From 72c7dd36151d26007d40bce359634bec5cfcba38 Mon Sep 17 00:00:00 2001
From: nani8ot <git@wiedemer.xyz>
Date: Thu, 3 Apr 2025 22:51:21 +0200
Subject: [PATCH 01/94] nixos/redlib: harden systemd service

---
 nixos/modules/services/misc/redlib.nix | 42 ++++++++++++++++++++++++++
 1 file changed, 42 insertions(+)

diff --git a/nixos/modules/services/misc/redlib.nix b/nixos/modules/services/misc/redlib.nix
index 3e3cd31a814c..5e3529fbc846 100644
--- a/nixos/modules/services/misc/redlib.nix
+++ b/nixos/modules/services/misc/redlib.nix
@@ -95,6 +95,47 @@ in
       environment = mapAttrs (_: v: if isBool v then boolToString' v else toString v) cfg.settings;
       serviceConfig =
         {
+          # Hardening
+          LockPersonality = true;
+          MemoryDenyWriteExecute = true;
+          NoNewPrivileges = true;
+          PrivateDevices = true;
+          PrivateIPC = true;
+          PrivateTmp = true;
+          ProcSubset = "pid";
+          ProtectClock = true;
+          ProtectControlGroups = true;
+          ProtectHome = true;
+          ProtectHostname = true;
+          ProtectKernelLogs = true;
+          ProtectKernelModules = true;
+          ProtectKernelTunables = true;
+          ProtectProc = "invisible";
+          ProtectSystem = "full";
+          RemoveIPC = true;
+          RestrictAddressFamilies = [
+            "AF_INET"
+            "AF_INET6"
+          ];
+          RestrictNamespaces = true;
+          RestrictRealtime = true;
+          RestrictSUIDSGID = true;
+          SystemCallArchitectures = "native";
+          SystemCallFilter = [
+            "~@mount"
+            "~@swap"
+            "~@resources"
+            "~@reboot"
+            "~@raw-io"
+            "~@obsolete"
+            "~@module"
+            "~@debug"
+            "~@cpu-emulation"
+            "~@clock"
+            "~@privileged"
+          ];
+          UMask = "0027";
+
           ExecStart = [
             ""
             "${lib.getExe cfg.package} ${args}"
@@ -111,6 +152,7 @@ in
               # A private user cannot have process capabilities on the host's user
               # namespace and thus CAP_NET_BIND_SERVICE has no effect.
               PrivateUsers = true;
+              CapabilityBoundingSet = false;
             }
         );
     };

From 52aa361b92eddf6d0cadce2a7151f39f09e68c38 Mon Sep 17 00:00:00 2001
From: Yuriy Taraday <yuriy.taraday@tweag.io>
Date: Fri, 13 Jun 2025 17:00:46 +0200
Subject: [PATCH 02/94] comic-neue: fetch source from GitHub

The site comicneue.com is gone now, so fetch sources from GitHub instead.
---
 pkgs/by-name/co/comic-neue/package.nix | 21 ++++++++++-----------
 1 file changed, 10 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/co/comic-neue/package.nix b/pkgs/by-name/co/comic-neue/package.nix
index 0926f184ecef..32cfe6cb13a8 100644
--- a/pkgs/by-name/co/comic-neue/package.nix
+++ b/pkgs/by-name/co/comic-neue/package.nix
@@ -9,21 +9,20 @@ stdenv.mkDerivation rec {
   version = "2.51";
 
   src = fetchzip {
-    url = "http://comicneue.com/${pname}-${version}.zip";
-    sha256 = "sha256-DjRZtFnJOtZnxhfpgU5ihZFAonRK608/BQztCAExIU0=";
-    stripRoot = false; # because it comes with a __MACOSX directory
+    url = "https://github.com/crozynski/comicneue/releases/download/${version}/comicneue-master.zip";
+    hash = "sha256-Xkw+Yd36ffptKsS8RSEP9BPX6eQI7TZn2NgU49rdo80=";
   };
 
   installPhase = ''
     mkdir -pv $out/share/{doc/${pname}-${version},fonts/{opentype,truetype,WOFF,WOFF2}}
-    cp -v ${pname}-${version}/{FONTLOG,OFL-FAQ,OFL}.txt $out/share/doc/
-    cp -v ${pname}-${version}/Booklet-ComicNeue.pdf $out/share/doc/
-    cp -v ${pname}-${version}/OTF/ComicNeue-Angular/*.otf $out/share/fonts/opentype
-    cp -v ${pname}-${version}/OTF/ComicNeue/*.otf $out/share/fonts/opentype
-    cp -v ${pname}-${version}/TTF/ComicNeue-Angular/*.ttf $out/share/fonts/truetype
-    cp -v ${pname}-${version}/TTF/ComicNeue/*.ttf $out/share/fonts/truetype
-    cp -v ${pname}-${version}/WebFonts/*.woff $out/share/fonts/WOFF
-    cp -v ${pname}-${version}/WebFonts/*.woff2 $out/share/fonts/WOFF2
+    cp -v {FONTLOG,OFL-FAQ,OFL}.txt $out/share/doc/
+    cp -v Booklet-ComicNeue.pdf $out/share/doc/
+    cp -v Fonts/OTF/ComicNeue-Angular/*.otf $out/share/fonts/opentype
+    cp -v Fonts/OTF/ComicNeue/*.otf $out/share/fonts/opentype
+    cp -v Fonts/TTF/ComicNeue-Angular/*.ttf $out/share/fonts/truetype
+    cp -v Fonts/TTF/ComicNeue/*.ttf $out/share/fonts/truetype
+    cp -v Fonts/WebFonts/*.woff $out/share/fonts/WOFF
+    cp -v Fonts/WebFonts/*.woff2 $out/share/fonts/WOFF2
   '';
 
   meta = with lib; {

From 563ad3e49f9dd93f482c71cb9f1f4a16405f480d Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 16 Jun 2025 00:30:42 +0000
Subject: [PATCH 03/94] capnproto: 1.1.0 -> 1.2.0

---
 pkgs/by-name/ca/capnproto/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ca/capnproto/package.nix b/pkgs/by-name/ca/capnproto/package.nix
index 646df7c9a87b..193f1dccee04 100644
--- a/pkgs/by-name/ca/capnproto/package.nix
+++ b/pkgs/by-name/ca/capnproto/package.nix
@@ -30,14 +30,14 @@ in
 # See: https://gerrit.lix.systems/c/lix/+/1874
 clangStdenv.mkDerivation rec {
   pname = "capnproto";
-  version = "1.1.0";
+  version = "1.2.0";
 
   # release tarballs are missing some ekam rules
   src = fetchFromGitHub {
     owner = "capnproto";
     repo = "capnproto";
     rev = "v${version}";
-    hash = "sha256-gxkko7LFyJNlxpTS+CWOd/p9x/778/kNIXfpDGiKM2A=";
+    hash = "sha256-aDcn4bLZGq8915/NPPQsN5Jv8FRWd8cAspkG3078psc=";
   };
 
   nativeBuildInputs = [ cmake ];

From a36d414e2261bf43523edc5d7d266e3e2abdfeff Mon Sep 17 00:00:00 2001
From: Simon Hauser <simon.hauser@helsinki-systems.de>
Date: Wed, 25 Jun 2025 17:33:35 +0200
Subject: [PATCH 04/94] proxysql: 2.7.1 -> 3.0.1

changelog: https://github.com/sysown/proxysql/releases/tag/v3.0.1
---
 pkgs/by-name/pr/proxysql/makefiles.patch | 100 +++++++++++++----------
 pkgs/by-name/pr/proxysql/package.nix     |  24 ++++--
 2 files changed, 74 insertions(+), 50 deletions(-)

diff --git a/pkgs/by-name/pr/proxysql/makefiles.patch b/pkgs/by-name/pr/proxysql/makefiles.patch
index 61cb744101ff..cf6328920254 100644
--- a/pkgs/by-name/pr/proxysql/makefiles.patch
+++ b/pkgs/by-name/pr/proxysql/makefiles.patch
@@ -1,8 +1,8 @@
 diff --git a/Makefile b/Makefile
-index dd6b8c44..7a703858 100644
+index b9ad6f71..60e71a86 100644
 --- a/Makefile
 +++ b/Makefile
-@@ -73,10 +73,7 @@ endif
+@@ -81,10 +81,7 @@ endif
  export MAKEOPT := -j${NPROCS}
  
  ### systemd
@@ -14,16 +14,7 @@ index dd6b8c44..7a703858 100644
  
  ### check user/group
  USERCHECK := $(shell getent passwd proxysql)
-@@ -238,7 +235,7 @@ build_tap_test_debug: build_tap_tests_debug
- build_tap_tests_debug: build_src_debug
- 	cd test/tap && OPTZ="${O0} -ggdb -DDEBUG" CC=${CC} CXX=${CXX} ${MAKE} debug
- 
--# ClickHouse build targets are now default build targets. 
-+# ClickHouse build targets are now default build targets.
- # To maintain backward compatibility, ClickHouse targets are still available.
- .PHONY: build_deps_clickhouse
- build_deps_clickhouse: build_deps_default
-@@ -382,16 +379,10 @@ cleanbuild:
+@@ -415,16 +412,10 @@ cleanbuild:
  
  .PHONY: install
  install: src/proxysql
@@ -44,10 +35,10 @@ index dd6b8c44..7a703858 100644
  	install -m 0755 etc/init.d/proxysql /etc/init.d
  ifeq ($(DISTRO),"CentOS Linux")
 diff --git a/deps/Makefile b/deps/Makefile
-index 25bcc603..8fafc224 100644
+index 7c8fcc85..4ae0aba1 100644
 --- a/deps/Makefile
 +++ b/deps/Makefile
-@@ -54,10 +54,7 @@ default: $(targets)
+@@ -61,27 +61,22 @@ default: $(targets)
  ### deps targets
  
  libinjection/libinjection/src/libinjection.a:
@@ -57,21 +48,17 @@ index 25bcc603..8fafc224 100644
 -	cd libinjection/libinjection && patch -p1 < ../update-build-py3.diff
  	cd libinjection/libinjection && patch -p1 < ../libinjection_sqli.c.patch
  endif
- ifeq ($(SYS_KERN),Darwin)
-@@ -71,11 +68,7 @@ libinjection: libinjection/libinjection/src/libinjection.a
+ ifeq ($(UNAME_S),Darwin)
+ 	sed -i '' 's/CC=/CC?=/' libinjection/libinjection/src/Makefile
+ else
+ 	sed -i -e 's/CC=/CC?=/' libinjection/libinjection/src/Makefile
+ endif
+ 	cd libinjection/libinjection && CC=${CC} CXX=${CXX} ${MAKE}
  
+ libinjection: libinjection/libinjection/src/libinjection.a
  
- libssl/openssl/libssl.a:
--	cd libssl && rm -rf openssl-openssl-*/ openssl-3*/ || true
--	cd libssl && tar -zxf openssl-*.tar.gz
- 	cd libssl && ./verify-bio_st-match.sh
--#	cd libssl/openssl && patch crypto/ec/curve448/curve448.c < ../curve448.c-multiplication-overflow.patch
--#	cd libssl/openssl && patch crypto/asn1/a_time.c < ../a_time.c-multiplication-overflow.patch
- 	cd libssl/openssl && ./config no-ssl3 no-tests
- 	cd libssl/openssl && CC=${CC} CXX=${CXX} ${MAKE}
- 	cd libssl/openssl && ln -fs ./ lib # curl wants this path
-@@ -84,8 +77,6 @@ libssl: libssl/openssl/libssl.a
- 
+ include ../common_mk/openssl_flags.mk
+ include ../common_mk/openssl_version_check.mk
  
  libhttpserver/libhttpserver/build/src/.libs/libhttpserver.a: libmicrohttpd/libmicrohttpd/src/microhttpd/.libs/libmicrohttpd.a re2/re2/obj/libre2.a
 -	cd libhttpserver && rm -rf libhttpserver-*/ || true
@@ -79,7 +66,7 @@ index 25bcc603..8fafc224 100644
  	cd libhttpserver/libhttpserver && patch -p1 < ../noexcept.patch
  	cd libhttpserver/libhttpserver && patch -p1 < ../re2_regex.patch
  	cd libhttpserver/libhttpserver && patch -p1 < ../final_val_post_process.patch
-@@ -103,8 +94,6 @@ libhttpserver: libhttpserver/libhttpserver/build/src/.libs/libhttpserver.a
+@@ -99,58 +94,49 @@ libhttpserver: libhttpserver/libhttpserver/build/src/.libs/libhttpserver.a
  
  
  libev/libev/.libs/libev.a:
@@ -88,16 +75,30 @@ index 25bcc603..8fafc224 100644
  	cd libev/libev && patch ev.c < ../ev.c-multiplication-overflow.patch
  	cd libev/libev && ./configure
  	cd libev/libev && CC=${CC} CXX=${CXX} ${MAKE}
-@@ -121,8 +110,6 @@ coredumper/coredumper/src/libcoredumper.a:
+ 
+ ev: libev/libev/.libs/libev.a
+ 
+ 
+ coredumper/coredumper/src/libcoredumper.a:
+ 	cd coredumper && rm -rf coredumper-*/ || true
+ 	cd coredumper && tar -zxf coredumper-*.tar.gz
+ 	cd coredumper/coredumper && patch -p1 < ../includes.patch
+ 	cd coredumper/coredumper && cmake . -DBUILD_TESTING=OFF -DBUILD_SHARED_LIBS=OFF -DCMAKE_BUILD_TYPE=Debug
+ 	cd coredumper/coredumper && CC=${CC} CXX=${CXX} ${MAKE}
  coredumper: coredumper/coredumper/src/libcoredumper.a
  
- curl/curl/lib/.libs/libcurl.a: libssl/openssl/libssl.a
+ curl/curl/lib/.libs/libcurl.a:
 -	cd curl && rm -rf curl-*/ || true
 -	cd curl && tar -zxf curl-*.tar.gz
  #	cd curl/curl && ./configure --disable-debug --disable-ftp --disable-ldap --disable-ldaps --disable-rtsp --disable-proxy --disable-dict --disable-telnet --disable-tftp --disable-pop3 --disable-imap --disable-smb --disable-smtp --disable-gopher --disable-manual --disable-ipv6 --disable-sspi --disable-crypto-auth --disable-ntlm-wb --disable-tls-srp --without-nghttp2 --without-libidn2 --without-libssh2 --without-brotli --with-ssl=$(shell pwd)/../../libssl/openssl/ && CC=${CC} CXX=${CXX} ${MAKE}
  	cd curl/curl && autoreconf -fi
- ifeq ($(SYS_KERN),Darwin)
-@@ -134,9 +121,6 @@ curl: curl/curl/lib/.libs/libcurl.a
+ ifeq ($(UNAME_S),Darwin)
+ 	cd curl/curl && patch configure < ../configure.patch
+ endif
+ 	cd curl/curl && CPPFLAGS="-I$(SSL_IDIR)" LDFLAGS="$(LIB_SSL_PATH) $(LIB_CRYPTO_PATH)" ./configure --disable-debug --disable-ftp --disable-ldap --disable-ldaps --disable-rtsp --disable-proxy --disable-dict --disable-telnet --disable-tftp --disable-pop3 --disable-imap --disable-smb --disable-smtp --disable-gopher --disable-manual --disable-ipv6 --disable-sspi --disable-ntlm-wb --disable-tls-srp --without-nghttp2 --without-libidn2 --without-libssh2 --without-brotli --without-librtmp --without-libpsl --without-zstd --with-ssl --enable-shared=yes
+ 	cd curl/curl && CFLAGS=-fPIC CC=${CC} CXX=${CXX} ${MAKE}
+ 
+ curl: curl/curl/lib/.libs/libcurl.a
  
  
  libmicrohttpd/libmicrohttpd/src/microhttpd/.libs/libmicrohttpd.a:
@@ -107,7 +108,15 @@ index 25bcc603..8fafc224 100644
  	cd libmicrohttpd/libmicrohttpd && ./configure --enable-https && CC=${CC} CXX=${CXX} ${MAKE}
  
  microhttpd: libmicrohttpd/libmicrohttpd/src/microhttpd/.libs/libmicrohttpd.a
-@@ -152,8 +136,6 @@ cityhash: cityhash/cityhash/src/.libs/libcityhash.a
+ 
+ 
+ cityhash/cityhash/src/.libs/libcityhash.a:
+ 	cd cityhash && rm -rf cityhash-*/ || true
+ 	cd cityhash && tar -zxf cityhash-*.tar.gz
+ 	cd cityhash/cityhash && cp ../config.guess . && chmod +x config.guess && cp ../config.sub . && chmod +x config.sub
+ 	cd cityhash/cityhash && ./configure && CC=${CC} CXX=${CXX} ${MAKE}
+ 
+ cityhash: cityhash/cityhash/src/.libs/libcityhash.a
  
  
  lz4/lz4/lib/liblz4.a:
@@ -116,7 +125,7 @@ index 25bcc603..8fafc224 100644
  	cd lz4/lz4 && CC=${CC} CXX=${CXX} ${MAKE}
  
  lz4: lz4/lz4/lib/liblz4.a
-@@ -171,8 +153,6 @@ clickhouse-cpp: clickhouse-cpp/clickhouse-cpp/clickhouse/libclickhouse-cpp-lib-s
+@@ -168,8 +154,6 @@ clickhouse-cpp: clickhouse-cpp/clickhouse-cpp/clickhouse/libclickhouse-cpp-lib-s
  
  
  libdaemon/libdaemon/libdaemon/.libs/libdaemon.a:
@@ -125,8 +134,8 @@ index 25bcc603..8fafc224 100644
  	cd libdaemon/libdaemon && patch -p0 < ../daemon_fork_umask.patch
  	cd libdaemon/libdaemon && cp ../config.guess . && chmod +x config.guess && cp ../config.sub . && chmod +x config.sub && ./configure --disable-examples
  	cd libdaemon/libdaemon && CC=${CC} CXX=${CXX} ${MAKE}
-@@ -256,8 +236,6 @@ sqlite3: sqlite3/sqlite3/sqlite3.o
- 
+@@ -253,18 +237,13 @@ sqlite3/sqlite3/sqlite3.o:
+ sqlite3: sqlite3/sqlite3/sqlite3.o
  
  libconfig/libconfig/lib/.libs/libconfig++.a:
 -	cd libconfig && rm -rf libconfig-*/ || true
@@ -134,7 +143,7 @@ index 25bcc603..8fafc224 100644
  	cd libconfig/libconfig && ./configure --disable-examples
  	cd libconfig/libconfig && CC=${CC} CXX=${CXX} ${MAKE}
  
-@@ -265,9 +243,6 @@ libconfig: libconfig/libconfig/lib/.libs/libconfig++.a
+ libconfig: libconfig/libconfig/lib/.libs/libconfig++.a
  
  
  prometheus-cpp/prometheus-cpp/lib/libprometheus-cpp-core.a:
@@ -144,7 +153,7 @@ index 25bcc603..8fafc224 100644
  	cd prometheus-cpp/prometheus-cpp && patch -p1 < ../serial_exposer.patch
  	cd prometheus-cpp/prometheus-cpp && patch -p1 < ../registry_counters_reset.patch
  	cd prometheus-cpp/prometheus-cpp && patch -p1 < ../fix_old_distros.patch
-@@ -296,8 +271,6 @@ re2: re2/re2/obj/libre2.a
+@@ -293,17 +272,13 @@ re2: re2/re2/obj/libre2.a
  
  
  pcre/pcre/.libs/libpcre.a:
@@ -153,8 +162,17 @@ index 25bcc603..8fafc224 100644
  	cd pcre/pcre && patch pcretest.c < ../pcretest.c-multiplication-overflow.patch
  	cd pcre/pcre && ./configure
  	cd pcre/pcre && CC=${CC} CXX=${CXX} ${MAKE}
-@@ -334,4 +307,3 @@ cleanall:
- 	cd cityhash && rm -rf cityhash-*/ || true
- 	cd coredumper && rm -rf coredumper-*/ || true
+ 
+ pcre: pcre/pcre/.libs/libpcre.a
+ 
+ postgresql/postgresql/src/interfaces/libpq/libpq.a:
+-	cd postgresql && rm -rf postgresql-*/ || true
+-	cd postgresql && tar -zxf postgresql-*.tar.gz
+ 	cd postgresql/postgresql && patch -p0 < ../get_result_from_pgconn.patch
+ 	cd postgresql/postgresql && patch -p0 < ../handle_row_data.patch
+ 	#cd postgresql/postgresql && LD_LIBRARY_PATH="$(shell pwd)/libssl/openssl" ./configure --with-ssl=openssl --with-includes="$(shell pwd)/libssl/openssl/include/" --with-libraries="$(shell pwd)/libssl/openssl/" --without-readline --enable-debug  CFLAGS="-ggdb -O0 -fno-omit-frame-pointer" CPPFLAGS="-g -O0"
+@@ -360,4 +335,3 @@ cleanall:
+ 	cd libusual && rm -rf libusual-*/ || true
+ 	cd libscram && rm -rf lib/* obj/* || true
  .PHONY: cleanall
 -
diff --git a/pkgs/by-name/pr/proxysql/package.nix b/pkgs/by-name/pr/proxysql/package.nix
index 50f2ff5d0c83..0d9012a2054a 100644
--- a/pkgs/by-name/pr/proxysql/package.nix
+++ b/pkgs/by-name/pr/proxysql/package.nix
@@ -7,6 +7,7 @@
   automake,
   bison,
   cmake,
+  pkg-config,
   libtool,
   civetweb,
   coreutils,
@@ -29,17 +30,20 @@
   prometheus-cpp,
   zlib,
   texinfo,
+  postgresql_16,
+  icu,
+  libevent,
 }:
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "proxysql";
-  version = "2.7.1";
+  version = "3.0.1";
 
   src = fetchFromGitHub {
     owner = "sysown";
     repo = "proxysql";
-    rev = finalAttrs.version;
-    hash = "sha256-Ouz1SSc35gQaJcVQO95azkxNgLxuY712ELAwM5buEtY=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-yGxn46Vm8YdtIvvoTlOHQ1aAP2J/h/kFqr4ehruDsTw=";
   };
 
   patches = [
@@ -53,6 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
     cmake
     libtool
     perl
+    pkg-config
     python3
     texinfo # for makeinfo
   ];
@@ -62,8 +67,11 @@ stdenv.mkDerivation (finalAttrs: {
     curl
     flex
     gnutls
+    icu
+    libevent
     libgcrypt
     libuuid
+    openssl
     zlib
   ];
 
@@ -140,10 +148,6 @@ stdenv.mkDerivation (finalAttrs: {
                 f = "libmicrohttpd";
                 p = libmicrohttpd;
               }
-              {
-                f = "libssl";
-                p = openssl;
-              }
               {
                 f = "lz4";
                 p = lz4;
@@ -167,6 +171,10 @@ stdenv.mkDerivation (finalAttrs: {
                   }
                 );
               }
+              {
+                f = "postgresql";
+                p = postgresql_16;
+              }
             ]
         )
       }
@@ -185,8 +193,6 @@ stdenv.mkDerivation (finalAttrs: {
       replace_dep . "${civetweb.src}" civetweb
       popd
 
-      sed -i s_/usr/bin/env_${coreutils}/bin/env_g libssl/openssl/config
-
       pushd libmicrohttpd/libmicrohttpd
       autoreconf
       popd

From 4155b779ce698a4116c0116e8efebb2b02fe5529 Mon Sep 17 00:00:00 2001
From: Kermina Awad <kerminaawad@gmail.com>
Date: Tue, 1 Jul 2025 13:04:53 -0400
Subject: [PATCH 05/94] cloud-init: 24.2 -> 25.1.3

Auto update broke with version 24.3, this was caused by the following
commit: canonical/cloud-init@c28092f

The above commit changed some tests to write temporary files with
specific permissions, which seems to be causing trouble for us. I've
included a patch which removes these permissions, and the build is
working fine now.
---
 .../0002-fix-test-logs-on-nixos.patch         | 22 +++++++++++++++++++
 .../virtualization/cloud-init/default.nix     |  5 +++--
 2 files changed, 25 insertions(+), 2 deletions(-)
 create mode 100644 pkgs/tools/virtualization/cloud-init/0002-fix-test-logs-on-nixos.patch

diff --git a/pkgs/tools/virtualization/cloud-init/0002-fix-test-logs-on-nixos.patch b/pkgs/tools/virtualization/cloud-init/0002-fix-test-logs-on-nixos.patch
new file mode 100644
index 000000000000..ca023e58c330
--- /dev/null
+++ b/pkgs/tools/virtualization/cloud-init/0002-fix-test-logs-on-nixos.patch
@@ -0,0 +1,22 @@
+diff --git a/tests/unittests/cmd/devel/test_logs.py b/tests/unittests/cmd/devel/test_logs.py
+index 78466e8d0..cc2b7246d 100644
+--- a/tests/unittests/cmd/devel/test_logs.py
++++ b/tests/unittests/cmd/devel/test_logs.py
+@@ -179,7 +179,7 @@ class TestCollectLogs:
+ 
+         for to_write in to_collect:
+             write_file(
+-                tmp_path / to_write, pathlib.Path(to_write).name, mode=0x700
++                tmp_path / to_write, pathlib.Path(to_write).name
+             )
+ 
+         collect_dir = tmp_path / "collect"
+@@ -225,7 +225,7 @@ class TestCollectLogs:
+ 
+         for to_write in to_collect:
+             write_file(
+-                tmp_path / to_write, pathlib.Path(to_write).name, mode=0x700
++                tmp_path / to_write, pathlib.Path(to_write).name
+             )
+ 
+         collect_dir = tmp_path / "collect"
diff --git a/pkgs/tools/virtualization/cloud-init/default.nix b/pkgs/tools/virtualization/cloud-init/default.nix
index 64c3090acb41..7c77372609da 100644
--- a/pkgs/tools/virtualization/cloud-init/default.nix
+++ b/pkgs/tools/virtualization/cloud-init/default.nix
@@ -17,7 +17,7 @@
 
 python3.pkgs.buildPythonApplication rec {
   pname = "cloud-init";
-  version = "24.2";
+  version = "25.1.4";
   pyproject = true;
 
   namePrefix = "";
@@ -26,11 +26,12 @@ python3.pkgs.buildPythonApplication rec {
     owner = "canonical";
     repo = "cloud-init";
     tag = version;
-    hash = "sha256-BhTcOeSKZ1XRIx+xJQkqkSw9M8ilr+BRKXDy5MUXB6E=";
+    hash = "sha256-Ubu0uhpRrr4eV4ztOq/l004/+B2kjBWjRNwYcuHCfbU=";
   };
 
   patches = [
     ./0001-add-nixos-support.patch
+    ./0002-fix-test-logs-on-nixos.patch
   ];
 
   prePatch = ''

From 963a898a33aec55fd0677c2f0ab3049ea20a026c Mon Sep 17 00:00:00 2001
From: Nikolay Korotkiy <sikmir@disroot.org>
Date: Fri, 4 Jul 2025 18:53:37 +0400
Subject: [PATCH 06/94] qmapshack: migrate to by-name

---
 .../qm/qmapshack/package.nix}                       | 13 +++++--------
 pkgs/top-level/all-packages.nix                     |  2 --
 2 files changed, 5 insertions(+), 10 deletions(-)
 rename pkgs/{applications/gis/qmapshack/default.nix => by-name/qm/qmapshack/package.nix} (89%)

diff --git a/pkgs/applications/gis/qmapshack/default.nix b/pkgs/by-name/qm/qmapshack/package.nix
similarity index 89%
rename from pkgs/applications/gis/qmapshack/default.nix
rename to pkgs/by-name/qm/qmapshack/package.nix
index 1c6e0b27b4ff..07c89689c43c 100644
--- a/pkgs/applications/gis/qmapshack/default.nix
+++ b/pkgs/by-name/qm/qmapshack/package.nix
@@ -3,13 +3,10 @@
   stdenv,
   fetchFromGitHub,
   cmake,
-  wrapQtAppsHook,
-  qtscript,
-  qtwebengine,
+  libsForQt5,
   gdal,
   proj,
   routino,
-  quazip,
 }:
 
 stdenv.mkDerivation rec {
@@ -25,16 +22,16 @@ stdenv.mkDerivation rec {
 
   nativeBuildInputs = [
     cmake
-    wrapQtAppsHook
+    libsForQt5.wrapQtAppsHook
   ];
 
   buildInputs = [
-    qtscript
-    qtwebengine
+    libsForQt5.qtscript
+    libsForQt5.qtwebengine
     gdal
     proj
     routino
-    quazip
+    libsForQt5.quazip
   ];
 
   cmakeFlags = [
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8e392aaab28b..0c8d76907813 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -11721,8 +11721,6 @@ with pkgs;
 
   qgis = callPackage ../applications/gis/qgis { };
 
-  qmapshack = libsForQt5.callPackage ../applications/gis/qmapshack { };
-
   spatialite-gui = callPackage ../by-name/sp/spatialite-gui/package.nix {
     wxGTK = wxGTK32;
   };

From 14760848150158f3f50f56ca2f7d236c46ce2691 Mon Sep 17 00:00:00 2001
From: Nikolay Korotkiy <sikmir@disroot.org>
Date: Fri, 4 Jul 2025 19:00:42 +0400
Subject: [PATCH 07/94] =?UTF-8?q?qmapshack:=201.17.1=20=E2=86=92=201.18.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 pkgs/by-name/qm/qmapshack/package.nix | 31 ++++++++++++++++-----------
 1 file changed, 18 insertions(+), 13 deletions(-)

diff --git a/pkgs/by-name/qm/qmapshack/package.nix b/pkgs/by-name/qm/qmapshack/package.nix
index 07c89689c43c..d8644c2aadbb 100644
--- a/pkgs/by-name/qm/qmapshack/package.nix
+++ b/pkgs/by-name/qm/qmapshack/package.nix
@@ -3,39 +3,44 @@
   stdenv,
   fetchFromGitHub,
   cmake,
-  libsForQt5,
+  qt6,
+  qt6Packages,
+  alglib,
   gdal,
   proj,
   routino,
 }:
 
