Merge master into staging-nixos

2026-10-02 13:00:23 +00:00 · 2026-09-03 18:12:21 +00:00
parent 479f832fe0 909ed0be0b
commit ea9c118644
121 changed files with 1239 additions and 1440 deletions
--- a/nixos/modules/services/home-automation/home-assistant.nix
+++ b/nixos/modules/services/home-automation/home-assistant.nix
@@ -283,6 +283,10 @@ let
    # Components that require access to input devices (/dev/input/*)
    "keyboard_remote"
  ];
+  componentsUsingCecDevices = [
+    # Components that require access to cec devices (/dev/cec*)
+    "hdmi_cec"
+  ];
 in
 {
  imports = [
@@ -1031,6 +1035,9 @@ in
            ]
            ++ optionals (any useComponent componentsUsingInputDevices) [
              "char-input rw"
+            ]
+            ++ optionals (any useComponent componentsUsingCecDevices) [
+              "char-cec rw"
            ];
          DevicePolicy = "closed";
          LockPersonality = true;
@@ -1082,6 +1089,9 @@ in
            ]
            ++ optionals (any useComponent componentsUsingInputDevices) [
              "input"
+            ]
+            ++ optionals (any useComponent componentsUsingCecDevices) [
+              "video"
            ];
          SystemCallArchitectures = "native";
          SystemCallFilter = [
--- a/pkgs/applications/editors/android-studio/default.nix
+++ b/pkgs/applications/editors/android-studio/default.nix
@@ -88,28 +88,28 @@ let
    };
  };
  betaVersion = {
-    version = "2026.1.4.5"; # "Android Studio Quail 4 | 2026.1.4 RC 1"
+    version = "2026.1.4.6"; # "Android Studio Quail 4 | 2026.1.4 RC 2"
    sources = {
      x86_64-linux = {
-        sha256Hash = "sha256-of6o6bn3hpc5OyHJbm005GFeW2K1q3STQU4vzPRhB0w=";
-        url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.4.5/android-studio-quail4-rc1-linux.tar.gz";
+        sha256Hash = "sha256-e4lzCfGJq7PBx9qimChUi/NZWu3gWAOiONgUWrTXtgk=";
+        url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.4.6/android-studio-quail4-rc2-linux.tar.gz";
      };
      aarch64-darwin = {
-        sha256Hash = "sha256-FvtsU6FHFz/khKSWzBudNzgt4qVkdlS2kXIqGCcAncg=";
-        url = "https://edgedl.me.gvt1.com/android/studio/install/2026.1.4.5/android-studio-quail4-rc1-mac_arm.dmg";
+        sha256Hash = "sha256-KqD0LNcmMytDXmaTNIEsvrJRZzBCJ3V0mITlhBnFbf4=";
+        url = "https://edgedl.me.gvt1.com/android/studio/install/2026.1.4.6/android-studio-quail4-rc2-mac_arm.dmg";
      };
    };
  };
  latestVersion = {
-    version = "2026.1.4.4"; # "Android Studio Quail 4 | 2026.1.4 Canary 4"
+    version = "2026.2.1.3"; # "Android Studio Rabbit 1 | 2026.2.1 Canary 3"
    sources = {
      x86_64-linux = {
-        sha256Hash = "sha256-gcVlZzJ1/euSsKVrmYLXHt1Ym2kNghTzIk6crZXhGKQ=";
-        url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.1.4.4/android-studio-quail4-canary4-linux.tar.gz";
+        sha256Hash = "sha256-L44Xltg4bqLz3Vpun4rTBnh9HPinWm0rsy4d8U1ZPQE=";
+        url = "https://edgedl.me.gvt1.com/android/studio/ide-zips/2026.2.1.3/android-studio-rabbit1-canary3-linux.tar.gz";
      };
      aarch64-darwin = {
-        sha256Hash = "sha256-lEgZnmRbMNZ9HKC5JtjSo01MLX5hCFp7CvV67eKHGr0=";
-        url = "https://edgedl.me.gvt1.com/android/studio/install/2026.1.4.4/android-studio-quail4-canary4-mac_arm.dmg";
+        sha256Hash = "sha256-QS6YL5CkHykdnsySE+NyILjZAAUtAfGp5n6klOtwbSU=";
+        url = "https://edgedl.me.gvt1.com/android/studio/install/2026.2.1.3/android-studio-rabbit1-canary3-mac_arm.dmg";
      };
    };
  };
--- a/pkgs/applications/editors/jetbrains/builder/darwin.nix
+++ b/pkgs/applications/editors/jetbrains/builder/darwin.nix
@@ -1,9 +1,11 @@
 # Darwin-specific base builder.

 {
+  # keep-sorted start
  lib,
  stdenvNoCC,
  undmg,
+  # keep-sorted end

  excludeDrvArgNames,
  ...
--- a/pkgs/applications/editors/jetbrains/builder/default.nix
+++ b/pkgs/applications/editors/jetbrains/builder/default.nix
@@ -1,14 +1,13 @@
 # Builder for JetBrains IDEs (`mkJetBrainsProduct`)

 {
+  # keep-sorted start
+  callPackage,
  lib,
  stdenv,
-  callPackage,
-
-  jdk,
+  # keep-sorted end

  vmopts ? null,
-  forceWayland ? false,
 }:
 let
  baseBuilder = if stdenv.hostPlatform.isDarwin then ./darwin.nix else ./linux.nix;
@@ -16,7 +15,7 @@ in
 # Makes a JetBrains IDE
 lib.extendMkDerivation {
  constructDrv = callPackage baseBuilder {
-    inherit vmopts jdk forceWayland;
+    inherit vmopts;
    # Args to not pass to mkDerivation in the base builders. Since both get the same args
    # passed in, both have the same list of args to ignore, even if they don't both use
    # all of them.
@@ -25,7 +24,7 @@ lib.extendMkDerivation {
      "productShort"
      "buildNumber"
      "wmClass"
-      "libdbm"
+      "jetbrains-libdbm"
      "fsnotifier"
      "extraLdPath"
      "extraWrapperArgs"
@@ -39,7 +38,7 @@ lib.extendMkDerivation {
      buildNumber,
      product,

-      libdbm,
+      jetbrains-libdbm,
      fsnotifier,

      meta ? { },
@@ -51,7 +50,7 @@ lib.extendMkDerivation {
        inherit
          buildNumber
          product
-          libdbm
+          jetbrains-libdbm
          fsnotifier
          ;

@@ -61,9 +60,5 @@ lib.extendMkDerivation {
          plugins = callPackage ../plugins/tests.nix { ide = finalAttrs.finalPackage; };
        };
      };
-
-      meta = meta // {
-        teams = [ lib.teams.jetbrains ];
-      };
    };
 }
--- a/pkgs/applications/editors/jetbrains/builder/linux.nix
+++ b/pkgs/applications/editors/jetbrains/builder/linux.nix
@@ -1,37 +1,27 @@
 # Linux-specific base builder.

 {
-  stdenv,
-  lib,
-  makeDesktopItem,
-  makeWrapper,
-  patchelf,
-  writeText,
-  coreutils,
-  gnugrep,
-  which,
-  git,
-  unzip,
-  libsecret,
-  libnotify,
-  udev,
-  e2fsprogs,
-  python3,
-  autoPatchelfHook,
-  glibcLocales,
-  fontconfig,
-  libGL,
-  libx11,
-
-  # bundled jcef-plugin
+  # keep-sorted start
  alsa-lib,
  at-spi2-atk,
  at-spi2-core,
  atk,
+  autoPatchelfHook,
  cairo,
+  coreutils,
  cups,
  dbus,
+  e2fsprogs,
+  fontconfig,
+  git,
+  glibcLocales,
+  gnugrep,
+  lib,
+  libGL,
  libgbm,
+  libnotify,
+  libsecret,
+  libx11,
  libxcb,
  libxcomposite,
  libxdamage,
@@ -39,13 +29,21 @@
  libxfixes,
  libxkbcommon,
  libxrandr,
+  makeDesktopItem,
+  makeWrapper,
  nspr,
  nss,
  pango,
+  patchelf,
+  python3,
+  stdenv,
+  udev,
+  unzip,
+  which,
+  writeText,
+  # keep-sorted end

-  jdk,
  vmopts ? null,
-  forceWayland ? null,
  excludeDrvArgNames,
 }:

@@ -62,7 +60,8 @@ lib.extendMkDerivation {
      productShort ? product,
      wmClass,

-      libdbm,
+      jdk,
+      jetbrains-libdbm,
      fsnotifier,

      extraLdPath ? [ ],
@@ -78,11 +77,6 @@ lib.extendMkDerivation {
      loName = lib.toLower productShort;
      hiName = lib.toUpper productShort;
      vmoptsName = loName + lib.optionalString stdenv.hostPlatform.is64bit "64" + ".vmoptions";
-      finalExtraWrapperArgs =
-        extraWrapperArgs
-        ++ lib.optionals forceWayland [
-          ''--add-flags "\''${WAYLAND_DISPLAY:+-Dawt.toolkit.name=WLToolkit}"''
-        ];

      desktopItem = makeDesktopItem {
        name = finalAttrs.pname;
@@ -102,12 +96,7 @@ lib.extendMkDerivation {
      inherit desktopItem vmoptsIDE vmoptsFile;

      buildInputs = buildInputs ++ [
-        stdenv.cc.cc
-        fontconfig
-        libGL
-        libx11
-        # required for the bundled jcef-plugin
-        udev
+        # keep-sorted start
        alsa-lib
        at-spi2-atk
        at-spi2-core
@@ -115,7 +104,10 @@ lib.extendMkDerivation {
        cairo
        cups
        dbus
+        fontconfig
+        libGL
        libgbm
+        libx11
        libxcb
        libxcomposite
        libxdamage
@@ -126,13 +118,18 @@ lib.extendMkDerivation {
        nspr
        nss
        pango
+        stdenv.cc.cc
+        udev
+        # keep-sorted end
      ];

      nativeBuildInputs = nativeBuildInputs ++ [
+        # keep-sorted start
+        autoPatchelfHook
        makeWrapper
        patchelf
        unzip
-        autoPatchelfHook
+        # keep-sorted end
      ];

      postPatch = ''
@@ -167,11 +164,9 @@ lib.extendMkDerivation {
        fi
        echo -Djna.library.path=${
          lib.makeLibraryPath [
-            libsecret
            e2fsprogs
            libnotify
-            # Required for Help -> Collect Logs
-            # in at least rider and goland
+            libsecret
            udev
          ]
        } >> $vmopts_file
@@ -185,7 +180,7 @@ lib.extendMkDerivation {
        cp -a . $out/$pname
        [[ -f $out/$pname/bin/${loName}.png ]] && ln -s $out/$pname/bin/${loName}.png $out/share/icons/hicolor/128x128/apps/${pname}.png
        [[ -f $out/$pname/bin/${loName}.svg ]] && ln -s $out/$pname/bin/${loName}.svg $out/share/icons/hicolor/scalable/apps/${pname}.svg
-        cp ${libdbm}/lib/libdbm.so $out/$pname/bin/libdbm.so
+        cp ${jetbrains-libdbm}/lib/libdbm.so $out/$pname/bin/libdbm.so
        cp ${fsnotifier}/bin/fsnotifier $out/$pname/bin/fsnotifier

        jdk=${jdk.home}
@@ -205,16 +200,16 @@ lib.extendMkDerivation {
          wrapProgram  "$launcher" \
            --prefix PATH : "${
              lib.makeBinPath [
-                jdk
                coreutils
-                gnugrep
-                which
                git
+                gnugrep
+                jdk
+                which
              ]
            }" \
            --suffix PATH : "${lib.makeBinPath [ python3 ]}" \
            --prefix LD_LIBRARY_PATH : "${lib.makeLibraryPath extraLdPath}" \
-            ${lib.concatStringsSep " " finalExtraWrapperArgs} \
+            ${lib.concatStringsSep " " extraWrapperArgs} \
            --set-default JDK_HOME "$jdk" \
            --set-default ANDROID_JAVA_HOME "$jdk" \
            --set-default JAVA_HOME "$jdk" \
--- a/pkgs/applications/editors/jetbrains/default.nix
+++ b/pkgs/applications/editors/jetbrains/default.nix
@@ -1,102 +1,40 @@
 {
-  lib,
-  config,
-  stdenv,
+  # keep-sorted start
  callPackage,
-
-  python3,
-  jetbrains,
+  config,
+  lib,
+  stdenv,
+  # keep-sorted end

  vmopts ? null,
-  forceWayland ? false,
 }:
-
-let
-  jetbrainsBuilder =
-    jdk:
-    callPackage ./builder/default.nix {
-      inherit jdk forceWayland vmopts;
-    };
-
-  mkSrcIde =
-    path: extras:
-    callPackage path (
-      {
-        mkJetBrainsProduct = jetbrainsBuilder jetbrains.jdk;
-        mkJetBrainsSource = callPackage ./source/build.nix { };
-      }
-      // extras
-    );
-
-  _idea-oss = mkSrcIde ./ides/idea-oss.nix { };
-
-  # The binary builds use the same libdbm and fsnotifier as the current idea-oss source build.
-  mkBinIde =
-    path: extras:
-    callPackage path (
-      {
-        mkJetBrainsProduct = jetbrainsBuilder jetbrains.jdk-no-jcef;
-        libdbm = _idea-oss.libdbm;
-        fsnotifier = _idea-oss.fsnotifier;
-      }
-      // extras
-    );
-
-  # Common build overrides, fixes, etc.
-  # TODO: These should eventually be moved outside of this file
-  pyCharmCommonOverrides = (
-    finalAttrs: previousAttrs:
-    lib.optionalAttrs stdenv.hostPlatform.isLinux {
-      buildInputs =
-        with python3.pkgs;
-        (previousAttrs.buildInputs or [ ])
-        ++ [
-          python3
-          setuptools
-        ];
-      preInstall = ''
-        echo "compiling cython debug speedups"
-        if [[ -d plugins/python-ce ]]; then
-            ${python3.interpreter} plugins/python-ce/helpers/pydev/setup_cython.py build_ext --inplace
-        else
-            ${python3.interpreter} plugins/python/helpers/pydev/setup_cython.py build_ext --inplace
-        fi
-      '';
-      # See https://www.jetbrains.com/help/pycharm/2022.1/cython-speedups.html
-    }
-  );
-  patchSharedLibs = lib.optionalString stdenv.hostPlatform.isLinux ''
-    ls -d \
-      $out/*/bin/*/linux/*/lib/liblldb.so \
-      $out/*/bin/*/linux/*/lib/python3.*/lib-dynload/* \
-      $out/*/plugins/*/bin/*/linux/*/lib/liblldb.so \
-      $out/*/plugins/*/bin/*/linux/*/lib/python3.*/lib-dynload/* |
-    xargs patchelf \
-      --replace-needed libssl.so.10 libssl.so \
-      --replace-needed libssl.so.1.1 libssl.so \
-      --replace-needed libcrypto.so.10 libcrypto.so \
-      --replace-needed libcrypto.so.1.1 libcrypto.so \
-      --replace-needed libcrypt.so.1 libcrypt.so \
-      ${lib.optionalString stdenv.hostPlatform.isAarch "--replace-needed libxml2.so.2 libxml2.so"}
-  '';
-in
 {
+  # Builders
+  mkJetBrainsProduct = callPackage ./builder/default.nix {
+    inherit vmopts;
+  };
+  mkJetBrainsSource = callPackage ./source/build.nix { };
+
+  # Hooks
+  cythonDebugSpeedupsHook = callPackage ./hooks/cython-debug-speedups.nix { };
+  sharedLibsHook = callPackage ./hooks/shared-libs.nix { };
+
  # Sorted alphabetically. Deprecated products and aliases are at the very end.
-  clion = mkBinIde ./ides/clion.nix { inherit patchSharedLibs; };
-  datagrip = mkBinIde ./ides/datagrip.nix { };
-  dataspell = mkBinIde ./ides/dataspell.nix { };
-  gateway = mkBinIde ./ides/gateway.nix { };
-  goland = mkBinIde ./ides/goland.nix { };
-  idea = mkBinIde ./ides/idea.nix { };
-  idea-oss = _idea-oss;
-  mps = mkBinIde ./ides/mps.nix { };
-  phpstorm = mkBinIde ./ides/phpstorm.nix { };
-  pycharm = mkBinIde ./ides/pycharm.nix { inherit pyCharmCommonOverrides; };
-  pycharm-oss = mkSrcIde ./ides/pycharm-oss.nix { inherit pyCharmCommonOverrides; };
-  rider = mkBinIde ./ides/rider.nix { inherit patchSharedLibs; };
-  ruby-mine = mkBinIde ./ides/ruby-mine.nix { };
-  rust-rover = mkBinIde ./ides/rust-rover.nix { inherit patchSharedLibs; };
-  webstorm = mkBinIde ./ides/webstorm.nix { };
+  clion = callPackage ./ides/clion.nix { };
+  datagrip = callPackage ./ides/datagrip.nix { };
+  dataspell = callPackage ./ides/dataspell.nix { };
+  gateway = callPackage ./ides/gateway.nix { };
+  goland = callPackage ./ides/goland.nix { };
+  idea = callPackage ./ides/idea.nix { };
+  idea-oss = callPackage ./ides/idea-oss.nix { };
+  mps = callPackage ./ides/mps.nix { };
+  phpstorm = callPackage ./ides/phpstorm.nix { };
+  pycharm = callPackage ./ides/pycharm.nix { };
+  pycharm-oss = callPackage ./ides/pycharm-oss.nix { };
+  rider = callPackage ./ides/rider.nix { };
+  ruby-mine = callPackage ./ides/ruby-mine.nix { };
+  rust-rover = callPackage ./ides/rust-rover.nix { };
+  webstorm = callPackage ./ides/webstorm.nix { };

