Merge master into staging-nixos

2026-10-04 14:00:04 +00:00 · 2026-09-08 00:26:06 +00:00
parent 3016a6c1d4 cd4578ac64
commit ebda2229b0
141 changed files with 3871 additions and 959 deletions
--- a/doc/hooks/tauri.section.md
+++ b/doc/hooks/tauri.section.md
@@ -73,7 +73,7 @@ Controls the flags passed to `cargo tauri build`.

 #### `tauriBundleType` {#tauri-bundle-type}

-The [bundle type](https://tauri.app/v1/guides/building/) to build.
+The [bundle type](https://tauri.app/reference/javascript/api/namespaceapp/#bundletype) to build.

 #### `dontTauriBuild` {#dont-tauri-build}

--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -4474,6 +4474,14 @@
    githubId = 510553;
    name = "Jos van Bakel";
  };
+  c2fc2f = {
+    name = "c2fc2f";
+    github = "c2fc2f";
+    githubId = 59392138;
+    email = "contact@c2fc2f.com";
+    matrix = "@c2fc2f:sagbot.com";
+    keys = [ { fingerprint = "6EF1 8507 76B5 ABCE 5BF0  C0F8 42E0 E1D1 0B61 1208"; } ];
+  };
  c31io = {
    email = "celiogrand@outlook.com";
    github = "c31io";
@@ -19342,6 +19350,12 @@
    githubId = 708570;
    name = "Manuel Mendez";
  };
+  mmulqueen = {
+    email = "michael@mulqueen.me.uk";
+    github = "mmulqueen";
+    githubId = 6616321;
+    name = "Michael Mulqueen";
+  };
  mmusnjak = {
    email = "marko.musnjak@gmail.com";
    github = "mmusnjak";
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -207,6 +207,8 @@

 - `fail2ban` has been updated to 1.1.1, which has a few breaking changes compared to 1.1.0 ([changelog](https://github.com/fail2ban/fail2ban/blob/1.1.1/ChangeLog))

+- `services.neo4j.tls.<policy_name>`: This policy is no longer enabled by default. If you rely on this policy, you must now explicitly opt-in by setting `services.neo4j.tls.<policy_name>.enable = true;`.
+
 - `systemd.user.extraConfig` has been removed in favor of the structured [](#opt-systemd.user.settings.Manager) option. Use `systemd.user.settings.Manager` to set any `systemd-user.conf(5)` option directly. For example, replace `systemd.user.extraConfig = "DefaultTimeoutStartSec=60";` with `systemd.user.settings.Manager.DefaultTimeoutStartSec = 60;`.

 - `matrix-appservice-discord` was removed from nixpkgs along with its NixOS module (`services.matrix-appservice-discord`) as it is no longer actively maintained upstream. Use the actively-maintained puppeting bridge [`mautrix-discord`](#opt-services.mautrix-discord.enable) instead.
--- a/nixos/modules/security/pam.nix
+++ b/nixos/modules/security/pam.nix
@@ -1252,7 +1252,7 @@ let
                      name = "fscrypt";
                      enable = config.security.pam.enableFscrypt;
                      control = "optional";
-                      modulePath = "${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so";
+                      modulePath = "${pkgs.fscrypt}/lib/security/pam_fscrypt.so";
                    }
                    {
                      name = "zfs_key";
@@ -1449,7 +1449,7 @@ let
                name = "fscrypt";
                enable = config.security.pam.enableFscrypt;
                control = "optional";
-                modulePath = "${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so";
+                modulePath = "${pkgs.fscrypt}/lib/security/pam_fscrypt.so";
              }
              {
                name = "zfs_key";
@@ -1610,7 +1610,7 @@ let
                name = "fscrypt";
                enable = config.security.pam.enableFscrypt;
                control = "optional";
-                modulePath = "${pkgs.fscrypt-experimental}/lib/security/pam_fscrypt.so";
+                modulePath = "${pkgs.fscrypt}/lib/security/pam_fscrypt.so";
              }
              {
                name = "zfs_key-skip-systemd";
@@ -2663,7 +2663,7 @@ in
      ++ lib.optionals config.security.pam.enableOTPW [ pkgs.otpw ]
      ++ lib.optionals config.security.pam.oath.enable [ pkgs.oath-toolkit ]
      ++ lib.optionals config.security.pam.p11.enable [ pkgs.pam_p11 ]
-      ++ lib.optionals config.security.pam.enableFscrypt [ pkgs.fscrypt-experimental ]
+      ++ lib.optionals config.security.pam.enableFscrypt [ pkgs.fscrypt ]
      ++ lib.optionals config.security.pam.u2f.enable [ pkgs.pam_u2f ];

    security.wrappers = {
--- a/nixos/modules/security/polkit.nix
+++ b/nixos/modules/security/polkit.nix
@@ -151,6 +151,17 @@ in
        # ~/.config/Yubico/u2f_keys (the default key file location)
        ProtectHome = "read-only";
      })
+      (mkIf config.security.pam.yubico.enable {
+        # Override upstream PrivateDevices=yes to allow access to /dev/hidraw*
+        PrivateDevices = false;
+        DeviceAllow = [ "char-hidraw rw" ];
+      })
+      (mkIf config.services.fprintd.enable {
+        # Override upstream PrivateDevices=yes to allow access to /dev/bus/usb/**
+        PrivateDevices = false;
+        DeviceAllow = [ "char-usb_device rw" ];
+        RestrictAddressFamilies = [ "AF_NETLINK" ];
+      })
      (mkIf config.security.pam.zfs.enable {
        PrivateDevices = false;
        DeviceAllow = [
--- a/nixos/modules/services/databases/neo4j.nix
+++ b/nixos/modules/services/databases/neo4j.nix
@@ -13,6 +13,7 @@ let
    opt: lib.isOption opt && opt.type == lib.types.path && opt.highestPrio >= 1500;

  sslPolicies = lib.mapAttrsToList (name: conf: ''
+    dbms.ssl.policy.${name}.enabled=${lib.boolToString conf.enable}
    dbms.ssl.policy.${name}.allow_key_generation=${lib.boolToString conf.allowKeyGeneration}
    dbms.ssl.policy.${name}.base_directory=${conf.baseDirectory}
    ${lib.optionalString (conf.ciphers != null) ''
@@ -35,7 +36,7 @@ let
    dbms.ssl.policy.${name}.tls_versions=${lib.concatStringsSep "," conf.tlsVersions}
    dbms.ssl.policy.${name}.trust_all=${lib.boolToString conf.trustAll}
    dbms.ssl.policy.${name}.trusted_dir=${conf.trustedDir}
-  '') cfg.ssl.policies;
+  '') (lib.filterAttrs (_: v: v.enable) cfg.ssl.policies);

  serverConfig = pkgs.writeText "neo4j.conf" ''
    # General
@@ -467,6 +468,8 @@ in
            }:
            {
              options = {
+                enable = lib.mkEnableOption "this policy";
+
                allowKeyGeneration = lib.mkOption {
                  type = lib.types.bool;
                  default = false;
@@ -714,6 +717,6 @@ in
    };

  meta = {
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.c2fc2f ];
  };
 }
--- a/nixos/tests/gocron.nix
+++ b/nixos/tests/gocron.nix
@@ -34,10 +34,10 @@
      return status == 0 and int(output) == 1

    def start_job():
-      machine.succeed("curl -X POST http://localhost:8156/api/jobs/Test%20job")
+      machine.succeed("curl -X POST http://localhost:8156/api/jobs/test-job")

    def job_ran_successfully() -> bool:
-      output = machine.succeed("curl http://localhost:8156/api/runs/Test%20job | jq '.[0].status_id, .[0].logs.[2].message'")
+      output = machine.succeed("curl http://localhost:8156/api/runs/test-job | jq '.[0].status_id, .[0].logs.[2].message'")
      split_output = output.split('\n')
      ran_successfully = int(split_output[0]) == 3
      log_message_as_expected = "Job runs not successfully" in split_output[1]
--- a/nixos/tests/lomiri-system-settings.nix
+++ b/nixos/tests/lomiri-system-settings.nix
@@ -29,6 +29,7 @@
        ubuntu-classic
      ];

+      services.printing.enable = true;
      services.upower.enable = true;
    };

@@ -37,7 +38,7 @@
  testScript =
    let
      settingsPages = [
-        # Base pages
+        # Network
        {
          name = "wifi";
          type = "internal";
@@ -55,6 +56,8 @@
          element = "Add|Manual|Configuration";
          skipOCR = true;
        }
+
+        # Personal
        {
          name = "appearance";
          type = "internal";
@@ -85,6 +88,13 @@
          type = "internal";
          element = "Edge drag";
        }
+
+        # System
+        {
+          name = "printing";
+          type = "internal";
+          element = "no printers configured";
+        }
        {
          name = "mouse";
          type = "internal";
@@ -95,13 +105,10 @@
          type = "internal";
          element = "Time zone|Set the time and date";
        }
-
-        # External plugins
        {
          name = "security-privacy";
-          type = "external";
+          type = "internal";
          element = "Locking|unlocking|permissions";
-          elementLocalised = "Sperren|Entsperren|Berechtigungen";
        }
      ];
    in
--- a/nixos/tests/portunus.nix
+++ b/nixos/tests/portunus.nix
@@ -13,6 +13,7 @@

  testScript = ''
    machine.wait_for_unit("portunus.service")
-    machine.succeed("curl --fail -vvv http://localhost:8080/")
+    machine.wait_for_open_port(8080)
+    machine.wait_until_succeeds("curl --fail -vvv http://localhost:8080/")
  '';
 }
--- a/pkgs/applications/editors/vim/plugins/generated.nix
+++ b/pkgs/applications/editors/vim/plugins/generated.nix
@@ -2155,6 +2155,20 @@ final: prev: {
    meta.hydraPlatforms = [ ];
  };

+  boolean-toggle-nvim = buildVimPlugin {
+    pname = "boolean-toggle.nvim";
+    version = "0.5.0-1";
+    src = fetchFromGitHub {
+      owner = "DrKJeff16";
+      repo = "boolean-toggle.nvim";
+      tag = "v0.5.0-1";
+      hash = "sha256-93ppL2JP2K+lfeCtJG0R8YW6cLk8JJrPa5RAGKnzOlE=";
+    };
+    meta.homepage = "https://github.com/DrKJeff16/boolean-toggle.nvim/";
+    meta.license = getLicenseFromSpdxId "GPL-2.0-only";
+    meta.hydraPlatforms = [ ];
+  };
+
  bracey-vim = buildVimPlugin {
    pname = "bracey.vim";
    version = "0-unstable-2021-08-20";
--- a/pkgs/applications/editors/vim/plugins/vim-plugin-names
+++ b/pkgs/applications/editors/vim/plugins/vim-plugin-names
@@ -152,6 +152,7 @@ https://github.com/HampusHauffman/block.nvim/,,
 https://github.com/uloco/bluloco.nvim/,,
 https://github.com/rockerBOO/boo-colorscheme-nvim/,,
 https://github.com/nat-418/boole.nvim/,,
+https://github.com/DrKJeff16/boolean-toggle.nvim/,,
 https://github.com/turbio/bracey.vim/,,
 https://github.com/fruit-in/brainfuck-vim/,,
 https://github.com/famiu/bufdelete.nvim/,,
--- a/pkgs/applications/networking/cluster/nomad/default.nix
+++ b/pkgs/applications/networking/cluster/nomad/default.nix
@@ -1,6 +1,5 @@
 {
  lib,
-  buildGo125Module,
  buildGo126Module,
  fetchFromGitHub,
  nixosTests,
@@ -96,7 +95,7 @@ rec {
  };

  nomad_1_11 = generic {
-    buildGoModule = buildGo125Module;
+    buildGoModule = buildGo126Module;
    version = "1.11.3";
    hash = "sha256-J+w53HlMlrXX5yKjDYhf3rSGt1pmOyNcPlOqyUrkLWE=";
    vendorHash = "sha256-67etQUjcPXz4VVpNXLVusQlEybxEqKfYQcNTNL4X8bA=";
@@ -108,7 +107,7 @@ rec {
  };

  nomad_1_10 = generic {
-    buildGoModule = buildGo125Module;
+    buildGoModule = buildGo126Module;
    version = "1.10.5";
    hash = "sha256-NFH++oYWb6vQN6cOPByscI/ZBWDNy4YbcLiBMO3/jVU=";
    vendorHash = "sha256-QcTw9kKwoHIvXZoxfDohFG+sBs8OLvYPeygygDClsn8=";
@@ -120,7 +119,7 @@ rec {
  };

