Merge branch 'master' into staging-next

2026-09-28 10:50:15 +00:00 · 2026-08-27 10:43:03 +02:00
parent 3540cae6a2 c50682e290
commit f378905ca7
46 changed files with 727 additions and 161 deletions
--- a/ci/OWNERS
+++ b/ci/OWNERS
@@ -199,7 +199,7 @@ nixos/modules/installer/tools/nix-fallback-paths.nix  @Artturin @Ericson2314 @lo
 /doc/languages-frameworks/haskell.section.md  @sternenseemann @maralorn @wolfgangwalther
 /maintainers/scripts/haskell                  @sternenseemann @maralorn @wolfgangwalther
 /pkgs/development/compilers/ghc               @sternenseemann @maralorn @wolfgangwalther
-/pkgs/development/compilers/ghc/9.6.6-debian-binary.nix  @sternenseemann @maralorn @wolfgangwalther @OPNA2608 @liberodark
+/pkgs/development/compilers/ghc/9.6.6-debian-binary.nix  @sternenseemann @maralorn @wolfgangwalther @OPNA2608 @liberodark @NixOS/loongarch64
 /pkgs/development/haskell-modules             @sternenseemann @maralorn @wolfgangwalther
 /pkgs/test/haskell                            @sternenseemann @maralorn @wolfgangwalther
 /pkgs/top-level/release-haskell.nix           @sternenseemann @maralorn @wolfgangwalther
--- a/nixos/modules/hardware/printers.nix
+++ b/nixos/modules/hardware/printers.nix
@@ -7,6 +7,20 @@
 let
  cfg = config.hardware.printers;

+  inherit (lib)
+    concatLines
+    escapeShellArg
+    mkOption
+    ;
+
+  inherit (lib.types)
+    attrsOf
+    listOf
+    nullOr
+    str
+    submodule
+    ;
+
  ensurePrinter =
    p:
    let
@@ -42,6 +56,68 @@ let
    description = "printable string without spaces, # and /";
  };

+  getPrinters =
+    class:
+    lib.uniqueStrings (
+      lib.concatLists (
+        lib.textClosureList (lib.mapAttrs (
+          _:
+          {
+            classes ? [ ],
+            printers ? [ ],
+            ...
+          }:
+          {
+            deps = classes;
+            text = printers;
+          }
+        ) cfg.ensureClasses) [ class ]
+      )
+    );
+
+  mkClass = name: ''
+    lpadmin -p _tmp -v file:/dev/null
+    lpadmin -p _tmp -c ${escapeShellArg name}
+    lpadmin -x _tmp
+  '';
+
+  populateClass =
+    name:
+    {
+      description ? null,
+      location ? null,
+      ...
+    }:
+    lib.concatStringsSep "\n" [
+      (lib.optionalString (location != null) ''
+        lpadmin -p ${escapeShellArg name} -L ${escapeShellArg location}
+      '')
+
+      (lib.optionalString (description != null) ''
+        lpadmin -p ${escapeShellArg name} -D ${escapeShellArg description}
+      '')
+    ];
+
+  addPrintersToClass =
+    className: class:
+    let
+      printers = getPrinters className;
+      addToClass = printer: ''
+        lpadmin -p ${escapeShellArg printer} -c ${escapeShellArg className}
+      '';
+    in
+    map addToClass printers;
+
+  enableClass = className: ''
+    cupsenable ${escapeShellArg className}
+    cupsaccept ${escapeShellArg className}
+  '';
+
+  # if CUPS is configured only to start when it's needed, we can kill the service
+  # once the printer setup is done. However, if stateless is configured then we
+  # can't shut down the servive without losing the printers (and classes) we
+  # *just* configured.
+  ultimatelyStopCups = with config.services.printing; startWhenNeeded && !stateless;
 in
 {
  options = {
@@ -53,6 +129,72 @@ in
          Ensures the named printer is the default CUPS printer / printer queue.
        '';
      };
+      ensureClasses = mkOption {
+        description = ''
+          Will ensure that the given CUPS classes are configured as declared.
+          Please note that it is possible for some users to temporarily override
+          these properties. If those changes conflict with this configuration,
+          the configuration will take precedence and override them at boot and
+          when a rebuild is applied. This configuration will not delete any
+          classes that have been removed from the list. In order to list classes
+          you can use {command}`lpstat -c`. It will list any classes without
+          members as having a member titled `unknown`. Print jobs to empty
+          classes will silently fail. In order to remove a class, run
+          {command}`lpadmin -x <class name>`. Classes can still be added
+          manually. For more on classes see
+          <https://www.cups.org/doc/admin.html#CLASSES>, or
+          {manpage}`lpadmin(8)`.
+        '';
+        type = attrsOf (submodule {
+          options = {
+            description = mkOption {
+              type = nullOr str;
+              description = "Optional human-readable description";
+              example = "Printers that support color printing";
+            };
+            location = mkOption {
+              type = nullOr str;
+              description = "Optional human-readable location";
+              example = "Workroom";
+            };
+            printers = mkOption {
+              type = listOf str;
+              default = [ ];
+              example = [
+                "BrotherHL_Workroom"
+                "EpsonColor_Basement"
+              ];
+              description = ''
+                A list of printers included in this class. Note that all
+                printers in this list must also be present in
+                config.hardware.printers.ensurePrinters. Specifying a symblic
+                name here that does not match any of those printers is
+                considered a hard error.
+
+                ::: {.warning}
+                Print jobs to this class will quietly fail if there are no
+                printers in this class. CUPS reports them as pending
+                :::
+              '';
+            };
+            classes = mkOption {
+              type = listOf str;
+              default = [ ];
+              description = ''
+                A list of classes to include in this class.
+
+                ::: {.note}
+                CUPS itself does not support nested classes. Any classes will
+                simply have all of their member printers added to this class
+                in a recursive manner. This is an abstraction that serves the
+                purpose of convenience and expressiveness, not a 1:1 mapping
+                on top of CUPS.
+                :::
+              '';
+            };
+          };
+        });
+      };
      ensurePrinters = lib.mkOption {
        description = ''
          Will regularly ensure that the given CUPS printers are configured as declared here.
@@ -130,29 +272,172 @@ in
    };
  };

-  config = lib.mkIf (cfg.ensurePrinters != [ ] && config.services.printing.enable) {
-    systemd.services.ensure-printers = {
-      description = "Ensure NixOS-configured CUPS printers";
-      wantedBy = [ "multi-user.target" ];
-      wants = [ "cups.service" ];
-      after = [ "cups.service" ];
+  config.assertions = lib.mkIf config.services.printing.enable [
+    (
+      let
+        referencedClasses = lib.unique (
+          lib.flatten (
+            lib.mapAttrsToList (
+              _:
+              {
+                classes ? [ ],
+                ...
+              }:
+              classes
+            ) cfg.ensureClasses
+          )
+        );
+        definedClasses = lib.attrNames cfg.ensureClasses;
+        missingClasses = lib.subtractLists definedClasses referencedClasses;
+        getReferencingClasses =
+          missingClass:
+          (lib.mapAttrsToList (name: _: "`${name}`") (
+            lib.filterAttrs (
+              _:
+              {
+                classes ? [ ],
+                ...
+              }:
+              builtins.elem missingClass classes
+            ) cfg.ensureClasses
+          ));
+      in
+      {
+        assertion = missingClasses == [ ];
+        message = ''
+          One or more values of `config.hardware.printers.ensureClasses.<name>.classes`
+          contained values not present in `config.hardware.printers.ensureClasses`