  # Plugins
  plugins = callPackage ./plugins { };
--- a/pkgs/applications/editors/jetbrains/hooks/cython-debug-speedups-hook.sh
+++ b/pkgs/applications/editors/jetbrains/hooks/cython-debug-speedups-hook.sh
@@ -0,0 +1,12 @@
+#!@shell@
+
+compileCythonDebugSpeedupsHook() {
+    echo "compiling cython debug speedups" >&2
+    if [[ -d plugins/python-ce ]]; then
+        @python@ plugins/python-ce/helpers/pydev/setup_cython.py build_ext --inplace
+    else
+        @python@ plugins/python/helpers/pydev/setup_cython.py build_ext --inplace
+    fi
+}
+
+preInstallHooks+=(compileCythonDebugSpeedupsHook)
--- a/pkgs/applications/editors/jetbrains/hooks/cython-debug-speedups.nix
+++ b/pkgs/applications/editors/jetbrains/hooks/cython-debug-speedups.nix
@@ -0,0 +1,22 @@
+{
+  # keep-sorted start
+  bash,
+  lib,
+  makeSetupHook,
+  python3,
+  # keep-sorted end
+}:
+/**
+  See https://www.jetbrains.com/help/pycharm/2026.2/cython-speedups.html
+*/
+makeSetupHook {
+  name = "cython-debug-speedups-hook";
+  substitutions = {
+    shell = lib.getExe bash;
+    python = python3.interpreter;
+  };
+  meta = {
+    description = "Setup hook that applies Cython-based debugger speedups from JetBrains";
+    teams = [ lib.teams.jetbrains ];
+  };
+} ./cython-debug-speedups-hook.sh
--- a/pkgs/applications/editors/jetbrains/hooks/shared-libs-hook.sh
+++ b/pkgs/applications/editors/jetbrains/hooks/shared-libs-hook.sh
@@ -0,0 +1,18 @@
+#!@shell@
+
+jetbrainsPatchSharedLibs() {
+    ls -d \
+        $out/*/bin/*/linux/*/lib/liblldb.so \
+        $out/*/bin/*/linux/*/lib/python3.*/lib-dynload/* \
+        $out/*/plugins/*/bin/*/linux/*/lib/liblldb.so \
+        $out/*/plugins/*/bin/*/linux/*/lib/python3.*/lib-dynload/* |
+    xargs @patchelf@ \
+        --replace-needed libssl.so.10 libssl.so \
+        --replace-needed libssl.so.1.1 libssl.so \
+        --replace-needed libcrypto.so.10 libcrypto.so \
+        --replace-needed libcrypto.so.1.1 libcrypto.so \
+        --replace-needed libcrypt.so.1 libcrypt.so \
+        @darwinLibxml@
+}
+
+preFixupHooks+=(jetbrainsPatchSharedLibs)
--- a/pkgs/applications/editors/jetbrains/hooks/shared-libs.nix
+++ b/pkgs/applications/editors/jetbrains/hooks/shared-libs.nix
@@ -0,0 +1,19 @@
+{
+  # keep-sorted start
+  lib,
+  makeSetupHook,
+  patchelf,
+  stdenv,
+  # keep-sorted end
+}:
+makeSetupHook {
+  name = "shared-libs-hook";
+  substitutions = {
+    patchelf = lib.getExe patchelf;
+    darwinLibxml = lib.optionalString stdenv.hostPlatform.isAarch "--replace-needed libxml2.so.2 libxml2.so";
+  };
+  meta = {
+    description = "Setup hook that rewrites sonames in libraries bundled with JetBrains IDEs";
+    teams = [ lib.teams.jetbrains ];
+  };
+} ./shared-libs-hook.sh
--- a/pkgs/applications/editors/jetbrains/ides/clion.nix
+++ b/pkgs/applications/editors/jetbrains/ides/clion.nix
@@ -1,20 +1,21 @@
 {
-  stdenv,
-  lib,
-  fetchurl,
-  mkJetBrainsProduct,
-  libdbm,
-  fsnotifier,
-  patchSharedLibs,
+  # keep-sorted start
  dotnetCorePackages,
-  python3,
-  openssl,
+  expat,
+  fetchurl,
+  fsnotifier,
+  jetbrains,
+  jetbrains-libdbm,
+  lib,
  libxcrypt-legacy,
+  libxml2,
  lttng-ust_2_12,
  musl,
-  expat,
-  libxml2,
+  openssl,
+  python3,
+  stdenv,
  xz,
+  # keep-sorted end
 }:
 let
  system = stdenv.hostPlatform.system;
@@ -35,8 +36,8 @@ let
  };
  # update-script-end: urls
 in
-(mkJetBrainsProduct {
-  inherit libdbm fsnotifier;
+(jetbrains.mkJetBrainsProduct {
+  inherit jetbrains-libdbm fsnotifier;

  pname = "clion";

@@ -50,6 +51,15 @@ in

  src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

+  # the jdk is bundled on Darwin.
+  jdk =
+    if lib.meta.availableOn stdenv.hostPlatform jetbrains.jdk-no-jcef then
+      jetbrains.jdk-no-jcef
+    else
+      null;
+
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ jetbrains.sharedLibsHook ];
+
  buildInputs =
    lib.optionals stdenv.hostPlatform.isLinux [
      python3
@@ -73,6 +83,7 @@ in
      mic92
      tymscar
    ];
+    teams = [ lib.teams.jetbrains ];
    license = lib.licenses.unfree;
    sourceProvenance =
      if stdenv.hostPlatform.isDarwin then
@@ -90,9 +101,4 @@ in
          ln -s ${dotnetCorePackages.sdk_10_0-source}/share/dotnet $dir/dotnet
        done
      '';
-
-    postFixup = ''
-      ${attrs.postFixup or ""}
-      ${patchSharedLibs}
-    '';
  })
--- a/pkgs/applications/editors/jetbrains/ides/datagrip.nix
+++ b/pkgs/applications/editors/jetbrains/ides/datagrip.nix
@@ -1,11 +1,12 @@
 {
-  stdenv,
-  lib,
+  # keep-sorted start
  fetchurl,
-  mkJetBrainsProduct,
-  libdbm,
  fsnotifier,
-
+  jetbrains,
+  jetbrains-libdbm,
+  lib,
+  stdenv,
+  # keep-sorted end
 }:
 let
  system = stdenv.hostPlatform.system;
@@ -26,8 +27,8 @@ let
  };
  # update-script-end: urls
 in
-mkJetBrainsProduct {
-  inherit libdbm fsnotifier;
+jetbrains.mkJetBrainsProduct {
+  inherit jetbrains-libdbm fsnotifier;

  pname = "datagrip";

@@ -41,6 +42,13 @@ mkJetBrainsProduct {

  src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

+  # the jdk is bundled on Darwin.
+  jdk =
+    if lib.meta.availableOn stdenv.hostPlatform jetbrains.jdk-no-jcef then
+      jetbrains.jdk-no-jcef
+    else
+      null;
+
  # NOTE: meta attrs are used for the Linux desktop entries and may cause rebuilds when changed
  meta = {
    homepage = "https://www.jetbrains.com/datagrip/";
@@ -50,6 +58,7 @@ mkJetBrainsProduct {
      It allows you to quickly migrate and refactor relational databases, construct efficient, statically checked SQL queries and much more.
    '';
    maintainers = [ ];
+    teams = [ lib.teams.jetbrains ];
    license = lib.licenses.unfree;
    sourceProvenance =
      if stdenv.hostPlatform.isDarwin then
--- a/pkgs/applications/editors/jetbrains/ides/dataspell.nix
+++ b/pkgs/applications/editors/jetbrains/ides/dataspell.nix
@@ -1,13 +1,15 @@
 {
-  stdenv,
-  lib,
+  # keep-sorted start case=no
  fetchurl,
-  mkJetBrainsProduct,
-  libdbm,
  fsnotifier,
+  jetbrains,
+  jetbrains-libdbm,
+  lib,
  libgcc,
-  runCommand,
  R,
+  runCommand,
+  stdenv,
+  # keep-sorted end
 }:
 let
  system = stdenv.hostPlatform.system;
@@ -28,8 +30,8 @@ let
  };
  # update-script-end: urls
 in
-mkJetBrainsProduct {
-  inherit libdbm fsnotifier;
+jetbrains.mkJetBrainsProduct {
+  inherit jetbrains-libdbm fsnotifier;

  pname = "dataspell";

@@ -43,6 +45,13 @@ mkJetBrainsProduct {

  src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

+  # the jdk is bundled on Darwin.
+  jdk =
+    if lib.meta.availableOn stdenv.hostPlatform jetbrains.jdk-no-jcef then
+      jetbrains.jdk-no-jcef
+    else
+      null;
+
  # NOTE: This `lib.optionals` is only here because the old Darwin builder ignored `buildInputs`.
  #       DataSpell may need these, even on Darwin!
  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
@@ -62,6 +71,7 @@ mkJetBrainsProduct {
      Mainly it integrates Jupyter notebooks in the IntelliJ platform.
    '';
    maintainers = with lib.maintainers; [ leona ];
+    teams = [ lib.teams.jetbrains ];
    license = lib.licenses.unfree;
    sourceProvenance =
      if stdenv.hostPlatform.isDarwin then
--- a/pkgs/applications/editors/jetbrains/ides/gateway.nix
+++ b/pkgs/applications/editors/jetbrains/ides/gateway.nix
@@ -1,11 +1,13 @@
 {
-  stdenv,
-  lib,
+  # keep-sorted start
  fetchurl,
-  mkJetBrainsProduct,
-  libdbm,
  fsnotifier,
+  jetbrains,
+  jetbrains-libdbm,
+  lib,
  libgcc,
+  stdenv,
+  # keep-sorted end
 }:
 let
  system = stdenv.hostPlatform.system;
@@ -26,8 +28,8 @@ let
  };
  # update-script-end: urls
 in
-mkJetBrainsProduct {
-  inherit libdbm fsnotifier;
+jetbrains.mkJetBrainsProduct {
+  inherit jetbrains-libdbm fsnotifier;

  pname = "gateway";

@@ -42,6 +44,13 @@ mkJetBrainsProduct {

  src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

+  # the jdk is bundled on Darwin.
+  jdk =
+    if lib.meta.availableOn stdenv.hostPlatform jetbrains.jdk-no-jcef then
+      jetbrains.jdk-no-jcef
+    else
+      null;
+
  buildInputs = [
    libgcc
  ];
@@ -52,6 +61,7 @@ mkJetBrainsProduct {
    description = "Remote development for JetBrains products";
    longDescription = "JetBrains Gateway is a lightweight launcher that connects a remote server with your local machine and opens your project in JetBrains Client.";
    maintainers = [ ];
+    teams = [ lib.teams.jetbrains ];
    license = lib.licenses.unfree;
    sourceProvenance =
      if stdenv.hostPlatform.isDarwin then
--- a/pkgs/applications/editors/jetbrains/ides/goland.nix
+++ b/pkgs/applications/editors/jetbrains/ides/goland.nix
@@ -1,11 +1,13 @@
 {
-  stdenv,
-  lib,
+  # keep-sorted start
  fetchurl,
-  mkJetBrainsProduct,
-  libdbm,
  fsnotifier,
+  jetbrains,
+  jetbrains-libdbm,
+  lib,
  libgcc,
+  stdenv,
+  # keep-sorted end
 }:
 let
  system = stdenv.hostPlatform.system;
@@ -26,8 +28,8 @@ let
  };
  # update-script-end: urls
 in
-(mkJetBrainsProduct {
-  inherit libdbm fsnotifier;
+(jetbrains.mkJetBrainsProduct {
+  inherit jetbrains-libdbm fsnotifier;

  pname = "goland";

@@ -41,6 +43,13 @@ in

  src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

+  # the jdk is bundled on Darwin.
+  jdk =
+    if lib.meta.availableOn stdenv.hostPlatform jetbrains.jdk-no-jcef then
+      jetbrains.jdk-no-jcef
+    else
+      null;
+
  extraWrapperArgs = [
    # fortify source breaks build since delve compiles with -O0
    ''--prefix CGO_CPPFLAGS " " "-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=0"''
@@ -58,6 +67,7 @@ in
      The IDE extends the IntelliJ platform with the coding assistance and tool integrations specific for the Go language.
    '';
    maintainers = with lib.maintainers; [ tymscar ];
+    teams = [ lib.teams.jetbrains ];
    license = lib.licenses.unfree;
    sourceProvenance =
      if stdenv.hostPlatform.isDarwin then
--- a/pkgs/applications/editors/jetbrains/ides/idea-oss.nix
+++ b/pkgs/applications/editors/jetbrains/ides/idea-oss.nix
@@ -1,12 +1,15 @@
 {
+  # keep-sorted start
+  fsnotifier,
+  jetbrains,
  lib,
-  mkJetBrainsProduct,
-  mkJetBrainsSource,
  maven,
+  stdenv,
  zlib,
+  # keep-sorted end
 }:
 let
-  src = mkJetBrainsSource {
+  src = jetbrains.mkJetBrainsSource {
    # update-script-start: source-args
    version = "2025.3.4";
    buildNumber = "253.32098.37";
@@ -35,14 +38,17 @@ let
    # update-script-end: source-args
  };
 in
-mkJetBrainsProduct {
-  inherit src;
+jetbrains.mkJetBrainsProduct {
+  inherit src fsnotifier;
  inherit (src)
    version
    buildNumber
-    libdbm
-    fsnotifier
    ;
+  # this is jetbrains-libdbm but using the sources from the IDE build.
+  jetbrains-libdbm = src.libdbm;
+
+  # the jdk is bundled on Darwin.
+  jdk = if lib.meta.availableOn stdenv.hostPlatform jetbrains.jdk then jetbrains.jdk else null;

  pname = "idea-oss";

@@ -68,6 +74,7 @@ mkJetBrainsProduct {
      gytis-ivaskevicius
      tymscar
    ];
+    teams = [ lib.teams.jetbrains ];
    license = lib.licenses.asl20;
    sourceProvenance = [ lib.sourceTypes.fromSource ];
    knownVulnerabilities = [
--- a/pkgs/applications/editors/jetbrains/ides/idea.nix
+++ b/pkgs/applications/editors/jetbrains/ides/idea.nix
@@ -1,14 +1,16 @@
 {
-  stdenv,
-  lib,
+  # keep-sorted start
  fetchurl,
-  mkJetBrainsProduct,
-  libdbm,
  fsnotifier,
-  maven,
-  zlib,
+  jetbrains,
+  jetbrains-libdbm,
+  lib,
  lldb,
+  maven,
  musl,
+  stdenv,
+  zlib,
+  # keep-sorted end
 }:
 let
  system = stdenv.hostPlatform.system;
@@ -29,8 +31,8 @@ let
  };
  # update-script-end: urls
 in
-mkJetBrainsProduct {
-  inherit libdbm fsnotifier;
+jetbrains.mkJetBrainsProduct {
+  inherit jetbrains-libdbm fsnotifier;

  pname = "idea";

@@ -45,6 +47,13 @@ mkJetBrainsProduct {

  src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

+  # the jdk is bundled on Darwin.
+  jdk =
+    if lib.meta.availableOn stdenv.hostPlatform jetbrains.jdk-no-jcef then
+      jetbrains.jdk-no-jcef
+    else
+      null;
+
  extraLdPath = [ zlib ];
  extraWrapperArgs = [
    ''--set M2_HOME "${maven}/maven"''
@@ -52,8 +61,10 @@ mkJetBrainsProduct {
  ];

  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    # keep-sorted start
    lldb
    musl
+    # keep-sorted end
  ];

  # NOTE: meta attrs are used for the Linux desktop entries and may cause rebuilds when changed
@@ -68,6 +79,7 @@ mkJetBrainsProduct {
      gytis-ivaskevicius
      tymscar
    ];
+    teams = [ lib.teams.jetbrains ];
    license = lib.licenses.unfree;
    sourceProvenance =
      if stdenv.hostPlatform.isDarwin then
--- a/pkgs/applications/editors/jetbrains/ides/mps.nix
+++ b/pkgs/applications/editors/jetbrains/ides/mps.nix
@@ -1,11 +1,12 @@
 {
-  stdenv,
-  lib,
+  # keep-sorted start
  fetchurl,
-  mkJetBrainsProduct,
-  libdbm,
  fsnotifier,
-
+  jetbrains,
+  jetbrains-libdbm,
+  lib,
+  stdenv,
+  # keep-sorted end
 }:
 let
  system = stdenv.hostPlatform.system;
@@ -26,8 +27,8 @@ let
  };
  # update-script-end: urls
 in
-mkJetBrainsProduct {
-  inherit libdbm fsnotifier;
+jetbrains.mkJetBrainsProduct {
+  inherit jetbrains-libdbm fsnotifier;

  pname = "mps";

