Merge master into staging-next

2026-07-18 06:31:15 +00:00 · 2026-07-11 18:18:49 +00:00
parent 85ea91b158 8d230ae488
commit fbf6873ec8
96 changed files with 2095 additions and 937 deletions
--- a/lib/licenses/licenses.nix
+++ b/lib/licenses/licenses.nix
@@ -1052,6 +1052,11 @@ lib.mapAttrs mkLicense (
      fullName = "MIT License";
    };

+    mit-click = {
+      spdxId = "MIT-Click";
+      fullName = "MIT Click License";
+    };
+
    mit-cmu = {
      spdxId = "MIT-CMU";
      fullName = "CMU License";
--- a/lib/services/service.nix
+++ b/lib/services/service.nix
@@ -6,6 +6,7 @@
 # The module
 {
  lib,
+  config,
  ...
 }:
 let
@@ -49,6 +50,53 @@ in
          a shell script or `importas` from `pkgs.execline`.
        '';
      };
+
+      reloadSignal = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        example = "HUP";
+        description = ''
+          Configures the reload signal to send to the service manager.
+        '';
+      };
+
+      reloadCommand = mkOption {
+        type = types.nullOr types.str;
+        default = null;
+        example = lib.literalExpression ''"''${pkgs.coreutils}/bin/kill -HUP $MAINPID"'';
+
+        description = ''
+          Command used for reloading in the underlying service manager to reload.
+        '';
+      };
+    };
+
+    notificationProtocol = mkOption {
+      type = types.listOf (
+        types.enum [
+          "systemd"
+          "s6"
+        ]
+      );
+
+      default = [ ];
+      apply = v: lib.unique v;
+      description = ''
+        Notification protocol that this service supports with the underlying service manager.
+      '';
    };
  };
+
+  config = {
+    assertions = [
+      {
+        assertion = config.process.reloadSignal != null && config.process.reloadCommand != null;
+        message = "reloadSignal conflicts with reloadCommand. Please either use reloadSignal or reloadCommand.";
+      }
+    ];
+
+    process.reloadCommand = (lib.mkIf config.process.reloadSignal != null) (
+      lib.mkForce "${pkgs.coreutils}/bin/kill -${config.process.reloadSignal} $MAINPID"
+    );
+  };
 }
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -209,6 +209,12 @@
    github = "2hexed";
    githubId = 54501296;
  };
+  _2zqa = {
+    name = "Marijn Kok";
+    email = "hkju4b4ds@mozmail.com";
+    github = "2zqa";
+    githubId = 25235249;
+  };
  _30350n = {
    name = "Max Schlecht";
    github = "30350n";
@@ -257,11 +263,10 @@
    name = "Eske Nielsen";
  };
  _4evy = {
-    name = "_4evy";
-    email = "git@ps1.sh";
-    github = "_4evy";
+    name = "4evy";
+    email = "git@evy.pink";
+    github = "4evy";
    githubId = 57304299;
-    matrix = "@donteatoreo:matrix.org";
  };
  _4r7if3x = {
    email = "the.artifex@proton.me";
@@ -17820,6 +17825,12 @@
      { fingerprint = "838A FE0D 55DC 074E 360F  943A 84B6 9CE6 F3F6 B767"; }
    ];
  };
+  mcuste = {
+    email = "github@muratcanuste.com";
+    github = "mcuste";
+    githubId = 10829864;
+    name = "Murat Can Üste";
+  };
  mcwitt = {
    email = "mcwitt@gmail.com";
    github = "mcwitt";
@@ -27266,6 +27277,11 @@
    githubId = 203195;
    name = "Szczyp";
  };
+  szhekpisov = {
+    github = "szhekpisov";
+    githubId = 87662520;
+    name = "Sergei Zhekpisov";
+  };
  szkiba = {
    email = "iszkiba@gmail.com";
    github = "szkiba";
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -99,6 +99,9 @@

 - `komodo` has been updated to the v2 release line (2.x). See the [upstream v1 → v2 upgrade guide](https://github.com/moghtech/komodo/releases/tag/v2.0.0).

+- `temporal` has been updated to the 1.31 release line. Always consult the [upstream upgrade
+  notes](https://docs.temporal.io/self-hosted-guide/upgrade-server) before upgrading between versions.
+
 - The `shell_interact()` function on interactive runs of NixOS VM tests has been deprecated. Use the SSH backdoor instead.

 - [services.netbox](#opt-services.netbox.enable) has received a number of updates:
@@ -134,3 +137,10 @@
 - The `newuidmap` and `newgidmap` security wrappers are now installed with `cap_setuid`/`cap_setgid` file capabilities instead of the setuid-root bit, matching shadow's `--with-fcaps` install mode and other major distributions. Rootless containers (podman, docker-rootless, unprivileged user namespaces) are unaffected. The only behavioural change is that mapping host uid 0 via `/etc/subuid` (which NixOS never configures by default) additionally requires `cap_setfcap`; users who explicitly grant uid 0 in a subuid range can restore the previous behaviour with `security.wrappers.newuidmap.capabilities = lib.mkForce "cap_setuid,cap_setfcap+ep";`.

 - `zoneminder` has been updated to 1.38.x release. See [upstream release note](https://github.com/ZoneMinder/zoneminder/releases/tag/1.38.0). While database migration should happen automatically, it's recommended that you make a backup of the database before upgrading your system.
+
+- The latest available version of Nextcloud is v34 (available as `pkgs.nextcloud34`). The installation logic is as follows:
+  - If [`services.nextcloud.package`](#opt-services.nextcloud.package) is specified explicitly, this package will be installed (**recommended**)
+  - If `system.stateVersion` is >=26.11, `pkgs.nextcloud34` will be installed by default.
+  - If [`system.stateVersion`](#opt-system.stateVersion) is >=26.05, `pkgs.nextcloud33` will be installed by default.
+  - If [`system.stateVersion`](#opt-system.stateVersion) is >=25.11, `pkgs.nextcloud32` will be installed by default.
+  - Please note that Nextcloud prohibits skipping major versions while upgrading. You can upgrade to specific versions by declaring `services.nextcloud.package = pkgs.nextcloud33;`.
--- a/nixos/modules/services/desktops/oo7.nix
+++ b/nixos/modules/services/desktops/oo7.nix
@@ -15,27 +15,27 @@ in
  };

  config = lib.mkIf cfg.enable {
+    environment.systemPackages = [ pkgs.oo7 ];
    services.dbus.packages = [ pkgs.oo7-server ];

-    systemd.packages = [ pkgs.oo7-server ];
+    systemd = {
+      packages = [ pkgs.oo7-server ];
+      user.services.oo7-daemon.wantedBy = [ "default.target" ];
+    };

-    systemd.user.services.oo7-daemon.wantedBy = [ "default.target" ];
+    security = {
+      pam.services.login.oo7.enable = true;
+
+      wrappers.oo7-daemon = {
+        owner = "root";
+        group = "root";
+        capabilities = "cap_ipc_lock=ep";
+        source = "${pkgs.oo7-server}/libexec/oo7-daemon";
+      };
+    };

    xdg.portal.extraPortals = [ pkgs.oo7-portal ];
-
-    security.pam.services.login.oo7.enable = true;
-
-    security.wrappers.oo7-daemon = {
-      owner = "root";
-      group = "root";
-      capabilities = "cap_ipc_lock=ep";
-      source = "${pkgs.oo7-server}/libexec/oo7-daemon";
-    };
  };

-  meta = {
-    inherit (pkgs.oo7.meta)
-      maintainers
-      ;
-  };
+  meta = { inherit (pkgs.oo7.meta) maintainers; };
 }
--- a/nixos/modules/services/networking/syncthing.nix
+++ b/nixos/modules/services/networking/syncthing.nix
@@ -25,10 +25,10 @@ let
    if
      isUnixGui
    # if cfg.guiAddress is a unix socket, tell curl explicitly about it
-    # note that the dot in front of `${path}` is the hostname, which is
+    # note that the syncthing.local in front of `${path}` is the hostname, which is
    # required.
    then
-      "--unix-socket ${lib.strings.removePrefix "unix://" cfg.guiAddress} http://.${path}"
+      "--unix-socket ${lib.strings.removePrefix "unix://" cfg.guiAddress} http://syncthing.local${path}"
    # no adjustments are needed if cfg.guiAddress is a network address
    else
      "${cfg.guiAddress}${path}";
--- a/nixos/modules/services/web-apps/nextcloud.md
+++ b/nixos/modules/services/web-apps/nextcloud.md
@@ -5,7 +5,7 @@ self-hostable cloud platform. The server setup can be automated using
 [services.nextcloud](#opt-services.nextcloud.enable). A
 desktop client is packaged at `pkgs.nextcloud-client`.

-The current default by NixOS is `nextcloud33` which is also the latest
+The current default by NixOS is `nextcloud34` which is also the latest
 major version available.

 ## Basic usage {#module-services-nextcloud-basic-usage}
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -467,6 +467,7 @@ in
      relatedPackages = [
        "nextcloud32"
        "nextcloud33"
+        "nextcloud34"
      ];
    };
    phpPackage = lib.mkPackageOption pkgs "php" {
@@ -1195,7 +1196,7 @@ in
      {
        warnings =
          let
-            latest = 33;
+            latest = 34;
            upgradeWarning = major: nixos: ''
              A legacy Nextcloud install (from before NixOS ${nixos}) may be installed.

@@ -1228,7 +1229,8 @@ in
          ++ (lib.optional (lib.versionOlder cfg.package.version "30") (upgradeWarning 29 "24.11"))
          ++ (lib.optional (lib.versionOlder cfg.package.version "31") (upgradeWarning 30 "25.05"))
          ++ (lib.optional (lib.versionOlder cfg.package.version "32") (upgradeWarning 31 "25.11"))
-          ++ (lib.optional (lib.versionOlder cfg.package.version "33") (upgradeWarning 32 "26.05"));
+          ++ (lib.optional (lib.versionOlder cfg.package.version "33") (upgradeWarning 32 "26.05"))
+          ++ (lib.optional (lib.versionOlder cfg.package.version "34") (upgradeWarning 33 "26.11"));

        services.nextcloud.package = lib.mkDefault (
          if pkgs ? nextcloud then
@@ -1241,8 +1243,10 @@ in
            pkgs.nextcloud31
          else if lib.versionOlder stateVersion "26.05" then
            pkgs.nextcloud32
-          else
+          else if lib.versionOlder stateVersion "26.11" then
            pkgs.nextcloud33
+          else
+            pkgs.nextcloud34
        );

        services.nextcloud.phpOptions = lib.mkMerge [
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -1617,6 +1617,7 @@ in
          MemoryDenyWriteExecute =
            !(
              (builtins.any (mod: (mod.allowMemoryWriteExecute or false)) cfg.package.modules)
+              || cfg.lua.enable
              || (cfg.package == pkgs.openresty)
            );
          RestrictRealtime = true;
--- a/nixos/modules/system/service/systemd/service.nix
+++ b/nixos/modules/system/service/systemd/service.nix
@@ -113,6 +113,48 @@ in
      defaultText = lib.literalExpression "config.systemd.lib.escapeSystemdExecArgs config.process.argv";
    };

+    systemd.mainExecReload = mkOption {
+      description = ''
+        Main command line for systemd's ExecReload with systemd's specifier and
+        environment variable substitution enabled.
+
+        This option sets the primary ExecRestart entry. Additional ExecReload entries
+        can be added via `systemd.service.serviceConfig.ExecReload` with `lib.mkBefore`
+        or `lib.mkAfter`.
+
+        This option allows you to use systemd specifiers like `%n` (unit name),
+        `%i` (instance), `%t` (runtime directory), and environment variables using
+        `''${VAR}` syntax in your command line.
+
+        By default, it is either set to null or this is set to the escaped version of {option}`process.reloadCommand`
+        when specified to prevent systemd substitution. Set this option explicitly to enable
+        systemd's substitution features.
+
+        To extend {option}`process.reloadCommand` with systemd specifiers, you can append
+        to the escaped arguments:
+
+        ```nix
+        systemd.mainExecReload =
+          config.systemd.lib.escapeSystemdExecArgs config.process.reload + " --systemd-unit %n";
+        ```
+
+        This pattern allows you to pass the unit name (or other systemd specifiers)
+        as additional arguments while keeping the base command from {option}`process.argv`
+        properly escaped.
+
+        See {manpage}`systemd.service(5)` (section "COMMAND LINES") for details on
+        variable substitution and {manpage}`systemd.unit(5)` (section "SPECIFIERS")
+        for available specifiers like `%n`, `%i`, `%t`.
+      '';
+      type = types.nullOr types.str;
+      default =
+        if config.process.reloadCommand then
+          config.systemd.lib.escapeSystemdExecArgs config.process.reloadCommand
+        else
+          "";
+      defaultText = lib.literalExpression "config.systemd.lib.escapeSystemdExecArgs config.process.reloadCommand";
+    };
+
    systemd.services = mkOption {
      description = ''
        This module configures systemd services, with the notable difference that their unit names will be prefixed with the abstract service name.
@@ -170,7 +212,10 @@ in
      # TODO description;
      wantedBy = lib.mkDefault [ "multi-user.target" ];
      serviceConfig = {
-        Type = lib.mkDefault "simple";
+        ExecReload = config.systemd.mainExecReload;
+        Type = lib.mkDefault (
+          if (config.serviceManager.notificationProtocol == "systemd") then "notify" else "simple"
+        );
        Restart = lib.mkDefault "always";
        RestartSec = lib.mkDefault "5";
        ExecStart = [
--- a/nixos/tests/nextcloud/default.nix
+++ b/nixos/tests/nextcloud/default.nix
@@ -149,5 +149,6 @@ listToAttrs (
  concatMap genTests [
    32
    33
+    34
  ]
 )
--- a/pkgs/applications/emulators/libretro/cores/atari800.nix
+++ b/pkgs/applications/emulators/libretro/cores/atari800.nix
@@ -5,13 +5,13 @@
 }:
 mkLibretroCore rec {
  core = "atari800";
-  version = "0-unstable-2026-05-28";
+  version = "0-unstable-2026-07-10";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "libretro-atari800";
-    rev = "b6638e72b9d7770144837b0b63c637dd7ab2b39c";
-    hash = "sha256-G1RJXhgMq8txotriK0Xy8HdDDCzeDbEQ+3LQ5sUt8G0=";
+    rev = "3f036fd69a0f0948d32a9a7cd97af3e0dd7ec434";
+    hash = "sha256-WnozEFNpW6qmSsQGTKzflitG6TVaozyOMcnAka+E1fE=";
  };

  makefile = "Makefile";
--- a/pkgs/applications/emulators/libretro/cores/beetle-psx.nix
+++ b/pkgs/applications/emulators/libretro/cores/beetle-psx.nix
@@ -8,13 +8,13 @@
 }:
 mkLibretroCore {
  core = "mednafen-psx" + lib.optionalString withHw "-hw";
-  version = "0-unstable-2026-07-01";
+  version = "0-unstable-2026-07-11";

  src = fetchFromGitHub {
    owner = "libretro";
    repo = "beetle-psx-libretro";
-    rev = "b84c0c11677ea76fcad1e8958b9d25863c43a88f";
-    hash = "sha256-oKdM++ZH9FCGLVEkkbWGvyjk80HDOraU2rdPG7Mcle0=";
+    rev = "004268513bb56655fff358b8caee88503a141776";
+    hash = "sha256-47US8cQ0efhlTao8aW31yOdK/aGtWikYAtsAjQi83y4=";
  };

  extraBuildInputs = lib.optionals withHw [
--- a/pkgs/applications/networking/instant-messengers/discord/linux.nix
+++ b/pkgs/applications/networking/instant-messengers/discord/linux.nix
@@ -222,7 +222,7 @@ stdenv.mkDerivation (finalAttrs: {

  dontUnpack = true;

-  inherit libPath;
+  inherit libPath stageModules;

  autoPatchelfIgnoreMissingDeps = [
    "libssl.so.1.1"
@@ -262,7 +262,7 @@ stdenv.mkDerivation (finalAttrs: {
        --prefix LD_LIBRARY_PATH : ${finalAttrs.libPath}:$out/opt/${binaryName}:${addDriverRunpath.driverLink}/lib \
        --suffix VK_ADD_DRIVER_FILES : "${addDriverRunpath.driverLink}/share/vulkan/icd.d" \
        ${lib.strings.optionalString disableUpdates "--run ${lib.getExe disableBreakingUpdates}"} \
-        --run "${stageModules} $out/opt/${binaryName}/modules" \
+        --run "${finalAttrs.stageModules} $out/opt/${binaryName}/modules" \
        --add-flags ${lib.escapeShellArg commandLineArgs}

    ln -s $out/opt/${binaryName}/${binaryName} $out/bin/
--- a/pkgs/applications/networking/instant-messengers/discord/sources.json
+++ b/pkgs/applications/networking/instant-messengers/discord/sources.json
--- a/pkgs/by-name/ab/abtop/package.nix
+++ b/pkgs/by-name/ab/abtop/package.nix
@@ -8,17 +8,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "abtop";
-  version = "0.5.1";
+  version = "0.5.3";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "graykode";
    repo = "abtop";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-2m0FYv2HouFqnmDaG6ounc8VJxlEK3N3uTBZyNiFwzI=";
+    hash = "sha256-LvN+q7JwmvtbroocoRBEug/J5OZTXwHEPAiaRkj16lM=";
  };

-  cargoHash = "sha256-0sAjql2pH41dHdmV0uC4jjj6J1OFjMdEY1B+4C4id3Y=";
+  cargoHash = "sha256-o5ZHURx+OAQkd7S0TzkLQG5ZsR5HMaqfl8sp639axbg=";

  doInstallCheck = true;
  nativeInstallCheckInputs = [ versionCheckHook ];
--- a/pkgs/by-name/ab/abuild/package.nix
+++ b/pkgs/by-name/ab/abuild/package.nix
@@ -17,14 +17,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "abuild";
-  version = "3.15.0";
+  version = "3.17.0";

  src = fetchFromGitLab {
    domain = "gitlab.alpinelinux.org";
    owner = "alpine";
    repo = "abuild";
    tag = finalAttrs.version;
-    hash = "sha256-vHRh36igfb6WZ8JdtxW8OOqgiVBAXreTy+QOOKaWEwA=";
+    hash = "sha256-CiKOvYEidpykufpEwZLvLys97VRhpEabiVEJ6NJexb4=";
  };

  buildInputs = [
@@ -84,7 +84,9 @@ stdenv.mkDerivation (finalAttrs: {
    done
  '';

-  passthru.updateScript = gitUpdater { };
+  passthru.updateScript = gitUpdater {
+    ignoredVersions = "_rc";
+  };

  meta = {
    description = "Alpine Linux build tools";
--- a/pkgs/by-name/ar/arandr/gzip-timestamp-fix.patch
+++ b/pkgs/by-name/ar/arandr/gzip-timestamp-fix.patch
@@ -1,7 +1,8 @@
--- setup.py	2025-04-01 11:24:54.530984662 +0000
-+++ setup.py	2025-04-01 13:54:46.961341548 +0000
- 
-@@ -111,9 +111,11 @@
+diff --git a/setup.py b/setup.py
+index 6e295c8..048db19 100755
+--- a/setup.py
+++ b/setup.py
+@@ -111,9 +111,11 @@ class build_man(NoOptionCommand):
                 info('compressing man page to %s', gzfile)
 
                 if not self.dry_run:
@@ -13,3 +14,6 @@
 +                            compressed.write(manpage)
 +                            compressed.close()
 +                            file.close()
+ 
+ class update_translator_credits(NoOptionCommand):
+     description = 'Examine the git history to produce an updated metadata file.'
--- a/pkgs/by-name/ar/arandr/package.nix
+++ b/pkgs/by-name/ar/arandr/package.nix
@@ -1,6 +1,7 @@
 {
  lib,
  fetchFromGitLab,
+  fetchpatch,
  python3Packages,
  gobject-introspection,
  gsettings-desktop-schemas,
@@ -30,9 +31,17 @@ buildPythonApplication (finalAttrs: {
    hash = "sha256-nQtfOKAnWKsy2DmvtRGJa4+Y9uGgX41BeHpd9m4d9YA=";
  };

-  # patch to set mtime=0 on setup.py
-  patches = [ ./gzip-timestamp-fix.patch ];
-  patchFlags = [ "-p0" ];
+  patches = [
+    # patch to set mtime=0 on setup.py
+    ./gzip-timestamp-fix.patch
+
+    # fixes build with setuptools 81+, while keeping it backwards compatible
+    (fetchpatch {
+      name = "arandr-0.1.11-setuptools-81.patch";
+      url = "https://gitweb.gentoo.org/repo/gentoo.git/plain/x11-misc/arandr/files/arandr-0.1.11-setuptools-81.patch";
+      hash = "sha256-b9U8b4rdkN5lWDVpv50szaVS0rAZVSy7q6IXNVLvq3A=";
+    })
+  ];

  nativeBuildInputs = [
    gobject-introspection
--- a/pkgs/by-name/at/atril/package.nix
+++ b/pkgs/by-name/at/atril/package.nix
@@ -88,6 +88,12 @@ stdenv.mkDerivation (finalAttrs: {

  enableParallelBuilding = true;

