Merge master into staging-nixos

2026-09-18 05:39:58 +00:00 · 2026-09-16 18:12:15 +00:00
parent 60f3637c3b 408f28cce7
commit f69a0a858f
82 changed files with 2459 additions and 381 deletions
--- a/nixos/doc/manual/redirects.json
+++ b/nixos/doc/manual/redirects.json
@@ -1,4 +1,13 @@
 {
+  "module-services-netbird-relay": [
+    "index.html#module-services-netbird-relay"
+  ],
+  "module-services-netbird-relay-quickstart": [
+    "index.html#module-services-netbird-relay-quickstart"
+  ],
+  "module-services-netbird-relay-tls": [
+    "index.html#module-services-netbird-relay-tls"
+  ],
  "module-services-portmaster": [
    "index.html#module-services-portmaster"
  ],
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -132,6 +132,8 @@

 - [qbit-manage](https://github.com/StuffAnThings/qbit_manage), a tool to help manage tedious tasks in qBittorrent and automate them. Available as [services.qbit-manage](#opt-services.qbit-manage.enable).

+- [Netbird Relay](https://netbird.io/), a module to relay traffic when a point-to-point connection is not possible.
+
 ## Backward Incompatibilities {#sec-release-26.11-incompatibilities}

 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -1353,6 +1353,7 @@
  ./services/networking/nebula-lighthouse-service.nix
  ./services/networking/nebula.nix
  ./services/networking/netbird.nix
+  ./services/networking/netbird/netbird-relay.nix
  ./services/networking/netbird/server.nix
  ./services/networking/netclient.nix
  ./services/networking/netfoil.nix
--- a/nixos/modules/services/cluster/kubernetes/kubelet.nix
+++ b/nixos/modules/services/cluster/kubernetes/kubelet.nix
@@ -129,13 +129,24 @@ in
    };

    clusterDns = mkOption {
-      description = "Use alternative DNS.";
+      description = ''
+        List of DNS resolvers (IP addresses) used inside containers.
+
+        Defaulted to {option}`services.kubernetes.addons.dns.clusterIp`
+        when {option}`services.kubernetes.addons.dns.enable` is `true`.
+
+        Refer to the list of configuration attributes for [KubeletConfiguration](https://kubernetes.io/docs/reference/config-api/kubelet-config.v1beta1/#kubelet-config-k8s-io-v1beta1-KubeletConfiguration).
+      '';
      default = [ "10.1.0.1" ];
      type = listOf str;
    };

    clusterDomain = mkOption {
-      description = "Use alternative domain.";
+      description = ''
+        Search DNS domain used inside containers.
+
+        Refer to the list of configuration attributes for [KubeletConfiguration](https://kubernetes.io/docs/reference/config-api/kubelet-config.v1beta1/#kubelet-config-k8s-io-v1beta1-KubeletConfiguration).
+      '';
      default = config.services.kubernetes.addons.dns.clusterDomain;
      defaultText = literalExpression "config.${options.services.kubernetes.addons.dns.clusterDomain}";
      type = str;
--- a/nixos/modules/services/networking/netbird.md
+++ b/nixos/modules/services/networking/netbird.md
@@ -1,4 +1,4 @@
-# Netbird {#module-services-netbird}
+# Netbird Client {#module-services-netbird}

 ## Quickstart {#module-services-netbird-quickstart}

--- a/nixos/modules/services/networking/netbird/netbird-relay.md
+++ b/nixos/modules/services/networking/netbird/netbird-relay.md
@@ -0,0 +1,92 @@
+# Netbird Relay {#module-services-netbird-relay}
+
+The Relay service forwards encrypted WireGuard traffic between peers that cannot establish a direct P2P connection
+
+For more information, check [external relays](https://docs.netbird.io/selfhosted/maintenance/scaling/set-up-external-relays) documentation.
+
+## Quickstart {#module-services-netbird-relay-quickstart}
+
+You can run the relay directly, or behind a reverse proxy, like `traefik`.
+
+To run it directly, you'll have to run it on HTTPS port (443) and it will need the TLS certificates. Which you can configure using the `acme` module.
+
+In the following example, we can see the `traefik` route and the relay configuration.
+The operator should configure the TLS for the domain used by the relay, whether it's via `traefik` itself or using the `acme` module.
+
+```nix
+let
+  relayDomain = "relay.example.com";
+in
+{
+  services.netbird.relay = {
+    enable = true;
+    settings = {
+      listen-address = ":33080";
+      exposed-address = "rels://${relayDomain}:443";
+      log-level = "info";
+      enable-stun = true;
+      stun-ports = [ 3479 ];
+    };
+    openFirewall = true;
+    authSecretFile = "/run/auth_secret";
+  };
+
+  services.traefik = {
+    enable = true;
+    dynamicConfigOptions = {
+      http = {
+        routers = {
+          vpn-relay = {
+            rule = "Host(`${relayDomain}`)";
+            entryPoints = [ "websecure" ];
+            service = "vpn-relay-svc";
+            tls = { };
+          };
+        };
+        services = {
+          vpn-relay-svc = {
+            loadBalancer.servers = [ { url = "http://[::1]:33080"; } ];
+          };
+        };
+      };
+    };
+  };
+}
+```
+
+Finally, you must let `netbird.server` know about the new relay:
+
+```nix
+{ }:
+{
+  services.netbird.server = {
+    # ...other config...
+    management = {
+      # ...other config...
+      settings = {
+        # ...other config...
+        Relay = {
+          Addresses = [ "rels://${relayDomain}:443" ];
+          CredentialsTTL = "24h0m0s";
+          Secret = {
+            _secret = "/run/auth_secret";
+          };
+        };
+      };
+    };
+  };
+}
+```
+Done!
+
+## TLS with Let's Encrypt {#module-services-netbird-relay-tls}
+
+You can expose the netbird relay directly to the internet with TLS. Then you won't need a reverse proxy.
+
+To use TLS, set `settings."letsencrypt-domains"`.
+The relay gets and renews the certificates only when `settings."letsencrypt-domains"` is set.
+
+Certificates are stored on disk, and the services runs as a systemd dynamic user.
+The only writable location is therefore a `StateDirectory`, which can only be under `/var/lib`.
+
+Open the ports `tcp/443` and `tcp/80` manually for the HTTP challenge.
--- a/nixos/modules/services/networking/netbird/netbird-relay.nix
+++ b/nixos/modules/services/networking/netbird/netbird-relay.nix
@@ -0,0 +1,248 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  inherit (lib)
+    getExe'
+    types
+    ;
+
+  cfg = config.services.netbird.relay;
+  cmd = getExe' cfg.package "netbird-relay";
+  derivedLEDataDir = lib.optionalAttrs (
+    cfg.settings ? "letsencrypt-domain" && !cfg.settings ? "letsencrypt-data-dir"
+  ) { "letsencrypt-data-dir" = "/var/lib/netbird-relay"; };
+
+  args = lib.cli.toCommandLineShellGNU { } (cfg.settings // derivedLEDataDir);
+
+  listenPortMatch = builtins.match ".*:([0-9]+)$" cfg.settings.listen-address;
+  listenPort = if listenPortMatch == null then null else lib.toInt (builtins.head listenPortMatch);
+
+  # Checks
+  authSecretSet = cfg.authSecretFile != null;
+  needsPrivPort = listenPort != null && listenPort < 1024;
+  letsencryptEnabled = cfg.settings ? "letsencrypt-domain";
+in
+{
+  options.services.netbird.relay = {
+    enable = lib.mkEnableOption "Netbird's Relay Service";
+    package = lib.mkPackageOption pkgs "netbird-relay" { };
+
+    # as per RFC 0042:
+    settings = lib.mkOption {
+      type = types.submodule {
+        freeformType =
+          with lib.types;
+          nullOr (oneOf [
+            bool
+            str
+            # For --letsencrypt-domains strings
+            (listOf (oneOf [ str ]))
+          ]);
+        options.listen-address = lib.mkOption {
+          type = types.str;
+          description = ''
+            The host address and port separated by colon where the relay will listen
+          '';
+          default = ":33080";
+        };
+        options.exposed-address = lib.mkOption {
+          type = types.str;
+          description = ''
+            Exposed address for peers. Address told to the peers to connect to
+          '';
+          example = "rels://relay.example.com:443";
+        };
+        options.enable-stun = lib.mkOption {
+          type = types.bool;
+          default = false;
+          description = "Enable embedded STUN server";
+        };
+        options.stun-ports = lib.mkOption {
+          type = types.listOf types.port;
+          default = [ 3478 ];
+          description = "STUN server UDP ports";
+        };
+        options.log-level = lib.mkOption {
+          type = types.enum [
+            "panic"
+            "fatal"
+            "error"
+            "warn"
+            "info"
+            "debug"
+            "trace"
+          ];
+          default = "info";
+          description = "Log level of the netbird relay service";
+        };
+        options.metrics-port = lib.mkOption {
+          type = types.port;
+          default = 9092;
+          description = "Metrics endpoint http port. Metrics are accessible under host:metrics-port/metrics";
+        };
+        options.health-listen-address = lib.mkOption {
+          type = types.str;
+          description = ''
+            Listen address of healthcheck server
+          '';
+          default = ":9000";
+        };
+      };
+      default = null;
+      description = ''
+        Settings to configure the netbird relay.
+        Converted automatically into cli args, check all the options with `netbird-relay --help`
+      '';
+    };
+
+    environmentFile = lib.mkOption {
+      type = types.nullOr types.externalPath;
+      default = null;
+      description = ''
+        Path (as string) to an environmentFile with the netbird relay environment variables.
+        You can find all the variables under [Relay runtime env variables](https://docs.netbird.io/selfhosted/environment-variables#runtime-variables-2).
+
+        WARNING: You must manually open any port configured via environmentFile.
+        If you use an Internet domain privileged port (e.g 443), add CAP_NET_BIND_SERVICE to systemd's CapabilityBoundingSet and AmbientCapabilities
+      '';
+      example = "/run/netbird-relay.env";
+    };
+
+    openFirewall = lib.mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Open STUN ports in the firewall for the netbird relay.
+
+        WARNING: You must manually open listen-address port/tcp and port 80/tcp,
+        if you are exposing the relay directly to the internet.
+        Review [set-up-external-relays](https://docs.netbird.io/selfhosted/maintenance/scaling/set-up-external-relays)
+      '';
+    };
+
+    authSecretFile = lib.mkOption {
+      type = types.nullOr types.externalPath;
+      default = null;
+      description = ''
+        Path (as string) to a file containing the auth-secret used by netbird to connect to the relay server.
+        It will populate `NB_AUTH_SECRET`
+      '';
+      example = "/run/auth_secret";
+    };
+
+  };
+
+  config = lib.mkIf cfg.enable {
+    assertions = [
+      {
+        assertion = authSecretSet || cfg.environmentFile != null;
+        message = "services.netbird.relay requires NB_AUTH_SECRET, either set authSecretFile or configure it in environmentFile";
+      }
+      {
+        assertion = !(cfg.settings.auth-secret or null != null);
+        message = "settings.auth-secret puts the secret into the nix store and the cli args. Use relay.authSecretFile instead";
+      }
+      {
+        assertion =
+          !letsencryptEnabled || lib.hasPrefix "/var/lib/" (cfg.settings."letsencrypt-data-dir" or "");
+        message = "settings.letsencrypt-data-dir must be under /var/lib, the only writable location when using DynamidcUser in systemd";
+      }
+      {
+        assertion = !(cfg.settings.enable-stun && cfg.settings.stun-ports == [ ]);
+        message = "Missing stun ports while enable-stun = true";
+      }
+    ];
+
+    systemd.services.netbird-relay = {
+      description = "Relay for Netbird, a wireguard VPN";
+      documentation = [ "https://netbird.io/docs/" ];
+      after = [
+        "network.target"
+      ];
+      wantedBy = [ "multi-user.target" ];
+
+      script = ''
+        ${lib.optionalString authSecretSet ''
+          export NB_AUTH_SECRET="$(< "$CREDENTIALS_DIRECTORY/auth_secret")"
+        ''}
+        exec ${cmd} ${args}
+      '';
+      unitConfig = {
+        # Spread the restart
+        StartLimitIntervalSec = 60;
+        StartLimitBurst = 10;
+      };
+      serviceConfig = {
+        EnvironmentFile = lib.mkIf (cfg.environmentFile != null) [ cfg.environmentFile ];
+
+        # Let systemd ingest the secret safely
+        LoadCredential = lib.mkIf authSecretSet "auth_secret:${cfg.authSecretFile}";
+
+        Restart = "always";
+        RestartSec = "5s";
+
+        StateDirectory = lib.mkIf letsencryptEnabled (
+          lib.removeSuffix "/" (lib.removePrefix "/var/lib/" cfg.settings."letsencrypt-data-dir")
+        );
+
+        # Hardening::Start
+        # Dynamic user automatically sets:
+        #   NoNewPrivileges = true;
+        #   RemoveIPC = true;
+        #   RestrictSUIDSGID = true;
+        #   ProtectSystem = "strict";
+        #   ProtectHome = "read-only";
+        # see https://www.freedesktop.org/software/systemd/man/latest/systemd.exec.html#DynamicUser=
+        DynamicUser = true;
+
+        LockPersonality = true;
+        MemoryDenyWriteExecute = true;
+        # Relay is mostly stateless, no need to give access to any of this:
+        PrivateDevices = true;
+        PrivateMounts = true;
+        PrivateTmp = true;
+        ProtectClock = true;
+        ProtectControlGroups = true;
+        ProtectHostname = true;
+        ProtectKernelLogs = true;
+        ProtectKernelModules = true;
+        ProtectKernelTunables = true;
+        ProcSubset = "pid";
+        ProtectProc = "invisible";
+        RestrictNamespaces = true;
+        RestrictRealtime = true;
+        SystemCallFilter = [ "@system-service" ];
+        SystemCallArchitectures = "native";
+
+        # If a user wants to bind netbird to 443, we must allow binding to
+        # a socket to Internet domain privileged ports
+        CapabilityBoundingSet = lib.optionals needsPrivPort [ "CAP_NET_BIND_SERVICE" ];
+        AmbientCapabilities = lib.optionals needsPrivPort [ "CAP_NET_BIND_SERVICE" ];
+
+        # Use only IP, no socket needed
+        RestrictAddressFamilies = [
+          "AF_INET"
+          "AF_INET6"
+          "AF_NETLINK"
+        ];
+        UMask = "0077";
+        # Hardening::End
+      };
+    };
+    networking.firewall.allowedUDPPorts = lib.mkIf (
+      cfg.openFirewall && cfg.settings.enable-stun
+    ) cfg.settings.stun-ports;
+  };
+
+  meta = {
+    doc = ./netbird-relay.md;
+    maintainers = [
+      lib.maintainers.woile
+    ];
+  };
+}
--- a/nixos/tests/all-tests.nix
+++ b/nixos/tests/all-tests.nix
@@ -1240,6 +1240,7 @@ in
  nebula.reload = runTest ./nebula/reload.nix;
  neo4j = runTest ./neo4j.nix;
  netbird = runTest ./netbird.nix;
+  netbird-relay = runTest ./netbird-relay.nix;
  netbox = runTest ./web-apps/netbox/default.nix;
  netdata = runTest ./netdata.nix;
  netfoil = runTest ./netfoil.nix;
--- a/nixos/tests/netbird-relay.nix
+++ b/nixos/tests/netbird-relay.nix
@@ -0,0 +1,53 @@
+{ pkgs, ... }:
+{
+  name = "netbird-relay";
+
+  meta.maintainers = [
+    pkgs.lib.maintainers.woile
+  ];
+
+  nodes = {
+    relay = {
+      environment.systemPackages = [
+        pkgs.coturn
+      ];
+      networking.hosts = {
+        "127.0.0.1" = [ "relay.example.com" ];
+      };
+      systemd.tmpfiles.rules = [
+        "d /run/ 0755 root root -"
+        "f /run/auth_secret 0600 root root - super-secret-token"
+      ];
+
+      services.netbird.relay = {
+        enable = true;
+        settings = {
+          listen-address = ":33080";
+          # rel -> http ; rels -> https
+          exposed-address = "rel://relay.example.com:33080";
+          log-level = "info";
+          enable-stun = true;
+          stun-ports = [ 3479 ];
+          health-listen-address = ":9000";
+        };
+        authSecretFile = "/run/auth_secret";
+      };
+    };
+  };
+
+  testScript = ''
+    # Wait for service to start
+    relay.start()
+    relay.wait_for_unit("netbird-relay.service")
+
+    # Wait for TCP ports to be open an active
+    relay.wait_for_open_port(9000)
+    relay.wait_for_open_port(33080)
+
+    # Test the STUN port (UDP)
+    relay.wait_until_succeeds("turnutils_stunclient -p 3479 127.0.0.1", timeout=10)
+
+    # assert on health
+    relay.succeed("curl -f http://127.0.0.1:9000/health")
+  '';
+}
--- a/pkgs/by-name/am/amnezia-vpn/disable-conan-runtime-bundling.patch
+++ b/pkgs/by-name/am/amnezia-vpn/disable-conan-runtime-bundling.patch
@@ -1,6 +1,8 @@
+diff --git a/service/server/CMakeLists.txt b/service/server/CMakeLists.txt
+index 4cc47168..b7840b4d 100644
 --- a/service/server/CMakeLists.txt
 +++ b/service/server/CMakeLists.txt
-@@ -341,56 +341,6 @@
+@@ -341,115 +341,6 @@ if(APPLE)
     )
 endif()
 