  nomad_1_9 = generic {
-    buildGoModule = buildGo125Module;
+    buildGoModule = buildGo126Module;
    version = "1.9.7";
    hash = "sha256-U02H6DPr1friQ9EwqD/wQnE2Fm20OE5xNccPDJfnsqI=";
    vendorHash = "sha256-9GnwqkexJAxrhW9yJFaDTdSaZ+p+/dcMuhlusp4cmyw=";
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -54,13 +54,13 @@
    "vendorHash": "sha256-bJcVf4Yj70VwKn0p6RN+/dc5J+K6xFJcifVei9dK2bA="
  },
  "aminueza_minio": {
-    "hash": "sha256-2NbI/ANAuCogB4H31N2k5dPpg8jqRULFdWD0+NxQD5c=",
+    "hash": "sha256-pw8QgjdU0c4w6ZUJLCy3zTEk0UTML1Mymh+UsmBAdrQ=",
    "homepage": "https://registry.terraform.io/providers/aminueza/minio",
    "owner": "aminueza",
    "repo": "terraform-provider-minio",
-    "rev": "v3.41.0",
+    "rev": "v3.41.1",
    "spdx": "AGPL-3.0",
-    "vendorHash": "sha256-NplukDVIzE8OUBOUdi0NTEPYBIGTwIaXxd+j5FdJjf8="
+    "vendorHash": "sha256-V9yH/dGXZJ85XVQAksL4QCRbhS9yrXy2tY8Jr+kKQdk="
  },
  "archessmn_powerdns": {
    "hash": "sha256-1bjQFu3k0ERBga94pQ8HZjbfu3qlxnMQLjSkDU6Vp/I=",
@@ -209,11 +209,11 @@
    "vendorHash": "sha256-R3w7olc94QJuMk62bfvuM9aU+KlmNTUhojl/j9gmHjk="
  },
  "cloudamqp_cloudamqp": {
-    "hash": "sha256-UOEZK9zjHwUId86hawiWVtXAY3eGwbQIQLSmLHBbgCc=",
+    "hash": "sha256-GMfBdLUqw/3WEtZfP6ShCEwheHeUa/1EDMzIuYGalvA=",
    "homepage": "https://registry.terraform.io/providers/cloudamqp/cloudamqp",
    "owner": "cloudamqp",
    "repo": "terraform-provider-cloudamqp",
-    "rev": "v1.47.0",
+    "rev": "v1.48.0",
    "spdx": "MPL-2.0",
    "vendorHash": "sha256-hgi4CyYMNBmxAUc93uFc4J13nlgVOQNLYyLYz+rnWlM="
  },
@@ -292,13 +292,13 @@
    "vendorHash": "sha256-3o6YRDrq4rQhNAFyqiGJrAoxuAykWw85OExRGSE3kGI="
  },
  "datadog_datadog": {
-    "hash": "sha256-ATKQBtgI4yfjZo09iMPlH7g14xc6bI9ebP64GTtNZwk=",
+    "hash": "sha256-Sq3gP01DrTm41fLTZvavNTNhMy7AfMcbxe+ac8omJIQ=",
    "homepage": "https://registry.terraform.io/providers/DataDog/datadog",
    "owner": "DataDog",
    "repo": "terraform-provider-datadog",
-    "rev": "v4.19.0",
+    "rev": "v4.20.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-Uy798AsTpZNtaggIxUlf3WNIFTmvigtPp0yWygcyzJY="
+    "vendorHash": "sha256-PoM4C03Q8bAz1hqasx0SWYWEVW7dS7tCcI+tLE2MHLE="
  },
  "datadrivers_nexus": {
    "hash": "sha256-t9hpZ4COmMPvs4TgcZLeuOA23oD5vvHw8UVK7SpzI0Y=",
@@ -382,13 +382,13 @@
    "vendorHash": "sha256-uokHd4hDvWl6mrBa062F/uZmYPnW3TIZZKZwKBVq+Lo="
  },
  "e-breuninger_netbox": {
-    "hash": "sha256-qyzw5a35twJ5gsEe0ANv6a9MMD0UyV8hYbYt/2bBJ/k=",
+    "hash": "sha256-tbBCGOcbDhiOjdgyS9lSw6IbMgzZwnbM40/InvhUKCA=",
    "homepage": "https://registry.terraform.io/providers/e-breuninger/netbox",
    "owner": "e-breuninger",
    "repo": "terraform-provider-netbox",
-    "rev": "v5.7.0",
+    "rev": "v5.8.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-y9GRTuoh1X6GfGkGZbPpO500y8DoJS1dnwZL3BCTUcY="
+    "vendorHash": "sha256-NbFksqqwwelhSig6+5kqoTuUsUab8we+sSp1izfpF10="
  },
  "equinix_equinix": {
    "hash": "sha256-gPuRvWQiJZdyUGTNMCQSEFmbqC5ralxroBSbBprFe/8=",
@@ -517,13 +517,13 @@
    "vendorHash": "sha256-ikBqIxD5aTOcwNHCMN6EaOwSHCAP5n/SULuqQXPLpOc="
  },
  "hashicorp_aws": {
-    "hash": "sha256-INQXP7BRW+QbcxYd6QmIKLzilmXlT2ntVMONcpk5Q4g=",
+    "hash": "sha256-qSGvtJqiViBdBZD6gMZSaUXbZNZmCBBb1kkKUjCK0YM=",
    "homepage": "https://registry.terraform.io/providers/hashicorp/aws",
    "owner": "hashicorp",
    "repo": "terraform-provider-aws",
-    "rev": "v6.62.0",
+    "rev": "v6.63.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-e6ILWC7E2S9u+evH9OmS1hyn6WmYn9r0ch/zfJJ7xrg="
+    "vendorHash": "sha256-lrcDMPenGnTgKnrdL9oCk3Pg/WObKYqKxbLXqjWR7U4="
  },
  "hashicorp_awscc": {
    "hash": "sha256-cVpZA8XK3d6RDjdo8KMbQ/J540ZRzUb79S2wq/Vzo6Y=",
@@ -1328,11 +1328,11 @@
    "vendorHash": "sha256-kWwfjiWDm/voT95oxyNtCltRzeBJYR3gJo1USV0j/Uo="
  },
  "tencentcloudstack_tencentcloud": {
-    "hash": "sha256-p8DBZ2NRC5Dswf+iRSg00zBi3+mA1Y3jNKS5ikpJ1Qo=",
+    "hash": "sha256-nuzKpMtJT0y4OuSvYTKbAs1+FYTpnXnWYI9oEzdt1BM=",
    "homepage": "https://registry.terraform.io/providers/tencentcloudstack/tencentcloud",
    "owner": "tencentcloudstack",
    "repo": "terraform-provider-tencentcloud",
-    "rev": "v1.83.27",
+    "rev": "v1.83.29",
    "spdx": "MPL-2.0",
    "vendorHash": null
  },
--- a/pkgs/applications/networking/instant-messengers/discord/linux.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/linux.nix
@@ -285,7 +285,8 @@ stdenv.mkDerivation (finalAttrs: {
    exec = binaryName;
    icon = pname;
    inherit desktopName;
-    genericName = meta.description;
+    comment = meta.description;
+    genericName = "Instant Messenger";
    categories = [
      "Network"
      "InstantMessaging"
--- a/pkgs/applications/video/streamlink-twitch-gui/bin.nix
+++ b/pkgs/applications/video/streamlink-twitch-gui/bin.nix
@@ -1,159 +0,0 @@
-{
-  autoPatchelfHook,
-  fetchurl,
-  lib,
-  copyDesktopItems,
-  makeDesktopItem,
-  makeWrapper,
-  stdenv,
-  wrapGAppsHook3,
-  at-spi2-core,
-  atk,
-  alsa-lib,
-  cairo,
-  cups,
-  dbus,
-  expat,
-  gcc-unwrapped,
-  gdk-pixbuf,
-  glib,
-  pango,
-  gtk3-x11,
-  libudev0-shim,
-  libuuid,
-  libgbm,
-  nss,
-  nspr,
-  libxtst,
-  libxscrnsaver,
-  libxrender,
-  libxrandr,
-  libxi,
-  libxfixes,
-  libxext,
-  libxdamage,
-  libxcursor,
-  libxcomposite,
-  libx11,
-  libxcb,
-  streamlink,
-}:
-let
-  basename = "streamlink-twitch-gui";
-  runtimeLibs = lib.makeLibraryPath [
-    gtk3-x11
-    libudev0-shim
-  ];
-  runtimeBins = lib.makeBinPath [ streamlink ];
-
-in
-stdenv.mkDerivation rec {
-  pname = "${basename}-bin";
-  version = "2.5.3";
-
-  src =
-    {
-      x86_64-linux = fetchurl {
-        url = "https://github.com/streamlink/${basename}/releases/download/v${version}/${basename}-v${version}-linux64.tar.gz";
-        hash = "sha256-ue5Ehj/dLOIJNJVq0Pd6EbA1hkVPz5m+3chVvEXaH6U=";
-      };
-      i686-linux = fetchurl {
-        url = "https://github.com/streamlink/${basename}/releases/download/v${version}/${basename}-v${version}-linux32.tar.gz";
-        hash = "sha256-y252QhVsRakngdApOHgegMMhs61KTxL9gfPjBjaSKOI=";
-      };
-    }
-    .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
-
-  nativeBuildInputs = [
-    at-spi2-core
-    atk
-    alsa-lib
-    autoPatchelfHook
-    cairo
-    copyDesktopItems
-    cups.lib
-    dbus.lib
-    expat
-    gcc-unwrapped
-    gdk-pixbuf
-    glib
-    pango
-    gtk3-x11
-    libgbm
-    nss
-    nspr
-    libuuid
-    libx11
-    libxcb
-    libxcomposite
-    libxcursor
-    libxdamage
-    libxext
-    libxfixes
-    libxi
-    libxrandr
-    libxrender
-    libxscrnsaver
-    libxtst
-    makeWrapper
-    wrapGAppsHook3
-  ];
-
-  buildInputs = [ streamlink ];
-
-  dontBuild = true;
-  dontConfigure = true;
-
-  installPhase = ''
-    runHook preInstall
-    mkdir -p $out/{bin,opt/${basename},share}
-
-    # Install all files, remove unnecessary ones
-    cp -a . $out/opt/${basename}/
-    rm -r $out/opt/${basename}/{{add,remove}-menuitem.sh,credits.html,icons/}
-    ln -s $out/opt/${basename}/${basename} $out/bin/
-    for res in 16 32 48 64 128 256; do
-      install -Dm644 \
-        icons/icon-"$res".png \
-        $out/share/icons/hicolor/"$res"x"$res"/apps/${basename}.png
-    done
-    runHook postInstall
-  '';
-
-  preFixup = ''
-    gappsWrapperArgs+=(
-      --add-flags "--no-version-check" \
-      --prefix LD_LIBRARY_PATH : ${runtimeLibs} \
-      --prefix PATH : ${runtimeBins}
-    )
-  '';
-
-  desktopItems = [
-    (makeDesktopItem {
-      name = basename;
-      exec = basename;
-      icon = basename;
-      desktopName = "Streamlink Twitch GUI";
-      genericName = meta.description;
-      categories = [
-        "AudioVideo"
-        "Network"
-      ];
-    })
-  ];
-
-  meta = {
-    description = "Twitch.tv browser for Streamlink";
-    longDescription = "Browse Twitch.tv and watch streams in your videoplayer of choice";
-    homepage = "https://streamlink.github.io/streamlink-twitch-gui/";
-    downloadPage = "https://github.com/streamlink/streamlink-twitch-gui/releases";
-    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
-    license = lib.licenses.mit;
-    mainProgram = "streamlink-twitch-gui";
-    maintainers = [ ];
-    platforms = [
-      "x86_64-linux"
-      "i686-linux"
-    ];
-  };
-}
--- a/pkgs/applications/virtualization/docker/compose.nix
+++ b/pkgs/applications/virtualization/docker/compose.nix
@@ -7,17 +7,17 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "docker-compose";
-  version = "5.5.0";
+  version = "5.5.1";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "docker";
    repo = "compose";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-EUPf76jj4Wc287zZNiDzSljAnwl8adSkUAz8JJaT1es=";
+    hash = "sha256-f4lIO9zSONHSQoZy80NSg3pcXyDfT5GXRcB3RkXC9sw=";
  };

-  vendorHash = "sha256-3Jlc/0g/IjH7hhnx70PgZ76Dl8nPzv9M2Gee3TXOGCg=";
+  vendorHash = "sha256-8I+gPz7gdNKjuqLi0AnW4NjaONKxoYIhHZR064QYt6g=";

  nativeInstallCheckInputs = [ versionCheckHook ];

--- a/pkgs/build-support/docker/default.nix
+++ b/pkgs/build-support/docker/default.nix
@@ -71,9 +71,7 @@ let
      # A user is required by nix
      # https://github.com/NixOS/nix/blob/9348f9291e5d9e4ba3c4347ea1b235640f54fd79/src/libutil/util.cc#L478
      export USER=nobody
-      ${lib.getExe' buildPackages.nix "nix-store"} --load-db < ${
-        closureInfo { rootPaths = contentsList; }
-      }/registration
+      nix-store --load-db < ${closureInfo { rootPaths = contentsList; }}/registration
      # Reset registration times to make the image reproducible
      ${lib.getExe buildPackages.sqlite} nix/var/nix/db/db.sqlite "UPDATE ValidPaths SET registrationTime = ''${SOURCE_DATE_EPOCH}"

@@ -430,6 +428,7 @@ rec {
      keepContentsDirlinks ? false,
      # Additional commands to run on the layer before it is tar'd up.
      extraCommands ? "",
+      nativeBuildInputs ? [ ],
      uid ? 0,
      gid ? 0,
    }:
@@ -441,7 +440,8 @@ rec {
          jshon
          rsync
          tarsum
-        ];
+        ]
+        ++ nativeBuildInputs;
      }
      ''
        mkdir layer
@@ -705,6 +705,7 @@ rec {
              uid
              gid
              ;
+            nativeBuildInputs = optionals includeNixDB [ nix ];
            extraCommands = extraCommandsWithDB;
            copyToRoot = rootContents;
          }
@@ -1082,6 +1083,9 @@ rec {
        ]
        ++ optionals enableFakechroot [
          proot
+        ]
+        ++ optionals includeNixDB [
+          nix
        ];
        postBuild = ''
          mv $out old_out
--- a/pkgs/by-name/al/alerta-server/package.nix
+++ b/pkgs/by-name/al/alerta-server/package.nix
@@ -50,5 +50,8 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    mainProgram = "alertad";
    license = lib.licenses.asl20;
    maintainers = [ ];
+    knownVulnerabilities = [
+      "CVE-2026-34400: vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. This issue has been patched in version 9.1.0." # 505619 in nixpkgs
+    ];
  };
 })
--- a/pkgs/by-name/al/allure/package.nix
+++ b/pkgs/by-name/al/allure/package.nix
@@ -8,11 +8,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "allure";
-  version = "2.46.0";
+  version = "2.46.1";

  src = fetchurl {
    url = "https://github.com/allure-framework/allure2/releases/download/${finalAttrs.version}/allure-${finalAttrs.version}.tgz";
-    hash = "sha256-KRyhI4t+Z9Vho1/N758shQyBHBxh9FsccNbX87sBpog=";
+    hash = "sha256-N0KBZPMQyNE3z90sOiXQSbIzJh3asT4b1N/XYntcv40=";
  };

  dontConfigure = true;
--- a/pkgs/by-name/an/andcli/package.nix
+++ b/pkgs/by-name/an/andcli/package.nix
@@ -9,7 +9,7 @@

 buildGoModule (finalAttrs: {
  pname = "andcli";
-  version = "2.8.1";
+  version = "2.9.0";

  __structuredAttrs = true;

@@ -19,10 +19,10 @@ buildGoModule (finalAttrs: {
    owner = "tjblackheart";
    repo = "andcli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-BVF+r8N+/PvARxANlL7nPf23ABbp+O1DNPblMyXroq8=";
+    hash = "sha256-ls/QWEAxxnsersk7L3AaRo5jo1Vsao61c2mgjt91sAQ=";
  };

-  vendorHash = "sha256-aFOwfloqFPPMgCufwmDgfM9lDinkFvu4i+BiVUo+Iwk=";
+  vendorHash = "sha256-+qz2vIh4GTkdmhjGvYqJYZ9ZMI9f+yXObmyGHk/5Cyg=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/au/audacity/audacity-deployment-target.patch
+++ b/pkgs/by-name/au/audacity/audacity-deployment-target.patch
@@ -0,0 +1,20 @@
+diff --git a/buildscripts/cmake/SetupBuildEnvironment.cmake b/buildscripts/cmake/SetupBuildEnvironment.cmake
+index d45a7728590..c4c77d48198 100644
+--- a/buildscripts/cmake/SetupBuildEnvironment.cmake
+++ b/buildscripts/cmake/SetupBuildEnvironment.cmake
+@@ -159,7 +159,13 @@
+         endif()
+     endif() #MUE_COMPILE_QT5_COMPAT
+ 
+-    set(MACOSX_DEPLOYMENT_TARGET 10.15)
+-    set(CMAKE_OSX_DEPLOYMENT_TARGET 10.15)
+    if (NOT CMAKE_OSX_DEPLOYMENT_TARGET)
+        if (NOT "$ENV{MACOSX_DEPLOYMENT_TARGET}" STREQUAL "")
+            set(CMAKE_OSX_DEPLOYMENT_TARGET "$ENV{MACOSX_DEPLOYMENT_TARGET}")
+        else()
+            set(CMAKE_OSX_DEPLOYMENT_TARGET 10.15)
+        endif()
+    endif()
+    set(MACOSX_DEPLOYMENT_TARGET "${CMAKE_OSX_DEPLOYMENT_TARGET}")
+ endif(OS_IS_MAC)
+ 
--- a/pkgs/by-name/au/audacity/macdeployqt-extra-options.patch
+++ b/pkgs/by-name/au/audacity/macdeployqt-extra-options.patch
@@ -0,0 +1,25 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 17e3e15e4de..49d869a6777 100644
+--- a/CMakeLists.txt
+++ b/CMakeLists.txt
+@@ -62,6 +62,8 @@
+ 
+ set(AU4_REVISION "" CACHE STRING "Build revision")
+ 
+set(AU4_MACDEPLOYQT_EXTRA_OPTIONS "" CACHE STRING "Semicolon-separated extra arguments for macdeployqt")
+
+ # Modules (alphabetical order please)
+ option(AU_BUILD_APPSHELL_MODULE "Build appshell module" ON)
+ option(AU_BUILD_APPSHELL_TESTS "Build appshell tests" ${MUSE_ENABLE_UNIT_TESTS})
+diff --git a/src/app/CMakeLists.txt b/src/app/CMakeLists.txt
+index a653a0b4cda..1ee5a5b31eb 100644
+--- a/src/app/CMakeLists.txt
+++ b/src/app/CMakeLists.txt
+@@ -418,6 +418,7 @@
+         DEPLOY_TOOL_OPTIONS
+             -qmldir=${PROJECT_SOURCE_DIR}/src
+             -qmldir=${PROJECT_SOURCE_DIR}/muse/framework
+            ${AU4_MACDEPLOYQT_EXTRA_OPTIONS}
+     )
+     install(SCRIPT ${deploy_script})
+ 
--- a/pkgs/by-name/au/audacity/muse-deps-wxwidgets-frameworks.patch
+++ b/pkgs/by-name/au/audacity/muse-deps-wxwidgets-frameworks.patch
@@ -0,0 +1,13 @@
+diff --git a/muse_deps/recipes/wxwidgets/meta.cmake b/muse_deps/recipes/wxwidgets/meta.cmake
+index b30de19..3d18391 100644
+--- a/muse_deps/recipes/wxwidgets/meta.cmake
+++ b/muse_deps/recipes/wxwidgets/meta.cmake
+@@ -35,6 +35,8 @@
+     endif()
+     separate_arguments(wx_cxx_list NATIVE_COMMAND "${wx_cxx}")
+     separate_arguments(wx_libs_list NATIVE_COMMAND "${wx_libs}")
+    # Keep framework flags and names together as a single CMake link item.
+    string(REGEX REPLACE "-framework;([^;]+)" "-framework \\1" wx_libs_list "${wx_libs_list}")
+ 
+     set(incs "")
+     set(opts "")
--- a/pkgs/by-name/au/audacity/muse-framework-deployment-target.patch
+++ b/pkgs/by-name/au/audacity/muse-framework-deployment-target.patch
@@ -0,0 +1,21 @@
+diff --git a/muse/buildscripts/cmake/SetupBuildEnvironment.cmake b/muse/buildscripts/cmake/SetupBuildEnvironment.cmake
+index 994b4ab30a..71a910bcfa 100644
+--- a/muse/buildscripts/cmake/SetupBuildEnvironment.cmake
+++ b/muse/buildscripts/cmake/SetupBuildEnvironment.cmake
+@@ -63,8 +63,14 @@
+ 
+ # Mac-specific
+ if(OS_IS_MAC)
+-    set(MACOSX_DEPLOYMENT_TARGET 10.15.4)
+-    set(CMAKE_OSX_DEPLOYMENT_TARGET 10.15.4)
+    if(NOT CMAKE_OSX_DEPLOYMENT_TARGET)
+        if(NOT "$ENV{MACOSX_DEPLOYMENT_TARGET}" STREQUAL "")
+            set(CMAKE_OSX_DEPLOYMENT_TARGET "$ENV{MACOSX_DEPLOYMENT_TARGET}")
+        else()
+            set(CMAKE_OSX_DEPLOYMENT_TARGET 10.15.4)
+        endif()
+    endif()
+    set(MACOSX_DEPLOYMENT_TARGET "${CMAKE_OSX_DEPLOYMENT_TARGET}")
+ endif(OS_IS_MAC)
+ 
+ # MSVC-specific
--- a/pkgs/by-name/au/audacity/package.nix
+++ b/pkgs/by-name/au/audacity/package.nix
@@ -1,214 +1,193 @@
 {
-  stdenv,
  lib,
-  fetchFromGitHub,
+  stdenv,
+  fetchurl,
+
+  # nativeBuildInputs
  cmake,
-  makeWrapper,
-  wrapGAppsHook3,
+  git,
+  linuxHeaders,
+  ninja,
  pkg-config,
  python3,
-  gettext,
-  file,
-  libvorbis,
-  libmad,
+  qt6,
+  wrapGAppsHook3,
+
+  # buildInputs
+  alsa-lib,
+  expat,
+  ffmpeg,
+  flac,
+  freetype,
+  harfbuzz,
+  lame,
  libjack2,
-  lv2,
-  lilv,
+  libogg,
+  libopus,
+  libsndfile,
+  libvorbis,
  mpg123,
  opusfile,
-  rapidjson,
-  serd,
-  sord,
-  sqlite,
-  sratom,
-  suil,
-  libsndfile,
-  soxr,
-  flac,
-  lame,
-  twolame,
-  expat,
-  libid3tag,
-  libopus,
-  libuuid,
-  ffmpeg,
-  soundtouch,
-  portaudio, # given up fighting their portaudio.patch?
-  portmidi,
-  linuxHeaders,
-  alsa-lib,
-  at-spi2-core,
-  dbus,
-  libepoxy,
-  libxdmcp,
-  libxtst,
-  libpthread-stubs,
-  libsbsms_2_3_0,
-  libselinux,
-  libsepol,
-  libxkbcommon,
-  util-linux,
+  portaudio,
+  pugixml,
+  utf8cpp,
  wavpack,
  wxwidgets_3_2,
-  gtk3,
-  libpng,
-  libjpeg,
+  zlib,
 }:
-
-# TODO
-# 1. detach sbsms
-
+let
+  wxwidgets = wxwidgets_3_2.override { withWebKit = false; };
+in
 stdenv.mkDerivation (finalAttrs: {
  pname = "audacity";
-  version = "3.7.9";
+  version = "4.0.0";

