Merge release-26.05 into staging-nixos-26.05

2026-08-26 02:05:02 +00:00 · 2026-08-22 00:13:44 +00:00
parent 44b4e8026b 7fd8dd0519
commit ee738b522f
52 changed files with 1733 additions and 1160 deletions
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -59,7 +59,7 @@ jobs:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}
          target-as-trusted-at: ${{ inputs.targetSha }}

-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
        with:
          # Sandbox is disabled on MacOS by default.
          extra_nix_config: sandbox = true
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -178,7 +178,7 @@ jobs:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}
          target-as-trusted-at: ${{ inputs.targetSha }}

-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1

      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        continue-on-error: true
--- a/.github/workflows/eval.yml
+++ b/.github/workflows/eval.yml
@@ -139,7 +139,7 @@ jobs:
            core.info(`Found pinned.json commit: ${ciPinBumpCommit}`)

      - name: Install Nix
-        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1

      - name: Load supported versions
        id: versions
@@ -187,7 +187,7 @@ jobs:
          target-as-trusted-at: ${{ inputs.targetSha }}

      - name: Install Nix
-        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1

      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        continue-on-error: true
@@ -277,7 +277,7 @@ jobs:
          merge-multiple: true

      - name: Install Nix
-        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1

      - name: Combine all output paths and eval stats
        run: |
@@ -486,7 +486,7 @@ jobs:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}

      - name: Install Nix
-        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1

      - name: Ensure flake outputs on all systems still evaluate
        run: nix flake check --all-systems --no-build './nixpkgs/untrusted?shallow=1'
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -35,7 +35,7 @@ jobs:
        with:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}

-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1

      # TODO: Figure out how to best enable caching for the treefmt job. Cachix won't work well,
      # because the cache would be invalidated on every commit - treefmt checks every file.
@@ -70,7 +70,7 @@ jobs:
        with:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}

-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1

      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        continue-on-error: true
@@ -100,7 +100,7 @@ jobs:
          merged-as-untrusted-at: ${{ inputs.mergedSha }}
          target-as-trusted-at: ${{ inputs.targetSha }}

-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31.11.0
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1

      - uses: cachix/cachix-action@5f2d7c5294214f71b873db4b969586b980625e71 # v17
        continue-on-error: true
--- a/doc/languages-frameworks/ocaml.section.md
+++ b/doc/languages-frameworks/ocaml.section.md
@@ -59,6 +59,9 @@ Here is a simple package example.
 - The library will be installed using the `angstrom.install` file that dune
  generates.