@@ -32,6 +34,30 @@
 -        ${CONAN_EXECS} ${CONAN_BINS}
 -        "$<TARGET_FILE_DIR:${PROJECT}>"
 -)
+-
+-# prebuilt openvpn carries the rpath of whatever machine baked it; point the
+-# build-tree copy at the local conan openssl (install rewrites it to $ORIGIN)
+-if(LINUX)
+-    file(GENERATE OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/set_openvpn_rpath.cmake
+-        CONTENT "file(RPATH_SET FILE \"$<TARGET_FILE_DIR:${PROJECT}>/openvpn\" NEW_RPATH \"$<TARGET_FILE_DIR:OpenSSL::SSL>\")\n"
+-    )
+-    add_custom_command(TARGET ${PROJECT} POST_BUILD
+-        COMMAND ${CMAKE_COMMAND} -P ${CMAKE_CURRENT_BINARY_DIR}/set_openvpn_rpath.cmake
+-    )
+-elseif(APPLE)
+-    file(GENERATE OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/set_openvpn_rpath.cmake CONTENT
+-[=[
+-set(ovpn "$<TARGET_FILE_DIR:AmneziaVPN-service>/openvpn")
+-set(dir "$<TARGET_FILE_DIR:OpenSSL::SSL>")
+-execute_process(COMMAND install_name_tool -delete_rpath "${dir}" "${ovpn}" ERROR_QUIET)
+-execute_process(COMMAND install_name_tool -add_rpath "${dir}" "${ovpn}")
+-]=]
+-    )
+-    add_custom_command(TARGET ${PROJECT} POST_BUILD
+-        COMMAND ${CMAKE_COMMAND} -P ${CMAKE_CURRENT_BINARY_DIR}/set_openvpn_rpath.cmake
+-    )
+-endif()
+-
 -if(WIN32)
 -    # using PERMISSIONS on Windows appends read-only flag
 -    # to the files so just omit it for it
@@ -40,7 +66,11 @@
 -        COMPONENT AmneziaVPN
 -    )
 -else()
-    install(FILES ${CONAN_EXECS}
+-    set(CONAN_EXECS_INSTALL ${CONAN_EXECS})
+-    if(LINUX)
+-        list(REMOVE_ITEM CONAN_EXECS_INSTALL "$<TARGET_FILE:openvpn::openvpn>")
+-    endif()
+-    install(FILES ${CONAN_EXECS_INSTALL}
 -        DESTINATION ${CMAKE_INSTALL_BINDIR}
 -        COMPONENT AmneziaVPN
 -        PERMISSIONS
@@ -53,6 +83,37 @@
 -    DESTINATION ${CMAKE_INSTALL_BINDIR}
 -    COMPONENT AmneziaVPN
 -)
+-
+-# install openvpn via the service's dep set to ship its openssl, then
+-# rewrite conan's absolute build rpath to a relative one for the package
+-if(LINUX)
+-    install(IMPORTED_RUNTIME_ARTIFACTS openvpn::openvpn
+-        RUNTIME_DEPENDENCY_SET service_deps
+-        PERMISSIONS
+-            OWNER_READ OWNER_EXECUTE
+-            GROUP_READ GROUP_EXECUTE
+-            WORLD_READ WORLD_EXECUTE
+-        COMPONENT AmneziaVPN
+-    )
+-    install(CODE "
+-        set(_ovpn \"\$ENV{DESTDIR}\${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_BINDIR}/openvpn\")
+-        file(CHMOD \"\${_ovpn}\" PERMISSIONS
+-            OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE)
+-        file(RPATH_SET FILE \"\${_ovpn}\" NEW_RPATH \"$ORIGIN:$ORIGIN/../lib\")
+-        file(CHMOD \"\${_ovpn}\" PERMISSIONS
+-            OWNER_READ OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE)
+-    "
+-        COMPONENT AmneziaVPN
+-    )
+-elseif(APPLE)
+-    install(CODE "
+-        set(_ovpn \"\$ENV{DESTDIR}\${CMAKE_INSTALL_PREFIX}/${CMAKE_INSTALL_BINDIR}/openvpn\")
+-        execute_process(COMMAND install_name_tool -delete_rpath \"$<TARGET_FILE_DIR:OpenSSL::SSL>\" \"\${_ovpn}\" ERROR_QUIET)
+-        execute_process(COMMAND install_name_tool -add_rpath \"@executable_path/../Frameworks\" \"\${_ovpn}\")
+-    "
+-        COMPONENT AmneziaVPN
+-    )
+-endif()
 -
 # install drivers
 if (WIN32)
--- a/pkgs/by-name/am/amnezia-vpn/package.nix
+++ b/pkgs/by-name/am/amnezia-vpn/package.nix
@@ -22,13 +22,13 @@ let
  # Even minor updates can break VPN connections without failing the build.
  amneziawg-go-pinned = amneziawg-go.overrideAttrs (
    finalAttrs: _: {
-      version = "3.0.1";
+      version = "3.1.20260814";

      src = fetchFromGitHub {
        owner = "amnezia-vpn";
        repo = "amneziawg-go";
        tag = "v${finalAttrs.version}";
-        hash = "sha256-wtjUJSTDWWgJLedyQPlPa+TtOztciyDWIbyZ24N5ELM=";
+        hash = "sha256-HMmbKd1wYzotB+GAZ8GulyJmX7+XUnXOEerab0OCPO8=";
      };

      vendorHash = "sha256-Y2dCwlKMVLrkzDcNKyCPxFJwMbCA2mQKkakvzwbamCY=";
@@ -84,7 +84,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "amnezia-vpn";
-  version = "5.0.0.5";
+  version = "5.0.1.5";

  __structuredAttrs = true;

@@ -92,7 +92,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "amnezia-vpn";
    repo = "amnezia-client";
    tag = finalAttrs.version;
-    hash = "sha256-knQgGyNkOV9CX1I0hJ8xEMRENBV35E2DwWUOgby3iUo=";
+    hash = "sha256-pSuKAv/Vy4k9kCotIzN1g5NbnyUG/6hDeuQQcGOt5Ow=";
    fetchSubmodules = true;
    # Preserve VCS metadata needed by the build before .git is removed.
    postCheckout = ''
--- a/pkgs/by-name/am/amnezia-vpn/xray-lib.nix
+++ b/pkgs/by-name/am/amnezia-vpn/xray-lib.nix
@@ -5,16 +5,16 @@

 buildGoModule rec {
  pname = "amnezia-xray";
-  version = "1.3.0";
+  version = "1.4.0";

  src = fetchFromGitHub {
    owner = "amnezia-vpn";
    repo = "amnezia-xray-bindings";
    tag = "v${version}";
-    hash = "sha256-kGtRw5Ic/++1ehwLToZ96WfC3ULp+DIsPYArqjL06ck=";
+    hash = "sha256-lvU3bDzd5kgYl5DjdglnQzgjPwhtczxWu6LyxeVvVXE=";
  };

-  vendorHash = "sha256-JAHpQUMQT6tJKwGld0QCobDxgLVujA4KHkhOLXHS65w=";
+  vendorHash = "sha256-L05GHzj9lyFAm9JgR8ZDQf+2auumug6PcoD1F4ozk3E=";

  env.CGO_ENABLED = 1;

--- a/pkgs/by-name/au/aurral/package.nix
+++ b/pkgs/by-name/au/aurral/package.nix
@@ -16,7 +16,7 @@

 buildNpmPackage (finalAttrs: {
  pname = "aurral";
-  version = "2.8.0";
+  version = "2.9.0";

  __structuredAttrs = true;

@@ -24,7 +24,7 @@ buildNpmPackage (finalAttrs: {
    owner = "lklynet";
    repo = "aurral";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Ceo5CHIGa+98XFLazqmAyAV64rzDYqB0gvJ95AKwfUk=";
+    hash = "sha256-pwk+efWL0dfvKiobRmGXgPtvunpRDOVbtxohbJamVqY=";
  };

  # Specifies files to package leveraging npm & nix hooks. Not used by upstream.
@@ -33,7 +33,7 @@ buildNpmPackage (finalAttrs: {
    ./package.json.patch
  ];

-  npmDepsHash = "sha256-Qa/TcKzMEY/w8FWKMiHUeqVB9cMxxWtEwF30y0nndkg=";
+  npmDepsHash = "sha256-NVz5eqDDtMBKiTDl3aX0pHBYGTcYal8lmCf8mbKu31I=";

  nodejs = nodejs_26;

--- a/pkgs/by-name/ba/bazarr/package.nix
+++ b/pkgs/by-name/ba/bazarr/package.nix
@@ -1,29 +1,16 @@
 {
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchNpmDeps,
-  nodejs,
-  npmHooks,
+  buildNpmPackage,
  dart-sass,
-  makeBinaryWrapper,
-  python313,
+  fetchFromGitHub,
  ffmpeg,
-  unar,
-  nixosTests,
+  lib,
  nix-update-script,
+  nixosTests,
+  nodejs_22,
+  python313Packages,
+  unar,
 }:
-let
-  python = python313.withPackages (ps: [
-    ps.lxml
-    ps.numpy
-    ps.pillow
-    ps.psycopg2
-    ps.setuptools
-    ps.webrtcvad
-  ]);
-in
-stdenv.mkDerivation (finalAttrs: {
+python313Packages.buildPythonApplication (finalAttrs: {
  pname = "bazarr";
  version = "1.6.0";

@@ -34,41 +21,28 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-r3H0JEcGYzQOTHVR/zONmtOIF+LnJd+qn2pcAj8vdOA=";
  };

-  npmRoot = "frontend";
-  npmDeps = fetchNpmDeps {
-    name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";
-    inherit (finalAttrs) src;
-    sourceRoot = "${finalAttrs.src.name}/frontend";
-    hash = "sha256-cb++eqVtKZer9B1rwJ9WR4mZImnASeFU2MojgXAPWf4=";
-  };
-
-  nativeBuildInputs = [
-    nodejs
-    npmHooks.npmConfigHook
-    dart-sass
-    makeBinaryWrapper
+  dependencies = with python313Packages; [
+    lxml
+    numpy
+    pillow
+    psycopg2
+    setuptools
+    webrtcvad
  ];