@@ -41,12 +42,20 @@ mkJetBrainsProduct {

  src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

+  # the jdk is bundled on Darwin.
+  jdk =
+    if lib.meta.availableOn stdenv.hostPlatform jetbrains.jdk-no-jcef then
+      jetbrains.jdk-no-jcef
+    else
+      null;
+
  # NOTE: meta attrs are used for the Linux desktop entries and may cause rebuilds when changed
  meta = {
    homepage = "https://www.jetbrains.com/mps/";
    description = "IDE for building domain-specific languages from JetBrains";
    longDescription = "A metaprogramming system which uses projectional editing which allows users to overcome the limits of language parsers, and build DSL editors, such as ones with tables and diagrams.";
    maintainers = [ ];
+    teams = [ lib.teams.jetbrains ];
    license = lib.licenses.unfree;
    sourceProvenance =
      if stdenv.hostPlatform.isDarwin then
--- a/pkgs/applications/editors/jetbrains/ides/phpstorm.nix
+++ b/pkgs/applications/editors/jetbrains/ides/phpstorm.nix
@@ -1,11 +1,13 @@
 {
-  stdenv,
-  lib,
+  # keep-sorted start
  fetchurl,
-  mkJetBrainsProduct,
-  libdbm,
  fsnotifier,
+  jetbrains,
+  jetbrains-libdbm,
+  lib,
  musl,
+  stdenv,
+  # keep-sorted end
 }:
 let
  system = stdenv.hostPlatform.system;
@@ -26,8 +28,8 @@ let
  };
  # update-script-end: urls
 in
-mkJetBrainsProduct {
-  inherit libdbm fsnotifier;
+jetbrains.mkJetBrainsProduct {
+  inherit jetbrains-libdbm fsnotifier;

  pname = "phpstorm";

@@ -41,6 +43,13 @@ mkJetBrainsProduct {

  src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

+  # the jdk is bundled on Darwin.
+  jdk =
+    if lib.meta.availableOn stdenv.hostPlatform jetbrains.jdk-no-jcef then
+      jetbrains.jdk-no-jcef
+    else
+      null;
+
  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
    musl
  ];
@@ -51,6 +60,7 @@ mkJetBrainsProduct {
    description = "PHP IDE from JetBrains";
    longDescription = "PhpStorm provides an editor for PHP, HTML and JavaScript with on-the-fly code analysis, error prevention and automated refactorings for PHP and JavaScript code.";
    maintainers = with lib.maintainers; [ tymscar ];
+    teams = [ lib.teams.jetbrains ];
    license = lib.licenses.unfree;
    sourceProvenance =
      if stdenv.hostPlatform.isDarwin then
--- a/pkgs/applications/editors/jetbrains/ides/pycharm-oss.nix
+++ b/pkgs/applications/editors/jetbrains/ides/pycharm-oss.nix
@@ -1,11 +1,14 @@
 {
+  # keep-sorted start
+  fsnotifier,
+  jetbrains,
  lib,
-  mkJetBrainsProduct,
-  mkJetBrainsSource,
-  pyCharmCommonOverrides,
+  python3,
+  stdenv,
+  # keep-sorted end
 }:
 let
-  src = mkJetBrainsSource {
+  src = jetbrains.mkJetBrainsSource {
    # update-script-start: source-args
    version = "2025.3.3";
    buildNumber = "253.31033.139";
@@ -34,14 +37,17 @@ let
    # update-script-end: source-args
  };
 in
-(mkJetBrainsProduct {
-  inherit src;
+jetbrains.mkJetBrainsProduct {
+  inherit src fsnotifier;
  inherit (src)
    version
    buildNumber
-    libdbm
-    fsnotifier
    ;
+  # this is jetbrains-libdbm but using the sources from the IDE build.
+  jetbrains-libdbm = src.libdbm;
+
+  # the jdk is bundled on Darwin.
+  jdk = if lib.meta.availableOn stdenv.hostPlatform jetbrains.jdk then jetbrains.jdk else null;

  pname = "pycharm-oss";

@@ -49,6 +55,14 @@ in
  product = "PyCharm Open Source";
  productShort = "PyCharm";

+  nativeBuildInputs = [
+    # keep-sorted start
+    jetbrains.cythonDebugSpeedupsHook
+    python3
+    python3.pkgs.setuptools
+    # keep-sorted end
+  ];
+
  # NOTE: meta attrs are used for the Linux desktop entries and may cause rebuilds when changed
  meta = {
    homepage = "https://www.jetbrains.com/pycharm/";
@@ -61,6 +75,7 @@ in
    maintainers = with lib.maintainers; [
      tymscar
    ];
+    teams = [ lib.teams.jetbrains ];
    license = lib.licenses.asl20;
    sourceProvenance = [ lib.sourceTypes.fromSource ];
    knownVulnerabilities = [
@@ -70,5 +85,4 @@ in
      ''
    ];
  };
-}).overrideAttrs
-  pyCharmCommonOverrides
+}
--- a/pkgs/applications/editors/jetbrains/ides/pycharm.nix
+++ b/pkgs/applications/editors/jetbrains/ides/pycharm.nix
@@ -1,12 +1,14 @@
 {
-  stdenv,
-  lib,
+  # keep-sorted start
  fetchurl,
-  mkJetBrainsProduct,
-  libdbm,
  fsnotifier,
-  pyCharmCommonOverrides,
+  jetbrains,
+  jetbrains-libdbm,
+  lib,
  musl,
+  python3,
+  stdenv,
+  # keep-sorted end
 }:
 let
  system = stdenv.hostPlatform.system;
@@ -27,8 +29,8 @@ let
  };
  # update-script-end: urls
 in
-(mkJetBrainsProduct {
-  inherit libdbm fsnotifier;
+jetbrains.mkJetBrainsProduct {
+  inherit jetbrains-libdbm fsnotifier;

  pname = "pycharm";

@@ -42,6 +44,21 @@ in

  src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

+  # the jdk is bundled on Darwin.
+  jdk =
+    if lib.meta.availableOn stdenv.hostPlatform jetbrains.jdk-no-jcef then
+      jetbrains.jdk-no-jcef
+    else
+      null;
+
+  nativeBuildInputs = [
+    # keep-sorted start
+    jetbrains.cythonDebugSpeedupsHook
+    python3
+    python3.pkgs.setuptools
+    # keep-sorted end
+  ];
+
  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
    musl
  ];
@@ -58,6 +75,7 @@ in
    maintainers = with lib.maintainers; [
      tymscar
    ];
+    teams = [ lib.teams.jetbrains ];
    license = lib.licenses.unfree;
    sourceProvenance =
      if stdenv.hostPlatform.isDarwin then
@@ -65,5 +83,4 @@ in
      else
        [ lib.sourceTypes.binaryBytecode ];
  };
-}).overrideAttrs
-  pyCharmCommonOverrides
+}
--- a/pkgs/applications/editors/jetbrains/ides/rider.nix
+++ b/pkgs/applications/editors/jetbrains/ides/rider.nix
@@ -1,23 +1,24 @@
 {
-  stdenv,
-  lib,
+  # keep-sorted start
+  dotnetCorePackages,
+  expat,
  fetchurl,
-  mkJetBrainsProduct,
-  libdbm,
  fsnotifier,
-  patchSharedLibs,
-  openssl,
-  libxcrypt,
-  lttng-ust_2_12,
-  musl,
+  jetbrains,
+  jetbrains-libdbm,
+  lib,
  libice,
  libsm,
  libx11,
-  dotnetCorePackages,
  libxcb-keysyms,
-  expat,
+  libxcrypt,
  libxml2,
+  lttng-ust_2_12,
+  musl,
+  openssl,
+  stdenv,
  xz,
+  # keep-sorted end
 }:
 let
  system = stdenv.hostPlatform.system;
@@ -38,8 +39,8 @@ let
  };
  # update-script-end: urls
 in
-(mkJetBrainsProduct {
-  inherit libdbm fsnotifier;
+(jetbrains.mkJetBrainsProduct {
+  inherit jetbrains-libdbm fsnotifier;

  pname = "rider";

@@ -53,26 +54,41 @@ in

  src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

+  # the jdk is bundled on Darwin.
+  jdk =
+    if lib.meta.availableOn stdenv.hostPlatform jetbrains.jdk-no-jcef then
+      jetbrains.jdk-no-jcef
+    else
+      null;
+
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ jetbrains.sharedLibsHook ];
+
  # TODO: Some of these dependencies should probably also be added on Darwin - however it seems that JetBrains bundles them all? Unclear.
  #       Somebody with a Darwin machine should investigate this.
  buildInputs =
    lib.optionals stdenv.hostPlatform.isLinux [
-      openssl
+      # keep-sorted start
+      libxcb-keysyms
      libxcrypt
      lttng-ust_2_12
      musl
-      libxcb-keysyms
+      openssl
+      # keep-sorted end
    ]
    ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch) [
+      # keep-sorted start
      expat
      libxml2
      xz
+      # keep-sorted end
    ];
  extraLdPath = lib.optionals (stdenv.hostPlatform.isLinux) [
+    # keep-sorted start
    # Avalonia dependencies needed for dotMemory
    libice
    libsm
    libx11
+    # keep-sorted end
  ];

  # NOTE: meta attrs are used for the Linux desktop entries and may cause rebuilds when changed
@@ -85,6 +101,7 @@ in
      This lets you develop a wide array of applications including .NET desktop apps, services and libraries, Unity games, ASP.NET and ASP.NET Core web applications.
    '';
    maintainers = with lib.maintainers; [ raphaelr ];
+    teams = [ lib.teams.jetbrains ];
    license = lib.licenses.unfree;
    sourceProvenance =
      if stdenv.hostPlatform.isDarwin then
@@ -94,11 +111,10 @@ in
  };
 }).overrideAttrs
  (attrs: {
+    # TODO: It is not correct to bundle the .NET in nixpkgs as-is, see https://github.com/NixOS/nixpkgs/issues/489048
    postInstall =
      (attrs.postInstall or "")
      + lib.optionalString stdenv.hostPlatform.isLinux ''
-        ${patchSharedLibs}
-
        for dir in $out/rider/lib/ReSharperHost/linux-*; do
          rm -rf $dir/dotnet
          ln -s ${dotnetCorePackages.sdk_10_0-source}/share/dotnet $dir/dotnet
--- a/pkgs/applications/editors/jetbrains/ides/ruby-mine.nix
+++ b/pkgs/applications/editors/jetbrains/ides/ruby-mine.nix
@@ -1,11 +1,13 @@
 {
-  stdenv,
-  lib,
+  # keep-sorted start
  fetchurl,
-  mkJetBrainsProduct,
-  libdbm,
  fsnotifier,
+  jetbrains,
+  jetbrains-libdbm,
+  lib,
  musl,
+  stdenv,
+  # keep-sorted end
 }:
 let
  system = stdenv.hostPlatform.system;
@@ -26,8 +28,8 @@ let
  };
  # update-script-end: urls
 in
-mkJetBrainsProduct {
-  inherit libdbm fsnotifier;
+jetbrains.mkJetBrainsProduct {
+  inherit jetbrains-libdbm fsnotifier;

  pname = "ruby-mine";

@@ -41,6 +43,13 @@ mkJetBrainsProduct {

  src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

+  # the jdk is bundled on Darwin.
+  jdk =
+    if lib.meta.availableOn stdenv.hostPlatform jetbrains.jdk-no-jcef then
+      jetbrains.jdk-no-jcef
+    else
+      null;
+
  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
    musl
  ];
@@ -51,6 +60,7 @@ mkJetBrainsProduct {
    description = "Ruby IDE from JetBrains";
    longDescription = "Ruby IDE from JetBrains";
    maintainers = with lib.maintainers; [ tymscar ];
+    teams = [ lib.teams.jetbrains ];
    license = lib.licenses.unfree;
    sourceProvenance =
      if stdenv.hostPlatform.isDarwin then
--- a/pkgs/applications/editors/jetbrains/ides/rust-rover.nix
+++ b/pkgs/applications/editors/jetbrains/ides/rust-rover.nix
@@ -1,17 +1,18 @@
 {
-  stdenv,
-  lib,
-  fetchurl,
-  mkJetBrainsProduct,
-  libdbm,
-  fsnotifier,
-  patchSharedLibs,
-  python3,
-  openssl,
-  libxcrypt-legacy,
+  # keep-sorted start
  expat,
+  fetchurl,
+  fsnotifier,
+  jetbrains,
+  jetbrains-libdbm,
+  lib,
+  libxcrypt-legacy,
  libxml2,
+  openssl,
+  python3,
+  stdenv,
  xz,
+  # keep-sorted end
 }:
 let
  system = stdenv.hostPlatform.system;
@@ -32,8 +33,8 @@ let
  };
  # update-script-end: urls
 in
-(mkJetBrainsProduct {
-  inherit libdbm fsnotifier;
+jetbrains.mkJetBrainsProduct {
+  inherit jetbrains-libdbm fsnotifier;

  pname = "rust-rover";

@@ -47,16 +48,29 @@ in

  src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

+  # the jdk is bundled on Darwin.
+  jdk =
+    if lib.meta.availableOn stdenv.hostPlatform jetbrains.jdk-no-jcef then
+      jetbrains.jdk-no-jcef
+    else
+      null;
+
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [ jetbrains.sharedLibsHook ];
+
  buildInputs =
    lib.optionals stdenv.hostPlatform.isLinux [
-      python3
-      openssl
+      # keep-sorted start
      libxcrypt-legacy
+      openssl
+      python3
+      # keep-sorted end
    ]
    ++ lib.optionals (stdenv.hostPlatform.isLinux && stdenv.hostPlatform.isAarch) [
+      # keep-sorted start
      expat
      libxml2
      xz
+      # keep-sorted end
    ];

  # NOTE: meta attrs are used for the Linux desktop entries and may cause rebuilds when changed
@@ -65,6 +79,7 @@ in
    description = "Rust IDE from JetBrains";
    longDescription = "Rust IDE from JetBrains";
    maintainers = [ ];
+    teams = [ lib.teams.jetbrains ];
    license = lib.licenses.unfree;
    sourceProvenance =
      if stdenv.hostPlatform.isDarwin then
@@ -72,10 +87,4 @@ in
      else
        [ lib.sourceTypes.binaryBytecode ];
  };
-}).overrideAttrs
-  (attrs: {
-    postFixup = ''
-      ${attrs.postFixup or ""}
-      ${patchSharedLibs}
-    '';
-  })
+}
--- a/pkgs/applications/editors/jetbrains/ides/webstorm.nix
+++ b/pkgs/applications/editors/jetbrains/ides/webstorm.nix
@@ -1,11 +1,13 @@
 {
-  stdenv,
-  lib,
+  # keep-sorted start
  fetchurl,
-  mkJetBrainsProduct,
-  libdbm,
  fsnotifier,
+  jetbrains,
+  jetbrains-libdbm,
+  lib,
  musl,
+  stdenv,
+  # keep-sorted end
 }:
 let
  system = stdenv.hostPlatform.system;
@@ -26,8 +28,8 @@ let
  };
  # update-script-end: urls
 in
-mkJetBrainsProduct {
-  inherit libdbm fsnotifier;
+jetbrains.mkJetBrainsProduct {
+  inherit jetbrains-libdbm fsnotifier;

  pname = "webstorm";

@@ -41,6 +43,13 @@ mkJetBrainsProduct {

  src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));

+  # the jdk is bundled on Darwin.
+  jdk =
+    if lib.meta.availableOn stdenv.hostPlatform jetbrains.jdk-no-jcef then
+      jetbrains.jdk-no-jcef
+    else
+      null;
+
  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
    musl
  ];
@@ -54,6 +63,7 @@ mkJetBrainsProduct {
      abaldeau
      tymscar
    ];
+    teams = [ lib.teams.jetbrains ];
    license = lib.licenses.unfree;
    sourceProvenance =
      if stdenv.hostPlatform.isDarwin then
--- a/pkgs/applications/editors/jetbrains/plugins/default.nix
+++ b/pkgs/applications/editors/jetbrains/plugins/default.nix
@@ -1,12 +1,14 @@
 {
+  # keep-sorted start
+  autoPatchelfHook,
+  callPackage,
+  darwin,
  fetchurl,
  fetchzip,
+  glib,
  lib,
  stdenv,
-  callPackage,
-  autoPatchelfHook,
-  glib,
-  darwin,
+  # keep-sorted end
 }:
 {
  tests = callPackage ./tests.nix { };
--- a/pkgs/applications/editors/jetbrains/plugins/tests.nix
+++ b/pkgs/applications/editors/jetbrains/plugins/tests.nix
@@ -1,10 +1,13 @@
 {
+  # keep-sorted start
+  fetchurl,
+  fetchzip,
  jetbrains,
-  symlinkJoin,
  lib,
  runCommand,
-  fetchzip,
-  fetchurl,
+  symlinkJoin,
+  # keep-sorted end
+
  # If not set, all IDEs are tested.
  ide ? null,
 }:
@@ -14,21 +17,23 @@ let
    if ide == null then
      with jetbrains;
      [
+        # keep-sorted start
        clion
        datagrip
        dataspell
        gateway
        goland
-        idea-oss
        idea
+        idea-oss
        mps
        phpstorm
-        pycharm-oss
        pycharm
+        pycharm-oss
        rider
        ruby-mine
        rust-rover
        webstorm
+        # keep-sorted end
      ]
    else
      [ ide ];
--- a/pkgs/applications/editors/jetbrains/readme.md
+++ b/pkgs/applications/editors/jetbrains/readme.md
@@ -56,13 +56,15 @@ Any comments or other manual changes between these markers will be removed when
 - Add it to `default.nix`