-  src = fetchFromGitHub {
-    owner = "audacity";
-    repo = "audacity";
-    rev = "Audacity-${finalAttrs.version}";
-    hash = "sha256-q/5LPL76GPEFGRxTZcuxmLuq15fwbw2Mak/q2RObghk=";
+  src = fetchurl {
+    url = "https://github.com/audacity/audacity/releases/download/Audacity-${finalAttrs.version}/audacity-sources-${finalAttrs.version}.tar.xz";
+    hash = "sha256-spB2+Z+l0vUi0AHbRyqJbbgfnv/v0VlIyUBXF1OFgFg=";
  };

  patches = [
-    # Introduced by https://github.com/Tencent/rapidjson/commit/b1c0c2843fcb2aca9ecc650fc035c57ffc13697c#diff-2f1bcf2729ff7c408adb0c2cc2cfa01602bd5646b05b3e4bc7e46b606035d249R21
-    ./rapidjson.patch
+    # https://github.com/musescore/muse_deps/pull/47
+    ./muse-deps-wxwidgets-frameworks.patch
+    # https://github.com/audacity/audacity/pull/12021
+    ./audacity-deployment-target.patch
+    # https://github.com/musescore/muse_framework/pull/278
+    ./muse-framework-deployment-target.patch
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # https://github.com/audacity/audacity/pull/12056
+    ./macdeployqt-extra-options.patch
  ];

-  postPatch = ''
-    mkdir src/private
-    substituteInPlace scripts/build/macOS/fix_bundle.py \
-      --replace-fail "path.startswith('/usr/lib/')" "path.startswith('/usr/lib/') or path.startswith('${builtins.storeDir}')"
-  ''
-  + lib.optionalString stdenv.hostPlatform.isLinux ''
-    substituteInPlace libraries/lib-files/FileNames.cpp \
+  postPatch = lib.optionalString stdenv.hostPlatform.isLinux ''
+    substituteInPlace au3/libraries/au3-files/FileNames.cpp \
      --replace-fail /usr/include/linux/magic.h ${linuxHeaders}/include/linux/magic.h
  '';

  nativeBuildInputs = [
    cmake
-    gettext
+    git
+    ninja
    pkg-config
    python3
-    makeWrapper
-    wrapGAppsHook3
+    qt6.qttools
+    qt6.wrapQtAppsHook
+    wxwidgets
  ]
  ++ lib.optionals stdenv.hostPlatform.isLinux [
    linuxHeaders
+    wrapGAppsHook3
  ];

  buildInputs = [
    expat
    ffmpeg
-    file
    flac
-    gtk3
+    freetype
+    harfbuzz
    lame
-    libid3tag
    libjack2
-    libmad
+    libogg
    libopus
-    libsbsms_2_3_0
    libsndfile
    libvorbis
-    lilv
-    lv2
    mpg123
    opusfile
-    portmidi
-    rapidjson
-    serd
-    sord
-    soundtouch
-    soxr
-    sqlite
-    sratom
-    suil
-    twolame
    portaudio
+    pugixml
+    qt6.qt5compat
+    qt6.qtbase
+    qt6.qtdeclarative
+    qt6.qtnetworkauth
+    qt6.qtshadertools
+    qt6.qtsvg
+    utf8cpp
    wavpack
-    wxwidgets_3_2
+    wxwidgets
+    zlib
  ]
  ++ lib.optionals stdenv.hostPlatform.isLinux [
-    alsa-lib # for portaudio
-    at-spi2-core
-    dbus
-    libepoxy
-    libxdmcp
-    libxtst
-    libpthread-stubs
-    libxkbcommon
-    libselinux
-    libsepol
-    libuuid
-    util-linux
-  ]
-  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    libpng
-    libjpeg
+    alsa-lib
+    qt6.qtwayland
  ];

  cmakeFlags = [
-    "-DAUDACITY_BUILD_LEVEL=2"
-    "-DAUDACITY_REV_LONG=nixpkgs"
-    "-DAUDACITY_REV_TIME=nixpkgs"
-    "-DDISABLE_DYNAMIC_LOADING_FFMPEG=ON"
-    "-Daudacity_conan_enabled=Off"
-    "-Daudacity_use_ffmpeg=loaded"
-    "-Daudacity_has_vst3=Off"
-    "-Daudacity_has_crashreports=Off"
-
-    # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
-    "-DCMAKE_SKIP_BUILD_RPATH=ON"
-
-    # Fix duplicate store paths
-    "-DCMAKE_INSTALL_LIBDIR=lib"
+    (lib.cmakeFeature "AU4_BUILD_MODE" "release")
+    (lib.cmakeFeature "EXTDEPS_OVERRIDE_ALL" "SYSTEM")
+    (lib.cmakeBool "MUSE_COMPILE_USE_CCACHE" false)
+    (lib.cmakeBool "MUSE_ENABLE_UNIT_TESTS" finalAttrs.finalPackage.doCheck)
+    (lib.cmakeBool "MUSE_MODULE_DIAGNOSTICS_CRASHPAD_CLIENT" false)
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    (lib.cmakeFeature "CMAKE_OSX_ARCHITECTURES" stdenv.hostPlatform.darwinArch)
+    (lib.cmakeFeature "CMAKE_OSX_DEPLOYMENT_TARGET" stdenv.hostPlatform.darwinMinVersion)
+    # Nix performs stripping after deployment.
+    (lib.cmakeFeature "AU4_MACDEPLOYQT_EXTRA_OPTIONS" "-no-strip")
  ];

-  # [ 57%] Generating LightThemeAsCeeCode.h...
-  # ../../utils/image-compiler: error while loading shared libraries:
-  # lib-theme.so: cannot open shared object file: No such file or directory
-  preBuild = ''
-    export LD_LIBRARY_PATH=$PWD/Release/lib/audacity
+  preConfigure = ''
+    cmakeFlagsArray+=("-DEXTDEPS_CACHE=$PWD/offline-deps")
  '';

-  doCheck = false; # Test fails
+  preInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    export NIX_QMLIMPORTSCANNER=${lib.getBin qt6.qtdeclarative}/libexec/qmlimportscanner
+    export QML2_IMPORT_PATH=
+    for input in ${lib.escapeShellArgs finalAttrs.buildInputs}; do
+      addToSearchPath QML2_IMPORT_PATH "$input/${qt6.qtbase.qtQmlPrefix}"
+    done
+  '';
+
+  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    mkdir -p "$out/Applications"
+    mv "$out/audacity.app" "$out/Applications/"
+  '';
+
+  qtWrapperArgs = [
+    "--prefix"
+    "${lib.optionalString stdenv.hostPlatform.isDarwin "DY"}LD_LIBRARY_PATH"
+    ":"
+    (lib.makeLibraryPath [
+      ffmpeg
+      libjack2
+    ])
+  ];
+
+  preFixup = lib.optionalString stdenv.hostPlatform.isLinux ''
+    qtWrapperArgs+=("''${gappsWrapperArgs[@]}")
+  '';
+
+  postFixup = lib.optionalString stdenv.hostPlatform.isDarwin ''
+    # Use bundled Qt plugins, not a second Qt installation from the store.
+    wrapProgram "$out/Applications/audacity.app/Contents/MacOS/audacity" \
+      ${lib.escapeShellArgs finalAttrs.qtWrapperArgs} \
+      --unset QT_PLUGIN_PATH \
+      --unset NIXPKGS_QT6_QML_IMPORT_PATH \
+      --unset QML2_IMPORT_PATH \
+      --unset QML_IMPORT_PATH
+    mkdir -p "$out/bin"
+    makeWrapper "$out/Applications/audacity.app/Contents/MacOS/audacity" "$out/bin/audacity"
+  '';

  dontWrapGApps = true;
+  # Automatic scanning would wrap bundled framework libraries as executables.
+  dontWrapQtApps = stdenv.hostPlatform.isDarwin;

-  # Replace audacity's wrapper, to:
-  # - Put it in the right place; it shouldn't be in "$out/audacity"
-  # - Add the ffmpeg dynamic dependency
-  # - Use Xwayland by default on Wayland. See https://github.com/audacity/audacity/pull/5977
-  postFixup =
-    lib.optionalString stdenv.hostPlatform.isLinux ''
-      wrapProgram "$out/bin/audacity" \
-        "''${gappsWrapperArgs[@]}" \
-        --prefix LD_LIBRARY_PATH : "$out/lib/audacity":${lib.makeLibraryPath [ ffmpeg ]} \
-        --suffix AUDACITY_MODULES_PATH : "$out/lib/audacity/modules" \
-        --suffix AUDACITY_PATH : "$out/share/audacity" \
-        --set-default GDK_BACKEND x11
-    ''
-    + lib.optionalString stdenv.hostPlatform.isDarwin ''
-      mkdir -p $out/{Applications,bin}
-      mv $out/Audacity.app $out/Applications/
-      makeWrapper $out/Applications/Audacity.app/Contents/MacOS/Audacity $out/bin/audacity
-    '';
+  strictDeps = true;
+  __structuredAttrs = true;

  meta = {
    description = "Sound editor with graphical UI";
    mainProgram = "audacity";
    homepage = "https://www.audacityteam.org";
-    changelog = "https://github.com/audacity/audacity/releases";
-    license = with lib.licenses; [
-      gpl2Plus
-      # Must be GPL3 when building with "technologies that require it,
-      # such as the VST3 audio plugin interface".
-      # https://github.com/audacity/audacity/discussions/2142.
-      gpl3
-      # Documentation.
-      cc-by-30
+    changelog = "https://github.com/audacity/audacity/releases/tag/Audacity-${finalAttrs.version}";
+    license = lib.licenses.AND [
+      lib.licenses.gpl2Plus
+      lib.licenses.gpl3Only
+      lib.licenses.cc-by-30
    ];
    maintainers = with lib.maintainers; [
+      johnrichardrinehart
      veprbl
      wegank
    ];
--- a/pkgs/by-name/au/audacity_3/package.nix
+++ b/pkgs/by-name/au/audacity_3/package.nix
@@ -0,0 +1,221 @@
+{
+  stdenv,
+  lib,
+  fetchFromGitHub,
+  cmake,
+  makeWrapper,
+  wrapGAppsHook3,
+  pkg-config,
+  python3,
+  gettext,
+  file,
+  libvorbis,
+  libmad,
+  libjack2,
+  lv2,
+  lilv,
+  mpg123,
+  opusfile,
+  rapidjson,
+  serd,
+  sord,
+  sqlite,
+  sratom,
+  suil,
+  libsndfile,
+  soxr,
+  flac,
+  lame,
+  twolame,
+  expat,
+  libid3tag,
+  libopus,
+  libuuid,
+  ffmpeg,
+  soundtouch,
+  portaudio, # given up fighting their portaudio.patch?
+  portmidi,
+  linuxHeaders,
+  alsa-lib,
+  at-spi2-core,
+  dbus,
+  libepoxy,
+  libxdmcp,
+  libxtst,
+  libpthread-stubs,
+  libsbsms_2_3_0,
+  libselinux,
+  libsepol,
+  libxkbcommon,
+  util-linux,
+  wavpack,
+  wxwidgets_3_2,
+  gtk3,
+  libpng,
+  libjpeg,
+}:
+
+# TODO
+# 1. detach sbsms
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "audacity";
+  version = "3.7.9";
+
+  src = fetchFromGitHub {
+    owner = "audacity";
+    repo = "audacity";
+    rev = "Audacity-${finalAttrs.version}";
+    hash = "sha256-q/5LPL76GPEFGRxTZcuxmLuq15fwbw2Mak/q2RObghk=";
+  };
+
+  patches = [
+    # Introduced by https://github.com/Tencent/rapidjson/commit/b1c0c2843fcb2aca9ecc650fc035c57ffc13697c#diff-2f1bcf2729ff7c408adb0c2cc2cfa01602bd5646b05b3e4bc7e46b606035d249R21
+    ./rapidjson.patch
+  ];
+
+  postPatch = ''
+    mkdir src/private
+    substituteInPlace scripts/build/macOS/fix_bundle.py \
+      --replace-fail "path.startswith('/usr/lib/')" "path.startswith('/usr/lib/') or path.startswith('${builtins.storeDir}')"
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
+    substituteInPlace libraries/lib-files/FileNames.cpp \
+      --replace-fail /usr/include/linux/magic.h ${linuxHeaders}/include/linux/magic.h
+  '';
+
+  nativeBuildInputs = [
+    cmake
+    gettext
+    pkg-config
+    python3
+    makeWrapper
+    wrapGAppsHook3
+    wxwidgets_3_2
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    linuxHeaders
+  ];
+
+  buildInputs = [
+    expat
+    ffmpeg
+    file
+    flac
+    gtk3
+    lame
+    libid3tag
+    libjack2
+    libmad
+    libopus
+    libsbsms_2_3_0
+    libsndfile
+    libvorbis
+    lilv
+    lv2
+    mpg123
+    opusfile
+    portmidi
+    rapidjson
+    serd
+    sord
+    soundtouch
+    soxr
+    sqlite
+    sratom
+    suil
+    twolame
+    portaudio
+    wavpack
+    wxwidgets_3_2
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    alsa-lib # for portaudio
+    at-spi2-core
+    dbus
+    libepoxy
+    libxdmcp
+    libxtst
+    libpthread-stubs
+    libxkbcommon
+    libselinux
+    libsepol
+    libuuid
+    util-linux
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    libpng
+    libjpeg
+  ];
+
+  cmakeFlags = [
+    "-DAUDACITY_BUILD_LEVEL=2"
+    "-DAUDACITY_REV_LONG=nixpkgs"
+    "-DAUDACITY_REV_TIME=nixpkgs"
+    "-DDISABLE_DYNAMIC_LOADING_FFMPEG=ON"
+    "-Daudacity_conan_enabled=Off"
+    "-Daudacity_use_ffmpeg=loaded"
+    "-Daudacity_has_vst3=Off"
+    "-Daudacity_has_crashreports=Off"
+
+    # RPATH of binary /nix/store/.../bin/... contains a forbidden reference to /build/
+    "-DCMAKE_SKIP_BUILD_RPATH=ON"
+
+    # Fix duplicate store paths
+    "-DCMAKE_INSTALL_LIBDIR=lib"
+  ];
+
+  # [ 57%] Generating LightThemeAsCeeCode.h...
+  # ../../utils/image-compiler: error while loading shared libraries:
+  # lib-theme.so: cannot open shared object file: No such file or directory
+  preBuild = ''
+    export LD_LIBRARY_PATH=$PWD/Release/lib/audacity
+  '';
+
+  doCheck = false; # Test fails
+
+  dontWrapGApps = true;
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  # Replace audacity's wrapper, to:
+  # - Put it in the right place; it shouldn't be in "$out/audacity"
+  # - Add the ffmpeg dynamic dependency
+  # - Use Xwayland by default on Wayland. See https://github.com/audacity/audacity/pull/5977
+  postFixup =
+    lib.optionalString stdenv.hostPlatform.isLinux ''
+      wrapProgram "$out/bin/audacity" \
+        "''${gappsWrapperArgs[@]}" \
+        --prefix LD_LIBRARY_PATH : "$out/lib/audacity":${lib.makeLibraryPath [ ffmpeg ]} \
+        --suffix AUDACITY_MODULES_PATH : "$out/lib/audacity/modules" \
+        --suffix AUDACITY_PATH : "$out/share/audacity" \
+        --set-default GDK_BACKEND x11
+    ''
+    + lib.optionalString stdenv.hostPlatform.isDarwin ''
+      mkdir -p $out/{Applications,bin}
+      mv $out/Audacity.app $out/Applications/
+      makeWrapper $out/Applications/Audacity.app/Contents/MacOS/Audacity $out/bin/audacity
+    '';
+
+  meta = {
+    description = "Sound editor with graphical UI";
+    mainProgram = "audacity";
+    homepage = "https://www.audacityteam.org";
+    changelog = "https://github.com/audacity/audacity/releases";
+    license = with lib.licenses; [
+      gpl2Plus
+      # Must be GPL3 when building with "technologies that require it,
+      # such as the VST3 audio plugin interface".
+      # https://github.com/audacity/audacity/discussions/2142.
+      gpl3
+      # Documentation.
+      cc-by-30
+    ];
+    maintainers = with lib.maintainers; [
+      veprbl
+      wegank
+    ];
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/by-name/au/audacity_3/rapidjson.patch
+++ b/pkgs/by-name/au/audacity_3/rapidjson.patch
--- a/pkgs/by-name/bo/bookorbit/package.nix
+++ b/pkgs/by-name/bo/bookorbit/package.nix
@@ -16,7 +16,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "bookorbit";
-  version = "2.8.1";
+  version = "2.9.0";
  __structuredAttrs = true;
  strictDeps = true;