-      serviceConfig = {
-        Type = "oneshot";
-        RemainAfterExit = true;
+          Missing classes:
+          ${lib.concatMapStringsSep "\n" (
+            p: "  - `${p}` (included in class(es): ${lib.concatStringsSep ", " (getReferencingClasses p)})"
+          ) missingClasses}
+        '';
+      }
+    )
+
+    (
+      let
+        referencedPrinters = lib.unique (
+          lib.flatten (
+            lib.mapAttrsToList (
+              _:
+              {
+                printers ? [ ],
+                ...
+              }:
+              printers
+            ) cfg.ensureClasses
+          )
+        );
+        definedPrinters = lib.catAttrs "name" cfg.ensurePrinters;
+        missingPrinters = lib.subtractLists definedPrinters referencedPrinters;
+        getReferencingClasses =
+          missingPrinter:
+          (lib.mapAttrsToList (name: _: "`${name}`") (
+            lib.filterAttrs (
+              _:
+              {
+                printers ? [ ],
+                ...
+              }:
+              builtins.elem missingPrinter printers
+            ) cfg.ensureClasses
+          ));
+      in
+      {
+        assertion = missingPrinters == [ ];
+        message = ''
+          One or more values of `config.hardware.printers.ensureClasses.<name>.printers`
+          contained values not present in `config.hardware.printers.ensurePrinters`
+
+          Missing printers:
+          ${lib.concatMapStringsSep "\n" (
+            p: "  - `${p}` (included in class(es): ${lib.concatStringsSep ", " (getReferencingClasses p)})"
+          ) missingPrinters}
+        '';
+      }
+    )
+  ];
+
+  config.systemd.services.ensure-printer-classes =
+    lib.mkIf (cfg.ensureClasses != { } && config.services.printing.enable)
+      {
+        description = "Ensure NixOS-configured CUPS classes";
+        wantedBy = [ "multi-user.target" ];
+        wants = [
+          "cups.service"
+        ];
+        after = [
+          "cups.service"
+          "ensure-printers.service"
+        ];
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+        };
+        path = with pkgs; [ cups ];
+        script =
+          let
+            attrMap = fn: l: map fn (builtins.attrNames l);
+            classDefs = lib.pipe cfg.ensureClasses [
+              (attrMap mkClass)
+              concatLines
+            ];
+            classAdds = lib.pipe cfg.ensureClasses [
+              (lib.mapAttrsToList addPrintersToClass)
+              lib.flatten
+              concatLines
+            ];
+            populatedClasses = lib.pipe cfg.ensureClasses [
+              (lib.mapAttrsToList populateClass)
+              concatLines
+            ];
+            enables = lib.pipe cfg.ensureClasses [
+              (attrMap enableClass)
+              concatLines
+            ];
+          in
+          ''
+            #### CLASS DEFINITIONS ####
+            ${classDefs}
+
+            #### ADDING PRINTERS TO CLASSES ####
+            ${classAdds}
+
+            #### POPULATING CLASSES ####
+            ${populatedClasses}
+
+            #### ENABLING CLASSES ####
+            ${enables}
+
+            ${lib.optionalString ultimatelyStopCups "systemctl stop cups.service"}
+          '';
      };

-      script = lib.concatStringsSep "\n" [
-        (lib.concatMapStrings ensurePrinter cfg.ensurePrinters)
-        (lib.optionalString (cfg.ensureDefaultPrinter != null) (
-          ensureDefaultPrinter cfg.ensureDefaultPrinter
-        ))
-        # Note: if cupsd is "stateless" the service can't be stopped,
-        # otherwise the configuration will be wiped on the next start.
-        (lib.optionalString (
-          with config.services.printing; startWhenNeeded && !stateless
-        ) "systemctl stop cups.service")
-      ];
-    };
-  };
+  config.systemd.services.ensure-printers =
+    lib.mkIf (cfg.ensurePrinters != [ ] && config.services.printing.enable)
+      {
+        description = "Ensure NixOS-configured CUPS printers";
+        wantedBy = [ "multi-user.target" ];
+        wants = [ "cups.service" ];
+        after = [ "cups.service" ];
+
+        serviceConfig = {
+          Type = "oneshot";
+          RemainAfterExit = true;
+        };
+
+        script = lib.concatStringsSep "\n" [
+          (lib.concatMapStrings ensurePrinter cfg.ensurePrinters)
+          (lib.optionalString (cfg.ensureDefaultPrinter != null) (
+            ensureDefaultPrinter cfg.ensureDefaultPrinter
+          ))
+          # Let ensure-printer-classes.service kill cups because it is called
+          # after this service.
+          (lib.optionalString (
+            ultimatelyStopCups && !(config.systemd.services ? ensure-printer-classes)
+          ) "systemctl stop cups.service")
+        ];
+      };
 }
--- a/nixos/modules/services/backup/pgbackrest.nix
+++ b/nixos/modules/services/backup/pgbackrest.nix
@@ -90,10 +90,6 @@ let
 in

 {
-  meta = {
-    maintainers = with lib.maintainers; [ wolfgangwalther ];
-  };
-
  # TODO: Add enableServer option and corresponding pgBackRest TLS server service.
  # TODO: Write wrapper around pgbackrest to turn --repo=<name> into --repo=<number>
  # The following two are dependent on improvements upstream:
--- a/nixos/modules/services/networking/i2pd.nix
+++ b/nixos/modules/services/networking/i2pd.nix
@@ -398,8 +398,8 @@ in
          sections = (lib.mapAttrs (_: unwrapPrefixes) (removeNulls attrs));
        };

-      gen = attr: {
-        conf = genConfig "i2pd.conf" (credSubstituteRec attr cfg.settings);
+      gen = attr: settings: {
+        conf = genConfig "i2pd.conf" (credSubstituteRec attr settings);
        tunconf = genTunnels "i2pd-tunnels.conf" (
          lib.mapAttrs' (k: v: lib.nameValuePair "client-${k}" (v // { "type" = "client"; })) (
            credSubstituteRec attr cfg.clientTunnels
@@ -410,8 +410,21 @@ in
        );
      };

-      i2pdConfig = gen "id";
-      i2pdCheckedConfig = gen "placeholder";
+      i2pdConfig = gen "id" cfg.settings;
+      # i2pd has no parse-only mode and requires a transport during startup.
+      i2pdCheckedConfig = gen "placeholder" (
+        lib.recursiveUpdate cfg.settings (
+          {
+            # Disable connectivity, in case build sandbox is disabled
+            ipv4 = false;
+            ipv6 = false;
+          }
+          // lib.optionalAttrs (cfg.settings.meshnets.yggdrasil or false) {
+            # Yggdrasil is unavailable in the check environment, so provide a usable transport.
+            ntcp2.enabled = true;
+          }
+        )
+      );

      # List of all passed credentials: `[ { id = ...; path = ...; } ... ]`
      credentials = credCollectRec [
@@ -457,10 +470,6 @@ in
            conf="${i2pdCheckedConfig.conf}"
            tunconf="${i2pdCheckedConfig.tunconf}"