+- It also accepts an optional `dunePackages` argument, if there is more than one
+  dune package that needs to be built (see `zipperposition`)
+
 ```nix
 {
  lib,
--- a/maintainers/github-teams.json
+++ b/maintainers/github-teams.json
@@ -694,8 +694,8 @@
      "eclairevoyant": 848000
    },
    "members": {
-      "Eveeifyeve": 88671402,
-      "daylinmorgan": 47667941
+      "daylinmorgan": 47667941,
+      "eveeifyeve": 88671402
    },
    "name": "nim"
  },
@@ -788,10 +788,11 @@
    "description": "Maintain Pantheon desktop environment and platform",
    "id": 4786995,
    "maintainers": {
+      "bobby285271": 20080233,
      "davidak": 91113
    },
    "members": {
-      "bobby285271": 20080233
+      "amz-x": 18249234
    },
    "name": "Pantheon"
  },
@@ -895,7 +896,6 @@
      "0x4A6F": 9675338
    },
    "members": {
-      "DarkKirb": 23011243,
      "dramforever": 2818072,
      "fgaz": 8182846,
      "jonhermansen": 660911
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -1958,6 +1958,12 @@
    githubId = 14838767;
    name = "Jacopo Scannella";
  };
+  antoineco = {
+    email = "hello@acotten.com";
+    github = "antoineco";
+    githubId = 3299086;
+    name = "Antoine Cotten";
+  };
  anton-4 = {
    name = "Anton";
    github = "Anton-4";
--- a/nixos/modules/services/monitoring/ups.nix
+++ b/nixos/modules/services/monitoring/ups.nix
@@ -679,7 +679,7 @@ in
      environment = envVars;
      serviceConfig = {
        Type = "oneshot";
-        ExecStart = "${cfg.package}/bin/upsdrvctl shutdown";
+        ExecStart = "${cfg.package}/bin/upsdrvctl -u root shutdown";
      };
    };

--- a/nixos/modules/services/video/frigate.nix
+++ b/nixos/modules/services/video/frigate.nix
@@ -787,6 +787,7 @@ in

        # Caches
        PrivateTmp = true;
+        TemporaryFileSystem = "/dev/shm:mode=1777,nosuid,nodev";
        CacheDirectory = [
          "frigate"
          # https://github.com/blakeblackshear/frigate/discussions/18129
--- a/nixos/modules/services/web-apps/discourse.nix
+++ b/nixos/modules/services/web-apps/discourse.nix
@@ -641,6 +641,8 @@ in
      s3_http_continue_timeout = null;
      s3_install_cors_rule = null;
      s3_asset_cdn_url = null;
+      s3_role_arn = null;
+      s3_role_session_name = null;

      max_user_api_reqs_per_minute = 20;
      max_user_api_reqs_per_day = 2880;
@@ -667,7 +669,6 @@ in
      compress_anon_cache = false;
      anon_cache_store_threshold = 2;
      allowed_theme_repos = null;
-      enable_email_sync_demon = false;
      max_digests_enqueued_per_30_mins_per_site = 10000;
      cluster_name = null;
      multisite_config_path = "config/multisite.yml";
@@ -681,6 +682,10 @@ in
      allow_impersonation = true;
      log_line_max_chars = 160000;
      yjit_enabled = false;
+      # this option is set to `true` in discourse's defaults.
+      # however, having this option enabled appears to cause a segfault in mini_racer
+      # see https://github.com/rubyjs/mini_racer/issues/422
+      mini_racer_single_threaded = false;
    };

    services.redis.servers.discourse =
@@ -951,27 +956,35 @@ in
              # asset pipeline enables this
              brotli_static on;
              gzip_static on;
+              add_header Access-Control-Allow-Origin *;
            '';
            "~ ^/plugins/".extraConfig = cache_1y;
            "~ /images/emoji/".extraConfig = cache_1y;
            "~ ^/uploads/" = proxy {
-              extraConfig = cache_1y + ''
+              extraConfig = ''
                proxy_set_header X-Sendfile-Type X-Accel-Redirect;
                proxy_set_header X-Accel-Mapping ${cfg.package}/share/discourse/public/=/downloads/;

                # custom CSS
                location ~ /stylesheet-cache/ {
+                    ${cache_1y}
                    try_files $uri =404;
                }
                # this allows us to bypass rails
                location ~* \.(gif|png|jpg|jpeg|bmp|tif|tiff|ico|webp)$ {
+                    ${cache_1y}
                    try_files $uri =404;
                }
-                # SVG needs an extra header attached
+                # force attachment so SVGs can't render as a document on direct navigation
                location ~* \.(svg)$ {
+                    ${cache_1y}
+                    add_header Access-Control-Allow-Origin *;
+                    add_header Content-Disposition attachment;
+                    try_files $uri =404;
                }
                # thumbnails & optimized images
                location ~ /_?optimized/ {
+                    ${cache_1y}
                    try_files $uri =404;
                }
              '';
--- a/pkgs/applications/networking/browsers/chromium/info.json
+++ b/pkgs/applications/networking/browsers/chromium/info.json
@@ -1,10 +1,10 @@
 {
  "chromium": {
-    "version": "151.0.7922.169",
+    "version": "151.0.7922.173",
    "chromedriver": {
-      "version": "151.0.7922.170",
-      "hash_darwin": "sha256-DpYk2U4zCxM+eHNThABQhtp5SN09ntQKpQL9Fh0aQ8I=",
-      "hash_darwin_aarch64": "sha256-UO/M1Mh1nDDKqHNPBxeVd0CXX24xiIpVBA/bNNa8s3M="
+      "version": "151.0.7922.174",
+      "hash_darwin": "sha256-ZvSYSZVVXOUVNjBkrXNQ04qdUcAj7Z2RbWPt6/rVkdo=",
+      "hash_darwin_aarch64": "sha256-10cDX124TzB9kIQfx+Jxzz6mgo3Aq/C+Nfwy9BR0F2c="
    },
    "deps": {
      "depot_tools": {
@@ -21,8 +21,8 @@
    "DEPS": {
      "src": {
        "url": "https://chromium.googlesource.com/chromium/src.git",
-        "rev": "4b1c7520055f77780fe76d89bb89b76e4d19f64c",
-        "hash": "sha256-Esamlwf17X1PzJsQRRcIJ4QwA0qHD3vslQwzdAbGJxk=",
+        "rev": "a96602f30358e9b5d256a0464e7e4d4bec223004",
+        "hash": "sha256-uumIVSzf318Xd1JB9jESXgpLxXlrvMDclOzSFQqweZ8=",
        "recompress": true
      },
      "src/third_party/clang-format/script": {
@@ -827,8 +827,8 @@
      },
      "src/v8": {
        "url": "https://chromium.googlesource.com/v8/v8.git",
-        "rev": "dccfc345769bb723321ce10168d8084f7f9ac9f7",
-        "hash": "sha256-uyS4w15ppEOxv/FKsdtGDzSIER5bqZtHPic6eKTIVDM="
+        "rev": "4b407bc23f23059b1019cde542601c2cf8f70eb2",
+        "hash": "sha256-TB1A+iIyZOdlbHvim1JOaXOf9uQnoAYqbUL2+PFKUcs="
      },
      "src/agents/shared": {
        "url": "https://chromium.googlesource.com/chromium/agents.git",
--- a/pkgs/build-support/ocaml/dune.nix
+++ b/pkgs/build-support/ocaml/dune.nix
@@ -18,6 +18,7 @@ lib.extendMkDerivation {
    {
      pname,
      version,
+      dunePackages ? [ pname ],
      nativeBuildInputs ? [ ],
      enableParallelBuilding ? true,
      ...
@@ -58,14 +59,14 @@ lib.extendMkDerivation {
        buildPhase =
          args.buildPhase or ''
            runHook preBuild
-            dune build -p ${pname} ''${enableParallelBuilding:+-j $NIX_BUILD_CORES}
+            dune build -p ${lib.concatStringsSep "," dunePackages} ''${enableParallelBuilding:+-j $NIX_BUILD_CORES}
            runHook postBuild
          '';

        installPhase =
          args.installPhase or ''
            runHook preInstall
-            dune install --prefix $out --libdir $OCAMLFIND_DESTDIR ${pname} \
+            dune install --prefix $out --libdir $OCAMLFIND_DESTDIR ${lib.concatStringsSep " " dunePackages} \
             ${
               if lib.versionAtLeast Dune.version "2.9" then
                 "--docdir $out/share/doc --mandir $out/share/man"
@@ -78,7 +79,7 @@ lib.extendMkDerivation {
        checkPhase =
          args.checkPhase or ''
            runHook preCheck
-            dune runtest -p ${pname} ''${enableParallelBuilding:+-j $NIX_BUILD_CORES}
+            dune runtest -p ${lib.concatStringsSep "," dunePackages} ''${enableParallelBuilding:+-j $NIX_BUILD_CORES}
            runHook postCheck
          '';

--- a/pkgs/by-name/do/dolibarr/package.nix
+++ b/pkgs/by-name/do/dolibarr/package.nix
@@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "dolibarr";
-  version = "23.0.3";
+  version = "23.0.4";

  src = fetchFromGitHub {
    owner = "Dolibarr";
    repo = "dolibarr";
    tag = finalAttrs.version;
-    hash = "sha256-Yse1rUaxRnuXawgAk0m4U3GCZNlV0IPPpZ9Qml4heA8=";
+    hash = "sha256-YJKTaLGaILhCFREtAgmX+vzhXIKp0DIj6jn7TtqtFB4=";
  };

  dontBuild = true;
--- a/pkgs/by-name/fo/fosrl-pangolin/package.nix
+++ b/pkgs/by-name/fo/fosrl-pangolin/package.nix
@@ -36,7 +36,7 @@ in

 buildNpmPackage (finalAttrs: {
  pname = "pangolin";
-  version = "1.21.0";
+  version = "1.21.1";

  __structuredAttrs = true;
  enableParallelBuilding = true;
@@ -45,12 +45,12 @@ buildNpmPackage (finalAttrs: {
    owner = "fosrl";
    repo = "pangolin";
    tag = finalAttrs.version;
-    hash = "sha256-LR4UO2xrTLKmemDVsJWtEQoV2bDy6U2ahxTtA+SDymI=";
+    hash = "sha256-zfXHev0bN3KVkoiSQ+2WQCgmcCtWi3dib6EiaYmthTo=";
  };

  nodejs = nodejs_22;
  npmDepsFetcherVersion = 2;
-  npmDepsHash = "sha256-EBectG1zNdUb30SlhAzy9rCwF/mYHAV4HZTRbk2CbDY=";
