From f6eb2cc890cae8e64d9f7aa15b8f922d08700760 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 4 Dec 2025 06:45:56 +0000
Subject: [PATCH 01/35] python3Packages.urwid: 3.0.3 -> 3.0.4

---
 pkgs/development/python-modules/urwid/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/urwid/default.nix b/pkgs/development/python-modules/urwid/default.nix
index 9b79dce6a1fb..388de583719c 100644
--- a/pkgs/development/python-modules/urwid/default.nix
+++ b/pkgs/development/python-modules/urwid/default.nix
@@ -19,14 +19,14 @@
 
 buildPythonPackage rec {
   pname = "urwid";
-  version = "3.0.3";
+  version = "3.0.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "urwid";
     repo = "urwid";
     tag = version;
-    hash = "sha256-+bvtIjSKWhu1JzyIgM60YZtrzNEaAvVqJrhq8PnkXk0=";
+    hash = "sha256-mKBLAoEBiqr//1Gl8DAmpUJ9woq6Zf2HhbYEirAoi2M=";
   };
 
   postPatch = ''

From c595f3c127c7a9e048973a322957f92d01f8b556 Mon Sep 17 00:00:00 2001
From: janhencic <jan@hencic.com>
Date: Sat, 24 Jan 2026 21:45:36 +0000
Subject: [PATCH 02/35] maintainers: add janhencic

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 413061ab2dfa..4cdd3651ca0e 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -11738,6 +11738,12 @@
     githubId = 1358764;
     name = "Jamie Magee";
   };
+  janhencic = {
+    name = "Jan Hencic";
+    email = "jan@hencic.com";
+    github = "janhencic";
+    githubId = 61284133;
+  };
   jankaifer = {
     name = "Jan Kaifer";
     email = "jan@kaifer.cz";

From a99c07da98a44b3a1853d889ba30cd7e2650f626 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 1 Feb 2026 22:06:36 +0000
Subject: [PATCH 03/35] unityhub: 3.15.4 -> 3.16.1

---
 pkgs/by-name/un/unityhub/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/un/unityhub/package.nix b/pkgs/by-name/un/unityhub/package.nix
index 1836ab96b8af..8cca1d00f1c2 100644
--- a/pkgs/by-name/un/unityhub/package.nix
+++ b/pkgs/by-name/un/unityhub/package.nix
@@ -11,11 +11,11 @@
 
 stdenv.mkDerivation rec {
   pname = "unityhub";
-  version = "3.15.4";
+  version = "3.16.1";
 
   src = fetchurl {
     url = "https://hub-dist.unity3d.com/artifactory/hub-debian-prod-local/pool/main/u/unity/unityhub_amd64/UnityHubSetup-${version}-amd64.deb";
-    hash = "sha256-O8rR4gLToJgUe8EsTvsk1AShGAAsgU4cy1+UITXiVm8=";
+    hash = "sha256-C21G9bbm6z/JSPb9zqJRnpqlJB+W3Y33tbEGFZIIlTc=";
   };
 
   nativeBuildInputs = [

From 4067c42823bedc8eb00279ae278c4859d8ea84ea Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 3 Feb 2026 04:11:41 +0000
Subject: [PATCH 04/35] kodiPackages.youtube: 7.4.0 -> 7.4.0.1

---
 pkgs/applications/video/kodi/addons/youtube/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/video/kodi/addons/youtube/default.nix b/pkgs/applications/video/kodi/addons/youtube/default.nix
index 65a25fb06dfa..ae3566402649 100644
--- a/pkgs/applications/video/kodi/addons/youtube/default.nix
+++ b/pkgs/applications/video/kodi/addons/youtube/default.nix
@@ -10,13 +10,13 @@
 buildKodiAddon rec {
   pname = "youtube";
   namespace = "plugin.video.youtube";
-  version = "7.4.0";
+  version = "7.4.0.1";
 
   src = fetchFromGitHub {
     owner = "anxdpanic";
     repo = "plugin.video.youtube";
     rev = "v${version}";
-    hash = "sha256-IEfgpl/uuELQ+4dVqek7/iCHW+sooVZ5eiASNXnm5EA=";
+    hash = "sha256-8cWwsaF37tVfj3ATWVn9r2UMwQa4SZiXL3x8GW67EfE=";
   };
 
   propagatedBuildInputs = [

From 77bf9b15d5eaa475e50a9d6a6885af0e2cd9e68f Mon Sep 17 00:00:00 2001
From: Bruno Bigras <24027+bbigras@users.noreply.github.com>
Date: Wed, 4 Feb 2026 22:51:23 -0500
Subject: [PATCH 05/35] tmuxPlugins.fingers: 2.5.1 -> 2.6.1

---
 pkgs/misc/tmux-plugins/tmux-fingers/default.nix |  4 ++--
 pkgs/misc/tmux-plugins/tmux-fingers/fix.patch   | 15 +++++++++++----
 2 files changed, 13 insertions(+), 6 deletions(-)

diff --git a/pkgs/misc/tmux-plugins/tmux-fingers/default.nix b/pkgs/misc/tmux-plugins/tmux-fingers/default.nix
index 97a665c3b04a..352ec9b22685 100644
--- a/pkgs/misc/tmux-plugins/tmux-fingers/default.nix
+++ b/pkgs/misc/tmux-plugins/tmux-fingers/default.nix
@@ -7,13 +7,13 @@
 let
   fingers = crystal.buildCrystalPackage rec {
     format = "shards";
-    version = "2.5.1";
+    version = "2.6.1";
     pname = "fingers";
     src = fetchFromGitHub {
       owner = "Morantron";
       repo = "tmux-fingers";
       rev = "${version}";
-      sha256 = "sha256-O5CfboFnl51OeOgqI2NB3MmELDeKykd5NO2d5FGXkII=";
+      sha256 = "sha256-f18y4Jq5Ab/5KZKv8woMTkFGEY2/f5KeRH0sf6R1l1U=";
     };
 
     shardsFile = ./shards.nix;
diff --git a/pkgs/misc/tmux-plugins/tmux-fingers/fix.patch b/pkgs/misc/tmux-plugins/tmux-fingers/fix.patch
index 34014441ebf9..2cad0ea1ed67 100644
--- a/pkgs/misc/tmux-plugins/tmux-fingers/fix.patch
+++ b/pkgs/misc/tmux-plugins/tmux-fingers/fix.patch
@@ -1,8 +1,8 @@
 diff --git a/tmux-fingers.tmux b/tmux-fingers.tmux
-index f15b509..a14e312 100755
+index c62915a..eb065e7 100755
 --- a/tmux-fingers.tmux
 +++ b/tmux-fingers.tmux
-@@ -1,35 +1,4 @@
+@@ -1,36 +1,5 @@
  #!/usr/bin/env bash
  
 -CURRENT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
@@ -36,6 +36,13 @@ index f15b509..a14e312 100755
 -  fi
 -fi
 -
--tmux run "$FINGERS_BINARY load-config"
-+tmux run "@tmuxFingersDir@/tmux-fingers load-config"
+ if [[ "$TERM" == "dumb" ]]; then
+   # force term value to get proper colors in systemd and tmux 3.6a
+   # https://github.com/Morantron/tmux-fingers/issues/143
+@@ -39,5 +8,5 @@ else
+   FINGERS_TERM="$TERM"
+ fi
+ 
+-tmux run "TERM=$FINGERS_TERM $FINGERS_BINARY load-config"
++tmux run "TERM=$FINGERS_TERM @tmuxFingersDir@/tmux-fingers load-config"
  exit $?

From 9a57fc3b608a56e616d90380511f916b88d096b6 Mon Sep 17 00:00:00 2001
From: Malik <abdelmalik.najhi@stud.hs-kempten.de>
Date: Wed, 4 Feb 2026 14:01:27 +0100
Subject: [PATCH 06/35] Crush: 0.36.0 -> 0.39.2

---
 pkgs/by-name/cr/crush/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/cr/crush/package.nix b/pkgs/by-name/cr/crush/package.nix
index 3f2b9a2f8a32..7175f27d524e 100644
--- a/pkgs/by-name/cr/crush/package.nix
+++ b/pkgs/by-name/cr/crush/package.nix
@@ -9,16 +9,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "crush";
-  version = "0.36.0";
+  version = "0.39.2";
 
   src = fetchFromGitHub {
     owner = "charmbracelet";
     repo = "crush";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-xitCvejiVts9kkvtcVwh/zaeWIzDj0jx9xQMh2h+9Ns=";
+    hash = "sha256-2Y9hxrqFQmKR6BaKP0fHTW5h5P8bnlyCKL/vy1ZqsOE=";
   };
 
-  vendorHash = "sha256-8Tw+O57E5aKFO2bKimiXRK9tGnAAQr3qsuP6P9LgBjw=";
+  vendorHash = "sha256-Y7QterJ5Mmjg/kMqFGbeSvd+3UwG8uGFTrdIBET5yRI=";
 
   ldflags = [
     "-s"

From 193deb853344a1381bcf7fe077f48b0847eb3a62 Mon Sep 17 00:00:00 2001
From: Silvan Mosberger <silvan.mosberger@moduscreate.com>
Date: Fri, 31 Oct 2025 23:40:20 +0100
Subject: [PATCH 07/35] ci: First-class team package maintainer review requests

Co-Authored-By: Alexander Bantyev <alexander.bantyev@tweag.io>
---
 ci/eval/compare/default.nix        |  14 ++-
 ci/eval/compare/maintainers.nix    |  53 +++++---
 ci/github-script/bot.js            |  88 +++++++++++--
 ci/github-script/merge.js          |   2 +-
 ci/github-script/reviewers.js      | 190 +++++++++++++++++------------
 pkgs/stdenv/generic/check-meta.nix |   5 +
 6 files changed, 243 insertions(+), 109 deletions(-)

diff --git a/ci/eval/compare/default.nix b/ci/eval/compare/default.nix
index 9791d26e9550..f1473367a7d9 100644
--- a/ci/eval/compare/default.nix
+++ b/ci/eval/compare/default.nix
@@ -161,12 +161,13 @@ let
     );
 
   inherit
-    (callPackage ./maintainers.nix { } {
+    (callPackage ./maintainers.nix {
       changedattrs = lib.attrNames (lib.groupBy (a: a.name) changedPackagePlatformAttrs);
       changedpathsjson = touchedFilesJson;
       removedattrs = lib.attrNames (lib.groupBy (a: a.name) removedPackagePlatformAttrs);
     })
-    maintainers
+    users
+    teams
     packages
     ;
 in
@@ -178,10 +179,12 @@ runCommand "compare"
       cmp-stats
       codeowners
     ];
-    maintainers = builtins.toJSON maintainers;
+    users = builtins.toJSON users;
+    teams = builtins.toJSON teams;
     packages = builtins.toJSON packages;
     passAsFile = [
-      "maintainers"
+      "users"
+      "teams"
       "packages"
     ];
   }
@@ -262,6 +265,7 @@ runCommand "compare"
 
     done
 
-    cp "$maintainersPath" "$out/maintainers.json"
+    cp "$usersPath" "$out/maintainers.json"
+    cp "$teamsPath" "$out/teams.json"
     cp "$packagesPath" "$out/packages.json"
   ''
diff --git a/ci/eval/compare/maintainers.nix b/ci/eval/compare/maintainers.nix
index 6eb983c9c5f6..a0180e10f193 100644
--- a/ci/eval/compare/maintainers.nix
+++ b/ci/eval/compare/maintainers.nix
@@ -1,7 +1,5 @@
 {
   lib,
-}:
-{
   changedattrs,
   changedpathsjson,
   removedattrs,
@@ -51,15 +49,16 @@ let
         # updates to .json files.
         # TODO: Support by-name package sets.
         filenames = lib.optional (lib.length path == 1) "pkgs/by-name/${sharded (lib.head path)}/";
-        # TODO: Refactor this so we can ping entire teams instead of the individual members.
-        # Note that this will require keeping track of GH team IDs in "maintainers/teams.nix".
-        maintainers = package.meta.maintainers or [ ];
+        # meta.maintainers also contains all individual team members.
+        # We only want to ping individuals if they're added individually as maintainers, not via teams.
+        users = package.meta.nonTeamMaintainers or [ ];
+        teams = package.meta.teams or [ ];
       }
     ))
     # No need to match up packages without maintainers with their files.
     # This also filters out attributes where `packge = null`, which is the
     # case for libintl, for example.
-    (lib.filter (pkg: pkg.maintainers != [ ]))
+    (lib.filter (pkg: pkg.users != [ ] || pkg.teams != [ ]))
   ];
 
   relevantFilenames =
@@ -94,20 +93,44 @@ let
 
   attrsWithModifiedFiles = lib.filter (pkg: anyMatchingFiles pkg.filenames) attrsWithFilenames;
 
-  listToPing = lib.concatMap (
+  userPings =
     pkg:
     map (maintainer: {
-      id = maintainer.githubId;
-      inherit (maintainer) github;
+      type = "user";
+      userId = maintainer.githubId;
       packageName = pkg.name;
-      dueToFiles = pkg.filenames;
-    }) pkg.maintainers
+    });
+
+  teamPings =
+    pkg: team:
+    if team ? github then
+      [
+        {
+          type = "team";
+          teamId = team.githubId;
+          packageName = pkg.name;
+        }
+      ]
+    else
+      userPings pkg team.members;
+
+  maintainersToPing = lib.concatMap (
+    pkg: userPings pkg pkg.users ++ lib.concatMap (teamPings pkg) pkg.teams
   ) attrsWithModifiedFiles;
 
