-s"
--- a/pkgs/tools/misc/youtube-dl/default.nix
+++ b/pkgs/tools/misc/youtube-dl/default.nix
@@ -106,7 +106,7 @@ buildPythonPackage rec {
      the public domain, which means you can modify it, redistribute it or use
      it however you like.
    '';
-    license = licenses.publicDomain;
+    license = licenses.unlicense;
    maintainers = with maintainers; [
      fpletz
    ];
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -498,6 +498,7 @@ mapAliases {
  badtouch = authoscope; # Project was renamed, added 20210626
  badwolf = throw "'badwolf' has been removed due to being unmaintained"; # Added 2025-04-15
  baget = throw "'baget' has been removed due to being unmaintained";
+  bandwidth = throw "'bandwidth' has been removed due to lack of maintenance"; # Added 2025-09-01
  banking = saldo; # added 2025-08-29
  base16-builder = throw "'base16-builder' has been removed due to being unmaintained"; # Added 2025-06-03
  baserow = throw "baserow has been removed, due to lack of maintenance"; # Added 2025-08-02
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -12112,7 +12112,7 @@ with pkgs;
  klayout = libsForQt5.callPackage ../applications/misc/klayout { };

  klee = callPackage ../applications/science/logic/klee {
-    llvmPackages = llvmPackages_13;
+    llvmPackages = llvmPackages_18;
  };

  kmplayer = libsForQt5.callPackage ../applications/video/kmplayer { };
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -10315,6 +10315,8 @@ self: super: with self; {

  netbox-bgp = callPackage ../development/python-modules/netbox-bgp { };

+  netbox-contextmenus = callPackage ../development/python-modules/netbox-contextmenus { };
+
  netbox-contract = callPackage ../development/python-modules/netbox-contract { };

  netbox-dns = callPackage ../development/python-modules/netbox-dns { };