@@ -24,7 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "bookorbit";
    repo = "bookorbit";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Un30txjsp+sdEPX9DTQ4f0ht7klDhbDptizUzQMP5AA=";
+    hash = "sha256-Dj/H7HWzxscl+uSMGDRgAwLeHDzcZEOM0RsiWrPJjUs=";
  };

  pnpmWorkspaces = [
@@ -41,7 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
      ;
    inherit pnpm;
    fetcherVersion = 4;
-    hash = "sha256-y/cdgAjv8ZWlF4IikKb0pPqrlakMfTo9nY1Bb9AnxlM=";
+    hash = "sha256-NVI9R6n9HIE2VufTcqe4cjZbTK30R/i6dZy39TGH8qs=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/bu/bulwark/package.nix
+++ b/pkgs/by-name/bu/bulwark/package.nix
@@ -4,6 +4,7 @@
  fetchFromGitHub,
  google-fonts,
  nodejs,
+  stdenv,
  nix-update-script,
  nixosTests,
 }:
@@ -67,6 +68,12 @@ buildNpmPackage (finalAttrs: {
    runHook postInstall
  '';

+  postInstall = ''
+    # sharp picks its native binary by libc (detect-libc), so the copies built
+    # for the other libc can never be loaded.
+    rm -rf $out/node_modules/@img/*-${if stdenv.hostPlatform.isMusl then "linux" else "linuxmusl"}-*
+  '';
+
  __structuredAttrs = true;

  passthru = {
--- a/pkgs/by-name/bu/buzz-cli/package.nix
+++ b/pkgs/by-name/bu/buzz-cli/package.nix
@@ -8,7 +8,7 @@

 rustPlatform.buildRustPackage {
  pname = "buzz-cli";
-  version = "0.1.0-unstable-2026-08-27";
+  version = "0.1.0-unstable-2026-09-02";
  __structuredAttrs = true;
  __darwinAllowLocalNetworking = true;
  strictDeps = true;
@@ -16,11 +16,11 @@ rustPlatform.buildRustPackage {
  src = fetchFromGitHub {
    owner = "block";
    repo = "buzz";
-    rev = "0808ab485c39c3c12ef02af2188c65a5145eb99d";
-    hash = "sha256-+vYRX6yZmyWxtpcaQj62ujmcG2uwo3fdaX5Oo6Q1jEE=";
+    rev = "47d068e2109d077414cbf2f4f1c927f6d051037a";
+    hash = "sha256-sLIyStOy330KzzVF9QnIn27loT5QXCRz0U4NN9bxU40=";
  };

-  cargoHash = "sha256-y067FJWvsJAe6mvtnLPSW1YK0/gcBrKuZX45OCO8/2U=";
+  cargoHash = "sha256-q8FUmTHnPfy/Ub+TNs3UK3exOoX1GdZGwHkH5pDteKE=";
  cargoBuildFlags = [ "--package=buzz-cli" ];
  cargoTestFlags = [ "--package=buzz-cli" ];

--- a/pkgs/by-name/bz/bzip3/package.nix
+++ b/pkgs/by-name/bz/bzip3/package.nix
@@ -9,7 +9,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "bzip3";
-  version = "1.5.3";
+  version = "1.5.4";

  outputs = [
    "bin"
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "iczelia";
    repo = "bzip3";
    tag = finalAttrs.version;
-    hash = "sha256-SOouMUctxsAJdkt84rJBaCbK23GKmXRH9nVgGdDodsk=";
+    hash = "sha256-uLL87HbohLNTm+Pq96iNlN+zqjG/bxCV7BJk1H7DvgY=";
  };

  postPatch = ''
--- a/pkgs/by-name/ca/cargo-typify/package.nix
+++ b/pkgs/by-name/ca/cargo-typify/package.nix
@@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-typify";
-  version = "0.6.2";
+  version = "0.7.0";

  src = fetchFromGitHub {
    owner = "oxidecomputer";
    repo = "typify";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Ym3xPMn36+Y8dnImmuegjwrARPzozhwI+qhDCXmFsHg=";
+    hash = "sha256-1JnNNapIg0uholQkgnqU+KQ1q1SCF0MJmrO8XybxBzw=";
  };

-  cargoHash = "sha256-3hh4M5cqwLDHcHI+YGKXQOeTXGcVTec+xk+mZcVp0IU=";
+  cargoHash = "sha256-tH6Unl9mFUmpIiDoHp7ZUwaKAK8QEWGf2ldKbcyBET0=";

  nativeBuildInputs = [
    rustfmt
@@ -46,6 +46,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
      --set RUSTFMT "${lib.getExe rustfmt}"
  '';

+  passthru.updateScript = gitUpdater { rev-prefix = "v"; };
+
  meta = {
    description = "JSON Schema to Rust type converter";
    homepage = "https://github.com/oxidecomputer/typify";
--- a/pkgs/by-name/ch/cherrytree/package.nix
+++ b/pkgs/by-name/ch/cherrytree/package.nix
@@ -8,7 +8,6 @@
  wrapGAppsHook3,
  gtkmm3,
  gtksourceview4,
-  gtksourceviewmm,
  gspell,
  libxmlxx,
  sqlite,
@@ -40,7 +39,6 @@ stdenv.mkDerivation (finalAttrs: {
  buildInputs = [
    gtkmm3
    gtksourceview4
-    gtksourceviewmm
    gspell
    libxmlxx
    sqlite
--- a/pkgs/by-name/cp/cpak/package.nix
+++ b/pkgs/by-name/cp/cpak/package.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+  versionCheckHook,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "cpak";
+  version = "2.12.7";
+
+  src = fetchFromGitHub {
+    owner = "Containerpak";
+    repo = "cpak";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-bISKyH1+Yr1EBzZYIK0xpe0jmBiWtCnByz4Ng01QJCI=";
+  };
+
+  vendorHash = "sha256-cgqb2AY06Ru+JJIK7vyaLSPyjJqiLvNytvSQCgDOASc=";
+
+  subPackages = [
+    "."
+    "cmd/cpak-storaged"
+    "cmd/cpak-sign"
+  ];
+
+  tags = [ "cpak_ui_builtin" ];
+
+  __structuredAttrs = true;
+
+  env.CGO_ENABLED = 0;
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${finalAttrs.version}"
+    "-X main.selfUpdateMode=disabled"
+  ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Decentralized, portable, low-overhead containerized application format for Linux";
+    homepage = "https://cpak.it";
+    changelog = "https://github.com/Containerpak/cpak/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.lgpl21Only;
+    maintainers = with lib.maintainers; [ rachalaraj ];
+    mainProgram = "cpak";
+    platforms = lib.platforms.linux;
+  };
+})
--- a/pkgs/by-name/cr/crossover/package.nix
+++ b/pkgs/by-name/cr/crossover/package.nix
@@ -0,0 +1,73 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchurl,
+  unzip,
+  writeShellScript,
+  curl,
+  gnugrep,
+  gnused,
+  coreutils,
+  common-updater-scripts,
+}:
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "crossover";
+  version = "26.3.0";
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  src = fetchurl {
+    url = "https://media.codeweavers.com/pub/crossover/cxmac/demo/crossover-${finalAttrs.version}.zip";
+    hash = "sha256-hojghIxOX3nxzDUctS0yRH2gDGwAz9O0uy0WTURYmiY=";
+  };
+
+  sourceRoot = ".";
+
+  nativeBuildInputs = [ unzip ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/Applications
+    cp -R CrossOver.app $out/Applications/
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = writeShellScript "crossover-update-script" ''
+    set -euo pipefail
+    export PATH="${
+      lib.makeBinPath [
+        curl
+        gnugrep
+        gnused
+        coreutils
+        common-updater-scripts
+      ]
+    }"
+
+    new_version=$(curl -s "https://www.codeweavers.com/xml/versions/cxmac.xml" \
+      | grep -oE 'crossover-[0-9]+\.[0-9]+\.[0-9]+\.zip' \
+      | sed -E 's/crossover-(.*)\.zip/\1/' \
+      | sort -V \
+      | tail -n1)
+
+    if [[ "${finalAttrs.version}" = "$new_version" ]]; then
+      echo "crossover is already at the latest version $new_version."
+      exit 0
+    fi
+
+    update-source-version "crossover" "$new_version" \
+      --ignore-same-version
+  '';
+
+  meta = {
+    description = "Run Windows applications on macOS without a Windows license";
+    homepage = "https://www.codeweavers.com/crossover";
+    license = lib.licenses.unfree;
+    maintainers = [ lib.maintainers.delafthi ];
+    platforms = lib.platforms.darwin;
+    sourceProvenance = [ lib.sourceTypes.binaryNativeCode ];
+  };
+})
--- a/pkgs/by-name/da/databricks-cli/package.nix
+++ b/pkgs/by-name/da/databricks-cli/package.nix
@@ -9,22 +9,16 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "databricks-cli";
-  version = "1.11.0";
+  version = "1.14.0";

  src = fetchFromGitHub {
    owner = "databricks";
    repo = "cli";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-ViMRqQ9lfek1ETCW30NDmIlG5dtPDmNv4F1EeDwlk6k=";
+    hash = "sha256-iR7fvhLHUVUBpVC2TlAkFcuTe0l+HJmLnmxhOYp8O7U=";
  };

-  # Otherwise these tests fail asserting that the version is 0.0.0-dev
-  postPatch = ''
-    substituteInPlace bundle/deploy/terraform/init_test.go \
-      --replace-fail "cli/0.0.0-dev" "cli/${finalAttrs.version}"
-  '';
-
-  vendorHash = "sha256-LjU4cWFiCrmNwRFt9rAFDQhRw1fN2lLK03/z7wTr+E4=";
+  vendorHash = "sha256-xKv7EYwyEeuxlM+fMa+FpIygWxswQSkuwGzQYWHHvy0=";

  subPackages = [ "." ];

--- a/pkgs/by-name/dc/dcpomatic/asdcplib.nix
+++ b/pkgs/by-name/dc/dcpomatic/asdcplib.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  stdenv,
+  fetchgit,
+
+  wafHook,
+  python3,
+  gitMinimal,
+  pkg-config,
+  openssl,
+  boost,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "asdcplib";
+  version = "1.0.11";
+
+  src = fetchgit {
+    url = "https://git.carlh.net/git/asdcplib";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-VkXDiNYPXU4eOgOfhZB3RMoSp1ujL2jMdAYwjdyIei0=";
+  };
+
+  # for some reason the version is not set properly upstream
+  postPatch = ''
+    substituteInPlace wscript \
+      --replace-fail \
+        "VERSION = open('VERSION').read().strip()" \
+        "VERSION = '${finalAttrs.version}'"
+  '';
+
+  nativeBuildInputs = [
+    wafHook
+    python3
+    gitMinimal
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+    boost
+  ];
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  meta = {
+    description = "asdcplib library for low-level DCP handling";
+    homepage = "https://git.carlh.net/cgit/asdcplib";
+    downloadPage = "https://git.carlh.net/cgit/asdcplib";
+    license = lib.licenses.bsd3;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ logn ];
+  };
+})
--- a/pkgs/by-name/dc/dcpomatic/leqm-nrt-libsndfile-linking.patch
+++ b/pkgs/by-name/dc/dcpomatic/leqm-nrt-libsndfile-linking.patch
@@ -0,0 +1,12 @@
+diff --git a/src/wscript b/src/wscript
+index cbea215..62b0a06 100644
+--- a/src/wscript
+++ b/src/wscript
+@@ -6,6 +6,7 @@ def build(bld):
+     obj.source = 'leqm_nrt.cc'
+ 
+     if bld.env.WITH_LIBSNDFILE:
+        obj.uselib = 'SNDFILE'
+         obj = bld(features='cxx cxxprogram')
+         obj.name = 'leqm_nrt_cli'
+         obj.target = 'leqm_nrt'
--- a/pkgs/by-name/dc/dcpomatic/leqm-nrt.nix
+++ b/pkgs/by-name/dc/dcpomatic/leqm-nrt.nix
@@ -0,0 +1,48 @@
+{
+  stdenv,
+  lib,
+  fetchgit,
+  wafHook,
+  python3,
+  gitMinimal,
+  pkg-config,
+  libsndfile,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "leqm-nrt";
+  version = "0.0.2";
+
+  src = fetchgit {
+    url = "https://git.carlh.net/git/leqm-nrt";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-rynqxvh2FT03Fs5XOV5ZBLzB6lJlop793cMv0FB3s1g=";
+  };
+
+  patches = [
+    ./leqm-nrt-libsndfile-linking.patch
+  ];
+
+  nativeBuildInputs = [
+    wafHook
+    python3
+    gitMinimal
+    pkg-config
+  ];
+
+  buildInputs = [
+    libsndfile
+  ];
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  meta = {
+    description = "a non-real-time implementation of Leq(M) measurement";
+    homepage = "https://git.carlh.net/cgit/leqm-nrt";
+    downloadPage = "https://git.carlh.net/cgit/leqm-nrt";
+    license = lib.licenses.gpl3Plus;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ logn ];
+  };
+})
--- a/pkgs/by-name/dc/dcpomatic/libcxml.nix
+++ b/pkgs/by-name/dc/dcpomatic/libcxml.nix
@@ -0,0 +1,55 @@
+{
+  lib,
+  stdenv,
+  fetchgit,
+
+  wafHook,
+  python3,
+  gitMinimal,
+  pkg-config,
+  libxmlxx,
+  boost,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libcxml";
+  version = "0.17.17";
+
+  src = fetchgit {
+    url = "https://git.carlh.net/git/libcxml.git";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-fd6KYSQnFw3aHCQOT6TTcGUvTxIWrJeRT5rmk2CgbrQ=";
+  };
+
+  # for some reason the version is not set properly upstream
+  postPatch = ''
+    substituteInPlace wscript \
+      --replace-fail \
+        "this_version = subprocess.Popen(shlex.split('git tag -l --points-at HEAD'), stdout=subprocess.PIPE).communicate()[0].decode('UTF-8')" \
+        "this_version = 'v${finalAttrs.version}'"
+  '';
+
+  nativeBuildInputs = [
+    wafHook
+    python3
+    gitMinimal
+    pkg-config
+  ];
+
+  buildInputs = [
+    libxmlxx
+    boost
+  ];
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  meta = {
+    description = "libxml++ helper library";
+    homepage = "https://git.carlh.net/cgit/libcxml";
+    downloadPage = "https://git.carlh.net/cgit/libcxml";
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ logn ];
+  };
+})
--- a/pkgs/by-name/dc/dcpomatic/libdcp.nix
+++ b/pkgs/by-name/dc/dcpomatic/libdcp.nix
@@ -0,0 +1,84 @@
+{
+  lib,
+  stdenv,
+  fetchgit,
+
+  wafHook,
+  python3,
+  gitMinimal,
+  pkg-config,
+  openssl,
+  libxmlxx,
+  libcxml,
+  xmlsec,
+  imagemagick,
+  libsndfile,
+  openjpeg,
+  boost,
+  xercesc,
+  ffmpeg-headless,
+  fmt,
+  fast-float,
+  libtool,
+  libharu,
+  asdcplib,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libdcp";
+  version = "1.10.61";
+
+  src = fetchgit {
+    url = "https://git.carlh.net/git/libdcp";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-MV2kANCq8IqsSJIk95rqIX7iSGmnDVetXPMLn5mEOEs=";
+  };
+
+  # for some reason the version is not set properly upstream
+  postPatch = ''
+    substituteInPlace wscript \
+      --replace-fail \
+        "this_version = subprocess.Popen(shlex.split('git tag -l --points-at HEAD'), stdout=subprocess.PIPE).communicate()[0].decode('UTF-8')" \
+        "this_version = 'v${finalAttrs.version}'"
+  '';
+
+  nativeBuildInputs = [
+    wafHook
+    python3
+    gitMinimal
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+    libxmlxx
+    libcxml
+    xmlsec
+    imagemagick
+    libsndfile
+    openjpeg
+    asdcplib
+    xercesc
+    boost
+    ffmpeg-headless
+    fmt
+    fast-float
+    libtool
+    libharu
+  ];
+
+  propagatedBuildInputs = [
+    asdcplib
+  ];
+
+  __structuredAttrs = true;
+
+  meta = {
+    description = "DCP handling library";
+    homepage = "https://git.carlh.net/cgit/libdcp";
+    downloadPage = "https://git.carlh.net/cgit/libdcp";
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ logn ];
+  };
+})
--- a/pkgs/by-name/dc/dcpomatic/libsub.nix
+++ b/pkgs/by-name/dc/dcpomatic/libsub.nix
@@ -0,0 +1,57 @@
+{
+  lib,
+  stdenv,
+  fetchgit,
+
+  wafHook,
+  python3,
+  gitMinimal,
+  pkg-config,
+  openssl,
+  boost,
+  fmt,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libsub";
+  version = "1.6.62";
+
+  src = fetchgit {
+    url = "https://git.carlh.net/git/libsub";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-NSCg+YnxUPII16K1SGozBRYorm0UVGTGozJOhLti4kc=";
+  };
+
+  # for some reason the version is not set properly upstream
+  postPatch = ''
+    substituteInPlace wscript \
+      --replace-fail \
+        "this_version = subprocess.Popen(shlex.split('git tag -l --points-at HEAD'), stdout=subprocess.PIPE).communicate()[0].decode('UTF-8')" \
+        "this_version = 'v${finalAttrs.version}'"
+  '';
+
+  nativeBuildInputs = [
+    wafHook
+    python3
+    gitMinimal
+    pkg-config
+  ];
+
+  buildInputs = [
+    openssl
+    boost
+    fmt
+  ];
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  meta = {
+    description = "Subtitle handling library";
+    homepage = "https://git.carlh.net/cgit/libsub";
+    downloadPage = "https://git.carlh.net/cgit/libsub";
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ logn ];
+  };
+})
--- a/pkgs/by-name/dc/dcpomatic/libttf.nix
+++ b/pkgs/by-name/dc/dcpomatic/libttf.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  stdenv,
+  fetchgit,
+
+  wafHook,
+  python3,
+  gitMinimal,
+  pkg-config,
+  boost,
+  fmt,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "libttf";
+  version = "0.0.7";
+
+  src = fetchgit {
+    url = "https://git.carlh.net/git/libttf";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-pLduKqcfCw8m4hZn8KsVa8rHESEPSQrvW4NCBcwXT5g=";
+  };
+
+  nativeBuildInputs = [
+    wafHook
+    python3
+    gitMinimal
+    pkg-config
+  ];
+
+  buildInputs = [
+    boost
+    fmt
+  ];
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  meta = {
+    description = "Limited TTF manipulation library";
+    homepage = "https://git.carlh.net/cgit/libttf";
+    downloadPage = "https://git.carlh.net/cgit/libttf";
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ logn ];
+  };
+})
--- a/pkgs/by-name/dc/dcpomatic/package.nix
+++ b/pkgs/by-name/dc/dcpomatic/package.nix
@@ -0,0 +1,118 @@
+{
+  lib,
+  stdenv,
+  fetchgit,
+  callPackage,
+
+  wafHook,
+  wrapGAppsHook3,
+  python3,
+  gitMinimal,
+  pkg-config,
+  boost,
+  curl,
+  icu,
+  libsamplerate,
+  glib,
+  libzip,
+  bzip2,
+  fontconfig,
+  pangomm,
+  libxmlxx,
+  libssh,
+  xmlsec,
+  xercesc,
+  ffmpeg-headless,
+  fmt,
+  nettle,
+  libjpeg,
+  sqlite,
+  wxwidgets_3_2,
+  rtaudio,
+  libGL,
+  libGLU,
+  libsndfile,
+  libtool,
+  libharu,
+  openssl,
+  nlohmann_json,
+}:
+let
+  libcxml = callPackage ./libcxml.nix { };
+  leqm-nrt = callPackage ./leqm-nrt.nix { };
+  asdcplib = callPackage ./asdcplib.nix { };
+  libttf = callPackage ./libttf.nix { };
+  libsub = callPackage ./libsub.nix { };
+  libdcp = callPackage ./libdcp.nix { inherit libcxml asdcplib; };
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "dcpomatic";
+  version = "2.19.1";
+
+  src = fetchgit {
+    url = "https://git.carlh.net/git/dcpomatic";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-c+An8V/A7Vk0ChGQULk9uj0zN5slLb8wSKlWl+3uL1Y=";
+  };
+
+  nativeBuildInputs = [
+    wafHook
+    python3
+    gitMinimal
+    pkg-config
+    fontconfig
+    wrapGAppsHook3
+    wxwidgets_3_2
+  ];
+
+  buildInputs = [
+    boost
+    curl
+    icu
+    libsamplerate
+    glib
+    libzip
+    bzip2
+    pangomm
+    leqm-nrt
+    libttf
+    libcxml
+    libxmlxx
+    libssh
+    libdcp
+    xmlsec
+    xercesc
+    ffmpeg-headless
+    fmt
+    libsub
+    nettle
+    libjpeg
+    sqlite
+    wxwidgets_3_2
+    rtaudio
+    libGL
+    libGLU
+    libsndfile
+    libtool
+    libharu
+    openssl
+    nlohmann_json
+  ];
+
+  postInstall = ''
+    ln -s ${openssl}/bin/openssl $out/bin/dcpomatic2_openssl
+    ln -s ${libdcp}/share/libdcp $out/share/libdcp
+  '';
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  meta = {
+    description = "Convert video, audio and subtitles into DCP";
+    homepage = "https://dcpomatic.com/";
+    downloadPage = "https://git.carlh.net/cgit/dcpomatic";
+    license = lib.licenses.gpl2Plus;
+    platforms = lib.platforms.linux;
+    maintainers = with lib.maintainers; [ logn ];
+  };
+})
--- a/pkgs/by-name/de/decasify/package.nix
+++ b/pkgs/by-name/de/decasify/package.nix
@@ -10,22 +10,25 @@
  cargo,
  rustc,
  rustPlatform,
+
+  # nativeInstallCheckInputs
+  versionCheckHook,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "decasify";
-  version = "0.11.3";
+  version = "0.11.4";

