From ec47a8468b4edb9c41161dad85749fdbe8ff6e54 Mon Sep 17 00:00:00 2001
From: Silvio Ankermann <silvio.ankermann@cloudandheat.com>
Date: Fri, 27 Mar 2026 11:43:14 +0100
Subject: [PATCH 01/89] ruqola: 2.6.1 -> 2.7.0

---
 pkgs/by-name/ru/ruqola/package.nix | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ru/ruqola/package.nix b/pkgs/by-name/ru/ruqola/package.nix
index 01df74ca627e..542108baacc5 100644
--- a/pkgs/by-name/ru/ruqola/package.nix
+++ b/pkgs/by-name/ru/ruqola/package.nix
@@ -11,14 +11,14 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "ruqola";
-  version = "2.6.1";
+  version = "2.7.0";
 
   src = fetchFromGitLab {
     domain = "invent.kde.org";
     owner = "network";
     repo = "ruqola";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-z/JyIXZKXdOc92Ebq1Jcnhx/6EL7rkcdnxN2BsQn5Cw=";
+    hash = "sha256-ndb20iKNaWwK5yR3mlDoBYEPj2QLHOlQVBejGKs/FMw=";
   };
 
   nativeBuildInputs = [
@@ -50,6 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
     qt6.qtbase
     qt6.qtmultimedia
     qt6.qtnetworkauth
+    qt6.qtspeech
     qt6.qtwebsockets
   ];
 

From 53d0f0af89c3cf43137cb033ee9ba7cd27833f7f Mon Sep 17 00:00:00 2001
From: Thomas Butter <tbutter@gmail.com>
Date: Sun, 22 Mar 2026 21:49:16 +0000
Subject: [PATCH 02/89] maintainers: add tbutter

---
 maintainers/maintainer-list.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 5ad86c2b1db6..16032d74aaea 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -26584,6 +26584,12 @@
     githubId = 156964;
     name = "Thomas Boerger";
   };
+  tbutter = {
+    email = "tbutter@gmail.com";
+    github = "tbutter";
+    githubId = 1336537;
+    name = "Thomas Butter";
+  };
   tc-kaluza = {
     github = "tc-kaluza";
     githubId = 101565936;

From 3dc2b39395409ec58f33f25b855c9692ca5fb883 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 6 Apr 2026 03:03:20 +0000
Subject: [PATCH 03/89] gitea-mcp-server: 1.0.1 -> 1.1.0

---
 pkgs/by-name/gi/gitea-mcp-server/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/gi/gitea-mcp-server/package.nix b/pkgs/by-name/gi/gitea-mcp-server/package.nix
index 5a1d597045e6..832169f03f63 100644
--- a/pkgs/by-name/gi/gitea-mcp-server/package.nix
+++ b/pkgs/by-name/gi/gitea-mcp-server/package.nix
@@ -6,17 +6,17 @@
 
 buildGo126Module (finalAttrs: {
   pname = "gitea-mcp-server";
-  version = "1.0.1";
+  version = "1.1.0";
 
   src = fetchFromGitea {
     domain = "gitea.com";
     owner = "gitea";
     repo = "gitea-mcp";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-B7uB69YsQd8EeENrezFK7kFXha21XValjEAYRjeYreo=";
+    hash = "sha256-weJcl9Vp7mhPiaui7VGETs5t4trUDTegDoUR8gRTGIs=";
   };
 
-  vendorHash = "sha256-xfhvbTcniRnkv81MIEnoy36up8O2IZ1WUrhYJrhtZ3k=";
+  vendorHash = "sha256-35zVDzivvO3tSi1RYvXJoLvrlvnp3JCzwC5FqDEj91M=";
 
   subPackages = [ "." ];
 

From 8b73b657168bf02fb48302348a6c8da2b596fe65 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 8 Apr 2026 12:29:51 +0000
Subject: [PATCH 04/89] ustreamer: 6.40 -> 6.55

---
 pkgs/by-name/us/ustreamer/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/us/ustreamer/package.nix b/pkgs/by-name/us/ustreamer/package.nix
index cad1b45a1505..50c350b1ff47 100644
--- a/pkgs/by-name/us/ustreamer/package.nix
+++ b/pkgs/by-name/us/ustreamer/package.nix
@@ -23,13 +23,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "ustreamer";
-  version = "6.40";
+  version = "6.55";
 
   src = fetchFromGitHub {
     owner = "pikvm";
     repo = "ustreamer";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-jKltFQsx8Q9+TMTOg1p6nljII72CLEg6VYe60/KojUY=";
+    hash = "sha256-xL35xlgKEpgiD3m6xoEs+CBmEx0Fpwo43EbzqCqDgvc=";
   };
 
   buildInputs = [

From 267c387c53ac1340ab5a1ba45c2b69c1062c1c5c Mon Sep 17 00:00:00 2001
From: Adam Thompson-Sharpe <adamthompsonsharpe@gmail.com>
Date: Wed, 18 Mar 2026 19:52:48 -0400
Subject: [PATCH 05/89] opentxl: pass proper make variables for
 cross-compilation

Provides the correct information about binutils to use for compilation.
Without this, builds will fail when the C compiler has a target prefix.
---
 pkgs/by-name/op/opentxl/fix-cross.patch | 166 ++++++++++++++++++++++++
 pkgs/by-name/op/opentxl/package.nix     |  34 +++--
 2 files changed, 189 insertions(+), 11 deletions(-)
 create mode 100644 pkgs/by-name/op/opentxl/fix-cross.patch

diff --git a/pkgs/by-name/op/opentxl/fix-cross.patch b/pkgs/by-name/op/opentxl/fix-cross.patch
new file mode 100644
index 000000000000..3cc318cf134d
--- /dev/null
+++ b/pkgs/by-name/op/opentxl/fix-cross.patch
@@ -0,0 +1,166 @@
+diff --git a/Makefile b/Makefile
+index 1374808..2de353f 100644
+--- a/Makefile
++++ b/Makefile
+@@ -13,9 +13,10 @@
+ # most optimizing C compilers to generate incorrect code for it, or at 
+ # the very least to slow it down severely, at higher levels of optimization.
+ 
+-CC = gcc -w -Wno-error=int-conversion 
+-CFLAGS = -c -O -fno-inline -I .
++CC = gcc
++CFLAGS = -w -Wno-error=int-conversion -c -O -fno-inline -I .
+ LD = gcc
++STRIP = strip
+ LDFLAGS =
+ LDLIBS = -lm
+ RLFLAGS = -r 
+@@ -52,12 +53,14 @@ else ifeq ($(OS), CYGWIN)
+ 
+ else ifeq ($(OS), MSYS)
+     MESSAGE = "Making TXL on Msys / MinGW using gcc and BSD signal handling"
++    CFLAGS := $(CFLAGS) -DWIN
+     LDFLAGS := $(LDFLAGS) -Wl,--stack,0x2000000
+     EXE = .exe
+     SIGTYPE = BSD
+ 
+ else ifeq ($(OS), MINGW64)
+     MESSAGE = "Making TXL on Msys / MinGW using gcc and BSD signal handling"
++    CFLAGS := $(CFLAGS) -DWIN
+     LDFLAGS := $(LDFLAGS) -Wl,--stack,0x2000000
+     EXE = .exe
+     SIGTYPE = BSD
+@@ -89,18 +92,18 @@ alltxls : thetxl thetxldb thetxlpf thetxlvm thetxlcvt thetxlapr
+ thetxl : bin objs objs/main.o objs/txl.o objs/xform.o objs/parse.o objs/loadstor.o ${OBJS} ${TLOBJS} 
+ 	${CC} ${LDFLAGS} -o bin/txl objs/main.o objs/txl.o objs/xform.o objs/parse.o objs/loadstor.o \
+ 	    ${OBJS} ${TLOBJS} ${LDLIBS}
+-	strip bin/txl${EXE}
++	$(STRIP) bin/txl${EXE}
+ 	cp scripts/unix/* bin/
+ 
+ thetxldb : bin objs objs/main.o objs/txl.o objs/xformdb.o objs/parse.o objs/loadstor.o ${OBJS} ${TLOBJS} 
+ 	${CC} ${LDFLAGS} -o bin/txldb objs/main.o objs/txl.o objs/xformdb.o objs/parse.o objs/loadstor.o \
+ 	    ${OBJS} ${TLOBJS} ${LDLIBS}
+-	strip bin/txldb${EXE}
++	$(STRIP) bin/txldb${EXE}
+ 
+ thetxlpf : lib objs objs/main.o objs/txl.o objs/xformpf.o objs/parsepf.o objs/loadstor.o ${OBJS} ${TLOBJS}
+ 	${CC} ${LDFLAGS} -o lib/txlpf.x objs/main.o objs/txl.o objs/xformpf.o objs/parsepf.o objs/loadstor.o \
+ 	    ${OBJS} ${TLOBJS} ${LDLIBS}
+-	strip lib/txlpf.x
++	$(STRIP) lib/txlpf.x
+ 
+ thetxlvm : lib objs objs/main.o objs/txlsa.o objs/xform.o objs/loadsa.o objs/parsa.o ${COMMONOBJS} ${TLOBJS} 
+ 	${LD} ${RLFLAGS} -o lib/txlvm.o objs/txlsa.o objs/xform.o objs/loadsa.o objs/parsa.o \
+@@ -109,11 +112,11 @@ thetxlvm : lib objs objs/main.o objs/txlsa.o objs/xform.o objs/loadsa.o objs/par
+ 
+ thetxlcvt : lib objs objs/main.o objs/txlcvt.o
+ 	${CC} ${LDFLAGS} -o lib/txlcvt.x objs/main.o objs/txlcvt.o ${TLOBJS} ${LDLIBS}
+-	strip lib/txlcvt.x
++	$(STRIP) lib/txlcvt.x
+ 
+ thetxlapr : lib objs objs/main.o objs/txlapr.o
+ 	${CC} ${LDFLAGS} -o lib/txlapr.x objs/main.o objs/txlapr.o ${TLOBJS} ${LDLIBS}
+-	strip lib/txlapr.x
++	$(STRIP) lib/txlapr.x
+ 
+ objs/main.o : tpluslib/TL.h UNIX main.c 
+ 	${CC} $(CFLAGS) -D${SIGTYPE} main.c; mv main.o objs/main.o
+@@ -216,4 +219,3 @@ clean :
+ 	rm -f bin/txl* objs/*.o 
+ 	rm -rf opentxl opentxl-* opentxl*.tar.gz 
+ 	cd test; make clean; cd ..
+-
+diff --git a/scripts/unix/txl2c b/scripts/unix/txl2c
+index 7429daf..ebf56c5 100755
+--- a/scripts/unix/txl2c
++++ b/scripts/unix/txl2c
+@@ -19,15 +19,7 @@ then
+     exit 99
+ fi
+ 
+-# Localization
+-CC="gcc"
+-
+-case `uname -s` in
+-    CYGWIN*|MSYS*|MINGW64*)
+-        CC="$CC -Wl,--stack,0x20000000";;
+-    *)
+-	;;
+-esac
++BUILD_TXLLIB="${BUILD_TXLLIB:-$TXLLIB}"
+ 
+ # Decode TXL program name and options
+ TXLPROG=""
+@@ -90,7 +82,7 @@ then
+ fi
+ 
+ # Convert TXLVM byte code to initialized C byte array
+-$TXLLIB/txlcvt.x $TXLNAME.ctxl
++$BUILD_TXLLIB/txlcvt.x $TXLNAME.ctxl
+ 
+ # Clean up
+ /bin/rm -f $TXLNAME.ctxl Txl/$TXLNAME.ctxl txl/$TXLNAME.ctxl 2> /dev/null
+diff --git a/scripts/unix/txlc b/scripts/unix/txlc
+index 4f49f49..201037e 100755
+--- a/scripts/unix/txlc
++++ b/scripts/unix/txlc
+@@ -20,9 +20,12 @@ then
+ fi
+ 
+ # Localization
+-CC="gcc"
++CC="${CC:-cc}"
++BUILD_TXLLIB="${BUILD_TXLLIB:-$TXLLIB}"
++TARGET_TXLLIB="${TARGET_TXLLIB:-$TXLLIB}"
++OS="${OS:-$(uname -s)}"
+ 
+-case `uname -s` in
++case "$OS" in
+     CYGWIN*|MSYS*|MINGW64*)
+         CC="$CC -Wl,--stack,0x20000000";;
+     *)
+@@ -90,10 +93,10 @@ then
+ fi
+ 
+ # Convert TXLVM byte code to initialized C byte array
+-$TXLLIB/txlcvt.x $TXLNAME.ctxl
++$BUILD_TXLLIB/txlcvt.x $TXLNAME.ctxl
+ 
+ # Compile and link with TXLVM
+-$CC -O -w -o $TXLNAME.x $TXLLIB/txlmain.o $TXLLIB/txlvm.o  ${TXLNAME}_TXL.c -lm
++$CC -O -w -o $TXLNAME.x $TARGET_TXLLIB/txlmain.o $TARGET_TXLLIB/txlvm.o  ${TXLNAME}_TXL.c -lm
+ 
+ # Clean up
+ /bin/rm -f $TXLNAME.ctxl Txl/$TXLNAME.ctxl txl/$TXLNAME.ctxl ${TXLNAME}_TXL.* 2> /dev/null
+diff --git a/scripts/unix/txlp b/scripts/unix/txlp
+index e39af87..cbb53ac 100755
+--- a/scripts/unix/txlp
++++ b/scripts/unix/txlp
+@@ -19,6 +19,8 @@ then
+     exit 99
+ fi
+ 
++BUILD_TXLLIB="${BUILD_TXLLIB:-$TXLLIB}"
++
+ # Decode TXL program name and options
+ TXLFILES=""
+ TXLOPTIONS=""
+@@ -43,7 +45,7 @@ done
+ # Run the TXL command, using txlpf
+ if [ "$1" != "" ]
+ then
+-if  ! $TXLLIB/txlpf.x $* > /dev/null 2> /tmp/txlp$$ 
++if  ! $BUILD_TXLLIB/txlpf.x $* > /dev/null 2> /tmp/txlp$$
+ then
+ 	echo "txlp:  TXL program failed" 2>&1
+ 	cat /tmp/txlp$$ 2>&1
+@@ -54,7 +56,7 @@ then
+ fi
+ 
+ # Analyze the results
+-$TXLLIB/txlapr.x $PROFOPTIONS
++$BUILD_TXLLIB/txlapr.x $PROFOPTIONS
+ 
+ # Clean up
+ /bin/rm -f /tmp/txlp$$
diff --git a/pkgs/by-name/op/opentxl/package.nix b/pkgs/by-name/op/opentxl/package.nix
index ae5d1c644e84..e26fb2167e8a 100644
--- a/pkgs/by-name/op/opentxl/package.nix
+++ b/pkgs/by-name/op/opentxl/package.nix
@@ -5,6 +5,18 @@
   fetchurl,
   nix-update-script,
 }:
+let
+  osOption =
+    platform:
+    if platform.isDarwin then
+      "Darwin"
+    else if platform.isCygwin then
+      "CYGWIN"
+    else if platform.isWindows then
+      "MSYS"
+    else
+      "Linux";
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "opentxl";
   version = "11.3.7";
@@ -19,6 +31,10 @@ stdenv.mkDerivation (finalAttrs: {
   # Using -std=gnu89 to prevent errors that occur with default args
   env.NIX_CFLAGS_COMPILE = "-std=gnu89 -Wno-int-conversion";
 
+  patches = [
+    ./fix-cross.patch
+  ];
+
   postPatch = ''
     # Replace hardcoded FHS paths in various files
     find . -type f -exec sed -i \
@@ -27,18 +43,15 @@ stdenv.mkDerivation (finalAttrs: {
       -e "s#/usr/local/bin#$out/bin#g" \
       -e "s#/usr/local/lib/txl#$out/lib#g" \
       {} +
-
-    # Replace hardcoded gcc references
-    substituteInPlace scripts/unix/{txlc,txl2c} \
-      --replace-fail gcc '${stdenv.cc}/bin/cc'
   '';
 
-  preBuild = ''
-    makeFlagsArray+=(
-      CC="$CC"
-      LD="$CC"
-    )
-  '';
+  makeFlags = [
+    "CC=${stdenv.cc.targetPrefix}cc"
+    "LD=${stdenv.cc.targetPrefix}cc"
+    "STRIP=${stdenv.cc.targetPrefix}strip"
+    "EXE=${stdenv.hostPlatform.extensions.executable}"
+    "OS=${osOption stdenv.hostPlatform}"
+  ];
 
   checkFlags = [ "-C test" ];
 
@@ -58,7 +71,6 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "Open-source compiler for the Txl language";
     mainProgram = "txl";
-    platforms = lib.platforms.unix;
     homepage = "https://github.com/CordyJ/OpenTxl";
     downloadPage = "https://github.com/CordyJ/OpenTxl/releases";
     changelog = "https://github.com/CordyJ/OpenTxl/releases/tag/v${finalAttrs.version}";

From f56d8ab9f1086b3ee5f2f404e8c53b804195d02c Mon Sep 17 00:00:00 2001
From: Adam Thompson-Sharpe <adamthompsonsharpe@gmail.com>
Date: Thu, 9 Apr 2026 15:32:27 -0400
Subject: [PATCH 06/89] opentxl: include runtimeShellPackage in buildInputs

Required for patchShebangs to find the right shell for runtime scripts.
---
 pkgs/by-name/op/opentxl/package.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/op/opentxl/package.nix b/pkgs/by-name/op/opentxl/package.nix
index e26fb2167e8a..084179a97734 100644
--- a/pkgs/by-name/op/opentxl/package.nix
+++ b/pkgs/by-name/op/opentxl/package.nix
@@ -4,6 +4,7 @@
   callPackage,
   fetchurl,
   nix-update-script,
+  runtimeShellPackage,
 }:
 let
   osOption =
@@ -20,6 +21,7 @@ in
 stdenv.mkDerivation (finalAttrs: {
   pname = "opentxl";
   version = "11.3.7";
+  strictDeps = true;
 
   # The code generation part of the upstream build system relies on an x86-only binary,
   # so the generated code is fetched from the GitHub release instead
@@ -28,6 +30,11 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-qIvxQqo1yCVJImjUvNNinzhoywVgaq9s0E+Ab+QStc0=";
   };
 
+  # Required for patchShebangs to find the right shell for runtime scripts.
+  # Optional check is to make sure that it is not added on platforms
+  # that can't run a POSIX shell (e.g. MinGW)
+  buildInputs = lib.optional (lib.meta.availableOn stdenv.hostPlatform runtimeShellPackage) runtimeShellPackage;
+
   # Using -std=gnu89 to prevent errors that occur with default args
   env.NIX_CFLAGS_COMPILE = "-std=gnu89 -Wno-int-conversion";
 

From 1b769bd0d31d248a0406a1fe5f40b4efef948fbd Mon Sep 17 00:00:00 2001
From: Adam Thompson-Sharpe <adamthompsonsharpe@gmail.com>
Date: Tue, 7 Apr 2026 09:57:01 -0400
Subject: [PATCH 07/89] opentxl-unwrapped: rename from opentxl

---
 pkgs/by-name/op/{opentxl => opentxl-unwrapped}/factorial-test.nix | 0
 pkgs/by-name/op/{opentxl => opentxl-unwrapped}/factorial.txl      | 0
 pkgs/by-name/op/{opentxl => opentxl-unwrapped}/fix-cross.patch    | 0
 pkgs/by-name/op/{opentxl => opentxl-unwrapped}/package.nix        | 0
 4 files changed, 0 insertions(+), 0 deletions(-)
 rename pkgs/by-name/op/{opentxl => opentxl-unwrapped}/factorial-test.nix (100%)
 rename pkgs/by-name/op/{opentxl => opentxl-unwrapped}/factorial.txl (100%)
 rename pkgs/by-name/op/{opentxl => opentxl-unwrapped}/fix-cross.patch (100%)
 rename pkgs/by-name/op/{opentxl => opentxl-unwrapped}/package.nix (100%)

diff --git a/pkgs/by-name/op/opentxl/factorial-test.nix b/pkgs/by-name/op/opentxl-unwrapped/factorial-test.nix
similarity index 100%
rename from pkgs/by-name/op/opentxl/factorial-test.nix
rename to pkgs/by-name/op/opentxl-unwrapped/factorial-test.nix
diff --git a/pkgs/by-name/op/opentxl/factorial.txl b/pkgs/by-name/op/opentxl-unwrapped/factorial.txl
similarity index 100%
rename from pkgs/by-name/op/opentxl/factorial.txl
rename to pkgs/by-name/op/opentxl-unwrapped/factorial.txl
diff --git a/pkgs/by-name/op/opentxl/fix-cross.patch b/pkgs/by-name/op/opentxl-unwrapped/fix-cross.patch
similarity index 100%
rename from pkgs/by-name/op/opentxl/fix-cross.patch
rename to pkgs/by-name/op/opentxl-unwrapped/fix-cross.patch
diff --git a/pkgs/by-name/op/opentxl/package.nix b/pkgs/by-name/op/opentxl-unwrapped/package.nix
similarity index 100%
rename from pkgs/by-name/op/opentxl/package.nix
rename to pkgs/by-name/op/opentxl-unwrapped/package.nix

From 6b57a9f2ffe11d18aece218cd04e772713757f06 Mon Sep 17 00:00:00 2001
From: Adam Thompson-Sharpe <adamthompsonsharpe@gmail.com>
Date: Thu, 19 Mar 2026 22:37:32 -0400
Subject: [PATCH 08/89] opentxl: init wrapper

---
 pkgs/by-name/op/opentxl-unwrapped/package.nix |  7 +-
 pkgs/by-name/op/opentxl/package.nix           | 69 +++++++++++++++++++
 2 files changed, 74 insertions(+), 2 deletions(-)
 create mode 100644 pkgs/by-name/op/opentxl/package.nix

diff --git a/pkgs/by-name/op/opentxl-unwrapped/package.nix b/pkgs/by-name/op/opentxl-unwrapped/package.nix
index 084179a97734..7524f904c7ca 100644
--- a/pkgs/by-name/op/opentxl-unwrapped/package.nix
+++ b/pkgs/by-name/op/opentxl-unwrapped/package.nix
@@ -72,8 +72,11 @@ stdenv.mkDerivation (finalAttrs: {
     runHook postInstall
   '';
 
-  passthru.tests.factorial = callPackage ./factorial-test.nix { opentxl = finalAttrs.finalPackage; };
-  passthru.updateScript = nix-update-script { };
+  passthru = {
+    inherit osOption;
+    tests.factorial = callPackage ./factorial-test.nix { opentxl = finalAttrs.finalPackage; };
+    updateScript = nix-update-script { };
+  };
 
   meta = {
     description = "Open-source compiler for the Txl language";
diff --git a/pkgs/by-name/op/opentxl/package.nix b/pkgs/by-name/op/opentxl/package.nix
new file mode 100644
index 000000000000..ab1b5896ba1c
--- /dev/null
+++ b/pkgs/by-name/op/opentxl/package.nix
@@ -0,0 +1,69 @@
+{
+  lib,
+  stdenv,
+  makeWrapper,
+  opentxl-unwrapped,
+  targetPackages,
+}:
+let
+  inherit (targetPackages.stdenv.cc) targetPrefix;
+
+  crossCompiling = stdenv.hostPlatform != stdenv.targetPlatform;
+  targetOpentxl = if !crossCompiling then opentxl-unwrapped else targetPackages.opentxl-unwrapped;
+in
+stdenv.mkDerivation (finalAttrs: {
+  pname = "${targetPrefix}opentxl-wrapper";
+  inherit (opentxl-unwrapped) version;
+  preferLocalBuild = true;
+  strictDeps = true;
+
+  dontUnpack = true;
+  dontConfigure = true;
+  dontBuild = true;
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/bin
+
+    # Wrap compiler
+    makeWrapper ${opentxl-unwrapped}/bin/txlc \
+      $out/bin/${targetPrefix}txlc \
+      --set TXLLIB ${opentxl-unwrapped}/lib \
+      --set BUILD_TXLLIB ${opentxl-unwrapped}/lib \
+      --set TARGET_TXLLIB ${targetOpentxl}/lib \
+      --set CC ${targetPackages.stdenv.cc}/bin/${targetPrefix}cc \
+      --set OS ${opentxl-unwrapped.osOption stdenv.targetPlatform}
+    ${
+      # For convenience, if there is a target prefix, create a symlink named txlc
+      lib.optionalString (targetPrefix != "") ''
+        ln -s $out/bin/${targetPrefix}txlc $out/bin/txlc
+      ''
+    }
+
+    # Wrap other scripts
+    for name in txl2c txlp; do
+      makeWrapper "${opentxl-unwrapped}/bin/$name" \
+        "$out/bin/$name" \
+        --set-default TXLLIB ${opentxl-unwrapped}/lib
+    done
+
+    # Link to binaries that don't need wrapping
+    for name in txl txldb; do
+      ln -s "${opentxl-unwrapped}/bin/$name" "$out/bin/$name"
+    done
+
+    runHook postInstall
+  '';
+
+  passthru = {
+    unwrapped = opentxl-unwrapped;
+    inherit (opentxl-unwrapped.passthru) tests;
+  };
+
+  meta = opentxl-unwrapped.meta // {
+    platforms = lib.platforms.unix;
+  };
+})

From 046be2151563e9f89294e31eb7bec1857b523fca Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 13 Apr 2026 12:29:14 +0000
Subject: [PATCH 09/89] atftp: 0.8.0 -> 0.8.1

---
 pkgs/by-name/at/atftp/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/at/atftp/package.nix b/pkgs/by-name/at/atftp/package.nix
index ad83c6487259..6204948caa8a 100644
--- a/pkgs/by-name/at/atftp/package.nix
+++ b/pkgs/by-name/at/atftp/package.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "atftp";
-  version = "0.8.0";
+  version = "0.8.1";
 
   src = fetchurl {
     url = "mirror://sourceforge/atftp/atftp-${finalAttrs.version}.tar.gz";
-    hash = "sha256-3yqgicdnD56rQOVZjl0stqWC3FGCkm6lC01pDk438xY=";
+    hash = "sha256-lsvb0vFmFcicnbNr6bMG3hdtmhwD3LjLd3Ylv+BovCs=";
   };
 
   # fix test script

From cbd432b6a8ecb73b2f517927f72137f2300457d1 Mon Sep 17 00:00:00 2001
From: Jiajie Chen <c@jia.je>
Date: Wed, 15 Apr 2026 15:53:05 +0800
Subject: [PATCH 10/89] cbmc: 6.8.0 -> 6.9.0

---
 .../cbmc/0002-Do-not-download-sources-in-cmake.patch | 12 ++++++------
 pkgs/by-name/cb/cbmc/package.nix                     |  6 +++---
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/cb/cbmc/0002-Do-not-download-sources-in-cmake.patch b/pkgs/by-name/cb/cbmc/0002-Do-not-download-sources-in-cmake.patch
index c45b65e80f6e..9a5c365285df 100644
--- a/pkgs/by-name/cb/cbmc/0002-Do-not-download-sources-in-cmake.patch
+++ b/pkgs/by-name/cb/cbmc/0002-Do-not-download-sources-in-cmake.patch
@@ -27,12 +27,12 @@ index ab8d111..d7165e2 100644
          message(STATUS "Building solvers with cadical")
  
          download_project(PROJ cadical
--            URL https://github.com/arminbiere/cadical/archive/rel-2.0.0.tar.gz
+-            URL https://github.com/arminbiere/cadical/archive/rel-3.0.0.tar.gz
 +            SOURCE_DIR @srccadical@
-             PATCH_COMMAND patch -p1 -i ${CBMC_SOURCE_DIR}/scripts/cadical-2.0.0-patch
+             PATCH_COMMAND patch -p1 -i ${CBMC_SOURCE_DIR}/scripts/cadical-3.0.0-patch
              COMMAND cmake -E copy ${CBMC_SOURCE_DIR}/scripts/cadical_CMakeLists.txt CMakeLists.txt
              COMMAND ./configure
--            URL_MD5 9fc2a66196b86adceb822a583318cc35
+-            URL_HASH SHA256=282b1c9422fde8631cb721b86450ae94df4e8de0545c17a69a301aaa4bf92fcf
          )
  
          add_subdirectory(${cadical_SOURCE_DIR} ${cadical_BINARY_DIR})
@@ -40,11 +40,11 @@ index ab8d111..d7165e2 100644
          message(STATUS "Building with IPASIR solver linking against: CaDiCaL")
  
          download_project(PROJ cadical
--            URL https://github.com/arminbiere/cadical/archive/rel-2.0.0.tar.gz
+-            URL https://github.com/arminbiere/cadical/archive/rel-3.0.0.tar.gz
 +            SOURCE_DIR @srccadical@
-             PATCH_COMMAND patch -p1 -i ${CBMC_SOURCE_DIR}/scripts/cadical-2.0.0-patch
+             PATCH_COMMAND patch -p1 -i ${CBMC_SOURCE_DIR}/scripts/cadical-3.0.0-patch
              COMMAND ./configure
--            URL_MD5 9fc2a66196b86adceb822a583318cc35
+-            URL_HASH SHA256=282b1c9422fde8631cb721b86450ae94df4e8de0545c17a69a301aaa4bf92fcf
          )
  
          message(STATUS "Building CaDiCaL")
diff --git a/pkgs/by-name/cb/cbmc/package.nix b/pkgs/by-name/cb/cbmc/package.nix
index 77c0d72ce4e7..ca8059681e24 100644
--- a/pkgs/by-name/cb/cbmc/package.nix
+++ b/pkgs/by-name/cb/cbmc/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "cbmc";
-  version = "6.8.0";
+  version = "6.9.0";
 
   src = fetchFromGitHub {
     owner = "diffblue";
     repo = "cbmc";
     tag = "cbmc-${finalAttrs.version}";
-    hash = "sha256-PT6AYiwkplCeyMREZnGZA0BKl4ZESRC02/9ibKg7mYU=";
+    hash = "sha256-SMJBnzoyTwcwJa9L2X1iX2W4Z/Mwoirf8EXfoyG0dRI=";
   };
 
   srcglucose = fetchFromGitHub {
@@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   srccadical =
     (cadical.override {
-      version = "2.0.0";
+      version = "3.0.0";
     }).src;
 
   nativeBuildInputs = [

From 9fd13f18a0e7ff4b61bc882d1f996e105c3b937e Mon Sep 17 00:00:00 2001
From: Marcin Serwin <marcin@serwin.dev>
Date: Wed, 15 Apr 2026 16:55:39 +0200
Subject: [PATCH 11/89] azahar: 2125.0.1 -> 2125.1

Signed-off-by: Marcin Serwin <marcin@serwin.dev>
---
 pkgs/by-name/az/azahar/package.nix | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/az/azahar/package.nix b/pkgs/by-name/az/azahar/package.nix
index cfb78f9d8cbe..7fb9055926b8 100644
--- a/pkgs/by-name/az/azahar/package.nix
+++ b/pkgs/by-name/az/azahar/package.nix
@@ -61,7 +61,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "azahar";
-  version = "2125.0.1";
+  version = "2125.1";
 
   src = fetchFromGitHub {
     owner = "azahar-emu";
@@ -74,7 +74,7 @@ stdenv.mkDerivation (finalAttrs: {
       echo "${finalAttrs.version}" > "$out/GIT-TAG"
       git -C "$out" rev-parse HEAD > "$out/GIT-COMMIT"
     '';
-    hash = "sha256-KzM2FWJPxZtkpwvK4DSdfNuxE8yy1OVaioVegQbBSWk=";
+    hash = "sha256-F5v52axQ4+vH6ZqEEuuMtV5PVahWmnS3PixZHqywhtM=";
   };
 
   strictDeps = true;
@@ -138,14 +138,6 @@ stdenv.mkDerivation (finalAttrs: {
     (darwinMinVersionHook "13.4")
   ];
 
-  patches = [
-    (fetchpatch {
-      name = "cmake-Add-option-to-use-system-oaknut.patch";
-      url = "https://github.com/azahar-emu/azahar/commit/6201256e15ee4d4fc053933545abf50fc46be178.patch";
-      hash = "sha256-03eIubAJ65W9clI9iaLcLNAAMbkX4E507nYNV8DVwZc=";
-    })
-  ];
-
   postPatch = ''
     # We already know the submodules are present
     substituteInPlace CMakeLists.txt \

From 0473cbade63851e732cd6f19d231920e54429799 Mon Sep 17 00:00:00 2001
From: Gus <58223632+thegu5@users.noreply.github.com>
Date: Wed, 15 Apr 2026 13:03:16 -0400
Subject: [PATCH 12/89] seanime: 3.5.2 -> 3.6.0

---
 pkgs/by-name/se/seanime/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/se/seanime/package.nix b/pkgs/by-name/se/seanime/package.nix
index 0a20a6f5ba44..7f64469fe647 100644
--- a/pkgs/by-name/se/seanime/package.nix
+++ b/pkgs/by-name/se/seanime/package.nix
@@ -10,13 +10,13 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "seanime";
-  version = "3.5.2";
+  version = "3.6.0";
 
   src = fetchFromGitHub {
     owner = "5rahim";
     repo = "seanime";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-ejXWQPUROIzu6RlUJIaKaiJfPb59kupQDhqWU83EqP4=";
+    hash = "sha256-R6WKRuU2kBvw9XD3iAZky1YNKWDv+W7YZAwpprYeWkw=";
   };
 
   nativeBuildInputs = [
@@ -28,7 +28,7 @@ buildGoModule (finalAttrs: {
     npmRoot = "seanime-web";
     npmDeps = fetchNpmDeps {
       src = "${finalAttrs.src}/seanime-web";
-      hash = "sha256-fWlK2h0RQF9GnEogXW3bwM01RCCDVij/9S2sn2BA3S4=";
+      hash = "sha256-4ItF0+Bmc+75oeNHjQP4RsbcRWgeG9Wq/27wDiQ4KVM=";
     };
   };
 
@@ -42,7 +42,7 @@ buildGoModule (finalAttrs: {
     rm -rf .github
   '';
 
-  vendorHash = "sha256-TN9shH4B7XVDIa541+7MHTNQs1IKPRJW1dn8tmES5jg=";
+  vendorHash = "sha256-9RCVIL+h5L20156BuD8GGbC98QUchB8JCWId8b/Sfy8=";
 
   subPackages = [ "." ];
 