-stdenv.mkDerivation rec {
+stdenv.mkDerivation (finalAttrs: {
   pname = "qmapshack";
-  version = "1.17.1";
+  version = "1.18.0";
 
   src = fetchFromGitHub {
     owner = "Maproom";
     repo = "qmapshack";
-    rev = "V_${version}";
-    hash = "sha256-wqztKmaUxY3qd7IgPM7kV7x0BsrTMTX3DbcdM+lsarI=";
+    tag = "V_${finalAttrs.version}";
+    hash = "sha256-+M76EZeZOsBQ7RXtVplsrbrDgU0plRAht4/jz/GpIhM=";
   };
 
   nativeBuildInputs = [
     cmake
-    libsForQt5.wrapQtAppsHook
+    qt6.qttools
+    qt6.wrapQtAppsHook
   ];
 
   buildInputs = [
-    libsForQt5.qtscript
-    libsForQt5.qtwebengine
+    alglib
     gdal
     proj
     routino
-    libsForQt5.quazip
+    qt6.qtwebengine
+    qt6Packages.quazip
   ];
 
   cmakeFlags = [
-    "-DROUTINO_XML_PATH=${routino}/share/routino"
+    (lib.cmakeFeature "ALGLIB_INCLUDE_DIRS" "${alglib}/include/alglib")
+    (lib.cmakeFeature "ALGLIB_LIBRARIES" "alglib3")
+    (lib.cmakeFeature "ROUTINO_XML_PATH" "${routino}/share/routino")
   ];
 
   qtWrapperArgs = [
@@ -50,12 +55,12 @@ stdenv.mkDerivation rec {
   meta = {
     description = "Consumer grade GIS software";
     homepage = "https://github.com/Maproom/qmapshack";
-    changelog = "https://github.com/Maproom/qmapshack/blob/V_${version}/changelog.txt";
+    changelog = "https://github.com/Maproom/qmapshack/blob/V_${finalAttrs.version}/changelog.txt";
     license = lib.licenses.gpl3Plus;
     maintainers = with lib.maintainers; [
       dotlambda
       sikmir
     ];
-    platforms = with lib.platforms; linux;
+    platforms = lib.platforms.linux;
   };
-}
+})

From 6a13f90e88435fd4bc505d7124ee949dcd7279ed Mon Sep 17 00:00:00 2001
From: Sean Gilligan <sean@msgilligan.com>
Date: Mon, 30 Jun 2025 16:47:34 -0700
Subject: [PATCH 08/94] zulu24: 24.0.0 -> 24.0.1

Update zulu24 to 24.0.1, currently the latest version seen
using the API at: https://api.azul.com/metadata/v1/zulu/packages
---
 pkgs/development/compilers/zulu/24.nix | 28 +++++++++++++-------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/pkgs/development/compilers/zulu/24.nix b/pkgs/development/compilers/zulu/24.nix
index 28e876e4ca0b..530764d10742 100644
--- a/pkgs/development/compilers/zulu/24.nix
+++ b/pkgs/development/compilers/zulu/24.nix
@@ -5,8 +5,8 @@
 }@args:
 
 let
-  # For 24 JDK FX is newer than regular JDK?
-  zuluVersion = if enableJavaFX then "24.28.85" else "24.28.83";
+  # For 24 JDK FX is newer than regular JDK
+  zuluVersion = if enableJavaFX then "24.30.13" else "24.30.11";
 in
 callPackage ./common.nix (
   {
@@ -15,42 +15,42 @@ callPackage ./common.nix (
     dists = {
       x86_64-linux = {
         inherit zuluVersion;
-        jdkVersion = "24.0.0";
+        jdkVersion = "24.0.1";
         hash =
           if enableJavaFX then
-            "sha256-y8jiE5yECh96pHYZFM0Q/JTiVcm5a0PONYJDLYydCT0="
+            "sha256-jbpWNE+X5GJABQERq126ediyzGRQE9NZy9oMW/sPUa0="
           else
-            "sha256-Kf6gF8A8ZFIhujEgjlENeuSPVzW6QWnVZcRst35/ZvI=";
+            "sha256-EvaVfDoqdNNtaSz+467rlJ8VtdgNrQi/DT7ZMNZthlk=";
       };
 
       aarch64-linux = {
         inherit zuluVersion;
-        jdkVersion = "24.0.0";
+        jdkVersion = "24.0.1";
         hash =
           if enableJavaFX then
-            "sha256-H6YD8uhk9rTpd+3/S1+7QVzpCi6jykWKyu7RPxMx/sI="
+            "sha256-N9VOweloyX/2bFPH3L+Iw7nTkbiE7LvDNnTNM1b8Ghc="
           else
-            "sha256-6J7szd/ax9xCMNA9efw9Bhgv/VwQFXz5glWIoj+UYIc=";
+            "sha256-4R5K5XTgpR9kq9WWE3SgvqVTq8CFvyb943zAiSsq3k0=";
       };
 
       x86_64-darwin = {
         inherit zuluVersion;
-        jdkVersion = "24.0.0";
+        jdkVersion = "24.0.1";
         hash =
           if enableJavaFX then
-            "sha256-lMdbPkUdXyNcye8uMxGIhZTErrTI0P0SnqMS+8+Rjqg="
+            "sha256-c6Gwj8ol2YLfo4sMeCMGfYQvtDz7029L0Yj1dqVQvsw="
           else
-            "sha256-e7KJtJ9+mFFSdKCj68thfTXguWH5zXaSSb9phzXf/lQ=";
+            "sha256-VhGOiZaspXeVVLEp0MJZXxj/+ovGgmy+gRb2BZ9OuhY=";
       };
 
       aarch64-darwin = {
         inherit zuluVersion;
-        jdkVersion = "24.0.0";
+        jdkVersion = "24.0.1";
         hash =
           if enableJavaFX then
-            "sha256-oR2x0vphBGgh3KkEkLAcmtIMNONny9/b32z9jLR98X0="
+            "sha256-Sac+DxNyGqsiStpc/wZYd2K7rvPEjo901kOYERYi+Sw="
           else
-            "sha256-7yXLOJCK0RZ8V1vsexOGxGR9NAwi/pCl95BlO8E8nGU=";
+            "sha256-pJsq2gKcTy44zbFbSAj6Kd5VZi095jKGkZqd8ceIz7E=";
       };
     };
   }

From 9a3a54f1123cb2ae270b7af45c052985f0748fc5 Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Wed, 2 Jul 2025 14:45:24 +0200
Subject: [PATCH 09/94] froide-govplan: 0-unstable-2025-01-27 ->
 0-unstable-2025-06-25

---
 pkgs/by-name/fr/froide-govplan/package.nix | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/fr/froide-govplan/package.nix b/pkgs/by-name/fr/froide-govplan/package.nix
index cd2f605c7ca9..cad713bb1957 100644
--- a/pkgs/by-name/fr/froide-govplan/package.nix
+++ b/pkgs/by-name/fr/froide-govplan/package.nix
@@ -14,13 +14,14 @@
 let
   python = python3Packages.python.override {
     packageOverrides = self: super: {
-      django = super.django.override { withGdal = true; };
+      django_5 = super.django_5.override { withGdal = true; };
+      django = super.django_5;
     };
   };
 in
 python.pkgs.buildPythonApplication rec {
   pname = "froide-govplan";
-  version = "0-unstable-2025-01-27";
+  version = "0-unstable-2025-06-25";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -28,8 +29,8 @@ python.pkgs.buildPythonApplication rec {
     repo = "froide-govplan";
     # No tagged release yet
     # https://github.com/okfde/froide-govplan/issues/15
-    rev = "f1763807614b8c54a9214359a2a1e442ca58cb6d";
-    hash = "sha256-Y7/qjhu3y9E55ZDmDf5HUk9JVcUTvi9KnqavqwNixTM=";
+    rev = "9c325e70a84f26fea37b5a34f24d19fd82ea62ff";
+    hash = "sha256-OD4vvKt0FLuiAVGwpspWLB2ZuM1UJkZdv2YcbKKYk9A=";
   };
 
   patches = [
@@ -69,7 +70,6 @@ python.pkgs.buildPythonApplication rec {
   build-inputs = [ gdal ];
 
   dependencies = with python.pkgs; [
-    bleach
     django-admin-sortable2
     django-cms
     django-filer
@@ -93,6 +93,7 @@ python.pkgs.buildPythonApplication rec {
         };
       })
     ))
+    nh3
     psycopg
   ];
 
@@ -103,7 +104,7 @@ python.pkgs.buildPythonApplication rec {
     cp -r project $out/${python.sitePackages}/froide_govplan/
     cp -r froide_govplan/locale $out/${python.sitePackages}/froide_govplan/
     makeWrapper $out/${python.sitePackages}/froide_govplan/manage.py $out/bin/froide-govplan \
-      --prefix PYTHONPATH : "$PYTHONPATH" \
+      --prefix PYTHONPATH : ${passthru.pythonPath}:$out/${python.sitePackages} \
       --set GDAL_LIBRARY_PATH "${gdal}/lib/libgdal.so" \
       --set GEOS_LIBRARY_PATH "${geos}/lib/libgeos_c.so"
   '';
@@ -112,8 +113,8 @@ python.pkgs.buildPythonApplication rec {
     tests = {
       inherit (nixosTests) froide-govplan;
     };
-    python = python;
-    pythonPath = "${python.pkgs.makePythonPath dependencies}:${froide-govplan}/${python.sitePackages}";
+    inherit python;
+    pythonPath = "${python.pkgs.makePythonPath dependencies}";
   };
 
   meta = {

From 7f1da3b0ae0a1168e249b95c02fdb8fd69d38e8f Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Wed, 2 Jul 2025 14:47:51 +0200
Subject: [PATCH 10/94] froide: 0-unstable-2025-04-25 -> 0-unstable-2025-06-01

---
 pkgs/by-name/fr/froide/package.nix | 40 ++++++++++++++++++++++--------
 1 file changed, 29 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/fr/froide/package.nix b/pkgs/by-name/fr/froide/package.nix
index c6e120dafb69..10fed1c6e595 100644
--- a/pkgs/by-name/fr/froide/package.nix
+++ b/pkgs/by-name/fr/froide/package.nix
@@ -15,20 +15,38 @@
 let
 
   python = python3Packages.python.override {
-    packageOverrides = self: super: { django = super.django.override { withGdal = true; }; };
+    packageOverrides = self: super: {
+      django_5 = super.django_5.override { withGdal = true; };
+      django = super.django_5;
+      # custom python module part of froide
+      dogtail = super.buildPythonPackage {
+        pname = "dogtail";
+        version = "0-unstable-2024-11-27";
+        pyproject = true;
+
+        src = fetchFromGitHub {
+          owner = "okfde";
+          repo = "dogtail";
+          rev = "d2f341cab0f05ef4e193f0158fe5a64aadc5bae6";
+          hash = "sha256-2lQZgvFXAz6q/3NpBcwckUologWxKmwXI0ZG5nylajg=";
+        };
+
+        build-system = with super; [ setuptools ];
+      };
+    };
   };
 
 in
 python.pkgs.buildPythonApplication rec {
   pname = "froide";
-  version = "0-unstable-2025-04-25";
+  version = "0-unstable-2025-07-01";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "okfde";
     repo = "froide";
-    rev = "9e4838fc5f17a0506af42ad5fd1ebc66cff4b92a";
-    hash = "sha256-0EC6oCaiK7gw5ikemskiK3qOlflGHzlG4giDQNj9tBQ=";
+    rev = "362bddb5a8fdfe762d59cdebd29016568c9531b2";
+    hash = "sha256-c8I/FvXQSkAeacxMQJCpCMKFueNEnLI4R0ElqRbVbNg=";
   };
 
   patches = [ ./django_42_storages.patch ];
@@ -48,11 +66,9 @@ python.pkgs.buildPythonApplication rec {
   ];
 
   dependencies = with python.pkgs; [
-    bleach
     celery
     celery-singleton
     channels
-    coreapi
     dj-database-url
     django
     django-celery-beat
@@ -63,9 +79,6 @@ python.pkgs.buildPythonApplication rec {
     django-elasticsearch-dsl
     django-filingcabinet
     django-filter
-    # Project discontinued upstream
-    # https://github.com/okfde/froide/issues/893
-    django-fsm
     django-json-widget
     django-leaflet
     django-mfa3
@@ -86,6 +99,7 @@ python.pkgs.buildPythonApplication rec {
     geoip2
     icalendar
     markdown
+    nh3
     phonenumbers
     pillow
     pikepdf
@@ -104,7 +118,7 @@ python.pkgs.buildPythonApplication rec {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit pname version src;
-    hash = "sha256-IeuQoiI/r9AKLZgKkZx0C+qE9ueWuC39Y77MB08zSAc=";
+    hash = "sha256-g7YX2fVXGmb3Qq9NNCb294bk4/0khcIZVSskYbE8Mdw=";
   };
 
   postBuild = ''
@@ -114,7 +128,7 @@ python.pkgs.buildPythonApplication rec {
   postInstall = ''
     cp -r build manage.py $out/${python.sitePackages}/froide/
     makeWrapper $out/${python.sitePackages}/froide/manage.py $out/bin/froide \
-      --prefix PYTHONPATH : "$PYTHONPATH" \
+      --prefix PYTHONPATH : "${python3Packages.makePythonPath dependencies}" \
       --set GDAL_LIBRARY_PATH "${gdal}/lib/libgdal.so" \
       --set GEOS_LIBRARY_PATH "${geos}/lib/libgeos_c.so"
   '';
@@ -129,6 +143,7 @@ python.pkgs.buildPythonApplication rec {
 
   checkInputs = with python.pkgs; [
     beautifulsoup4
+    pytest-asyncio
     pytest-factoryboy
     time-machine
   ];
@@ -156,6 +171,9 @@ python.pkgs.buildPythonApplication rec {
     "test_bouncing_email"
     "test_multiple_partial"
     "test_logfile_rotation"
+    # Test hangs
+    "test_collapsed_menu"
+    "test_make_request_logged_out_with_existing_account"
   ];
 
   preCheck =

From 5afac852f362f037374d59942575c79f8d777595 Mon Sep 17 00:00:00 2001
From: Markus Theil <theil.markus@gmail.com>
Date: Mon, 7 Jul 2025 09:19:06 +0200
Subject: [PATCH 11/94] rshim-user-space: 2.2.4 -> 2.4.2

From upstream changelog:
* Update bfb-tool - support NIC FW replacing
* Reduce CPU usage by polling optimization
* bfb-install: Support trimmed NIC_FW
* bfdump support
* Use BREADCRUMB.BIT32 to indicate NIC mode
* Added bfb-tool script

Signed-off-by: Markus Theil <theil.markus@gmail.com>
---
 pkgs/by-name/rs/rshim-user-space/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/rs/rshim-user-space/package.nix b/pkgs/by-name/rs/rshim-user-space/package.nix
index 347958bd6d04..e7ae7f02e0c8 100644
--- a/pkgs/by-name/rs/rshim-user-space/package.nix
+++ b/pkgs/by-name/rs/rshim-user-space/package.nix
@@ -16,13 +16,13 @@
 
 stdenv.mkDerivation rec {
   pname = "rshim-user-space";
-  version = "2.2.4";
+  version = "2.4.2";
 
   src = fetchFromGitHub {
     owner = "Mellanox";
     repo = "rshim-user-space";
     rev = "rshim-${version}";
-    hash = "sha256-z0Uk520vsBERbeVtxBqXPXSWhO0sLD5GCQy1dQsJdEg=";
+    hash = "sha256-J/gCACqpUY+KraVOLWpd+UVyZ1f2o77EfpAgUVtZL9w=";
   };
 
   nativeBuildInputs = [

From fe748ee89180b3b64f282ccbc3609c93cd81133d Mon Sep 17 00:00:00 2001
From: Markus Theil <theil.markus@gmail.com>
Date: Mon, 7 Jul 2025 09:19:55 +0200
Subject: [PATCH 12/94] mlxbf-bootimages: 4.10.0-13520 -> 4.11.0-13611

Update to current revision. No good changelog found.

Signed-off-by: Markus Theil <theil.markus@gmail.com>
---
 pkgs/by-name/ml/mlxbf-bootimages/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ml/mlxbf-bootimages/package.nix b/pkgs/by-name/ml/mlxbf-bootimages/package.nix
index 63a8317bc572..d95122cef9e9 100644
--- a/pkgs/by-name/ml/mlxbf-bootimages/package.nix
+++ b/pkgs/by-name/ml/mlxbf-bootimages/package.nix
@@ -7,11 +7,11 @@
 
 stdenv.mkDerivation rec {
   pname = "mlxbf-bootimages";
-  version = "4.10.0-13520";
+  version = "4.11.0-13611";
 
   src = fetchurl {
     url = "https://linux.mellanox.com/public/repo/bluefield/${version}/bootimages/prod/${pname}-signed_${version}_arm64.deb";
-    hash = "sha256-lPclxhKmn1hvGXWI1A+Q1yXK7FZzKUcOtBoXG6KRsCA=";
+    hash = "sha256-bZpZ6qnC3Q/BuOngS4ZoU6vjeekPjVom0KdDoJF5iko=";
   };
 
   nativeBuildInputs = [

From c8f46a60b9628ca2ec2454806644db4359dd43e7 Mon Sep 17 00:00:00 2001
From: Markus Theil <theil.markus@gmail.com>
Date: Mon, 7 Jul 2025 09:20:32 +0200
Subject: [PATCH 13/94] mlxbf-bootctl: 1.1-6 -> unstable-2025-01-16

Update to current state, as no release was made for years,
but bug fixes on master arrive.

Notable additions:
- better support for watchdog config

Signed-off-by: Markus Theil <theil.markus@gmail.com>
---
 pkgs/by-name/ml/mlxbf-bootctl/package.nix | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/ml/mlxbf-bootctl/package.nix b/pkgs/by-name/ml/mlxbf-bootctl/package.nix
index 8db85e010dd5..cad1b8a116f2 100644
--- a/pkgs/by-name/ml/mlxbf-bootctl/package.nix
+++ b/pkgs/by-name/ml/mlxbf-bootctl/package.nix
@@ -6,13 +6,13 @@
 
 stdenv.mkDerivation rec {
   pname = "mlxbf-bootctl";
-  version = "1.1-6";
+  version = "unstable-2025-01-16";
 
   src = fetchFromGitHub {
     owner = "Mellanox";
     repo = "mlxbf-bootctl";
-    rev = "mlxbf-bootctl-${version}";
-    hash = "sha256-F49ZZtty+NARXA/doAFLhsQn4XkPW6GWLXGy4waIaM0=";
+    rev = "278160ca8e08251cff5e7989e5a1010bd247a6ae";
+    hash = "sha256-qS35wCb8zvuF2Zs/5hPZkoZAapr7fwKQ/0ZOBPtrkRQ=";
   };
 
   installPhase = ''
@@ -27,6 +27,9 @@ stdenv.mkDerivation rec {
     # This package is supposed to only run on a BlueField. Thus aarch64-linux
     # is the only relevant platform.
     platforms = [ "aarch64-linux" ];
-    maintainers = with lib.maintainers; [ nikstur ];
+    maintainers = with lib.maintainers; [
+      nikstur
+      thillux
+    ];
   };
 }

From 04514c4b7de3cc1b91aa7fe6c0063f90d9bd1182 Mon Sep 17 00:00:00 2001
From: Markus Theil <theil.markus@gmail.com>
Date: Mon, 7 Jul 2025 09:21:22 +0200
Subject: [PATCH 14/94] bfscripts: unstable-2023-05-15 -> unstable-2025-06-27

Multiple fixes since 2023, mlx-mkbfb faster and more
features.

Signed-off-by: Markus Theil <theil.markus@gmail.com>
---
 pkgs/by-name/bf/bfscripts/package.nix | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/bf/bfscripts/package.nix b/pkgs/by-name/bf/bfscripts/package.nix
index 65be3bf4cdb6..80bc09cc4a38 100644
--- a/pkgs/by-name/bf/bfscripts/package.nix
+++ b/pkgs/by-name/bf/bfscripts/package.nix
@@ -1,8 +1,10 @@
 {
-  stdenv,
   fetchFromGitHub,
+  git,
   lib,
   python3,
+  rpm,
+  stdenv,
 }:
 
 let
@@ -36,19 +38,24 @@ let
 in
 stdenv.mkDerivation {
   pname = "bfscripts";
-  version = "unstable-2023-05-15";
+  version = "unstable-2025-06-27";
 
   src = fetchFromGitHub {
     owner = "Mellanox";
     repo = "bfscripts";
-    rev = "1da79f3ece7cdf99b2571c00e8b14d2e112504a4";
-    hash = "sha256-pTubrnZKEFmtAj/omycFYeYwrCog39zBDEszoCrsQNQ=";
+    rev = "ed8ede79fa002a2d83719a1bef6fbe0f7dcf37a4";
+    hash = "sha256-x+hpH6D5HTl39zD0vYj6wRFw881M4AcfM+ePcgXMst8=";
   };
 
   buildInputs = [
     python3
   ];
 
+  nativeBuildInputs = [
+    git
+    rpm
+  ];
+
   installPhase = ''
     ${lib.concatStringsSep "\n" (map (b: "install -D ${b} $out/bin/${b}") binaries)}
   '';
@@ -58,6 +65,9 @@ stdenv.mkDerivation {
     homepage = "https://github.com/Mellanox/bfscripts";
     license = licenses.bsd2;
     platforms = platforms.linux;
-    maintainers = with maintainers; [ nikstur ];
+    maintainers = with maintainers; [
+      nikstur
+      thillux
+    ];
   };
 }

From 9f863f5c56ec011a0406081de459f9f5fc71d90e Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Thu, 3 Jul 2025 11:20:43 +0200
Subject: [PATCH 15/94] python3Packages.django-allauth: 65.7.0 -> 65.9.0

---
 .../python-modules/django-allauth/default.nix   | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/python-modules/django-allauth/default.nix b/pkgs/development/python-modules/django-allauth/default.nix
index 0938fa8a70a2..7de34b9ca763 100644
--- a/pkgs/development/python-modules/django-allauth/default.nix
+++ b/pkgs/development/python-modules/django-allauth/default.nix
@@ -1,7 +1,7 @@
 {
   lib,
   buildPythonPackage,
-  fetchFromGitHub,
+  fetchFromGitea,
   pythonOlder,
   python,
 
@@ -40,16 +40,17 @@
 
 buildPythonPackage rec {
   pname = "django-allauth";
-  version = "65.7.0";
+  version = "65.9.0";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
 
-  src = fetchFromGitHub {
-    owner = "pennersr";
+  src = fetchFromGitea {
+    domain = "codeberg.org";
+    owner = "allauth";
     repo = "django-allauth";
     tag = version;
-    hash = "sha256-1HmEJ5E4Vp/CoyzUegqQXpzKUuz3dLx2EEv7dk8fq8w=";
+    hash = "sha256-gusA9TnsgSSnWBPwHsNYeESD9nX5DWh4HqMgcsoJRw0=";
   };
 
   nativeBuildInputs = [ gettext ];
@@ -101,10 +102,10 @@ buildPythonPackage rec {
   passthru.tests = { inherit dj-rest-auth; };
 
   meta = {
-    changelog = "https://github.com/pennersr/django-allauth/blob/${version}/ChangeLog.rst";
     description = "Integrated set of Django applications addressing authentication, registration, account management as well as 3rd party (social) account authentication";
-    downloadPage = "https://github.com/pennersr/django-allauth";
-    homepage = "https://www.intenct.nl/projects/django-allauth";
+    changelog = "https://codeberg.org/allauth/django-allauth/src/tag/${version}/ChangeLog.rst";
+    downloadPage = "https://codeberg.org/allauth/django-allauth";
+    homepage = "https://allauth.org";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ derdennisop ];
   };

From 27c51c7c51c09280d7fc1eb575e39afbb485d84b Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Thu, 3 Jul 2025 11:21:13 +0200
Subject: [PATCH 16/94] django-filingcabinet: 0.17-unstable-2025-04-10 ->
 0.17-unstable-2025-07-01

---
 .../python-modules/django-filingcabinet/default.nix       | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/django-filingcabinet/default.nix b/pkgs/development/python-modules/django-filingcabinet/default.nix
index 24289add7fce..ea04a57f5f25 100644
--- a/pkgs/development/python-modules/django-filingcabinet/default.nix
+++ b/pkgs/development/python-modules/django-filingcabinet/default.nix
@@ -37,7 +37,7 @@
 
 buildPythonPackage rec {
   pname = "django-filingcabinet";
-  version = "0.17-unstable-2025-04-10";
+  version = "0.17-unstable-2025-07-01";
   pyproject = true;
 
   src = fetchFromGitHub {
@@ -45,8 +45,8 @@ buildPythonPackage rec {
     repo = "django-filingcabinet";
     # No release tagged yet on GitHub
     # https://github.com/okfde/django-filingcabinet/issues/69
-    rev = "64b7b4ad804067e2f16e8a0f165c139e3ffe5fb5";
-    hash = "sha256-48Peui/5N/GfzWS1EJ5uKeKEoPjX+fPEXzG2owxsDaE=";
+    rev = "ff39722209acf70bc73fa7074c16ed8a787fceea";
+    hash = "sha256-9SrMWBTk7RQCbVPHOU5rB/pi286hb6UONaLmBOtx6X0=";
   };
 
   postPatch = ''
@@ -94,7 +94,7 @@ buildPythonPackage rec {
 
   pnpmDeps = pnpm.fetchDeps {
     inherit pname version src;
-    hash = "sha256-uMO2iEOi9ACYdIM8Thf7+y1KpHQEqVxO3yxZ8RaGFXA=";
+    hash = "sha256-kvLV/pCX/wQHG0ttrjSro7/CoQ5K1T0aFChafQOwvNw=";
   };
 
   postBuild = ''

From 3d106afccc54e6cce9099ddcb57e306f79eb4704 Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Thu, 3 Jul 2025 11:21:33 +0200
Subject: [PATCH 17/94] python3Packages.django-mfa3: 0.15.1 -> 1.0.0

---
 pkgs/development/python-modules/django-mfa3/default.nix | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/python-modules/django-mfa3/default.nix b/pkgs/development/python-modules/django-mfa3/default.nix
index fe1c247ca603..5651335e8c2f 100644
--- a/pkgs/development/python-modules/django-mfa3/default.nix
+++ b/pkgs/development/python-modules/django-mfa3/default.nix
@@ -5,21 +5,21 @@
   django,
   setuptools,
   pyotp,
-  fido2,
+  fido2_2,
   qrcode,
   python,
 }:
 
 buildPythonPackage rec {
   pname = "django-mfa3";
-  version = "0.15.1";
+  version = "1.0.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "xi";
     repo = "django-mfa3";
     tag = version;
-    hash = "sha256-HcurgGSzPnKVRpL9NVq0vkCmYDvj/HoWYVbnIrK5pSI=";
+    hash = "sha256-bgIzrSM8KP6uQHvn393NWYw9DODdHLMqKn6pgw3EG/w=";
   };
 
   build-system = [ setuptools ];
@@ -27,7 +27,7 @@ buildPythonPackage rec {
   dependencies = [
     django
     pyotp
-    fido2
+    fido2_2
     qrcode
   ];
 

From 16426f94914eaa8509e5ae83cb97eb8451a4248f Mon Sep 17 00:00:00 2001
From: Thierry Delafontaine <delafthi@pm.me>
Date: Tue, 8 Jul 2025 11:20:31 +0200
Subject: [PATCH 18/94] opencode: 0.1.194 -> 0.2.5

---
 pkgs/by-name/op/opencode/package.nix | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix
index 0177c0224b4a..65b5fabd3ae1 100644
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -12,10 +12,10 @@
 
 let
   opencode-node-modules-hash = {
-    "aarch64-darwin" = "sha256-+eXXWskZg0CIY12+Ee4Y3uwpB5I92grDiZ600Whzx/I=";
-    "aarch64-linux" = "sha256-rxLPrYAIiKDh6de/GACPfcYXY7nIskqAu1Xi12y5DpU=";
-    "x86_64-darwin" = "sha256-LOz7N6gMRaZLPks+y5fDIMOuUCXTWpHIss1v0LHPnqw=";
-    "x86_64-linux" = "sha256-GKLR+T+lCa7GFQr6HqSisfa4uf8F2b79RICZmePmCBE=";
+    "aarch64-darwin" = "sha256-uk8HQfHCKTAW54rNHZ1Rr0piZzeJdx6i4o0+xKjfFZs=";
+    "aarch64-linux" = "sha256-gDQh8gfFKl0rAujtos1XsCUnxC2Vjyq9xH5FLZoNW5s=";
+    "x86_64-darwin" = "sha256-H5+qa7vxhwNYRXUo4v8IFUToVXtyXzU3veIqu4idAbU=";
+    "x86_64-linux" = "sha256-1ZxetDrrRdNNOfDOW2uMwMwpEs5S3BLF+SejWcRdtik=";
   };
   bun-target = {
     "aarch64-darwin" = "bun-darwin-arm64";
@@ -26,12 +26,12 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencode";
-  version = "0.1.194";
+  version = "0.2.5";
   src = fetchFromGitHub {
     owner = "sst";
     repo = "opencode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-51Mc0Qrg3C0JTpXl2OECKEUvle+6X+j9+/Blu8Nu9Ao=";
+    hash = "sha256-eeB0M95APRLS5sJ49ubrUTga71Sy5UHUbR3Ps7oWYzo=";
   };
 
   tui = buildGoModule {
@@ -39,7 +39,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     inherit (finalAttrs) version;
     src = "${finalAttrs.src}/packages/tui";
 
-    vendorHash = "sha256-hxtQHlaV2Em8CyTK3BNaoo/LgnGbMjj5XafbleF+p9I=";
+    vendorHash = "sha256-hLXOcZKGx56Q4BaWC0Y1/38Uo/soGbvqFSqoznYwoOo=";
 
     subPackages = [ "cmd/opencode" ];
 

From 2b77792944c579f8c8ae51a138a55aefd19f4b35 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 8 Jul 2025 09:42:59 +0000
Subject: [PATCH 19/94] tana: 1.0.36 -> 1.0.37

---
 pkgs/by-name/ta/tana/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ta/tana/package.nix b/pkgs/by-name/ta/tana/package.nix
index 4f8600066f06..48c92f4e6ed9 100644
--- a/pkgs/by-name/ta/tana/package.nix
+++ b/pkgs/by-name/ta/tana/package.nix
@@ -62,7 +62,7 @@ let
     stdenv.cc.cc
     stdenv.cc.libc
   ];
-  version = "1.0.36";
+  version = "1.0.37";
 in
 stdenv.mkDerivation {
   pname = "tana";
@@ -70,7 +70,7 @@ stdenv.mkDerivation {
 
   src = fetchurl {
     url = "https://github.com/tanainc/tana-desktop-releases/releases/download/v${version}/tana_${version}_amd64.deb";
-    hash = "sha256-dDB2RcTk58IQGqNGepaIvxGhR0/soWWDbBXxnSEYkdw=";
+    hash = "sha256-S7aihKoeP1zJpMd+mdb6D9QEtFBghyVU+K0nSzGd2ew=";
   };
 
   nativeBuildInputs = [

From d1a79fcd1714d6d32ede425e70dcbf1cc7cb132c Mon Sep 17 00:00:00 2001
From: Thierry Delafontaine <delafthi@pm.me>
Date: Tue, 8 Jul 2025 21:05:46 +0200
Subject: [PATCH 20/94] opencode: 0.2.5 -> 0.2.6

