Merge staging-next-26.05 into staging-26.05

2026-09-29 19:30:11 +00:00 · 2026-09-20 00:32:22 +00:00
parent 581c8e4e32 107fcea8c1
commit fd8892684a
98 changed files with 3377 additions and 4489 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -10100,6 +10100,12 @@
    githubId = 2041764;
    name = "Andreas Wendleder";
  };
+  goobertony = {
+    github = "goobertony";
+    email = "tonygameing@proton.me";
+    githubId = 133613491;
+    name = "Tonii Bittersweet";
+  };
  goodrone = {
    email = "goodrone@gmail.com";
    github = "goodrone";
--- a/nixos/modules/services/misc/klipper.nix
+++ b/nixos/modules/services/misc/klipper.nix
@@ -270,7 +270,7 @@ in
          popd
        '';

-        restartTriggers = lib.optional (!cfg.mutableConfig) [ printerConfig ];
+        restartTriggers = lib.optionals (!cfg.mutableConfig) [ printerConfig ];

        serviceConfig = {
          ExecStart = "${cfg.package}/bin/klippy ${klippyArgs} ${cfg.configDir}/printer.cfg";
--- a/nixos/modules/services/misc/pinchflat.nix
+++ b/nixos/modules/services/misc/pinchflat.nix
@@ -16,6 +16,7 @@ let
    getExe
    literalExpression
    optional
+    optionals
    attrValues
    mapAttrs
    ;
@@ -158,7 +159,7 @@ in
          "LOG_LEVEL=${cfg.logLevel}"
          "PHX_SERVER=true"
        ]
-        ++ optional cfg.selfhosted [ "RUN_CONTEXT=selfhosted" ]
+        ++ optionals cfg.selfhosted [ "RUN_CONTEXT=selfhosted" ]
        ++ optional (!isNull config.time.timeZone) "TZ=${config.time.timeZone}"
        ++ attrValues (mapAttrs (name: value: name + "=" + toString value) cfg.extraConfig);
        EnvironmentFile = optional (cfg.secretsFile != null) cfg.secretsFile;
--- a/nixos/modules/services/monitoring/prometheus/exporters/restic.nix
+++ b/nixos/modules/services/monitoring/prometheus/exporters/restic.nix
@@ -16,7 +16,7 @@ let
    mapAttrs'
    splitString
    toUpper
-    optional
+    optionals
    optionalAttrs
    nameValuePair
    ;
@@ -145,7 +145,7 @@ in
      LoadCredential = [
        "RESTIC_PASSWORD_FILE:${cfg.passwordFile}"
      ]
-      ++ optional (cfg.repositoryFile != null) [ "RESTIC_REPOSITORY:${cfg.repositoryFile}" ];
+      ++ optionals (cfg.repositoryFile != null) [ "RESTIC_REPOSITORY:${cfg.repositoryFile}" ];
    };
    environment =
      let
--- a/nixos/modules/services/monitoring/vmagent.nix
+++ b/nixos/modules/services/monitoring/vmagent.nix
@@ -152,7 +152,7 @@ in
          startCLIList
          ++ lib.optionals (cfg.prometheusConfig != { }) [ "-promscrape.config=${prometheusConfigYml}" ]
        );
-        LoadCredential = lib.optional (cfg.remoteWrite.basicAuthPasswordFile != null) [
+        LoadCredential = lib.optionals (cfg.remoteWrite.basicAuthPasswordFile != null) [
          "remote_write_basic_auth_password:${cfg.remoteWrite.basicAuthPasswordFile}"
        ];
      };
--- a/nixos/modules/services/web-servers/garage.nix
+++ b/nixos/modules/services/web-servers/garage.nix
@@ -133,7 +133,7 @@ in
            # if data_dir is a list, the actual path will in in the `path` attribute of each item
            # see https://garagehq.deuxfleurs.fr/documentation/reference-manual/configuration/#data_dir
            ++ lib.optional (lib.isList data_dir) (map (item: item.path) data_dir)
-            ++ lib.optional (lib.isString data_dir) [ data_dir ]
+            ++ lib.optionals (lib.isString data_dir) [ data_dir ]
          );
          isDefault = lib.hasPrefix "/var/lib/garage";
          isDefaultStateDirectory = lib.any isDefault paths;
--- a/nixos/modules/services/web-servers/nginx/default.nix
+++ b/nixos/modules/services/web-servers/nginx/default.nix
@@ -1578,7 +1578,7 @@ in
          SystemCallFilter = [
            "~@cpu-emulation @debug @keyring @mount @obsolete @privileged @setuid"
          ]
-          ++ optional cfg.enableQuicBPF [ "bpf" ];
+          ++ optionals cfg.enableQuicBPF [ "bpf" ];
        };
      };

--- a/nixos/modules/services/web-servers/stargazer.nix
+++ b/nixos/modules/services/web-servers/stargazer.nix
@@ -271,7 +271,7 @@ in
          "~CAP_SYS_BOOT"
          "~CAP_NET_ADMIN"
        ]
-        ++ lib.lists.optional (!cfg.allowCgiUser) [
+        ++ lib.lists.optionals (!cfg.allowCgiUser) [
          "~CAP_SETGID"
          "~CAP_SETUID"
        ];
@@ -279,7 +279,7 @@ in
        SystemCallFilter = [
          "~@cpu-emulation @debug @keyring @mount @obsolete"
        ]
-        ++ lib.lists.optional (!cfg.allowCgiUser) [ "@privileged @setuid" ];
+        ++ lib.lists.optionals (!cfg.allowCgiUser) [ "@privileged @setuid" ];
      };
    };

--- a/pkgs/applications/editors/vscode/generic.nix
+++ b/pkgs/applications/editors/vscode/generic.nix
@@ -295,7 +295,7 @@ stdenv.mkDerivation (
    dontConfigure = true;
    noDumpEnvVars = true;

-    stripExclude = lib.optional hasVsceSign [
+    stripExclude = lib.optionals hasVsceSign [
      # vsce-sign is a single executable application built with Node.js, and it becomes non-functional if stripped
      "lib/vscode/resources/app/node_modules/@vscode/vsce-sign/bin/vsce-sign"
    ];
--- a/pkgs/applications/gis/qgis/unwrapped-ltr.nix
+++ b/pkgs/applications/gis/qgis/unwrapped-ltr.nix
@@ -185,7 +185,7 @@ mkDerivation rec {
    "-DQGIS_MACAPP_BUNDLE=0" # Don't copy Qt into bundle; we fix paths in postFixup
    "-DSQLITE3_INCLUDE_DIR=${sqlite.dev}/include" # FindSqlite3.cmake incorrectly assumes framework
  ]
-  ++ lib.optional withServer [
+  ++ lib.optionals withServer [
    "-DWITH_SERVER=True"
    "-DQGIS_CGIBIN_SUBDIR=${placeholder "out"}/lib/cgi-bin"
  ]
--- a/pkgs/applications/gis/qgis/unwrapped.nix
+++ b/pkgs/applications/gis/qgis/unwrapped.nix
@@ -190,7 +190,7 @@ stdenv.mkDerivation rec {
    "-DSQLITE3_INCLUDE_DIR=${sqlite.dev}/include"
    "-DUSE_OPENCL=OFF"
  ]
-  ++ lib.optional withServer [
+  ++ lib.optionals withServer [
    "-DWITH_SERVER=True"
    "-DQGIS_CGIBIN_SUBDIR=${placeholder "out"}/lib/cgi-bin"
  ]
--- a/pkgs/build-support/teleport/default.nix
+++ b/pkgs/build-support/teleport/default.nix
@@ -162,10 +162,10 @@ buildGoModule (finalAttrs: {
    ++ [
      ./rdpclient.patch
    ]
-    ++ lib.optional (lib.versionOlder version "18.8.0") [
+    ++ lib.optionals (lib.versionOlder version "18.8.0") [
      ./0001-fix-add-nix-path-to-exec-env.patch
    ]
-    ++ lib.optional (lib.versionAtLeast version "18.8.0") [
+    ++ lib.optionals (lib.versionAtLeast version "18.8.0") [
      ./0001-fix-add-nix-path-to-exec-env-reexec.patch
    ];

--- a/pkgs/by-name/ai/airwin2rack/package.nix
+++ b/pkgs/by-name/ai/airwin2rack/package.nix
@@ -192,7 +192,7 @@ stdenv.mkDerivation {
    license =
      with lib.licenses;
      [ mit ]
-      ++ lib.optional enableVCVRack [
+      ++ lib.optionals enableVCVRack [
        gpl3Plus
        cc-by-nc-40
        unfreeRedistributable
--- a/pkgs/by-name/ap/apache-orc/package.nix
+++ b/pkgs/by-name/ap/apache-orc/package.nix
@@ -69,7 +69,7 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.cmakeBool "STOP_BUILD_ON_WARNING" stdenv.hostPlatform.isLinux)
    (lib.cmakeBool "INSTALL_VENDORED_LIBS" false)
  ]
-  ++ lib.optional (stdenv.hostPlatform != stdenv.buildPlatform) [
+  ++ lib.optionals (stdenv.hostPlatform != stdenv.buildPlatform) [
    # Fix (RiscV) cross-compilation
    # See https://github.com/apache/orc/issues/2334
    (lib.cmakeFeature "HAS_PRE_1970_EXITCODE" "0")
--- a/pkgs/by-name/as/astyle/package.nix
+++ b/pkgs/by-name/as/astyle/package.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation (finalAttrs: {
  # upstream repo includes a build/ directory
  cmakeBuildDir = "_build";

-  cmakeFlags = lib.optional asLibrary [
+  cmakeFlags = lib.optionals asLibrary [
    "-DBUILD_SHARED_LIBS=ON"
  ];

--- a/pkgs/by-name/au/aurral/package.nix
+++ b/pkgs/by-name/au/aurral/package.nix
@@ -16,7 +16,7 @@

 buildNpmPackage (finalAttrs: {
  pname = "aurral";
-  version = "2.9.0";
+  version = "2.9.1";

  __structuredAttrs = true;

@@ -24,7 +24,7 @@ buildNpmPackage (finalAttrs: {
    owner = "lklynet";
    repo = "aurral";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-pwk+efWL0dfvKiobRmGXgPtvunpRDOVbtxohbJamVqY=";
+    hash = "sha256-HiOcDvp+ZZozWPEoou0UJFsZAoql89q2WVZaj7fgVrs=";
  };