 ### TODO:
- - move PyCharm overrides to a common place outside of `default.nix`
- - package `patchSharedLibs` from `default.nix` as a hook
- - cleanup this TODO list, especially the following points, which have been here since 2023
+ - get rid of remaining `overrideAttrs` in IDE drvs:
+   - see https://github.com/NixOS/nixpkgs/pull/475183#discussion_r2655348886
+   - see https://github.com/NixOS/nixpkgs/pull/475183#discussion_r2655305961
+ - cleanup this TODO list, especially the following points, which (mostly) have been here since 2023
 - replace `libxcrypt-legacy` with `libxcrypt` when supported
 - make `jetbrains-remote-dev.patch` cleaner
 - is extraLdPath needed for IDEA?
 - from source builds:
+   - switch to Bazel builds, see https://github.com/NixOS/nixpkgs/pull/531637
   - remove timestamps in output `.jar` of `jps-bootstrap`
   - automated update scripts
   - fetch `.jar`s from stuff built in nixpkgs when available
--- a/pkgs/applications/editors/jetbrains/source/build.nix
+++ b/pkgs/applications/editors/jetbrains/source/build.nix
@@ -1,28 +1,24 @@
 {
+  # keep-sorted start
+  ant,
+  callPackage,
  fetchFromGitHub,
  fetchurl,
  fetchzip,
+  fsnotifier,
+  glibc,
+  jetbrains,
+  jetbrains-libdbm,
+  kotlin,
  lib,
  linkFarm,
  makeWrapper,
-  runCommand,
-  stdenv,
-  stdenvNoCC,
-  rustPlatform,
-  callPackage,
-
-  ant,
-  cmake,
-  fsnotifier,
-  glib,
-  glibc,
-  jetbrains,
-  kotlin,
-  libdbusmenu,
  maven,
  p7zip,
-  pkg-config,
-  libx11,
+  runCommand,
+  rustPlatform,
+  stdenvNoCC,
+  # keep-sorted end
 }:
 {
  version,
@@ -67,59 +63,11 @@ let
    cp -r ${androidSrc} $out/android
  '';

-  libdbusmenu-jb = libdbusmenu.overrideAttrs (old: {
-    version = "jetbrains-fork";
-    src = fetchFromGitHub {
-      owner = "jetbrains";
-      repo = "libdbusmenu";
-      rev = "d8a49303f908a272e6670b7cee65a2ba7c447875";
-      hash = "sha256-u87ZgbfeCPJ0qG8gsom3gFaZxbS5NcHEodb0EVakk60=";
-    };
-    configureFlags = old.configureFlags ++ [
-      "--enable-static"
-    ];
-    installPhase = ''
-      runHook preInstall
-
-      mkdir -p $out/lib
-      cp libdbusmenu-glib/.libs/libdbusmenu-glib.a $out/lib
-
-      runHook postInstall
-    '';
+  # Use the libdbm version in our src.
+  libdbm = jetbrains-libdbm.overrideAttrs (finalAttrs: {
+    inherit src version;
  });

-  libdbm = stdenv.mkDerivation {
-    pname = "libdbm";
-    version = buildNumber;
-    nativeBuildInputs = [
-      cmake
-      pkg-config
-    ];
-    buildInputs = [
-      glib
-      libx11
-      libdbusmenu
-    ];
-    inherit src;
-    sourceRoot = "${src.name}/native/LinuxGlobalMenu";
-    patches = [ ../patches/libdbm-headers.patch ];
-    postPatch = ''
-      # Fix the build with CMake 4.
-      substituteInPlace CMakeLists.txt \
-        --replace-fail 'cmake_minimum_required(VERSION 2.6.0)' 'cmake_minimum_required(VERSION 3.10)'
-      cp ${libdbusmenu-jb}/lib/libdbusmenu-glib.a libdbusmenu-glib.a
-    '';
-    passthru.patched-libdbusmenu = libdbusmenu-jb;
-    installPhase = ''
-      runHook preInstall
-
-      mkdir -p $out/lib
-      mv libdbm.so $out/lib/libdbm.so
-
-      runHook postInstall
-    '';
-  };
-
  restarter = rustPlatform.buildRustPackage {
    pname = "restarter";
    version = buildNumber;
@@ -130,8 +78,10 @@ let

    # Allow static linking
    buildInputs = [
+      # keep-sorted start
      glibc
      glibc.static
+      # keep-sorted end
    ];
  };

@@ -143,9 +93,11 @@ let
    inherit src;
    sourceRoot = "${src.name}/platform/jps-bootstrap";
    nativeBuildInputs = [
+      # keep-sorted start
      ant
-      makeWrapper
      jbr
+      makeWrapper
+      # keep-sorted end
    ];
    patches = [ ../patches/kotlinc-path.patch ];
    postPatch = "sed -i 's|KOTLIN_PATH_HERE|${kotlin'}|' src/main/java/org/jetbrains/jpsBootstrap/KotlinCompiler.kt";
@@ -237,9 +189,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  name = "${finalAttrs.pname}-${version}.tar.gz";
  inherit src;
  nativeBuildInputs = [
-    p7zip
+    # keep-sorted start
    jbr
    jps-bootstrap
+    p7zip
+    # keep-sorted end
  ];
  repo = mvnRepo;

@@ -316,8 +270,8 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    inherit
      version
      buildNumber
+      # this is jetbrains-libdbm but using the sources from the IDE build.
      libdbm
-      fsnotifier
      jps-bootstrap
      ;
  };
--- a/pkgs/applications/editors/jetbrains/source/jps_repo.nix
+++ b/pkgs/applications/editors/jetbrains/source/jps_repo.nix
@@ -1,10 +1,11 @@
 {
-  runCommand,
+  # keep-sorted start
  ant,
  jbr,
-
  jpsHash,
+  runCommand,
  src,
+  # keep-sorted end
 }:
 runCommand "jps-bootstrap-repository"
  {
@@ -12,8 +13,10 @@ runCommand "jps-bootstrap-repository"
    outputHashMode = "recursive";
    outputHash = jpsHash;
    nativeBuildInputs = [
+      # keep-sorted start
      ant
      jbr
+      # keep-sorted end
    ];
  }
  ''
--- a/pkgs/applications/misc/tuxclocker/default.nix
+++ b/pkgs/applications/misc/tuxclocker/default.nix
@@ -9,23 +9,22 @@
  ninja,
  pkg-config,
  python3,
-  qtbase,
-  qtcharts,
+  qt5,
  tuxclocker-plugins,
  tuxclocker-without-unfree,
-  wrapQtAppsHook,
+  unstableGitUpdater,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "tuxclocker";
-  version = "1.5.1";
+  version = "1.5.1-unstable-2026-08-19";

  src = fetchFromGitHub {
    owner = "Lurkki14";
    repo = "tuxclocker";
    fetchSubmodules = true;
-    rev = finalAttrs.version;
-    hash = "sha256-QLKLqTCpVMWxlDINa8Bo1vgCDcjwovoaXUs/PdMnxv0=";
+    rev = "c7c9021e6c32f3df581f266ccab4275d29810be1";
+    hash = "sha256-FMLpzt/VFzzFdn2b8MUxjPowLJu+tHiJhCDum5I6kSU=";
  };

  nativeBuildInputs = [
@@ -34,13 +33,13 @@ stdenv.mkDerivation (finalAttrs: {
    meson
    ninja
    pkg-config
-    wrapQtAppsHook
+    qt5.wrapQtAppsHook
  ];

  buildInputs = [
    boost
-    qtbase
-    qtcharts
+    qt5.qtbase
+    qt5.qtcharts
  ];

  postInstall = ''
@@ -54,8 +53,11 @@ stdenv.mkDerivation (finalAttrs: {
    "-Dplugins=false"
  ];

-  passthru.tests = {
-    inherit tuxclocker-without-unfree;
+  passthru = {
+    tests = {
+      inherit tuxclocker-without-unfree;
+    };
+    updateScript = unstableGitUpdater { };
  };

  meta = {
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-esr-140.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-esr-140.nix
@@ -24,6 +24,19 @@ buildMozillaMach rec {
    maxSilent = 14400; # 4h, double the default of 7200s (c.f. #129212, #129115)
    license = lib.licenses.mpl20;
    mainProgram = "firefox";
+    identifiers = {
+      cpeParts = {
+        product = "firefox";
+        sw_edition = "esr";
+        update = "*";
+        vendor = "mozilla";
+        version = lib.removeSuffix "esr" version;
+      };
+      purlParts = {
+        type = "generic";
+        spec = "firefox@${lib.removeSuffix "esr" version}";
+      };
+    };
  };
  tests = {
    inherit (nixosTests) firefox-esr-140;
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox-esr-153.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox-esr-153.nix
@@ -25,6 +25,19 @@ buildMozillaMach rec {
    maxSilent = 14400; # 4h, double the default of 7200s (c.f. #129212, #129115)
    license = lib.licenses.mpl20;
    mainProgram = "firefox";
+    identifiers = {
+      cpeParts = {
+        product = "firefox";
+        sw_edition = "esr";
+        update = "*";
+        vendor = "mozilla";
+        version = lib.removeSuffix "esr" version;
+      };
+      purlParts = {
+        type = "generic";
+        spec = "firefox@${lib.removeSuffix "esr" version}";
+      };
+    };
  };
  tests = {
    inherit (nixosTests) firefox-esr-153;
--- a/pkgs/applications/networking/browsers/firefox/packages/firefox.nix
+++ b/pkgs/applications/networking/browsers/firefox/packages/firefox.nix
@@ -30,6 +30,18 @@ buildMozillaMach rec {
    maxSilent = 14400; # 4h, double the default of 7200s (c.f. #129212, #129115)
    license = lib.licenses.mpl20;
    mainProgram = "firefox";
+    identifiers = {
+      cpeParts = {
+        inherit version;
+        product = "firefox";
+        update = "*";
+        vendor = "mozilla";
+      };
+      purlParts = {
+        type = "generic";
+        spec = "firefox@${version}";
+      };
+    };
  };
  tests = {
    inherit (nixosTests) firefox;
--- a/pkgs/applications/networking/instant-messengers/pidgin/pidgin-plugins/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin/pidgin-plugins/default.nix
@@ -48,8 +48,6 @@ lib.makeScope newScope (

    purple-slack = callPackage ./purple-slack { };

-    purple-xmpp-http-upload = callPackage ./purple-xmpp-http-upload { };
-
  }
  // lib.optionalAttrs config.allowAliases {
    tdlib-purple = throw "'pidginPackages.tdlib-purple' has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-02-05
@@ -62,5 +60,6 @@ lib.makeScope newScope (
    purple-facebook = throw "'pidginPackages.purple-facebook' has been removed as it is unmaintained and doesn't support e2ee enforced by facebook.";
    pidgin-opensteamworks = throw "'pidginPackages.pidgin-opensteamworks' has been removed as it is unmaintained and no longer works with Steam.";
    purple-vk-plugin = throw "'pidginPackages.purple-vk-plugin' has been removed as upstream repository was deleted and no active forks are found.";
+    purple-xmpp-http-upload = throw "'pidginPackages.purple-xmpp-http-upload' has been removed because it is no longer maintained upstream."; # Added 2026-09-02
  }
 )
--- a/pkgs/applications/networking/instant-messengers/pidgin/pidgin-plugins/purple-xmpp-http-upload/default.nix
+++ b/pkgs/applications/networking/instant-messengers/pidgin/pidgin-plugins/purple-xmpp-http-upload/default.nix
@@ -1,38 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  pidgin,
-  glib,
-  libxml2,
-}:
-
-stdenv.mkDerivation {
-  pname = "purple-xmpp-upload";
-  version = "unstable-2021-11-04";
-
-  src = fetchFromGitHub {
-    owner = "Junker";
-    repo = "purple-xmpp-http-upload";
-    rev = "f370b4a2c474c6fe4098d929d8b7c18aeba87b6b";
-    sha256 = "0n05jybmibn44xb660p08vrrbanfsyjn17w1xm9gwl75fxxq8cdc";
-  };
-
-  buildInputs = [
-    pidgin
-    glib
-    libxml2
-  ];
-
-  installPhase = ''
-    install -Dm644 -t $out/lib/purple-2 jabber_http_file_upload.so
-  '';
-
-  meta = {
-    homepage = "https://github.com/Junker/purple-xmpp-http-upload";
-    description = "HTTP File Upload plugin for libpurple (XMPP Protocol XEP-0363)";
-    license = lib.licenses.gpl3;
-    platforms = lib.platforms.linux;
-    maintainers = with lib.maintainers; [ emmanuelrosa ];
-  };
-}
--- a/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
+++ b/pkgs/applications/networking/mailreaders/thunderbird/packages.nix
@@ -112,8 +112,8 @@ rec {
  thunderbird-140 = common {
    applicationName = "Thunderbird ESR";

-    version = "140.14.0esr";
-    sha512 = "4c95b1ca3fc7f6429b2360a7e732635bdfb60927622a7da4d8af9ca2abd550611b91763c587cddad5d51c0dd4e905ba8e106da3cd21591a1bec3dba1b9a2502d";
+    version = "140.15.0esr";
+    sha512 = "52f014fb75ac131780aba924dd973a1fb5d6a60be4f800c258dca931e2c6ad75baaad37a5ad52228e91d3d174823b6b4d38ddc2dbbf9c04b8700cc33079448bb";