---
 pkgs/by-name/op/opencode/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix
index 65b5fabd3ae1..83ae2c602226 100644
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -26,12 +26,12 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencode";
-  version = "0.2.5";
+  version = "0.2.6";
   src = fetchFromGitHub {
     owner = "sst";
     repo = "opencode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-eeB0M95APRLS5sJ49ubrUTga71Sy5UHUbR3Ps7oWYzo=";
+    hash = "sha256-k1eDQPZKV+X7I1gDPpAKTQBhWMjvXfOyZV4w+UIqLbU=";
   };
 
   tui = buildGoModule {
@@ -39,7 +39,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     inherit (finalAttrs) version;
     src = "${finalAttrs.src}/packages/tui";
 
-    vendorHash = "sha256-hLXOcZKGx56Q4BaWC0Y1/38Uo/soGbvqFSqoznYwoOo=";
+    vendorHash = "sha256-i7nFthcJOT1rCMsu4b3nzKjWnErGJJkWcGF1BFw58ZE=";
 
     subPackages = [ "cmd/opencode" ];
 

From 405f561c3775f7c11e173150352675cc96848024 Mon Sep 17 00:00:00 2001
From: Markus Theil <theil.markus@gmail.com>
Date: Mon, 7 Jul 2025 15:03:10 +0200
Subject: [PATCH 21/94] mstflint_access: use kernel Makefile for install

Signed-off-by: Markus Theil <theil.markus@gmail.com>
---
 pkgs/os-specific/linux/mstflint_access/default.nix | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/pkgs/os-specific/linux/mstflint_access/default.nix b/pkgs/os-specific/linux/mstflint_access/default.nix
index 2b90ddf7ae65..9c4576c9256c 100644
--- a/pkgs/os-specific/linux/mstflint_access/default.nix
+++ b/pkgs/os-specific/linux/mstflint_access/default.nix
@@ -26,13 +26,13 @@ stdenv.mkDerivation rec {
 
   enableParallelBuilding = true;
 
-  installPhase = ''
-    runHook preInstall
-
-    install -D ${pname}.ko $out/lib/modules/${kernel.modDirVersion}/extra/${pname}.ko
-
-    runHook postInstall
-  '';
+  installTargets = [ "modules_install" ];
+  installFlags = [
+    "-C"
+    "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build"
+    "INSTALL_MOD_PATH=${placeholder "out"}"
+    "M=$(PWD)"
+  ] ++ makeFlags;
 
   meta = with lib; {
     description = "Kernel module for Nvidia NIC firmware update";

From afa0c5dc82ec21b74169e1cf9d8787abcac976da Mon Sep 17 00:00:00 2001
From: Thierry Delafontaine <delafthi@pm.me>
Date: Wed, 9 Jul 2025 13:03:23 +0200
Subject: [PATCH 22/94] opencode: 0.2.6 -> 0.2.13

---
 pkgs/by-name/op/opencode/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix
index 83ae2c602226..68f4e9f4fd81 100644
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -26,12 +26,12 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencode";
-  version = "0.2.6";
+  version = "0.2.13";
   src = fetchFromGitHub {
     owner = "sst";
     repo = "opencode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-k1eDQPZKV+X7I1gDPpAKTQBhWMjvXfOyZV4w+UIqLbU=";
+    hash = "sha256-Sh7FEn34iL4iZuusmghLCvKHfx/CMjOogBwnT+enz4g=";
   };
 
   tui = buildGoModule {
@@ -39,7 +39,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     inherit (finalAttrs) version;
     src = "${finalAttrs.src}/packages/tui";
 
-    vendorHash = "sha256-i7nFthcJOT1rCMsu4b3nzKjWnErGJJkWcGF1BFw58ZE=";
+    vendorHash = "sha256-Qvn59PU95TniPy7JaZDJhn/wUCfFYM+7bzav1jxNv34=";
 
     subPackages = [ "cmd/opencode" ];
 

From 38914c8076f2f63911c46258983b2c3f1e74f4e6 Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Fri, 4 Jul 2025 00:36:15 +0200
Subject: [PATCH 23/94] python3Packages.dj-rest-auth: Fix compatibility with
 django-allauth

---
 .../python-modules/dj-rest-auth/default.nix   | 42 ++++++++++++++-----
 1 file changed, 31 insertions(+), 11 deletions(-)

diff --git a/pkgs/development/python-modules/dj-rest-auth/default.nix b/pkgs/development/python-modules/dj-rest-auth/default.nix
index 7cabff4b15e1..dffa779db8b7 100644
--- a/pkgs/development/python-modules/dj-rest-auth/default.nix
+++ b/pkgs/development/python-modules/dj-rest-auth/default.nix
@@ -11,6 +11,8 @@
   responses,
   setuptools,
   unittest-xml-reporting,
+  pytestCheckHook,
+  pytest-django,
 }:
 
 buildPythonPackage rec {
@@ -32,6 +34,13 @@ buildPythonPackage rec {
       url = "https://github.com/iMerica/dj-rest-auth/commit/cc5587e4e3f327697709f3f0d491650bff5464e7.diff";
       hash = "sha256-2LahibxuNECAfjqsbNs2ezaWt1VH0ZBNwSNWCZwIe8I=";
     })
+    # Add compatibility with django-allauth v65.4
+    # See https://github.com/iMerica/dj-rest-auth/pull/681
+    (fetchpatch {
+      name = "django-allauth_65.4_compatibility.patch";
+      url = "https://github.com/iMerica/dj-rest-auth/commit/59b8cab7e2f4e3f2fdc11ab3b027a32cad45deef.patch";
+      hash = "sha256-CH85vB3EOQvFxx+ZP2LYI4LEvaZ+ccLdXZGuAvEfStc=";
+    })
   ];
 
   postPatch = ''
@@ -55,25 +64,36 @@ buildPythonPackage rec {
     unittest-xml-reporting
   ] ++ optional-dependencies.with_social;
 
+  checkInputs = [
+    pytestCheckHook
+    pytest-django
+  ];
+
+  env.DJANGO_SETTINGS_MODULE = "dj_rest_auth.tests.settings";
+
   preCheck = ''
-    # Test connects to graph.facebook.com
-    substituteInPlace dj_rest_auth/tests/test_serializers.py \
-      --replace-fail "def test_http_error" "def dont_test_http_error"
+    # Make tests module available for the checkPhase
+    export PYTHONPATH=$out/${python.sitePackages}/dj_rest_auth:$PYTHONPATH
   '';
 
-  checkPhase = ''
-    runHook preCheck
-    ${python.interpreter} runtests.py
-    runHook postCheck
-  '';
+  disabledTests = [
+    # Test connects to graph.facebook.com
+    "TestSocialLoginSerializer"
+  ];
+
+  disabledTestPaths = [
+    # Test fails with > django-allauth 65.4
+    # See: https://github.com/iMerica/dj-rest-auth/pull/681#issuecomment-3034953311
+    "dj_rest_auth/tests/test_social.py"
+  ];
 
   pythonImportsCheck = [ "dj_rest_auth" ];
 
-  meta = with lib; {
+  meta = {
     description = "Authentication for Django Rest Framework";
     homepage = "https://github.com/iMerica/dj-rest-auth";
     changelog = "https://github.com/iMerica/dj-rest-auth/releases/tag/${version}";
-    license = licenses.mit;
-    maintainers = [ ];
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ onny ];
   };
 }

From cd85e93ff776c1f347a911c7ecbb19e0d7bedda0 Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Fri, 4 Jul 2025 12:34:42 +0200
Subject: [PATCH 24/94] nixos/froide-govplan: Fix PYTHONPATH

---
 nixos/modules/services/web-apps/froide-govplan.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/web-apps/froide-govplan.nix b/nixos/modules/services/web-apps/froide-govplan.nix
index 85294f10ea88..5dbde5f1f7fd 100644
--- a/nixos/modules/services/web-apps/froide-govplan.nix
+++ b/nixos/modules/services/web-apps/froide-govplan.nix
@@ -191,7 +191,7 @@ in
           wantedBy = [ "multi-user.target" ];
           environment =
             {
-              PYTHONPATH = pkg.pythonPath;
+              PYTHONPATH = "${pkg.pythonPath}:${pkg}/${pkg.python.sitePackages}";
               GDAL_LIBRARY_PATH = "${pkgs.gdal}/lib/libgdal.so";
               GEOS_LIBRARY_PATH = "${pkgs.geos}/lib/libgeos_c.so";
             }

From 30b46a50bc1bbb66984cbb4961a6ddcb1c1026a0 Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Mon, 7 Jul 2025 11:12:15 +0200
Subject: [PATCH 25/94] paperless-ngx: Pin django-allauth version

---
 pkgs/by-name/pa/paperless-ngx/package.nix | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/pa/paperless-ngx/package.nix b/pkgs/by-name/pa/paperless-ngx/package.nix
index 84e93dc8cb72..8dd83e5e7257 100644
--- a/pkgs/by-name/pa/paperless-ngx/package.nix
+++ b/pkgs/by-name/pa/paperless-ngx/package.nix
@@ -162,7 +162,17 @@ python.pkgs.buildPythonApplication rec {
       concurrent-log-handler
       dateparser
       django
-      django-allauth
+      # django-allauth version 65.9.X not yet supported
+      # See https://github.com/paperless-ngx/paperless-ngx/issues/10336
+      (django-allauth.overrideAttrs (
+        new: prev: rec {
+          version = "65.7.0";
+          src = prev.src.override {
+            tag = version;
+            hash = "sha256-1HmEJ5E4Vp/CoyzUegqQXpzKUuz3dLx2EEv7dk8fq8w=";
+          };
+        }
+      ))
       django-auditlog
       django-celery-results
       django-compression-middleware

From 99d4350e1241334d64ece49da7bd9a48cbf6d9dc Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Tue, 8 Jul 2025 10:04:09 +0200
Subject: [PATCH 26/94] python3Packages.fido2_2: init at 2.0.0

---
 pkgs/development/python-modules/fido2/2.nix | 50 +++++++++++++++++++++
 pkgs/top-level/python-packages.nix          |  2 +
 2 files changed, 52 insertions(+)
 create mode 100644 pkgs/development/python-modules/fido2/2.nix

diff --git a/pkgs/development/python-modules/fido2/2.nix b/pkgs/development/python-modules/fido2/2.nix
new file mode 100644
index 000000000000..a9f8a826e43e
--- /dev/null
+++ b/pkgs/development/python-modules/fido2/2.nix
@@ -0,0 +1,50 @@
+{
+  lib,
+  buildPythonPackage,
+  cryptography,
+  fetchPypi,
+  poetry-core,
+  pyscard,
+  pythonOlder,
+  pytestCheckHook,
+}:
+
+buildPythonPackage rec {
+  pname = "fido2";
+  version = "2.0.0";
+  pyproject = true;
+
+  disabled = pythonOlder "3.8";
+
+  src = fetchPypi {
+    inherit pname version;
+    hash = "sha256-MGHNBec7Og72r8O4A9V8gmqi1qlzLRar1ydzYfWOeWQ=";
+  };
+
+  build-system = [ poetry-core ];
+
+  pythonRelaxDeps = [ "cryptography" ];
+
+  dependencies = [ cryptography ];
+
+  optional-dependencies = {
+    pcsc = [ pyscard ];
+  };
+
+  nativeCheckInputs = [ pytestCheckHook ];
+
+  unittestFlagsArray = [ "-v" ];
+
+  # Disable tests which require physical device
+  pytestFlagsArray = [ "--no-device" ];
+
+  pythonImportsCheck = [ "fido2" ];
+
+  meta = {
+    description = "Provides library functionality for FIDO 2.0, including communication with a device over USB";
+    homepage = "https://github.com/Yubico/python-fido2";
+    changelog = "https://github.com/Yubico/python-fido2/releases/tag/${version}";
+    license = lib.licenses.bsd2;
+    maintainers = with lib.maintainers; [ prusnak ];
+  };
+}
diff --git a/pkgs/top-level/python-packages.nix b/pkgs/top-level/python-packages.nix
index 7291fcd58710..a6b87ea385bf 100644
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -5016,6 +5016,8 @@ self: super: with self; {
 
   fido2 = callPackage ../development/python-modules/fido2 { };
 
+  fido2_2 = callPackage ../development/python-modules/fido2/2.nix { };
+
   fields = callPackage ../development/python-modules/fields { };
 
   file-read-backwards = callPackage ../development/python-modules/file-read-backwards { };

From d6e3516544e5754483496a5f6aa9c3d9e64932f3 Mon Sep 17 00:00:00 2001
From: Jonas Heinrich <onny@project-insanity.org>
Date: Thu, 10 Jul 2025 10:54:47 +0200
Subject: [PATCH 27/94] nixos/froide-govplan: Increase startup timeout

---
 nixos/modules/services/web-apps/froide-govplan.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/nixos/modules/services/web-apps/froide-govplan.nix b/nixos/modules/services/web-apps/froide-govplan.nix
index 5dbde5f1f7fd..7fab1ad19310 100644
--- a/nixos/modules/services/web-apps/froide-govplan.nix
+++ b/nixos/modules/services/web-apps/froide-govplan.nix
@@ -182,6 +182,7 @@ in
             StateDirectory = lib.mkIf (cfg.dataDir == "/var/lib/froide-govplan") "froide-govplan";
             User = "govplan";
             Group = "govplan";
+            TimeoutStartSec = "5m";
           };
           after = [
             "postgresql.target"

From e9c609f61adab4de2eb4073267a608a99598d72f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 10 Jul 2025 10:01:25 +0000
Subject: [PATCH 28/94] dotbot: 1.22.0 -> 1.23.0

---
 pkgs/by-name/do/dotbot/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/do/dotbot/package.nix b/pkgs/by-name/do/dotbot/package.nix
index 6f205e102d77..34049b5dac70 100644
--- a/pkgs/by-name/do/dotbot/package.nix
+++ b/pkgs/by-name/do/dotbot/package.nix
@@ -6,14 +6,14 @@
 
 python3Packages.buildPythonApplication rec {
   pname = "dotbot";
-  version = "1.22.0";
+  version = "1.23.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "anishathalye";
     repo = "dotbot";
     tag = "v${version}";
-    hash = "sha256-3U8lIsqy95Ulxa5f2hHGFmuAqQ7WZtikvgaplX6GTF0=";
+    hash = "sha256-Bv9nvS8DxmpMB5Bo4Sw2+rVbrnQIcnc/hQZiq0qeJxc=";
   };
 
   preCheck = ''

From dfb2cac6aa5d7917881d7e3e36cabc74e431c5e0 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 10 Jul 2025 10:49:15 +0000
Subject: [PATCH 29/94] parallel-disk-usage: 0.12.0 -> 0.13.1

---
 pkgs/by-name/pa/parallel-disk-usage/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pa/parallel-disk-usage/package.nix b/pkgs/by-name/pa/parallel-disk-usage/package.nix
index cca97919e092..169568127b97 100644
--- a/pkgs/by-name/pa/parallel-disk-usage/package.nix
+++ b/pkgs/by-name/pa/parallel-disk-usage/package.nix
@@ -5,17 +5,17 @@
 }:
 rustPlatform.buildRustPackage rec {
   pname = "parallel-disk-usage";
-  version = "0.12.0";
+  version = "0.13.1";
 
   src = fetchFromGitHub {
     owner = "KSXGitHub";
     repo = "parallel-disk-usage";
     rev = version;
-    hash = "sha256-Wj19lWepCrZe36njX+NMdpwXeRRh3ml9jKbbi7irrpg=";
+    hash = "sha256-gzjNi7ujYe7OZKYyrYk1xqqo/k8yBJdIwRoNASm5Db4=";
   };
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-UK+jonM/ZBGoCKFcQlCo5OqYtKeU0VIWtx83oBh3lJQ=";
+  cargoHash = "sha256-3U61AkCicX7VNh1bf0IHPH5YX7qAtp4PvWi8FRKoBQI=";
 
   meta = with lib; {
     description = "Highly parallelized, blazing fast directory tree analyzer";

From 0d9b468a64721dc27627784cc89542373510a275 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 10 Jul 2025 12:07:04 +0000
Subject: [PATCH 30/94] python3Packages.langchain-mistralai: 0.2.10 -> 0.2.11

---
 .../python-modules/langchain-mistralai/default.nix            | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/langchain-mistralai/default.nix b/pkgs/development/python-modules/langchain-mistralai/default.nix
index 6cc5a0baeec6..b76fb3893586 100644
--- a/pkgs/development/python-modules/langchain-mistralai/default.nix
+++ b/pkgs/development/python-modules/langchain-mistralai/default.nix
@@ -24,14 +24,14 @@
 
 buildPythonPackage rec {
   pname = "langchain-mistralai";
-  version = "0.2.10";
+  version = "0.2.11";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-mistralai==${version}";
-    hash = "sha256-1oH9GRvjYv/YzedKXeWgw5nwNgMQ9mSNkmZ2xwPekXc=";
+    hash = "sha256-14mYvW7j2hxAFZanRhuuo1seX6E4+tAuEPExDbdwHKg=";
   };
 
   sourceRoot = "${src.name}/libs/partners/mistralai";

From b2a9f721586ae549445585503d174a8383a73ec6 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 10 Jul 2025 12:30:11 +0000
Subject: [PATCH 31/94] angie-console-light: 1.4.0 -> 1.8.0

---
 pkgs/servers/http/angie/console-light.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/http/angie/console-light.nix b/pkgs/servers/http/angie/console-light.nix
index 1c7be0b681d5..228d7f5e2bf7 100644
--- a/pkgs/servers/http/angie/console-light.nix
+++ b/pkgs/servers/http/angie/console-light.nix
@@ -6,12 +6,12 @@
 }:
 
 stdenv.mkDerivation rec {
-  version = "1.4.0";
+  version = "1.8.0";
   pname = "angie-console-light";
 
   src = fetchurl {
     url = "https://download.angie.software/files/${pname}/${pname}-${version}.tar.gz";
-    hash = "sha256-Oz+FdMrIGNmJKHl/wOVZCP1b0AJODcURvDUKz4gCqYU=";
+    hash = "sha256-8btNEsh8Me/MQyLY0iIJal3UnZHzoHq6QpqyVYJvO84=";
   };
 
   outputs = [

From 7bc194686d26b9f8320c62d73ef8ee82457af8bc Mon Sep 17 00:00:00 2001
From: Thierry Delafontaine <delafthi@pm.me>
Date: Thu, 10 Jul 2025 14:56:58 +0200
Subject: [PATCH 32/94] opencode: 0.2.13 -> 0.2.20

---
 pkgs/by-name/op/opencode/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix
index 68f4e9f4fd81..696d2329b2bb 100644
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -26,12 +26,12 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencode";
-  version = "0.2.13";
+  version = "0.2.20";
   src = fetchFromGitHub {
     owner = "sst";
     repo = "opencode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-Sh7FEn34iL4iZuusmghLCvKHfx/CMjOogBwnT+enz4g=";
+    hash = "sha256-QONFC5HP5+mA/p7irEskJb8fN/uOnQ4VoB6mjP9v32k=";
   };
 
   tui = buildGoModule {
@@ -39,7 +39,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     inherit (finalAttrs) version;
     src = "${finalAttrs.src}/packages/tui";
 
-    vendorHash = "sha256-Qvn59PU95TniPy7JaZDJhn/wUCfFYM+7bzav1jxNv34=";
+    vendorHash = "sha256-ujDTUdQLpWMFcmbabg4je6ZHFmUEyjaGt6BDucnC6mg=";
 
     subPackages = [ "cmd/opencode" ];
 

From 8e96e65a9a07961ae9581695129c18cba8ed48ce Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 10 Jul 2025 13:07:54 +0000
Subject: [PATCH 33/94] xpipe: 16.6 -> 16.7

---
 pkgs/by-name/xp/xpipe/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/xp/xpipe/package.nix b/pkgs/by-name/xp/xpipe/package.nix
index 37eee295a66a..2cb64a2a9517 100644
--- a/pkgs/by-name/xp/xpipe/package.nix
+++ b/pkgs/by-name/xp/xpipe/package.nix
@@ -39,7 +39,7 @@ let
 
   hash =
     {
-      x86_64-linux = "sha256-BQNynZwQevXl+PlAi+OhaIUIf9TaNW5JowD3mLGgJxE=";
+      x86_64-linux = "sha256-2ZkFVhOTBfGWsyDTWRCFq0FXzuewWOsuZ9lH/0q8jEw=";
     }
     .${system} or throwSystem;
 
@@ -48,7 +48,7 @@ let
 in
 stdenvNoCC.mkDerivation rec {
   pname = "xpipe";
-  version = "16.6";
+  version = "16.7";
 
   src = fetchzip {
     url = "https://github.com/xpipe-io/xpipe/releases/download/${version}/xpipe-portable-linux-${arch}.tar.gz";

From a05ecf0d45e715ef30febca6586c7ff0dddf8e93 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 10 Jul 2025 16:30:02 +0000
Subject: [PATCH 34/94] flannel: 0.27.0 -> 0.27.1

---
 pkgs/tools/networking/flannel/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/tools/networking/flannel/default.nix b/pkgs/tools/networking/flannel/default.nix
index 083a0e9cf831..2bc4f17978ee 100644
--- a/pkgs/tools/networking/flannel/default.nix
+++ b/pkgs/tools/networking/flannel/default.nix
@@ -7,16 +7,16 @@
 
 buildGoModule rec {
   pname = "flannel";
-  version = "0.27.0";
+  version = "0.27.1";
   rev = "v${version}";
 
-  vendorHash = "sha256-vwv7B3G9v9FNDS/RWTZwA5uqW2/GQLtUgylFsi0Dldo=";
+  vendorHash = "sha256-FR9jeHVZS87Tlv1jtO4h5ZDqKIRLfa4xGlpCj1IWoXU=";
 
   src = fetchFromGitHub {
     inherit rev;
     owner = "flannel-io";
     repo = "flannel";
-    sha256 = "sha256-GVbDmRXyZjWXHi9eHiQ28RDi1N//ro3AnKb0txvA8yA=";
+    sha256 = "sha256-xmKXemr/qSLsBOwLhJIewF7Iu/ERpZX8kUFgotz4Yyw=";
   };
 
   ldflags = [ "-X github.com/flannel-io/flannel/pkg/version.Version=${rev}" ];

From 7f448818767b8dfcc204873ec9a485d75ec5e17e Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 10 Jul 2025 17:02:41 +0000
Subject: [PATCH 35/94] codipack: 2.3.2 -> 3.0.0

---
 pkgs/by-name/co/codipack/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/co/codipack/package.nix b/pkgs/by-name/co/codipack/package.nix
index 3f1a717a507c..675ec508b7c4 100644
--- a/pkgs/by-name/co/codipack/package.nix
+++ b/pkgs/by-name/co/codipack/package.nix
@@ -9,13 +9,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "codipack";
-  version = "2.3.2";
+  version = "3.0.0";
 
   src = fetchFromGitHub {
     owner = "SciCompKL";
     repo = "CoDiPack";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-feYtPDV0t7b49NIL5s6ZoBttRG2Bkwc0gOX6R6xDIbs=";
+    hash = "sha256-dGzLPU8YOrBdXPwUnEElqfxzbUdkAQxtv2+7+itNsyI=";
   };
 
   nativeBuildInputs = [

From 1ae010b3b11837aa75070b827e16a8370cdc7b46 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Thu, 10 Jul 2025 18:44:40 +0000
Subject: [PATCH 36/94] python3Packages.metaflow: 2.15.18 -> 2.15.20

---
 pkgs/development/python-modules/metaflow/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/metaflow/default.nix b/pkgs/development/python-modules/metaflow/default.nix
index 69971befefa4..b60da7236ce9 100644
--- a/pkgs/development/python-modules/metaflow/default.nix
+++ b/pkgs/development/python-modules/metaflow/default.nix
@@ -10,14 +10,14 @@
 
 buildPythonPackage rec {
   pname = "metaflow";
-  version = "2.15.18";
+  version = "2.15.20";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "Netflix";
     repo = "metaflow";
     tag = version;
-    hash = "sha256-Yg5DoFPn5uInLf8roHhIKXvK+/K6TWATdG8uK8XOUyg=";
+    hash = "sha256-D4Pf2/xhEJ22kDmmxYS0PiT5k2BJ3CBfTJZ4GrvkI58=";
   };
 
   build-system = [

From 3e1661ea7ff1ad2b580296bc8ea3652fece8708a Mon Sep 17 00:00:00 2001
From: Thierry Delafontaine <delafthi@pm.me>
Date: Thu, 10 Jul 2025 21:36:04 +0200
Subject: [PATCH 37/94] opencode: 0.2.20 -> 0.2.23

---
 pkgs/by-name/op/opencode/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix
index 696d2329b2bb..5e986898d3f1 100644
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -26,12 +26,12 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencode";
-  version = "0.2.20";
+  version = "0.2.23";
   src = fetchFromGitHub {
     owner = "sst";
     repo = "opencode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-QONFC5HP5+mA/p7irEskJb8fN/uOnQ4VoB6mjP9v32k=";
+    hash = "sha256-rfYhlbSiSgpbbJazZf7P+bOiugVO+sYt+xFuYjBcBhY=";
   };
 
   tui = buildGoModule {
@@ -39,7 +39,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     inherit (finalAttrs) version;
     src = "${finalAttrs.src}/packages/tui";
 
-    vendorHash = "sha256-ujDTUdQLpWMFcmbabg4je6ZHFmUEyjaGt6BDucnC6mg=";
+    vendorHash = "sha256-PRPJlLjzcxKpVSKKLc9fOEh41QZz2AH7vsLb1P5/tvg=";
 
     subPackages = [ "cmd/opencode" ];
 

From a435da7902de33caef36e890f128e125f196bcf7 Mon Sep 17 00:00:00 2001
From: Thierry Delafontaine <delafthi@pm.me>
Date: Thu, 10 Jul 2025 22:14:27 +0200
Subject: [PATCH 38/94] opencode: 0.2.23 -> 0.2.25

---
 pkgs/by-name/op/opencode/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix
index 5e986898d3f1..57ffe8253858 100644
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -26,12 +26,12 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencode";
-  version = "0.2.23";
+  version = "0.2.25";
   src = fetchFromGitHub {
     owner = "sst";
     repo = "opencode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-rfYhlbSiSgpbbJazZf7P+bOiugVO+sYt+xFuYjBcBhY=";
+    hash = "sha256-eZCWBnFfC4WSprhr+MXnJLuOyY3bEEfWwc89kc9VBs4=";
   };
 
   tui = buildGoModule {

From 17c863a0498e5e067edfb3cf8f85196aa4e813f7 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 11 Jul 2025 01:05:34 +0000
Subject: [PATCH 39/94] smartgit: 24.1.3 -> 24.1.4

---
 pkgs/by-name/sm/smartgit/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/sm/smartgit/package.nix b/pkgs/by-name/sm/smartgit/package.nix
index 15b19494541c..63c535d6d17e 100644
--- a/pkgs/by-name/sm/smartgit/package.nix
+++ b/pkgs/by-name/sm/smartgit/package.nix
@@ -16,13 +16,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "smartgit";
-  version = "24.1.3";
+  version = "24.1.4";
 
   src = fetchurl {
     url = "https://www.syntevo.com/downloads/smartgit/smartgit-linux-${
       builtins.replaceStrings [ "." ] [ "_" ] finalAttrs.version
     }.tar.gz";
-    hash = "sha256-YhgE1Y0L8lzefJnvswKwIFnx6XIo40DszAr/cxOoOds=";
+    hash = "sha256-1JKFSIGUE8b1yWBg41x+HRWgmg5prZF2+ND/SId4NVs=";
   };
 
   nativeBuildInputs = [ wrapGAppsHook3 ];

From 598be38ee478189110531456632cdd16a4af1983 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 11 Jul 2025 03:50:25 +0000
Subject: [PATCH 40/94] python3Packages.langchain-ollama: 0.3.3 -> 0.3.4

---
 pkgs/development/python-modules/langchain-ollama/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/langchain-ollama/default.nix b/pkgs/development/python-modules/langchain-ollama/default.nix
index 705a53178a35..98a84696fd59 100644
--- a/pkgs/development/python-modules/langchain-ollama/default.nix
+++ b/pkgs/development/python-modules/langchain-ollama/default.nix
@@ -22,14 +22,14 @@
 
 buildPythonPackage rec {
   pname = "langchain-ollama";
-  version = "0.3.3";
+  version = "0.3.4";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "langchain-ai";
     repo = "langchain";
     tag = "langchain-ollama==${version}";
-    hash = "sha256-YxcxVyiPEZPvO4NyeDp8nTVfbxlOCLClWCmAlL5PPi0=";
+    hash = "sha256-biPQAYF9VfF6z0244v1+iXaqX0IAiKCuJ+XyXzxD/Jg=";
   };
 
   sourceRoot = "${src.name}/libs/partners/ollama";

From 3f8ee50157312fa368341ed77a555df3edda0e09 Mon Sep 17 00:00:00 2001
From: Robert Rose <robert.rose@mailbox.org>
Date: Fri, 11 Jul 2025 07:01:01 +0200
Subject: [PATCH 41/94] python3Packages.mkdocs-mermaid2-plugin: 1.1.0 -> 1.2.1

https://github.com/fralau/mkdocs-mermaid2-plugin/releases/tag/v1.2.1
---
 .../python-modules/mkdocs-mermaid2-plugin/default.nix         | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/mkdocs-mermaid2-plugin/default.nix b/pkgs/development/python-modules/mkdocs-mermaid2-plugin/default.nix
index bdc996bbe79f..ac686c4f7018 100644
--- a/pkgs/development/python-modules/mkdocs-mermaid2-plugin/default.nix
+++ b/pkgs/development/python-modules/mkdocs-mermaid2-plugin/default.nix
@@ -14,7 +14,7 @@
 
 buildPythonPackage rec {
   pname = "mkdocs-mermaid2-plugin";
-  version = "1.1.0";
+  version = "1.2.1";
   format = "setuptools";
 
   disabled = pythonOlder "3.7";
@@ -23,7 +23,7 @@ buildPythonPackage rec {
     owner = "fralau";
     repo = "mkdocs-mermaid2-plugin";
     tag = "v${version}";
-    hash = "sha256-9vYLkGUnL+rnmZntcgFzOvXQdf6angb9DRsmrBjnPUY=";
+    hash = "sha256-LKPjhCPozz/+UV2658qWOIjpMt6w+UDBXsg1fqyg48M=";
   };
 
   propagatedBuildInputs = [

From dacef64157acf7b4301c0949920950cb3e288a97 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 11 Jul 2025 05:18:27 +0000
Subject: [PATCH 42/94] mpvScripts.quality-menu: 4.2.0 -> 4.2.1

---
 pkgs/applications/video/mpv/scripts/quality-menu.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/video/mpv/scripts/quality-menu.nix b/pkgs/applications/video/mpv/scripts/quality-menu.nix
index 8cee576a5792..8c6f00240c19 100644
--- a/pkgs/applications/video/mpv/scripts/quality-menu.nix
+++ b/pkgs/applications/video/mpv/scripts/quality-menu.nix
@@ -8,13 +8,13 @@
 
 buildLua rec {
   pname = "mpv-quality-menu";
-  version = "4.2.0";
+  version = "4.2.1";
 
   src = fetchFromGitHub {
     owner = "christoph-heinrich";
     repo = "mpv-quality-menu";
     rev = "v${version}";
-    hash = "sha256-uaU4W72P7zhHzxmfr59icCAl1mJ3ycLGzkGcYasHllI=";
+    hash = "sha256-W+6OYjh0S7nYrNC/P9sF7t6p1Rt/awOtO865cr6qtR0=";
   };
   passthru.updateScript = gitUpdater { rev-prefix = "v"; };
 

From 4f666a693af6c571c5242cbd39c0002d532f2c1b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 11 Jul 2025 05:32:29 +0000
Subject: [PATCH 43/94] vscode-extensions.illixion.vscode-vibrancy-continued:
 1.1.54 -> 1.1.57

---
 pkgs/applications/editors/vscode/extensions/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/default.nix b/pkgs/applications/editors/vscode/extensions/default.nix
index 6ab87df26539..e34f10ad5c88 100644
--- a/pkgs/applications/editors/vscode/extensions/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/default.nix
@@ -2453,8 +2453,8 @@ let
         mktplcRef = {
           name = "vscode-vibrancy-continued";
           publisher = "illixion";
-          version = "1.1.54";
-          hash = "sha256-CzhDStBa/LB/bzgzrFCUEcVDeBluWJPblneUbHdIcRE=";
+          version = "1.1.57";
+          hash = "sha256-UJn+RFBlQXmPqKkFIBiD4AblnX4s0O2IK747fG+UC/0=";
         };
         meta = {
           downloadPage = "https://marketplace.visualstudio.com/items?itemName=illixion.vscode-vibrancy-continued";

From dabbedd709d4e740a76b7e888a5a0bb6c983f3cd Mon Sep 17 00:00:00 2001
From: Thierry Delafontaine <delafthi@pm.me>
Date: Fri, 11 Jul 2025 12:12:03 +0200
Subject: [PATCH 44/94] opencode: remove unnecessary `mkdir` in `installPhase`

---
 pkgs/by-name/op/opencode/package.nix | 1 -
 1 file changed, 1 deletion(-)

diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix
index 57ffe8253858..0268c74af6ca 100644
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -144,7 +144,6 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   installPhase = ''
     runHook preInstall
 
-    mkdir -p $out/bin
     install -Dm755 opencode $out/bin/opencode
 
     runHook postInstall

From dd88db29ed76a434460fa544473eeaa867e9a6cd Mon Sep 17 00:00:00 2001
From: phaer <hello@phaer.org>
Date: Thu, 10 Jul 2025 14:25:51 +0200
Subject: [PATCH 45/94] modules/systemd-oomd: add
 After=systemd-sysusers.service

Before this change, systemd-oomd startup was flaky at least with
either systemd-sysusers or userborn enabled. It would restart several
times until users were provisioned, so that it finally succeeded.