-            # Disable connectivity, in case build sandbox is disabled
-            echo "ipv4 = false" >>conf
-            echo "ipv6 = false" >>conf
-            grep -Pv "^(ipv4|ipv6)[\s=]" "$conf" >>conf
            opts="$("$i2pd" --help | grep -Eo "^  --\S*port(udp)? arg" | sed "s/ arg\$/=0/g")"

            echo Checking "$conf"
--- a/nixos/tests/i2pd.nix
+++ b/nixos/tests/i2pd.nix
@@ -136,6 +136,38 @@
          };
        };
      };
+
+    yggdrasilCheck = {
+      services = {
+        yggdrasil = {
+          enable = true;
+          settings.MulticastInterfaces = [ ];
+        };
+
+        i2pd = {
+          enable = true;
+          settings = {
+            loglevel = "info";
+            netid = 77;
+            reseed.urls = "";
+            reseed.yggurls = "";
+            httpproxy.enabled = false;
+            socksproxy.enabled = false;
+
+            ipv4 = false;
+            ipv6 = false;
+            ntcp2.enabled = false;
+            ssu2.enabled = false;
+            meshnets.yggdrasil = true;
+
+            shareddest.inbound.length = 0;
+            shareddest.outbound.length = 0;
+            exploratory.inbound.length = 0;
+            exploratory.outbound.length = 0;
+          };
+        };
+      };
+    };
  };

  testScript =
@@ -147,9 +179,12 @@
      server.wait_for_unit("i2pd.service")
      client.wait_for_unit("i2pd.service")
      router.wait_for_unit("i2pd.service")
+      yggdrasilCheck.wait_for_unit("yggdrasil.service")
+      yggdrasilCheck.wait_for_unit("i2pd.service")
      server.wait_for_file("/var/lib/i2pd/router.info")
      client.wait_for_file("/var/lib/i2pd/router.info")
      router.wait_for_file("/var/lib/i2pd/router.info")
+      yggdrasilCheck.wait_for_file("/var/lib/i2pd/router.info")

      with subtest("Exchange router info"):
          server.wait_until_succeeds(
--- a/nixos/tests/pgbackrest/posix.nix
+++ b/nixos/tests/pgbackrest/posix.nix
@@ -6,10 +6,6 @@ in
 {
  name = "pgbackrest-posix";

-  meta = {
-    maintainers = with lib.maintainers; [ wolfgangwalther ];
-  };
-
  nodes.primary =
    {
      pkgs,
--- a/nixos/tests/pgbackrest/sftp.nix
+++ b/nixos/tests/pgbackrest/sftp.nix
@@ -6,10 +6,6 @@ in
 {
  name = "pgbackrest-sftp";

-  meta = {
-    maintainers = with lib.maintainers; [ wolfgangwalther ];
-  };
-
  nodes.primary =
    {
      pkgs,
--- a/pkgs/applications/networking/cluster/terraform-providers/providers.json
+++ b/pkgs/applications/networking/cluster/terraform-providers/providers.json
@@ -878,13 +878,13 @@
    "vendorHash": "sha256-vcuUt3WIo1TnLApch410JgtyCzliQRYMQQQ2Z9diDZ8="
  },
  "lxc_incus": {
-    "hash": "sha256-Jabbg13UetT4B+kGNP2DDEXFALR8apqjPB5xWkHF5UA=",
+    "hash": "sha256-2U1848xlGbw4VxraBOCQm/Tqr3G1h1ZjkIY37HpMbOc=",
    "homepage": "https://registry.terraform.io/providers/lxc/incus",
    "owner": "lxc",
    "repo": "terraform-provider-incus",
-    "rev": "v1.1.1",
+    "rev": "v1.2.0",
    "spdx": "MPL-2.0",
-    "vendorHash": "sha256-nRkttehaieVOcTBJ3rIU/JHtv/q4fU18z8MUo3xtE28="
+    "vendorHash": "sha256-WXr4HcrwbdhHh4IuNIaA8DR3nWj2fOdBFBuDlbJt9bk="
  },
  "marcofranssen_dexidp": {
    "hash": "sha256-Aby3FNEA6LgsGM/N10LNu9sCv3f2N8WIrmWoqEqTa8E=",
--- a/pkgs/by-name/bl/blesh/package.nix
+++ b/pkgs/by-name/bl/blesh/package.nix
@@ -10,14 +10,14 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "blesh";
-  version = "0.4.0-devel3-unstable-2026-08-12";
+  version = "0.4.0-devel3-unstable-2026-08-19";

  src = fetchFromGitHub {
    owner = "akinomyoga";
    repo = "ble.sh";
-    rev = "95ae551dd687a0c61227839dda43f52ac7ea6631";
+    rev = "63c23e99f1f7133ae57b79f87b16d1f68cd39884";
    fetchSubmodules = true;
-    hash = "sha256-dsQK5uu8LvPWBHr+CGK6QAP1ka0qHtCD/WH9nbsrTxI=";
+    hash = "sha256-zE9ejja5uPrU0fCIofid29EeW9YAyEuTJ5Lja/PiLQY=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/cr/crun/package.nix
+++ b/pkgs/by-name/cr/crun/package.nix
@@ -5,13 +5,13 @@
  autoreconfHook,
  go-md2man,
  pkg-config,
+  json_c,
  libcap,
  libkrun,
  libkrun-sev,
  libseccomp,
  python3,
  systemdMinimal,
-  yajl,
  nixosTests,
  criu,
  versionCheckHook,
@@ -45,13 +45,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "crun";
-  version = "1.27.1";
+  version = "1.29.1";

  src = fetchFromGitHub {
    owner = "containers";
    repo = "crun";
    tag = finalAttrs.version;
-    hash = "sha256-cuzw0YbbV4LU5nOP2DZghLAIYhkSY3Qf1bdm+JskHZA=";
+    hash = "sha256-KmwkiExekHozW84dmkcC8OW8AP11Fsqj2t/n+ZGXpB4=";
    fetchSubmodules = true;
    leaveDotGit = true;
    postFetch = ''
@@ -70,10 +70,10 @@ stdenv.mkDerivation (finalAttrs: {

  buildInputs = [
    criu
+    json_c
    libcap
    libseccomp
    systemdMinimal
-    yajl
  ]
  ++ lib.optionals withLibkrun [
    libkrun
--- a/pkgs/by-name/fe/feh/package.nix
+++ b/pkgs/by-name/fe/feh/package.nix
@@ -18,13 +18,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "feh";
-  version = "3.12.2";
+  version = "3.12.3";

  src = fetchFromGitHub {
    owner = "derf";
    repo = "feh";
    rev = finalAttrs.version;
-    hash = "sha256-YAVj4ZD4WchMalIUyqnw4sZTTTnLouv9VDwqK6q3SAE=";
+    hash = "sha256-mPXr/X3rBYT/RtPyGJyBbiV8Xpntck43UxHe8vLG6Mc=";
  };

  outputs = [
--- a/pkgs/by-name/gd/gdevelop/darwin.nix
+++ b/pkgs/by-name/gd/gdevelop/darwin.nix
@@ -18,7 +18,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://github.com/4ian/GDevelop/releases/download/v${version}/GDevelop-5-${version}-universal-mac.zip";
-    hash = "sha256-egF4NbBjbehRDUIvm+17xT1uVRRXZ2iQtFo+cM4Lhp0=";
+    hash = "sha256-U1qcF7HMlD9VS/Fw3yDjNOhtvNrtPhjYFLIAb/0/AW0=";
  };

  sourceRoot = ".";
--- a/pkgs/by-name/gd/gdevelop/linux.nix
+++ b/pkgs/by-name/gd/gdevelop/linux.nix
@@ -13,7 +13,7 @@ let
    if stdenv.hostPlatform.system == "x86_64-linux" then
      fetchurl {
        url = "https://github.com/4ian/GDevelop/releases/download/v${version}/GDevelop-5-${version}.AppImage";
-        hash = "sha256-ZoTn9twne3Qlu+PECpVxOf2I7p7uo1MqQbnE5GoI/p4=";
+        hash = "sha256-67tg09jIs2z2atI9i6W8jhMGhbjpHsfpgKklAkuXJEw=";
      }
    else
      throw "${pname}-${version} is not supported on ${stdenv.hostPlatform.system}";
--- a/pkgs/by-name/gd/gdevelop/package.nix
+++ b/pkgs/by-name/gd/gdevelop/package.nix
@@ -4,7 +4,7 @@
  callPackage,
 }:
 let
-  version = "5.6.279";
+  version = "5.6.280";
  pname = "gdevelop";
  meta = {
    description = "Graphical Game Development Studio";
--- a/pkgs/by-name/gg/ggh/package.nix
+++ b/pkgs/by-name/gg/ggh/package.nix
@@ -7,16 +7,16 @@

 buildGoModule (finalAttrs: {
  pname = "ggh";
-  version = "0.1.4";
+  version = "0.1.5";

  src = fetchFromGitHub {
    owner = "byawitz";
    repo = "ggh";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-itNx/AcLUQCH99ZCOXiXPWNg3mx+UhHepidqmzPY8Oc=";
+    hash = "sha256-IjiRz6ierqqjRZB4XBQYwohasx7ByAs7aPt1i2Tv5Eo=";
  };