-  byMaintainer = lib.groupBy (ping: toString ping.id) listToPing;
+  byType = lib.groupBy (ping: ping.type) maintainersToPing;
+
+  byUser = lib.pipe (byType.user or [ ]) [
+    (lib.groupBy (ping: toString ping.userId))
+    (lib.mapAttrs (_user: lib.map (pkg: pkg.packageName)))
+  ];
+  byTeam = lib.pipe (byType.team or [ ]) [
+    (lib.groupBy (ping: toString ping.teamId))
+    (lib.mapAttrs (_team: lib.map (pkg: pkg.packageName)))
+  ];
 in
 {
-  maintainers = lib.mapAttrs (_: lib.catAttrs "packageName") byMaintainer;
-
-  packages = lib.catAttrs "packageName" listToPing;
+  users = byUser;
+  teams = byTeam;
+  packages = lib.catAttrs "name" attrsWithModifiedFiles;
 }
diff --git a/ci/github-script/bot.js b/ci/github-script/bot.js
index f0155e8edd1c..8cfc7c20df56 100644
--- a/ci/github-script/bot.js
+++ b/ci/github-script/bot.js
@@ -143,6 +143,29 @@ module.exports = async ({ github, context, core, dry }) => {
     return users[id]
   }
 
+  // Same for teams
+  const teams = {}
+  function getTeam(id) {
+    if (!teams[id]) {
+      teams[id] = github
+        .request({
+          method: 'GET',
+          url: '/organizations/{orgId}/team/{id}',
+          // TODO: Make this work without pull_requests payloads
+          orgId: context.payload.pull_request.base.user.id,
+          id,
+        })
+        .then((resp) => resp.data)
+        .catch((e) => {
+          // Team may have been deleted
+          if (e.status === 404) return null
+          throw e
+        })
+    }
+
+    return teams[id]
+  }
+
   async function handlePullRequest({ item, stats, events }) {
     const log = (k, v) => core.info(`PR #${item.number} - ${k}: ${v}`)
 
@@ -175,17 +198,49 @@ module.exports = async ({ github, context, core, dry }) => {
     })
 
     // Check for any human reviews other than the PR author, GitHub actions and other GitHub apps.
-    // Accounts could be deleted as well, so don't count them.
     const reviews = (
-      await github.paginate(github.rest.pulls.listReviews, {
-        ...context.repo,
-        pull_number,
-      })
-    ).filter(
+      await github.graphql(
+        `query($owner: String!, $repo: String!, $pr: Int!) {
+        repository(owner: $owner, name: $repo) {
+          pullRequest(number: $pr) {
+            # Unlikely that there's ever more than 100 reviews, so let's not bother,
+            # but once https://github.com/actions/github-script/issues/309 is resolved,
+            # it would be easy to enable pagination.
+            reviews(first: 100) {
+              nodes {
+                state
+                user: author {
+                  # Only get users, no bots
+                  ... on User {
+                    login
+                    # Set the id field in the resulting JSON to GraphQL's databaseId
+                    # databaseId in GraphQL-land is the same as id in REST-land
+                    id: databaseId
+                  }
+                }
+                onBehalfOf(first: 100) {
+                  nodes {
+                    slug
+                  }
+                }
+              }
+            }
+          }
+        }
+      }`,
+        {
+          owner: context.repo.owner,
+          repo: context.repo.repo,
+          pr: pull_number,
+        },
+      )
+    ).repository.pullRequest.reviews.nodes.filter(
       (r) =>
-        r.user &&
-        !r.user.login.endsWith('[bot]') &&
-        r.user.type !== 'Bot' &&
+        // The `... on User` makes it such that .login only exists for users,
+        // but we still need to filter the others out.
+        // Accounts could be deleted as well, so don't count them.
+        r.user?.login &&
+        // Also exclude author reviews, can't request their review in any case
         r.user.id !== pull_request.user?.id,
     )
 
@@ -354,6 +409,16 @@ module.exports = async ({ github, context, core, dry }) => {
           if (e.code !== 'ENOENT') throw e
         }
 
+        let team_maintainers = []
+        try {
+          team_maintainers = Object.keys(
+            JSON.parse(await readFile(`${pull_number}/teams.json`, 'utf-8')),
+          ).map((id) => parseInt(id))
+        } catch (e) {
+          // Older artifacts don't have the teams.json, yet.
+          if (e.code !== 'ENOENT') throw e
+        }
+
         // We set this label earlier already, but the current PR state can be very different
         // after handleReviewers has requested reviews, so update it in this case to prevent
         // this label from flip-flopping.
@@ -366,14 +431,15 @@ module.exports = async ({ github, context, core, dry }) => {
           pull_request,
           reviews,
           // TODO: Use maintainer map instead of the artifact.
-          maintainers: Object.keys(
+          user_maintainers: Object.keys(
             JSON.parse(
               await readFile(`${pull_number}/maintainers.json`, 'utf-8'),
             ),
           ).map((id) => parseInt(id)),
+          team_maintainers,
           owners,
-          getTeamMembers,
           getUser,
+          getTeam,
         })
       }
     }
diff --git a/ci/github-script/merge.js b/ci/github-script/merge.js
index 14d6fd3762ab..d4b5e4a0b826 100644
--- a/ci/github-script/merge.js
+++ b/ci/github-script/merge.js
@@ -171,7 +171,7 @@ async function handleMerge({
   async function merge() {
     if (dry) {
       core.info(`Merging #${pull_number}... (dry)`)
-      return 'Merge completed (dry)'
+      return ['Merge completed (dry)']
     }
 
     // Using GraphQL mutations instead of the REST /merge endpoint, because the latter
diff --git a/ci/github-script/reviewers.js b/ci/github-script/reviewers.js
index d10b9f6a98e2..fbbcc996eba9 100644
--- a/ci/github-script/reviewers.js
+++ b/ci/github-script/reviewers.js
@@ -6,28 +6,29 @@ async function handleReviewers({
   dry,
   pull_request,
   reviews,
-  maintainers,
+  user_maintainers,
+  team_maintainers,
   owners,
-  getTeamMembers,
   getUser,
+  getTeam,
 }) {
   const pull_number = pull_request.number
 
-  const requested_reviewers = new Set(
-    pull_request.requested_reviewers.map(({ login }) => login.toLowerCase()),
-  )
-  log(
-    'reviewers - requested_reviewers',
-    Array.from(requested_reviewers).join(', '),
-  )
+  // Users that the PR has already reached, e.g. they've left a review or have been requested for one
+  const users_reached = new Set([
+    ...pull_request.requested_reviewers.map(({ login }) => login.toLowerCase()),
+    ...reviews.map(({ user }) => user.login.toLowerCase()),
+  ])
+  log('reviewers - users_reached', Array.from(users_reached).join(', '))
 
-  const existing_reviewers = new Set(
-    reviews.map(({ user }) => user?.login.toLowerCase()).filter(Boolean),
-  )
-  log(
-    'reviewers - existing_reviewers',
-    Array.from(existing_reviewers).join(', '),
-  )
+  // Same for teams
+  const teams_reached = new Set([
+    ...pull_request.requested_teams.map(({ slug }) => slug.toLowerCase()),
+    ...reviews.flatMap(({ onBehalfOf }) =>
+      onBehalfOf.nodes.map(({ slug }) => slug.toLowerCase()),
+    ),
+  ])
+  log('reviewers - teams_reached', Array.from(teams_reached).join(', '))
 
   // Early sanity check, before we start making any API requests. The list of maintainers
   // does not have duplicates so the only user to filter out from this list would be the
@@ -35,16 +36,17 @@ async function handleReviewers({
   // further down again.
   // This is to protect against huge treewides consuming all our API requests for no
   // reason.
-  if (maintainers.length > 16) {
+  if (user_maintainers.length + team_maintainers.length > 16) {
     core.warning('Too many potential reviewers, skipping review requests.')
     // Return a boolean on whether the "needs: reviewers" label should be set.
-    return existing_reviewers.size === 0 && requested_reviewers.size === 0
+    return users_reached.size === 0 && teams_reached.size === 0
   }
 
-  const users = new Set([
+  // Users that should be reached
+  var users_to_reach = new Set([
     ...(
       await Promise.all(
-        maintainers.map(async (id) => {
+        user_maintainers.map(async (id) => {
           const user = await getUser(id)
           // User may have deleted their account
           return user?.login?.toLowerCase()
@@ -55,76 +57,108 @@ async function handleReviewers({
       .filter((handle) => handle && !handle.includes('/'))
       .map((handle) => handle.toLowerCase()),
   ])
-  log('reviewers - users', Array.from(users).join(', '))
-
-  const teams = new Set(
-    owners
-      .map((handle) => handle.split('/'))
-      .filter(([org, slug]) => org === context.repo.owner && slug)
-      .map(([, slug]) => slug),
-  )
-  log('reviewers - teams', Array.from(teams).join(', '))
-
-  const team_members = new Set(
-    (await Promise.all(Array.from(teams, getTeamMembers)))
-      .flat(1)
-      .map(({ login }) => login.toLowerCase()),
-  )
-  log('reviewers - team_members', Array.from(team_members).join(', '))
-
-  const new_reviewers = users
-    .union(team_members)
     // We can't request a review from the author.
     .difference(new Set([pull_request.user?.login.toLowerCase()]))
-  log('reviewers - new_reviewers', Array.from(new_reviewers).join(', '))
 
   // Filter users to repository collaborators. If they're not, they can't be requested
   // for review. In that case, they probably missed their invite to the maintainers team.
-  const reviewers = (
-    await Promise.all(
-      Array.from(new_reviewers, async (username) => {
-        // TODO: Restructure this file to only do the collaborator check for those users
-        // who were not already part of a team. Being a member of a team makes them
-        // collaborators by definition.
-        try {
-          await github.rest.repos.checkCollaborator({
-            ...context.repo,
-            username,
-          })
-          return username
-        } catch (e) {
-          if (e.status !== 404) throw e
-          core.warning(
-            `PR #${pull_number}: User ${username} cannot be requested for review because they don't exist or are not a repository collaborator, ignoring. They probably missed the automated invite to the maintainers team (see <https://github.com/NixOS/nixpkgs/issues/234293>).`,
-          )
-        }
-      }),
-    )
-  ).filter(Boolean)
-  log('reviewers - reviewers', reviewers.join(', '))
+  users_to_reach = new Set(
+    (
+      await Promise.all(
+        Array.from(users_to_reach, async (username) => {
+          // TODO: Restructure this file to only do the collaborator check for those users
+          // who were not already part of a team. Being a member of a team makes them
+          // collaborators by definition.
+          try {
+            await github.rest.repos.checkCollaborator({
+              ...context.repo,
+              username,
+            })
+            return username
+          } catch (e) {
+            if (e.status !== 404) throw e
+            core.warning(
+              `PR #${pull_number}: User ${username} cannot be requested for review because they don't exist or are not a repository collaborator, ignoring. They probably missed the automated invite to the maintainers team (see <https://github.com/NixOS/nixpkgs/issues/234293>).`,
+            )
+          }
+        }),
+      )
+    ).filter(Boolean),
+  )
+  log('reviewers - users_to_reach', Array.from(users_to_reach).join(', '))
 
-  if (reviewers.length > 15) {
+  // Similar for teams
+  var teams_to_reach = new Set([
+    ...(
+      await Promise.all(
+        team_maintainers.map(async (id) => {
+          const team = await getTeam(id)
+          // Team may have been deleted
+          return team?.slug?.toLowerCase()
+        }),
+      )
+    ).filter(Boolean),
+    ...owners
+      .map((handle) => handle.split('/'))
+      .filter(
+        ([org, slug]) =>
+          org.toLowerCase() === context.repo.owner.toLowerCase() && slug,
+      )
+      .map(([, slug]) => slug.toLowerCase()),
+  ])
+  teams_to_reach = new Set(
+    (
+      await Promise.all(
+        Array.from(teams_to_reach, async (slug) => {
+          try {
+            await github.rest.teams.checkPermissionsForRepoInOrg({
+              org: context.repo.owner,
+              team_slug: slug,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+            })
+            return slug
+          } catch (e) {
+            if (e.status !== 404) throw e
+            core.warning(
+              `PR #${pull_number}: Team ${slug} cannot be requested for review because it doesn't exist or has no repository permissions, ignoring. Probably wasn't added to the nixpkgs-maintainers team (see https://github.com/NixOS/nixpkgs/tree/master/maintainers#maintainer-teams)`,
+            )
+          }
+        }),
+      )
+    ).filter(Boolean),
+  )
+  log('reviewers - teams_to_reach', Array.from(teams_to_reach).join(', '))
+
+  if (users_to_reach.size + teams_to_reach.size > 15) {
     core.warning(
-      `Too many reviewers (${reviewers.join(', ')}), skipping review requests.`,
+      `Too many reviewers (users: ${Array.from(users_to_reach).join(', ')}, teams: ${Array.from(teams_to_reach).join(', ')}), skipping review requests.`,
     )
     // Return a boolean on whether the "needs: reviewers" label should be set.
-    return existing_reviewers.size === 0 && requested_reviewers.size === 0
+    return users_reached.size === 0 && teams_reached.size === 0
   }
 