  # Specifies files to package leveraging npm & nix hooks. Not used by upstream.
--- a/pkgs/by-name/bi/bitsnpicas/package.nix
+++ b/pkgs/by-name/bi/bitsnpicas/package.nix
@@ -13,13 +13,13 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "bitsnpicas";
-  version = "2.2";
+  version = "2.2.2";

  src = fetchFromGitHub {
    owner = "kreativekorp";
    repo = "bitsnpicas";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-TIpnefPLHgKXJfBhrYbYG+/kpHjWpk/VrJvu1LKHf4o=";
+    hash = "sha256-+LmAav7E5boKNVby4YusSqNGt4PSSnefxsF10O8/deo=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/bo/bookstack/package.nix
+++ b/pkgs/by-name/bo/bookstack/package.nix
@@ -8,16 +8,16 @@

 php83.buildComposerProject2 (finalAttrs: {
  pname = "bookstack";
-  version = "26.05.4";
+  version = "26.05.5";

  src = fetchFromGitHub {
    owner = "bookstackapp";
    repo = "bookstack";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-DDjJZehRUf1GP19S+RqhqZSSGOMF/SzItt2GFXi4+1U=";
+    hash = "sha256-9E0hewzzN4prXUOrokIY6vDZUttv1HpPEd2/sLc0mhM=";
  };

-  vendorHash = "sha256-Ioth8Kp5fx4iwfy0p7N8xE0L41oWcp+ATfhmq3PUYyY=";
+  vendorHash = "sha256-usRZ70uiD54jlXkKcikvkNmFQbw7/r9F9Dg3QN/gdts=";

  passthru = {
    phpPackage = php83;
--- a/pkgs/by-name/bo/bowtie2/package.nix
+++ b/pkgs/by-name/bo/bowtie2/package.nix
@@ -42,7 +42,7 @@ stdenv.mkDerivation (finalAttrs: {
    perl
  ];

-  cmakeFlags = lib.optional (!stdenv.hostPlatform.isx86) [
+  cmakeFlags = lib.optionals (!stdenv.hostPlatform.isx86) [
    "-DCMAKE_CXX_FLAGS=-I${finalAttrs.src}/third_party"
  ];

--- a/pkgs/by-name/co/cogl/package.nix
+++ b/pkgs/by-name/co/cogl/package.nix
@@ -116,11 +116,11 @@ stdenv.mkDerivation rec {
    );
    NIX_CFLAGS_COMPILE = toString (
      [ ]
-      ++ lib.optional stdenv.cc.isGNU [
+      ++ lib.optionals stdenv.cc.isGNU [
        # Fix build with gcc15
        "-std=gnu17"
      ]
-      ++ lib.optional stdenv.cc.isClang [
+      ++ lib.optionals stdenv.cc.isClang [
        "-Wno-error=implicit-function-declaration"
      ]
    );
--- a/pkgs/by-name/co/copilot-language-server/package.nix
+++ b/pkgs/by-name/co/copilot-language-server/package.nix
@@ -4,10 +4,13 @@
  makeWrapper,
  fetchzip,
  nix-update-script,
-  nodejs,
-
-  testers,
+  nodejs-slim,
+  writableTmpDirAsHomeHook,
+  versionCheckHook,
 }:
+let
+  inherit (stdenvNoCC.hostPlatform.node) arch platform;
+in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "copilot-language-server";
  version = "1.495.0";
@@ -23,24 +26,44 @@ stdenvNoCC.mkDerivation (finalAttrs: {
  ];

  buildInputs = [
-    nodejs
+    nodejs-slim
  ];

  installPhase = ''
    runHook preInstall

-    mkdir -p $out/share/copilot-language-server
-    cp -r ./* $out/share/copilot-language-server/
+    server=$out/share/copilot-language-server

-    makeWrapper ${lib.getExe nodejs} $out/bin/copilot-language-server \
+    mkdir -p $server
+    cp -r ./* $server/
+
+    find "$server/node_modules/@github" -mindepth 1 -maxdepth 1 \
+      \( -name 'copilot-linux-*' -o -name 'copilot-darwin-*' -o -name 'copilot-win32-*' \) \
+      ! -name "copilot-${platform}-${arch}" -exec rm -rf {} +
+
+    find "$server/bin" "$server/compiled" -mindepth 1 -maxdepth 1 ! -name "${platform}" -exec rm -rf {} +
+    find "$server/bin/${platform}" "$server/compiled/${platform}" -mindepth 1 -maxdepth 1 ! -name "${arch}" -exec rm -rf {} +
+
+    find "$server/policy-templates" -mindepth 1 -maxdepth 1 ! -name "${platform}" -exec rm -rf {} +
+
+    find "$server" -name '*.map' -delete
+
+    makeWrapper ${lib.getExe nodejs-slim} $out/bin/copilot-language-server \
      --add-flags $out/share/copilot-language-server/main.js

    runHook postInstall
  '';

+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    writableTmpDirAsHomeHook
+    versionCheckHook
+  ];
+  # uv_os_homedir returned ENOENT (no such file or directory)
+  versionCheckKeepEnvironment = lib.optionals stdenvNoCC.hostPlatform.isDarwin [ "HOME" ];
+
  passthru = {
    updateScript = nix-update-script { };
-    tests.version = testers.testVersion { package = finalAttrs.finalPackage; };
  };

  meta = {
@@ -54,6 +77,11 @@ stdenvNoCC.mkDerivation (finalAttrs: {
      shortName = "GitHub Copilot License";
      url = "https://github.com/customer-terms/github-copilot-product-specific-terms";
    };
+    sourceProvenance = with lib.sourceTypes; [
+      binaryNativeCode # prebuild directory
+      binaryBytecode # WASM files
+      obfuscatedCode # minified JavaScript
+    ];
    mainProgram = "copilot-language-server";
    platforms = [
      "x86_64-linux"
--- a/pkgs/by-name/cr/crispy-doom/package.nix
+++ b/pkgs/by-name/cr/crispy-doom/package.nix
@@ -30,7 +30,7 @@ stdenv.mkDerivation (finalAttrs: {
    for script in $(grep -lr '^#!/usr/bin/env python3$'); do patchShebangs $script; done
  '';

-  configureFlags = lib.optional enableTruecolor [ "--enable-truecolor" ];
+  configureFlags = lib.optionals enableTruecolor [ "--enable-truecolor" ];

  nativeBuildInputs = [
    autoreconfHook
--- a/pkgs/by-name/cu/cup-docker/package.nix
+++ b/pkgs/by-name/cu/cup-docker/package.nix
@@ -60,7 +60,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
  buildFeatures = [
    "cli"
  ]
-  ++ lib.optional withServer [
+  ++ lib.optionals withServer [
    "server"
  ];

--- a/pkgs/by-name/dh/dhtbsign/package.nix
+++ b/pkgs/by-name/dh/dhtbsign/package.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
  strictDeps = true;

  env.NIX_CFLAGS_COMPILE = toString (
-    lib.optional stdenv.cc.isGNU [
+    lib.optionals stdenv.cc.isGNU [
      # Required with newer GCC
      "-Wno-error=stringop-overflow"
    ]
--- a/pkgs/by-name/di/diffoscope/package.nix
+++ b/pkgs/by-name/di/diffoscope/package.nix
@@ -125,6 +125,7 @@ python.pkgs.buildPythonApplication rec {
    ./ignore_links.patch
    # https://salsa.debian.org/reproducible-builds/diffoscope/-/merge_requests/166
    ./fix-tests-with-zipdetails-4.006.patch
+    ./radare2.patch
  ];

  postPatch = ''
@@ -156,11 +157,7 @@ python.pkgs.buildPythonApplication rec {
  # docx2txt <- makes tests broken:
  # > FAILED tests/comparators/test_docx.py::test_diff - IndexError: list index out of range
  # > FAILED tests/comparators/test_docx.py::test_compare_non_existing - AssertionError
-  # radare2
-  # > FAILED tests/comparators/test_elf_decompiler.py::test_ghidra_diff - IndexError: list index out of range
-  # > FAILED tests/comparators/test_elf_decompiler.py::test_radare2_diff - AssertionError
-  # > FAILED tests/comparators/test_macho_decompiler.py::test_ghidra_diff - assert 0 == 1
-  # > FAILED tests/comparators/test_macho_decompiler.py::test_radare2_diff - AssertionError
+  # radare2 (the exact output of the r2 version debian ships is expected, and our more recent version has a slightly different one)
  #
  # We filter automatically all packages for the host platform (some dependencies are not supported on Darwin, aarch64, etc.).
  # Packages which are marked broken for a platform are not automatically filtered to avoid accidentally removing them without noticing it.
--- a/pkgs/by-name/di/diffoscope/radare2.patch
+++ b/pkgs/by-name/di/diffoscope/radare2.patch
@@ -0,0 +1,26 @@
+Fix comparing ELF objects when r2 is in PATH
+
+https://github.com/radareorg/radare2/issues/21201 renamed the "offset" key of
+the json output diffoscope uses to "addr". As a result running diffoscope on an
+ELF object results in this error:
+KeyError: 'offset'
+
+This patch does not include the modifications to the test suite required to
+submit it upstream.
+
+Upstream issue: https://salsa.debian.org/reproducible-builds/diffoscope/-/work_items/432
+
+diff --git a/diffoscope/comparators/decompile.py b/diffoscope/comparators/decompile.py
+index bf85deb9..f6a5564f 100644
+--- a/diffoscope/comparators/decompile.py
+++ b/diffoscope/comparators/decompile.py
+@@ -242,6 +242,9 @@ class AsmFunction(File):
+ 
+     @property
+     def offset(self):
+        if "addr" in self.data_dict:
+            return self.data_dict["addr"]
+        # backward compat with r2 version < 5.9.0
+         return self.data_dict["offset"]
+ 
+     @property
--- a/pkgs/by-name/fi/fireplace/package.nix
+++ b/pkgs/by-name/fi/fireplace/package.nix
@@ -25,7 +25,7 @@ stdenv.mkDerivation {
    hash = "sha256-2NUE/zaFoGwkZxgvVCYXxToiL23aVUFwFNlQzEq9GEc=";
  };

-  makeFlags = lib.optional stdenv.hostPlatform.isDarwin [ "CC=cc" ];
+  makeFlags = lib.optionals stdenv.hostPlatform.isDarwin [ "CC=cc" ];

  meta = {
    description = "Cozy fireplace in your terminal";
--- a/pkgs/by-name/fl/flycast/package.nix
+++ b/pkgs/by-name/fl/flycast/package.nix
@@ -19,13 +19,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "flycast";
-  version = "2.6";
+  version = "2.7";

  src = fetchFromGitHub {
    owner = "flyinghead";
    repo = "flycast";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Lq6Oj+U4mpwNlL/t3ZB9gjE5NAVQyhdvBwLUGu1C+j0=";
+    hash = "sha256-8qGAoMQ7hF1HFx7m+CuhxX+IG7L4fk1XQkKUYZODGmA=";
    fetchSubmodules = true;
  };