+  postInstall = ''
+    substituteInPlace $out/share/thumbnailers/atril.thumbnailer \
+      --replace-fail "TryExec=atril-thumbnailer" "TryExec=$out/bin/atril-thumbnailer" \
+      --replace-fail "Exec=atril-thumbnailer" "Exec=$out/bin/atril-thumbnailer"
+  '';
+
  passthru.updateScript = gitUpdater {
    rev-prefix = "v";
    odd-unstable = true;
--- a/pkgs/by-name/av/avrdude/package.nix
+++ b/pkgs/by-name/av/avrdude/package.nix
@@ -31,13 +31,13 @@ in

 stdenv.mkDerivation (finalAttrs: {
  pname = "avrdude";
-  version = "8.1";
+  version = "8.2";

  src = fetchFromGitHub {
    owner = "avrdudes";
    repo = "avrdude";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-i1q0NQKVd/wiOm1Amop3hW+FWuefFOQCCivuEtEH38k=";
+    sha256 = "sha256-wUKUlJYbBo3oBUs/hWWN2epj4ji/9gsOGr5wrF9kz34=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/br/brave/package.nix
+++ b/pkgs/by-name/br/brave/package.nix
@@ -3,24 +3,24 @@

 let
  pname = "brave";
-  version = "1.92.134";
+  version = "1.92.139";

  allArchives = {
    aarch64-linux = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_arm64.deb";
-      hash = "sha256-qo40t+PGl1RO2ajJ2Hev4G1FWvzTx7Ak5CVxjdxabLI=";
+      hash = "sha256-CkCpXgP4InjfjuhKqG66OjuZcqq7VLLK3/n+7fXpMj0=";
    };
    x86_64-linux = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-browser_${version}_amd64.deb";
-      hash = "sha256-T3A/ejmLkIRYGWc8GXQmvIAZvQFwYEyhQJxssNDalhQ=";
+      hash = "sha256-UFQV8iBsa6HdUhGGngpi341o41yRoenkxbG2M90O62A=";
    };
    aarch64-darwin = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-arm64.zip";
-      hash = "sha256-K1p5mAYfEDJNZFSmoOQV7kHNsA5RQuyUl3T2KVsNcbw=";
+      hash = "sha256-65qGzjXZfY5eTWbxTA9R3jN2F0CdkXnHXGVfw3spujo=";
    };
    x86_64-darwin = {
      url = "https://github.com/brave/brave-browser/releases/download/v${version}/brave-v${version}-darwin-x64.zip";
-      hash = "sha256-IrhvRVFZGLoGSVNy10ppFL9rEy7MRTb/HIhzspDsrs8=";
+      hash = "sha256-XPKKB/X8w5Neuxeluc5OFZVN1thqZ0Cf/pFTP4GY2/o=";
    };
  };

--- a/pkgs/by-name/co/codipack/package.nix
+++ b/pkgs/by-name/co/codipack/package.nix
@@ -9,13 +9,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "codipack";
-  version = "3.1.0";
+  version = "3.1.1";

  src = fetchFromGitHub {
    owner = "SciCompKL";
    repo = "CoDiPack";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-dHJvCR5IJ7Q/T94XcpbvXuXL41OrCNepqAmDVJ/7m6U=";
+    hash = "sha256-Xg87vpLiRuFqpKKKxmbf3TWjQRTbWWqYlH/Fku82Pak=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/co/cosmic-player/package.nix
+++ b/pkgs/by-name/co/cosmic-player/package.nix
@@ -72,6 +72,10 @@ rustPlatform.buildRustPackage (finalAttrs: {

  preFixup = ''
    libcosmicAppWrapperArgs+=(--prefix GST_PLUGIN_SYSTEM_PATH_1_0 : "$GST_PLUGIN_SYSTEM_PATH_1_0")
+
+    substituteInPlace $out/share/thumbnailers/com.system76.CosmicPlayer.thumbnailer \
+      --replace-fail "TryExec=cosmic-player" "TryExec=$out/bin/cosmic-player" \
+      --replace-fail "Exec=cosmic-player" "Exec=$out/bin/cosmic-player"
  '';

  passthru = {
--- a/pkgs/by-name/co/cosmic-reader/package.nix
+++ b/pkgs/by-name/co/cosmic-reader/package.nix
@@ -66,6 +66,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
    "target/${stdenv.hostPlatform.rust.cargoShortTarget}"
  ];

+  postInstall = ''
+    substituteInPlace $out/share/thumbnailers/com.system76.CosmicReader.thumbnailer \
+      --replace-fail "TryExec=cosmic-reader" "TryExec=$out/bin/cosmic-reader" \
+      --replace-fail "Exec=cosmic-reader" "Exec=$out/bin/cosmic-reader"
+  '';
+
  passthru.updateScript = nix-update-script {
    extraArgs = [
      "--version"
--- a/pkgs/by-name/cr/crosswords/package.nix
+++ b/pkgs/by-name/cr/crosswords/package.nix
@@ -45,6 +45,12 @@ stdenv.mkDerivation (finalAttrs: {
    libipuz
  ];

+  postInstall = ''
+    substituteInPlace $out/share/thumbnailers/crosswords.thumbnailer \
+      --replace-fail "TryExec=crosswords-thumbnailer" "TryExec=$out/bin/crosswords-thumbnailer" \
+      --replace-fail "Exec=crosswords-thumbnailer" "Exec=$out/bin/crosswords-thumbnailer"
+  '';
+
  passthru.updateScript = nix-update-script { };

  meta = {
--- a/pkgs/by-name/de/deputy/package.nix
+++ b/pkgs/by-name/de/deputy/package.nix
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "deputy";
-  version = "0.7.0";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "filiptibell";
    repo = "deputy";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-NBtVIe4ZMNiOgCoIbngk4ECqT0hwe7rsWye6QFJrdPg=";
+    hash = "sha256-OdIhRdJvuSlZoKO0bDVplbcASc0w7iO9b1FnY8Uf33o=";
  };

-  cargoHash = "sha256-ZwBWmOVFRAlWg+nmnzCue7F8XBhpuX+yp2PlEntB5Oo=";
+  cargoHash = "sha256-pnpL3hLaJRo3VJ9EK5ewYHu/2JJtkvd7VUFeMq0kJKQ=";

  nativeInstallCheckInputs = [ versionCheckHook ];
  doInstallCheck = true;
--- a/pkgs/by-name/di/dia/package.nix
+++ b/pkgs/by-name/di/dia/package.nix
@@ -98,6 +98,12 @@ stdenv.mkDerivation {
    gtk-mac-integration-gtk3
  ];

+  postInstall = ''
+    substituteInPlace $out/share/thumbnailers/org.gnome.Dia.thumbnailer \
+      --replace-fail "TryExec=dia" "TryExec=$out/bin/dia" \
+      --replace-fail "Exec=dia" "Exec=$out/bin/dia"
+  '';
+
  meta = {
    description = "Gnome Diagram drawing software";
    mainProgram = "dia";
--- a/pkgs/by-name/di/diffyml/package.nix
+++ b/pkgs/by-name/di/diffyml/package.nix
@@ -0,0 +1,58 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "diffyml";
+  version = "1.7.0";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "szhekpisov";
+    repo = "diffyml";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-DIKHvFY/eW3CAF/ojW+D737vFCcZk0peRrSb8I/an9Q=";
+  };
+
+  vendorHash = "sha256-QE/EwVzMqUO24ZAl0WBibGx6x0kNo1AUTZtfnQvX50k=";
+
+  # bench/compare and doc/gen-cli-ref are internal dev tools, not user-facing.
+  excludedPackages = [
+    "bench/compare"
+    "doc/gen-cli-ref"
+  ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X main.version=${finalAttrs.version}"
+    "-X main.commit=v${finalAttrs.version}"
+    "-X main.buildDate=1970-01-01"
+  ];
+
+  # test/ holds e2e (kind/kubectl) and repo-health suites that need network
+  # and external tooling; unsuitable for the sandboxed build.
+  preCheck = ''
+    rm -rf test
+  '';
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+  doInstallCheck = true;
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Structural YAML diff tool with Kubernetes awareness and CI-friendly output";
+    homepage = "https://szhekpisov.github.io/diffyml/";
+    downloadPage = "https://github.com/szhekpisov/diffyml";
+    changelog = "https://github.com/szhekpisov/diffyml/releases/tag/v${finalAttrs.version}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ szhekpisov ];
+    mainProgram = "diffyml";
+  };
+})
--- a/pkgs/by-name/el/elogind/errno-list-filter-out-EFSBADCRC-and-EFSCORRUPTED.patch
+++ b/pkgs/by-name/el/elogind/errno-list-filter-out-EFSBADCRC-and-EFSCORRUPTED.patch
@@ -0,0 +1,34 @@
+From: Yu Watanabe <watanabe.yu+github@gmail.com>
+Date: Tue, 24 Feb 2026 20:19:45 +0900
+Subject: errno-list: filter out EFSBADCRC and EFSCORRUPTED
+
+These are introduced in kernel v7.0.
+
+(cherry picked from commit 3cfb16998808a6ec8012a6120d0a82f0e1a0c8bb)
+(cherry picked from commit f870952f69c453aeef0b4022d32bba4769d84238)
+(cherry picked from commit 73e2fa308cfa49f599e104e599e1a479fd3d21e3)
+---
+ src/basic/generate-errno-list.sh | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/src/basic/generate-errno-list.sh b/src/basic/generate-errno-list.sh
+index f756b2e..491fa1b 100755
+--- a/src/basic/generate-errno-list.sh
+++ b/src/basic/generate-errno-list.sh
+@@ -3,9 +3,13 @@
+ set -eu
+ set -o pipefail
+
+-# In kernel's arch/parisc/include/uapi/asm/errno.h, ECANCELLED and EREFUSED are defined as aliases of
+-# ECANCELED and ECONNREFUSED, respectively. Let's drop them.
+# In kernel's arch/parisc/include/uapi/asm/errno.h, The following aliases are defined:
+# ECANCELLED → ECANCELED
+# EREFUSED → ECONNREFUSED
+# EFSBADCRC → EBADMSG
+# EFSCORRUPTED → EUCLEAN
+# Let's drop them.
+
+ ${1:?} -dM -include errno.h - </dev/null | \
+-       grep -Ev '^#define[[:space:]]+(ECANCELLED|EREFUSED)' | \
+       grep -Ev '^#define[[:space:]]+(ECANCELLED|EREFUSED|EFSBADCRC|EFSCORRUPTED)' | \
+        awk '/^#define[ \t]+E[^ _]+[ \t]+/ { print $2; }'
--- a/pkgs/by-name/el/elogind/package.nix
+++ b/pkgs/by-name/el/elogind/package.nix
@@ -136,6 +136,7 @@ stdenv.mkDerivation (finalAttrs: {
    })
    ./Add-missing-musl_missing.h-includes-for-basename.patch
    ./Remove-outdated-musl-hack-in-rlimit_nofile_safe.patch
+    ./errno-list-filter-out-EFSBADCRC-and-EFSCORRUPTED.patch
  ];