-  const non_requested_reviewers = new Set(reviewers)
-    .difference(requested_reviewers)
-    // We don't want to rerequest reviews from people who already reviewed.
-    .difference(existing_reviewers)
+  // We don't want to rerequest reviews from people who already reviewed or were requested
+  const users_not_yet_reached = users_to_reach.difference(users_reached)
   log(
-    'reviewers - non_requested_reviewers',
-    Array.from(non_requested_reviewers).join(', '),
+    'reviewers - users_not_yet_reached',
+    Array.from(users_not_yet_reached).join(', '),
+  )
+  // We don't want to rerequest reviews from teams who already reviewed or were requested
+  const teams_not_yet_reached = teams_to_reach.difference(teams_reached)
+  log(
+    'reviewers - teams_not_yet_reached',
+    Array.from(teams_not_yet_reached).join(', '),
   )
 
-  if (non_requested_reviewers.size === 0) {
+  if (users_not_yet_reached.size === 0 && teams_not_yet_reached.size === 0) {
     log('Has reviewer changes', 'false (skipped)')
   } else if (dry) {
     core.info(
-      `Requesting reviewers for #${pull_number}: ${Array.from(non_requested_reviewers).join(', ')} (dry)`,
+      `Requesting user reviewers for #${pull_number}: ${Array.from(users_not_yet_reached).join(', ')} (dry)`,
+    )
+    core.info(
+      `Requesting team reviewers for #${pull_number}: ${Array.from(teams_not_yet_reached).join(', ')} (dry)`,
     )
   } else {
     // We had tried the "request all reviewers at once" thing in the past, but it didn't work out:
@@ -134,15 +168,17 @@ async function handleReviewers({
     await github.rest.pulls.requestReviewers({
       ...context.repo,
       pull_number,
-      reviewers,
+      reviewers: users_not_yet_reached,
+      team_reviewers: teams_not_yet_reached,
     })
   }
 
   // Return a boolean on whether the "needs: reviewers" label should be set.
   return (
-    non_requested_reviewers.size === 0 &&
-    existing_reviewers.size === 0 &&
-    requested_reviewers.size === 0
+    users_not_yet_reached.size === 0 &&
+    teams_not_yet_reached.size === 0 &&
+    users_reached.size === 0 &&
+    teams_reached.size === 0
   )
 }
 
diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index 28de9c68110e..6f473a708e2e 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -352,6 +352,7 @@ let
         ];
       sourceProvenance = listOf attrs;
       maintainers = listOf (attrsOf any); # TODO use the maintainer type from lib/tests/maintainer-module.nix
+      nonTeamMaintainers = listOf (attrsOf any); # TODO use the maintainer type from lib/tests/maintainer-module.nix
       teams = listOf (attrsOf any); # TODO similar to maintainers, use a teams type
       priority = int;
       pkgConfigModules = listOf str;
@@ -626,6 +627,10 @@ let
         attrs.meta.maintainers or [ ] ++ concatMap (team: team.members or [ ]) attrs.meta.teams or [ ]
       );
 
+      # Needed for CI to be able to avoid requesting reviews from individual
+      # team members
+      nonTeamMaintainers = attrs.meta.maintainers or [ ];
+
       identifiers =
         let
           # nix-env writes a warning for each derivation that has null in its meta values, so

From 064d6ca6d39a6766d3e13092f62b79d738e0e0e8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?J=C3=B6rg=20Thalheim?= <joerg@thalheim.io>
Date: Thu, 5 Feb 2026 14:49:47 +0100
Subject: [PATCH 08/35] libsForQt5.mapbox-gl-native: remove broken package

mapbox-gl-native has been marked broken since NixOS 24.05 due to
incompatibility with gcc-13 and the upstream repository being archived.

Per RFC 180, packages broken for a full release cycle are subject
to removal.

https://github.com/NixOS/rfcs/pull/180
---
 .../libraries/mapbox-gl-native/default.nix    | 92 -------------------
 pkgs/top-level/qt5-packages.nix               |  3 +-
 2 files changed, 1 insertion(+), 94 deletions(-)
 delete mode 100644 pkgs/development/libraries/mapbox-gl-native/default.nix

diff --git a/pkgs/development/libraries/mapbox-gl-native/default.nix b/pkgs/development/libraries/mapbox-gl-native/default.nix
deleted file mode 100644
index c4e2c1ef09a8..000000000000
--- a/pkgs/development/libraries/mapbox-gl-native/default.nix
+++ /dev/null
@@ -1,92 +0,0 @@
-{
-  lib,
-  mkDerivation,
-  fetchFromGitHub,
-  fetchpatch,
-  cmake,
-  pkg-config,
-  qtbase,
-  curl,
-  libuv,
-  glfw3,
-  rapidjson,
-}:
-
-mkDerivation rec {
-  pname = "mapbox-gl-native";
-  version = "1.6.0";
-
-  src = fetchFromGitHub {
-    owner = "mapbox";
-    repo = "mapbox-gl-native";
-    rev = "maps-v${version}";
-    sha256 = "027rw23yvd5a6nl9b5hsanddc44nyb17l2whdcq9fxb9n6vcda4c";
-    fetchSubmodules = true;
-  };
-
-  patches = [
-    # https://github.com/mapbox/mapbox-gl-native/pull/16591
-    (fetchpatch {
-      name = "add-support-for-qmapboxgl-installation.patch";
-      url = "https://github.com/mapbox/mapbox-gl-native/commit/e18467d755f470b26f61f6893eddd76ecf0816e6.patch";
-      sha256 = "0gs7wmkvyhf2db4cwbsq31sprsh1avi70ggvi32bk0wn3cw4d79b";
-    })
-    (fetchpatch {
-      name = "add-support-for-using-qmapboxgl-as-a-proper-cmake-dependency.patch";
-      url = "https://github.com/mapbox/mapbox-gl-native/commit/ab27b9b8207754ef731b588d187c470ffb084455.patch";
-      sha256 = "1lr5p1g4qaizs57vjqry9aq8k1ki59ks0y975chlnrm2sffp140r";
-    })
-    (fetchpatch {
-      name = "skip-license-check.patch";
-      url = "https://git.alpinelinux.org/aports/plain/testing/mapbox-gl-native/0002-skip-license-check.patch?id=6751a93dca26b0b3ceec9eb151272253a2fe497e";
-      sha256 = "1yybwzxbvn0lqb1br1fyg7763p2h117s6mkmywkl4l7qg9daa7ba";
-    })
-    (fetchpatch {
-      name = "fix-compilation.patch";
-      url = "https://aur.archlinux.org/cgit/aur.git/plain/fix-compilation.patch?h=mapbox-gl-native";
-      hash = "sha256-KgJHyoIdKdnQo+gedns3C+mEXlaTH/UtyQsaYR1T3iI=";
-    })
-    (fetchpatch {
-      name = "fix-narrowing-conversion.patch";
-      url = "https://github.com/mapbox/mapbox-gl-native/commit/2955d0e479f57a39a0af4a0fa7ca7683455cca58.patch";
-      hash = "sha256-Jk7OLb9/mVtc2mm0AL1h9zcSiQ54jogNI+q6ojY0HEo=";
-    })
-  ];
-
-  postPatch = ''
-    # don't use vendored rapidjson
-    rm -r vendor/mapbox-base/extras/rapidjson
-  '';
-
-  nativeBuildInputs = [
-    cmake
-    pkg-config
-  ];
-  buildInputs = [
-    curl
-    libuv
-    glfw3
-    qtbase
-    rapidjson
-  ];
-
-  cmakeFlags = [
-    "-DMBGL_WITH_QT=ON"
-    "-DMBGL_WITH_QT_LIB_ONLY=ON"
-    "-DMBGL_WITH_QT_HEADLESS=OFF"
-  ];
-  env.NIX_CFLAGS_COMPILE = "-Wno-error=deprecated-declarations -Wno-error=type-limits";
-
-  meta = {
-    # Does not build against gcc-13, the repository is archived upstream.
-    broken = true;
-    description = "Interactive, thoroughly customizable maps in native Android, iOS, macOS, Node.js, and Qt applications, powered by vector tiles and OpenGL";
-    homepage = "https://mapbox.com/mobile";
-    license = lib.licenses.bsd2;
-    maintainers = with lib.maintainers; [
-      Thra11
-      dotlambda
-    ];
-    platforms = lib.platforms.linux;
-  };
-}
diff --git a/pkgs/top-level/qt5-packages.nix b/pkgs/top-level/qt5-packages.nix
index c6e9bab6d11d..e7bc54d06c14 100644
--- a/pkgs/top-level/qt5-packages.nix
+++ b/pkgs/top-level/qt5-packages.nix
@@ -122,8 +122,6 @@ makeScopeWithSplicing' {
 
         libqaccessibilityclient = callPackage ../development/libraries/libqaccessibilityclient { };
 
-        mapbox-gl-native = libsForQt5.callPackage ../development/libraries/mapbox-gl-native { };
-
         mapbox-gl-qml = libsForQt5.callPackage ../development/libraries/mapbox-gl-qml { };
 
         maplibre-gl-native = callPackage ../development/libraries/maplibre-gl-native { };
@@ -228,6 +226,7 @@ makeScopeWithSplicing' {
           'libsForQt5.kf5gpgmepp' has been removed because it has been unmaintained upstream since 2017.
           Consider switching to the gpgmepp included in gpgme (gpgme <2), or to the GnuPG fork of gpgmepp (gpgme 2+), instead.
         ''; # Added 2025-10-25
+        mapbox-gl-native = throw "libsForQt5.mapbox-gl-native has been removed due to being broken for more than a year; see RFC 180"; # Added 2026-02-05
       }
     ))
   );

From 669b32c4649407a469ebd791edf150a65a4cfbb6 Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Thu, 5 Feb 2026 09:35:58 -0500
Subject: [PATCH 09/35] erlang_27: 27.3.4.6 -> 27.3.4.7

Changelog: https://github.com/erlang/otp/releases/tag/OTP-27.3.4.7
---
 pkgs/development/interpreters/erlang/27.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/erlang/27.nix b/pkgs/development/interpreters/erlang/27.nix
index 96487d748c01..c00e351a7dcb 100644
--- a/pkgs/development/interpreters/erlang/27.nix
+++ b/pkgs/development/interpreters/erlang/27.nix
@@ -1,6 +1,6 @@
 genericBuilder:
 
 genericBuilder {
-  version = "27.3.4.6";
-  hash = "sha256-QC8C7rOpRXFriZtmVc48Se7IQ61p4DSAXVobnDeEkAE=";
+  version = "27.3.4.7";
+  hash = "sha256-3D+j36vNio0REx02bJ/dYey/nTojZuQSnzIWBIOch1U=";
 }

From 0074cdf299ad6f7d2be1b5f80d18b5176308467b Mon Sep 17 00:00:00 2001
From: 06kellyjac <dev@j-k.io>
Date: Thu, 5 Feb 2026 15:53:30 +0000
Subject: [PATCH 10/35] apko: 1.0.5 -> 1.1.4

Diff: https://github.com/chainguard-dev/apko/compare/v1.0.5...v1.1.4

Changelog: https://github.com/chainguard-dev/apko/releases/tag/v1.1.4

Removed internal gen-jsonschema bin.