  src = fetchurl {
    url = "https://github.com/alerque/decasify/releases/download/v${finalAttrs.version}/decasify-${finalAttrs.version}.tar.zst";
-    hash = "sha256-JATJ8cFjtCkK65NpTTrUkYHAo4nDrqftarqyJInRTpM=";
+    hash = "sha256-N+VnUMfMvnJfRN0GXG28Fw+Sr6lQwzXn+CVvIbo7j8w=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version src;
    dontConfigure = true;
    nativeBuildInputs = [ zstd ];
-    hash = "sha256-hXU9Yw9rGQDkNnwy63LYPIrreOO2P/f8jVaPnVOhrWI=";
+    hash = "sha256-nkuKeVGqn/stlezRDIf6vGQSqNzVCnrkvuFXqkLdvdE=";
  };

  nativeBuildInputs = [
@@ -46,6 +49,9 @@ stdenv.mkDerivation (finalAttrs: {

  enableParallelBuilding = true;

+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
  meta = {
    description = "Utility to change the case of prose strings following natural language style guides";
    longDescription = ''
--- a/pkgs/by-name/de/desync/package.nix
+++ b/pkgs/by-name/de/desync/package.nix
@@ -8,16 +8,18 @@

 buildGoModule (finalAttrs: {
  pname = "desync";
-  version = "1.1.0";
+  version = "1.1.3";

  src = fetchFromGitHub {
    owner = "folbricht";
    repo = "desync";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-ViwNE+8fmYbAMPFd8yiWXDLbaenkgri9PBe92M0Se5U=";
+    hash = "sha256-xiiN+0veHRxVNsIpob7W/iRH+dABYIiWfw22DH1bTEs=";
  };

-  vendorHash = "sha256-dAFci7GXe1fPPABIG1dngEyGqC5TKa90fyQPYSbJJrk=";
+  vendorHash = "sha256-FRXwQUOD1UiGSlGkBLXT0RGG382RJdEGUJxaQiyzR9A=";
+
+  ldflags = [ "-X main.version=${finalAttrs.src.tag}" ];

  nativeBuildInputs = [ installShellFiles ];

@@ -26,25 +28,7 @@ buildGoModule (finalAttrs: {

  checkFlags =
    let
-      skippedTests = [
-        "TestExtract" # block cloning fails on ZFS
-        "TestExtractCommand/extract_while_regenerating_the_corrupted_seed" # block cloning fails on ZFS
-        "TestExtractCommand/extract_with_seed_directory" # block cloning fails on ZFS
-        "TestExtractCommand/extract_with_single_seed" # block cloning fails on ZFS
-        "TestExtractCommand/extract_with_single_seed,_explicit_data_directory_and_unexpected_seed_options" # block cloning fails on ZFS
-        "TestExtractCommand/extract_with_single_seed_and_explicit_data_directory" # block cloning fails on ZFS
-        "TestExtractWithNonStaticSeeds" # block cloning fails on ZFS
-        "TestLocalFSDirSetgidWhilePopulated" # cannot setgid in /tmp
-        "TestMountIndex" # FUSE does not work in sandbox
-        "TestSeed/extract_repetitive_file" # block cloning fails on ZFS
-        "TestTar" # xattr.list: operation not supported
-        "TestUnTarDirMTime" # xattr.list: operation not supported
-        "TestUnTarIntoReadOnlyDir" # xattr.list: operation not supported
-        "TestUnTarNoSamePermissionsOverReadOnlyTree" # xattr.list: operation not supported
-        "TestUnTarReadOnlyDir" # xattr.list: operation not supported
-        "TestUnTarReadOnlyDirNoSamePermissions" # xattr.list: operation not supported
-      ]
-      ++ lib.optionals stdenv.hostPlatform.isDarwin [
+      skippedTests = lib.optionals stdenv.hostPlatform.isDarwin [
        "TestS3StoreGetChunk/fail" # sendfile is not permitted in Darwin sandbox
        "TestS3StoreGetChunk/recover" # sendfile is not permitted in Darwin sandbox
      ];
--- a/pkgs/by-name/de/devin-desktop/package.nix
+++ b/pkgs/by-name/de/devin-desktop/package.nix
@@ -21,8 +21,8 @@ in
  pname = "devin-desktop";

  executableName = "devin-desktop";
-  longName = "devin-desktop";
-  shortName = "devin-desktop";
+  longName = "Devin Desktop";
+  shortName = "Devin Desktop";
  libraryName = "devin-desktop";
  iconName = "devin-desktop";

--- a/pkgs/by-name/do/dotenvx/package.nix
+++ b/pkgs/by-name/do/dotenvx/package.nix
@@ -7,16 +7,16 @@

 buildNpmPackage (finalAttrs: {
  pname = "dotenvx";
-  version = "2.22.0";
+  version = "2.23.0";

  src = fetchFromGitHub {
    owner = "dotenvx";
    repo = "dotenvx";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-V9JkdNNRKvlSreA8OH/IA7UsPDzOKARI+52JTnv3GM8=";
+    hash = "sha256-cvIblWPNhJPah8nWrJqHAwawQ9C8EueB0leF+miOIH0=";
  };

-  npmDepsHash = "sha256-d/0mqanXqy9KyK0vlCpAElB3WSi9F77l3Jbw9a9zEeI=";
+  npmDepsHash = "sha256-5dhLX6yWdQlS5XHF3Evbk5xbD87HJEiMRDdHTstzfWw=";

  dontNpmBuild = true;

--- a/pkgs/by-name/e1/e1s/package.nix
+++ b/pkgs/by-name/e1/e1s/package.nix
@@ -5,16 +5,16 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "e1s";
-  version = "1.0.53";
+  version = "2.0.0";

  src = fetchFromGitHub {
    owner = "keidarcy";
    repo = "e1s";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Cy/aZVO6xM1oCeyT6x1O+otbUZ5lS90fl3iZzkf02QM=";
+    hash = "sha256-bOG6txoreiP/buYO3rvcxhL1yAxlECkbwf9FqvWLz9k=";
  };

-  vendorHash = "sha256-8z2RVT2W8TLXdZBAmi/2fu63pijVgzqSvF9xpGexlQ0=";
+  vendorHash = "sha256-vVUuoAsoxVKDGxLOQBjOx56IiPWBbtYBJbJNq+kPV7A=";

  meta = {
    description = "Easily Manage AWS ECS Resources in Terminal";
--- a/pkgs/by-name/ed/edhm-ui/package.nix
+++ b/pkgs/by-name/ed/edhm-ui/package.nix
@@ -28,13 +28,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "edhm-ui";
-  version = "3.0.70";
+  version = "3.0.71";

  strictDeps = true;

  src = fetchzip {
    url = "https://github.com/BlueMystical/EDHM_UI/releases/download/v${finalAttrs.version}/edhm-ui-v3-linux-x64.zip";
-    hash = "sha256-jAvUWrjQl8dmXxd99ONYqgdnPkzDQwdSEf8ar2nLEds=";
+    hash = "sha256-wMsP2VeSbo78II/tT5nBAvOIQc3lCBqy+l0F2r3ulEM=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/eg/eggdrop/package.nix
+++ b/pkgs/by-name/eg/eggdrop/package.nix
@@ -8,11 +8,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "eggdrop";
-  version = "1.10.1";
+  version = "1.10.2";

  src = fetchurl {
    url = "https://ftp.eggheads.org/pub/eggdrop/source/${lib.versions.majorMinor finalAttrs.version}/eggdrop-${finalAttrs.version}.tar.gz";
-    hash = "sha256-pc33RE14HC/09dC+FCAvXQlx4AOHGBpJtyUFf+lTEtU=";
+    hash = "sha256-1mRrYwh54azZsFP/oS9GZn+QcUXymvHfD4J0nvMDKpQ=";
  };

  buildInputs = [
--- a/pkgs/by-name/es/espresso/package.nix
+++ b/pkgs/by-name/es/espresso/package.nix
@@ -4,23 +4,22 @@
  cmake,
  stdenv,
  nix-update-script,
+  asciidoctor,
 }:
 stdenv.mkDerivation rec {
  pname = "espresso";
-  version = "2.4";
+  version = "2.5.1";
  src = fetchFromGitHub {
    owner = "chipsalliance";
    repo = "espresso";
    rev = "v${version}";
-    hash = "sha256-z5By57VbmIt4sgRgvECnLbZklnDDWUA6fyvWVyXUzsI=";
+    hash = "sha256-dZigbd4md8ffFawpPB/N/TccBQL6sbMKN2VdGu+fhKY=";
  };

-  postPatch = ''
-    substituteInPlace utility/port.h \
-      --replace-fail "VOID_HACK srandom();" "VOID_HACK srandom(unsigned int __seed);"
-  '';
-
-  nativeBuildInputs = [ cmake ];
+  nativeBuildInputs = [
+    cmake
+    asciidoctor
+  ];

  doCheck = true;

@@ -42,6 +41,7 @@ stdenv.mkDerivation rec {
      heuristic Boolean minimization.
    '';
    homepage = "https://github.com/chipsalliance/espresso";
+    changelog = "https://github.com/chipsalliance/espresso/releases/tag/v${version}";
    maintainers = with lib.maintainers; [ pineapplehunter ];
    mainProgram = "espresso";
    platforms = lib.platforms.all;
--- a/pkgs/by-name/ex/extism-js-core/package.nix
+++ b/pkgs/by-name/ex/extism-js-core/package.nix
@@ -6,23 +6,22 @@
  lld,
  nodejs,
  npmHooks,
-  runCommand,
  rustPlatform,
  stdenv,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "extism-js-core";
-  version = "1.6.0";
+  version = "1.7.0";

  src = fetchFromGitHub {
    owner = "extism";
    repo = "js-pdk";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-CLyH0gDtw988cTcw4B86/kejfbYWMXEVG9Y6PKAZazE=";
+    hash = "sha256-U2C82By8JXUrtaAceZ5xr5Fb9Ltipyvd/sXG+Dsi8F8=";
  };

-  cargoHash = "sha256-9lFX+Q4318ClVIRT4/uCesyNYwU9H2vV+fD3553M2Dc=";
+  cargoHash = "sha256-BBhHTzG0FU4AOuUz7yjp4bpELr1vEVdwT+vyyuITagE=";

  npmDeps = fetchNpmDeps {
    name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
@@ -35,7 +34,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  # https://github.com/extism/js-pdk/pull/154
  postPatch = ''
    substituteInPlace Cargo.toml \
-      --replace-fail '1.5.1' '${finalAttrs.version}'
+      --replace-fail '1.6.1' '${finalAttrs.version}'
  '';

  preBuild = ''
@@ -60,22 +59,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    rustPlatform.bindgenHook
  ];

-  # io-extras v0.18.4 uses #![feature]
-  env.RUSTC_BOOTSTRAP = 1;
-
  env.RUSTFLAGS = "-C linker=wasm-ld";

-  # rquickjs-sys expects the dir structure from wasi-sdk
-  # https://github.com/DelSkayn/rquickjs/blob/v0.11.0/sys/build.rs#L216-L230
-  # TODO: revisit when https://github.com/DelSkayn/rquickjs/pull/648 is released and extism updated
-  env.WASI_SDK = runCommand "wasi-sdk" { } ''
-    mkdir -p $out/bin
-    ln -s ${lib.getExe' stdenv.cc "wasm32-unknown-wasip1-clang"} $out/bin/clang
-    ln -s ${lib.getExe' stdenv.cc "wasm32-unknown-wasip1-ar"} $out/bin/ar
-    ln -s ${stdenv.cc}/nix-support $out/nix-support
-    mkdir -p $out/share
-    ln -s ${stdenv.cc.libc} $out/share/wasi-sysroot
-  '';
+  # stdenv handles setting up the appropriate env variables
+  env.RQUICKJS_SYS_NO_WASI_SDK = 1;

  cargoBuildFlags = [ "--package=js-pdk-core" ];

--- a/pkgs/by-name/ex/extism-js/package.nix
+++ b/pkgs/by-name/ex/extism-js/package.nix
@@ -33,9 +33,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
    zstd
  ];

-  # fs-set-times v0.20.3 uses #![feature]
-  env.RUSTC_BOOTSTRAP = 1;
-
  env.EXTISM_ENGINE_PATH = "${pkgsCross.wasm32-wasip1.extism-js-core}/bin/js_pdk_core.wasm";
  env.ZSTD_SYS_USE_PKG_CONFIG = true;

--- a/pkgs/by-name/fl/flake-du/package.nix
+++ b/pkgs/by-name/fl/flake-du/package.nix
@@ -4,7 +4,7 @@
  fetchgit,
 }:
 let
-  version = "0.1.0";
+  version = "0.2.0";
 in
 rustPlatform.buildRustPackage {
  pname = "flake-du";
@@ -13,7 +13,7 @@ rustPlatform.buildRustPackage {
  src = fetchgit {
    url = "https://github.com/kmein/flake-du";
    rev = "v${version}";
-    sha256 = "sha256-+YfQRi6QE4xNUcIcEc9HWIbnin6GCVp4SYrjvBwksys=";
+    hash = "sha256-mwSZvAEs4RKzIKErnxPhK7J7yhqo1ibDRy0FXoKlsHY=";
  };

  cargoHash = "sha256-DYVT9jM9WcgoVSOnoUIWWR9EmNywR1f4xZOAzkbNkCk=";
--- a/pkgs/by-name/fs/fscrypt-experimental/package.nix
+++ b/pkgs/by-name/fs/fscrypt-experimental/package.nix
@@ -4,11 +4,8 @@
  fetchFromGitHub,
  gnum4,
  pam,
-  fscrypt-experimental,
 }:

-# Don't use this for anything important yet!
-
 buildGoModule rec {
  pname = "fscrypt";
  version = "0.3.7";
@@ -28,6 +25,7 @@ buildGoModule rec {

  vendorHash = "sha256-lR3qcRSVQjxyBuqHv5warfVVJy5zdomfE0DEJbA/RkQ=";