+  npmDepsHash = "sha256-9wPn2nSD9VxMyHywrG52WrChsrJ/ctnKGlMZZEymP6A=";

  nativeBuildInputs = [
    esbuild
@@ -64,11 +64,11 @@ buildNpmPackage (finalAttrs: {

  # upstream inconsistently updates this
  # so leaving this here in case it's needed
-  postPatch = ''
-    substituteInPlace server/lib/consts.ts --replace-fail \
-      'export const APP_VERSION = "${lib.versions.majorMinor finalAttrs.version + ".0"}";' \
-      'export const APP_VERSION = "${finalAttrs.version}";'
-  '';
+  # postPatch = ''
+  #   substituteInPlace server/lib/consts.ts --replace-fail \
+  #     'export const APP_VERSION = "${lib.versions.majorMinor finalAttrs.version + ".0"}";' \
+  #     'export const APP_VERSION = "${finalAttrs.version}";'
+  # '';

  preBuild = ''
    npm run set:${db false}
--- a/pkgs/by-name/ge/gelly/package.nix
+++ b/pkgs/by-name/ge/gelly/package.nix
@@ -19,16 +19,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "gelly";
-  version = "1.9.7";
+  version = "1.10.0";

  src = fetchFromGitHub {
    owner = "Fingel";
    repo = "gelly";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-KPU16kQUmM+TOOzw8JXFjlchhFHQy9Zt7brky9YW/fE=";
+    hash = "sha256-YpSES6qf9W7oj2LIQcI48N2SxMbVRumQ2zxsnYgMdlg=";
  };

-  cargoHash = "sha256-CUbQp1E+snaIuduXmEXErOoOELFXmEm3Td1y5Mou+UA=";
+  cargoHash = "sha256-AHcdJF8Um7gUMF1g0ZVooyoCRGEX+tXvEmPOn6BIuMw=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/gh/gh/package.nix
+++ b/pkgs/by-name/gh/gh/package.nix
@@ -10,7 +10,7 @@

 buildGoModule (finalAttrs: {
  pname = "gh";
-  version = "2.97.0";
+  version = "2.98.0";

  __structuredAttrs = true;

@@ -18,10 +18,10 @@ buildGoModule (finalAttrs: {
    owner = "cli";
    repo = "cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-yG3bo7YVs1Q//9PePusU0m4TilujQMxI4Faz26iAb5g=";
+    hash = "sha256-2MktrI8FEvGkU2/cC6vrPtujl8fszuxz+Ey30WjRjhg=";
  };

-  vendorHash = "sha256-XeXHMEhe1ZVWtenyYIzaYjNovaArvI0xBRWVabUF9KU=";
+  vendorHash = "sha256-fhFsu/LjLNFwexSfUsd4X74UD+AQojLcdxU5IqOi3GY=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/by-name/ke/keycloak/package.nix
+++ b/pkgs/by-name/ke/keycloak/package.nix
@@ -24,11 +24,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "keycloak";
-  version = "26.7.1";
+  version = "26.7.2";

  src = fetchzip {
    url = "https://github.com/keycloak/keycloak/releases/download/${finalAttrs.version}/keycloak-${finalAttrs.version}.zip";
-    hash = "sha256-YkjFJcD2G132mUm4HmyHriAK+b+3UCUeLilEMeKBZho=";
+    hash = "sha256-D4Hj4OHX8veFjIDbvbQN0E7C2oHVpbD2U4TV1Z8fZ8Y=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/li/libsignal-ffi/package.nix
+++ b/pkgs/by-name/li/libsignal-ffi/package.nix
@@ -13,14 +13,14 @@ rustPlatform.buildRustPackage (finalAttrs: {
  pname = "libsignal-ffi";
  # must match the version used in mautrix-signal
  # see https://github.com/mautrix/signal/issues/401
-  version = "0.97.2";
+  version = "0.100.0";

  src = fetchFromGitHub {
    fetchSubmodules = true;
    owner = "signalapp";
    repo = "libsignal";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-p9NIt+n7MTsYWAFS+FOuSGMJUZi8rBlTb6ATgVJ+uU8=";
+    hash = "sha256-ATK0wnTbT3b8lFAwXSm5j31LXywCh70iOTgUL6Pfd+Q=";
  };

  postPatch =
@@ -46,7 +46,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    NIX_LDFLAGS = if stdenv.hostPlatform.isDarwin then "-lc++" else "-lstdc++";
  };

-  cargoHash = "sha256-JtNGubDMrUINCCiawrAW63L1trcBCAIibFpojK8mzhc=";
+  cargoHash = "sha256-OuJdAi2TbtpQlXSr7PpLuBqeHYx0l2ax5byoEZ5PGj8=";

  cargoBuildFlags = [
    "-p"
--- a/pkgs/by-name/lu/luanti/package.nix
+++ b/pkgs/by-name/lu/luanti/package.nix
@@ -43,13 +43,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "luanti";
-  version = "5.16.1";
+  version = "5.17.0";

  src = fetchFromGitHub {
    owner = "luanti-org";
    repo = "luanti";
    tag = finalAttrs.version;
-    hash = "sha256-EzLjLkN/3BdcpWJ92QnrdhxKmY6Bz2JkOC0oX0TrUtI=";
+    hash = "sha256-PieiiJTpgUK7q0WiUY2EAp72ywHkDR2Mba1DCDkvCaY=";
  };

  patches = [
--- a/pkgs/by-name/lu/lucida-downloader/package.nix
+++ b/pkgs/by-name/lu/lucida-downloader/package.nix
@@ -7,18 +7,18 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "lucida-downloader";
-  version = "0.8.0";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "jelni";
    repo = "lucida-downloader";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-284f3+yKkE37wZzmyW7qupvYwEkmLvco8lc5dFSiLAQ=";
+    hash = "sha256-7mq6xoafXqhqhe9vLdc67aGzlUrD8hTyCGkIyqndfPA=";
  };

  passthru.updateScript = nix-update-script { };

-  cargoHash = "sha256-PT8E9AqvhChKk76AA2qsAf2ICy5maQ9SK96V/vkmwy8=";
+  cargoHash = "sha256-lUxPPykO/U7bVgtw3yGxqD0PbqHng5bIW0krvYW7+Kw=";

  meta = {
    description = "Multithreaded client for downloading music for free with lucida";
--- a/pkgs/by-name/ma/matrix-authentication-service/package.nix
+++ b/pkgs/by-name/ma/matrix-authentication-service/package.nix
@@ -20,21 +20,21 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "matrix-authentication-service";
-  version = "1.22.0";
+  version = "1.23.0";

  src = fetchFromGitHub {
    owner = "element-hq";
    repo = "matrix-authentication-service";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-vy9eZYtlAMPXh+xvgAOEeJd7jZirX5Y4sXmNbYLBYGI=";
+    hash = "sha256-DnaVIMp+pRRsNlyBZiTiqXajOgGFBT38sNLmC+IF8pU=";
  };

-  cargoHash = "sha256-3MDbg+vfLIqSDiRqBVZs2zbrg9UUpe4Vx+Ze656yOdE=";
+  cargoHash = "sha256-3fBikvSbPTiIYXk7TQKoQ/YqjF5ZCoN0xQRSqCmHF9Q=";

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
    fetcherVersion = 4;
-    hash = "sha256-9a62WlBQW8lgXluMh+DM21CkFCqFYd7yUz220G1uTIY=";
+    hash = "sha256-8dPqsa1/D4q7hdntV1AmbRxQyZgAf7Q/z+etj+R/jIE=";
  };

  pnpmRoot = "frontend";
--- a/pkgs/by-name/ma/mautrix-signal/package.nix
+++ b/pkgs/by-name/ma/mautrix-signal/package.nix
@@ -20,14 +20,14 @@ let
 in
 buildGoModule rec {
  pname = "mautrix-signal";
-  version = "26.07";
-  tag = "v0.2607.0";
+  version = "26.08";
+  tag = "v0.2608.0";

  src = fetchFromGitHub {
    owner = "mautrix";
    repo = "signal";
    inherit tag;
-    hash = "sha256-l6IIL2bClC6t5+P0/AkFIjkD/eDpQnnmA8x4i5ROaY4=";
+    hash = "sha256-B06szaP9QbdVy6rmnGAVkavzgzFrJXeWCN1iIvUzbzc=";
  };

  buildInputs =
@@ -46,7 +46,7 @@ buildGoModule rec {
    CGO_LDFLAGS = toString [ cppStdLib ];
  };

-  vendorHash = "sha256-0ifGza94s4+ED5OrlrqoDKIDZIYJWJhB2q3LJRpKiJs=";
+  vendorHash = "sha256-KoFLr5As31/YyusfA3bxTnI1V73F6KGWLSZPg0LZa78=";

  ldflags = [
    "-X"
--- a/pkgs/by-name/mu/mullvad-browser/package.nix
+++ b/pkgs/by-name/mu/mullvad-browser/package.nix
@@ -97,7 +97,7 @@ let
    ++ lib.optionals mediaSupport [ ffmpeg_7 ]
  );

-  version = "15.0.19";
+  version = "15.0.20";

  sources = {
    x86_64-linux = fetchurl {
@@ -109,7 +109,7 @@ let
        "https://tor.eff.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
        "https://tor.calyxinstitute.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
      ];
-      hash = "sha256-9Vbv7A8JarYtT0Ll1bveQmwif7/IViq6geMxMqeF+S4=";
+      hash = "sha256-EyVih1kklIg7b3fdh6tqtEE3Xh/UPpPMZgfdxtY6c5s=";
    };
  };

--- a/pkgs/by-name/te/teams-for-linux/package.nix
+++ b/pkgs/by-name/te/teams-for-linux/package.nix
@@ -5,7 +5,8 @@
  fetchFromGitHub,
  alsa-utils,
  copyDesktopItems,
-  electron_41,
+  electron_42,
+  libicns,
  makeDesktopItem,
  makeWrapper,
  nix-update-script,
@@ -14,26 +15,27 @@
 }:

 let
-  electron = electron_41;
+  electron = electron_42;
 in
 buildNpmPackage rec {
  pname = "teams-for-linux";
-  version = "2.11.1";
+  version = "2.17.1";

  src = fetchFromGitHub {
    owner = "IsmaelMartinez";
    repo = "teams-for-linux";
    tag = "v${version}";
-    hash = "sha256-XEu0x9g2mEsmY+vZtazTOzW6KNMRbrxlPck/kPNehmo=";
+    hash = "sha256-qI8+QqnrkGmQGweMcfyaXQnjNMf4htJAF9Gk97zL9jg=";
  };

-  npmDepsHash = "sha256-urLRj7668NX7CaDWAVxAoOg+c1TmMyvf23Je+RmFwHE=";
+  npmDepsHash = "sha256-wPHap85tS3JrN4ei/HRYyzwFfVFcPkBdbY5ViEk4bwE=";

  nativeBuildInputs = [
    makeWrapper
    versionCheckHook
  ]
-  ++ lib.optionals (stdenv.hostPlatform.isLinux) [ copyDesktopItems ];
+  ++ lib.optionals (stdenv.hostPlatform.isLinux) [ copyDesktopItems ]
+  ++ lib.optionals (stdenv.hostPlatform.isDarwin) [ libicns ];

  doInstallCheck = stdenv.hostPlatform.isLinux;

@@ -48,13 +50,29 @@ buildNpmPackage rec {
    cp -r ${electron.dist}/. "$electron_dist"
    chmod -R u+w "$electron_dist"

-    npm exec electron-builder -- \
-        --dir \
-        -c.npmRebuild=true \
-        -c.asarUnpack="**/*.node" \
-        -c.electronDist="$electron_dist" \
-        -c.electronVersion=${electron.version} \
-        -c.mac.identity=null
+    electron_builder_args=(
+      --dir
+      -c.npmRebuild=true
+      -c.asarUnpack="**/*.node"
+      -c.electronDist="$electron_dist"
+      -c.electronVersion=${electron.version}