-  vendorHash = "sha256-WPPjpxCD3WA3E7lx5+DPvG31p8djera5xRn980eaJT8=";
+  vendorHash = "sha256-TVe6Yd3dOmrrcTIEGWnXRG+nCAyE/ygCv/M23ZXXzB4=";

  ldflags = [
    "-s"
@@ -24,6 +24,11 @@ buildGoModule (finalAttrs: {
    "-X main.version=v${finalAttrs.version}"
  ];

+  # Test requires a HOME dir
+  preCheck = ''
+    export HOME=$TMPDIR
+  '';
+
  passthru.updateScript = nix-update-script { };

  meta = {
--- a/pkgs/by-name/gg/ggml/package.nix
+++ b/pkgs/by-name/gg/ggml/package.nix
@@ -7,7 +7,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ggml";
-  version = "0.20.1";
+  version = "0.22.0";

  __structuredAttrs = true;
  strictDeps = true;
@@ -16,7 +16,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "ggml-org";
    repo = "ggml";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-lV8ldR84Uw0zGI0vMmks8h/bSU+0jKL898x7fLgSgJA=";
+    hash = "sha256-Howxsb05/WsDDPAFtyGtn2TJup3TDUBNaR9TWiATMq4=";
  };

  # The cmake package does not handle absolute CMAKE_INSTALL_LIBDIR and CMAKE_INSTALL_INCLUDEDIR
--- a/pkgs/development/tools/infisical/hashes.json
+++ b/pkgs/development/tools/infisical/hashes.json
@@ -1,4 +1,4 @@
-{ "_comment": "@generated by pkgs/development/tools/infisical/update.sh"
+{ "_comment": "@generated by pkgs/by-name/in/infisical/update.sh"
 , "x86_64-linux": "sha256-MLpz9w66ghyKgFvfXVtbpLK0S0u7l9yIEMrX74d7fC8="
 , "aarch64-linux": "sha256-g0Bhraebd+223g8GP1BQNaAv4n9e5vScA5h3PIxSRt8="
 , "aarch64-darwin": "sha256-bWO0bv1s28Zkoa1x+mHuQCyEj2m9gJUDYWq1gc+HVjo="
--- a/pkgs/development/tools/infisical/default.nix
+++ b/pkgs/development/tools/infisical/default.nix
--- a/pkgs/development/tools/infisical/update.sh
+++ b/pkgs/development/tools/infisical/update.sh
@@ -14,11 +14,11 @@ ARCHS=(
    "aarch64-darwin:darwin_arm64"
 )

-NFILE=pkgs/development/tools/infisical/default.nix
-HFILE=pkgs/development/tools/infisical/hashes.json
+NFILE=pkgs/by-name/in/infisical/package.nix
+HFILE=pkgs/by-name/in/infisical/hashes.json
 rm -f "$HFILE" && touch "$HFILE"

-printf "{ \"_comment\": \"@generated by pkgs/development/tools/infisical/update.sh\"\n" >> "$HFILE"
+printf "{ \"_comment\": \"@generated by pkgs/by-name/in/infisical/update.sh\"\n" >> "$HFILE"

 for arch in "${ARCHS[@]}"; do
    IFS=: read -r arch_name arch_target <<< "$arch"
--- a/pkgs/by-name/la/lagrange/package.nix
+++ b/pkgs/by-name/la/lagrange/package.nix
@@ -22,13 +22,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "lagrange";
-  version = "1.20.9";
+  version = "1.21.0";

  src = fetchFromGitHub {
    owner = "skyjake";
    repo = "lagrange";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-2g5WJSb6qX1vbwuypYiGtrKK7lXtfgiaGaeapcLGDxE=";
+    hash = "sha256-h/3XARwa0ATVdIYuzn6I+eOBkyvK/okCRuxbtHTPX6E=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/li/librewolf-unwrapped/src.json
+++ b/pkgs/by-name/li/librewolf-unwrapped/src.json
@@ -1,11 +1,11 @@
 {
-  "packageVersion": "154.0-2",
+  "packageVersion": "154.0.1-2",
  "source": {
-    "rev": "154.0-2",
-    "hash": "sha256-J7n4xjl6RO9PQD0rMWeB+0EKkZcvopY8GvkM0+WbkM4="
+    "rev": "154.0.1-2",
+    "hash": "sha256-cwPJzF9kvbVGAB8lBJSTCoP26k1EKQUKGbngsKmdtt0="
  },
  "firefox": {
-    "version": "154.0",
-    "hash": "sha512-p3zWZJgq3WKGgRZ+9ZOb1r8MiUqjgMymb5tfsmWUeHTR6BnUImTx3QfIQ/im3AINomjMqf8eBk/KAZ3pGvm5lg=="
+    "version": "154.0.1",
+    "hash": "sha512-kUHjSXjC7L4bJns8xjE2FCYlc0YY5ny7v2U24UJ69m0B8ZhRIA66DbfHFZkfOefV0CAKu54s18FdWKikEbG0Eg=="
  }
 }
--- a/pkgs/by-name/li/librewolf-unwrapped/src.nix
+++ b/pkgs/by-name/li/librewolf-unwrapped/src.nix
@@ -1,20 +1,19 @@
 {
  lib,
  fetchurl,
-  fetchFromGitLab,
+  fetchFromForgejo,
 }:
 let
  src = lib.importJSON ./src.json;
 in
 {
  inherit (src) packageVersion;
-  source = fetchFromGitLab (
+  source = fetchFromForgejo (
    src.source
    // {
      domain = "librewolf.dev";
      owner = "librewolf";
      repo = "source";
-      fetchSubmodules = true;
    }
  );
  firefox = fetchurl (
--- a/pkgs/by-name/li/libxml2Python/package.nix
+++ b/pkgs/by-name/li/libxml2Python/package.nix
@@ -0,0 +1,27 @@
+{
+  buildEnv,
+  libxml2,
+  python3,
+}:
+let
+  pythonLibxml2 = python3.pkgs.libxml2;
+in
+buildEnv {
+  # slightly hacky
+  name = "libxml2+py-${libxml2.version}";
+  paths = with pythonLibxml2; [
+    dev
+    bin
+    py
+  ];
+  # Avoid update.nix/tests conflicts with libxml2.
+  passthru = removeAttrs pythonLibxml2.passthru [
+    "updateScript"
+    "tests"
+  ];
+  # the hook to find catalogs is hidden by buildEnv
+  postBuild = ''
+    mkdir "$out/nix-support"
+    cp '${pythonLibxml2.dev}/nix-support/propagated-build-inputs' "$out/nix-support/"
+  '';
+}
--- a/pkgs/by-name/ne/neo-cowsay/package.nix
+++ b/pkgs/by-name/ne/neo-cowsay/package.nix
@@ -30,10 +30,12 @@ buildGoModule (finalAttrs: {
  meta = {
    description = "Cowsay reborn, written in Go";
    homepage = "https://github.com/Code-Hex/Neo-cowsay";
-    license = with lib.licenses; [
-      artistic1 # or
-      gpl3
-    ];
+    license =
+      with lib.licenses;
+      OR [
+        artistic2
+        gpl3Only
+      ];
    mainProgram = "cowsay";
  };
 })
--- a/pkgs/by-name/no/noctalia/package.nix
+++ b/pkgs/by-name/no/noctalia/package.nix
@@ -111,6 +111,7 @@ stdenv.mkDerivation (finalAttrs: {