-  buildPhase = ''
-    runHook preBuild
-    pushd frontend
-    # sass-embedded's bundled Dart compiler won't run in the sandbox; use nixpkgs' dart-sass.
-    # https://github.com/sass/embedded-host-node/issues/334
-    substituteInPlace node_modules/sass-embedded/dist/lib/src/compiler-path.js \
-      --replace-fail 'compilerCommand = (() => {' 'compilerCommand = (() => { return ["dart-sass"];'
-    npm run build
-    popd
-    runHook postBuild
-  '';
+  __structuredAttrs = true;
+  dontBuild = true;
+  dontWrapPythonPrograms = true;
+  pyproject = false;

  installPhase = ''
    runHook preInstall

-    mkdir -p $out/share/bazarr/frontend
-    cp -r bazarr bazarr.py custom_libs libs migrations $out/share/bazarr/
-    cp -r frontend/build $out/share/bazarr/frontend/build
+    mkdir -p $out/lib/bazarr/frontend
+    cp -r bazarr bazarr.py custom_libs libs migrations $out/lib/bazarr/
+    cp -r ${finalAttrs.passthru.frontend} $out/lib/bazarr/frontend/build

-    printf '%s' "${finalAttrs.version}" > $out/share/bazarr/VERSION
+    printf '%s' "${finalAttrs.version}" > $out/lib/bazarr/VERSION

    printf '%s' "${
      lib.generators.toKeyValue { } {
@@ -77,29 +51,62 @@ stdenv.mkDerivation (finalAttrs: {
        packageversion = finalAttrs.version;
        packageauthor = "nixpkgs";
      }
-    }" > $out/share/bazarr/package_info
+    }" > $out/lib/bazarr/package_info

-    makeWrapper ${lib.getExe python} $out/bin/bazarr \
-      --add-flags $out/share/bazarr/bazarr.py \
+    makeWrapper ${lib.getExe python313Packages.python} $out/bin/bazarr \
+      --add-flags $out/lib/bazarr/bazarr.py \
      --prefix PATH : ${
        lib.makeBinPath [
          ffmpeg
          unar
        ]
-      }
+      } \
+      --prefix PYTHONPATH : ${python313Packages.makePythonPath finalAttrs.passthru.dependencies} \
+      --set PYTHONNOUSERSITE true

    runHook postInstall
  '';

  passthru = {
+    frontend = buildNpmPackage {
+      inherit (finalAttrs) src version;
+      pname = "${finalAttrs.pname}-frontend";
+
+      sourceRoot = "${finalAttrs.src.name}/frontend";
+
+      nodejs = nodejs_22;
+
+      npmDepsHash = "sha256-cb++eqVtKZer9B1rwJ9WR4mZImnASeFU2MojgXAPWf4=";
+
+      nativeBuildInputs = [ dart-sass ];
+
+      # sass-embedded's bundled Dart compiler won't run in the sandbox; use nixpkgs' dart-sass.
+      # https://github.com/sass/embedded-host-node/issues/334
+      preBuild = ''
+        substituteInPlace node_modules/sass-embedded/dist/lib/src/compiler-path.js \
+          --replace-fail 'compilerCommand = (() => {' 'compilerCommand = (() => { return ["dart-sass"];'
+      '';
+
+      installPhase = ''
+        runHook preInstall
+        mv build $out
+        runHook postInstall
+      '';
+
+      dontFixup = true;
+    };
+
    tests.smoke-test = nixosTests.bazarr;
-    updateScript = nix-update-script { };
+
+    updateScript = nix-update-script {
+      extraArgs = lib.cli.toCommandLineGNU { } { subpackage = "frontend"; };
+    };
  };

  meta = {
    description = "Subtitle manager for Sonarr and Radarr";
    homepage = "https://www.bazarr.media/";
-    changelog = "https://github.com/morpheus65535/bazarr/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/morpheus65535/bazarr/releases/tag/${finalAttrs.src.tag}";
    sourceProvenance = with lib.sourceTypes; [ fromSource ];
    license = lib.licenses.gpl3Only;
    maintainers = with lib.maintainers; [
--- a/pkgs/by-name/br/brook/package.nix
+++ b/pkgs/by-name/br/brook/package.nix
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "brook";
-  version = "20240606";
+  version = "20270101";

  src = fetchFromGitHub {
    owner = "txthinking";
    repo = "brook";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-rfCqYI0T/nbK+rlPGl5orLo3qHKITesdFNtXc/ECATA=";
+    sha256 = "sha256-OIuEJFGOUkvHjxI4FPKWU65VFvgXG0+pu9giGJXYS0w=";
  };

-  vendorHash = "sha256-dYiifLUOq6RKAVSXuoGlok9Jp8jHmbXN/EjQeQpoqWw=";
+  vendorHash = "sha256-974jdNwpQbdTbYjY/6KaicwNclizeIQXfyMZI3v/9aA=";

  meta = {
    homepage = "https://github.com/txthinking/brook";
--- a/pkgs/by-name/ca/casadi/package.nix
+++ b/pkgs/by-name/ca/casadi/package.nix
@@ -37,13 +37,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "casadi";
-  version = "3.8.0";
+  version = "3.8.1";

  src = fetchFromGitHub {
    owner = "casadi";
    repo = "casadi";
    tag = finalAttrs.version;
-    hash = "sha256-kSuNOn55eSaF4admtw4aHmPpdxUS/JDF1yBMrRbPv04=";
+    hash = "sha256-GY7Dyt53QE3+/aPB5oDRfZzpRLqKTGrxrmvihq4YJ2o=";
  };

  postPatch = ''
--- a/pkgs/by-name/cl/clickhouse/lts.nix
+++ b/pkgs/by-name/cl/clickhouse/lts.nix
@@ -1,6 +1,6 @@
 import ./generic.nix {
-  version = "26.8.2.7-lts";
-  rev = "c2930599c56702022276de06657ed51d83f31a05";
-  hash = "sha256-AKEzqbWWfi04Llhw7R4MCEuWPrcyym1z59LR14OluRI=";
+  version = "26.8.5.13-lts";
+  rev = "ec5605431dacfc812affc406cc81ca398ca68174";
+  hash = "sha256-PKvk9iJoPFHB4dTHSWox2hPiTNt2EPlwZ/t3+Up9GsY=";
  lts = true;
 }
--- a/pkgs/by-name/da/dalfox/package.nix
+++ b/pkgs/by-name/da/dalfox/package.nix
@@ -9,16 +9,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "dalfox";
-  version = "3.2.2";
+  version = "3.2.3";

  src = fetchFromGitHub {
    owner = "hahwul";
    repo = "dalfox";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-cTpZGRBlrZEb5H08UIqrefpE0TGNYH6sIHebhQZHtpk=";
+    hash = "sha256-NhYoxsV1xxCbteI691ld6rHdlBGyJr6yn0ZJvDHEt8w=";
  };

-  cargoHash = "sha256-F2JkgwGt7uhl7vq2UI1/l1/C5QTVrPXgBj5mxUu7pYI=";
+  cargoHash = "sha256-huOPIV2sblLQ5P5dO+qrBDl5F7LokTieyecjhjmhmP0=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/by-name/dm/dms-greeter/package.nix
+++ b/pkgs/by-name/dm/dms-greeter/package.nix
@@ -8,7 +8,7 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "dms-greeter";
-  version = "1.6.1";
+  version = "1.6.2";

  __structuredAttrs = true;
  strictDeps = true;
@@ -17,7 +17,7 @@ buildGoModule (finalAttrs: {
    owner = "AvengeMedia";
    repo = "dank-greeter";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Tt4/VvShpkHNbgXQedAsTzN2GbwIaQj0l9rOjqpRU+M=";
+    hash = "sha256-kON8+yjGeCwjvULWNoaHlPmC5OglqL+IejtVlzsvqv4=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/es/essh/package.nix
+++ b/pkgs/by-name/es/essh/package.nix
@@ -10,18 +10,18 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "essh";
-  version = "0.3.3";
+  version = "0.4.0";

  src = fetchFromGitHub {
    owner = "matthart1983";
    repo = "essh";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-dK9M730LgS4CG/BAOSfvH2T06RJsEWHVFT0/VoFvt3Q=";
+    hash = "sha256-+NBKATXTaKaXjkVIrXJvYibI/Xbcuh048kuMZShVjo8=";
  };

  __structuredAttrs = true;

-  cargoHash = "sha256-2ZAvm3LJHpLF99ahLdTFKuneRMLn6XryNd+ZT2uSawE=";
+  cargoHash = "sha256-IU9TNPJPGT+KgrCTt6tcgLHudNpJeAtus4NAcjaQYAE=";

  nativeBuildInputs = [ pkg-config ];

--- a/pkgs/by-name/fc/fcitx5-rime/package.nix
+++ b/pkgs/by-name/fc/fcitx5-rime/package.nix
@@ -16,11 +16,11 @@

 stdenv.mkDerivation rec {
  pname = "fcitx5-rime";
-  version = "5.1.14";
+  version = "5.1.16";

  src = fetchurl {
    url = "https://download.fcitx-im.org/fcitx5/${pname}/${pname}-${version}.tar.zst";
-    hash = "sha256-dHiBH74dTnzabm23TrDAXV/oHSGMqdyBtrf0uyuwjWI=";
+    hash = "sha256-MlGoRCHE8ou69BZU108jgKUt4O3RuoAt5ZQMK/O/ps8=";
  };

  cmakeFlags = [
--- a/pkgs/by-name/fc/fcitx5-skk/package.nix
+++ b/pkgs/by-name/fc/fcitx5-skk/package.nix
@@ -16,13 +16,13 @@

 stdenv.mkDerivation rec {
  pname = "fcitx5-skk";
-  version = "5.1.10";
+  version = "5.1.11";

  src = fetchFromGitHub {
    owner = "fcitx";
    repo = pname;
    rev = version;
-    hash = "sha256-4ApXom3SDwlT55lj0q3u5wBmKRGAzJCvpx1H30z3Ubo=";
+    hash = "sha256-DM0QNAgXnzOhrcNsnBPdI6hrKejMxPbYZCK+yaFqVPA=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/fc/fcitx5/package.nix
+++ b/pkgs/by-name/fc/fcitx5/package.nix
@@ -35,6 +35,7 @@
  libxkbfile,
  nixosTests,
  gettext,
+  librsvg,
 }:
 let
  enDictVer = "20121020";
@@ -45,13 +46,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "fcitx5";
-  version = "5.1.21";
+  version = "5.1.22";

  src = fetchFromGitHub {
    owner = "fcitx";
    repo = pname;
    rev = version;
-    hash = "sha256-IR5mKOsVJ/GPL2czdztLVXGJTNk1JXnWpzmqC/UIwuw=";
+    hash = "sha256-t0Xn15su7nij9ll7EbQeIC75ScSwCoPOgPtTbuP4xN8=";
    fetchSubmodules = true;
  };

@@ -94,6 +95,7 @@ stdenv.mkDerivation rec {
    xcb-imdkit
    xkeyboard_config
    libxkbfile
+    librsvg
  ];

  cmakeFlags = lib.optionals (!stdenv.buildPlatform.canExecute stdenv.hostPlatform) [
--- a/pkgs/by-name/gp/gpu-screen-recorder-notification/package.nix
+++ b/pkgs/by-name/gp/gpu-screen-recorder-notification/package.nix
@@ -21,12 +21,12 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gpu-screen-recorder-notification";
-  version = "1.3.4";
+  version = "1.3.6";

  src = fetchgit {
    url = "https://repo.dec05eba.com/gpu-screen-recorder-notification";
    tag = finalAttrs.version;
-    hash = "sha256-rGredPrTda6/3pG4+0k6fHr4fRSVCRvTC/+sRFytrWo=";
+    hash = "sha256-UmK9aDVsWgMZx9dCA0LFLmY0NLmhwh3O2VgztUzvPOs=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/gr/gremlin-console/package.nix
+++ b/pkgs/by-name/gr/gremlin-console/package.nix
@@ -10,10 +10,10 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "gremlin-console";
-  version = "3.8.1";
+  version = "3.8.2";
  src = fetchzip {
    url = "https://downloads.apache.org/tinkerpop/${finalAttrs.version}/apache-tinkerpop-gremlin-console-${finalAttrs.version}-bin.zip";
-    sha256 = "sha256-43coWvunyzOrFKzkUx5hUHiiXynkaCiV1WVkJvIgwd0=";
+    sha256 = "sha256-U2sorMLLFcYV9dRX64uHR+eUu92ZmxhYgOK4CBsL5YE=";
  };

  nativeBuildInputs = [ makeWrapper ];
--- a/pkgs/by-name/gt/gthumb/package.nix
+++ b/pkgs/by-name/gt/gthumb/package.nix
@@ -34,11 +34,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "gthumb";
-  version = "3.12.10";
+  version = "3.12.11";

  src = fetchurl {
    url = "mirror://gnome/sources/gthumb/${lib.versions.majorMinor finalAttrs.version}/gthumb-${finalAttrs.version}.tar.xz";
-    sha256 = "sha256-MiI0RlPNb7XXmBtzlRrj2QxBT3QiCoschmWyVXQoTHU=";
+    sha256 = "sha256-HDGuxNoV7Ma6AcAa8LH4JTf7JQuXDIboBm1enDEfZIE=";
  };

  strictDeps = true;
--- a/pkgs/by-name/je/jet/package.nix
+++ b/pkgs/by-name/je/jet/package.nix
@@ -19,8 +19,24 @@ buildGraalvmNativeImage (finalAttrs: {
    "-H:Log=registerResource:"
    "--no-fallback"
    "--no-server"
+    "-J-Djet.native=true"
+    # GraalVM >= 25.1 no longer discovers @AutomaticFeature annotations.
+    "--features=InitAtBuildTimeFeature"
  ];

+  doInstallCheck = true;
+  installCheckPhase = ''
+    runHook preInstallCheck
+
+    output="$(
+      printf '%s\n' '{"value":1}' \
+        | $out/bin/jet --from json --to edn --keywordize
+    )"
+    test "$output" = '{:value 1}'
+
+    runHook postInstallCheck
+  '';
+
  passthru.tests.version = testers.testVersion {
    inherit (finalAttrs) version;
    package = finalAttrs.finalPackage;
--- a/pkgs/by-name/ju/just-lsp/package.nix
+++ b/pkgs/by-name/ju/just-lsp/package.nix
@@ -8,7 +8,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "just-lsp";
-  version = "0.7.1";
+  version = "0.8.0";