+  __structuredAttrs = true;
  doCheck = false;

  nativeBuildInputs = [ gnum4 ];
--- a/pkgs/by-name/ge/getmail6/package.nix
+++ b/pkgs/by-name/ge/getmail6/package.nix
@@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "getmail6";
-  version = "6.20.00";
+  version = "6.20.01";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "getmail6";
    repo = "getmail6";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-f0IH0wI7Ue/HjvMIhBRGaMoO9BYDJoH/3fWRDsFD9+8=";
+    hash = "sha256-U5/vOpVVuPc1ITn0SCr7bnDFUwSBqFr51dUsyiMbORM=";
  };

  build-system = with python3.pkgs; [
--- a/pkgs/by-name/go/gocron/package.nix
+++ b/pkgs/by-name/go/gocron/package.nix
@@ -2,12 +2,8 @@
  lib,
  fetchFromGitHub,
  nodejs,
-  fetchYarnDeps,
-  yarnConfigHook,
-  yarnBuildHook,
-  yarnInstallHook,
-  stdenv,
-  buildGoModule,
+  buildNpmPackage,
+  buildGo127Module,
  makeWrapper,
  bash,
  versionCheckHook,
@@ -15,38 +11,30 @@
  nixosTests,
 }:

-buildGoModule (finalAttrs: {
+buildGo127Module (finalAttrs: {

  pname = "gocron";
-  version = "0.9.14";
+  version = "0.11.0";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "flohoss";
    repo = "gocron";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-LKjK5V+WrzTJlWPytafy8Ypva41RW4/12aSGaJj572I=";
+    hash = "sha256-NyL//yrKqYiwwQBdJHwQcPvjKssX4o9XrymI/6Hvbhc=";
  };

-  gocron-web = stdenv.mkDerivation (finalAttrsWebassets: {
+  gocron-web = buildNpmPackage (finalAttrsWebassets: {
    pname = "${finalAttrs.pname}-web";
    src = "${finalAttrs.src}/web";
    inherit (finalAttrs) version;

-    yarnOfflineCache = fetchYarnDeps {
-      yarnLock = finalAttrsWebassets.src + "/yarn.lock";
-      hash = "sha256-f0xnF9gd3c0KPrORPVkApyWPy+DazyzHeQu32wWybiw=";
-    };
+    npmDepsHash = "sha256-LVazZ0O82sQGxqyu0Dh4G/SmM33ftLoGqpgKrHMFGks=";

-    nativeBuildInputs = [
-      yarnConfigHook
-      yarnBuildHook
-      yarnInstallHook
-      nodejs
-    ];
+    dontNpmInstall = true;

    preBuild = ''
-      yarn types
+      npm run types
    '';

    postBuild = ''
@@ -55,7 +43,7 @@ buildGoModule (finalAttrs: {

  });

-  vendorHash = "sha256-VbmS9Fh0pr/dUB+pZBqKbi4bu6Do/3TRr9uI3TmGsOM=";
+  vendorHash = "sha256-p45E84MWNTa0VvvGiOfOZ/ZEJ41m0Wu7g1nTEFYkU6c=";

  postPatch = ''
    substituteInPlace handlers/web.go \
--- a/pkgs/by-name/gp/gpu-screen-recorder-gtk/package.nix
+++ b/pkgs/by-name/gp/gpu-screen-recorder-gtk/package.nix
@@ -79,6 +79,7 @@ stdenv.mkDerivation (finalAttrs: {
    maintainers = with lib.maintainers; [
      babbaj
      js6pak
+      keenanweaver
    ];
    platforms = lib.platforms.linux;
  };
--- a/pkgs/by-name/gp/gpu-screen-recorder/package.nix
+++ b/pkgs/by-name/gp/gpu-screen-recorder/package.nix
@@ -29,12 +29,12 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gpu-screen-recorder";
-  version = "6.0.1";
+  version = "6.1.1";

  src = fetchgit {
    url = "https://repo.dec05eba.com/gpu-screen-recorder";
    tag = finalAttrs.version;
-    hash = "sha256-mq+I90JaVsYZgPFLHRO/Qebv5p3XQZ6VaNbvHJBfXbQ=";
+    hash = "sha256-I5q2bvCjoXkXue/rr6IhwwhdQkxMmf1MgaKEjh+IZP8=";
  };

  postPatch = ''
@@ -104,6 +104,7 @@ stdenv.mkDerivation (finalAttrs: {
    maintainers = with lib.maintainers; [
      babbaj
      js6pak
+      keenanweaver
    ];
    platforms = lib.platforms.linux;
  };
--- a/pkgs/by-name/ip/ipatool/package.nix
+++ b/pkgs/by-name/ip/ipatool/package.nix
@@ -6,26 +6,30 @@
  testers,
  ipatool,
  writableTmpDirAsHomeHook,
+  installShellFiles,
 }:

 buildGoModule (finalAttrs: {
  pname = "ipatool";
-  version = "2.3.2";
+  version = "2.5.0";

  src = fetchFromGitHub {
    owner = "majd";
    repo = "ipatool";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-jIdjTDs/g41j805vkC1PqLvChtzB055JYmd4GbEHNZU=";
+    hash = "sha256-yC6MSyL3b9u/mb+YJUIZTsH2dtVgE0w2K3F2LlQE9tI=";
  };

-  vendorHash = "sha256-HNus5wZUmiuVVdDj4i9X9sO8iyccrq4h//s0zkQNYjY=";
+  vendorHash = "sha256-/DIJ41YXPMKZgnNraBasnJ1AIgfC5OA3fLn/vFJqs/Q=";

  # Fixes "import lookup disabled by -mod=vendor" for onepassword-sdk-go on macOS
  proxyVendor = true;

  # Fixes "unable to open output file '/homeless-shelter/.cache/clang/ModuleCache/" on macOS
-  nativeBuildInputs = [ writableTmpDirAsHomeHook ];
+  nativeBuildInputs = [
+    writableTmpDirAsHomeHook
+    installShellFiles
+  ];

  ldflags = [
    "-s"
@@ -40,6 +44,13 @@ buildGoModule (finalAttrs: {
  # '';
  doCheck = false;

+  postInstall = ''
+    installShellCompletion --cmd ipatool \
+      --bash <($out/bin/ipatool completion bash) \
+      --fish <($out/bin/ipatool completion fish) \
+      --zsh <($out/bin/ipatool completion zsh)
+  '';
+
  passthru = {
    updateScript = nix-update-script { };
    tests.version = testers.testVersion {
--- a/pkgs/by-name/ko/kotlin-cli/package.nix
+++ b/pkgs/by-name/ko/kotlin-cli/package.nix
@@ -10,11 +10,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "kotlin-cli";
-  version = "0.11.1";
+  version = "0.12.0";

  src = fetchurl {
    url = "https://packages.jetbrains.team/maven/p/amper/amper/org/jetbrains/kotlin/kotlin-cli/${finalAttrs.version}/kotlin-cli-${finalAttrs.version}-dist.tgz";
-    hash = "sha256-De0qQ09r8ZOyTiptVsO6RD9CMnIRVaZaqoNyeJQSES8=";
+    hash = "sha256-YmstbodTrXW0sCFE5ZfS9EHdlAeUvlEDNSry6ADk4T4=";
  };
  sourceRoot = ".";
  dontBuild = true;
--- a/pkgs/by-name/ku/kubectl-gadget/package.nix
+++ b/pkgs/by-name/ku/kubectl-gadget/package.nix
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "kubectl-gadget";
-  version = "0.55.1";
+  version = "0.56.0";

  src = fetchFromGitHub {
    owner = "inspektor-gadget";
    repo = "inspektor-gadget";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-trpvsOefcmajxmVTPGLDKjS7To5psgIBGcQ/XxlFeHo=";
+    hash = "sha256-HyQpkaa6MfBi1JJarXRSTpYUjx/golGl1lIStHAU3YU=";
  };

-  vendorHash = "sha256-AJmtOmFV06WYtHD5e/3TuzxsRVypoIVIiTxgesNtCKk=";
+  vendorHash = "sha256-mXHoMsJMwNwsnpoLDc7OLiOUZhlbcslySkyJRAC9hb8=";

  env.CGO_ENABLED = 0;

--- a/pkgs/by-name/lu/lux-cli/package.nix
+++ b/pkgs/by-name/lu/lux-cli/package.nix
@@ -19,18 +19,18 @@
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "lux-cli";

-  version = "0.42.1";
+  version = "0.43.5";

  src = fetchFromGitHub {
    owner = "lumen-oss";
    repo = "lux";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-wjEci3i1auW76bssZ97IwY4AMG+wyvik5ZC/IMkXcGg=";
+    hash = "sha256-Uo180nB7/7lcYeaOCcOODtWJaqf4eQeMPKHN2OIVP70=";
  };

  buildAndTestSubdir = "lux-cli";

-  cargoHash = "sha256-EquC8//qIAY3qFZ11jxvJFlSXARLSFWGnLlxj4k8t5o=";
+  cargoHash = "sha256-fQoKFzMhvwlEXLmJQGiarPp2gtAJjodjQK7DjnY7reM=";

  nativeInstallCheckInputs = [
    versionCheckHook
--- a/pkgs/by-name/ma/matrix-alertmanager/package.nix
+++ b/pkgs/by-name/ma/matrix-alertmanager/package.nix
@@ -3,17 +3,18 @@
  buildNpmPackage,
  fetchFromGitHub,
  jq,
+  nix-update-script,
 }:

 buildNpmPackage rec {
  pname = "matrix-alertmanager";
-  version = "0.9.0";
+  version = "0.10.0";

  src = fetchFromGitHub {
    owner = "jaywink";
    repo = "matrix-alertmanager";
    rev = "v${version}";
-    hash = "sha256-t5e9UfRtt1OzxEXuMkPLW352BbAVSLEt26fo5YppQQc=";
+    hash = "sha256-kdz5KyT0ZIbiq6MMVAQBPjz2QP1kcNWtEv10/RzH/14=";
  };

  postPatch = ''
@@ -21,10 +22,12 @@ buildNpmPackage rec {
    mv package.json.tmp package.json
  '';

-  npmDepsHash = "sha256-4UYX9ndqecr06/gZeouzrDss6568jBXY1ypcVX7DEVk=";
+  npmDepsHash = "sha256-r1OvxCk6dgVAb3NKxveTr/1PTRFYQVDhQmBHbikzALE=";

  dontNpmBuild = true;

+  passthru.updateScript = nix-update-script { };
+
  meta = {
    changelog = "https://github.com/jaywink/matrix-alertmanager/blob/${src.rev}/CHANGELOG.md";
    description = "Bot to receive Alertmanager webhook events and forward them to chosen rooms";
--- a/pkgs/by-name/ma/matrix-commander-rs/package.nix
+++ b/pkgs/by-name/ma/matrix-commander-rs/package.nix
@@ -5,20 +5,23 @@
  pkg-config,
  rustPlatform,
  perl,
+  nix-update-script,
 }:

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "matrix-commander-rs";
-  version = "1.0.1";
+  version = "0.11.0";

  src = fetchFromGitHub {
    owner = "8go";
    repo = "matrix-commander-rs";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-SyAKKSPGO8yjP3Pgsr2sPW5cpNyNLiYTy7CDDAXdztw=";
+    hash = "sha256-eWD1nj+xRWNkyC3lM/hIZACI2i1Awl9NTgslR8rJZSc=";
  };

-  cargoHash = "sha256-X1xBhJ0B4FcC66qKtYZbcX2+92hy2R4fM/GYBI8AFTY=";
+  cargoHash = "sha256-OWuKwaJfwOAtwtN0so/afWeHq2oslAT2YahnJC0QB6w=";
+
+  __structuredAttrs = true;

  nativeBuildInputs = [
    pkg-config
@@ -27,12 +30,22 @@ rustPlatform.buildRustPackage (finalAttrs: {

  buildInputs = [ openssl ];

+  passthru.updateScript = nix-update-script {
+    extraArgs = [
+      "--version-regex"
+      "^v(0.*)$" # https://github.com/8go/matrix-commander-rs/issues/194#issuecomment-4864773450
+    ];
+  };
+
  meta = {
    description = "CLI-based Matrix client app for sending and receiving";
    homepage = "https://github.com/8go/matrix-commander-rs";
-    changelog = "https://github.com/8go/matrix-commander-rs/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/8go/matrix-commander-rs/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.gpl3Only;
-    maintainers = with lib.maintainers; [ fab ];
+    maintainers = with lib.maintainers; [
+      fab
+      ilkecan
+    ];
    mainProgram = "matrix-commander-rs";
  };
 })
--- a/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
+++ b/pkgs/by-name/ma/matrix-synapse-unwrapped/package.nix
@@ -14,19 +14,19 @@

 python3Packages.buildPythonApplication rec {
  pname = "matrix-synapse";
-  version = "1.159.0";
+  version = "1.160.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "element-hq";
    repo = "synapse";
    rev = "v${version}";
-    hash = "sha256-Fdbr+uMKFTZl1ETyaDavsSCpJYwS5+eLqifMlLGtDeA=";
+    hash = "sha256-sf7YS3AKPnhQySGZD1uvHvpVdUWIV/hrzBLvmbvS3bA=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit pname version src;
-    hash = "sha256-9VmEej1AKvGMMgbdyvm0DFZJ9sLP2WcV29+xVtOLV4g=";
+    hash = "sha256-154xfJLCCcPbjxknbm5HanJyMGnAJCTZKH8BYvMCvpo=";
  };

  build-system =
@@ -165,7 +165,7 @@ python3Packages.buildPythonApplication rec {

  meta = {
    homepage = "https://matrix.org";
-    changelog = "https://github.com/element-hq/synapse/releases/tag/v${version}";
+    changelog = "https://github.com/element-hq/synapse/blob/v${version}/CHANGES.md";
    description = "Matrix reference homeserver";
    license = lib.licenses.agpl3Plus;
    maintainers = with lib.maintainers; [ sumnerevans ];
--- a/pkgs/by-name/mc/mcp-proxy/package.nix
+++ b/pkgs/by-name/mc/mcp-proxy/package.nix
@@ -2,16 +2,17 @@
  lib,
  python3Packages,
  fetchFromGitHub,
+  versionCheckHook,
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "mcp-proxy";
-  version = "0.10.0";
+  version = "0.12.0";

  src = fetchFromGitHub {
    owner = "sparfenyuk";
    repo = "mcp-proxy";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Hig+ZDFdToiYGOjb/rpqxnu8MaLmQLgSh5WYcgJGA1I=";
+    hash = "sha256-rurNHP5TprhFUrg+0E6FnNxhCqQv2xtkfhUrGUdGod0=";
  };

  pyproject = true;
@@ -19,10 +20,15 @@ python3Packages.buildPythonApplication (finalAttrs: {
  build-system = [ python3Packages.setuptools ];

  dependencies = with python3Packages; [
-    uvicorn
+    httpx-auth
    mcp
+    uvicorn
  ];

+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  versionCheckProgramArg = "--version";
+
  nativeCheckInputs = with python3Packages; [
    pytestCheckHook
    pytest-asyncio
--- a/pkgs/by-name/me/mediaharbor/package.nix
+++ b/pkgs/by-name/me/mediaharbor/package.nix
@@ -20,7 +20,6 @@
  pango,
  pkg-config,
  rustPlatform,
-  typescript_7,
  webkitgtk_4_1,
  wrapGAppsHook4,
  zlib,
@@ -59,7 +58,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
    nodejs
    npmHooks.npmConfigHook
    pkg-config
-    typescript_7
    wrapGAppsHook4
  ];

@@ -103,5 +101,8 @@ rustPlatform.buildRustPackage (finalAttrs: {
    license = lib.licenses.gpl3Only;
    maintainers = with lib.maintainers; [ idkdontaskm3 ];
    mainProgram = "mediaharbor";
+    platforms = [
+      "x86_64-linux"
+    ];
  };
 })
--- a/pkgs/by-name/me/meh/gif.patch
+++ b/pkgs/by-name/me/meh/gif.patch
@@ -0,0 +1,18 @@
+diff --git a/src/gif.c b/src/gif.c
+index 9d492c2..a1455a5 100644
+--- a/src/gif.c
+++ b/src/gif.c
+@@ -96,11 +96,11 @@ error:
+ 
+ void gif_close(struct image *img){
+ 	struct gif_t *g = (struct gif_t *)img;
+-#if defined(GIFLIB_MAJOR) && defined(GIFLIB_MINOR) && (GIFLIB_MAJOR == 5 && GIFLIB_MINOR >= 1)
+#if defined(GIFLIB_MAJOR) && defined(GIFLIB_MINOR) && ((GIFLIB_MAJOR == 5 && GIFLIB_MINOR >= 1) || GIFLIB_MAJOR == 6)
+ 	int ret;
+ #endif
+ 
+-#if defined(GIFLIB_MAJOR) && defined(GIFLIB_MINOR) && (GIFLIB_MAJOR == 5 && GIFLIB_MINOR >= 1)
+#if defined(GIFLIB_MAJOR) && defined(GIFLIB_MINOR) && ((GIFLIB_MAJOR == 5 && GIFLIB_MINOR >= 1) || GIFLIB_MAJOR == 6)
+ 	DGifCloseFile(g->gif,&ret);
+ 	if(ret != GIF_OK) {
+ #if defined(GIFLIB_MAJOR) && GIFLIB_MAJOR >= 5
--- a/pkgs/by-name/me/meh/package.nix
+++ b/pkgs/by-name/me/meh/package.nix
@@ -35,6 +35,8 @@ stdenv.mkDerivation {
    giflib
  ];