  mesonFlags = [
    (lib.mesonEnable "tests" false)
+    (lib.mesonEnable "jemalloc" (!stdenv.hostPlatform.isMusl))
  ];

  mesonBuildType = "release";
--- a/pkgs/by-name/nu/numen/package.nix
+++ b/pkgs/by-name/nu/numen/package.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  stdenv,
+  fetchFromGitHub,
+  catch2_3,
+  cmake,
+  ninja,
+}:
+
+stdenv.mkDerivation (finalAttrs: {
+  pname = "numen";
+  version = "0.4.1";
+
+  src = fetchFromGitHub {
+    owner = "vicinaehq";
+    repo = "numen";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-j+Y331tYcnCTnQ9NdqqwDME6PLQU/1Xtid/8CKfdSC4=";
+  };
+
+  __structuredAttrs = true;
+
+  strictDeps = true;
+
+  nativeBuildInputs = [
+    cmake
+    ninja
+  ];
+
+  cmakeFlags = [
+    (lib.cmakeBool "BUILD_SHARED_LIBS" true)
+    (lib.cmakeBool "BUILD_REPL" false)
+    (lib.cmakeBool "BUILD_TESTS" finalAttrs.doCheck)
+    (lib.cmakeBool "USE_SYSTEM_CATCH" true)
+  ];
+
+  doCheck = true;
+  checkInputs = [ catch2_3 ];
+
+  meta = {
+    description = "Natural language calculator library";
+    homepage = "https://github.com/vicinaehq/numen";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ nolight132 ];
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/by-name/op/open62541pp/package.nix
+++ b/pkgs/by-name/op/open62541pp/package.nix
@@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "open62541pp";
-  version = "0.21.2";
+  version = "0.21.3";

  src = fetchFromGitHub {
    owner = "open62541pp";
    repo = "open62541pp";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-zi707TD40XH/W5kJ7WXeFOX14aVJovo5WsHKsTQjt3w=";
+    hash = "sha256-inweo5RGhNkUIRjQh43l5tRhfXoFRcRTHZFpETdIJgg=";
  };

  cmakeFlags = [
--- a/pkgs/by-name/pg/pgdog/package.nix
+++ b/pkgs/by-name/pg/pgdog/package.nix
@@ -14,16 +14,16 @@ let
 in
 rustPlatform.buildRustPackage.override { inherit stdenv; } (finalAttrs: {
  pname = "pgdog";
-  version = "0.1.52";
+  version = "0.1.54";

  src = fetchFromGitHub {
    owner = "pgdogdev";
    repo = "pgdog";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-k2M5D4/g/NqCC34lnzNmTO0v5rTNClBA94rUlHdYEno=";
+    hash = "sha256-4T8ttM0BYUEtldMr1sVIvPQuLDrubBnl8w8SB5qrv3g=";
  };

-  cargoHash = "sha256-lKDaBpbfNmOox96KVwh2MGj5u6V2Ak3g2vSrombUChI=";
+  cargoHash = "sha256-7Te0H90ZHamAOWtUX49wemAdQ7/vYTC6P+7ZsD0c270=";

  # Hardcoded paths for C compiler and linker
  postPatch = ''
--- a/pkgs/by-name/qp/qpwgraph/package.nix
+++ b/pkgs/by-name/qp/qpwgraph/package.nix
@@ -11,14 +11,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "qpwgraph";
-  version = "1.0.3";
+  version = "1.0.4";

  src = fetchFromGitLab {
    domain = "gitlab.freedesktop.org";
    owner = "rncbc";
    repo = "qpwgraph";
    tag = "v${finalAttrs.version}";
-    sha256 = "sha256-xzAnZG9tPeVKgOBIX0PdB6bWlK49nMLZWpfDJpnjP4o=";
+    sha256 = "sha256-KZXKGujfn6IZff28eMmM+UwH1+T3/mEOiysecwWOO1o=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ru/rusthound-ce/package.nix
+++ b/pkgs/by-name/ru/rusthound-ce/package.nix
@@ -10,14 +10,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rusthound-ce";
-  version = "2.5.1";
+  version = "2.5.5";

  src = fetchCrate {
    inherit (finalAttrs) pname version;
-    hash = "sha256-7t1YEgBKDFkkF1fnPsUvB9+y3GQaaBI3ywvNTbZmgZA=";
+    hash = "sha256-+Rdy1eGW7m3nA5blFsZGOj7Kpc2ra73AU9V8c9+97/k=";
  };

-  cargoHash = "sha256-2UAANogFKAAe7/VY0G8o7frPFmxfEPACDC0bdv9Zb6w=";
+  cargoHash = "sha256-krhpWu6Cn3/6v0f/My8BgntDz2OqP/U9Z2I30Y86IU0=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/th/the-foundation/package.nix
+++ b/pkgs/by-name/th/the-foundation/package.nix
@@ -13,14 +13,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "the-foundation";
-  version = "1.12.2";
+  version = "1.13.1";

  src = fetchFromGitea {
-    domain = "git.skyjake.fi";
+    domain = "codeberg.org";
    owner = "skyjake";
    repo = "the_Foundation";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-1mHZ+ihGeslOnLATf6PjaemkJBXSbqe4ULvwAluH6JM=";
+    hash = "sha256-j8AeJdCjGxjsy6R+MFuWqXfYEFISfQqg2SlqiRx6G/k=";
  };

  nativeBuildInputs = [
@@ -40,11 +40,9 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.cmakeFeature "UNISTRING_DIR" "${libunistring}")
  ];

-  env.NIX_CFLAGS_COMPILE = "-Wno-error=attribute-warning";
-
  postFixup = ''
    substituteInPlace "$out"/lib/pkgconfig/the_Foundation.pc \
-      --replace '="''${prefix}//' '="/'
+      --replace-fail '="''${prefix}//' '="/'
  '';

  meta = {
--- a/pkgs/by-name/uw/uwsm/package.nix
+++ b/pkgs/by-name/uw/uwsm/package.nix
@@ -29,13 +29,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "uwsm";
-  version = "0.26.6";
+  version = "0.26.7";

  src = fetchFromGitHub {
    owner = "Vladimir-csp";
    repo = "uwsm";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-5wfQ2Iv4j2Gd/CV1BQ7mdkIXG7sA90iMiBAefmM3BvY=";
+    hash = "sha256-ibJx0vbZ11TPwQszGoRQo8124vIJTrFLnQC3GPj4E+o=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ve/vencord/package.nix
+++ b/pkgs/by-name/ve/vencord/package.nix
@@ -22,13 +22,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "vencord";
-  version = "1.15.1";
+  version = "1.15.3";