  __structuredAttrs = true;

@@ -16,10 +16,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "terror";
    repo = "just-lsp";
    tag = finalAttrs.version;
-    hash = "sha256-MQzXXsosKyFBRJBXB8Om9Su5aZDGSnW8rGdLfvuCo6U=";
+    hash = "sha256-V075W4jrHGhOraSzoVCVtK3WSTCyb8lm6Vdfxyo8UOY=";
  };

-  cargoHash = "sha256-D52hr/h2+/GTp95ZZJWxh6wXLa6FU/xVlP/2M8A6KL8=";
+  cargoHash = "sha256-yp/4n1WR/JqhyGeK7CTvfaeHAu+9yhRiYI0W2ZBF6VY=";

  nativeInstallCheckInputs = [
    versionCheckHook
--- a/pkgs/by-name/ke/keycloak/keycloak-orgs/default.nix
+++ b/pkgs/by-name/ke/keycloak/keycloak-orgs/default.nix
@@ -6,13 +6,13 @@
 }:
 maven.buildMavenPackage (finalAttrs: {
  pname = "keycloak-orgs";
-  version = "0.175";
+  version = "0.180";

  src = fetchFromGitHub {
    owner = "p2-inc";
    repo = "keycloak-orgs";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-TKej3VjDLn3GJ8UPFyAzMQmMIZfktzcrK/CDWRqHuS4=";
+    hash = "sha256-M9adZ3oNf4ZcPgSVT++66ltznCc2vJM+eOrYrUk9qI4=";
  };

  mvnHash = "sha256-kU9nmiu/hWJaEfQzdVKC/IIWqZarRPpOqDP/bJQIIEY=";
--- a/pkgs/by-name/ki/kicad/base.nix
+++ b/pkgs/by-name/ki/kicad/base.nix
@@ -2,12 +2,9 @@
  lib,
  stdenv,
  cmake,
-  libGLU,
-  libGL,
  zlib,
  wxGTK,
  gtk3,
-  libx11,
  gettext,
  glew,
  glm,
@@ -17,30 +14,12 @@
  boost,
  pkg-config,
  doxygen,
-  graphviz,
-  libpthread-stubs,
-  libxdmcp,
  unixodbc,
  libgit2,
  libsecret,
-  libgcrypt,
-  libgpg-error,
  ninja,
  writableTmpDirAsHomeHook,

-  util-linuxMinimal,
-  libselinux,
-  libsepol,
-  libthai,
-  libdatrie,
-  libxkbcommon,
-  libepoxy,
-  dbus,
-  at-spi2-core,
-  libxtst,
-  pcre2,
-  libdeflate,
-
  swig,
  python,
  poppler,
@@ -133,41 +112,18 @@ stdenv.mkDerivation (finalAttrs: {
    cmake
    ninja
    doxygen
-    graphviz
    pkg-config
    libgit2
    libsecret
-    libgcrypt
-    libgpg-error
-  ]
-  # wanted by configuration on linux, doesn't seem to affect performance
-  # no effect on closure size
-  ++ optionals (stdenv.hostPlatform.isLinux) [
-    util-linuxMinimal
-    libselinux
-    libsepol
-    libthai
-    libdatrie
-    libxkbcommon
-    libepoxy
-    dbus
-    at-spi2-core
-    libxtst
-    pcre2
  ];

  buildInputs = [
-    libGLU
-    libGL
    zlib
-    libx11
    wxGTK
    gtk3
-    libxdmcp
    gettext
    glew
    glm
-    libpthread-stubs
    cairo
    curl
    openssl
@@ -176,7 +132,6 @@ stdenv.mkDerivation (finalAttrs: {
    python
    poppler
    unixodbc
-    libdeflate
    opencascade-occt
    protobuf_29

--- a/pkgs/by-name/li/libime/package.nix
+++ b/pkgs/by-name/li/libime/package.nix
@@ -18,26 +18,26 @@ let
    url = "https://download.fcitx-im.org/data/table-${tableVer}.tar.zst";
    hash = "sha256-Pp2HsEo5PxMXI0csjqqGDdI8N4o9T2qQBVE7KpWzYUs=";
  };
-  arpaVer = "20250113";
+  arpaVer = "20260629";
  arpa = fetchurl {
    url = "https://download.fcitx-im.org/data/lm_sc.arpa-${arpaVer}.tar.zst";
-    hash = "sha256-7oPs8g1S6LzNukz2zVcYPVPCV3E6Xrd+46Y9UPw3lt0=";
+    hash = "sha256-BoCDM7kXPlN0zyy1r8EtCPViW/mrtTZInKw3b8BfLn8=";
  };
-  dictVer = "20250327";
+  dictVer = "20260703";
  dict = fetchurl {
    url = "https://download.fcitx-im.org/data/dict-${dictVer}.tar.zst";
-    hash = "sha256-fKa+R1TA1MJ7p3AsDc5lFlm9LKH6pcvyhI2BoAU8jBM=";
+    hash = "sha256-xobKtt+JZMSNWW9X0gW6wx/HKHCwaoMBfkRQPfjAlpc=";
  };
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "libime";
-  version = "1.1.14";
+  version = "1.1.16";

  src = fetchFromGitHub {
    owner = "fcitx";
    repo = "libime";
    tag = finalAttrs.version;
-    hash = "sha256-q9OSY1q4MNlFqw6lRMrHO6QT9xP8Czz4b4M0BuIkp34=";
+    hash = "sha256-SDp7j37ZtIQ+YqOh+JKGaPgnrz0sVIom3lJx0Jmbk38=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/li/libvirt/package.nix
+++ b/pkgs/by-name/li/libvirt/package.nix
@@ -15,7 +15,6 @@
  gnutls,
  iproute2,
  iptables,
-  libgcrypt,
  libpcap,
  libtasn1,
  libxml2,
@@ -226,7 +225,6 @@ stdenv.mkDerivation rec {
    dbus
    glib
    gnutls
-    libgcrypt
    libpcap
    libtasn1
    libxml2
--- a/pkgs/by-name/li/linux-firmware/package.nix
+++ b/pkgs/by-name/li/linux-firmware/package.nix
@@ -23,13 +23,13 @@ let
 in
 stdenvNoCC.mkDerivation rec {
  pname = "linux-firmware";
-  version = "20260910";
+  version = "20260916";

  src = fetchFromGitLab {
    owner = "kernel-firmware";
    repo = "linux-firmware";
    tag = version;
-    hash = "sha256-gT9XYrQk5oZvbJgp4u8xkGWR4NdDomx5tzLmB4V52H8=";
+    hash = "sha256-VbDTRN/i+a1BrKnDtdDFxanp3BQujBhe9CyWay9GTXY=";
  };

  postUnpack = ''
--- a/pkgs/by-name/ll/llama-cpp/package.nix
+++ b/pkgs/by-name/ll/llama-cpp/package.nix
@@ -205,12 +205,16 @@ effectiveStdenv.mkDerivation (finalAttrs: {
  # the tests are failing as of 2025-08
  doCheck = false;

-  passthru = {
+  passthru = lib.optionalAttrs (!cudaSupport && !rocmSupport && !vulkanSupport) {
    updateScript = ./update.sh;
  };

  meta = {
-    description = "Inference of Meta's LLaMA model (and others) in pure C/C++";
+    description =
+      "Inference of Meta's LLaMA model (and others) in pure C/C++"
+      + optionalString cudaSupport ", with CUDA support"
+      + optionalString rocmSupport ", with ROCm support"
+      + optionalString vulkanSupport ", with Vulkan support";
    homepage = "https://github.com/ggml-org/llama.cpp";
    license = lib.licenses.mit;
    mainProgram = "llama";
--- a/pkgs/by-name/ma/malwoverview/package.nix
+++ b/pkgs/by-name/ma/malwoverview/package.nix
@@ -6,7 +6,7 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "malwoverview";
-  version = "8.0.5";
+  version = "8.1.0";
  pyproject = true;

  __structuredAttrs = true;
@@ -15,7 +15,7 @@ python3Packages.buildPythonApplication (finalAttrs: {
    owner = "alexandreborges";
    repo = "malwoverview";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-BIuz7QitSM7xOSwiIsitIdYXaBoENhzrOLVfyVcoy3M=";
+    hash = "sha256-Dd2phAb1xNNkWVQ8b52HnkOQ8BU5UxnuvcF/3dmec+w=";
  };

  build-system = with python3Packages; [
--- a/pkgs/by-name/ma/mastodon/source.nix
+++ b/pkgs/by-name/ma/mastodon/source.nix
@@ -5,14 +5,14 @@
  patches ? [ ],
 }:
 let
-  version = "4.6.7";
+  version = "4.6.8";
 in
 applyPatches {
  src = fetchFromGitHub {
    owner = "mastodon";
    repo = "mastodon";
    rev = "v${version}";
-    hash = "sha256-gSJXe4/uRYYKQTmjMirD2uFA7ymRl2LQP6VHt8nBD9k=";
+    hash = "sha256-fDbQunhcpnMnIufEX2oRH9vulsHjtlR95boj0M2O3CQ=";
    passthru = {
      inherit version;
      yarnHash = "sha256-VlOG91ZuO+1UXTbtwIrYUbqHjmSfPSfLhrf4TxCJqJ0=";
--- a/pkgs/by-name/mu/mujoco/package.nix
+++ b/pkgs/by-name/mu/mujoco/package.nix
@@ -108,6 +108,18 @@ stdenv.mkDerivation (finalAttrs: {
    ./mujoco-system-deps-dont-fetch.patch
  ];

+  # Install plugins to expose them in python to fix mujoco-warp tests
+  # ref. https://github.com/google-deepmind/mujoco/pull/3602
+  postPatch = ''
+    for plugin in actuator elasticity sensor; do
+      echo "install(TARGETS $plugin)" >> plugin/$plugin/CMakeLists.txt
+    done
+
+    for plugin in sdf usd_decoder; do
+      echo "install(TARGETS $plugin""_plugin)" >> plugin/$plugin/CMakeLists.txt
+    done
+  '';
+
  nativeBuildInputs = [
    cmake
    # git is needed to apply patches to ccd-src and qhull-src (see below)
--- a/pkgs/by-name/mu/mullvad-browser/package.nix
+++ b/pkgs/by-name/mu/mullvad-browser/package.nix
@@ -97,7 +97,7 @@ let
    ++ lib.optionals mediaSupport [ ffmpeg_7 ]
  );

-  version = "15.0.21";
+  version = "15.0.23";

  sources = {
    x86_64-linux = fetchurl {
@@ -109,7 +109,7 @@ let
        "https://tor.eff.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
        "https://tor.calyxinstitute.org/dist/mullvadbrowser/${version}/mullvad-browser-linux-x86_64-${version}.tar.xz"
      ];
-      hash = "sha256-LHv/hY/abmy7/8nsNkKiwJh+SvRLzEO97fNNvPuYXQo=";
+      hash = "sha256-Bzd0atOeqHFhmIlpN3cbGogkwg6SwpNhn5m4yscpIzo=";
    };
  };

--- a/pkgs/by-name/ne/netbird/package.nix
+++ b/pkgs/by-name/ne/netbird/package.nix
@@ -196,18 +196,22 @@ buildGoModule (finalAttrs: {
  versionCheckProgramArg = component.versionCheckProgramArg or "version";

  passthru = {
-    tests = lib.attrsets.optionalAttrs (componentName == "client") {
-      nixos = nixosTests.netbird;
-      inherit
-        # make sure child packages are built by `ofborg`
-        netbird-management
-        netbird-relay
-        netbird-signal
-        netbird-ui
-        netbird-upload
-        netbird-proxy
-        ;
-    };
+    tests =
+      lib.attrsets.optionalAttrs (componentName == "client") {
+        nixos = nixosTests.netbird;
+        inherit
+          # make sure child packages are built by `ofborg`
+          netbird-management
+          netbird-relay
+          netbird-signal
+          netbird-ui
+          netbird-upload
+          netbird-proxy
+          ;
+      }
+      // lib.attrsets.optionalAttrs (componentName == "relay") {
+        nixos = nixosTests.netbird-relay;
+      };
    updateScript = nix-update-script { };
  };

--- a/pkgs/by-name/ne/networkmanager/package.nix
+++ b/pkgs/by-name/ne/networkmanager/package.nix
@@ -83,11 +83,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "networkmanager";
-  version = "1.58.0";
+  version = "1.58.1";

  src = fetchurl {
    url = "https://gitlab.freedesktop.org/NetworkManager/NetworkManager/-/releases/${finalAttrs.version}/downloads/NetworkManager-${finalAttrs.version}.tar.xz";
-    hash = "sha256-DG8nA6LJsBfNaPv+HS6KGl1/8FE3x1HsQhy6NulFRro=";
+    hash = "sha256-Jihkz9GYEj0+Xb6Rk3RBuX7pBZ1tcS4aW/uxxUZo0U0=";
  };

  outputs = [
--- a/pkgs/by-name/ol/ollama/package.nix
+++ b/pkgs/by-name/ol/ollama/package.nix
@@ -383,9 +383,10 @@ goBuild (finalAttrs: {
      service-rocm = nixosTests.ollama-rocm;
      service-vulkan = nixosTests.ollama-vulkan;
    };
-    updateScript = ./update.sh;
  }
-  // lib.optionalAttrs (!enableRocm && !enableCuda && !enableVulkan) { updateScript = ./update.sh; };
+  // lib.optionalAttrs (!rocmRequested && !cudaRequested && !vulkanRequested) {
+    updateScript = ./update.sh;
+  };

  meta = {
    description =
--- a/pkgs/by-name/om/omp/package.nix
+++ b/pkgs/by-name/om/omp/package.nix
@@ -32,7 +32,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "omp";
-  version = "18.1.21";
+  version = "18.2.1";

  strictDeps = true;
  __structuredAttrs = true;
@@ -41,12 +41,12 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "can1357";
    repo = "oh-my-pi";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Zy7nk0hz1RlVt3HYmXiasSDvIDHUv0/Ek/izvOb3dZM=";
+    hash = "sha256-Xxce8dTViESlYF0koYujNHH7lbZj+BRA9tvgOKXmQ7s=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) src;
-    hash = "sha256-KDUALAEWzm5Lf+SZcqhK4uzBpMcEUxBFsKoj7VFJMeU=";
+    hash = "sha256-PIsVh8HAIuUIoi8K8vExBKurGM86RSebB4f475jdai8=";
  };

  postPatch = ''
@@ -91,7 +91,7 @@ stdenv.mkDerivation (finalAttrs: {
    # Prevents breaking symlinks in node_modules
    dontFixup = true;