  # Inspired by the systemd `preConfigure`.
--- a/pkgs/by-name/es/eslint/package-lock.json
+++ b/pkgs/by-name/es/eslint/package-lock.json
@@ -1,12 +1,12 @@
 {
  "name": "eslint",
-  "version": "10.6.0",
+  "version": "10.7.0",
  "lockfileVersion": 3,
  "requires": true,
  "packages": {
    "": {
      "name": "eslint",
-      "version": "10.6.0",
+      "version": "10.7.0",
      "license": "MIT",
      "workspaces": [
        "packages/*"
@@ -51,8 +51,8 @@
        "@babel/core": "^7.4.3",
        "@babel/preset-env": "^7.4.3",
        "@cypress/webpack-preprocessor": "^6.0.2",
-        "@eslint/eslintrc": "^3.3.5",
-        "@eslint/json": "^2.0.0",
+        "@eslint/eslintrc": "^3.3.6",
+        "@eslint/json": "^2.0.1",
        "@types/esquery": "^1.5.4",
        "@types/node": "^22.13.14",
        "@typescript-eslint/parser": "^8.58.2",
@@ -94,7 +94,7 @@
        "mocha": "^11.7.1",
        "node-polyfill-webpack-plugin": "^1.0.3",
        "npm-license": "^0.3.3",
-        "prettier": "3.8.4",
+        "prettier": "3.9.4",
        "progress": "^2.0.3",
        "proxyquire": "^2.0.1",
        "regenerator-runtime": "^0.14.0",
@@ -128,13 +128,13 @@
      "dev": true
    },
    "node_modules/@arethetypeswrong/cli": {
-      "version": "0.18.4",
-      "resolved": "https://registry.npmjs.org/@arethetypeswrong/cli/-/cli-0.18.4.tgz",
-      "integrity": "sha512-kNWo6LTzGAuLYPpJ7Sgo63whSUeeSuKMlYx6IBgzs4ONEG807gW4hSSENvpeCHzO2H2wIzG5EFl0OKBbqGBAyA==",
+      "version": "0.18.5",
+      "resolved": "https://registry.npmjs.org/@arethetypeswrong/cli/-/cli-0.18.5.tgz",
+      "integrity": "sha512-gM+8vRsQOD/Uc7EnBedUhkG5OCsDWE4uoak5QvomGpMpaky0Eh41p04nIMgrWb8EOmqZUJGc6zz9hsP6E56R7g==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@arethetypeswrong/core": "0.18.4",
+        "@arethetypeswrong/core": "0.18.5",
        "chalk": "^4.1.2",
        "cli-table3": "^0.6.3",
        "commander": "^10.0.1",
@@ -163,9 +163,9 @@
      }
    },
    "node_modules/@arethetypeswrong/core": {
-      "version": "0.18.4",
-      "resolved": "https://registry.npmjs.org/@arethetypeswrong/core/-/core-0.18.4.tgz",
-      "integrity": "sha512-M5F0ePyN6h2Z6XxRiyIPqjGbltotXLjR0CKA0uKspsDu0QmgTNYvRb4RSQPMUs2ZXZHCCYpbaZbFbYOXLxCjUA==",
+      "version": "0.18.5",
+      "resolved": "https://registry.npmjs.org/@arethetypeswrong/core/-/core-0.18.5.tgz",
+      "integrity": "sha512-9ytjzGwxjm9Uz7I9avfbt5vlQt6uk9uRRESzJjqrznl6WKvI6dwYTo+vJ3U02Wrq/mR3iql/PzhvHhKdJIAjDQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -2185,9 +2185,9 @@
      }
    },
    "node_modules/@eslint-community/eslint-plugin-eslint-comments/node_modules/ignore": {
-      "version": "7.0.5",
-      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
-      "integrity": "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==",
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.6.tgz",
+      "integrity": "sha512-BAg6QkE8W+TuQLrrw0Ugr7HegXduRuuj8/ti2kSOc+jz1dmx8/WNcjr6XGnq5YpDWxFwwaavqD0+jIUOKelTsw==",
      "license": "MIT",
      "engines": {
        "node": ">= 4"
@@ -2271,9 +2271,9 @@
      }
    },
    "node_modules/@eslint/eslintrc": {
-      "version": "3.3.5",
-      "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.5.tgz",
-      "integrity": "sha512-4IlJx0X0qftVsN5E+/vGujTRIFtwuLbNsVUe7TO6zYPDR1O6nFwvwhIKEKSrl6dZchmYBITazxKoUYOjdtjlRg==",
+      "version": "3.3.6",
+      "resolved": "https://registry.npmjs.org/@eslint/eslintrc/-/eslintrc-3.3.6.tgz",
+      "integrity": "sha512-l2Ul9PrHsPCKcEY/ac7VgFj9D80C7S68sOKc618SyHDPK36s1XcFebXY0iTzUVn4Yq+YbwvSnDmCz9yxjX+QrA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -2283,7 +2283,7 @@
        "globals": "^14.0.0",
        "ignore": "^5.2.0",
        "import-fresh": "^3.2.1",
-        "js-yaml": "^4.1.1",
+        "js-yaml": "^4.3.0",
        "minimatch": "^3.1.5",
        "strip-json-comments": "^3.1.1"
      },
@@ -2302,9 +2302,9 @@
      "license": "MIT"
    },
    "node_modules/@eslint/eslintrc/node_modules/brace-expansion": {
-      "version": "1.1.15",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.15.tgz",
-      "integrity": "sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==",
+      "version": "1.1.16",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz",
+      "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -2374,14 +2374,14 @@
      "link": true
    },
    "node_modules/@eslint/json": {
-      "version": "2.0.0",
-      "resolved": "https://registry.npmjs.org/@eslint/json/-/json-2.0.0.tgz",
-      "integrity": "sha512-P32ZJMIopNWQd1SFhd0tgjfA/hgzUuVSqHmMi2273QaLWHWimXq6V+qL4DNKnjGzO/aNECtYW+rEJ/pWB6uP+w==",
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/@eslint/json/-/json-2.0.1.tgz",
+      "integrity": "sha512-Thz2j92ceUF3Bq/0TuWb3MWn3Z+Cwc8k5ptF0fakl2D4Mp8mSx07Xr1aQM4R5NoihzarWUdxfOmQ8DesGy4jOg==",
      "dev": true,
      "license": "Apache-2.0",
      "dependencies": {
        "@eslint/core": "^1.2.1",
-        "@eslint/plugin-kit": "^0.7.1",
+        "@eslint/plugin-kit": "^0.7.2",
        "@humanwhocodes/momoa": "^3.3.10",
        "natural-compare": "^1.4.0"
      },
@@ -3718,9 +3718,9 @@
      "license": "MIT"
    },
    "node_modules/@types/node": {
-      "version": "22.20.0",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.20.0.tgz",
-      "integrity": "sha512-QWlFW2wf3nTjC13/DqRnBpR4ZO36VJH/JVBkA/vcnmbTBNQIlnObqyqZE1tUR7+Ni23Lda8R1BxMfbXRpCUx5g==",
+      "version": "22.20.1",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-22.20.1.tgz",
+      "integrity": "sha512-EANqOCF9QFyra+4pfxUcX9STKJpCLjMbObVzljIJomAWSnuSIEAvyzEU53GaajbXJEgdh0iEcPL+DGvpUd4k1Q==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -3777,16 +3777,16 @@
      }
    },
    "node_modules/@typescript-eslint/parser": {
-      "version": "8.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.62.0.tgz",
-      "integrity": "sha512-dzHeT2gySzZtLDsuqxU9AkYgIsQoHAHtRBpOqM+Ofzx1Bwrd2RcCjQJ+6iQbsHOIR6NS33bF2W1k3blN1zLDrA==",
+      "version": "8.63.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/parser/-/parser-8.63.0.tgz",
+      "integrity": "sha512-gwh4gvvlaVDKKxyfxMG+Gnu1u9X0OQBwyGLkbwB65dIzBKnxeRiJlNFqlI3zwVhNXJIs6qV7mlFCn/BIajlVig==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/scope-manager": "8.62.0",
-        "@typescript-eslint/types": "8.62.0",
-        "@typescript-eslint/typescript-estree": "8.62.0",
-        "@typescript-eslint/visitor-keys": "8.62.0",
+        "@typescript-eslint/scope-manager": "8.63.0",
+        "@typescript-eslint/types": "8.63.0",
+        "@typescript-eslint/typescript-estree": "8.63.0",
+        "@typescript-eslint/visitor-keys": "8.63.0",
        "debug": "^4.4.3"
      },
      "engines": {
@@ -3802,14 +3802,14 @@
      }
    },
    "node_modules/@typescript-eslint/project-service": {
-      "version": "8.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.62.0.tgz",
-      "integrity": "sha512-wexnCqiTg7BOGtbLDftYpRWlmLq4xfoMd7BKFR6Y75sZS3QmRKLdN3yWLhmIYgqMmP/OXWpj3H8odkb5nGURCQ==",
+      "version": "8.63.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/project-service/-/project-service-8.63.0.tgz",
+      "integrity": "sha512-e5dh0/UI0ok53AlZ5wRkXCB32z/f2jUZqPR/ygAw5WYaSw8j9EoJWlS7wQjr/dmOaqWjnPIn2m+HhVPCMWGZVQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/tsconfig-utils": "^8.62.0",
-        "@typescript-eslint/types": "^8.62.0",
+        "@typescript-eslint/tsconfig-utils": "^8.63.0",
+        "@typescript-eslint/types": "^8.63.0",
        "debug": "^4.4.3"
      },
      "engines": {
@@ -3824,14 +3824,14 @@
      }
    },
    "node_modules/@typescript-eslint/scope-manager": {
-      "version": "8.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.62.0.tgz",
-      "integrity": "sha512-1lX38kNxXIRb8mEc3lbq5mdHq1Pf2+U0nFU65KfT18mtPxxl0fvjuEE92mHuXPuCtElJhOrddOpyMlM3Z0umEA==",
+      "version": "8.63.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/scope-manager/-/scope-manager-8.63.0.tgz",
+      "integrity": "sha512-uUyfMWCnDSN8bCpcrY8nGP2BLkQ9Xn0GsipcONcpIDWhwhO4ZSyHvyS14U3X75mzxWxL3I2UZIrenTzdzcJO8A==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/types": "8.62.0",
-        "@typescript-eslint/visitor-keys": "8.62.0"
+        "@typescript-eslint/types": "8.63.0",
+        "@typescript-eslint/visitor-keys": "8.63.0"
      },
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -3842,9 +3842,9 @@
      }
    },
    "node_modules/@typescript-eslint/tsconfig-utils": {
-      "version": "8.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.62.0.tgz",
-      "integrity": "sha512-y2GAdB6ykaXUvuspbYnizQc4oDDz0Tz/Yc7iWrXf9mx8vm/L/0vLHCe0tS2boG96Zy+DivnVDQ9ZUEWoHqqx1g==",
+      "version": "8.63.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/tsconfig-utils/-/tsconfig-utils-8.63.0.tgz",
+      "integrity": "sha512-sUAbkulqBAsncKnbRP3+7CtQFRKicexnj7ZwNC6ddCR7EmrXvjvdCYMJbUIqMd6lwoEriZjwLo08aS5tSjVMHg==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -3859,9 +3859,9 @@
      }
    },
    "node_modules/@typescript-eslint/types": {
-      "version": "8.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.62.0.tgz",
-      "integrity": "sha512-KvAclkktORPvM54TgLgA4z9HIV1M8zOgw9ZVNXl9f/8dLYfXYX1wkMXP7qmabpijQRV5bHJLOmoyGQbLMaUYeg==",
+      "version": "8.63.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/types/-/types-8.63.0.tgz",
+      "integrity": "sha512-xyLtl9DUBBFrcJS4x2pIqGLH68/tC2uOa4Z7pUteW09D3bXnnXUom4dyPikzWgB7llmIc1zoeI3aoUdC4rPK/Q==",
      "license": "MIT",
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -3872,16 +3872,16 @@
      }
    },
    "node_modules/@typescript-eslint/typescript-estree": {
-      "version": "8.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.62.0.tgz",
-      "integrity": "sha512-+hVbNxtW64pIcZWDPGbyaKF7vp2IBTVY5ma1blwwksrjdsbdqqEKvJWMGbBofei4F6Dovx1M0RJgoFeNu2279A==",
+      "version": "8.63.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/typescript-estree/-/typescript-estree-8.63.0.tgz",
+      "integrity": "sha512-ygBkU+B7ex5UI/gKhaqexWev79uISfIv7XQCRNYO/jmD8rGLPyWLAb3KMRT6nd8Gt9bmUBi9+iX6tBdYfOY81Q==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/project-service": "8.62.0",
-        "@typescript-eslint/tsconfig-utils": "8.62.0",
-        "@typescript-eslint/types": "8.62.0",
-        "@typescript-eslint/visitor-keys": "8.62.0",
+        "@typescript-eslint/project-service": "8.63.0",
+        "@typescript-eslint/tsconfig-utils": "8.63.0",
+        "@typescript-eslint/types": "8.63.0",
+        "@typescript-eslint/visitor-keys": "8.63.0",
        "debug": "^4.4.3",
        "minimatch": "^10.2.2",
        "semver": "^7.7.3",
@@ -3900,16 +3900,16 @@
      }
    },
    "node_modules/@typescript-eslint/utils": {
-      "version": "8.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.62.0.tgz",
-      "integrity": "sha512-82r66fi9zYwZ+mTq3vKgwjbZ1PVk/DJzrXFLpG6RnBbdvH8TEGVHIs9H4d2drhkOzf0syZuD/OZvvlu6GDbP4g==",
+      "version": "8.63.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/utils/-/utils-8.63.0.tgz",
+      "integrity": "sha512-fUKaeAvrTuQg/Tgt3nliAUSZHJM6DlCcfyEmxCvlX8kieWSStBX+5O5Fnidtc3i2JrH+9c/GL4RY2iasd/GPTA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
        "@eslint-community/eslint-utils": "^4.9.1",
-        "@typescript-eslint/scope-manager": "8.62.0",
-        "@typescript-eslint/types": "8.62.0",
-        "@typescript-eslint/typescript-estree": "8.62.0"
+        "@typescript-eslint/scope-manager": "8.63.0",
+        "@typescript-eslint/types": "8.63.0",
+        "@typescript-eslint/typescript-estree": "8.63.0"
      },
      "engines": {
        "node": "^18.18.0 || ^20.9.0 || >=21.1.0"
@@ -3924,13 +3924,13 @@
      }
    },
    "node_modules/@typescript-eslint/visitor-keys": {
-      "version": "8.62.0",
-      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.62.0.tgz",
-      "integrity": "sha512-CY3uyFSRbcQv3nnSv8S0+lDftMVz6P963PoRlxrV7ew/Md564g9ut60PYzdLM5qW4jFn93GBF+Soi90ISAN+GQ==",
+      "version": "8.63.0",
+      "resolved": "https://registry.npmjs.org/@typescript-eslint/visitor-keys/-/visitor-keys-8.63.0.tgz",
+      "integrity": "sha512-UexrHGnGTpbuQHct2ExOc2ZcFbGUS9FOesCxxqdBGcpI1BxYu/LZ6U8Aq6/72XtF/qRBk9nhuGHFJIXXMhPMdw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "@typescript-eslint/types": "8.62.0",
+        "@typescript-eslint/types": "8.63.0",
        "eslint-visitor-keys": "^5.0.0"
      },
      "engines": {
@@ -4420,9 +4420,9 @@
      }
    },
    "node_modules/asn1.js/node_modules/bn.js": {
-      "version": "4.12.4",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.4.tgz",
-      "integrity": "sha512-njR1b+ixG2ufvL9Zn9JGneW+b5GV6jqpYyPPpg4QVt723b5kJPGUczkUyWEH9BwEA74UakJZ43I4FDLBF7ci0g==",
+      "version": "4.12.5",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.5.tgz",
+      "integrity": "sha512-3aRg6/JxfffFD+OlOjOFR3Vo79l39ooBTFucxx+MT3dhCtzn3EmiUPQo+6/OZuI2jbXi3YKgmiTFBgChQMwIRQ==",
      "dev": true,
      "license": "MIT"
    },
@@ -4650,9 +4650,9 @@
      "license": "MIT"
    },
    "node_modules/baseline-browser-mapping": {
-      "version": "2.10.40",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.40.tgz",
-      "integrity": "sha512-BSSLZ9/Cjjv7Gtj5B68ZzXcXUg8iOf3fme+FCuh8rC/Go+Kmh8cox7M3A8dolou16s64QjLPOSdngh7GxXvkSw==",
+      "version": "2.10.42",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.10.42.tgz",
+      "integrity": "sha512-c/jurFrDLyui7o1J86yLkRu4LMsTYcBohveus7/I2Hzdn9KIP2bdJPTue/lR1KH46enoPbD77GKeSYNdyPoD3Q==",
      "license": "Apache-2.0",
      "bin": {
        "baseline-browser-mapping": "dist/cli.cjs"
@@ -4706,9 +4706,9 @@
      "license": "MIT"
    },
    "node_modules/bn.js": {
-      "version": "5.2.4",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-5.2.4.tgz",
-      "integrity": "sha512-QL7sb18rJ1PbdsKsqPA0guxL563vIMwRHgzNrW/uzQuRGN1Cjqd/wonUBAVqHox9KwzHA6vCbM0lXx3k4iQMow==",
+      "version": "5.2.5",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-5.2.5.tgz",
+      "integrity": "sha512-Vq886eXykuP5E6HcKSSStP3bJgrE6In5WKxVUvJ8XGpWWYs2xZHWqUwzCtGgEtBcxyd57KBFDPFoUfNzdaHCNg==",
      "dev": true,
      "license": "MIT"
    },
@@ -4892,9 +4892,9 @@
      }
    },
    "node_modules/browserslist": {
-      "version": "4.28.4",
-      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.4.tgz",
-      "integrity": "sha512-MTc8i/x9jBQd1iMw2CFGS+rwMa07eYjLR0CCTLDACl9xhxy+nIs3KeML/biicXtk9JrZ6dnnTatmc7ErPXIxqw==",
+      "version": "4.28.5",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.28.5.tgz",
+      "integrity": "sha512-Cu2E6QejHWzuDMTkuwgpABFgDfZrXLQq5V13YOACZx4mFAG4IwGTbTfHPMr4WtxlHoXSM8FIuRwYYCz5XiabaQ==",
      "funding": [
        {
          "type": "opencollective",
@@ -4911,10 +4911,10 @@
      ],
      "license": "MIT",
      "dependencies": {
-        "baseline-browser-mapping": "^2.10.38",
-        "caniuse-lite": "^1.0.30001799",
-        "electron-to-chromium": "^1.5.376",
-        "node-releases": "^2.0.48",
+        "baseline-browser-mapping": "^2.10.42",
+        "caniuse-lite": "^1.0.30001800",
+        "electron-to-chromium": "^1.5.387",
+        "node-releases": "^2.0.50",
        "update-browserslist-db": "^1.2.3"
      },
      "bin": {
@@ -5139,9 +5139,9 @@
      }
    },
    "node_modules/caniuse-lite": {
-      "version": "1.0.30001799",
-      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001799.tgz",
-      "integrity": "sha512-hG1bReV+OUU+MOqK4t/ZWI0tZOyz3rqS9XuhOUz1cIcbwBKjOyJEJuw9ER5JuNyqxNk8u/JUVbGibBOL1yrjFw==",
+      "version": "1.0.30001803",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001803.tgz",
+      "integrity": "sha512-g/uHREV2ZpK9qMalCsWaxmA6ol+DX8GYhuf3T40RKoP+oL7vhRJh8LNt73PCjpnR6l14FzfPrB5Yux4PKm2meg==",
      "funding": [
        {
          "type": "opencollective",
@@ -5934,9 +5934,9 @@
      }
    },
    "node_modules/create-ecdh/node_modules/bn.js": {
-      "version": "4.12.4",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.4.tgz",
-      "integrity": "sha512-njR1b+ixG2ufvL9Zn9JGneW+b5GV6jqpYyPPpg4QVt723b5kJPGUczkUyWEH9BwEA74UakJZ43I4FDLBF7ci0g==",
+      "version": "4.12.5",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.5.tgz",
+      "integrity": "sha512-3aRg6/JxfffFD+OlOjOFR3Vo79l39ooBTFucxx+MT3dhCtzn3EmiUPQo+6/OZuI2jbXi3YKgmiTFBgChQMwIRQ==",
      "dev": true,
      "license": "MIT"
    },
@@ -6486,9 +6486,9 @@
      }
    },
    "node_modules/diffie-hellman/node_modules/bn.js": {
-      "version": "4.12.4",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.4.tgz",
-      "integrity": "sha512-njR1b+ixG2ufvL9Zn9JGneW+b5GV6jqpYyPPpg4QVt723b5kJPGUczkUyWEH9BwEA74UakJZ43I4FDLBF7ci0g==",
+      "version": "4.12.5",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.5.tgz",
+      "integrity": "sha512-3aRg6/JxfffFD+OlOjOFR3Vo79l39ooBTFucxx+MT3dhCtzn3EmiUPQo+6/OZuI2jbXi3YKgmiTFBgChQMwIRQ==",
      "dev": true,
      "license": "MIT"
    },
@@ -6593,9 +6593,9 @@
      }
    },
    "node_modules/electron-to-chromium": {
-      "version": "1.5.380",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.380.tgz",
-      "integrity": "sha512-W6d5AbuEoRayO447cqrg6lKJIlscgRnnxOZl/08kfV71BQDoEBC7Wwis68z87LjyK6f4kWyTaubuDbhHKrZkbA==",
+      "version": "1.5.389",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.389.tgz",
+      "integrity": "sha512-cEto7aeOqBfU1D+c5py5pE+ooscKE75JifxLBdFUZsqAxRS6y7kebtxAZvICszSl05gPjYHDTjY+lXpyGvpJbg==",
      "license": "ISC"
    },
    "node_modules/elliptic": {
@@ -6615,9 +6615,9 @@
      }
    },
    "node_modules/elliptic/node_modules/bn.js": {
-      "version": "4.12.4",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.4.tgz",
-      "integrity": "sha512-njR1b+ixG2ufvL9Zn9JGneW+b5GV6jqpYyPPpg4QVt723b5kJPGUczkUyWEH9BwEA74UakJZ43I4FDLBF7ci0g==",
+      "version": "4.12.5",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.5.tgz",
+      "integrity": "sha512-3aRg6/JxfffFD+OlOjOFR3Vo79l39ooBTFucxx+MT3dhCtzn3EmiUPQo+6/OZuI2jbXi3YKgmiTFBgChQMwIRQ==",
      "dev": true,
      "license": "MIT"
    },
@@ -6670,9 +6670,9 @@
      }
    },
    "node_modules/enhanced-resolve": {
-      "version": "5.24.1",
-      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.24.1.tgz",
-      "integrity": "sha512-7DdUaTjmNwMcH2gLr1qycesKII3BK4RLy/mdAb7x10Lq7bR4aNKHt1BR1ZALSv0rPM/hF5wYF0PhGop/rJm8vw==",
+      "version": "5.24.2",
+      "resolved": "https://registry.npmjs.org/enhanced-resolve/-/enhanced-resolve-5.24.2.tgz",
+      "integrity": "sha512-rpsZEGT1jFuve6QlpyRp9ckQ+kN61hvF9BzCPyMdaKTm8UJce96KBn3sorXOFXlzjPrs3Vc4T1NsSroZ3PxlFw==",
      "license": "MIT",
      "dependencies": {
        "graceful-fs": "^4.2.4",
@@ -6770,9 +6770,9 @@
      }
    },
    "node_modules/es-module-lexer": {
-      "version": "2.2.0",
-      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.2.0.tgz",
-      "integrity": "sha512-3lGxdTXCLfe1MYfTz1y2ksAAUM4NAOP6rPEjxGJVKO7TZ5+tvHCaQWGpC4Y3IXvW3ece0Cz1cIP4FWBxOnGCTQ==",
+      "version": "2.3.0",
+      "resolved": "https://registry.npmjs.org/es-module-lexer/-/es-module-lexer-2.3.0.tgz",
+      "integrity": "sha512-KLdwQm2NvGLDkQDCGvmiQrhkd0JbMzXthwQAUgWjQuQdBLFa3eiBP5arXZyA+f8x+x7OXgud6bq2rxjGtHV2tw==",
      "dev": true,
      "license": "MIT"
    },
@@ -6887,9 +6887,9 @@
      }
    },
    "node_modules/eslint-plugin-eslint-plugin": {
-      "version": "7.4.0",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-eslint-plugin/-/eslint-plugin-eslint-plugin-7.4.0.tgz",
-      "integrity": "sha512-yLFVy13SVSgGWiufaB3lGIUef6dmjBTrfYdFD0xPxBSHdrfyIonl3zGszesOXS2iYy/iVPd5ZLBKryS12s0Scg==",
+      "version": "7.4.1",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-eslint-plugin/-/eslint-plugin-eslint-plugin-7.4.1.tgz",
+      "integrity": "sha512-qDn/je8VILWFpaDh2FAnQcvoLQmt3q0QWsBkjHF8OiECgvRWhMLazDS4igVnjxCf8GYdZCMs/SxAgYC/HjaVtQ==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -6924,9 +6924,9 @@
      }
    },
    "node_modules/eslint-plugin-expect-type/node_modules/fs-extra": {
-      "version": "11.3.5",
-      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.5.tgz",
-      "integrity": "sha512-eKpRKAovdpZtR1WopLHxlBWvAgPny3c4gX1G5Jhwmmw4XJj0ifSD5qB5TOo8hmA0wlRKDAOAhEE1yVPgs6Fgcg==",
+      "version": "11.3.6",
+      "resolved": "https://registry.npmjs.org/fs-extra/-/fs-extra-11.3.6.tgz",
+      "integrity": "sha512-w8ZNZr2mKIc7qeNaQ9AVPT1+iFaI+Avd4xudVOvdDJ8VytREi1Ft5Ih7hd9jjehod8vAM5GMsfQ/TpPf4EyoEA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -7457,9 +7457,9 @@
      "license": "MIT"
    },
    "node_modules/fast-uri": {
-      "version": "3.1.2",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.2.tgz",
-      "integrity": "sha512-rVjf7ArG3LTk+FS6Yw81V1DLuZl1bRbNrev6Tmd/9RaroeeRRJhAt7jg/6YFxbvAQXUCavSoZhPPj6oOx+5KjQ==",
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.3.tgz",
+      "integrity": "sha512-i70LwGWUduXqzicKXWshooq+sWL1K3WUU5rKZNG/0i3a1OSoX3HqhH5WbWwTmqWfor4urUakGPiRQcleRZTwOg==",
      "dev": true,
      "funding": [
        {
@@ -7604,9 +7604,9 @@
      "license": "MIT"
    },
    "node_modules/filelist/node_modules/brace-expansion": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.1.tgz",
-      "integrity": "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==",
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz",
+      "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -8125,9 +8125,9 @@
      "license": "MIT"
    },
    "node_modules/glob/node_modules/brace-expansion": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.1.tgz",
-      "integrity": "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==",
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz",
+      "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -8200,9 +8200,9 @@
      }
    },
    "node_modules/globby/node_modules/ignore": {
-      "version": "7.0.5",
-      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.5.tgz",
-      "integrity": "sha512-Hs59xBNfUIunMFgWAbGX5cq6893IbWg4KnrjbYwX3tx0ztorVgTDA6B2sxf8ejHJ4wz8BqGUMYlnzNBer5NvGg==",
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/ignore/-/ignore-7.0.6.tgz",
+      "integrity": "sha512-BAg6QkE8W+TuQLrrw0Ugr7HegXduRuuj8/ti2kSOc+jz1dmx8/WNcjr6XGnq5YpDWxFwwaavqD0+jIUOKelTsw==",
      "dev": true,
      "license": "MIT",
      "engines": {
@@ -8715,17 +8715,22 @@
      }
    },
    "node_modules/install-artifact-from-github": {
-      "version": "1.6.0",
-      "resolved": "https://registry.npmjs.org/install-artifact-from-github/-/install-artifact-from-github-1.6.0.tgz",
-      "integrity": "sha512-wKsuzN8fy8QK7iEUqyWTQmvZ1QFGPn1xyl3/1iIIDthDjS7Hn9HoPwHlNakZirWbCsbad0lZMkr6Xfbpe1pUzw==",
+      "version": "1.7.0",
+      "resolved": "https://registry.npmjs.org/install-artifact-from-github/-/install-artifact-from-github-1.7.0.tgz",
+      "integrity": "sha512-qAb91yAKVF9rFY4rVP21ZtYUyCScxAFt9udwzVWNLBE1pQcdQeB2gd1HlNPcQNYCzCDvJ/QJQPuWQ6aTmSlU8g==",
      "dev": true,
      "license": "BSD-3-Clause",
      "bin": {
+        "hash-github-cache": "bin/hash-github-cache.js",
        "install-from-cache": "bin/install-from-cache.js",
        "save-to-github-cache": "bin/save-to-github-cache.js"
      },
      "engines": {
        "node": ">=18"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/uhop"
      }
    },
    "node_modules/interpret": {
@@ -9468,9 +9473,9 @@
      }
    },
    "node_modules/jsdom/node_modules/tough-cookie": {
-      "version": "6.0.1",
-      "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-6.0.1.tgz",
-      "integrity": "sha512-LktZQb3IeoUWB9lqR5EWTHgW/VTITCXg4D21M+lvybRVdylLrRMnqaIONLVb5mav8vM19m44HIcGq4qASeu2Qw==",
+      "version": "6.0.2",
+      "resolved": "https://registry.npmjs.org/tough-cookie/-/tough-cookie-6.0.2.tgz",
+      "integrity": "sha512-exgYmnmL/sJpR3upZfXG5PoatXQii55xAiXGXzY+sROLZ/Y+SLcp9PgJNI9Vz37HpQ74WvDcLT8eqm+kV3FzrA==",
      "dev": true,
      "license": "BSD-3-Clause",
      "dependencies": {
@@ -9654,9 +9659,9 @@
      }
    },
    "node_modules/knip": {
-      "version": "6.23.0",
-      "resolved": "https://registry.npmjs.org/knip/-/knip-6.23.0.tgz",
-      "integrity": "sha512-2DvAOX2pZWiG4SLvRRxOAU0aWGEn1ZoVblI541xIoXFdHqq2THMZXy66/qcY5WGuW3TXhb9T1x1zd/Hd1u+yqg==",
+      "version": "6.26.0",
+      "resolved": "https://registry.npmjs.org/knip/-/knip-6.26.0.tgz",
+      "integrity": "sha512-e9eELEEpBpGTd4H4HB7818/DYj9dMzMyUqAddfYwUN/EbSkgIjOuWEF96W/xHsmV0SDrsdXjIM+oZ2xpPzPsBA==",
      "dev": true,
      "funding": [
        {
@@ -9746,9 +9751,9 @@
      "license": "MIT"
    },
    "node_modules/linkify-it": {
-      "version": "5.0.1",
-      "resolved": "https://registry.npmjs.org/linkify-it/-/linkify-it-5.0.1.tgz",
-      "integrity": "sha512-wVoTjP4Q6R0NW5hiZkVJaFZPWgtXfoGF+6LucL3/FtiNjmcHhYjEr5f1Kqjirc1nBW07J/ZuRFumqr2oqccEWg==",
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/linkify-it/-/linkify-it-5.0.2.tgz",
+      "integrity": "sha512-ONTm2jCMAVZjgQa/Fy1kScXsuOoF5NPTsoFBdE1KVIZ2vAh/r9+Bqo+0jINCBYnavTPQZz38QzFTme79ENoN3Q==",
      "dev": true,
      "funding": [
        {
@@ -10168,9 +10173,9 @@
      }
    },
    "node_modules/lru-cache": {
-      "version": "11.5.1",
-      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.1.tgz",
-      "integrity": "sha512-RPimw/7aMdv2oqRrxKwvZXcPfwBrn/JZ2xYcY9Hus/6LaS3VOAKVWKWgNLCFSiOm1ESXinjsDlidVU7JlnCN2A==",
+      "version": "11.5.2",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.2.tgz",
+      "integrity": "sha512-4pfM1Ff0x50o0tQwb5ucw/RzNyD0/YJME6IVcStalZuMWxdt3sR3huStTtxz4PUmvZfRguvDejasvQ2kifR11g==",
      "dev": true,
      "license": "BlueOak-1.0.0",
      "engines": {
@@ -10204,9 +10209,9 @@
      }
    },
    "node_modules/markdown-it": {
-      "version": "14.2.0",
-      "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.2.0.tgz",
-      "integrity": "sha512-1TGiQiJVRQ3NPmZH6sx5Cfnmg6GQm9jvC1ch4TK511NjSJvjzKLzn5pPfZRNZkRPZP0HqCioSndqH8v2nRaWVQ==",
+      "version": "14.3.0",
+      "resolved": "https://registry.npmjs.org/markdown-it/-/markdown-it-14.3.0.tgz",
+      "integrity": "sha512-RCEsPjR+sr0x+AuYp601tKTkgFG4YEPLCzHST3cQ/fhlJkqAkz1L2/Qbp1j9qw5SBwQHFBoW8+hoN5xssOF0Tw==",
      "dev": true,
      "funding": [
        {
@@ -10221,8 +10226,8 @@
      "license": "MIT",
      "dependencies": {
        "argparse": "^2.0.1",
-        "entities": "^4.4.0",
-        "linkify-it": "^5.0.1",
+        "entities": "^4.5.0",
+        "linkify-it": "^5.0.2",
        "mdurl": "^2.0.0",
        "punycode.js": "^2.3.1",
        "uc.micro": "^2.1.0"
@@ -11393,9 +11398,9 @@
      }
    },
    "node_modules/miller-rabin/node_modules/bn.js": {
-      "version": "4.12.4",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.4.tgz",
-      "integrity": "sha512-njR1b+ixG2ufvL9Zn9JGneW+b5GV6jqpYyPPpg4QVt723b5kJPGUczkUyWEH9BwEA74UakJZ43I4FDLBF7ci0g==",
+      "version": "4.12.5",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.5.tgz",
+      "integrity": "sha512-3aRg6/JxfffFD+OlOjOFR3Vo79l39ooBTFucxx+MT3dhCtzn3EmiUPQo+6/OZuI2jbXi3YKgmiTFBgChQMwIRQ==",
      "dev": true,
      "license": "MIT"
    },
@@ -11696,9 +11701,9 @@
      "license": "MIT"
    },
    "node_modules/mocha/node_modules/brace-expansion": {
-      "version": "2.1.1",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.1.tgz",
-      "integrity": "sha512-WR1cURNjuvBLMZBMbqM0UoE+WAfdUcEV1ccD8PVBVOI+Z3ND4+SZbN8RsfT2bMuG1qwz5RFvPukSZm5fF2D5eA==",
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz",
+      "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -11850,9 +11855,9 @@
      }
    },
    "node_modules/node-gyp": {
-      "version": "13.0.0",
-      "resolved": "https://registry.npmjs.org/node-gyp/-/node-gyp-13.0.0.tgz",
-      "integrity": "sha512-FYYyBDWdc+kzoyPd5PqHUgM9DGs1C/Z4jxBZAOnA2GRUVXPivKRREq5q+VVPXVr9aGVqGMaMqyFHbviy/yb7Hg==",
+      "version": "13.0.1",
+      "resolved": "https://registry.npmjs.org/node-gyp/-/node-gyp-13.0.1.tgz",
+      "integrity": "sha512-piOr0S10qy5THB+q5BdqkoOx65XL/tjTMUAit3vciPNp+snTOBnGunWH1Rz7XZUxf2T9uFrfT/Ty4+aC3yPeyg==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -11864,7 +11869,7 @@
        "semver": "^7.3.5",
        "tar": "^7.5.4",
        "tinyglobby": "^0.2.12",
-        "undici": "^6.25.0",
+        "undici": "^8.4.1",
        "which": "^7.0.0"
      },
      "bin": {
@@ -11911,13 +11916,13 @@
      }
    },
    "node_modules/node-gyp/node_modules/undici": {
-      "version": "6.27.0",
-      "resolved": "https://registry.npmjs.org/undici/-/undici-6.27.0.tgz",
-      "integrity": "sha512-YmfV3YnEDzXRC5lZ2jWtWWHKGUm1zIt8AhesR1tens+HTNv+YZlN/dp6G727LOvMJ8xjP9Be7Y2Sdr96LDm+pg==",
+      "version": "8.7.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-8.7.0.tgz",
+      "integrity": "sha512-N7iQtfyLhIMOFgQubvmLV26svHpO0bqKnAiWotTQCVKCmWrcGbBotPuW1x+xwYZ2VHdSTVUfPQQnlEt1/LouTQ==",
      "dev": true,
      "license": "MIT",
      "engines": {
-        "node": ">=18.17"
+        "node": ">=22.19.0"
      }
    },
    "node_modules/node-gyp/node_modules/which": {
@@ -12001,9 +12006,9 @@
      }
    },
    "node_modules/node-releases": {
-      "version": "2.0.50",
-      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.50.tgz",
-      "integrity": "sha512-J6l92tKHX6w8Jy5nO1Vuc01NoIiRGi/d6qBKVxh+IQ8Cr3b6HbVNfKiF8ZpFKufTwpwxMmce2W3iQZ861ZRyTg==",
+      "version": "2.0.51",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.51.tgz",
+      "integrity": "sha512-wRNIrw4DmVLKQlbgOMdkMx27Wrpzes2hh5Jtbi2bjPd+4wJstWIqP5A+lscnqbm0xxmT5Bpg8Lec5ItEBwx6BQ==",
      "license": "MIT",
      "engines": {
        "node": ">=18"
@@ -12766,9 +12771,9 @@
      "license": "ISC"
    },
    "node_modules/picomatch": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
-      "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
+      "version": "4.0.5",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.5.tgz",
+      "integrity": "sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==",
      "license": "MIT",
      "engines": {
        "node": ">=12"
@@ -12905,9 +12910,9 @@
      }
    },
    "node_modules/prettier": {
-      "version": "3.8.4",
-      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.8.4.tgz",
-      "integrity": "sha512-N2MylSdi48+5N/6S5j+maeHbUSIzzZ5uOcX5Hm4QpV8Dkb1HFjfAKTKX6yNPJQD9AhcT3ifHNB66tWTTJDi11Q==",
+      "version": "3.9.4",
+      "resolved": "https://registry.npmjs.org/prettier/-/prettier-3.9.4.tgz",
+      "integrity": "sha512-yWG/o/4oJfo036EKAfK6ACAoDOfHeRHx4tuxkfBZiauURiaSmYwlpOr5LQqKtIkRD2z1PLteme2WoxEnj4tHTg==",
      "dev": true,
      "license": "MIT",
      "bin": {
@@ -13028,9 +13033,9 @@
      }
    },
    "node_modules/public-encrypt/node_modules/bn.js": {
-      "version": "4.12.4",
-      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.4.tgz",
-      "integrity": "sha512-njR1b+ixG2ufvL9Zn9JGneW+b5GV6jqpYyPPpg4QVt723b5kJPGUczkUyWEH9BwEA74UakJZ43I4FDLBF7ci0g==",
+      "version": "4.12.5",
+      "resolved": "https://registry.npmjs.org/bn.js/-/bn.js-4.12.5.tgz",
+      "integrity": "sha512-3aRg6/JxfffFD+OlOjOFR3Vo79l39ooBTFucxx+MT3dhCtzn3EmiUPQo+6/OZuI2jbXi3YKgmiTFBgChQMwIRQ==",
      "dev": true,
      "license": "MIT"
    },
@@ -13178,9 +13183,9 @@
      }
    },
    "node_modules/re2": {
-      "version": "1.25.0",
-      "resolved": "https://registry.npmjs.org/re2/-/re2-1.25.0.tgz",
-      "integrity": "sha512-mtxKjWS+VYIt2ijgt6ohEdwzNlGPom1whyaEKJD40cBc/wqkO1vJoOyK539Qb8Xa9m4GA6hiPGDIbW/d3egSRQ==",
+      "version": "1.25.2",
+      "resolved": "https://registry.npmjs.org/re2/-/re2-1.25.2.tgz",
+      "integrity": "sha512-t75KS05wrPM0S7IRbM0l/WUYlHftJj3WAzQJAcSH8CrDP/jFYicZbMYTKohJ8w/3kFGwkY/G8/dGtC6CdShDlw==",
      "dev": true,
      "hasInstallScript": true,
      "license": "BSD-3-Clause",
@@ -13261,9 +13266,9 @@
      "license": "MIT"
    },
    "node_modules/read-package-json/node_modules/brace-expansion": {
-      "version": "1.1.15",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.15.tgz",
-      "integrity": "sha512-EwOCDEex4quD37XhqM3omwtMoJjr//isUZz1JopUNWms+4Z2ViyM/k1YIRePpoVNnQhENnxtFjLaxNHrT7xIUg==",
+      "version": "1.1.16",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz",
+      "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -14673,9 +14678,9 @@
      }
    },
    "node_modules/terser": {
-      "version": "5.48.0",
-      "resolved": "https://registry.npmjs.org/terser/-/terser-5.48.0.tgz",
-      "integrity": "sha512-J/9An6vs9Us6wKRriSFXBWdRZapREHqFzdNUKk0pmu804EMR6dr6winwo7e5JDxN4xahxQsuysyYFwlwj4XN/Q==",
+      "version": "5.49.0",
+      "resolved": "https://registry.npmjs.org/terser/-/terser-5.49.0.tgz",
+      "integrity": "sha512-SNiDnXyHSrxVcIOtVbULzcTmniUiwcV7Nwdyj1twVubeTmbjoa8p69KKDpfkdoOavuM4/GRm1+ykI8qqnavHoA==",
      "dev": true,
      "license": "BSD-2-Clause",
      "dependencies": {
@@ -14829,22 +14834,22 @@
      }
    },
    "node_modules/tldts": {
-      "version": "7.4.5",
-      "resolved": "https://registry.npmjs.org/tldts/-/tldts-7.4.5.tgz",
-      "integrity": "sha512-RfEzKWcq5fHUOFq7J3rl3Oz6ylKGtcHqUznzj4EcXsxLSIjJcvpbXAQtWGeJQ0xKnimR5e0Cn+cn9TssfMzm+g==",
+      "version": "7.4.8",
+      "resolved": "https://registry.npmjs.org/tldts/-/tldts-7.4.8.tgz",
+      "integrity": "sha512-htwgN/8KRB3z3vnC0BOETVh2m499g5GmyTK9Wq5JBLX3FNz6tSBveAd+fQhzy9hkjif8vy2jwDMR1sGhLtZl2A==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
-        "tldts-core": "^7.4.5"
+        "tldts-core": "^7.4.8"
      },
      "bin": {
        "tldts": "bin/cli.js"
      }
    },
    "node_modules/tldts-core": {
-      "version": "7.4.5",
-      "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-7.4.5.tgz",
-      "integrity": "sha512-pGrwzZDvPwKe+7NNUqAunb6rqTfynr0VOUhCMdqbu5xlvNiszsAJygRzwvpVycdzejlbpY+SWJOn+s75Og7FEA==",
+      "version": "7.4.8",
+      "resolved": "https://registry.npmjs.org/tldts-core/-/tldts-core-7.4.8.tgz",
+      "integrity": "sha512-c1P7u0EhACHj7lPy4MJm8iTFEU8+nB0LCtddH0fhP7noaVoXAqafMtOOeX+ulpuPBqnrRgRhw494RICT3mbhnw==",
      "dev": true,
      "license": "MIT"
    },
@@ -15479,9 +15484,9 @@
      }
    },
    "node_modules/webpack": {
-      "version": "5.108.1",
-      "resolved": "https://registry.npmjs.org/webpack/-/webpack-5.108.1.tgz",
-      "integrity": "sha512-UUCihHQK3O7483Woa0SulNLDeAiOhHI2PN2PAPU4fVWJqbzhv04EJ8FaWtB9WWh3i8fRt28543U7VfuJTOrpgQ==",
+      "version": "5.108.4",
+      "resolved": "https://registry.npmjs.org/webpack/-/webpack-5.108.4.tgz",
+      "integrity": "sha512-yur8LyJoeiWh47dErD+Ok7vlbmDsJ3UbbRPAoxbGJ54WpE2y5yVo5G/inUzujnYgw3tPmBRdn+G7PoxXaYC33w==",
      "dev": true,
      "license": "MIT",
      "dependencies": {
@@ -15605,9 +15610,9 @@
      }
    },
    "node_modules/webpack-sources": {
-      "version": "3.5.0",
-      "resolved": "https://registry.npmjs.org/webpack-sources/-/webpack-sources-3.5.0.tgz",
-      "integrity": "sha512-HPuy+uuoTCaaoEoI1LQ3JN9+vrPBvEesnnX1jADHy728cHSMlq4wUc4afYqahq2B1mhQVZxCXOkNTnXltr+2vQ==",
+      "version": "3.5.1",
+      "resolved": "https://registry.npmjs.org/webpack-sources/-/webpack-sources-3.5.1.tgz",
+      "integrity": "sha512-jyuiGJdtvY434z5bUZrjz67v76/ePNvFZTp9Mdz29IlH4+GPsgyGjiv0fKI+M7BdkU6ADjulUcKAd3tUK3WlEw==",
      "dev": true,
      "license": "MIT",
      "engines": {
--- a/pkgs/by-name/es/eslint/package.nix
+++ b/pkgs/by-name/es/eslint/package.nix
@@ -7,13 +7,13 @@
 }:
 buildNpmPackage (finalAttrs: {
  pname = "eslint";
-  version = "10.6.0";
+  version = "10.7.0";