Resolves: #487265 #487282
---
 pkgs/by-name/ap/apko/package.nix | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ap/apko/package.nix b/pkgs/by-name/ap/apko/package.nix
index c9a671fb7242..31400b0860df 100644
--- a/pkgs/by-name/ap/apko/package.nix
+++ b/pkgs/by-name/ap/apko/package.nix
@@ -11,13 +11,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "apko";
-  version = "1.0.5";
+  version = "1.1.4";
 
   src = fetchFromGitHub {
     owner = "chainguard-dev";
     repo = "apko";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-7KDyTXqIM4hUnNVJt4xwsuUdP0eYSF+fSBRuSKs8VzQ=";
+    hash = "sha256-8nxz8Qmo1waHa3c6qbb5cy+mMT2kaWcHSl4uW3qrBsI=";
     # populate values that require us to use git. By doing this in postFetch we
     # can delete .git afterwards and maintain better reproducibility of the src.
     leaveDotGit = true;
@@ -29,7 +29,11 @@ buildGoModule (finalAttrs: {
       find "$out" -name .git -print0 | xargs -0 rm -rf
     '';
   };
-  vendorHash = "sha256-vHTJCfXVlbBLQXC/tsXJsGoACcxAhJmFlU/tq10836Q=";
+  vendorHash = "sha256-vGtxVQSesrqWnYJT7B2KhWiYtUFsYVPdI/ZEbpFmkOc=";
+
+  excludedPackages = [
+    "internal/gen-jsonschema"
+  ];
 
   nativeBuildInputs = [ installShellFiles ];
 

From cd54639772608b0ce123683aedb5345c613aa535 Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Thu, 5 Feb 2026 17:52:52 +0100
Subject: [PATCH 11/35] librewolf: move to by-name

---
 ci/OWNERS                                              |  1 -
 .../li/librewolf-unwrapped}/librewolf.nix              |  0
 .../li/librewolf-unwrapped/package.nix}                |  1 -
 .../li/librewolf-unwrapped}/src.json                   |  0
 .../li/librewolf-unwrapped}/src.nix                    |  0
 .../li/librewolf-unwrapped}/update.nix                 |  2 +-
 pkgs/top-level/all-packages.nix                        | 10 ----------
 7 files changed, 1 insertion(+), 13 deletions(-)
 rename pkgs/{applications/networking/browsers/librewolf => by-name/li/librewolf-unwrapped}/librewolf.nix (100%)
 rename pkgs/{applications/networking/browsers/librewolf/default.nix => by-name/li/librewolf-unwrapped/package.nix} (95%)
 rename pkgs/{applications/networking/browsers/librewolf => by-name/li/librewolf-unwrapped}/src.json (100%)
 rename pkgs/{applications/networking/browsers/librewolf => by-name/li/librewolf-unwrapped}/src.nix (100%)
 rename pkgs/{applications/networking/browsers/librewolf => by-name/li/librewolf-unwrapped}/update.nix (97%)

diff --git a/ci/OWNERS b/ci/OWNERS
index 4e8cc28e50fe..8a52e846aafd 100644
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -247,7 +247,6 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 /pkgs/applications/networking/browsers/firefox/update.nix
 /pkgs/applications/networking/browsers/firefox/packages/firefox.nix @mweinelt
 /pkgs/applications/networking/browsers/firefox/packages/firefox-esr-*.nix @mweinelt
-/pkgs/applications/networking/browsers/librewolf @squalus @DominicWrege @fpletz
 /pkgs/applications/networking/browsers/chromium @emilylange @networkException
 /nixos/tests/chromium.nix @emilylange @networkException
 
diff --git a/pkgs/applications/networking/browsers/librewolf/librewolf.nix b/pkgs/by-name/li/librewolf-unwrapped/librewolf.nix
similarity index 100%
rename from pkgs/applications/networking/browsers/librewolf/librewolf.nix
rename to pkgs/by-name/li/librewolf-unwrapped/librewolf.nix
diff --git a/pkgs/applications/networking/browsers/librewolf/default.nix b/pkgs/by-name/li/librewolf-unwrapped/package.nix
similarity index 95%
rename from pkgs/applications/networking/browsers/librewolf/default.nix
rename to pkgs/by-name/li/librewolf-unwrapped/package.nix
index ccb39de0dc8d..e8ca16d5a5c1 100644
--- a/pkgs/applications/networking/browsers/librewolf/default.nix
+++ b/pkgs/by-name/li/librewolf-unwrapped/package.nix
@@ -29,7 +29,6 @@ in
     description = "Fork of Firefox, focused on privacy, security and freedom";
     homepage = "https://librewolf.net/";
     maintainers = with lib.maintainers; [
-      # Also update ci/OWNERS entry when changing maintainers
       squalus
       dwrege
       fpletz
diff --git a/pkgs/applications/networking/browsers/librewolf/src.json b/pkgs/by-name/li/librewolf-unwrapped/src.json
similarity index 100%
rename from pkgs/applications/networking/browsers/librewolf/src.json
rename to pkgs/by-name/li/librewolf-unwrapped/src.json
diff --git a/pkgs/applications/networking/browsers/librewolf/src.nix b/pkgs/by-name/li/librewolf-unwrapped/src.nix
similarity index 100%
rename from pkgs/applications/networking/browsers/librewolf/src.nix
rename to pkgs/by-name/li/librewolf-unwrapped/src.nix
diff --git a/pkgs/applications/networking/browsers/librewolf/update.nix b/pkgs/by-name/li/librewolf-unwrapped/update.nix
similarity index 97%
rename from pkgs/applications/networking/browsers/librewolf/update.nix
rename to pkgs/by-name/li/librewolf-unwrapped/update.nix
index 8833c2bcf1db..db09200e5520 100644
--- a/pkgs/applications/networking/browsers/librewolf/update.nix
+++ b/pkgs/by-name/li/librewolf-unwrapped/update.nix
@@ -36,7 +36,7 @@ writeScript "update-librewolf" ''
   latestTag=$(curl "https://codeberg.org/api/v1/repos/librewolf/source/tags?page=1&limit=1" | jq -r .[0].name)
   echo "latestTag=$latestTag"
 
-  srcJson=pkgs/applications/networking/browsers/librewolf/src.json
+  srcJson=pkgs/by-name/li/librewolf-unwrapped/src.json
   localRev=$(jq -r .source.rev < $srcJson)
   echo "localRev=$localRev"
 
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 78cc0f997b23..8331bd8c39bf 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -10011,16 +10011,6 @@ with pkgs;
     pname = "firefox-bin";
   };
 
-  librewolf-unwrapped = import ../applications/networking/browsers/librewolf {
-    inherit
-      stdenv
-      lib
-      callPackage
-      buildMozillaMach
-      nixosTests
-      ;
-  };
-
   librewolf = wrapFirefox librewolf-unwrapped {
     inherit (librewolf-unwrapped) extraPrefsFiles extraPoliciesFiles;
     libName = "librewolf";

From ae3d2174fe66d47106c28148ebdef7ce2ff67ad8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 5 Feb 2026 18:45:07 +0000
Subject: [PATCH 12/35] mirrord: 3.184.0 -> 3.185.1

---
 pkgs/by-name/mi/mirrord/manifest.json | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/mi/mirrord/manifest.json b/pkgs/by-name/mi/mirrord/manifest.json
index 3e9e5da10c18..b9e148da8261 100644
--- a/pkgs/by-name/mi/mirrord/manifest.json
+++ b/pkgs/by-name/mi/mirrord/manifest.json
@@ -1,21 +1,21 @@
 {
-  "version": "3.184.0",
+  "version": "3.185.1",
   "assets": {
     "x86_64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.184.0/mirrord_linux_x86_64",
-      "hash": "sha256-/1LTDzulmiMzoobMUyADv+MWthoL/slQldgImUFikC4="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.185.1/mirrord_linux_x86_64",
+      "hash": "sha256-zDhN3KtvyFdGeZYZRnjKFCDiGSnIezXrBISOq1hR3Yg="
     },
     "aarch64-linux": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.184.0/mirrord_linux_aarch64",
-      "hash": "sha256-zlpLCuJO+gouYYCBZ2Oo711QIvSfDXX/81JyyL3vdKE="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.185.1/mirrord_linux_aarch64",
+      "hash": "sha256-8Cylh5Pq0uxPLCu1H/JsfxvRgipF3bTOpsbkLL50OXY="
     },
     "aarch64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.184.0/mirrord_mac_universal",
-      "hash": "sha256-iHTWgj18BDrvW0PCriWZdkMKA0V0D828xoaD3mSHTac="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.185.1/mirrord_mac_universal",
+      "hash": "sha256-EUScHFfJpqB9v1qjrMzF+Itfs4rTQzj5XPUDod2xiJU="
     },
     "x86_64-darwin": {
-      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.184.0/mirrord_mac_universal",
-      "hash": "sha256-iHTWgj18BDrvW0PCriWZdkMKA0V0D828xoaD3mSHTac="
+      "url": "https://github.com/metalbear-co/mirrord/releases/download/3.185.1/mirrord_mac_universal",
+      "hash": "sha256-EUScHFfJpqB9v1qjrMzF+Itfs4rTQzj5XPUDod2xiJU="
     }
   }
 }

From 120850e91289fa65ea11e83cff322ea3a6743dd7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 5 Feb 2026 20:40:36 +0000
Subject: [PATCH 13/35] python3Packages.apycula: 0.28 -> 0.29

---
 pkgs/development/python-modules/apycula/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/apycula/default.nix b/pkgs/development/python-modules/apycula/default.nix
index eb179169f6f5..6927c4f611d0 100644
--- a/pkgs/development/python-modules/apycula/default.nix
+++ b/pkgs/development/python-modules/apycula/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage rec {
   pname = "apycula";
-  version = "0.28";
+  version = "0.29";
   pyproject = true;
 
   src = fetchPypi {
     inherit pname version;
-    hash = "sha256-AfNjHQkDrZ9oULuEmgXhqr063NWDZCpVW5pE6chnnFI=";
+    hash = "sha256-awhGSmGQDQ0Pi+4y9KoR1Yw6UZjM/CTxAV0jdfen6Qw=";
   };
 
   build-system = [ setuptools-scm ];

From 881d48d486d7a92f00adc3991cb0595cb3dc3208 Mon Sep 17 00:00:00 2001
From: Bruno Hoffmann <0xbruno.hoffmann@gmail.com>
Date: Thu, 5 Feb 2026 21:57:24 +0100
Subject: [PATCH 14/35] nixos/crowdsec: Add use of lib.getExe to cat call

---
 nixos/modules/services/security/crowdsec.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/security/crowdsec.nix b/nixos/modules/services/security/crowdsec.nix
index 7d89659f5dd1..78d861604dad 100644
--- a/nixos/modules/services/security/crowdsec.nix
+++ b/nixos/modules/services/security/crowdsec.nix
@@ -602,7 +602,7 @@ in
       ++ lib.optionals (cfg.settings.console.tokenFile != null) [
         ''
           if [ ! -e "${cfg.settings.console.tokenFile}" ]; then
-            ${lib.getExe cscli} console enroll "$(cat ${cfg.settings.console.tokenFile})" --name ${cfg.name}
+            ${lib.getExe cscli} console enroll "$(${lib.getExe' pkgs.coreutils "cat"} ${cfg.settings.console.tokenFile})" --name ${cfg.name}
           fi
         ''
       ];

From b44a7fc8ff9c4724f8d66bf3cbf822dfcc44813a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 5 Feb 2026 22:34:31 +0000
Subject: [PATCH 15/35] easyeffects: 8.0.9 -> 8.1.2

---
 pkgs/by-name/ea/easyeffects/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ea/easyeffects/package.nix b/pkgs/by-name/ea/easyeffects/package.nix
index 8031453475ca..8cedc500052b 100644
--- a/pkgs/by-name/ea/easyeffects/package.nix
+++ b/pkgs/by-name/ea/easyeffects/package.nix
@@ -59,13 +59,13 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "easyeffects";
-  version = "8.0.9";
+  version = "8.1.2";
 
   src = fetchFromGitHub {
     owner = "wwmm";
     repo = "easyeffects";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-cFMbeJeEIDP7uiNi+rRKErgHtjP/PbPKASo+M2qogZQ=";
+    hash = "sha256-Tz14pjI5pNJOQH0KFaf9mJkFdup1GVxlkMnzVQusx/M=";
   };
 
   patches = [ ./qmlmodule-fix.patch ];

From b1139b1b949597fc82fd06558d40a02e6ab986be Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 5 Feb 2026 22:52:01 +0000
Subject: [PATCH 16/35] cspell: 9.6.2 -> 9.6.4

---
 pkgs/by-name/cs/cspell/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/cs/cspell/package.nix b/pkgs/by-name/cs/cspell/package.nix
index 846e253afc33..eef3622ff733 100644
--- a/pkgs/by-name/cs/cspell/package.nix
+++ b/pkgs/by-name/cs/cspell/package.nix
@@ -11,13 +11,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "cspell";
-  version = "9.6.2";
+  version = "9.6.4";
 
   src = fetchFromGitHub {
     owner = "streetsidesoftware";
     repo = "cspell";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JEvvopeSqoVXrh9t4ORUlT0nPdE+3PofzD7h4VajnAs=";
+    hash = "sha256-OeS3wBOnvhxQtAAra40wb1FMYIb2mpKrqf72AFuU944=";
   };
 
   pnpmWorkspaces = [ "cspell..." ];
@@ -31,7 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     pnpm = pnpm_10;
     fetcherVersion = 2;
-    hash = "sha256-CNsxfAsIQxmDvuGZtedKnHMOoB1usDlw45cKYxaD05U=";
+    hash = "sha256-ufHALS8FL2VjNnYHUBZh99IpivZDtaYaVjTmEoY6Sqc=";
   };
 
   nativeBuildInputs = [

From 74e44369fe5ad7702d0299cd5e0378e8a4de4bde Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 5 Feb 2026 23:21:17 +0000
Subject: [PATCH 17/35] python3Packages.python-roborock: 4.8.0 -> 4.12.0

---
 pkgs/development/python-modules/python-roborock/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/python-roborock/default.nix b/pkgs/development/python-modules/python-roborock/default.nix
index 20821b5d597c..dedcdcbc8cac 100644
--- a/pkgs/development/python-modules/python-roborock/default.nix
+++ b/pkgs/development/python-modules/python-roborock/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "python-roborock";
-  version = "4.8.0";
+  version = "4.12.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Python-roborock";
     repo = "python-roborock";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-eOvadiJ0zLwCJDK22qb/ZPsNi+d6lI5+lzn05EHWB7I=";
+    hash = "sha256-H47NKOGKUCJs9LolVcTg6R8W6Fuq+YWBgrwJUB08JVA=";
   };
 
   pythonRelaxDeps = [ "pycryptodome" ];

From 9baa0fed4d976d6b2f1ff6694ae01cf9ca55e9f4 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 6 Feb 2026 00:23:45 +0100
Subject: [PATCH 18/35] python313Packages.apycula: migrate to finalAttrs