-    outputHash = "sha256-t7DIu+/aP6VG+Fks/6FjAprpJMlip0XoFCHPQqdjx94=";
+    outputHash = "sha256-EeOZ7XTDjSHH6QtcqOVBQQeXMh47GhCOPXHTB52VeOA=";
    outputHashMode = "recursive";
  };

--- a/pkgs/by-name/pg/pgschema/package.nix
+++ b/pkgs/by-name/pg/pgschema/package.nix
@@ -1,4 +1,5 @@
 {
+  stdenv,
  lib,
  buildGoModule,
  fetchFromGitHub,
@@ -33,11 +34,15 @@ buildGoModule (finalAttrs: {
    "github.com/pgplex/pgschema/internal/postgres.binariesPath=${postgresql}"
  ];

+  # Tests fail in sandbox on darwin, with:
+  # Could not create shared memory segment: Cannot allocate memory
+  # Failed system call was shmget(key=18446744072262306125, size=56, 03600)
+  doCheck = !stdenv.hostPlatform.isDarwin;
+
  doInstallCheck = true;
  nativeInstallCheckInputs = [
    versionCheckHook
  ];
-  versionCheckProgramArg = "--help"; # there is no -v/--version

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/po/poke/package.nix
+++ b/pkgs/by-name/po/poke/package.nix
@@ -22,11 +22,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "poke";
-  version = "4.3";
+  version = "5.0";

  src = fetchurl {
    url = "mirror://gnu/poke/poke-${finalAttrs.version}.tar.gz";
-    hash = "sha256-qEy5F11Q1FpBHySB/QZiuDyzLOUXMWuInPtXCBlXk3M=";
+    hash = "sha256-aHPVmr6CHIERuIYj6nrZ4JCJL6lcdVYmBt2IN04vW48=";
  };

  outputs = [
--- a/pkgs/by-name/po/portmaster/package.nix
+++ b/pkgs/by-name/po/portmaster/package.nix
@@ -26,7 +26,7 @@
 }:

 let
-  version = "2.2.1";
+  version = "2.2.3";

  nodejsPython = buildPackages.nodejs.python.withPackages (ps: [ ps.setuptools ]);

@@ -34,7 +34,7 @@ let
    owner = "safing";
    repo = "portmaster";
    tag = "v${version}";
-    hash = "sha256-MkVVRPI0yoQ9dl2vyluSz+eNgErfcMveLmeaReJuYIM=";
+    hash = "sha256-MVcynhN8svv83TDOx54dZ/zFyl4lDfUT1bIgHcmeKYE=";
  };

  portmasterUI = buildNpmPackage {
@@ -49,7 +49,7 @@ let
    ];

    sourceRoot = "${src.name}/desktop/angular";
-    npmDepsHash = "sha256-MVlOjD/rKtR+bcCz51mDhZo65jyqTAa1Al+sK/1hJgw=";
+    npmDepsHash = "sha256-TvH3dIrSFmkfuHoJfUjEfPoOJcIzximFQ8vkwQHJXac=";

    nativeBuildInputs = [ nodejsPython ];

@@ -85,7 +85,7 @@ let
    pname = "portmaster-desktop";
    inherit version src;

-    cargoHash = "sha256-QK/L3vUD+MZjFVLgwWm+kZIgXY9ol0y9EIP7aSD45sU=";
+    cargoHash = "sha256-9xJMNkihi+v5eRl6CfcxN4WTMrE/x+jp/isgwNwq1Cs=";
    cargoRoot = "desktop/tauri/src-tauri";
    buildAndTestSubdir = finalAttrs.cargoRoot;

@@ -153,7 +153,7 @@ buildGoModule (finalAttrs: {
    ./disable-software-updates.patch
  ];

-  vendorHash = "sha256-22sIbmpbgYtOwrnxcrKfksgbyqaFRH5DZ/UNXr8723I=";
+  vendorHash = "sha256-sxjARIwy46mJhqgrafj+nGG231Vvq4/iuC+ECXyAU9U=";

  nativeBuildInputs = [
    copyDesktopItems
--- a/pkgs/by-name/ro/roon-server/package.nix
+++ b/pkgs/by-name/ro/roon-server/package.nix
@@ -16,7 +16,7 @@
  stdenv,
 }:
 let
-  version = "2.70.1671";
+  version = "2.71.1683";
  urlVersion = builtins.replaceStrings [ "." ] [ "0" ] version;
 in
 stdenv.mkDerivation {
@@ -25,7 +25,7 @@ stdenv.mkDerivation {

  src = fetchurl {
    url = "https://download.roonlabs.com/updates/production/RoonServer_linuxx64_${urlVersion}.tar.bz2";
-    hash = "sha256-vYFhYMGFyu/eaQnVoRij9aUP9aZvxBj8N7yHmXD7904=";
+    hash = "sha256-z/8rORTsDUhgh2hfep62jMVeAvX/c5HW4vBkVnvhcQc=";
  };

  dontConfigure = true;
@@ -50,19 +50,14 @@ stdenv.mkDerivation {
      # NB: While this might seem like odd behavior, it's what Roon expects. The
      # tarball distribution provides scripts that do a bunch of nonsense on top
      # of what wrapBin is doing here, so consider it the lesser of two evils.
-      # I didn't bother checking whether the symlinks are really necessary, but
-      # I wouldn't put it past Roon to have custom code based on the binary
-      # name, so we're playing it safe.
      wrapBin = binPath: ''
        (
          binDir="$(dirname "${binPath}")"
          binName="$(basename "${binPath}")"
-          dotnetDir="$out/RoonDotnet"
+          actualBin="$binDir/$binName.exe"

-          ln -sf "$dotnetDir/dotnet" "$dotnetDir/$binName"
          rm "${binPath}"
-          makeWrapper "$dotnetDir/$binName" "${binPath}" \
-            --add-flags "$binDir/$binName.dll" \
+          makeWrapper "$actualBin" "${binPath}" \
            --argv0 "$binName" \
            --prefix LD_LIBRARY_PATH : "${
              lib.makeLibraryPath [
@@ -72,7 +67,7 @@ stdenv.mkDerivation {
                openssl
              ]
            }" \
-            --prefix PATH : "$dotnetDir" \
+            --prefix PATH : "$binDir" \
            --prefix PATH : "${
              lib.makeBinPath [
                alsa-utils
@@ -80,8 +75,7 @@ stdenv.mkDerivation {
                ffmpeg
              ]
            }" \
-            --chdir "$binDir" \
-            --set DOTNET_ROOT "$dotnetDir"
+            --chdir "$binDir"
        )
      '';
    in
--- a/pkgs/by-name/rp/rpi-imager/package.nix
+++ b/pkgs/by-name/rp/rpi-imager/package.nix
@@ -23,13 +23,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "rpi-imager";
-  version = "2.0.10-1-proto1";
+  version = "2.0.11.1";

  src = fetchFromGitHub {
    owner = "raspberrypi";
    repo = "rpi-imager";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-5EmriYrjm73fEgcbL/WJ5ggnFqyPQ/DXLBOnhDq1NxA=";
+    hash = "sha256-FjFbDRwykY9q+aDJsEiXhRXjmy12DNpAQTUuF3tRIu4=";
  };

  patches = [ ./remove-vendoring.patch ];
--- a/pkgs/by-name/ru/rustfs-cli/package.nix
+++ b/pkgs/by-name/ru/rustfs-cli/package.nix
@@ -7,17 +7,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rustfs-cli";
-  version = "0.1.35";
+  version = "0.1.36";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "rustfs";
    repo = "cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-KLFQxoQfIvXHmO6gUCV4c9xM10svYhjThZ15Ja47E04=";
+    hash = "sha256-KKidgJMijvcxp5Ek0gknEdr5paHyarXYAB75e7feKEQ=";
  };

-  cargoHash = "sha256-gP4f3L6t0FAUAISG20GG07wYCQ8AmogMWaQ15pyvAfY=";
+  cargoHash = "sha256-CmPMjJc/yyn0csYsKJawzfc+Rkz2gYWCmJVkgJLz/pQ=";

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/sh/shattered-pixel-dungeon/rat-king-adventure/default.nix
+++ b/pkgs/by-name/sh/shattered-pixel-dungeon/rat-king-adventure/default.nix
@@ -5,15 +5,17 @@

 callPackage ../generic.nix rec {
  pname = "rat-king-adventure";
-  version = "2.3.2";
+  version = "2.3.4";

  src = fetchFromGitHub {
    owner = "TrashboxBobylev";
    repo = "Rat-King-Adventure";
    rev = version;
-    hash = "sha256-iGlTDSoXvn1m7avLOBbqPjlEkCoHSL/FtWCyR6IRwM0=";
+    hash = "sha256-uT61XUzR5Eubmjglr4NRY/LFqmyvv6aIZxmnCt+VcbA=";
  };

+  patches = [ ];
+
  desktopName = "Rat King Adventure";

  meta = {
--- a/pkgs/by-name/sh/shattered-pixel-dungeon/rat-king-adventure/deps.json
+++ b/pkgs/by-name/sh/shattered-pixel-dungeon/rat-king-adventure/deps.json
@@ -1,38 +1,55 @@
 {
 "!comment": "This is a nixpkgs Gradle dependency lockfile. For more details, refer to the Gradle section in the nixpkgs manual.",
 "!version": 1,
+ "https://plugins.gradle.org/m2/org": {
+  "beryx#badass-runtime-plugin/2.0.1": {
+   "jar": "sha256-qc8YDAVtxs/vU2XOjloPJml5eJr7CUdlERPRyqm2UhQ=",
+   "module": "sha256-Y1r26XwZhilpzegxJvdwltB8i536+fk+x2sQYCukbcY=",
+   "pom": "sha256-l6xBsi4rPVcN9UXfSjFHmkVqH5O0bMl27Jo/WdHw/Ak="
+  },
+  "beryx/runtime#org.beryx.runtime.gradle.plugin/2.0.1": {
+   "pom": "sha256-Jm5jyHX+OFPIobK4qpMSMU2uK+ceihR2Z/mSnRwc1tQ="
+  },
+  "slf4j#slf4j-api/1.7.32": {
+   "jar": "sha256-NiT4R0wa9G11+YvAl9eGSjI8gbOAiqQ2iabhxgHAJ74=",
+   "pom": "sha256-ABzeWzxrqRBwQlz+ny5pXkrri8KQotTNllMRJ6skT+U="
+  },
+  "slf4j#slf4j-parent/1.7.32": {
+   "pom": "sha256-WrNJ0PTHvAjtDvH02ThssZQKL01vFSFQ4W277MC4PHA="
+  }
+ },
 "https://repo.maven.apache.org/maven2": {
-  "com/badlogicgames/gdx#gdx-backend-lwjgl3/1.12.1": {
-   "jar": "sha256-B3OwjHfBoHcJPFlyy4u2WJuRe4ZF/+tKh7gKsDg41o0=",
-   "module": "sha256-9O7d2ip5+E6OiwN47WWxC8XqSX/mT+b0iDioCRTTyqc=",
-   "pom": "sha256-IRSihaCUPC2d0QzB0MVDoOWM1DXjcisTYtnaaxR9SRo="
+  "com/badlogicgames/gdx#gdx-backend-lwjgl3/1.14.0": {
+   "jar": "sha256-3pV68nyhyv+3eO2hqNMbmDXcc/AEcB0WduyjOWMHICA=",
+   "module": "sha256-GJYW7PSrxbXLJMt1Xwc+IsogkUv4ojCdFdJ/fnpoyOU=",
+   "pom": "sha256-S+xaAWtXxkg0Rruzr4XV0V9f4gedhSpnTcVLMOWd9pY="
  },
-  "com/badlogicgames/gdx#gdx-freetype-platform/1.12.1": {
-   "pom": "sha256-cAGFUunqi4o21kDX8V86OT6aMmXjJUqyMHLHhUWLBm4="
+  "com/badlogicgames/gdx#gdx-freetype-platform/1.14.0": {
+   "pom": "sha256-qQmd0nb4AW2O5i/+TUneaeGohmjS2crXrGc7PvSbKM0="
  },
-  "com/badlogicgames/gdx#gdx-freetype-platform/1.12.1/natives-desktop": {
-   "jar": "sha256-1g5ZN21QWpk+yLogowR3rwaQKx4pJ/8uN17/2/Ql2UE="
+  "com/badlogicgames/gdx#gdx-freetype-platform/1.14.0/natives-desktop": {
+   "jar": "sha256-SFwrJdkZBLlBQ0Bm+BAgBpJHMMLCONBIcq5goC63Ofc="
  },
-  "com/badlogicgames/gdx#gdx-freetype/1.12.1": {
-   "jar": "sha256-rbjskAa7YdrW0pdslaHeGN5eGmUULRilgH0OUkyL8WU=",
-   "module": "sha256-HG9UGDxQFjSvGqLrKEkE7YnVvqtURs7FyqWwunHdXKE=",
-   "pom": "sha256-pLaMZBcEufzo+xszIlcUPJSYJJQg1uY6rm7tb6fHyT8="
+  "com/badlogicgames/gdx#gdx-freetype/1.14.0": {
+   "jar": "sha256-Pr/nUymeEYNLyIzzxMDCzIucJDWsA+VgsKh2QlZYK7Q=",
+   "module": "sha256-fUf8X7lgc5I5ddUqrgMuACcJ144JKU/wOK6K3R7W44A=",
+   "pom": "sha256-Rtq9qlQ6ZRDgUGOMNmphRdkGkbIaBiEf+rSbICMyQiw="
  },
-  "com/badlogicgames/gdx#gdx-jnigen-loader/2.3.1": {
-   "jar": "sha256-ZJDdoiWmHHYCwnu+xOSBE3/1lfjOCy3bpBTww0Bq7mA=",
-   "module": "sha256-nNWFK9nlHTbRJxrypGzZfOwk5XEHblQTbsmtNxhGua8=",
-   "pom": "sha256-7e2XZPzSpbw8peeAUEHppiAZ+ovkNLWZ8D1JR+KkQng="
+  "com/badlogicgames/gdx#gdx-jnigen-loader/2.5.2": {
+   "jar": "sha256-34HyPP1nhcUtNeEI7qo5MPVZ1NJ3CmEC51ynv6b58no=",
+   "module": "sha256-jwtii5G9Ez24XxUuFZMprPf0tmeDvR32AcNZfcJRIiQ=",
+   "pom": "sha256-i0dgu2bbPz+ZuEBj7z6ZDWOhzZx81XSlatf07kvRdoc="
  },
-  "com/badlogicgames/gdx#gdx-platform/1.12.1": {
-   "pom": "sha256-bZhlcVVYfr/+qIAG20v12CgcyUetGduKZP28TnOzkZc="
+  "com/badlogicgames/gdx#gdx-platform/1.14.0": {
+   "pom": "sha256-2Ps74A82eRr6thqFkeVCr7qkkQEHoFdUnMlwBu2NoRs="
  },
-  "com/badlogicgames/gdx#gdx-platform/1.12.1/natives-desktop": {
-   "jar": "sha256-P+utqUwiNjYQkXufuMJLD55h4+bGnHO9DTUDhYTA4e0="
+  "com/badlogicgames/gdx#gdx-platform/1.14.0/natives-desktop": {
+   "jar": "sha256-qKjJzM9endUYJWs8315raJpdaWoU4EYK9bDLxR218vE="
  },
-  "com/badlogicgames/gdx#gdx/1.12.1": {
-   "jar": "sha256-jTIJ6UghH96c2swrAfrO0yPlSKpS73jlx2CEWoh0aXA=",
-   "module": "sha256-7Th6fCSDcEBGAyOsXYZIZwKAPw88K1h448x4If03n6o=",
-   "pom": "sha256-Qg9vfLMYtQsglKsHYme67w6bBlI0yHqWCqkvtCEYpZY="
+  "com/badlogicgames/gdx#gdx/1.14.0": {
+   "jar": "sha256-owWJXpFfxfWUg95dOZokoMpi/hFQFf/oIQw249ZPgSY=",
+   "module": "sha256-xJCoyufsdrraEiLaEyJl5fqyyyzc3q51IXrIhkmUWyU=",
+   "pom": "sha256-CiUFNinRwfRgZMN7orOC0MRmQstKTssVF3jbNXEKmgw="
  },
  "com/badlogicgames/gdx-controllers#gdx-controllers-core/2.2.4": {
   "jar": "sha256-BNpnYnsaNkbvjyFMkdKWdCp8BVl9vCFnqqsJy9zHdHA=",
--- a/pkgs/by-name/sw/swayimg/package.nix
+++ b/pkgs/by-name/sw/swayimg/package.nix
@@ -13,6 +13,7 @@
  exiv2,
  fontconfig,
  giflib,
+  ffmpeg,
  libheif,
  libjpeg,
  libwebp,
@@ -34,13 +35,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "swayimg";
-  version = "5.5";
+  version = "5.6";