An alternative would be to use a DynamicUser which was my first
approach, before I discovered that upstream added the after statement
in Dec 2024[1]. DynamicUsers could have further
implications (sandboxing, etc), so we follow upstream here.

It's not clear to me we why Upstreams "After=systemd-sysusers.service"
doesn't show up on nixos-unstable systems (systemd v257.6).

Userborn is covered, as its unit is aliased to systemd-sysusers.service.

The following test succeeded after this change on x86_64-linux:

  nix-build -A nixosTests.systemd-oomd

[1]: https://github.com/systemd/systemd/commit/36dd4296806b5541eb67cd13c535eb0fe3213121
---
 nixos/modules/system/boot/systemd/oomd.nix | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/nixos/modules/system/boot/systemd/oomd.nix b/nixos/modules/system/boot/systemd/oomd.nix
index d7df8903367b..421190e80ed6 100644
--- a/nixos/modules/system/boot/systemd/oomd.nix
+++ b/nixos/modules/system/boot/systemd/oomd.nix
@@ -45,6 +45,8 @@ in
       "systemd-oomd.service"
       "systemd-oomd.socket"
     ];
+    # TODO: Added upstream in upcoming systemd release. Good to drop once we use v258 or later
+    systemd.services.systemd-oomd.after = [ "systemd-sysusers.service" ];
     systemd.services.systemd-oomd.wantedBy = [ "multi-user.target" ];
 
     environment.etc."systemd/oomd.conf".text = lib.generators.toINI { } {

From 6f4fff59128c41282513415e2513b269afbc9bc5 Mon Sep 17 00:00:00 2001
From: Thierry Delafontaine <delafthi@pm.me>
Date: Fri, 11 Jul 2025 17:29:10 +0200
Subject: [PATCH 46/94] opencode: add comment for the necessity of
 `fix-model-macro.patch`

---
 pkgs/by-name/op/opencode/package.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix
index 0268c74af6ca..031d53d38400 100644
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -113,7 +113,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
 
   nativeBuildInputs = [ bun ];
 
-  patches = [ ./fix-models-macro.patch ];
+  patches = [
+    # Patch `packages/opencode/src/provider/models-macro.ts` to load the prefetched `models.dev/api.json`
+    # from the `MODELS_JSON` environment variable instead of fetching it at build time.
+    ./fix-models-macro.patch
+  ];
 
   configurePhase = ''
     runHook preConfigure

From ae30ba98d574b6618aca66457ec121388d439a58 Mon Sep 17 00:00:00 2001
From: Thierry Delafontaine <delafthi@pm.me>
Date: Fri, 11 Jul 2025 17:33:32 +0200
Subject: [PATCH 47/94] opencode: 0.2.25 -> 0.2.27

---
 pkgs/by-name/op/opencode/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix
index 031d53d38400..9e2e732681f4 100644
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -26,12 +26,12 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencode";
-  version = "0.2.25";
+  version = "0.2.27";
   src = fetchFromGitHub {
     owner = "sst";
     repo = "opencode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-eZCWBnFfC4WSprhr+MXnJLuOyY3bEEfWwc89kc9VBs4=";
+    hash = "sha256-nVjvcPL4s6xvlyR3NMXISl2Kaypwjk8QdvBnLc7c/E0=";
   };
 
   tui = buildGoModule {
@@ -39,7 +39,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     inherit (finalAttrs) version;
     src = "${finalAttrs.src}/packages/tui";
 
-    vendorHash = "sha256-PRPJlLjzcxKpVSKKLc9fOEh41QZz2AH7vsLb1P5/tvg=";
+    vendorHash = "sha256-5PG81ca/MPLdYbiQu6tj7DL+4HSEgHpwi4zekOnbf/c=";
 
     subPackages = [ "cmd/opencode" ];
 

From a143f72199562a060730d34dbf84ea9b5ec78220 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 11 Jul 2025 19:31:53 +0000
Subject: [PATCH 48/94] wlvncc: 0-unstable-2025-04-20 -> 0-unstable-2025-07-07

---
 pkgs/by-name/wl/wlvncc/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/wl/wlvncc/package.nix b/pkgs/by-name/wl/wlvncc/package.nix
index e4d1b1a68315..33209a300ed9 100644
--- a/pkgs/by-name/wl/wlvncc/package.nix
+++ b/pkgs/by-name/wl/wlvncc/package.nix
@@ -27,13 +27,13 @@
 
 stdenv.mkDerivation {
   pname = "wlvncc";
-  version = "0-unstable-2025-04-20";
+  version = "0-unstable-2025-07-07";
 
   src = fetchFromGitHub {
     owner = "any1";
     repo = "wlvncc";
-    rev = "a6a5463a9c69ce4db04d8d699dd58e1ba8560a0a";
-    hash = "sha256-8p2IOQvcjOV5xe0c/RWP6aRHtQnu9tYI7QgcC13sg4k=";
+    rev = "bc6063aeacd4fbe9ac8f58f4ba3c5388b3e1f1f2";
+    hash = "sha256-Udu/CtrNBqnlgZCK2cS8VWNTfHJGXdijTnNIWnAW2Nw=";
   };
 
   nativeBuildInputs = [

From f36ece2a4790ef1862708d33aa32c88f77e9bd30 Mon Sep 17 00:00:00 2001
From: Leah Amelia Chen <hi@pluie.me>
Date: Sun, 18 May 2025 01:08:17 +0200
Subject: [PATCH 49/94] python312Packages.rapidocr-onnxruntime: 1.4.4 -> 2.1.0

---
 .../rapidocr-onnxruntime/default.nix          | 23 +++++--------------
 1 file changed, 6 insertions(+), 17 deletions(-)

diff --git a/pkgs/development/python-modules/rapidocr-onnxruntime/default.nix b/pkgs/development/python-modules/rapidocr-onnxruntime/default.nix
index 6e4f2c5d9137..e0af42135d96 100644
--- a/pkgs/development/python-modules/rapidocr-onnxruntime/default.nix
+++ b/pkgs/development/python-modules/rapidocr-onnxruntime/default.nix
@@ -21,13 +21,13 @@
   requests,
 }:
 let
-  version = "1.4.4";
+  version = "2.1.0";
 
   src = fetchFromGitHub {
     owner = "RapidAI";
     repo = "RapidOCR";
     tag = "v${version}";
-    hash = "sha256-x0VELDKOffxbV3v0aDFJFuDC4YfsGM548XWgINmRc3M=";
+    hash = "sha256-4R2rOCfnhElII0+a5hnvbn+kKQLEtH1jBvfFdxpLEBk=";
   };
 
   models =
@@ -101,21 +101,10 @@ buildPythonPackage {
 
   pythonImportsCheck = [ "rapidocr_onnxruntime" ];
 
-  nativeCheckInputs = [
-    pytestCheckHook
-    requests
-  ];
-
-  # These are tests for different backends.
-  disabledTestPaths = [
-    "tests/test_vino.py"
-    "tests/test_paddle.py"
-  ];
-
-  disabledTests = [
-    # Needs Internet access
-    "test_long_img"
-  ];
+  # As of version 2.1.0, 61 out of 70 tests require internet access.
+  # It's just not plausible to manually pick out ones that actually work
+  # in a hermetic build environment anymore :(
+  doCheck = false;
 
   meta = {
     # This seems to be related to https://github.com/microsoft/onnxruntime/issues/10038

From 35638d2160be5e124654183126233d2163527f04 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 12 Jul 2025 01:30:36 +0000
Subject: [PATCH 50/94] mark: 14.1.0 -> 14.1.1

---
 pkgs/by-name/ma/mark/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ma/mark/package.nix b/pkgs/by-name/ma/mark/package.nix
index fcdc9ea4f24f..c71ff3bda690 100644
--- a/pkgs/by-name/ma/mark/package.nix
+++ b/pkgs/by-name/ma/mark/package.nix
@@ -8,16 +8,16 @@
 # https://github.com/kovetskiy/mark/pull/581#issuecomment-2797872996
 buildGoModule rec {
   pname = "mark";
-  version = "14.1.0";
+  version = "14.1.1";
 
   src = fetchFromGitHub {
     owner = "kovetskiy";
     repo = "mark";
     rev = "${version}";
-    sha256 = "sha256-TQU49rPpHCDQEOIfC3R89kdtVMVJrisOXF5DhbRgJQ0=";
+    sha256 = "sha256-jKc5QugqfdjSQjK7SbLG02a9+YdFcweS+91LhdR0Dzg=";
   };
 
-  vendorHash = "sha256-y5WCpL0bJE48iVUO2hPy7AvAx9KEVQJUK6vVwFfob/M=";
+  vendorHash = "sha256-AHtIVp2n5v4YoYfWAsE7eD1QcEFKdjSqzGIlR7+mnxg=";
 
   ldflags = [
     "-s"

From b72563dedc47bc7fc22633eb5d16d0d0e541a61c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sat, 12 Jul 2025 00:33:43 +0000
Subject: [PATCH 51/94] orthanc: 1.12.7 -> 1.12.8

---
 pkgs/by-name/or/orthanc/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/or/orthanc/package.nix b/pkgs/by-name/or/orthanc/package.nix
index 8b2099a10274..6ec7af87decf 100644
--- a/pkgs/by-name/or/orthanc/package.nix
+++ b/pkgs/by-name/or/orthanc/package.nix
@@ -28,12 +28,12 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "orthanc";
-  version = "1.12.7";
+  version = "1.12.8";
 
   src = fetchhg {
     url = "https://orthanc.uclouvain.be/hg/orthanc/";
     rev = "Orthanc-${finalAttrs.version}";
-    hash = "sha256-aWUA8cCnWff5Tl8PWGJJtERlGh4GX4a8hTG9E2ADG9k=";
+    hash = "sha256-ktfTqCid/0aYAp5HPB7niZ1sw+zMNmd5mhZrXRbMGyk=";
   };
 
   outputs = [

From 1f0f25154225df0302adcd7b8110ad2c99e48adc Mon Sep 17 00:00:00 2001
From: Thierry Delafontaine <delafthi@pm.me>
Date: Sat, 12 Jul 2025 06:33:41 +0200
Subject: [PATCH 52/94] opencode: 0.2.27 -> 0.2.33

Diff: https://github.com/sst/opencode/compare/refs/tags/v0.2.27...refs/tags/v0.2.33
---
 pkgs/by-name/op/opencode/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/op/opencode/package.nix b/pkgs/by-name/op/opencode/package.nix
index 9e2e732681f4..712e796f75f0 100644
--- a/pkgs/by-name/op/opencode/package.nix
+++ b/pkgs/by-name/op/opencode/package.nix
@@ -26,12 +26,12 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "opencode";
-  version = "0.2.27";
+  version = "0.2.33";
   src = fetchFromGitHub {
     owner = "sst";
     repo = "opencode";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-nVjvcPL4s6xvlyR3NMXISl2Kaypwjk8QdvBnLc7c/E0=";
+    hash = "sha256-l/V9YHwuIPN73ieMT++enL1O5vecA9L0qBDGr8eRVxY=";
   };
 
   tui = buildGoModule {
@@ -39,7 +39,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     inherit (finalAttrs) version;
     src = "${finalAttrs.src}/packages/tui";
 
-    vendorHash = "sha256-5PG81ca/MPLdYbiQu6tj7DL+4HSEgHpwi4zekOnbf/c=";
+    vendorHash = "sha256-0vf4fOk32BLF9/904W8g+5m0vpe6i6tUFRXqDHVcMIQ=";
 
     subPackages = [ "cmd/opencode" ];
 

From 4cd15e834f5ca373a503fbb22706afbb8f444aa0 Mon Sep 17 00:00:00 2001
From: Yejun Su <goofan.su@gmail.com>
Date: Sat, 12 Jul 2025 16:24:49 +0800
Subject: [PATCH 53/94] aporetic: 1.1.0 -> 1.2.0

Ref: https://github.com/protesilaos/aporetic/commit/24f0e591dad28d64e56f3ef6ba5f9c839075bb98
---
 pkgs/by-name/ap/aporetic/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/ap/aporetic/package.nix b/pkgs/by-name/ap/aporetic/package.nix
index e21a2c7007ef..9c05714c594a 100644
--- a/pkgs/by-name/ap/aporetic/package.nix
+++ b/pkgs/by-name/ap/aporetic/package.nix
@@ -14,12 +14,12 @@ let
     "serif"
   ];
   pname = "aporetic";
-  version = "1.1.0";
+  version = "1.2.0";
   src = fetchFromGitHub {
     owner = "protesilaos";
     repo = "aporetic";
     tag = version;
-    hash = "sha256-5lPViAo9SztOdds6HEmKJpT17tgcxmU/voXDffxTMDI=";
+    hash = "sha256-1BbuC/mWEcXJxzDppvsukhNtdOLz0QosD6QqI/93Khc=";
   };
   privateBuildPlan = src.outPath + "/private-build-plans.toml";
   makeIosevkaFont =
@@ -40,11 +40,11 @@ let
             src = fetchFromGitHub {
               owner = "be5invis";
               repo = "iosevka";
-              tag = "v32.5.0";
-              hash = "sha256-MzsAkq5l4TP19UJNPW/8hvIqsJd94pADrrv8wLG6NMQ=";
+              tag = "v33.2.2";
+              hash = "sha256-dhMTcceHru/uLHRY4eWzFV+73ckCBBnDlizP3iY5w5w=";
             };
 
-            npmDepsHash = "sha256-HeqwpZyHLHdMhd/UfXVBonMu+PhStrLCxAMuP/KuTT8=";
+            npmDepsHash = "sha256-5DcMV9N16pyQxRaK6RCoeghZqAvM5EY1jftceT/bP+o=";
           }
         );
     });

From 8acc71bb6f9be7d75b973bbb24f8548b859e3c1f Mon Sep 17 00:00:00 2001
From: Yejun Su <goofan.su@gmail.com>
Date: Sun, 13 Jul 2025 22:49:19 +0800
Subject: [PATCH 54/94] aporetic-bin: 1.1.0 -> 1.2.0

---
 pkgs/by-name/ap/aporetic-bin/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ap/aporetic-bin/package.nix b/pkgs/by-name/ap/aporetic-bin/package.nix
index fe9d0b1753d2..a0b62ae3f690 100644
--- a/pkgs/by-name/ap/aporetic-bin/package.nix
+++ b/pkgs/by-name/ap/aporetic-bin/package.nix
@@ -6,13 +6,13 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "aporetic-bin";
-  version = "1.1.0";
+  version = "1.2.0";
 
   src = fetchFromGitHub {
     owner = "protesilaos";
     repo = "aporetic";
     tag = finalAttrs.version;
-    hash = "sha256-5lPViAo9SztOdds6HEmKJpT17tgcxmU/voXDffxTMDI=";
+    hash = "sha256-1BbuC/mWEcXJxzDppvsukhNtdOLz0QosD6QqI/93Khc=";
   };
 
   installPhase = ''

From bceb8e6b7012ac831a27c85bf6e2a98d4c3c96bb Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Sun, 13 Jul 2025 14:49:04 +0000
Subject: [PATCH 55/94] =?UTF-8?q?evince:=2048.0=20=E2=86=92=2048.1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://gitlab.gnome.org/GNOME/evince/-/compare/48.0...48.1

Contains fixes for a potential heap overflow.
---
 pkgs/by-name/ev/evince/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ev/evince/package.nix b/pkgs/by-name/ev/evince/package.nix
index 977b8b78b30d..49722821b258 100644
--- a/pkgs/by-name/ev/evince/package.nix
+++ b/pkgs/by-name/ev/evince/package.nix
@@ -42,7 +42,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "evince";
-  version = "48.0";
+  version = "48.1";
 
   outputs = [
     "out"
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/evince/${lib.versions.major finalAttrs.version}/evince-${finalAttrs.version}.tar.xz";
-    hash = "sha256-zS9lg1X6kHX9+eW0SqCvOn4JKMVWFOsQQrNhds9FESY=";
+    hash = "sha256-fYuab6OgXT9bkEiFkCdojHOniP9ukjvDlFEmiElD+hA=";
   };
 
   depsBuildBuild = [

From 321ff26fb4321b15bd1a9a3d87c63f9479a94730 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Sun, 13 Jul 2025 14:49:36 +0000
Subject: [PATCH 56/94] =?UTF-8?q?glycin-loaders:=201.2.1=20=E2=86=92=201.2?=
 =?UTF-8?q?.2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://gitlab.gnome.org/GNOME/glycin/-/compare/1.2.1...1.2.2
---
 pkgs/by-name/gl/glycin-loaders/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gl/glycin-loaders/package.nix b/pkgs/by-name/gl/glycin-loaders/package.nix
index 30cb241f5dec..cb6d963cf508 100644
--- a/pkgs/by-name/gl/glycin-loaders/package.nix
+++ b/pkgs/by-name/gl/glycin-loaders/package.nix
@@ -24,11 +24,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "glycin-loaders";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchurl {
     url = "mirror://gnome/sources/glycin/${lib.versions.majorMinor finalAttrs.version}/glycin-${finalAttrs.version}.tar.xz";
-    hash = "sha256-zMV46aPoPQ3BU1c30f2gm6qVxxZ/Xl7LFfeGZUCU7tU=";
+    hash = "sha256-SrRG1YsQx2KDInplSHuLvbdLpQCentIwRfz6i6P7KGE=";
   };
 
   patches = [

From d877c9b3e3c202041f0b947b11c42f4f7c920349 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Sun, 13 Jul 2025 23:06:44 +0800
Subject: [PATCH 57/94] libglycin: Handle cargoDeps hash in update script

Copied from gnome-user-share.
---
 pkgs/by-name/li/libglycin/package.nix | 33 +++++++++++++++++++++++----
 1 file changed, 29 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/li/libglycin/package.nix b/pkgs/by-name/li/libglycin/package.nix
index f59e81215cb4..a9bb734a160f 100644
--- a/pkgs/by-name/li/libglycin/package.nix
+++ b/pkgs/by-name/li/libglycin/package.nix
@@ -15,6 +15,8 @@
   gtk4,
   gobject-introspection,
   gnome,
+  common-updater-scripts,
+  _experimental-update-script-combinators,
   buildPackages,
   withIntrospection ?
     lib.meta.availableOn stdenv.hostPlatform gobject-introspection
@@ -71,10 +73,33 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   passthru = {
-    updateScript = gnome.updateScript {
-      attrPath = "libglycin";
-      packageName = "glycin";
-    };
+    updateScript =
+      let
+        updateSource = gnome.updateScript {
+          attrPath = "libglycin";
+          packageName = "glycin";
+        };
+        updateLockfile = {
+          command = [
+            "sh"
+            "-c"
+            ''
+              PATH=${
+                lib.makeBinPath [
+                  common-updater-scripts
+                ]
+              }
+              update-source-version libglycin --ignore-same-version --source-key=cargoDeps.vendorStaging > /dev/null
+            ''
+          ];
+          # Experimental feature: do not copy!
+          supportedFeatures = [ "silent" ];
+        };
+      in
+      _experimental-update-script-combinators.sequence [
+        updateSource
+        updateLockfile
+      ];
   };
 
   meta = {

From 2aebae6243aceff4e28d7cd0437f0a5175289d8c Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Sun, 13 Jul 2025 15:07:33 +0000
Subject: [PATCH 58/94] =?UTF-8?q?libglycin:=201.2.1=20=E2=86=92=201.2.2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://gitlab.gnome.org/GNOME/glycin/-/compare/1.2.1...1.2.2
---
 pkgs/by-name/li/libglycin/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/li/libglycin/package.nix b/pkgs/by-name/li/libglycin/package.nix
index a9bb734a160f..389977babf4f 100644
--- a/pkgs/by-name/li/libglycin/package.nix
+++ b/pkgs/by-name/li/libglycin/package.nix
@@ -24,14 +24,14 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
   pname = "libglycin";
-  version = "1.2.1";
+  version = "1.2.2";
 
   src = fetchFromGitLab {
     domain = "gitlab.gnome.org";
     owner = "GNOME";
     repo = "glycin";
     tag = finalAttrs.version;
-    hash = "sha256-M4DcWLE40OPB7zIkv4uLj6xTac3LTDcZ2uAO2S/cUz4=";
+    hash = "sha256-K+cR+0a/zRpOvMsX1ZljjJYYOXbHkyDGE9Q9vY1qJBg=";
   };
 
   nativeBuildInputs =
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   cargoDeps = rustPlatform.fetchCargoVendor {
     inherit (finalAttrs) pname version src;
-    hash = "sha256-iNSpLvIi3oZKSRlkwkDJp5i8MdixRvmWIOCzbFHIdHw=";
+    hash = "sha256-zGDmmRbaR2boaf9lLzvW/H7xgMo9uHTmlC0oNupLUos=";
   };
 
   buildInputs = [

From 8391b82ee0d0c6df668030af257517f186098d02 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Sun, 13 Jul 2025 14:49:59 +0000
Subject: [PATCH 59/94] =?UTF-8?q?gnome-builder:=2048.0=20=E2=86=92=2048.2?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://gitlab.gnome.org/GNOME/gnome-builder/-/compare/48.0...48.2
---
 pkgs/by-name/gn/gnome-builder/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gn/gnome-builder/package.nix b/pkgs/by-name/gn/gnome-builder/package.nix
index 429899d4c2f9..d8b3287f780a 100644
--- a/pkgs/by-name/gn/gnome-builder/package.nix
+++ b/pkgs/by-name/gn/gnome-builder/package.nix
@@ -42,7 +42,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-builder";
-  version = "48.0";
+  version = "48.2";
 
   outputs = [
     "out"
@@ -51,7 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-builder/${lib.versions.major finalAttrs.version}/gnome-builder-${finalAttrs.version}.tar.xz";
-    hash = "sha256-ev6aejs8ZiF2i8RqYdaY3XiLNlP7RqcII4vcz03me6Q=";
+    hash = "sha256-7BKA1H6BSjE7dMuSfVoFk4BUSqD1bodVKXg5fWx0zGM=";
   };
 
   patches = [

From 256507292313907c711151c823d2b35ba011c43a Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Sun, 13 Jul 2025 14:50:32 +0000
Subject: [PATCH 60/94] =?UTF-8?q?gnome-online-accounts:=203.54.3=20?=
 =?UTF-8?q?=E2=86=92=203.54.4?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://gitlab.gnome.org/GNOME/gnome-online-accounts/-/compare/3.54.3...3.54.4
---
 pkgs/by-name/gn/gnome-online-accounts/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gn/gnome-online-accounts/package.nix b/pkgs/by-name/gn/gnome-online-accounts/package.nix
index dcf5cf77f51e..178c1ae9b02b 100644
--- a/pkgs/by-name/gn/gnome-online-accounts/package.nix
+++ b/pkgs/by-name/gn/gnome-online-accounts/package.nix
@@ -32,7 +32,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-online-accounts";
-  version = "3.54.3";
+  version = "3.54.4";
 
   outputs =
     [
@@ -46,7 +46,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-online-accounts/${lib.versions.majorMinor finalAttrs.version}/gnome-online-accounts-${finalAttrs.version}.tar.xz";
-    hash = "sha256-vPZV3R3cIrwleTtoQNoZ9crXugtyJ/+WntnCUvA2qsU=";
+    hash = "sha256-VXOZQ+dH3LSIXqYHpMJ2fYAC9xKV4a/+pi6jb20c9ZM=";
   };
 
   mesonFlags = [

From 2242659119d02f3b2a6661f48fa3dae9b40b769c Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Sun, 13 Jul 2025 14:51:09 +0000
Subject: [PATCH 61/94] =?UTF-8?q?gnome-shell:=2048.2=20=E2=86=92=2048.3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://gitlab.gnome.org/GNOME/gnome-shell/-/compare/48.2...48.3
---
 pkgs/by-name/gn/gnome-shell/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gn/gnome-shell/package.nix b/pkgs/by-name/gn/gnome-shell/package.nix
index 1d383b1d6cb1..7efa7375bae7 100644
--- a/pkgs/by-name/gn/gnome-shell/package.nix
+++ b/pkgs/by-name/gn/gnome-shell/package.nix
@@ -69,7 +69,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-shell";
-  version = "48.2";
+  version = "48.3";
 
   outputs = [
     "out"
@@ -78,7 +78,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-shell/${lib.versions.major finalAttrs.version}/gnome-shell-${finalAttrs.version}.tar.xz";
-    hash = "sha256-XSbMfvymNIW33bbHo5Msoa+fqPy+OLjJnqP0qyFzpqk=";
+    hash = "sha256-+wID/HSFk/FOUXMmGOHwQlJf1xl2Sg/bDuP2/kE6mys=";
   };
 
   patches = [

From 5d868eded8f553bc1b487eb6be3c5cf503f99875 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Sun, 13 Jul 2025 14:51:39 +0000
Subject: [PATCH 62/94] =?UTF-8?q?gnome-shell-extensions:=2048.2=20?=
 =?UTF-8?q?=E2=86=92=2048.3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://gitlab.gnome.org/GNOME/gnome-shell-extensions/-/compare/48.2...48.3
---
 pkgs/by-name/gn/gnome-shell-extensions/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gn/gnome-shell-extensions/package.nix b/pkgs/by-name/gn/gnome-shell-extensions/package.nix
index 3d5dc92ddb82..d190a459755f 100644
--- a/pkgs/by-name/gn/gnome-shell-extensions/package.nix
+++ b/pkgs/by-name/gn/gnome-shell-extensions/package.nix
@@ -15,11 +15,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-shell-extensions";
-  version = "48.2";
+  version = "48.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-shell-extensions/${lib.versions.major finalAttrs.version}/gnome-shell-extensions-${finalAttrs.version}.tar.xz";
-    hash = "sha256-6Sh+hjSJ5fpqLFWuW+ocqRCuQBbe6zQXNiZ4sEqR7P8=";
+    hash = "sha256-rd40wI9AtjQRvm8dF+I1VQoAkElIceZIHDEpidf0otQ=";
   };
 
   patches = [

From 4fed923d2138ee4669ea9aa91f7b407edd28d930 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Sun, 13 Jul 2025 14:52:07 +0000
Subject: [PATCH 63/94] =?UTF-8?q?gnome-software:=2048.2=20=E2=86=92=2048.3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://gitlab.gnome.org/GNOME/gnome-software/-/compare/48.2...48.3
---
 pkgs/by-name/gn/gnome-software/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gn/gnome-software/package.nix b/pkgs/by-name/gn/gnome-software/package.nix
index dda5eef005eb..475449737e09 100644
--- a/pkgs/by-name/gn/gnome-software/package.nix
+++ b/pkgs/by-name/gn/gnome-software/package.nix
@@ -48,11 +48,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-software";
-  version = "48.2";
+  version = "48.3";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-software/${lib.versions.major finalAttrs.version}/gnome-software-${finalAttrs.version}.tar.xz";
-    hash = "sha256-q/0wZDqGxl9IhrZ2XrO7YhXJ6gmBfWvRZcUAVokIIsk=";
+    hash = "sha256-Emlx6LwADdwgAXjI+sj3EU7tQt5KTiASugaz/+cH4jo=";
   };
 