From 3577cbc9e1cea94b5233ed9821946fe112788f7a Mon Sep 17 00:00:00 2001
From: yuannan <brandon@emergence.ltd>
Date: Wed, 15 Apr 2026 20:32:14 +0100
Subject: [PATCH 13/89] vscode: 1.115 -> 1.116

---
 pkgs/applications/editors/vscode/vscode.nix | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/pkgs/applications/editors/vscode/vscode.nix b/pkgs/applications/editors/vscode/vscode.nix
index 67af88256f06..661e8d968a0c 100644
--- a/pkgs/applications/editors/vscode/vscode.nix
+++ b/pkgs/applications/editors/vscode/vscode.nix
@@ -35,17 +35,17 @@ let
 
   hash =
     {
-      x86_64-linux = "sha256-eDSGfF05h5HPTZNeV9l/SBV+9fIV9iVnommM5P/cGgA=";
-      x86_64-darwin = "sha256-gHNXSWjbS+xqxjNYaoE7WSeo1Vf2+au/x68RVObJtp0=";
-      aarch64-linux = "sha256-PkZiq6STbt1Rb/g9XKeE3tktcrSRyQn/ah1QQxrOITg=";
-      aarch64-darwin = "sha256-T7An1+qkBO2QncPvoyymjerwLwti2/MgwmOJJCb2Nhw=";
-      armv7l-linux = "sha256-+KfjkiqMBGg9x/Qnd4FHiW0kw0dIQ56DSGUm8SBTc8o=";
+      x86_64-linux = "sha256-zoe2E9xlpAME4QD8IagicbAj71g3cA9XlymQQQMFJLo=";
+      x86_64-darwin = "sha256-gKpy6+wkcO+znxLdkGMOetpVyhs3SViQyRtCc6yc5XY=";
+      aarch64-linux = "sha256-KQR6zD+3m+OgeICSs3LkWo7kC2OxqF6Xax8BRTa6QYQ=";
+      aarch64-darwin = "sha256-VZufcJ/g1LPtlQruUwI8Pe5c8LNiAIUHY5+gNnyaPTQ=";
+      armv7l-linux = "sha256-0TxKXKQppxcURimXgC40wmqMgiX3DBMJAMc+qjMQCck=";
     }
     .${system} or throwSystem;
 
   # Please backport all compatible updates to the stable release.
   # This is important for the extension ecosystem.
-  version = "1.115.0";
+  version = "1.116.0";
 
   # The update server (update.code.visualstudio.com) expects the version path
   # segment in X.Y.Z form, so we normalize X.Y to X.Y.0 (e.g. "1.110" → "1.110.0").
@@ -53,7 +53,7 @@ let
   downloadVersion = lib.versions.pad 3 version;
 
   # This is used for VS Code - Remote SSH test
-  rev = "41dd792b5e652393e7787322889ed5fdc58bd75b";
+  rev = "560a9dba96f961efea7b1612916f89e5d5d4d679";
 in
 buildVscode {
   pname = "vscode" + lib.optionalString isInsiders "-insiders";
@@ -86,7 +86,7 @@ buildVscode {
     src = fetchurl {
       name = "vscode-server-${rev}.tar.gz";
       url = "https://update.code.visualstudio.com/commit:${rev}/server-linux-x64/stable";
-      hash = "sha256-2CQBU7TfYNO4m1Mf6Q0QXFt8C2txJgcN9kd7wX355J4=";
+      hash = "sha256-HqcaLktkhw3BoEgyFwnMmP7/vuSl1OXZygrQreKeHnM=";
     };
     stdenv = stdenvNoCC;
   };
@@ -121,6 +121,7 @@ buildVscode {
       jefflabonte
       wetrustinprize
       oenu
+      yuannan
     ];
     platforms = [
       "x86_64-linux"

From f7fc4c896a1ea774cc71b86b935486bf7346c18e Mon Sep 17 00:00:00 2001
From: Tom van Dijk <18gatenmaker6@gmail.com>
Date: Wed, 15 Apr 2026 21:55:47 +0200
Subject: [PATCH 14/89] slint-viewer: 1.14.1 -> 1.16.0

---
 pkgs/by-name/sl/slint-viewer/package.nix | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/sl/slint-viewer/package.nix b/pkgs/by-name/sl/slint-viewer/package.nix
index 40fb1c66c1ff..88bab1a42643 100644
--- a/pkgs/by-name/sl/slint-viewer/package.nix
+++ b/pkgs/by-name/sl/slint-viewer/package.nix
@@ -2,29 +2,37 @@
   lib,
   rustPlatform,
   fetchCrate,
-  qt6,
+
+  fontconfig,
   libGL,
+  pkg-config,
+  qt6,
+
   nix-update-script,
   versionCheckHook,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "slint-viewer";
-  version = "1.14.1";
+  version = "1.16.0";
 
   src = fetchCrate {
     inherit (finalAttrs) pname version;
-    hash = "sha256-7NxpnkMAQTBDfcDhdnneFNjB0oE82dDdpfq4vmMqECg=";
+    hash = "sha256-POkfEU4m54dEgaSSEHLqKozMXqMxqkUoLCevm6SY2IU=";
   };
 
-  cargoHash = "sha256-RNK3dzXdWRpugC7FwenUF/IsKbD3GxFRLqyLzBf2Wuw=";
+  cargoHash = "sha256-zjiII898Zpzdr19UHua3yuhRRHCn5yg/PHYpYODh7Pc=";
 
   buildInputs = [
     qt6.qtbase
     qt6.qtsvg
+    fontconfig
     libGL
   ];
 
-  nativeBuildInputs = [ qt6.wrapQtAppsHook ];
+  nativeBuildInputs = [
+    pkg-config
+    qt6.wrapQtAppsHook
+  ];
 
   # There are no tests
   doCheck = false;

From 64bafe9a2330e15b7284578b40fc8f0ce1d17ef3 Mon Sep 17 00:00:00 2001
From: Boldi Koller <boldi.koller@wtss.eu>
Date: Thu, 16 Apr 2026 15:17:58 +0200
Subject: [PATCH 15/89] dbvisualizer: 25.2.6 -> 25.3.3

---
 pkgs/by-name/db/dbvisualizer/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/db/dbvisualizer/package.nix b/pkgs/by-name/db/dbvisualizer/package.nix
index ffcfa1424829..36cf72b5a7a8 100644
--- a/pkgs/by-name/db/dbvisualizer/package.nix
+++ b/pkgs/by-name/db/dbvisualizer/package.nix
@@ -13,7 +13,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   inherit pname;
-  version = "25.2.6";
+  version = "25.3.3";
 
   src =
     let
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
     in
     fetchurl {
       url = "https://www.dbvis.com/product_download/dbvis-${finalAttrs.version}/media/dbvis_linux_${underscoreVersion}.tar.gz";
-      hash = "sha256-yiL0FFkSntwLy/oOkiDQKTvTOUrtbv/9kV+1nLZtMB0=";
+      hash = "sha256-rvS2NczwmT1+/JIfpLI518I0/2AaIJEQAOwmKUK2FQs=";
     };
 
   strictDeps = true;

From d389a337cba834aa1977e6b5bca8f6cfa8f80e3f Mon Sep 17 00:00:00 2001
From: Boldi Koller <boldi.koller@wtss.eu>
Date: Thu, 16 Apr 2026 15:26:36 +0200
Subject: [PATCH 16/89] dbvisualizer: Disable nixpkgs-update

---
 pkgs/by-name/db/dbvisualizer/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/db/dbvisualizer/package.nix b/pkgs/by-name/db/dbvisualizer/package.nix
index 36cf72b5a7a8..c93af60e6840 100644
--- a/pkgs/by-name/db/dbvisualizer/package.nix
+++ b/pkgs/by-name/db/dbvisualizer/package.nix
@@ -8,6 +8,12 @@
   stdenv,
 }:
 
+# nixpkgs-update: no auto update
+# NOTE: Do not update to interim patch versions. The download URL will get shut
+# down after a while. Dbvisualizer discontinues download
+# URLs for all but the last patch version per minor version.
+# Example: v25.3.2 gets shut down after v25.3.3 gets released.
+
 let
   pname = "dbvisualizer";
 in

From ac2dd54d4f4e27b07dbe97672ff8adea83c0da96 Mon Sep 17 00:00:00 2001
From: Amadej Kastelic <amadejkastelic7@gmail.com>
Date: Fri, 6 Mar 2026 20:43:40 +0100
Subject: [PATCH 17/89] semtools: 1.2.0 -> 3.0.1

---
 pkgs/by-name/se/semtools/package.nix | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/se/semtools/package.nix b/pkgs/by-name/se/semtools/package.nix
index 01d6722dd0da..76b28a1696a0 100644
--- a/pkgs/by-name/se/semtools/package.nix
+++ b/pkgs/by-name/se/semtools/package.nix
@@ -1,32 +1,37 @@
 {
   lib,
-  stdenv,
   rustPlatform,
   fetchFromGitHub,
   nix-update-script,
   openssl,
   pkg-config,
+  protobuf,
 }:
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "semtools";
-  version = "1.2.0";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "run-llama";
     repo = "semtools";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-wpOKEESM3uG9m/EqWnF2uXITbrwIhwe2MSA0FN7Fu+w=";
+    hash = "sha256-8vQJd1/EnskcMNN2cfXOQxHeLPh61dypL51KwCLps8Q=";
   };
 
-  cargoHash = "sha256-irLhwlNnB3G63WUGV2wo+LQGQgNHYzu/vb/RM/G6Fdc=";
+  cargoHash = "sha256-spllUpCze3ajNZtWVRr9GZLDj7HMi6UIraeEp9XgfK0=";
+
+  nativeBuildInputs = [
+    pkg-config
+    protobuf
+  ];
 
-  nativeBuildInputs = [ pkg-config ];
   buildInputs = [ openssl ];
 
-  checkFlags = lib.optionals (stdenv.hostPlatform.system == "x86_64-darwin") [
-    # https://github.com/run-llama/semtools/issues/17
-    "--skip=tests::test_search_result_context_calculation"
+  checkFlags = [
+    # Require network
+    "--skip=search::tests"
+    "--skip=workspace::tests::test_workspace_save_and_open"
   ];
 
   passthru.updateScript = nix-update-script { };

From b37c629e35a7db874d12778e4b367d179dd5b689 Mon Sep 17 00:00:00 2001
From: Thomas Butter <tbutter@gmail.com>
Date: Thu, 16 Apr 2026 18:33:44 +0000
Subject: [PATCH 18/89] avfs: 1.2.0 -> 1.3.0

---
 pkgs/by-name/av/avfs/package.nix | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/av/avfs/package.nix b/pkgs/by-name/av/avfs/package.nix
index 26aa23980605..0a01dd6b4f6d 100644
--- a/pkgs/by-name/av/avfs/package.nix
+++ b/pkgs/by-name/av/avfs/package.nix
@@ -5,14 +5,15 @@
   pkg-config,
   fuse,
   xz,
+  zlib,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "avfs";
-  version = "1.2.0";
+  version = "1.3.0";
   src = fetchurl {
     url = "mirror://sourceforge/avf/${finalAttrs.version}/avfs-${finalAttrs.version}.tar.bz2";
-    sha256 = "sha256-olqOxDwe4XJiThpMec5mobkwhBzbVFtyXx7GS8q+iJw=";
+    sha256 = "sha256-B81p1MDH7QgOgP8EDZgChkBa04pEP9xS3Dle/vEcRLE=";
   };
 
   nativeBuildInputs = [ pkg-config ];
@@ -20,19 +21,20 @@ stdenv.mkDerivation (finalAttrs: {
   buildInputs = [
     fuse
     xz
+    zlib
   ];
 
   configureFlags = [
     "--enable-library"
     "--enable-fuse"
-  ];
+  ]
+  ++ lib.optional stdenv.hostPlatform.isDarwin "--with-system-zlib";
 
   meta = {
     homepage = "https://avf.sourceforge.net/";
     description = "Virtual filesystem that allows browsing of compressed files";
     platforms = lib.platforms.unix;
     license = lib.licenses.gpl2Only;
-    # The last successful Darwin Hydra build was in 2024
-    broken = stdenv.hostPlatform.isDarwin;
+    maintainers = with lib.maintainers; [ tbutter ];
   };
 })

From 6ab8a02c933f66a2ac1ab283564eaefe7bf01923 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 16 Apr 2026 20:29:04 +0000
Subject: [PATCH 19/89] goperf: 0-unstable-2026-03-11 -> 0-unstable-2026-04-09

---
 pkgs/by-name/go/goperf/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/go/goperf/package.nix b/pkgs/by-name/go/goperf/package.nix
index 84626a929f00..0953b98791b9 100644
--- a/pkgs/by-name/go/goperf/package.nix
+++ b/pkgs/by-name/go/goperf/package.nix
@@ -9,15 +9,15 @@
 
 buildGoModule (finalAttrs: {
   pname = "goperf";
-  version = "0-unstable-2026-03-11";
+  version = "0-unstable-2026-04-09";
 
   src = fetchgit {
     url = "https://go.googlesource.com/perf";
-    rev = "16a31bc5fbd0f58f2e8e2a496d8e035bdc4a2e06";
-    hash = "sha256-be0vWFJUXTPWKapd+rX3Stnzra9LUGNEw+4P+fWzjyk=";
+    rev = "8e83ce0f7b1c6c5d6eab4763f10b9322cbe4cecb";
+    hash = "sha256-JIR+ytMsZaiQ5w4vTmLG4JHg6tz3/sAs24C3m5//hy4=";
   };
 
-  vendorHash = "sha256-oBSd0D66BGfanCADtrpyIoUit8c+yHk8Nm6o2GmKoZg=";
+  vendorHash = "sha256-5WnH49NE1OUaTFuan3DZYhm0uJxIf7i5pgXK1PuqhA0=";
 
   passthru.updateScript = writeShellScript "update-goperf" ''
     export UPDATE_NIX_ATTR_PATH=goperf

From 2b7c904df686929656b556b47dc7398587fbacf2 Mon Sep 17 00:00:00 2001
From: Sean Buckley <sean.bck@gmail.com>
Date: Thu, 16 Apr 2026 19:31:24 -0400
Subject: [PATCH 20/89] brave: 1.89.132 -> 1.89.137

https://community.brave.app/t/release-channel-1-89-137/651837
---
 pkgs/by-name/br/brave/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/br/brave/package.nix b/pkgs/by-name/br/brave/package.nix
index ef7912e2e08e..79e393d7f5a4 100644
--- a/pkgs/by-name/br/brave/package.nix
+++ b/pkgs/by-name/br/brave/package.nix
@@ -3,24 +3,24 @@
 
 let
   pname = "brave";
-  version = "1.89.132";
+  version = "1.89.137";
 
   allArchives = {
     aarch64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-mYY8eyMWcwx6RuMNP5ucf6xd1NXfYO4nqXEkiTUtX0o=";
+      hash = "sha256-JeYoRM6ClQ7iqu+wvwaTUmdDuIS+2AXoTIU+VxAbgRg=";
     };
     x86_64-linux = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-/SmzRSgmXM567D1YQdD/IfDaIe3RPLtgJMYvcOCwvZo=";
+      hash = "sha256-BFbx/Ex4HdaFpfY2AKc3yAaMp6PiYwC/kmEIF0WdcwU=";
     };
     aarch64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-3f29ehqJNQjYJ+vh15ZI2UJEB1VdBfLL3VWv8CRasCw=";
+      hash = "sha256-Ffc9se0j9ULZsZQktWzrUgBiLyC5QR1jAPg6IcHoOTI=";
     };
     x86_64-darwin = {
       url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-x64.zip";
-      hash = "sha256-KIod2FbWck1OUATr/vKK+vgwIih3Lha48MAdt5qNIAk=";
+      hash = "sha256-SOOf35CONFydjSK47xgQLHxX7weQFPl2Fh33H5qeqXo=";
     };
   };
 

From d848c1fa08de263672aa89809d97dcc26db5ca91 Mon Sep 17 00:00:00 2001
From: ElnuDev <elnu@elnu.com>
Date: Thu, 16 Apr 2026 19:04:29 -0700
Subject: [PATCH 21/89] kanboard: don't hard-code nginx user in service

---
 nixos/modules/services/web-apps/kanboard.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/web-apps/kanboard.nix b/nixos/modules/services/web-apps/kanboard.nix
index 4f541a712853..8318282ecdd2 100644
--- a/nixos/modules/services/web-apps/kanboard.nix
+++ b/nixos/modules/services/web-apps/kanboard.nix
@@ -123,7 +123,7 @@ in
           "pm" = "dynamic";
           "php_admin_value[error_log]" = "stderr";
           "php_admin_flag[log_errors]" = true;
-          "listen.owner" = "nginx";
+          "listen.owner" = config.services.nginx.user;
           "catch_workers_output" = true;
           "pm.max_children" = "32";
           "pm.start_servers" = "2";

From 0f8dab97c999bbc2b56abf3463a3cfb63397c3f3 Mon Sep 17 00:00:00 2001
From: ElnuDev <elnu@elnu.com>
Date: Thu, 16 Apr 2026 20:44:39 -0700
Subject: [PATCH 22/89] roundcube: don't hard-code nginx user in service

---
 nixos/modules/services/mail/roundcube.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/mail/roundcube.nix b/nixos/modules/services/mail/roundcube.nix
index 9a6ca6fa9635..c58832daac19 100644
--- a/nixos/modules/services/mail/roundcube.nix
+++ b/nixos/modules/services/mail/roundcube.nix
@@ -256,8 +256,8 @@ in
         upload_max_filesize = ${cfg.maxAttachmentSize}
       '';
       settings = lib.mapAttrs (name: lib.mkDefault) {
-        "listen.owner" = "nginx";
-        "listen.group" = "nginx";
+        "listen.owner" = config.services.nginx.user;
+        "listen.group" = config.services.nginx.group;
         "listen.mode" = "0660";
         "pm" = "dynamic";
         "pm.max_children" = 75;

From c8d883c148a161014b4ccbd891054114c5a2605a Mon Sep 17 00:00:00 2001
From: ElnuDev <elnu@elnu.com>
Date: Thu, 16 Apr 2026 20:45:22 -0700
Subject: [PATCH 23/89] baikal: don't hard-code nginx user in service

---
 nixos/modules/services/web-apps/baikal.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/web-apps/baikal.nix b/nixos/modules/services/web-apps/baikal.nix
index 1c3f89c510d2..568f250df0df 100644
--- a/nixos/modules/services/web-apps/baikal.nix
+++ b/nixos/modules/services/web-apps/baikal.nix
@@ -57,8 +57,8 @@ in
           "BAIKAL_PATH_SPECIFIC" = "/var/lib/baikal/specific/";
         };
         settings = lib.mapAttrs (name: lib.mkDefault) {
-          "listen.owner" = "nginx";
-          "listen.group" = "nginx";
+          "listen.owner" = config.services.nginx.user;
+          "listen.group" = config.services.nginx.group;
           "listen.mode" = "0600";
           "pm" = "dynamic";
           "pm.max_children" = 75;

From e1ab6b934d6fc441e946e6824adb24d16ae0069f Mon Sep 17 00:00:00 2001
From: ElnuDev <elnu@elnu.com>
Date: Thu, 16 Apr 2026 22:08:34 -0700
Subject: [PATCH 24/89] grocy: don't hard-code nginx user in service

---
 nixos/modules/services/web-apps/grocy.nix | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/nixos/modules/services/web-apps/grocy.nix b/nixos/modules/services/web-apps/grocy.nix
index 8106cc06fd2b..a6860a0902b3 100644
--- a/nixos/modules/services/web-apps/grocy.nix
+++ b/nixos/modules/services/web-apps/grocy.nix
@@ -44,7 +44,7 @@ in
         "pm" = "dynamic";
         "php_admin_value[error_log]" = "stderr";
         "php_admin_flag[log_errors]" = true;
-        "listen.owner" = "nginx";
+        "listen.owner" = config.services.nginx.user;
         "catch_workers_output" = true;
         "pm.max_children" = "32";
         "pm.start_servers" = "2";
@@ -52,6 +52,20 @@ in
         "pm.max_spare_servers" = "4";
         "pm.max_requests" = "500";
       };
+      defaultText = lib.literalExpression ''
+        {
+          "pm" = "dynamic";
+          "php_admin_value[error_log]" = "stderr";
+          "php_admin_flag[log_errors]" = true;
+          "listen.owner" = config.services.nginx.user;
+          "catch_workers_output" = true;
+          "pm.max_children" = "32";
+          "pm.start_servers" = "2";
+          "pm.min_spare_servers" = "2";
+          "pm.max_spare_servers" = "4";
+          "pm.max_requests" = "500";
+        }
+      '';
 
       description = ''
         Options for grocy's PHPFPM pool.

From 7028da51c2c10f24cb60dc0c7fa852736be44971 Mon Sep 17 00:00:00 2001
From: ElnuDev <elnu@elnu.com>
Date: Thu, 16 Apr 2026 22:08:45 -0700
Subject: [PATCH 25/89] icingaweb2: don't hard-code nginx user in service

---
 nixos/modules/services/web-apps/icingaweb2/icingaweb2.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/web-apps/icingaweb2/icingaweb2.nix b/nixos/modules/services/web-apps/icingaweb2/icingaweb2.nix
index 597d4951a0db..b7d9dd3dbfe1 100644
--- a/nixos/modules/services/web-apps/icingaweb2/icingaweb2.nix
+++ b/nixos/modules/services/web-apps/icingaweb2/icingaweb2.nix
@@ -200,8 +200,8 @@ in
           date.timezone = "${cfg.timezone}"
         '';
         settings = mapAttrs (name: mkDefault) {
-          "listen.owner" = "nginx";
-          "listen.group" = "nginx";
+          "listen.owner" = config.services.nginx.user;
+          "listen.group" = config.services.nginx.group;
           "listen.mode" = "0600";
           "pm" = "dynamic";
           "pm.max_children" = 75;

From febd95b49f23bfd15ee976ca6f23c560cd35728e Mon Sep 17 00:00:00 2001
From: ElnuDev <elnu@elnu.com>
Date: Thu, 16 Apr 2026 22:09:12 -0700
Subject: [PATCH 26/89] selfoss: don't hard-code nginx user in service

---
 nixos/modules/services/web-apps/selfoss.nix | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/nixos/modules/services/web-apps/selfoss.nix b/nixos/modules/services/web-apps/selfoss.nix
index f4aa61a4c910..6c1d4a0f46e5 100644
--- a/nixos/modules/services/web-apps/selfoss.nix
+++ b/nixos/modules/services/web-apps/selfoss.nix
@@ -37,7 +37,8 @@ in
 
       user = mkOption {
         type = types.str;
-        default = "nginx";
+        default = config.services.nginx.user;
+        defaultText = lib.literalExpression "config.services.nginx.user";
         description = ''
           User account under which both the service and the web-application run.
         '';
@@ -122,10 +123,10 @@ in
   config = mkIf cfg.enable {
     services.phpfpm.pools = mkIf (cfg.pool == "${poolName}") {
       ${poolName} = {
-        user = "nginx";
+        user = config.services.nginx.user;
         settings = mapAttrs (name: mkDefault) {
-          "listen.owner" = "nginx";
-          "listen.group" = "nginx";
+          "listen.owner" = config.services.nginx.user;
+          "listen.group" = config.services.nginx.group;
           "listen.mode" = "0600";
           "pm" = "dynamic";
           "pm.max_children" = 75;

From 6b6166c53168dcabf80c9ede0c0d0c32893068a1 Mon Sep 17 00:00:00 2001
From: ElnuDev <elnu@elnu.com>
Date: Thu, 16 Apr 2026 22:09:25 -0700
Subject: [PATCH 27/89] tt-rss: don't hard-code nginx user in service

---
 nixos/modules/services/web-apps/tt-rss.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/nixos/modules/services/web-apps/tt-rss.nix b/nixos/modules/services/web-apps/tt-rss.nix
index 607b99537f30..eb33661a8637 100644
--- a/nixos/modules/services/web-apps/tt-rss.nix
+++ b/nixos/modules/services/web-apps/tt-rss.nix
@@ -594,8 +594,8 @@ in
         inherit (cfg) user;
         inherit phpPackage;
         settings = mapAttrs (name: mkDefault) {
-          "listen.owner" = "nginx";
-          "listen.group" = "nginx";
+          "listen.owner" = config.services.nginx.user;
+          "listen.group" = config.services.nginx.group;
           "listen.mode" = "0600";
           "pm" = "dynamic";
           "pm.max_children" = 75;

From 2cc910e4005c537d1b056435fbbe0222ba05c4bb Mon Sep 17 00:00:00 2001
From: Steve Purcell <steve@sanityinc.com>
Date: Fri, 13 Mar 2026 08:16:12 +0000
Subject: [PATCH 28/89] lstk: init at 0.5.7

---
 pkgs/by-name/ls/lstk/package.nix | 42 ++++++++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)
 create mode 100644 pkgs/by-name/ls/lstk/package.nix

diff --git a/pkgs/by-name/ls/lstk/package.nix b/pkgs/by-name/ls/lstk/package.nix
new file mode 100644
index 000000000000..9b5a4c84e820
--- /dev/null
+++ b/pkgs/by-name/ls/lstk/package.nix
@@ -0,0 +1,42 @@
+{
+  fetchFromGitHub,
+  buildGoModule,
+  lib,
+  nix-update-script,
+}:
+buildGoModule (finalAttrs: {
+  pname = "lstk";
+  version = "0.5.7";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "localstack";
+    repo = "lstk";
+    tag = "v${finalAttrs.version}";
+    sha256 = "sha256-HWkCDnbg/D2zX3rdvmFTdKrx03SO6FaiA/Pzj0f4hlA=";
+  };
+
+  vendorHash = "sha256-rEcVtSFnBQ+3bbU5pjbCXEJZo89+lL/1HJG9bCn8OSE=";
+
+  excludedPackages = "test/integration";
+
+  __darwinAllowLocalNetworking = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Command line interface for LocalStack";
+    mainProgram = "lstk";
+    homepage = "https://github.com/localstack/lstk";
+    changelog = "https://github.com/localstack/lstk/releases/tag/v${finalAttrs.version}";
+    longDescription = ''
+      lstk is a command-line interface for LocalStack built in Go with a modern
+      terminal Ul, and native CLI experience for managing and interacting with
+      LocalStack deployments.
+    '';
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ purcell ];
+    platforms = lib.platforms.unix;
+  };
+})

From 5c9b20e2292240da8093f7efdf839432facd854a Mon Sep 17 00:00:00 2001
From: polykernel <81340136+polykernel@users.noreply.github.com>
Date: Fri, 17 Apr 2026 11:23:58 -0400
Subject: [PATCH 29/89] privoxy: 4.0.0 -> 4.1.0

Release notes: https://www.privoxy.org/sf-download-mirror/Sources/4.1.0%20%28stable%29/announce.txt
---
 pkgs/tools/networking/privoxy/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/tools/networking/privoxy/default.nix b/pkgs/tools/networking/privoxy/default.nix
index 646eef378047..a0e3a713c9ac 100644
--- a/pkgs/tools/networking/privoxy/default.nix
+++ b/pkgs/tools/networking/privoxy/default.nix
@@ -6,7 +6,7 @@
   fetchurl,
   autoreconfHook,
   zlib,
-  pcre,
+  pcre2,
   w3m,
   man,
   openssl,
@@ -16,11 +16,11 @@
 stdenv.mkDerivation rec {
 
   pname = "privoxy";
-  version = "4.0.0";
+  version = "4.1.0";
 
   src = fetchurl {
     url = "mirror://sourceforge/ijbswa/Sources/${version}%20%28stable%29/${pname}-${version}-stable-src.tar.gz";
-    sha256 = "sha256-wI4roASTBwF7+dimPdKg37lqoM3rNK4Ad3bmPrpiom8=";
+    sha256 = "sha256-I+RoblhIx0y2gMCcKBHwNXc57P5kH5xAcu5COZCSyXs=";
   };
 
   nativeBuildInputs = [
@@ -30,7 +30,7 @@ stdenv.mkDerivation rec {
   ];
   buildInputs = [
     zlib
-    pcre
+    pcre2
     openssl
     brotli
   ];

From d9cc39ff09ce4770f9731ee3aabbf6b022a9a76b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 17 Apr 2026 18:27:44 +0000
Subject: [PATCH 30/89] python3Packages.lupa: 2.7 -> 2.8

---
 pkgs/development/python-modules/lupa/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/lupa/default.nix b/pkgs/development/python-modules/lupa/default.nix
index 0a0b6c217452..172b5e128c0f 100644
--- a/pkgs/development/python-modules/lupa/default.nix
+++ b/pkgs/development/python-modules/lupa/default.nix
@@ -8,12 +8,12 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "lupa";
-  version = "2.7";
+  version = "2.8";
   pyproject = true;
 
   src = fetchPypi {
     inherit (finalAttrs) pname version;
-    hash = "sha256-c6ZM5dyM2Vt1ozDBUT5G4JjUD87tP+pRbAn2WV6t6Ik=";
+    hash = "sha256-2AImQbnsjs8sXsvp9H5acOC4fEta6SG5LLAqY44KzQg=";
   };
 
   build-system = [

From f2c79d678ae6f050c822ea8a98dbdc48d98dd416 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 17 Apr 2026 22:51:40 +0000
Subject: [PATCH 31/89] python3Packages.nox: 2026.02.09 -> 2026.04.10

---
 pkgs/development/python-modules/nox/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/nox/default.nix b/pkgs/development/python-modules/nox/default.nix
index 706868312c06..acdd8ef3d6bc 100644
--- a/pkgs/development/python-modules/nox/default.nix
+++ b/pkgs/development/python-modules/nox/default.nix
@@ -29,7 +29,7 @@
 
 buildPythonPackage rec {
   pname = "nox";
-  version = "2026.02.09";
+  version = "2026.04.10";
   pyproject = true;
 
   disabled = pythonOlder "3.12";
@@ -38,7 +38,7 @@ buildPythonPackage rec {
     owner = "wntrblm";
     repo = "nox";
     tag = version;
-    hash = "sha256-RaB0q9gCoYqKAI8IzNh5qUd0SrzsPeOa3C6IGxpcbwE=";
+    hash = "sha256-ArSA9I86hTKM+fkTdzOeheYVxpdjweMs2I0mUwR14sQ=";
   };
 
   build-system = [ hatchling ];

From 065c5280d70a737fbb9c25ada606431229555fc6 Mon Sep 17 00:00:00 2001
From: Nikita Pedorich <pedorich.n@gmail.com>
Date: Thu, 9 Apr 2026 20:23:41 +0900
Subject: [PATCH 32/89] dashy-ui: 3.1.1-unstable-2025-09-12 -> 3.3.0

---
 pkgs/by-name/da/dashy-ui/package.nix | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/da/dashy-ui/package.nix b/pkgs/by-name/da/dashy-ui/package.nix
index 7ff42949d6d0..be6ac75dc161 100644
--- a/pkgs/by-name/da/dashy-ui/package.nix
+++ b/pkgs/by-name/da/dashy-ui/package.nix
@@ -12,24 +12,26 @@
   nodejs_20,
   nodejs-slim_20,
   remarshal_0_17,
+  nix-update-script,
   settings ? { },
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "dashy-ui";
-  version = "3.1.1-unstable-2025-09-12";
+  version = "3.3.0";
   src = fetchFromGitHub {
     owner = "lissy93";
     repo = "dashy";
-    rev = "e70ade555fdccf4e723a90f8a2d46fcf83645c4f";
-    hash = "sha256-edsGHc6Hi306aq+TA2g5FL/ZYNfExbcgHS5PWF9O0+0=";
+    tag = finalAttrs.version;
+    hash = "sha256-Xc6zwnR0J+0DuTKNW3eHyJRvUgJgEeL3jA26wzNTMN0=";
   };
   yarnOfflineCache = fetchYarnDeps {
     yarnLock = finalAttrs.src + "/yarn.lock";
-    hash = "sha256-r36w3Cz/V7E/xPYYpvfQsdk2QXfCVDYE9OxiFNyKP2s=";
+    hash = "sha256-EMns5J8rM4qOfrACoX6lttOXh/RUtZjaKtd+BpsS6Xs=";
   };
 
-  passthru.tests = {
-    dashy = nixosTests.dashy;
+  passthru = {
+    tests.dashy = nixosTests.dashy;
+    updateScript = nix-update-script { };
   };
 
   # - If no settings are passed, use the default config provided by upstream

From fb9121285dca92ad6cabbe80dd7a59b0b4fa34fe Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Fri, 17 Apr 2026 23:48:37 -0400
Subject: [PATCH 33/89] docuseal: 2.3.4 -> 2.4.4

---
 pkgs/by-name/do/docuseal/Gemfile              |   5 +-
 pkgs/by-name/do/docuseal/Gemfile.lock         | 312 +++++++--------
 pkgs/by-name/do/docuseal/gemset.nix           | 376 ++++++++----------
 pkgs/by-name/do/docuseal/package.nix          |  12 +-
 .../ruby-modules/gem-config/default.nix       |   5 +-
 5 files changed, 308 insertions(+), 402 deletions(-)

diff --git a/pkgs/by-name/do/docuseal/Gemfile b/pkgs/by-name/do/docuseal/Gemfile
index 1a44d72dd7dd..f1c15e33d37d 100644
--- a/pkgs/by-name/do/docuseal/Gemfile
+++ b/pkgs/by-name/do/docuseal/Gemfile
@@ -3,6 +3,7 @@
 source 'https://rubygems.org'
 