--- a/pkgs/tools/package-management/fpm/Gemfile
+++ b/pkgs/tools/package-management/fpm/Gemfile
--- a/pkgs/tools/package-management/fpm/Gemfile.lock
+++ b/pkgs/tools/package-management/fpm/Gemfile.lock
--- a/pkgs/tools/package-management/fpm/gemset.nix
+++ b/pkgs/tools/package-management/fpm/gemset.nix
--- a/pkgs/tools/package-management/fpm/default.nix
+++ b/pkgs/tools/package-management/fpm/default.nix
--- a/pkgs/by-name/fr/frankenphp/package.nix
+++ b/pkgs/by-name/fr/frankenphp/package.nix
@@ -80,7 +80,7 @@ buildGoModule (finalAttrs: {
    "-X 'github.com/caddyserver/caddy/v2.CustomVersion=FrankenPHP ${finalAttrs.version} PHP ${phpUnwrapped.version} Caddy'"
    # pie mode is only available with pkgsMusl, it also automatically add -buildmode=pie to $GOFLAGS
  ]
-  ++ (lib.optional pieBuild [ "-static-pie" ]);
+  ++ (lib.optionals pieBuild [ "-static-pie" ]);

  preBuild = ''
    export CGO_CFLAGS="$(${phpConfig} --includes)"
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -180,7 +180,7 @@ let

  linux = stdenvNoCC.mkDerivation (finalAttrs: {
    inherit pname meta;
-    version = "153.0.8010.47";
+    version = "153.0.8010.52";

    src =
      let
@@ -195,8 +195,8 @@ let
        url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_${debArch}.deb";
        hash =
          {
-            amd64 = "sha256-oybe/eVN4vHA1G2L9La18/dvDIl70wsgsCUJcTmgW94=";
-            arm64 = "sha256-DEyVf0gz2ab4HkwzXEEpwowPmHfh5SA2/XYuygrfTbI=";
+            amd64 = "sha256-KeDkta8BITkV/9t/TkmhGVbcX8WRFlyFr4aI3N/5B6w=";
+            arm64 = "sha256-5aHWRq9ZRWiUHjph57jt3Gk/dpt/Fmh0xx9yycuAYWU=";
          }
          .${debArch};
      };
@@ -306,11 +306,11 @@ let

  darwin = stdenvNoCC.mkDerivation (finalAttrs: {
    inherit pname meta;
-    version = "153.0.8010.48";
+    version = "153.0.8010.53";

    src = fetchurl {
-      url = "https://dl.google.com/release2/chrome/ad6l2piroiqtckdm7rwkc6givuyq_153.0.8010.48/GoogleChrome-153.0.8010.48.dmg";
-      hash = "sha256-FgoOxuBiUAFk3X9iBHxlWFsNcO/PU95ObKTTuWLPnpo=";
+      url = "https://dl.google.com/release2/chrome/advkfamzjrpin7rbc7pzjxz6wkuq_153.0.8010.53/GoogleChrome-153.0.8010.53.dmg";
+      hash = "sha256-Hi/sZoZ16hdmIdGlpbEQ7DmhmwqxblE9mzgkHLMgN2w=";
    };

    dontPatch = true;
--- a/pkgs/by-name/gp/gpauth/package.nix
+++ b/pkgs/by-name/gp/gpauth/package.nix
@@ -2,10 +2,12 @@
  rustPlatform,
  lib,
  fetchFromGitHub,
+  glib-networking,
  openssl,
  pkg-config,
  perl,
  webkitgtk_4_1,
+  wrapGAppsHook3,
  stdenv,
  nix-update-script,
 }:
@@ -29,11 +31,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
  nativeBuildInputs = [
    perl
    pkg-config
+  ]
+  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    wrapGAppsHook3
  ];
  buildInputs = [
    openssl
  ]
  ++ lib.optionals stdenv.hostPlatform.isLinux [
+    glib-networking
    webkitgtk_4_1
  ];

--- a/pkgs/by-name/gr/grafana/package.nix
+++ b/pkgs/by-name/gr/grafana/package.nix
@@ -21,7 +21,7 @@

 buildGoModule (finalAttrs: {
  pname = "grafana";
-  version = "13.0.7";
+  version = "13.0.9";

  subPackages = [
    "pkg/cmd/grafana"
@@ -33,7 +33,7 @@ buildGoModule (finalAttrs: {
    owner = "grafana";
    repo = "grafana";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-Akb3ZhfYqwaXnhB6o+gbGfibflBYRDMUNvXQzwGXab0=";
+    hash = "sha256-VUPn7EN3dzoJdRpKUKF57n3wsxnXND/hXGQ0FdWswLs=";
  };

  patches = [
@@ -55,12 +55,12 @@ buildGoModule (finalAttrs: {
  # Since this is not a dependency attribute the buildPackages has to be specified.
  offlineCache = buildPackages.yarn-berry_4-fetcher.fetchYarnBerryDeps {
    inherit (finalAttrs) src missingHashes patches;
-    hash = "sha256-0rmQGRgu22Yxm3Vlr2YKrGjU1xxePadByH/HGqubSVM=";
+    hash = "sha256-3p9EYboa6ilguJ+cqmcBfnYfe6L/LqZk0hI7ix1hQBM=";
  };

  disallowedRequisites = [ finalAttrs.offlineCache ];

-  vendorHash = "sha256-iYC96mt2Zy/yHRj1sYncvOc5P4zVAv3bk3Bq733UMDw=";
+  vendorHash = "sha256-XT9bVwF/crVpPzodQaGtvCYr9+1BBy1SYhC81EI+UsI=";

  # Grafana seems to just set it to the latest version available
  # nowadays.
--- a/pkgs/by-name/ha/haste-client/Gemfile
+++ b/pkgs/by-name/ha/haste-client/Gemfile
--- a/pkgs/by-name/ha/haste-client/Gemfile.lock
+++ b/pkgs/by-name/ha/haste-client/Gemfile.lock
--- a/pkgs/by-name/ha/haste-client/gemset.nix
+++ b/pkgs/by-name/ha/haste-client/gemset.nix
--- a/pkgs/by-name/ha/haste-client/package.nix
+++ b/pkgs/by-name/ha/haste-client/package.nix
--- a/pkgs/by-name/ki/kid3/package.nix
+++ b/pkgs/by-name/ki/kid3/package.nix
@@ -42,11 +42,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "kid3";
-  version = "3.9.7";
+  version = "3.10.1";

  src = fetchurl {
    url = "mirror://kde/stable/kid3/${finalAttrs.version}/kid3-${finalAttrs.version}.tar.xz";
-    hash = "sha256-+c/u99Td3nitiXiHbLNSWEOjAlBPVHwiXpwiyB1xB2A=";
+    hash = "sha256-Agw1fHTDnJMUNbSedAkyjQt/baVJG1jC9zLtcjbqmkU=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/kt/ktls-utils/package.nix
+++ b/pkgs/by-name/kt/ktls-utils/package.nix
@@ -42,9 +42,9 @@ stdenv.mkDerivation (finalAttrs: {
    "man"
  ];

-  configureFlags = lib.optional withSystemd [ "--with-systemd" ];
+  configureFlags = lib.optionals withSystemd [ "--with-systemd" ];

-  makeFlags = lib.optional withSystemd [ "unitdir=$(out)/lib/systemd/system" ];
+  makeFlags = lib.optionals withSystemd [ "unitdir=$(out)/lib/systemd/system" ];

  doCheck = true;

--- a/pkgs/by-name/le/ledger-live-desktop/package.nix
+++ b/pkgs/by-name/le/ledger-live-desktop/package.nix
@@ -8,11 +8,11 @@

 let
  pname = "ledger-live-desktop";
-  version = "4.19.0";
+  version = "4.19.1";

  src = fetchurl {
    url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-8D2ErfvFQTuRUdodo7CjhQwVsvz5qfmlzs3LpPEG8+M=";
+    hash = "sha256-zPaMkbU36HwcMUHy9nrocCOJfZ4k/CXj/3gd4BZUV0M=";
  };

  appimageContents = appimageTools.extractType2 {
--- a/pkgs/by-name/ma/matrix-tuwunel/package.nix
+++ b/pkgs/by-name/ma/matrix-tuwunel/package.nix
@@ -145,7 +145,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    "url_preview"
    "zstd_compression"
  ]
-  ++ lib.optional enableJemalloc [
+  ++ lib.optionals enableJemalloc [
    "jemalloc"
    "jemalloc_conf"
  ]
--- a/pkgs/by-name/me/meowfetch/package.nix
+++ b/pkgs/by-name/me/meowfetch/package.nix
@@ -0,0 +1,34 @@
+{
+  lib,
+  buildGoModule,
+  fetchFromGitHub,
+  nix-update-script,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "meowfetch";
+  version = "1.0.1";
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "faynopi";
+    repo = "meowfetch";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-5nUogUYc25FPQKY9oIU2bmOpgWN8bCoxEhRJQfEZOcM=";
+  };
+
+  vendorHash = "sha256-PnkXXNr+kIige1YB/vEG+sYI0X/rr+6Gtcnb0rW4YK0=";
+
+  ldflags = [ "-s" ];
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Minimal system information fetcher program written in go";
+    homepage = "https://github.com/faynopi/meowfetch";
+    changelog = "https://github.com/faynopi/meowfetch/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ goobertony ];
+    mainProgram = "meowfetch";
+  };
+})
--- a/pkgs/by-name/mi/mimir-sleep/package.nix
+++ b/pkgs/by-name/mi/mimir-sleep/package.nix
@@ -0,0 +1,60 @@
+{
+  lib,
+  stdenvNoCC,
+  fetchFromGitHub,
+  makeWrapper,
+  nix-update-script,
+  bashNonInteractive,
+  gawk,
+  sox,
+}:
+
+stdenvNoCC.mkDerivation (finalAttrs: {
+  pname = "mimir-sleep";
+  version = "2.0.0";
+
+  src = fetchFromGitHub {
+    owner = "FraioVeio";
+    repo = "mimir";
+    tag = finalAttrs.version;
+    hash = "sha256-TahlhXE5BWGGL2AKmgiAdruUkNgQSId/QwoJEfplHCc=";
+  };
+
+  strictDeps = true;
+  __structuredAttrs = true;
+
+  nativeBuildInputs = [ makeWrapper ];
+  buildInputs = [ bashNonInteractive ];
+
+  dontBuild = true;
+
+  installPhase = ''
+    runHook preInstall
+
+    install -Dm755 mimir.sh "$out/bin/mimir"
+    install -Dm444 -t "$out/share/mimir" mimir/esleep1.wav mimir/esleep2.wav
+
+    patchShebangs "$out/bin/mimir"
+    wrapProgram "$out/bin/mimir" \
+      --prefix PATH : ${
+        lib.makeBinPath [
+          gawk
+          sox
+        ]
+      }
+
+    runHook postInstall
+  '';
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Drop-in `sleep` replacement that plays soothing sound effects while your computer is asleep";
+    homepage = "https://github.com/FraioVeio/mimir";
+    changelog = "https://github.com/FraioVeio/mimir/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.mit;
+    maintainers = with lib.maintainers; [ fraioveio ];
+    platforms = lib.platforms.unix;
+    mainProgram = "mimir";
+  };
+})
--- a/pkgs/by-name/mk/mkbootimg-osm0sis/package.nix
+++ b/pkgs/by-name/mk/mkbootimg-osm0sis/package.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation {
  strictDeps = true;

  env.NIX_CFLAGS_COMPILE = toString (
-    lib.optional stdenv.cc.isGNU [
+    lib.optionals stdenv.cc.isGNU [
      # Required with newer GCC
      "-Wstringop-overflow=0"
    ]
--- a/pkgs/by-name/mo/monero-cli/package.nix
+++ b/pkgs/by-name/mo/monero-cli/package.nix
@@ -92,7 +92,7 @@ stdenv.mkDerivation rec {
    "-Wno-dev"
  ]
  ++ lib.optional stdenv.hostPlatform.isDarwin "-DBoost_USE_MULTITHREADED=OFF"
-  ++ lib.optional trezorSupport [
+  ++ lib.optionals trezorSupport [
    "-DUSE_DEVICE_TREZOR=ON"
  ];

