Merge staging-next into staging

2026-08-26 02:05:02 +00:00 · 2026-08-17 12:07:48 +00:00
parent be800eb98d 1a91e8ab71
commit fe296c3ab4
145 changed files with 3131 additions and 2627 deletions
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -5188,6 +5188,11 @@
    githubId = 1103294;
    name = "Christopher Rosset";
  };
+  christo-auer = {
+    name = "Christopher Auer";
+    github = "christo-auer";
+    githubId = 15138131;
+  };
  christoph-heiss = {
    email = "christoph@c8h4.io";
    github = "christoph-heiss";
@@ -7782,7 +7787,8 @@
    matrix = "@dvdznf:gitter.im";
  };
  dvn0 = {
-    email = "git@dvn.me";
+    email = "devan@informatics.coop";
+    keys = [ { fingerprint = "E0F4 87C6 6298 7353 A7D0 E997 8203 BD5C 41D8 29DF"; } ];
    github = "dvn0";
    githubId = 10859387;
    name = "Devan Carpenter";
@@ -23627,6 +23633,13 @@
    github = "rachalaraj";
    githubId = 124191100;
  };
+  rachitvrma = {
+    name = "Rachit Kumar Verma";
+    email = "rachitverma1122+nixpkgs@gmail.com";
+    matrix = "@rachitvrma:matrix.org";
+    github = "rachitvrma";
+    githubId = 155641117;
+  };
  RadxaYuntian = {
    # This is the work account for @MakiseKurisu
    name = "ZHANG Yuntian";
--- a/nixos/doc/manual/release-notes/rl-2611.section.md
+++ b/nixos/doc/manual/release-notes/rl-2611.section.md
@@ -160,6 +160,8 @@

 - String values passed to `services.phpfpm.settings`, `services.phpfpm.pools.<name>.phpEnv`, and `services.phpfpm.pools.<name>.settings` are now properly quoted and escaped, except for the `${}` syntax that is left as-is. If you are manually escaping these values, please adjust accordingly.

+- GitLab has been updated from 18.x to 19.x and requires PostgreSQL >= 17, as stated in the [documentation](https://docs.gitlab.com/19.1/install/requirements/#postgresql). Check the [upgrade guide](#module-services-postgres-upgrading) in the NixOS manual on how to upgrade your PostgreSQL installation.
+
 - `services.gitlab.registry` has been modified so that the GitLab container registry runs in the `gitlab-container-registry` system user. This behavior can be modified with the `services.gitlab.registry.user` option.

 - `systemd.user.extraConfig` has been removed in favor of the structured [](#opt-systemd.user.settings.Manager) option. Use `systemd.user.settings.Manager` to set any `systemd-user.conf(5)` option directly. For example, replace `systemd.user.extraConfig = "DefaultTimeoutStartSec=60";` with `systemd.user.settings.Manager.DefaultTimeoutStartSec = 60;`.
--- a/nixos/modules/hardware/all-hardware.nix
+++ b/nixos/modules/hardware/all-hardware.nix
@@ -109,6 +109,10 @@ in
      "pata_qdi"
      "pata_winbond"
    ]
+    ++ lib.optionals (lib.versionAtLeast config.boot.kernelPackages.kernel.version "7.2") [
+      # xhci-pci defers AMD 800-series chipset controllers to this driver.
+      "xhci_pci_prom21"
+    ]
    ++ lib.optionals platform.isx86 [ "vmw_balloon" ]
    ++ lib.optionals (pkgs.stdenv.hostPlatform.isi686 || pkgs.stdenv.hostPlatform.isx86_64) [
      "vmw_vmci"
--- a/nixos/modules/installer/tools/nixos-generate-config.pl
+++ b/nixos/modules/installer/tools/nixos-generate-config.pl
@@ -206,10 +206,10 @@ sub pciCheck {
         $device eq "0x4222" || $device eq "0x4227");

    # Intel NPU driver
-    # list taken from linux(v6.18): drivers/accel/ivpu/ivpu_drv.h
+    # list taken from linux(v7.1): drivers/accel/ivpu/ivpu_drv.h
    if ($vendor eq "0x8086" &&
-        ($device eq "0xfd3e" || $device eq "0x7d1d" || $device eq "0xad1d" ||
-         $device eq "0x643e" || $device eq "0xb03e"))
+        ($device eq "0x7d1d" || $device eq "0xad1d" || $device eq "0x643e" ||
+         $device eq "0xb03e" || $device eq "0xfd3e" || $device eq "0xd71d"))
    {
        push @attrs, "hardware.cpu.intel.npu.enable = true;";
    }
--- a/nixos/modules/services/audio/mpd.nix
+++ b/nixos/modules/services/audio/mpd.nix
@@ -84,12 +84,10 @@ let
          }
        }
      '';
-      passAsFile = [
-        "expectScript"
-      ];
+      __structuredAttrs = true;
    };
    checkPhase = ''
-      ${lib.getExe pkgs.buildPackages.expect} -f "$expectScriptPath"
+      printf "%s" "$expectScript" | ${lib.getExe pkgs.buildPackages.expect} -f -
    '';
  };