  src = fetchFromGitHub {
    owner = "Vendicated";
    repo = "Vencord";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-QwJoc49N0F03w7FvOcFJDmpv+qVO6PwX+o5ZFx1KrUo=";
+    hash = "sha256-YjejceAa5MwJu1+J93UVD0IOuwLEmHwQcaoSGvl734k=";
  };

  patches = [ ./fix-deps.patch ];
@@ -47,7 +47,7 @@ stdenv.mkDerivation (finalAttrs: {
      ;
    inherit pnpm;
    fetcherVersion = 4;
-    hash = "sha256-JmTSfUVHsMG0TcOwXkZWinRxpONZagtwKzESd8Q4LlQ=";
+    hash = "sha256-Zn6No8EyGHUR36Av1VxGWD19tUMBxSUo3QPCPXzlx0U=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/vi/vicinae/package.nix
+++ b/pkgs/by-name/vi/vicinae/package.nix
@@ -13,6 +13,7 @@
  ninja,
  nodejs,
  npmHooks,
+  numen,
  pkg-config,
  qt6,
  stdenv,
@@ -24,13 +25,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "vicinae";
-  version = "0.26.3";
+  version = "0.27.0";

  src = fetchFromGitHub {
    owner = "vicinaehq";
    repo = "vicinae";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Of1YU59mj9BZwQi7lbj/+XGaCs+MTGFCZ12bgcNbEu0=";
+    hash = "sha256-64RsDvhlfGSJWqI7yeE47lL05octOSX5vIPrIh8SHZ8=";
  };

  apiDeps = fetchNpmDeps {
@@ -47,9 +48,9 @@ stdenv.mkDerivation (finalAttrs: {
    "VICINAE_GIT_TAG" = "v${finalAttrs.version}";
    "VICINAE_PROVENANCE" = "nix";
    "INSTALL_NODE_MODULES" = "OFF";
-    "INSTALL_BROWSER_NATIVE_HOST" = "OFF";
    "USE_SYSTEM_CMARK_GFM" = "ON";
    "USE_SYSTEM_GLAZE" = "ON";
+    "USE_SYSTEM_NUMEN" = "ON";
    "USE_SYSTEM_KF6" = "ON";
    "USE_SYSTEM_QT_KEYCHAIN" = "ON";
    "BUNDLE_SOULVER_CORE" = "OFF";
@@ -81,6 +82,7 @@ stdenv.mkDerivation (finalAttrs: {
    libqalculate
    minizip
    nodejs
+    numen
    qt6.qtbase
    qt6.qtdeclarative
    qt6.qtimageformats
--- a/pkgs/by-name/wr/wrangler/package.nix
+++ b/pkgs/by-name/wr/wrangler/package.nix
@@ -20,13 +20,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "wrangler";
-  version = "4.125.0";
+  version = "4.126.0";

  src = fetchFromGitHub {
    owner = "cloudflare";
    repo = "workers-sdk";
    rev = "wrangler@${finalAttrs.version}";
-    hash = "sha256-4waGrQngRu4YTufvGJDoxP5pqXFwtJJ2IRSru3+R82w=";
+    hash = "sha256-b5JAdryIkuABxsBJ72YG9IwkK1iMg0KtSi2403U+nWY=";
  };

  pnpmDeps = fetchPnpmDeps {
@@ -38,7 +38,7 @@ stdenv.mkDerivation (finalAttrs: {
      ;
    pnpm = pnpm_10;
    fetcherVersion = 3;
-    hash = "sha256-3Ma7zMlFtOKYgEKCS0eZM9+lKiVH7tnTsbjzQIJN7OI=";
+    hash = "sha256-hbOl7GkBTrZP5IiTEAPU9mTw+XdaSWNma/9ZgXfJxho=";
  };
  # pnpm packageManager version in workers-sdk root package.json may not match nixpkgs
  postPatch = ''
--- a/pkgs/by-name/wr/writedisk/package.nix
+++ b/pkgs/by-name/wr/writedisk/package.nix
@@ -7,15 +7,15 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "writedisk";
-  version = "1.3.0";
+  version = "1.5.0";

  src = fetchCrate {
    inherit (finalAttrs) version;
    pname = "writedisk";
-    hash = "sha256-MZFnNb8rJMu/nlH8rfnD//bhqPSkhyXucbTrwsRM9OY=";
+    hash = "sha256-Weu2rUZYvKMQIwxDQsCW30NAjb6Dar2926r/tyREDoo=";
  };

-  cargoHash = "sha256-2Vc0vCQJY2enwTAgaRgqLdCTtF5znrF3xaCTvF44XX0=";
+  cargoHash = "sha256-W1IuK6/gkvfaHsivgfF0J+SisX8nPKLR7qFZ2Ia+LEc=";

  nativeBuildInputs = [ pkg-config ];

@@ -24,6 +24,9 @@ rustPlatform.buildRustPackage (finalAttrs: {
    homepage = "https://github.com/nicholasbishop/writedisk";
    platforms = lib.platforms.linux;
    license = lib.licenses.asl20;
-    maintainers = with lib.maintainers; [ devhell ];
+    maintainers = with lib.maintainers; [
+      devhell
+      lukas-sgx
+    ];
  };
 })
--- a/pkgs/development/compilers/ghc/9.6.6-debian-binary.nix
+++ b/pkgs/development/compilers/ghc/9.6.6-debian-binary.nix
@@ -27,6 +27,32 @@ let
  # GHC upstream doesn't release bindist tarballs for some platforms.
  # We're using Debian's binary package, and patching it into a usable-in-Nixpkgs state.
  ghcDebs = {
+    loongarch64-linux = {
+      toolPrefix = "loongarch64-linux-gnu-";
+      src = {
+        url = "http://ftp.ports.debian.org/debian-ports/pool-loong64/main/g/ghc/ghc_9.6.6-4+b1_loong64.deb";
+        sha256 = "f14b5e3c8e6bd233b5be8e72c369fea0644f2a804d7636f930c05b4abf77d57f";
+      };
+      exePathForLibraryCheck = null;
+      archSpecificLibraries = [
+        {
+          nixPackage = gmp;
+          fileToCheckFor = null;
+        }
+        {
+          nixPackage = ncurses6;
+          fileToCheckFor = "libtinfo.so.6";
+        }
+        {
+          nixPackage = numactl;
+          fileToCheckFor = null;
+        }
+        {
+          nixPackage = libffi;
+          fileToCheckFor = null;
+        }
+      ];
+    };
    powerpc64-linux = {
      toolPrefix = "powerpc64-linux-gnu-";
      src = {
@@ -320,6 +346,10 @@ stdenv.mkDerivation (finalAttrs: {
      # riscv64-linux
      lib.maintainers.liberodark
    ];
-    teams = [ lib.teams.haskell ];
+    teams = [
+      lib.teams.haskell
+      # loongarch64-linux
+      lib.teams.loongarch64
+    ];
  };
 })
--- a/pkgs/development/compilers/ghc/common-hadrian.nix
+++ b/pkgs/development/compilers/ghc/common-hadrian.nix
@@ -257,7 +257,7 @@
      ++
        lib.optionals
          (
-            stdenv.hostPlatform.isRiscV64
+            (stdenv.hostPlatform.isRiscV64 || stdenv.hostPlatform.isLoongArch64)
            && lib.versionAtLeast version "9.10"
            && lib.versionOlder version "9.12"
          )
@@ -353,6 +353,20 @@
            })
          ]