--- a/pkgs/by-name/mo/monero-gui/package.nix
+++ b/pkgs/by-name/mo/monero-gui/package.nix
@@ -104,7 +104,7 @@ stdenv.mkDerivation rec {
  cmakeFlags = [
    "-DARCH=default"
  ]
-  ++ lib.optional trezorSupport [
+  ++ lib.optionals trezorSupport [
    # fix build on recent gcc versions
    "-DCMAKE_CXX_FLAGS=-fpermissive"
  ];
--- a/pkgs/by-name/mu/musescore/package.nix
+++ b/pkgs/by-name/mu/musescore/package.nix
@@ -35,24 +35,6 @@
  nixosTests,
 }:

-let
-  qt6' = qt6.overrideScope (
-    self: super: {
-      # Fix for: https://github.com/NixOS/nixpkgs/issues/526825
-      # reported upstream at: https://github.com/musescore/MuseScore/issues/33015
-      qtdeclarative = super.qtdeclarative.overrideAttrs (
-        new: old: {
-          patches = old.patches ++ [
-            (fetchpatch {
-              url = "https://github.com/qt/qtdeclarative/commit/9d4d376726a6ce15c429128dc65b927e411e40da.patch";
-              hash = "sha256-XhfliF5wZuN4/E55f8hfipIRjxBe9V7vL1cgn5p4xqA=";
-            })
-          ];
-        }
-      );
-    }
-  );
-in
 stdenv.mkDerivation (finalAttrs: {
  pname = "musescore";
  version = "4.7.4";
@@ -124,8 +106,8 @@ stdenv.mkDerivation (finalAttrs: {

  nativeBuildInputs = [
    cmake
-    qt6'.qttools
-    qt6'.wrapQtAppsHook
+    qt6.qttools
+    qt6.wrapQtAppsHook
    ninja
    pkg-config
  ]
@@ -138,12 +120,12 @@ stdenv.mkDerivation (finalAttrs: {
  buildInputs = [
    flac
    freetype
-    qt6'.qt5compat
-    qt6'.qtbase
-    qt6'.qtdeclarative
-    qt6'.qtnetworkauth
-    qt6'.qtscxml
-    qt6'.qtsvg
+    qt6.qt5compat
+    qt6.qtbase
+    qt6.qtdeclarative
+    qt6.qtnetworkauth
+    qt6.qtscxml
+    qt6.qtsvg
    lame
    libjack2
    libogg
@@ -160,7 +142,7 @@ stdenv.mkDerivation (finalAttrs: {
  ]
  ++ lib.optionals stdenv.hostPlatform.isLinux [
    alsa-lib
-    qt6'.qtwayland
+    qt6.qtwayland
  ];

  # Put the default, `$prefix/lib` directory to look for ffmpeg shared objects,
--- a/pkgs/by-name/n8/n8n/package.nix
+++ b/pkgs/by-name/n8/n8n/package.nix
@@ -27,20 +27,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "n8n";
-  version = "2.37.10";
+  version = "2.39.6";

  src = fetchFromGitHub {
    owner = "n8n-io";
    repo = "n8n";
    tag = "n8n@${finalAttrs.version}";
-    hash = "sha256-cEWwXiyBLiZ8MgH5OKe0+hgd9ooYZTDQIuS4Dq0nKos=";
+    hash = "sha256-fmo0xL6IF6J+D5ZamkoBXyZ4Q8s3l5MeBWaXc39OsTU=";
  };

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
    pnpm = pnpm_11;
    fetcherVersion = 4;
-    hash = "sha256-T1axKjZT1I8NjXFV8hAKSYa+zCl/Fpyzz2DGM+cmkLQ=";
+    hash = "sha256-yL95w+Jd5I5R6r/qNihvAJ4MX2LMyS9ICZzJnLxHR4s=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/np/npins/package.nix
+++ b/pkgs/by-name/np/npins/package.nix
@@ -19,16 +19,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "npins";
-  version = "0.4.1";
+  version = "0.4.2";

  src = fetchFromGitHub {
    owner = "andir";
    repo = "npins";
    tag = finalAttrs.version;
-    sha256 = "sha256-XzJaDf5tlrYGTMJ+eS9hH9l79S4JA8h2KfbvKHF14xY=";
+    sha256 = "sha256-toAQj3cO6dhfm6FnK0a0mbj+VBaADCsNZNi1PMuJnFQ=";
  };

-  cargoHash = "sha256-Fiku3UULsm6HL1skjJA/UiW9VRFRWbnXULQFBiVDCJ0=";
+  cargoHash = "sha256-Ee/QN1Jro78mzwcRWerpZu8Gsj2mkddHBrKUXGGoIQU=";

  nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/by-name/nu/nuclei/package.nix
+++ b/pkgs/by-name/nu/nuclei/package.nix
@@ -2,21 +2,24 @@
  lib,
  buildGoModule,
  fetchFromGitHub,
+  nix-update-script,
  versionCheckHook,
 }:

 buildGoModule (finalAttrs: {
  pname = "nuclei";
-  version = "3.8.0";
+  version = "3.11.1";
+
+  __structuredAttrs = true;

  src = fetchFromGitHub {
    owner = "projectdiscovery";
    repo = "nuclei";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-jzXV9QBpeH26nrViHdKR6Id7Dkdl0Ob1r71RhorCJvM=";
+    hash = "sha256-iXeMYiri3gwfjXnWgSgGOtcXFqZynSzGXnVIM6hOH5Y=";
  };

-  vendorHash = "sha256-dxyyaletTVud6p81QzOsitw7m4yAZG3r1ZoEb2vQqOY=";
+  vendorHash = "sha256-N7Oj55t5PO17sRkxafbG4UsejjpLBVAoSC5t0R2tD1k=";

  proxyVendor = true; # hash mismatch between Linux and Darwin

@@ -24,10 +27,7 @@ buildGoModule (finalAttrs: {

  nativeInstallCheckInputs = [ versionCheckHook ];

-  ldflags = [
-    "-w"
-    "-s"
-  ];
+  ldflags = [ "-s" ];

  # Test files are not part of the release tarball
  doCheck = false;
@@ -36,6 +36,8 @@ buildGoModule (finalAttrs: {

  versionCheckProgramArg = "-version";

+  passthru.updateScript = nix-update-script { };
+
  meta = {
    description = "Tool for configurable targeted scanning";
    longDescription = ''
--- a/pkgs/applications/window-managers/phosh/default.nix
+++ b/pkgs/applications/window-managers/phosh/default.nix
--- a/pkgs/by-name/po/policycoreutils/package.nix
+++ b/pkgs/by-name/po/policycoreutils/package.nix
@@ -2,6 +2,7 @@
  lib,
  stdenv,
  fetchurl,
+  fetchpatch,
  gettext,
  libsepol,
  libselinux,
@@ -20,6 +21,16 @@ stdenv.mkDerivation (finalAttrs: {
    hash = "sha256-BU5B7AOXMaXua3l6jguNbjRu4dCpusLyUttIwj+aixs=";
  };

+  patches = [
+    # https://nvd.nist.gov/vuln/detail/CVE-2026-19079
+    (fetchpatch {
+      name = "CVE-2026-19079.patch";
+      url = "https://github.com/SELinuxProject/selinux/commit/a556538c2d5d2583273e025b45c02651fef47679.patch";
+      stripLen = 1;
+      hash = "sha256-na/4xfW1R5VwvwHTUHXSs23pOD8Z/ClbBET+oxJe+uA=";
+    })
+  ];
+
  postPatch = ''
    # Fix install references
    substituteInPlace po/Makefile \
--- a/pkgs/by-name/px/pxa-mkbootimg/package.nix
+++ b/pkgs/by-name/px/pxa-mkbootimg/package.nix
@@ -17,7 +17,7 @@ stdenv.mkDerivation (finalAttrs: {
  strictDeps = true;

  env.NIX_CFLAGS_COMPILE = toString (
-    lib.optional stdenv.cc.isGNU [
+    lib.optionals stdenv.cc.isGNU [
      # Required with newer GCC
      "-Wno-error=stringop-overflow"
    ]
--- a/pkgs/by-name/re/refind/package.nix
+++ b/pkgs/by-name/re/refind/package.nix
@@ -88,7 +88,7 @@ stdenv.mkDerivation (finalAttrs: {
    "HOSTARCH=${hostarch}"
    "ARCH=${hostarch}"
  ]
-  ++ lib.optional stdenv.hostPlatform.isAarch64 [
+  ++ lib.optionals stdenv.hostPlatform.isAarch64 [
    # aarch64 is special for GNU-EFI, see BUILDING.txt
    "GNUEFI_ARM64_TARGET_SUPPORT=y"
  ];
--- a/pkgs/by-name/ry/ryubing/package.nix
+++ b/pkgs/by-name/ry/ryubing/package.nix
@@ -100,7 +100,7 @@ buildDotnetModule rec {
    "Ryujinx"
  ];