---
 pkgs/development/python-modules/apycula/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/apycula/default.nix b/pkgs/development/python-modules/apycula/default.nix
index 6927c4f611d0..e53bc2239dc4 100644
--- a/pkgs/development/python-modules/apycula/default.nix
+++ b/pkgs/development/python-modules/apycula/default.nix
@@ -6,13 +6,13 @@
   setuptools-scm,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "apycula";
   version = "0.29";
   pyproject = true;
 
   src = fetchPypi {
-    inherit pname version;
+    inherit (finalAttrs) pname version;
     hash = "sha256-awhGSmGQDQ0Pi+4y9KoR1Yw6UZjM/CTxAV0jdfen6Qw=";
   };
 
@@ -28,8 +28,8 @@ buildPythonPackage rec {
   meta = {
     description = "Open Source tools for Gowin FPGAs";
     homepage = "https://github.com/YosysHQ/apicula";
-    changelog = "https://github.com/YosysHQ/apicula/releases/tag/${version}";
+    changelog = "https://github.com/YosysHQ/apicula/releases/tag/${finalAttrs.version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ newam ];
   };
-}
+})

From 7dd2100c60471d150180611d89df65c4a8acd54f Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 6 Feb 2026 00:36:28 +0100
Subject: [PATCH 19/35] python313Packages.pyenphase: 2.4.3 -> 2.4.5

Diff: https://github.com/pyenphase/pyenphase/compare/v2.4.3...v2.4.5

Changelog: https://github.com/pyenphase/pyenphase/blob/v2.4.5/CHANGELOG.md
---
 pkgs/development/python-modules/pyenphase/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pyenphase/default.nix b/pkgs/development/python-modules/pyenphase/default.nix
index d8e6b4cb297f..06715a760afb 100644
--- a/pkgs/development/python-modules/pyenphase/default.nix
+++ b/pkgs/development/python-modules/pyenphase/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "pyenphase";
-  version = "2.4.3";
+  version = "2.4.5";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pyenphase";
     repo = "pyenphase";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-JJtkfN3udslcNYMXGGRXjyPqP3hjix9bg7GcGNOoMbM=";
+    hash = "sha256-BMzYo6KrgJII/30TJndYRGOjRS2ufWJirQd5X8D0bbo=";
   };
 
   pythonRelaxDeps = [ "tenacity" ];

From a4286ed83606b130d18f08f81c856e1346129e24 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 6 Feb 2026 00:38:13 +0100
Subject: [PATCH 20/35] python313Packages.denonavr: 1.3.1 -> 1.3.2

Diff: https://github.com/ol-iver/denonavr/compare/1.3.1...1.3.2

Changelog: https://github.com/ol-iver/denonavr/releases/tag/1.3.2
---
 pkgs/development/python-modules/denonavr/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/denonavr/default.nix b/pkgs/development/python-modules/denonavr/default.nix
index 0390dd429a3c..b84bd6581cdd 100644
--- a/pkgs/development/python-modules/denonavr/default.nix
+++ b/pkgs/development/python-modules/denonavr/default.nix
@@ -17,14 +17,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "denonavr";
-  version = "1.3.1";
+  version = "1.3.2";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "ol-iver";
     repo = "denonavr";
     tag = finalAttrs.version;
-    hash = "sha256-GrcTNnGanyYwcRIqzh5gToe2Z0E5KM2V7Ph/eBFoljA=";
+    hash = "sha256-nuxTZA4kGSaRp6qqOG8XjqjYxiCwmAraetVD4LFd0Qc=";
   };
 
   build-system = [ setuptools ];

From 3a68f6bcb6e40b5fb2240422fed67f01b83fbb45 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 5 Feb 2026 23:44:16 +0000
Subject: [PATCH 21/35] edmarketconnector: 6.1.1 -> 6.1.2

---
 pkgs/by-name/ed/edmarketconnector/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ed/edmarketconnector/package.nix b/pkgs/by-name/ed/edmarketconnector/package.nix
index 0bf83b5c809c..3ae084e7e72c 100644
--- a/pkgs/by-name/ed/edmarketconnector/package.nix
+++ b/pkgs/by-name/ed/edmarketconnector/package.nix
@@ -24,13 +24,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "edmarketconnector";
-  version = "6.1.1";
+  version = "6.1.2";
 
   src = fetchFromGitHub {
     owner = "EDCD";
     repo = "EDMarketConnector";
     tag = "Release/${finalAttrs.version}";
-    hash = "sha256-kWxen2CTmccI6FMoIZIvgI0Sk5TIL09onxTB3iY60I4=";
+    hash = "sha256-dnSzT1C4ElUkj34S3bYI+v0oKJQQ7zQBZ8OuhVB6ans=";
   };
 
   nativeBuildInputs = [ makeWrapper ];

From 13797469b9077576d4660c7ef71b974544c10fa8 Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 6 Feb 2026 00:45:38 +0100
Subject: [PATCH 22/35] python313Packages.pypck: 0.9.9 -> 0.9.10

Diff: https://github.com/alengwenus/pypck/compare/0.9.9...0.9.10

Changelog: https://github.com/alengwenus/pypck/releases/tag/0.9.10
---
 pkgs/development/python-modules/pypck/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/pypck/default.nix b/pkgs/development/python-modules/pypck/default.nix
index 443945c7d3d6..3660404c195f 100644
--- a/pkgs/development/python-modules/pypck/default.nix
+++ b/pkgs/development/python-modules/pypck/default.nix
@@ -11,14 +11,14 @@
 
 buildPythonPackage rec {
   pname = "pypck";
-  version = "0.9.9";
+  version = "0.9.10";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "alengwenus";
     repo = "pypck";
     tag = version;
-    hash = "sha256-EsPfPRYp75GML9JMoFPf5U8obh51LjIkg/FFRNkrEOY=";
+    hash = "sha256-UTUYYnXY+Wak4cd0fH1V5rdkJ/Aet0DSCHfd+PL+SBo=";
   };
 
   postPatch = ''

From ca59d52ebdeb9c00b7c91b41f55a23781ec26c5a Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Fri, 6 Feb 2026 00:48:34 +0100
Subject: [PATCH 23/35] python313Packages.pypck: migrate to finalAttrs

---
 pkgs/development/python-modules/pypck/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/pypck/default.nix b/pkgs/development/python-modules/pypck/default.nix
index 3660404c195f..9a993a1a4ce6 100644
--- a/pkgs/development/python-modules/pypck/default.nix
+++ b/pkgs/development/python-modules/pypck/default.nix
@@ -9,7 +9,7 @@
   setuptools,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pypck";
   version = "0.9.10";
   pyproject = true;
@@ -17,12 +17,12 @@ buildPythonPackage rec {
   src = fetchFromGitHub {
     owner = "alengwenus";
     repo = "pypck";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-UTUYYnXY+Wak4cd0fH1V5rdkJ/Aet0DSCHfd+PL+SBo=";
   };
 
   postPatch = ''
-    echo "${version}" > VERSION
+    echo "${finalAttrs.version}" > VERSION
   '';
 
   build-system = [ setuptools ];
@@ -42,8 +42,8 @@ buildPythonPackage rec {
   meta = {
     description = "LCN-PCK library written in Python";
     homepage = "https://github.com/alengwenus/pypck";
-    changelog = "https://github.com/alengwenus/pypck/releases/tag/${src.tag}";
+    changelog = "https://github.com/alengwenus/pypck/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.epl20;
     maintainers = with lib.maintainers; [ fab ];
   };
-}
+})

From cc7774848774da641eced0409bd31303649ce3ba Mon Sep 17 00:00:00 2001
From: janhencic <jan@hencic.com>
Date: Sat, 24 Jan 2026 21:47:26 +0000
Subject: [PATCH 24/35] remark42: init at 1.15.0

---
 pkgs/by-name/re/remark42/package.nix | 106 +++++++++++++++++++++++++++
 1 file changed, 106 insertions(+)
 create mode 100644 pkgs/by-name/re/remark42/package.nix

diff --git a/pkgs/by-name/re/remark42/package.nix b/pkgs/by-name/re/remark42/package.nix
new file mode 100644
index 000000000000..77595ef28e4a
--- /dev/null
+++ b/pkgs/by-name/re/remark42/package.nix
@@ -0,0 +1,106 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  buildGoModule,
+  nodejs_22,
+  pnpm_8,
+  fetchPnpmDeps,
+  pnpmConfigHook,
+  testers,
+}:
+
+let
+  version = "1.15.0";
+
+  src = fetchFromGitHub {
+    owner = "umputun";
+    repo = "remark42";
+    tag = "v${version}";
+    hash = "sha256-yd/qTRSZj0nZpgK77xP+XHyHcVXlNpyMzdfj6EbVcXQ=";
+  };
+
+  remark42-web = stdenv.mkDerivation (finalAttrs: {
+    pname = "remark42-web";
+    inherit version src;
+
+    strictDeps = true;
+
+    pnpmRoot = "frontend";
+
+    nativeBuildInputs = [
+      nodejs_22
+      pnpm_8
+      pnpmConfigHook
+    ];
+
+    pnpmDeps = fetchPnpmDeps {
+      inherit (finalAttrs) pname version src;
+      sourceRoot = "${finalAttrs.src.name}/frontend";
+      pnpm = pnpm_8;
+      fetcherVersion = 3;
+      hash = "sha256-E2tUZXhcufuztXS+Z//uZk9omvaPrevNbGqVd41Lwhw=";
+    };
+
+    buildPhase = ''
+      runHook preBuild
+      pushd "$pnpmRoot"
+      pnpm --filter ./apps/remark42 --fail-if-no-match run build
+      popd
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+      mkdir -p $out/web
+      cp -r "$pnpmRoot/apps/remark42/public/." $out/web/
+      runHook postInstall
+    '';
+  });
+in
+buildGoModule (finalAttrs: {
+  pname = "remark42";
+  inherit version src;
+
+  strictDeps = true;
+
+  modRoot = "backend";
+
+  # build the main package in ./backend/app
+  subPackages = [ "app" ];
+
+  preBuild = ''
+    rm -rf app/cmd/web
+    mkdir -p app/cmd/web
+    cp -r ${remark42-web}/web/. app/cmd/web/
+  '';
+
+  vendorHash = null;
+
+  # set the version string in the built binary.
+  ldflags = [
+    "-s"
+    "-w"
+    "-X"
+    "main.revision=v${version}"
+  ];
+
+  postInstall = ''
+    mv "$out/bin/app" "$out/bin/remark42"
+  '';
+
+  passthru.tests.version = testers.testVersion {
+    package = finalAttrs.finalPackage;
+    command = "remark42 --help";
+    version = "v${finalAttrs.version}";
+  };
+
+  meta = with lib; {
+    description = "Self-hosted comment engine that embeds a statically built frontend";
+    homepage = "https://remark42.com/";
+    license = licenses.mit;
+    mainProgram = "remark42";
+    platforms = platforms.unix;
+    maintainers = with maintainers; [ janhencic ];
+  };
+})

From 96d9a0c6d0ebf1fb928c20a9aa500c3b3c281214 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 6 Feb 2026 01:28:49 +0000
Subject: [PATCH 25/35] coc-pyright: 0-unstable-2026-01-04 ->
 0-unstable-2026-02-01

---
 pkgs/by-name/co/coc-pyright/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/co/coc-pyright/package.nix b/pkgs/by-name/co/coc-pyright/package.nix
index 4ed1a55251c2..05b85464a88e 100644
--- a/pkgs/by-name/co/coc-pyright/package.nix
+++ b/pkgs/by-name/co/coc-pyright/package.nix
@@ -7,17 +7,17 @@
 
 buildNpmPackage {
   pname = "coc-pyright";
-  version = "0-unstable-2026-01-04";
+  version = "0-unstable-2026-02-01";
 
   src = fetchFromGitHub {
     owner = "fannheyward";
     repo = "coc-pyright";
     # No tagged releases, this commit corresponds to the latest release of the package.
-    rev = "767eebcb9f9b828412b9ec02e80558f3e748798a";
-    hash = "sha256-PNCh6EiXQxIYgU6hOG1/ialhP0p2uGTQAgipiDpgI6s=";
+    rev = "8160b7e315c3b2480749b141f9a24d19323d4282";
+    hash = "sha256-0pdbwZa7ikFVKP3OTDufOobIoWUlfWheIC5mSRAF198=";
   };
 
-  npmDepsHash = "sha256-D5e17ubJ8leB5zoNO0DbZ1rUf/JpSJlezOldA3pvtFo=";
+  npmDepsHash = "sha256-01AvG8BPwFIqqYwqHbbEonA0jMIKhF5wnl/azjfmaPE=";
 
   passthru.updateScript = nix-update-script { extraArgs = [ "--version=branch" ]; };
 

From 29ba2db6ae99b0fb93d71c47707ee81f2bf908fc Mon Sep 17 00:00:00 2001
From: zowoq <59103226+zowoq@users.noreply.github.com>
Date: Fri, 6 Feb 2026 11:58:51 +1000
Subject: [PATCH 26/35] python3Packages.protobuf5: disable nixpkgs-update