 
+gem 'addressable'
 gem 'arabic-letter-connector', require: false
 gem 'aws-sdk-s3', require: false
 gem 'aws-sdk-secretsmanager', require: false
@@ -27,12 +28,10 @@ gem 'oj'
 gem 'onnxruntime', require: false
 gem 'pagy'
 gem 'pg', require: false
-gem 'premailer-rails'
 gem 'pretender'
 gem 'puma', require: false
 gem 'rack'
 gem 'rails'
-gem 'rails_autolink'
 gem 'rails-i18n'
 gem 'rotp'
 gem 'rouge', require: false
@@ -43,7 +42,7 @@ gem 'shakapacker'
 gem 'sidekiq'
 gem 'sqlite3', require: false
 gem 'strip_attributes'
-gem 'trilogy', github: 'trilogy-libraries/trilogy', glob: 'contrib/ruby/*.gemspec', require: false
+gem 'trilogy', require: false
 gem 'turbo-rails'
 gem 'twitter_cldr', require: false
 gem 'tzinfo-data'
diff --git a/pkgs/by-name/do/docuseal/Gemfile.lock b/pkgs/by-name/do/docuseal/Gemfile.lock
index ac3adcc8fda0..a52dd3b0b983 100644
--- a/pkgs/by-name/do/docuseal/Gemfile.lock
+++ b/pkgs/by-name/do/docuseal/Gemfile.lock
@@ -1,39 +1,31 @@
-GIT
-  remote: https://github.com/trilogy-libraries/trilogy.git
-  revision: 3963d490459df7a2b5bedb42424c3285f25eab22
-  glob: contrib/ruby/*.gemspec
-  specs:
-    trilogy (2.10.0)
-      bigdecimal
-
 GEM
   remote: https://rubygems.org/
   specs:
-    action_text-trix (2.1.16)
+    action_text-trix (2.1.18)
       railties
-    actioncable (8.1.2)
-      actionpack (= 8.1.2)
-      activesupport (= 8.1.2)
+    actioncable (8.1.3)
+      actionpack (= 8.1.3)
+      activesupport (= 8.1.3)
       nio4r (~> 2.0)
       websocket-driver (>= 0.6.1)
       zeitwerk (~> 2.6)
-    actionmailbox (8.1.2)
-      actionpack (= 8.1.2)
-      activejob (= 8.1.2)
-      activerecord (= 8.1.2)
-      activestorage (= 8.1.2)
-      activesupport (= 8.1.2)
+    actionmailbox (8.1.3)
+      actionpack (= 8.1.3)
+      activejob (= 8.1.3)
+      activerecord (= 8.1.3)
+      activestorage (= 8.1.3)
+      activesupport (= 8.1.3)
       mail (>= 2.8.0)
-    actionmailer (8.1.2)
-      actionpack (= 8.1.2)
-      actionview (= 8.1.2)
-      activejob (= 8.1.2)
-      activesupport (= 8.1.2)
+    actionmailer (8.1.3)
+      actionpack (= 8.1.3)
+      actionview (= 8.1.3)
+      activejob (= 8.1.3)
+      activesupport (= 8.1.3)
       mail (>= 2.8.0)
       rails-dom-testing (~> 2.2)
-    actionpack (8.1.2)
-      actionview (= 8.1.2)
-      activesupport (= 8.1.2)
+    actionpack (8.1.3)
+      actionview (= 8.1.3)
+      activesupport (= 8.1.3)
       nokogiri (>= 1.8.5)
       rack (>= 2.2.4)
       rack-session (>= 1.0.1)
@@ -41,36 +33,36 @@ GEM
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
       useragent (~> 0.16)
-    actiontext (8.1.2)
+    actiontext (8.1.3)
       action_text-trix (~> 2.1.15)
-      actionpack (= 8.1.2)
-      activerecord (= 8.1.2)
-      activestorage (= 8.1.2)
-      activesupport (= 8.1.2)
+      actionpack (= 8.1.3)
+      activerecord (= 8.1.3)
+      activestorage (= 8.1.3)
+      activesupport (= 8.1.3)
       globalid (>= 0.6.0)
       nokogiri (>= 1.8.5)
-    actionview (8.1.2)
-      activesupport (= 8.1.2)
+    actionview (8.1.3)
+      activesupport (= 8.1.3)
       builder (~> 3.1)
       erubi (~> 1.11)
       rails-dom-testing (~> 2.2)
       rails-html-sanitizer (~> 1.6)
-    activejob (8.1.2)
-      activesupport (= 8.1.2)
+    activejob (8.1.3)
+      activesupport (= 8.1.3)
       globalid (>= 0.3.6)
-    activemodel (8.1.2)
-      activesupport (= 8.1.2)
-    activerecord (8.1.2)
-      activemodel (= 8.1.2)
-      activesupport (= 8.1.2)
+    activemodel (8.1.3)
+      activesupport (= 8.1.3)
+    activerecord (8.1.3)
+      activemodel (= 8.1.3)
+      activesupport (= 8.1.3)
       timeout (>= 0.4.0)
-    activestorage (8.1.2)
-      actionpack (= 8.1.2)
-      activejob (= 8.1.2)
-      activerecord (= 8.1.2)
-      activesupport (= 8.1.2)
+    activestorage (8.1.3)
+      actionpack (= 8.1.3)
+      activejob (= 8.1.3)
+      activerecord (= 8.1.3)
+      activesupport (= 8.1.3)
       marcel (~> 1.0)
-    activesupport (8.1.2)
+    activesupport (8.1.3)
       base64
       bigdecimal
       concurrent-ruby (~> 1.0, >= 1.3.1)
@@ -83,16 +75,16 @@ GEM
       securerandom (>= 0.3)
       tzinfo (~> 2.0, >= 2.0.5)
       uri (>= 0.13.1)
-    addressable (2.8.8)
+    addressable (2.9.0)
       public_suffix (>= 2.0.2, < 8.0)
-    annotaterb (4.20.0)
+    annotaterb (4.22.0)
       activerecord (>= 6.0.0)
       activesupport (>= 6.0.0)
     arabic-letter-connector (0.1.1)
     ast (2.4.3)
     aws-eventstream (1.4.0)
-    aws-partitions (1.1209.0)
-    aws-sdk-core (3.241.4)
+    aws-partitions (1.1233.0)
+    aws-sdk-core (3.244.0)
       aws-eventstream (~> 1, >= 1.3.0)
       aws-partitions (~> 1, >= 1.992.0)
       aws-sigv4 (~> 1.9)
@@ -100,15 +92,15 @@ GEM
       bigdecimal
       jmespath (~> 1, >= 1.6.1)
       logger
-    aws-sdk-kms (1.121.0)
-      aws-sdk-core (~> 3, >= 3.241.4)
+    aws-sdk-kms (1.123.0)
+      aws-sdk-core (~> 3, >= 3.244.0)
       aws-sigv4 (~> 1.5)
-    aws-sdk-s3 (1.212.0)
-      aws-sdk-core (~> 3, >= 3.241.4)
+    aws-sdk-s3 (1.218.0)
+      aws-sdk-core (~> 3, >= 3.244.0)
       aws-sdk-kms (~> 1)
       aws-sigv4 (~> 1.5)
-    aws-sdk-secretsmanager (1.128.0)
-      aws-sdk-core (~> 3, >= 3.241.4)
+    aws-sdk-secretsmanager (1.129.0)
+      aws-sdk-core (~> 3, >= 3.244.0)
       aws-sigv4 (~> 1.5)
     aws-sigv4 (1.12.1)
       aws-eventstream (~> 1, >= 1.0.2)
@@ -116,7 +108,7 @@ GEM
       cgi
       rexml
     base64 (0.3.0)
-    bcrypt (3.1.21)
+    bcrypt (3.1.22)
     better_html (2.2.0)
       actionview (>= 7.0)
       activesupport (>= 7.0)
@@ -124,11 +116,11 @@ GEM
       erubi (~> 1.4)
       parser (>= 2.4)
       smart_properties
-    bigdecimal (4.0.1)
+    bigdecimal (4.1.0)
     bindex (0.8.1)
-    bootsnap (1.21.1)
+    bootsnap (1.23.0)
       msgpack (~> 1.2)
-    brakeman (7.1.2)
+    brakeman (8.0.4)
       racc
     builder (3.3.0)
     bullet (8.1.0)
@@ -158,8 +150,6 @@ GEM
       bigdecimal
       rexml
     crass (1.0.6)
-    css_parser (1.21.1)
-      addressable
     csv (3.3.5)
     csv-safe (3.3.1)
       csv (~> 3.0)
@@ -171,16 +161,16 @@ GEM
       irb (~> 1.10)
       reline (>= 0.3.8)
     declarative (0.0.20)
-    devise (4.9.4)
+    devise (5.0.3)
       bcrypt (~> 3.0)
       orm_adapter (~> 0.1)
-      railties (>= 4.1.0)
+      railties (>= 7.0)
       responders
       warden (~> 1.2.3)
-    devise-two-factor (6.3.1)
-      activesupport (>= 7.0, < 8.2)
-      devise (>= 4.0, < 5.0)
-      railties (>= 7.0, < 8.2)
+    devise-two-factor (6.4.0)
+      activesupport (>= 7.2, < 8.2)
+      devise (>= 4.0, < 6.0)
+      railties (>= 7.2, < 8.2)
       rotp (~> 6.0)
     diff-lcs (1.6.2)
     digest-crc (0.7.0)
@@ -189,7 +179,7 @@ GEM
     dotenv (3.2.0)
     drb (2.2.3)
     email_typo (0.2.3)
-    erb (6.0.1)
+    erb (6.0.2)
     erb_lint (0.9.0)
       activesupport
       better_html (>= 2.0.1)
@@ -203,7 +193,7 @@ GEM
     factory_bot_rails (6.5.1)
       factory_bot (~> 6.5)
       railties (>= 6.1.0)
-    faker (3.6.0)
+    faker (3.6.1)
       i18n (>= 1.8.11, < 2)
     faraday (2.14.1)
       faraday-net_http (>= 2.0, < 3.5)
@@ -213,16 +203,16 @@ GEM
       faraday (>= 1, < 3)
     faraday-net_http (3.4.2)
       net-http (~> 0.5)
-    ferrum (0.17.1)
+    ferrum (0.17.2)
       addressable (~> 2.5)
       base64 (~> 0.2)
       concurrent-ruby (~> 1.1)
       webrick (~> 1.7)
       websocket-driver (~> 0.7)
-    ffi (1.17.3)
-    ffi (1.17.3-aarch64-linux-musl)
-    ffi (1.17.3-arm64-darwin)
-    ffi (1.17.3-x86_64-linux-musl)
+    ffi (1.17.4)
+    ffi (1.17.4-aarch64-linux-musl)
+    ffi (1.17.4-arm64-darwin)
+    ffi (1.17.4-x86_64-linux-musl)
     foreman (0.90.0)
       thor (~> 1.4)
     geom2d (0.4.1)
@@ -238,7 +228,7 @@ GEM
       retriable (~> 3.1)
     google-apis-iamcredentials_v1 (0.26.0)
       google-apis-core (>= 0.15.0, < 2.a)
-    google-apis-storage_v1 (0.59.0)
+    google-apis-storage_v1 (0.61.0)
       google-apis-core (>= 0.15.0, < 2.a)
     google-cloud-core (1.8.0)
       google-cloud-env (>= 1.0, < 3.a)
@@ -246,8 +236,8 @@ GEM
     google-cloud-env (2.3.1)
       base64 (~> 0.2)
       faraday (>= 1.0, < 3.a)
-    google-cloud-errors (1.5.0)
-    google-cloud-storage (1.58.0)
+    google-cloud-errors (1.6.0)
+    google-cloud-storage (1.59.0)
       addressable (~> 2.8)
       digest-crc (~> 0.4)
       google-apis-core (>= 0.18, < 2)
@@ -257,7 +247,7 @@ GEM
       googleauth (~> 1.9)
       mini_mime (~> 1.0)
     google-logging-utils (0.2.0)
-    googleauth (1.16.1)
+    googleauth (1.16.2)
       faraday (>= 1.0, < 3.a)
       google-cloud-env (~> 2.2)
       google-logging-utils (~> 0.1)
@@ -266,24 +256,24 @@ GEM
       os (>= 0.9, < 2.0)
       signet (>= 0.16, < 2.a)
     hashdiff (1.2.1)
-    hexapdf (1.5.0)
+    hexapdf (1.6.0)
       cmdparse (~> 3.0, >= 3.0.3)
       geom2d (~> 0.4, >= 0.4.1)
       openssl (>= 2.2.1)
       strscan (>= 3.1.2)
-    htmlentities (4.4.2)
     i18n (1.14.8)
       concurrent-ruby (~> 1.0)
     image_processing (1.14.0)
       mini_magick (>= 4.9.5, < 6)
       ruby-vips (>= 2.0.17, < 3)
     io-console (0.8.2)
-    irb (1.16.0)
+    irb (1.17.0)
       pp (>= 0.6.0)
+      prism (>= 1.3.0)
       rdoc (>= 4.0.0)
       reline (>= 0.4.2)
     jmespath (1.6.2)
-    json (2.18.1)
+    json (2.19.3)
     jwt (3.1.2)
       base64
     language_server-protocol (3.17.0.5)
@@ -305,7 +295,7 @@ GEM
       activesupport (>= 4)
       railties (>= 4)
       request_store (~> 1.0)
-    loofah (2.25.0)
+    loofah (2.25.1)
       crass (~> 1.0.2)
       nokogiri (>= 1.12.0)
     mail (2.9.0)
@@ -321,13 +311,14 @@ GEM
       logger
     mini_mime (1.1.5)
     mini_portile2 (2.8.9)
-    minitest (6.0.1)
+    minitest (6.0.3)
+      drb (~> 2.0)
       prism (~> 1.5)
     msgpack (1.8.0)
     multi_json (1.19.1)
     net-http (0.9.1)
       uri (>= 0.11.1)
-    net-imap (0.6.2)
+    net-imap (0.6.3)
       date
       net-protocol
     net-pop (0.1.2)
@@ -337,17 +328,17 @@ GEM
     net-smtp (0.5.1)
       net-protocol
     nio4r (2.7.5)
-    nokogiri (1.19.0)
+    nokogiri (1.19.2)
       mini_portile2 (~> 2.8.2)
       racc (~> 1.4)
-    nokogiri (1.19.0-aarch64-linux-musl)
+    nokogiri (1.19.2-aarch64-linux-musl)
       racc (~> 1.4)
-    nokogiri (1.19.0-arm64-darwin)
+    nokogiri (1.19.2-arm64-darwin)
       racc (~> 1.4)
-    nokogiri (1.19.0-x86_64-linux-musl)
+    nokogiri (1.19.2-x86_64-linux-musl)
       racc (~> 1.4)
-    numo-narray-alt (0.9.13)
-    oj (3.16.13)
+    numo-narray-alt (0.10.3)
+    oj (3.16.16)
       bigdecimal (>= 3.0)
       ostruct (>= 0.2)
     onnxruntime (0.10.1)
@@ -358,16 +349,17 @@ GEM
       ffi
     onnxruntime (0.10.1-x86_64-linux)
       ffi
-    openssl (4.0.0)
+    openssl (4.0.1)
     orm_adapter (0.5.0)
     os (1.1.4)
     ostruct (0.6.3)
     package_json (0.2.0)
-    pagy (43.2.8)
+    pagy (43.4.4)
       json
+      uri
       yaml
-    parallel (1.27.0)
-    parser (3.3.10.1)
+    parallel (1.28.0)
+    parser (3.3.11.1)
       ast (~> 2.4.1)
       racc
     pg (1.6.3)
@@ -376,18 +368,10 @@ GEM
     pg (1.6.3-x86_64-linux-musl)
     pp (0.6.3)
       prettyprint
-    premailer (1.27.0)
-      addressable
-      css_parser (>= 1.19.0)
-      htmlentities (>= 4.0.0)
-    premailer-rails (1.12.0)
-      actionmailer (>= 3)
-      net-smtp
-      premailer (~> 1.7, >= 1.7.9)
-    pretender (0.6.0)
-      actionpack (>= 7.1)
+    pretender (1.0.0)
+      actionpack (>= 7.2)
     prettyprint (0.2.0)
-    prism (1.8.0)
+    prism (1.9.0)
     pry (0.16.0)
       coderay (~> 1.1)
       method_source (~> 1.0)
@@ -397,51 +381,47 @@ GEM
     psych (5.3.1)
       date
       stringio
-    public_suffix (7.0.2)
+    public_suffix (7.0.5)
     puma (7.2.0)
       nio4r (~> 2.0)
     racc (1.8.1)
-    rack (3.2.4)
+    rack (3.2.6)
     rack-proxy (0.7.7)
       rack
-    rack-session (2.1.1)
+    rack-session (2.1.2)
       base64 (>= 0.1.0)
       rack (>= 3.0.0)
     rack-test (2.2.0)
       rack (>= 1.3)
     rackup (2.3.1)
       rack (>= 3)
-    rails (8.1.2)
-      actioncable (= 8.1.2)
-      actionmailbox (= 8.1.2)
-      actionmailer (= 8.1.2)
-      actionpack (= 8.1.2)
-      actiontext (= 8.1.2)
-      actionview (= 8.1.2)
-      activejob (= 8.1.2)
-      activemodel (= 8.1.2)
-      activerecord (= 8.1.2)
-      activestorage (= 8.1.2)
-      activesupport (= 8.1.2)
+    rails (8.1.3)
+      actioncable (= 8.1.3)
+      actionmailbox (= 8.1.3)
+      actionmailer (= 8.1.3)
+      actionpack (= 8.1.3)
+      actiontext (= 8.1.3)
+      actionview (= 8.1.3)
+      activejob (= 8.1.3)
+      activemodel (= 8.1.3)
+      activerecord (= 8.1.3)
+      activestorage (= 8.1.3)
+      activesupport (= 8.1.3)
       bundler (>= 1.15.0)
-      railties (= 8.1.2)
+      railties (= 8.1.3)
     rails-dom-testing (2.3.0)
       activesupport (>= 5.0.0)
       minitest
       nokogiri (>= 1.6)
-    rails-html-sanitizer (1.6.2)
-      loofah (~> 2.21)
+    rails-html-sanitizer (1.7.0)
+      loofah (~> 2.25)
       nokogiri (>= 1.15.7, != 1.16.7, != 1.16.6, != 1.16.5, != 1.16.4, != 1.16.3, != 1.16.2, != 1.16.1, != 1.16.0.rc1, != 1.16.0)
     rails-i18n (8.1.0)
       i18n (>= 0.7, < 2)
       railties (>= 8.0.0, < 9)
-    rails_autolink (1.1.8)
-      actionview (> 3.1)
-      activesupport (> 3.1)
-      railties (> 3.1)
-    railties (8.1.2)
-      actionpack (= 8.1.2)
-      activesupport (= 8.1.2)
+    railties (8.1.3)
+      actionpack (= 8.1.3)
+      activesupport (= 8.1.3)
       irb (~> 1.13)
       rackup (>= 1.0.0)
       rake (>= 12.2)
@@ -450,11 +430,11 @@ GEM
       zeitwerk (~> 2.6)
     rainbow (3.1.1)
     rake (13.3.1)
-    rdoc (7.1.0)
+    rdoc (7.2.0)
       erb
       psych (>= 4.0.0)
       tsort
-    redis-client (0.26.4)
+    redis-client (0.28.0)
       connection_pool
     regexp_parser (2.11.3)
     reline (0.6.3)
@@ -468,7 +448,7 @@ GEM
     responders (3.2.0)
       actionpack (>= 7.0)
       railties (>= 7.0)
-    retriable (3.1.2)
+    retriable (3.4.1)
     rexml (3.4.4)
     rotp (6.3.0)
     rouge (4.7.0)
@@ -481,19 +461,19 @@ GEM
     rspec-expectations (3.13.5)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
-    rspec-mocks (3.13.7)
+    rspec-mocks (3.13.8)
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.13.0)
-    rspec-rails (8.0.2)
+    rspec-rails (8.0.4)
       actionpack (>= 7.2)
       activesupport (>= 7.2)
       railties (>= 7.2)
-      rspec-core (~> 3.13)
-      rspec-expectations (~> 3.13)
-      rspec-mocks (~> 3.13)
-      rspec-support (~> 3.13)
-    rspec-support (3.13.6)
-    rubocop (1.82.1)
+      rspec-core (>= 3.13.0, < 5.0.0)
+      rspec-expectations (>= 3.13.0, < 5.0.0)
+      rspec-mocks (>= 3.13.0, < 5.0.0)
+      rspec-support (>= 3.13.0, < 5.0.0)
+    rspec-support (3.13.7)
+    rubocop (1.86.0)
       json (~> 2.3)
       language_server-protocol (~> 3.17.0.2)
       lint_roller (~> 1.1.0)
@@ -501,10 +481,10 @@ GEM
       parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 2.9.3, < 3.0)
-      rubocop-ast (>= 1.48.0, < 2.0)
+      rubocop-ast (>= 1.49.0, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 2.4.0, < 4.0)
-    rubocop-ast (1.49.0)
+    rubocop-ast (1.49.1)
       parser (>= 3.3.7.2)
       prism (~> 1.7)
     rubocop-performance (1.26.1)
@@ -529,14 +509,14 @@ GEM
       rubyzip (>= 3.2.2)
     rubyzip (3.2.2)
     securerandom (0.4.1)
-    semantic_range (3.1.0)
-    shakapacker (9.5.0)
+    semantic_range (3.1.1)
+    shakapacker (9.7.0)
       activesupport (>= 5.2)
       package_json
       rack-proxy (>= 0.6.1)
       railties (>= 5.2)
       semantic_range (>= 2.3.0)
-    sidekiq (8.1.0)
+    sidekiq (8.1.2)
       connection_pool (>= 3.0.0)
       json (>= 2.16.0)
       logger (>= 1.7.0)
@@ -554,20 +534,22 @@ GEM
     simplecov-html (0.13.2)
     simplecov_json_formatter (0.1.4)
     smart_properties (1.17.0)
-    sqlite3 (2.9.0)
+    sqlite3 (2.9.2)
       mini_portile2 (~> 2.8.0)
-    sqlite3 (2.9.0-aarch64-linux-musl)
-    sqlite3 (2.9.0-arm64-darwin)
-    sqlite3 (2.9.0-x86_64-linux-musl)
+    sqlite3 (2.9.2-aarch64-linux-musl)
+    sqlite3 (2.9.2-arm64-darwin)
+    sqlite3 (2.9.2-x86_64-linux-musl)
     stringio (3.2.0)
     strip_attributes (2.0.1)
       activemodel (>= 3.0, < 9.0)
-    strscan (3.1.7)
+    strscan (3.1.8)
     thor (1.5.0)
-    timeout (0.6.0)
+    timeout (0.6.1)
     trailblazer-option (0.1.2)
+    trilogy (2.12.2)
+      bigdecimal
     tsort (0.2.0)
-    turbo-rails (2.0.21)
+    turbo-rails (2.0.23)
       actionpack (>= 7.1.0)
       railties (>= 7.1.0)
     twitter_cldr (6.14.0)
@@ -577,7 +559,7 @@ GEM
       tzinfo
     tzinfo (2.0.6)
       concurrent-ruby (~> 1.0)
-    tzinfo-data (1.2025.3)
+    tzinfo-data (1.2026.1)
       tzinfo (>= 1.0.0)
     uber (0.1.0)
     unicode-display_width (3.2.0)
@@ -588,12 +570,11 @@ GEM
     useragent (0.16.11)
     warden (1.2.9)
       rack (>= 2.0.9)
-    web-console (4.2.1)
-      actionview (>= 6.0.0)
-      activemodel (>= 6.0.0)
+    web-console (4.3.0)
+      actionview (>= 8.0.0)
       bindex (>= 0.4.0)
-      railties (>= 6.0.0)
-    webmock (3.26.1)
+      railties (>= 8.0.0)
+    webmock (3.26.2)
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
@@ -605,7 +586,7 @@ GEM
     xpath (3.2.0)
       nokogiri (~> 1.8)
     yaml (0.4.0)
-    zeitwerk (2.7.4)
+    zeitwerk (2.7.5)
 
 PLATFORMS
   aarch64-linux-musl
@@ -614,6 +595,7 @@ PLATFORMS
   x86_64-linux-musl
 
 DEPENDENCIES
+  addressable
   annotaterb
   arabic-letter-connector
   aws-sdk-s3
@@ -650,14 +632,12 @@ DEPENDENCIES
   onnxruntime
   pagy
   pg
-  premailer-rails
   pretender
   pry-rails
   puma
   rack
   rails
   rails-i18n
-  rails_autolink
   rotp
   rouge
   rqrcode
@@ -673,7 +653,7 @@ DEPENDENCIES
   simplecov
   sqlite3
   strip_attributes
-  trilogy!
+  trilogy
   turbo-rails
   twitter_cldr
   tzinfo-data
@@ -681,4 +661,4 @@ DEPENDENCIES
   webmock
 