-  makeWrapperArgs = lib.optional stdenv.hostPlatform.isLinux [
+  makeWrapperArgs = lib.optionals stdenv.hostPlatform.isLinux [
    # Without this Ryujinx fails to start on wayland. See https://github.com/Ryujinx/Ryujinx/issues/2714
    "--set SDL_VIDEODRIVER x11"
  ];
--- a/pkgs/by-name/s7/s7/package.nix
+++ b/pkgs/by-name/s7/s7/package.nix
@@ -74,7 +74,7 @@ stdenv.mkDerivation (finalAttrs: {
      "-lpthread"
      "--export-all-symbols"
    ]
-    ++ lib.optional (!static && stdenv.hostPlatform.isMinGW) [ "--out-implib,libs7dll.a" ]
+    ++ lib.optionals (!static && stdenv.hostPlatform.isMinGW) [ "--out-implib,libs7dll.a" ]
    ++ lib.optional withArb "-lflint"
    ++ lib.optionals withGMP [
      "-lgmp"
--- a/pkgs/by-name/sf/sfml/package.nix
+++ b/pkgs/by-name/sf/sfml/package.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
  };

  # Only unvendor miniaudio on non-Darwin as Darwin cannot build the miniaudio package.
-  patches = lib.optional (!stdenv.hostPlatform.isDarwin) [
+  patches = lib.optionals (!stdenv.hostPlatform.isDarwin) [
    # Not upstreamble in the near future, see https://github.com/SFML/SFML/pull/3555
    ./unvendor-miniaudio.patch
  ];
--- a/pkgs/by-name/sh/shaperglot-cli/package.nix
+++ b/pkgs/by-name/sh/shaperglot-cli/package.nix
@@ -8,16 +8,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "shaperglot-cli";
-  version = "1.2.1";
+  version = "1.2.2";

  src = fetchFromGitHub {
    owner = "googlefonts";
    repo = "shaperglot";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-g8f8Q2DvYNvm8i6S+9K/jhhUiuGw366dht0Khx3/INg=";
+    hash = "sha256-VVxOkJ6a5UhQvSCswbgeRCLUEOzAbPhHuhJJAr1VvKA=";
  };

-  cargoHash = "sha256-ivl3Zq0HRn4yP9JKfbjSaaERjbQ3SAEWhHk6toFp8dE=";
+  cargoHash = "sha256-WOIYg/QlWEk1StmudlPjpit/cKMkPtqLtf0BhPWQeg8=";

  cargoBuildFlags = [
    "--package=shaperglot-cli"
--- a/pkgs/by-name/si/simple-completion-language-server/package.nix
+++ b/pkgs/by-name/si/simple-completion-language-server/package.nix
@@ -18,7 +18,7 @@ rustPlatform.buildRustPackage {

  cargoHash = "sha256-RgRmbQVZK/4U37CO8AjNQOqR/SXvL1TQU03LX7LnqPY=";

-  buildFeatures = lib.optional withCitation [ "citation" ];
+  buildFeatures = lib.optionals withCitation [ "citation" ];

  meta = {
    description = "Language server to enable word completion and snippets for Helix editor";
--- a/pkgs/by-name/sp/spla/package.nix
+++ b/pkgs/by-name/sp/spla/package.nix
@@ -72,7 +72,7 @@ stdenv.mkDerivation (finalAttrs: {
    "-DCMAKE_INSTALL_INCLUDEDIR=include"
  ]
  ++ lib.optional (gpuBackend == "cuda") "-DSPLA_GPU_BACKEND=CUDA"
-  ++ lib.optional (gpuBackend == "rocm") [ "-DSPLA_GPU_BACKEND=ROCM" ];
+  ++ lib.optionals (gpuBackend == "rocm") [ "-DSPLA_GPU_BACKEND=ROCM" ];

  preFixup = ''
    substituteInPlace $out/lib/cmake/SPLA/SPLASharedTargets-release.cmake \
--- a/pkgs/by-name/ta/talosctl/package.nix
+++ b/pkgs/by-name/ta/talosctl/package.nix
@@ -4,21 +4,29 @@
  buildGoModule,
  fetchFromGitHub,
  installShellFiles,
+  makeWrapper,
  versionCheckHook,
+  withQemu ? false,
+  qemu,
 }:

 buildGoModule (finalAttrs: {
  pname = "talosctl";
-  version = "1.13.7";
+  version = "1.13.9";

  src = fetchFromGitHub {
    owner = "siderolabs";
    repo = "talos";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-KT8ln7i3YkNS8GzMeNo+7ENXL5jAc+ZgyVL+7Ke4NDE=";
+    hash = "sha256-I+FygHLeNQKy0OV6yaWMbVwJ/TxLl8KCncX2ICulCbU=";
  };

-  vendorHash = "sha256-8v4xJT4HfE3tTFPPxXeqKMHNE/kKUVGE73flW17zXKM=";
+  vendorHash = "sha256-Ep24y1ehD1s5/6uxiufwvTKt4XBp/GmrDE2xnTuVIK8=";
+
+  postPatch = lib.optionalString withQemu ''
+    substituteInPlace pkg/provision/providers/qemu/arch.go \
+      --replace-fail '/opt/homebrew' '${lib.getLib qemu}'
+  '';

  ldflags = [
    "-s"
@@ -33,14 +41,19 @@ buildGoModule (finalAttrs: {

  subPackages = [ "cmd/talosctl" ];

-  nativeBuildInputs = [ installShellFiles ];
+  nativeBuildInputs = [ installShellFiles ] ++ lib.optionals withQemu [ makeWrapper ];

-  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
-    installShellCompletion --cmd talosctl \
-      --bash <($out/bin/talosctl completion bash) \
-      --fish <($out/bin/talosctl completion fish) \
-      --zsh <($out/bin/talosctl completion zsh)
-  '';
+  postInstall =
+    lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
+      installShellCompletion --cmd talosctl \
+        --bash <($out/bin/talosctl completion bash) \
+        --fish <($out/bin/talosctl completion fish) \
+        --zsh <($out/bin/talosctl completion zsh)
+    ''
+    + lib.optionalString withQemu ''
+      wrapProgram $out/bin/talosctl \
+        --suffix PATH : ${lib.makeBinPath [ qemu ]}
+    '';

  doCheck = false; # no tests

--- a/pkgs/by-name/te/tesla_auth/package.nix
+++ b/pkgs/by-name/te/tesla_auth/package.nix
@@ -0,0 +1,66 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  nix-update-script,
+  pkg-config,
+  wrapGAppsHook3,
+  webkitgtk_4_1,
+  xdotool,
+  gtk3,
+  cairo,
+  pango,
+  gdk-pixbuf,
+  glib,
+  libsoup_3,
+  openssl,
+  glib-networking,
+  nss,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "tesla_auth";
+  version = "0.15.0";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "adriankumpf";
+    repo = "tesla_auth";
+    tag = "v${finalAttrs.version}";
+    hash = "sha256-nidbHxvvvmL0PAh+nNLlYBYM5riGdt4pL4w4UxdEdV0=";
+  };
+
+  cargoHash = "sha256-TkqxzB6ufCFbibVCFM4dI2ZNQpGneNNR7j73YTgI+hE=";
+
+  nativeBuildInputs = [
+    pkg-config
+    wrapGAppsHook3
+  ];
+
+  buildInputs = [
+    webkitgtk_4_1
+    xdotool
+    gtk3
+    cairo
+    pango
+    gdk-pixbuf
+    glib
+    libsoup_3
+    openssl
+    glib-networking
+    nss
+  ];
+
+  env.STATIC_VCRUNTIME_NO_BUILD = "1";
+
+  passthru.updateScript = nix-update-script { };
+
+  meta = {
+    description = "Securely generate API tokens for third-party access to your Tesla";
+    homepage = "https://github.com/adriankumpf/tesla_auth";
+    license = lib.licenses.mit;
+    mainProgram = "tesla_auth";
+    maintainers = with lib.maintainers; [ brianmay ];
+  };
+})
--- a/pkgs/by-name/te/textadept/package.nix
+++ b/pkgs/by-name/te/textadept/package.nix
@@ -25,8 +25,8 @@ stdenv.mkDerivation (finalAttrs: {
  buildInputs = lib.optionals withQt [ libsForQt5.qtbase ] ++ lib.optionals withCurses ncurses;

  cmakeFlags =
-    lib.optional withQt [ "-DQT=ON" ]
-    ++ lib.optional withCurses [
+    lib.optionals withQt [ "-DQT=ON" ]
+    ++ lib.optionals withCurses [
      "-DCURSES=ON"
      "-DQT=OFF"
    ];
--- a/pkgs/by-name/un/uniscribe/Gemfile
+++ b/pkgs/by-name/un/uniscribe/Gemfile
--- a/pkgs/by-name/un/uniscribe/Gemfile.lock
+++ b/pkgs/by-name/un/uniscribe/Gemfile.lock
--- a/pkgs/by-name/un/uniscribe/gemset.nix
+++ b/pkgs/by-name/un/uniscribe/gemset.nix
--- a/pkgs/by-name/un/uniscribe/package.nix
+++ b/pkgs/by-name/un/uniscribe/package.nix
--- a/pkgs/by-name/ve/vencord/package.nix
+++ b/pkgs/by-name/ve/vencord/package.nix
@@ -22,13 +22,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "vencord";
-  version = "1.15.5";
+  version = "1.15.6";

  src = fetchFromGitHub {
    owner = "Vendicated";
    repo = "Vencord";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-AiZjrbx2A3NMkbyKJBGiCB/zq7fIvWlhpAAcyPrtT7Q=";
+    hash = "sha256-bsTw8F6bBJFZWzOYV84VMtrMMj0fHId9BKCxrFUQYxM=";
  };