   patches = [

From f1ad3fdb48995bc8c8b40fa2c8b5c47cbc262437 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Sun, 13 Jul 2025 14:52:55 +0000
Subject: [PATCH 64/94] =?UTF-8?q?gnome-user-share:=2048.0=20=E2=86=92=2048?=
 =?UTF-8?q?.1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://gitlab.gnome.org/GNOME/gnome-user-share/-/compare/48.0...48.1
---
 pkgs/by-name/gn/gnome-user-share/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/gn/gnome-user-share/package.nix b/pkgs/by-name/gn/gnome-user-share/package.nix
index b49dd59173c8..cb300d5afd47 100644
--- a/pkgs/by-name/gn/gnome-user-share/package.nix
+++ b/pkgs/by-name/gn/gnome-user-share/package.nix
@@ -26,11 +26,11 @@ in
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-user-share";
-  version = "48.0";
+  version = "48.1";
 
   src = fetchurl {
     url = "mirror://gnome/sources/gnome-user-share/${lib.versions.major finalAttrs.version}/gnome-user-share-${finalAttrs.version}.tar.xz";
-    hash = "sha256-tVgFBwGVwvZYQVuc0shbLNFOqYHWGCOlANTWK4v4OAE=";
+    hash = "sha256-grz9TvPqf9eyr3+6mkW0dOF03NgowcS/5/+KLvhYunc=";
   };
 
   cargoDeps = rustPlatform.fetchCargoVendor {

From 859ada395b46198514d55b46f097dca46fb47de3 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Sun, 13 Jul 2025 14:53:19 +0000
Subject: [PATCH 65/94] =?UTF-8?q?libdex:=200.10.0=20=E2=86=92=200.10.1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://gitlab.gnome.org/GNOME/libdex/-/compare/0.10.0...0.10.1
---
 pkgs/by-name/li/libdex/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libdex/package.nix b/pkgs/by-name/li/libdex/package.nix
index a7a060d9dc6d..34078fc48c3c 100644
--- a/pkgs/by-name/li/libdex/package.nix
+++ b/pkgs/by-name/li/libdex/package.nix
@@ -15,7 +15,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "libdex";
-  version = "0.10.0";
+  version = "0.10.1";
 
   outputs = [
     "out"
@@ -25,7 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/libdex/${lib.versions.majorMinor finalAttrs.version}/libdex-${finalAttrs.version}.tar.xz";
-    hash = "sha256-mKaWJqp2Rq1FW+p6f5LSof+kfkVZoVShv+mMFvpxHuE=";
+    hash = "sha256-dHLogJDbKyKDB1Be3rpEg+hyaBNAywQErmSsPaW+0KY=";
   };
 
   nativeBuildInputs = [

From ea74420a54b2a097b294abcf64483a706408b8b4 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Sun, 13 Jul 2025 14:53:39 +0000
Subject: [PATCH 66/94] =?UTF-8?q?mutter:=2048.3.1=20=E2=86=92=2048.4?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://gitlab.gnome.org/GNOME/mutter/-/compare/48.3.1...48.4
---
 pkgs/by-name/mu/mutter/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/mu/mutter/package.nix b/pkgs/by-name/mu/mutter/package.nix
index aadec9a67011..840ed7f1d55e 100644
--- a/pkgs/by-name/mu/mutter/package.nix
+++ b/pkgs/by-name/mu/mutter/package.nix
@@ -72,7 +72,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "mutter";
-  version = "48.3.1";
+  version = "48.4";
 
   outputs = [
     "out"
@@ -83,7 +83,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/mutter/${lib.versions.major finalAttrs.version}/mutter-${finalAttrs.version}.tar.xz";
-    hash = "sha256-BvimrX/0+HOa9q8uF1PJHfp7mDl+UpRmMloQGMeVCmo=";
+    hash = "sha256-EYnPfmPMh8/dHzqG6PFNl8M9ap2iVPI+gWVVSbbFDZM=";
   };
 
   mesonFlags = [

From d670c4274622751f5216d702dd79fce0e5253432 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Sun, 13 Jul 2025 14:53:59 +0000
Subject: [PATCH 67/94] =?UTF-8?q?nautilus:=2048.2=20=E2=86=92=2048.3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://gitlab.gnome.org/GNOME/nautilus/-/compare/48.2...48.3
---
 pkgs/by-name/na/nautilus/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/na/nautilus/package.nix b/pkgs/by-name/na/nautilus/package.nix
index c1078773bb1a..0fad8a9d816d 100644
--- a/pkgs/by-name/na/nautilus/package.nix
+++ b/pkgs/by-name/na/nautilus/package.nix
@@ -40,7 +40,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "nautilus";
-  version = "48.2";
+  version = "48.3";
 
   outputs = [
     "out"
@@ -50,7 +50,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/nautilus/${lib.versions.major finalAttrs.version}/nautilus-${finalAttrs.version}.tar.xz";
-    hash = "sha256-oDD2Fj+KaAZPrlqeieN/Gcuyk94uEqGd1eIQlW0N9LU=";
+    hash = "sha256-IaKuoAUWDbCDx6HU0sCYm4RcxyLATvnrtgElp+xbOT0=";
   };
 
   patches = [

From 65a03038b93d8fa95461042889361c29bcc2e9e4 Mon Sep 17 00:00:00 2001
From: Bobby Rong <rjl931189261@126.com>
Date: Sun, 13 Jul 2025 14:54:17 +0000
Subject: [PATCH 68/94] =?UTF-8?q?vte:=200.80.2=20=E2=86=92=200.80.3?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

https://gitlab.gnome.org/GNOME/vte/-/compare/0.80.2...0.80.3
---
 pkgs/by-name/vt/vte/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/vt/vte/package.nix b/pkgs/by-name/vt/vte/package.nix
index 665dd9867921..153230409156 100644
--- a/pkgs/by-name/vt/vte/package.nix
+++ b/pkgs/by-name/vt/vte/package.nix
@@ -35,7 +35,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "vte";
-  version = "0.80.2";
+  version = "0.80.3";
 
   outputs = [
     "out"
@@ -44,7 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
 
   src = fetchurl {
     url = "mirror://gnome/sources/vte/${lib.versions.majorMinor finalAttrs.version}/vte-${finalAttrs.version}.tar.xz";
-    hash = "sha256-siW+vQQ2M71JHy6hcTdNDz+d5i3+wHZTBTvAjE+s5G8=";
+    hash = "sha256-Lllv0/vqu3FTFmIiTnH2osN/aEQmE21ihUYnJ2709pk=";
   };
 
   patches = [

From aa71528276f6e97368237c8043eb14b66cd16008 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 13 Jul 2025 16:45:43 +0000
Subject: [PATCH 69/94] phpPackages.castor: 0.25.0 -> 0.26.0

---
 pkgs/development/php-packages/castor/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/php-packages/castor/default.nix b/pkgs/development/php-packages/castor/default.nix
index f240a0348246..52fa0e4b74b7 100644
--- a/pkgs/development/php-packages/castor/default.nix
+++ b/pkgs/development/php-packages/castor/default.nix
@@ -9,16 +9,16 @@
 
 php.buildComposerProject2 (finalAttrs: {
   pname = "castor";
-  version = "0.25.0";
+  version = "0.26.0";
 
   src = fetchFromGitHub {
     owner = "jolicode";
     repo = "castor";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-qHCW/VHHMk8+/RL2HEW+RyaZaq7MsxB9RePwmgYHpDI=";
+    hash = "sha256-Aktr7mU2KP8Io6H0qXii1sVYkgb8wArYIgJ+OFb+/ao=";
   };
 
-  vendorHash = "sha256-DJ8iHhkLfe1GNf7eJHeE8ORt9cyRFLr0gLGeHENiASw=";
+  vendorHash = "sha256-CAsDHwv+oLoiLJ4pUdVvq4w8wD0QsIfYG/AIXASETqI=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From 0b5d0cd3487fa5beaa62646426144a82f62d631f Mon Sep 17 00:00:00 2001
From: Piotr Kwiecinski <2151333+piotrkwiecinski@users.noreply.github.com>
Date: Sun, 13 Jul 2025 19:07:03 +0200
Subject: [PATCH 70/94] php8{1-4}Extensions.spx: 0.4.18 -> 0.4.20

---
 pkgs/development/php-packages/spx/default.nix | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/pkgs/development/php-packages/spx/default.nix b/pkgs/development/php-packages/spx/default.nix
index 7b9e73b538de..b56996b944f7 100644
--- a/pkgs/development/php-packages/spx/default.nix
+++ b/pkgs/development/php-packages/spx/default.nix
@@ -6,7 +6,7 @@
 }:
 
 let
-  version = "0.4.18";
+  version = "0.4.20";
 in
 buildPecl {
   inherit version;
@@ -16,15 +16,13 @@ buildPecl {
     owner = "NoiseByNorthwest";
     repo = "php-spx";
     rev = "v${version}";
-    hash = "sha256-Dcv8ncYPIug7e24mvL1gn0x0CeLNAck8djm/r/yiPe8=";
+    hash = "sha256-2MOl9waWY3zK5NzQ19TJKK8kE7xC4K+e9AwV+wyAHZc=";
   };
 
-  configureFlags = [ "--with-zlib-dir=${zlib.dev}" ];
-
-  preConfigure = ''
-    substituteInPlace Makefile.frag \
-      --replace '$(INSTALL_ROOT)$(prefix)/share/misc/php-spx/assets/web-ui' '${placeholder "out"}/share/misc/php-spx/assets/web-ui'
-  '';
+  configureFlags = [
+    "--with-zlib-dir=${zlib.dev}"
+    "--with-spx-assets-dir=${placeholder "out"}/share/misc/php-spx/assets/"
+  ];
 
   meta = {
     changelog = "https://github.com/NoiseByNorthwest/php-spx/releases/tag/${version}";

From e9e1be0d97319d30c8f272a48b10b5657b3c8a62 Mon Sep 17 00:00:00 2001
From: blenderfreaky <blenderfreaky@mailbox.org>
Date: Sun, 13 Jul 2025 21:05:05 +0200
Subject: [PATCH 71/94] home-assistant-custom-components.lednetwf_ble: 0.0.14.2
 -> 0.0.15

---
 .../custom-components/lednetwf_ble/package.nix            | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-components/lednetwf_ble/package.nix b/pkgs/servers/home-assistant/custom-components/lednetwf_ble/package.nix
index 33b57159f978..4b880705dbc9 100644
--- a/pkgs/servers/home-assistant/custom-components/lednetwf_ble/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/lednetwf_ble/package.nix
@@ -8,7 +8,7 @@
   nix-update-script,
 }:
 let
-  version = "0.0.14.2";
+  version = "0.0.15";
 in
 buildHomeAssistantComponent {
   owner = "8none1";
@@ -18,8 +18,8 @@ buildHomeAssistantComponent {
   src = fetchFromGitHub {
     owner = "8none1";
     repo = "lednetwf_ble";
-    tag = "v.${version}";
-    hash = "sha256-FgLUBCIYsmvrU8auraFVJ+hnl/p6KHpEeIWMT4KGJBM=";
+    tag = "v${version}";
+    hash = "sha256-Ir3a6mr9OmBiiHRJktrv6HirHcVzKhc730aq6lynTmg=";
   };
 
   dependencies = [
@@ -36,7 +36,7 @@ buildHomeAssistantComponent {
   meta = {
     description = "Home Assistant custom integration for LEDnetWF devices";
     homepage = "https://github.com/8none1/lednetwf_ble";
-    changelog = "https://github.com/8none1/lednetwf_ble/releases/tag/v.${version}";
+    changelog = "https://github.com/8none1/lednetwf_ble/releases/tag/v${version}";
     license = lib.licenses.mit;
     maintainers = with lib.maintainers; [ blenderfreaky ];
   };

From 3a0cd56be2cab7e487c3c3e6c8d486c62da632db Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 13 Jul 2025 20:59:07 +0000
Subject: [PATCH 72/94] 
 vscode-extensions.ms-windows-ai-studio.windows-ai-studio: 0.16.0 -> 0.16.1

---
 .../ms-windows-ai-studio.windows-ai-studio/default.nix        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/ms-windows-ai-studio.windows-ai-studio/default.nix b/pkgs/applications/editors/vscode/extensions/ms-windows-ai-studio.windows-ai-studio/default.nix
index 11ccd1845d0e..00203e6a4b12 100644
--- a/pkgs/applications/editors/vscode/extensions/ms-windows-ai-studio.windows-ai-studio/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/ms-windows-ai-studio.windows-ai-studio/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension {
   mktplcRef = {
     name = "windows-ai-studio";
     publisher = "ms-windows-ai-studio";
-    version = "0.16.0";
-    hash = "sha256-JBHdwvlJ4BHlphABT2ViR03R4zRVSwkHkOw1n3bNzAQ=";
+    version = "0.16.1";
+    hash = "sha256-uhAUSXB7ULNmkRSHqfbo3T3AZ3TiUaIqEZL4YwkWxtY=";
   };
 
   meta = {

From 5a794e9af7ba6a6ed998814b75313f95e69f2560 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 13 Jul 2025 22:20:55 +0000
Subject: [PATCH 73/94] vscode-extensions.amazonwebservices.amazon-q-vscode:
 1.81.0 -> 1.83.0

---
 .../extensions/amazonwebservices.amazon-q-vscode/default.nix  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/applications/editors/vscode/extensions/amazonwebservices.amazon-q-vscode/default.nix b/pkgs/applications/editors/vscode/extensions/amazonwebservices.amazon-q-vscode/default.nix
index 3fb21266ac0c..9f82142adf50 100644
--- a/pkgs/applications/editors/vscode/extensions/amazonwebservices.amazon-q-vscode/default.nix
+++ b/pkgs/applications/editors/vscode/extensions/amazonwebservices.amazon-q-vscode/default.nix
@@ -7,8 +7,8 @@ vscode-utils.buildVscodeMarketplaceExtension (finalAttrs: {
   mktplcRef = {
     name = "amazon-q-vscode";
     publisher = "AmazonWebServices";
-    version = "1.81.0";
-    hash = "sha256-zuE+KR0iLEkQrxxS835ZYq20yxWgV1S14bay4shqVWg=";
+    version = "1.83.0";
+    hash = "sha256-BicMVFpCmG3/NnBJUG5w8B/5039SWx6kAv8SC+Vaj5c=";
   };
 
   meta = {

From f63ae8e9610c3644d9318b3b0f3add05fd65aced Mon Sep 17 00:00:00 2001
From: Gaetan Lepage <gaetan@glepage.com>
Date: Mon, 14 Jul 2025 00:31:45 +0200
Subject: [PATCH 74/94] presenterm: 0.14.0 -> 0.15.0

Diff: https://github.com/mfontanini/presenterm/compare/refs/tags/v0.14.0...refs/tags/v0.15.0

Changelog: https://github.com/mfontanini/presenterm/releases/tag/v0.15.0
---
 pkgs/by-name/pr/presenterm/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/pr/presenterm/package.nix b/pkgs/by-name/pr/presenterm/package.nix
index 3e270de606b9..2e9ba73dbba0 100644
--- a/pkgs/by-name/pr/presenterm/package.nix
+++ b/pkgs/by-name/pr/presenterm/package.nix
@@ -14,13 +14,13 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "presenterm";
-  version = "0.14.0";
+  version = "0.15.0";
 
   src = fetchFromGitHub {
     owner = "mfontanini";
     repo = "presenterm";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-vBEHk0gQe4kUTtH4qtc0jVfDvYGabnkJrwPxmxt10hs=";
+    hash = "sha256-6ziPuWbPOsSwlnqVN1cKaOvxVk3axFnPBsnCIZz2iTg=";
   };
 
   nativeBuildInputs =
@@ -40,7 +40,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   ];
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-u0wOWKAfzi1Fxmx6x2ckrIv/PKgtqKrDiDauD4/BY24=";
+  cargoHash = "sha256-UOPX5+RnnAStrsvBbL211m5NzYFjqbpIG/sdvoej1Rc=";
 
   env = lib.optionalAttrs (isDarwin && isx86_64) {
     NIX_CFLAGS_LINK = "-fuse-ld=lld";

From 3e953bce5d1830525ed89ad00a1c14f1077dc501 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 13 Jul 2025 22:59:43 +0000
Subject: [PATCH 75/94] crowdin-cli: 4.8.0 -> 4.9.0

---
 pkgs/by-name/cr/crowdin-cli/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/cr/crowdin-cli/package.nix b/pkgs/by-name/cr/crowdin-cli/package.nix
index 70626e0c2a46..0245a807e4f3 100644
--- a/pkgs/by-name/cr/crowdin-cli/package.nix
+++ b/pkgs/by-name/cr/crowdin-cli/package.nix
@@ -14,11 +14,11 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "crowdin-cli";
-  version = "4.8.0";
+  version = "4.9.0";
 
   src = fetchurl {
     url = "https://github.com/crowdin/crowdin-cli/releases/download/${finalAttrs.version}/crowdin-cli.zip";
-    hash = "sha256-4+D1O+/32aYbZs1aKAEPuKq3IDmZho7oX+zERRrGMpw=";
+    hash = "sha256-fPgcr0Gg0uIgDhnfowFp6K+NhtKdjThLd4yzjcZ78K4=";
   };
 
   nativeBuildInputs = [

From 9f5916f02edb4f4a6dc029a0c59b342c74217d3b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 13 Jul 2025 23:25:06 +0000
Subject: [PATCH 76/94] code-cursor: 1.2.1 -> 1.2.2

---
 pkgs/by-name/co/code-cursor/package.nix | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/co/code-cursor/package.nix b/pkgs/by-name/co/code-cursor/package.nix
index 725e38a37160..8b884edea82f 100644
--- a/pkgs/by-name/co/code-cursor/package.nix
+++ b/pkgs/by-name/co/code-cursor/package.nix
@@ -16,20 +16,20 @@ let
 
   sources = {
     x86_64-linux = fetchurl {
-      url = "https://downloads.cursor.com/production/031e7e0ff1e2eda9c1a0f5df67d44053b059c5df/linux/x64/Cursor-1.2.1-x86_64.AppImage";
-      hash = "sha256-2rOs5+85crKO/N9dCQLFfUXTfP9JVVR1s/g0bK2E78s=";
+      url = "https://downloads.cursor.com/production/faa03b17cce93e8a80b7d62d57f5eda6bb6ab9fa/linux/x64/Cursor-1.2.2-x86_64.AppImage";
+      hash = "sha256-mQr1QMw4wP+kHvE9RWPkCKtHObbr0jpyOxNw3LfTPfc=";
     };
     aarch64-linux = fetchurl {
-      url = "https://downloads.cursor.com/production/031e7e0ff1e2eda9c1a0f5df67d44053b059c5df/linux/arm64/Cursor-1.2.1-aarch64.AppImage";
-      hash = "sha256-Otg+NyW1DmrqIb0xqZCfJ4ys61/DBOQNgaAR8PMOCfg=";
+      url = "https://downloads.cursor.com/production/faa03b17cce93e8a80b7d62d57f5eda6bb6ab9fa/linux/arm64/Cursor-1.2.2-aarch64.AppImage";
+      hash = "sha256-EGvm/VW+NDTmOB1o2j3dpq4ckWbroFWEbF9Pezr8SZQ=";
     };
     x86_64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/production/031e7e0ff1e2eda9c1a0f5df67d44053b059c5df/darwin/x64/Cursor-darwin-x64.dmg";
-      hash = "sha256-Rh1erFG7UtGwO1NaM5+tq17mI5WdIX750pIzeO9AK+Q=";
+      url = "https://downloads.cursor.com/production/faa03b17cce93e8a80b7d62d57f5eda6bb6ab9fa/darwin/x64/Cursor-darwin-x64.dmg";
+      hash = "sha256-IDJklB8wMfrPpc2SO02iVBBE9d7fLN7JotVpPyCQkyE=";
     };
     aarch64-darwin = fetchurl {
-      url = "https://downloads.cursor.com/production/031e7e0ff1e2eda9c1a0f5df67d44053b059c5df/darwin/arm64/Cursor-darwin-arm64.dmg";
-      hash = "sha256-k/j3hJnHIdtfK9+T0aq2gFkRM+JulDt4FpU7n4HGEYM=";
+      url = "https://downloads.cursor.com/production/faa03b17cce93e8a80b7d62d57f5eda6bb6ab9fa/darwin/arm64/Cursor-darwin-arm64.dmg";
+      hash = "sha256-GxiNf58Kf5/l01eBhXRWMLMxAnj1txDQwSe5ei6nTgg=";
     };
   };
 
@@ -39,7 +39,7 @@ in
   inherit useVSCodeRipgrep;
   commandLineArgs = finalCommandLineArgs;
 
-  version = "1.2.1";
+  version = "1.2.2";
   pname = "cursor";
 
   # You can find the current VSCode version in the About dialog:

From 480338db33f288dc3b1212a4ab39a5e1d25ee02b Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 14 Jul 2025 04:38:22 +0000
Subject: [PATCH 77/94] python3Packages.jupyter-collaboration: 4.0.2 -> 4.1.0

---
 .../python-modules/jupyter-collaboration/default.nix        | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/python-modules/jupyter-collaboration/default.nix b/pkgs/development/python-modules/jupyter-collaboration/default.nix
index dace73df26e3..b990300eac78 100644
--- a/pkgs/development/python-modules/jupyter-collaboration/default.nix
+++ b/pkgs/development/python-modules/jupyter-collaboration/default.nix
@@ -23,14 +23,14 @@
 
 buildPythonPackage rec {
   pname = "jupyter-collaboration";
-  version = "4.0.2";
+  version = "4.1.0";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "jupyterlab";
     repo = "jupyter-collaboration";
     tag = "v${version}";
-    hash = "sha256-BCvTtrlP45YC9G/m/e8Nvbls7AugIaQzO2Gect1EmGE=";
+    hash = "sha256-PnfUWtOXdXYG5qfzAW5kATSQr2sWKDBNiINA8/G4ZX4=";
   };
 
   sourceRoot = "${src.name}/projects/jupyter-collaboration";
@@ -67,7 +67,7 @@ buildPythonPackage rec {
   meta = {
     description = "JupyterLab Extension enabling Real-Time Collaboration";
     homepage = "https://github.com/jupyterlab/jupyter_collaboration";
-    changelog = "https://github.com/jupyterlab/jupyter_collaboration/blob/v${version}/CHANGELOG.md";
+    changelog = "https://github.com/jupyterlab/jupyter_collaboration/blob/${src.tag}/CHANGELOG.md";
     license = lib.licenses.bsd3;
     teams = [ lib.teams.jupyter ];
   };

From ab1ab3e6d85cd71b60e259e5a3a964c80983adf5 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Sun, 13 Jul 2025 18:49:49 +0000
Subject: [PATCH 78/94] python3Packages.robotframework: 7.3.1 -> 7.3.2

---
 pkgs/development/python-modules/robotframework/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/robotframework/default.nix b/pkgs/development/python-modules/robotframework/default.nix
index b14f11541b29..7f30ea89797a 100644
--- a/pkgs/development/python-modules/robotframework/default.nix
+++ b/pkgs/development/python-modules/robotframework/default.nix
@@ -10,7 +10,7 @@
 
 buildPythonPackage rec {
   pname = "robotframework";
-  version = "7.3.1";
+  version = "7.3.2";
   pyproject = true;
 
   disabled = pythonOlder "3.8";
@@ -19,7 +19,7 @@ buildPythonPackage rec {
     owner = "robotframework";
     repo = "robotframework";
     tag = "v${version}";
-    hash = "sha256-gcmHud5HPDwRSXX3VD+mpeD2ySdV6BIhfPfvDdz9OsQ=";
+    hash = "sha256-JxZI0i9Aj/TX4BkIi+jeBdTy0ckv5Fdy5tHRI9vQ8Ss=";
   };
 
   build-system = [ setuptools ];

From 5d82cd9e7c6892569de0fda68920b7ab276001de Mon Sep 17 00:00:00 2001
From: "R. RyanTM" <ryantm-bot@ryantm.com>
Date: Mon, 14 Jul 2025 17:08:43 +1000
Subject: [PATCH 79/94] 
 home-assistant-custom-lovelace-modules.advanced-camera-card: 7.14.1 -> 7.14.2
 (#424967)

https://github.com/dermotduffy/advanced-camera-card/releases/tag/v7.14.2
---
 .../custom-lovelace-modules/advanced-camera-card/package.nix  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/advanced-camera-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/advanced-camera-card/package.nix
index 4f71a69943a0..4f834e41bbdb 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/advanced-camera-card/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/advanced-camera-card/package.nix
@@ -6,11 +6,11 @@
 
 stdenv.mkDerivation rec {
   pname = "advanced-camera-card";
-  version = "7.14.1";
+  version = "7.14.2";
 
   src = fetchzip {
     url = "https://github.com/dermotduffy/advanced-camera-card/releases/download/v${version}/advanced-camera-card.zip";
-    hash = "sha256-SBUDM4+uayW5MJFs7arHXs1WzBmlHntVlE2hDBtGlAI=";
+    hash = "sha256-I4ZrkhrwP+b7IHNWbGpGPmlH9CP7o2mFTfN5J1fOY/E=";
   };
 
   # TODO: build from source once yarn berry support lands in nixpkgs

From e084a24b594fa6b947ea4ba5ca46668788ef4eda Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Vladim=C3=ADr=20=C4=8Cun=C3=A1t?= <v@cunat.cz>
Date: Mon, 14 Jul 2025 09:31:43 +0200
Subject: [PATCH 80/94] plasma5Packages.kimageformats: temporarily disable
 libavif support

See commit 2c91b7b6b8e for version 6.*
---
 pkgs/development/libraries/kde-frameworks/kimageformats.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/libraries/kde-frameworks/kimageformats.nix b/pkgs/development/libraries/kde-frameworks/kimageformats.nix
index bc1b86099939..763e866a1c51 100644
--- a/pkgs/development/libraries/kde-frameworks/kimageformats.nix
+++ b/pkgs/development/libraries/kde-frameworks/kimageformats.nix
@@ -23,7 +23,8 @@ mkDerivation {
   buildInputs = [
     karchive
     openexr
-    libavif
+    # FIXME: cmake files are broken, disabled for now
+    # libavif
     libheif
     libjxl
     libraw

From 089a8d87cb089fc91f10adf9d559959886893506 Mon Sep 17 00:00:00 2001
From: Jeremy Fleischman <jeremyfleischman@gmail.com>
Date: Fri, 11 Jul 2025 11:49:31 -0700
Subject: [PATCH 81/94] 
 home-assistant-custom-lovelace-modules.restriction-card: init at 1.2.19

---
 .../restriction-card/package.nix              | 36 +++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 pkgs/servers/home-assistant/custom-lovelace-modules/restriction-card/package.nix

diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/restriction-card/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/restriction-card/package.nix
new file mode 100644
index 000000000000..3c14c273d465
--- /dev/null
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/restriction-card/package.nix
@@ -0,0 +1,36 @@
+{
+  lib,
+  buildNpmPackage,
+  fetchFromGitHub,
+}:
+
+buildNpmPackage (finalAttrs: {
+  pname = "restriction-card";
+  version = "1.2.19";
+
+  src = fetchFromGitHub {
+    owner = "iantrich";
+    repo = "restriction-card";
+    tag = finalAttrs.version;
+    hash = "sha256-2scUSEpDPrMoos/QuOqXARAf1IL8P4gJaga7LRQ/67U=";
+  };
+
+  npmDepsHash = "sha256-9Hz+7Q4i5baIWxVIo6e8d5isvZWnJW2947q5Uk0Gm9w=";
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir $out
+    install -m0644 dist/restriction-card.js $out
+
+    runHook postInstall
+  '';
+
+  meta = {
+    changelog = "https://github.com/iantrich/restriction-card/releases/tag/${finalAttrs.src.tag}";
+    description = "Apply restrictions to Lovelace cards";
+    homepage = "https://github.com/iantrich/restriction-card";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ jfly ];
+  };
+})

From a9032d8b0daddfa9172269b1420e17b987bc9245 Mon Sep 17 00:00:00 2001
From: botnk <github-botnk@korz.dev>
Date: Thu, 10 Jul 2025 01:49:16 +0000
Subject: [PATCH 82/94] zed-editor: 0.193.3 -> 0.194.3

Changelog: https://github.com/zed-industries/zed/releases/tag/v0.194.3
---
 pkgs/by-name/ze/zed-editor/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ze/zed-editor/package.nix b/pkgs/by-name/ze/zed-editor/package.nix
index 6f4e92fdd96c..9c25ecd1b900 100644
--- a/pkgs/by-name/ze/zed-editor/package.nix
+++ b/pkgs/by-name/ze/zed-editor/package.nix
@@ -99,7 +99,7 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "zed-editor";
-  version = "0.193.3";
+  version = "0.194.3";
 
   outputs =
     [ "out" ]
@@ -111,7 +111,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "zed-industries";
     repo = "zed";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-6/WRuO0UgQFtV0nK8/u3mZPYfAqVzemi3LzuCprOSgY=";
+    hash = "sha256-KF83XTCOWi78Uq720YSpJ6+JzllhqJQKLCqzq2WFS/U=";
   };
 
   patches = [
@@ -138,7 +138,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     '';
 
   useFetchCargoVendor = true;
-  cargoHash = "sha256-FG2JFnruGqUbIbCeBCqhuzrT/pwDv1tqpAYRMnmvxHk=";
+  cargoHash = "sha256-gSM3Qd87rhtG/oPLe3b1ItJmz9G4AEJY5h81lTz9Kl0=";
 
   nativeBuildInputs =
     [

From d1daa51173cb55804a0a87dfc87954b5f3a303d8 Mon Sep 17 00:00:00 2001
From: liberodark <liberodark@gmail.com>
Date: Tue, 28 Jan 2025 19:30:13 +0100
Subject: [PATCH 83/94] jumpy: 0.8.0 -> 0.12.2

---
 pkgs/by-name/ju/jumpy/package.nix | 27 +++++++++++++++++++--------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/pkgs/by-name/ju/jumpy/package.nix b/pkgs/by-name/ju/jumpy/package.nix
index ebca0dc9095c..08da47828918 100644
--- a/pkgs/by-name/ju/jumpy/package.nix
+++ b/pkgs/by-name/ju/jumpy/package.nix
@@ -2,6 +2,7 @@
   lib,
   rustPlatform,
   fetchFromGitHub,
+  fetchpatch2,
   makeWrapper,
   pkg-config,
   zstd,
@@ -14,19 +15,27 @@
   xorg,
 }:
 
-rustPlatform.buildRustPackage rec {
+rustPlatform.buildRustPackage (finalAttrs: {
   pname = "jumpy";
-  version = "0.8.0";
+  version = "0.12.2";
 
   src = fetchFromGitHub {
     owner = "fishfolk";
     repo = "jumpy";
-    rev = "v${version}";
-    sha256 = "sha256-ggePJH2kKJ17aOWRKUnLyolIdSzlc6Axf5Iw74iFfek=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-g/CpSycTCM1i6O7Mir+3huabvr4EXghDApquEUNny8c=";
   };
 