+      -c.mac.identity=null
+    )
+
+  ''
+  + lib.optionalString stdenv.hostPlatform.isDarwin ''
+    png2icns build/icon.icns \
+      build/icons/16x16.png \
+      build/icons/32x32.png \
+      build/icons/128x128.png \
+      build/icons/256x256.png \
+      build/icons/512x512.png \
+      build/icons/1024x1024.png
+    electron_builder_args+=(-c.mac.icon=build/icon.icns)
+  ''
+  + ''
+
+    npm exec electron-builder -- "''${electron_builder_args[@]}"

    runHook postBuild
  '';
--- a/pkgs/by-name/ti/tirith/package.nix
+++ b/pkgs/by-name/ti/tirith/package.nix
@@ -8,15 +8,15 @@
 }:
 rustPlatform.buildRustPackage (final: {
  pname = "tirith";
-  version = "0.3.1";
+  version = "0.3.3";
  src = fetchFromGitHub {
    owner = "sheeki03";
    repo = "tirith";
    tag = "v${final.version}";
-    hash = "sha256-RdStW5ubqypdmFqNk9DHtUp5jHnZdXiWW/lAlSaBb3c=";
+    hash = "sha256-kU/HeCW4QNS1Ica69YZkdSgL3gsbDOJVGTyINZOnHUQ=";
  };

-  cargoHash = "sha256-/V2vv02x0zSsJCcJMSttG9eekRZMK7KTk6m2VYePFa8=";
+  cargoHash = "sha256-r13gquMmfJhR5N8Vu3/R+3SWUyVWyJFE6fiJbqbE5n4=";

  cargoBuildFlags = [
    "-p"
@@ -30,8 +30,18 @@ rustPlatform.buildRustPackage (final: {

  checkFlags = [
    # requires a fully functional shell environment, generating init scripts needs a patch under nix to work at build time
+    "--skip=bash_capability_cache_steers_default_mode"
+    "--skip=bash_enter_degradation_is_visible_not_silent"
+    "--skip=cli::clipboard::tests::copy_path_does_not_consult_sidecar"
+    "--skip=clipboard_watch_exits_when_stdout_pipe_closed"
    "--skip=init_bash_output"
+    "--skip=init_prompt_status_emits_marker_wrapped_snippet_zsh"
+    "--skip=init_prompt_status_is_idempotent_when_run_twice"
+    "--skip=init_prompt_status_supports_bash_and_fish_and_powershell"
+    "--skip=init_without_prompt_status_does_not_emit_snippet"
    "--skip=init_zsh_output"
+    # fails with: no such file or directory
+    "--skip=cli::checkpoint::tests::restore_checkpoint_nonzero_on_partial_failure"
  ];

  nativeBuildInputs = lib.optionals (stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
--- a/pkgs/by-name/to/tor-browser/package.nix
+++ b/pkgs/by-name/to/tor-browser/package.nix
@@ -102,7 +102,7 @@ let
    ++ lib.optionals mediaSupport [ ffmpeg_7 ]
  );

-  version = "15.0.19";
+  version = "15.0.20";

  sources = {
    x86_64-linux = fetchurl {
@@ -112,7 +112,7 @@ let
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
        "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
      ];
-      hash = "sha256-LrSrQx9JIcpjsSO2+fRFoHP797ZfGI9FpXfVdusr4s8=";
+      hash = "sha256-1DAmM9YFnS2tlOLIg7MRQdx7Paor+lqrsP0p3aGNIuk=";
    };

    i686-linux = fetchurl {
@@ -122,7 +122,7 @@ let
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
        "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
      ];
-      hash = "sha256-N+TjpJrHg8cB6vwCqrTWnz4/dwzu2/r55kNmkLemWvU=";
+      hash = "sha256-iqvfcBsVFN25JtAKDyL94hoL/K3rM0M7pbK7gbir5ZA=";
    };
  };

--- a/pkgs/by-name/tu/tuigreet/package.nix
+++ b/pkgs/by-name/tu/tuigreet/package.nix
@@ -8,16 +8,18 @@
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "tuigreet";
-  version = "0.9.1";
+  version = "0.11.1";
+
+  __structuredAttrs = true;

  src = fetchFromGitHub {
-    owner = "apognu";
+    owner = "tuigreet";
    repo = "tuigreet";
    tag = finalAttrs.version;
-    hash = "sha256-e0YtpakEaaWdgu+bMr2VFoUc6+SUMFk4hYtSyk5aApY=";
+    hash = "sha256-nZkZY4ZlywDUbOWmDpj1ubjoiLQamYCwTV72N0Lgb8g=";
  };

-  cargoHash = "sha256-w6ZOqpwogKoN4oqqI1gFqY8xAnfvhEBVaL8/6JXpKXs=";
+  cargoHash = "sha256-5Q4E8nnmQ109gcfxxctn/rne5N4Qvz2Pft6o7as2fSc=";

  nativeBuildInputs = [
    installShellFiles
@@ -33,10 +35,13 @@ rustPlatform.buildRustPackage (finalAttrs: {

  meta = {
    description = "Graphical console greeter for greetd";
-    homepage = "https://github.com/apognu/tuigreet";
-    changelog = "https://github.com/apognu/tuigreet/releases/tag/${finalAttrs.version}";
+    homepage = "https://github.com/tuigreet/tuigreet";
+    changelog = "https://github.com/tuigreet/tuigreet/releases/tag/${finalAttrs.version}";
    license = lib.licenses.gpl3Plus;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [
+      NotAShelf
+      antoineco
+    ];
    platforms = lib.platforms.linux;
    mainProgram = "tuigreet";
  };
--- a/pkgs/by-name/wa/wayvr/package.nix
+++ b/pkgs/by-name/wa/wayvr/package.nix
@@ -1,13 +1,17 @@
 {
  alsa-lib,
+  autoPatchelfHook,
  dav1d,
  dbus,
  fetchFromGitHub,
  lib,
+  libinput,
  libx11,
+  libxcursor,
  libxext,
  libxrandr,
  libxcb,
+  libxi,
  libxkbcommon,
  nix-update-script,
  openssl,
@@ -17,35 +21,48 @@
  pkg-config,
  procps,
  pulseaudio,
+  replaceVars,
  rustPlatform,
  shaderc,
  stdenv,
  testers,
+  vulkan-loader,
+  wayland,
  wayvr,
+  xwayland-satellite,
  withOpenVR ? !stdenv.hostPlatform.isAarch64,
 }:
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "wayvr";
-  version = "26.7.1";
+  version = "26.8.0";

  src = fetchFromGitHub {
    owner = "wlx-team";
    repo = "wayvr";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-SdHN3jDe2QJaRORy452RP7kTMxPOZOB/yjpApUOLhRU=";
+    hash = "sha256-0llU19bFJJ4yJvA6eGzOzyW8TnnurTS9js3/r+UAVCQ=";
  };

-  cargoHash = "sha256-eGmlFtlorKG7uygLer3UW6ERLQzdugoYyXVSC2sFh+k=";
+  patches = [
+    (replaceVars ./use-system-xwayland-satellite.patch {
+      xwayland-satellite = lib.getExe xwayland-satellite;
+    })
+  ];
+
+  cargoHash = "sha256-yUHLtB3/cBEWVAN1vuGLLlLFqJ25ucIy6qqInTGaOvA=";

  nativeBuildInputs = [
    pkg-config
    rustPlatform.bindgenHook
+    autoPatchelfHook
  ];

  buildInputs = [
    alsa-lib
    dav1d
    dbus
+    libinput
+    # X dependencies are dlopen'd at runtime by uidev
    libx11
    libxext
    libxrandr
@@ -54,6 +71,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
    openssl
    openxr-loader
    pipewire
+
+    # only dlopen'd at runtime by uidev
+    libxcursor
+    libxi
+    wayland
+    vulkan-loader
  ]
  ++ lib.optionals withOpenVR [ openvr ];

@@ -84,6 +107,20 @@ rustPlatform.buildRustPackage (finalAttrs: {
    rm $out/bin/prost_build
  '';

+  preFixup = ''
+    patchelf \
+      --add-needed libwayland-client.so.0 \
+      --add-needed libwayland-cursor.so.0 \
+      --add-needed libwayland-egl.so.1 \
+      --add-needed libX11.so.6 \
+      --add-needed libxcb.so.1 \
+      --add-needed libXcursor.so.1 \
+      --add-needed libXi.so.6 \
+      --add-needed libvulkan.so.1 \
+      --add-needed libxkbcommon.so.0 \
+      $out/bin/uidev
+  '';
+
  passthru = {
    tests.testVersion = testers.testVersion { package = wayvr; };

@@ -97,7 +134,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
      gpl3Only
      mit # wayvr-ipc
    ];
-    maintainers = with lib.maintainers; [ Scrumplex ];
+    maintainers = with lib.maintainers; [
+      Scrumplex
+      ImSapphire
+    ];
    platforms = lib.platforms.linux;
    broken = stdenv.hostPlatform.isAarch64 && withOpenVR;
    mainProgram = "wayvr";
--- a/pkgs/by-name/wa/wayvr/use-system-xwayland-satellite.patch
+++ b/pkgs/by-name/wa/wayvr/use-system-xwayland-satellite.patch
@@ -0,0 +1,25 @@
+diff --git a/wayvr/src/backend/wayvr/client.rs b/wayvr/src/backend/wayvr/client.rs
+index 734e8b68..17058705 100644
+--- a/wayvr/src/backend/wayvr/client.rs
+++ b/wayvr/src/backend/wayvr/client.rs
+@@ -98,7 +98,7 @@ impl WayVRCompositor {
+     ) -> anyhow::Result<Self> {
+         let (wayland_env, listener) = create_wayland_listener()?;
+ 
+-        let xwayland_satellite = Command::new(bundled_executable("xwayland-satellite"))
+        let xwayland_satellite = Command::new("@xwayland-satellite@")
+             .arg(wayland_env.display_num_string())
+             .env("WAYLAND_DISPLAY", wayland_env.wayland_display_num_string())
+             .spawn()
+@@ -468,11 +468,3 @@ fn accumulate_discrete_scroll(acc: &mut f32, delta_v120: i32) -> i32 {
+ 
+     steps
+ }
+-
+-/// Runs executable from APPDIR, falling back to PATH
+-fn bundled_executable(name: impl AsRef<std::path::Path>) -> PathBuf {
+-    match std::env::var_os("APPDIR") {
+-        Some(appdir) => PathBuf::from(appdir).join("usr").join("bin").join(name),
+-        None => PathBuf::from(name.as_ref()),
+-    }
+-}
--- a/pkgs/by-name/zi/zipperposition/package.nix
+++ b/pkgs/by-name/zi/zipperposition/package.nix
@@ -29,17 +29,12 @@ ocamlPackages.buildDunePackage {
    oseq
  ];

-  buildPhase = ''
-    runHook preBuild
-    dune build -p logtk,libzipperposition,zipperposition,zipperposition-tools ''${enableParallelBuilding:+-j $NIX_BUILD_CORES}
-    runHook postBuild
-  '';
-
-  installPhase = ''
-    runHook preInstall
-    dune install --prefix $out --libdir $OCAMLFIND_DESTDIR logtk libzipperposition zipperposition zipperposition-tools
-    runHook postInstall
-  '';
+  dunePackages = [
+    "logtk"
+    "libzipperposition"