  src = fetchFromGitHub {
    owner = "artemsen";
    repo = "swayimg";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-PaxVcuEafLdUETSG78lGSaDukPv/2m1TUbfvpBZTT40=";
+    hash = "sha256-R+tdrKnQXLMu+nrcZRiH9SoiMYoV2LTFHS+jYXLJb7g=";
  };

  strictDeps = true;
@@ -69,6 +70,7 @@ stdenv.mkDerivation (finalAttrs: {
    exiv2
    fontconfig
    giflib
+    ffmpeg
    libheif
    libjpeg
    libwebp
--- a/pkgs/by-name/ta/taproot-assets/package.nix
+++ b/pkgs/by-name/ta/taproot-assets/package.nix
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "taproot-assets";
-  version = "0.8.3";
+  version = "0.8.4";

  src = fetchFromGitHub {
    owner = "lightninglabs";
    repo = "taproot-assets";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-1ZTCRsPJia4+v7SUtRZkwNr1Dm2p385ot1TO83fx46E=";
+    hash = "sha256-eMT6hQx5zzSouusgSmD5IWh93/KakW9PitrwxP3sSj4=";
  };

-  vendorHash = "sha256-kfcgeMgyK3gElf79aWvonsLz4PrRGkImEqm0JTkOKxk=";
+  vendorHash = "sha256-YpxWfNln7YwpKEINbOVbLf1iHEVCRWXj53tC2DhLI6w=";

  subPackages = [
    "cmd/tapcli"
--- a/pkgs/by-name/to/tor-browser/package.nix
+++ b/pkgs/by-name/to/tor-browser/package.nix
@@ -102,7 +102,7 @@ let
    ++ lib.optionals mediaSupport [ ffmpeg_7 ]
  );

-  version = "15.0.22";
+  version = "15.0.23";

  sources = {
    x86_64-linux = fetchurl {
@@ -112,7 +112,7 @@ let
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
        "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-x86_64-${version}.tar.xz"
      ];
-      hash = "sha256-wizrBGx5zl57M7obg3iUr9Y7P/H8ckwCPbVL2BNWZFc=";
+      hash = "sha256-D2L41lx/w03UuGy6t/yq7HOBVz3aNGrHsX5WjiK0vzk=";
    };

    i686-linux = fetchurl {
@@ -122,7 +122,7 @@ let
        "https://tor.eff.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
        "https://tor.calyxinstitute.org/dist/torbrowser/${version}/tor-browser-linux-i686-${version}.tar.xz"
      ];
-      hash = "sha256-1J82ddE8DqVSOnS4yI4ayLyx3MBP++TOonLulGsBz4E=";
+      hash = "sha256-EXCHkprnH1ylopayMN/kckEpYJAePWnzmUlldSqVswk=";
    };
  };

--- a/pkgs/by-name/tr/trash-cli/package.nix
+++ b/pkgs/by-name/tr/trash-cli/package.nix
@@ -9,14 +9,14 @@

 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "trash-cli";
-  version = "0.24.5.26";
+  version = "0.26.9.14";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "andreafrancia";
    repo = "trash-cli";
    rev = finalAttrs.version;
-    hash = "sha256-ltuMnxtG4jTTSZd6ZHWl8wI0oQMMFqW0HAPetZMfGtc=";
+    hash = "sha256-gmLJDTlCGFOmrUgjrQbdr5WBsS+H0czSKnxcmS8F8MI=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/tu/tutanota-desktop/package.nix
+++ b/pkgs/by-name/tu/tutanota-desktop/package.nix
@@ -9,16 +9,16 @@

 let
  pname = "tutanota-desktop";
-  version = "357.260812.1";
+  version = "359.260904.0";

  linuxSrc = fetchurl {
    url = "https://github.com/tutao/tutanota/releases/download/tutanota-desktop-release-${version}/tutanota-desktop-linux.AppImage";
-    hash = "sha256-CnOJmmMLYyC4lCY/3WLz+WrdnC7nysDl4JWWL8KAn74=";
+    hash = "sha256-bhgKpOVkx5NdnhbfDawZp3cvE9sjdZYu0TKcUSgi6w4=";
  };

  darwinSrc = fetchurl {
    url = "https://github.com/tutao/tutanota/releases/download/tutanota-desktop-release-${version}/tutanota-desktop-mac.dmg";
-    hash = "sha256-RKwhWXTeVC6NICbXnsuORH3Xdp3qsX/VJPycr0Dnizs=";
+    hash = "sha256-l0M1p/9HNOS7Z0+ljnDeX0eHeyLHc6rM4//EjDsWzo4=";
  };

  passthru.updateScript = ./update.sh;
--- a/pkgs/by-name/ty/typst/typst-packages-from-universe.toml
+++ b/pkgs/by-name/ty/typst/typst-packages-from-universe.toml
--- a/pkgs/by-name/xc/xchm/package.nix
+++ b/pkgs/by-name/xc/xchm/package.nix
@@ -10,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "xchm";
-  version = "1.39";
+  version = "1.40";

  src = fetchFromGitHub {
    owner = "rzvncj";
    repo = "xCHM";
    rev = finalAttrs.version;
-    sha256 = "sha256-u/7f3yGWvCjmYhd5fs5TcSccz8Wr+WFQlHqUqgriUc0=";
+    sha256 = "sha256-83u13OINHH1poImsyi75mjRZTWu7nvhxKbnF29Cjk0c=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/xk/xkcd-font/package.nix
+++ b/pkgs/by-name/xk/xkcd-font/package.nix
@@ -5,15 +5,15 @@
  installFonts,
 }:

-stdenvNoCC.mkDerivation {
+stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "xkcd-font";
-  version = "0-unstable-2017-08-24";
+  version = "2026.2";

  src = fetchFromGitHub {
    owner = "ipython";
    repo = "xkcd-font";
-    rev = "5632fde618845dba5c22f14adc7b52bf6c52d46d";
-    hash = "sha256-1DgSx2L+OpXuPVSXbbl/hcZUyBK9ikPyGWuk6wNzlwc=";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-IRDwdrlktO/uda3etrv5fpsF6gd+AFAXmRz/X7U5CeA=";
  };

  preInstall = "rm xkcd/build/xkcd.otf";
@@ -32,4 +32,4 @@ stdenvNoCC.mkDerivation {
    platforms = lib.platforms.all;
    maintainers = with lib.maintainers; [ pancaek ];
  };
-}
+})
--- a/pkgs/by-name/xm/xmlsec/package.nix
+++ b/pkgs/by-name/xm/xmlsec/package.nix
@@ -1,97 +1,90 @@
 {
  stdenv,
  fetchurl,
-  fetchpatch,
  libxml2,
  gnutls,
  libxslt,
  pkg-config,
-  libgcrypt,
  libtool,
  openssl,
  nss,
  lib,
+  python3Packages,
  runCommandCC,
  writeText,
 }:
+stdenv.mkDerivation (finalAttrs: {
+  pname = "xmlsec";
+  version = "1.3.12";

-lib.fix (
-  self:
-  stdenv.mkDerivation (finalAttrs: {
-    pname = "xmlsec";
-    version = "1.3.7";
+  __structuredAttrs = true;

-    src = fetchurl {
-      urls = [
-        "https://www.aleksey.com/xmlsec/download/xmlsec1-${finalAttrs.version}.tar.gz"
+  src = fetchurl {
+    urls = [
+      "https://www.aleksey.com/xmlsec/download/xmlsec1-${finalAttrs.version}.tar.gz"

-        # for when the ${finalAttrs.version} gets older than the last two
-        "https://www.aleksey.com/xmlsec/download/older-releases/xmlsec1-${finalAttrs.version}.tar.gz"
-      ];
-      hash = "sha256-2C6TtpuKogWmFrYpF6JpMiv2Oj6q+zd1AU5hdSsgE+o=";
-    };
-
-    patches = [
-      ./lt_dladdsearchdir.patch
-      ./remove_bsd_base64_decode_flag.patch
-      (fetchpatch {
-        # xmlDoc.encoding is no longer const in libxml 2.15, so fetch the fix
-        url = "https://github.com/lsh123/xmlsec/commit/ef0e3b5cac04db13ce070b1e5bcad7dd7b0eb49b.patch?full_index=1";
-        hash = "sha256-Hv8PaJXkXLq++NuCAJ4IvsYBPj8wkN7dBTniYucq18o=";
-      })
+      # for when the ${finalAttrs.version} gets older than the last two
+      "https://www.aleksey.com/xmlsec/download/older-releases/xmlsec1-${finalAttrs.version}.tar.gz"
    ];
+    hash = "sha256-JARRma8S2T/l/bu/fjhugj5IQgcelDLiuQrBCLiJqSM=";
+  };

-    postPatch = ''
-      substituteAllInPlace src/dl.c
-    '';
+  patches = [
+    ./lt_dladdsearchdir.patch
+    ./remove_bsd_base64_decode_flag.patch
+  ];

-    outputs = [
-      "out"
-      "dev"
-    ];
+  postPatch = ''
+    substituteInPlace src/dl.c --replace-fail "@out@" "$out"
+  '';

-    nativeBuildInputs = [ pkg-config ];
+  outputs = [
+    "out"
+    "dev"
+  ];

-    buildInputs = [
-      libxml2
-      gnutls
-      libgcrypt
-      libtool
-      openssl
-      nss
-    ];
+  strictDeps = true;

-    propagatedBuildInputs = [
-      # required by xmlsec/transforms.h
-      libxslt
-    ];
+  nativeBuildInputs = [ pkg-config ];

-    enableParallelBuilding = true;
-    doCheck = true;
-    nativeCheckInputs = [ nss.tools ];
-    preCheck = ''
-      export TMPFOLDER=$(mktemp -d)
-      substituteInPlace tests/testrun.sh --replace 'timestamp=`date +%Y%m%d_%H%M%S`' 'timestamp=19700101_000000'
-    '';
+  buildInputs = [
+    libxml2
+    gnutls
+    libtool
+    openssl
+    nss
+  ];

-    # enable deprecated soap headers required by lasso
-    # https://dev.entrouvert.org/issues/18771
-    configureFlags = [ "--enable-soap" ];
+  propagatedBuildInputs = [
+    # required by xmlsec/transforms.h
+    libxslt
+  ];

-    # otherwise libxmlsec1-gnutls.so won't find libgcrypt.so, after #909
-    env.NIX_LDFLAGS = "-lgcrypt";
+  enableParallelBuilding = true;
+  doCheck = true;
+  nativeCheckInputs = [ nss.tools ];
+  preCheck = ''
+    export TMPFOLDER=$(mktemp -d)
+    substituteInPlace tests/testrun.sh --replace 'timestamp=`date +%Y%m%d_%H%M%S`' 'timestamp=19700101_000000'
+  '';