 BUNDLED WITH
-   2.6.9
+   2.7.2
diff --git a/pkgs/by-name/do/docuseal/gemset.nix b/pkgs/by-name/do/docuseal/gemset.nix
index 5d953be5684d..cd083904d9c0 100644
--- a/pkgs/by-name/do/docuseal/gemset.nix
+++ b/pkgs/by-name/do/docuseal/gemset.nix
@@ -5,10 +5,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "12isf17cd4xyx5vg97nzxsi92703yh40fxyns6gl9f11331a4ign";
+      sha256 = "0hinzgbjfwgdjm3dz9mz218sy764gbacv0z2ic4ms57lpzw87nrz";
       type = "gem";
     };
-    version = "2.1.16";
+    version = "2.1.18";
   };
   actioncable = {
     dependencies = [
@@ -22,10 +22,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0s8rp5zpcxqkpj610whkrnjhwk119f5xn7b9bkydx76a9k1yycfw";
+      sha256 = "1w40bbkjd0lds57bfr24hbj9qfkwj9v33x6457g24sjfwispzg75";
       type = "gem";
     };
-    version = "8.1.2";
+    version = "8.1.3";
   };
   actionmailbox = {
     dependencies = [
@@ -40,10 +40,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "16w8h4awh3k1v6b2anix20qjdij5zby7am379y4mlp8fk2qjz2q5";
+      sha256 = "0ndf98dpzmz8xs6m253zpwnhyfrvxdkfyvssxps0vrx0x9sa8zfz";
       type = "gem";
     };
-    version = "8.1.2";
+    version = "8.1.3";
   };
   actionmailer = {
     dependencies = [
@@ -61,10 +61,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1sbmj65nzqzjh9ji94p91mkpjlhf3jkcbzd7ia8gwfv51w3d5hgl";
+      sha256 = "13a4329lgrda8s9mqrfbaakvc90i6ak82rfpljmd0w5vj54747w3";
       type = "gem";
     };
-    version = "8.1.2";
+    version = "8.1.3";
   };
   actionpack = {
     dependencies = [
@@ -86,10 +86,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "08w49zj1skvviyakjy2cazfklkgx2dsnfzxb9fmaznphl53l3myf";
+      sha256 = "18r93ii2ayw8n60qsx259dy8nwgbfxf3ndncla0xbia79np8r6dg";
       type = "gem";
     };
-    version = "8.1.2";
+    version = "8.1.3";
   };
   actiontext = {
     dependencies = [
@@ -105,10 +105,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0b9dilsjx9saqqz7dwj0fqfbacdyar5f4g4wfxqdj6cw5ai7vx8b";
+      sha256 = "1ln7mwflqf7nsgkj9lm1p7bmc6h8yqaa47q1cdj9xsp102f034fj";
       type = "gem";
     };
-    version = "8.1.2";
+    version = "8.1.3";
   };
   actionview = {
     dependencies = [
@@ -126,10 +126,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0nrf7qn2p6r645427whfh071az6bv8728bf2rrr9n74ii0jmnic0";
+      sha256 = "0pgxl9p2q2zbwb6626yw7rgpbmv2bvxykq2w1h83inrygy6chiqk";
       type = "gem";
     };
-    version = "8.1.2";
+    version = "8.1.3";
   };
   activejob = {
     dependencies = [
@@ -143,10 +143,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "09gq0bivkb9qfmg69k1jqbsbs1vb2ps1jn1p6saqa0di2cvsp3ch";
+      sha256 = "1lz8bxb6pcf9yvxwyj6355aws3ylxi5rwc577ly4q858d9vb2jd1";
       type = "gem";
     };
-    version = "8.1.2";
+    version = "8.1.3";
   };
   activemodel = {
     dependencies = [ "activesupport" ];
@@ -157,10 +157,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0gpkph1mq78yg1cl0vkc8js0gh3vjxjf9drqk0zyv2p63k0mh4z2";
+      sha256 = "06c23jww82grgvxw19g4bi9c957aj5hh24wzyyw4jdpg9jz5rh4h";
       type = "gem";
     };
-    version = "8.1.2";
+    version = "8.1.3";
   };
   activerecord = {
     dependencies = [
@@ -175,10 +175,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0i6c9g3q0lx4bca5gvz0p8p6ibhwn176zzhih0hgll6cvz5f1yxc";
+      sha256 = "1avhmih54xqyj14zrv6ciw2ndpb11bmkwq0fcwm0mfk64ixvw0w0";
       type = "gem";
     };
-    version = "8.1.2";
+    version = "8.1.3";
   };
   activestorage = {
     dependencies = [
@@ -192,10 +192,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0xms9z8asdpqw5ybl6n4bk1iys4l7y0iyi2rdbifxjlr766a8qwa";
+      sha256 = "0k9q8sdlf576r8rp2hgdxy5lpr8f157bpq8mfsk52f8l169wwr05";
       type = "gem";
     };
-    version = "8.1.2";
+    version = "8.1.3";
   };
   activesupport = {
     dependencies = [
@@ -220,10 +220,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1bpxnr83z1x78h3jxvmga7vrmzmc8b4fic49h9jhzm6hriw2b148";
+      sha256 = "03m2vjhq3nmc8c3hpivxhvkjd8igg16nmv0p2fgdsgacppgy1991";
       type = "gem";
     };
-    version = "8.1.2";
+    version = "8.1.3";
   };
   addressable = {
     dependencies = [ "public_suffix" ];
@@ -235,10 +235,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0mxhjgihzsx45l9wh2n0ywl9w0c6k70igm5r0d63dxkcagwvh4vw";
+      sha256 = "1by7h2lwziiblizpd5yx87jsq8ppdhzvwf08ga34wzqgcv1nmpvz";
       type = "gem";
     };
-    version = "2.8.8";
+    version = "2.9.0";
   };
   annotaterb = {
     dependencies = [
@@ -249,10 +249,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1xwbz5zk37f7p3g6ypxzamisay06hidjmdsrvhxw4q0xin4jw6w7";
+      sha256 = "11h2lz0fyj1hh37x1lwvxr0svaisnkjs2g81hap84nwdykjl1z36";
       type = "gem";
     };
-    version = "4.20.0";
+    version = "4.22.0";
   };
   arabic-letter-connector = {
     groups = [ "default" ];
@@ -293,10 +293,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1099j8l3k40n7drhlxc4m7m32p79xy5zgy4jrcgf5ngxblq2w2n6";
+      sha256 = "1hhkcawvn8fr5ys7xy4bhk4glcqyyibwkd3y75cidc9d123393cj";
       type = "gem";
     };
-    version = "1.1209.0";
+    version = "1.1233.0";
   };
   aws-sdk-core = {
     dependencies = [
@@ -312,10 +312,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1zg44q9bykznxdp4l130qkvmhx4n3hhalh3cgc781aafqalcnb54";
+      sha256 = "1shqk9frm15g1ygiy33krwj34jrphfjc6w63bglxwnqcic3qqi9y";
       type = "gem";
     };
-    version = "3.241.4";
+    version = "3.244.0";
   };
   aws-sdk-kms = {
     dependencies = [
@@ -326,10 +326,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1q015l5gm3f230jz9l6si9s3hlw7ra76q8biqvxlwxdmnk7w2qym";
+      sha256 = "080zh4g1lcjl0bz2l0gjm8vmpd60cvi0p658bh235ypqh9zg61fl";
       type = "gem";
     };
-    version = "1.121.0";
+    version = "1.123.0";
   };
   aws-sdk-s3 = {
     dependencies = [
@@ -341,10 +341,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "06bw769knngyhgrfw8j8mbl637ms9z00a3l4g7f1hj4iwvpc93hy";
+      sha256 = "134qr73ri1j52y42xib0fpyscd5miwc37zx1ikxavwh747rsawjn";
       type = "gem";
     };
-    version = "1.212.0";
+    version = "1.218.0";
   };
   aws-sdk-secretsmanager = {
     dependencies = [
@@ -355,10 +355,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "16ib5p04fk66qr2vfps0qr340ld5xb5dsypbdii9f40n6hfxwb6n";
+      sha256 = "0m69f1jghxlixd4b5wb2dsp38dly7nxm5si1klnajv89m23mqi00";
       type = "gem";
     };
-    version = "1.128.0";
+    version = "1.129.0";
   };
   aws-sigv4 = {
     dependencies = [ "aws-eventstream" ];
@@ -404,10 +404,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1krd99p9828n07rcjjms56jaqv7v6s9pn7y6bppcfhhaflyn2r2r";
+      sha256 = "0clhya4p8lhjj7hp31inp321wgzb0b5wbwppmya5sw1dikl7400z";
       type = "gem";
     };
-    version = "3.1.21";
+    version = "3.1.22";
   };
   better_html = {
     dependencies = [
@@ -439,10 +439,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "19y406nx17arzsbc515mjmr6k5p59afprspa1k423yd9cp8d61wb";
+      sha256 = "1bkcvp4aavdxh1pmgg65sypyjx5l0w5ffylfsk65di1xm9kpgh3d";
       type = "gem";
     };
-    version = "4.0.1";
+    version = "4.1.0";
   };
   bindex = {
     groups = [
@@ -463,10 +463,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1i64vd32pacs1sspz4isgdyfg35gh4s7scrwc935i8rdfgzaqwwk";
+      sha256 = "057jsch213i42qgdsz2vg1b190n2xvvbi3hgprc8nmaqim2ly9f1";
       type = "gem";
     };
-    version = "1.21.1";
+    version = "1.23.0";
   };
   brakeman = {
     dependencies = [ "racc" ];
@@ -474,10 +474,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1kkds9q66jryhlyqzwhp4kh8hcb39i05v2r4f8xd3rx221vr413b";
+      sha256 = "0vyg9l6xivamb49r4kzkcw12r9x943kv79wsvwslhm1qjvx23ybv";
       type = "gem";
     };
-    version = "7.1.2";
+    version = "8.0.4";
   };
   builder = {
     groups = [
@@ -677,17 +677,6 @@
     };
     version = "1.0.6";
   };
-  css_parser = {
-    dependencies = [ "addressable" ];
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1izp5vna86s7xivqzml4nviy01bv76arrd5is8wkncwp1by3zzbc";
-      type = "gem";
-    };
-    version = "1.21.1";
-  };
   csv = {
     groups = [ "default" ];
     platforms = [ ];
@@ -776,10 +765,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1y57fpcvy1kjd4nb7zk7mvzq62wqcpfynrgblj558k3hbvz4404j";
+      sha256 = "0ilmy9wgy57nj3zgal4j4vqx15sc7if7yavvah8wwjnw3h2nbh64";
       type = "gem";
     };
-    version = "4.9.4";
+    version = "5.0.3";
   };
   devise-two-factor = {
     dependencies = [
@@ -792,10 +781,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0mzrx8z03vrbfl13dz3kp33as50jd8ad7b39s4k4l3j9k522c2mc";
+      sha256 = "1d5day3h573faxsy24h9pbidjm04hs4ql8qxi1wdmrwsbcxs5qq9";
       type = "gem";
     };
-    version = "6.3.1";
+    version = "6.4.0";
   };
   diff-lcs = {
     groups = [
@@ -879,10 +868,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1rcpq49pyaiclpjp3c3qjl25r95hqvin2q2dczaynaj7qncxvv18";
+      sha256 = "0ar4nmvk1sk7drjigqyh9nnps3mxg625b8chfk42557p8i6jdrlz";
       type = "gem";
     };
-    version = "6.0.1";
+    version = "6.0.2";
   };
   erb_lint = {
     dependencies = [
@@ -960,10 +949,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0jj6via2mqccr8vngy10qkm60bc6py86cnf5ykzvn2cd3kwhps2c";
+      sha256 = "1pncl49j3sn6ka53dbf1sw8n0mqlnzh2afwi7ql2dd163lyd44y5";
       type = "gem";
     };
-    version = "3.6.0";
+    version = "3.6.1";
   };
   faraday = {
     dependencies = [
@@ -1017,20 +1006,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1rybr2bd1da7n7m3c7m9jaxlalcz71s697ax7fhyb4y51w993mai";
+      sha256 = "1vp62wy85hr5fa0d29y3wh3zaj10sszj3pl19mps84dja2l4099c";
       type = "gem";
     };
-    version = "0.17.1";
+    version = "0.17.2";
   };
   ffi = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0k1xaqw2jk13q3ss7cnyvkp8fzp75dk4kazysrxgfd1rpgvkk7qf";
+      sha256 = "1kqasqvy8d7r09ri4n6bkdwbk63j7afd9ilsw34nzlgh0qp69ldw";
       type = "gem";
     };
-    version = "1.17.3";
+    version = "1.17.4";
   };
   foreman = {
     dependencies = [ "thor" ];
@@ -1103,10 +1092,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0f7mikkwfa3hzv4xpbkcr0766v2r34q6rdg5j8k3i3hw2fznw5xa";
+      sha256 = "1s42r7hmf2wl8l0wdc7z07qvmgbdilwjb58q7i9h2slfnncyac5k";
       type = "gem";
     };
-    version = "0.59.0";
+    version = "0.61.0";
   };
   google-cloud-core = {
     dependencies = [
@@ -1141,10 +1130,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0jvv9w8s4dqc4ncfa6c6qpdypz2wj8dmgpjd44jq2qhhij5y4sxm";
+      sha256 = "18fh8xvflhhksibcn1v4gnrn6d3xs284ng1fsfwh9b86sxnlga0x";
       type = "gem";
     };
-    version = "1.5.0";
+    version = "1.6.0";
   };
   google-cloud-storage = {
     dependencies = [
@@ -1161,10 +1150,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1zfzix33r060ch1ms2g7m7zzjhgrp43d67fy3sg1dbvmkixc1v8v";
+      sha256 = "1fc6n7227l3b0b14c0gbfqjibn3zw1mivfvrnb66apbp3mkabjdq";
       type = "gem";
     };
-    version = "1.58.0";
+    version = "1.59.0";
   };
   google-logging-utils = {
     groups = [ "default" ];
@@ -1190,10 +1179,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "173h8r5dzhn4dvq2idx59jaybkhd02dr7333qshc3n2mkp76nxrn";
+      sha256 = "0f56614nd955cxwy98c2d1zk4zg263r1iafd90czg2p3w819a00m";
       type = "gem";
     };
-    version = "1.16.1";
+    version = "1.16.2";
   };
   hashdiff = {
     groups = [
@@ -1219,20 +1208,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0f14iqfk5f9xiir82b50hpyc1ms1m7n5wpywbyvahnggjk41daq5";
+      sha256 = "10i5826zgvk04jsn6yg7w72s1l5xghrapm6anay4g8w8l32jzqvq";
       type = "gem";
     };
-    version = "1.5.0";
-  };
-  htmlentities = {
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1hy5jvzd4wagk0k0yq7bjm6fa7ba7vjggzjfpri95jifkzvbvbxv";
-      type = "gem";
-    };
-    version = "4.4.2";
+    version = "1.6.0";
   };
   i18n = {
     dependencies = [ "concurrent-ruby" ];
@@ -1280,6 +1259,7 @@
   irb = {
     dependencies = [
       "pp"
+      "prism"
       "rdoc"
       "reline"
     ];
@@ -1291,10 +1271,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "01h8bdksg0cr8bw5dhlhr29ix33rp822jmshy6rdqz4lmk4mdgia";
+      sha256 = "1bishrxfn2anwlagw8rzly7i2yicjnr947f48nh638yqjgdlv30n";
       type = "gem";
     };
-    version = "1.16.0";
+    version = "1.17.0";
   };
   jmespath = {
     groups = [ "default" ];
@@ -1315,10 +1295,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "11prr7nrxh1y4rfsqa51gy4ixx63r18cz9mdnmk0938va1ajf4gy";
+      sha256 = "0il6qxkxqql7n7sgrws5bi5a36v51dswqcxb6j6gm8aj62shp6r8";
       type = "gem";
     };
-    version = "2.18.1";
+    version = "2.19.3";
   };
   jwt = {
     dependencies = [ "base64" ];
@@ -1450,10 +1430,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1rk0n13c9nmk8di2x5gqk5r04vf8bkp7ff6z0b44wsmc7fndfpnz";
+      sha256 = "011fdngxzr1p9dq2hxqz7qq1glj2g44xnhaadjqlf48cplywfdnl";
       type = "gem";
     };
-    version = "2.25.0";
+    version = "2.25.1";
   };
   mail = {
     dependencies = [
@@ -1552,7 +1532,10 @@
     version = "2.8.9";
   };
   minitest = {
-    dependencies = [ "prism" ];
+    dependencies = [
+      "drb"
+      "prism"
+    ];
     groups = [
       "default"
       "development"
@@ -1561,10 +1544,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1fslin1vyh60snwygx8jnaj4kwhk83f3m0v2j2b7bsg2917wfm3q";
+      sha256 = "048ls6kn009jkwj1rvka2b5vnwq73b0krjz740j6j03cwcfqmb48";
       type = "gem";
     };
-    version = "6.0.1";
+    version = "6.0.3";
   };
   msgpack = {
     groups = [ "default" ];
@@ -1609,10 +1592,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1imc50a9ic3ynsl3k0japhmb0ggrgp2c186cfqbcclv892nsrjh8";
+      sha256 = "1bgjhb65r1bl52wdym6wpbb0r3j7va8s44grggp0jvarfvw7bawv";
       type = "gem";
     };
-    version = "0.6.2";
+    version = "0.6.3";
   };
   net-pop = {
     dependencies = [ "net-protocol" ];
@@ -1679,20 +1662,20 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "15anyh2ir3kdji93kw770xxwm5rspn9rzx9b9zh1h9gnclcd4173";
+      sha256 = "0mhp90nf3g3yy5vgjnwd34czi6rbi0p7057vgngfmmdkknsxiz9q";
       type = "gem";
     };
-    version = "1.19.0";
+    version = "1.19.2";
   };
   numo-narray-alt = {
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1q9vi03hrxgaq21w0g7babhn9drxpzf9flmvsck9j7rakakqcvnc";
+      sha256 = "1vh20lxy5gsdr4an994s0d4h1d5bfbhmlr63gw15n3ghcf31mc07";
       type = "gem";
     };
-    version = "0.9.13";
+    version = "0.10.3";
   };
   oj = {
     dependencies = [
@@ -1703,10 +1686,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "00q33rm7lpfc319pf6him05ak76gfy7i04iiddrz317q7swbq55i";
+      sha256 = "0g817hjx1rh4zhvcpb9m6lr6l8yyq3n8vnjm9x1rc5wr51hv6d9n";
       type = "gem";
     };
-    version = "3.16.13";
+    version = "3.16.16";
   };
   onnxruntime = {
     dependencies = [ "ffi" ];
@@ -1724,10 +1707,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "14gfk3j88gcfk2mzp4ingm7y1pq2nbnsgzkfvflwksfljgni2mqq";
+      sha256 = "0zazkk5q3p2ldd23ka04wypsz2g8gqwwainf3d58j0kvdc9p8yg2";
       type = "gem";
     };
-    version = "4.0.0";
+    version = "4.0.1";
   };
   orm_adapter = {
     groups = [ "default" ];
@@ -1772,16 +1755,17 @@
   pagy = {
     dependencies = [
       "json"
+      "uri"
       "yaml"
     ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0qkmmx83pggimiryyjacgiq72qw98db84s5vc4rqk9x9yinkff1x";
+      sha256 = "1xmywpn5zj99708zhmxx2xf76fnwwffrxa3648igvaqai8r5f6ml";
       type = "gem";
     };
-    version = "43.2.8";
+    version = "43.4.4";
   };
   parallel = {
     groups = [
@@ -1792,10 +1776,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0c719bfgcszqvk9z47w2p8j2wkz5y35k48ywwas5yxbbh3hm3haa";
+      sha256 = "0w697335hi5dk5ay9kyn53399sy87y8v0y6ij93m5wmshhadxrik";
       type = "gem";
     };
-    version = "1.27.0";
+    version = "1.28.0";
   };
   parser = {
     dependencies = [
@@ -1810,10 +1794,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1256ws3w3gnfqj7r3yz2i9y1y7k38fhjphxpybkyb4fds8jsgxh6";
+      sha256 = "0m2xqvn1la62hji1mn04y59giikww95p2hs0r4y2rrz3mdxcwyni";
       type = "gem";
     };
-    version = "3.3.10.1";
+    version = "3.3.11.1";
   };
   pg = {
     groups = [ "default" ];
@@ -1840,46 +1824,16 @@
     };
     version = "0.6.3";
   };
-  premailer = {
-    dependencies = [
-      "addressable"
-      "css_parser"
-      "htmlentities"
-    ];
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "1ryivdnij1990hcqqmq4s0x1vjvfl0awjc9b91f8af17v2639qhg";
-      type = "gem";
-    };
-    version = "1.27.0";
-  };
-  premailer-rails = {
-    dependencies = [
-      "actionmailer"
-      "net-smtp"
-      "premailer"
-    ];
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0004f73kgrglida336fqkgx906m6n05nnfc17mypzg5rc78iaf61";
-      type = "gem";
-    };
-    version = "1.12.0";
-  };
   pretender = {
     dependencies = [ "actionpack" ];
     groups = [ "default" ];
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0gd6zmdgb48n63459g09xvfk279l6lsa4xyhnlj59p6h5ps8slnl";
+      sha256 = "0a0n8imhm4m3y3ql8l4ncx3k8krlx5sz4wy4s99dp09jillg953x";
       type = "gem";
     };
-    version = "0.6.0";
+    version = "1.0.0";
   };
   prettyprint = {
     groups = [
@@ -1904,10 +1858,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0m0jkk1y537xc2rw5fg7sid5fnd4a9mw2gphqmiflc2mxwb3lic4";
+      sha256 = "11ggfikcs1lv17nhmhqyyp6z8nq5pkfcj6a904047hljkxm0qlvv";
       type = "gem";
     };
-    version = "1.8.0";
+    version = "1.9.0";
   };
   pry = {
     dependencies = [
@@ -1969,10 +1923,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0mx84s7gn3xabb320hw8060v7amg6gmcyyhfzp0kawafiq60j54i";
+      sha256 = "08znfv30pxmdkjyihvbjqbvv874dj3nybmmyscl958dy3f7v12qs";
       type = "gem";
     };
-    version = "7.0.2";
+    version = "7.0.5";
   };
   puma = {
     dependencies = [ "nio4r" ];
@@ -2008,10 +1962,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1xmnrk076sqymilydqgyzhkma3hgqhcv8xhy7ks479l2a3vvcx2x";
+      sha256 = "1hhjy9gcp52dzij05gmidqac8g28ski5xm67prwmdqmjfcgqxmsy";
       type = "gem";
     };
-    version = "3.2.4";
+    version = "3.2.6";
   };
   rack-proxy = {
     dependencies = [ "rack" ];
@@ -2037,10 +1991,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1sg4laz2qmllxh1c5sqlj9n1r7scdn08p3m4b0zmhjvyx9yw0v8b";
+      sha256 = "1s7zcxlmg88a6dam4aqbgk9xkpy6dkdfqmmcszkkliy3q3w38m2r";
       type = "gem";
     };
-    version = "2.1.1";
+    version = "2.1.2";
   };
   rack-test = {
     dependencies = [ "rack" ];
@@ -2091,10 +2045,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "15bxpa0acs5qc9ls4y1i21cp6wimkn5swn81kxmp1a6z4cdhcsah";
+      sha256 = "1lww7i686rm9s50d34hb596y2kfl46dida2kjy8gr64c6jjpn0bd";
       type = "gem";
     };
-    version = "8.1.2";
+    version = "8.1.3";
   };
   rails-dom-testing = {
     dependencies = [
@@ -2128,10 +2082,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0q55i6mpad20m2x1lg5pkqfpbmmapk0sjsrvr1sqgnj2hb5f5z1m";
+      sha256 = "128y5g3fyi8fds41jasrr4va1jrs7hcamzklk1523k7rxb64bc98";
       type = "gem";
     };
-    version = "1.6.2";
+    version = "1.7.0";
   };
   rails-i18n = {
     dependencies = [
@@ -2147,21 +2101,6 @@
     };
     version = "8.1.0";
   };
-  rails_autolink = {
-    dependencies = [
-      "actionview"
-      "activesupport"
-      "railties"
-    ];
-    groups = [ "default" ];
-    platforms = [ ];
-    source = {
-      remotes = [ "https://rubygems.org" ];
-      sha256 = "0fpwkc20bi7aynfgp2bqhvb7x6vsdiai4prflcsr9sicbwp9vjzv";
-      type = "gem";
-    };
-    version = "1.1.8";
-  };
   railties = {
     dependencies = [
       "actionpack"
@@ -2181,10 +2120,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0mc0kz2vhld3gn5m91ddy98qfnrbk765aznh8vy6hxjgdgkyr28j";
+      sha256 = "08nyhsigcvjpj9i3r0s73yi8zm16sxmr2x7xgxlaq2jjrghb0gli";
       type = "gem";
     };
-    version = "8.1.2";
+    version = "8.1.3";
   };
   rainbow = {
     groups = [
@@ -2228,10 +2167,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0qvky4s2fx5xbaz1brxanalqbcky3c7xbqd6dicpih860zgrjj29";
+      sha256 = "14iiyb4yi1chdzrynrk74xbhmikml3ixgdayjma3p700singfl46";
       type = "gem";
     };
-    version = "7.1.0";
+    version = "7.2.0";
   };
   redis-client = {
     dependencies = [ "connection_pool" ];
@@ -2239,10 +2178,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "083i9ig39bc249mv24nsb2jlfwcdgmp9kbpy5ph569nsypphpmrs";
+      sha256 = "0jw2xjzz24dwn85y8v1jf1vzzpsnypsvs06f1qfa91w7rpwr5248";
       type = "gem";
     };
-    version = "0.26.4";
+    version = "0.28.0";
   };
   regexp_parser = {
     groups = [
@@ -2318,10 +2257,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1q48hqws2dy1vws9schc0kmina40gy7sn5qsndpsfqdslh65snha";
+      sha256 = "1g634lvyriq8pk87fn0dnz2ib9mma98ks7y0b30j28a9gm5i2gzv";
       type = "gem";
     };
-    version = "3.1.2";
+    version = "3.4.1";
   };
   rexml = {
     groups = [
@@ -2427,10 +2366,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "071bqrk2rblk3zq3jk1xxx0dr92y0szi5pxdm8waimxici706y89";
+      sha256 = "0iqxmw0knjiz5nf6pgr8ihs6cjzh89f0ppj3fqiz8cvms79x6sh8";
       type = "gem";
     };
-    version = "3.13.7";
+    version = "3.13.8";
   };
   rspec-rails = {
     dependencies = [
@@ -2449,10 +2388,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1kis8dfxlvi6gdzrv9nsn3ckw0c2z7armhni917qs1jx7yjkjc8i";
+      sha256 = "1pr29snnnlgkqv80vbi4795l6rxq3l47x5rl7lyni4h8zj95c8q6";
       type = "gem";
     };
-    version = "8.0.2";
+    version = "8.0.4";
   };
   rspec-support = {
     groups = [
@@ -2463,10 +2402,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1cmgz34hwj5s3jwxhyl8mszs24nci12ffbrmr5jb1si74iqf739f";
+      sha256 = "0z64h5rznm2zv21vjdjshz4v0h7bxvg02yc6g7yzxakj11byah06";
       type = "gem";
     };
-    version = "3.13.6";
+    version = "3.13.7";
   };
   rubocop = {
     dependencies = [
@@ -2488,10 +2427,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0wz2np5ck54vpwcz18y9x7w80c308wza7gmfcykysq59ajkadw89";
+      sha256 = "11nicljvmns665vryhfdrpssnk5dn1mxdap7ynprpgkfw5piiwag";
       type = "gem";
     };
-    version = "1.82.1";
+    version = "1.86.0";
   };
   rubocop-ast = {
     dependencies = [
@@ -2506,10 +2445,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1zbikzd6237fvlzjfxdlhwi2vbmavg1cc81y6cyr581365nnghs9";
+      sha256 = "0dahfpnzz63hyqxa03x8rypnrxzwyvh4i5a8ri34bzpnf3pg64j4";
       type = "gem";
     };
-    version = "1.49.0";
+    version = "1.49.1";
   };
   rubocop-performance = {
     dependencies = [
@@ -2637,10 +2576,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "189l1ajvpy8znkmbalrpc3fpg0b8gy1j3m4m5q282prf1zj1xh4z";
+      sha256 = "1af49rikvc0m4mf6asjyb601195hgvgx8ycmwwrvmizhdqck70sh";
       type = "gem";
     };
-    version = "3.1.0";
+    version = "3.1.1";
   };
   shakapacker = {
     dependencies = [
@@ -2654,10 +2593,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1a1r7zf15bxjdwmavjl363fqgv9gpd6mpc41d0fn8lhc468r4n3b";
+      sha256 = "0kxji9yj8vga2qbgg8x1m3j74w8n21rqqz60f33q9kwzaabby9j1";
       type = "gem";
     };
-    version = "9.5.0";
+    version = "9.7.0";
   };
   sidekiq = {
     dependencies = [
@@ -2671,10 +2610,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1r6ik93p4dbjjdwa8w7qn4rgn9rn4y2xbswp3q9b3mz4x6p5xpkb";
+      sha256 = "1szw72f2k9vyyi81c9rv1rj91s849j6jxwvvsxsxdnmi5gr6c4ja";
       type = "gem";
     };
-    version = "8.1.0";
+    version = "8.1.2";
   };
   signet = {
     dependencies = [
@@ -2758,10 +2697,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0v19bypbf46ms3gvk47hi4smcf6pm0gc8daa786mapzc685w1sgc";
+      sha256 = "1cbkgb5s3qsfjgnp75habwxsi97711jg90yh52ihcssbf58430c6";
       type = "gem";
     };
-    version = "2.9.0";
+    version = "2.9.2";
   };
   stringio = {
     groups = [
@@ -2793,10 +2732,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "131cnwbs375r349yzsdyw7a9djxjfmymn8kk96s51sm3jhmlcxjz";
+      sha256 = "17k75zrwf4ag9yl9wjjkcb90zrm4r5jigdzv3zr5jm9239hxpqma";
       type = "gem";
     };
-    version = "3.1.7";
+    version = "3.1.8";
   };
   thor = {
     groups = [
@@ -2820,10 +2759,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1bz11pq7n1g51f50jqmgyf5b1v64p1pfqmy5l21y6vpr37b2lwkd";
+      sha256 = "1jxcji88mh6xsqz0mfzwnxczpg7cyniph7wpavnavfz7lxl77xbq";
       type = "gem";
     };
-    version = "0.6.0";
+    version = "0.6.1";
   };
   trailblazer-option = {
     groups = [ "default" ];
@@ -2840,13 +2779,11 @@
     groups = [ "default" ];
     platforms = [ ];
     source = {
-      fetchSubmodules = false;
-      rev = "3963d490459df7a2b5bedb42424c3285f25eab22";
-      sha256 = "155ghsvf9kcsp6wpvhb15yzkhvq8k6lykip3f2npiasgyz10b3c5";
-      type = "git";
-      url = "https://github.com/trilogy-libraries/trilogy.git";
+      remotes = [ "https://rubygems.org" ];
+      sha256 = "0m5d1v0gsdh8m24bxc8hw7gypf9l56zkdy1lfaca7a9ix12n463m";
+      type = "gem";
     };
-    version = "2.10.0";
+    version = "2.12.2";
   };
   tsort = {
     groups = [
@@ -2871,10 +2808,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1ivb45cpj3v9ky0nr34vwfa0x8i90ycbxmyr0wd8q7fikyi0w1q2";
+      sha256 = "0priz7ww23h2j9j5zicc4np3rr357n01xw8zymn0bzxg79rr03gf";
       type = "gem";
     };
-    version = "2.0.21";
+    version = "2.0.23";
   };
   twitter_cldr = {
     dependencies = [
@@ -2913,10 +2850,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "0qlm97fqcwhvfa7jg2gnq8la3mnk617b5bwsc460mi75wpqy4imm";
+      sha256 = "1z896q8kzig9x6g3bcp38apns05y36jhf4j7ml7wzqjsmqcnb8sf";
       type = "gem";
     };
-    version = "1.2025.3";
+    version = "1.2026.1";
   };
   uber = {
     groups = [ "default" ];
@@ -3013,7 +2950,6 @@
   web-console = {
     dependencies = [
       "actionview"
-      "activemodel"
       "bindex"
       "railties"
     ];
@@ -3021,10 +2957,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "087y4byl2s3fg0nfhix4s0r25cv1wk7d2j8n5324waza21xg7g77";
+      sha256 = "193ddancfznc34qp2bqz5mkv906v4aka6njv2lzhkhnz3hq72fz1";
       type = "gem";
     };
-    version = "4.2.1";
+    version = "4.3.0";
   };
   webmock = {
     dependencies = [
@@ -3036,10 +2972,10 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "1mqw7ca931zmqgad0fq4gw7z3gwb0pwx9cmd1b12ga4hgjsnysag";
+      sha256 = "142cbab47mjxmg8gc89d94sd3h7an9ligh38r9n88wb3xbr5cibp";
       type = "gem";
     };
-    version = "3.26.1";
+    version = "3.26.2";
   };
   webrick = {
     groups = [
@@ -3117,9 +3053,9 @@
     platforms = [ ];
     source = {
       remotes = [ "https://rubygems.org" ];
-      sha256 = "12zcvhzfnlghzw03czy2ifdlyfpq0kcbqcmxqakfkbxxavrr1vrb";
+      sha256 = "1pbkiwwla5gldgb3saamn91058nl1sq1344l5k36xsh9ih995nnq";
       type = "gem";
     };
-    version = "2.7.4";
+    version = "2.7.5";
   };
 }
diff --git a/pkgs/by-name/do/docuseal/package.nix b/pkgs/by-name/do/docuseal/package.nix
index 9c8cdf964329..abb8db12fb46 100644
--- a/pkgs/by-name/do/docuseal/package.nix
+++ b/pkgs/by-name/do/docuseal/package.nix
@@ -16,7 +16,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "docuseal";
-  version = "2.3.4";
+  version = "2.4.4";
 
   bundler = bundler.override { ruby = ruby_3_4; };
 
@@ -24,17 +24,11 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "docusealco";
     repo = "docuseal";
     tag = finalAttrs.version;
-    hash = "sha256-JKV0xAtEbGETprC5zYEcmCVcUFrW4h/+lbYayzWefKs=";
+    hash = "sha256-GjWR0jxVRTs5KNbFDEcgCbG/HTJlJGYpbKf8+0YBSmk=";
     # https://github.com/docusealco/docuseal/issues/505#issuecomment-3153802333
     postFetch = "rm $out/db/schema.rb";
   };
 
-  patches = [
-    # Drop setxid calls in non-root mode (fails under strict seccomp).
-    # https://github.com/docusealco/docuseal/pull/593
-    ./only-switch-uid-when-root.patch
-  ];
-
   rubyEnv = bundlerEnv {
     name = "docuseal-gems";
     ruby = ruby_3_4;
@@ -52,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
 
     offlineCache = fetchYarnDeps {
       inherit (finalAttrs) src;
-      hash = "sha256-AvdaSIXO31t15wWysTvFISqmKCAi1Q8CJgO0J2DqM6M=";
+      hash = "sha256-62nI/QUzlpI1VyZ6PWPz2kSp4S2GUIQDaf4jUwzyj24=";
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/development/ruby-modules/gem-config/default.nix b/pkgs/development/ruby-modules/gem-config/default.nix
index e509560fddee..3cf941cdca06 100644
--- a/pkgs/development/ruby-modules/gem-config/default.nix
+++ b/pkgs/development/ruby-modules/gem-config/default.nix
@@ -1130,10 +1130,7 @@ in
   };
 
   trilogy = attrs: {
-    postInstall = ''
-      installPath=$(cat "$out/nix-support/gem-meta/install-path")
-      ln -s contrib/ruby/trilogy.gemspec "$installPath/trilogy.gemspec"
-    '';
+    buildInputs = [ openssl ];
   };
 
   typhoeus = attrs: {

From c9cf1d2cd5ae2a9f5f2510efbff1cfeef4c436ef Mon Sep 17 00:00:00 2001
From: kyehn <kyehn@users.noreply.github.com>
Date: Sat, 18 Apr 2026 12:33:49 +0800
Subject: [PATCH 34/89] interstellar: 0.11.1 -> 0.11.2

---
 .../in/interstellar/emoji_builder.patch       |  82 ++++++++
 pkgs/by-name/in/interstellar/git-hashes.json  |   1 +
 pkgs/by-name/in/interstellar/package.nix      |  42 ++--
 .../by-name/in/interstellar/pubspec.lock.json | 183 +++++++++++++-----
 4 files changed, 245 insertions(+), 63 deletions(-)
 create mode 100644 pkgs/by-name/in/interstellar/emoji_builder.patch

diff --git a/pkgs/by-name/in/interstellar/emoji_builder.patch b/pkgs/by-name/in/interstellar/emoji_builder.patch
new file mode 100644
index 000000000000..e5645839f60c
--- /dev/null
+++ b/pkgs/by-name/in/interstellar/emoji_builder.patch
@@ -0,0 +1,82 @@
+--- a/lib/src/widgets/emoji_picker/emoji_builder.dart
++++ b/lib/src/widgets/emoji_picker/emoji_builder.dart
+@@ -1,7 +1,7 @@
+ import 'dart:convert';
++import 'dart:io';
+ 
+ import 'package:build/build.dart';
+-import 'package:http/http.dart' as http;
+ import 'package:interstellar/src/utils/trie.dart';
+ 
+ Builder emojiBuilder(BuilderOptions options) =>
+@@ -29,15 +29,9 @@
+   };
+ 
+   Future<String> _generateContent() async {
+-    final dataResponse = await http.get(
+-      Uri.parse('$_sourcePrefix/compact.raw.json'),
+-    );
+-    final dataJson = jsonDecode(dataResponse.body);
++    final dataJson = jsonDecode(await File('@compact.raw.json@').readAsString()) as List;
+ 
+-    final messagesResponse = await http.get(
+-      Uri.parse('$_sourcePrefix/messages.raw.json'),
+-    );
+-    final messagesJson = jsonDecode(messagesResponse.body);
++    final messagesJson = jsonDecode(await File('@messages.raw.json@').readAsString()) as Map<String, dynamic>;
+ 
+     final s = StringBuffer()
+       ..write('''
+@@ -53,8 +47,9 @@
+ 
+     final emojiGroups = <String>[];
+ 
+-    for (var i = 0; i < (messagesJson['groups'] as List).length; i++) {
+-      final group = messagesJson['groups'][i];
++    final groups = messagesJson['groups'] as List;
++    for (var i = 0; i < groups.length; i++) {
++      final group = groups[i] as Map<String, dynamic>;
+ 
+       assert(group['order'] == i, 'Emoji group order value should match index');
+ 
+@@ -61,4 +56,4 @@
+-      emojiGroups.add(group['message']);
++      emojiGroups.add(group['message'] as String);
+     }
+ 
+     s
+@@ -72,7 +67,8 @@
+ 
+     {
+       var i = 0;
+-      for (final emoji in dataJson) {
++      for (final emojiItem in dataJson) {
++        final emoji = emojiItem as Map<String, dynamic>;
+         if (emoji['group'] == null || emoji['order'] == null) continue;
+ 
+         assert(emoji['order'] == i + 1, 'Emoji order value should match index');
+@@ -84,9 +80,9 @@
+               : emoji['emoticon']),
+         ];
+ 
+-        trie.addChild(Trie.normalizeTerm(emoji['label']), {i});
++        trie.addChild(Trie.normalizeTerm(emoji['label'] as String), {i});
+         for (final tag in tags) {
+-          trie.addChild(Trie.normalizeTerm(tag), {i});
++          trie.addChild(Trie.normalizeTerm(tag as String), {i});
+         }
+ 
+         s
+@@ -93,9 +89,9 @@
+           ..write('const Emoji("')
+-          ..write(emoji['unicode'])
++          ..write(emoji['unicode'] as String)
+           ..write('","')
+-          ..write(emoji['label'])
++          ..write(emoji['label'] as String)
+           ..write('",')
+-          ..write(emoji['group'])
++          ..write(emoji['group'].toString())
+           ..write('),\n');
+ 
+         i++;
diff --git a/pkgs/by-name/in/interstellar/git-hashes.json b/pkgs/by-name/in/interstellar/git-hashes.json
index 2aa5054878ae..fa2ad4a29e94 100644
--- a/pkgs/by-name/in/interstellar/git-hashes.json
+++ b/pkgs/by-name/in/interstellar/git-hashes.json
@@ -1,3 +1,4 @@
 {
+  "flutter_web_auth_2": "sha256-x3SVeFIYS+UtyNKr4ohq4dvktCgS6nECGrb2vMg9aZc=",
   "webcrypto": "sha256-HX8CcCRbDlVMLMbKGnqKlrkMT9XITLbQE/2OW9zO72w="
 }
diff --git a/pkgs/by-name/in/interstellar/package.nix b/pkgs/by-name/in/interstellar/package.nix
index 1eb70a7f857a..fbdcd5bcd769 100644
--- a/pkgs/by-name/in/interstellar/package.nix
+++ b/pkgs/by-name/in/interstellar/package.nix
@@ -1,7 +1,8 @@
 {
   lib,
-  flutter338,
+  flutter341,
   fetchFromGitHub,
+  fetchurl,
   imagemagick,
   alsa-lib,
   libass,
@@ -13,25 +14,42 @@
   dart,
 }:
 
-let
+flutter341.buildFlutterApplication (finalAttrs: {
   pname = "interstellar";
-
-  version = "0.11.1";
+  version = "0.11.2";
 
   src = fetchFromGitHub {
     owner = "interstellar-app";
     repo = "interstellar";
-    tag = "v${version}";
-    hash = "sha256-ZhZBy/KECz/Gs3RSuuXmTtI5pKPBMFQNG/kS8JvEaFc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-WprvuIN7yS5yLR4eUF/M9yG25ZU1Sf1I1myujclF4oM=";
   };
-in
-flutter338.buildFlutterApplication {
-  inherit pname version src;
 
   pubspecLock = lib.importJSON ./pubspec.lock.json;
 
   gitHashes = lib.importJSON ./git-hashes.json;
 