+      # Enable GHCi on LoongArch64 (not in upstream's hardcoded platform list)
+      ++ lib.optionals stdenv.targetPlatform.isLoongArch64 [
+        (
+          if lib.versionOlder version "9.10" then
+            ./ghc-9.6-hadrian-Enable-GHCi-on-all-platforms.patch
+          else if lib.versionOlder version "9.12" then
+            ./ghc-9.10-hadrian-Enable-GHCi-on-all-platforms.patch
+          else if lib.versionOlder version "9.14" then
+            ./ghc-9.12-hadrian-Enable-GHCi-on-all-platforms.patch
+          else
+            null
+        )
+      ]
+
      ++ (import ./common-llvm-patches.nix { inherit lib version fetchpatch; });

    stdenv = stdenvNoCC;
--- a/pkgs/development/compilers/ghc/ghc-9.10-hadrian-Enable-GHCi-on-all-platforms.patch
+++ b/pkgs/development/compilers/ghc/ghc-9.10-hadrian-Enable-GHCi-on-all-platforms.patch
@@ -0,0 +1,42 @@
+From a19a206f1daba6f8bb72138ea7fc0b80b51e40c1 Mon Sep 17 00:00:00 2001
+From: darkyzhou <me@zqy.io>
+Date: Mon, 29 Dec 2025 10:13:16 +0800
+Subject: [PATCH] hadrian: Enable GHCi on all platforms
+
+This removes the platform-specific restrictions for GHCi support,
+allowing it to be built on all target OS and architecture combinations.
+
+Originally implemented for Debian packaging to ensure GHCi availability
+across all supported platforms.
+
+Co-authored-by: Ilias Tsitsimpis <iliastsi@debian.org>
+---
+ hadrian/src/Oracles/Setting.hs | 12 ++----------
+ 1 file changed, 2 insertions(+), 10 deletions(-)
+
+diff --git a/hadrian/src/Oracles/Setting.hs b/hadrian/src/Oracles/Setting.hs
+index e854c1c..cb5a91c 100644
+--- a/hadrian/src/Oracles/Setting.hs
+++ b/hadrian/src/Oracles/Setting.hs
+@@ -196,16 +196,8 @@ hostSupportsRPaths = queryHostTarget (\t -> let os = archOS_OS (tgtArchOs t)
+ -- | Check whether the target supports GHCi.
+ ghcWithInterpreter :: Action Bool
+ ghcWithInterpreter = do
+-    goodOs <- anyTargetOs [ OSMinGW32, OSLinux, OSSolaris2 -- TODO "cygwin32"?,
+-                          , OSFreeBSD, OSDragonFly, OSNetBSD, OSOpenBSD
+-                          , OSDarwin, OSKFreeBSD ]
+-    goodArch <- (||) <$>
+-                anyTargetArch [ ArchX86, ArchX86_64, ArchPPC
+-                              , ArchAArch64, ArchS390X
+-                              , ArchPPC_64 ELF_V1, ArchPPC_64 ELF_V2
+-                              , ArchRISCV64 ]
+-                              <*> isArmTarget
+-    return $ goodOs && goodArch
+    -- Enable GHCi on all platforms
+    return True
+ 
+ -- | Which variant of the ARM architecture is the target (or 'Nothing' if not
+ -- ARM)?
+-- 
+2.51.2
+
--- a/pkgs/development/compilers/ghc/ghc-9.12-hadrian-Enable-GHCi-on-all-platforms.patch
+++ b/pkgs/development/compilers/ghc/ghc-9.12-hadrian-Enable-GHCi-on-all-platforms.patch
@@ -0,0 +1,44 @@
+From 25e167be6b213fbbd2c274cc7d4dbea4406fefb0 Mon Sep 17 00:00:00 2001
+From: darkyzhou <me@zqy.io>
+Date: Mon, 29 Dec 2025 21:24:43 +0800
+Subject: [PATCH] hadrian: Enable GHCi on all platforms
+
+This removes the platform-specific restrictions for GHCi support,
+allowing it to be built on all target OS and architecture combinations.
+
+Originally implemented for Debian packaging to ensure GHCi availability
+across all supported platforms.
+
+Co-authored-by: Ilias Tsitsimpis <iliastsi@debian.org>
+---
+ hadrian/src/Oracles/Setting.hs | 14 ++------------
+ 1 file changed, 2 insertions(+), 12 deletions(-)
+
+diff --git a/hadrian/src/Oracles/Setting.hs b/hadrian/src/Oracles/Setting.hs
+index 5818750..2bad8d4 100644
+--- a/hadrian/src/Oracles/Setting.hs
+++ b/hadrian/src/Oracles/Setting.hs
+@@ -198,18 +198,8 @@ targetSupportsRPaths = queryTargetTarget (\t -> let os = archOS_OS (tgtArchOs t)
+ -- | Check whether the target supports GHCi.
+ ghcWithInterpreter :: Action Bool
+ ghcWithInterpreter = do
+-    goodOs <- anyTargetOs [ OSMinGW32, OSLinux, OSSolaris2 -- TODO "cygwin32"?,
+-                          , OSFreeBSD, OSDragonFly, OSNetBSD, OSOpenBSD
+-                          , OSDarwin, OSKFreeBSD
+-                          , OSWasi ]
+-    goodArch <- (||) <$>
+-                anyTargetArch [ ArchX86, ArchX86_64, ArchPPC
+-                              , ArchAArch64, ArchS390X
+-                              , ArchPPC_64 ELF_V1, ArchPPC_64 ELF_V2
+-                              , ArchRISCV64
+-                              , ArchWasm32 ]
+-                              <*> isArmTarget
+-    return $ goodOs && goodArch
+    -- Enable GHCi on all platforms
+    return True
+ 
+ -- | Which variant of the ARM architecture is the target (or 'Nothing' if not
+ -- ARM)?
+-- 
+2.51.2
+
--- a/pkgs/development/compilers/ghc/ghc-9.6-hadrian-Enable-GHCi-on-all-platforms.patch
+++ b/pkgs/development/compilers/ghc/ghc-9.6-hadrian-Enable-GHCi-on-all-platforms.patch
@@ -0,0 +1,39 @@
+From 2bf7be28ffdee724c7b252c83e9ef4576262e145 Mon Sep 17 00:00:00 2001
+From: darkyzhou <me@zqy.io>
+Date: Mon, 29 Dec 2025 10:16:33 +0800
+Subject: [PATCH] hadrian: Enable GHCi on all platforms
+
+This removes the platform-specific restrictions for GHCi support,
+allowing it to be built on all target OS and architecture combinations.
+
+Originally implemented for Debian packaging to ensure GHCi availability
+across all supported platforms.
+
+Co-authored-by: Ilias Tsitsimpis <iliastsi@debian.org>
+---
+ hadrian/src/Oracles/Setting.hs | 9 ++-------
+ 1 file changed, 2 insertions(+), 7 deletions(-)
+
+diff --git a/hadrian/src/Oracles/Setting.hs b/hadrian/src/Oracles/Setting.hs
+index a0f639d..a27b87c 100644
+--- a/hadrian/src/Oracles/Setting.hs
+++ b/hadrian/src/Oracles/Setting.hs
+@@ -302,13 +302,8 @@ hostSupportsRPaths = anyHostOs (elfOSes ++ machoOSes)
+ -- | Check whether the target supports GHCi.
+ ghcWithInterpreter :: Action Bool
+ ghcWithInterpreter = do
+-    goodOs <- anyTargetOs [ "mingw32", "cygwin32", "linux", "solaris2"
+-                          , "freebsd", "dragonfly", "netbsd", "openbsd"
+-                          , "darwin", "kfreebsdgnu" ]
+-    goodArch <- anyTargetArch [ "i386", "x86_64", "powerpc"
+-                              , "arm", "aarch64", "s390x"
+-                              , "powerpc64", "powerpc64le" ]
+-    return $ goodOs && goodArch
+    -- Enable GHCi on all platforms
+    return True
+ 
+ -- | Variants of the ARM architecture.
+ data ArmVersion = ARMv5 | ARMv6 | ARMv7
+-- 
+2.51.2
+
--- a/pkgs/development/python-modules/urlscan-python/default.nix
+++ b/pkgs/development/python-modules/urlscan-python/default.nix
@@ -9,19 +9,20 @@
  pytest-randomly,
  pytest-timeout,
  pytestCheckHook,
+  python-dotenv,
  uv-dynamic-versioning,
 }:

-buildPythonPackage rec {
+buildPythonPackage (finalAttrs: {
  pname = "urlscan-python";
-  version = "0.0.1";
+  version = "2026.08.18";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "urlscan";
    repo = "urlscan-python";
-    tag = "v${version}";
-    hash = "sha256-HkovBmmVvUYA5U43w5TUOcwhZAN/0o0BETd1s9R940w=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-N7l4+Izn0fhRuoOejtR4/WHTxfoaQVWM6EdSIB0wm+0=";
  };

  build-system = [
@@ -37,15 +38,21 @@ buildPythonPackage rec {
    pytest-randomly
    pytest-timeout
    pytestCheckHook
+    python-dotenv
  ];

  pythonImportsCheck = [ "urlscan" ];

+  disabledTestPaths = [
+    # Tests require an API key
+    "tests/integration"
+  ];
+
  meta = {
    description = "Python API client for urlscan.io";
    homepage = "https://github.com/urlscan/urlscan-python/";
-    changelog = "https://github.com/urlscan/urlscan-python/releases/tag/${src.tag}";
+    changelog = "https://github.com/urlscan/urlscan-python/releases/tag/${finalAttrs.src.tag}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ fab ];
  };
-}
+})
--- a/pkgs/servers/home-assistant/custom-components/solarman/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/solarman/package.nix
@@ -1,33 +1,42 @@
 {
+  aiofiles,
+  aiohttp,
  buildHomeAssistantComponent,
  fetchFromGitHub,
  lib,
-  pysolarmanv5,
+  propcache,
  pyyaml,
 }:

 buildHomeAssistantComponent rec {
-  owner = "StephanJoubert";
+  owner = "davidrapan";
  domain = "solarman";
-  version = "1.5.1";
+  version = "25.08.16";

  src = fetchFromGitHub {
-    owner = "StephanJoubert";
-    repo = "home_assistant_solarman";
-    tag = version;
-    hash = "sha256-+znRq7LGIxbxMEypIRqbIMgV8H4OyiOakmExx1aHEl8=";
+    owner = "davidrapan";
+    repo = "ha-solarman";
+    tag = "v${version}";
+    hash = "sha256-SsUObH3g3i9xQ4JvRDcCm1Fg2giH+MN3rC3NMPYO5m0=";
  };

  dependencies = [
-    pysolarmanv5
+    aiofiles
+    aiohttp
+    propcache
    pyyaml
  ];

  meta = {
-    description = "Home Assistant component for Solarman collectors used with a variety of inverters";
-    changelog = "https://github.com/StephanJoubert/home_assistant_solarman/releases/tag/${version}";
-    homepage = "https://github.com/StephanJoubert/home_assistant_solarman";
+    description = "Home Assistant component for Solarman Stick Loggers";
+    changelog = "https://github.com/davidrapan/ha-solarman/releases/tag/${version}";
+    homepage = "https://github.com/davidrapan/ha-solarman";
    maintainers = with lib.maintainers; [ Scrumplex ];
-    license = lib.licenses.asl20;
+    # `license` and `custom_components/solarman/pysolarman/license` are MIT
+    # `custom_components/solarman/pysolarman/umodbus/license` is MPL 2.0
+    license = with lib.licenses; [
+      mit
+      mpl20
+    ];
  };
 }
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -23,7 +23,7 @@ let
    ;
 in

-res: pkgs: super:
+pkgs:

 with pkgs;

@@ -2223,8 +2223,6 @@ with pkgs;

  indexed-bzip2 = with python3Packages; toPythonApplication indexed-bzip2;

-  infisical = callPackage ../development/tools/infisical { };
-
  internetarchive = with python3Packages; toPythonApplication internetarchive;

  iocextract = with python3Packages; toPythonApplication iocextract;
@@ -6111,30 +6109,6 @@ with pkgs;
    libxml2
    ;

-  libxml2Python =
-    let
-      inherit (python3.pkgs) libxml2;
-    in
-    pkgs.buildEnv {
-      # slightly hacky
-      name = "libxml2+py-${res.libxml2.version}";
-      paths = with libxml2; [
-        dev
-        bin
-        py
-      ];
-      # Avoid update.nix/tests conflicts with libxml2.
-      passthru = removeAttrs libxml2.passthru [
-        "updateScript"
-        "tests"
-      ];
-      # the hook to find catalogs is hidden by buildEnv
-      postBuild = ''
-        mkdir "$out/nix-support"
-        cp '${libxml2.dev}/nix-support/propagated-build-inputs' "$out/nix-support/"
-      '';
-    };
-
  libxmlxx = callPackage ../development/libraries/libxmlxx { };
  libxmlxx3 = callPackage ../development/libraries/libxmlxx/v3.nix { };

@@ -10648,7 +10622,7 @@ with pkgs;

  samsung-unified-linux-driver_1_00_37 = callPackage ../misc/cups/drivers/samsung/1.00.37.nix { };
  samsung-unified-linux-driver_4_01_17 = callPackage ../misc/cups/drivers/samsung/4.01.17.nix { };
-  samsung-unified-linux-driver = res.samsung-unified-linux-driver_4_01_17;
+  samsung-unified-linux-driver = samsung-unified-linux-driver_4_01_17;

  sane-backends = callPackage ../applications/graphics/sane/backends (config.sane or { });

--- a/pkgs/top-level/haskell-packages.nix
+++ b/pkgs/top-level/haskell-packages.nix
@@ -123,6 +123,8 @@ in
            bb.packages.ghc966DebianBinary
          else if stdenv.buildPlatform.isRiscV64 then
            bb.packages.ghc966DebianBinary
+          else if stdenv.buildPlatform.isLoongArch64 then
+            bb.packages.ghc966DebianBinary
          else
            bb.packages.ghc948;
        inherit (buildPackages.python3Packages) sphinx;
@@ -140,6 +142,8 @@ in
            bb.packages.ghc966DebianBinary
          else if stdenv.buildPlatform.isRiscV64 then
            bb.packages.ghc966DebianBinary
+          else if stdenv.buildPlatform.isLoongArch64 then
+            bb.packages.ghc966DebianBinary
          else if stdenv.buildPlatform.isi686 then
            bb.packages.ghc948
          else
@@ -159,6 +163,8 @@ in
            bb.packages.ghc966DebianBinary
          else if stdenv.buildPlatform.isRiscV64 then
            bb.packages.ghc966DebianBinary
+          else if stdenv.buildPlatform.isLoongArch64 then
+            bb.packages.ghc966DebianBinary
          else if stdenv.buildPlatform.isi686 then
            bb.packages.ghc967
          else
--- a/pkgs/top-level/stage.nix
+++ b/pkgs/top-level/stage.nix
@@ -153,7 +153,7 @@ let
          config
          overlays
          ;
-      } res self super;
+      } self;

      conflictingAttrs = lib.intersectAttrs res super;
    in