  patches = [ ./fix-deps.patch ];
--- a/pkgs/by-name/vr/vrcx/deps.json
+++ b/pkgs/by-name/vr/vrcx/deps.json
@@ -29,11 +29,6 @@
    "version": "4.1.0",
    "hash": "sha256-pM9WXvxZI3SS89CGVjxqtAyZyfyiZQzW0UnNCDiQrQA="
  },
-  {
-    "pname": "Microsoft.CSharp",
-    "version": "4.7.0",
-    "hash": "sha256-Enknv2RsFF68lEPdrf5M+BpV1kHoLTVRApKUwuk/pj0="
-  },
  {
    "pname": "Microsoft.Extensions.DependencyInjection.Abstractions",
    "version": "10.0.8",
@@ -59,30 +54,10 @@
    "version": "0.9.21",
    "hash": "sha256-zlfkByJBFn3SRHyAaOXHmk7lUc0HZtdsMrtisqx2zOo="
  },
-  {
-    "pname": "Microsoft.NETCore.Platforms",
-    "version": "2.1.2",
-    "hash": "sha256-gYQQO7zsqG+OtN4ywYQyfsiggS2zmxw4+cPXlK+FB5Q="
-  },
-  {
-    "pname": "Microsoft.NETCore.Platforms",
-    "version": "3.1.0",
-    "hash": "sha256-cnygditsEaU86bnYtIthNMymAHqaT/sf9Gjykhzqgb0="
-  },
-  {
-    "pname": "Microsoft.Win32.Registry",
-    "version": "4.7.0",
-    "hash": "sha256-+jWCwRqU/J/jLdQKDFm93WfIDrDMXMJ984UevaQMoi8="
-  },
  {
    "pname": "Microsoft.Win32.SystemEvents",
-    "version": "4.7.0",
-    "hash": "sha256-GHxnD1Plb32GJWVWSv0Y51Kgtlb+cdKgOYVBYZSgVF4="
-  },
-  {
-    "pname": "Newtonsoft.Json",
-    "version": "13.0.1",
-    "hash": "sha256-K2tSVW4n4beRPzPu3rlVaBEMdGvWSv/3Q1fxaDh4Mjo="
+    "version": "10.0.10",
+    "hash": "sha256-WURA2NISoZzDBDMH7YnJcc/iI47inqJJtHMj40HhVJE="
  },
  {
    "pname": "Newtonsoft.Json",
@@ -91,13 +66,13 @@
  },
  {
    "pname": "NLog",
-    "version": "6.1.3",
-    "hash": "sha256-s0sxfQ1tiWRSFVh/m/eIzEe4+ZgT02e9GZiwDAi7xp4="
+    "version": "6.1.4",
+    "hash": "sha256-76h0KhYh0B6NDrkV5MHhv8SqUSvhTF6CFKsao5nRBbQ="
  },
  {
    "pname": "runtime.native.System.Data.SqlClient.sni",
-    "version": "4.7.0",
-    "hash": "sha256-cj0+BpmoibwOWj2wNXwONJeTGosmFwhD349zPjNaBK0="
+    "version": "4.4.0",
+    "hash": "sha256-fqYLXAyMXfKXKx1A+E62vt2fiJOyfR+m3wMbULy/lpc="
  },
  {
    "pname": "runtime.win-arm64.runtime.native.System.Data.SqlClient.sni",
@@ -119,11 +94,6 @@
    "version": "2.1.3",
    "hash": "sha256-lUTFK7OBtiXU1gyROax4GXDRvNj3aqgGlZZvicc37VQ="
  },
-  {
-    "pname": "SixLabors.ImageSharp",
-    "version": "3.1.11",
-    "hash": "sha256-MlRF+3SGfahbsB1pZGKMOrsfUCx//hCo7ECrXr03DpA="
-  },
  {
    "pname": "SixLabors.ImageSharp",
    "version": "3.1.12",
@@ -136,8 +106,8 @@
  },
  {
    "pname": "SourceGear.sqlite3",
-    "version": "3.50.4.5",
-    "hash": "sha256-yPOyLiK4QoTfE3IED0hFl1JJYjmt8RBB3fp1a1CwvqE="
+    "version": "3.53.4",
+    "hash": "sha256-PrKw/AkB++CbeDloscGwAurHh4BT/kfTCed9ImgBDZo="
  },
  {
    "pname": "Stub.System.Data.SQLite.Core.NetStandard",
@@ -146,24 +116,14 @@
  },
  {
    "pname": "System.CodeDom",
-    "version": "10.0.8",
-    "hash": "sha256-BePlDeK617FVuzguexH5RnBDyapaN/zY47lpV/3nzyw="
+    "version": "10.0.10",
+    "hash": "sha256-xmuoa7ejwrNsha6hXLm0zsagGrUsoCe8Dd+5xFiNWvI="
  },
  {
    "pname": "System.CodeDom",
    "version": "4.7.0",
    "hash": "sha256-4lO4CQyyqvwSG/EtNsRTQsbwyiY5pr225kAQXvlDkNE="
  },
-  {
-    "pname": "System.Collections.Immutable",
-    "version": "5.0.0",
-    "hash": "sha256-GdwSIjLMM0uVfE56VUSLVNgpW0B//oCeSFj8/hSlbM8="
-  },
-  {
-    "pname": "System.Collections.Immutable",
-    "version": "6.0.0",
-    "hash": "sha256-DKEbpFqXCIEfqp9p3ezqadn5b/S1YTk32/EQK+tEScs="
-  },
  {
    "pname": "System.ComponentModel.Annotations",
    "version": "4.7.0",
@@ -176,8 +136,8 @@
  },
  {
    "pname": "System.Data.SqlClient",
-    "version": "4.8.1",
-    "hash": "sha256-SrhZIjgbS7XpFHsydxRBs8zu0qbgGLkdtvP0PBORv6A="
+    "version": "4.9.1",
+    "hash": "sha256-jsjLF1pojTAIlyOfinZLWcwOxUKjV5LUHGjAtOYt7aM="
  },
  {
    "pname": "System.Data.SQLite",
@@ -194,66 +154,26 @@
    "version": "1.0.119",
    "hash": "sha256-upgcZ/YGVNT7kl+oZ/4fsLVourVef/8xpLQjk+J9+7w="
  },
-  {
-    "pname": "System.Diagnostics.DiagnosticSource",
-    "version": "10.0.8",
-    "hash": "sha256-WUukX2DEBYxDiJVcGosDMfq16sarrbDGtzq7p5WC7EE="
-  },
  {
    "pname": "System.Drawing.Common",
-    "version": "4.7.0",
-    "hash": "sha256-D3qG+xAe78lZHvlco9gHK2TEAM370k09c6+SQi873Hk="
+    "version": "10.0.10",
+    "hash": "sha256-kHJHgIhFa9+HN86in89Y2NDxy5Cz/r2sSOguFQhXKt0="
  },
  {
    "pname": "System.Management",
-    "version": "10.0.8",
-    "hash": "sha256-q0aaBuL/OblJw7vq+yxjWiUJuT5Hi6rfqebsgcHxb9E="
-  },
-  {
-    "pname": "System.Memory",
-    "version": "4.5.4",
-    "hash": "sha256-3sCEfzO4gj5CYGctl9ZXQRRhwAraMQfse7yzKoRe65E="
+    "version": "10.0.10",
+    "hash": "sha256-FAyMQ6ouxpt5/tdVv62lNp/3hiUbV8uAI4YoKMmj2oE="
  },
  {
    "pname": "System.Reactive",
    "version": "6.1.0",
    "hash": "sha256-zACYoZmKxHo0qKY8FOVa7jIsw7dN7WjdXdRRV95qY2Y="
  },
-  {
-    "pname": "System.Reflection.Metadata",
-    "version": "5.0.0",
-    "hash": "sha256-Wo+MiqhcP9dQ6NuFGrQTw6hpbJORFwp+TBNTq2yhGp8="
-  },
-  {
-    "pname": "System.Reflection.Metadata",
-    "version": "6.0.0",
-    "hash": "sha256-VJHXPjP05w6RE/Swu8wa2hilEWuji3g9bl/6lBMSC/Q="
-  },
  {
    "pname": "System.Reflection.MetadataLoadContext",
    "version": "6.0.0",
    "hash": "sha256-82aeU8c4rnYPLL3ba1ho1fxfpYQt5qrSK5e6ES+OTsY="
  },
-  {
-    "pname": "System.Runtime.CompilerServices.Unsafe",
-    "version": "4.5.2",
-    "hash": "sha256-8eUXXGWO2LL7uATMZye2iCpQOETn2jCcjUhG6coR5O8="
-  },
-  {
-    "pname": "System.Runtime.CompilerServices.Unsafe",
-    "version": "5.0.0",
-    "hash": "sha256-neARSpLPUzPxEKhJRwoBzhPxK+cKIitLx7WBYncsYgo="
-  },
-  {
-    "pname": "System.Runtime.CompilerServices.Unsafe",
-    "version": "6.0.0",
-    "hash": "sha256-bEG1PnDp7uKYz/OgLOWs3RWwQSVYm+AnPwVmAmcgp2I="
-  },
-  {
-    "pname": "System.Security.AccessControl",
-    "version": "4.7.0",
-    "hash": "sha256-/9ZCPIHLdhzq7OW4UKqTsR0O93jjHd6BRG1SRwgHE1g="
-  },
  {
    "pname": "System.Security.Cryptography.ProtectedData",
    "version": "4.7.0",
@@ -264,21 +184,6 @@
    "version": "4.7.0",
    "hash": "sha256-BGgXMLUi5rxVmmChjIhcXUxisJjvlNToXlyaIbUxw40="
  },
-  {
-    "pname": "System.Security.Principal.Windows",
-    "version": "4.7.0",
-    "hash": "sha256-rWBM2U8Kq3rEdaa1MPZSYOOkbtMGgWyB8iPrpIqmpqg="
-  },
-  {
-    "pname": "System.Text.Encoding.CodePages",
-    "version": "4.5.1",
-    "hash": "sha256-PIhkv59IXjyiuefdhKxS9hQfEwO9YWRuNudpo53HQfw="
-  },
-  {
-    "pname": "System.Threading.Tasks.Extensions",
-    "version": "4.5.4",
-    "hash": "sha256-owSpY8wHlsUXn5xrfYAiu847L6fAKethlvYx97Ri1ng="
-  },
  {
    "pname": "System.Windows.Extensions",
    "version": "4.7.0",
--- a/pkgs/by-name/vr/vrcx/package-lock.json
+++ b/pkgs/by-name/vr/vrcx/package-lock.json
--- a/pkgs/by-name/vr/vrcx/package.nix
+++ b/pkgs/by-name/vr/vrcx/package.nix
@@ -14,23 +14,23 @@
 let
  node = nodejs_24;
  electron = electron_42;
-  dotnet = dotnetCorePackages.dotnet_9;
+  dotnet = dotnetCorePackages.dotnet_10;
 in
 buildNpmPackage (finalAttrs: {
  pname = "vrcx";
-  version = "2026.07.18";
+  version = "2026.09.16";

  src = fetchFromGitHub {
    repo = "VRCX";
    owner = "vrcx-team";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-gmCS1M77CTJLWb+SR42kghtGxJuPZDRADKZS14Tx9Y8=";
+    hash = "sha256-CNO3Ur8xp77QN+HCexCpGX+QdAKM76YOSWOG3ZHT1g0=";
  };

  nodejs = node;
  makeCacheWritable = true;
  npmFlags = [ "--ignore-scripts" ];
-  npmDepsHash = "sha256-YwhRYpPcGwswf3OC3n1zFoSADOPkI5sTlaQN+fDe8sI=";
+  npmDepsHash = "sha256-fFuqtISueODEFzuqWWL3aG4DWbrq2G4dHsXi3RWByjY=";

  nativeBuildInputs = [
    makeWrapper
@@ -48,11 +48,13 @@ buildNpmPackage (finalAttrs: {
    runHook preBuild