+  patches = [ ./gif.patch ];
+
  meta = {
    description = "Minimal image viewer using raw XLib";
    homepage = "https://www.johnhawthorn.com/meh/";
--- a/pkgs/by-name/me/metadata/ffmpeg-next-8.1.patch
+++ b/pkgs/by-name/me/metadata/ffmpeg-next-8.1.patch
@@ -1,71 +0,0 @@
-diff --git a/Cargo.lock b/Cargo.lock
--- a/Cargo.lock
-+++ b/Cargo.lock
-@@ -37,7 +37,7 @@
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "4f72209734318d0b619a5e0f5129918b848c416e122a3c4ce054e03cb87b726f"
- dependencies = [
- "bitflags 2.9.3",
-+ "bitflags 2.11.1",
-  "cexpr",
-  "clang-sys",
-  "itertools",
-@@ -57,9 +57,9 @@
- 
- [[package]]
- name = "bitflags"
-version = "2.9.3"
-+version = "2.11.1"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "34efbcccd345379ca2868b2b2c9d3782e9cc58ba87bc7d79d5b53d9c9ae6f25d"
-+checksum = "c4512299f36f043ab09a583e57bceb5a5aab7a73db1805848e8fef3c9e8c78b3"
- 
- [[package]]
- name = "block-buffer"
-@@ -204,20 +204,20 @@
- 
- [[package]]
- name = "ffmpeg-next"
-version = "8.0.0"
-+version = "8.1.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d658424d233cbd993a972dd73a66ca733acd12a494c68995c9ac32ae1fe65b40"
-+checksum = "f7c4bd5ab1ac61f29c634df1175d350ded29cf74c3c6d4f7030431a5ae3c7d5d"
- dependencies = [
- "bitflags 2.9.3",
-+ "bitflags 2.11.1",
-  "ffmpeg-sys-next",
-  "libc",
- ]
- 
- [[package]]
- name = "ffmpeg-sys-next"
-version = "8.0.1"
-+version = "8.1.0"
- source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9bca20aa4ee774fe384c2490096c122b0b23cf524a9910add0686691003d797b"
-+checksum = "a314bc0e022a33a99567ed4bd2576bd58ffd8fcff7891c29194cfecc26a62547"
- dependencies = [
-  "bindgen",
-  "cc",
-@@ -606,7 +606,7 @@
- source = "registry+https://github.com/rust-lang/crates.io-index"
- checksum = "11181fbabf243db407ef8df94a6ce0b2f9a733bd8be4ad02b4eda9602296cac8"
- dependencies = [
- "bitflags 2.9.3",
-+ "bitflags 2.11.1",
-  "errno",
-  "libc",
-  "linux-raw-sys",
-diff --git a/Cargo.toml b/Cargo.toml
--- a/Cargo.toml
-+++ b/Cargo.toml
-@@ -33,7 +33,7 @@
- serde_derive = "1.0.198"
- 
- [dependencies.ffmpeg-next]
-version = "8.0.0"
-+version = "8.1.0"
- default-features = false
- features = ["codec", "format"]
- 
--- a/pkgs/by-name/me/metadata/package.nix
+++ b/pkgs/by-name/me/metadata/package.nix
@@ -11,21 +11,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "metadata";
-  version = "0.1.12";
+  version = "0.1.13";

  src = fetchFromGitHub {
    owner = "zmwangx";
    repo = "metadata";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-gDOYqPwrWUfUTCx+p+ZpwsP8XxUufDCGem/WzW5cQPc=";
+    hash = "sha256-E9UL10RYHibbaLIHbgMxuOAz7RLKGcZgyfvS1HDFZjE=";
  };

-  cargoPatches = [
-    # bump ffmpeg-next 8.0.0 -> 8.1.0 for ffmpeg 8.1 enum variants
-    ./ffmpeg-next-8.1.patch
-  ];
+  cargoHash = "sha256-oVP9DXnVU1uZrGkJuELRtExpQnYqrzhjxGpIDWDbbbA=";

-  cargoHash = "sha256-TgF88oaf6567Xk20TkqbtE+H+nEKTiUSyswvxvCNFVI=";
+  env.FFMPEG_DIR = ffmpeg.dev;

  nativeBuildInputs = [
    pkg-config
@@ -34,34 +31,29 @@ rustPlatform.buildRustPackage (finalAttrs: {
    rustPlatform.bindgenHook
  ];

-  postBuild = ''
-    a2x --doctype manpage --format manpage man/metadata.1.adoc
-  '';
-  postInstall = ''
-    installManPage man/metadata.1
-  '';
-
  buildInputs = [
    ffmpeg
    glib
  ];

-  env.FFMPEG_DIR = ffmpeg.dev;
+  postBuild = ''
+    a2x --doctype manpage --format manpage man/metadata.1.adoc
+  '';

-  checkFlags = [
-    # "AAC (HE-AAC v2)" is reported as "AAC (LC)" in newer ffmpeg
-    # https://github.com/zmwangx/metadata/issues/13
-    "--skip=aac_he_aac"
-  ];
+  postInstall = ''
+    installManPage man/metadata.1
+  '';

  nativeInstallCheckInputs = [ versionCheckHook ];
  doInstallCheck = true;

  meta = {
    description = "Media metadata parser and formatter designed for human consumption, powered by FFmpeg";
-    maintainers = [ ];
    license = lib.licenses.mit;
    homepage = "https://github.com/zmwangx/metadata";
    mainProgram = "metadata";
+    maintainers = with lib.maintainers; [
+      debtquity
+    ];
  };
 })
--- a/pkgs/by-name/mo/mo-viewer/package.nix
+++ b/pkgs/by-name/mo/mo-viewer/package.nix
@@ -15,13 +15,13 @@

 buildGoModule (finalAttrs: {
  pname = "mo-viewer";
-  version = "1.6.7";
+  version = "1.6.8";

  src = fetchFromGitHub {
    owner = "k1LoW";
    repo = "mo";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-8A3km3N9pGm/gBvIxManVgBV5opMZIoNR/JE93gX5yk=";
+    hash = "sha256-aam8kDxZfNXJyGeyj4ZtDRLcZ9mPVKNHnHfVFFkv/Ro=";
  };

  frontend = stdenvNoCC.mkDerivation (finalFrontendAttrs: {
@@ -35,7 +35,7 @@ buildGoModule (finalAttrs: {
      sourceRoot = "${finalFrontendAttrs.src.name}/internal/frontend";
      pnpm = pnpm_10;
      fetcherVersion = 4;
-      hash = "sha256-tjeDH6wiA3KjUyhpQfvrSsXqSRf1bOOA0vPfkUR8Kvc=";
+      hash = "sha256-jvTMP8XKUpanM2CQVX/cZr2sqMt6Zgh1JKJhaCeGKt4=";
    };

    nativeBuildInputs = [
@@ -63,7 +63,7 @@ buildGoModule (finalAttrs: {
    '';
  });

-  vendorHash = "sha256-gaw85ILGr3iDWZ8ibRAA7l+UROCaItDBauCVtbZNa0U=";
+  vendorHash = "sha256-9LXhQUTsk0+UCtXWMFsE4aGG+2MSOyM+U6dlWw+0G+c=";

  preBuild = ''
    cp -r ${finalAttrs.frontend} internal/static/dist
--- a/pkgs/by-name/mp/mpv-shim-default-shaders/package.nix
+++ b/pkgs/by-name/mp/mpv-shim-default-shaders/package.nix
@@ -6,13 +6,13 @@

 stdenv.mkDerivation rec {
  pname = "mpv-shim-default-shaders";
-  version = "2.1.0";
+  version = "3.0.0";

  src = fetchFromGitHub {
    owner = "iwalton3";
    repo = "default-shader-pack";
    rev = "v${version}";
-    sha256 = "sha256-BM2GvmUoWQUUMH464YIIqu5A1t1B+otbJxAGFbySuq8=";
+    sha256 = "sha256-lHFidCHBduvNBy1HGgqLDqZMJeLv3jfVWQ73Hlev7w8=";
  };

  installPhase = ''
--- a/pkgs/by-name/my/myx/package.nix
+++ b/pkgs/by-name/my/myx/package.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  stdenv,
+  alsa-lib,
+  openssl,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "myx";
+  version = "0.4.0";
+
+  src = fetchFromGitHub {
+    owner = "HaseebKhalid1507";
+    repo = "Myx";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-72Q0AkUT8ms0+zbtVEBjqnku7njUAzVk/Y/d2AyQVeQ=";
+  };
+
+  cargoHash = "sha256-aNDKxvz918mwLteGpgQR7cpXs3VK12OHrfm4Q/jT+1s=";
+
+  nativeBuildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    pkg-config
+  ];
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [
+    alsa-lib
+    openssl
+  ];
+
+  __structuredAttrs = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Lean, beautiful terminal Spotify player";
+    homepage = "https://github.com/HaseebKhalid1507/Myx";
+    changelog = "https://github.com/HaseebKhalid1507/Myx/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    mainProgram = "myx";
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ miniharinn ];
+  };
+})
--- a/pkgs/development/libraries/nemo-qml-plugin-dbus/default.nix
+++ b/pkgs/development/libraries/nemo-qml-plugin-dbus/default.nix
@@ -2,9 +2,7 @@
  lib,
  stdenv,
  fetchFromGitLab,
-  qmake,
-  wrapQtAppsHook,
-  qtbase,
+  qt5,
 }:

 stdenv.mkDerivation rec {
@@ -20,8 +18,8 @@ stdenv.mkDerivation rec {
  };

  nativeBuildInputs = [
-    qmake
-    wrapQtAppsHook
+    qt5.qmake
+    qt5.wrapQtAppsHook
  ];

  postPatch = ''
@@ -30,7 +28,7 @@ stdenv.mkDerivation rec {
      --replace /usr $out \
      --replace '$$[QT_INSTALL_LIBS]' $out'/lib'
    substituteInPlace src/plugin/plugin.pro \
-      --replace '$$[QT_INSTALL_QML]' $out'/${qtbase.qtQmlPrefix}'
+      --replace '$$[QT_INSTALL_QML]' $out'/${qt5.qtbase.qtQmlPrefix}'
  '';

  meta = {
--- a/pkgs/by-name/ne/neo4j/package.nix
+++ b/pkgs/by-name/ne/neo4j/package.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
    description = "Highly scalable, robust (fully ACID) native graph database";
    homepage = "https://neo4j.com/";
    license = lib.licenses.gpl3;
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.c2fc2f ];
    platforms = lib.platforms.unix;
  };
 })
--- a/pkgs/by-name/ne/netatalk/package.nix
+++ b/pkgs/by-name/ne/netatalk/package.nix
@@ -39,11 +39,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "netatalk";
-  version = "4.5.1";
+  version = "4.5.2";

  src = fetchurl {
    url = "mirror://sourceforge/netatalk/netatalk/netatalk-${finalAttrs.version}.tar.xz";
-    hash = "sha256-8JHeELDECZbr99ZQLPlHz9h9/hp+YvnZYBMiVXOThSQ=";
+    hash = "sha256-LN/VQg6Okchcgt2mapLc3Vl07vB2/rFpsnnGABM/OLI=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ni/nixtamal/package.nix
+++ b/pkgs/by-name/ni/nixtamal/package.nix
@@ -21,7 +21,7 @@

 ocamlPackages.buildDunePackage (finalAttrs: {
  pname = "nixtamal";
-  version = "1.10.0";
+  version = "1.10.1";
  release_year = 2026;

  minimalOCamlVersion = "5.3";
@@ -30,7 +30,7 @@ ocamlPackages.buildDunePackage (finalAttrs: {
    url = "https://darcs.toastal.in.th/nixtamal/stable/";
    mirrors = [ "https://smeder.ee/~toastal/nixtamal.darcs" ];
    rev = finalAttrs.version;
-    hash = "sha256-IiR8hihbhdGDIcKA4dwQPcieSxT6VOlB2TcuHB16PmQ=";
+    hash = "sha256-cKYsuwUq2IVr50Tnc7qzMZANkldFAVDaXFWfgx7i8Ks=";
  };

  nativeBuildInputs = [
@@ -56,6 +56,7 @@ ocamlPackages.buildDunePackage (finalAttrs: {
    camomile
    eio
    eio_main
+    eio_posix
    jingoo
    (jsont.override {
      withBrr = false;
--- a/pkgs/by-name/op/openvpn3/package.nix
+++ b/pkgs/by-name/op/openvpn3/package.nix
@@ -35,14 +35,14 @@ let
    hash = "sha256-ZFvxwzWiRgi0s08W7RC5I3u7ATFIhmj7hkVCAiOeCGw=";
  };
 in
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
  pname = "openvpn3";
  version = "27.1";

  src = fetchFromGitHub {
    owner = "OpenVPN";
    repo = "openvpn3-linux";
-    tag = "v${version}";
+    tag = "v${finalAttrs.version}";
    hash = "sha256-Egt6lVcvlmxnABw4v0cdROQzVdkA3DgOGGCSgl+QFdM=";
    # `openvpn3-core` is a submodule.
    # TODO: make it into a separate package
@@ -63,7 +63,7 @@ stdenv.mkDerivation rec {

  postPatch = ''
    echo '#define OPENVPN_VERSION "3.git:unknown:unknown"
-    #define PACKAGE_GUIVERSION "v${builtins.replaceStrings [ "_" ] [ ":" ] version}"
+    #define PACKAGE_GUIVERSION "v${builtins.replaceStrings [ "_" ] [ ":" ] finalAttrs.version}"
    #define PACKAGE_NAME "openvpn3-linux"
    ' > ./src/build-version.h

@@ -134,7 +134,7 @@ stdenv.mkDerivation rec {
  '';
  postFixup = ''
    wrapPythonPrograms
-    wrapPythonProgramsIn "$out/libexec/openvpn3-linux" "$out ${pythonPath}"
+    wrapPythonProgramsIn "$out/libexec/openvpn3-linux" "$out ${finalAttrs.pythonPath}"
  '';

  env.NIX_LDFLAGS = "-lpthread";
@@ -145,10 +145,10 @@ stdenv.mkDerivation rec {
    description = "OpenVPN 3 Linux client";
    license = lib.licenses.agpl3Plus;
    homepage = "https://github.com/OpenVPN/openvpn3-linux/";
-    changelog = "https://github.com/OpenVPN/openvpn3-linux/releases/tag/v${version}";
+    changelog = "https://github.com/OpenVPN/openvpn3-linux/releases/tag/v${finalAttrs.version}";
    maintainers = with lib.maintainers; [
      progrm_jarvis
    ];
    platforms = lib.platforms.linux;
  };
-}
+})
--- a/pkgs/by-name/os/ostui/package.nix
+++ b/pkgs/by-name/os/ostui/package.nix
@@ -8,13 +8,13 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "ostui";
-  version = "1.3.8";
+  version = "1.3.9";

  src = fetchFromSourcehut {
    owner = "~ser";
    repo = "ostui";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-+G+lox1gDP+EeHFkWbUHzVrrrel7d99gYUNyYXdOJ0I=";
+    hash = "sha256-al8vMreGUS4Y6/407wXozZRb5rnKyXKBzXN+Z3d2MC4=";
  };

  vendorHash = "sha256-cCyOG6nqlw2DPbA1dCuki5cpDy9LmZV/3YGyB3nCreI=";
--- a/pkgs/by-name/po/pokego/package.nix
+++ b/pkgs/by-name/po/pokego/package.nix
@@ -1,25 +1,28 @@
 {
  lib,
-  buildGoModule,
+  stdenv,
+  buildPackages,
+  buildGo127Module,
  fetchFromGitHub,
  installShellFiles,
  nix-update-script,
 }:

-buildGoModule (finalAttrs: {
+buildGo127Module (finalAttrs: {
  pname = "pokego";
-  version = "0.5.2";
-
+  version = "0.5.6";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "rubiin";
    repo = "pokego";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-GBKQ9YV98znhTP9QsvAAyva8dNohFS8dbQ4FAG5IDig=";
+    hash = "sha256-esUIcW7lJ6WDmu2nWeVg3UdKB5sZ7lT/ffA4FSi0/Go=";
  };

-  vendorHash = "sha256-a/YYEMVCqyg76P2Pyfpej46vYQhnnJjicpxNMAZGOVg=";
+  vendorHash = "sha256-Ip2GuQDOolMyDvfmXcJRlY2rMp1amS8owkqcNMOR1+Y=";
+
+  doCheck = false;

  ldflags = [
    "-s"
@@ -28,11 +31,20 @@ buildGoModule (finalAttrs: {

  nativeBuildInputs = [ installShellFiles ];

-  postInstall = ''
-    installShellCompletion completions/pokego.bash
-    installShellCompletion completions/pokego.fish
-    installShellCompletion completions/pokego.zsh
-  '';
+  postInstall =
+    let
+      exe =
+        if stdenv.buildPlatform.canExecute stdenv.hostPlatform then
+          "$out/bin/pokego"
+        else
+          lib.getExe buildPackages.pokego;
+    in
+    ''
+      installShellCompletion --cmd pokego \
+        --bash <(${exe} completion bash) \
+        --fish <(${exe} completion fish) \
+        --zsh <(${exe} completion zsh)
+    '';

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/pr/prometheus-redis-exporter/package.nix
+++ b/pkgs/by-name/pr/prometheus-redis-exporter/package.nix
@@ -12,7 +12,7 @@

 buildGoModule (finalAttrs: {
  pname = "redis_exporter";
-  version = "1.90.0";
+  version = "1.91.0";

  __structuredAttrs = true;

@@ -20,7 +20,7 @@ buildGoModule (finalAttrs: {
    owner = "oliver006";
    repo = "redis_exporter";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-IZgFd6hlWVsUAx2sQsB8lTp7aZEGGmJ8BequT/TsZ+w=";
+    hash = "sha256-BECFx4sHL9zEEk5wKSZ9U1IEK6l2C9M8zdNrVJwc8LY=";
  };

  vendorHash = "sha256-+g1HSv+AxXsNzVr6QHpm2EJnRR80rPCtBnPgwq6aq5I=";
--- a/pkgs/by-name/qb/qbit-manage/package.nix
+++ b/pkgs/by-name/qb/qbit-manage/package.nix
@@ -8,13 +8,13 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "qbit-manage";
-  version = "4.11.0";
+  version = "4.13.0";

  src = fetchFromGitHub {
    owner = "StuffAnThings";
    repo = "qbit_manage";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-3HYxrFvte38ZKcKJOW86Yp1nGvEvzmflapNkVd9hSGg=";
+    hash = "sha256-Btj6Lavz5vcCURDKy7OTdEonTD5jwBbAwSMzK06lK3o=";
  };

  pyproject = true;
@@ -42,7 +42,6 @@ python3Packages.buildPythonApplication (finalAttrs: {

  pythonRelaxDeps = [
    "bencode.py"
-    "gitpython"
    "humanize"
  ];