  src = fetchFromGitHub {
    owner = "eslint";
    repo = "eslint";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-lMdm5pKTPIhQqJjRnhvgCTLi5JxkQu5UqGtUSRHnnN8=";
+    hash = "sha256-DrmrPuFbEZzyfwFdJr/nAMq1xCugbyfJpJqN/qxsNCs=";
  };

  # NOTE: Generating lock-file
@@ -22,7 +22,7 @@ buildNpmPackage (finalAttrs: {
    cp ${./package-lock.json} package-lock.json
  '';

-  npmDepsHash = "sha256-tGeXepnZbD316nN/eGDLTcZ4hllFJiTPH2QMt/AWmZg=";
+  npmDepsHash = "sha256-9VeeXBpQMww3Xb+tum+8julwek86k6S5Afqx9E2Ta14=";
  npmInstallFlags = [ "--omit=dev" ];

  dontNpmBuild = true;
--- a/pkgs/by-name/ev/evince/package.nix
+++ b/pkgs/by-name/ev/evince/package.nix
@@ -126,6 +126,12 @@ stdenv.mkDerivation (finalAttrs: {
    "-DHAVE_STDLIB_H"
  ];

+  postInstall = ''
+    substituteInPlace $out/share/thumbnailers/evince.thumbnailer \
+      --replace-fail "TryExec=evince-thumbnailer" "TryExec=$out/bin/evince-thumbnailer" \
+      --replace-fail "Exec=evince-thumbnailer" "Exec=$out/bin/evince-thumbnailer"
+  '';
+
  preFixup = ''
    gappsWrapperArgs+=(--prefix XDG_DATA_DIRS : "${shared-mime-info}/share")
  '';
--- a/pkgs/by-name/f3/f3d/package.nix
+++ b/pkgs/by-name/f3/f3d/package.nix
@@ -84,6 +84,14 @@ stdenv.mkDerivation rec {
    "-DF3D_PLUGIN_BUILD_USD=ON"
  ];

+  postInstall = ''
+    for thumbnailer in $out/share/thumbnailers/f3d-plugin-*.thumbnailer; do
+      substituteInPlace $thumbnailer \
+        --replace-fail "TryExec=f3d" "TryExec=$out/bin/f3d" \
+        --replace-fail "Exec=f3d" "Exec=$out/bin/f3d"
+    done
+  '';
+
  meta = {
    description = "Fast and minimalist 3D viewer using VTK";
    homepage = "https://f3d-app.github.io/f3d";
--- a/pkgs/by-name/fa/fastmail-desktop/sources.nix
+++ b/pkgs/by-name/fa/fastmail-desktop/sources.nix
@@ -1,26 +1,26 @@
 # Generated by ./update.sh - do not update manually!
-# Last updated: 2026-07-02
+# Last updated: 2026-07-11
 { fetchurl, fetchzip }:
 {
  aarch64-darwin = {
-    version = "1.3.0";
+    version = "1.4.0";
    src = fetchurl {
-      url = "https://dl.fastmailcdn.com/desktop/production/mac/arm64/Fastmail-1.3.0-arm64-mac.zip";
-      hash = "sha512-6iRUcoI0dsW5ByaQ7dv7Oki5y0Y1wuMlQjjCpqWaThttsNJ4yYXh812RGsPjJTvcwVNMvPRbmPcbb/y//mXqRg==";
+      url = "https://dl.fastmailcdn.com/desktop/production/mac/arm64/Fastmail-1.4.0-arm64-mac.zip";
+      hash = "sha512-QyZZu6pwFJ0SkVye0/OtvNTligl6qKsYbpJfdPeHojPj+OqVyV8bavz15Lest+v7ALJhACZ3x+2kBiWa0ZCSow==";
    };
  };
  aarch64-linux = {
-    version = "1.3.0";
+    version = "1.4.0";
    src = fetchurl {
-      url = "https://dl.fastmailcdn.com/desktop/production/linux/arm64/com.fastmail.Fastmail-1.3.0-arm64.AppImage";
-      hash = "sha512-XJdxJVJ3xdhF04TInc3vmEtcUnzPzwujzTix+t2WbRo9qNEPqxnmN6hurGq0dZO/Dnk7jgOfAkjCpVq/kxWVRQ==";
+      url = "https://dl.fastmailcdn.com/desktop/production/linux/arm64/com.fastmail.Fastmail-1.4.0-arm64.AppImage";
+      hash = "sha512-sw55AwedyijKTXWAAAaSi6sgGMGK0uF4nPtQRacp9VG5EwlC+0wedyO4ax2cWxhsVUSXnk9ngN4mkraSd07vag==";
    };
  };
  x86_64-linux = {
-    version = "1.3.0";
+    version = "1.4.0";
    src = fetchurl {
-      url = "https://dl.fastmailcdn.com/desktop/production/linux/x64/com.fastmail.Fastmail-1.3.0.AppImage";
-      hash = "sha512-KnFAmjGQGXfA83JDynSixecoqqZbnC0bYGFQVf8YfP3ITwspHNDj3TIMp2jqXKtl9j4DlH1w8eLwSbKD0En9Wg==";
+      url = "https://dl.fastmailcdn.com/desktop/production/linux/x64/com.fastmail.Fastmail-1.4.0.AppImage";
+      hash = "sha512-0hNTRFNAnnLPq19isnaoVlXNl6za4Z5o6yh9ovU564JBMyAjsDNHk8h+2zArSSpydaUky6tIgAUsOhhWrIRtcg==";
    };
  };
 }
--- a/pkgs/by-name/fi/firewalld/package.nix
+++ b/pkgs/by-name/fi/firewalld/package.nix
@@ -43,7 +43,7 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "firewalld";
-  version = "2.4.3";
+  version = "2.5.0";

  __structuredAttrs = true;
  strictDeps = true;
@@ -52,7 +52,7 @@ stdenv.mkDerivation (finalAttrs: {
    owner = "firewalld";
    repo = "firewalld";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-S7E0szAZ2MEttL4PdBkoOcDGFVCVrwsTKr9xe+DPPgM=";
+    hash = "sha256-d/mKBkyi9f1/FpD5ECnvC0R/WCtfq6ewWu8kFs6sG9o=";
  };

  patches = [
--- a/pkgs/by-name/fl/flint/package.nix
+++ b/pkgs/by-name/fl/flint/package.nix
@@ -25,11 +25,11 @@ assert

 stdenv.mkDerivation (finalAttrs: {
  pname = "flint";
-  version = "3.5.0";
+  version = "3.6.0";

  src = fetchurl {
    url = "https://flintlib.org/download/flint-${finalAttrs.version}.tar.gz";
-    hash = "sha256-OYLzhfAGEKlE4BUusKKYk7I2b6ZA6PXzB2xHVkz34qY=";
+    hash = "sha256-uV4sd5L17qShyNLULECYQ0dWgy5XoJSyletd/cm0w2s=";
  };

  strictDeps = true;
--- a/pkgs/by-name/fl/flytectl/package.nix
+++ b/pkgs/by-name/fl/flytectl/package.nix
@@ -0,0 +1,65 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  installShellFiles,
+  stdenv,
+  testers,
+  flytectl,
+}:
+buildGoModule (finalAttrs: {
+  pname = "flytectl";
+  version = "0.9.8";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "flyteorg";
+    repo = "flyte";
+    tag = "flytectl/v${finalAttrs.version}";
+    hash = "sha256-p6fU+BLvhwK+4zDNBy4jwtvIll+s4jXmpYIF1mfeoB4=";
+  };
+
+  vendorHash = "sha256-h4L8BFzRiph4SBffVRH9TU5j7k+CZGshOV160mENAL0=";
+
+  sourceRoot = "${finalAttrs.src.name}/flytectl";
+
+  subPackages = [ "." ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/flyteorg/flyte/flytestdlib/version.Version=v${finalAttrs.version}"
+    "-X github.com/flyteorg/flyte/flytestdlib/version.Build=${finalAttrs.src.tag}"
+    "-X github.com/flyteorg/flyte/flytestdlib/version.BuildTime=1970-01-01"
+  ];
+
+  nativeBuildInputs = [ installShellFiles ];
+
+  # Tests require network and file system access
+  doCheck = false;
+
+  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+    installShellCompletion --cmd flytectl \
+      --bash <($out/bin/flytectl completion bash) \
+      --fish <($out/bin/flytectl completion fish) \
+      --zsh <($out/bin/flytectl completion zsh)
+  '';
+
+  passthru.tests.version = testers.testVersion {
+    package = finalAttrs.finalPackage;
+    command = "flytectl version";
+    version = "v${finalAttrs.src.version}";
+  };
+
+  meta = {
+    description = "Command-line interface for Flyte, a cloud-native workflow orchestration platform";
+    downloadPage = "https://github.com/flyteorg/flyte";
+    homepage = "https://flyte.org/";
+    changelog = "https://github.com/flyteorg/flyte/releases/tag/flytectl%2Fv${finalAttrs.version}";
+    license = lib.licenses.asl20;
+    maintainers = [ lib.maintainers.mcuste ];
+    mainProgram = "flytectl";
+    platforms = lib.platforms.unix;
+  };
+})
--- a/pkgs/by-name/fr/freecad/package.nix
+++ b/pkgs/by-name/fr/freecad/package.nix
@@ -138,6 +138,12 @@ freecad-utils.makeCustomizable (
        "--prefix PYTHONPATH : ${python3Packages.makePythonPath pythonDeps}"
      ];