    env PLATFORM=linux npm exec vite build src
-    node ./src-electron/patch-package-version.js
-    npm exec electron-builder -- --dir \
+    node ./build-scripts/patch-package-version.js
+    npm exec electron-builder -- \
+      --config electron-builder.config.js \
+      --dir \
      -c.electronDist=${electron.dist} \
      -c.electronVersion=${electron.version}
-    node ./src-electron/patch-node-api-dotnet.js
+    node ./build-scripts/patch-node-api-dotnet.js

    runHook postBuild
  '';
--- a/pkgs/by-name/vt/vtk-dicom/package.nix
+++ b/pkgs/by-name/vt/vtk-dicom/package.nix
@@ -35,7 +35,7 @@ stdenv.mkDerivation (finalAttrs: {
    (lib.cmakeFeature "CMAKE_INSTALL_LIBDIR" "lib")
    (lib.cmakeFeature "CMAKE_INSTALL_INCLUDEDIR" "include")
  ]
-  ++ lib.optional finalAttrs.finalPackage.doCheck [
+  ++ lib.optionals finalAttrs.finalPackage.doCheck [
    # vtkBool does not accept TRUE, we have to use STRING "ON"
    (lib.cmakeFeature "BUILD_TESTING" "ON")
  ];
--- a/pkgs/by-name/xp/xpra/package.nix
+++ b/pkgs/by-name/xp/xpra/package.nix
@@ -238,7 +238,7 @@ effectiveBuildPythonApplication rec {
    "--with-pam"
    "--with-vsock"
  ]
-  ++ lib.optional withNvenc [
+  ++ lib.optionals withNvenc [
    "--with-nvenc"
    "--with-nvjpeg_encoder"
  ];
--- a/pkgs/development/compilers/llvm/common/lldb/default.nix
+++ b/pkgs/development/compilers/llvm/common/lldb/default.nix
@@ -73,7 +73,7 @@ stdenv.mkDerivation (
    patches = [
      ./gnu-install-dirs.patch
    ]
-    ++ lib.optional (lib.versions.major release_version == "18") [
+    ++ lib.optionals (lib.versions.major release_version == "18") [
      # Fix build with gcc15
      # https://github.com/llvm/llvm-project/commit/bb59f04e7e75dcbe39f1bf952304a157f0035314
      ./lldb-add-include-cstdint.patch
--- a/pkgs/development/compilers/llvm/common/mlir/default.nix
+++ b/pkgs/development/compilers/llvm/common/mlir/default.nix
@@ -40,7 +40,7 @@ stdenv.mkDerivation (finalAttrs: {
  patches = [
    ./gnu-install-dirs.patch
  ]
-  ++ lib.optional (lib.versionOlder release_version "20") [
+  ++ lib.optionals (lib.versionOlder release_version "20") [
    # Fix build with gcc15
    # https://github.com/llvm/llvm-project/commit/41eb186fbb024898bacc2577fa3b88db0510ba1f
    # https://github.com/llvm/llvm-project/commit/101109fc5460d5bb9bb597c6ec77f998093a6687
--- a/pkgs/development/interpreters/php/generic.nix
+++ b/pkgs/development/interpreters/php/generic.nix
@@ -290,7 +290,7 @@ let
            ++ lib.optional valgrindSupport "--with-valgrind=${valgrind.dev}"
            ++ lib.optional ztsSupport "--enable-zts"
            ++ lib.optional staticSupport "--enable-static"
-            ++ lib.optional (!zendSignalsSupport) [ "--disable-zend-signals" ]
+            ++ lib.optionals (!zendSignalsSupport) [ "--disable-zend-signals" ]
            ++ lib.optional zendMaxExecutionTimersSupport "--enable-zend-max-execution-timers"

            # Sendmail
--- a/pkgs/development/libraries/libxmlxx/v3.nix
+++ b/pkgs/development/libraries/libxmlxx/v3.nix
@@ -56,7 +56,7 @@ stdenv.mkDerivation rec {
    docbook5
    docbook-xsl-ns
  ]
-  ++ lib.lists.optional withPDF [
+  ++ lib.lists.optionals withPDF [
    fop
    dblatex
  ];
--- a/pkgs/development/libraries/science/astronomy/indilib/default.nix
+++ b/pkgs/development/libraries/science/astronomy/indilib/default.nix
@@ -58,7 +58,7 @@ stdenv.mkDerivation (finalAttrs: {
    "-DCMAKE_INSTALL_LIBDIR=lib"
    "-DUDEVRULES_INSTALL_DIR=lib/udev/rules.d"
  ]
-  ++ lib.optional finalAttrs.finalPackage.doCheck [
+  ++ lib.optionals finalAttrs.finalPackage.doCheck [
    "-DINDI_BUILD_UNITTESTS=ON"
    "-DINDI_BUILD_INTEGTESTS=ON"
  ];
--- a/pkgs/development/libraries/science/astronomy/indilib/indi-3rdparty.nix
+++ b/pkgs/development/libraries/science/astronomy/indilib/indi-3rdparty.nix
@@ -77,7 +77,7 @@ let
          "-DRULES_INSTALL_DIR=lib/udev/rules.d"
          "-DINDI_DATA_DIR=share/indi/"
        ]
-        ++ lib.optional doCheck [
+        ++ lib.optionals doCheck [
          "-DINDI_BUILD_UNITTESTS=ON"
          "-DINDI_BUILD_INTEGTESTS=ON"
        ]
--- a/pkgs/development/python-modules/deal/default.nix
+++ b/pkgs/development/python-modules/deal/default.nix
@@ -72,7 +72,7 @@ buildPythonPackage rec {
    # assert basically correct but fails in string match due to '' removed
    "test_unknown_command"
  ]
-  ++ lib.optional (pythonAtLeast "3.13") [
+  ++ lib.optionals (pythonAtLeast "3.13") [
    # assert basically correct but string match fails in due to
    # ('pathlib._local', 'Path.write_text') != ('pathlib', 'Path.write_text')
    "test_infer"
--- a/pkgs/development/python-modules/ffmpeg-progress-yield/default.nix
+++ b/pkgs/development/python-modules/ffmpeg-progress-yield/default.nix
@@ -37,7 +37,7 @@ buildPythonPackage rec {
    procps
  ];

-  disabledTests = lib.optional stdenv.hostPlatform.isDarwin [
+  disabledTests = lib.optionals stdenv.hostPlatform.isDarwin [
    # cannot access /usr/bin/pgrep from the sandbox
    "test_context_manager"
    "test_context_manager_with_exception"
--- a/pkgs/development/python-modules/inkex/default.nix
+++ b/pkgs/development/python-modules/inkex/default.nix
@@ -71,7 +71,7 @@ buildPythonPackage {
    "test_extract_multiple"
    "test_lookup_and"
  ]
-  ++ lib.optional stdenv.hostPlatform.isDarwin [
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
    "test_image_extract"
    "test_path_number_nodes"
    "test_plotter" # Hangs
--- a/pkgs/development/python-modules/loro/default.nix
+++ b/pkgs/development/python-modules/loro/default.nix
@@ -8,17 +8,17 @@

 buildPythonPackage rec {
  pname = "loro";
-  version = "1.10.3";
+  version = "1.13.1";
  pyproject = true;

  src = fetchPypi {
    inherit pname version;
-    hash = "sha256-aBhKscKrlK9q1Kq6QW0i9XnKvuCybLsJofZ4WCB7vOg=";
+    hash = "sha256-DDcnvFL1CYV2Uy7dOZ78CM6yNMXZI1oZy9XqN8T7pIU=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit pname version src;
-    hash = "sha256-Lp4VwxmYqB2uvCuxX+tHl0QCpbCvPMjgrgPk0KL1LEQ=";
+    hash = "sha256-KVBe2bUvxilOysCVfcBSZCtwexlTkVAc83tH1H7nMbQ=";
  };

  build-system = [
--- a/pkgs/development/python-modules/mpl-typst/default.nix
+++ b/pkgs/development/python-modules/mpl-typst/default.nix
@@ -60,7 +60,7 @@ buildPythonPackage rec {
    "test_draw_image_spy"
  ];

-  disabledTestPaths = lib.optional stdenv.hostPlatform.isDarwin [
+  disabledTestPaths = lib.optionals stdenv.hostPlatform.isDarwin [
    # fatal error when matplotlib creates a canvas
    "mpl_typst/backend_test.py"
  ];
--- a/pkgs/development/python-modules/pandas/default.nix
+++ b/pkgs/development/python-modules/pandas/default.nix
@@ -221,7 +221,7 @@ let
      # These tests are unreliable on aarch64-darwin. See https://github.com/pandas-dev/pandas/issues/38921.
      "test_rolling"
    ]
-    ++ lib.optional stdenv.hostPlatform.is32bit [
+    ++ lib.optionals stdenv.hostPlatform.is32bit [
      # https://github.com/pandas-dev/pandas/issues/37398
      "test_rolling_var_numerical_issues"
    ];
--- a/pkgs/development/python-modules/pymupdf/default.nix
+++ b/pkgs/development/python-modules/pymupdf/default.nix
@@ -149,7 +149,7 @@ buildPythonPackage (finalAttrs: {
    # Do not lint code
    "tests/test_typing.py"
  ]
-  ++ lib.optional stdenv.hostPlatform.isDarwin [
+  ++ lib.optionals stdenv.hostPlatform.isDarwin [
    # Trace/BPT trap: 5 when getting widget options
    "tests/test_4505.py"
    "tests/test_widgets.py"
--- a/pkgs/development/python-modules/starlette-admin/0001-fix-pytest-pyproject-collision.patch
+++ b/pkgs/development/python-modules/starlette-admin/0001-fix-pytest-pyproject-collision.patch
@@ -1,14 +0,0 @@
-diff --git a/pyproject.toml b/pyproject.toml
-index 3e170b4..e2c6c77 100644
--- a/pyproject.toml
-+++ b/pyproject.toml
-@@ -183,9 +183,6 @@ parallel = true
- concurrency = ["thread", "greenlet"]
- source = ["starlette_admin", "tests"]
- 
-[tool.pytest]
-asyncio_mode = "auto"
-
- [tool.pytest.ini_options]
- asyncio_mode="auto"
- asyncio_default_fixture_loop_scope="function"
--- a/pkgs/development/python-modules/starlette-admin/default.nix
+++ b/pkgs/development/python-modules/starlette-admin/default.nix
@@ -3,136 +3,146 @@
  stdenv,
  buildPythonPackage,
  fetchFromGitHub,
-  pythonAtLeast,