    updateScript = callPackage ./update.nix {
      attrPath = "thunderbirdPackages.thunderbird-140";
--- a/pkgs/by-name/ar/arc-unpacker/fix-test-float-variance.patch
+++ b/pkgs/by-name/ar/arc-unpacker/fix-test-float-variance.patch
@@ -1,101 +0,0 @@
-diff --git a/tests/test_support/audio_support.cc b/tests/test_support/audio_support.cc
-index c26022e9..5f50d035 100644
--- a/tests/test_support/audio_support.cc
-+++ b/tests/test_support/audio_support.cc
-@@ -16,6 +16,7 @@
- // along with arc_unpacker. If not, see <http://www.gnu.org/licenses/>.
- 
- #include "test_support/audio_support.h"
-+#include <cstdlib>
- #include "algo/format.h"
- #include "algo/range.h"
- #include "dec/microsoft/wav_audio_decoder.h"
-@@ -44,13 +45,42 @@ res::Audio tests::get_test_audio()
- void tests::compare_audio(
-     const res::Audio &actual, const res::Audio &expected)
- {
-+    // Allow for minor variances in audio samples within the specified
-+    // threshold. Floating point calculations in some audio decoders yields
-+    // slightly differing results across different CPU architectures.
-+    //
-+    // Affected tests:
-+    //   * tests/dec/cri/hca_audio_decoder_test.cc
-+    //   * tests/dec/entis/mio_audio_decoder_test.cc
-+    static constexpr int tolerance = 1;
-+
-     REQUIRE(actual.codec == expected.codec);
-     REQUIRE(actual.channel_count == expected.channel_count);
-     REQUIRE(actual.sample_rate == expected.sample_rate);
-     REQUIRE(actual.bits_per_sample == expected.bits_per_sample);
-     REQUIRE(actual.extra_codec_headers == expected.extra_codec_headers);
-     REQUIRE(actual.samples.size() == expected.samples.size());
-+
-+#ifdef __x86_64__
-     tests::compare_binary(actual.samples, expected.samples);
-+#else
-+    tests::compare_binary(
-+      actual.samples,
-+      expected.samples,
-+      [](const bstr& bytes1, const bstr& bytes2) -> bool {
-+        const auto samples1 = reinterpret_cast<const s16*>(bytes1.c_str());
-+        const auto samples2 = reinterpret_cast<const s16*>(bytes2.c_str());
-+        const auto n_samples = bytes1.size() / sizeof(*samples1);
-+        // algo::range is a bit incomplete to work with std::all_of
-+        for (const int i : algo::range(n_samples)) {
-+          if (std::abs(samples1[i] - samples2[i]) > tolerance) {
-+            return false;
-+          }
-+        }
-+        return true;
-+      }
-+    );
-+#endif
- 
-     REQUIRE(actual.loops.size() == expected.loops.size());
-     for (const auto i : algo::range(expected.loops.size()))
-diff --git a/tests/test_support/common.cc b/tests/test_support/common.cc
-index b63ffa89..265ef7b1 100644
--- a/tests/test_support/common.cc
-+++ b/tests/test_support/common.cc
-@@ -40,3 +40,19 @@ void au::tests::compare_binary(const bstr &actual, const bstr &expected)
-     INFO(actual_dump << " != " << expected_dump);
-     REQUIRE(actual == expected);
- }
-+
-+void au::tests::compare_binary(
-+    const bstr &actual,
-+    const bstr &expected,
-+    std::function<bool(const bstr &, const bstr &)> compare)
-+{
-+    const auto max_size = 10000;
-+    auto actual_dump = algo::hex(actual);
-+    auto expected_dump = algo::hex(expected);
-+    if (actual_dump.size() > max_size)
-+        actual_dump = actual_dump.substr(0, max_size) + "(...)";
-+    if (expected_dump.size() > max_size)
-+        expected_dump = expected_dump.substr(0, max_size) + "(...)";
-+    INFO(actual_dump << " != " << expected_dump);
-+    REQUIRE(compare(actual, expected));
-+}
-diff --git a/tests/test_support/common.h b/tests/test_support/common.h
-index 7d8be579..ecd5dcf8 100644
--- a/tests/test_support/common.h
-+++ b/tests/test_support/common.h
-@@ -17,6 +17,7 @@
- 
- #pragma once
- 
-+#include <functional>
- #include "io/path.h"
- #include "types.h"
- 
-@@ -27,4 +28,9 @@ namespace tests {
- 
-     void compare_binary(const bstr &actual, const bstr &expected);
- 
-+    void compare_binary(
-+        const bstr &actual,
-+        const bstr &expected,
-+        std::function<bool(const bstr &, const bstr &)> compare);
-+
- } }
--- a/pkgs/by-name/ar/arc-unpacker/package.nix
+++ b/pkgs/by-name/ar/arc-unpacker/package.nix
@@ -1,118 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchpatch,
-  cmake,
-  makeWrapper,
-  ninja,
-  boost,
-  libpng,
-  libiconv,
-  libjpeg,
-  zlib,
-  openssl,
-  libwebp,
-  catch2,
-}:
-
-stdenv.mkDerivation {
-  pname = "arc-unpacker";
-  version = "0.11-unstable-2021-09-06";
-
-  strictDeps = true;
-  __structuredAttrs = true;
-
-  src = fetchFromGitHub {
-    owner = "vn-tools";
-    repo = "arc_unpacker";
-    rev = "456834ecf2e5686813802c37efd829310485c57d";
-    hash = "sha256-STbdWH7Mr3gpOrZvujblYrIIKEWBHzy1/BaNuh4teI8=";
-  };
-
-  patches = [ ./fix-test-float-variance.patch ];
-
-  postPatch = ''
-    cp ${catch2}/include/catch2/catch.hpp tests/test_support/catch.h
-
-    # missing includes
-    sed '1i#include <limits>' -i src/dec/eagls/pak_archive_decoder.cc # gcc12
-    sed '1i#include <cstdint>' -i src/types.h # gcc13
-    sed '1i#include <vector>' -i src/flow/cli_facade.h # gcc14
-
-    # cmake-4 support
-    substituteInPlace CMakeLists.txt --replace-fail \
-      'cmake_minimum_required(VERSION 2.8.8)' \
-      'cmake_minimum_required(VERSION 3.10)'
-
-    # boost 1.89 no longer provides boost_system as a separate CMake component
-    substituteInPlace CMakeLists.txt --replace-fail \
-      'find_package(Boost COMPONENTS filesystem system REQUIRED)' \
-      'find_package(Boost COMPONENTS filesystem REQUIRED)'
-  '';
-
-  nativeBuildInputs = [
-    cmake
-    makeWrapper
-    ninja
-    catch2
-  ];
-
-  buildInputs = [
-    boost
-    libiconv
-    libjpeg
-    libpng
-    libwebp
-    openssl
-    zlib
-  ];
-
-  checkPhase =
-    let
-      checkTarget = [
-        "~CatSystem INT archives"
-      ]
-      ++ lib.optionals (stdenv.hostPlatform.system == "aarch64-linux") [ "~Ivory WADY audio" ];
-    in
-    ''
-      # Specify test targets
-      # https://catch2-temp.readthedocs.io/en/latest/command-line.html#specifying-which-tests-to-run
-      checkTarget=(${lib.escapeShellArgs checkTarget})
-
-      runHook preCheck
-
-      local flagsArray=()
-      concatTo flagsArray checkFlags checkFlagsArray checkTarget
-
-      pushd ..
-      echoCmd 'check flags' "''${flagsArray[@]}"
-      ./build/run_tests "''${flagsArray[@]}"
-      popd
-
-      runHook postCheck
-    '';
-
-  installPhase = ''
-    runHook preInstall
-
-    mkdir -p $out/bin $out/share/doc/arc_unpacker $out/libexec/arc_unpacker
-    cp arc_unpacker $out/libexec/arc_unpacker/arc_unpacker
-    cp ../GAMELIST.{htm,js} $out/share/doc/arc_unpacker
-    cp -r ../etc $out/libexec/arc_unpacker
-    makeWrapper $out/libexec/arc_unpacker/arc_unpacker $out/bin/arc_unpacker
-
-    runHook postInstall
-  '';
-
-  doCheck = true;
-
-  meta = {
-    description = "Tool to extract files from visual novel archives";
-    homepage = "https://github.com/vn-tools/arc_unpacker";
-    license = lib.licenses.gpl3Plus;
-    maintainers = with lib.maintainers; [ midchildan ];
-    platforms = lib.platforms.all;
-    mainProgram = "arc_unpacker";
-  };
-}
--- a/pkgs/by-name/bi/bitrise/package.nix
+++ b/pkgs/by-name/bi/bitrise/package.nix
@@ -6,13 +6,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "bitrise";
-  version = "2.42.2";
+  version = "2.43.2";

  src = fetchFromGitHub {
    owner = "bitrise-io";
    repo = "bitrise";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-+EkhiOy9iknsWM5gUEBJYeyRE3GqQ7Wv738kG1906lc=";
+    hash = "sha256-QRgOoqk+A79MSXkRX3N8oUHhzatxMm/nzXemKRJ4JHU=";
  };

  # many tests rely on writable $HOME/.bitrise and require network access
--- a/pkgs/by-name/co/connman-gtk/package.nix
+++ b/pkgs/by-name/co/connman-gtk/package.nix
@@ -1,62 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchpatch,
-  meson,
-  ninja,
-  pkg-config,
-  python3,
-  gtk3,
-  connman,
-  openconnect,
-  wrapGAppsHook3,
-}:
-
-stdenv.mkDerivation {
-  pname = "connman-gtk";
-  version = "1.1.1-unstable-2018-06-26";
-
-  src = fetchFromGitHub {
-    owner = "jgke";
-    repo = "connman-gtk";
-    rev = "b72c6ab3bb19c07325c8e659902b046daa23c506";
-    hash = "sha256-6lX6FYERDgLj9G6nwnP35kF5x8dpRJqfJB/quZFtFzM=";
-  };
-
-  postPatch = ''
-    patchShebangs --build data/meson_post_install.py
-  '';
-
-  nativeBuildInputs = [
-    meson
-    ninja
-    pkg-config
-    python3
-    wrapGAppsHook3
-  ];
-
-  buildInputs = [
-    gtk3
-    openconnect
-    connman
-  ];
-
-  patches = [
-    (fetchpatch {
-      url = "https://salsa.debian.org/nickm/connman-gtk/-/raw/ef01b52fa02c5cca199b2e47c0cf360691266fd8/debian/patches/incompatible-pointer-type";
-      hash = "sha256-T+N9FfDyROBA4/HLK+l/fpnju2imDU4y6nGSbF+JDiA=";
-    })
-  ];
-
-  env.MESON_INSTALL_PREFIX = placeholder "out";
-
-  meta = {
-    description = "GTK GUI for Connman";
-    mainProgram = "connman-gtk";
-    homepage = "https://github.com/jgke/connman-gtk";
-    license = lib.licenses.gpl2Plus;
-    platforms = lib.platforms.linux;
-    maintainers = [ lib.maintainers.romildo ];
-  };
-}
--- a/pkgs/by-name/cu/curv/package.nix
+++ b/pkgs/by-name/cu/curv/package.nix
@@ -20,7 +20,6 @@
  libxext,
  libxcursor,
  libx11,
-  ilmbase,
  llvmPackages,
  unstableGitUpdater,
 }:
@@ -61,7 +60,6 @@ stdenv.mkDerivation {
    libxrandr
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    ilmbase
    llvmPackages.openmp
  ];

--- a/pkgs/by-name/di/diamond/package.nix
+++ b/pkgs/by-name/di/diamond/package.nix
@@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "diamond";
-  version = "2.2.5";
+  version = "2.2.6";

  src = fetchFromGitHub {
    owner = "bbuchfink";
    repo = "diamond";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-qt9oNHru1qBwrcncqvQzjinWGfFW0jexOqHWCWHiWX0=";
+    hash = "sha256-8IlF/PQpceFx8THy1T9zD+yMxPLIyqvntwij3TJZB4M=";
  };

  nativeBuildInputs = [ cmake ];
--- a/pkgs/by-name/dj/djv/package.nix
+++ b/pkgs/by-name/dj/djv/package.nix
@@ -4,30 +4,21 @@
  fetchFromGitHub,
  cmake,
  pkg-config,
-  bzip2,
  feather-tk,
  ffmpeg_7,
  freetype,
  glfw,
  imath,
  libGL,
-  libjpeg,
-  libtiff,
-  libpng,
  lunasvg,
  minizip-ng,
  nativefiledialog-extended,
  nlohmann_json,
  opencolorio,
-  openexr_2,
-  openssl,
  opentimelineio,
  plutovg,
  SDL2,
  tlrender,
-  xz,
-  zlib,
-  zstd,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -48,36 +39,30 @@ stdenv.mkDerivation (finalAttrs: {
        " ${tlrender}/etc/tlRender/LICENSE_"
  '';

+  __structuredAttrs = true;
+  strictDeps = true;
+
  nativeBuildInputs = [
    cmake
    pkg-config
  ];

  buildInputs = [
-    bzip2
    feather-tk
    ffmpeg_7
    freetype
    glfw
    imath
    tlrender
-    libjpeg
    libGL
-    libpng
-    libtiff
    lunasvg
    minizip-ng
    nativefiledialog-extended
    nlohmann_json
    opencolorio
-    openexr_2
-    openssl
    opentimelineio
    plutovg
    SDL2
-    xz
-    zlib
-    zstd
  ];

  # GLFW requires a working X11 session.
--- a/pkgs/by-name/dl/dlpack/package.nix
+++ b/pkgs/by-name/dl/dlpack/package.nix
@@ -19,6 +19,16 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-kIHBgTYaHEmweRBFtRl1pXhOyQ5TEwU8dLUssTMEnpc=";
  };

+  postPatch =
+    # Fix outdated version in CMakeLists.txt. It makes dlpackConfigVersion.cmake advertise 0.6 and
+    # any call to `find_package(dlpack <1.x>)` fails.
+    ''
+      substituteInPlace CMakeLists.txt \
+        --replace-fail \
+          'project(dlpack VERSION 0.6 LANGUAGES C CXX)' \
+          'project(dlpack VERSION ${finalAttrs.version} LANGUAGES C CXX)'
+    '';
+
  nativeBuildInputs = [
    cmake
  ];
--- a/pkgs/by-name/do/dolt/package.nix
+++ b/pkgs/by-name/do/dolt/package.nix
@@ -7,18 +7,18 @@

 buildGoModule (finalAttrs: {
  pname = "dolt";
-  version = "2.3.1";
+  version = "2.3.2";

  src = fetchFromGitHub {
    owner = "dolthub";
    repo = "dolt";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-KwN0na1G2M9hnPQqraRF8UhU8P3efv6DYXj3WEBCBDA=";
+    hash = "sha256-+mGvRm0YaDFuXuJfBocfJEqH36UllEm8rhx73RoihyM=";
  };

  modRoot = "./go";
  subPackages = [ "cmd/dolt" ];
-  vendorHash = "sha256-28lZ8rL/X/Lgxi1kwg62Wk97M/lEFqhllUAmnq8v54c=";
+  vendorHash = "sha256-j9HnfUZ1w6l/ytnYgvd3xiUNmTXd4BePOtSX1eJKaAc=";
  proxyVendor = true;
  doCheck = false;

--- a/pkgs/by-name/eg/egctl/package.nix
+++ b/pkgs/by-name/eg/egctl/package.nix
@@ -9,16 +9,16 @@

 buildGoModule (finalAttrs: {
  pname = "egctl";
-  version = "1.8.3";
+  version = "1.9.1";

  src = fetchFromGitHub {
    owner = "envoyproxy";
    repo = "gateway";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-dhAzFpo+pnttcVBVTbOK7sOEeXaIkdPF058Zt8M2JHU=";
+    hash = "sha256-PszV+N0RqH06kDYvEwd1rhj8XS2+lnKZA2+fOMA2vwA=";
  };

-  vendorHash = "sha256-rAShQLNGffK/l8H6b004HfC/Jt3I4ReVlb2YV9yMrwQ=";
+  vendorHash = "sha256-BJBNe5+ztc3WJ1RIvsbLGl0T4znlVNNg+AToXY16ixM=";
  # Fix case-insensitive conflicts producing platform-dependent checksums
  # https://github.com/microsoft/go-mssqldb/issues/234
  proxyVendor = true;
--- a/pkgs/by-name/fa/fancy-motd/package.nix
+++ b/pkgs/by-name/fa/fancy-motd/package.nix
@@ -1,65 +0,0 @@
-{
-  stdenv,
-  lib,
-  fetchFromGitHub,
-  bc,
-  curl,
-  figlet,
-  fortune,
-  gawk,
-  iproute2,
-  procps,
-}:
-
-stdenv.mkDerivation {
-  pname = "fancy-motd";
-  version = "0-unstable-2022-06-06";
-
-  src = fetchFromGitHub {
-    owner = "bcyran";
-    repo = "fancy-motd";
-    rev = "812c58f04f65053271f866f3797baa2eba7324f5";
-    sha256 = "sha256-O/euB63Dyj+NyfZK42egSEYwZhL8B0jCxSSDYoT4cpo=";
-  };
-
-  buildInputs = [
-    bc
-    curl
-    figlet
-    fortune
-    gawk
-    iproute2
-  ];
-
-  postPatch = ''
-    substituteInPlace motd.sh \
-      --replace 'BASE_DIR="$(dirname "$(readlink -f "$0")")"' "BASE_DIR=\"$out/lib\""
-
-    substituteInPlace modules/20-uptime \
-      --replace "uptime -p" "${procps}/bin/uptime -p"
-
-    # does not work on nixos
-    rm modules/41-updates
-  '';
-
-  installPhase = ''
-    runHook preInstall
-
-    install -D motd.sh $out/bin/motd
-
-    install -D framework.sh $out/lib/framework.sh
-    install -D config.sh.example $out/lib/config.sh
-    find modules -type f -exec install -D {} $out/lib/{} \;
-
-    runHook postInstall
-  '';
-
-  meta = {
-    description = "Fancy, colorful MOTD written in bash. Server status at a glance";
-    homepage = "https://github.com/bcyran/fancy-motd";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ rhoriguchi ];
-    platforms = lib.platforms.linux;
-    mainProgram = "motd";
-  };
-}
--- a/pkgs/by-name/fl/flyctl/package.nix
+++ b/pkgs/by-name/fl/flyctl/package.nix
@@ -12,7 +12,7 @@

 buildGoModule rec {
  pname = "flyctl";
-  version = "0.4.87";
+  version = "0.4.97";

  src = fetchFromGitHub {
    owner = "superfly";
@@ -22,11 +22,11 @@ buildGoModule rec {
      cd "$out"
      git rev-parse HEAD > COMMIT
    '';
-    hash = "sha256-rvI9M4BDsll9ZoQgrRXQvXivKSe0NRrbAinXQ3w5RdE=";
+    hash = "sha256-d0tUJMddbCKEwE/iwZxeqm3xDON13O3PBPJPZouobkA=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-N7lNBaT6DLroK0219d+lWy+APrAJqUqOFCeacBIqB8c=";
+  vendorHash = "sha256-ygEH7Y9lHZtdHGRa7/a7RXXF4r8X+XkdqJM6m/EZsdY=";

  subPackages = [ "." ];

--- a/pkgs/by-name/gi/github-mcp-server/package.nix
+++ b/pkgs/by-name/gi/github-mcp-server/package.nix
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "github-mcp-server";
-  version = "1.10.1";
+  version = "1.11.0";

  src = fetchFromGitHub {
    owner = "github";
    repo = "github-mcp-server";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-9521Cx4+xE5QFfD+ny9k/uHI9rU5RiC3SGyhU3hMCYY=";
+    hash = "sha256-omRwUoVmbG+BNe5JJXYNE3csa4vMXBP+LOL2PMIGOEA=";
  };