+  # This patch may be removed in the next release
+  cargoPatches = [
+    (fetchpatch2 {
+      url = "https://github.com/fishfolk/jumpy/commit/8234e6d2c0b33c75e2112596ded1734fdba50fb8.patch?full_index=1";
+      hash = "sha256-IWjBw1Wj/6CT/x6xm6vfpUMfk7A5/EsdbPDvWywRFc8=";
+    })
+  ];
+
   useFetchCargoVendor = true;
-  cargoHash = "sha256-hVEpTNTXwOQoxlhOewUvHyfBh+APnx8Fox90CmdMRQ4=";
+  cargoHash = "sha256-2I9s1zH94GRqXGBxZYyXOQwNeYrpV1UhUSKGCs9Ce9Q=";
 
   nativeBuildInputs = [
     makeWrapper
@@ -77,12 +86,14 @@ rustPlatform.buildRustPackage rec {
   meta = {
     description = "Tactical 2D shooter played by up to 4 players online or on a shared screen";
     mainProgram = "jumpy";
-    homepage = "https://fishfight.org/";
-    changelog = "https://github.com/fishfolk/jumpy/releases/tag/v${version}";
+    homepage = "https://fishfolk.org/games/jumpy";
+    changelog = "https://github.com/fishfolk/jumpy/releases/tag/v${finalAttrs.version}";
     license = with lib.licenses; [
       mit # or
       asl20
+      # Assets
+      cc-by-nc-40
     ];
     maintainers = with lib.maintainers; [ figsoda ];
   };
-}
+})

From bb4936d520360c91c8ce8b22e332f68d920ee683 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 14 Jul 2025 08:15:16 +0000
Subject: [PATCH 84/94] dbeaver-bin: 25.1.1 -> 25.1.2

---
 pkgs/by-name/db/dbeaver-bin/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/db/dbeaver-bin/package.nix b/pkgs/by-name/db/dbeaver-bin/package.nix
index e7d4db0cd085..88df87ea873b 100644
--- a/pkgs/by-name/db/dbeaver-bin/package.nix
+++ b/pkgs/by-name/db/dbeaver-bin/package.nix
@@ -18,7 +18,7 @@
 
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "dbeaver-bin";
-  version = "25.1.1";
+  version = "25.1.2";
 
   src =
     let
@@ -31,10 +31,10 @@ stdenvNoCC.mkDerivation (finalAttrs: {
         aarch64-darwin = "macos-aarch64.dmg";
       };
       hash = selectSystem {
-        x86_64-linux = "sha256-PFY1eZFG8mvbG6D7pDJBBbsySeNmw6/DlxSyNvCJcSI=";
-        aarch64-linux = "sha256-Fny8+XA7N3rmXqP2UfTPYFIwHHSZTLbABjm+ESMoFJ4=";
-        x86_64-darwin = "sha256-/U8lcvJotAB+K0pQWpy6RIRqbfJzqVefS67qF9arzw0=";
-        aarch64-darwin = "sha256-lfz+B2ZHaBoyDKduDn45ocSTMAsS/bBXrByBeIZb0Ew=";
+        x86_64-linux = "sha256-jyqUIar/RnUvcnXOB3/c7F5BAcpUVL3ufnGuKNGHq0M=";
+        aarch64-linux = "sha256-1aEbrgPVIaWG3rUwHQCcnVTQtRgS2ksjqH5l13eR7NY=";
+        x86_64-darwin = "sha256-n6cu7wzC4GowWGUMF2vg+kA+tiOWzgaWLcUw0I/fCXU=";
+        aarch64-darwin = "sha256-XRFg11t6kiBTPhX8wZbVkHotacjRu3BK1MMGaHDJs6s=";
       };
     in
     fetchurl {

From 5e710aa4f758492895f903a8fd236d54d6b2e6df Mon Sep 17 00:00:00 2001
From: sternenseemann <sternenseemann@systemli.org>
Date: Sat, 12 Jul 2025 22:56:45 +0200
Subject: [PATCH 85/94] haskellPackages.xml-picklers: fix edge case in test
 suite

We've noticed this issue on Hydra already some 10 years ago, but
apparently never applied the patch the upstream developer authored
later (but unfortunately never released).
---
 pkgs/development/haskell-modules/configuration-common.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkgs/development/haskell-modules/configuration-common.nix b/pkgs/development/haskell-modules/configuration-common.nix
index be9ce186e3e3..1f2bb0174a32 100644
--- a/pkgs/development/haskell-modules/configuration-common.nix
+++ b/pkgs/development/haskell-modules/configuration-common.nix
@@ -762,6 +762,14 @@ with haskellLib;
   HerbiePlugin = dontCheck super.HerbiePlugin;
   wai-cors = dontCheck super.wai-cors;
 
+  # Apply patch fixing an incorrect QuickCheck property which occasionally causes false negatives
+  # https://github.com/Philonous/xml-picklers/issues/5
+  xml-picklers = appendPatch (pkgs.fetchpatch {
+    name = "xml-picklers-fix-prop-xp-attribute.patch";
+    url = "https://github.com/Philonous/xml-picklers/commit/887e5416b5e61c589cadf775d82013eb87751ea2.patch";
+    sha256 = "sha256-EAyTVkAqCvJ0lRD0+q/htzBJ8iD5qP47j5i2fKhRrlw=";
+  }) super.xml-picklers;
+
   # 2024-05-18: Upstream tests against a different pandoc version
   pandoc-crossref = dontCheck super.pandoc-crossref;
 

From fd61e1c200f03e87ba4cf2868200ee7032a3a36d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Sun, 6 Jul 2025 18:58:28 +0200
Subject: [PATCH 86/94] pnpm.fetchDeps: introduce versioning

---
 .../javascript.section.md                     | 35 +++++++++++++++++++
 doc/redirects.json                            |  6 ++++
 .../ba/bash-language-server/package.nix       |  1 +
 .../tools/pnpm/fetch-deps/default.nix         |  6 ++++
 .../tools/pnpm/fetch-deps/pnpm-config-hook.sh |  7 ++++
 5 files changed, 55 insertions(+)