+    postInstall = ''
+      substituteInPlace $out/share/thumbnailers/FreeCAD.thumbnailer \
+        --replace-fail "TryExec=freecad-thumbnailer" "TryExec=$out/bin/freecad-thumbnailer" \
+        --replace-fail "Exec=freecad-thumbnailer" "Exec=$out/bin/freecad-thumbnailer"
+    '';
+
    postFixup = ''
      mv $out/share/doc $out
      ln -s $out/doc $out/share/doc
--- a/pkgs/by-name/fu/fut/package.nix
+++ b/pkgs/by-name/fu/fut/package.nix
@@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "fut";
-  version = "3.3.4";
+  version = "3.3.5";

  src = fetchFromGitHub {
    owner = "fusionlanguage";
    repo = "fut";
    tag = "fut-${finalAttrs.version}";
-    hash = "sha256-mFNyMo6pQ3LshYy8JDGFalNEgK1A9cxLp/wAnlO1I6k=";
+    hash = "sha256-7TNnxt3r/6pOvzGwWA2IHkEO8PIX2eS1WQPOIHfKhB4=";
  };

  buildPhase = ''
--- a/pkgs/by-name/gl/glslviewer/package.nix
+++ b/pkgs/by-name/gl/glslviewer/package.nix
@@ -43,6 +43,13 @@ stdenv.mkDerivation (finalAttrs: {
    ffmpeg_7
    python3
  ];
+
+  postInstall = ''
+    substituteInPlace $out/share/thumbnailers/glslViewer.thumbnailer \
+      --replace-fail "TryExec=glslThumbnailer" "TryExec=$out/bin/glslThumbnailer" \
+      --replace-fail "Exec=glslThumbnailer" "Exec=$out/bin/glslThumbnailer"
+  '';
+
  meta = {
    description = "Live GLSL coding renderer";
    homepage = "https://patriciogonzalezvivo.com/2015/glslViewer/";
--- a/pkgs/by-name/gn/gnome-font-viewer/package.nix
+++ b/pkgs/by-name/gn/gnome-font-viewer/package.nix
@@ -47,6 +47,12 @@ stdenv.mkDerivation (finalAttrs: {
    fribidi
  ];

+  postInstall = ''
+    substituteInPlace $out/share/thumbnailers/gnome-font-viewer.thumbnailer \
+      --replace-fail "TryExec=gnome-thumbnail-font" "TryExec=$out/bin/gnome-thumbnail-font" \
+      --replace-fail "Exec=gnome-thumbnail-font" "Exec=$out/bin/gnome-thumbnail-font"
+  '';
+
  passthru = {
    updateScript = gnome.updateScript {
      packageName = "gnome-font-viewer";
--- a/pkgs/by-name/ic/icoextract/package.nix
+++ b/pkgs/by-name/ic/icoextract/package.nix
@@ -30,6 +30,9 @@ python3Packages.buildPythonApplication (finalAttrs: {

  postInstall = ''
    install -Dm644 exe-thumbnailer.thumbnailer -t $out/share/thumbnailers
+
+    substituteInPlace $out/share/thumbnailers/exe-thumbnailer.thumbnailer \
+      --replace-fail "Exec=exe-thumbnailer" "Exec=$out/bin/exe-thumbnailer"
  '';

  meta = {
--- a/pkgs/by-name/jf/jfrog-cli/package.nix
+++ b/pkgs/by-name/jf/jfrog-cli/package.nix
@@ -9,17 +9,17 @@

 buildGoModule (finalAttrs: {
  pname = "jfrog-cli";
-  version = "2.112.0";
+  version = "2.113.0";

  src = fetchFromGitHub {
    owner = "jfrog";
    repo = "jfrog-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-jqzjkUbCwR+EMA4Zrb4rZHDsQWD4YimPVhHA2GcLNF8=";
+    hash = "sha256-AcydCwarePzysegEH9QUgbp0v2SP8J56rAYFBF6FxO0=";
  };

  proxyVendor = true;
-  vendorHash = "sha256-Bw2g9bfuG+IgItrRh85G9lyFZP8oXNXxkZTcvSy0WWA=";
+  vendorHash = "sha256-gghTbLH/o88u9smpe5gDUM0a4Zk0x/J9unABnqaKo58=";

  checkFlags = "-skip=^(TestReleaseBundle|TestVisibilitySendUsage_RtCurl_E2E)";

--- a/pkgs/by-name/ku/kubectl-rabbitmq/package.nix
+++ b/pkgs/by-name/ku/kubectl-rabbitmq/package.nix
@@ -7,18 +7,18 @@

 buildGoModule (finalAttrs: {
  pname = "kubectl-rabbitmq";
-  version = "2.21.0";
+  version = "2.22.1";

  src = fetchFromGitHub {
    owner = "rabbitmq";
    repo = "cluster-operator";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-6kh4R84Nq82M66Y0vl1NLYUxWh52oYpCydK7vOmkMcU=";
+    hash = "sha256-Vofl4YXJUyjWBwxLhbQ09427hBz70Un2P0YLNYn7v28=";
  };

  modRoot = "kubectl-rabbitmq";

-  vendorHash = "sha256-/50MnUk1wxpUed8jZ8OC6rgu4Qj6CnUZdbYsgyjsxIo=";
+  vendorHash = "sha256-Jud0VpVcBPBtc3hgb997SzefZx7kM9hbPgdOqBRDezY=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/li/libgsf/package.nix
+++ b/pkgs/by-name/li/libgsf/package.nix
@@ -83,6 +83,12 @@ stdenv.mkDerivation (finalAttrs: {
    patchShebangs ./tests/
  '';

+  postInstall = ''
+    substituteInPlace $out/share/thumbnailers/gsf-office.thumbnailer \
+      --replace-fail "TryExec=gsf-office-thumbnailer" "TryExec=$out/bin/gsf-office-thumbnailer" \
+      --replace-fail "Exec=gsf-office-thumbnailer" "Exec=$out/bin/gsf-office-thumbnailer"
+  '';
+
  passthru = {
    updateScript = gnome.updateScript {
      packageName = finalAttrs.pname;
--- a/pkgs/by-name/li/libresprite/package.nix
+++ b/pkgs/by-name/li/libresprite/package.nix
@@ -87,6 +87,10 @@ stdenv.mkDerivation (finalAttrs: {
      dst="$out"/share/icons/hicolor/"$size"x"$size"
      install -Dm644 "$src"/doc"$size".png "$dst"/mimetypes/aseprite.png
    done
+
+    substituteInPlace $out/share/thumbnailers/libresprite.thumbnailer \
+      --replace-fail "TryExec=libresprite-thumbnailer" "TryExec=$out/bin/libresprite-thumbnailer" \
+      --replace-fail "Exec=libresprite-thumbnailer" "Exec=$out/bin/libresprite-thumbnailer"
  '';

  passthru.tests = {
--- a/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
+++ b/pkgs/by-name/li/librewolf-bin-unwrapped/package.nix
@@ -36,7 +36,7 @@ let

  pname = "librewolf-bin-unwrapped";

-  version = "152.0.4-1";
+  version = "152.0.5-1";
 in

 stdenv.mkDerivation {
@@ -46,8 +46,8 @@ stdenv.mkDerivation {
    url = "https://codeberg.org/api/packages/librewolf/generic/librewolf/${version}/librewolf-${version}-${arch}-package.tar.xz";
    hash =
      {
-        x86_64-linux = "sha256-4vmsv93ENtteE18uGJF2ZEhaRA3nGJg//WYYdBREIig=";
-        aarch64-linux = "sha256-Q1vT/9qOs2AiMRsLcofF7F2Y+5QJJloI/QSVZwA9gC8=";
+        x86_64-linux = "sha256-9Y0n3UHRK9WgKhKFIMB3CLmh1Gp5aHoIiKxlKNKe5gc=";
+        aarch64-linux = "sha256-x9vUXaEtjnY6+mOLbLiXmBr5c7ZmEYRTJK9fDIpfgVs=";
      }
      .${stdenv.hostPlatform.system} or throwSystem;
  };
--- a/pkgs/by-name/ll/llmserve/package.nix
+++ b/pkgs/by-name/ll/llmserve/package.nix
@@ -7,16 +7,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "llmserve";
-  version = "0.0.8";
+  version = "0.0.10";

  src = fetchFromGitHub {
    owner = "AlexsJones";
    repo = "llmserve";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-j4ko8AkrIOWlM1Tkl/pGMI1PzQc6yImCAZXEmO/NBko=";
+    hash = "sha256-V0DtCjTQhgfO/WQy/OZc2ayDY9nl2YzstCnsoRAJDFo=";
  };

-  cargoHash = "sha256-jwCQSm4k1YofCn2r5IX+knXbTo70bsAVHIxojeLpkqI=";
+  cargoHash = "sha256-5svPhLTpWfJgDVNyoytF42efiXzSZ2vbbrglSuNl3Ck=";

  __structuredAttrs = true;
  __darwinAllowLocalNetworking = true;
--- a/pkgs/by-name/ma/mate-control-center/package.nix
+++ b/pkgs/by-name/ma/mate-control-center/package.nix
@@ -89,6 +89,12 @@ stdenv.mkDerivation (finalAttrs: {

  configureFlags = [ "--disable-update-mimedb" ];

+  postInstall = ''
+    substituteInPlace $out/share/thumbnailers/mate-font-viewer.thumbnailer \
+      --replace-fail "TryExec=mate-thumbnail-font" "TryExec=$out/bin/mate-thumbnail-font" \
+      --replace-fail "Exec=mate-thumbnail-font" "Exec=$out/bin/mate-thumbnail-font"
+  '';
+
  preFixup = ''
    gappsWrapperArgs+=(
      # WM keyboard shortcuts
--- a/pkgs/by-name/ml/mlib/package.nix
+++ b/pkgs/by-name/ml/mlib/package.nix
@@ -6,13 +6,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "mlib";
-  version = "0.8.0";
+  version = "0.8.2";

  src = fetchFromGitHub {
    owner = "P-p-H-d";
    repo = "mlib";
    rev = "V${finalAttrs.version}";
-    hash = "sha256-l91UGIxCd6868F21jHTEQd6CgKtuUigxgZJTTnuVPwo=";
+    hash = "sha256-kJYQL1rTcnuFtcqREhi+PCeitV4s+TLGSPciUZDuny0=";
  };

  makeFlags = [
--- a/pkgs/by-name/mo/moonlight/package.nix
+++ b/pkgs/by-name/mo/moonlight/package.nix
@@ -17,13 +17,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "moonlight";
-  version = "2026.5.2";
+  version = "2026.7.0";

  src = fetchFromGitHub {
    owner = "moonlight-mod";
    repo = "moonlight";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-eTya6Y7dw/otqohgYZudkqrcI50740jFUTe4Lyd6GKc=";
+    hash = "sha256-c6F/HGxdpNeKYFwaeyQsa4rtfXnd++Xa3hIdgN2oPwA=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/mp/mpd/package.nix
+++ b/pkgs/by-name/mp/mpd/package.nix
@@ -197,13 +197,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "mpd";
-  version = "0.24.12";
+  version = "0.24.13";

  src = fetchFromGitHub {
    owner = "MusicPlayerDaemon";
    repo = "MPD";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-CYwpPKFTW7engtPJoUqIWWn6YhmoSRjiew6n0tAZSmE=";
+    sha256 = "sha256-ZcSMd+PhO8sWGA96GtwM3ykPS//8SpqDh9lLh3unB8Q=";
  };

  buildInputs = [
--- a/pkgs/by-name/mu/multica-cli/package.nix
+++ b/pkgs/by-name/mu/multica-cli/package.nix
@@ -9,18 +9,18 @@ buildGoModule rec {
  __structuredAttrs = true;

  pname = "multica-cli";
-  version = "0.3.34";
+  version = "0.3.43";

  src = fetchFromGitHub {
    owner = "multica-ai";
    repo = "multica";
    rev = "v${version}";
-    hash = "sha256-8SZ9NIWpyZirUYM5zvQv7bA82XhxgZanzw0oeyAkntg=";
+    hash = "sha256-XzJIWvSLK83f2ey7MKNvQuPuDy44dMf2YkxaudnLnvc=";
  };

  sourceRoot = "${src.name}/server";

-  vendorHash = "sha256-4OHW+OEIzi65iZ+XZqhBcs9ZNR13Js0dHDHZTbEG6nc=";
+  vendorHash = "sha256-+IZt3ZQDHEcLA1cOcN4j4cTtIbATzAowUL3i1ZQnzBc=";

  subPackages = [ "cmd/multica" ];

--- a/pkgs/by-name/mu/musescore/package.nix
+++ b/pkgs/by-name/mu/musescore/package.nix
@@ -74,17 +74,22 @@ stdenv.mkDerivation (finalAttrs: {

  qtWrapperArgs = [
    # MuseScore JACK backend loads libjack at runtime.
-    "--prefix ${lib.optionalString stdenv.hostPlatform.isDarwin "DY"}LD_LIBRARY_PATH : ${
-      lib.makeLibraryPath [ libjack2 ]
-    }"
+    "--prefix"
+    "${lib.optionalString stdenv.hostPlatform.isDarwin "DY"}LD_LIBRARY_PATH"
+    ":"
+    (lib.makeLibraryPath [ libjack2 ])
  ]
  ++ lib.optionals (stdenv.hostPlatform.isLinux) [
-    "--set ALSA_PLUGIN_DIR ${alsa-plugins}/lib/alsa-lib"
+    "--set"
+    "ALSA_PLUGIN_DIR"
+    "${alsa-plugins}/lib/alsa-lib"
  ]
  ++ lib.optionals (!stdenv.hostPlatform.isDarwin) [
    # There are some issues with using the wayland backend, see:
    # https://musescore.org/en/node/321936
-    "--set-default QT_QPA_PLATFORM xcb"
+    "--set-default"
+    "QT_QPA_PLATFORM"
+    "xcb"
  ];

  preFixup = ''
--- a/pkgs/by-name/my/mypaint/package.nix
+++ b/pkgs/by-name/my/mypaint/package.nix
@@ -161,6 +161,12 @@ buildPythonApplication (finalAttrs: {
    runHook postCheck
  '';

+  postInstall = ''
+    substituteInPlace $out/share/thumbnailers/mypaint-ora.thumbnailer \
+      --replace-fail "TryExec=mypaint-ora-thumbnailer" "TryExec=$out/bin/mypaint-ora-thumbnailer" \
+      --replace-fail "Exec=mypaint-ora-thumbnailer" "Exec=$out/bin/mypaint-ora-thumbnailer"
+  '';
+
  meta = {
    description = "Graphics application for digital painters";
    homepage = "http://mypaint.org/";
--- a/pkgs/by-name/ni/nixbang/package.nix
+++ b/pkgs/by-name/ni/nixbang/package.nix
@@ -1,27 +0,0 @@
-{
-  lib,
-  python3Packages,
-  fetchFromGitHub,
-}:
-
-python3Packages.buildPythonApplication rec {
-  pname = "nixbang";
-  version = "0.1.2";
-  format = "setuptools";
-  namePrefix = "";
-
-  src = fetchFromGitHub {
-    owner = "madjar";
-    repo = "nixbang";
-    rev = version;
-    sha256 = "1kzk53ry60i814wa6n9y2ni0bcxhbi9p8gdv10b974gf23mhi8vc";
-  };
-
-  meta = {
-    homepage = "https://github.com/madjar/nixbang";
-    description = "Special shebang to run scripts in a nix-shell";
-    mainProgram = "nixbang";
-    maintainers = [ lib.maintainers.madjar ];
-    platforms = lib.platforms.all;
-  };
-}
--- a/pkgs/by-name/ob/objdiff/package.nix
+++ b/pkgs/by-name/ob/objdiff/package.nix
@@ -0,0 +1,63 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  protobuf,
+  fontconfig,
+  freetype,
+  libxkbcommon,
+  openssl,
+  vulkan-loader,
+  stdenv,
+  wayland,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "objdiff";
+  version = "3.7.3";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "encounter";
+    repo = "objdiff";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-2Rzoj8JXv9MOGRHWiIodaBbP8ID+8RFJFuB3hzrodh8=";
+  };
+
+  cargoHash = "sha256-Z9vyUj35nrHuUoOYM54RLCn7CzcQ6k3A6FsDYKCVqVM=";
+
+  nativeBuildInputs = [
+    pkg-config
+    protobuf
+  ];
+
+  buildInputs = [
+    fontconfig
+    freetype
+    libxkbcommon
+    openssl
+    vulkan-loader
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    wayland
+  ];
+
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Local diffing tool for decompilation projects";
+    homepage = "https://github.com/encounter/objdiff";
+    license = with lib.licenses; [
+      asl20
+      mit
+    ];
+    maintainers = with lib.maintainers; [ Br1ght0ne ];
+    mainProgram = "objdiff";
+  };
+})
--- a/pkgs/by-name/oc/ocenaudio/package.nix
+++ b/pkgs/by-name/oc/ocenaudio/package.nix
@@ -14,12 +14,12 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ocenaudio";
-  version = "3.19.5";
+  version = "3.20.0";

  src = fetchurl {
    name = "ocenaudio.deb";
    url = "https://www.ocenaudio.com/downloads/index.php/ocenaudio_debian12.deb?version=v${finalAttrs.version}";
-    hash = "sha256-xXyzxdvfGnqUzDk7Tf3HFWnJnOFnfV1gBdbElB5ixak=";
+    hash = "sha256-iykGoFPyxJGyF4S1YjNS1XKkGrxxgK+xxA4gyVsgw8E=";
  };

  autoPatchelfIgnoreMissingDeps = [
--- a/pkgs/by-name/op/openlist/frontend.nix
+++ b/pkgs/by-name/op/openlist/frontend.nix
@@ -12,18 +12,18 @@
 }:
 buildNpmPackage (finalAttrs: {
  pname = "openlist-frontend";
-  version = "4.2.2";
+  version = "4.2.3";

  src = fetchFromGitHub {
    owner = "OpenListTeam";
    repo = "OpenList-Frontend";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-RLuAGjiYELy+roip2TtvUXGOw6Vk+GkczT1LSI0Vx+8=";
+    hash = "sha256-33W0JCAmt3pjhAAOxoaZS7zBbJJbl4i85fqyKzoibz8=";
  };

  i18n = fetchzip {
    url = "https://github.com/OpenListTeam/OpenList-Frontend/releases/download/v${finalAttrs.version}/i18n.tar.gz";
-    hash = "sha256-ZO/ozyRNqh2W4/acQmGHoEMpjpf2jph7Gn/kOlwVSFs=";
+    hash = "sha256-nnsnYXbH4Uq+sux11txanUs11MB2dHIT0vCLMIzYQdg=";
    stripRoot = false;
  };

@@ -41,7 +41,7 @@ buildNpmPackage (finalAttrs: {
    inherit (finalAttrs) pname version src;
    pnpm = openlistPnpm;
    fetcherVersion = 4;
-    hash = "sha256-ujsCuQexnKPNwoJzaWmhu3+4xMkZ0jR04m2exG674dI=";
+    hash = "sha256-V+YhQsfUvd8WHxIYEjuihEjTZE75eFfziq2GwW1rPbg=";
  };

  npmConfigHook = pnpmConfigHook;
--- a/pkgs/by-name/op/openlist/package.nix
+++ b/pkgs/by-name/op/openlist/package.nix
@@ -12,13 +12,13 @@

 buildGoModule (finalAttrs: {
  pname = "openlist";
-  version = "4.2.2";
+  version = "4.2.3";

  src = fetchFromGitHub {
    owner = "OpenListTeam";
    repo = "OpenList";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-MxoF+hpzn/44knjVeaINo4/1T4ia7HG8mm+tbvJEsfQ=";
+    hash = "sha256-q7s6u/pQ+bvSbz19029uO9CzVc1KVoISpcStngVUffs=";
    # populate values that require us to use git. By doing this in postFetch we
    # can delete .git afterwards and maintain better reproducibility of the src.
    leaveDotGit = true;
@@ -34,7 +34,7 @@ buildGoModule (finalAttrs: {
  frontend = callPackage ./frontend.nix { };

  proxyVendor = true;
-  vendorHash = "sha256-ScPfry0PtSlABdyG+7egMAndG7D3iz1+ceAAhLQPtkM=";
+  vendorHash = "sha256-a4v2JP/+feit3uTqnACWgl77fWZU8yVE/0Hm7qxoI8E=";

  nativeBuildInputs = [
    installShellFiles
--- a/pkgs/by-name/pr/proton-pass/package.nix
+++ b/pkgs/by-name/pr/proton-pass/package.nix
@@ -10,17 +10,17 @@
 }:
 let
  pname = "proton-pass";
-  version = "1.36.1";
+  version = "1.38.0";

  passthru = {
    sources = {
      "x86_64-linux" = fetchurl {
        url = "https://proton.me/download/pass/linux/x64/proton-pass_${version}_amd64.deb";
-        hash = "sha256-w6q1UWADVxUu8TGVCqzBJvoUlSnJGckvTFs2GKY/WeA=";
+        hash = "sha256-6WYiqEJquq64b1fNv8HcQcT4/VCwtEkK4YrfAXDC6nY=";
      };
      "aarch64-darwin" = fetchurl {
        url = "https://proton.me/download/pass/macos/ProtonPass_${version}.dmg";
-        hash = "sha256-JKm5DhIZLj2XXuxWKo48VY4onRypouIJUVV9IK/wJGE=";
+        hash = "sha256-CwdiHEqKnk+ELoavs1p6ND48e2rvEFBqbXQs79ihQ4M=";
      };
      "x86_64-darwin" = passthru.sources."aarch64-darwin";
    };
--- a/pkgs/by-name/re/renderdoc/package.nix
+++ b/pkgs/by-name/re/renderdoc/package.nix
@@ -142,6 +142,12 @@ stdenv.mkDerivation (finalAttrs: {
     )
  '';