-  vendorHash = "sha256-tNAC2tSmfTuT4OZmq7vrG2j5njJaL1NyN+/IjYegp60=";
+  vendorHash = "sha256-6a5zjwTfEjGx23lG1ZTnUewm97FNacQY/y92TzAATXg=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/il/ilmbase/package.nix
+++ b/pkgs/by-name/il/ilmbase/package.nix
@@ -1,43 +0,0 @@
-{
-  stdenv,
-  lib,
-  buildPackages,
-  cmake,
-  # explicitly depending on openexr_2 because ilmbase doesn't exist for v3
-  openexr_2,
-}:
-
-stdenv.mkDerivation {
-  pname = "ilmbase";
-  version = lib.getVersion openexr_2;
-
-  # the project no longer provides separate tarballs. We may even want to merge
-  # the ilmbase package into openexr in the future.
-  inherit (openexr_2) src patches;
-
-  outputs = [
-    "out"
-    "dev"
-  ];
-
-  nativeBuildInputs = [ cmake ];
-  depsBuildBuild = [ buildPackages.stdenv.cc ];
-
-  # fails 1 out of 1 tests with
-  # "lt-ImathTest: testBoxAlgo.cpp:892: void {anonymous}::boxMatrixTransform(): Assertion `b21 == b2' failed"
-  # at least on i686. spooky!
-  doCheck = stdenv.hostPlatform.isx86_64;
-
-  preConfigure = ''
-    # Need to cd after patches for openexr patches to apply.
-    cd IlmBase
-  '';
-
-  meta = {
-    description = "Library for 2D/3D vectors and matrices and other mathematical objects, functions and data types for computer graphics";
-    homepage = "https://www.openexr.com/";
-    license = lib.licenses.bsd3;
-    platforms = lib.platforms.all;
-    inherit (openexr_2.meta) knownVulnerabilities;
-  };
-}
--- a/pkgs/applications/editors/jetbrains/patches/libdbm-headers.patch
+++ b/pkgs/applications/editors/jetbrains/patches/libdbm-headers.patch
--- a/pkgs/by-name/je/jetbrains-libdbm/libdbusmenu.nix
+++ b/pkgs/by-name/je/jetbrains-libdbm/libdbusmenu.nix
@@ -0,0 +1,96 @@
+{
+  dbus-glib,
+  fetchFromGitHub,
+  file,
+  glib,
+  gobject-introspection,
+  intltool,
+  json-glib,
+  lib,
+  pkg-config,
+  stdenv,
+  vala,
+}:
+# This is directly based on ../../li/libdbusmenu .
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libdbusmenu-glib";
+  version = "16.04.0-jetbrains-fork-2022-05-18";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "jetbrains";
+    repo = "libdbusmenu";
+    rev = "d8a49303f908a272e6670b7cee65a2ba7c447875";
+    hash = "sha256-u87ZgbfeCPJ0qG8gsom3gFaZxbS5NcHEodb0EVakk60=";
+  };
+
+  nativeBuildInputs = [
+    vala
+    pkg-config
+    intltool
+    gobject-introspection
+  ];
+
+  buildInputs = [
+    glib
+    dbus-glib
+    json-glib
+  ];
+
+  patches = [
+    ./requires-glib.patch
+  ];
+
+  postPatch = ''
+    for f in {configure,ltmain.sh,m4/libtool.m4}; do
+      substituteInPlace $f \
+        --replace /usr/bin/file ${file}/bin/file
+    done
+  '';
+
+  preConfigure = ''
+    export HAVE_VALGRIND_TRUE="#"
+    export HAVE_VALGRIND_FALSE=""
+  '';
+
+  configureFlags = [
+    "CFLAGS=-Wno-error"
+    "--sysconfdir=/etc"
+    "--localstatedir=/var"
+    "--disable-gtk"
+    "--disable-dumper"
+    "--disable-scrollkeeper"
+    # jb:
+    "--enable-static"
+  ];
+
+  doCheck = false;
+
+  installFlags = [
+    "sysconfdir=${placeholder "out"}/etc"
+    "localstatedir=\${TMPDIR}"
+    "typelibdir=${placeholder "out"}/lib/girepository-1.0"
+  ];
+
+  postInstall = ''
+    mkdir -p $out/lib
+    cp libdbusmenu-glib/.libs/libdbusmenu-glib.a $out/lib
+  '';
+
+  meta = {
+    description = "Library for passing menu structures across DBus";
+    homepage = "https://launchpad.net/dbusmenu";
+    license = with lib.licenses; [
+      gpl3
+      lgpl21
+      lgpl3
+    ];
+    pkgConfigModules = [
+      "dbusmenu-glib-0.4"
+      "dbusmenu-jsonloader-0.4"
+    ];
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/by-name/je/jetbrains-libdbm/package.nix
+++ b/pkgs/by-name/je/jetbrains-libdbm/package.nix
@@ -0,0 +1,68 @@
+{
+  callPackage,
+  cmake,
+  fetchFromGitHub,
+  glib,
+  lib,
+  libx11,
+  pkg-config,
+  stdenv,
+}:
+let
+  libdbusmenu-jb = callPackage ./libdbusmenu.nix { };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "jetbrains-libdbm";
+  # nixpkgs-update: no auto update
+  # In practice this package does not need to be regularly updated,
+  # at the time of writing the last change was 4 years ago.
+  # Check before updating.
+  version = "2025.3.4";
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "jetbrains";
+    repo = "intellij-community";
+    tag = "idea/${finalAttrs.version}";
+    hash = "sha256-5rPaXIGOeWY9tcHRs5p376kgo4EbUtEltwcmNpPSsM8=";
+  };
+  sourceRoot = "source/native/LinuxGlobalMenu";
+
+  nativeBuildInputs = [
+    cmake
+    pkg-config
+  ];
+
+  buildInputs = [
+    glib
+    libx11
+    libdbusmenu-jb
+  ];
+
+  patches = [ ./headers.patch ];
+  postPatch = ''
+    # Fix the build with CMake 4.
+    substituteInPlace CMakeLists.txt \
+      --replace-fail 'cmake_minimum_required(VERSION 2.6.0)' 'cmake_minimum_required(VERSION 3.10)'
+    cp ${libdbusmenu-jb}/lib/libdbusmenu-glib.a libdbusmenu-glib.a
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/lib
+    mv libdbm.so $out/lib/libdbm.so
+
+    runHook postInstall
+  '';
+
+  meta = {
+    description = "libdbusmenu wrapper by JetBrains for their IDEs";
+    homepage = "https://github.com/JetBrains/intellij-community/tree/master/native/LinuxGlobalMenu";
+    license = lib.licenses.asl20;
+    teams = [ lib.teams.jetbrains ];
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/je/jetbrains-libdbm/requires-glib.patch
+++ b/pkgs/by-name/je/jetbrains-libdbm/requires-glib.patch
@@ -0,0 +1,11 @@
+--- a/libdbusmenu-glib/dbusmenu-glib-0.4.pc.in
+++ b/libdbusmenu-glib/dbusmenu-glib-0.4.pc.in
+@@ -5,7 +5,7 @@
+ includedir=@includedir@
+
+ Cflags: -I${includedir}/libdbusmenu-glib-0.4
+-Requires:
+Requires: glib-2.0
+ Libs: -L${libdir} -ldbusmenu-glib
+
+ Name: libdbusmenu-glib
--- a/pkgs/by-name/ku/kubescape/package.nix
+++ b/pkgs/by-name/ku/kubescape/package.nix
@@ -9,18 +9,18 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "kubescape";
-  version = "4.0.12";
+  version = "4.0.13";

  src = fetchFromGitHub {
    owner = "kubescape";
    repo = "kubescape";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-HsWCr+6BldF8l5nA/yWJG15nR+rliW7E+1HtX5Pa9Iw=";
+    hash = "sha256-OsMCmh2KxpPKjXd0XkaoHtmaocw/kYDlZDPSPFgu5oU=";
    fetchSubmodules = true;
  };

  proxyVendor = true;
-  vendorHash = "sha256-gZD5fvD8EDD30K5C/3ZXul4ZWpfILljyMXD9bVP0Ad8=";
+  vendorHash = "sha256-dF6JC6Ransv8iCHz3LfmIs4HZAmbATlNsnII379rNyo=";

  subPackages = [ "." ];

--- a/pkgs/by-name/li/libretroPackages/cores/puae.nix
+++ b/pkgs/by-name/li/libretroPackages/cores/puae.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore {
  core = "puae";
-  version = "0-unstable-2026-07-30";
+  version = "0-unstable-2026-09-01";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "libretro-uae";
-    rev = "96ebfcfc2c66233ad37f6dc99ee991211dc719ad";
-    hash = "sha256-bqqb1gSg4Y0TjB/oQmUBRK8ZeX7hHuVfbH6XfHv25yY=";
+    rev = "bc0c2b0ec64b81e368fa253f029e31247aeb66ac";
+    hash = "sha256-ExD4yQGc962HacOyok7L47KkpX3FjbXSjELOX6ti//g=";
  };

  makefile = "Makefile";
--- a/pkgs/by-name/mc/mcp-searxng/package.nix
+++ b/pkgs/by-name/mc/mcp-searxng/package.nix
@@ -0,0 +1,31 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "mcp-searxng";
+  version = "2.1.0";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchFromGitHub {
+    owner = "ihor-sokoliuk";
+    repo = "mcp-searxng";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-Zq6oKXxmo+jaiSCGOsEB76y4xTEqU+WC1eQVFzsazXQ=";
+  };
+
+  npmDepsHash = "sha256-YIH/5RIdF/iSnUT+rWFUCKiwn3oPr1GJsgYvriJt0co=";
+
+  meta = {
+    description = "Private web search for AI assistants via SearXNG — supports Claude, Cursor, and any MCP client";
+    homepage = "https://github.com/ihor-sokoliuk/mcp-searxng";
+    changelog = "https://github.com/ihor-sokoliuk/mcp-searxng/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ SuperSandro2000 ];
+    mainProgram = "mcp-searxng";
+  };
+})
--- a/pkgs/by-name/ne/netassert/package.nix
+++ b/pkgs/by-name/ne/netassert/package.nix
@@ -2,23 +2,25 @@
  lib,
  buildGoModule,
  fetchFromGitHub,
+  versionCheckHook,
 }:

 buildGoModule (finalAttrs: {
  pname = "netassert";
  version = "2.1.7";

+  __structuredAttrs = true;
+
  src = fetchFromGitHub {
    owner = "controlplaneio";
    repo = "netassert";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-ef4KRsbgqhYMSuddBBa9J5+FQ7mG1MtjVhqwE91v77A=";
  };
  vendorHash = "sha256-eathx5R8iYLNitpt7YHZz7xRs6u2hVBNskxAfphvQ40=";

  ldflags = [
    "-s"
-    "-w"
    "-X main.version=${finalAttrs.src.rev}"
  ];

@@ -26,6 +28,9 @@ buildGoModule (finalAttrs: {
    mv $GOPATH/bin/{cli,netassert}
  '';

+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
  meta = {
    homepage = "https://github.com/controlplaneio/netassert";
    changelog = "https://github.com/controlplaneio/netassert/blob/${finalAttrs.src.rev}/CHANGELOG.md";
--- a/pkgs/by-name/no/noctalia/package.nix
+++ b/pkgs/by-name/no/noctalia/package.nix
@@ -54,13 +54,13 @@ stdenv.mkDerivation (finalAttrs: {
  __structuredAttrs = true;

  pname = "noctalia";
-  version = "5.0.0-beta.10";
+  version = "5.0.1";

  src = fetchFromGitHub {
    owner = "noctalia-dev";
    repo = "noctalia";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-WijEuINvjcXMO/e/zMqwG1lyGiWNosnVt1QY+ko0Rw8=";
+    hash = "sha256-diS3b69rt/IqehH/8Tsd8/JEQmogVc1ml6FP+iTwBzg=";
  };

  strictDeps = true;
@@ -129,14 +129,7 @@ stdenv.mkDerivation (finalAttrs: {
      --prefix PATH : ${lib.makeBinPath [ gitMinimal ]}
  '';

-  # remove --version=unstable once 5.0.0 stable is released
-  passthru.updateScript = nix-update-script {
-    extraArgs = [
-      "--version=unstable"
-      "--version-regex"
-      "v(5\\..*)"
-    ];
-  };
+  passthru.updateScript = nix-update-script { };

  meta = {
    description = "Sleek, customizable desktop shell crafted for Wayland";
--- a/pkgs/by-name/no/node-core-utils/package.nix
+++ b/pkgs/by-name/no/node-core-utils/package.nix
@@ -9,16 +9,16 @@

 buildNpmPackage (finalAttrs: {
  pname = "node-core-utils";
-  version = "7.1.0";
+  version = "7.2.0";

  src = fetchFromGitHub {
    owner = "nodejs";
    repo = "node-core-utils";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-qNyBR4rRr9moRpy7iVObtnDLZwjJuUhrNuLlFrJ7+lE=";
+    hash = "sha256-ctM/vp5ZOwUMOc8c1nmXgcRA8lSqUTIX+0rFTa5PJ1o=";
  };

-  npmDepsHash = "sha256-uASahJmUBtm0k15MCixQpngmZnoBpie6+rj+UnJXtBc=";
+  npmDepsHash = "sha256-FEQZwEnOOv2X0F6UI3cvWduERVL1dH9hTdKeOfsGKCM=";

  dontNpmBuild = true;
  dontNpmPrune = true;
--- a/pkgs/by-name/oe/oelint-adv/package.nix
+++ b/pkgs/by-name/oe/oelint-adv/package.nix
@@ -7,14 +7,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "oelint-adv";
-  version = "9.11.0";
+  version = "9.11.2";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "priv-kweihmann";
    repo = "oelint-adv";
    tag = finalAttrs.version;
-    hash = "sha256-7B8R5EEiEvUg5ZYSstggx6D60w3ZCZMGifVhS2kydYk=";
+    hash = "sha256-iV/AOn8qy9e5z5PLbeZeeMfipKJ3ezOv61SXBT0iLeI=";
  };

  postPatch = ''
--- a/pkgs/by-name/op/opencloud-desktop/package.nix
+++ b/pkgs/by-name/op/opencloud-desktop/package.nix
@@ -12,12 +12,12 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "opencloud-desktop";
-  version = "3.0.3";
+  version = "4.0.0";
  src = fetchFromGitHub {
    owner = "opencloud-eu";
    repo = "desktop";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-b6KaWrthL2z/Ep+O7wFIXxjd+H8+sBqZz8nmoQijTQU=";
+    hash = "sha256-f8R/q6oyMpPBW3viWoWZeRVrcHYX46JiNIdvONdaqQQ=";
  };

  buildInputs = [
--- a/pkgs/development/libraries/openexr/disable-iex-test.patch
+++ b/pkgs/development/libraries/openexr/disable-iex-test.patch
--- a/pkgs/development/libraries/openexr/3.nix
+++ b/pkgs/development/libraries/openexr/3.nix
--- a/pkgs/by-name/op/openexrid-unstable/openexrid.patch
+++ b/pkgs/by-name/op/openexrid-unstable/openexrid.patch
@@ -1,35 +0,0 @@
-diff --git a/makefile b/makefile
-index 7a92771..31ef664 100644
--- a/makefile
-+++ b/makefile
-@@ -8,8 +8,8 @@ _openexrid:
- _openfx:
- 	make -C openfx
- 
-_test: _openexrid
-	make -C test
-+#_test: _openexrid
-+#	make -C test
- 
- clean:
- 	make -C openfx clean
-diff --git a/makefile.config b/makefile.config
-index 0c6cdfa..0166c4c 100644
--- a/makefile.config
-+++ b/makefile.config
-@@ -4,7 +4,7 @@
- 
- PREFIX ?= ~/openexrid
- 
-OFX_INCLUDE ?= /usr/include/openfx
-+OFX_INCLUDE ?= /usr/include/OpenFX
- EXR_INCLUDE ?= /usr/include/OpenEXR
- EXR_LIB ?= /usr/lib
- RE2_INCLUDE ?= /usr/include
-@@ -13,5 +13,5 @@ RE2_LIB ?= /usr/lib
- VERSION ?= release
- CPPFLAGS += -O3 -Wall -DNDEBUG -fPIC -I $(EXR_INCLUDE) -I $(OFX_INCLUDE) -I $(RE2_INCLUDE) -Dlinux
- LDFLAGS += -L$(EXR_LIB) -L$(RE2_LIB) -L../openexrid/$(VERSION) -lpthread
-LDFLAGS += -Wl,-Bstatic -lopenexrid -lIlmImf -lIlmThread -lIex -lImath -lHalf -lz -lre2 -Wl,-Bdynamic
-+LDFLAGS += -lopenexrid -lIlmImf -lIlmThread -lIex -lImath -lHalf -lz -lre2 -Wl,-Bdynamic
- 
--- a/pkgs/by-name/op/openexrid-unstable/package.nix
+++ b/pkgs/by-name/op/openexrid-unstable/package.nix
@@ -1,78 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  re2,
-  openfx,
-  zlib,
-  ilmbase,
-  libGLU,
-  libGL,
-  openexr,
-}:
-
-stdenv.mkDerivation {
-  pname = "openexrid-unstable";
-  version = "2017-09-17";
-
-  src = fetchFromGitHub {
-    owner = "MercenariesEngineering";
-    repo = "openexrid";
-    rev = "bec0081548a096f9bcdd1504970c96264b0fc050";
-    sha256 = "0h4b74lv59p4hhrvrqdmlnchn2i0v5id4kl8xc7j26l9884q0383";
-  };
-
-  outputs = [
-    "dev"
-    "out"
-    "lib"
-  ];
-
-  patches = [ ./openexrid.patch ];
-
-  postPatch = ''
-    substituteInPlace openexrid/makefile \
-        --replace g++ c++
-  '';
-
-  env.NIX_CFLAGS_COMPILE = ''
-    -I${ilmbase.dev}/include/OpenEXR
-    -I${openexr.dev}/include/OpenEXR
-    -I${openfx.dev}/include/OpenFX
-  '';
-
-  buildInputs = [
-    re2
-    openfx
-    zlib
-    ilmbase
-    libGLU
-    libGL
-    openexr
-  ];
-
-  enableParallelBuilding = true;
-
-  buildPhase = ''
-    mkdir openexrid/release
-
-    PREFIX=$out make -C openexrid install
-
-    mkdir $dev;
-    mkdir $lib;
-  '';
-
-  installPhase = ''
-    find $out
-    mv $out/include $dev/
-    mv $out/lib $lib/
-  '';
-
-  meta = {
-    description = "OpenEXR files able to isolate any object of a CG image with a perfect antialiazing";
-    homepage = "https://github.com/MercenariesEngineering/openexrid";
-    maintainers = [ lib.maintainers.guibou ];
-    platforms = lib.platforms.all;
-    license = lib.licenses.mit;
-  };
-}
--- a/pkgs/by-name/or/orbit/package.nix
+++ b/pkgs/by-name/or/orbit/package.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  undmg,
+  nix-update-script,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "orbit";
+  version = "1.6";
+
+  src = fetchurl {
+    url = "https://github.com/yuzeguitarist/Orbit/releases/download/v${finalAttrs.version}/Orbit.dmg";
+    hash = "sha256-5SHMfufwQgR5u008Ws4qNT5x5Owb4qCO+bKijnfu0YA=";
+  };
+
+  nativeBuildInputs = [ undmg ];
+
+  sourceRoot = ".";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/Applications
+    cp -r *.app $out/Applications
+
+    runHook postInstall
+  '';
+
+  dontBuild = true;
+  dontFixup = true;
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "A radial, gesture-first app switcher and file hub for macOS.";
+    homepage = "https://github.com/yuzeguitarist/Orbit";
+    changelog = "https://github.com/yuzeguitarist/Orbit/releases/tag/v${finalAttrs.version}";
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
+    platforms = lib.platforms.darwin;
+    license = lib.licenses.unfree;
+    maintainers = with lib.maintainers; [ myzel394 ];
+  };
+})
--- a/pkgs/by-name/pi/piper-tts/package.nix
+++ b/pkgs/by-name/pi/piper-tts/package.nix
@@ -10,9 +10,10 @@
  espeak-ng,