---
 pkgs/development/python-modules/protobuf/5.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/protobuf/5.nix b/pkgs/development/python-modules/protobuf/5.nix
index f714303f2099..05f9ba66f81a 100644
--- a/pkgs/development/python-modules/protobuf/5.nix
+++ b/pkgs/development/python-modules/protobuf/5.nix
@@ -10,6 +10,7 @@ buildPythonPackage rec {
   pname = "protobuf";
   version = "5.29.6";
   pyproject = true;
+  # nixpkgs-update: no auto update
 
   src = fetchPypi {
     inherit pname version;

From 0d74c65927d2e9cbd2c8ad012021e18d256c2841 Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Thu, 5 Feb 2026 21:50:27 -0500
Subject: [PATCH 27/35] Revert "ci: First-class team package maintainer review
 requests"

This reverts commit 193deb853344a1381bcf7fe077f48b0847eb3a62.
---
 ci/eval/compare/default.nix        |  14 +--
 ci/eval/compare/maintainers.nix    |  53 +++-----
 ci/github-script/bot.js            |  88 ++-----------
 ci/github-script/merge.js          |   2 +-
 ci/github-script/reviewers.js      | 190 ++++++++++++-----------------
 pkgs/stdenv/generic/check-meta.nix |   5 -
 6 files changed, 109 insertions(+), 243 deletions(-)

diff --git a/ci/eval/compare/default.nix b/ci/eval/compare/default.nix
index f1473367a7d9..9791d26e9550 100644
--- a/ci/eval/compare/default.nix
+++ b/ci/eval/compare/default.nix
@@ -161,13 +161,12 @@ let
     );
 
   inherit
-    (callPackage ./maintainers.nix {
+    (callPackage ./maintainers.nix { } {
       changedattrs = lib.attrNames (lib.groupBy (a: a.name) changedPackagePlatformAttrs);
       changedpathsjson = touchedFilesJson;
       removedattrs = lib.attrNames (lib.groupBy (a: a.name) removedPackagePlatformAttrs);
     })
-    users
-    teams
+    maintainers
     packages
     ;
 in
@@ -179,12 +178,10 @@ runCommand "compare"
       cmp-stats
       codeowners
     ];
-    users = builtins.toJSON users;
-    teams = builtins.toJSON teams;
+    maintainers = builtins.toJSON maintainers;
     packages = builtins.toJSON packages;
     passAsFile = [
-      "users"
-      "teams"
+      "maintainers"
       "packages"
     ];
   }
@@ -265,7 +262,6 @@ runCommand "compare"
 
     done
 
-    cp "$usersPath" "$out/maintainers.json"
-    cp "$teamsPath" "$out/teams.json"
+    cp "$maintainersPath" "$out/maintainers.json"
     cp "$packagesPath" "$out/packages.json"
   ''
diff --git a/ci/eval/compare/maintainers.nix b/ci/eval/compare/maintainers.nix
index a0180e10f193..6eb983c9c5f6 100644
--- a/ci/eval/compare/maintainers.nix
+++ b/ci/eval/compare/maintainers.nix
@@ -1,5 +1,7 @@
 {
   lib,
+}:
+{
   changedattrs,
   changedpathsjson,
   removedattrs,
@@ -49,16 +51,15 @@ let
         # updates to .json files.
         # TODO: Support by-name package sets.
         filenames = lib.optional (lib.length path == 1) "pkgs/by-name/${sharded (lib.head path)}/";
-        # meta.maintainers also contains all individual team members.
-        # We only want to ping individuals if they're added individually as maintainers, not via teams.
-        users = package.meta.nonTeamMaintainers or [ ];
-        teams = package.meta.teams or [ ];
+        # TODO: Refactor this so we can ping entire teams instead of the individual members.
+        # Note that this will require keeping track of GH team IDs in "maintainers/teams.nix".
+        maintainers = package.meta.maintainers or [ ];
       }
     ))
     # No need to match up packages without maintainers with their files.
     # This also filters out attributes where `packge = null`, which is the
     # case for libintl, for example.
-    (lib.filter (pkg: pkg.users != [ ] || pkg.teams != [ ]))
+    (lib.filter (pkg: pkg.maintainers != [ ]))
   ];
 
   relevantFilenames =
@@ -93,44 +94,20 @@ let
 
   attrsWithModifiedFiles = lib.filter (pkg: anyMatchingFiles pkg.filenames) attrsWithFilenames;
 
-  userPings =
+  listToPing = lib.concatMap (
     pkg:
     map (maintainer: {
-      type = "user";
-      userId = maintainer.githubId;
+      id = maintainer.githubId;
+      inherit (maintainer) github;
       packageName = pkg.name;
-    });
-
-  teamPings =
-    pkg: team:
-    if team ? github then
-      [
-        {
-          type = "team";
-          teamId = team.githubId;
-          packageName = pkg.name;
-        }
-      ]
-    else
-      userPings pkg team.members;
-
-  maintainersToPing = lib.concatMap (
-    pkg: userPings pkg pkg.users ++ lib.concatMap (teamPings pkg) pkg.teams
+      dueToFiles = pkg.filenames;
+    }) pkg.maintainers
   ) attrsWithModifiedFiles;
 
-  byType = lib.groupBy (ping: ping.type) maintainersToPing;
-
-  byUser = lib.pipe (byType.user or [ ]) [
-    (lib.groupBy (ping: toString ping.userId))
-    (lib.mapAttrs (_user: lib.map (pkg: pkg.packageName)))
-  ];
-  byTeam = lib.pipe (byType.team or [ ]) [
-    (lib.groupBy (ping: toString ping.teamId))
-    (lib.mapAttrs (_team: lib.map (pkg: pkg.packageName)))
-  ];
+  byMaintainer = lib.groupBy (ping: toString ping.id) listToPing;
 in
 {
-  users = byUser;
-  teams = byTeam;
-  packages = lib.catAttrs "name" attrsWithModifiedFiles;
+  maintainers = lib.mapAttrs (_: lib.catAttrs "packageName") byMaintainer;
+
+  packages = lib.catAttrs "packageName" listToPing;
 }
diff --git a/ci/github-script/bot.js b/ci/github-script/bot.js
index 76055a3c2d4c..efb0b1e0a11c 100644
--- a/ci/github-script/bot.js
+++ b/ci/github-script/bot.js
@@ -160,29 +160,6 @@ module.exports = async ({ github, context, core, dry }) => {
     return users[id]
   }
 
-  // Same for teams
-  const teams = {}
-  function getTeam(id) {
-    if (!teams[id]) {
-      teams[id] = github
-        .request({
-          method: 'GET',
-          url: '/organizations/{orgId}/team/{id}',
-          // TODO: Make this work without pull_requests payloads
-          orgId: context.payload.pull_request.base.user.id,
-          id,
-        })
-        .then((resp) => resp.data)
-        .catch((e) => {
-          // Team may have been deleted
-          if (e.status === 404) return null
-          throw e
-        })
-    }
-
-    return teams[id]
-  }
-
   async function handlePullRequest({ item, stats, events }) {
     const log = (k, v) => core.info(`PR #${item.number} - ${k}: ${v}`)
 
@@ -215,49 +192,17 @@ module.exports = async ({ github, context, core, dry }) => {
     })
 
     // Check for any human reviews other than the PR author, GitHub actions and other GitHub apps.
+    // Accounts could be deleted as well, so don't count them.
     const reviews = (
-      await github.graphql(
-        `query($owner: String!, $repo: String!, $pr: Int!) {
-        repository(owner: $owner, name: $repo) {
-          pullRequest(number: $pr) {
-            # Unlikely that there's ever more than 100 reviews, so let's not bother,
-            # but once https://github.com/actions/github-script/issues/309 is resolved,
-            # it would be easy to enable pagination.
-            reviews(first: 100) {
-              nodes {
-                state
-                user: author {
-                  # Only get users, no bots
-                  ... on User {
-                    login
-                    # Set the id field in the resulting JSON to GraphQL's databaseId
-                    # databaseId in GraphQL-land is the same as id in REST-land
-                    id: databaseId
-                  }
-                }
-                onBehalfOf(first: 100) {
-                  nodes {
-                    slug
-                  }
-                }
-              }
-            }
-          }
-        }
-      }`,
-        {
-          owner: context.repo.owner,
-          repo: context.repo.repo,
-          pr: pull_number,
-        },
-      )
-    ).repository.pullRequest.reviews.nodes.filter(
+      await github.paginate(github.rest.pulls.listReviews, {
+        ...context.repo,
+        pull_number,
+      })
+    ).filter(
       (r) =>
-        // The `... on User` makes it such that .login only exists for users,
-        // but we still need to filter the others out.
-        // Accounts could be deleted as well, so don't count them.
-        r.user?.login &&
-        // Also exclude author reviews, can't request their review in any case
+        r.user &&
+        !r.user.login.endsWith('[bot]') &&
+        r.user.type !== 'Bot' &&
         r.user.id !== pull_request.user?.id,
     )
 
@@ -457,16 +402,6 @@ module.exports = async ({ github, context, core, dry }) => {
           if (e.code !== 'ENOENT') throw e
         }
 
-        let team_maintainers = []
-        try {
-          team_maintainers = Object.keys(
-            JSON.parse(await readFile(`${pull_number}/teams.json`, 'utf-8')),
-          ).map((id) => parseInt(id))
-        } catch (e) {
-          // Older artifacts don't have the teams.json, yet.
-          if (e.code !== 'ENOENT') throw e
-        }
-
         // We set this label earlier already, but the current PR state can be very different
         // after handleReviewers has requested reviews, so update it in this case to prevent
         // this label from flip-flopping.
@@ -479,15 +414,14 @@ module.exports = async ({ github, context, core, dry }) => {
           pull_request,
           reviews,
           // TODO: Use maintainer map instead of the artifact.
-          user_maintainers: Object.keys(
+          maintainers: Object.keys(
             JSON.parse(
               await readFile(`${pull_number}/maintainers.json`, 'utf-8'),
             ),
           ).map((id) => parseInt(id)),
-          team_maintainers,
           owners,
+          getTeamMembers,
           getUser,
-          getTeam,
         })
       }
     }
diff --git a/ci/github-script/merge.js b/ci/github-script/merge.js
index d4b5e4a0b826..14d6fd3762ab 100644
--- a/ci/github-script/merge.js
+++ b/ci/github-script/merge.js
@@ -171,7 +171,7 @@ async function handleMerge({
   async function merge() {
     if (dry) {
       core.info(`Merging #${pull_number}... (dry)`)
-      return ['Merge completed (dry)']
+      return 'Merge completed (dry)'
     }
 
     // Using GraphQL mutations instead of the REST /merge endpoint, because the latter
diff --git a/ci/github-script/reviewers.js b/ci/github-script/reviewers.js
index fbbcc996eba9..d10b9f6a98e2 100644
--- a/ci/github-script/reviewers.js
+++ b/ci/github-script/reviewers.js
@@ -6,29 +6,28 @@ async function handleReviewers({
   dry,
   pull_request,
   reviews,
-  user_maintainers,
-  team_maintainers,
+  maintainers,
   owners,
+  getTeamMembers,
   getUser,
-  getTeam,
 }) {
   const pull_number = pull_request.number
 
-  // Users that the PR has already reached, e.g. they've left a review or have been requested for one
-  const users_reached = new Set([
-    ...pull_request.requested_reviewers.map(({ login }) => login.toLowerCase()),
-    ...reviews.map(({ user }) => user.login.toLowerCase()),
-  ])
-  log('reviewers - users_reached', Array.from(users_reached).join(', '))
+  const requested_reviewers = new Set(
+    pull_request.requested_reviewers.map(({ login }) => login.toLowerCase()),
+  )
+  log(
+    'reviewers - requested_reviewers',
+    Array.from(requested_reviewers).join(', '),
+  )
 
-  // Same for teams
-  const teams_reached = new Set([
-    ...pull_request.requested_teams.map(({ slug }) => slug.toLowerCase()),
-    ...reviews.flatMap(({ onBehalfOf }) =>
-      onBehalfOf.nodes.map(({ slug }) => slug.toLowerCase()),
-    ),
-  ])
-  log('reviewers - teams_reached', Array.from(teams_reached).join(', '))
+  const existing_reviewers = new Set(
+    reviews.map(({ user }) => user?.login.toLowerCase()).filter(Boolean),
+  )
+  log(
+    'reviewers - existing_reviewers',
+    Array.from(existing_reviewers).join(', '),
+  )
 
   // Early sanity check, before we start making any API requests. The list of maintainers
   // does not have duplicates so the only user to filter out from this list would be the
@@ -36,17 +35,16 @@ async function handleReviewers({
   // further down again.
   // This is to protect against huge treewides consuming all our API requests for no
   // reason.
-  if (user_maintainers.length + team_maintainers.length > 16) {
+  if (maintainers.length > 16) {
     core.warning('Too many potential reviewers, skipping review requests.')
     // Return a boolean on whether the "needs: reviewers" label should be set.
-    return users_reached.size === 0 && teams_reached.size === 0
+    return existing_reviewers.size === 0 && requested_reviewers.size === 0
   }
 