+  postInstall = ''
+    substituteInPlace $out/share/thumbnailers/renderdoc.thumbnailer \
+      --replace-fail "TryExec=/usr/bin/renderdoccmd" "TryExec=$out/bin/renderdoccmd" \
+      --replace-fail "Exec=/usr/bin/renderdoccmd" "Exec=$out/bin/renderdoccmd"
+  '';
+
  preFixup =
    let
      libPath = lib.makeLibraryPath [
--- a/pkgs/by-name/rn/rnote/package.nix
+++ b/pkgs/by-name/rn/rnote/package.nix
@@ -80,6 +80,12 @@ stdenv.mkDerivation (finalAttrs: {
    patchShebangs build-aux
  '';

+  postInstall = ''
+    substituteInPlace $out/share/thumbnailers/rnote.thumbnailer \
+      --replace-fail "TryExec=rnote-cli" "TryExec=$out/bin/rnote-cli" \
+      --replace-fail "Exec=rnote-cli" "Exec=$out/bin/rnote-cli"
+  '';
+
  env = lib.optionalAttrs stdenv.cc.isClang {
    NIX_CFLAGS_COMPILE = "-Wno-error=incompatible-function-pointer-types";
  };
--- a/pkgs/by-name/sa/sameboy/package.nix
+++ b/pkgs/by-name/sa/sameboy/package.nix
@@ -48,6 +48,12 @@ stdenv.mkDerivation (finalAttrs: {
      --replace-fail '"libgtk-3.so"' '"${gtk3}/lib/libgtk-3.so"'
  '';

+  postInstall = ''
+    substituteInPlace $out/share/thumbnailers/sameboy.thumbnailer \
+      --replace-fail "TryExec=sameboy-thumbnailer" "TryExec=$out/bin/sameboy-thumbnailer" \
+      --replace-fail "Exec=sameboy-thumbnailer" "Exec=$out/bin/sameboy-thumbnailer"
+  '';
+
  meta = {
    homepage = "https://sameboy.github.io";
    description = "Game Boy, Game Boy Color, and Super Game Boy emulator";
--- a/pkgs/by-name/sh/shaka-packager/package.nix
+++ b/pkgs/by-name/sh/shaka-packager/package.nix
@@ -22,13 +22,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "shaka-packager";
-  version = "3.7.2";
+  version = "3.8.0";

  src = fetchFromGitHub {
    owner = "shaka-project";
    repo = "shaka-packager";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-E493sleVbsuytneK51lxuQnaEzvAEJwAXYmsxcaOXSs=";
+    hash = "sha256-GdBNysDHDWy1Zgtf+gfKtyvqCiPFJeA3K1mErK/GoRk=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/si/simplenote/package.nix
+++ b/pkgs/by-name/si/simplenote/package.nix
@@ -0,0 +1,64 @@
+{
+  appimageTools,
+  lib,
+  fetchurl,
+  nix-update-script,
+  makeDesktopItem,
+}:
+
+let
+  pname = "simplenote";
+  version = "2.27.1";
+
+  src = fetchurl {
+    url = "https://github.com/Automattic/simplenote-electron/releases/download/v${version}/Simplenote-linux-${version}-x86_64.AppImage";
+    hash = "sha512-jf9mnmf+5Xcowxgx7uizWVmv88gPdYwojQ2f+xhbqnXaHD3dSbcW2YdxiV3qjmFsRzUgwZvBVOGpOMvnSHuQDA==";
+  };
+
+  appimageContents = appimageTools.extract { inherit pname version src; };
+in
+appimageTools.wrapType2 {
+  inherit pname version src;
+
+  __structuredAttrs = true;
+  strictDeps = true;
+
+  extraInstallCommands = ''
+    install -m 444 -D ${appimageContents}/${pname}.desktop -t $out/share/applications
+    substituteInPlace $out/share/applications/${pname}.desktop \
+      --replace-fail 'Exec=AppRun' 'Exec=${pname}'
+
+    cp -r ${appimageContents}/usr/share/icons $out/share
+  '';
+
+  extraPkgs =
+    pkgs: with pkgs; [
+      libsecret
+      libnotify
+      libappindicator-gtk3
+    ];
+
+  desktopItems = [
+    (makeDesktopItem {
+      name = pname;
+      exec = pname;
+      icon = "simplenote";
+      genericName = "Note Taking Application";
+      comment = "Simplenote for Linux";
+      categories = [ "Utility" ];
+      startupNotify = true;
+    })
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    mainProgram = "simplenote";
+    description = "The simplest way to keep notes";
+    homepage = "https://github.com/Automattic/simplenote-electron";
+    license = lib.licenses.gpl2Plus;
+    platforms = [ "x86_64-linux" ];
+    maintainers = with lib.maintainers; [ _2zqa ];
+    changelog = "https://github.com/Automattic/simplenote-electron/releases/tag/v${version}/RELEASE-NOTES.md";
+  };
+}
--- a/pkgs/by-name/st/statix/package.nix
+++ b/pkgs/by-name/st/statix/package.nix
@@ -8,17 +8,17 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "statix";
-  version = "0.5.8-unstable-2026-06-28";
+  version = "0.5.8-unstable-2026-07-10";
  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "molybdenumsoftware";
    repo = "statix";
-    rev = "964eee9bd0ef445838e32d38d097be0f0d4a2273";
-    hash = "sha256-V3AacP6DHq9WIZJZvFCPSqe0/VjwKFROUNblJxxPXxI=";
+    rev = "7cbd82249a0154836db6118bec97da06ab447013";
+    hash = "sha256-3n3hDc52+hAj1TWr3TFAeWzyDkaprsHafZVAlcS2WAM=";
  };

-  cargoHash = "sha256-8iV21qkzXgzCfq9P+VVsuNC3M5MtIkflr6PtCu3FkoQ=";
+  cargoHash = "sha256-Ed0eSGhx0D1oZS44ObS3j1TuM3A1HnDKzDjDVYlX1jM=";

  buildFeatures = lib.optional withJson "json";

--- a/pkgs/by-name/su/sub-store-frontend/package.nix
+++ b/pkgs/by-name/su/sub-store-frontend/package.nix
@@ -14,13 +14,13 @@ let
 in
 buildNpmPackage (finalAttrs: {
  pname = "sub-store-frontend";
-  version = "2.27.3";
+  version = "2.28.6";

  src = fetchFromGitHub {
    owner = "sub-store-org";
    repo = "Sub-Store-Front-End";
    tag = finalAttrs.version;
-    hash = "sha256-OO40cItVKlYAQqohxdbJkuX5Wf9y1MaId+ewfCkRjSo=";
+    hash = "sha256-dCby4fKCx9lzlSdn9TZwOsQWPFf36ZcL5bEg3XgipjY=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/t1/t1utils/package.nix
+++ b/pkgs/by-name/t1/t1utils/package.nix
@@ -24,12 +24,7 @@ stdenv.mkDerivation (finalAttrs: {
      file from a PFA or PFB font.
    '';
    homepage = "https://www.lcdf.org/type/";
-    license = {
-      shortName = "Click"; # README.md says BSD-like, see LICENSE
-      url = "https://github.com/kohler/t1utils/blob/master/LICENSE";
-      free = true;
-      redistributable = true;
-    };
+    license = lib.licenses.mit-click;
    platforms = lib.platforms.all;
    maintainers = [ lib.maintainers.bjornfor ];
  };
--- a/pkgs/by-name/ta/talhelper/package.nix
+++ b/pkgs/by-name/ta/talhelper/package.nix
@@ -9,16 +9,16 @@

 buildGoModule (finalAttrs: {
  pname = "talhelper";
-  version = "3.1.12";
+  version = "3.1.13";

  src = fetchFromGitHub {
    owner = "budimanjojo";
    repo = "talhelper";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-oz9YugQlklC+Rgm65wIfacjs8xuO9T4gVyLkdTfLEus=";
+    hash = "sha256-AKyyrslc2bNLBvZ6KjQOHnVIX1ESnE7OZyF8aucctdI=";
  };

-  vendorHash = "sha256-KJGnwjk6W1/5YgiBKaC4DDd2Uphp5NltimHi5DM3qvs=";
+  vendorHash = "sha256-mXM7c6T5qcAHez5QrmxFmGE0DLyL2RADIFTdrQaH2GQ=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/tb/tbls/package.nix
+++ b/pkgs/by-name/tb/tbls/package.nix
@@ -9,16 +9,16 @@

 buildGoModule (finalAttrs: {
  pname = "tbls";
-  version = "1.94.5";
+  version = "1.95.0";

  src = fetchFromGitHub {
    owner = "k1LoW";
    repo = "tbls";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-edwTHkweia5FAn4UGm4FFV/mtDc+L7KA6hlrjSxYNws=";
+    hash = "sha256-24FdXGakfLkbR58Wwz5o9q3GD4rkToCfv4ygM/NBQXg=";
  };

-  vendorHash = "sha256-NhssCwXaeBUS+LLU/CTG/+Y5hOih9aOVCMYIXrxbU4M=";
+  vendorHash = "sha256-FANXWBI5ZTqBdZ7iLrErYmUb6l1LaLnYo4RA1iz9wM8=";

  excludedPackages = [ "scripts/jsonschema" ];

--- a/pkgs/by-name/te/temporal/darwin-sandbox-fix.patch
+++ b/pkgs/by-name/te/temporal/darwin-sandbox-fix.patch
@@ -1,20 +0,0 @@
--- vendor/modernc.org/libc/honnef.co/go/netdb/netdb.go
-+++ vendor/modernc.org/libc/honnef.co/go/netdb/netdb.go
-@@ -696,7 +696,7 @@ func init() {
- 	// Load protocols
- 	data, err := ioutil.ReadFile("/etc/protocols")
- 	if err != nil {
-		if !os.IsNotExist(err) {
-+		if !os.IsNotExist(err) && !os.IsPermission(err) {
- 			panic(err)
- 		}
- 
-@@ -732,7 +732,7 @@ func init() {
- 	// Load services
- 	data, err = ioutil.ReadFile("/etc/services")
- 	if err != nil {
-		if !os.IsNotExist(err) {
-+		if !os.IsNotExist(err) && !os.IsPermission(err) {
- 			panic(err)
- 		}
- 
--- a/pkgs/by-name/te/temporal/package.nix
+++ b/pkgs/by-name/te/temporal/package.nix
@@ -6,27 +6,21 @@
  testers,
  temporal,
  versionCheckHook,
+  nix-update-script,
 }:

 buildGoModule (finalAttrs: {
  pname = "temporal";
-  version = "1.30.5";
+  version = "1.31.2";

  src = fetchFromGitHub {
    owner = "temporalio";
    repo = "temporal";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Uw1E1GcLtIo1XZea/tb1TnbIk9O4Mf2NaCpDwUIfSak=";
+    hash = "sha256-NuvgeG1a7octJ2HD0EGQIdU8CtZsNRf4KX/F17S/uOQ=";
  };

-  vendorHash = "sha256-5++ETJgWDVveUxb2QZL5AUQG8/8QNVx5iS/NBjoacCY=";
-
-  overrideModAttrs = old: {
-    # netdb.go allows /etc/protocols and /etc/services to not exist and happily proceeds, but it panic()s if they exist but return permission denied.
-    postBuild = ''
-      patch -p0 < ${./darwin-sandbox-fix.patch}
-    '';
-  };
+  vendorHash = "sha256-KZKlARki/AXGhfsQsOixHjx+t1H9htd9oBx3wsiebY0=";

  excludedPackages = [ "./build" ];

@@ -62,10 +56,18 @@ buildGoModule (finalAttrs: {
  versionCheckProgramArg = "--version";
  doInstallCheck = true;

-  passthru.tests = {
-    inherit (nixosTests) temporal;
-    version = testers.testVersion {
-      package = temporal;
+  passthru = {
+    tests = {
+      inherit (nixosTests) temporal;
+      version = testers.testVersion {
+        package = temporal;
+      };
+    };
+
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--use-github-releases"
+      ];
    };
  };

--- a/pkgs/by-name/ti/tiled/package.nix
+++ b/pkgs/by-name/ti/tiled/package.nix
@@ -76,6 +76,12 @@ stdenv.mkDerivation (finalAttrs: {
    runHook postInstall
  '';

+  postInstall = ''
+    substituteInPlace $out/share/thumbnailers/tiled.thumbnailer \
+      --replace-fail "TryExec=tmxrasterizer" "TryExec=$out/bin/tmxrasterizer" \
+      --replace-fail "Exec=tmxrasterizer" "Exec=$out/bin/tmxrasterizer"
+  '';
+
  meta = {
    description = "Free, easy to use and flexible tile map editor";
    homepage = "https://www.mapeditor.org/";
--- a/pkgs/by-name/vi/victoriatraces/package.nix
+++ b/pkgs/by-name/vi/victoriatraces/package.nix
@@ -13,13 +13,13 @@

 buildGo126Module (finalAttrs: {
  pname = "VictoriaTraces";
-  version = "0.9.3";
+  version = "0.9.4";

  src = fetchFromGitHub {
    owner = "VictoriaMetrics";
    repo = "VictoriaTraces";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-jyVHqdnnvLEYFFVUwXNf/B9vSwKwPrE5iJzlRccOhTg=";
+    hash = "sha256-tIYiyaYHJzlOHeGSu+DlLTvxc5SrVWA76pMTCrJtwbE=";
  };

  vendorHash = null;
--- a/pkgs/by-name/xo/xournalpp/package.nix
+++ b/pkgs/by-name/xo/xournalpp/package.nix
@@ -67,6 +67,11 @@ stdenv.mkDerivation (finalAttrs: {

  buildFlags = [ "translations" ];

+  postInstall = ''
+    substituteInPlace $out/share/thumbnailers/com.github.xournalpp.xournalpp.thumbnailer \
+      --replace-fail "Exec=xournalpp-thumbnailer" "Exec=$out/bin/xournalpp-thumbnailer"
+  '';
+
  preFixup = ''
    gappsWrapperArgs+=(
      --prefix XDG_DATA_DIRS : "${adwaita-icon-theme}/share"
--- a/pkgs/by-name/xr/xreader/package.nix
+++ b/pkgs/by-name/xr/xreader/package.nix
@@ -79,6 +79,12 @@ stdenv.mkDerivation (finalAttrs: {
    djvulibre
  ];

+  postInstall = ''
+    substituteInPlace $out/share/thumbnailers/xreader.thumbnailer \
+      --replace-fail "TryExec=xreader-thumbnailer" "TryExec=$out/bin/xreader-thumbnailer" \
+      --replace-fail "Exec=xreader-thumbnailer" "Exec=$out/bin/xreader-thumbnailer"
+  '';
+
  preFixup = ''
    gappsWrapperArgs+=(
      --prefix XDG_DATA_DIRS : "${lib.makeSearchPath "share" [ xapp-symbolic-icons ]}"
--- a/pkgs/by-name/ze/zennotes-desktop/package.nix
+++ b/pkgs/by-name/ze/zennotes-desktop/package.nix
@@ -13,14 +13,14 @@

 buildNpmPackage (finalAttrs: {
  pname = "zennotes-desktop";
-  version = "2.12.0";
-  npmDepsHash = "sha256-Wy/I0mjEFuUjbTr5DFAeSAEaQ9G9fsNjh6lX8jn/wkA=";
+  version = "2.13.1";
+  npmDepsHash = "sha256-7dchbcGAZm+PlVsES76sYD9NOqeCulEKC7S0zLERvvY=";

  src = fetchFromGitHub {
    owner = "ZenNotes";
    repo = "zennotes";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Yvngd39S55KuYK1A0j+KP0ANA2YhZTiJ1ICX0HAvBuU=";
+    hash = "sha256-jhdX+GFzBBxbT+B04RDqm66qfDi/LcpJR5eCRlQhx68=";
  };

  npmWorkspace = "apps/desktop";
--- a/pkgs/development/lua-modules/generated-packages.nix
+++ b/pkgs/development/lua-modules/generated-packages.nix
@@ -1040,15 +1040,15 @@ final: prev: {
    }:
    buildLuarocksPackage {
      pname = "fzf-lua";
-      version = "0.0.2676-1";
+      version = "0.0.2682-1";
      knownRockspec =
        (fetchurl {
-          url = "mirror://luarocks/fzf-lua-0.0.2676-1.rockspec";
-          sha256 = "04nd0zfijpiy3iimzjcpyqp4p0l3bkl5d393v7rpi6m2ayzydhcl";
+          url = "mirror://luarocks/fzf-lua-0.0.2682-1.rockspec";
+          sha256 = "1kqpacp8ycywvdazcychl18xzdiw1bd1ga0780hffig3wgh190ys";
        }).outPath;
      src = fetchzip {
-        url = "https://github.com/ibhagwan/fzf-lua/archive/774150bc05f774af1df614f55d156b3318c6decd.zip";
-        sha256 = "0p85swghvns2fha9xmdhs6phvql7wzrdwchamp3a9bpyvay2nnzk";
+        url = "https://github.com/ibhagwan/fzf-lua/archive/532d463f5c83595192fe740572d8fd6902b2217a.zip";
+        sha256 = "1wy69gn4fx34jn5l7f8a9x4plbl1axv2aj7dw5q944ni71bwl8h1";
      };

      disabled = luaOlder "5.1";
@@ -1322,15 +1322,15 @@ final: prev: {
    }:
    buildLuarocksPackage {
      pname = "kulala.nvim";
-      version = "6.20.7-1";
+      version = "6.21.0-1";
      knownRockspec =
        (fetchurl {
-          url = "mirror://luarocks/kulala.nvim-6.20.7-1.rockspec";
-          sha256 = "0i607kc9vdspwqjdz17ppryh86k0xmri07lwbbllx8r5g3ds3n58";
+          url = "mirror://luarocks/kulala.nvim-6.21.0-1.rockspec";
+          sha256 = "11g9k9gi1cl9bmrcd70p6gy874nql6z0l3wfhiskjwac8385lqj3";
        }).outPath;
      src = fetchzip {
-        url = "https://github.com/mistweaverco/kulala.nvim/archive/v6.20.7.zip";
-        sha256 = "1z7sby5k07fwk275dr4ck1jhrhqi1wd4blnnpw9b7wynh1v3hpmh";
+        url = "https://github.com/mistweaverco/kulala.nvim/archive/v6.21.0.zip";
+        sha256 = "0zglgmxz1lcfzk7x4p6c78drpa60b9rf9bvsnmnbg2w0rypg91wm";
      };

      disabled = luaOlder "5.1";
@@ -2373,17 +2373,17 @@ final: prev: {
    }:
    buildLuarocksPackage {
      pname = "lua-resty-http";
-      version = "0.17.2-0";
+      version = "0.18.0-0";
      knownRockspec =
        (fetchurl {
-          url = "mirror://luarocks/lua-resty-http-0.17.2-0.rockspec";
-          sha256 = "10swbq779d1q794d17269v0ln26hblsk7kvxj9s60rx71skzql6s";
+          url = "mirror://luarocks/lua-resty-http-0.18.0-0.rockspec";
+          sha256 = "1zdhf22zbkb61k8vpkzmd33mn6nhl53splklv2aaj40066hlbhzs";
        }).outPath;
      src = fetchFromGitHub {
        owner = "ledgetech";
        repo = "lua-resty-http";
-        tag = "v0.17.2";
-        hash = "sha256-Ph3PpzQYKYMvPvjYwx4TeZ9RYoryMsO6mLpkAq/qlHY=";
+        tag = "v0.18.0";
+        hash = "sha256-3rHm44vLIT9cHIQa5EHbwdmB/KVaLl/RbvLgNsnYwc4=";
      };

      disabled = luaOlder "5.1";
@@ -4916,15 +4916,15 @@ final: prev: {
    }:
    buildLuarocksPackage {
      pname = "neotest-nix";
-      version = "2.2.0-1";
+      version = "2.3.0-1";
      knownRockspec =
        (fetchurl {
-          url = "mirror://luarocks/neotest-nix-2.2.0-1.rockspec";
-          sha256 = "07whvs4bwnlf4pf893r5y69246r9s3n1nypqgx5a1vlmmxinhx1v";
+          url = "mirror://luarocks/neotest-nix-2.3.0-1.rockspec";
+          sha256 = "0p5vc6nblxc5vqpxwr5a2fy8l14gdbqhvkkdx1zbkba01qph7rll";
        }).outPath;
      src = fetchzip {
-        url = "https://github.com/khaneliman/neotest-nix/archive/61ba4c732ed5d685deb33b7f42963ff765752991.zip";
-        sha256 = "139fiir0q5s3b5vlchm1fyngz4mgz5hnbm1n1h7xk2w6yhrk43mc";
+        url = "https://github.com/khaneliman/neotest-nix/archive/b61774dcb3e0d93af07c55de608775b8eb013fc7.zip";
+        sha256 = "1ynq7ywqn9l8dyzf4nzjvywrirjg6nrkijrv1mhasa7cikar567v";
      };

      disabled = luaOlder "5.1";
@@ -4937,7 +4937,7 @@ final: prev: {
        homepage = "https://github.com/khaneliman/neotest-nix";
        maintainers = with lib.maintainers; [ khaneliman ];
        license = lib.licenses.mit;
-        description = "A Neotest adapter for Nix flakes.";
+        description = "A Neotest adapter for Nix tests.";
      };
    }
  ) { };
@@ -6307,15 +6307,15 @@ final: prev: {
    }:
    buildLuarocksPackage {
      pname = "tree-sitter-kulala_http";
-      version = "0.2.1-1";
+      version = "0.3.0-1";
      knownRockspec =
        (fetchurl {
-          url = "mirror://luarocks/tree-sitter-kulala_http-0.2.1-1.rockspec";
-          sha256 = "05zrx3sqjdyibfdlm0ycf02s0vpzbaq47gwamg9bizjd5mhhyv22";
+          url = "mirror://luarocks/tree-sitter-kulala_http-0.3.0-1.rockspec";
+          sha256 = "15wvlzf7ggr1bli32zi865y4gfsdwiqmrl2kz7vga9c58gqb05pz";
        }).outPath;
      src = fetchzip {
-        url = "https://github.com/mistweaverco/tree-sitter-kulala-http/archive/v0.2.1.zip";
-        sha256 = "1xl2qjfdqj13jmqzvh90i9djlqf675br42z6jm3cfkmj14riid1s";
+        url = "https://github.com/mistweaverco/tree-sitter-kulala-http/archive/v0.3.0.zip";
+        sha256 = "08f9hx939xpnz772yc5zywkksgp9v0hhbj3xd2bb6xwf52avnfmm";
      };

      nativeBuildInputs = [ luarocks-build-treesitter-parser ];
--- a/pkgs/development/python-modules/nomadnet/default.nix
+++ b/pkgs/development/python-modules/nomadnet/default.nix
@@ -12,14 +12,14 @@

 buildPythonPackage (finalAttrs: {
  pname = "nomadnet";
-  version = "1.2.6";
+  version = "1.2.7";
  pyproject = true;