  # extras
-  withTrain ? true,
-  withHTTP ? true,
  withAlignment ? true,
+  withHTTP ? true,
+  withJapanese ? true,
+  withTrain ? true,
 }:

 let
@@ -81,11 +82,21 @@ python3Packages.buildPythonApplication rec {
      onnxruntime
      pathvalidate
    ]
-    ++ lib.optionals withTrain optional-dependencies.train
+    ++ lib.optionals withAlignment optional-dependencies.alignment
    ++ lib.optionals withHTTP optional-dependencies.http
-    ++ lib.optionals withAlignment optional-dependencies.alignment;
+    ++ lib.optionals withJapanese optional-dependencies.ja
+    ++ lib.optionals withTrain optional-dependencies.train;

  optional-dependencies = {
+    alignment = with python3Packages; [
+      onnx
+    ];
+    http = with python3Packages; [
+      flask
+    ];
+    ja = with python3Packages; [
+      pyopenjtalk-plus
+    ];
    train =
      with python3Packages;
      [
@@ -99,21 +110,12 @@ python3Packages.buildPythonApplication rec {
        torch
      ]
      ++ jsonargparse.optional-dependencies.signatures;
-    http = with python3Packages; [
-      flask
-    ];
-    alignment = with python3Packages; [
-      onnx
-    ];
    zh = with python3Packages; [
      # g2pw # not packaged
      transformers
      sentence-stream
      unicode-rbnf
    ];
-    ja = [
-      # pyopenjtalk-plus # not packaged
-    ];
  };

  postInstall = ''
--- a/pkgs/by-name/pr/prometheus-bird-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-bird-exporter/package.nix
@@ -7,7 +7,7 @@

 buildGoModule (finalAttrs: {
  pname = "bird-exporter";
-  version = "1.5.0";
+  version = "1.6.2";

  __structuredAttrs = true;

@@ -15,10 +15,10 @@ buildGoModule (finalAttrs: {
    owner = "czerwonk";
    repo = "bird_exporter";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-rSZFSIg17t1gcWYVHLEW54dSnqx889TC0R4UAZoBHMQ=";
+    hash = "sha256-V/ouf+NcJQhkSPYl5Ysisbs3cgOma8LlXezndDz36qw=";
  };

-  vendorHash = "sha256-anmrvgKfcuzky3tnniVvqdJs8SuJcJJStusVY3q9ago=";
+  vendorHash = "sha256-xNqLRIn5SkEo9L2p1ThlsNuTboz4dxyBw9hEpew5+V8=";

  passthru.tests = { inherit (nixosTests.prometheus-exporters) bird; };

--- a/pkgs/by-name/pr/prowler/package.nix
+++ b/pkgs/by-name/pr/prowler/package.nix
@@ -8,7 +8,7 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "prowler";
-  version = "5.40.0";
+  version = "5.41.0";
  pyproject = true;

  __structuredAttrs = true;
@@ -17,7 +17,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
    owner = "prowler-cloud";
    repo = "prowler";
    tag = finalAttrs.version;
-    hash = "sha256-FdRBdpboegT+oe6WPVXeRE1VcuA1FAgXbGUaBjfvlmA=";
+    hash = "sha256-aWGMdpQXwxDXqYpil+MjlIRTZ9/KzxPGPtJ3eLyiTIY=";
  };

  postPatch = ''
--- a/pkgs/by-name/ra/rapidsvn/package.nix
+++ b/pkgs/by-name/ra/rapidsvn/package.nix
@@ -1,56 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  autoreconfHook,
-  wxwidgets_3_2,
-  subversion,
-  apr,
-  aprutil,
-  python3,
-}:
-
-stdenv.mkDerivation {
-  pname = "rapidsvn";
-  version = "unstable-2021-08-02";
-
-  src = fetchFromGitHub {
-    owner = "RapidSVN";
-    repo = "RapidSVN";
-    rev = "3a564e071c3c792f5d733a9433b9765031f8eed0";
-    hash = "sha256-6bQTHAOZAP+06kZDHjDx9VnGm4vrZUDyLHZdTpiyP08=";
-  };
-
-  postPatch = ''
-    substituteInPlace configure.ac \
-      --replace "[3.0.*]" "[3.*]"
-  '';
-
-  nativeBuildInputs = [
-    autoreconfHook
-  ];
-
-  buildInputs = [
-    wxwidgets_3_2
-    subversion
-    apr
-    aprutil
-    python3
-  ];
-
-  configureFlags = [
-    "--with-svn-include=${subversion.dev}/include"
-    "--with-svn-lib=${subversion.out}/lib"
-  ];
-
-  env.NIX_CFLAGS_COMPILE = "-std=c++14";
-
-  meta = {
-    description = "Multi-platform GUI front-end for the Subversion revision system";
-    homepage = "http://rapidsvn.tigris.org/";
-    license = lib.licenses.gpl3Plus;
-    maintainers = [ ];
-    platforms = lib.platforms.unix;
-    mainProgram = "rapidsvn";
-  };
-}
--- a/pkgs/by-name/re/rebuilderd/package.nix
+++ b/pkgs/by-name/re/rebuilderd/package.nix
@@ -21,13 +21,13 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rebuilderd";
-  version = "0.27.0";
+  version = "0.28.0";

  src = fetchFromGitHub {
    owner = "kpcyrd";
    repo = "rebuilderd";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-f+WfmkV0P4VfaOXxX3t5t9g/uJYCh2A587HEq9OK5QU=";
+    hash = "sha256-ALYL407mWi8DCY+rLcURuPE1imPmcXfEFCn9ryp35Fo=";
  };

  postPatch = ''
@@ -41,7 +41,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
      --replace-fail '/bin/echo' 'echo'
  '';

-  cargoHash = "sha256-se5u7+SF3fW5WqdUA3qmztUw5oPa0YXbgOp9GIVOQu0=";
+  cargoHash = "sha256-2z7EfGwdSBaW8qhcPXrhknAkRRf8pH6D7kVRY4ZV1bg=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/re/redprl/package.nix
+++ b/pkgs/by-name/re/redprl/package.nix
@@ -1,43 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  mlton,
-}:
-
-stdenv.mkDerivation {
-  pname = "redprl";
-  version = "unstable-2019-11-04";
-
-  src = fetchFromGitHub {
-    owner = "RedPRL";
-    repo = "sml-redprl";
-    rev = "c72190de76f7ed1cfbe1d2046c96e99ac5022b0c";
-    fetchSubmodules = true;
-    hash = "sha256-xrQT5o0bsIN+mCYUOz9iY4+j3HGROb1I6R2ADcLy8n4=";
-  };
-
-  buildInputs = [ mlton ];
-
-  postPatch = ''
-    patchShebangs ./script/
-  '';
-
-  buildPhase = ''
-    ./script/mlton.sh
-  '';
-
-  installPhase = ''
-    mkdir -p $out/bin
-    mv ./bin/redprl $out/bin
-  '';
-
-  meta = {
-    description = "Proof assistant for Nominal Computational Type Theory";
-    mainProgram = "redprl";
-    homepage = "http://www.redprl.org/";
-    license = lib.licenses.mit;
-    maintainers = with lib.maintainers; [ acowley ];
-    platforms = lib.platforms.unix;
-  };
-}
--- a/pkgs/by-name/rs/rsyslog/package.nix
+++ b/pkgs/by-name/rs/rsyslog/package.nix
@@ -66,29 +66,19 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "rsyslog";
-  version = "8.2606.0";
+  version = "8.2608.0";

  src = fetchurl {
    url = "https://www.rsyslog.com/files/download/rsyslog/rsyslog-${finalAttrs.version}.tar.gz";
-    hash = "sha256-JXSz8waOaVXrlO9WQ+K2pbhYXMjqp3IJ/1y8Hi5fceU=";
+    hash = "sha256-49YMg0BSaMQi+V/ux0BFWhzEuRHQC9hCTV0ScrxQmxo=";
  };

  patches = [
-    # Remove with rsyslog 8.2608.0 or newer.
+    # Remove with the first rsyslog release containing this fix.
    (fetchpatch {
-      name = "CVE-2026-19654.patch";
-      url = "https://github.com/rsyslog/rsyslog/commit/f7f774228273730ba1075f4cd457ae78303a8f08.patch";
-      hash = "sha256-ww8Ade2eKrQygJduLMPFjxd/fmBnpQ4ePLEzHffPy90=";
-    })
-
-    # Fix imjournal invalidation reopen busy-loop.
-    # Remove with rsyslog 8.2608.0 or newer.
-    # https://github.com/rsyslog/rsyslog/pull/7384
-    (fetchpatch {
-      name = "imjournal-invalidation-reopen-busy-loop.patch";
-      url = "https://github.com/rsyslog/rsyslog/commit/383f80f21f16c3c94e7d7a57b0a5af12cdac9d75.patch";
-      excludes = [ "ChangeLog" ];
-      hash = "sha256-RlhXoK+dAPBN2wu4V7GoFw/d+uWQzO7+nUkW5+z7QJY=";
+      name = "CVE-2026-78002.patch";
+      url = "https://github.com/rsyslog/rsyslog/commit/667e3f61aec5ee02c5c2ee6f0f8accf6fe4301a9.patch";
+      hash = "sha256-QsxOJCvr6VBbLbXzednwgvCfisSvNm6zfxPaMFxXVT0=";
    })
  ];

--- a/pkgs/by-name/ru/ruri/package.nix
+++ b/pkgs/by-name/ru/ruri/package.nix
@@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ruri";
-  version = "3.9.3";
+  version = "3.9.5";

  src = fetchFromGitHub {
    owner = "RuriOSS";
    repo = "ruri";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-cFHbsaZwxu2ABAln5hGDSOib11M/1/4OeXz2EKXFlZI=";
+    hash = "sha256-eiljz0atD2lmgl4emoCw9xWsqm/cXP8QEj7AfcyHaSE=";
  };

  buildInputs = [
--- a/pkgs/by-name/sb/sbt/package.nix
+++ b/pkgs/by-name/sb/sbt/package.nix
@@ -25,11 +25,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "sbt";
-  version = "2.0.7";
+  version = "2.0.8";

  src = fetchurl {
    url = "https://github.com/sbt/sbt/releases/download/v${finalAttrs.version}/sbt-${finalAttrs.version}.tgz";
-    hash = "sha256-Q5RRUgckJTu/IvOjSwutk3nxjv+2WhF1XNi/cFt8IC8=";
+    hash = "sha256-QMKjF4bTaihvDZ6L/fURgeVAjE+Z6rhVVuK81eEuq0Q=";
  };

  # This is baked into conf/sbtopts below, so it is the JDK every sbt
--- a/pkgs/by-name/sh/shelfmark/package.nix
+++ b/pkgs/by-name/sh/shelfmark/package.nix
@@ -39,13 +39,13 @@ let
    h2
  ];

-  version = "1.3.11";
+  version = "1.3.15";

  src = fetchFromGitHub {
    owner = "calibrain";
    repo = "shelfmark";
    tag = "v${version}";
-    hash = "sha256-UECLBwwfDs1FZQOfidDkRelRnJT0ykCptiFRJL3iALM=";
+    hash = "sha256-TW02RyRSUMVTKP/PE7BTCHFZKHR8AB+rQ+NNuV1FUuE=";
  };

  frontend = buildNpmPackage (finalAttrs: {
@@ -54,7 +54,7 @@ let

    sourceRoot = "${finalAttrs.src.name}/src/frontend";

-    npmDepsHash = "sha256-XNXI1cCMaJCCBcoFyhDcG2ca7njVcrDtqvhUP85Ha/8=";
+    npmDepsHash = "sha256-93MKxyEA8zgay67Divp2LuFHPklqv8WMexmJ7yq4ckg=";

    installPhase = ''
      runHook preInstall
--- a/pkgs/by-name/st/stakk/package.nix
+++ b/pkgs/by-name/st/stakk/package.nix
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "stakk";
-  version = "2.2.1";
+  version = "2.5.0";

  src = fetchFromGitHub {
    owner = "glennib";
    repo = "stakk";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-PKmU1CE7Zf9lTSUdZYpchn8mNYN4ty8Rxd8FKgd82aY=";
+    hash = "sha256-4P1ZAwmpt9OJPz9h5DYEFWtWlLyxMXQI53T+1lP82X4=";
  };

-  cargoHash = "sha256-2jIyLk4yeaN1RBg+xq2VMKrINdU5MPpAQL6NP7Z9iy4=";
+  cargoHash = "sha256-ycQc9I2sYmchBK8hQAJCkB/GFSNUBp+/qX9Kt5tPPLY=";

  useNextest = true;

--- a/pkgs/by-name/st/stash-clipboard/package.nix
+++ b/pkgs/by-name/st/stash-clipboard/package.nix
@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "stash-clipboard";
-  version = "0.5.0";
+  version = "0.5.1";

  src = fetchFromGitHub {
    owner = "NotAShelf";
    repo = "stash";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-G31RXNllgbC5SqRMVj5L9/hCpsKuK/s4Byq+TT8a7X4=";
+    hash = "sha256-vB3fyaq8ca+y0ct0RQhFTZAVG/vgYXOd9kPocky/wmM=";
  };

-  cargoHash = "sha256-biKZ2qIAiNuvEuI8cJV2zuRXusuUlkd8MKq/M9J+FJs=";
+  cargoHash = "sha256-m5ra/XCWogrY3edfQfrvKFHKP7mEWWRNJPYC/phPeDA=";

  __structuredAttrs = true;

--- a/pkgs/by-name/ta/tailsnitch/package.nix
+++ b/pkgs/by-name/ta/tailsnitch/package.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "tailsnitch";
-  version = "1.5";
+  version = "1.6";

  src = fetchFromGitHub {
    owner = "Adversis";
    repo = "tailsnitch";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-5gS9IQfu525ZtNQ74WWLQoqfXPJ2clm3pCz+/Ujmr4Y=";
+    hash = "sha256-b0++CFdOvdD99jszz6KZl7tKxGM0vAajPH9FAN8EIi0=";
  };

-  vendorHash = "sha256-khw9K4sKhubhkccoC4f923Aw2Cj9eKpVqLHZICdkTXw=";
+  vendorHash = "sha256-4K3I714F6gIG26W1Z7CpBNIGiJVg2VNfBuUbEN1+R2E=";

  ldflags = [
    "-w"
--- a/pkgs/by-name/te/teams-for-linux/package.nix
+++ b/pkgs/by-name/te/teams-for-linux/package.nix
@@ -19,16 +19,16 @@ let
 in
 buildNpmPackage rec {
  pname = "teams-for-linux";
-  version = "2.17.1";
+  version = "2.18.1";

  src = fetchFromGitHub {
    owner = "IsmaelMartinez";
    repo = "teams-for-linux";
    tag = "v${version}";
-    hash = "sha256-qI8+QqnrkGmQGweMcfyaXQnjNMf4htJAF9Gk97zL9jg=";
+    hash = "sha256-dKTsilBu57Z8XcoyiviuOW/jfIqnbfiBZFl2hpvaiIc=";
  };

-  npmDepsHash = "sha256-wPHap85tS3JrN4ei/HRYyzwFfVFcPkBdbY5ViEk4bwE=";
+  npmDepsHash = "sha256-/1CPHy+gBVc79GYLAlfzSEOckM7UxyFblBQO9lZoMTw=";

  nativeBuildInputs = [
    makeWrapper
--- a/pkgs/by-name/tr/trufflehog/package.nix
+++ b/pkgs/by-name/tr/trufflehog/package.nix
@@ -8,16 +8,16 @@

 buildGoModule (finalAttrs: {
  pname = "trufflehog";
-  version = "3.97.1";
+  version = "3.97.2";

  src = fetchFromGitHub {
    owner = "trufflesecurity";
    repo = "trufflehog";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-0bXcmXNdbW/AUjtc7Hgwobtvn7egO4WDfWalWfmdKdE=";
+    hash = "sha256-/8QOjJuFB0+8+fbHmJTtVUQTIrX6Dt/8MF+jSOfOEIk=";
  };

-  vendorHash = "sha256-Yqvdvznu9T0aoJdE08gzy6BfwUicXJVYo0+ZeWrFmbw=";
+  vendorHash = "sha256-zzJ5zrksCaMjKMTFZOvaNAAmsPX30yasg6Ot6FjvihY=";

  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/by-name/ve/vermouth/package.nix
+++ b/pkgs/by-name/ve/vermouth/package.nix
@@ -13,7 +13,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "vermouth";
-  version = "2.0.2";
+  version = "2.0.3";