+  patches = [ ./emoji_builder.patch ];
+
+  postPatch = ''
+    substituteInPlace lib/src/widgets/emoji_picker/emoji_builder.dart \
+        --replace-fail "@compact.raw.json@" "${
+          fetchurl {
+            url = "https://raw.githubusercontent.com/milesj/emojibase/a5fc630a91ca42cddf3f4a66492965600fd3bce8/packages/data/en/compact.raw.json";
+            hash = "sha256-OivCYjiBEooRx3zni9jAr3lR0rzpoa3HX2l/a0UwDpE=";
+          }
+        }" \
+        --replace-fail "@messages.raw.json@" "${
+          fetchurl {
+            url = "https://raw.githubusercontent.com/milesj/emojibase/a5fc630a91ca42cddf3f4a66492965600fd3bce8/packages/data/en/messages.raw.json";
+            hash = "sha256-ZQWXZJ5jXxDNQHaOAsxApAt6oanvaEwZ6VXbDA0YeMs=";
+          }
+        }"
+    substituteInPlace lib/src/controller/database/database.dart \
+      --replace-fail "const Color.from(alpha: 1, red: 1, green: 1, blue: 1).value32bit" "0xFFFFFFFF" \
+      --replace-fail "const Color.from(alpha: 1, red: 0, green: 0, blue: 0).value32bit" "0xFF000000"
+  '';
+
   nativeBuildInputs = [ imagemagick ];
 
   buildInputs = [
@@ -54,14 +72,14 @@ flutter338.buildFlutterApplication {
   '';
 
   extraWrapProgramArgs = ''
-    --prefix LD_LIBRARY_PATH : $out/app/${pname}/lib
+    --prefix LD_LIBRARY_PATH : $out/app/${finalAttrs.pname}/lib
   '';
 
   passthru = {
     pubspecSource =
       runCommand "pubspec.lock.json"
         {
-          inherit src;
+          inherit (finalAttrs) src;
           nativeBuildInputs = [ yq-go ];
         }
         ''
@@ -96,4 +114,4 @@ flutter338.buildFlutterApplication {
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ JollyDevelopment ];
   };
-}
+})
diff --git a/pkgs/by-name/in/interstellar/pubspec.lock.json b/pkgs/by-name/in/interstellar/pubspec.lock.json
index d1914455de24..dd9676c3b25b 100644
--- a/pkgs/by-name/in/interstellar/pubspec.lock.json
+++ b/pkgs/by-name/in/interstellar/pubspec.lock.json
@@ -4,21 +4,31 @@
       "dependency": "transitive",
       "description": {
         "name": "_fe_analyzer_shared",
-        "sha256": "f0bb5d1648339c8308cc0b9838d8456b3cfe5c91f9dc1a735b4d003269e5da9a",
+        "sha256": "5b7468c326d2f8a4f630056404ca0d291ade42918f4a3c6233618e724f39da8e",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "88.0.0"
+      "version": "92.0.0"
     },
     "analyzer": {
       "dependency": "transitive",
       "description": {
         "name": "analyzer",
-        "sha256": "0b7b9c329d2879f8f05d6c05b32ee9ec025f39b077864bdb5ac9a7b63418a98f",
+        "sha256": "70e4b1ef8003c64793a9e268a551a82869a8a96f39deb73dea28084b0e8bf75e",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "8.1.1"
+      "version": "9.0.0"
+    },
+    "ansicolor": {
+      "dependency": "transitive",
+      "description": {
+        "name": "ansicolor",
+        "sha256": "50e982d500bc863e1d703448afdbf9e5a72eb48840a4f766fa361ffd6877055f",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "2.0.3"
     },
     "any_link_preview": {
       "dependency": "direct main",
@@ -60,15 +70,25 @@
       "source": "hosted",
       "version": "2.13.0"
     },
-    "blurhash_ffi": {
+    "auto_route": {
       "dependency": "direct main",
       "description": {
-        "name": "blurhash_ffi",
-        "sha256": "9811937f2e568aedb5630c9d901323c236414e3e882050fdf25bc42f7431d7bb",
+        "name": "auto_route",
+        "sha256": "e9acfeb3df33d188fce4ad0239ef4238f333b7aa4d95ec52af3c2b9360dcd969",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.2.7"
+      "version": "11.1.0"
+    },
+    "auto_route_generator": {
+      "dependency": "direct main",
+      "description": {
+        "name": "auto_route_generator",
+        "sha256": "04300eaf5821962aae8b5cd94f67013fd2fd326dc3be212d3ec1ae7470f09834",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "10.4.0"
     },
     "boolean_selector": {
       "dependency": "transitive",
@@ -81,14 +101,14 @@
       "version": "2.1.2"
     },
     "build": {
-      "dependency": "transitive",
+      "dependency": "direct main",
       "description": {
         "name": "build",
-        "sha256": "5b887c55a0f734b433b3b2d89f9cd1f99eb636b17e268a5b4259258bc916504b",
+        "sha256": "275bf6bb2a00a9852c28d4e0b410da1d833a734d57d39d44f94bfc895a484ec3",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.0.0"
+      "version": "4.0.4"
     },
     "build_config": {
       "dependency": "transitive",
@@ -111,14 +131,14 @@
       "version": "4.0.4"
     },
     "build_runner": {
-      "dependency": "direct dev",
+      "dependency": "direct main",
       "description": {
         "name": "build_runner",
-        "sha256": "804c47c936df75e1911c19a4fb8c46fa8ff2b3099b9f2b2aa4726af3774f734b",
+        "sha256": "b4d854962a32fd9f8efc0b76f98214790b833af8b2e9b2df6bfc927c0415a072",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.8.0"
+      "version": "2.10.5"
     },
     "built_collection": {
       "dependency": "transitive",
@@ -264,11 +284,11 @@
       "dependency": "transitive",
       "description": {
         "name": "dart_style",
-        "sha256": "c87dfe3d56f183ffe9106a18aebc6db431fc7c98c31a54b952a77f3d54a85697",
+        "sha256": "a9c30492da18ff84efe2422ba2d319a89942d93e58eb0b73d32abe822ef54b7b",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.1.2"
+      "version": "3.1.3"
     },
     "db_viewer": {
       "dependency": "transitive",
@@ -294,11 +314,11 @@
       "dependency": "direct main",
       "description": {
         "name": "drift",
-        "sha256": "540cf382a3bfa99b76e51514db5b0ebcd81ce3679b7c1c9cb9478ff3735e47a1",
+        "sha256": "5ea2f718558c0b31d4b8c36a3d8e5b7016f1265f46ceb5a5920e16117f0c0d6a",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.28.2"
+      "version": "2.30.1"
     },
     "drift_db_viewer": {
       "dependency": "direct main",
@@ -311,14 +331,14 @@
       "version": "2.1.0"
     },
     "drift_dev": {
-      "dependency": "direct dev",
+      "dependency": "direct main",
       "description": {
         "name": "drift_dev",
-        "sha256": "4db0eeedc7e8bed117a9f22d867ab7a3a294300fed5c269aac90d0b3545967ca",
+        "sha256": "892dfb5d69d9e604bdcd102a9376de8b41768cf7be93fd26b63cfc4d8f91ad5f",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "2.28.3"
+      "version": "2.30.1"
     },
     "drift_flutter": {
       "dependency": "direct main",
@@ -486,6 +506,16 @@
       "source": "sdk",
       "version": "0.0.0"
     },
+    "flutter_blurhash": {
+      "dependency": "direct main",
+      "description": {
+        "name": "flutter_blurhash",
+        "sha256": "e97b9aff13b9930bbaa74d0d899fec76e3f320aba3190322dcc5d32104e3d25d",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.9.1"
+    },
     "flutter_colorpicker": {
       "dependency": "direct main",
       "description": {
@@ -497,7 +527,7 @@
       "version": "1.1.0"
     },
     "flutter_launcher_icons": {
-      "dependency": "direct dev",
+      "dependency": "direct main",
       "description": {
         "name": "flutter_launcher_icons",
         "sha256": "10f13781741a2e3972126fae08393d3c4e01fa4cd7473326b94b72cf594195e7",
@@ -506,16 +536,6 @@
       "source": "hosted",
       "version": "0.14.4"
     },
-    "flutter_lints": {
-      "dependency": "direct dev",
-      "description": {
-        "name": "flutter_lints",
-        "sha256": "3105dc8492f6183fb076ccf1f351ac3d60564bff92e20bfc4af9cc1651f4e7e1",
-        "url": "https://pub.dev"
-      },
-      "source": "hosted",
-      "version": "6.0.0"
-    },
     "flutter_local_notifications": {
       "dependency": "direct main",
       "description": {
@@ -618,6 +638,27 @@
       "source": "sdk",
       "version": "0.0.0"
     },
+    "flutter_web_auth_2": {
+      "dependency": "direct main",
+      "description": {
+        "path": "flutter_web_auth_2",
+        "ref": "b1af971b79160979320a4865e238dcaacf69b624",
+        "resolved-ref": "b1af971b79160979320a4865e238dcaacf69b624",
+        "url": "https://github.com/interstellar-app/flutter_web_auth_2.git"
+      },
+      "source": "git",
+      "version": "5.0.1"
+    },
+    "flutter_web_auth_2_platform_interface": {
+      "dependency": "transitive",
+      "description": {
+        "name": "flutter_web_auth_2_platform_interface",
+        "sha256": "ba0fbba55bffb47242025f96852ad1ffba34bc451568f56ef36e613612baffab",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "5.0.0"
+    },
     "flutter_web_plugins": {
       "dependency": "transitive",
       "description": "flutter",
@@ -625,14 +666,14 @@
       "version": "0.0.0"
     },
     "freezed": {
-      "dependency": "direct dev",
+      "dependency": "direct main",
       "description": {
         "name": "freezed",
-        "sha256": "13065f10e135263a4f5a4391b79a8efc5fb8106f8dd555a9e49b750b45393d77",
+        "sha256": "03dd9b7423ff0e31b7e01b2204593e5e1ac5ee553b6ea9d8184dff4a26b9fb07",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "3.2.3"
+      "version": "3.2.4"
     },
     "freezed_annotation": {
       "dependency": "direct main",
@@ -674,6 +715,16 @@
       "source": "hosted",
       "version": "2.3.2"
     },
+    "hotreloader": {
+      "dependency": "transitive",
+      "description": {
+        "name": "hotreloader",
+        "sha256": "bc167a1163807b03bada490bfe2df25b0d744df359227880220a5cbd04e5734b",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "4.3.0"
+    },
     "html": {
       "dependency": "transitive",
       "description": {
@@ -865,14 +916,14 @@
       "version": "4.9.0"
     },
     "json_serializable": {
-      "dependency": "direct dev",
+      "dependency": "direct main",
       "description": {
         "name": "json_serializable",
-        "sha256": "33a040668b31b320aafa4822b7b1e177e163fc3c1e835c6750319d4ab23aa6fe",
+        "sha256": "5b89c1e32ae3840bb20a1b3434e3a590173ad3cb605896fb0f60487ce2f8104e",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.11.1"
+      "version": "6.11.4"
     },
     "leak_tracker": {
       "dependency": "transitive",
@@ -904,15 +955,15 @@
       "source": "hosted",
       "version": "3.0.2"
     },
-    "lints": {
+    "lean_builder": {
       "dependency": "transitive",
       "description": {
-        "name": "lints",
-        "sha256": "a5e2b223cb7c9c8efdc663ef484fdd95bb243bff242ef5b13e26883547fce9a0",
+        "name": "lean_builder",
+        "sha256": "4f3d70c34c52cc5034e8cc6f53d35aa3a32fb373b78fb4c29cf45cd1dcf06942",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "6.0.0"
+      "version": "0.1.5"
     },
     "logger": {
       "dependency": "direct main",
@@ -1514,21 +1565,21 @@
       "dependency": "transitive",
       "description": {
         "name": "source_gen",
-        "sha256": "ccf30b0c9fbcd79d8b6f5bfac23199fb354938436f62475e14aea0f29ee0f800",
+        "sha256": "1d562a3c1f713904ebbed50d2760217fd8a51ca170ac4b05b0db490699dbac17",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "4.0.1"
+      "version": "4.2.0"
     },
     "source_helper": {
       "dependency": "transitive",
       "description": {
         "name": "source_helper",
-        "sha256": "6a3c6cc82073a8797f8c4dc4572146114a39652851c157db37e964d9c7038723",
+        "sha256": "4a85e90b50694e652075cbe4575665539d253e6ec10e46e76b45368ab5e3caae",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.3.8"
+      "version": "1.3.10"
     },
     "source_span": {
       "dependency": "transitive",
@@ -1574,11 +1625,11 @@
       "dependency": "transitive",
       "description": {
         "name": "sqlparser",
-        "sha256": "57090342af1ce32bb499aa641f4ecdd2d6231b9403cea537ac059e803cc20d67",
+        "sha256": "f52f5d5649dcc13ed198c4176ddef74bf6851c30f4f31603f1b37788695b93e2",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "0.41.2"
+      "version": "0.43.0"
     },
     "stack_trace": {
       "dependency": "transitive",
@@ -1870,6 +1921,16 @@
       "source": "hosted",
       "version": "2.2.0"
     },
+    "very_good_analysis": {
+      "dependency": "direct main",
+      "description": {
+        "name": "very_good_analysis",
+        "sha256": "96245839dbcc45dfab1af5fa551603b5c7a282028a64746c19c547d21a7f1e3a",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "10.0.0"
+    },
     "visibility_detector": {
       "dependency": "direct main",
       "description": {
@@ -1914,11 +1975,11 @@
       "dependency": "transitive",
       "description": {
         "name": "watcher",
-        "sha256": "5bf046f41320ac97a469d506261797f35254fa61c641741ef32dacda98b7d39c",
+        "sha256": "f52385d4f73589977c80797e60fe51014f7f2b957b5e9a62c3f6ada439889249",
         "url": "https://pub.dev"
       },
       "source": "hosted",
-      "version": "1.1.3"
+      "version": "1.2.0"
     },
     "web": {
       "dependency": "transitive",
@@ -2031,6 +2092,16 @@
       "source": "hosted",
       "version": "0.5.1"
     },
+    "window_to_front": {
+      "dependency": "transitive",
+      "description": {
+        "name": "window_to_front",
+        "sha256": "7aef379752b7190c10479e12b5fd7c0b9d92adc96817d9e96c59937929512aee",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "0.0.3"
+    },
     "xdg_directories": {
       "dependency": "transitive",
       "description": {
@@ -2051,6 +2122,16 @@
       "source": "hosted",
       "version": "6.6.1"
     },
+    "xxh3": {
+      "dependency": "transitive",
+      "description": {
+        "name": "xxh3",
+        "sha256": "399a0438f5d426785723c99da6b16e136f4953fb1e9db0bf270bd41dd4619916",
+        "url": "https://pub.dev"
+      },
+      "source": "hosted",
+      "version": "1.2.0"
+    },
     "yaml": {
       "dependency": "transitive",
       "description": {
@@ -2074,6 +2155,6 @@
   },
   "sdks": {
     "dart": ">=3.9.0 <4.0.0",
-    "flutter": "3.38.5"
+    "flutter": "3.38.9"
   }
 }

From 34db1a242a619144db21f3e13d648cab3e6bf1f5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 18 Apr 2026 07:20:09 +0000
Subject: [PATCH 35/89] flexget: 3.19.10 -> 3.19.12

---
 pkgs/by-name/fl/flexget/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/fl/flexget/package.nix b/pkgs/by-name/fl/flexget/package.nix
index 14f922dc3216..0920e715eb15 100644
--- a/pkgs/by-name/fl/flexget/package.nix
+++ b/pkgs/by-name/fl/flexget/package.nix
@@ -7,14 +7,14 @@
 
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "flexget";
-  version = "3.19.10";
+  version = "3.19.12";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Flexget";
     repo = "Flexget";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-G0Scv6XHjpxp5V0Ep+4itu+SmO/8jhR6LHvG/9scIPY=";
+    hash = "sha256-BSXIC85iRVtSx1TB8yB2EassXfnlEqDpTX17+c1VauQ=";
   };
 
   pythonRelaxDeps = true;

From e54dbca00ae6bd24857c7fa623cc7ce14b130b3f Mon Sep 17 00:00:00 2001
From: eljamm <fedi.jamoussi@protonmail.ch>
Date: Sat, 18 Apr 2026 09:29:30 +0200
Subject: [PATCH 36/89] odamex: 12.1.0 -> 12.2.0

Changelog: https://github.com/odamex/odamex/releases/tag/12.2.0
---
 pkgs/by-name/od/odamex/package.nix | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/od/odamex/package.nix b/pkgs/by-name/od/odamex/package.nix
index e0e69caf7afd..b98c575dda8f 100644
--- a/pkgs/by-name/od/odamex/package.nix
+++ b/pkgs/by-name/od/odamex/package.nix
@@ -5,7 +5,7 @@
 
   cmake,
   copyDesktopItems,
-  deutex,
+  python3,
   makeDesktopItem,
   makeWrapper,
   pkg-config,
@@ -18,7 +18,7 @@
   cpptrace,
   curl,
   expat,
-  fltk,
+  fltk_1_4,
   libdwarf,
   libselinux,
   libsepol,
@@ -43,20 +43,20 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "odamex";
-  version = "12.1.0";
+  version = "12.2.0";
 
   src = fetchFromGitHub {
     owner = "odamex";
     repo = "odamex";
     tag = finalAttrs.version;
-    hash = "sha256-kLI1gdGH5NXJ8YI1tR0N5W6yvGZ+7302z0QLl2j+b0k=";
+    hash = "sha256-cRQtY4C0gjzheE4cG8aPjzAoPf/Hm05a6tidsbce7uM=";
     fetchSubmodules = true;
   };
 
   nativeBuildInputs = [
     cmake
     copyDesktopItems
-    deutex
+    python3
     makeWrapper
     pkg-config
   ]
@@ -71,7 +71,7 @@ stdenv.mkDerivation (finalAttrs: {
     cpptrace
     curl
     expat
-    fltk
+    fltk_1_4
     libdwarf
     libsysprof-capture
     pcre2
@@ -191,7 +191,6 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/odamex/odamex/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl2Only;
     platforms = lib.platforms.unix;
-    broken = stdenv.hostPlatform.isDarwin;
     maintainers = with lib.maintainers; [ eljamm ];
     mainProgram = "odalaunch";
   };

From 310ce64b523477df72e0845dc6b99a302480337b Mon Sep 17 00:00:00 2001
From: Fabian Affolter <mail@fabian-affolter.ch>
Date: Sat, 18 Apr 2026 11:22:21 +0200
Subject: [PATCH 37/89] python3Packages.nox: modernize

---
 pkgs/development/python-modules/nox/default.nix | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/nox/default.nix b/pkgs/development/python-modules/nox/default.nix
index acdd8ef3d6bc..e9325dc9fa87 100644
--- a/pkgs/development/python-modules/nox/default.nix
+++ b/pkgs/development/python-modules/nox/default.nix
@@ -2,7 +2,6 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
-  pythonOlder,
 
   # build-system
   hatchling,
@@ -27,17 +26,15 @@
   virtualenv,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "nox";
   version = "2026.04.10";
   pyproject = true;
 
-  disabled = pythonOlder "3.12";
-
   src = fetchFromGitHub {
     owner = "wntrblm";
     repo = "nox";
-    tag = version;
+    tag = finalAttrs.version;
     hash = "sha256-ArSA9I86hTKM+fkTdzOeheYVxpdjweMs2I0mUwR14sQ=";
   };
 
@@ -65,7 +62,7 @@ buildPythonPackage rec {
     pytestCheckHook
     writableTmpDirAsHomeHook
   ]
-  ++ lib.concatAttrValues optional-dependencies;
+  ++ lib.flatten (builtins.attrValues finalAttrs.passthru.optional-dependencies);
 
   pythonImportsCheck = [ "nox" ];
 
@@ -86,11 +83,11 @@ buildPythonPackage rec {
   meta = {
     description = "Flexible test automation for Python";
     homepage = "https://nox.thea.codes/";
-    changelog = "https://github.com/wntrblm/nox/blob/${src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/wntrblm/nox/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.asl20;
     maintainers = with lib.maintainers; [
       doronbehar
       fab
     ];
   };
-}
+})

From 4c4a4ee68ffd416592e73908ed9323ae091e38da Mon Sep 17 00:00:00 2001
From: Stephane <stephane@github.no-sp.am>
Date: Fri, 17 Apr 2026 17:38:21 +0200
Subject: [PATCH 38/89] ollama: 0.20.7 -> 0.21.0

---
 pkgs/by-name/ol/ollama/package.nix | 19 +++++++++++++------
 1 file changed, 13 insertions(+), 6 deletions(-)

diff --git a/pkgs/by-name/ol/ollama/package.nix b/pkgs/by-name/ol/ollama/package.nix
index a610262ce240..1a90cdcd1b46 100644
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -7,6 +7,7 @@
   stdenv,
   addDriverRunpath,
   nix-update-script,
+  coreutils,
 
   cmake,
   gitMinimal,
@@ -94,7 +95,7 @@ let
 
   cudaToolkit = buildEnv {
     # ollama hardcodes the major version in the Makefile to support different variants.
-    # - https://github.com/ollama/ollama/blob/v0.20.6/CMakePresets.json#L21-L47
+    # - https://github.com/ollama/ollama/blob/v0.21.0/CMakePresets.json#L21-L47
     name = "cuda-merged-${cudaMajorVersion}";
     paths = map lib.getLib cudaLibs ++ [
       (lib.getOutput "static" cudaPackages.cuda_cudart)
@@ -140,13 +141,13 @@ let
 in
 goBuild (finalAttrs: {
   pname = "ollama";
-  version = "0.20.7";
+  version = "0.21.0";
 
   src = fetchFromGitHub {
     owner = "ollama";
     repo = "ollama";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-a08TZMzoRg1YzqIU6l1Z8JOBh6VSK5lhfA8ggoMl/ss=";
+    hash = "sha256-DtrYopNtndQXq9Xjriw5Bqell9A8RHPOvgDF8BlKtdU=";
   };
 
   vendorHash = "sha256-Lc1Ktdqtv2VhJQssk8K1UOimeEjVNvDWePE9WkamCos=";
@@ -187,9 +188,17 @@ goBuild (finalAttrs: {
     ++ lib.optionals enableVulkan vulkanLibs;
 
   # replace inaccurate version number with actual release version
+  # and replace core utils tools from their FHS location to nix store
   postPatch = ''
     substituteInPlace version/version.go \
       --replace-fail 0.0.0 '${finalAttrs.version}'
+    substituteInPlace cmd/launch/openclaw_test.go \
+      --replace-fail '/bin/mkdir' '${coreutils}/bin/mkdir' \
+      --replace-fail '/bin/cat' '${coreutils}/bin/cat'
+    substituteInPlace cmd/launch/hermes_test.go \
+      --replace-fail '/bin/mkdir' '${coreutils}/bin/mkdir' \
+      --replace-fail '/bin/cat' '${coreutils}/bin/cat' \
+      --replace-fail '/bin/chmod' '${coreutils}/bin/chmod'
     rm -r app
   ''
   # disable tests that fail in sandbox due to Metal init failure
@@ -232,7 +241,7 @@ goBuild (finalAttrs: {
     '';
 
   # ollama looks for acceleration libs in ../lib/ollama/ (now also for CPU-only with arch specific optimizations)
-  # https://github.com/ollama/ollama/blob/v0.20.5/docs/development.md#library-detection
+  # https://github.com/ollama/ollama/blob/v0.21.0/docs/development.md#library-detection
   postInstall = ''
     mkdir -p $out/lib
     cp -r build/lib/ollama $out/lib/
@@ -263,8 +272,6 @@ goBuild (finalAttrs: {
       skippedTests = [
         "TestPushHandler/unauthorized_push" # Writes to $HOME, see https://github.com/ollama/ollama/pull/12307#pullrequestreview-3249128660
         "TestPiRun_InstallAndWebSearchLifecycle" # Requires network access to install npm packages
-        "TestOpenclawRun_ChannelSetupHappensBeforeGatewayRestart" # /bin/mkdir and /bin/cat are unavailable on NixOS
-        "TestOpenclawChannelSetupPreflight" # /bin/mkdir and /bin/cat are unavailable on NixOS
       ];
     in
     [ "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$" ];

From 47d93cf7087c0d07eb5fcce993687f4bad69a71b Mon Sep 17 00:00:00 2001
From: Kerstin Humm <kerstin@erictapen.name>
Date: Thu, 16 Apr 2026 16:05:22 +0200
Subject: [PATCH 39/89] python3Packages.dj-rest-auth: remove unneeded postPatch

---
 pkgs/development/python-modules/dj-rest-auth/default.nix | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/dj-rest-auth/default.nix b/pkgs/development/python-modules/dj-rest-auth/default.nix
index 64a110368d99..789f2f0dc140 100644
--- a/pkgs/development/python-modules/dj-rest-auth/default.nix
+++ b/pkgs/development/python-modules/dj-rest-auth/default.nix
@@ -27,11 +27,6 @@ buildPythonPackage (finalAttrs: {
     hash = "sha256-eUcve2KPcLjKKWU7AxQEZ0mokP185E43Xjm4b+4hQzA=";
   };
 
-  postPatch = ''
-    substituteInPlace setup.py \
-      --replace-fail "==" ">="
-  '';
-
   build-system = [ setuptools ];
 
   buildInputs = [ django ];
@@ -49,6 +44,7 @@ buildPythonPackage (finalAttrs: {
   };
 
   nativeCheckInputs = [
+    pytest-django
     djangorestframework-simplejwt
     pytestCheckHook
     pytest-django

From cd8f3c05dc59df2c987c45a04b3e84f042ff2885 Mon Sep 17 00:00:00 2001
From: Kerstin Humm <kerstin@erictapen.name>
Date: Thu, 16 Apr 2026 15:03:36 +0200
Subject: [PATCH 40/89] python3Packages.django-celery-beat: 2.8.1 -> 2.9.0

Diff: https://github.com/celery/django-celery-beat/compare/v2.8.1...v2.9.0

Changelog: https://github.com/celery/django-celery-beat/releases/tag/v2.9.0
---
 .../django-celery-beat/default.nix            | 54 +++++++++++++++----
 1 file changed, 43 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/python-modules/django-celery-beat/default.nix b/pkgs/development/python-modules/django-celery-beat/default.nix
index 4109ba3d3c8a..e274817a24bb 100644
--- a/pkgs/development/python-modules/django-celery-beat/default.nix
+++ b/pkgs/development/python-modules/django-celery-beat/default.nix
@@ -2,6 +2,7 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+  fetchpatch,
 
   # build-system
   setuptools,
@@ -20,18 +21,54 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "django-celery-beat";
-  version = "2.8.1";
+  version = "2.9.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "celery";
     repo = "django-celery-beat";
-    tag = "v${version}";
-    hash = "sha256-pakOpch5r2ug0UDSqEU34qr4Tz1/mkuFiHW+IOUuGcc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-UGKMSXB+Hg865sAk5ePc/noO3eNTr7b3pp7tvNvn1T8=";
   };
 
+  # https://github.com/celery/django-celery-beat/pull/1009
+  patches = [
+    (fetchpatch {
+      url = "https://github.com/celery/django-celery-beat/commit/dc11bdfa06858409da01f2d407bb68486870a559.patch";
+      hash = "sha256-aK8u2CfmNYFwE9CQvKjnwywVcw8MQfXvev7JYU9kz4E=";
+    })
+    (fetchpatch {
+      url = "https://github.com/celery/django-celery-beat/commit/ddcbe8bf2c970a82e87f50c0e9c232b0ae951a85.patch";
+      hash = "sha256-uw3l6CA0lnbF1HnNeSgZ91l1ujkB4V3831Yj+L4i+L0=";
+    })
+    (fetchpatch {
+      url = "https://github.com/celery/django-celery-beat/commit/088355dc6531bfffc19272c9de55f4d18606634e.patch";
+      hash = "sha256-6pamaLcHbNUGJMw6nCWeY/C1O58choDbJ1j/4SqDPx4=";
+    })
+    (fetchpatch {
+      url = "https://github.com/celery/django-celery-beat/commit/273e2f23edee26404a1691320a69dee280f9639b.patch";
+      hash = "sha256-8wZrDi9GDIF+w5ZZDssJGLG3UyE45xqld95nnG3SV0A=";
+    })
+    (fetchpatch {
+      url = "https://github.com/celery/django-celery-beat/commit/69f4a231f30df9ff028f8fc0f67cb115e5d53246.patch";
+      hash = "sha256-74p2XxB9ssWpVokY8XVUjkyyE4+/2lijDYZcZSu9ms0=";
+    })
+    (fetchpatch {
+      url = "https://github.com/celery/django-celery-beat/commit/4b8246a44a69e79d7648a9f4658abd8b7937b2b8.patch";
+      hash = "sha256-c1ZJHgnxvOoEWAc9oRkcCLRG7sLLsSER/Dq0H8TIOYU=";
+    })
+    (fetchpatch {
+      url = "https://github.com/celery/django-celery-beat/commit/17dd67625f99a0e6dbe7fb779f61f336e7af1730.patch";
+      hash = "sha256-w+MynocR80jUARgvuk5cUIdzmdAYGglvrNXph/8XdBE=";
+    })
+    (fetchpatch {
+      url = "https://github.com/celery/django-celery-beat/commit/03018882f088be83e1c78b4ca657b960b3080081.patch";
+      hash = "sha256-YE121p2aGqoj9mRFSQu+oi+8xaz0QE+CsJHdBB7xwUM=";
+    })
+  ];
+
   pythonRelaxDeps = [ "django" ];
 
   build-system = [ setuptools ];
@@ -56,18 +93,13 @@ buildPythonPackage rec {
     "t/unit/test_schedulers.py"
   ];
 
-  disabledTests = [
-    # AssertionError: 'At 02:00, only on Monday UTC' != 'At 02:00 AM, only on Monday UTC'
-    "test_long_name"
-  ];
-
   pythonImportsCheck = [ "django_celery_beat" ];
 
   meta = {
     description = "Celery Periodic Tasks backed by the Django ORM";
     homepage = "https://github.com/celery/django-celery-beat";
-    changelog = "https://github.com/celery/django-celery-beat/releases/tag/${src.tag}";
+    changelog = "https://github.com/celery/django-celery-beat/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ onny ];
   };
-}
+})

From 6e1ada0d38e079d62cc6a221f61275c9583fa082 Mon Sep 17 00:00:00 2001
From: Kerstin Humm <kerstin@erictapen.name>
Date: Thu, 16 Apr 2026 14:42:41 +0200
Subject: [PATCH 41/89] python3Packages.translate-toolkit: add all
 optional-dependencies

---
 .../translate-toolkit/default.nix             | 59 ++++++++++---------
 1 file changed, 32 insertions(+), 27 deletions(-)

diff --git a/pkgs/development/python-modules/translate-toolkit/default.nix b/pkgs/development/python-modules/translate-toolkit/default.nix
index f88bfc6a603c..28e64d4cb293 100644
--- a/pkgs/development/python-modules/translate-toolkit/default.nix
+++ b/pkgs/development/python-modules/translate-toolkit/default.nix
@@ -9,25 +9,26 @@
   # dependencies
   lxml,
   unicode-segmentation-rs,
-  urllib3,
 
   # optional-dependencies
-  tomlkit,
-
-  # tests
-  aeidon,
   charset-normalizer,
-  cheroot,
   fluent-syntax,
-  gettext,
+  vobject,
   iniparse,
+  rapidfuzz,
   mistletoe,
   phply,
   pyparsing,
-  pytestCheckHook,
+  pyenchant,
+  aeidon,
+  tomlkit,
   ruamel-yaml,
-  syrupy,
-  vobject,
+
+  # tests
+  pytestCheckHook,
+  addBinToPathHook,
+  pytest-xdist,
+  gettext,
 }:
 
 buildPythonPackage (finalAttrs: {
@@ -47,36 +48,40 @@ buildPythonPackage (finalAttrs: {
   dependencies = [
     lxml
     unicode-segmentation-rs
-    urllib3
   ];
 
   optional-dependencies = {
+    chardet = [ charset-normalizer ];
+    fluent = [ fluent-syntax ];
+    ical = [ vobject ];
+    ini = [ iniparse ];
+    levenshtein = [ rapidfuzz ];
+    markdown = [ mistletoe ];
+    php = [ phply ];
+    rc = [ pyparsing ];
+    spellcheck = [ pyenchant ];
+    subtitles = [ aeidon ];
     toml = [ tomlkit ];
+    yaml = [ ruamel-yaml ];
   };
 
   nativeCheckInputs = [
-    aeidon
-    charset-normalizer
-    cheroot
-    fluent-syntax
-    gettext
-    iniparse
-    mistletoe
-    phply
-    pyparsing
     pytestCheckHook
-    ruamel-yaml
-    syrupy
-    tomlkit
-    vobject
-  ];
+    addBinToPathHook
+    pytest-xdist
+    gettext
+  ]
+  ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
 
   disabledTests = [
     # Probably breaks because of nix sandbox
     "test_timezones"
+  ];
 
-    # Requires network
-    "test_xliff_conformance"
+  disabledTestPaths = [
+    # Require pytest-snapshot but there are no snapshots checked in
+    "tests/translate/tools/test_pocount.py"
+    "tests/translate/tools/test_junitmsgfmt.py"
   ];
 
   pythonImportsCheck = [ "translate" ];

From 1264073efd44d22faa6c347fe0fdae897d68c28b Mon Sep 17 00:00:00 2001
From: Kerstin Humm <kerstin@erictapen.name>
Date: Thu, 16 Apr 2026 16:46:42 +0200
Subject: [PATCH 42/89] python3Packages.celery: skip failing test

---
 pkgs/development/python-modules/celery/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/python-modules/celery/default.nix b/pkgs/development/python-modules/celery/default.nix
index bb9aae785f0e..c6f6f4e7ff0e 100644
--- a/pkgs/development/python-modules/celery/default.nix
+++ b/pkgs/development/python-modules/celery/default.nix
@@ -194,6 +194,9 @@ buildPythonPackage (finalAttrs: {
     "test_regression_worker_startup_info"
     "test_check_privileges"
 
+    # FileNotFoundError: [Errno 2] No such file or directory: 'test.db'
+    "test_forget"
+
     # Flaky: Unclosed temporary file handle under heavy load (as in nixpkgs-review)
     "test_check_privileges_without_c_force_root_and_no_group_entry"
   ]

From 97279180b81902169c18a9e4ac31e227fd5ac61b Mon Sep 17 00:00:00 2001
From: Kerstin Humm <kerstin@erictapen.name>
Date: Thu, 16 Apr 2026 14:53:08 +0200
Subject: [PATCH 43/89] python3Packages.altcha: 1.0.0 -> 2.0.0

---
 pkgs/development/python-modules/altcha/default.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/python-modules/altcha/default.nix b/pkgs/development/python-modules/altcha/default.nix
index e8f05bd7c524..bb8b45651ccb 100644
--- a/pkgs/development/python-modules/altcha/default.nix
+++ b/pkgs/development/python-modules/altcha/default.nix
@@ -6,16 +6,16 @@
   pytestCheckHook,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "altcha";
-  version = "1.0.0";
+  version = "2.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "altcha-org";
     repo = "altcha-lib-py";
-    tag = "v${version}";
-    hash = "sha256-N30luHhGFkd+XvVKhVnR6degEf0Nm/K/GEaqoEEuZMU=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-k5vy6lalC3idiquXbDCwF+mObzja/QC3PRBGQJMZ6fA=";
   };
 
   build-system = [ setuptools ];
@@ -30,4 +30,4 @@ buildPythonPackage rec {
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ erictapen ];
   };
-}
+})

From 652e7b6f2194b58f75e278fb46779287dd75b57d Mon Sep 17 00:00:00 2001
From: Kerstin Humm <kerstin@erictapen.name>
Date: Thu, 16 Apr 2026 14:53:27 +0200
Subject: [PATCH 44/89] weblate: 5.16.2 -> 5.17

Changelog: https://github.com/WeblateOrg/weblate/releases/tag/weblate-5.17
---
 pkgs/by-name/we/weblate/package.nix | 69 ++++++++++++++++++++++-------
 1 file changed, 53 insertions(+), 16 deletions(-)

diff --git a/pkgs/by-name/we/weblate/package.nix b/pkgs/by-name/we/weblate/package.nix
index 7f15172322a6..eeeaf2c02ea2 100644
--- a/pkgs/by-name/we/weblate/package.nix
+++ b/pkgs/by-name/we/weblate/package.nix
@@ -31,11 +31,13 @@
 
 let
   python = python3.override {
+    self = python;
     packageOverrides = _final: prev: {
-      django = prev.django_5;
+      django = prev.django_6;
+      pygobject = prev.pygobject3;
     };
   };
-  python3Packages = python3.pkgs;
+  python3Packages = python.pkgs;
 