+    "zipperposition"
+    "zipperposition-tools"
+  ];

  doCheck = true;

@@ -49,12 +44,6 @@ ocamlPackages.buildDunePackage {
    qcheck-alcotest
  ];

-  checkPhase = ''
-    runHook preCheck
-    dune runtest -p logtk,libzipperposition,zipperposition,zipperposition-tools ''${enableParallelBuilding:+-j $NIX_BUILD_CORES}
-    runHook postCheck
-  '';
-
  meta = {
    description = "Superposition prover for full first order logic";
    homepage = "https://github.com/sneeuwballen/zipperposition";
--- a/pkgs/development/compilers/temurin-bin/jdk-linux-base.nix
+++ b/pkgs/development/compilers/temurin-bin/jdk-linux-base.nix
@@ -56,7 +56,7 @@ let
      else
        "${name-prefix}-${sourcePerArch.packageType}-bin";

-    version = sourcePerArch.${cpuName}.version or (throw "unsupported CPU ${cpuName}");
+    version = sourcePerArch.${cpuName}.version or "unsupported";

    src = fetchurl {
      inherit (sourcePerArch.${cpuName}) url sha256;
--- a/pkgs/development/libraries/ffmpeg/generic.nix
+++ b/pkgs/development/libraries/ffmpeg/generic.nix
@@ -453,6 +453,15 @@ stdenv.mkDerivation (
      ++ optionals (lib.versionAtLeast version "5.1") [
        ./nvccflags-cpp14.patch
      ]
+      ++ optionals (lib.versionAtLeast version "8.1.2" && stdenv.hostPlatform.isLoongArch64) [
+        # https://code.ffmpeg.org/FFmpeg/FFmpeg/pulls/23825 (merged, but not backported to 8.1.x or 9.0.x)
+        # As git.ffmpeg.org deploys Anubis, we cannot fetch this patch reliably from there.
+        # So instead, we fetch it from Debian.
+        (fetchpatch2 {
+          url = "https://salsa.debian.org/multimedia-team/ffmpeg/-/raw/d52aea25bc9123bfaf61f7a7e5a0d9da01c8788d/debian/patches/0001-swscale-loongarch-fix-buffer-underflow-in-yuv2plane1.patch";
+          hash = "sha256-QRkb7z4Btyd9ZgV/1hh6Fb87IhkygFgVDqQdloXKL6Q=";
+        })
+      ]
      ++ optionals (lib.versionAtLeast version "7.0" && lib.versionOlder version "7.1.4") [
        (fetchpatch2 {
          name = "unbreak-hardcoded-tables.patch";
--- a/pkgs/development/python-modules/skia-pathops/default.nix
+++ b/pkgs/development/python-modules/skia-pathops/default.nix
@@ -72,7 +72,7 @@ buildPythonPackage rec {
    description = "Python access to operations on paths using the Skia library";
    homepage = "https://github.com/fonttools/skia-pathops";
    license = lib.licenses.bsd3;
-    maintainers = [ ];
+    maintainers = [ lib.maintainers.wegank ];
    # "The Skia team is not endian-savvy enough to support big-endian CPUs."
    badPlatforms = lib.platforms.bigEndian;
    # ERROR at //gn/BUILDCONFIG.gn:87:14: Script returned non-zero exit code.
--- a/pkgs/servers/http/nginx/mainline.nix
+++ b/pkgs/servers/http/nginx/mainline.nix
@@ -1,6 +1,6 @@
 { callPackage, ... }@args:

 callPackage ./generic.nix args {
-  version = "1.31.3";
-  hash = "sha256-p2V8UIEcLZLZiVOV6Lhz72A5gULE2yHrZHgRw49t1SU=";
+  version = "1.31.4";
+  hash = "sha256-5vILZEoXpkPwWa5kZ6GXH+KBFYfQJeBxBodTofHjs8M=";
 }
--- a/pkgs/servers/web-apps/discourse/default.nix
+++ b/pkgs/servers/web-apps/discourse/default.nix
@@ -11,7 +11,8 @@
  nixosTests,

  defaultGemConfig,
-  ruby_3_3,
+  ruby_3_4,
+  fetchzip,
  gzip,
  gnutar,
  git,
@@ -53,18 +54,18 @@
 }:

 let
-  version = "2026.1.4";
+  version = "2026.7.1";

  src = fetchFromGitHub {
    owner = "discourse";
    repo = "discourse";
    rev = "v${version}";
-    sha256 = "sha256-kQYDKZIMsWByuCZQfUlwhoIew5QykVylRMh6xvrHIBY=";
+    sha256 = "sha256-sGygaOCygtDVjg8uBGdDVaRouUKib8aAukaBAY8aQ9w=";
  };

  pnpm = pnpm_10;

-  ruby = ruby_3_3;
+  ruby = ruby_3_4;

  runtimeDeps = [
    # For backups, themes and assets
@@ -176,129 +177,171 @@ let
            --chdir '${discourse}/share/discourse'
      '';

-  rubyEnv = bundlerEnv {
-    name = "discourse-ruby-env-${version}";
-    inherit version ruby;
-    gemdir = ./rubyEnv;
-    gemset = import ./rubyEnv/gemset.nix;
-    gemConfig = defaultGemConfig // {
-      mini_racer = attrs: {
-        buildInputs = [ icu78 ];
-        dontBuild = false;
-        NIX_LDFLAGS = "-licui18n";
+  rubyEnv =
+    let
+      # these hashes are auto-updated by update.py
+      dart-x64-hash = "sha256-2rnqNeEr8PFMuFa4IhutxxXui1dCw3XQVqCV5ZwsUR8=";
+      dart-arm64-hash = "sha256-8sgc9IaeWSRnURFtMuSOqnKACkDc5WynmLIboYWwoSM=";
+    in
+    bundlerEnv rec {
+      name = "discourse-ruby-env-${version}";
+      inherit version ruby;
+      gemdir = ./rubyEnv;
+      gemset = import (gemdir + "/gemset.nix") src;
+      passthru = {
+        # these MUST be passthru'd for update.py to function correctly (to update dart-dart-x64-hash and dart-arm64-hash)
+        inherit dart-x64-hash dart-arm64-hash gemset;
      };
-      libv8-node =
-        attrs:
-        let
-          noopScript = writeShellScript "noop" "exit 0";
-          linkFiles = writeShellScript "link-files" ''
-            cd ../..
-
-            mkdir -p vendor/v8/${stdenv.hostPlatform.system}/libv8/obj/
-            ln -s "${nodejs-slim_22.libv8}/lib/libv8.a" vendor/v8/${stdenv.hostPlatform.system}/libv8/obj/libv8_monolith.a
-
-            ln -s ${nodejs-slim_22.libv8}/include vendor/v8/include
-
-            mkdir -p ext/libv8-node
-            echo '--- !ruby/object:Libv8::Node::Location::Vendor {}' >ext/libv8-node/.location.yml
-          '';
-        in
-        {
+      gemConfig = defaultGemConfig // {
+        mini_racer = attrs: {
+          buildInputs = [ icu78 ];
          dontBuild = false;
+          NIX_LDFLAGS = "-licui18n";
+        };
+        libv8-node =
+          attrs:
+          let
+            noopScript = writeShellScript "noop" "exit 0";
+            linkFiles = writeShellScript "link-files" ''
+              cd ../..
+
+              mkdir -p vendor/v8/${stdenv.hostPlatform.system}/libv8/obj/
+              ln -s "${nodejs-slim_22.libv8}/lib/libv8.a" vendor/v8/${stdenv.hostPlatform.system}/libv8/obj/libv8_monolith.a
+
+              ln -s ${nodejs-slim_22.libv8}/include vendor/v8/include
+
+              mkdir -p ext/libv8-node
+              echo '--- !ruby/object:Libv8::Node::Location::Vendor {}' >ext/libv8-node/.location.yml
+            '';
+          in
+          {
+            dontBuild = false;
+            postPatch = ''
+              cp ${noopScript} libexec/build-libv8
+              cp ${noopScript} libexec/build-monolith
+              cp ${noopScript} libexec/download-node
+              cp ${noopScript} libexec/extract-node
+              cp ${linkFiles} libexec/inject-libv8
+            '';
+          };
+        mini_suffix = attrs: {
+          propagatedBuildInputs = [ libpsl ];
+          dontBuild = false;
+          # Use our libpsl instead of the vendored one, which isn't
+          # available for aarch64. It has to be called
+          # libpsl.x86_64.so or it isn't found.
          postPatch = ''
-            cp ${noopScript} libexec/build-libv8
-            cp ${noopScript} libexec/build-monolith
-            cp ${noopScript} libexec/download-node
-            cp ${noopScript} libexec/extract-node
-            cp ${linkFiles} libexec/inject-libv8
+            cp $(readlink -f ${lib.getLib libpsl}/lib/libpsl.so) vendor/libpsl.x86_64.so
          '';
        };
-      mini_suffix = attrs: {
-        propagatedBuildInputs = [ libpsl ];
-        dontBuild = false;
-        # Use our libpsl instead of the vendored one, which isn't
-        # available for aarch64. It has to be called
-        # libpsl.x86_64.so or it isn't found.
-        postPatch = ''
-          cp $(readlink -f ${lib.getLib libpsl}/lib/libpsl.so) vendor/libpsl.x86_64.so
-        '';
-      };
-      tokenizers = attrs: {
-        cargoDeps = rustPlatform.fetchCargoVendor {
-          inherit (buildRubyGem { inherit (attrs) gemName version source; })
-            name
-            src
-            unpackPhase
-            nativeBuildInputs
-            ;
-          hash = "sha256-Yxcerq4Wil1nrEzHoEmsTAj4VnUmrwRlA3WO2b72yOc=";
+        tokenizers = attrs: {
+          cargoDeps = rustPlatform.fetchCargoVendor {
+            inherit (buildRubyGem { inherit (attrs) gemName version source; })
+              name
+              src
+              unpackPhase
+              nativeBuildInputs
+              ;
+            hash = "sha256-BWOnHSgEkhK1yYcQIYMbGz8HyATuQ8tFk8QzoNiuML8=";
+          };
+
+          dontBuild = false;
+
+          nativeBuildInputs = [
+            cargo
+            rustc
+            rustPlatform.cargoSetupHook
+            rustPlatform.bindgenHook
+          ];
+
+          disallowedReferences = [
+            rustc.unwrapped
+          ];
+
+          preInstall = ''
+            export CARGO_HOME="$PWD/../.cargo/"
+          '';
+
+          postInstall = ''
+            find $out -type f -name .rustc_info.json -delete
+          '';
        };
+        tiktoken_ruby = attrs: {