  # build-system
  hatchling,

  # dependencies
+  itsdangerous,
  jinja2,
  python-multipart,
  starlette,

  # optional-dependencies
+  aiobotocore,
  babel,
+  email-validator,
+  nh3,
+  reportlab,

  # tests
-  aiosqlite,
  arrow,
-  cacert,
-  colour,
-  fasteners,
-  httpx,
+  boto3,
+  httpx2,
+  markdown,
+  minio,
  mongoengine,
-  motor,
-  passlib,
-  phonenumbers,
+  openpyxl,
  pillow,
-  psycopg2,
  pydantic,
  pytest-asyncio,
  pytestCheckHook,
-  requests,
  sqlalchemy,
  sqlalchemy-file,
  sqlalchemy-utils,
-  sqlmodel,
+  tablib,
+  testcontainers,
+  tinydb,
 }:

 buildPythonPackage rec {
  pname = "starlette-admin";
-  version = "0.16.0";
+  version = "1.0.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "jowilf";
    repo = "starlette-admin";
    tag = version;
-    hash = "sha256-JVvrfbyKillkx6fOx4DEbHZoHIPxF1Gn3HzkxyJc66o=";
+    hash = "sha256-Gc5CGQhJx55BJmbcxDO8M5JpQULWtXQqQv/9+7J0X6A=";
  };

-  patches = [
-    # "Cannot use both [tool.pytest] (native TOML types) and [tool.pytest.ini_options] (string-based INI format) simultaneously"
-    ./0001-fix-pytest-pyproject-collision.patch
-  ];
-
  build-system = [ hatchling ];

  dependencies = [
+    itsdangerous
    jinja2
    python-multipart
    starlette
  ];

  optional-dependencies = {
+    email = [ email-validator ];
    i18n = [ babel ];
+    pdf = [ reportlab ];
+    s3 = [ aiobotocore ];
+    tinymce = [ nh3 ];
  };

  nativeCheckInputs = [
-    aiosqlite
+    aiobotocore
    arrow
    babel
-    cacert
-    colour
-    fasteners
-    httpx
+    boto3
+    email-validator
+    httpx2
+    markdown
+    minio
    mongoengine
-    motor
-    passlib
-    phonenumbers
+    openpyxl
    pillow
-    psycopg2
    pydantic
    pytest-asyncio
    pytestCheckHook
-    requests
    sqlalchemy
    sqlalchemy-file
    sqlalchemy-utils
-    sqlmodel
-  ];
+    tablib
+    testcontainers
+    tinydb
+    reportlab
+  ]
+  ++ tablib.optional-dependencies.all;

-  preCheck = ''
-    # used in get_test_container in tests/sqla/utils.py
-    # fixes FileNotFoundError: [Errno 2] No such file or directory: '/tmp/storage/...'
-    mkdir .storage
-    export LOCAL_PATH="$PWD/.storage"
-  '';
+  # exclude cookicutter tests
+  pytestFlags = [ "tests/" ];

-  disabledTests =
-    lib.optionals (pythonAtLeast "3.14") [
-      # AssertionError: Regex pattern did not match
-      "test_not_supported_annotation"
-    ]
-    ++ lib.optionals stdenv.hostPlatform.isDarwin [
-      # flaky, depends on test order
-      "test_ensuring_pk"
-      # flaky, of-by-one
-      "test_api"
-    ];
-
-  disabledTestPaths = [
-    # odmantic is not packaged
-    "tests/odmantic"
-    # beanie is not packaged
-    "tests/beanie"
-    # needs mongodb running on port 27017
-    "tests/mongoengine"
+  disabledTests = [
+    # requires docker
+    "test_build_response_with_file_field_returns_zip"
+    "test_storage_save_returns_file_info"
+    "test_storage_save_never_overwrites"
+    "test_storage_delete_is_idempotent"
+    "test_storage_url_contains_key"
+    "test_storage_serve_returns_response"
+    "test_storage_serve_returns_response"
+    "test_s3_presigned_url"
  ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [
-    # very flaky, sandbox issues?
-    # libcloud.storage.types.ContainerDoesNotExistError
-    # sqlite3.OperationalError: attempt to write a readonly database
-    "tests/sqla/test_sync_engine.py"
-    "tests/sqla/test_async_engine.py"
+    # flaky, depends on test order
+    "test_ensuring_pk"
+    # flaky, of-by-one
+    "test_api"
+  ];
+
+  disabledTestPaths = [
+    # not packaged
+    "tests/unit/beanie"
+    "tests/unit/tortoise"
+    # slow, requires a huge build closure
+    "tests/integration"
+    # requires various services running or docker
+    "tests/e2e"
  ];

  pythonImportsCheck = [
    "starlette_admin"
    "starlette_admin.actions"
+    "starlette_admin.auth"
    "starlette_admin.base"
+    "starlette_admin.converters"
+    "starlette_admin.cookies"
+    "starlette_admin.events"
+    "starlette_admin.exceptions"
+    "starlette_admin.export"
    "starlette_admin.fields"
+    "starlette_admin.filters"
+    "starlette_admin.flash"
    "starlette_admin.i18n"
+    "starlette_admin.routing"
+    "starlette_admin.security"
+    "starlette_admin.storage"
+    "starlette_admin.theme"
    "starlette_admin.tools"
    "starlette_admin.views"
  ];
--- a/pkgs/development/python-modules/uqbar/default.nix
+++ b/pkgs/development/python-modules/uqbar/default.nix
@@ -63,11 +63,11 @@ buildPythonPackage (finalAttrs: {
    # https://github.com/supriya-project/uqbar/issues/107
    "SummarizingRootDocumenter"
  ]
-  ++ lib.optional (pythonAtLeast "3.11") [
+  ++ lib.optionals (pythonAtLeast "3.11") [
    # assert not '\x1b[91m/build/uqbar-0.7.0/tests/fake_package/enums.py:docstring
    "test_sphinx_style"
  ]
-  ++ lib.optional (pythonAtLeast "3.12") [
+  ++ lib.optionals (pythonAtLeast "3.12") [
    # https://github.com/supriya-project/uqbar/issues/93
    "objects.get_vars"
  ]
--- a/pkgs/development/tools/godot/common.nix
+++ b/pkgs/development/tools/godot/common.nix
@@ -325,7 +325,7 @@ let

                    # stripping dlls results in:
                    # Failed to load System.Private.CoreLib.dll (error code 0x8007000B)
-                    stripExclude = lib.optional withMono [ "*.dll" ];
+                    stripExclude = lib.optionals withMono [ "*.dll" ];

                    runtimeDependencies =
                      prev.runtimeDependencies or [ ]
--- a/pkgs/os-specific/cygwin/newlib-cygwin/default.nix
+++ b/pkgs/os-specific/cygwin/newlib-cygwin/default.nix
@@ -41,7 +41,7 @@
      # declared. Backport of https://cygwin.com/cgit/newlib-cygwin/commit/?id=73600d68227e125af24b7de7c3fccbd4eb66ee03
      ./fix-winsize.patch
    ]
-    ++ lib.optional (!headersOnly) [
+    ++ lib.optionals (!headersOnly) [
      # https://cygwin.com/pipermail/cygwin-developers/2020-September/011970.html
      # This is required for boost coroutines to work. After we get to the point
      # where nix runs on cygwin, we can attempt to upstream this again.
--- a/pkgs/servers/http/angie/default.nix
+++ b/pkgs/servers/http/angie/default.nix
@@ -9,11 +9,11 @@

 callPackage ../nginx/generic.nix args rec {
  pname = "angie";
-  version = "1.12.1";
+  version = "1.12.2";

  src = fetchurl {
    url = "https://download.angie.software/files/angie-${version}.tar.gz";
-    hash = "sha256-X08gO+Kspv4gdwtInHIORuUdM35SEGXn5HK2HiTj0vU=";
+    hash = "sha256-TwpRsd6N2fCSSLKEW7+k308DSHe/kvYF5Jn9f/8Jx3w=";
  };

  configureFlags = lib.optionals withAcme [
@@ -43,8 +43,5 @@ callPackage ../nginx/generic.nix args rec {
    license = lib.licenses.bsd2;
    platforms = lib.platforms.all;
    maintainers = with lib.maintainers; [ izorkin ];
-    knownVulnerabilities = [
-      "angie is insufficiently maintained in nixpkgs. Security updates are frequently delayed. Please consider stepping up as maintainer or switching to an alternative."
-    ];
  };
 }
--- a/pkgs/servers/http/nginx/mainline.nix
+++ b/pkgs/servers/http/nginx/mainline.nix
@@ -1,6 +1,6 @@
 { callPackage, ... }@args:

 callPackage ./generic.nix args {
-  version = "1.31.5";
-  hash = "sha256-6VFgfVNINmJL02trRacdv7BVI33q43ONprvzJw2tonk=";
+  version = "1.31.6";
+  hash = "sha256-l07VKYpeOY4AhwTtXbKE5lX8JwxZZJPbzK2kUkSPyfE=";
 }
--- a/pkgs/servers/http/nginx/stable.nix
+++ b/pkgs/servers/http/nginx/stable.nix
@@ -1,6 +1,6 @@
 { callPackage, ... }@args:

 callPackage ./generic.nix args {
-  version = "1.30.4";
-  hash = "sha256-QmHckOnkfBxAQSdumqo9SOvi5mT3KOFPqVrmxn1XoIs=";
+  version = "1.30.5";
+  hash = "sha256-bCBWWqIyXLgiFq6AT0pP8YdReQFHWaOBxC3cjhHEkG0=";
 }
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2161,8 +2161,6 @@ with pkgs;
    buildProduct = "daemon";
  };

-  fpm = callPackage ../tools/package-management/fpm { };
-
  ferdium = callPackage ../applications/networking/instant-messengers/ferdium {
    mkFranzDerivation = callPackage ../applications/networking/instant-messengers/franz/generic.nix { };
  };
@@ -2173,8 +2171,6 @@ with pkgs;

  frostwire-bin = callPackage ../applications/networking/p2p/frostwire/frostwire-bin.nix { };

-  uniscribe = callPackage ../tools/text/uniscribe { };
-
  inherit (callPackages ../tools/filesystems/garage { })
    garage
    garage_1
@@ -2337,8 +2333,6 @@ with pkgs;

  hassil = with python3Packages; toPythonApplication hassil;

-  haste-client = callPackage ../tools/misc/haste-client { };
-
  hareThirdParty = recurseIntoAttrs (callPackage ./hare-third-party.nix { });

  hdf5 = callPackage ../tools/misc/hdf5 {
@@ -2926,8 +2920,6 @@ with pkgs;
    ssh = openssh;
  };

-  phosh = callPackage ../applications/window-managers/phosh { };
-
  phosh-mobile-settings =
    callPackage ../applications/window-managers/phosh/phosh-mobile-settings.nix
      { };