   GI_TYPELIB_PATH = lib.makeSearchPathOutput "out" "lib/girepository-1.0" [
     pango
@@ -48,7 +50,7 @@ let
 in
 python3Packages.buildPythonApplication (finalAttrs: {
   pname = "weblate";
-  version = "5.16.2";
+  version = "5.17";
   pyproject = true;
 
   outputs = [
@@ -60,7 +62,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
     owner = "WeblateOrg";
     repo = "weblate";
     tag = "weblate-${finalAttrs.version}";
-    hash = "sha256-er3KtCAFtHh3UtM58Kni/PTBfXpWW/GOarRGJeAanL8=";
+    hash = "sha256-+czdS1cICvm8esXxJG9BjzPTJExajxvDoRVH7f+t6lY=";
   };
 
   postPatch = ''
@@ -92,15 +94,14 @@ python3Packages.buildPythonApplication (finalAttrs: {
     '';
 
   pythonRelaxDeps = [
+    "requests"
+    "pygobject"
     "certifi"
-    "crispy-bootstrap5"
-    "dateparser"
   ];
 
   dependencies =
     with python3Packages;
     [
-      aeidon
       ahocorasick-rs
       altcha
       (toPythonModule (borgbackup.override { python3 = python; }))
@@ -108,7 +109,6 @@ python3Packages.buildPythonApplication (finalAttrs: {
       certifi
       charset-normalizer
       confusable-homoglyphs
-      crispy-bootstrap3
       crispy-bootstrap5
       cryptography
       cssselect
@@ -134,23 +134,20 @@ python3Packages.buildPythonApplication (finalAttrs: {
       drf-standardized-errors
       fedora-messaging
       filelock
-      fluent-syntax
       gitpython
       hiredis
       html2text
-      iniparse
       jsonschema
       lxml
       mistletoe
       nh3
       openpyxl
       packaging
-      phply
       pillow
       pyaskalono
       pycairo
       pygments
-      pygobject3
+      pygobject
       pyicumessageformat
       pyparsing
       python-dateutil
@@ -178,7 +175,15 @@ python3Packages.buildPythonApplication (finalAttrs: {
     ++ celery.optional-dependencies.redis
     ++ drf-spectacular.optional-dependencies.sidecar
     ++ drf-standardized-errors.optional-dependencies.openapi
+    ++ translate-toolkit.optional-dependencies.chardet
+    ++ translate-toolkit.optional-dependencies.fluent
+    ++ translate-toolkit.optional-dependencies.ini
+    ++ translate-toolkit.optional-dependencies.markdown
     ++ translate-toolkit.optional-dependencies.toml
+    ++ translate-toolkit.optional-dependencies.php
+    ++ translate-toolkit.optional-dependencies.rc
+    ++ translate-toolkit.optional-dependencies.subtitles
+    ++ translate-toolkit.optional-dependencies.yaml
     ++ urllib3.optional-dependencies.brotli
     ++ urllib3.optional-dependencies.zstd;
 
@@ -197,12 +202,12 @@ python3Packages.buildPythonApplication (finalAttrs: {
     ];
     ldap = [ django-auth-ldap ];
     # mercurial = [ mercurial ];
-    mysql = [ mysqlclient ];
     openai = [ openai ];
     postgres = [ psycopg ];
     saml = [ python3-saml ];
-    # saml2idp = [ djangosaml2idp ];
-    # wlhosted = [ wlhosted ];
+    # saml2idp = [ djangosaml2idp2 ];
+    sphinx = [ sphinx ];
+    # wllegal = [ wllegal ];
     wsgi = [ granian ];
     # zxcvbn = [ django-zxcvbn-password-validator ];
   };
@@ -243,7 +248,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
       openssh
     ]
     ++ social-auth-core.optional-dependencies.saml
-    ++ (lib.concatLists (builtins.attrValues finalAttrs.passthru.optional-dependencies));
+    ++ lib.concatAttrValues finalAttrs.passthru.optional-dependencies;
 
   env = {
     CI_DATABASE = "postgresql";
@@ -277,6 +282,38 @@ python3Packages.buildPythonApplication (finalAttrs: {
     "test_ocr_backend"
   ];
 
+  disabledTestPaths = [
+    # Probably network access?
+    "weblate/addons/tests.py::SlackWebhooksAddonsTest::test_component_scopes"
+    "weblate/addons/tests.py::SlackWebhooksAddonsTest::test_connection_error"
+    "weblate/addons/tests.py::SlackWebhooksAddonsTest::test_invalid_response"
+    "weblate/addons/tests.py::SlackWebhooksAddonsTest::test_project_scopes"
+    "weblate/addons/tests.py::SlackWebhooksAddonsTest::test_site_wide_scope"
+    "weblate/addons/tests.py::SlackWebhooksAddonsTest::test_translation_added"
+    "weblate/addons/tests.py::SlackWebhooksAddonsTest::test_announcement"
+    "weblate/addons/tests.py::SlackWebhooksAddonsTest::test_bulk_changes"
+    "weblate/addons/tests.py::WebhooksAddonTest::test_announcement"
+    "weblate/addons/tests.py::WebhooksAddonTest::test_bulk_changes"
+    "weblate/addons/tests.py::WebhooksAddonTest::test_category_in_payload"
+    "weblate/addons/tests.py::WebhooksAddonTest::test_component_scopes"
+    "weblate/addons/tests.py::WebhooksAddonTest::test_connection_error"
+    "weblate/addons/tests.py::WebhooksAddonTest::test_invalid_response"
+    "weblate/addons/tests.py::WebhooksAddonTest::test_project_scopes"
+    "weblate/addons/tests.py::WebhooksAddonTest::test_site_wide_scope"
+    "weblate/addons/tests.py::WebhooksAddonTest::test_translation_added"
+    "weblate/addons/tests.py::WebhooksAddonTest::test_webhook_signature"
+    "weblate/addons/tests.py::WebhooksAddonTest::test_webhook_signature_prefix"
+
+    # Tries to resolve DNS
+    "weblate/api/tests.py::ProjectAPITest::test_install_machinery"
+
+    # djangosaml2idp2 is not packaged yet
+    "weblate/utils/tests/test_djangosaml2idp.py"
+
+    # Don't understand why
+    "weblate/trans/tests/test_alert.py::WebsiteAlertSettingTest::test_website_alerts_enabled"
+  ];
+
   passthru = {
     inherit python;
     # We need to expose this so weblate can work outside of calling its bin output

From 12e3dde80d2f86ffdcd8a3ae26f9b59b14747e78 Mon Sep 17 00:00:00 2001
From: Xiangyan Sun <wishstudio@gmail.com>
Date: Sat, 18 Apr 2026 11:35:05 -0700
Subject: [PATCH 45/89] zgv: fix build with gcc15; migrate to by-name

---
 .../zg}/zgv/add-include.patch                    |  0
 .../default.nix => by-name/zg/zgv/package.nix}   | 16 +++++++++++++---
 .../graphics => by-name/zg}/zgv/switch.patch     |  0
 pkgs/top-level/all-packages.nix                  |  8 --------
 4 files changed, 13 insertions(+), 11 deletions(-)
 rename pkgs/{applications/graphics => by-name/zg}/zgv/add-include.patch (100%)
 rename pkgs/{applications/graphics/zgv/default.nix => by-name/zg/zgv/package.nix} (79%)
 rename pkgs/{applications/graphics => by-name/zg}/zgv/switch.patch (100%)

diff --git a/pkgs/applications/graphics/zgv/add-include.patch b/pkgs/by-name/zg/zgv/add-include.patch
similarity index 100%
rename from pkgs/applications/graphics/zgv/add-include.patch
rename to pkgs/by-name/zg/zgv/add-include.patch
diff --git a/pkgs/applications/graphics/zgv/default.nix b/pkgs/by-name/zg/zgv/package.nix
similarity index 79%
rename from pkgs/applications/graphics/zgv/default.nix
rename to pkgs/by-name/zg/zgv/package.nix
index f0d662e0d4a7..bc55d389deb1 100644
--- a/pkgs/applications/graphics/zgv/default.nix
+++ b/pkgs/by-name/zg/zgv/package.nix
@@ -4,13 +4,20 @@
   fetchurl,
   fetchpatch,
   pkg-config,
-  SDL,
+  SDL_sixel,
   SDL_image,
   libjpeg,
   libpng,
   libtiff,
 }:
 
+let
+  # Enable terminal display. Note that it requires sixel graphics compatible
+  # terminals like mlterm or xterm -ti 340
+  SDL_image_sixel = SDL_image.override {
+    SDL = SDL_sixel;
+  };
+in
 stdenv.mkDerivation (finalAttrs: {
   pname = "zgv";
   version = "5.9";
@@ -21,8 +28,8 @@ stdenv.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ pkg-config ];
   buildInputs = [
-    SDL
-    SDL_image
+    SDL_sixel
+    SDL_image_sixel
     libjpeg
     libpng
     libtiff
@@ -30,6 +37,9 @@ stdenv.mkDerivation (finalAttrs: {
 
   hardeningDisable = [ "format" ];
 
+  # gcc15
+  env.NIX_CFLAGS_COMPILE = "-std=gnu17";
+
   makeFlags = [
     "BACKEND=SDL"
   ];
diff --git a/pkgs/applications/graphics/zgv/switch.patch b/pkgs/by-name/zg/zgv/switch.patch
similarity index 100%
rename from pkgs/applications/graphics/zgv/switch.patch
rename to pkgs/by-name/zg/zgv/switch.patch
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 0c6306892b86..4d1c9996c9a5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11026,14 +11026,6 @@ with pkgs;
 
   zed-editor-fhs = zed-editor.fhs;
 
-  zgv = callPackage ../applications/graphics/zgv {
-    # Enable the below line for terminal display. Note
-    # that it requires sixel graphics compatible terminals like mlterm
-    # or xterm -ti 340
-    SDL = SDL_sixel;
-    SDL_image = SDL_image.override { SDL = SDL_sixel; };
-  };
-
   zynaddsubfx-fltk = zynaddsubfx.override {
     guiModule = "fltk";
   };

From 71600138d1df554c4f22f126db68464acb24b0c3 Mon Sep 17 00:00:00 2001
From: Xiangyan Sun <wishstudio@gmail.com>
Date: Sat, 18 Apr 2026 12:25:03 -0700
Subject: [PATCH 46/89] x2x: unstable-2023-04-30 -> 1.30-unstable-2025-02-17

---
 pkgs/by-name/x2/x2x/package.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/x2/x2x/package.nix b/pkgs/by-name/x2/x2x/package.nix
index 51466f358818..6c276de0158c 100644
--- a/pkgs/by-name/x2/x2x/package.nix
+++ b/pkgs/by-name/x2/x2x/package.nix
@@ -12,19 +12,20 @@
 
 stdenv.mkDerivation {
   pname = "x2x";
-  version = "unstable-2023-04-30";
+  version = "1.30-unstable-2025-02-17";
 
   src = fetchFromGitHub {
     owner = "dottedmag";
     repo = "x2x";
-    rev = "53692798fa0e991e0dd67cdf8e8126158d543d08";
-    hash = "sha256-FUl2z/Yz9uZlUu79LHdsXZ6hAwSlqwFV35N+GYDNvlQ=";
+    rev = "08842516fa443a2cf799c6372f83466062f612c9";
+    hash = "sha256-0ZVpG4ZrygrFZ0mVmNLWWdyqM43LtQPGwvZZPC92zuY=";
   };
 
   nativeBuildInputs = [
     autoreconfHook
     pkg-config
   ];
+
   buildInputs = [
     libx11
     libxtst

From e390b6c148abde9014a92d8da245efc956c3cfbc Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Sat, 18 Apr 2026 21:56:47 +0200
Subject: [PATCH 47/89] opencryptoki: 3.25.0 -> 3.26.0-unstable-2026-04-09

diff: https://github.com/opencryptoki/opencryptoki/compare/v3.25.0...ed378f463ef73364c89feb0fc923f4dc867332a3

fixes: CVE-2026-40253
---
 pkgs/by-name/op/opencryptoki/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/op/opencryptoki/package.nix b/pkgs/by-name/op/opencryptoki/package.nix
index fec8f764047c..6d4ca5a70087 100644
--- a/pkgs/by-name/op/opencryptoki/package.nix
+++ b/pkgs/by-name/op/opencryptoki/package.nix
@@ -14,13 +14,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "opencryptoki";
-  version = "3.25.0";
+  version = "3.26.0-unstable-2026-04-09";
 
   src = fetchFromGitHub {
     owner = "opencryptoki";
     repo = "opencryptoki";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-JIDy5LY2rJqMM1uWDWn6Q62kJ+7pYU4G7zptkbyvf9Q=";
+    rev = "ed378f463ef73364c89feb0fc923f4dc867332a3";
+    hash = "sha256-1DxlsjPoK3kIQkfguhOlzP2d7dneYRz/Qwp4cH30AhU=";
   };
 
   nativeBuildInputs = [

From 94883689aa9b371264c555f3ea8979a7100fe309 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 18 Apr 2026 19:59:21 +0000
Subject: [PATCH 48/89] mpich: 5.0.0 -> 5.0.1

---
 pkgs/development/libraries/mpich/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/libraries/mpich/default.nix b/pkgs/development/libraries/mpich/default.nix
index 9809da4aa0fb..ae7ca1448294 100644
--- a/pkgs/development/libraries/mpich/default.nix
+++ b/pkgs/development/libraries/mpich/default.nix
@@ -46,11 +46,11 @@ assert (ch4backend.pname == "ucx" || ch4backend.pname == "libfabric");
 
 stdenv.mkDerivation rec {
   pname = "mpich";
-  version = "5.0.0";
+  version = "5.0.1";
 
   src = fetchurl {
     url = "https://www.mpich.org/static/downloads/${version}/mpich-${version}.tar.gz";
-    hash = "sha256-6TUOMiJCg+lTEfIhNPNsmOPNHGZdF/riCmzJLtPP/hE=";
+    hash = "sha256-jBgyoT3azwcWhQafX639Hyh3op4aYoZSiSxlIRsfMyc=";
   };
 
   patches = [

From 76e6acc5f10dfd3800a74113ae7518136323084d Mon Sep 17 00:00:00 2001
From: Hythera <87016780+Hythera@users.noreply.github.com>
Date: Sat, 18 Apr 2026 22:07:57 +0200
Subject: [PATCH 49/89] siyuan: 3.6.3 -> 3.6.4

changelog: https://github.com/siyuan-note/siyuan/releases/tag/v3.6.4

diff: https://github.com/siyuan-note/siyuan/compare/v3.6.3...v3.6.4

fixes: CVE-2026-40318
---
 pkgs/by-name/si/siyuan/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/si/siyuan/package.nix b/pkgs/by-name/si/siyuan/package.nix
index feb88419c6e3..8ed473dbd84b 100644
--- a/pkgs/by-name/si/siyuan/package.nix
+++ b/pkgs/by-name/si/siyuan/package.nix
@@ -36,20 +36,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "siyuan";
-  version = "3.6.3";
+  version = "3.6.4";
 
   src = fetchFromGitHub {
     owner = "siyuan-note";
     repo = "siyuan";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-zVBsnVqm38mEROtRChiNh9bJ/e8BP09CSxVS1wHVYZQ=";
+    hash = "sha256-dfM8mlZrfq8tqxwVL+TLGT26wLOzVJmw561eicFx2VY=";
   };
 
   kernel = buildGoModule {
     name = "${finalAttrs.pname}-${finalAttrs.version}-kernel";
     inherit (finalAttrs) src;
     sourceRoot = "${finalAttrs.src.name}/kernel";
-    vendorHash = "sha256-nbHBBRSoFOm8/NJ+8ZsOJbHcTZ+Le0RCAbF1AKaPIbs=";
+    vendorHash = "sha256-TixhAJwIHQwCrA2kdpAN2vK6UeSzLMGfX85j2KtlPfQ=";
 
     patches = [
       (replaceVars ./set-pandoc-path.patch {
@@ -100,7 +100,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
     pnpm = pnpm_9;
     fetcherVersion = 3;
-    hash = "sha256-TrdP871uy1Ie4MQiqC1/RaseU42FosOO7m4k+UVXGHc=";
+    hash = "sha256-jvTDT0Uze+E3hQ9wU3RqKQ7RI9+OLQlewGd+kSHuZ34=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/app";

From f423bdd8d3768de255354f887ba41e416cd280e9 Mon Sep 17 00:00:00 2001
From: emily-lavender <emily@foggy.city>
Date: Sat, 18 Apr 2026 14:53:18 -0700
Subject: [PATCH 50/89] deps-fnl: 0.2.5 -> 0.2.6

---
 pkgs/by-name/de/deps-fnl/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/de/deps-fnl/package.nix b/pkgs/by-name/de/deps-fnl/package.nix
index 3bb25de12b6a..82aeae7a2a6a 100644
--- a/pkgs/by-name/de/deps-fnl/package.nix
+++ b/pkgs/by-name/de/deps-fnl/package.nix
@@ -7,13 +7,13 @@
 
 stdenv.mkDerivation rec {
   pname = "deps.fnl";
-  version = "0.2.5";
+  version = "0.2.6";
 
   src = fetchFromGitLab {
     owner = "andreyorst";
     repo = "deps.fnl";
     tag = version;
-    hash = "sha256-gUqi0g7myWTbjILN4RQqbeeaSYcg0oVJYNO0Gv9XzNY=";
+    hash = "sha256-FrFeRbfK4sHd3pjiVDMrE8IpDKptZuwkTLMQ9hppVRY=";
   };
 
   dontBuild = true;

From acc5ae74745868427a2e74f53d1c0b6236aa04a9 Mon Sep 17 00:00:00 2001
From: Liam Murphy <liampm32@gmail.com>
Date: Tue, 14 Apr 2026 08:50:53 +1000
Subject: [PATCH 51/89] gfan: disable hardening, enable tests

`libcxxhardeningfast` was causing some of Sage's tests to fail on
Darwin. I disabled it, and then enabled gfan's tests so that failures
like this will be attributed to gfan itself in future.
---
 pkgs/by-name/gf/gfan/package.nix | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/gf/gfan/package.nix b/pkgs/by-name/gf/gfan/package.nix
index 9c1d1864dc48..9ca8ed038811 100644
--- a/pkgs/by-name/gf/gfan/package.nix
+++ b/pkgs/by-name/gf/gfan/package.nix
@@ -35,7 +35,14 @@ stdenv.mkDerivation (finalAttrs: {
     })
   ];
 
-  postPatch = lib.optionalString stdenv.cc.isClang ''
+  # This test assumes that our implementation of sort behaves identically to the
+  # one used during development, which is not necessarily the case; update the
+  # expected result to be sorted using our copy of sort.
+  postPatch = ''
+    sort testsuite/0008PolynomialSetUnion/output -o testsuite/0008PolynomialSetUnion/output
+    sort testsuite/0008PolynomialSetUnion/outputNew -o testsuite/0008PolynomialSetUnion/outputNew
+  ''
+  + lib.optionalString stdenv.cc.isClang ''
     substituteInPlace Makefile --replace "-fno-guess-branch-probability" ""
 
     for f in $(find -name "*.h" -or -name "*.cpp"); do
@@ -53,6 +60,15 @@ stdenv.mkDerivation (finalAttrs: {
     mpir
     cddlib
   ];
+  hardeningDisable = [ "libcxxhardeningfast" ];
+
+  doCheck = true;
+  # The test runner still exits successfully when there are failed tests, so check
+  # stdout to see if anything failed.
+  checkPhase = ''
+    make check | tee "$TMPDIR/test.log"
+    ! grep -q "Failed tests:" "$TMPDIR/test.log"
+  '';
 
   meta = {
     description = "Software package for computing Gröbner fans and tropical varieties";

From b1d8fb01d513e8eb393b5d19ca3487b8e3ca4e83 Mon Sep 17 00:00:00 2001
From: Austin Horstman <khaneliman12@gmail.com>
Date: Sat, 18 Apr 2026 20:39:52 -0500
Subject: [PATCH 52/89] sketchybar-app-font: 2.0.58 -> 2.0.60

---
 pkgs/by-name/sk/sketchybar-app-font/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sk/sketchybar-app-font/package.nix b/pkgs/by-name/sk/sketchybar-app-font/package.nix
index 046c55b5c71c..4f593faa9c08 100644
--- a/pkgs/by-name/sk/sketchybar-app-font/package.nix
+++ b/pkgs/by-name/sk/sketchybar-app-font/package.nix
@@ -10,13 +10,13 @@
 }:
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "sketchybar-app-font";
-  version = "2.0.58";
+  version = "2.0.60";
 
   src = fetchFromGitHub {
     owner = "kvndrsslr";
     repo = "sketchybar-app-font";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Q140vSaHkyddxUQut/r8LGuBvTel6kpcpZwqWRP0h8s=";
+    hash = "sha256-6fi3v+h3i5J1j4xDP1QUlGfrY8o9kiXtMCWmYZ9zgng=";
   };
 
   pnpmDeps = fetchPnpmDeps {

From 63ca6ee74c743933a9cab1c6e053e6de0ed8c62e Mon Sep 17 00:00:00 2001
From: figsoda <figsoda@pm.me>
Date: Sat, 18 Apr 2026 22:49:21 -0400
Subject: [PATCH 53/89] ci/OWNERS: add figsoda as an owner of nvim-treesitter

---
 ci/OWNERS | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/ci/OWNERS b/ci/OWNERS
index b8fc4ecf920c..027559c13299 100644
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -376,6 +376,9 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 
 # VimPlugins
 /pkgs/applications/editors/vim/plugins         @NixOS/neovim
+## nvim-treesitter
+/pkgs/applications/editors/vim/plugins/nvim-treesitter/overrides.nix @figsoda
+/pkgs/applications/editors/vim/plugins/utils/nvim-treesitter         @figsoda
 
 # VsCode Extensions
 /pkgs/applications/editors/vscode/extensions

From 521aca79b337535d9cb32a55df6d0ccf36733f4e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 19 Apr 2026 02:50:55 +0000
Subject: [PATCH 54/89] python3Packages.utitools: 0.4.0 -> 0.5.0

---
 pkgs/development/python-modules/utitools/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/utitools/default.nix b/pkgs/development/python-modules/utitools/default.nix
index 0a1b48894f28..77586f27fb29 100644
--- a/pkgs/development/python-modules/utitools/default.nix
+++ b/pkgs/development/python-modules/utitools/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "utitools";
-  version = "0.4.0";
+  version = "0.5.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "RhetTbull";
     repo = "utitools";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-oI+a+sc9+qi7aFP0dLINAQekib/9pZm10A5jhVIHWvo=";
+    hash = "sha256-mx9vcMCeDTJyWJKm0Ci9IEAPCNfx9NvPGC8cuNYnH1M=";
   };
 
   build-system = [ flit-core ];

From 004e3403088f1efb18fec65df314af2a97e14276 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 19 Apr 2026 04:10:02 +0000
Subject: [PATCH 55/89] webdav: 5.11.5 -> 5.11.6

---
 pkgs/by-name/we/webdav/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/we/webdav/package.nix b/pkgs/by-name/we/webdav/package.nix
index cda2eadfd9db..b8da03e924a4 100644
--- a/pkgs/by-name/we/webdav/package.nix
+++ b/pkgs/by-name/we/webdav/package.nix
@@ -6,16 +6,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "webdav";
-  version = "5.11.5";
+  version = "5.11.6";
 
   src = fetchFromGitHub {
     owner = "hacdias";
     repo = "webdav";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Al1rl6Ez36I3qE++1ZOvTgey9lfHp0SVzK6KJQSPBYc=";
+    hash = "sha256-iTBh6cH7is7UnbbXhn+z/Tnvq5//Jdt1OlPHNfICVUw=";
   };
 
-  vendorHash = "sha256-JctG+gkZtjlSX616Rv3rC7RU9YBNWp9LsD5Ut8qn1tY=";
+  vendorHash = "sha256-L98EShwiysMYXhI6aQut5bfMr76CwY1U06iOgG+jtCY=";
 
   __darwinAllowLocalNetworking = true;
 

From 38704fd7ae43a26a42045efef42a210585bb503d Mon Sep 17 00:00:00 2001
From: ccicnce113424 <ccicnce113424@gmail.com>
Date: Sat, 11 Apr 2026 10:44:20 +0800
Subject: [PATCH 56/89] hmcl: add libxkbcommon and jdk 25, don't use system
 glfw by default

LWJGL uses its own glfw fork, and Minecraft 26.1 will crash if you use
the system one.

For those who prefer to use Wayland, you can add `-DMC_DEBUG_ENABLED`
and `-DMC_DEBUG_PREFER_WAYLAND` on JVM arguments to enable Wayland
support, and LWJGL requires libxkbcommon to work on Wayland.

For those who still need system glfw, you can enable it in the advanced
settings of HMCL.
---
 pkgs/by-name/hm/hmcl/package.nix | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/hm/hmcl/package.nix b/pkgs/by-name/hm/hmcl/package.nix
index 1192c1935d42..b1fbd152a13c 100644
--- a/pkgs/by-name/hm/hmcl/package.nix
+++ b/pkgs/by-name/hm/hmcl/package.nix
@@ -10,7 +10,7 @@
   copyDesktopItems,
   desktopToDarwinBundle,
   jdk,
-  jdk17,
+  jdk25,
   hmclJdk ? jdk.override {
     # Required by jar file
     enableJavaFX = true;
@@ -21,13 +21,14 @@
   },
   minecraftJdks ? [
     hmclJdk
-    jdk17
+    jdk25
   ],
   libxxf86vm,
   libxtst,
   libxrandr,
   libxext,
   libxcursor,
+  libxkbcommon,
   libx11,
   xrandr,
   glib,
@@ -152,6 +153,7 @@ stdenv.mkDerivation (finalAttrs: {
     libxxf86vm
     libxext
     libxcursor
+    libxkbcommon
     libxrandr
     libxtst
     libpulseaudio
@@ -192,7 +194,6 @@ stdenv.mkDerivation (finalAttrs: {
         lib.makeBinPath (minecraftJdks ++ lib.optional stdenv.hostPlatform.isLinux xrandr)
       }" \
       --run 'cd $HOME' \
-      ${lib.optionalString stdenv.hostPlatform.isLinux ''--prefix JAVA_TOOL_OPTIONS " " "-Dorg.lwjgl.glfw.libname=${lib.getLib glfw3'}/lib/libglfw.so"''} \
       ''${gappsWrapperArgs[@]}
   '';
 
@@ -212,6 +213,15 @@ stdenv.mkDerivation (finalAttrs: {
       Hello Minecraft! Launcher (HMCL) is a free, open-source, and cross-platform Minecraft launcher.
       It provides comprehensive support for managing multiple game versions and mod loaders,
       including Forge, NeoForge, Fabric, Quilt, LiteLoader, and OptiFine.
+
+      Starting with Minecraft 26.1, Wayland support can be enabled
+      by adding the JDK arguments -DMC_DEBUG_ENABLED and
+      -DMC_DEBUG_PREFER_WAYLAND. If needed, configure them in
+      HMCL -> Advanced Settings -> JVM Options -> JVM Arguments.
+
+      Users who are still on an older version and want to use Wayland should
+      enable HMCL -> Advanced Settings -> Workaround -> Use System GLFW.
+      Otherwise, keep it disabled.
     '';
     maintainers = with lib.maintainers; [
       daru-san

From ef4ec75a15edf67ad9464e8f26051b4ebde0daef Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Tue, 24 Nov 2020 22:21:47 +0700
Subject: [PATCH 57/89] gforth: fix cross-compilation

Co-authored-by: Artturin <Artturin@artturin.com>
---
 pkgs/by-name/gf/gforth/package.nix | 44 ++++++++++++++++++++++++++----
 1 file changed, 39 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/gf/gforth/package.nix b/pkgs/by-name/gf/gforth/package.nix
index 4ff19e15c911..bed387a3214a 100644
--- a/pkgs/by-name/gf/gforth/package.nix
+++ b/pkgs/by-name/gf/gforth/package.nix
@@ -2,7 +2,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  callPackage,
+  buildPackages,
   autoreconfHook,
   gitUpdater,
   texinfo,
@@ -11,8 +11,8 @@
 }:
 
 let
-  swig = callPackage ./swig.nix { };
-  bootForth = callPackage ./boot-forth.nix { };
+  swig = buildPackages.callPackage ./swig.nix { };
+  bootForth = buildPackages.callPackage ./boot-forth.nix { };
   lispDir = "${placeholder "out"}/share/emacs/site-lisp";
 in
 stdenv.mkDerivation (finalAttrs: {
@@ -32,9 +32,14 @@ stdenv.mkDerivation (finalAttrs: {
     writableTmpDirAsHomeHook
     autoreconfHook
     texinfo
-    bootForth
     swig
-  ];
+  ]
+  ++ (
+    if (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) then
+      [ buildPackages.gforth ]
+    else
+      [ bootForth ]
+  );
 
   buildInputs = [
     libffi
@@ -47,12 +52,41 @@ stdenv.mkDerivation (finalAttrs: {
   ]
   ++ lib.optionals (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) [
     "--build=x86_64-apple-darwin"
+  ]
+  ++ lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
+    # Tries to run ./engine/gforth-ll
+    "--without-check"
+    # Use build-platform CC for helper programs that must run during build
+    "HOSTCC=${buildPackages.stdenv.cc}/bin/cc"
+    # Tell gforth's libcc where to find the cross compiler
+    "CROSS_PREFIX=${stdenv.hostPlatform.config}-"
+  ];
+
+  env = lib.optionalAttrs (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) {
+    # Tell gforth's libcc to prefix compiler commands with the cross-compilation target
+    CROSS_PREFIX = "${stdenv.hostPlatform.config}-";
+  };
+
+  makeFlags = lib.optionals (stdenv.buildPlatform != stdenv.hostPlatform) [
+    "DITCENGINE=${buildPackages.gforth}/bin/gforth-ditc"
+    "GFORTH=${buildPackages.gforth}/bin/gforth"
+    "ENGINE=${buildPackages.gforth}/bin/gforth" # for ./preforth
   ];
 
   preConfigure = ''
     mkdir -p ${lispDir}
   '';
 
+  postConfigure = lib.optionalString (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    # Put the project-local (cross-aware) libtool first in PATH
+    mkdir -p .cross-bin
+    ln -sf "$PWD/libtool" .cross-bin/libtool
+    ln -sf "$PWD/libtool" ".cross-bin/${stdenv.hostPlatform.config}-libtool"
+    export PATH="$PWD/.cross-bin:$PATH"
+    # Remove 'check' from the default 'all' target (can't run cross binaries)
+    sed -i 's/^\(all:.*\) check/\1/' Makefile
+  '';
+
   passthru.updateScript = gitUpdater { };
 
   meta = {

From 70a747a8abe9684c42ecdd5ff54b53bd53b4c65a Mon Sep 17 00:00:00 2001
From: Pascal Dietrich <cameo007@mintux.de>
Date: Sun, 19 Apr 2026 11:16:48 +0200
Subject: [PATCH 58/89] rgx: 0.10.2 -> 0.12.0

---
 pkgs/by-name/rg/rgx/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/rg/rgx/package.nix b/pkgs/by-name/rg/rgx/package.nix
index d5c0a4692d81..4f62aa8ac97b 100644
--- a/pkgs/by-name/rg/rgx/package.nix
+++ b/pkgs/by-name/rg/rgx/package.nix
@@ -7,16 +7,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "rgx";
-  version = "0.10.2";
+  version = "0.12.0";
 
   src = fetchFromGitHub {
     owner = "brevity1swos";
     repo = "rgx";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-lZA8Tfyneg8cnBeCf0abgPr9232a1OGBfOJEBnU2l+s=";
+    hash = "sha256-JLFJGMwKQqkrVwck6gd79AzSVL0fRHJ8jo73+EEdYlA=";
   };
 
-  cargoHash = "sha256-DOIQaqoUkR1KpQURC89PRds0wJkroSYufbKz62rjSB4=";
+  cargoHash = "sha256-D609cDiJ+L/iGtC9dKwU5dgz4+X3//6qiFjWixBBqhg=";
 
   buildInputs = [ pcre2 ];
 

From a1e64ff70e2835323d217283e4d63d8a534690cc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 19 Apr 2026 10:18:22 +0000
Subject: [PATCH 59/89] sampo: 0.17.3 -> 0.17.4

---
 pkgs/by-name/sa/sampo/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sa/sampo/package.nix b/pkgs/by-name/sa/sampo/package.nix
index aaa697d14708..37e2834096c2 100644
--- a/pkgs/by-name/sa/sampo/package.nix
+++ b/pkgs/by-name/sa/sampo/package.nix
@@ -9,20 +9,20 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "sampo";
-  version = "0.17.3";
+  version = "0.17.4";
 
   src = fetchFromGitHub {
     owner = "bruits";
     repo = "sampo";
     tag = "sampo-v${finalAttrs.version}";
-    hash = "sha256-g/cl24IUTQ2Tqxfzfsx3yxCgsbiFOUWKy1JisUhQ3wg=";
+    hash = "sha256-P+CekuDM3u+iG2HmCNWxZoTCaKtAUMnrNre4zeGNPrQ=";
   };
 
   nativeBuildInputs = [ pkg-config ];
 
   buildInputs = [ openssl ];
 
-  cargoHash = "sha256-wd76EJeKrUH/h6Net3vwROw83sXjAPXX0N1ckYDMulc=";
+  cargoHash = "sha256-udMpH0LWNqPTORSb1/c686stgvti5shx/O9rcH7YZNs=";
 
   cargoBuildFlags = [
     "-p"

From bb8e1c54e9b912154d7dc2fbb17f0e2c82f90f27 Mon Sep 17 00:00:00 2001
From: jopejoe1 <jopejoe1@missing.ninja>
Date: Sun, 9 Nov 2025 22:17:25 +0100
Subject: [PATCH 60/89] lib.licenses: add compound licenses

---
 ci/OWNERS                          |   2 +-
 lib/default.nix                    |   2 +-
 lib/licenses/default.nix           |   7 ++
 lib/licenses/helpers.nix           | 152 +++++++++++++++++++++++++++++
 lib/{ => licenses}/licenses.nix    |   1 +
 lib/licenses/operators.nix         | 110 +++++++++++++++++++++
 pkgs/stdenv/generic/check-meta.nix |   6 +-
 7 files changed, 277 insertions(+), 3 deletions(-)
 create mode 100644 lib/licenses/default.nix
 create mode 100644 lib/licenses/helpers.nix
 rename lib/{ => licenses}/licenses.nix (99%)
 create mode 100644 lib/licenses/operators.nix

diff --git a/ci/OWNERS b/ci/OWNERS
index b8fc4ecf920c..1b4b3e68ef9b 100644
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -268,7 +268,7 @@ pkgs/development/python-modules/buildcatrust/ @ajs124 @lukegb @mweinelt
 /pkgs/applications/editors/jetbrains @leona-ya @theCapypara
 