  __structuredAttrs = true;

  src = fetchPypi {
    inherit (finalAttrs) version pname;
-    hash = "sha256-XNRs4avq22JslxkSlqgTOj0bKuiVwam3i9bzoMAUjAU=";
+    hash = "sha256-52pFpgeRBXouASwpx8vLn+ZDHx7Tl6NttkgRkENhT1s=";
  };

  build-system = [ setuptools ];
--- a/pkgs/development/python-modules/publicsuffixlist/default.nix
+++ b/pkgs/development/python-modules/publicsuffixlist/default.nix
@@ -11,12 +11,12 @@

 buildPythonPackage (finalAttrs: {
  pname = "publicsuffixlist";
-  version = "1.0.2.20260703";
+  version = "1.0.2.20260710";
  pyproject = true;

  src = fetchPypi {
    inherit (finalAttrs) pname version;
-    hash = "sha256-NTZ4oalz09w74HpiWHRJP95yartWAHc8baWeQPBnZ3Q=";
+    hash = "sha256-lCJ66oP52KxMfVJ/LIan0qx2tjn09RAD0J9+8foEI6Q=";
  };

  postPatch = ''
--- a/pkgs/development/python-modules/pytest-mh/default.nix
+++ b/pkgs/development/python-modules/pytest-mh/default.nix
@@ -0,0 +1,54 @@
+{
+  lib,
+  buildPythonPackage,
+  fetchFromGitHub,
+  hatchling,
+  hatch-vcs,
+  hatch-requirements-txt,
+  ansible-pylibssh,
+  colorama,
+  pytest,
+  pyyaml,
+  gitUpdater,
+}:
+
+buildPythonPackage (finalAttrs: {
+  pname = "pytest-mh";
+  version = "1.0.29";
+  pyproject = true;
+
+  src = fetchFromGitHub {
+    owner = "next-actions";
+    repo = "pytest-mh";
+    tag = finalAttrs.version;
+    hash = "sha256-1QaqHDS+eU1O2aLWtdd6XWxErwqONAPngKe8FqYAmJY=";
+  };
+
+  build-system = [
+    hatchling
+    hatch-vcs
+    hatch-requirements-txt
+  ];
+
+  dependencies = [
+    ansible-pylibssh
+    colorama
+    pytest
+    pyyaml
+  ];
+
+  # Patch requirements.txt out of the package
+  postInstall = ''
+    rm -f $out/lib/python*/site-packages/requirements.txt
+  '';
+
+  passthru.updateScript = gitUpdater { };
+
+  meta = {
+    description = "pytest plugin that allows you to run shell commands and scripts over SSH on remote Linux or Windows hosts";
+    homepage = "https://github.com/next-actions/pytest-mh";
+    changelog = "https://github.com/next-actions/pytest-mh/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.gpl3;
+    maintainers = with lib.maintainers; [ joaosreis ];
+  };
+})
--- a/pkgs/development/python-modules/virtualenv-clone/default.nix
+++ b/pkgs/development/python-modules/virtualenv-clone/default.nix
@@ -19,6 +19,11 @@ buildPythonPackage (finalAttrs: {
    hash = "sha256-qrN74IwLRqiVPxU8gVhdiM34yBmiS/5ot07uroYPDVw=";
  };

+  patches = [
+    # https://github.com/edwardgeorge/virtualenv-clone/pull/84
+    ./fix-pyvenv-cfg-path.patch
+  ];
+
  build-system = [ setuptools ];

  postPatch = ''
--- a/pkgs/development/python-modules/virtualenv-clone/fix-pyvenv-cfg-path.patch
+++ b/pkgs/development/python-modules/virtualenv-clone/fix-pyvenv-cfg-path.patch
@@ -0,0 +1,71 @@
+From d5f6e1fead9bff210a1a1c4f92c80d48db807165 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Miro=20Hron=C4=8Dok?= <miro@hroncok.cz>
+Date: Fri, 6 Mar 2026 16:24:20 +0100
+Subject: [PATCH] Amend the virtualenv path in pyvenv.cfg command
+
+https://github.com/pypa/virtualenv/commit/44b7bd6d103bdc19860b0ca05c238171c6283008
+
+Without this, test_clone_contents fails with virtualenv 20.38.0+:
+
+                    with open(file_in_clone, 'rb') as f:
+                        lines = f.read().decode('utf-8')
+    >                   assert venv_path not in lines,\
+                            'Found source path in cloned file %s' % file_in_clone
+    E                   AssertionError: Found source path in cloned file /tmp/tmp_lsp66c7/clone_venv/pyvenv.cfg
+    E                   assert '/tmp/tmp_lsp66c7/srs_venv' not in 'home = /usr/bin\nimplementation = CPython\nversion_info = 3.14.3.final.0\nversion = 3.14.3\nexecutable = /usr/bin/python3.14\ncommand = /.../virtualenv-clone/.tox/py314/bin/python3 -m virtualenv /tmp/tmp_lsp66c7/srs_venv\nvirtualenv = 21.1.0\ninclude-system-site-packages = false\nbase-prefix = /usr\nbase-exec-prefix = /usr\nbase-executable = /usr/bin/python3.14\n'
+    E
+    E                     '/tmp/tmp_lsp66c7/srs_venv' is contained here:
+    E                       home = /usr/bin
+    E                       implementation = CPython
+    E                       version_info = 3.14.3.final.0
+    E                       version = 3.14.3
+    E                       executable = /usr/bin/python3.14
+    E                       command = /.../virtualenv-clone/.tox/py314/bin/python3 -m virtualenv /tmp/tmp_lsp66c7/srs_venv
+    E                     ?                                                                                                   +++++++++++++++++++++++++
+    E                       virtualenv = 21.1.0
+    E                       include-system-site-packages = false
+    E                       base-prefix = /usr
+    E                       base-exec-prefix = /usr
+    E                       base-executable = /usr/bin/python3.14
+
+Fixes https://github.com/edwardgeorge/virtualenv-clone/issues/83
+---
+ clonevirtualenv.py | 18 ++++++++++++++++++
+ 1 file changed, 18 insertions(+)
+
+diff --git a/clonevirtualenv.py b/clonevirtualenv.py
+index 399b11ddaed91bf37a3df94d42ceba7a6e15a0b5..f78573c5bffe42c856c6e5e79141522fce60d525 100755
+--- a/clonevirtualenv.py
+++ b/clonevirtualenv.py
+@@ -77,6 +77,7 @@ def clone_virtualenv(src_dir, dst_dir):
+     version, sys_path = _virtualenv_sys(dst_dir)
+     logger.info('fixing scripts in bin...')
+     fixup_scripts(src_dir, dst_dir, version)
+    fixup_pyvenv_cfg(src_dir, dst_dir)
+ 
+     has_old = lambda s: any(i for i in s if _dirmatch(i, src_dir))
+ 
+@@ -132,6 +133,23 @@ def fixup_scripts(old_dir, new_dir, version, rewrite_env_python=False):
+                 rewrite_env_python=rewrite_env_python)
+ 
+ 
+def fixup_pyvenv_cfg(old_dir, new_dir):
+    filename = os.path.join(new_dir, 'pyvenv.cfg')
+    if not os.path.exists(filename):
+        return
+    with open(filename, 'rb') as f:
+        original = f.read()
+    replaced = original.replace(
+        old_dir.encode('utf-8'),
+        new_dir.encode('utf-8')
+    )
+    if original == replaced:
+        return
+    logger.info('fixing pyvenv.cfg...')
+    with open(filename, 'wb') as f:
+        f.write(replaced)
+
+
+ def fixup_script_(root, file_, old_dir, new_dir, version,
+                   rewrite_env_python=False):
+     old_shebang = '#!%s/bin/python' % os.path.normcase(os.path.abspath(old_dir))
--- a/pkgs/development/tools/pnpm/default.nix
+++ b/pkgs/development/tools/pnpm/default.nix
@@ -17,6 +17,9 @@ let
        "CVE-2026-50017"
        "CVE-2026-50573"
        "CVE-2026-55699"
+        "CVE-2026-59194"
+        "CVE-2026-59195"
+        "CVE-2026-59196"
      ];
    };
    "9" = {
@@ -30,6 +33,9 @@ let
        "CVE-2026-50017"
        "CVE-2026-50573"
        "CVE-2026-55699"
+        "CVE-2026-59194"
+        "CVE-2026-59195"
+        "CVE-2026-59196"
      ];
    };
    # 10.29.3 made a breaking change: https://github.com/pnpm/pnpm/issues/10601.
@@ -46,6 +52,9 @@ let
        "CVE-2026-50017"
        "CVE-2026-50573"
        "CVE-2026-55699"
+        "CVE-2026-59194"
+        "CVE-2026-59195"
+        "CVE-2026-59196"
      ];
    };
    # 10.34.1 made a breaking change that causes
@@ -58,6 +67,9 @@ let
        "CVE-2026-55698"
        "CVE-2026-55180"
        "CVE-2026-55697"
+        "CVE-2026-59194"
+        "CVE-2026-59195"
+        "CVE-2026-59196"
      ];
    };
    "10" = {
@@ -65,8 +77,8 @@ let
      hash = "sha256-mM1XGNvYxLJokVZJO5WWzs9rZLGpjUoIfoITWhdbQOs=";
    };
    "11" = {
-      version = "11.10.0";
-      hash = "sha256-YgtmBepPYvxWptCphzP0eQcdAyHgPkhrUix+mnRhdDE=";
+      version = "11.11.0";
+      hash = "sha256-he8u/yFqGukIBMAMjfv6ZoU1NkRlDRCQaok8Ba7c2IQ=";
    };
  };

--- a/pkgs/servers/nextcloud/default.nix
+++ b/pkgs/servers/nextcloud/default.nix
@@ -5,6 +5,7 @@
  nixosTests,
  nextcloud32Packages,
  nextcloud33Packages,
+  nextcloud34Packages,
 }:

 let
@@ -20,18 +21,14 @@ let
      pname = "nextcloud";
      inherit version;

+      __structuredAttrs = true;
+      strictDeps = true;
+
      src = fetchurl {
        url = "https://download.nextcloud.com/server/releases/nextcloud-${version}.tar.bz2";
        inherit hash;
      };

-      passthru = {
-        tests = lib.filterAttrs (
-          key: _: (lib.hasSuffix (lib.versions.major version) key)
-        ) nixosTests.nextcloud;
-        inherit packages;
-      };
-
      installPhase = ''
        runHook preInstall
        mkdir -p $out/
@@ -39,6 +36,13 @@ let
        runHook postInstall
      '';

+      passthru = {
+        tests = lib.filterAttrs (
+          key: _: (lib.hasSuffix (lib.versions.major version) key)
+        ) nixosTests.nextcloud;
+        inherit packages;
+      };
+
      meta = {
        changelog = "https://nextcloud.com/changelog/#${lib.replaceStrings [ "." ] [ "-" ] version}";
        description = "Sharing solution for files, calendars, contacts and more";
@@ -64,6 +68,12 @@ in
    packages = nextcloud33Packages;
  };