-    postInstall = ''
-      moveToOutput "bin/xmlsec1-config" "$dev"
-      moveToOutput "lib/xmlsec1Conf.sh" "$dev"
-    '';
+  # enable deprecated soap headers required by lasso
+  # https://dev.entrouvert.org/issues/18771
+  configureFlags = [ "--enable-soap" ];

-    passthru.tests.libxmlsec1-crypto =
+  postInstall = ''
+    moveToOutput "bin/xmlsec1-config" "$dev"
+    moveToOutput "lib/xmlsec1Conf.sh" "$dev"
+  '';
+
+  passthru.tests = {
+    python-xmlsec = python3Packages.xmlsec;
+    libxmlsec1-crypto =
      runCommandCC "libxmlsec1-crypto-test"
        {
          nativeBuildInputs = [ pkg-config ];
          buildInputs = [
-            self
+            finalAttrs.finalPackage
            libxml2
            libxslt
            libtool
@@ -109,20 +102,20 @@ lib.fix (
            }
          ''}

-          for crypto in "" gcrypt gnutls nss openssl; do
+          for crypto in "" gnutls nss openssl; do
            ./crypto-test $crypto
          done
          touch $out
        '';
+  };

-    meta = {
-      description = "XML Security Library in C based on libxml2";
-      homepage = "https://www.aleksey.com/xmlsec/";
-      downloadPage = "https://www.aleksey.com/xmlsec/download.html";
-      license = lib.licenses.mit;
-      mainProgram = "xmlsec1";
-      maintainers = [ ];
-      platforms = with lib.platforms; linux ++ darwin;
-    };
-  })
-)
+  meta = {
+    description = "XML Security Library in C based on libxml2";
+    homepage = "https://www.aleksey.com/xmlsec/";
+    downloadPage = "https://www.aleksey.com/xmlsec/download.html";
+    license = lib.licenses.mit;
+    mainProgram = "xmlsec1";
+    maintainers = [ ];
+    platforms = with lib.platforms; linux ++ darwin;
+  };
+})
--- a/pkgs/development/compilers/llvm/common/lldb/gnu-install-dirs.patch
+++ b/pkgs/development/compilers/llvm/common/lldb/gnu-install-dirs.patch
--- a/pkgs/development/compilers/llvm/23/lldb/gnu-install-dirs.patch
+++ b/pkgs/development/compilers/llvm/23/lldb/gnu-install-dirs.patch
@@ -0,0 +1,64 @@
+diff --git a/bindings/lua/CMakeLists.txt b/bindings/lua/CMakeLists.txt
+index f4ca6bb5f9cb..2355eb159d98 100644
+--- a/bindings/lua/CMakeLists.txt
+++ b/bindings/lua/CMakeLists.txt
+@@ -61,7 +61,7 @@ function(finish_swig_lua swig_target lldb_lua_bindings_dir lldb_lua_target_dir)
+   if(LLDB_BUILD_FRAMEWORK)
+     set(LLDB_LUA_INSTALL_PATH ${LLDB_FRAMEWORK_INSTALL_DIR}/LLDB.framework/Resources/Lua)
+   else()
+-    set(LLDB_LUA_INSTALL_PATH ${LLDB_LUA_RELATIVE_PATH})
+    set(LLDB_LUA_INSTALL_PATH ${CMAKE_INSTALL_LIBDIR}/../${LLDB_LUA_RELATIVE_PATH})
+   endif()
+   install(DIRECTORY ${lldb_lua_target_dir}/
+           DESTINATION ${LLDB_LUA_INSTALL_PATH}
+diff --git a/bindings/python/CMakeLists.txt b/bindings/python/CMakeLists.txt
+index d29b143c1408..8ce045f7fa1f 100644
+--- a/bindings/python/CMakeLists.txt
+++ b/bindings/python/CMakeLists.txt
+@@ -197,7 +197,7 @@ function(finish_swig_python swig_target lldb_python_bindings_dir lldb_python_tar
+   if(LLDB_BUILD_FRAMEWORK)
+     set(LLDB_PYTHON_INSTALL_PATH ${LLDB_FRAMEWORK_INSTALL_DIR}/LLDB.framework/Versions/${LLDB_FRAMEWORK_VERSION}/Resources/Python)
+   else()
+-    set(LLDB_PYTHON_INSTALL_PATH ${LLDB_PYTHON_RELATIVE_PATH})
+    set(LLDB_PYTHON_INSTALL_PATH ${CMAKE_INSTALL_LIBDIR}/../${LLDB_PYTHON_RELATIVE_PATH})
+   endif()
+   if (NOT CMAKE_CFG_INTDIR STREQUAL  ".")
+     string(REPLACE ${CMAKE_CFG_INTDIR} "\$\{CMAKE_INSTALL_CONFIG_NAME\}" LLDB_PYTHON_INSTALL_PATH ${LLDB_PYTHON_INSTALL_PATH})
+@@ -248,14 +248,6 @@ function(add_python_wrapper target)
+   add_dependencies(${target} swig_wrapper_python)
+   add_swig_wrapper(${target} ${lldb_python_wrapper})
+ 
+-  # lib/pythonX.Y/dist-packages/lldb/_lldb.so is a symlink to lib/liblldb.so,
+-  # which depends on lib/libLLVM*.so (BUILD_SHARED_LIBS) or lib/libLLVM-10git.so
+-  # (LLVM_LINK_LLVM_DYLIB). Add an additional rpath $ORIGIN/../../../../lib so
+-  # that _lldb.so can be loaded from Python.
+-  if(LLDB_ENABLE_PYTHON AND (BUILD_SHARED_LIBS OR LLVM_LINK_LLVM_DYLIB) AND UNIX AND NOT APPLE)
+-    set_property(TARGET ${target} APPEND PROPERTY INSTALL_RPATH "\$ORIGIN/../../../../lib${LLVM_LIBDIR_SUFFIX}")
+-  endif()
+-
+   if(Python3_RPATH)
+     set_property(TARGET ${target} APPEND PROPERTY INSTALL_RPATH "${Python3_RPATH}")
+     set_property(TARGET ${target} APPEND PROPERTY BUILD_RPATH   "${Python3_RPATH}")
+diff --git a/cmake/modules/AddLLDB.cmake b/cmake/modules/AddLLDB.cmake
+index b6ad8d46380b..02c5f9806295 100644
+--- a/cmake/modules/AddLLDB.cmake
+++ b/cmake/modules/AddLLDB.cmake
+@@ -329,7 +329,7 @@ function(add_lldb_library name)
+   endif()
+ 
+   if(PARAM_SHARED)
+-    set(install_dest lib${LLVM_LIBDIR_SUFFIX})
+    set(install_dest ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX})
+     if(PARAM_INSTALL_PREFIX)
+       set(install_dest ${PARAM_INSTALL_PREFIX})
+     endif()
+diff --git a/tools/intel-features/CMakeLists.txt b/tools/intel-features/CMakeLists.txt
+index 7d48491ec89a..c04543585588 100644
+--- a/tools/intel-features/CMakeLists.txt
+++ b/tools/intel-features/CMakeLists.txt
+@@ -30,4 +30,4 @@ add_lldb_library(lldbIntelFeatures SHARED
+   )
+ 
+ install(TARGETS lldbIntelFeatures
+-  LIBRARY DESTINATION lib${LLVM_LIBDIR_SUFFIX})
+  LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}${LLVM_LIBDIR_SUFFIX})
--- a/pkgs/development/compilers/llvm/common/lldb/default.nix
+++ b/pkgs/development/compilers/llvm/common/lldb/default.nix
@@ -3,6 +3,7 @@
  stdenv,
  llvm_meta,
  release_version,
+  getVersionFile,
  cmake,
  zlib,
  ncurses,
@@ -75,7 +76,7 @@ stdenv.mkDerivation (
    sourceRoot = "${finalAttrs.src.name}/lldb";

    patches = [
-      ./gnu-install-dirs.patch
+      (getVersionFile "lldb/gnu-install-dirs.patch")
    ]
    ++ lib.optionals (lib.versions.major release_version == "18") [
      # Fix build with gcc15
--- a/pkgs/development/compilers/llvm/common/patches.nix
+++ b/pkgs/development/compilers/llvm/common/patches.nix
@@ -20,6 +20,16 @@
      path = ../18;
    }
  ];
+  "lldb/gnu-install-dirs.patch" = [
+    {
+      before = "23";
+      path = ../18;
+    }
+    {
+      after = "23";
+      path = ../23;
+    }
+  ];
  "llvm/backport-darwin-triple-parsing.patch" = [
    {
      after = "18";
--- a/pkgs/development/ocaml-modules/jws/default.nix
+++ b/pkgs/development/ocaml-modules/jws/default.nix
@@ -0,0 +1,44 @@
+{
+  lib,
+  buildDunePackage,
+  fetchurl,
+  base64,
+  digestif,
+  jsont,
+  mirage-crypto-ec,
+  mirage-crypto-pk,
+  mirage-crypto-rng,
+  ounit2,
+  x509,
+}:
+
+buildDunePackage (finalAttrs: {
+  pname = "jws";
+  version = "0.0.2";
+  src = fetchurl {
+    url = "https://github.com/robur-coop/jws/releases/download/v${finalAttrs.version}/jws-${finalAttrs.version}.tbz";
+    hash = "sha256-7qcxmuhMNkm0xyzVn2MI+mLyO7UbQe+4r0o6CX3XHD0=";
+  };
+
+  propagatedBuildInputs = [
+    base64
+    digestif
+    jsont
+    mirage-crypto-ec
+    mirage-crypto-pk
+  ];
+
+  doCheck = true;
+  checkInputs = [
+    mirage-crypto-rng
+    ounit2
+    x509
+  ];
+
+  meta = {
+    homepage = "https://git.robur.coop/robur/jws";
+    description = "Implementation of JSON Web Signature/Token (RFC 7515)";
+    license = lib.licenses.mit;
+    maintainers = [ lib.maintainers.vbgl ];
+  };
+})
--- a/pkgs/development/ocaml-modules/letsencrypt/app.nix
+++ b/pkgs/development/ocaml-modules/letsencrypt/app.nix
@@ -16,7 +16,6 @@

 buildDunePackage {
  pname = "letsencrypt-app";
-  minimalOCamlVersion = "4.08";

  inherit (letsencrypt)
    src
--- a/pkgs/development/ocaml-modules/letsencrypt/default.nix
+++ b/pkgs/development/ocaml-modules/letsencrypt/default.nix
@@ -2,17 +2,11 @@
  buildDunePackage,
  lib,
  fetchurl,
-  uri,
-  base64,
-  digestif,
+  jws,
+  lun,
  logs,
  fmt,
-  lwt,
-  mirage-crypto,
-  mirage-crypto-ec,
-  mirage-crypto-pk,
  x509,
-  yojson,
  ounit2,
  ptime,
  domain-name,
@@ -20,15 +14,13 @@

 buildDunePackage (finalAttrs: {
  pname = "letsencrypt";
-  version = "1.1.0";
+  version = "2.1.0";

  src = fetchurl {
    url = "https://github.com/mmaker/ocaml-letsencrypt/releases/download/v${finalAttrs.version}/letsencrypt-${finalAttrs.version}.tbz";
-    hash = "sha256-Iw55GffyG5tWA49hao1z9BX6p4N2+EKuhLIoOwG8EKM=";
+    hash = "sha256-fBSPKtt8roTqhzBlpf9rDg5Y1ieC2lS6XQJNQGncUO0=";
  };

-  minimalOCamlVersion = "4.08";
-
  buildInputs = [
    fmt
    ptime
@@ -36,16 +28,10 @@ buildDunePackage (finalAttrs: {
  ];

  propagatedBuildInputs = [
+    jws
    logs
-    yojson
-    lwt
-    base64
-    digestif
-    mirage-crypto
-    mirage-crypto-ec
-    mirage-crypto-pk
+    lun
    x509
-    uri
  ];

  doCheck = true;
--- a/pkgs/development/ocaml-modules/letsencrypt/dns.nix
+++ b/pkgs/development/ocaml-modules/letsencrypt/dns.nix
@@ -11,7 +11,6 @@

 buildDunePackage {
  pname = "letsencrypt-dns";
-  minimalOCamlVersion = "4.08";

  inherit (letsencrypt)
    version
--- a/pkgs/development/ocaml-modules/ocaml-solo5/default.nix
+++ b/pkgs/development/ocaml-modules/ocaml-solo5/default.nix
@@ -17,20 +17,24 @@
      throw "ocaml-solo5 does not support ${stdenv.targetPlatform.system}",
 }:

-assert lib.asserts.assertOneOf "ocaml-solo5's ocaml version" ocaml.version [
-  "5.4.1"
-  "5.5.0"
-];
+let
+  # check upstream patches/<name> directory names
+  allowlisted = [ "5.5" ];
+  entry =
+    if lib.elem ocaml.version allowlisted then ocaml.version else lib.versions.majorMinor ocaml.version;
+in
+
+assert lib.asserts.assertOneOf "ocaml-solo5's ocaml version" entry allowlisted;

 stdenv.mkDerivation (finalAttrs: {
  pname = "ocaml-solo5";
-  version = "1.3.3";
+  version = "1.3.4";

  src = fetchFromGitHub {
    owner = "mirage";
    repo = "ocaml-solo5";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-/xUF98MPhjv9yRWoRDx2uIkCr2Furz1qUJexIxnHhI4=";
+    hash = "sha256-ZbJoh3HHjD7XNvGK1Ehdu/uEoPFtRgVNNz8vtT7zaXI=";
  };

  strictDeps = true;
@@ -52,12 +56,9 @@ stdenv.mkDerivation (finalAttrs: {
  postPatch = ''
    mkdir ocaml
    tar xf ${ocaml.src} -C ocaml --strip-components=1
-    version=$(head -n1 ocaml/VERSION)
-    if test -d "patches/$version"; then
-      for p in "patches/$version"/*; do
-        patch -d ocaml -p1 < "$p"
-      done
-    fi
+    for p in patches/${entry}/*; do
+      patch -d ocaml -p1 < "$p"
+    done
  '';