-  // Users that should be reached
-  var users_to_reach = new Set([
+  const users = new Set([
     ...(
       await Promise.all(
-        user_maintainers.map(async (id) => {
+        maintainers.map(async (id) => {
           const user = await getUser(id)
           // User may have deleted their account
           return user?.login?.toLowerCase()
@@ -57,108 +55,76 @@ async function handleReviewers({
       .filter((handle) => handle && !handle.includes('/'))
       .map((handle) => handle.toLowerCase()),
   ])
+  log('reviewers - users', Array.from(users).join(', '))
+
+  const teams = new Set(
+    owners
+      .map((handle) => handle.split('/'))
+      .filter(([org, slug]) => org === context.repo.owner && slug)
+      .map(([, slug]) => slug),
+  )
+  log('reviewers - teams', Array.from(teams).join(', '))
+
+  const team_members = new Set(
+    (await Promise.all(Array.from(teams, getTeamMembers)))
+      .flat(1)
+      .map(({ login }) => login.toLowerCase()),
+  )
+  log('reviewers - team_members', Array.from(team_members).join(', '))
+
+  const new_reviewers = users
+    .union(team_members)
     // We can't request a review from the author.
     .difference(new Set([pull_request.user?.login.toLowerCase()]))
+  log('reviewers - new_reviewers', Array.from(new_reviewers).join(', '))
 
   // Filter users to repository collaborators. If they're not, they can't be requested
   // for review. In that case, they probably missed their invite to the maintainers team.
-  users_to_reach = new Set(
-    (
-      await Promise.all(
-        Array.from(users_to_reach, async (username) => {
-          // TODO: Restructure this file to only do the collaborator check for those users
-          // who were not already part of a team. Being a member of a team makes them
-          // collaborators by definition.
-          try {
-            await github.rest.repos.checkCollaborator({
-              ...context.repo,
-              username,
-            })
-            return username
-          } catch (e) {
-            if (e.status !== 404) throw e
-            core.warning(
-              `PR #${pull_number}: User ${username} cannot be requested for review because they don't exist or are not a repository collaborator, ignoring. They probably missed the automated invite to the maintainers team (see <https://github.com/NixOS/nixpkgs/issues/234293>).`,
-            )
-          }
-        }),
-      )
-    ).filter(Boolean),
-  )
-  log('reviewers - users_to_reach', Array.from(users_to_reach).join(', '))
+  const reviewers = (
+    await Promise.all(
+      Array.from(new_reviewers, async (username) => {
+        // TODO: Restructure this file to only do the collaborator check for those users
+        // who were not already part of a team. Being a member of a team makes them
+        // collaborators by definition.
+        try {
+          await github.rest.repos.checkCollaborator({
+            ...context.repo,
+            username,
+          })
+          return username
+        } catch (e) {
+          if (e.status !== 404) throw e
+          core.warning(
+            `PR #${pull_number}: User ${username} cannot be requested for review because they don't exist or are not a repository collaborator, ignoring. They probably missed the automated invite to the maintainers team (see <https://github.com/NixOS/nixpkgs/issues/234293>).`,
+          )
+        }
+      }),
+    )
+  ).filter(Boolean)
+  log('reviewers - reviewers', reviewers.join(', '))
 
-  // Similar for teams
-  var teams_to_reach = new Set([
-    ...(
-      await Promise.all(
-        team_maintainers.map(async (id) => {
-          const team = await getTeam(id)
-          // Team may have been deleted
-          return team?.slug?.toLowerCase()
-        }),
-      )
-    ).filter(Boolean),
-    ...owners
-      .map((handle) => handle.split('/'))
-      .filter(
-        ([org, slug]) =>
-          org.toLowerCase() === context.repo.owner.toLowerCase() && slug,
-      )
-      .map(([, slug]) => slug.toLowerCase()),
-  ])
-  teams_to_reach = new Set(
-    (
-      await Promise.all(
-        Array.from(teams_to_reach, async (slug) => {
-          try {
-            await github.rest.teams.checkPermissionsForRepoInOrg({
-              org: context.repo.owner,
-              team_slug: slug,
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-            })
-            return slug
-          } catch (e) {
-            if (e.status !== 404) throw e
-            core.warning(
-              `PR #${pull_number}: Team ${slug} cannot be requested for review because it doesn't exist or has no repository permissions, ignoring. Probably wasn't added to the nixpkgs-maintainers team (see https://github.com/NixOS/nixpkgs/tree/master/maintainers#maintainer-teams)`,
-            )
-          }
-        }),
-      )
-    ).filter(Boolean),
-  )
-  log('reviewers - teams_to_reach', Array.from(teams_to_reach).join(', '))
-
-  if (users_to_reach.size + teams_to_reach.size > 15) {
+  if (reviewers.length > 15) {
     core.warning(
-      `Too many reviewers (users: ${Array.from(users_to_reach).join(', ')}, teams: ${Array.from(teams_to_reach).join(', ')}), skipping review requests.`,
+      `Too many reviewers (${reviewers.join(', ')}), skipping review requests.`,
     )
     // Return a boolean on whether the "needs: reviewers" label should be set.
-    return users_reached.size === 0 && teams_reached.size === 0
+    return existing_reviewers.size === 0 && requested_reviewers.size === 0
   }
 
-  // We don't want to rerequest reviews from people who already reviewed or were requested
-  const users_not_yet_reached = users_to_reach.difference(users_reached)
+  const non_requested_reviewers = new Set(reviewers)
+    .difference(requested_reviewers)
+    // We don't want to rerequest reviews from people who already reviewed.
+    .difference(existing_reviewers)
   log(
-    'reviewers - users_not_yet_reached',
-    Array.from(users_not_yet_reached).join(', '),
-  )
-  // We don't want to rerequest reviews from teams who already reviewed or were requested
-  const teams_not_yet_reached = teams_to_reach.difference(teams_reached)
-  log(
-    'reviewers - teams_not_yet_reached',
-    Array.from(teams_not_yet_reached).join(', '),
+    'reviewers - non_requested_reviewers',
+    Array.from(non_requested_reviewers).join(', '),
   )
 
-  if (users_not_yet_reached.size === 0 && teams_not_yet_reached.size === 0) {
+  if (non_requested_reviewers.size === 0) {
     log('Has reviewer changes', 'false (skipped)')
   } else if (dry) {
     core.info(
-      `Requesting user reviewers for #${pull_number}: ${Array.from(users_not_yet_reached).join(', ')} (dry)`,
-    )
-    core.info(
-      `Requesting team reviewers for #${pull_number}: ${Array.from(teams_not_yet_reached).join(', ')} (dry)`,
+      `Requesting reviewers for #${pull_number}: ${Array.from(non_requested_reviewers).join(', ')} (dry)`,
     )
   } else {
     // We had tried the "request all reviewers at once" thing in the past, but it didn't work out:
@@ -168,17 +134,15 @@ async function handleReviewers({
     await github.rest.pulls.requestReviewers({
       ...context.repo,
       pull_number,
-      reviewers: users_not_yet_reached,
-      team_reviewers: teams_not_yet_reached,
+      reviewers,
     })
   }
 
   // Return a boolean on whether the "needs: reviewers" label should be set.
   return (
-    users_not_yet_reached.size === 0 &&
-    teams_not_yet_reached.size === 0 &&
-    users_reached.size === 0 &&
-    teams_reached.size === 0
+    non_requested_reviewers.size === 0 &&
+    existing_reviewers.size === 0 &&
+    requested_reviewers.size === 0
   )
 }
 
diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index cfc08ba9847f..4f314801a749 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -364,7 +364,6 @@ let
         ];
       sourceProvenance = listOf attrs;
       maintainers = listOf (attrsOf any); # TODO use the maintainer type from lib/tests/maintainer-module.nix
-      nonTeamMaintainers = listOf (attrsOf any); # TODO use the maintainer type from lib/tests/maintainer-module.nix
       teams = listOf (attrsOf any); # TODO similar to maintainers, use a teams type
       priority = int;
       pkgConfigModules = listOf str;
@@ -630,10 +629,6 @@ let
         attrs.meta.maintainers or [ ] ++ concatMap (team: team.members or [ ]) attrs.meta.teams or [ ]
       );
 
-      # Needed for CI to be able to avoid requesting reviews from individual
-      # team members
-      nonTeamMaintainers = attrs.meta.maintainers or [ ];
-
       identifiers =
         let
           # nix-env writes a warning for each derivation that has null in its meta values, so

From 71c3187076c8635b21e5b5d326642cc39a74d41f Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Tue, 29 Jul 2025 11:31:44 -0700
Subject: [PATCH 28/35] nix-prefetch-scripts: add nix-prefetch-fossil

Add a nix-prefetch-fossil script that follows the same pattern as the
existing nix-prefetch-git, nix-prefetch-hg, etc. scripts. This allows
users to easily fetch Fossil repositories and calculate their hashes
for use with fetchfossil in Nix expressions.

The script supports:
- Fetching from Fossil repository URLs
- Specifying revisions (defaults to "trunk")
- Checking expected hashes
- JSON output compatible with other nix-prefetch scripts
---
 .../fetchfossil/nix-prefetch-fossil           | 125 ++++++++++++++++++
 .../nix-prefetch-scripts/default.nix          |   7 +
 2 files changed, 132 insertions(+)
 create mode 100755 pkgs/build-support/fetchfossil/nix-prefetch-fossil

diff --git a/pkgs/build-support/fetchfossil/nix-prefetch-fossil b/pkgs/build-support/fetchfossil/nix-prefetch-fossil
new file mode 100755
index 000000000000..1f3c2636355e
--- /dev/null
+++ b/pkgs/build-support/fetchfossil/nix-prefetch-fossil
@@ -0,0 +1,125 @@
+#!/bin/sh -e
+
+url=
+rev=
+expHash=
+hashType="${NIX_HASH_ALGO:-sha256}"
+
+# Parse command line arguments
+argi=0
+argfun=""
+for arg; do
+    if test -z "$argfun"; then
+        case $arg in
+            --url) argfun=set_url;;
+            --rev) argfun=set_rev;;
+            --hash) argfun=set_expHash;;
+            --help|-h)
+                echo "Usage: nix-prefetch-fossil [options] [URL [REVISION [EXPECTED-HASH]]]"
+                echo ""
+                echo "Options:"
+                echo "  --url URL       Fossil repository URL"
+                echo "  --rev REV       Fossil revision/tag/branch (default: trunk)"
+                echo "  --hash HASH     Expected hash"
+                echo "  --help          Show this help message"
+                exit 0
+                ;;
+            *)
+                argi=$((argi + 1))
+                case $argi in
+                    1) url=$arg;;
+                    2) rev=$arg;;
+                    3) expHash=$arg;;
+                    *) echo "Too many arguments" >&2; exit 1;;
+                esac
+                ;;
+        esac
+    else
+        case $argfun in
+            set_*)
+                var=${argfun#set_}
+                eval "$var='$arg'"
+                ;;
+        esac
+        argfun=""
+    fi
+done
+
+if test -z "$url"; then
+    echo "error: URL is required" >&2
+    echo "Usage: nix-prefetch-fossil [URL [REVISION [EXPECTED-HASH]]]" >&2
+    exit 1
+fi
+
+# Default to trunk if no revision specified
+if test -z "$rev"; then
+    rev="trunk"
+fi
+
+# If the hash was given, check if we already have it in store
+if test -n "$expHash"; then
+    finalPath=$(nix-store --print-fixed-path --recursive "$hashType" "$expHash" fossil-archive)
+    if nix-store --check-validity "$finalPath" 2> /dev/null; then
+        echo "$expHash"
+        exit 0
+    fi
+fi
+
+# Create temporary directory for cloning
+tmpPath="$(mktemp -d --tmpdir fossil-checkout-tmp-XXXXXXXX)"
+cleanup() { rm -rf "$tmpPath"; }
+trap cleanup EXIT
+
+# Fossil wants to write global configuration to $HOME/.fossil
+# We'll let it write to the temp directory instead
+export HOME="$tmpPath"
+
+echo "Fetching Fossil repository $url at revision $rev..." >&2
+
+# Clone the repository
+fossil clone -A nobody "$url" "$tmpPath/fossil-clone.fossil" >&2
+
+# Create directory for checkout
+checkoutDir="$tmpPath/checkout"
+mkdir -p "$checkoutDir"
+
+# Open the repository at the specified revision
+cd "$checkoutDir"
+fossil open "$tmpPath/fossil-clone.fossil" "$rev" >&2
+
+# Get the actual commit hash and date
+checkoutLine=$(fossil info | grep ^checkout:)
+# Remove 'checkout:' prefix and squeeze multiple spaces, then extract fields
+actualRev=$(echo "$checkoutLine" | sed 's/^checkout:[[:space:]]*//' | tr -s ' ' | cut -d' ' -f1)
+# Extract date (format: checkout:     HASH YYYY-MM-DD HH:MM:SS UTC)
+actualDate=$(echo "$checkoutLine" | sed 's/^checkout:[[:space:]]*//' | tr -s ' ' | cut -d' ' -f2)
+cd - >/dev/null
+
+# Remove the fossil checkout file
+rm -f "$checkoutDir/.fslckout"
+
+# Calculate the hash
+hash=$(nix-hash --type "$hashType" --base32 "$checkoutDir")
+echo "hash is $hash" >&2
+
+# Add to store if we don't have an expected hash or if it matches
+if test -z "$expHash" || test "$expHash" = "$hash"; then
+    finalPath=$(nix-store --add-fixed --recursive "$hashType" "$checkoutDir")
+    echo "path is $finalPath" >&2
+elif test -n "$expHash" && test "$expHash" != "$hash"; then
+    echo "error: hash mismatch for Fossil repository $url" >&2
+    echo "  expected: $expHash" >&2
+    echo "  actual:   $hash" >&2
+    exit 1
+fi
+
+# Output JSON result
+cat <<EOF
+{
+  "url": "$url",
+  "rev": "$actualRev",
+  "date": "$actualDate",
+  "$hashType": "$hash",
+  "hash": "$(nix-hash --to-sri --type $hashType $hash)"
+}
+EOF
diff --git a/pkgs/tools/package-management/nix-prefetch-scripts/default.nix b/pkgs/tools/package-management/nix-prefetch-scripts/default.nix
index e9c692d57f8e..64a94eb494d3 100644
--- a/pkgs/tools/package-management/nix-prefetch-scripts/default.nix
+++ b/pkgs/tools/package-management/nix-prefetch-scripts/default.nix
@@ -10,6 +10,7 @@
   cvs,
   darcs,
   findutils,
+  fossil,
   gawk,
   gitMinimal,
   git-lfs,
@@ -65,6 +66,11 @@ rec {
     gawk
     jq
   ];
+  nix-prefetch-fossil =
+    mkPrefetchScript "fossil" ../../../build-support/fetchfossil/nix-prefetch-fossil
+      [
+        fossil
+      ];
   nix-prefetch-git = mkPrefetchScript "git" ../../../build-support/fetchgit/nix-prefetch-git [
     findutils
     gawk
@@ -94,6 +100,7 @@ rec {
       nix-prefetch-bzr
       nix-prefetch-cvs
       nix-prefetch-darcs
+      nix-prefetch-fossil
       nix-prefetch-git
       nix-prefetch-hg
       nix-prefetch-svn