+          cargoDeps = rustPlatform.fetchCargoVendor {
+            inherit (buildRubyGem { inherit (attrs) gemName version source; })
+              name
+              src
+              unpackPhase
+              nativeBuildInputs
+              ;
+            hash = "sha256-OIkSavAjja1atbeyPAKFXsXoYI3nUk9c5G3RFBj53Uk=";
+          };

-        dontBuild = false;
+          dontBuild = false;

-        nativeBuildInputs = [
-          cargo
-          rustc
-          rustPlatform.cargoSetupHook
-          rustPlatform.bindgenHook
-        ];
+          nativeBuildInputs = [
+            cargo
+            rustc
+            rustPlatform.cargoSetupHook
+            rustPlatform.bindgenHook
+          ];

-        disallowedReferences = [
-          rustc.unwrapped
-        ];
+          disallowedReferences = [
+            rustc.unwrapped
+          ];

-        preInstall = ''
-          export CARGO_HOME="$PWD/../.cargo/"
-        '';
+          preInstall = ''
+            export CARGO_HOME="$PWD/../.cargo/"
+          '';

-        postInstall = ''
-          find $out -type f -name .rustc_info.json -delete
-        '';
-      };
-      tiktoken_ruby = attrs: {
-        cargoDeps = rustPlatform.fetchCargoVendor {
-          inherit (buildRubyGem { inherit (attrs) gemName version source; })
-            name
-            src
-            unpackPhase
-            nativeBuildInputs
-            ;
-          hash = "sha256-zyGK+XJpMls6w0Uydegqsj4TH4IrVxANm0qmpR7+95I=";
+          postInstall = ''
+            #ls $GEM_HOME/gems/${attrs.gemName}-${attrs.version}/lib
+            #mv -v $GEM_HOME/gems/${attrs.gemName}-${attrs.version}/lib/{glfm_markdown/glfm_markdown.so,}
+            find $out -type f -name .rustc_info.json -delete
+          '';
+        };
+        sass-embedded = attrs: {
+          # pre-download dart sass with the version matching sass-embedded. this is the same behavior as sass-embedded does internally
+          # but packages don't get internet access during build so it can't do it itself
+          env =
+            let
+              system-code =
+                if stdenv.system == "x86_64-linux" then
+                  "linux-x64"
+                else if stdenv.system == "aarch64-linux" then
+                  "linux-arm64"
+                else
+                  "unsupported-system-triple-download-will-fail";
+              hash =
+                if stdenv.system == "x86_64-linux" then
+                  dart-x64-hash
+                else if stdenv.system == "aarch64-linux" then
+                  dart-arm64-hash
+                else
+                  "unsupported-system";
+            in
+            attrs.env or { }
+            // {
+              DART_SASS_VENDORED = fetchzip {
+                inherit hash;
+                url = "https://github.com/sass/dart-sass/releases/download/${attrs.version}/dart-sass-${attrs.version}-${system-code}.tar.gz";
+              };
+            };
+          dontBuild = false;
+          patches = [
+            ./sass_embedded_vendored_dart_sass.patch
+          ];
        };
-
-        dontBuild = false;
-
-        nativeBuildInputs = [
-          cargo
-          rustc
-          rustPlatform.cargoSetupHook
-          rustPlatform.bindgenHook
-        ];
-
-        disallowedReferences = [
-          rustc.unwrapped
-        ];
-
-        preInstall = ''
-          export CARGO_HOME="$PWD/../.cargo/"
-        '';
-
-        postInstall = ''
-          #ls $GEM_HOME/gems/${attrs.gemName}-${attrs.version}/lib
-          #mv -v $GEM_HOME/gems/${attrs.gemName}-${attrs.version}/lib/{glfm_markdown/glfm_markdown.so,}
-          find $out -type f -name .rustc_info.json -delete
-        '';
      };
+
+      groups = [
+        "default"
+        "assets"
+        "development"
+        "test"
+      ];
    };

-    groups = [
-      "default"
-      "assets"
-      "development"
-      "test"
-    ];
-  };
-
  assets = stdenv.mkDerivation {
    pname = "discourse-assets";
    inherit version src;
@@ -307,7 +350,7 @@ let
      pname = "discourse-assets";
      inherit version src pnpm;
      fetcherVersion = 3;
-      hash = "sha256-xft/2x0iti0yJ53uI9q2+FSvKgWWfKQzlMlPFz3RZsE=";
+      hash = "sha256-T0qcUYHqpjeGlyozcaiVI/Art0zh2PLyuMzbquhfe/o=";
    };

    nativeBuildInputs = runtimeDeps ++ [
@@ -345,10 +388,16 @@ let
      # assets precompilation task.
      ./assets_rake_command.patch

-      # Little does he know, so he decided there is no need to generate the
-      # theme-transpiler over and over again. Which at the same time allows the removal
-      # of javascript devDependencies from the runtime environment.
+      # Because the required dependencies to execute the build at runtime don't exist, and
+      # because we fail to copy tmp/ (the default directory where the asset processor is cached,
+      # see notes in the discourse `installPhase`) we need to change the directory to something under
+      # frontend/ which is moved over as expected.
      ./prebuild-asset-processor.patch
+
+      # safe_exec.rb, which is used to execute ImageMagick among other things, restricts executable paths to standard FHS paths
+      # which breaks on nix. this patch adds the entire /nix/store to allowed paths, which is sub-optimal but
+      # still provides some benifits over disabling entirely.
+      ./safe-exec-from-nix-store.patch
    ];

    env.RAILS_ENV = "production";
@@ -398,6 +447,7 @@ let
      runHook preBuild

      patchShebangs script/
+      patchShebangs bin/
      bundle exec rake assets:precompile

      runHook postBuild
@@ -441,10 +491,6 @@ let
      # Add the path to the CA cert bundle to make TLS work
      ./action_mailer_ca_cert.patch

-      # Log Unicorn messages to the journal and make request timeout
-      # configurable
-      ./unicorn_logging_and_timeout.patch
-
      # Use the Ruby API version in the plugin gem path, to match the
      # one constructed by bundlerEnv
      ./plugin_gem_api_version.patch
@@ -457,11 +503,17 @@ let
      # Make sure the notification email setting applies
      ./notification_email.patch

-      # Little does he know, so he decided there is no need to generate the
-      # theme-transpiler over and over again. Which at the same time allows the removal
-      # of javascript devDependencies from the runtime environment.
+      # Because the required dependencies to execute the build at runtime don't exist, and
+      # because we fail to copy tmp/ (the default directory where the asset processor is cached,
+      # see notes in the discourse `installPhase`) we need to change the directory to something under
+      # frontend/ which is moved over as expected.
      ./prebuild-asset-processor.patch

+      # safe_exec.rb, which is used to execute ImageMagick among other things, restricts executable paths to standard FHS paths
+      # which breaks on nix. this patch adds the entire /nix/store to allowed paths, which is sub-optimal but
+      # still provides some benifits over disabling entirely.
+      ./safe-exec-from-nix-store.patch
+
      # Our app/assets/generated folder is a symlink, but the ruby File.mkdir_p doesn't allow
      # a symlink in the way to the last directory. This patch explicitly resolves the symlink.
      ./resolve_generated_assets_symlink.patch
@@ -494,6 +546,9 @@ let
      cp -r . $out/share/discourse
      rm -r $out/share/discourse/log
      ln -sf /var/log/discourse $out/share/discourse/log
+      # we don't copy `tmp` from ${assets}, which means that any pre-cached content will be re-generated later
+      # however, we also can't copy `tmp` because then it would not be writeable by discourse, which it must be
+      # and we can't write to /var/lib/discourse/tmp, because you can't do that in a build. this sucks.
      ln -sf /var/lib/discourse/tmp $out/share/discourse/tmp
      ln -sf /run/discourse/config $out/share/discourse/config
      ln -sf /run/discourse/public $out/share/discourse/public
--- a/pkgs/servers/web-apps/discourse/notification_email.patch
+++ b/pkgs/servers/web-apps/discourse/notification_email.patch
@@ -1,11 +1,10 @@
 diff --git a/db/fixtures/990_settings.rb b/db/fixtures/990_settings.rb
-deleted file mode 100644
-index 6f21e58813..0000000000
+index c64d9fbc205..d8cf8d88010 100644
 --- a/db/fixtures/990_settings.rb
-+++ /dev/null
-@@ -1,12 +0,0 @@
-# frozen_string_literal: true
-
+++ b/db/fixtures/990_settings.rb
+@@ -1,14 +1,3 @@
+ # frozen_string_literal: true
+ 
 -if SiteSetting.notification_email == SiteSetting.defaults[:notification_email]
 -  # don't crash for invalid hostname, which is possible in dev
 -  begin
@@ -16,3 +15,5 @@ index 6f21e58813..0000000000
 -    end
 -  end
 -end
+-
+ SiteSetting.api_key_last_used_epoch = Time.now if SiteSetting.api_key_last_used_epoch.blank?