diff --git a/doc/languages-frameworks/javascript.section.md b/doc/languages-frameworks/javascript.section.md
index e327eb43ea40..f91ea3e60e0e 100644
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@@ -444,6 +444,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "...";
+    fetcherVersion = 1;
   };
 })
 ```
@@ -558,6 +559,40 @@ set `prePnpmInstall` to the right commands to run. For example:
 
 In this example, `prePnpmInstall` will be run by both `pnpm.configHook` and by the `pnpm.fetchDeps` builder.
 
+#### PNPM `fetcherVersion` {#javascript-pnpm-fetcherVersion}
+
+This is the version of the output of `pnpm.fetchDeps`, if you haven't set it already, you can use `1` with your current hash:
+
+```nix
+{
+  # ...
+  pnpmDeps = pnpm.fetchDeps {
+    # ...
+    hash = "..."; # you can use your already set hash here
+    fetcherVersion = 1;
+  };
+}
+```
+
+After upgrading to a newer `fetcherVersion`, you need to regenerate the hash:
+
+```nix
+{
+  # ...
+  pnpmDeps = pnpm.fetchDeps {
+    # ...
+    hash = "..."; # clear this hash and generate a new one
+    fetcherVersion = 2;
+  };
+}
+```
+
+This variable ensures that we can make changes to the output of `pnpm.fetchDeps` without breaking existing hashes.
+Changes can include workarounds or bug fixes to existing PNPM issues.
+
+##### Version history {#javascript-pnpm-fetcherVersion-versionHistory}
+
+- 1: Initial version, nothing special
 
 ### Yarn {#javascript-yarn}
 
diff --git a/doc/redirects.json b/doc/redirects.json
index c262568cf5ca..bf27cda98186 100644
--- a/doc/redirects.json
+++ b/doc/redirects.json
@@ -3347,6 +3347,12 @@
   "javascript-pnpm-extraCommands": [
     "index.html#javascript-pnpm-extraCommands"
   ],
+  "javascript-pnpm-fetcherVersion": [
+    "index.html#javascript-pnpm-fetcherVersion"
+  ],
+  "javascript-pnpm-fetcherVersion-versionHistory": [
+    "index.html#javascript-pnpm-fetcherVersion-versionHistory"
+  ],
   "javascript-yarn": [
     "index.html#javascript-yarn"
   ],
diff --git a/pkgs/by-name/ba/bash-language-server/package.nix b/pkgs/by-name/ba/bash-language-server/package.nix
index 49e85c9f6661..f03d0195e32c 100644
--- a/pkgs/by-name/ba/bash-language-server/package.nix
+++ b/pkgs/by-name/ba/bash-language-server/package.nix
@@ -29,6 +29,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       pnpmWorkspaces
       ;
     hash = "sha256-NvyqPv5OKgZi3hW98Da8LhsYatmrzrPX8kLOfLr+BrI=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/development/tools/pnpm/fetch-deps/default.nix b/pkgs/development/tools/pnpm/fetch-deps/default.nix
index 8e26d173fd90..7403548e8792 100644
--- a/pkgs/development/tools/pnpm/fetch-deps/default.nix
+++ b/pkgs/development/tools/pnpm/fetch-deps/default.nix
@@ -22,6 +22,7 @@ in
       pnpmWorkspaces ? [ ],
       prePnpmInstall ? "",
       pnpmInstallFlags ? [ ],
+      fetcherVersion ? 1,
       ...
     }@args:
     let
@@ -96,6 +97,11 @@ in
                 --registry="$NIX_NPM_REGISTRY" \
                 --frozen-lockfile
 
+            # Store newer fetcherVersion in case pnpm.configHook also needs it
+            if [[ ${toString fetcherVersion} -gt 1 ]]; then
+              echo ${toString fetcherVersion} > $out/.fetcher-version
+            fi
+
             runHook postInstall
           '';
 
diff --git a/pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh b/pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh
index f66f06c0a867..a9fc3050435b 100644
--- a/pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh
+++ b/pkgs/development/tools/pnpm/fetch-deps/pnpm-config-hook.sh
@@ -12,6 +12,13 @@ pnpmConfigHook() {
       exit 1
     fi
 
+    fetcherVersion=1
+    if [[ -e "${pnpmDeps}/.fetcher-version" ]]; then
+      fetcherVersion=$(cat "${pnpmDeps}/.fetcher-version")
+    fi
+
+    echo "Using fetcherVersion: $fetcherVersion"
+
     echo "Configuring pnpm store"
 
     export HOME=$(mktemp -d)

From 09a31a6397a080b637a984a2baa81cc83d41f140 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Mon, 14 Jul 2025 11:51:34 +0200
Subject: [PATCH 87/94] treewide: set `pnpm.fetchDeps` `fetcherVersion` to 1

---
 pkgs/applications/audio/youtube-music/default.nix               | 1 +
 pkgs/by-name/ao/aonsoku/package.nix                             | 1 +
 pkgs/by-name/ap/apache-answer/package.nix                       | 1 +
 pkgs/by-name/ar/artalk/package.nix                              | 1 +
 pkgs/by-name/as/astro-language-server/package.nix               | 1 +
 pkgs/by-name/au/autobrr/package.nix                             | 1 +
 pkgs/by-name/au/autoprefixer/package.nix                        | 1 +
 pkgs/by-name/ba/backrest/package.nix                            | 1 +
 pkgs/by-name/bu/bumpp/package.nix                               | 1 +
 pkgs/by-name/ca/cargo-tauri/test-app.nix                        | 1 +
 pkgs/by-name/cd/cdxgen/package.nix                              | 1 +
 pkgs/by-name/cl/clash-verge-rev/unwrapped.nix                   | 1 +
 pkgs/by-name/co/concurrently/package.nix                        | 1 +
 pkgs/by-name/da/daed/package.nix                                | 1 +
 pkgs/by-name/de/deltachat-desktop/package.nix                   | 1 +
 pkgs/by-name/do/dorion/package.nix                              | 1 +
 pkgs/by-name/em/emmet-language-server/package.nix               | 1 +
 pkgs/by-name/en/en-croissant/package.nix                        | 1 +
 pkgs/by-name/eq/equibop/package.nix                             | 1 +
 pkgs/by-name/eq/equicord/package.nix                            | 1 +
 pkgs/by-name/et/etherpad-lite/package.nix                       | 1 +
 pkgs/by-name/fe/fedistar/package.nix                            | 1 +
 pkgs/by-name/fi/filebrowser/package.nix                         | 1 +
 pkgs/by-name/fi/firezone-gui-client/package.nix                 | 1 +
 pkgs/by-name/fi/firezone-server/package.nix                     | 1 +
 pkgs/by-name/fl/flood/package.nix                               | 1 +
 pkgs/by-name/fo/follow/package.nix                              | 1 +
 pkgs/by-name/fr/froide/package.nix                              | 1 +
 pkgs/by-name/gi/gitbutler/package.nix                           | 1 +
 pkgs/by-name/gi/gitify/package.nix                              | 1 +
 pkgs/by-name/go/goofcord/package.nix                            | 1 +
 pkgs/by-name/gu/gui-for-clash/package.nix                       | 1 +
 pkgs/by-name/gu/gui-for-singbox/package.nix                     | 1 +
 pkgs/by-name/he/heroic-unwrapped/package.nix                    | 1 +
 pkgs/by-name/ho/homebox/package.nix                             | 1 +
 pkgs/by-name/ho/homepage-dashboard/package.nix                  | 1 +
 pkgs/by-name/ho/homer/package.nix                               | 1 +
 pkgs/by-name/it/it-tools/package.nix                            | 1 +
 pkgs/by-name/je/jellyseerr/package.nix                          | 1 +
 pkgs/by-name/ka/karakeep/package.nix                            | 1 +
 pkgs/by-name/le/legcord/package.nix                             | 1 +
 pkgs/by-name/me/memos/package.nix                               | 1 +
 pkgs/by-name/me/metacubexd/package.nix                          | 1 +
 pkgs/by-name/mi/misskey/package.nix                             | 1 +
 pkgs/by-name/mo/modrinth-app-unwrapped/package.nix              | 1 +
 pkgs/by-name/mo/moonfire-nvr/package.nix                        | 1 +
 pkgs/by-name/mo/moonlight/package.nix                           | 1 +
 pkgs/by-name/n8/n8n/package.nix                                 | 1 +
 pkgs/by-name/ni/ni/package.nix                                  | 1 +
 pkgs/by-name/oc/ocis/package.nix                                | 1 +
 pkgs/by-name/oc/ocis/web.nix                                    | 1 +
 pkgs/by-name/op/opencloud/idp-web.nix                           | 1 +
 pkgs/by-name/op/opencloud/web.nix                               | 1 +
 pkgs/by-name/op/openlist/frontend.nix                           | 1 +
 pkgs/by-name/ov/overlayed/package.nix                           | 1 +
 pkgs/by-name/pa/paperless-ngx/package.nix                       | 1 +
 pkgs/by-name/pa/parca/package.nix                               | 1 +
 pkgs/by-name/pd/pds/package.nix                                 | 1 +
 pkgs/by-name/pg/pgrok/package.nix                               | 1 +
 pkgs/by-name/pi/piped/package.nix                               | 1 +
 pkgs/by-name/po/podman-desktop/package.nix                      | 1 +
 pkgs/by-name/po/porn-vault/package.nix                          | 1 +
 pkgs/by-name/po/pot/package.nix                                 | 1 +
 pkgs/by-name/pr/prisma/package.nix                              | 1 +
 pkgs/by-name/qu/quantframe/package.nix                          | 1 +
 pkgs/by-name/re/readest/package.nix                             | 1 +
 pkgs/by-name/re/renovate/package.nix                            | 1 +
 pkgs/by-name/rm/rmfakecloud/package.nix                         | 1 +
 pkgs/by-name/rq/rquickshare/package.nix                         | 1 +
 pkgs/by-name/rs/rsshub/package.nix                              | 1 +
 pkgs/by-name/sa/satisfactorymodmanager/package.nix              | 1 +
 pkgs/by-name/sh/shadcn/package.nix                              | 1 +
 pkgs/by-name/sh/sharkey/package.nix                             | 1 +
 pkgs/by-name/si/signal-desktop/package.nix                      | 2 ++
 pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix             | 1 +
 pkgs/by-name/si/siyuan/package.nix                              | 1 +
 pkgs/by-name/sk/sketchybar-app-font/package.nix                 | 1 +
 pkgs/by-name/sl/slimevr/package.nix                             | 1 +
 pkgs/by-name/sp/splayer/package.nix                             | 1 +
 pkgs/by-name/st/stylelint-lsp/package.nix                       | 1 +
 pkgs/by-name/su/surrealist/package.nix                          | 1 +
 pkgs/by-name/sy/synchrony/package.nix                           | 1 +
 pkgs/by-name/sy/syncyomi/package.nix                            | 1 +
 pkgs/by-name/ta/tabby-agent/package.nix                         | 1 +
 pkgs/by-name/ta/tailwindcss-language-server/package.nix         | 1 +
 pkgs/by-name/ta/taler-wallet-core/package.nix                   | 1 +
 pkgs/by-name/ta/taze/package.nix                                | 1 +
 pkgs/by-name/te/teleport/package.nix                            | 1 +
 pkgs/by-name/ts/tsx/package.nix                                 | 1 +
 pkgs/by-name/ty/typespec/package.nix                            | 1 +
 pkgs/by-name/ve/vencord/package.nix                             | 1 +
 pkgs/by-name/ve/vesktop/package.nix                             | 1 +
 pkgs/by-name/vi/vikunja/package.nix                             | 1 +
 pkgs/by-name/vo/voicevox/package.nix                            | 1 +
 pkgs/by-name/vt/vtsls/package.nix                               | 1 +
 pkgs/by-name/we/wealthfolio/package.nix                         | 1 +
 pkgs/by-name/wo/wox/package.nix                                 | 1 +
 pkgs/by-name/wr/wrangler/package.nix                            | 1 +
 pkgs/by-name/za/zammad/package.nix                              | 1 +
 pkgs/by-name/za/zashboard/package.nix                           | 1 +
 pkgs/by-name/ze/zenn-cli/package.nix                            | 1 +
 pkgs/by-name/zi/zigbee2mqtt_2/package.nix                       | 1 +
 pkgs/by-name/zi/zipline/package.nix                             | 1 +
 .../development/python-modules/django-filingcabinet/default.nix | 1 +
 pkgs/development/python-modules/gradio/default.nix              | 1 +
 pkgs/servers/authelia/web.nix                                   | 1 +
 .../custom-lovelace-modules/custom-sidebar/package.nix          | 1 +
 pkgs/servers/web-apps/discourse/default.nix                     | 1 +
 pkgs/servers/web-apps/lemmy/ui.nix                              | 1 +
 109 files changed, 110 insertions(+)

diff --git a/pkgs/applications/audio/youtube-music/default.nix b/pkgs/applications/audio/youtube-music/default.nix
index 871c0ca56807..c89793a26ee0 100644
--- a/pkgs/applications/audio/youtube-music/default.nix
+++ b/pkgs/applications/audio/youtube-music/default.nix
@@ -25,6 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-xIQyTetHU37gTxCcQp4VCqzGdIfVQGy/aORCVba6YQ0=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ao/aonsoku/package.nix b/pkgs/by-name/ao/aonsoku/package.nix
index 03fa9cc13a3d..b58573ad4aee 100644
--- a/pkgs/by-name/ao/aonsoku/package.nix
+++ b/pkgs/by-name/ao/aonsoku/package.nix
@@ -28,6 +28,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pnpmDeps = pnpm_8.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-h1rcM+H2c0lk7bpGeQT5ue9bQIggrCFHkj4o7KxnH08=";
+    fetcherVersion = 1;
   };
 
   cargoRoot = "src-tauri";
diff --git a/pkgs/by-name/ap/apache-answer/package.nix b/pkgs/by-name/ap/apache-answer/package.nix
index efa453863614..5e657cf8f680 100644
--- a/pkgs/by-name/ap/apache-answer/package.nix
+++ b/pkgs/by-name/ap/apache-answer/package.nix
@@ -29,6 +29,7 @@ buildGoModule rec {
       inherit src version pname;
       sourceRoot = "${src.name}/ui";
       hash = "sha256-/se6IWeHdazqS7PzOpgtT4IxCJ1WptqBzZ/BdmGb4BA=";
+      fetcherVersion = 1;
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/ar/artalk/package.nix b/pkgs/by-name/ar/artalk/package.nix
index 4c1507a9f793..d0d94f2afa1c 100644
--- a/pkgs/by-name/ar/artalk/package.nix
+++ b/pkgs/by-name/ar/artalk/package.nix
@@ -34,6 +34,7 @@ let
     pnpmDeps = pnpm_9.fetchDeps {
       inherit (finalAttrs) pname version src;
       hash = "sha256-QIfadS2gNPtH006O86EndY/Hx2ml2FoKfUXJF5qoluw=";
+      fetcherVersion = 1;
     };
 
     buildPhase = ''
diff --git a/pkgs/by-name/as/astro-language-server/package.nix b/pkgs/by-name/as/astro-language-server/package.nix
index 4f96e607fc1b..c1d467284a0e 100644
--- a/pkgs/by-name/as/astro-language-server/package.nix
+++ b/pkgs/by-name/as/astro-language-server/package.nix
@@ -26,6 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
       prePnpmInstall
       ;
     hash = "sha256-tlpk+wbLjJqt37lu67p2A2RZAR1ZfnZFiYoqIQwvWPQ=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/au/autobrr/package.nix b/pkgs/by-name/au/autobrr/package.nix
index ba8eeade0a0f..b545937a1ddc 100644
--- a/pkgs/by-name/au/autobrr/package.nix
+++ b/pkgs/by-name/au/autobrr/package.nix
@@ -41,6 +41,7 @@ let
         sourceRoot
         ;
       hash = "sha256-TbdRJqLdNI7wchUsx2Kw1LlDyv50XlCiKyn6rhZyN1U=";
+      fetcherVersion = 1;
     };
 
     postBuild = ''
diff --git a/pkgs/by-name/au/autoprefixer/package.nix b/pkgs/by-name/au/autoprefixer/package.nix
index 3713dd359c3d..31662f322b7e 100644
--- a/pkgs/by-name/au/autoprefixer/package.nix
+++ b/pkgs/by-name/au/autoprefixer/package.nix
@@ -26,6 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-zb/BwL//i0oly5HEXN20E3RzZXdaOn+G2yIWRas3PB4=";
+    fetcherVersion = 1;
   };
 
   installPhase = ''
diff --git a/pkgs/by-name/ba/backrest/package.nix b/pkgs/by-name/ba/backrest/package.nix
index 760cd77ed852..55f1a97532d8 100644
--- a/pkgs/by-name/ba/backrest/package.nix
+++ b/pkgs/by-name/ba/backrest/package.nix
@@ -34,6 +34,7 @@ let
     pnpmDeps = pnpm_9.fetchDeps {
       inherit (finalAttrs) pname version src;
       hash = "sha256-q7VMQb/FRT953yT2cyGMxUPp8p8XkA9mvqGI7S7Eifg=";
+      fetcherVersion = 1;
     };
 
     buildPhase = ''
diff --git a/pkgs/by-name/bu/bumpp/package.nix b/pkgs/by-name/bu/bumpp/package.nix
index b557e8f14eb8..3b05d5a65df2 100644
--- a/pkgs/by-name/bu/bumpp/package.nix
+++ b/pkgs/by-name/bu/bumpp/package.nix
@@ -25,6 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-duxpym1DlJM4q5j0wmrubYiAHQ3cDEFfeD9Gyic6mbI=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ca/cargo-tauri/test-app.nix b/pkgs/by-name/ca/cargo-tauri/test-app.nix
index 2f5401e4e4cf..af0c230af635 100644
--- a/pkgs/by-name/ca/cargo-tauri/test-app.nix
+++ b/pkgs/by-name/ca/cargo-tauri/test-app.nix
@@ -35,6 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
       ;
 
     hash = "sha256-plANa/+9YEQ4ipgdQ7QzPyxgz6eDCBhO7qFlxK6Ab58=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/cd/cdxgen/package.nix b/pkgs/by-name/cd/cdxgen/package.nix
index bcca4ac226ed..3fa6ec4c0a45 100644
--- a/pkgs/by-name/cd/cdxgen/package.nix
+++ b/pkgs/by-name/cd/cdxgen/package.nix
@@ -38,6 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-7NrDYd4H0cPQs8w4lWlB0BhqcYZVo6/9zf0ujPjBzsE=";
+    fetcherVersion = 1;
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/cl/clash-verge-rev/unwrapped.nix b/pkgs/by-name/cl/clash-verge-rev/unwrapped.nix
index 5c4f49447278..42c311251c50 100644
--- a/pkgs/by-name/cl/clash-verge-rev/unwrapped.nix
+++ b/pkgs/by-name/cl/clash-verge-rev/unwrapped.nix
@@ -38,6 +38,7 @@ rustPlatform.buildRustPackage {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     hash = pnpm-hash;
+    fetcherVersion = 1;
   };
 
   env = {
diff --git a/pkgs/by-name/co/concurrently/package.nix b/pkgs/by-name/co/concurrently/package.nix
index f6b3a6166be0..b89146d333c9 100644
--- a/pkgs/by-name/co/concurrently/package.nix
+++ b/pkgs/by-name/co/concurrently/package.nix
@@ -30,6 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
       patches
       ;
     hash = "sha256-F1teWIABkK0mqZcK3RdGNKmexI/C59QWSrrD1jYbHt0=";
+    fetcherVersion = 1;
   };
 
   patches = [
diff --git a/pkgs/by-name/da/daed/package.nix b/pkgs/by-name/da/daed/package.nix
index 5fcd7389b94d..618a7d85a16f 100644
--- a/pkgs/by-name/da/daed/package.nix
+++ b/pkgs/by-name/da/daed/package.nix
@@ -28,6 +28,7 @@ let
     pnpmDeps = pnpm_9.fetchDeps {
       inherit pname version src;
       hash = "sha256-+yLpSbDzr1OV/bmUUg6drOvK1ok3cBd+RRV7Qrrlp+Q=";
+      fetcherVersion = 1;
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/de/deltachat-desktop/package.nix b/pkgs/by-name/de/deltachat-desktop/package.nix
index 443c6f672acf..0f5992cd0bcb 100644
--- a/pkgs/by-name/de/deltachat-desktop/package.nix
+++ b/pkgs/by-name/de/deltachat-desktop/package.nix
@@ -49,6 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-PBCmyNmlH88y5s7+8WHcei8SP3Q0lIAAnAQn9uaFxLc=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/do/dorion/package.nix b/pkgs/by-name/do/dorion/package.nix
index 9c4530cbc0f2..f8e3dba5d29b 100644
--- a/pkgs/by-name/do/dorion/package.nix
+++ b/pkgs/by-name/do/dorion/package.nix
@@ -60,6 +60,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-xBonUzA4+1zbViEsKap6CaG6ZRldW1LjNYIB+FmVRFs=";
+    fetcherVersion = 1;
   };
 
   # CMake (webkit extension)
diff --git a/pkgs/by-name/em/emmet-language-server/package.nix b/pkgs/by-name/em/emmet-language-server/package.nix
index 61b80c57f34d..dc2a8a8cff46 100644
--- a/pkgs/by-name/em/emmet-language-server/package.nix
+++ b/pkgs/by-name/em/emmet-language-server/package.nix
@@ -21,6 +21,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-hh5PEtmSHPs6QBgwWHS0laGU21e82JckIP3mB/P9/vE=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/en/en-croissant/package.nix b/pkgs/by-name/en/en-croissant/package.nix
index 942c2f342a3c..86d89a85933e 100644
--- a/pkgs/by-name/en/en-croissant/package.nix
+++ b/pkgs/by-name/en/en-croissant/package.nix
@@ -31,6 +31,7 @@ rustPlatform.buildRustPackage rec {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     hash = "sha256-hvWXSegUWJvwCU5NLb2vqnl+FIWpCLxw96s9NUIgJTI=";
+    fetcherVersion = 1;
   };
 
   cargoRoot = "src-tauri";
diff --git a/pkgs/by-name/eq/equibop/package.nix b/pkgs/by-name/eq/equibop/package.nix
index 4bf15d43a41b..4da34c82565b 100644
--- a/pkgs/by-name/eq/equibop/package.nix
+++ b/pkgs/by-name/eq/equibop/package.nix
@@ -40,6 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
       patches
       ;
     hash = "sha256-laTyxRh54x3iopGVgoFtcgaV7R6IKux1O/+tzGEy0Fg=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/eq/equicord/package.nix b/pkgs/by-name/eq/equicord/package.nix
index 3bd00c4f1962..e0c5734b2ad5 100644
--- a/pkgs/by-name/eq/equicord/package.nix
+++ b/pkgs/by-name/eq/equicord/package.nix
@@ -26,6 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-fjfzBy1Z7AUKA53yjjCQ6yasHc5QMaOBtXtXA5fNK5s=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/et/etherpad-lite/package.nix b/pkgs/by-name/et/etherpad-lite/package.nix
index 87be43114134..cfccafa873c6 100644
--- a/pkgs/by-name/et/etherpad-lite/package.nix
+++ b/pkgs/by-name/et/etherpad-lite/package.nix
@@ -32,6 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-n7LolizpKng7zzccytYoCwJ7uGQbMagsgYPDuq0mdxU=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fe/fedistar/package.nix b/pkgs/by-name/fe/fedistar/package.nix
index c80656a565e9..ad1b4f3cce96 100644
--- a/pkgs/by-name/fe/fedistar/package.nix
+++ b/pkgs/by-name/fe/fedistar/package.nix
@@ -39,6 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-xXVsjAXmrsOp+mXrYAxSKz4vX5JApLZ+Rh6hrYlnJDI=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/fi/filebrowser/package.nix b/pkgs/by-name/fi/filebrowser/package.nix
index cc46daaaafae..e84c9dcd3c8b 100644
--- a/pkgs/by-name/fi/filebrowser/package.nix
+++ b/pkgs/by-name/fi/filebrowser/package.nix
@@ -38,6 +38,7 @@ let
       inherit (finalAttrs) pname version src;
       sourceRoot = "${src.name}/frontend";
       hash = "sha256-vLOtVeGFeHXgQglvKsih4lj1uIs6wipwfo374viIq4I=";
+      fetcherVersion = 1;
     };
 
     installPhase = ''
diff --git a/pkgs/by-name/fi/firezone-gui-client/package.nix b/pkgs/by-name/fi/firezone-gui-client/package.nix
index b73b294a424b..d586e1f9cfc4 100644
--- a/pkgs/by-name/fi/firezone-gui-client/package.nix
+++ b/pkgs/by-name/fi/firezone-gui-client/package.nix
@@ -41,6 +41,7 @@ let
       inherit pname version;
       src = "${src}/rust/gui-client";
       hash = "sha256-ttbTYBuUv0vyiYzrFATF4x/zngsRXjuLPfL3qW2HEe4=";
+      fetcherVersion = 1;
     };
     pnpmRoot = "rust/gui-client";
 
diff --git a/pkgs/by-name/fi/firezone-server/package.nix b/pkgs/by-name/fi/firezone-server/package.nix
index 3e09361bf1bb..549c272590b8 100644
--- a/pkgs/by-name/fi/firezone-server/package.nix
+++ b/pkgs/by-name/fi/firezone-server/package.nix
@@ -35,6 +35,7 @@ beamPackages.mixRelease rec {
     inherit pname version;
     src = "${src}/apps/web/assets";
     hash = "sha256-ejyBppFtKeyVhAWmssglbpLleOnbw9d4B+iM5Vtx47A=";
+    fetcherVersion = 1;
   };
   pnpmRoot = "apps/web/assets";
 
diff --git a/pkgs/by-name/fl/flood/package.nix b/pkgs/by-name/fl/flood/package.nix
index 083d79d9861b..8d561a278e23 100644
--- a/pkgs/by-name/fl/flood/package.nix
+++ b/pkgs/by-name/fl/flood/package.nix
@@ -23,6 +23,7 @@ buildNpmPackage rec {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     hash = "sha256-E2VxRcOMLvvCQb9gCAGcBTsly571zh/HWM6Q1Zd2eVw=";
+    fetcherVersion = 1;
   };
 
   passthru = {
diff --git a/pkgs/by-name/fo/follow/package.nix b/pkgs/by-name/fo/follow/package.nix
index c942a2e62d71..2cbb1401ccb0 100644
--- a/pkgs/by-name/fo/follow/package.nix
+++ b/pkgs/by-name/fo/follow/package.nix
@@ -31,6 +31,7 @@ stdenv.mkDerivation rec {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     hash = "sha256-xNGLYzEz1G5sZSqmji+ItJ9D1vvZcwkkygnDeuypcIM=";
+    fetcherVersion = 1;
   };
 
   env = {
diff --git a/pkgs/by-name/fr/froide/package.nix b/pkgs/by-name/fr/froide/package.nix
index 10fed1c6e595..b602b385a771 100644
--- a/pkgs/by-name/fr/froide/package.nix
+++ b/pkgs/by-name/fr/froide/package.nix
@@ -119,6 +119,7 @@ python.pkgs.buildPythonApplication rec {
   pnpmDeps = pnpm.fetchDeps {
     inherit pname version src;
     hash = "sha256-g7YX2fVXGmb3Qq9NNCb294bk4/0khcIZVSskYbE8Mdw=";
+    fetcherVersion = 1;
   };
 
   postBuild = ''
diff --git a/pkgs/by-name/gi/gitbutler/package.nix b/pkgs/by-name/gi/gitbutler/package.nix
index 83cd155efe1c..b6741c04df1e 100644
--- a/pkgs/by-name/gi/gitbutler/package.nix
+++ b/pkgs/by-name/gi/gitbutler/package.nix
@@ -65,6 +65,7 @@ rustPlatform.buildRustPackage rec {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     hash = "sha256-5NtfstUuIYyntt09Mu9GAFAOImfO6VMmJ7g15kvGaLE=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/gi/gitify/package.nix b/pkgs/by-name/gi/gitify/package.nix
index 19547d81247d..48333f8312e1 100644
--- a/pkgs/by-name/gi/gitify/package.nix
+++ b/pkgs/by-name/gi/gitify/package.nix
@@ -34,6 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-eIvqZ9a+foYH+jXuqGz1m/4C+0Xq8mTvm7ZajKeOw58=";
+    fetcherVersion = 1;
   };
 
   env.ELECTRON_SKIP_BINARY_DOWNLOAD = 1;
diff --git a/pkgs/by-name/go/goofcord/package.nix b/pkgs/by-name/go/goofcord/package.nix
index 95e7d9824df8..168a77c346a7 100644
--- a/pkgs/by-name/go/goofcord/package.nix
+++ b/pkgs/by-name/go/goofcord/package.nix
@@ -43,6 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm'.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-8dSyU9arSvISc2kDWbg/CP6L4sZjZi/Zv7TZN4ONOjQ=";
+    fetcherVersion = 1;
   };
 
   env = {
diff --git a/pkgs/by-name/gu/gui-for-clash/package.nix b/pkgs/by-name/gu/gui-for-clash/package.nix
index b2dcd36565c2..0831f4c4d86f 100644
--- a/pkgs/by-name/gu/gui-for-clash/package.nix
+++ b/pkgs/by-name/gu/gui-for-clash/package.nix
@@ -44,6 +44,7 @@ let
       inherit (finalAttrs) pname version src;
       sourceRoot = "${finalAttrs.src.name}/frontend";
       hash = "sha256-5tz1FItH9AvZhJjka8i5Kz22yf/tEmRPkDhz6iswZzc=";
+      fetcherVersion = 1;
     };
 
     sourceRoot = "${finalAttrs.src.name}/frontend";
diff --git a/pkgs/by-name/gu/gui-for-singbox/package.nix b/pkgs/by-name/gu/gui-for-singbox/package.nix
index a7480d64ee4e..fae5157c6005 100644
--- a/pkgs/by-name/gu/gui-for-singbox/package.nix
+++ b/pkgs/by-name/gu/gui-for-singbox/package.nix
@@ -46,6 +46,7 @@ let
       inherit (finalAttrs) pname version src;
       sourceRoot = "${finalAttrs.src.name}/frontend";
       hash = "sha256-5tz1FItH9AvZhJjka8i5Kz22yf/tEmRPkDhz6iswZzc=";
+      fetcherVersion = 1;
     };
 
     sourceRoot = "${finalAttrs.src.name}/frontend";
diff --git a/pkgs/by-name/he/heroic-unwrapped/package.nix b/pkgs/by-name/he/heroic-unwrapped/package.nix
index 1722a58ebafa..d5dca60dbe20 100644
--- a/pkgs/by-name/he/heroic-unwrapped/package.nix
+++ b/pkgs/by-name/he/heroic-unwrapped/package.nix
@@ -34,6 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-9WCIdQ91IU8pfq6kpbmmn6APBTNwpCi9ovgRuWYUad8=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ho/homebox/package.nix b/pkgs/by-name/ho/homebox/package.nix
index 951a2f8a29d6..d2e40a060116 100644
--- a/pkgs/by-name/ho/homebox/package.nix
+++ b/pkgs/by-name/ho/homebox/package.nix
@@ -39,6 +39,7 @@ buildGo123Module {
     inherit pname version;
     src = "${src}/frontend";
     hash = "sha256-6Q+tIY5dl5jCQyv1F8btLdJg0oEUGs0Wyu/joVdVhf8=";
+    fetcherVersion = 1;
   };
   pnpmRoot = "../frontend";
 
diff --git a/pkgs/by-name/ho/homepage-dashboard/package.nix b/pkgs/by-name/ho/homepage-dashboard/package.nix
index b48cb98ebe58..95e0091061b4 100644
--- a/pkgs/by-name/ho/homepage-dashboard/package.nix
+++ b/pkgs/by-name/ho/homepage-dashboard/package.nix
@@ -51,6 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
       patches
       ;
     hash = "sha256-aPkXHKG3vDsfYqYx9q9+2wZhuFqmPcXdoBqOfAvW9oA=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ho/homer/package.nix b/pkgs/by-name/ho/homer/package.nix
index b25aa33f9143..0eb47d64454f 100644
--- a/pkgs/by-name/ho/homer/package.nix
+++ b/pkgs/by-name/ho/homer/package.nix
@@ -26,6 +26,7 @@ stdenvNoCC.mkDerivation rec {
       patches
       ;
     hash = "sha256-y1R+rlaOtFOHHAgEHPBl40536U10Ft0iUSfGcfXS08Y=";
+    fetcherVersion = 1;
   };
 
   # Enables specifying a custom Sass compiler binary path via `SASS_EMBEDDED_BIN_PATH` environment variable.
diff --git a/pkgs/by-name/it/it-tools/package.nix b/pkgs/by-name/it/it-tools/package.nix
index 75bba8012aaa..7c8bb989875a 100644
--- a/pkgs/by-name/it/it-tools/package.nix
+++ b/pkgs/by-name/it/it-tools/package.nix
@@ -24,6 +24,7 @@ stdenv.mkDerivation rec {
   pnpmDeps = pnpm_8.fetchDeps {
     inherit pname version src;
     hash = "sha256-m1eXBE5rakcq8NGnPC9clAAvNJQrN5RuSQ94zfgGZxw=";
+    fetcherVersion = 1;
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/je/jellyseerr/package.nix b/pkgs/by-name/je/jellyseerr/package.nix
index 0c90d98157bc..25804ba2c1ce 100644
--- a/pkgs/by-name/je/jellyseerr/package.nix
+++ b/pkgs/by-name/je/jellyseerr/package.nix
@@ -29,6 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-Ym16jPHMHKmojMQOuMamDsW/u+oP1UhbCP5dooTUzFQ=";
+    fetcherVersion = 1;
   };
 
   buildInputs = [ sqlite ];
diff --git a/pkgs/by-name/ka/karakeep/package.nix b/pkgs/by-name/ka/karakeep/package.nix
index 2c2e9c3129a3..1d63fdab3e5b 100644
--- a/pkgs/by-name/ka/karakeep/package.nix
+++ b/pkgs/by-name/ka/karakeep/package.nix
@@ -54,6 +54,7 @@ stdenv.mkDerivation (finalAttrs: {
     };
 
     hash = "sha256-yf8A0oZ0Y4A5k7gfinIU02Lbqp/ygyvIBlldS0pv5+0=";
+    fetcherVersion = 1;
   };
   buildPhase = ''
     runHook preBuild
diff --git a/pkgs/by-name/le/legcord/package.nix b/pkgs/by-name/le/legcord/package.nix
index c7ee06fcca50..e6568dc948c5 100644
--- a/pkgs/by-name/le/legcord/package.nix
+++ b/pkgs/by-name/le/legcord/package.nix
@@ -45,6 +45,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-nobOORfhwlGEvNt+MfDKd3rXor6tJHDulz5oD1BGY4I=";
+    fetcherVersion = 1;
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/me/memos/package.nix b/pkgs/by-name/me/memos/package.nix
index f5285035ad3a..97e48f88b0d9 100644
--- a/pkgs/by-name/me/memos/package.nix
+++ b/pkgs/by-name/me/memos/package.nix
@@ -62,6 +62,7 @@ let
       inherit (finalAttrs) pname version src;
       sourceRoot = "${finalAttrs.src.name}/web";
       hash = "sha256-AyQYY1vtBB6DTcieC7nw5aOOVuwESJSDs8qU6PGyaTw=";
+      fetcherVersion = 1;
     };
     pnpmRoot = "web";
     nativeBuildInputs = [
diff --git a/pkgs/by-name/me/metacubexd/package.nix b/pkgs/by-name/me/metacubexd/package.nix
index e3fedba48c11..9ebf3530a5e9 100644
--- a/pkgs/by-name/me/metacubexd/package.nix
+++ b/pkgs/by-name/me/metacubexd/package.nix
@@ -25,6 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-Ct/YLnpZb0YBXVaghd5W1bmDcjVRladwQNRoLagHgJo=";
+    fetcherVersion = 1;
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/mi/misskey/package.nix b/pkgs/by-name/mi/misskey/package.nix
index 0cabaa810bbf..24eedc13aa62 100644
--- a/pkgs/by-name/mi/misskey/package.nix
+++ b/pkgs/by-name/mi/misskey/package.nix
@@ -38,6 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-T8LwpEjeWNmkIo3Dn1BCFHBsTzA/Dt6/pk/NMtvT0N4=";
+    fetcherVersion = 1;
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix b/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
index 856faa41b314..747b703ae64c 100644
--- a/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
+++ b/pkgs/by-name/mo/modrinth-app-unwrapped/package.nix
@@ -37,6 +37,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-Q6e942R+3+511qFe4oehxdquw1TgaWMyOGOmP3me54o=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/mo/moonfire-nvr/package.nix b/pkgs/by-name/mo/moonfire-nvr/package.nix
index 2923cf1db51c..f28324dac034 100644
--- a/pkgs/by-name/mo/moonfire-nvr/package.nix
+++ b/pkgs/by-name/mo/moonfire-nvr/package.nix
@@ -33,6 +33,7 @@ let
       inherit (finalAttrs) pname version src;
       sourceRoot = "${finalAttrs.src.name}/ui";
       hash = "sha256-7fMhUFlV5lz+A9VG8IdWoc49C2CTdLYQlEgBSBqJvtw=";
+      fetcherVersion = 1;
     };
     installPhase = ''
       runHook preInstall
diff --git a/pkgs/by-name/mo/moonlight/package.nix b/pkgs/by-name/mo/moonlight/package.nix
index c5341bd1bc91..12e4a6d63dab 100644
--- a/pkgs/by-name/mo/moonlight/package.nix
+++ b/pkgs/by-name/mo/moonlight/package.nix
@@ -28,6 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
     buildInputs = [ nodejs_22 ];
 
     hash = "sha256-vrSfrAnLc30kba+8VOPawdp8KaQVUhsD6mUq+YdAJTY=";
+    fetcherVersion = 1;
   };
 
   env = {
diff --git a/pkgs/by-name/n8/n8n/package.nix b/pkgs/by-name/n8/n8n/package.nix
index f64716e62444..591307ed01be 100644
--- a/pkgs/by-name/n8/n8n/package.nix
+++ b/pkgs/by-name/n8/n8n/package.nix
@@ -29,6 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-HzJej2Mt110n+1KX0wzuAn6j69zQOzI42EGxQB6PYbc=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/ni/ni/package.nix b/pkgs/by-name/ni/ni/package.nix
index fdbf18dfffad..c943ebba7215 100644
--- a/pkgs/by-name/ni/ni/package.nix
+++ b/pkgs/by-name/ni/ni/package.nix
@@ -25,6 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-gDBjAwut217mdbWyk/dSU4JOkoRbOk4Czlb/lXhWqRU=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/oc/ocis/package.nix b/pkgs/by-name/oc/ocis/package.nix
index 41669e7cf9f8..a03c50f4734f 100644
--- a/pkgs/by-name/oc/ocis/package.nix
+++ b/pkgs/by-name/oc/ocis/package.nix
@@ -51,6 +51,7 @@ buildGoModule rec {
     inherit pname version src;
     sourceRoot = "${src.name}/services/idp";
     hash = "sha256-gNlN+u/bobnTsXrsOmkDcWs67D/trH3inT5AVQs3Brs=";
+    fetcherVersion = 1;
   };
   pnpmRoot = "services/idp";
 
diff --git a/pkgs/by-name/oc/ocis/web.nix b/pkgs/by-name/oc/ocis/web.nix
index def8a16b351d..14b407470371 100644
--- a/pkgs/by-name/oc/ocis/web.nix
+++ b/pkgs/by-name/oc/ocis/web.nix
@@ -37,6 +37,7 @@ stdenvNoCC.mkDerivation rec {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     hash = "sha256-3Erva6srdkX1YQ727trx34Ufx524nz19MUyaDQToz6M=";
+    fetcherVersion = 1;
   };
 
   meta = {
diff --git a/pkgs/by-name/op/opencloud/idp-web.nix b/pkgs/by-name/op/opencloud/idp-web.nix
index b89fa6f55ead..fa1c4dfeb595 100644
--- a/pkgs/by-name/op/opencloud/idp-web.nix
+++ b/pkgs/by-name/op/opencloud/idp-web.nix
@@ -17,6 +17,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
     inherit (finalAttrs) pname version src;
     sourceRoot = "${finalAttrs.src.name}/${finalAttrs.pnpmRoot}";
     hash = "sha256-yseRO1tClLTRpQj5BzMscElUlgLEzj1u8ndT1+di2+Y=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/op/opencloud/web.nix b/pkgs/by-name/op/opencloud/web.nix
index a140684baed3..38b796df4115 100644
--- a/pkgs/by-name/op/opencloud/web.nix
+++ b/pkgs/by-name/op/opencloud/web.nix
@@ -21,6 +21,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-7wwviWveMf+xnYmO05MI3XuPVZ/pcSqQi4sGjrEdjGc=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/op/openlist/frontend.nix b/pkgs/by-name/op/openlist/frontend.nix
index 693c50cc69cf..28a8aff7ea19 100644
--- a/pkgs/by-name/op/openlist/frontend.nix
+++ b/pkgs/by-name/op/openlist/frontend.nix
@@ -33,6 +33,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-PTZ+Vhg3hNnORnulkzuVg6TF/jY0PvUWYja9z7S4GdM=";
+    fetcherVersion = 1;
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/ov/overlayed/package.nix b/pkgs/by-name/ov/overlayed/package.nix
index 4b6f82a184cc..8aa00be38990 100644
--- a/pkgs/by-name/ov/overlayed/package.nix
+++ b/pkgs/by-name/ov/overlayed/package.nix
@@ -36,6 +36,7 @@ rustPlatform.buildRustPackage rec {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     hash = "sha256-+yyxoodcDfqJ2pkosd6sMk77/71RDsGthedo1Oigwto=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/pa/paperless-ngx/package.nix b/pkgs/by-name/pa/paperless-ngx/package.nix
index 758d2fef192f..e3a29e4f5e05 100644
--- a/pkgs/by-name/pa/paperless-ngx/package.nix
+++ b/pkgs/by-name/pa/paperless-ngx/package.nix
@@ -70,6 +70,7 @@ let
       pnpmDeps = pnpm.fetchDeps {
         inherit pname version src;
         hash = "sha256-VtYYwpMXPAC3g1OESnw3dzLTwiGqJBQcicFZskEucok=";
+        fetcherVersion = 1;
       };
 
       nativeBuildInputs =
diff --git a/pkgs/by-name/pa/parca/package.nix b/pkgs/by-name/pa/parca/package.nix
index eafeb89fd3b2..7a32df1ea4f0 100644
--- a/pkgs/by-name/pa/parca/package.nix
+++ b/pkgs/by-name/pa/parca/package.nix
@@ -25,6 +25,7 @@ let
     pnpmDeps = pnpm_9.fetchDeps {
       inherit (finalAttrs) pname src version;
       hash = "sha256-gczEkCU9xESn9T1eVOmGAufh+24mOsYCMO6f5tcbdmQ=";
+      fetcherVersion = 1;
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/pd/pds/package.nix b/pkgs/by-name/pd/pds/package.nix
index 17651e7959ba..5fdc7aaea121 100644
--- a/pkgs/by-name/pd/pds/package.nix
+++ b/pkgs/by-name/pd/pds/package.nix
@@ -51,6 +51,7 @@ stdenv.mkDerivation (finalAttrs: {
       sourceRoot
       ;
     hash = "sha256-KyHa7pZaCgyqzivI0Y7E6Y4yBRllYdYLnk1s0o0dyHY=";
+    fetcherVersion = 1;
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/pg/pgrok/package.nix b/pkgs/by-name/pg/pgrok/package.nix
index 107c0c2fb3df..7dc9a44a034f 100644
--- a/pkgs/by-name/pg/pgrok/package.nix
+++ b/pkgs/by-name/pg/pgrok/package.nix
@@ -34,6 +34,7 @@ buildGoModule {
   env.pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     hash = "sha256-o6wxO8EGRmhcYggJnfxDkH+nbt+isc8bfHji8Hu9YKg=";
+    fetcherVersion = 1;
   };
 
   vendorHash = "sha256-nIxsG1O5RG+PDSWBcUWpk+4aFq2cYaxpkgOoDqLjY90=";
diff --git a/pkgs/by-name/pi/piped/package.nix b/pkgs/by-name/pi/piped/package.nix
index 3502f59f4f37..374063af3be6 100644
--- a/pkgs/by-name/pi/piped/package.nix
+++ b/pkgs/by-name/pi/piped/package.nix
@@ -29,6 +29,7 @@ buildNpmPackage rec {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     hash = "sha256-WtZfRZFRV9I1iBlAoV69GGFjdiQhTSBG/iiEadPVcys=";
+    fetcherVersion = 1;
   };
 
   passthru.updateScript = unstableGitUpdater { };
diff --git a/pkgs/by-name/po/podman-desktop/package.nix b/pkgs/by-name/po/podman-desktop/package.nix
index fb2909e1a474..2a84d1d207e2 100644
--- a/pkgs/by-name/po/podman-desktop/package.nix
+++ b/pkgs/by-name/po/podman-desktop/package.nix
@@ -61,6 +61,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-8lNmCLfuAkXK1Du4iYYasRTozZf0HoAttf8Dfc6Jglw=";
+    fetcherVersion = 1;
   };
 
   patches = [
diff --git a/pkgs/by-name/po/porn-vault/package.nix b/pkgs/by-name/po/porn-vault/package.nix
index 4f529aade0b6..7dd5e251116c 100644
--- a/pkgs/by-name/po/porn-vault/package.nix
+++ b/pkgs/by-name/po/porn-vault/package.nix
@@ -52,6 +52,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-Xr9tRiP1hW+aFs9FnPvPkeJ0/LtJI57cjWY5bZQaRTQ=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/po/pot/package.nix b/pkgs/by-name/po/pot/package.nix
index 10098cccb472..5a1c84fba77c 100644
--- a/pkgs/by-name/po/pot/package.nix
+++ b/pkgs/by-name/po/pot/package.nix
@@ -42,6 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-iYQNGRWqXYBU+WIH/Xm8qndgOQ6RKYCtAyi93kb7xrQ=";
+    fetcherVersion = 1;
   };
 
   cargoRoot = "src-tauri";
diff --git a/pkgs/by-name/pr/prisma/package.nix b/pkgs/by-name/pr/prisma/package.nix
index d82d9a8fa5ff..3bcae8fba8be 100644
--- a/pkgs/by-name/pr/prisma/package.nix
+++ b/pkgs/by-name/pr/prisma/package.nix
@@ -33,6 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-dhEpn0oaqZqeiRMfcSiaqhud/RsKd6Wm5RR5iyQp1I8=";
+    fetcherVersion = 1;
   };
 
   patchPhase = ''
diff --git a/pkgs/by-name/qu/quantframe/package.nix b/pkgs/by-name/qu/quantframe/package.nix
index c175469262c6..6a622cb21655 100644
--- a/pkgs/by-name/qu/quantframe/package.nix
+++ b/pkgs/by-name/qu/quantframe/package.nix
@@ -42,6 +42,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-3IHwwbl1aH3Pzh9xq2Jfev9hj6/LXZaVaIJOPbgsquE=";
+    fetcherVersion = 1;
   };
 
   useFetchCargoVendor = true;
diff --git a/pkgs/by-name/re/readest/package.nix b/pkgs/by-name/re/readest/package.nix
index 38f12482d17c..3639341555ac 100644
--- a/pkgs/by-name/re/readest/package.nix
+++ b/pkgs/by-name/re/readest/package.nix
@@ -40,6 +40,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-lez75n3dIM4efpP+qPuDteCfMnC6wPD+L2173iJbTZM=";
+    fetcherVersion = 1;
   };
 
   pnpmRoot = "../..";
diff --git a/pkgs/by-name/re/renovate/package.nix b/pkgs/by-name/re/renovate/package.nix
index 14bbd4886fd1..daff959eeca6 100644
--- a/pkgs/by-name/re/renovate/package.nix
+++ b/pkgs/by-name/re/renovate/package.nix
@@ -40,6 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-XOlFJFFyzbx8Bg92HXhVFFCI51j2GUK7+LJKfqVOQyU=";
+    fetcherVersion = 1;
   };
 
   env.COREPACK_ENABLE_STRICT = 0;
diff --git a/pkgs/by-name/rm/rmfakecloud/package.nix b/pkgs/by-name/rm/rmfakecloud/package.nix
index 30a1709b67a5..da58d05dbad6 100644
--- a/pkgs/by-name/rm/rmfakecloud/package.nix
+++ b/pkgs/by-name/rm/rmfakecloud/package.nix
@@ -29,6 +29,7 @@ buildGoModule rec {
     sourceRoot = "${src.name}/ui";
     pnpmLock = "${src}/ui/pnpm-lock.yaml";
     hash = "sha256-VNmCT4um2W2ii8jAm+KjQSjixYEKoZkw7CeRwErff/o=";
+    fetcherVersion = 1;
   };
   preBuild = lib.optionals enableWebui ''
     # using sass-embedded fails at executing node_modules/sass-embedded-linux-x64/dart-sass/src/dart
diff --git a/pkgs/by-name/rq/rquickshare/package.nix b/pkgs/by-name/rq/rquickshare/package.nix
index 0c4f9ac5edf2..a1fcb7c53e1d 100644
--- a/pkgs/by-name/rq/rquickshare/package.nix
+++ b/pkgs/by-name/rq/rquickshare/package.nix
@@ -65,6 +65,7 @@ rustPlatform.buildRustPackage rec {
       ;
     postPatch = "cd ${pnpmRoot}";
     hash = app-type-either "sha256-V46V/VPwCKEe3sAp8zK0UUU5YigqgYh1GIOorqIAiNE=" "sha256-8QRigYNtxirXidFFnTzA6rP0+L64M/iakPqe2lZKegs=";
+    fetcherVersion = 1;
   };
 
   useFetchCargoVendor = true;
diff --git a/pkgs/by-name/rs/rsshub/package.nix b/pkgs/by-name/rs/rsshub/package.nix
index 159dee479fd0..d9121ef6d829 100644
--- a/pkgs/by-name/rs/rsshub/package.nix
+++ b/pkgs/by-name/rs/rsshub/package.nix
@@ -31,6 +31,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-7qh6YZbIH/kHVssDZxHY7X8bytrnMcUq0MiJzWZYItc=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sa/satisfactorymodmanager/package.nix b/pkgs/by-name/sa/satisfactorymodmanager/package.nix
index db3b6e1414a5..bdb1fa77f346 100644
--- a/pkgs/by-name/sa/satisfactorymodmanager/package.nix
+++ b/pkgs/by-name/sa/satisfactorymodmanager/package.nix
@@ -56,6 +56,7 @@ buildGoModule rec {
       inherit pname version src;
       sourceRoot = "${src.name}/frontend";
       hash = "sha256-OP+3zsNlvqLFwvm2cnBd2bj2Kc3EghQZE3hpotoqqrQ=";
+      fetcherVersion = 1;
     };
 
     pnpmRoot = "frontend";
diff --git a/pkgs/by-name/sh/shadcn/package.nix b/pkgs/by-name/sh/shadcn/package.nix
index 9135d1b5dd0b..02f73aace615 100644
--- a/pkgs/by-name/sh/shadcn/package.nix
+++ b/pkgs/by-name/sh/shadcn/package.nix
@@ -29,6 +29,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       pnpmWorkspaces
       ;
     hash = "sha256-/80LJm65ZRqyfhsNqGl83bsI2wjgVkvrA6Ij4v8rtoQ=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sh/sharkey/package.nix b/pkgs/by-name/sh/sharkey/package.nix
index 2db89f5d1838..c3572f5e278c 100644
--- a/pkgs/by-name/sh/sharkey/package.nix
+++ b/pkgs/by-name/sh/sharkey/package.nix
@@ -35,6 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-S8LxawbtguFOEZyYbS1FQWw/TcRm4Z6mG7dUhfXbf1c=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/si/signal-desktop/package.nix b/pkgs/by-name/si/signal-desktop/package.nix
index 1dcee4bb8c21..a0a2fcc0baeb 100644
--- a/pkgs/by-name/si/signal-desktop/package.nix
+++ b/pkgs/by-name/si/signal-desktop/package.nix
@@ -69,6 +69,7 @@ let
     pnpmDeps = pnpm.fetchDeps {
       inherit (finalAttrs) pname src version;
       hash = "sha256-cT7Ixl/V/mesPHvJUsG63Y/wXwKjbjkjdjP3S7uEOa0=";
+      fetcherVersion = 1;
     };
 
     strictDeps = true;
@@ -123,6 +124,7 @@ stdenv.mkDerivation (finalAttrs: {
         "sha256-ry7s9fbKx4e1LR8DlI2LIJY9GQrxmU7JQt+3apJGw/M="
       else
         "sha256-AkrfugpNvk4KgesRLQbso8p5b96Dg174R9/xuP4JtJg=";
+    fetcherVersion = 1;
   };
 
   env = {
diff --git a/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix b/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix
index 6f53f67100ca..14f9e1866e55 100644
--- a/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix
+++ b/pkgs/by-name/si/signal-desktop/signal-sqlcipher.nix
@@ -23,6 +23,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-regaYG+SDvIgdnHQVR1GG1A1FSBXpzFfLuyTEdMt1kQ=";
+    fetcherVersion = 1;
   };
 
   cargoRoot = "deps/extension";
diff --git a/pkgs/by-name/si/siyuan/package.nix b/pkgs/by-name/si/siyuan/package.nix
index a31210383502..dc85f15bd48b 100644
--- a/pkgs/by-name/si/siyuan/package.nix
+++ b/pkgs/by-name/si/siyuan/package.nix
@@ -97,6 +97,7 @@ stdenv.mkDerivation (finalAttrs: {
       postPatch
       ;
     hash = "sha256-eSf4mpKBm1G4K9+V6VXEiPrIVQMyru7o9BGVIUycQaQ=";
+    fetcherVersion = 1;
   };
 
   sourceRoot = "${finalAttrs.src.name}/app";
diff --git a/pkgs/by-name/sk/sketchybar-app-font/package.nix b/pkgs/by-name/sk/sketchybar-app-font/package.nix
index e7fdb59764bf..481d59136084 100644
--- a/pkgs/by-name/sk/sketchybar-app-font/package.nix
+++ b/pkgs/by-name/sk/sketchybar-app-font/package.nix
@@ -21,6 +21,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-NGAgueJ+cuK/csjdf94KNklu+Xf91BHoWKVgEctX6eA=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sl/slimevr/package.nix b/pkgs/by-name/sl/slimevr/package.nix
index f7ce1adc5e1b..2d82414032bf 100644
--- a/pkgs/by-name/sl/slimevr/package.nix
+++ b/pkgs/by-name/sl/slimevr/package.nix
@@ -40,6 +40,7 @@ rustPlatform.buildRustPackage rec {
     pname = "${pname}-pnpm-deps";
     inherit version src;
     hash = "sha256-lh5IKdBXuH9GZFUTrzaQFDWCEYj0UJhKwCdPmsiwfCs=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sp/splayer/package.nix b/pkgs/by-name/sp/splayer/package.nix
index 5f1c45c4f2db..9e405aaacbc0 100644
--- a/pkgs/by-name/sp/splayer/package.nix
+++ b/pkgs/by-name/sp/splayer/package.nix
@@ -27,6 +27,7 @@ stdenv.mkDerivation (final: {
   pnpmDeps = final.pnpm.fetchDeps {
     inherit (final) pname version src;
     hash = "sha256-mC1iJtkZpTd2Vte5DLI3ntZ7vSO5Gka2qOk7ihQd3Gs=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/st/stylelint-lsp/package.nix b/pkgs/by-name/st/stylelint-lsp/package.nix
index 78c830808d7c..06fb4c4d3d24 100644
--- a/pkgs/by-name/st/stylelint-lsp/package.nix
+++ b/pkgs/by-name/st/stylelint-lsp/package.nix
@@ -29,6 +29,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-PVA6sXbiuxqvi9u3sPoeVIJSSpSbFQHQQnTFO3w31WE=";
+    fetcherVersion = 1;
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/su/surrealist/package.nix b/pkgs/by-name/su/surrealist/package.nix
index ac2372736750..87df89375c41 100644
--- a/pkgs/by-name/su/surrealist/package.nix
+++ b/pkgs/by-name/su/surrealist/package.nix
@@ -67,6 +67,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-oreeV9g16/F7JGLApi0Uq+vTqNhIg7Lg1Z4k00RUOYI=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/sy/synchrony/package.nix b/pkgs/by-name/sy/synchrony/package.nix
index fdc86661cbfb..bae597725037 100644
--- a/pkgs/by-name/sy/synchrony/package.nix
+++ b/pkgs/by-name/sy/synchrony/package.nix
@@ -28,6 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-+hS4UK7sncCxv6o5Yl72AeY+LSGLnUTnKosAYB6QsP0=";
+    fetcherVersion = 1;
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/sy/syncyomi/package.nix b/pkgs/by-name/sy/syncyomi/package.nix
index 0765c78a7335..b3944784c853 100644
--- a/pkgs/by-name/sy/syncyomi/package.nix
+++ b/pkgs/by-name/sy/syncyomi/package.nix
@@ -34,6 +34,7 @@ buildGoModule rec {
         sourceRoot
         ;
       hash = "sha256-edcZIqshnvM3jJpZWIR/UncI0VCMLq26h/n3VvV/384=";
+      fetcherVersion = 1;
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/ta/tabby-agent/package.nix b/pkgs/by-name/ta/tabby-agent/package.nix
index 13742184d32f..271e4dd38cab 100644
--- a/pkgs/by-name/ta/tabby-agent/package.nix
+++ b/pkgs/by-name/ta/tabby-agent/package.nix
@@ -49,6 +49,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-SiJJxRzmKQxqw3UESN7q+3qkU1nK+7z6K5RpIMRRces=";
+    fetcherVersion = 1;
   };
 
   passthru.updateScript = nix-update-script {
diff --git a/pkgs/by-name/ta/tailwindcss-language-server/package.nix b/pkgs/by-name/ta/tailwindcss-language-server/package.nix
index bef1a40ee1bf..c543ed0803c9 100644
--- a/pkgs/by-name/ta/tailwindcss-language-server/package.nix
+++ b/pkgs/by-name/ta/tailwindcss-language-server/package.nix
@@ -26,6 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
       pnpmWorkspaces
       ;
     hash = "sha256-SUEq20gZCiTDkFuNgMc5McHBPgW++8P9Q1MJb7a7pY8=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ta/taler-wallet-core/package.nix b/pkgs/by-name/ta/taler-wallet-core/package.nix
index e136588b3726..eb86a73f1a0c 100644
--- a/pkgs/by-name/ta/taler-wallet-core/package.nix
+++ b/pkgs/by-name/ta/taler-wallet-core/package.nix
@@ -57,6 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-pLe5smsXdzSBgz/OYNO5FVEI2L6y/p+jMxEkzqUaX34=";
+    fetcherVersion = 1;
   };
 
   buildInputs = [ nodejs_20 ];
diff --git a/pkgs/by-name/ta/taze/package.nix b/pkgs/by-name/ta/taze/package.nix
index a36cb0aad6cf..76c9b8b8560b 100644
--- a/pkgs/by-name/ta/taze/package.nix
+++ b/pkgs/by-name/ta/taze/package.nix
@@ -25,6 +25,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-aUMV2REINp5LDcj1s8bgQAj/4508UEewu+ebD+JT0+M=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/te/teleport/package.nix b/pkgs/by-name/te/teleport/package.nix
index 0f8be9b81afa..4b3667ba21e3 100644
--- a/pkgs/by-name/te/teleport/package.nix
+++ b/pkgs/by-name/te/teleport/package.nix
@@ -74,6 +74,7 @@ let
     pnpmDeps = pnpm_10.fetchDeps {
       inherit src pname version;
       hash = pnpmHash;
+      fetcherVersion = 1;
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/ts/tsx/package.nix b/pkgs/by-name/ts/tsx/package.nix
index f902d7a7bccd..43e081b470d2 100644
--- a/pkgs/by-name/ts/tsx/package.nix
+++ b/pkgs/by-name/ts/tsx/package.nix
@@ -20,6 +20,7 @@ stdenv.mkDerivation rec {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     hash = "sha256-57KDZ9cHb7uqnypC0auIltmYMmIhs4PWyf0HTRWEFiU=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ty/typespec/package.nix b/pkgs/by-name/ty/typespec/package.nix
index 97adcd8bb595..d78bc9ebd677 100644
--- a/pkgs/by-name/ty/typespec/package.nix
+++ b/pkgs/by-name/ty/typespec/package.nix
@@ -39,6 +39,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
       postPatch
       ;
     hash = "sha256-9RQZ2ycu78W3Ie6MLpo6x7Sa/iYsUdq5bYed56mOPxs=";
+    fetcherVersion = 1;
   };
 
   postPatch = ''
diff --git a/pkgs/by-name/ve/vencord/package.nix b/pkgs/by-name/ve/vencord/package.nix
index c6498b649e54..440ebab7b0c6 100644
--- a/pkgs/by-name/ve/vencord/package.nix
+++ b/pkgs/by-name/ve/vencord/package.nix
@@ -26,6 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname src;
     hash = "sha256-hO6QKRr4jTfesRDAEGcpFeJmGTGLGMw6EgIvD23DNzw=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/ve/vesktop/package.nix b/pkgs/by-name/ve/vesktop/package.nix
index de1b9f02c052..a9a48dc3e768 100644
--- a/pkgs/by-name/ve/vesktop/package.nix
+++ b/pkgs/by-name/ve/vesktop/package.nix
@@ -41,6 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
       patches
       ;
     hash = "sha256-C05rDd5bcbR18O6ACgzS0pQdWzB99ulceOBpW+4Zbqw=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/vi/vikunja/package.nix b/pkgs/by-name/vi/vikunja/package.nix
index 1096639899de..c703e6eca8f9 100644
--- a/pkgs/by-name/vi/vikunja/package.nix
+++ b/pkgs/by-name/vi/vikunja/package.nix
@@ -37,6 +37,7 @@ let
         sourceRoot
         ;
       hash = "sha256-94ZlywOZYmW/NsvE0dtEA81MeBWGUrJsBXTUauuOmZM=";
+      fetcherVersion = 1;
     };
 
     nativeBuildInputs = [
diff --git a/pkgs/by-name/vo/voicevox/package.nix b/pkgs/by-name/vo/voicevox/package.nix
index d2ca2cda3f53..1b8b303807fb 100644
--- a/pkgs/by-name/vo/voicevox/package.nix
+++ b/pkgs/by-name/vo/voicevox/package.nix
@@ -65,6 +65,7 @@ stdenv.mkDerivation (finalAttrs: {
     ];
 
     hash = "sha256-RKgqFmHQnjHS7yeUIbH9awpNozDOCCHplc/bmfxmMyg=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs =
diff --git a/pkgs/by-name/vt/vtsls/package.nix b/pkgs/by-name/vt/vtsls/package.nix
index c35f81ce69f1..4aba8fa0a226 100644
--- a/pkgs/by-name/vt/vtsls/package.nix
+++ b/pkgs/by-name/vt/vtsls/package.nix
@@ -41,6 +41,7 @@ stdenv.mkDerivation (finalAttrs: {
       version
       ;
     hash = "sha256-SdqeTYRH60CyU522+nBo0uCDnzxDP48eWBAtGTL/pqg=";
+    fetcherVersion = 1;
   };
 
   # Patches to get submodule sha from file instead of 'git submodule status'
diff --git a/pkgs/by-name/we/wealthfolio/package.nix b/pkgs/by-name/we/wealthfolio/package.nix
index 9a872331ac78..42bfe5434ca1 100644
--- a/pkgs/by-name/we/wealthfolio/package.nix
+++ b/pkgs/by-name/we/wealthfolio/package.nix
@@ -30,6 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) src pname version;
     hash = "sha256-KupqObdNrnWbbt9C4NNmgmQCfJ2O4FjJBwGy6XQhhHg=";
+    fetcherVersion = 1;
   };
 
   cargoRoot = "src-tauri";
diff --git a/pkgs/by-name/wo/wox/package.nix b/pkgs/by-name/wo/wox/package.nix
index d589848649a6..cb5987089024 100644
--- a/pkgs/by-name/wo/wox/package.nix
+++ b/pkgs/by-name/wo/wox/package.nix
@@ -75,6 +75,7 @@ let
         sourceRoot
         ;
       hash = "sha256-4Xj6doUHFoZSwel+cPnr2m3rfvlxNmQCppm5gXGIEtU=";
+      fetcherVersion = 1;
     };
 
     buildPhase = ''
diff --git a/pkgs/by-name/wr/wrangler/package.nix b/pkgs/by-name/wr/wrangler/package.nix
index a7d7da4b40d9..d1cf0d4f75bb 100644
--- a/pkgs/by-name/wr/wrangler/package.nix
+++ b/pkgs/by-name/wr/wrangler/package.nix
@@ -34,6 +34,7 @@ stdenv.mkDerivation (finalAttrs: {
       postPatch
       ;
     hash = "sha256-r3QswmqP6CNufnsFM0KeKojm/HjHogrfYO/TdL3SrmA=";
+    fetcherVersion = 1;
   };
   # pnpm packageManager version in workers-sdk root package.json may not match nixpkgs
   postPatch = ''
diff --git a/pkgs/by-name/za/zammad/package.nix b/pkgs/by-name/za/zammad/package.nix
index 5e994ac4b21a..16d9dd41c465 100644
--- a/pkgs/by-name/za/zammad/package.nix
+++ b/pkgs/by-name/za/zammad/package.nix
@@ -82,6 +82,7 @@ stdenvNoCC.mkDerivation {
     inherit pname src;
 
     hash = "sha256-mfdzb/LXQYL8kaQpWi9wD3OOroOOonDlJrhy9Dwl1no";
+    fetcherVersion = 1;
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/za/zashboard/package.nix b/pkgs/by-name/za/zashboard/package.nix
index 9a80dd69c623..99921816e3eb 100644
--- a/pkgs/by-name/za/zashboard/package.nix
+++ b/pkgs/by-name/za/zashboard/package.nix
@@ -26,6 +26,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-aiSZS6FEs7kqGXxC9Tx6Rngv3qrPMi5gOuh5Z3/oZyc=";
+    fetcherVersion = 1;
   };
 
   buildPhase = ''
diff --git a/pkgs/by-name/ze/zenn-cli/package.nix b/pkgs/by-name/ze/zenn-cli/package.nix
index 380b4cc8fc9b..9f1a07298756 100644
--- a/pkgs/by-name/ze/zenn-cli/package.nix
+++ b/pkgs/by-name/ze/zenn-cli/package.nix
@@ -57,6 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-AjdXclrNl1AHJ4LXq9I5Rk6KGyDaWXW187o2uLwRy/o=";
+    fetcherVersion = 1;
   };
 
   preBuild =
diff --git a/pkgs/by-name/zi/zigbee2mqtt_2/package.nix b/pkgs/by-name/zi/zigbee2mqtt_2/package.nix
index 20eebac9e1e0..eb0c4c21d2b5 100644
--- a/pkgs/by-name/zi/zigbee2mqtt_2/package.nix
+++ b/pkgs/by-name/zi/zigbee2mqtt_2/package.nix
@@ -28,6 +28,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-OPfs9WiUehKPaAqqgMOiIELoCPVBFYpNKeesfmA8Db0=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/by-name/zi/zipline/package.nix b/pkgs/by-name/zi/zipline/package.nix
index 22deed18f2c6..a44a9b099dc8 100644
--- a/pkgs/by-name/zi/zipline/package.nix
+++ b/pkgs/by-name/zi/zipline/package.nix
@@ -44,6 +44,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_10.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-kIneqtLPZ29PzluKUGO4XbQYHbNddu0kTfoP4C22k7U=";
+    fetcherVersion = 1;
   };
 
   buildInputs = [
diff --git a/pkgs/development/python-modules/django-filingcabinet/default.nix b/pkgs/development/python-modules/django-filingcabinet/default.nix
index ea04a57f5f25..19c27bc950ec 100644
--- a/pkgs/development/python-modules/django-filingcabinet/default.nix
+++ b/pkgs/development/python-modules/django-filingcabinet/default.nix
@@ -95,6 +95,7 @@ buildPythonPackage rec {
   pnpmDeps = pnpm.fetchDeps {
     inherit pname version src;
     hash = "sha256-kvLV/pCX/wQHG0ttrjSro7/CoQ5K1T0aFChafQOwvNw=";
+    fetcherVersion = 1;
   };
 
   postBuild = ''
diff --git a/pkgs/development/python-modules/gradio/default.nix b/pkgs/development/python-modules/gradio/default.nix
index 3cc2be55271e..42068d644a01 100644
--- a/pkgs/development/python-modules/gradio/default.nix
+++ b/pkgs/development/python-modules/gradio/default.nix
@@ -86,6 +86,7 @@ buildPythonPackage rec {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit pname version src;
     hash = "sha256-h3ulPik0Uf8X687Se3J7h3+8jYzwXtbO6obsO27zyfA=";
+    fetcherVersion = 1;
   };
 
   pythonRelaxDeps = [
diff --git a/pkgs/servers/authelia/web.nix b/pkgs/servers/authelia/web.nix
index 7b3083600603..3c4e0ae2ca72 100644
--- a/pkgs/servers/authelia/web.nix
+++ b/pkgs/servers/authelia/web.nix
@@ -32,6 +32,7 @@ stdenv.mkDerivation (finalAttrs: {
       sourceRoot
       ;
     hash = pnpmDepsHash;
+    fetcherVersion = 1;
   };
 
   postPatch = ''
diff --git a/pkgs/servers/home-assistant/custom-lovelace-modules/custom-sidebar/package.nix b/pkgs/servers/home-assistant/custom-lovelace-modules/custom-sidebar/package.nix
index 613b7f73b718..5e7304ea9f13 100644
--- a/pkgs/servers/home-assistant/custom-lovelace-modules/custom-sidebar/package.nix
+++ b/pkgs/servers/home-assistant/custom-lovelace-modules/custom-sidebar/package.nix
@@ -20,6 +20,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "sha256-ZWh2R6wr7FH2RfoFAE81Kl+wHnUeNjUbFG3KIk8ZN3g=";
+    fetcherVersion = 1;
   };
 
   nativeBuildInputs = [
diff --git a/pkgs/servers/web-apps/discourse/default.nix b/pkgs/servers/web-apps/discourse/default.nix
index 3d8fceacbe13..20ed0a5ef44f 100644
--- a/pkgs/servers/web-apps/discourse/default.nix
+++ b/pkgs/servers/web-apps/discourse/default.nix
@@ -234,6 +234,7 @@ let
       pname = "discourse-assets";
       inherit version src;
       hash = "sha256-WyRBnuKCl5NJLtqy3HK/sJcrpMkh0PjbasGPNDV6+7Y=";
+      fetcherVersion = 1;
     };
 
     nativeBuildInputs = runtimeDeps ++ [
diff --git a/pkgs/servers/web-apps/lemmy/ui.nix b/pkgs/servers/web-apps/lemmy/ui.nix
index b423bcd8748f..eecf875e3728 100644
--- a/pkgs/servers/web-apps/lemmy/ui.nix
+++ b/pkgs/servers/web-apps/lemmy/ui.nix
@@ -43,6 +43,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm_9.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = pinData.uiPNPMDepsHash;
+    fetcherVersion = 1;
   };
 
   buildPhase = ''

From 25f7b297dbae34d38ebc0c989d0e550498a60c8a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Wed, 9 Jul 2025 18:37:08 +0200
Subject: [PATCH 88/94] pnpm.fetchDeps: enforce setting `fetcherVersion`

---
 pkgs/development/tools/pnpm/fetch-deps/default.nix | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkgs/development/tools/pnpm/fetch-deps/default.nix b/pkgs/development/tools/pnpm/fetch-deps/default.nix
index 7403548e8792..3d784c5eab9e 100644
--- a/pkgs/development/tools/pnpm/fetch-deps/default.nix
+++ b/pkgs/development/tools/pnpm/fetch-deps/default.nix
@@ -22,7 +22,7 @@ in
       pnpmWorkspaces ? [ ],
       prePnpmInstall ? "",
       pnpmInstallFlags ? [ ],
-      fetcherVersion ? 1,
+      fetcherVersion ? null,
       ...
     }@args:
     let
@@ -46,6 +46,10 @@ in
       "pnpm.fetchDeps: `pnpmWorkspace` is no longer supported, please migrate to `pnpmWorkspaces`."
     ) true;
 
+    assert (lib.throwIf (fetcherVersion == null)
+      "pnpm.fetchDeps: `fetcherVersion` is not set, see https://nixos.org/manual/nixpkgs/stable/#javascript-pnpm-fetcherVersion."
+    ) true;
+
     stdenvNoCC.mkDerivation (
       finalAttrs:
       (

From 71e3980f188d0a322c91127d11a8d07fe3bb15ca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Gutyina=20Gerg=C5=91?= <gutyina.gergo.2@gmail.com>
Date: Wed, 9 Jul 2025 13:52:43 +0200
Subject: [PATCH 89/94] pnpm.fetchDeps: ensure consistent permissions for
 fetcherVersion >=2

Co-authored-by: Oliver Breitwieser <oliver@breitwieser.eu>
---
 doc/languages-frameworks/javascript.section.md  |  3 ++-
 .../tools/pnpm/fetch-deps/default.nix           | 17 +++++++++++++++++
 2 files changed, 19 insertions(+), 1 deletion(-)

diff --git a/doc/languages-frameworks/javascript.section.md b/doc/languages-frameworks/javascript.section.md
index f91ea3e60e0e..166e0d4c7266 100644
--- a/doc/languages-frameworks/javascript.section.md
+++ b/doc/languages-frameworks/javascript.section.md
@@ -444,7 +444,7 @@ stdenv.mkDerivation (finalAttrs: {
   pnpmDeps = pnpm.fetchDeps {
     inherit (finalAttrs) pname version src;
     hash = "...";
-    fetcherVersion = 1;
+    fetcherVersion = 2;
   };
 })
 ```
@@ -593,6 +593,7 @@ Changes can include workarounds or bug fixes to existing PNPM issues.
 ##### Version history {#javascript-pnpm-fetcherVersion-versionHistory}
 