  # stdenv exports these environment variables
--- a/pkgs/development/python-modules/claude-agent-sdk/default.nix
+++ b/pkgs/development/python-modules/claude-agent-sdk/default.nix
@@ -14,14 +14,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "claude-agent-sdk";
-  version = "0.2.152";
+  version = "0.2.153";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "anthropics";
    repo = "claude-agent-sdk-python";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-h3LjBolK1hpcATNX45ftYZBTKWQtSF34o78E6fRab2M=";
+    hash = "sha256-lGLTNY+XtudqR0SzkDw+HrU1k53mm37inmczfB5jw4I=";
  };

  build-system = [ hatchling ];
--- a/pkgs/development/python-modules/fastgit/default.nix
+++ b/pkgs/development/python-modules/fastgit/default.nix
@@ -8,14 +8,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "fastgit";
-  version = "0.1.3";
+  version = "0.1.4";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "AnswerDotAI";
    repo = "fastgit";
    tag = finalAttrs.version;
-    hash = "sha256-yN471RY02Ccpct0zrHxhHkiz5Fpbmpgwx+fzSktib4E=";
+    hash = "sha256-sBnl4CWYts4cjQ/etfPN1IZWlT1TPDGW+aM/oPukR0E=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/mjviser/default.nix
+++ b/pkgs/development/python-modules/mjviser/default.nix
@@ -0,0 +1,64 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  uv-build,
+
+  # dependencies
+  mujoco,
+  numpy,
+  pillow,
+  trimesh,
+  viser,
+
+  # tests
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "mjviser";
+  version = "0.0.14";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "mujocolab";
+    repo = "mjviser";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-LzltAgWKK84gQU4IlzKv7SClaUrLCdyU8vzHh4LIqDs=";
+  };
+
+  postPatch = ''
+    substituteInPlace pyproject.toml \
+      --replace-fail \
+        "uv_build>=0.8.19,<0.9.0" \
+        "uv_build"
+  '';
+
+  build-system = [
+    uv-build
+  ];
+
+  dependencies = [
+    mujoco
+    numpy
+    pillow
+    trimesh
+    viser
+  ];
+
+  pythonImportsCheck = [ "mjviser" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "Web-based MuJoCo viewer powered by Viser";
+    homepage = "https://github.com/mujocolab/mjviser";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ nim65s ];
+  };
+})
--- a/pkgs/development/python-modules/msmart-ng/default.nix
+++ b/pkgs/development/python-modules/msmart-ng/default.nix
@@ -17,14 +17,14 @@

 buildPythonPackage rec {
  pname = "msmart-ng";
-  version = "2026.8.0";
+  version = "2026.9.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "mill1000";
    repo = "midea-msmart";
    tag = version;
-    hash = "sha256-UbRL42jQk3A8VYe/eLj3XNTFPhyVjBMzB/lTNs0tyRM=";
+    hash = "sha256-pTL7Kn+m5HP1xJ2cvxWaj8700c7bGPonS4nku+SwsRI=";
  };

  build-system = [
--- a/pkgs/development/python-modules/mujoco-warp/default.nix
+++ b/pkgs/development/python-modules/mujoco-warp/default.nix
@@ -0,0 +1,72 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  absl-py,
+  etils,
+  mujoco,
+  numpy,
+  warp-lang,
+
+  # optional-dependencies
+  jax,
+
+  # tests
+  pytestCheckHook,
+  writableTmpDirAsHomeHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "mujoco-warp";
+  version = "3.13.0";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "google-deepmind";
+    repo = "mujoco_warp";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-R+YizRSaPOt4eSy6W0dRsFn+ovn+Ks05wVyd5e9lgYc=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    absl-py
+    etils
+    mujoco
+    numpy
+    warp-lang
+  ];
+
+  optional-dependencies = {
+    cpu = [
+      jax
+    ];
+    cuda = [
+      jax
+    ];
+  };
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    writableTmpDirAsHomeHook
+  ];
+
+  pythonImportsCheck = [ "mujoco_warp" ];
+
+  meta = {
+    description = "GPU-optimized version of the MuJoCo physics simulator, designed for NVIDIA hardware";
+    homepage = "https://github.com/google-deepmind/mujoco_warp";
+    changelog = "https://github.com/google-deepmind/mujoco_warp/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.asl20;
+    maintainers = with lib.maintainers; [ nim65s ];
+  };
+})
--- a/pkgs/development/python-modules/print-color/default.nix
+++ b/pkgs/development/python-modules/print-color/default.nix
@@ -8,14 +8,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "print-color";
-  version = "0.4.7";
+  version = "0.4.8";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "xy3";
    repo = "print-color";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-bVmJiRFYThAwNz25DKvBl1k1mdqwQ5FB2vuaYvuf4kg=";
+    hash = "sha256-WzWButpFc+YHQNjd7+t5MHgAa8W9nSyWfTCd9zmnD6s=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/rsl-rl-lib/default.nix
+++ b/pkgs/development/python-modules/rsl-rl-lib/default.nix
@@ -0,0 +1,77 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  setuptools,
+
+  # dependencies
+  gitpython,
+  numpy,
+  onnx,
+  onnxscript,
+  tensorboard,
+  tensordict,
+  torch,
+  torchvision,
+
+  # optional-dependencies
+  wandb,
+
+  # tests
+  pytestCheckHook,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "rsl-rl-lib";
+  version = "5.4.2";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "leggedrobotics";
+    repo = "rsl_rl";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-m9M9yWCKs5vLHb7k5A7AFfHko980HDeF3qr1x7s1KGE=";
+  };
+
+  build-system = [
+    setuptools
+  ];
+
+  dependencies = [
+    gitpython
+    numpy
+    onnx
+    onnxscript
+    tensorboard
+    tensordict
+    torch
+    torchvision
+  ];
+
+  optional-dependencies = {
+    # https://github.com/neptune-ai/neptune-client is archived
+    # neptune = [
+    #   neptune
+    # ];
+    wandb = [
+      wandb
+    ];
+  };
+
+  pythonImportsCheck = [ "rsl_rl" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+  ];
+
+  meta = {
+    description = "Fast and simple implementation of learning algorithms for robotics";
+    homepage = "https://github.com/leggedrobotics/rsl_rl";
+    changelog = "https://github.com/leggedrobotics/rsl_rl/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.bsd3;
+    maintainers = with lib.maintainers; [ nim65s ];
+  };
+})
--- a/pkgs/development/python-modules/torchrunx/default.nix
+++ b/pkgs/development/python-modules/torchrunx/default.nix
@@ -0,0 +1,81 @@
+{
+  lib,
+  stdenv,
+  buildPythonPackage,
+  fetchFromGitHub,
+
+  # build-system
+  uv-build,
+
+  # dependencies
+  cloudpickle,
+  fabric,
+  numpy,
+  torch,
+
+  # tests
+  pytestCheckHook,
+  submitit,
+  transformers,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "torchrunx";
+  version = "0.4.0";
+  pyproject = true;
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "apoorvkh";
+    repo = "torchrunx";
+    tag = finalAttrs.version;
+    hash = "sha256-cb9X65rnacgB59NdjEVpReFZD1wvC9GWmE0BULnCTow=";
+  };
+
+  build-system = [
+    uv-build
+  ];
+
+  dependencies = [
+    cloudpickle
+    fabric
+    numpy
+    torch
+  ];
+
+  pythonImportsCheck = [ "torchrunx" ];
+
+  nativeCheckInputs = [
+    pytestCheckHook
+    submitit
+    transformers
+  ];
+
+  disabledTests = [
+    # RuntimeError: Not in a SLURM job
+    "test_launch"
+
+    # RuntimeError: Could not detect "srun", are you indeed on a slurm cluster?
+    "test_submitit"
+
+    #  RuntimeError: workers_per_host="gpu", but no GPUs detected on: ['localhost'].
+    "test_distributed_train"
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
+    # torch.distributed.DistNetworkError: The client socket has timed out after 300000ms while
+    # trying to connect to (build03, 63972).
+    "test_error"
+    "test_logging"
+    "test_simple_localhost"
+  ];
+
+  __darwinAllowLocalNetworking = true;
+
+  meta = {
+    description = "Easily run PyTorch on multiple GPUs & machines";
+    homepage = "https://github.com/apoorvkh/torchrunx";
+    changelog = "https://github.com/apoorvkh/torchrunx/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.gpl3Only;
+    maintainers = with lib.maintainers; [ nim65s ];
+  };
+})
--- a/pkgs/development/python-modules/xmlsec/default.nix
+++ b/pkgs/development/python-modules/xmlsec/default.nix
@@ -3,6 +3,7 @@
  stdenv,
  buildPythonPackage,
  fetchFromGitHub,
+  fetchpatch,

  # build-system
  pkgconfig,
@@ -38,6 +39,20 @@ buildPythonPackage (finalAttrs: {
    hash = "sha256-p3V75DLUI2PKdharP3/0HrKOgma9Kh3lAOZLRAQjo80=";
  };

+  patches = [
+    # https://github.com/lsh123/xmlsec/issues/1148
+    # https://github.com/xmlsec/python-xmlsec/pull/422
+    (fetchpatch {
+      name = "xmlsec-1.3.11-test-compatibility.patch";
+      url = "https://github.com/xmlsec/python-xmlsec/commit/5e8b4e6aa133c358b8aaf8e17ceb5b3b7fea78e8.patch";
+      includes = [
+        "src/*"
+        "tests/*"
+      ];
+      hash = "sha256-+J2L6oq802/534qIDvFqsWYfn9LExRlXXIeDvVqZEYk=";
+    })
+  ];
+
  postPatch = ''
    substituteInPlace pyproject.toml \
      --replace-fail "lxml==" "lxml>=" \
--- a/pkgs/servers/home-assistant/custom-components/midea_ac/package.nix
+++ b/pkgs/servers/home-assistant/custom-components/midea_ac/package.nix
@@ -10,13 +10,13 @@
 buildHomeAssistantComponent rec {
  owner = "mill1000";
  domain = "midea_ac";
-  version = "2026.8.3";
+  version = "2026.9.0";

  src = fetchFromGitHub {
    owner = "mill1000";
    repo = "midea-ac-py";
    tag = version;
-    hash = "sha256-vuSMP+RuDRQPiaz5SauXym/dNPtJBARPybAEiFWRFbw=";
+    hash = "sha256-c8svh2Td2fxVnoMGhSK9Iz+ZekS7dCvoVQ6Z7WiQgA4=";
  };

  dependencies = [ msmart-ng ];
--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-chinese-addons.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-chinese-addons.nix
@@ -2,7 +2,6 @@
  lib,
  stdenv,
  fetchurl,
-  fetchpatch,
  fetchFromGitHub,
  cmake,
  pkg-config,
@@ -19,6 +18,7 @@
  fmt,
  qtbase,
  luaSupport ? true,
+  nlohmann_json,
 }:

 let
@@ -36,13 +36,13 @@ in

 stdenv.mkDerivation rec {
  pname = "fcitx5-chinese-addons";
-  version = "5.1.12";
+  version = "5.1.14";

  src = fetchFromGitHub {
    owner = "fcitx";
    repo = pname;
    rev = version;
-    hash = "sha256-bAx5m+tU8hT1WdaLChpQV3J0l+QJzDLzMEPTgjEGCuw=";
+    hash = "sha256-EtAoUoZQqxb049oD7r/UgdpJdS/kenMn3t1SHv+YIkg=";
  };

  nativeBuildInputs = [
@@ -68,6 +68,7 @@ stdenv.mkDerivation rec {
    qtwebengine
    fmt
    qtbase
+    nlohmann_json
  ]
  ++ lib.optional luaSupport fcitx5-lua;

--- a/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix
+++ b/pkgs/tools/inputmethods/fcitx5/fcitx5-qt.nix
@@ -16,13 +16,13 @@ let
 in
 stdenv.mkDerivation rec {
  pname = "fcitx5-qt${majorVersion}";
-  version = "5.1.14";
+  version = "5.1.15";

  src = fetchFromGitHub {
    owner = "fcitx";
    repo = "fcitx5-qt";
    rev = version;
-    hash = "sha256-fyqejCb6c6VuPb44UPQDLrdZ93mHTxlX29jCN6KcZ5I=";
+    hash = "sha256-xmtFiWjjknDNN0RdI45GwiuBojRCRZiSGxP9asE5OeY=";
  };

  postPatch = ''
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -1053,6 +1053,8 @@ let
        junit_alcotest = callPackage ../development/ocaml-modules/junit/alcotest.nix { };
        junit_ounit = callPackage ../development/ocaml-modules/junit/ounit.nix { };

+        jws = callPackage ../development/ocaml-modules/jws { };
+
        jwto = callPackage ../development/ocaml-modules/jwto { };

        ### K ###
--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -10926,6 +10926,8 @@ self: super: with self; {

  mizani = callPackage ../development/python-modules/mizani { };

+  mjviser = callPackage ../development/python-modules/mjviser { };
+
  mkdocs = callPackage ../development/python-modules/mkdocs { };

  mkdocs-autolinks-plugin = callPackage ../development/python-modules/mkdocs-autolinks-plugin { };
@@ -11325,6 +11327,8 @@ self: super: with self; {

  mujoco-mjx = callPackage ../development/python-modules/mujoco-mjx { mujoco-main = pkgs.mujoco; };

+  mujoco-warp = callPackage ../development/python-modules/mujoco-warp { };
+
  mujson = callPackage ../development/python-modules/mujson { };

  mullvad-api = callPackage ../development/python-modules/mullvad-api { };
@@ -18344,6 +18348,8 @@ self: super: with self; {

  rsa = callPackage ../development/python-modules/rsa { };

+  rsl-rl-lib = callPackage ../development/python-modules/rsl-rl-lib { };
+
  rsskey = callPackage ../development/python-modules/rsskey { };

  rst2ansi = callPackage ../development/python-modules/rst2ansi { };
@@ -20962,6 +20968,8 @@ self: super: with self; {

  torchrl = callPackage ../development/python-modules/torchrl { };

+  torchrunx = callPackage ../development/python-modules/torchrunx { };
+
  torchsde = callPackage ../development/python-modules/torchsde { };

  torchsnapshot = callPackage ../development/python-modules/torchsnapshot { };