  __structuredAttrs = true;
  strictDeps = true;
@@ -22,7 +22,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "dekomote";
    repo = "vermouth";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-T/3HqDSGMR5HLp8QyLz46ULIZC2Lx7x2Ch113XN+s8Y=";
+    hash = "sha256-lRqXvp5PO+0tl7PxJZ/7TET1mZgv8A/E2lTQD+0K0Hc=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ve/versatiles/package.nix
+++ b/pkgs/by-name/ve/versatiles/package.nix
@@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "versatiles";
-  version = "4.9.1";
+  version = "4.12.2";

  src = fetchFromGitHub {
    owner = "versatiles-org";
    repo = "versatiles-rs";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-WPn96f9wN1p0uDtWzOQVx5fqBwKM1l93dVwNSReBkwc=";
+    hash = "sha256-4qG+jveFcVnKwkwlp9zEdXVT6zTZEfiwDPGAAYXrKVY=";
  };

-  cargoHash = "sha256-WFUIIjb+bXq/Sz7tTI2Z5Fyqrnjac0F3fVNTxCQeUT0=";
+  cargoHash = "sha256-AnCLHBy1LbKvMY/H/tABVkzHedclEQ1PQuxqaN2JtE8=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/ya/yazi/plugins/mediainfo/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/mediainfo/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
  pname = "mediainfo.yazi";
-  version = "0-unstable-2026-08-23";
+  version = "0-unstable-2026-08-31";

  src = fetchFromGitHub {
    owner = "boydaihungst";
    repo = "mediainfo.yazi";
-    rev = "73a36587bd896a20a0c84c0b79b341a0cb7e7b92";
-    hash = "sha256-cdIVIqVxsr+V1I/pqAhr2dxfujTL/de7DFTAOd2jfUk=";
+    rev = "d2dd310bfbc3a819acf1c9c9c32f402ab6774d3a";
+    hash = "sha256-nmhn2lcs5F+MRlmqBPbsU74NNiO0Y0Js4YEjRfD9IPE=";
  };

  meta = {
--- a/pkgs/by-name/ya/yazi/plugins/yafg/default.nix
+++ b/pkgs/by-name/ya/yazi/plugins/yafg/default.nix
@@ -5,13 +5,13 @@
 }:
 mkYaziPlugin {
  pname = "yafg.yazi";
-  version = "0-unstable-2026-05-06";
+  version = "0-unstable-2026-09-01";

  src = fetchFromGitHub {
    owner = "XYenon";
    repo = "yafg.yazi";
-    rev = "e6ba85125bfa4e3a60ef28b70949299712103b2a";
-    hash = "sha256-IKQscTTirtfbsXKzCmaokPDrQZqXa4MSY2+6DbEQluU=";
+    rev = "bd03a32e7de7c718c966e21f800c23bd26b717cb";
+    hash = "sha256-8LKyY0GpvcOlWavcaWKfvh/nQzcHMrnLeoStRGHCXrk=";
  };

  meta = {
--- a/pkgs/development/compilers/jetbrains-jdk/common.nix
+++ b/pkgs/development/compilers/jetbrains-jdk/common.nix
@@ -223,11 +223,11 @@ jdk.overrideAttrs (oldAttrs: {
      your own risk.
    '';
    homepage = "https://confluence.jetbrains.com/display/JBR/JetBrains+Runtime";
-    inherit (jdk.meta) license platforms mainProgram;
+    inherit (jdk.meta) license mainProgram;
    maintainers = with lib.maintainers; [
      aoli-al
    ];

-    broken = stdenv.hostPlatform.isDarwin;
+    platforms = lib.platforms.linux;
  };
 })
--- a/pkgs/development/cuda-modules/packages/cudnn-frontend/package.nix
+++ b/pkgs/development/cuda-modules/packages/cudnn-frontend/package.nix
@@ -35,13 +35,13 @@ backendStdenv.mkDerivation (finalAttrs: {
  name = "${cudaNamePrefix}-${finalAttrs.pname}-${finalAttrs.version}";

  pname = "cudnn-frontend";
-  version = "1.27.0";
+  version = "1.28.0";

  src = fetchFromGitHub {
    owner = "NVIDIA";
    repo = "cudnn-frontend";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-4KDxORr6vJRgJKYrooIILaWMWkGF6ZDuti1QtrzYTfA=";
+    hash = "sha256-oMsXgbLHhCnU+Q7bItzAPAN0U8LL4ZZCuXJwFKbJpEg=";
  };

  # nlohmann_json should be the only vendored dependency.
--- a/pkgs/development/libraries/openexr/2.nix
+++ b/pkgs/development/libraries/openexr/2.nix
@@ -1,103 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  zlib,
-  ilmbase,
-  fetchpatch,
-  cmake,
-  ctestCheckHook,
-}:
-
-stdenv.mkDerivation rec {
-  pname = "openexr";
-  version = "2.5.10";
-
-  outputs = [
-    "bin"
-    "dev"
-    "out"
-    "doc"
-  ];
-
-  src = fetchFromGitHub {
-    owner = "AcademySoftwareFoundation";
-    repo = "openexr";
-    rev = "v${version}";
-    hash = "sha256-xdC+T79ZQBx/XhuIXtP93Roj0N9lF+E65ReEKQ4kIsg=";
-  };
-
-  patches = [
-    (fetchpatch {
-      name = "CVE-2021-45942.patch";
-      url = "https://github.com/AcademySoftwareFoundation/openexr/commit/11cad77da87c4fa2aab7d58dd5339e254db7937e.patch";
-      stripLen = 4;
-      extraPrefix = "OpenEXR/IlmImf/";
-      sha256 = "1wa2jn6sa0n3phaqvklnlbgk1bz60y756ad4jk4d757pzpnannsy";
-    })
-    (fetchpatch {
-      name = "CVE-2021-3933.patch";
-      url = "https://github.com/AcademySoftwareFoundation/openexr/commit/5db6f7aee79e3e75e8c3780b18b28699614dd08e.patch";
-      stripLen = 4;
-      extraPrefix = "OpenEXR/IlmImf/";
-      sha256 = "sha256-DrpldpNgN5pWKzIuuPIrynGX3EpP8YhJlu+lLfNFGxQ=";
-    })
-
-    # GCC 13 fixes
-    ./gcc-13.patch
-  ];
-
-  postPatch = ''
-    # tests are determined to use /var/tmp on unix
-    find . -name tmpDir.h | while read -r f ; do
-      substituteInPlace $f --replace '/var/tmp' "$TMPDIR"
-    done
-    # On slower machines this test can take more than the default 1500 seconds
-    echo 'set_tests_properties(OpenEXR.IlmImf PROPERTIES TIMEOUT 3000)' >> OpenEXR/IlmImfTest/CMakeLists.txt
-  '';
-
-  cmakeFlags = [
-    "-DCMAKE_CTEST_ARGUMENTS=--timeout;3600"
-  ]
-  ++ lib.optional stdenv.hostPlatform.isStatic "-DCMAKE_SKIP_RPATH=ON";
-
-  nativeBuildInputs = [ cmake ];
-  nativeCheckInputs = [
-    ctestCheckHook
-  ];
-  propagatedBuildInputs = [
-    ilmbase
-    zlib
-  ];
-
-  # https://github.com/AcademySoftwareFoundation/openexr/issues/1400
-  # https://github.com/AcademySoftwareFoundation/openexr/issues/1281
-  doCheck = !stdenv.hostPlatform.isAarch32 && !stdenv.hostPlatform.isi686;
-
-  disabledTests = lib.optionals (stdenv.hostPlatform.isPower64 && stdenv.hostPlatform.isBigEndian) [
-    # https://github.com/AcademySoftwareFoundation/openexr/issues/222
-    "OpenEXR.IlmImf"
-  ];
-
-  meta = {
-    description = "High dynamic-range (HDR) image file format";
-    homepage = "https://www.openexr.com/";
-    license = lib.licenses.bsd3;
-    platforms = lib.platforms.all;
-    knownVulnerabilities = [
-      "CVE-2021-3598: ImfDeepScanLineInputFile Out-of-Bounds Read"
-      "CVE-2021-3605: rleUncompress Out-of-Bounds Read"
-      "CVE-2021-3933: Integer Overflow Vulnerability in File Processing on 32-bit Systems"
-      "CVE-2021-23169: copyIntoFrameBuffer Heap Buffer Overflow Leading to Arbitrary Code Execution"
-      "CVE-2021-23215: DwaCompressor Integer Overflow Leads to Heap Buffer Overflow"
-      "CVE-2021-26260: DwaCompressor Integer Overflow Leading to Heap Buffer Overflow"
-      "CVE-2021-26945: Integer Overflow Leading to Heap Buffer Overflow"
-      "CVE-2023-5841: Heap Overflow in Scanline Deep Data Parsing"
-      "CVE-2024-31047: convert Function Denial of Service"
-      "CVE-2025-12495: EXR File Parsing Heap-based Buffer Overflow Remote Code Execution"
-      "CVE-2025-12839: EXR File Parsing Heap-based Buffer Overflow Remote Code Execution"
-      "CVE-2025-12840: EXR File Parsing Heap-based Buffer Overflow Remote Code Execution"
-      "CVE-2026-27622: CompositeDeepScanLine integer-overflow leads to heap OOB write"
-    ];
-  };
-}
--- a/pkgs/development/libraries/openexr/gcc-13.patch
+++ b/pkgs/development/libraries/openexr/gcc-13.patch
@@ -1,25 +0,0 @@
-From 8aa103fe6e815514990e59708468eabc36f7f332 Mon Sep 17 00:00:00 2001
-From: =?UTF-8?q?=C3=A9clairevoyant?=
- <848000+eclairevoyant@users.noreply.github.com>
-Date: Fri, 5 Jan 2024 18:12:16 -0500
-Subject: [PATCH] gcc13
-
---
- OpenEXR/IlmImf/ImfTiledMisc.cpp | 1 +
- 1 file changed, 1 insertion(+)
-
-diff --git a/OpenEXR/IlmImf/ImfTiledMisc.cpp b/OpenEXR/IlmImf/ImfTiledMisc.cpp
-index 06ea3144..749537d4 100644
--- a/OpenEXR/IlmImf/ImfTiledMisc.cpp
-+++ b/OpenEXR/IlmImf/ImfTiledMisc.cpp
-@@ -46,6 +46,7 @@
- #include <ImfTileDescription.h>
- #include <algorithm>
- #include <limits>
-+#include <cstdint>
- 
- #include "ImfNamespace.h"
- 
-- 
-2.42.0
-
--- a/pkgs/development/python-modules/drf-spectacular-sidecar/default.nix
+++ b/pkgs/development/python-modules/drf-spectacular-sidecar/default.nix
@@ -6,16 +6,16 @@
  setuptools,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "drf-spectacular-sidecar";
-  version = "2026.8.1";
+  version = "2026.9.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "tfranzel";
    repo = "drf-spectacular-sidecar";
-    tag = version;
-    hash = "sha256-bH/0W+LZeC9zlqpJyXEfRPqhQhOdOktzf/1XOhtMbL4=";
+    tag = finalAttrs.version;
+    hash = "sha256-fjrXNUR2IyMrK2ZmaxbSkjCSfoIr82x6y83OxZQFD4k=";
  };

  build-system = [ setuptools ];
@@ -33,4 +33,4 @@ buildPythonPackage rec {
    license = lib.licenses.bsd3;
    maintainers = [ ];
  };
-}
+})
--- a/pkgs/development/python-modules/fastcore/default.nix
+++ b/pkgs/development/python-modules/fastcore/default.nix
@@ -8,14 +8,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "fastcore";
-  version = "2.2.13";
+  version = "2.2.16";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "fastai";
    repo = "fastcore";
    tag = finalAttrs.version;
-    hash = "sha256-m+LCtC80uBAPv2LYhYcMFkI7ZJ6y32BinoiABpmKykM=";
+    hash = "sha256-MWQl2O5NqxVzWcCU9dewUdh6iT8zFSMDZey/YogJBik=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/fasttransport/default.nix
+++ b/pkgs/development/python-modules/fasttransport/default.nix
@@ -11,7 +11,7 @@

 buildPythonPackage (finalAttrs: {
  pname = "fasttransport";
-  version = "0.0.2";
+  version = "0.0.4";
  pyproject = true;

  __structuredAttrs = true;
@@ -20,7 +20,7 @@ buildPythonPackage (finalAttrs: {
    owner = "AnswerDotAI";
    repo = "fasttransport";
    tag = finalAttrs.version;
-    hash = "sha256-Vc3RFhIDd/P5lR3+UmyQjzNxsxoHXv3PvapInBfpszk=";
+    hash = "sha256-t0Kc/w6BTQ1l3esnGam0sY1m3/W6C00ruYsmIfNwaWA=";
  };

  build-system = [
--- a/pkgs/development/python-modules/ghapi/default.nix
+++ b/pkgs/development/python-modules/ghapi/default.nix
@@ -10,14 +10,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "ghapi";
-  version = "2.1.2";
+  version = "2.1.3";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "fastai";
    repo = "ghapi";
    tag = finalAttrs.version;
-    hash = "sha256-o54xFz7AgTGbsI7OSjXx3d/Prv8OPKPBRNSpK6kCrIY=";
+    hash = "sha256-3FTAs/gZjLPZPKrB3SVEKWpwTXfkDiehkapEAbR1jZM=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/ha-iotawattpy/default.nix
+++ b/pkgs/development/python-modules/ha-iotawattpy/default.nix
@@ -12,14 +12,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "ha-iotawattpy";
-  version = "0.2.1";
+  version = "0.3.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "home-assistant-libs";
    repo = "iotawattpy";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-yPWQisSBeAGx5bTCXq6HeJmH06Frk7zlP+9kpoOHTOo=";
+    hash = "sha256-7fXnl1ao/UANhV0P2iz8BE9qK7OUXBsdotnlxSNr/7I=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/huaweicloudsdk/default.nix
+++ b/pkgs/development/python-modules/huaweicloudsdk/default.nix
@@ -11,14 +11,14 @@ let
    serviceName:
    buildPythonPackage (finalAttrs: {
      pname = "huaweicloudsdk${serviceName}";
-      version = "3.1.211";
+      version = "3.1.212";
      pyproject = true;

      src = fetchFromGitHub {
        owner = "huaweicloud";
        repo = "huaweicloud-sdk-python-v3";
        tag = "v${finalAttrs.version}";
-        hash = "sha256-UcuWHYMnsgxMbB/RcBZkZYbRzZYEPP8Q8Ccur7iWrZk=";
+        hash = "sha256-/JqI+0KYcBx8nJ+6TkNWNGCrZM5W7YxFAX+Mrg62fas=";
      };

      sourceRoot = "${finalAttrs.src.name}/huaweicloud-sdk-${serviceName}";
@@ -91,7 +91,6 @@ in
  huaweicloudsdkcodeartsrepo = buildHuaweiCloudSdkPackage "codeartsrepo";
  huaweicloudsdkcodecraft = buildHuaweiCloudSdkPackage "codecraft";
  huaweicloudsdkconfig = buildHuaweiCloudSdkPackage "config";
-  huaweicloudsdkcore = buildHuaweiCloudSdkPackage "core";
  huaweicloudsdkcpcs = buildHuaweiCloudSdkPackage "cpcs";
  huaweicloudsdkcph = buildHuaweiCloudSdkPackage "cph";
  huaweicloudsdkcpts = buildHuaweiCloudSdkPackage "cpts";
--- a/pkgs/development/python-modules/huaweicloudsdkcore/default.nix
+++ b/pkgs/development/python-modules/huaweicloudsdkcore/default.nix
@@ -15,14 +15,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "huaweicloudsdkcore";
-  version = "3.1.211";
+  version = "3.1.212";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "huaweicloud";
    repo = "huaweicloud-sdk-python-v3";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-UcuWHYMnsgxMbB/RcBZkZYbRzZYEPP8Q8Ccur7iWrZk=";
+    hash = "sha256-/JqI+0KYcBx8nJ+6TkNWNGCrZM5W7YxFAX+Mrg62fas=";
  };

  sourceRoot = "${finalAttrs.src.name}/huaweicloud-sdk-core";
--- a/pkgs/development/python-modules/hwdata/default.nix
+++ b/pkgs/development/python-modules/hwdata/default.nix
@@ -20,8 +20,11 @@ buildPythonPackage rec {

  nativeBuildInputs = [ setuptools ];

-  patchPhase = ''
-    substituteInPlace hwdata.py --replace "/usr/share/hwdata" "${pkgs.hwdata}/share/hwdata"
+  postPatch = ''
+    substituteInPlace setup.py \
+      --replace-fail "2.4.3" "2.4.3-1"
+    substituteInPlace hwdata.py \
+      --replace-fail "/usr/share/hwdata" "${pkgs.hwdata}/share/hwdata"
  '';

  pythonImportsCheck = [ "hwdata" ];
--- a/pkgs/development/python-modules/iamdata/default.nix
+++ b/pkgs/development/python-modules/iamdata/default.nix
@@ -8,14 +8,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "iamdata";
-  version = "0.1.202609021";
+  version = "0.1.202609031";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "cloud-copilot";
    repo = "iam-data-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-9br8Zd1dHZ9BzEULjl4zddgkJgYeIeY1ooB1fLtbZFI=";
+    hash = "sha256-bcoZunL72CNZB/xP55o5I8/S5ZZrYmgLHiSIzaXFOio=";
  };

  __darwinAllowLocalNetworking = true;
--- a/Show More
+++ b/Show More