From dec5f03ecc6272717308ecadfba0abadc9a0d767 Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Tue, 29 Jul 2025 12:10:51 -0700
Subject: [PATCH 29/35] althttpd: add updateScript

---
 pkgs/by-name/al/althttpd/package.nix |  3 +++
 pkgs/by-name/al/althttpd/update.sh   | 40 ++++++++++++++++++++++++++++
 2 files changed, 43 insertions(+)
 create mode 100755 pkgs/by-name/al/althttpd/update.sh

diff --git a/pkgs/by-name/al/althttpd/package.nix b/pkgs/by-name/al/althttpd/package.nix
index f467d0fd03f1..3faf0c936441 100644
--- a/pkgs/by-name/al/althttpd/package.nix
+++ b/pkgs/by-name/al/althttpd/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   fetchfossil,
   openssl,
+  nix-update-script,
 }:
 
 stdenv.mkDerivation {
@@ -23,6 +24,8 @@ stdenv.mkDerivation {
     install -Dm755 -t $out/bin althttpd
   '';
 
+  passthru.updateScript = ./update.sh;
+
   meta = {
     description = "Althttpd webserver";
     homepage = "https://sqlite.org/althttpd/";
diff --git a/pkgs/by-name/al/althttpd/update.sh b/pkgs/by-name/al/althttpd/update.sh
new file mode 100755
index 000000000000..66cb9c236d63
--- /dev/null
+++ b/pkgs/by-name/al/althttpd/update.sh
@@ -0,0 +1,40 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p common-updater-scripts jq gawk
+
+set -euo pipefail
+
+nixpkgs="$(git rev-parse --show-toplevel)"
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+# Build and run nix-prefetch-fossil from the local nixpkgs
+prefetch_fossil="$(nix-build "$nixpkgs" -A nix-prefetch-scripts --no-out-link 2>/dev/null)/bin/nix-prefetch-fossil"
+
+echo "Fetching latest althttpd revision..." >&2
+
+# Run nix-prefetch-fossil and capture output
+output=$("$prefetch_fossil" https://sqlite.org/althttpd trunk 2>&1)
+
+# Extract JSON from output (it's at the end after the blank line)
+json_output=$(echo "$output" | gawk '/^{/{p=1} p')
+
+# Extract revision, hash, and date
+full_rev=$(echo "$json_output" | jq -r '.rev')
+new_rev="${full_rev:0:16}"  # Use 16-char prefix for consistency
+new_hash=$(echo "$json_output" | jq -r '.hash')
+commit_date=$(echo "$json_output" | jq -r '.date')
+
+# Fallback to current date if extraction fails
+if [ -z "$commit_date" ] || [ "$commit_date" = "null" ]; then
+    commit_date=$(date +%Y-%m-%d)
+fi
+new_version="unstable-$commit_date"
+
+echo "Updating althttpd to $new_version (rev $new_rev)" >&2
+
+# Use update-source-version from the nixpkgs root
+(
+    cd "$nixpkgs"
+    update-source-version althttpd "$new_version" "$new_hash" \
+        --file="pkgs/by-name/al/althttpd/package.nix" \
+        --rev="$new_rev"
+)

From 548a2cb7c872c8d5e4574ce7fe53de358dfc886f Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Tue, 29 Jul 2025 12:21:04 -0700
Subject: [PATCH 30/35] althttpd: unstable-2023-08-12 -> unstable-2025-08-22

---
 pkgs/by-name/al/althttpd/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/al/althttpd/package.nix b/pkgs/by-name/al/althttpd/package.nix
index 3faf0c936441..e8148aa18a5c 100644
--- a/pkgs/by-name/al/althttpd/package.nix
+++ b/pkgs/by-name/al/althttpd/package.nix
@@ -8,12 +8,12 @@
 
 stdenv.mkDerivation {
   pname = "althttpd";
-  version = "0-unstable-2023-08-12";
+  version = "0-unstable-2025-08-22";
 
   src = fetchfossil {
     url = "https://sqlite.org/althttpd/";
-    rev = "c0bdc68e6c56ef25";
-    hash = "sha256-VoDR5MlVlvar9wYA0kUhvDQVjxDwsZlqrNR3u4Tqw5c=";
+    rev = "e9bf26f78e1f5792";
+    hash = "sha256-Q16tqhnPzYrFkrHTC8NBrdpsbrpjPUkdxLwmyYqUHZo=";
   };
 
   buildInputs = [ openssl ];

From 916dcf96aaa74683bf3faf7ddfdf9464c765da79 Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Tue, 29 Jul 2025 12:36:01 -0700
Subject: [PATCH 31/35] pikchr: add update script

---
 pkgs/by-name/pi/pikchr/package.nix |  2 ++
 pkgs/by-name/pi/pikchr/update.sh   | 40 ++++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+)
 create mode 100755 pkgs/by-name/pi/pikchr/update.sh

diff --git a/pkgs/by-name/pi/pikchr/package.nix b/pkgs/by-name/pi/pikchr/package.nix
index 97a0185323a2..f89061a31ba0 100644
--- a/pkgs/by-name/pi/pikchr/package.nix
+++ b/pkgs/by-name/pi/pikchr/package.nix
@@ -48,6 +48,8 @@ stdenv.mkDerivation {
 
   doCheck = true;
 
+  passthru.updateScript = ./update.sh;
+
   meta = {
     description = "PIC-like markup language for diagrams in technical documentation";
     homepage = "https://pikchr.org";
diff --git a/pkgs/by-name/pi/pikchr/update.sh b/pkgs/by-name/pi/pikchr/update.sh
new file mode 100755
index 000000000000..c565ab5cce6b
--- /dev/null
+++ b/pkgs/by-name/pi/pikchr/update.sh
@@ -0,0 +1,40 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p common-updater-scripts jq gawk
+
+set -euo pipefail
+
+nixpkgs="$(git rev-parse --show-toplevel)"
+cd "$(dirname "${BASH_SOURCE[0]}")"
+
+# Build and run nix-prefetch-fossil from the local nixpkgs
+prefetch_fossil="$(nix-build "$nixpkgs" -A nix-prefetch-scripts --no-out-link 2>/dev/null)/bin/nix-prefetch-fossil"
+
+echo "Fetching latest pikchr revision..." >&2
+
+# Run nix-prefetch-fossil and capture output
+output=$("$prefetch_fossil" https://pikchr.org/home trunk 2>&1)
+
+# Extract JSON from output (it's at the end after the blank line)
+json_output=$(echo "$output" | gawk '/^{/{p=1} p')
+
+# Extract revision, hash, and date
+full_rev=$(echo "$json_output" | jq -r '.rev')
+new_rev="${full_rev:0:16}"  # Use 16-char prefix for consistency
+new_hash=$(echo "$json_output" | jq -r '.hash')
+commit_date=$(echo "$json_output" | jq -r '.date')
+
+# Fallback to current date if extraction fails
+if [ -z "$commit_date" ] || [ "$commit_date" = "null" ]; then
+    commit_date=$(date +%Y-%m-%d)
+fi
+new_version="0-unstable-$commit_date"
+
+echo "Updating pikchr to $new_version (rev $new_rev)" >&2
+
+# Use update-source-version from the nixpkgs root
+(
+    cd "$nixpkgs"
+    update-source-version pikchr "$new_version" "$new_hash" \
+        --file="pkgs/by-name/pi/pikchr/package.nix" \
+        --rev="$new_rev"
+)

From d12ba66216a59a62c03052b0ff944f5fbe79bb5d Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Tue, 29 Jul 2025 12:37:20 -0700
Subject: [PATCH 32/35] pikchr: unstable-2025-02-28 -> unstable-2025-05-12

---
 pkgs/by-name/pi/pikchr/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pi/pikchr/package.nix b/pkgs/by-name/pi/pikchr/package.nix
index f89061a31ba0..02ae12243c53 100644
--- a/pkgs/by-name/pi/pikchr/package.nix
+++ b/pkgs/by-name/pi/pikchr/package.nix
@@ -10,12 +10,12 @@
 stdenv.mkDerivation {
   pname = "pikchr";
   # To update, use the last check-in in https://pikchr.org/home/timeline?r=trunk
-  version = "0-unstable-2025-02-28";
+  version = "0-unstable-2025-05-12";
 
   src = fetchfossil {
     url = "https://pikchr.org/home";
-    rev = "b7fbd56c4eb82ab9";
-    hash = "sha256-7oW1IYYk3YKPjOUPP6qYIdR0oGo9pRDDlyu30J4B3bI=";
+    rev = "2972d1d24849d4c3";
+    hash = "sha256-IZ9m1xa2bO9Sd6XYROkNz6PloLEbR3d3JpSSYyDJR8I=";
   };
 
   # can't open generated html files

From 84fc8fba9e13108bf572f8bfd8fbadcd27554731 Mon Sep 17 00:00:00 2001
From: Wael Nasreddine <wael.nasreddine@gmail.com>
Date: Thu, 5 Feb 2026 20:03:26 -0800
Subject: [PATCH 33/35] ncps: 0.8.2 -> 0.8.3

---
 pkgs/by-name/nc/ncps/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/nc/ncps/package.nix b/pkgs/by-name/nc/ncps/package.nix
index b926379be6d0..558f352bd6f8 100644
--- a/pkgs/by-name/nc/ncps/package.nix
+++ b/pkgs/by-name/nc/ncps/package.nix
@@ -33,13 +33,13 @@ let
 
   finalAttrs = {
     pname = "ncps";
-    version = "0.8.2";
+    version = "0.8.3";
 
     src = fetchFromGitHub {
       owner = "kalbasit";
       repo = "ncps";
       tag = "v${finalAttrs.version}";
-      hash = "sha256-1VWEN1HYV52H/LCfAvFv3R9DxQbHNRnyay3p2BY8dCg=";
+      hash = "sha256-zMMeY2dDF+SKv1mMFPZgeQycqZC1VZLXNiyKkBe/+wc=";
     };
 
     vendorHash = "sha256-AcgC+zTS3eVsbcs0jim4zDBGc3lIjwPbdVT7/KQ9Lkc=";

From 2095c71efcdd82fac420910c206615b2f251dc95 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Thu, 5 Feb 2026 20:52:18 -0800
Subject: [PATCH 34/35] python3Packages.mitmproxy: unpin urwid

---
 pkgs/development/python-modules/mitmproxy/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/mitmproxy/default.nix b/pkgs/development/python-modules/mitmproxy/default.nix
index 31fc2db49508..9715ad66ac9f 100644
--- a/pkgs/development/python-modules/mitmproxy/default.nix
+++ b/pkgs/development/python-modules/mitmproxy/default.nix
@@ -50,6 +50,7 @@ buildPythonPackage rec {
   };
 
   pythonRelaxDeps = [
+    "urwid"
     "zstandard"
 
     # requested by maintainer

From 8626f0298ea92a83afc86db2cacc9028e8a1cf34 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Thu, 5 Feb 2026 20:54:05 -0800
Subject: [PATCH 35/35] pq-cli: unpin urwid

---
 pkgs/by-name/pq/pq-cli/package.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/by-name/pq/pq-cli/package.nix b/pkgs/by-name/pq/pq-cli/package.nix
index 225ee762b0d7..59ade259277c 100644
--- a/pkgs/by-name/pq/pq-cli/package.nix
+++ b/pkgs/by-name/pq/pq-cli/package.nix
@@ -30,6 +30,7 @@ python3Packages.buildPythonApplication rec {
   ];
 
   pythonRelaxDeps = [
+    "urwid"
     "urwid-readline"
   ];