 # Licenses
-/lib/licenses.nix @alyssais @emilazy @jopejoe1
+/lib/licenses @alyssais @emilazy @jopejoe1
 
 # Qt
 /pkgs/development/libraries/qt-5 @K900 @NickCao @SuperSandro2000 @ttuegel
diff --git a/lib/default.nix b/lib/default.nix
index 15949d1cdf36..751738a98965 100644
--- a/lib/default.nix
+++ b/lib/default.nix
@@ -73,7 +73,7 @@ let
       types = callLibs ./types.nix;
 
       # constants
-      licenses = callLibs ./licenses.nix;
+      licenses = callLibs ./licenses;
       sourceTypes = callLibs ./source-types.nix;
       systems = callLibs ./systems;
 
diff --git a/lib/licenses/default.nix b/lib/licenses/default.nix
new file mode 100644
index 000000000000..7e260e98833f
--- /dev/null
+++ b/lib/licenses/default.nix
@@ -0,0 +1,7 @@
+{ lib }:
+let
+  licenses = import ./licenses.nix { inherit lib; };
+  operators = import ./operators.nix;
+  helpers = import ./helpers.nix { inherit lib; };
+in
+licenses // operators // helpers
diff --git a/lib/licenses/helpers.nix b/lib/licenses/helpers.nix
new file mode 100644
index 000000000000..b234515284f8
--- /dev/null
+++ b/lib/licenses/helpers.nix
@@ -0,0 +1,152 @@
+{ lib }:
+rec {
+  /**
+    Evaluate a license expression for a given predicate.
+
+    # Example
+
+    ```nix
+    evaluateProperty (x: x.free) true (with lib.licenses; AND [ ncsa (WITH asl20 llvm-exception) ])
+    ```
+    # Type
+
+    ```
+    evaluateProperty :: Function -> Bool -> AttrSet -> Bool
+    ```
+
+    # Arguments
+
+    - [predicate] checks for each license included in the license expression
+    - [permissive] whether to apply checks permissive or reciprocal
+    - [license] license expression to check
+  */
+  evaluateProperty =
+    predicate: permissive: license:
+    let
+      OR = if permissive then lib.any else lib.all;
+      AND = if permissive then lib.all else lib.any;
+    in
+    if license.licenseType == "simple" then
+      predicate license
+    else if license.licenseType == "compound" then
+      if license.operator == "OR" then
+        OR (x: evaluateProperty predicate permissive x) license.licenses
+      else if license.operator == "AND" then
+        AND (x: evaluateProperty predicate permissive x) license.licenses
+      else
+        throw "Unknown license operator"
+    else if license.licenseType == "exception" then
+      AND (x: evaluateProperty predicate permissive x) [
+        license.license
+        license.exception
+      ]
+    else if license.licenseType == "plus" then
+      evaluateProperty predicate permissive license.license
+    else
+      throw "Unknown license type or legacy license";
+
+  /**
+    Check whether a license expression is free.
+
+    # Example
+
+    ```nix
+    isFree (with lib.licenses; (AND [ ncsa (WITH asl20 llvm-exception) ]))
+    => true
+    ```
+
+    # Type
+
+    ```
+    isFree :: AttrSet -> Bool
+    ```
+
+    # Arguments
+
+    - [license] License expression to check if free
+  */
+  isFree = evaluateProperty (x: x.free) true;
+
+  /**
+    Check whether a license expression is redistributable.
+
+    # Example
+
+    ```nix
+    isRedistributable (with lib.licenses; (AND [ ncsa (WITH asl20 llvm-exception) ]))
+    => true
+    ```
+
+    # Type
+
+    ```
+    isRedistributable :: AttrSet -> Bool
+    ```
+
+    # Arguments
+
+    - [license] License expression to check if redistributable
+  */
+  isRedistributable = evaluateProperty (x: x.redistributable) true;
+
+  /**
+    Check whether any of the given licenses is required in the license expression.
+
+    # Example
+
+    ```nix
+    containsLicenses [ lib.licenses.asl20 ] (with lib.licenses; (AND [ ncsa (WITH asl20 llvm-exception) ]))
+    => true
+    ```
+
+    # Type
+
+    ```
+    containsLicenses :: List -> AttrSet -> Bool
+    ```
+
+    # Arguments
+
+    - [licenses] List of licenses to look
+    - [license] License expression to check
+  */
+  containsLicenses = licenses: evaluateProperty (x: lib.lists.elem x licenses) false;
+
+  /**
+    Convert a license expression to an SPDX license expression string.
+
+    # Example
+
+    ```nix
+    toSPDX (with lib.licenses; AND [ ncsa (WITH asl20 llvm-exception) ])
+    => "NCSA AND (Apache-2.0 WITH LLVM-exception)"
+    ```
+
+    # Type
+
+    ```
+    toSPDX :: AttrSet -> String
+    ```
+
+    # Arguments
+
+    - [license] License expression which to convert to spdx expression
+  */
+  toSPDX =
+    license:
+    let
+      mkBracket =
+        x:
+        if x.licenseType == "compound" || x.licenseType == "exception" then "(${toSPDX x})" else toSPDX x;
+    in
+    if license.licenseType == "simple" then
+      license.spdxId or "LicenseRef-nixos-${license.shortName}"
+    else if license.licenseType == "compound" then
+      lib.concatMapStringsSep " ${license.operator} " (x: mkBracket x) license.licenses
+    else if license.licenseType == "exception" then
+      "${mkBracket license.license} ${license.operator} ${mkBracket license.exception}"
+    else if license.licenseType == "plus" then
+      "${mkBracket license.license}${license.operator}"
+    else
+      throw "Unknown license type";
+}
diff --git a/lib/licenses.nix b/lib/licenses/licenses.nix
similarity index 99%
rename from lib/licenses.nix
rename to lib/licenses/licenses.nix
index 416891232e84..56f29b690495 100644
--- a/lib/licenses.nix
+++ b/lib/licenses/licenses.nix
@@ -21,6 +21,7 @@ let
         deprecated
         redistributable
         ;
+      licenseType = "simple";
     }
     // optionalAttrs (attrs ? spdxId) {
       inherit spdxId;
diff --git a/lib/licenses/operators.nix b/lib/licenses/operators.nix
new file mode 100644
index 000000000000..c7dab4a1469a
--- /dev/null
+++ b/lib/licenses/operators.nix
@@ -0,0 +1,110 @@
+{
+  /**
+    This should be used when there is a choice of which license expression to use.
+    This is a disjunctive binary "OR" operator.
+
+    # Example
+
+    ```nix
+    OR [ lib.licenses.mit lib.licenses.asl20 ]
+    => { licenseType = "compound"; operator = "OR"; licenses = [ lib.licenses.mit lib.licenses.asl20 ] };
+    ```
+
+    # Type
+
+    ```
+    OR :: List -> AttrSet
+    ```
+
+    # Arguments
+
+    - [licenses] Possible licenses to choose from
+  */
+  OR = licenses: {
+    licenseType = "compound";
+    operator = "OR";
+    inherit licenses;
+  };
+
+  /**
+     Create a compound licenses where the user needs to follow both licenses,
+     eqivialent of spdx `and` modifier.
+
+    # Example
+
+    ```nix
+    AND [ lib.licenses.mit lib.licenses.asl20 ]
+    => { licenseType = "compound"; operator = "AND"; licenses = [ lib.licenses.mit lib.licenses.asl20 ] };
+    ```
+
+    # Type
+
+    ```
+    AND :: List -> AttrSet
+    ```
+
+    # Arguments
+
+    - [licenses] Licenses required to use
+  */
+  AND = licenses: {
+    licenseType = "compound";
+    operator = "AND";
+    inherit licenses;
+  };
+
+  /**
+     Create a licenses exception where a license has a license exception,
+     eqivialent of spdx `with` modifier.
+
+    # Example
+
+    ```nix
+    WITH lib.licenses.lgpl21Only lib.licenses.ocamlLgplLinkingException
+    => { licenseType = "exception"; operator = "WITH"; license = lib.licenses.lgpl21Only; exception = lib.licenses.ocamlLgplLinkingException; };
+    ```
+
+    # Type
+
+    ```
+    WITH :: AttrSet -> AttrSet -> AttrSet
+    ```
+
+    # Arguments
+
+    - [license] License to which the exception applies
+    - [exception] Exception to apply
+  */
+  WITH = license: exception: {
+    licenseType = "compound";
+    operator = "WITH";
+    inherit license exception;
+  };
+
+  /**
+     Create a licenses which can be upgraded to any later version of itself,
+     eqivialent of spdx `+` modifier
+
+    # Example
+
+    ```nix
+    PLUS lib.licenses.lgpl21Only
+    => { licenseType = "plus"; operator = "+"; license = lib.licenses.lgpl21Only; };
+    ```
+
+    # Type
+
+    ```
+    PLUS :: AttrSet -> AttrSet
+    ```
+
+    # Arguments
+
+    - [license] License to wich apply an exception
+  */
+  PLUS = license: {
+    licenseType = "plus";
+    operator = "+";
+    inherit license;
+  };
+}
diff --git a/pkgs/stdenv/generic/check-meta.nix b/pkgs/stdenv/generic/check-meta.nix
index fbf72005f92d..6c3a49c4957c 100644
--- a/pkgs/stdenv/generic/check-meta.nix
+++ b/pkgs/stdenv/generic/check-meta.nix
@@ -90,6 +90,8 @@ let
       && (
         if isList attrs.meta.license then
           any (l: elem l list) attrs.meta.license
+        else if attrs.meta.license ? "type" then
+          lib.licenses.containsLicenses list attrs.meta.license
         else
           elem attrs.meta.license list
       );
@@ -103,7 +105,9 @@ let
 
   isUnfree =
     licenses:
-    if isAttrs licenses then
+    if isAttrs licenses && licenses ? "type" then
+      !(lib.licenses.isFree licenses)
+    else if isAttrs licenses then
       !(licenses.free or true)
     # TODO: Returning false in the case of a string is a bug that should be fixed.
     # In a previous implementation of this function the function body

From dbdb37908f5393fb4dc5ebcae799f86f72b0f27c Mon Sep 17 00:00:00 2001
From: jopejoe1 <jopejoe1@missing.ninja>
Date: Thu, 22 Jan 2026 20:36:13 +0100
Subject: [PATCH 61/89] lib/tests: add tests for lib.licenses

---
 lib/licenses/operators.nix |  6 +--
 lib/tests/misc.nix         | 99 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 102 insertions(+), 3 deletions(-)

diff --git a/lib/licenses/operators.nix b/lib/licenses/operators.nix
index c7dab4a1469a..db7cc25d37c6 100644
--- a/lib/licenses/operators.nix
+++ b/lib/licenses/operators.nix
@@ -76,7 +76,7 @@
     - [exception] Exception to apply
   */
   WITH = license: exception: {
-    licenseType = "compound";
+    licenseType = "exception";
     operator = "WITH";
     inherit license exception;
   };
@@ -88,8 +88,8 @@
     # Example
 
     ```nix
-    PLUS lib.licenses.lgpl21Only
-    => { licenseType = "plus"; operator = "+"; license = lib.licenses.lgpl21Only; };
+    PLUS lib.licenses.eupl11
+    => { licenseType = "plus"; operator = "+"; license = lib.licenses.eupl11; };
     ```
 
     # Type
diff --git a/lib/tests/misc.nix b/lib/tests/misc.nix
index da0979756720..916994152754 100644
--- a/lib/tests/misc.nix
+++ b/lib/tests/misc.nix
@@ -5012,4 +5012,103 @@ runTests {
   testReplaceElemAtOutOfRange = testingThrow (lib.replaceElemAt [ 1 2 3 ] 5 "a");
 
   testReplaceElemAtNegative = testingThrow (lib.replaceElemAt [ 1 2 3 ] (-1) "a");
+
+  testIsFree = {
+    expr = lib.licenses.isFree (
+      lib.licenses.AND [
+        (lib.licenses.mit)
+        (lib.licenses.OR [
+          lib.licenses.free
+          lib.licenses.unfree
+        ])
+        (lib.licenses.WITH lib.licenses.asl20 lib.licenses.llvm-exception)
+        (lib.licenses.PLUS lib.licenses.eupl11)
+      ]
+    );
+    expected = true;
+  };
+
+  testIsUnfree = {
+    expr = lib.licenses.isFree (
+      lib.licenses.AND [
+        (lib.licenses.mit)
+        (lib.licenses.OR [ lib.licenses.unfree ])
+        (lib.licenses.WITH lib.licenses.asl20 lib.licenses.llvm-exception)
+        (lib.licenses.PLUS lib.licenses.eupl11)
+      ]
+    );
+    expected = false;
+  };
+
+  testIsRedistributable = {
+    expr = lib.licenses.isRedistributable (
+      lib.licenses.AND [
+        (lib.licenses.mit)
+        (lib.licenses.OR [
+          lib.licenses.free
+          lib.licenses.unfree
+        ])
+        (lib.licenses.WITH lib.licenses.asl20 lib.licenses.llvm-exception)
+        (lib.licenses.PLUS lib.licenses.eupl11)
+      ]
+    );
+    expected = true;
+  };
+
+  testIsUnredistributable = {
+    expr = lib.licenses.isRedistributable (
+      lib.licenses.AND [
+        (lib.licenses.mit)
+        (lib.licenses.OR [ lib.licenses.unfree ])
+        (lib.licenses.WITH lib.licenses.asl20 lib.licenses.llvm-exception)
+        (lib.licenses.PLUS lib.licenses.eupl11)
+      ]
+    );
+    expected = false;
+  };
+
+  testContainsLicenses = {
+    expr = lib.licenses.containsLicenses [ lib.licenses.mit ] (
+      lib.licenses.AND [
+        (lib.licenses.mit)
+        (lib.licenses.OR [
+          lib.licenses.free
+          lib.licenses.unfree
+        ])
+        (lib.licenses.WITH lib.licenses.asl20 lib.licenses.llvm-exception)
+        (lib.licenses.PLUS lib.licenses.eupl11)
+      ]
+    );
+    expected = true;
+  };
+
+  testToSPDX = {
+    expr = lib.licenses.toSPDX (
+      lib.licenses.AND [
+        (lib.licenses.mit)
+        (lib.licenses.OR [
+          lib.licenses.free
+          lib.licenses.unfree
+        ])
+        (lib.licenses.WITH lib.licenses.asl20 lib.licenses.llvm-exception)
+        (lib.licenses.PLUS lib.licenses.eupl11)
+      ]
+    );
+    expected = "MIT AND (LicenseRef-nixos-free OR LicenseRef-nixos-unfree) AND (Apache-2.0 WITH LLVM-exception) AND EUPL-1.1+";
+  };
+
+  testEvaluateProperty = {
+    expr = lib.licenses.evaluateProperty (x: x.deprecated) true (
+      lib.licenses.AND [
+        (lib.licenses.mit)
+        (lib.licenses.OR [
+          lib.licenses.free
+          lib.licenses.unfree
+        ])
+        (lib.licenses.WITH lib.licenses.asl20 lib.licenses.llvm-exception)
+        (lib.licenses.PLUS lib.licenses.eupl11)
+      ]
+    );
+    expected = false;
+  };
 }

From baf97485d9bfd2255839b5b7d67ca2ce69979383 Mon Sep 17 00:00:00 2001
From: jopejoe1 <jopejoe1@missing.ninja>
Date: Sun, 9 Nov 2025 22:44:56 +0100
Subject: [PATCH 62/89] llvm: make use of compound licenses

---
 .../compilers/llvm/common/common-let.nix       | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/development/compilers/llvm/common/common-let.nix b/pkgs/development/compilers/llvm/common/common-let.nix
index 84fd098ff3fa..d8b636feac5d 100644
--- a/pkgs/development/compilers/llvm/common/common-let.nix
+++ b/pkgs/development/compilers/llvm/common/common-let.nix
@@ -12,19 +12,19 @@ rec {
   llvm_meta = {
     license =
       with lib.licenses;
-      [ ncsa ]
-      ++
-        # Contributions after June 1st, 2024 are only licensed under asl20 and
-        # llvm-exception: https://github.com/llvm/llvm-project/pull/92394
-        lib.optionals (lib.versionAtLeast release_version "19") [
-          asl20
-          llvm-exception
-        ];
+      # Contributions after June 1st, 2024 are only licensed under asl20 and
+      # llvm-exception: https://github.com/llvm/llvm-project/pull/92394
+      if lib.versionAtLeast release_version "19" then
+        AND [
+          ncsa
+          (WITH asl20 llvm-exception)
+        ]
+      else
+        ncsa;
     teams = [
       lib.teams.llvm
       lib.teams.security-review
     ];
-
     # See llvm/cmake/config-ix.cmake.
     platforms =
       lib.platforms.aarch64

From 89ad9afe537050399845361a9da96b2b8b93021a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 19 Apr 2026 10:54:11 +0000
Subject: [PATCH 63/89] typora: 1.13.2 -> 1.13.4

---
 pkgs/by-name/ty/typora/package.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ty/typora/package.nix b/pkgs/by-name/ty/typora/package.nix
index ac2fb3873462..b86c2fc588ea 100644
--- a/pkgs/by-name/ty/typora/package.nix
+++ b/pkgs/by-name/ty/typora/package.nix
@@ -20,7 +20,7 @@
 
 let
   pname = "typora";
-  version = "1.13.2";
+  version = "1.13.4";
 
   passthru = {
     sources = {
@@ -29,21 +29,21 @@ let
           "https://download.typora.io/linux/typora_${version}_amd64.deb"
           "https://downloads.typoraio.cn/linux/typora_${version}_amd64.deb"
         ];
-        hash = "sha256-oMb57//kg8TldZpWD0kaNYhveDe9MXHu9IMeuIvGcq4=";
+        hash = "sha256-aEgp0j6HGZePKwc21LvMpmXk7S5cgcUttpxl3fQw9ak=";
       };
       aarch64-linux = fetchurl {
         urls = [
           "https://download.typora.io/linux/typora_${version}_arm64.deb"
           "https://downloads.typoraio.cn/linux/typora_${version}_arm64.deb"
         ];
-        hash = "sha256-fa/jvmhQ/tx3JWCDwNxRW+WTXnLYD+WrJoGJmes0JKs=";
+        hash = "sha256-hvEsnkjbEhZVOIGKGh9RloUBicKpSMzzBGMFtc+3EAk=";
       };
       aarch64-darwin = fetchurl {
         urls = [
           "https://download.typora.io/mac/Typora-${version}.dmg"
           "https://downloads.typoraio.cn/mac/Typora-${version}.dmg"
         ];
-        hash = "sha256-3wPZAuU2EE62M0F3TQw6aX5cHdeUmJuASWnlbMVmgss=";
+        hash = "sha256-3IyOFTLDkd43Tij1B1Tw0epZ8HwMiNMJHQJAGHCcP84=";
       };
     };
     updateScript = ./update.sh;

From 17fa4476062f8abf712c27590679a76c24952b21 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 19 Apr 2026 10:55:45 +0000
Subject: [PATCH 64/89] duckdb: 1.5.1 -> 1.5.2

---
 pkgs/by-name/du/duckdb/versions.json | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/du/duckdb/versions.json b/pkgs/by-name/du/duckdb/versions.json
index 14c629fe5313..6b16dcfd94a2 100644
--- a/pkgs/by-name/du/duckdb/versions.json
+++ b/pkgs/by-name/du/duckdb/versions.json
@@ -1,6 +1,6 @@
 {
-  "version": "1.5.1",
-  "rev": "7dbb2e646fea939a89f10a55aa98c474cbb0c098",
-  "hash": "sha256-FygBpfhvezvUbI969Dta+vZOPt6BnSW2d5gO4I4oB2A=",
-  "python_hash": "sha256-ZB+Zcxg5VjBzfTkQk7TxoP9pw+hvOXpB2qqnqqmjhxM="
+  "version": "1.5.2",
+  "rev": "8a5851971fae891f292c2714d86046ee018e9737",
+  "hash": "sha256-FWoVF7s/n28NN1HtnO0Cr3YyoIDgJcWBtBiO7vWiSOU=",
+  "python_hash": "sha256-B14dXW5pPnToiKbSD9ACzNksIhBG+ui1P9l67Qyke8o="
 }

From efda700bc26762b26938131f22de70aa2938a0b4 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 19 Apr 2026 14:29:12 +0300
Subject: [PATCH 65/89] texpresso: set strictDeps and split to buildInputs

Should have been done correctly in the init commit of it (#299168).
---
 pkgs/by-name/te/texpresso/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/te/texpresso/package.nix b/pkgs/by-name/te/texpresso/package.nix
index ddda76c43b6d..6ee830876cdd 100644
--- a/pkgs/by-name/te/texpresso/package.nix
+++ b/pkgs/by-name/te/texpresso/package.nix
@@ -33,8 +33,13 @@ stdenv.mkDerivation (finalAttrs: {
       --replace-fail "LDCC=g++" "LDCC=${stdenv.cc.targetPrefix}c++"
   '';
 
+  strictDeps = true;
+
   nativeBuildInputs = [
     makeWrapper
+  ];
+
+  buildInputs = [
     mupdf
     SDL2
     re2c

From cab006059b55c82dd5ca7434dd005669db171a4b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 19 Apr 2026 11:36:18 +0000
Subject: [PATCH 66/89] python3Packages.actron-neo-api: 0.5.1 -> 0.5.4

---
 pkgs/development/python-modules/actron-neo-api/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/actron-neo-api/default.nix b/pkgs/development/python-modules/actron-neo-api/default.nix
index 2fced01e209c..7c82d159a8fd 100644
--- a/pkgs/development/python-modules/actron-neo-api/default.nix
+++ b/pkgs/development/python-modules/actron-neo-api/default.nix
@@ -12,14 +12,14 @@
 
 buildPythonPackage rec {
   pname = "actron-neo-api";
-  version = "0.5.1";
+  version = "0.5.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kclif9";
     repo = "actronneoapi";
     tag = "v${version}";
-    hash = "sha256-TEKRQQbmcDjHuZOte4fqZqLkw4Eo8FUgoyui3Mg8CqA=";
+    hash = "sha256-XyX9o1fIyY5TZqLzK1a+KLkLDVEorw2illg+lHutLtc=";
   };
 
   build-system = [

From e58fd79293963b5de30760d4637669e39efd1267 Mon Sep 17 00:00:00 2001
From: Sigmanificient <edhyjox@gmail.com>
Date: Sun, 19 Apr 2026 14:06:20 +0200
Subject: [PATCH 67/89] python3Packages.utitools: fix changelog

---
 pkgs/development/python-modules/utitools/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/utitools/default.nix b/pkgs/development/python-modules/utitools/default.nix
index 77586f27fb29..f003e336e480 100644
--- a/pkgs/development/python-modules/utitools/default.nix
+++ b/pkgs/development/python-modules/utitools/default.nix
@@ -34,7 +34,7 @@ buildPythonPackage (finalAttrs: {
   meta = {
     description = "Utilities for working with Uniform Type Identifiers";
     homepage = "https://github.com/RhetTbull/utitools";
-    changelog = "https://github.com/RhetTbull/osxphotos/blob/${finalAttrs.src.tag}/CHANGELOG.md";
+    changelog = "https://github.com/RhetTbull/utitools/blob/${finalAttrs.src.tag}/CHANGELOG.md";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ sigmanificient ];
   };

From 7d834b6fe543583513e9cd5f39d05f872d3161ee Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 19 Apr 2026 15:43:38 +0300
Subject: [PATCH 68/89] python3.pkgs.plopp: 26.3.1 -> 26.4.0

Diff: https://github.com/scipp/plopp/compare/26.3.1...26.4.0
---
 pkgs/development/python-modules/plopp/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/plopp/default.nix b/pkgs/development/python-modules/plopp/default.nix
index c9d83bceb510..63d7d9d2abc7 100644
--- a/pkgs/development/python-modules/plopp/default.nix
+++ b/pkgs/development/python-modules/plopp/default.nix
@@ -36,14 +36,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "plopp";
-  version = "26.3.1";
+  version = "26.4.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "scipp";
     repo = "plopp";
     tag = finalAttrs.version;
-    hash = "sha256-A8F2Gd0HmHRlusScFoFulsFaqaXA/HxmtT8ODdRLA+U=";
+    hash = "sha256-qjuhM0/qrGIZw00DOnaGODGHqzGn4r3gIAguJS5OPZ8=";
   };
 
   build-system = [

From 852d868fe65d8cdda0d004e4cc48fda7a69658c8 Mon Sep 17 00:00:00 2001
From: Philipp Bartsch <phil@grmr.de>
Date: Sun, 19 Apr 2026 14:43:00 +0200
Subject: [PATCH 69/89] coreboot-utils: mark nvramtool x86 only

accessors/cmos-hw-unix.c is only implemented for x86, else there is a
stub, but that fails to compile.

Fixes: https://github.com/NixOS/nixpkgs/issues/488459
---
 pkgs/tools/misc/coreboot-utils/default.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/tools/misc/coreboot-utils/default.nix b/pkgs/tools/misc/coreboot-utils/default.nix
index e1fa3c2b1b1d..0c0969c71f1e 100644
--- a/pkgs/tools/misc/coreboot-utils/default.nix
+++ b/pkgs/tools/misc/coreboot-utils/default.nix
@@ -110,6 +110,10 @@ let
       pname = "nvramtool";
       meta.description = "Read and write coreboot parameters and display information from the coreboot table in CMOS/NVRAM";
       meta.mainProgram = "nvramtool";
+      meta.platforms = [
+        "x86_64-linux"
+        "i686-linux"
+      ];
     };
     superiotool = generic {
       pname = "superiotool";

From d6db6d5512ef36f11e74bb78991a087ebf5a54f9 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 19 Apr 2026 15:50:35 +0300
Subject: [PATCH 70/89] python314Packages.plopp: improve comment of
 disabledTests

---
 pkgs/development/python-modules/plopp/default.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/development/python-modules/plopp/default.nix b/pkgs/development/python-modules/plopp/default.nix
index 63d7d9d2abc7..e9f0eff94a96 100644
--- a/pkgs/development/python-modules/plopp/default.nix
+++ b/pkgs/development/python-modules/plopp/default.nix
@@ -75,7 +75,7 @@ buildPythonPackage (finalAttrs: {
   ];
 
   disabledTests = lib.optionals (pythonAtLeast "3.14") [
-    # RuntimeError: There is no current event loop in thread 'MainThread'
+    # https://github.com/scipp/plopp/issues/508
     "test_move_cut"
     "test_value_cuts"
   ];

From 7ccf0f93e59c6ccffd9c3743b93c99118c7241c9 Mon Sep 17 00:00:00 2001
From: Nadir Ishiguro <23151917+nadir-ishiguro@users.noreply.github.com>
Date: Sun, 19 Apr 2026 14:57:13 +0200
Subject: [PATCH 71/89] okapi-ed: add nadir-ishiguro to maintainers

---
 pkgs/by-name/ok/okapi-ed/package.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ok/okapi-ed/package.nix b/pkgs/by-name/ok/okapi-ed/package.nix
index 2c0b9fbdc1f5..1148d36991b6 100644
--- a/pkgs/by-name/ok/okapi-ed/package.nix
+++ b/pkgs/by-name/ok/okapi-ed/package.nix
@@ -37,6 +37,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
     license = lib.licenses.asl20;
     mainProgram = "okapi";
     platforms = lib.platforms.unix;
-    maintainers = with lib.maintainers; [ toelke ];
+    maintainers = with lib.maintainers; [
+      toelke
+      nadir-ishiguro
+    ];
   };
 })

From c1f8fc71c5eaa3bd0a0dc2c62fbbe5464e43c0a0 Mon Sep 17 00:00:00 2001
From: Nadir Ishiguro <23151917+nadir-ishiguro@users.noreply.github.com>
Date: Sun, 19 Apr 2026 14:57:31 +0200
Subject: [PATCH 72/89] okapi-ed: add nix-update-script passthru, changelog

---
 pkgs/by-name/ok/okapi-ed/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/ok/okapi-ed/package.nix b/pkgs/by-name/ok/okapi-ed/package.nix
index 1148d36991b6..9c34d48ebbb7 100644
--- a/pkgs/by-name/ok/okapi-ed/package.nix
+++ b/pkgs/by-name/ok/okapi-ed/package.nix
@@ -5,6 +5,7 @@
   ripgrep,
   rustPlatform,
   versionCheckHook,
+  nix-update-script,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
   __structuredAttrs = true;
@@ -31,9 +32,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
   nativeInstallCheckInputs = [ versionCheckHook ];
   doInstallCheck = true;
 
+  passthru.updateScript = nix-update-script { };
+
   meta = {
     description = "Find lines across files by regex and edit them all at once with your $EDITOR";
     homepage = "https://github.com/nk9/okapi";
+    changelog = "https://github.com/nk9/okapi/releases/tag/v${finalAttrs.version}";
     license = lib.licenses.asl20;
     mainProgram = "okapi";
     platforms = lib.platforms.unix;

From d9b3863b3d5e02c8b3f31be589d461e25796b6d8 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 19 Apr 2026 14:24:43 +0000
Subject: [PATCH 73/89] python3Packages.aioamazondevices: 13.4.2 -> 13.4.3

---
 pkgs/development/python-modules/aioamazondevices/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/aioamazondevices/default.nix b/pkgs/development/python-modules/aioamazondevices/default.nix
index 6ad913beca89..5072a31cd6cb 100644
--- a/pkgs/development/python-modules/aioamazondevices/default.nix
+++ b/pkgs/development/python-modules/aioamazondevices/default.nix
@@ -16,14 +16,14 @@
 
 buildPythonPackage rec {
   pname = "aioamazondevices";
-  version = "13.4.2";
+  version = "13.4.3";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "chemelli74";
     repo = "aioamazondevices";
     tag = "v${version}";
-    hash = "sha256-df5f6meoMvrvS1d0U9M1XRXYC6t4e0AEmxfHOGD58CM=";
+    hash = "sha256-AH5edWwVEMo/TpnVbcOEC/oYI4DOQ5nqFfoFKeoI3Ok=";
   };
 
   build-system = [ poetry-core ];

From a8eca96edb54dde86c6a23116a505773b86b1bc6 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 19 Apr 2026 14:31:18 +0300
Subject: [PATCH 74/89] texpresso: small semantic changes

---
 pkgs/by-name/te/texpresso/package.nix | 48 ++++++++++++++++-----------
 1 file changed, 28 insertions(+), 20 deletions(-)

diff --git a/pkgs/by-name/te/texpresso/package.nix b/pkgs/by-name/te/texpresso/package.nix
index 6ee830876cdd..5427a98ddd5b 100644
--- a/pkgs/by-name/te/texpresso/package.nix
+++ b/pkgs/by-name/te/texpresso/package.nix
@@ -1,19 +1,25 @@
 {
-  stdenv,
   lib,
+  stdenv,
   fetchFromGitHub,
+
+  # nativeBuildInputs
   makeWrapper,
-  writeScript,
-  mupdf,
-  SDL2,
-  re2c,
+
+  # buildInputs
   freetype,
-  jbig2dec,
-  harfbuzz,
-  openjpeg,
   gumbo,
+  harfbuzz,
+  jbig2dec,
   libjpeg,
+  mupdf,
+  openjpeg,
+  re2c,
+  SDL2,
+
+  # passthru
   callPackage,
+  writeScript,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
@@ -40,28 +46,30 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   buildInputs = [
-    mupdf
-    SDL2
-    re2c
     freetype
-    jbig2dec
-    harfbuzz
-    openjpeg
     gumbo
+    harfbuzz
+    jbig2dec
     libjpeg
+    mupdf
+    openjpeg
+    re2c
+    SDL2
   ];
 
-  buildFlags = [ "texpresso" ];
+  buildFlags = [
+    "texpresso"
+  ];
 
-  env.NIX_CFLAGS_COMPILE = toString (
-    lib.optionals stdenv.hostPlatform.isDarwin [
+  env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
+    NIX_CFLAGS_COMPILE = toString [
       "-Wno-error=implicit-function-declaration"
-    ]
-  );
+    ];
+  };
 
   installPhase = ''
     runHook preInstall
-    install -Dm0755 -t "$out/bin/" "build/texpresso"
+    install -D -t "$out/bin/" "build/texpresso"
     runHook postInstall
   '';
 

From 75ec8afea2e1e8d0317c36f540c2d555851a41a7 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 12 Apr 2026 12:22:48 +0300
Subject: [PATCH 75/89] texpresso: 0.1 -> 0.1-unstable-2026-04-02

The main improvement of this update, is this:

https://github.com/let-def/texpresso/pull/102

Which allows us to avoid maintaining yet another derivation.
---
 pkgs/by-name/te/texpresso/package.nix  | 50 ++++++++++----------------
 pkgs/by-name/te/texpresso/tectonic.nix | 42 ----------------------
 2 files changed, 19 insertions(+), 73 deletions(-)
 delete mode 100644 pkgs/by-name/te/texpresso/tectonic.nix

diff --git a/pkgs/by-name/te/texpresso/package.nix b/pkgs/by-name/te/texpresso/package.nix
index 5427a98ddd5b..894dc5ea9b51 100644
--- a/pkgs/by-name/te/texpresso/package.nix
+++ b/pkgs/by-name/te/texpresso/package.nix
@@ -5,60 +5,65 @@
 