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-bbcode-color/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-bbcode-color/default.nix
@@ -9,8 +9,8 @@ mkDiscoursePlugin {
  src = fetchFromGitHub {
    owner = "discourse";
    repo = "discourse-bbcode-color";
-    rev = "8c621d07a7a60b94d717fd435b0f137e89db99cd";
-    sha256 = "sha256-+LqlJpg9s2GbZE136FUDIRn9C10a7IYPPu1crkMqMSA=";
+    rev = "b68e1c3bfbfe2468f70af47045276e4463568fe3";
+    sha256 = "sha256-AM3AMZFaTTf9Q6ulr9qoTZafykPFBTkXvtkmU+TAPew=";
  };
  meta = {
    homepage = "https://github.com/discourse/discourse-bbcode-color";
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-docs/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-docs/default.nix
@@ -9,8 +9,8 @@ mkDiscoursePlugin {
  src = fetchFromGitHub {
    owner = "discourse";
    repo = "discourse-docs";
-    rev = "742515b059c27803a7b813ae420b65ceba1e8798";
-    sha256 = "sha256-AG4WYskmEdW68n2XX4t139I3rlc0PNAL8cTehVvEgAs=";
+    rev = "0796384551e3f9d328c57e88577098be05d816c7";
+    sha256 = "sha256-lZ8BlFaQcd9H+bom2igbJl4Ty7qmqtpbOpGbqIF8nEo=";
  };
  meta = {
    homepage = "https://github.com/discourse/discourse-docs";
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-events/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-events/default.nix
@@ -10,8 +10,8 @@ mkDiscoursePlugin {
  src = fetchFromGitHub {
    owner = "angusmcleod";
    repo = "discourse-events";
-    rev = "3004435beb0913296dbaf8e5b3cd65be7b84df56";
-    sha256 = "sha256-TQ+mcd2IAswxqY6OJfXk+d770WBNBZ73bB2aAfxYSDs=";
+    rev = "5e22962b7346dbcdb579e7c3abb13c5c965c3c42";
+    sha256 = "sha256-IZ7xJaPb44CZOtg4xA4crCe4//oZO3pjkgvXOM1lihE=";
  };
  meta = {
    homepage = "https://github.com/angusmcleod/discourse-events";
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-ldap-auth/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-ldap-auth/default.nix
@@ -11,8 +11,8 @@ mkDiscoursePlugin {
  src = fetchFromGitHub {
    owner = "jonmbake";
    repo = "discourse-ldap-auth";
-    rev = "0f5749ca6443d63999f78ed8eac49dead1b322bc";
-    sha256 = "sha256-QquREAexMJjza+TtDveqJ3/sgjPCziv2oje4fKL6uz4=";
+    rev = "9776c1d021696e5bfdb8857093b8434063bc6ae1";
+    sha256 = "sha256-ZXYuplYF1xjxqcKT7+u/zkjh0fCmIgQ+cWBhs7NFm14=";
  };
  meta = {
    homepage = "https://github.com/jonmbake/discourse-ldap-auth";
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-prometheus/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-prometheus/default.nix
@@ -10,8 +10,8 @@ mkDiscoursePlugin {
  src = fetchFromGitHub {
    owner = "discourse";
    repo = "discourse-prometheus";
-    rev = "14d2328911c3b7ed5b38c4713c52cd835793be5a";
-    sha256 = "sha256-GpNh+7091Lj0JW+RB9EOgxFNOCkFVvpPd0vbbpFcvcE=";
+    rev = "ce51879d2c487cf74ca08d6d83d6ccb41cb28738";
+    sha256 = "sha256-OhzWC8dgfwhre1HF5sjqXAeIJd3wuknzb12RMCz3+4Y=";
  };

  patches = [
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-saved-searches/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-saved-searches/default.nix
@@ -9,8 +9,8 @@ mkDiscoursePlugin {
  src = fetchFromGitHub {
    owner = "discourse";
    repo = "discourse-saved-searches";
-    rev = "d13a708d33fc24bb6cc111e8d84fb896caf81ef4";
-    sha256 = "sha256-3hnmtHR1k1bZKH3ezauQPr7pfbQYRTbGV8a39w6m6F8=";
+    rev = "a930ddee76321bb929989a2edbabb799199f1445";
+    sha256 = "sha256-etcN88cIgaVvVAtE+z3zNacpNpwCp+cn2lE1DzeICyk=";
  };
  meta = {
    homepage = "https://github.com/discourse/discourse-saved-searches";
--- a/pkgs/servers/web-apps/discourse/plugins/discourse-yearly-review/default.nix
+++ b/pkgs/servers/web-apps/discourse/plugins/discourse-yearly-review/default.nix
@@ -9,8 +9,8 @@ mkDiscoursePlugin {
  src = fetchFromGitHub {
    owner = "discourse";
    repo = "discourse-yearly-review";
-    rev = "7e7df7878212ad976031cbbc17a0dd4ca1d55def";
-    sha256 = "sha256-+6CmXgXEyQb6CNSqaVqbfXQCc+XJQGDQnw9vgAlse0g=";
+    rev = "97720c573f04ce32544ef1e9353b12005de0bdec";
+    sha256 = "sha256-ZhkrPYFjhtNoh6jQhqPTMZJqHMyZo3tdbtSl3MuOJz0=";
  };
  meta = {
    homepage = "https://github.com/discourse/discourse-yearly-review";
--- a/pkgs/servers/web-apps/discourse/prebuild-asset-processor.patch
+++ b/pkgs/servers/web-apps/discourse/prebuild-asset-processor.patch
@@ -1,23 +1,13 @@
 diff --git a/lib/asset_processor.rb b/lib/asset_processor.rb
-index 06e8cadbb4..b3368d4912 100644
+index bacb376c856..11d7d7edd32 100644
 --- a/lib/asset_processor.rb
 +++ b/lib/asset_processor.rb
-@@ -1,7 +1,7 @@
- # frozen_string_literal: true
-
+@@ -3,7 +3,7 @@
 class AssetProcessor
-  PROCESSOR_PATH = "tmp/asset-processor.js"
-+  PROCESSOR_PATH = "frontend/asset-processor.js"
-
-   @mutex = Mutex.new
-   @ctx_init = Mutex.new
-@@ -28,7 +28,9 @@ class AssetProcessor
-   end
-
-   def self.build_production_asset_processor
-    File.write(PROCESSOR_PATH, build_asset_processor)
-+    if (!Rails.env.production? or !File.file?(PROCESSOR_PATH))
-+      File.write(PROCESSOR_PATH, build_asset_processor)
-+    end
-     PROCESSOR_PATH
-   end
+   BASE_COMPILER_VERSION = 113
+ 
+-  PROCESSOR_DIR = "tmp/asset-processor"
+  PROCESSOR_DIR = "frontend/asset-processor.build"
+   LOCK_FILE = "#{PROCESSOR_DIR}/build.lock"
+ 
+   CACHE_DEPENDENCY_GLOBS = %w[
--- a/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile
+++ b/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile
@@ -1,6 +1,6 @@
 # frozen_string_literal: true

-ruby "~> 3.3"
+ruby "~> 3.4"

 source "https://rubygems.org"
 # if there is a super emergency and rubygems is playing up, try
@@ -20,7 +20,7 @@ gem "propshaft"
 gem "json"

 # this will eventually be added to rails,
-# allows us to precompile all our templates in the unicorn master
+# allows us to precompile all our templates in the app server master
 gem "actionview_precompiler", require: false

 gem "discourse-seed-fu"
@@ -63,7 +63,9 @@ gem "fastimage"

 gem "aws-sdk-s3", require: false
 gem "aws-sdk-sns", require: false
+gem "aws-sdk-sts", require: false
 gem "aws-sdk-mediaconvert", require: false
+gem "aws-sdk-bedrockruntime", require: false
 gem "excon"
 gem "unf", require: false

@@ -72,6 +74,7 @@ gem "email_reply_trimmer"
 gem "image_optim"
 gem "multi_json"
 gem "mustache"
+gem "liquid", "5.12.0"
 gem "nokogiri"
 gem "loofah"
 gem "css_parser", require: false
@@ -97,14 +100,14 @@ gem "rake"
 gem "thor", require: false
 gem "diffy", require: false
 gem "rinku"
-gem "sidekiq"
+gem "sidekiq", ">= 7.3.10" # ensuring it won't get downgraded to accomodate a connection_pool upgrade
 gem "mini_scheduler"

 gem "mini_racer"

 gem "highline", require: false

-# When unicorn is not used anymore, we can use Rack 3
+# TODO: upgrade to Rack 3 now that Unicorn has been removed
 gem "rack", "< 3"

 gem "rack-protection" # security
@@ -127,6 +130,7 @@ group :test do
  gem "rails-dom-testing", require: false
  gem "minio_runner", require: false
  gem "capybara-playwright-driver"
+  gem "puma", require: false
 end

 group :test, :development do
@@ -142,7 +146,6 @@ group :test, :development do

  gem "shoulda-matchers", require: false
  gem "rspec-html-matchers"
-  gem "pry-stack_explorer", require: false
  gem "debug", ">= 1.0.0", require: "debug/prelude"
  gem "rubocop-discourse", require: false
  gem "parallel_tests"
@@ -160,7 +163,6 @@ group :development do
  gem "ruby-prof", require: false, platform: :mri
  gem "bullet", require: !!ENV["BULLET"]
  gem "better_errors", platform: :mri, require: !!ENV["BETTER_ERRORS"]
-  gem "binding_of_caller"
  gem "yaml-lint"
  gem "yard"
  gem "ruby-lsp", require: false
@@ -194,10 +196,12 @@ gem "htmlentities", require: false

 gem "rack-mini-profiler", require: ["enable_rails_patches"]

-gem "unicorn", require: false, platform: :ruby
-gem "puma", require: false
 gem "pitchfork", require: false

+# Used by discourse-prometheus to collect socket queue stats.
+# Was previously a transitive dependency of the unicorn gem.
+gem "raindrops", require: false, platform: :ruby
+
 gem "rbtrace", require: false, platform: :mri

 # required for feed importing and embedding
@@ -224,6 +228,8 @@ gem "rqrcode"

 gem "rubyzip", require: false

+gem "landlock", require: false
+
 gem "sshkey", require: false

 gem "rchardet", require: false
@@ -272,19 +278,10 @@ gem "iso8601"
 gem "rrule"

 group :migrations, optional: true do
-  gem "extralite-bundle", require: "extralite"
-
-  # auto-loading
-  gem "zeitwerk"
-
-  # databases
-  gem "trilogy"
-
-  # CLI
-  gem "ruby-progressbar"
-
-  # non-cryptographic hashing algorithm for generating placeholder IDs
-  gem "digest-xxhash"
+  gem "migrations-core", path: "migrations/core"
+  gem "migrations-tooling", path: "migrations/tooling"
+  gem "migrations-converters", path: "migrations/converters"
+  gem "migrations-importer", path: "migrations/importer"
 end

 gem "dry-initializer", "~> 3.1"