 - 1: Initial version, nothing special
+- 2: [Ensure consistent permissions](https://github.com/NixOS/nixpkgs/pull/422975)
 
 ### Yarn {#javascript-yarn}
 
diff --git a/pkgs/development/tools/pnpm/fetch-deps/default.nix b/pkgs/development/tools/pnpm/fetch-deps/default.nix
index 3d784c5eab9e..164feec97923 100644
--- a/pkgs/development/tools/pnpm/fetch-deps/default.nix
+++ b/pkgs/development/tools/pnpm/fetch-deps/default.nix
@@ -118,6 +118,23 @@ in
               jq --sort-keys "del(.. | .checkedAt?)" $f | sponge $f
             done
 
+            # Ensure consistent permissions
+            # NOTE: For reasons not yet fully understood, pnpm might create files with
+            # inconsistent permissions, for example inside the ubuntu-24.04
+            # github actions runner.
+            # To ensure stable derivations, we need to set permissions
+            # consistently, namely:
+            # * All files with `-exec` suffix have 555.
+            # * All other files have 444.
+            # * All folders have 555.
+            # See https://github.com/NixOS/nixpkgs/pull/350063
+            # See https://github.com/NixOS/nixpkgs/issues/422889
+            if [[ ${toString fetcherVersion} -ge 2 ]]; then
+              find $out -type f -name "*-exec" -print0 | xargs -0 chmod 555
+              find $out -type f -not -name "*-exec" -print0 | xargs -0 chmod 444
+              find $out -type d -print0 | xargs -0 chmod 555
+            fi
+
             runHook postFixup
           '';
 

From 4f53407902b2a6a410d776062c4f60f3768033b1 Mon Sep 17 00:00:00 2001
From: Thierry Delafontaine <delafthi@pm.me>
Date: Fri, 11 Jul 2025 20:00:57 +0200
Subject: [PATCH 90/94] models-dev: init at 0-unstable-2025-07-12

---
 pkgs/by-name/mo/models-dev/package.nix | 117 +++++++++++++++++++++++++
 1 file changed, 117 insertions(+)
 create mode 100644 pkgs/by-name/mo/models-dev/package.nix

diff --git a/pkgs/by-name/mo/models-dev/package.nix b/pkgs/by-name/mo/models-dev/package.nix
new file mode 100644
index 000000000000..bb365dba9403
--- /dev/null
+++ b/pkgs/by-name/mo/models-dev/package.nix
@@ -0,0 +1,117 @@
+{
+  lib,
+  stdenvNoCC,
+  bun,
+  fetchFromGitHub,
+  nix-update-script,
+  writableTmpDirAsHomeHook,
+}:
+
+let
+  models-dev-node-modules-hash = {
+    "aarch64-darwin" = "sha256-2EVW5zQTcqH9zBYAegWj/Wtb0lYHZwA7Bbqs3gRjcx0=";
+    "aarch64-linux" = "sha256-nJgFnszwvknqA21uaqlGQQ1x+4ztKx0/tEvcNrv1LJg=";
+    "x86_64-darwin" = "sha256-Un6UxmvsmBuDdUwcWnu4qb0nPN1V1PFJi4VGVkNh/YU=";
+    "x86_64-linux" = "sha256-nlL+Ayacxz4fm404cABORSVGQcNxb3cB4mOezkrI90U=";
+  };
+in
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "models-dev";
+  version = "0-unstable-2025-07-12";
+  src = fetchFromGitHub {
+    owner = "sst";
+    repo = "models.dev";
+    rev = "9384b47617ec10f5b008908457b3e8f89556e340";
+    hash = "sha256-ayhWGFyU6uLrXYrftP7J/xM064bErKFGnySt2AfBkBY=";
+  };
+
+  node_modules = stdenvNoCC.mkDerivation {
+    pname = "models-dev-node_modules";
+    inherit (finalAttrs) version src;
+
+    impureEnvVars = lib.fetchers.proxyImpureEnvVars ++ [
+      "GIT_PROXY_COMMAND"
+      "SOCKS_SERVER"
+    ];
+
+    nativeBuildInputs = [
+      bun
+      writableTmpDirAsHomeHook
+    ];
+
+    dontConfigure = true;
+
+    buildPhase = ''
+      runHook preBuild
+
+       export BUN_INSTALL_CACHE_DIR=$(mktemp -d)
+
+       bun install \
+         --force \
+         --frozen-lockfile \
+         --no-progress
+
+      runHook postBuild
+    '';
+
+    installPhase = ''
+      runHook preInstall
+
+      mkdir -p $out/node_modules
+      cp -R ./node_modules $out
+
+      runHook postInstall
+    '';
+
+    # Required else we get errors that our fixed-output derivation references store paths
+    dontFixup = true;
+
+    outputHash = models-dev-node-modules-hash.${stdenvNoCC.hostPlatform.system};
+    outputHashAlgo = "sha256";
+    outputHashMode = "recursive";
+  };
+
+  nativeBuildInputs = [ bun ];
+
+  configurePhase = ''
+    runHook preConfigure
+
+    cp -R ${finalAttrs.node_modules}/node_modules .
+
+    runHook postConfigure
+  '';
+
+  preBuild = ''
+    patchShebangs packages/web/script/build.ts
+  '';
+
+  buildPhase = ''
+    runHook preBuild
+
+    cd packages/web
+    bun run build
+
+    runHook postBuild
+  '';
+
+  installPhase = ''
+    runHook preInstall
+
+    mkdir -p $out/dist
+    cp -R ./dist $out
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script {
+    extraArgs = [ "--version=branch" ];
+  };
+
+  meta = {
+    description = "Comprehensive open-source database of AI model specifications, pricing, and capabilities";
+    homepage = "https://github.com/sst/models-dev";
+    license = lib.licenses.mit;
+    platforms = lib.platforms.unix;
+    maintainers = with lib.maintainers; [ delafthi ];
+  };
+})

From 419678255eaebe91559329db6bf449fa771eae52 Mon Sep 17 00:00:00 2001
From: Thierry Delafontaine <delafthi@pm.me>
Date: Mon, 14 Jul 2025 10:11:40 +0200
Subject: [PATCH 91/94] models-dev: 0-unstable-2025-07-12 ->
 0-unstable-2025-07-14

Diff: https://github.com/sst/models.dev/compare/9384b47617ec10f5b008908457b3e8f89556e340...2b0849aa20d48c28e2bac1fa3762aec867a2e7c7
---
 pkgs/by-name/mo/models-dev/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/mo/models-dev/package.nix b/pkgs/by-name/mo/models-dev/package.nix
index bb365dba9403..08ee5b69824a 100644
--- a/pkgs/by-name/mo/models-dev/package.nix
+++ b/pkgs/by-name/mo/models-dev/package.nix
@@ -17,12 +17,12 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
   pname = "models-dev";
-  version = "0-unstable-2025-07-12";
+  version = "0-unstable-2025-07-14";
   src = fetchFromGitHub {
     owner = "sst";
     repo = "models.dev";
-    rev = "9384b47617ec10f5b008908457b3e8f89556e340";
-    hash = "sha256-ayhWGFyU6uLrXYrftP7J/xM064bErKFGnySt2AfBkBY=";
+    rev = "2b0849aa20d48c28e2bac1fa3762aec867a2e7c7";
+    hash = "sha256-SC2yOy+6xjiGgRuRJY6wCtzWjFJm/DUy+gSlMXXDgAk=";
   };
 
   node_modules = stdenvNoCC.mkDerivation {

From 80efaa12b886558fd0a674f5e11b550311045f90 Mon Sep 17 00:00:00 2001
From: Tristan Ross <tristan.ross@midstall.com>
Date: Sun, 13 Jul 2025 20:44:13 -0700
Subject: [PATCH 92/94] llvmPackages_git: 21.0.0-unstable-2025-07-06 ->
 21.0.0-unstable-2025-07-12

---
 pkgs/development/compilers/llvm/default.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/development/compilers/llvm/default.nix b/pkgs/development/compilers/llvm/default.nix
index 850a58fa594b..64fd4ee4b139 100644
--- a/pkgs/development/compilers/llvm/default.nix
+++ b/pkgs/development/compilers/llvm/default.nix
@@ -33,9 +33,9 @@ let
     "19.1.7".officialRelease.sha256 = "sha256-cZAB5vZjeTsXt9QHbP5xluWNQnAHByHtHnAhVDV0E6I=";
     "20.1.6".officialRelease.sha256 = "sha256-PfCzECiCM+k0hHqEUSr1TSpnII5nqIxg+Z8ICjmMj0Y=";
     "21.0.0-git".gitRelease = {
-      rev = "be4cd9f4da981af3b93a180239cd631910b542d8";
-      rev-version = "21.0.0-unstable-2025-07-06";
-      sha256 = "sha256-cNJL0374m1LL5G7aS9CO/ufild5wfvhXcqwhqJXUZYA=";
+      rev = "e08833443256f8dde2f864853fa9491ffa7112d5";
+      rev-version = "21.0.0-unstable-2025-07-13";
+      sha256 = "sha256-O0mh9Kq6PHvGiCigjb5rDDqHNFBhy5Dv+IP67TstX8U=";
     };
   } // llvmVersions;
 

From e685fd62601a2018a9f1dadcea1b3391e67b7ea4 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Wed, 2 Jul 2025 15:42:34 +0200
Subject: [PATCH 93/94] nixos/spamassassin: enable TextCat

Worked for me without requiring any additional Perl modules.  By
default it just adds an X-Language header.

Link: https://spamassassin.apache.org/full/4.0.x/doc/Mail_SpamAssassin_Plugin_TextCat.html
---
 nixos/modules/services/mail/spamassassin.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/nixos/modules/services/mail/spamassassin.nix b/nixos/modules/services/mail/spamassassin.nix
index f34fad9b1606..b1c6c44c0f89 100644
--- a/nixos/modules/services/mail/spamassassin.nix
+++ b/nixos/modules/services/mail/spamassassin.nix
@@ -98,7 +98,7 @@ in
           # loadplugin Mail::SpamAssassin::Plugin::Shortcircuit
           loadplugin Mail::SpamAssassin::Plugin::SpamCop
           loadplugin Mail::SpamAssassin::Plugin::SPF
-          #loadplugin Mail::SpamAssassin::Plugin::TextCat
+          loadplugin Mail::SpamAssassin::Plugin::TextCat
           # loadplugin Mail::SpamAssassin::Plugin::TxRep
           loadplugin Mail::SpamAssassin::Plugin::URIDetail
           loadplugin Mail::SpamAssassin::Plugin::URIDNSBL

From 96dab5ade3b047c63818192b66d12cd6f976e282 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Wed, 2 Jul 2025 15:46:07 +0200
Subject: [PATCH 94/94] nixos/spamassassin: add reload triggers

Previously, SpamAssassin did not pick up configuration changes
automatically.
---
 nixos/modules/services/mail/spamassassin.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/nixos/modules/services/mail/spamassassin.nix b/nixos/modules/services/mail/spamassassin.nix
index b1c6c44c0f89..5acbc3470820 100644
--- a/nixos/modules/services/mail/spamassassin.nix
+++ b/nixos/modules/services/mail/spamassassin.nix
@@ -183,6 +183,11 @@ in
         "sa-update.service"
       ];
 
+      reloadTriggers = [
+        config.environment.etc."mail/spamassassin/init.pre".source
+        config.environment.etc."mail/spamassassin/local.cf".source
+      ];
+
       serviceConfig = {
         User = "spamd";
         Group = "spamd";