+  nextcloud34 = generic {
+    version = "34.0.1";
+    hash = "sha256-BOnDL8P+Ofa2qKGJFe9a/SgKVrSn90Thj1+i7/+8SmM=";
+    packages = nextcloud34Packages;
+  };
+
  # tip: get the sha with:
  # curl 'https://download.nextcloud.com/server/releases/nextcloud-${version}.tar.bz2.sha256'
 }
--- a/pkgs/servers/nextcloud/packages/32.json
+++ b/pkgs/servers/nextcloud/packages/32.json
@@ -40,9 +40,9 @@
    ]
  },
  "contacts": {
-    "hash": "sha256-+13qOi3veMZ+QUN8G78a073u8MDgMfaR3HBu6eiEWYQ=",
-    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v8.3.14/contacts-v8.3.14.tar.gz",
-    "version": "8.3.14",
+    "hash": "sha256-rFKmEZtyQgFjGBN44H167hGQP+n72uhUEiXlD7OguTI=",
+    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v8.3.15/contacts-v8.3.15.tar.gz",
+    "version": "8.3.15",
    "description": "The Nextcloud contacts app is a user interface for Nextcloud's CardDAV server. Easily sync contacts from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Mail and Calendar – more to come.\n* 🎉 **Never forget a birthday!** You can sync birthdays and other recurring events with your Nextcloud Calendar.\n* 👥 **Sharing of Adressbooks!** You want to share your contacts with your friends or coworkers? No problem!\n* 🙈 **We’re not reinventing the wheel!** Based on the great and open SabreDAV library.",
    "homepage": "https://github.com/nextcloud/contacts#readme",
    "licenses": [
@@ -50,9 +50,9 @@
    ]
  },
  "cookbook": {
-    "hash": "sha256-Xn2yvgVL7XPIN8awCaH5mznRMW9Jcr0s2E19D13Hm8I=",
-    "url": "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.7/cookbook-0.11.7.tar.gz",
-    "version": "0.11.7",
+    "hash": "sha256-eOB04pPqR5rthxK+yrpxuxgZes9chxjRKhy2yd+kIME=",
+    "url": "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.8/cookbook-0.11.8.tar.gz",
+    "version": "0.11.8",
    "description": "A library for all your recipes. It uses JSON files following the schema.org recipe format. To add a recipe to the collection, you can paste in the URL of the recipe, and the provided web page will be parsed and downloaded to whichever folder you specify in the app settings.",
    "homepage": "https://github.com/nextcloud/cookbook/",
    "licenses": [
@@ -150,9 +150,9 @@
    ]
  },
  "groupfolders": {
-    "hash": "sha256-/29wB6jwECzMsRvp5dXNuKodoMmYjD2gO9xiQX3Bg18=",
-    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v20.1.15/groupfolders-v20.1.15.tar.gz",
-    "version": "20.1.15",
+    "hash": "sha256-rOa82k/IwJdAweCzkZKLLqiOtP63eRdq98zxlnttFzc=",
+    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v20.1.16/groupfolders-v20.1.16.tar.gz",
+    "version": "20.1.16",
    "description": "Team Folders (formerly \"Group Folders\") allows administrators to create and manage shared\nfolders for selected teams within Nextcloud.\n\nAdmins can grant one or more teams access to a folder, configure permissions (such as read,\nwrite, and sharing rights), and assign storage quotas from the Team Folders section (under\nadmin settings). The app also supports advanced permissions and integration with Nextcloud’s\ntrash and versioning systems.\n\nAs of Hub 10 / Nextcloud 31, admins must be members of a team to assign that team to a Team\nFolder.",
    "homepage": "https://github.com/nextcloud/groupfolders",
    "licenses": [
@@ -160,9 +160,9 @@
    ]
  },
  "guests": {
-    "hash": "sha256-w1uPtTZEQFJlhfobGflHf17GEYF3oBPwhieumWfYaDk=",
-    "url": "https://github.com/nextcloud-releases/guests/releases/download/v4.7.5/guests-v4.7.5.tar.gz",
-    "version": "4.7.5",
+    "hash": "sha256-MK3P6fMKYWgKkYTPy9oQFTea/B2iJoZANVVT/HFEnKI=",
+    "url": "https://github.com/nextcloud-releases/guests/releases/download/v4.8.0/guests-v4.8.0.tar.gz",
+    "version": "4.8.0",
    "description": "👥 Allows for better collaboration with external users by allowing users to create guests account.\n\nGuests accounts can be created from the share menu by entering either the recipients email or name and choosing \"create guest account\", once the share is created the guest user will receive an email notification about the mail with a link to set their password.\n\nGuests users can only access files shared to them and cannot create any files outside of shares, additionally, the apps accessible to guest accounts are whitelisted.",
    "homepage": "https://github.com/nextcloud/guests/",
    "licenses": [
@@ -210,9 +210,9 @@
    ]
  },
  "mail": {
-    "hash": "sha256-GkLTk3Q1mSUGhU6lsNHmHGkwW6u4XoDCOj405vi8xuY=",
-    "url": "https://github.com/nextcloud-releases/mail/releases/download/v5.10.3/mail-v5.10.3.tar.gz",
-    "version": "5.10.3",
+    "hash": "sha256-c0pMd+A2Fbxa/20BAkg3lPeVRIdu0XRTbAGJxb/9NT0=",
+    "url": "https://github.com/nextcloud-releases/mail/releases/download/v5.10.7/mail-v5.10.7.tar.gz",
+    "version": "5.10.7",
    "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://www.horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** 🟢/🟡/🟠/🔴\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
    "homepage": "https://github.com/nextcloud/mail#readme",
    "licenses": [
@@ -270,9 +270,9 @@
    ]
  },
  "oidc": {
-    "hash": "sha256-CTnFegGasnG+2MPK6c0H01OjrEKSM0WALwns9nJySaA=",
-    "url": "https://github.com/H2CK/oidc/releases/download/1.17.0/oidc-1.17.0.tar.gz",
-    "version": "1.17.0",
+    "hash": "sha256-5CJjNvbZHuadT+7IHMNJSp8r47kZqzQwMey7ccpe/4Y=",
+    "url": "https://github.com/H2CK/oidc/releases/download/2.0.3/oidc-2.0.3.tar.gz",
+    "version": "2.0.3",
    "description": "Nextcloud as OpenID Connect Identity Provider\n\nWith this app you can use Nextcloud as OpenID Connect Identity Provider. If other services\nare configured correctly, you are able to access those services with your Nextcloud login.\n\nFull documentation can be found at:\n\n- [User Documentation](https://github.com/H2CK/oidc/wiki#user-documentation)\n- [Developer Documentation](https://github.com/H2CK/oidc/wiki#developer-documentation)",
    "homepage": "https://github.com/H2CK/oidc",
    "licenses": [
@@ -390,9 +390,9 @@
    ]
  },
  "spreed": {
-    "hash": "sha256-uBvz8qpJ/PDseSDLp4aWAmTlDIOtoGWAXRouYdqU3Yc=",
-    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v22.0.14/spreed-v22.0.14.tar.gz",
-    "version": "22.0.14",
+    "hash": "sha256-Px8WFUNSRRWMcR/keUhoss7sjOUfXB9IAKdFKPzuSqs=",
+    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v22.0.15/spreed-v22.0.15.tar.gz",
+    "version": "22.0.15",
    "description": "Chat, video & audio-conferencing using WebRTC\n\n* 💬 **Chat** Nextcloud Talk comes with a simple text chat, allowing you to share or upload files from your Nextcloud Files app or local device and mention other participants.\n* 👥 **Private, group, public and password protected calls!** Invite someone, a whole group or send a public link to invite to a call.\n* 🌐 **Federated chats** Chat with other Nextcloud users on their servers\n* 💻 **Screen sharing!** Share your screen with the participants of your call.\n* 🚀 **Integration with other Nextcloud apps** like Files, Calendar, User status, Dashboard, Flow, Maps, Smart picker, Contacts, Deck, and many more.\n* 🌉 **Sync with other chat solutions** With [Matterbridge](https://github.com/42wim/matterbridge/) being integrated in Talk, you can easily sync a lot of other chat solutions to Nextcloud Talk and vice-versa.",
    "homepage": "https://github.com/nextcloud/spreed",
    "licenses": [
@@ -410,9 +410,9 @@
    ]
  },
  "tasks": {
-    "hash": "sha256-nJFU65dthPRWd/SClKM/suZdYU3ic3QsIcXiPzUkQ6c=",
-    "url": "https://github.com/nextcloud/tasks/releases/download/v0.18.0/tasks.tar.gz",
-    "version": "0.18.0",
+    "hash": "sha256-DJiNUFMcm/okbmwx8/lTaa3eFim6cNFRlJFatW4kaHs=",
+    "url": "https://github.com/nextcloud/tasks/releases/download/v0.18.1/tasks.tar.gz",
+    "version": "0.18.1",
    "description": "Once enabled, a new Tasks menu will appear in your Nextcloud apps menu. From there you can add and delete tasks, edit their title, description, start and due dates and mark them as important. Tasks can be shared between users. Tasks can be synchronized using CalDav (each task list is linked to an Nextcloud calendar, to sync it to your local client: Thunderbird, Evolution, KDE Kontact, iCal … - just add the calendar as a remote calendar in your client). You can download your tasks as ICS files using the download button for each calendar.",
    "homepage": "https://github.com/nextcloud/tasks/",
    "licenses": [
@@ -430,9 +430,9 @@
    ]
  },
  "twofactor_admin": {
-    "hash": "sha256-dx8bEsC/rSAKN9rwP2hf3d8G3f3J1RzCrSqU6BbcvRY=",
-    "url": "https://github.com/nextcloud-releases/twofactor_admin/releases/download/v4.11.1/twofactor_admin-v4.11.1.tar.gz",
-    "version": "4.11.1",
+    "hash": "sha256-IkHzIqRBhG6zr+8y5ifrRfsKl9TyMDx7G1JGogbQrDM=",
+    "url": "https://github.com/nextcloud-releases/twofactor_admin/releases/download/v4.12.0/twofactor_admin-v4.12.0.tar.gz",
+    "version": "4.12.0",
    "description": "This two-factor auth (2FA) provider for Nextcloud allows admins to generate a one-time\n\t\tcode for users to log into a 2FA protected account. This is helpful in situations where\n\t\tusers have lost access to their other 2FA methods or mandatory 2FA without any previously\n\t\tenabled 2FA provider.",
    "homepage": "",
    "licenses": [
@@ -480,9 +480,9 @@
    ]
  },
  "user_saml": {
-    "hash": "sha256-rEeaUUYhsTVLZDo11Xh/wGI3k97Tq5J0Jn18QY1M1Xs=",
-    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v8.1.2/user_saml-v8.1.2.tar.gz",
-    "version": "8.1.2",
+    "hash": "sha256-LDiWtEaVJbNECJkcn80L4behkUyUsRlDFDd2lk2g+pE=",
+    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v8.1.4/user_saml-v8.1.4.tar.gz",
+    "version": "8.1.4",
    "description": "Using the SSO & SAML app of your Nextcloud you can make it easily possible to integrate your existing Single-Sign-On solution with Nextcloud. In addition, you can use the Nextcloud LDAP user provider to keep the convenience for users. (e.g. when sharing)\nThe following providers are supported and tested at the moment:\n\n* **SAML 2.0**\n\t* OneLogin\n\t* Shibboleth\n\t* Active Directory Federation Services (ADFS)\n\t* Authentik\n\n* **Authentication via Environment Variable**\n\t* Kerberos (mod_auth_kerb)\n\t* Any other provider that authenticates using the environment variable\n\nWhile theoretically any other authentication provider implementing either one of those standards is compatible, we like to note that they are not part of any internal test matrix.",
    "homepage": "https://github.com/nextcloud/user_saml",
    "licenses": [
--- a/pkgs/servers/nextcloud/packages/33.json
+++ b/pkgs/servers/nextcloud/packages/33.json
@@ -40,9 +40,9 @@
    ]
  },
  "contacts": {
-    "hash": "sha256-L0ro4VoU1GDMcs1m7qGns+S8y5+n1Q0oQ5EO1ojdLr0=",
-    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v8.7.2/contacts-v8.7.2.tar.gz",
-    "version": "8.7.2",
+    "hash": "sha256-Lgw+wF40FlZTlbw5IXG/eUW8Chaw5Cm1i9f2R8YyPRU=",
+    "url": "https://github.com/nextcloud-releases/contacts/releases/download/v8.7.3/contacts-v8.7.3.tar.gz",
+    "version": "8.7.3",
    "description": "The Nextcloud contacts app is a user interface for Nextcloud's CardDAV server. Easily sync contacts from various devices with your Nextcloud and edit them online.\n\n* 🚀 **Integration with other Nextcloud apps!** Currently Mail and Calendar – more to come.\n* 🎉 **Never forget a birthday!** You can sync birthdays and other recurring events with your Nextcloud Calendar.\n* 👥 **Sharing of Adressbooks!** You want to share your contacts with your friends or coworkers? No problem!\n* 🙈 **We’re not reinventing the wheel!** Based on the great and open SabreDAV library.",
    "homepage": "https://github.com/nextcloud/contacts#readme",
    "licenses": [
@@ -50,9 +50,9 @@
    ]
  },
  "cookbook": {
-    "hash": "sha256-Xn2yvgVL7XPIN8awCaH5mznRMW9Jcr0s2E19D13Hm8I=",
-    "url": "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.7/cookbook-0.11.7.tar.gz",
-    "version": "0.11.7",
+    "hash": "sha256-eOB04pPqR5rthxK+yrpxuxgZes9chxjRKhy2yd+kIME=",
+    "url": "https://github.com/christianlupus-nextcloud/cookbook-releases/releases/download/v0.11.8/cookbook-0.11.8.tar.gz",
+    "version": "0.11.8",
    "description": "A library for all your recipes. It uses JSON files following the schema.org recipe format. To add a recipe to the collection, you can paste in the URL of the recipe, and the provided web page will be parsed and downloaded to whichever folder you specify in the app settings.",
    "homepage": "https://github.com/nextcloud/cookbook/",
    "licenses": [
@@ -150,9 +150,9 @@
    ]
  },
  "groupfolders": {
-    "hash": "sha256-2jy9p4pu2OXdi8JENFCBcPSDHnGIQkpzuyKkjxALAE4=",
-    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v21.0.8/groupfolders-v21.0.8.tar.gz",
-    "version": "21.0.8",
+    "hash": "sha256-2LlfB3hCX2RvIxG6W0LY4vz9833C/TX8rI0/Ab3jiiE=",
+    "url": "https://github.com/nextcloud-releases/groupfolders/releases/download/v21.0.9/groupfolders-v21.0.9.tar.gz",
+    "version": "21.0.9",
    "description": "Team Folders (formerly \"Group Folders\") allows administrators to create and manage shared\nfolders for selected teams within Nextcloud.\n\nAdmins can grant one or more teams access to a folder, configure permissions (such as read,\nwrite, and sharing rights), and assign storage quotas from the Team Folders section (under\nadmin settings). The app also supports advanced permissions and integration with Nextcloud’s\ntrash and versioning systems.\n\nAs of Hub 10 / Nextcloud 31, admins must be members of a team to assign that team to a Team\nFolder.",
    "homepage": "https://github.com/nextcloud/groupfolders",
    "licenses": [
@@ -160,9 +160,9 @@
    ]
  },
  "guests": {
-    "hash": "sha256-w1uPtTZEQFJlhfobGflHf17GEYF3oBPwhieumWfYaDk=",
-    "url": "https://github.com/nextcloud-releases/guests/releases/download/v4.7.5/guests-v4.7.5.tar.gz",
-    "version": "4.7.5",
+    "hash": "sha256-MK3P6fMKYWgKkYTPy9oQFTea/B2iJoZANVVT/HFEnKI=",
+    "url": "https://github.com/nextcloud-releases/guests/releases/download/v4.8.0/guests-v4.8.0.tar.gz",
+    "version": "4.8.0",
    "description": "👥 Allows for better collaboration with external users by allowing users to create guests account.\n\nGuests accounts can be created from the share menu by entering either the recipients email or name and choosing \"create guest account\", once the share is created the guest user will receive an email notification about the mail with a link to set their password.\n\nGuests users can only access files shared to them and cannot create any files outside of shares, additionally, the apps accessible to guest accounts are whitelisted.",
    "homepage": "https://github.com/nextcloud/guests/",
    "licenses": [
@@ -210,9 +210,9 @@
    ]
  },
  "mail": {
-    "hash": "sha256-GkLTk3Q1mSUGhU6lsNHmHGkwW6u4XoDCOj405vi8xuY=",
-    "url": "https://github.com/nextcloud-releases/mail/releases/download/v5.10.3/mail-v5.10.3.tar.gz",
-    "version": "5.10.3",
+    "hash": "sha256-c0pMd+A2Fbxa/20BAkg3lPeVRIdu0XRTbAGJxb/9NT0=",
+    "url": "https://github.com/nextcloud-releases/mail/releases/download/v5.10.7/mail-v5.10.7.tar.gz",
+    "version": "5.10.7",
    "description": "**💌 A mail app for Nextcloud**\n\n- **🚀 Integration with other Nextcloud apps!** Currently Contacts, Calendar & Files – more to come.\n- **📥 Multiple mail accounts!** Personal and company account? No problem, and a nice unified inbox. Connect any IMAP account.\n- **🔒 Send & receive encrypted mails!** Using the great [Mailvelope](https://mailvelope.com) browser extension.\n- **🙈 We’re not reinventing the wheel!** Based on the great [Horde](https://www.horde.org) libraries.\n- **📬 Want to host your own mail server?** We do not have to reimplement this as you could set up [Mail-in-a-Box](https://mailinabox.email)!\n\n## Ethical AI Rating\n\n### Priority Inbox\n\nPositive:\n* The software for training and inferencing of this model is open source.\n* The model is created and trained on-premises based on the user's own data.\n* The training data is accessible to the user, making it possible to check or correct for bias or optimise the performance and CO2 usage.\n\n### Thread Summaries (opt-in)\n\n**Rating:** 🟢/🟡/🟠/🔴\n\nThe rating depends on the installed text processing backend. See [the rating overview](https://docs.nextcloud.com/server/latest/admin_manual/ai/index.html) for details.\n\nLearn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).",
    "homepage": "https://github.com/nextcloud/mail#readme",
    "licenses": [
@@ -270,9 +270,9 @@
    ]
  },
  "oidc": {
-    "hash": "sha256-CTnFegGasnG+2MPK6c0H01OjrEKSM0WALwns9nJySaA=",
-    "url": "https://github.com/H2CK/oidc/releases/download/1.17.0/oidc-1.17.0.tar.gz",
-    "version": "1.17.0",
+    "hash": "sha256-5CJjNvbZHuadT+7IHMNJSp8r47kZqzQwMey7ccpe/4Y=",
+    "url": "https://github.com/H2CK/oidc/releases/download/2.0.3/oidc-2.0.3.tar.gz",
+    "version": "2.0.3",
    "description": "Nextcloud as OpenID Connect Identity Provider\n\nWith this app you can use Nextcloud as OpenID Connect Identity Provider. If other services\nare configured correctly, you are able to access those services with your Nextcloud login.\n\nFull documentation can be found at:\n\n- [User Documentation](https://github.com/H2CK/oidc/wiki#user-documentation)\n- [Developer Documentation](https://github.com/H2CK/oidc/wiki#developer-documentation)",
    "homepage": "https://github.com/H2CK/oidc",
    "licenses": [
@@ -390,9 +390,9 @@
    ]
  },
  "spreed": {
-    "hash": "sha256-1oIezD9c7DPPGlFXfKrt/+3ohQpcD+JiKKArRXiDRYM=",
-    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v23.0.7/spreed-v23.0.7.tar.gz",
-    "version": "23.0.7",
+    "hash": "sha256-/katcYNLcsdnjHA+4ES+kdvhzuPNdDSv5Ann7X0+5xI=",
+    "url": "https://github.com/nextcloud-releases/spreed/releases/download/v23.0.8/spreed-v23.0.8.tar.gz",
+    "version": "23.0.8",
    "description": "Chat, video & audio-conferencing using WebRTC\n\n* 💬 **Chat** Nextcloud Talk comes with a simple text chat, allowing you to share or upload files from your Nextcloud Files app or local device and mention other participants.\n* 👥 **Private, group, public and password protected calls!** Invite someone, a whole group or send a public link to invite to a call.\n* 🌐 **Federated chats** Chat with other Nextcloud users on their servers\n* 💻 **Screen sharing!** Share your screen with the participants of your call.\n* 🚀 **Integration with other Nextcloud apps** like Files, Calendar, User status, Dashboard, Flow, Maps, Smart picker, Contacts, Deck, and many more.\n* 🌉 **Sync with other chat solutions** With [Matterbridge](https://github.com/42wim/matterbridge/) being integrated in Talk, you can easily sync a lot of other chat solutions to Nextcloud Talk and vice-versa.",
    "homepage": "https://github.com/nextcloud/spreed",
    "licenses": [
@@ -410,9 +410,9 @@
    ]
  },
  "tasks": {
-    "hash": "sha256-nJFU65dthPRWd/SClKM/suZdYU3ic3QsIcXiPzUkQ6c=",
-    "url": "https://github.com/nextcloud/tasks/releases/download/v0.18.0/tasks.tar.gz",
-    "version": "0.18.0",
+    "hash": "sha256-DJiNUFMcm/okbmwx8/lTaa3eFim6cNFRlJFatW4kaHs=",
+    "url": "https://github.com/nextcloud/tasks/releases/download/v0.18.1/tasks.tar.gz",
+    "version": "0.18.1",
    "description": "Once enabled, a new Tasks menu will appear in your Nextcloud apps menu. From there you can add and delete tasks, edit their title, description, start and due dates and mark them as important. Tasks can be shared between users. Tasks can be synchronized using CalDav (each task list is linked to an Nextcloud calendar, to sync it to your local client: Thunderbird, Evolution, KDE Kontact, iCal … - just add the calendar as a remote calendar in your client). You can download your tasks as ICS files using the download button for each calendar.",
    "homepage": "https://github.com/nextcloud/tasks/",
    "licenses": [
@@ -430,9 +430,9 @@
    ]
  },
  "twofactor_admin": {
-    "hash": "sha256-dx8bEsC/rSAKN9rwP2hf3d8G3f3J1RzCrSqU6BbcvRY=",
-    "url": "https://github.com/nextcloud-releases/twofactor_admin/releases/download/v4.11.1/twofactor_admin-v4.11.1.tar.gz",
-    "version": "4.11.1",
+    "hash": "sha256-IkHzIqRBhG6zr+8y5ifrRfsKl9TyMDx7G1JGogbQrDM=",
+    "url": "https://github.com/nextcloud-releases/twofactor_admin/releases/download/v4.12.0/twofactor_admin-v4.12.0.tar.gz",
+    "version": "4.12.0",
    "description": "This two-factor auth (2FA) provider for Nextcloud allows admins to generate a one-time\n\t\tcode for users to log into a 2FA protected account. This is helpful in situations where\n\t\tusers have lost access to their other 2FA methods or mandatory 2FA without any previously\n\t\tenabled 2FA provider.",
    "homepage": "",
    "licenses": [
@@ -480,9 +480,9 @@
    ]
  },
  "user_saml": {
-    "hash": "sha256-rEeaUUYhsTVLZDo11Xh/wGI3k97Tq5J0Jn18QY1M1Xs=",
-    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v8.1.2/user_saml-v8.1.2.tar.gz",
-    "version": "8.1.2",
+    "hash": "sha256-LDiWtEaVJbNECJkcn80L4behkUyUsRlDFDd2lk2g+pE=",
+    "url": "https://github.com/nextcloud-releases/user_saml/releases/download/v8.1.4/user_saml-v8.1.4.tar.gz",
+    "version": "8.1.4",
    "description": "Using the SSO & SAML app of your Nextcloud you can make it easily possible to integrate your existing Single-Sign-On solution with Nextcloud. In addition, you can use the Nextcloud LDAP user provider to keep the convenience for users. (e.g. when sharing)\nThe following providers are supported and tested at the moment:\n\n* **SAML 2.0**\n\t* OneLogin\n\t* Shibboleth\n\t* Active Directory Federation Services (ADFS)\n\t* Authentik\n\n* **Authentication via Environment Variable**\n\t* Kerberos (mod_auth_kerb)\n\t* Any other provider that authenticates using the environment variable\n\nWhile theoretically any other authentication provider implementing either one of those standards is compatible, we like to note that they are not part of any internal test matrix.",
    "homepage": "https://github.com/nextcloud/user_saml",
    "licenses": [
--- a/pkgs/servers/nextcloud/packages/34.json
+++ b/pkgs/servers/nextcloud/packages/34.json
--- a/pkgs/servers/nextcloud/packages/apps/memories.nix
+++ b/pkgs/servers/nextcloud/packages/apps/memories.nix
@@ -18,10 +18,11 @@ let
      srcHash = "sha256-KyUfrKHnRO3lMin0seSNFRnRRTPo12NbbvbkSpxSMQE=";
    };
    "33" = {
-      version = "8.0.1";
-      appHash = "sha256-B+O78qjBQbmMnFAvH/5a+YBive+rkBG9AKTX7G3qNR0=";
-      srcHash = "sha256-t/DiGJzSey9YpV5GkepKSGjr5gXc9KWDBtSY5UPRlEU=";
+      version = "8.1.0";
+      appHash = "sha256-SQ1gPdfICFqNBJM0dJOfKIJ/E1tBBcBQOjRdb/mKb04=";
+      srcHash = "sha256-T0oz5d4kPX/Pm06vKGTrltUFd1pKccsz5IDjv/Vmuz0=";
    };
+    "34" = latestVersionForNc."33";
  };
  currentVersionInfo =
    latestVersionForNc.${ncVersion}
--- a/pkgs/servers/nextcloud/packages/apps/recognize.nix
+++ b/pkgs/servers/nextcloud/packages/apps/recognize.nix
@@ -27,6 +27,11 @@ let
      appHash = "sha256-x3LXZKDWmzCYLTaNqSvgu4Gvrn6w2c/jifNCx1oaw1U=";
      modelHash = "sha256-Yx/NJwtD4ltETpkzlcadZsFKqEmMneoZaXiHVSB1WoE=";
    };
+    "34" = {
+      version = "12.0.0";
+      appHash = "sha256-1TpfDRMmJ7d5MPp0iTr/RpZHAG7LDsXof9u35O3+5Mg=";
+      modelHash = "sha256-+ec7kRPyWPVTk2wgRKMOP5mdmSnpv9mZmiRicEDKD6A=";
+    };
  };
  currentVersionInfo =
    latestVersionForNc.${ncVersion}
@@ -74,7 +79,9 @@ stdenv.mkDerivation rec {
    substituteInPlace recognize/lib/**/*.php \
      --replace-quiet "\$this->settingsService->getSetting('node_binary')" "'${lib.getExe nodejs}'" \
      --replace-quiet "\$this->config->getAppValueString('node_binary', '""')" "'${lib.getExe nodejs}'" \
-      --replace-quiet "\$this->config->getAppValueString('node_binary')" "'${lib.getExe nodejs}'"
+      --replace-quiet "\$this->config->getAppValueString('node_binary')" "'${lib.getExe nodejs}'" \
+      --replace-quiet "\$this->config->getAppValueString('node_binary', ''', lazy: true)" "'${lib.getExe nodejs}'" \
+      --replace-quiet "\$this->config->getAppValueString('node_binary', lazy: true)" "'${lib.getExe nodejs}'"
    test "$(grep "get[a-zA-Z]*('node_binary'" recognize/lib/**/*.php | wc -l)" -eq 0

    # Skip trying to install it... (less warnings in the log)
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1650,6 +1650,7 @@ mapAliases {
  nix-linter = throw "nix-linter has been removed as it was broken for 3 years and unmaintained upstream"; # Added 2025-09-06
  nix-plugin-pijul = throw "nix-plugin-pijul has been removed due to being discontinued"; # Added 2025-05-18
  nix_2_3 = throw "'nix_2_3' has been removed, because it was unmaintained and insecure."; # Converted to throw 2025-07-24
+  nixbang = throw "'nixbang' has been removed because it was unmaintained upstream. Use nix-shell shebang instead'"; # Added 2026-07-02
  nixfmt-classic =
    (
      if lib.oldestSupportedReleaseIsAtLeast 2605 then
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2602,10 +2602,12 @@ with pkgs;
  inherit (callPackages ../servers/nextcloud { })
    nextcloud32
    nextcloud33
+    nextcloud34
    ;

  nextcloud32Packages = callPackage ../servers/nextcloud/packages { ncVersion = "32"; };
  nextcloud33Packages = callPackage ../servers/nextcloud/packages { ncVersion = "33"; };
+  nextcloud34Packages = callPackage ../servers/nextcloud/packages { ncVersion = "34"; };

  nextcloud-notify_push = callPackage ../servers/nextcloud/notify_push.nix { };

--- a/pkgs/top-level/python-packages.nix
+++ b/pkgs/top-level/python-packages.nix
@@ -16145,6 +16145,8 @@ self: super: with self; {

  pytest-metadata = callPackage ../development/python-modules/pytest-metadata { };

+  pytest-mh = callPackage ../development/python-modules/pytest-mh { };
+
  pytest-mock = callPackage ../development/python-modules/pytest-mock { };

  pytest-mockito = callPackage ../development/python-modules/pytest-mockito { };