@@ -301,13 +298,15 @@ gem "zendesk_api", require: false
 # for discourse-subscriptions
 gem "stripe", require: false

-# for discourse-github
+# for discourse-code-review
 gem "sawyer", require: false
 gem "octokit", require: false

 # for discourse-ai
 gem "tokenizers", require: false
 gem "tiktoken_ruby", require: false
+gem "smarter_json", require: false
+gem "json_completer", require: false
 gem "discourse_ai-tokenizers", require: false
 gem "ed25519" # TODO: remove this as existing ssl gem should handle this
 gem "Ascii85", require: false
--- a/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
+++ b/pkgs/servers/web-apps/discourse/rubyEnv/Gemfile.lock
--- a/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix
+++ b/pkgs/servers/web-apps/discourse/rubyEnv/gemset.nix
--- a/pkgs/servers/web-apps/discourse/safe-exec-from-nix-store.patch
+++ b/pkgs/servers/web-apps/discourse/safe-exec-from-nix-store.patch
@@ -0,0 +1,13 @@
+diff --git a/lib/discourse/safe_exec.rb b/lib/discourse/safe_exec.rb
+index c4b8a5e3ecb..31d6f0d469d 100644
+--- a/lib/discourse/safe_exec.rb
+++ b/lib/discourse/safe_exec.rb
+@@ -5,7 +5,7 @@ require "landlock"
+ module Discourse
+   class SafeExec
+     DEFAULT_READ_PATHS = %w[/bin /etc /lib /lib64 /usr].freeze
+-    DEFAULT_EXECUTE_PATHS = %w[/bin /lib /lib64 /usr].freeze
+    DEFAULT_EXECUTE_PATHS = %w[/bin /lib /lib64 /usr /nix/store].freeze
+ 
+     def self.capture(
+       *command,
--- a/pkgs/servers/web-apps/discourse/sass_embedded_vendored_dart_sass.patch
+++ b/pkgs/servers/web-apps/discourse/sass_embedded_vendored_dart_sass.patch
@@ -0,0 +1,28 @@
+diff --git a/ext/sass/Rakefile b/ext/sass/Rakefile
+index d542efd..93f97cf 100644
+--- a/ext/sass/Rakefile
+++ b/ext/sass/Rakefile
+@@ -84,11 +84,18 @@ file File.absolute_path('node_modules/sass', ARCHDIR) do
+ end
+ 
+ task 'dart-sass' => (
+-  begin
+-    SassConfig.dart_sass
+-    File.absolute_path('dart-sass/sass', ARCHDIR)
+-  rescue NotImplementedError
+-    File.absolute_path('node_modules/sass', ARCHDIR)
+  p ENV
+  if ENV.has_key?('DART_SASS_VENDORED')
+    mkdir_p ARCHDIR
+    cp_r ENV.fetch('DART_SASS_VENDORED'), File.absolute_path('dart-sass', ARCHDIR)
+  else
+    raise Errno::EINVAL, "no vendored SASS"
+    begin
+      SassConfig.dart_sass
+      File.absolute_path('dart-sass/sass', ARCHDIR)
+    rescue NotImplementedError
+      File.absolute_path('node_modules/sass', ARCHDIR)
+    end
+   end
+ )
+ 
--- a/pkgs/servers/web-apps/discourse/unicorn_logging_and_timeout.patch
+++ b/pkgs/servers/web-apps/discourse/unicorn_logging_and_timeout.patch
@@ -1,25 +0,0 @@
-diff --git a/config/unicorn.conf.rb b/config/unicorn.conf.rb
-index b8c549bc0f..a7d3592013 100644
--- a/config/unicorn.conf.rb
-+++ b/config/unicorn.conf.rb
-@@ -35,19 +35,7 @@ FileUtils.mkdir_p("#{discourse_path}/tmp/pids") if !File.exist?("#{discourse_pat
- # feel free to point this anywhere accessible on the filesystem
- pid(ENV["UNICORN_PID_PATH"] || "#{discourse_path}/tmp/pids/unicorn.pid")
-
-if ENV["RAILS_ENV"] == "production"
-  # By default, the Unicorn logger will write to stderr.
-  # Additionally, some applications/frameworks log to stderr or stdout,
-  # so prevent them from going to /dev/null when daemonized here:
-  stderr_path unicorn_stderr_path
-  stdout_path unicorn_stdout_path
-
-  # nuke workers after 30 seconds instead of 60 seconds (the default)
-  timeout 30
-else
-  # we want a longer timeout in dev cause first request can be really slow
-  timeout(ENV["UNICORN_TIMEOUT"] && ENV["UNICORN_TIMEOUT"].to_i || 60)
-end
-+timeout(ENV["UNICORN_TIMEOUT"] && ENV["UNICORN_TIMEOUT"].to_i || 60)
-
- # important for Ruby 2.0
- preload_app true
--- a/pkgs/servers/web-apps/discourse/update.py
+++ b/pkgs/servers/web-apps/discourse/update.py
@@ -1,5 +1,5 @@
 #!/usr/bin/env nix-shell
-#! nix-shell -i python3 -p "python3.withPackages (ps: with ps; [ requests click click-log packaging ])" bundix bundler nix-update nurl
+#! nix-shell -i python3 -p "python3.withPackages (ps: with ps; [ requests click click-log packaging ])" bundix bundler nix-update nurl curl unzip
 from __future__ import annotations

 import click
@@ -149,6 +149,7 @@ def _diff_file(filepath: str, old_version: DiscourseVersion, new_version: Discou

    with tempfile.NamedTemporaryFile(mode='w') as o, tempfile.NamedTemporaryFile(mode='w') as n:
        o.write(old), n.write(new)
+        o.flush(), n.flush()
        width = shutil.get_terminal_size((80, 20)).columns
        diff_proc = subprocess.run(
            ['diff', '--color=always', f'--width={width}', '-y', o.name, n.name],
@@ -236,12 +237,71 @@ def update(rev):
        with open(rubyenv_dir / fn, 'w') as f:
            f.write(repo.get_file(fn, version.tag))

+    # download and copy the gems that are specified as path dependencies so bundle/bundix works
+    # currently this is only `migrations`
+    with tempfile.TemporaryDirectory() as d:
+        print("downloading discourse gems (path dependencies) for bundix")
+        subprocess.check_output(['curl',f'https://codeload.github.com/discourse/discourse/zip/refs/tags/{version.tag}','-o','discourse.zip'], cwd=d)
+        subprocess.check_output(['unzip', f'discourse.zip'], cwd=d)
+        subprocess.check_output(['mv', f'discourse-{version.version}/migrations', rubyenv_dir / 'migrations'], cwd=d)
+
+    # -- sed commands borrowed from ../../../by-name/gi/gitlab/update.py which has a similar predicament with path deps
+    # comment from that file: "Undo our gemset.nix patches so that bundix runs through"
+    subprocess.check_output(
+        ["sed", "-i", "-e", "s|\\${src}/||g", "gemset.nix"], cwd=rubyenv_dir
+    )
+    subprocess.check_output(
+        ["sed", "-i", "-e", "s|^src:[[:space:]]||g", "gemset.nix"], cwd=rubyenv_dir
+    )
+
    # work around https://github.com/nix-community/bundix/issues/8
    os.environ["BUNDLE_FORCE_RUBY_PLATFORM"] = "true"
    subprocess.check_output(['bundle', 'lock'], cwd=rubyenv_dir)
    _remove_platforms(rubyenv_dir)
    subprocess.check_output(['bundix'], cwd=rubyenv_dir)

+    # -- also from gitlab pkg, see above
+    subprocess.check_output(
+        [
+            "sed",
+            "-i",
+            "-e",
+            "1c\\src: {",
+            "-e",
+            's:path = \\(migrations/[^;]*\\);:path = "${src}/\\1";:g',
+            "gemset.nix",
+        ],
+        cwd=rubyenv_dir,
+    )
+    subprocess.check_output(["rm", "-rf", "migrations"], cwd=rubyenv_dir)
+    # -- end gitlab pkg code
+
+    # update the sass-embedded override
+    # must run *after* the gemfile update!
+    dart_sass_ver = _nix_eval('discourse.rubyEnv.gemset.sass-embedded.version')
+    for platform in ["x64", "arm64"]:
+        prev_hash = _nix_eval(f'discourse.rubyEnv.dart-{platform}-hash')
+        new_hash = subprocess.check_output([
+            "nurl",
+            "--fetcher", "fetchzip",
+            "--hash",
+            f"https://github.com/sass/dart-sass/releases/download/{dart_sass_ver}/dart-sass-{dart_sass_ver}-linux-{platform}.tar.gz",
+        ], text=True).strip("\n")
+
+        if prev_hash == new_hash:
+            click.echo(f"dart-sass for {platform} up to date!")
+            continue
+
+        click.echo(f"Update vendored dart-sass for {platform} to {dart_sass_ver} (hash {prev_hash} -> {new_hash})")
+
+        with open(Path(__file__).parent / "default.nix", 'r+') as f:
+            content = f.read()
+            content = content.replace(prev_hash, new_hash)
+            f.seek(0)
+            f.write(content)
+            f.truncate()
+
+    # update the discourse package itself
    _call_nix_update('discourse', version.version)

    old_pnpm_hash = _nix_eval('discourse.assets.pnpmDeps.outputHash')
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -15865,20 +15865,23 @@ with self;

  HashSharedMem = buildPerlModule {
    pname = "Hash-SharedMem";
-    version = "0.005";
+    version = "0.006";
    src = fetchurl {
-      url = "mirror://cpan/authors/id/Z/ZE/ZEFRAM/Hash-SharedMem-0.005.tar.gz";
-      hash = "sha256-Mkd2gIYC973EStqpN4lTZUVAKakm+mEfMhyb9rlAu14=";
+      url = "mirror://cpan/authors/id/K/KS/KSTAR/Hash-SharedMem-0.006.tar.gz";
+      hash = "sha256-6gA2LUokkXUFYvJFHK61l0eDXZxWcthGPNlhwz7jh2E=";
    };
    env.NIX_CFLAGS_COMPILE = lib.optionalString stdenv.hostPlatform.isAarch64 "-mno-outline-atomics";
    buildInputs = [ ScalarString ];
+    # Project uses ExtUtils::MakeMaker, can use default `make` targets
+    buildPhase = null;
+    checkPhase = null;
+    installPhase = null;
    meta = {
      description = "Efficient shared mutable hash";
      license = with lib.licenses; [
        artistic1
        gpl1Plus
      ];
-      broken = stdenv.hostPlatform.isDarwin; # never built on Hydra https://hydra.nixos.org/job/nixpkgs/staging-next/perl534Packages.HashSharedMem.x86_64-darwin
    };
  };