   # nativeBuildInputs
   makeWrapper,
+  pkg-config,
+  writeShellScriptBin,
 
   # buildInputs
+  fontconfig,
   freetype,
-  gumbo,
   harfbuzz,
+  icu,
   jbig2dec,
   libjpeg,
   mupdf,
-  openjpeg,
-  re2c,
   SDL2,
-
-  # passthru
-  callPackage,
-  writeScript,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "texpresso";
-  version = "0.1";
+  version = "0.1-unstable-2026-04-02";
 
   src = fetchFromGitHub {
     owner = "let-def";
     repo = "texpresso";
-    tag = "v${finalAttrs.version}";
-    hash = "sha256-d+wNQIysn3hdTQnHN9MJbFOIhJQ0ml6PoeuwsryntTI=";
+    rev = "96f008c94ece067fac8e896d0ab1808c948a4dd3";
+    hash = "sha256-ew7n3Sp4uYLv5jijRW2rRM9s63TQCeFgKXmmBXdYjx4=";
   };
 
   postPatch = ''
     substituteInPlace Makefile \
       --replace-fail "CC=gcc" "CC=${stdenv.cc.targetPrefix}cc" \
       --replace-fail "LDCC=g++" "LDCC=${stdenv.cc.targetPrefix}c++"
+    substituteInPlace src/engine/Makefile \
+      --replace-fail "_CC?=gcc" "_CC?=${stdenv.cc.targetPrefix}cc" \
+      --replace-fail "_LD?=g++" "_LD?=${stdenv.cc.targetPrefix}c++" \
+      --replace-fail "_CXX?=g++" "_CXX?=${stdenv.cc.targetPrefix}c++"
   '';
 
   strictDeps = true;
 
   nativeBuildInputs = [
     makeWrapper
+    pkg-config
+    # Especially for Darwin builds, we pretend we are Linux to avoid upstream's
+    # makefiles from using brew.
+    (writeShellScriptBin "uname" "echo Linux")
   ];
 
   buildInputs = [
+    fontconfig
     freetype
-    gumbo
     harfbuzz
+    icu
     jbig2dec
     libjpeg
     mupdf
-    openjpeg
-    re2c
     SDL2
   ];
 
   buildFlags = [
     "texpresso"
+    "texpresso-xetex"
   ];
 
   env = lib.optionalAttrs stdenv.hostPlatform.isDarwin {
@@ -70,27 +75,10 @@ stdenv.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
     install -D -t "$out/bin/" "build/texpresso"
+    install -D -t "$out/bin/" "build/texpresso-xetex"
     runHook postInstall
   '';
 
-  # needs to have texpresso-tonic on its path
-  postInstall = ''
-    wrapProgram $out/bin/texpresso \
-      --prefix PATH : ${lib.makeBinPath [ finalAttrs.finalPackage.passthru.tectonic ]}
-  '';
-
-  passthru = {
-    tectonic = callPackage ./tectonic.nix { };
-    updateScript = writeScript "update-texpresso" ''
-      #!/usr/bin/env nix-shell
-      #!nix-shell -i bash -p curl jq nix-update
-
-      tectonic_version="$(curl -s "https://api.github.com/repos/let-def/texpresso/contents/tectonic" | jq -r '.sha')"
-      nix-update texpresso
-      nix-update --version=branch=$tectonic_version texpresso.tectonic
-    '';
-  };
-
   meta = {
     inherit (finalAttrs.src.meta) homepage;
     description = "Live rendering and error reporting for LaTeX";
diff --git a/pkgs/by-name/te/texpresso/tectonic.nix b/pkgs/by-name/te/texpresso/tectonic.nix
deleted file mode 100644
index fe04d15191d7..000000000000
--- a/pkgs/by-name/te/texpresso/tectonic.nix
+++ /dev/null
@@ -1,42 +0,0 @@
-{
-  tectonic-unwrapped,
-  fetchFromGitHub,
-  rustPlatform,
-}:
-
-tectonic-unwrapped.overrideAttrs (
-  finalAttrs: prevAttrs: {
-    pname = "texpresso-tonic";
-    version = "0.15.0-unstable-2024-04-19";
-    src = fetchFromGitHub {
-      owner = "let-def";
-      repo = "tectonic";
-      rev = "b38cb3b2529bba947d520ac29fbb7873409bd270";
-      hash = "sha256-ap7fEPHsASAphIQkjcvk1CC7egTdxaUh7IpSS5os4W8=";
-      fetchSubmodules = true;
-    };
-
-    cargoHash = "sha256-mqhbIv5r/5EDRDfP2BymXv9se2NCKxzRGqNqwqbD9A0=";
-    # rebuild cargoDeps by hand because `.overrideAttrs cargoHash`
-    # does not reconstruct cargoDeps (a known limitation):
-    cargoDeps = rustPlatform.fetchCargoVendor {
-      inherit (finalAttrs) src;
-      name = "${finalAttrs.pname}-${finalAttrs.version}";
-      hash = finalAttrs.cargoHash;
-      patches = finalAttrs.cargoPatches;
-    };
-    # binary has a different name, bundled tests won't work
-    doCheck = false;
-    postInstall = ''
-      ${prevAttrs.postInstall or ""}
-
-      # Remove the broken `nextonic` symlink
-      # It points to `tectonic`, which doesn't exist because the exe is
-      # renamed to texpresso-tonic
-      rm $out/bin/nextonic
-    '';
-    meta = prevAttrs.meta // {
-      mainProgram = "texpresso-tonic";
-    };
-  }
-)

From a7fb6b70b317289a50cce780fe35e918d6bbdb83 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 19 Apr 2026 14:49:01 +0300
Subject: [PATCH 76/89] tectonic-unwrapped: install desktop files with 644
 permissions

---
 pkgs/by-name/te/tectonic-unwrapped/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/te/tectonic-unwrapped/package.nix b/pkgs/by-name/te/tectonic-unwrapped/package.nix
index ab4800a389fd..bce4aa2d1d38 100644
--- a/pkgs/by-name/te/tectonic-unwrapped/package.nix
+++ b/pkgs/by-name/te/tectonic-unwrapped/package.nix
@@ -79,8 +79,8 @@ buildRustPackage (finalAttrs: {
   + lib.optionalString clangStdenv.hostPlatform.isLinux ''
     substituteInPlace dist/appimage/tectonic.desktop \
       --replace Exec=tectonic Exec=$out/bin/tectonic
-    install -D dist/appimage/tectonic.desktop -t $out/share/applications/
-    install -D dist/appimage/tectonic.svg -t $out/share/icons/hicolor/scalable/apps/
+    install -Dm644 dist/appimage/tectonic.desktop -t $out/share/applications/
+    install -Dm644 dist/appimage/tectonic.svg -t $out/share/icons/hicolor/scalable/apps/
   '';
 
   doCheck = true;

From 33d317fc74424eacddfebc7905ed483ce74f1833 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 19 Apr 2026 14:49:28 +0300
Subject: [PATCH 77/89] tectonic-unwrapped: substitute Exec line with
 --replace-fail

---
 pkgs/by-name/te/tectonic-unwrapped/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/te/tectonic-unwrapped/package.nix b/pkgs/by-name/te/tectonic-unwrapped/package.nix
index bce4aa2d1d38..7b8be90f7423 100644
--- a/pkgs/by-name/te/tectonic-unwrapped/package.nix
+++ b/pkgs/by-name/te/tectonic-unwrapped/package.nix
@@ -78,7 +78,7 @@ buildRustPackage (finalAttrs: {
   ''
   + lib.optionalString clangStdenv.hostPlatform.isLinux ''
     substituteInPlace dist/appimage/tectonic.desktop \
-      --replace Exec=tectonic Exec=$out/bin/tectonic
+      --replace-fail Exec=tectonic Exec=$out/bin/tectonic
     install -Dm644 dist/appimage/tectonic.desktop -t $out/share/applications/
     install -Dm644 dist/appimage/tectonic.svg -t $out/share/icons/hicolor/scalable/apps/
   '';

From a4bcccc9c1dd2e1c684c830ebdb3182e177175f9 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Mon, 13 Apr 2026 11:02:02 +0300
Subject: [PATCH 78/89] tectonic-unwrapped: reorder expression arguments

---
 pkgs/by-name/te/tectonic-unwrapped/package.nix | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/te/tectonic-unwrapped/package.nix b/pkgs/by-name/te/tectonic-unwrapped/package.nix
index 7b8be90f7423..325744cdf537 100644
--- a/pkgs/by-name/te/tectonic-unwrapped/package.nix
+++ b/pkgs/by-name/te/tectonic-unwrapped/package.nix
@@ -10,13 +10,17 @@
   lib,
   clangStdenv,
   fetchFromGitHub,
+  fetchpatch2,
   rustPlatform,
+
+  # nativeBuildInputs
+  pkg-config,
+
+  # buildInputs
   fontconfig,
   harfbuzzFull,
   openssl,
-  pkg-config,
   icu,
-  fetchpatch2,
 }:
 
 let
@@ -61,7 +65,9 @@ buildRustPackage (finalAttrs: {
 
   cargoHash = "sha256-OMa89riyopKMQf9E9Fr7Qs4hFfEfjnDFzaSWFtkYUXE=";
 
-  nativeBuildInputs = [ pkg-config ];
+  nativeBuildInputs = [
+    pkg-config
+  ];
 
   buildFeatures = [ "external-harfbuzz" ];
 

From a3d70cceac7181a6314b04a330448b2455652a3b Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Mon, 13 Apr 2026 11:04:28 +0300
Subject: [PATCH 79/89] tectonic-unwrapped: share passthru.tests with wrapped
 tectonic

---
 pkgs/by-name/te/tectonic-unwrapped/package.nix | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/pkgs/by-name/te/tectonic-unwrapped/package.nix b/pkgs/by-name/te/tectonic-unwrapped/package.nix
index 325744cdf537..649ded603f4d 100644
--- a/pkgs/by-name/te/tectonic-unwrapped/package.nix
+++ b/pkgs/by-name/te/tectonic-unwrapped/package.nix
@@ -21,6 +21,9 @@
   harfbuzzFull,
   openssl,
   icu,
+
+  # passthru.tests
+  tectonic,
 }:
 
 let
@@ -91,6 +94,10 @@ buildRustPackage (finalAttrs: {
 
   doCheck = true;
 
+  passthru = {
+    inherit (tectonic.passthru) tests;
+  };
+
   meta = {
     description = "Modernized, complete, self-contained TeX/LaTeX engine, powered by XeTeX and TeXLive";
     homepage = "https://tectonic-typesetting.github.io/";

From 9ee6e26cb952a007e2506530e243a86062af1e36 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 19 Apr 2026 14:59:05 +0300
Subject: [PATCH 80/89] tectonic-unwrapped: enable strictDeps and
 __structuredAttrs

---
 pkgs/by-name/te/tectonic-unwrapped/package.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/by-name/te/tectonic-unwrapped/package.nix b/pkgs/by-name/te/tectonic-unwrapped/package.nix
index 649ded603f4d..0e30d7c02156 100644
--- a/pkgs/by-name/te/tectonic-unwrapped/package.nix
+++ b/pkgs/by-name/te/tectonic-unwrapped/package.nix
@@ -98,6 +98,9 @@ buildRustPackage (finalAttrs: {
     inherit (tectonic.passthru) tests;
   };
 
+  strictDeps = true;
+  __structuredAttrs = true;
+
   meta = {
     description = "Modernized, complete, self-contained TeX/LaTeX engine, powered by XeTeX and TeXLive";
     homepage = "https://tectonic-typesetting.github.io/";

From 664ea371bb2a86d6153094e3988c793dba919f97 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Sun, 12 Apr 2026 09:42:33 +0300
Subject: [PATCH 81/89] tectonic{-unwrapped,}: 0.15.0 -> 0.16.8

Diff: https://github.com/tectonic-typesetting/tectonic/compare/tectonic@0.15.0...tectonic@0.16.8

Changelog: https://github.com/tectonic-typesetting/tectonic/blob/tectonic@0.16.8/CHANGELOG.md

Other note: The hard-coded bundle URL is now written into the unwrapped
derivation, and the comment of it was expanded and should explain why
this was done. Due to this change, overriding tectonic to use a
different default bundle will require either wrapping only `tectonic` to
use a different `--bundle` command line argument, or rebuilding the
unwrapped derivation with a different `env.TECTONIC_BUNDLE_LOCKED`.
---
 .../by-name/te/tectonic-unwrapped/package.nix | 79 ++++++++++---------
 ...0.15-fix-dangerous_implicit_autorefs.patch | 13 ---
 pkgs/by-name/te/tectonic/package.nix          |  9 ---
 pkgs/by-name/te/tectonic/tests.nix            |  2 +-
 4 files changed, 44 insertions(+), 59 deletions(-)
 delete mode 100644 pkgs/by-name/te/tectonic-unwrapped/tectonic-0.15-fix-dangerous_implicit_autorefs.patch

diff --git a/pkgs/by-name/te/tectonic-unwrapped/package.nix b/pkgs/by-name/te/tectonic-unwrapped/package.nix
index 0e30d7c02156..9fff6c7debb9 100644
--- a/pkgs/by-name/te/tectonic-unwrapped/package.nix
+++ b/pkgs/by-name/te/tectonic-unwrapped/package.nix
@@ -8,9 +8,8 @@
 
 {
   lib,
-  clangStdenv,
+  stdenv,
   fetchFromGitHub,
-  fetchpatch2,
   rustPlatform,
 
   # nativeBuildInputs
@@ -26,47 +25,18 @@
   tectonic,
 }:
 
-let
-
-  buildRustPackage = rustPlatform.buildRustPackage.override {
-    # use clang to work around build failure with GCC 14
-    # see: https://github.com/tectonic-typesetting/tectonic/issues/1263
-    stdenv = clangStdenv;
-  };
-
-in
-
-buildRustPackage (finalAttrs: {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tectonic";
-  version = "0.15.0";
+  version = "0.16.8";
 
   src = fetchFromGitHub {
     owner = "tectonic-typesetting";
     repo = "tectonic";
     rev = "tectonic@${finalAttrs.version}";
-    sha256 = "sha256-dZnUu0g86WJIIvwMgdmwb6oYqItxoYrGQTFNX7I61Bs=";
+    sha256 = "sha256-drQ8hCe5vJHewUTFJTfVOotFvuUX19dHQLu2nVIWKbQ=";
   };
 
-  patches = [
-    (fetchpatch2 {
-      # https://github.com/tectonic-typesetting/tectonic/pull/1155
-      name = "1155-fix-endless-reruns-when-generating-bbl";
-      url = "https://github.com/tectonic-typesetting/tectonic/commit/fbb145cd079497b8c88197276f92cb89685b4d54.patch";
-      hash = "sha256-6FW5MFkOWnqzYX8Eg5DfmLaEhVWKYVZwodE4SGXHKV0=";
-    })
-    ./tectonic-0.15-fix-dangerous_implicit_autorefs.patch
-  ];
-
-  cargoPatches = [
-    (fetchpatch2 {
-      # cherry-picked from https://github.com/tectonic-typesetting/tectonic/pull/1202
-      name = "1202-fix-build-with-rust-1_80-and-icu-75";
-      url = "https://github.com/tectonic-typesetting/tectonic/compare/19654bf152d602995da970f6164713953cffc2e6...6b49ca8db40aaca29cb375ce75add3e575558375.patch?full_index=1";
-      hash = "sha256-CgQBCFvfYKKXELnR9fMDqmdq97n514CzGJ7EBGpghJc=";
-    })
-  ];
-
-  cargoHash = "sha256-OMa89riyopKMQf9E9Fr7Qs4hFfEfjnDFzaSWFtkYUXE=";
+  cargoHash = "sha256-Hh2w8c/K+AXdX4p620fqVUttQPY33eVIAf0/VIFhHiY=";
 
   nativeBuildInputs = [
     pkg-config
@@ -81,17 +51,54 @@ buildRustPackage (finalAttrs: {
     openssl
   ];
 
+  # By default, tectonic looks up the latest bundle by opening this URL:
+  #
+  #   https://relay.fullyjustified.net/default_bundle_v${FORMAT_VERSION}.tar
+  #
+  # Where FORMAT_VERSION is defined here:
+  #
+  #   https://github.com/tectonic-typesetting/tectonic/blob/master/crates/engine_xetex/xetex/xetex_bindings.h
+  #
+  # When we updated the package, this URL redirects to the following:
+  #
+  #   https://data1.fullyjustified.net/tlextras-2022.0r0.tar
+  #
+  # The environment variable set below, sets the URL that will be used during
+  # runtime by default. We chose to hard-code a URL to a specific version of
+  # the web bundle, so that upstream won't update the `default_bundle` without
+  # us noticing, and break compatibility with our biber-for-tectonic package.
+  #
+  # This is in principle the right thing to do, ever since the 0.16.0 release.
+  # As opposed to what we had with version 0.15.0, we choose to not hard-code a
+  # --web-bundle (or --bundle) argument in the wrapper of the
+  # `tectonic-wrapped` package, as it is not compatible with nextonic, and
+  # `tectonic -X` commands of versions 0.16.0+ -- These commands require the
+  # `--bundle` argument to appear after the subcommand.
+  #
+  # Lastly, we might in the future need to update the bundle URL below if
+  # upstream will upload a new bundle. However, upstream hasn't updated a new
+  # bundle for a long time, see:
+  #
+  #   https://github.com/tectonic-typesetting/tectonic/issues/1269
+  #
+  env.TECTONIC_BUNDLE_LOCKED = "https://data1.fullyjustified.net/tlextras-2022.0r0.tar";
+
   postInstall = ''
     # Makes it possible to automatically use the V2 CLI API
     ln -s $out/bin/tectonic $out/bin/nextonic
   ''
-  + lib.optionalString clangStdenv.hostPlatform.isLinux ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
     substituteInPlace dist/appimage/tectonic.desktop \
       --replace-fail Exec=tectonic Exec=$out/bin/tectonic
     install -Dm644 dist/appimage/tectonic.desktop -t $out/share/applications/
     install -Dm644 dist/appimage/tectonic.svg -t $out/share/icons/hicolor/scalable/apps/
   '';
 
+  checkFlags = [
+    # Test fails due to tectonic bundle missing and can't be downloaded in the
+    # sandbox
+    "--skip=tests::no_segfault_after_failed_compilation"
+  ];
   doCheck = true;
 
   passthru = {
diff --git a/pkgs/by-name/te/tectonic-unwrapped/tectonic-0.15-fix-dangerous_implicit_autorefs.patch b/pkgs/by-name/te/tectonic-unwrapped/tectonic-0.15-fix-dangerous_implicit_autorefs.patch
deleted file mode 100644
index 883c38486a71..000000000000
--- a/pkgs/by-name/te/tectonic-unwrapped/tectonic-0.15-fix-dangerous_implicit_autorefs.patch
+++ /dev/null
@@ -1,13 +0,0 @@
-diff --git a/crates/engine_bibtex/src/xbuf.rs b/crates/engine_bibtex/src/xbuf.rs
-index 8f3949e7..c216eb4d 100644
---- a/crates/engine_bibtex/src/xbuf.rs
-+++ b/crates/engine_bibtex/src/xbuf.rs
-@@ -52,7 +52,7 @@ pub unsafe fn xrealloc_zeroed<T: SafelyZero>(
-     old: *mut [T],
-     new_len: usize,
- ) -> Option<&'static mut [T]> {
--    let old_len = (*old).len();
-+    let old_len = (&(*old)).len();
-     let new_size = new_len * mem::size_of::<T>();
-     // SAFETY: realloc can be called with any size, even 0, that will just deallocate and return null
-     let ptr = unsafe { xrealloc(old.cast(), new_size) }.cast::<T>();
diff --git a/pkgs/by-name/te/tectonic/package.nix b/pkgs/by-name/te/tectonic/package.nix
index 0f36036bfcfb..947bed1eeacf 100644
--- a/pkgs/by-name/te/tectonic/package.nix
+++ b/pkgs/by-name/te/tectonic/package.nix
@@ -1,7 +1,6 @@
 {
   lib,
   symlinkJoin,
-  tectonic,
   tectonic-unwrapped,
   biber-for-tectonic,
   makeBinaryWrapper,
@@ -19,13 +18,6 @@ symlinkJoin {
     unwrapped = tectonic-unwrapped;
     biber = biber-for-tectonic;
     tests = callPackage ./tests.nix { };
-
-    # The version locked tectonic web bundle, redirected from:
-    #   https://relay.fullyjustified.net/default_bundle_v33.tar
-    # To check for updates, see:
-    #   https://github.com/tectonic-typesetting/tectonic/blob/master/crates/bundles/src/lib.rs
-    # ... and look up `get_fallback_bundle_url`.
-    bundleUrl = "https://data1.fullyjustified.net/tlextras-2022.0r0.tar";
   };
 
   # Replace the unwrapped tectonic with the one wrapping it with biber
@@ -48,7 +40,6 @@ symlinkJoin {
   + ''
     makeWrapper ${lib.getBin tectonic-unwrapped}/bin/tectonic $out/bin/tectonic \
       --prefix PATH : "${lib.getBin biber-for-tectonic}/bin" \
-      --add-flags "--web-bundle ${tectonic.passthru.bundleUrl}" \
       --inherit-argv0 ## make sure binary name e.g. `nextonic` is passed along
     ln -s $out/bin/tectonic $out/bin/nextonic
   '';
diff --git a/pkgs/by-name/te/tectonic/tests.nix b/pkgs/by-name/te/tectonic/tests.nix
index 04c91a1235c3..cb95d18de6ff 100644
--- a/pkgs/by-name/te/tectonic/tests.nix
+++ b/pkgs/by-name/te/tectonic/tests.nix
@@ -94,7 +94,7 @@ lib.mapAttrs networkRequiringTestPkg {
 
   workspace = ''
     tectonic -X new
-    cat Tectonic.toml | grep "${tectonic.bundleUrl}"
+    cat Tectonic.toml | grep "${tectonic.unwrapped.TECTONIC_BUNDLE_LOCKED}"
   '';
 
   /**

From 8dfa4f62c4a520a6c052de52164b1adc35b8c949 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Tue, 14 Apr 2026 12:53:45 +0300
Subject: [PATCH 82/89] tectonic-unwrapped: fix a substantial upstream bug

---
 pkgs/by-name/te/tectonic-unwrapped/package.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/by-name/te/tectonic-unwrapped/package.nix b/pkgs/by-name/te/tectonic-unwrapped/package.nix
index 9fff6c7debb9..ffb55ef972de 100644
--- a/pkgs/by-name/te/tectonic-unwrapped/package.nix
+++ b/pkgs/by-name/te/tectonic-unwrapped/package.nix
@@ -10,6 +10,7 @@
   lib,
   stdenv,
   fetchFromGitHub,
+  fetchpatch2,
   rustPlatform,
 
   # nativeBuildInputs
@@ -36,6 +37,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
     sha256 = "sha256-drQ8hCe5vJHewUTFJTfVOotFvuUX19dHQLu2nVIWKbQ=";
   };
 
+  patches = [
+    # Fixes a substantial MacOS arm64 bug, see:
+    # https://github.com/tectonic-typesetting/tectonic/pull/1346
+    (fetchpatch2 {
+      url = "https://github.com/tectonic-typesetting/tectonic/commit/5d95f47720e6518daa7164b097f207b772d565ac.patch";
+      hash = "sha256-GQPRwP9vljDIzs1uEBlnCdAGcvG/mLpw0WtM5wqobWg=";
+    })
+  ];
+
   cargoHash = "sha256-Hh2w8c/K+AXdX4p620fqVUttQPY33eVIAf0/VIFhHiY=";
 
   nativeBuildInputs = [

From 818bce69d9c751a06a2f9ea45814fd6a3f737fb8 Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Fri, 17 Apr 2026 15:16:38 +0300
Subject: [PATCH 83/89] tectonic-unwrapped: 0.16.8 -> 0.16.9

Diff: https://github.com/tectonic-typesetting/tectonic/compare/tectonic@0.16.8...tectonic@0.16.9

Changelog: https://github.com/tectonic-typesetting/tectonic/blob/tectonic@0.16.9/CHANGELOG.md
---
 pkgs/by-name/te/tectonic-unwrapped/package.nix | 16 +++-------------
 1 file changed, 3 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/te/tectonic-unwrapped/package.nix b/pkgs/by-name/te/tectonic-unwrapped/package.nix
index ffb55ef972de..a325bfbd6f79 100644
--- a/pkgs/by-name/te/tectonic-unwrapped/package.nix
+++ b/pkgs/by-name/te/tectonic-unwrapped/package.nix
@@ -10,7 +10,6 @@
   lib,
   stdenv,
   fetchFromGitHub,
-  fetchpatch2,
   rustPlatform,
 
   # nativeBuildInputs
@@ -28,25 +27,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "tectonic";
-  version = "0.16.8";
+  version = "0.16.9";
 
   src = fetchFromGitHub {
     owner = "tectonic-typesetting";
     repo = "tectonic";
     rev = "tectonic@${finalAttrs.version}";
-    sha256 = "sha256-drQ8hCe5vJHewUTFJTfVOotFvuUX19dHQLu2nVIWKbQ=";
+    sha256 = "sha256-5yphhmrrfgFwQ952eWpToyGfIJVJfV6y5w0BgznSOe0=";
   };
 
-  patches = [
-    # Fixes a substantial MacOS arm64 bug, see:
-    # https://github.com/tectonic-typesetting/tectonic/pull/1346
-    (fetchpatch2 {
-      url = "https://github.com/tectonic-typesetting/tectonic/commit/5d95f47720e6518daa7164b097f207b772d565ac.patch";
-      hash = "sha256-GQPRwP9vljDIzs1uEBlnCdAGcvG/mLpw0WtM5wqobWg=";
-    })
-  ];
-
-  cargoHash = "sha256-Hh2w8c/K+AXdX4p620fqVUttQPY33eVIAf0/VIFhHiY=";
+  cargoHash = "sha256-22Hy51zCzY2DRytcYHgwkI9+e/g52o1jy4eosvEm3KY=";
 
   nativeBuildInputs = [
     pkg-config

From a88b601ea35f3509ef1508e727be2892b42674de Mon Sep 17 00:00:00 2001
From: Doron Behar <doron.behar@gmail.com>
Date: Fri, 17 Apr 2026 15:44:37 +0300
Subject: [PATCH 84/89] tectonic-unwrapped: skip failing test on Darwin

---
 pkgs/by-name/te/tectonic-unwrapped/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/te/tectonic-unwrapped/package.nix b/pkgs/by-name/te/tectonic-unwrapped/package.nix
index a325bfbd6f79..27270b54c86b 100644
--- a/pkgs/by-name/te/tectonic-unwrapped/package.nix
+++ b/pkgs/by-name/te/tectonic-unwrapped/package.nix
@@ -98,6 +98,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     # Test fails due to tectonic bundle missing and can't be downloaded in the
     # sandbox
     "--skip=tests::no_segfault_after_failed_compilation"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # Test Panics only on Darwin, see:
+    # https://github.com/tectonic-typesetting/tectonic/issues/1352
+    "--skip=v2_watch_succeeds"
   ];
   doCheck = true;
 

From 2c3b812b0070f3700520d2631bcd80cc71bb2cfc Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 19 Apr 2026 15:08:10 +0000
Subject: [PATCH 85/89] python3Packages.tlds: 2026021400 -> 2026041800

---
 pkgs/development/python-modules/tlds/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/tlds/default.nix b/pkgs/development/python-modules/tlds/default.nix
index a297b802a9a1..526311fedecd 100644
--- a/pkgs/development/python-modules/tlds/default.nix
+++ b/pkgs/development/python-modules/tlds/default.nix
@@ -8,14 +8,14 @@
 
 buildPythonPackage (finalAttrs: {
   pname = "tlds";
-  version = "2026021400";
+  version = "2026041800";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "kichik";
     repo = "tlds";
     tag = finalAttrs.version;
-    hash = "sha256-IyIZCBlH918let5qa/fi/SYampE3E+yAVMG17nHF7mk=";
+    hash = "sha256-HMfAMYVNz/3lwCv5XTn7jSgFQgGX2uymTGxw8JcHeUU=";
   };
 
   nativeBuildInputs = [ setuptools ];

From 7d7a9f2257de11b158962bd1b23733f385793dbe Mon Sep 17 00:00:00 2001
From: Robert Hensing <robert@roberthensing.nl>
Date: Sun, 19 Apr 2026 13:37:39 +0100
Subject: [PATCH 86/89] nixosTests.nixos-test-driver.skip-typecheck: init

Simple regression test for https://github.com/NixOS/nixpkgs/pull/511225
---
 nixos/tests/all-tests.nix                     |  1 +
 .../nixos-test-driver/skip-typecheck.nix      | 21 +++++++++++++++++++
 2 files changed, 22 insertions(+)
 create mode 100644 nixos/tests/nixos-test-driver/skip-typecheck.nix

diff --git a/nixos/tests/all-tests.nix b/nixos/tests/all-tests.nix
index 767da3a67b16..f6093eb7e14a 100644
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -152,6 +152,7 @@ in
     ssh-backdoor = runTestOn [ "x86_64-linux" ] ./nixos-test-driver/ssh-backdoor.nix;
     console-log = runTest ./nixos-test-driver/console-log.nix;
     containers = runTest ./nixos-test-driver/containers.nix;
+    skip-typecheck = runTest ./nixos-test-driver/skip-typecheck.nix;
     driver-timeout =
       pkgs.runCommand "ensure-timeout-induced-failure"
         {
diff --git a/nixos/tests/nixos-test-driver/skip-typecheck.nix b/nixos/tests/nixos-test-driver/skip-typecheck.nix
new file mode 100644
index 000000000000..b36e4a819693
--- /dev/null
+++ b/nixos/tests/nixos-test-driver/skip-typecheck.nix
@@ -0,0 +1,21 @@
+/**
+  nixosTests.simple, but with skipTypeCheck.
+  This catches regressions in the wiring, e.g.
+  https://github.com/NixOS/nixpkgs/pull/511225
+*/
+{
+  name = "skip-typecheck";
+  meta = {
+    maintainers = [ ];
+  };
+
+  skipTypeCheck = true;
+
+  nodes.machine = { };
+
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("multi-user.target")
+    machine.shutdown()
+  '';
+}

From b787ee3d40fba82228e5dc39c145bbb30af999fb Mon Sep 17 00:00:00 2001
From: Ben Siraphob <bensiraphob@gmail.com>
Date: Tue, 14 Apr 2026 10:34:20 -0700
Subject: [PATCH 87/89] lib/modules: reduce allocations in evalModules and
 mergeModules
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- When `evalModules` is called without deprecated `args`/`check` parameters (the common case), avoid `modules ++ []` which copies the entire module list for no reason.
- `collectModules` was calling `collectStructuredModules` twice with identical arguments — once for `filterModules` and once for `toGraph`. Share the result via a `let` binding.
- Replace `zipAttrsWith (n: v: v)` with `zipAttrs`
- Replace `concatMap` with `filter`+`map` in `filterOverrides'`

NixOS minimal eval improvement: -5.0% list_concats, -1.2%
nrFunctionCalls, -0.7% nrThunks, -1.0% envs, -1.5% list_bytes.
---
 lib/modules.nix | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/lib/modules.nix b/lib/modules.nix
index 419fc750e8d9..e369d98a6426 100644
--- a/lib/modules.nix
+++ b/lib/modules.nix
@@ -589,6 +589,8 @@ let
     in
     modulesPath: initialModules: args: {
       modules = filterModules modulesPath (collectStructuredModules unknownModule "" initialModules args);
+      # Intentionally not shared with `modules` above: this allows `collected`
+      # to be garbage collected after `filterModules` returns.
       graph = toGraph modulesPath (collectStructuredModules unknownModule "" initialModules args);
     };
 
@@ -783,7 +785,7 @@ let
     prefix: modules: configs:
     let
       # an attrset 'name' => list of submodules that declare ‘name’.
-      declsByName = zipAttrsWith (n: v: v) (
+      declsByName = zipAttrs (
         map (
           module:
           let
@@ -838,7 +840,7 @@ let
         ) checkedConfigs
       );
       # extract the definitions for each loc
-      rawDefinitionsByName = zipAttrsWith (n: v: v) (
+      rawDefinitionsByName = zipAttrs (
         map (
           module:
           mapAttrs (n: value: {
@@ -1439,7 +1441,7 @@ let
         def: if def.value._type or "" == "override" then def // { value = def.value.content; } else def;
     in
     {
-      values = concatMap (def: if getPrio def == highestPrio then [ (strip def) ] else [ ]) defs;
+      values = map strip (filter (def: getPrio def == highestPrio) defs);
       inherit highestPrio;
     };
 

From 0607a2c71be54d0f7db7c7d382127ee996d1b13c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 19 Apr 2026 17:12:10 +0000
Subject: [PATCH 88/89] resterm: 0.26.2 -> 0.28.2

---
 pkgs/by-name/re/resterm/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/re/resterm/package.nix b/pkgs/by-name/re/resterm/package.nix
index 4d736bcf4541..e78d6658a9fd 100644
--- a/pkgs/by-name/re/resterm/package.nix
+++ b/pkgs/by-name/re/resterm/package.nix
@@ -8,13 +8,13 @@
 
 buildGoModule (finalAttrs: {
   pname = "resterm";
-  version = "0.26.2";
+  version = "0.28.2";
 
   src = fetchFromGitHub {
     owner = "unkn0wn-root";
     repo = "resterm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Addc59NlrD4GMEuir2BKoURDjMcqZYtAq4UPRCxNmCE=";
+    hash = "sha256-jJGL9oSThbFeO0c89LMFWVEzyrGeIWZDUKYVqOy2hMk=";
   };
 
   vendorHash = "sha256-AjckKD6NScBa8w9nWMdVExuNadz3vHnK854XXg3nj84=";

From 0c4c842ae81ef4aa2a537a9db714d3e511cda95e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 17 Apr 2026 23:42:57 +0000
Subject: [PATCH 89/89] python3Packages.pydo: 0.27.0 -> 0.30.0

---
 .../python-modules/pydo/default.nix            | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/pkgs/development/python-modules/pydo/default.nix b/pkgs/development/python-modules/pydo/default.nix
index 24e51eb5e74d..41f5447d3a56 100644
--- a/pkgs/development/python-modules/pydo/default.nix
+++ b/pkgs/development/python-modules/pydo/default.nix
@@ -2,27 +2,33 @@
   lib,
   buildPythonPackage,
   fetchFromGitHub,
+
+  # build-system
   poetry-core,
+
+  # dependencies
   azure-core,
   azure-identity,
   isodate,
   msrest,
+
+  # tests
   aioresponses,
   pytest-asyncio,
   pytestCheckHook,
   responses,
 }:
 
-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
   pname = "pydo";
-  version = "0.27.0";
+  version = "0.30.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "digitalocean";
     repo = "pydo";
-    tag = "v${version}";
-    hash = "sha256-2vJ/yOOJuil1oFWIYU2yV29RG/j92kpz0ubmJpyzS4U=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-tLw34aQ9gmKSQ/cy3Rz3eKqaw/Kv4lgS1saMYMCHPxo=";
   };
 
   build-system = [ poetry-core ];
@@ -52,9 +58,9 @@ buildPythonPackage rec {
   meta = {
     description = "Official DigitalOcean Client based on the DO OpenAPIv3 specification";
     homepage = "https://github.com/digitalocean/pydo";
-    changelog = "https://github.com/digitalocean/pydo/releases/tag/v${version}";
+    changelog = "https://github.com/digitalocean/pydo/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.asl20;
     platforms = lib.platforms.unix;
     maintainers = with lib.maintainers; [ ethancedwards8 ];
   };
-}
+})