--- a/pkgs/by-name/ra/radicle-ci-broker/package.nix
+++ b/pkgs/by-name/ra/radicle-ci-broker/package.nix
@@ -14,14 +14,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "radicle-ci-broker";
-  version = "0.31.0";
+  version = "0.32.1";

  src = fetchFromRadicle {
    seed = "seed.radicle.dev";
    repo = "zwTxygwuz5LDGBq255RA2CbNGrz8";
    node = "z6MkgEMYod7Hxfy9qCvDv5hYHkZ4ciWmLFgfvm3Wn1b2w2FV";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-yY2ke4JBAn0ZTaZ7HV8GCPF5Yqj1j+7GvjFXQQVM3ME=";
+    hash = "sha256-+NPlpDGrHjCB1ny81wbaM3f/b3wLFaH5ldINeTuV5hI=";
    leaveDotGit = true;
    postFetch = ''
      git -C $out rev-parse --short HEAD > $out/.git_head
@@ -29,7 +29,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    '';
  };

-  cargoHash = "sha256-+XB2+k18gWEO7tpsQK+ua133PcZ0mxV+txle7VutXIk=";
+  cargoHash = "sha256-o0s6za+IxeJQkwHKuMPJk+uDcMp7VRq+mMqpX3bcWVY=";

  postPatch = ''
    substituteInPlace build.rs \
@@ -41,7 +41,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  '';

  preCheck = ''
-    ln -s "$PWD/target/${stdenv.hostPlatform.rust.rustcTarget}/$cargoBuildType" target/debug
+    export SUBPLOT_DIR="$PWD/target/${stdenv.hostPlatform.rust.rustcTarget}/$cargoBuildType"

    rad auth --alias alice --stdin </dev/null
  '';
--- a/pkgs/by-name/ra/ralphex/package.nix
+++ b/pkgs/by-name/ra/ralphex/package.nix
@@ -9,7 +9,7 @@

 buildGoModule (finalAttrs: {
  pname = "ralphex";
-  version = "1.6.1";
+  version = "1.7.0";

  __structuredAttrs = true;

@@ -17,7 +17,7 @@ buildGoModule (finalAttrs: {
    owner = "umputun";
    repo = "ralphex";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-M1VeZgpNv64ZbcNvhzscnhTJhuR6yrh+clAWAce7vxI=";
+    hash = "sha256-fwbT23wzJrc7ljI4R2Lmdf0q0Y0/DeBbYYt2WMN/67A=";
  };

  vendorHash = null;
--- a/pkgs/by-name/rc/rcp/package.nix
+++ b/pkgs/by-name/rc/rcp/package.nix
@@ -6,58 +6,29 @@

 pkgsStatic.rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rcp";
-  version = "0.37.0";
+  version = "0.40.0";

  src = fetchFromGitHub {
    owner = "wykurz";
    repo = "rcp";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-svJA9QyqwpY1xzOQ09qFlZwrGp3HZXW9T2AICVJfqOs=";
+    hash = "sha256-xAuKhgnH5j5NioXDivwpaZFKkkTzGWJglbmVw5koaqE=";
  };

-  cargoHash = "sha256-QJr6kM520OWxje7Q5FZWgJH1IS8j+Jv1vNf7VyCINNA=";
+  cargoHash = "sha256-hNZhL+kZgm2pX28mKdCgpGyBexI33idlEfPB8OmgGOY=";

-  env.RUSTFLAGS = "--cfg tokio_unstable";
-
-  checkFlags = [
-    # these tests set setuid permissions on a test file (3oXXX) which doesn't work in a sandbox
-    "--skip=copy::copy_tests::check_default_mode"
-    "--skip=test_weird_permissions"
-    "--skip=test_edge_case_special_permissions"
-    "--skip=test_default_strips_special_bits_on_directories"
-    "--skip=test_default_strips_special_bits_on_files"
-    "--skip=test_default_preserves_special_bits_on_directories"
-    "--skip=test_preserve_all_preserves_special_bits_on_directories"
-    "--skip=test_preserve_all_preserves_special_bits_on_files"
-    "--skip=test_preserve_settings_dir_gid_time_7777"
-    "--skip=test_preserve_settings_dir_7777_preserves_special_bits"
-    "--skip=test_preserve_settings_file_7777_preserves_special_bits"
-    "--skip=test_preserve_settings_none_strips_special_bits_on_directories"
-    "--skip=no_setid_clears_bits_for_unchanged_owner_rule"
-    "--skip=no_setid_clears_existing_bits_for_unrelated_mode"
-    "--skip=no_setid_dry_run_reports_but_does_not_clear_bits"
-    "--skip=no_setid_respects_filter_and_per_type_scope"
-    "--skip=no_setid_retains_sticky_and_clears_setgid_on_directory"
-    # this test expects overwrite behavior that doesn't work in a sandbox
-    "--skip=test_overwrite_behavior"
-    # these tests require network access to determine local IP address
-    "--skip=test_remote"
-    # these tests expect to find version/git info from Cargo.toml, which isn't available in the sandbox
-    "--skip=version::tests::test_current_version"
-    "--skip=test_protocol_version_has_git_info"
-    "--skip=test_rcpd_protocol_version_has_git_info"
-    # these tests shell out to `getent` to resolve real user/group names, which isn't available in the sandbox
-    "--skip=chmod::tests::getent_real_resolves_root"
-    "--skip=chmod::tests::getent_real_option_like_name_fails_closed_no_injection"
-    "--skip=rejects_unknown_group"
-    # these tests change ownership and set setuid/setgid bits (fchown / chmod / chgrp),
-    # which the unprivileged sandbox build user isn't permitted to do (EPERM)
-    "--skip=safedir::tests::set_dir_metadata_fd_applies"
-    "--skip=safedir::tests::set_file_metadata_fd_ordering_preserves_setuid"
-    "--skip=applies_per_type_modes_recursively"
-    "--skip=group_change_preserves_setgid_across_chgrp"
-    "--skip=preserves_setgid_through_mode_change"
+  # Enable upstream's Nix sandbox test filter without replacing nixpkgs'
+  # target-specific Rust flags. Keep this config identical in both phases so
+  # Cargo can reuse the release artifacts built before the checks.
+  cargoBuildFlags = [
+    "--config"
+    ''target.'cfg(all())'.rustflags=["--cfg","tokio_unstable","--cfg","rcp_nix_sandbox"]''
  ];
+  cargoTestFlags = finalAttrs.cargoBuildFlags;
+
+  # fixtures that mutate process-global admission, congestion, hook and file-descriptor
+  # state are only supported under nextest's process isolation or single-threaded libtest
+  dontUseCargoParallelTests = true;

  meta = {
    changelog = "https://github.com/wykurz/rcp/releases/tag/v${finalAttrs.version}";
--- a/pkgs/by-name/ru/rustfetch/package.nix
+++ b/pkgs/by-name/ru/rustfetch/package.nix
@@ -2,18 +2,31 @@
  lib,
  fetchFromGitHub,
  rustPlatform,
+  libxcb,
+  stdenv,
+  versionCheckHook,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rustfetch";
-  version = "0.2.0";
+  version = "0.3.0";

  src = fetchFromGitHub {
    owner = "lemuray";
    repo = "rustfetch";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-iGcxDKl36kbEi+OiH4gB2+HxP37bpqAMZguIXDzq3Jw=";
+    hash = "sha256-7+25SYYpOwbJM3UofTjk8hAuDVQ33tUge+2k1oSRvvY=";
  };
-  cargoHash = "sha256-87wfFczmgCft4ke/RQKi54wvqFKGRJMtqhkwQgDCedg=";
+  cargoHash = "sha256-/D6y6h86V7qUfJqXW6XXTHAyiqwNJAfSQOLHxNfajv8=";
+
+  buildInputs = lib.optionals stdenv.hostPlatform.isLinux [ libxcb ];
+
+  checkFlags = [
+    # requires os calls which will error out to "Permission denied" in the sandbox
+    "--skip=test_no_pretty_name"
+  ];
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;

  meta = {
    description = "CLI tool designed to fetch system information in the fastest and safest way possible";
--- a/pkgs/by-name/sh/shfmt/package.nix
+++ b/pkgs/by-name/sh/shfmt/package.nix
@@ -10,13 +10,13 @@

 buildGoModule (finalAttrs: {
  pname = "shfmt";
-  version = "3.14.0";
+  version = "3.14.1";

  src = fetchFromGitHub {
    owner = "mvdan";
    repo = "sh";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-W0/40VfqHxKsdIZQzjv3T4Vc/BVgLl9aMuwSUycvclE=";
+    hash = "sha256-taZfXF8i8Kb6RjW7tWMFfaHH8K4OE4FT+U+X0IBaj08=";
  };

  vendorHash = "sha256-OfdXhgPyRRifRK4CylmOqWh0qmZ80mNAhBZtqJlwPPY=";
--- a/pkgs/by-name/si/sirikali/package.nix
+++ b/pkgs/by-name/si/sirikali/package.nix
@@ -8,7 +8,7 @@
  pkg-config,
  qt6,
  kdePackages,
-  fscrypt-experimental,
+  fscrypt,
  gocryptfs,
  sshfs,
  libgcrypt,
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
  qtWrapperArgs = [
    "--prefix PATH : ${
      lib.makeBinPath [
-        fscrypt-experimental
+        fscrypt
        gocryptfs
        sshfs
      ]
--- a/pkgs/by-name/sn/snyk/package.nix
+++ b/pkgs/by-name/sn/snyk/package.nix
@@ -10,13 +10,13 @@

 buildNpmPackage (finalAttrs: {
  pname = "snyk";
-  version = "1.1307.0";
+  version = "1.1307.1";

  src = fetchFromGitHub {
    owner = "snyk";
    repo = "cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-5Y9uMGxjP26q0zNIqp7Piauy0r5X8DthnYgL+F6eZrM=";
+    hash = "sha256-VhbtP1aHIkYaPbptkJMT/cMAhqFeAwTwSZioIAUbO8k=";

    # TODO: Remove once https://github.com/snyk/cli/pull/6924 is released.
    postFetch = ''
@@ -26,7 +26,7 @@ buildNpmPackage (finalAttrs: {

  npmDepsFetcherVersion = 2;

-  npmDepsHash = "sha256-xyLSYNXdZHvVXKMS87DKeCde1/XXZDNL3bnsiExXqng=";
+  npmDepsHash = "sha256-mTP5Tyi41BhSaDjCallH6r+PAFd/UCqNLxUkk2DzcLE=";

  nodejs = nodejs_24;

--- a/pkgs/by-name/sp/spnavcfg/package.nix
+++ b/pkgs/by-name/sp/spnavcfg/package.nix
@@ -5,6 +5,7 @@
  pkg-config,
  libspnav,
  qt6,
+  libx11,
 }:

 stdenv.mkDerivation (finalAttrs: {
@@ -22,6 +23,9 @@ stdenv.mkDerivation (finalAttrs: {
  nativeBuildInputs = [
    pkg-config
    qt6.wrapQtAppsHook
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    libx11
  ];

  buildInputs = [
--- a/pkgs/by-name/st/stump/package.nix
+++ b/pkgs/by-name/st/stump/package.nix
@@ -20,13 +20,13 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "stump";
-  version = "0.1.6";
+  version = "0.1.7";

  src = fetchFromGitHub {
    owner = "stumpapp";
    repo = "stump";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-y870qA9r9uhFJthKiz0uIu6xFMtZ0L5xBj4iRr20/QI=";
+    hash = "sha256-ERERTzoh0RoWtVNrOejiyFu7ZmSVgUVGFaTsj36Je48=";
  };

  frontend = stdenv.mkDerivation (_: {
@@ -35,7 +35,7 @@ rustPlatform.buildRustPackage (finalAttrs: {

    yarnOfflineCache = fetchYarnDeps {
      yarnLock = finalAttrs.src + "/yarn.lock";
-      hash = "sha256-j+S3FkiWZRZyX3CfwEDbspjG+oltECgIFOZZuN7FKRY=";
+      hash = "sha256-x5aZLRhNmoxcrMOQNvNDfuJCfc0ezYazVGm17v3CwqE=";
    };

    nativeBuildInputs = [
@@ -60,7 +60,7 @@ rustPlatform.buildRustPackage (finalAttrs: {

  __structuredAttrs = true;

-  cargoHash = "sha256-2WI/sjRM9GESBc3APrTwQ2F28CPkZCUfzEE+EMMWHKA=";
+  cargoHash = "sha256-4qCxyoo1WyurXLEw5Nq291Tglds0Lg1LGHfgZxsoZBQ=";

  cargoBuildFlags = [
    "--package"
@@ -118,5 +118,6 @@ rustPlatform.buildRustPackage (finalAttrs: {
    license = lib.licenses.mit;
    platforms = [ "x86_64-linux" ];
    mainProgram = "stump_server";
+    maintainers = with lib.maintainers; [ jvanbruegge ];
  };
 })
--- a/pkgs/by-name/su/supercell-wx/package.nix
+++ b/pkgs/by-name/su/supercell-wx/package.nix
@@ -92,6 +92,7 @@ stdenv.mkDerivation (finalAttrs: {
    ./patches/explicit-link-aws-crt.patch # fix missing symbols from aws-crt-cpp
    # }}}
    ./patches/boost-1.89-compat.patch
+    ./patches/memcpy-cstring.patch
  ];

  # This also may be submitted upstream to maplibre-native-qt, which is currently vendored
--- a/pkgs/by-name/su/supercell-wx/patches/memcpy-cstring.patch
+++ b/pkgs/by-name/su/supercell-wx/patches/memcpy-cstring.patch
@@ -0,0 +1,12 @@
+diff --git a/wxdata/source/scwx/zip/zip_stream_writer.cpp b/wxdata/source/scwx/zip/zip_stream_writer.cpp
+index 3822ea20..a455f63b 100644
+--- a/wxdata/source/scwx/zip/zip_stream_writer.cpp
+++ b/wxdata/source/scwx/zip/zip_stream_writer.cpp
+@@ -2,6 +2,7 @@
+ #include <scwx/util/logger.hpp>
+ 
+ #include <cstdlib>
+#include <cstring>
+ #include <fstream>
+ 
+ #include <zip.h>
--- a/pkgs/by-name/ta/tabiew/package.nix
+++ b/pkgs/by-name/ta/tabiew/package.nix
@@ -7,16 +7,16 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "tabiew";
-  version = "0.14.2";
+  version = "0.15.0";

  src = fetchFromGitHub {
    owner = "shshemi";
    repo = "tabiew";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-kFmlXjC7L8rW5XfIIMiDcGDxoGlcICuwOZh6jkecFWY=";
+    hash = "sha256-iHdHeWx8xxqirwiGdeSbvHDXYPn1UkqoQMosaiakQz0=";
  };

-  cargoHash = "sha256-vEGa1LyMRZkiWCtS+DjqRteZv/4kNbyh2yMrYVv73YM=";
+  cargoHash = "sha256-MemnQS6lRmIzo9x94yorGIp2upTY/CW/3jGh73AdowQ=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/by-name/ta/tauno-monitor/package.nix
+++ b/pkgs/by-name/ta/tauno-monitor/package.nix
@@ -14,7 +14,7 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "tauno-monitor";
-  version = "0.2.20";
+  version = "0.2.24";
  pyproject = false;

  __structuredAttrs = true;
@@ -23,7 +23,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
    owner = "taunoe";
    repo = "tauno-monitor";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-rtFnWK1K4S866lgR/lGaTB+REqDExKsEFePX8cwai5E=";
+    hash = "sha256-HtoXdKKa/2nvBZVUXSrXH/7JHzdQObjW+7QTx/e8IWo=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/th/thrift-ls/package.nix
+++ b/pkgs/by-name/th/thrift-ls/package.nix
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "thrift-ls";
-  version = "0.2.11";
+  version = "0.2.12";

  src = fetchFromGitHub {
    owner = "joyme123";
    repo = "thrift-ls";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-iXrfGoX24bOqV39PhHIshb7GzqDt7EW3aRwTptd50e8=";
+    hash = "sha256-Ts0zy/wBjZTm71Umk46KBkdbUm/Akf/KXdoKp8G95ks=";
  };

  vendorHash = "sha256-SGCJ12BxjFUQ7bnaNY0bvrrtm2qNNrwYKKfNEi1lPco=";
--- a/pkgs/by-name/to/tombi/package.nix
+++ b/pkgs/by-name/to/tombi/package.nix
@@ -9,7 +9,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "tombi";
-  version = "1.4.1";
+  version = "1.5.2";

  __structuredAttrs = true;

@@ -17,7 +17,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "tombi-toml";
    repo = "tombi";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-O9rtdhbyZn/hdUogWJz+H8bxOzj1leZnqMBpTgQ+ePM=";
+    hash = "sha256-HMAyzISP/q+eBAPPg/8FHa6eQ4xbA8sHne1dm+veUyo=";
  };

  # Tests relies on the presence of network
@@ -26,7 +26,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    "--package"
    "tombi-cli"
  ];
-  cargoHash = "sha256-9mEPyzSaxJLeejNuHMwBYjJ+pfDcNvarykPLgBxGtLs=";
+  cargoHash = "sha256-9x7Qesl6OsiN79b1MqP5BMF/0VOymER57ijwHzs0Taw=";

  postPatch = ''
    substituteInPlace Cargo.toml \
--- a/Show More
+++ b/Show More