--- a/nixos/modules/services/desktop-managers/gnome.nix
+++ b/nixos/modules/services/desktop-managers/gnome.nix
@@ -400,6 +400,15 @@ in
        pkgs.xdg-user-dirs-gtk # Used to create the default bookmarks
      ];

+      # Restarting this unit terminates the active GNOME session.
+      systemd.user.services.gnome-session-monitor = {
+        restartIfChanged = false;
+        overrideStrategy = "asDropin";
+        # No need to add the NixOS default Environment="Path=coreutils:...",
+        # to the gnome-session-monitor service.
+        enableDefaultPath = false;
+      };
+
      services.udev.packages = [
        # Force enable KMS modifiers for devices that require them.
        # https://gitlab.gnome.org/GNOME/pkgs.mutter/-/merge_requests/1443
--- a/nixos/modules/services/games/archisteamfarm.nix
+++ b/nixos/modules/services/games/archisteamfarm.nix
@@ -22,6 +22,9 @@ let
    // lib.optionalAttrs (cfg.ipcPasswordFile != null) {
      IPCPassword = "#ipcPassword#";
    }
+    // lib.optionalAttrs (cfg.licenseFile != null) {
+      LicenseID = "#licenseID#";
+    }
  );

  ipc-config = format.generate "IPC.config" cfg.ipcSettings;
@@ -109,6 +112,12 @@ in
      default = { };
    };

+    licenseFile = lib.mkOption {
+      type = with lib.types; nullOr path;
+      default = null;
+      description = "Path to a file containing the license. The file must be readable by the `archisteamfarm` user/group.";
+    };
+
    ipcPasswordFile = lib.mkOption {
      type = with lib.types; nullOr path;
      default = null;
@@ -273,6 +282,10 @@ in

            cp --no-preserve=mode ${configFile} config/ASF.json

+            ${lib.optionalString (cfg.licenseFile != null) ''
+              ${replaceSecretBin} '#licenseID#' '${cfg.licenseFile}' config/ASF.json
+            ''}
+
            ${lib.optionalString (cfg.ipcPasswordFile != null) ''
              ${replaceSecretBin} '#ipcPassword#' '${cfg.ipcPasswordFile}' config/ASF.json
            ''}
--- a/nixos/modules/services/misc/gitlab/default.nix
+++ b/nixos/modules/services/misc/gitlab/default.nix
@@ -1307,6 +1307,7 @@ in
      "d ${cfg.statePath}/custom_hooks/post-receive.d 0700 ${cfg.user} ${cfg.group} -"
      "d ${cfg.statePath}/custom_hooks/update.d 0700 ${cfg.user} ${cfg.group} -"
      "d ${gitlabConfig.production.shared.path} 0750 ${cfg.user} ${cfg.group} -"
+      "d ${gitlabConfig.production.shared.path}/agent_plan_content 0750 ${cfg.user} ${cfg.group} -"
      "d ${gitlabConfig.production.shared.path}/artifacts 0750 ${cfg.user} ${cfg.group} -"
      "d ${gitlabConfig.production.shared.path}/lfs-objects 0750 ${cfg.user} ${cfg.group} -"
      "d ${gitlabConfig.production.shared.path}/packages 0750 ${cfg.user} ${cfg.group} -"
--- a/nixos/modules/services/networking/hostapd.nix
+++ b/nixos/modules/services/networking/hostapd.nix
@@ -795,7 +795,7 @@ in
                            - {var}`"wpa2-sha256"`: WPA2-Personal using HMAC-SHA256 (IEEE 802.11i/RSN). Passwords are set
                              using {option}`wpaPassword` or preferably by {option}`wpaPasswordFile` or {option}`wpaPskFile`.
                            - {var}`"wpa3-sae-transition"`: Use WPA3-Personal (SAE) if possible, otherwise fallback
-                              to WPA2-SHA256. Only use if necessary and switch to the newer WPA3-SAE when possible.
+                              to WPA2-Personal. Only use if necessary and switch to the newer WPA3-SAE when possible.
                              You will have to specify both {option}`wpaPassword` and {option}`saePasswords` (or one of their alternatives).
                            - {var}`"wpa3-sae"`: Use WPA3-Personal (SAE). This is currently the recommended way to
                              setup a secured WiFi AP (as of March 2023) and therefore the default. Passwords are set
@@ -803,6 +803,27 @@ in
                          '';
                        };

+                        transitionDisable = mkOption {
+                          default = false;
+                          example = true;
+                          type = types.bool;
+                          description = ''
+                            Enable the WPA3-Personal Transition Disable indication. After a successful
+                            WPA3 association, compatible stations will disable WPA2-Personal for this
+                            network profile, protecting subsequent associations against downgrade attacks.
+                            Legacy stations can still connect using WPA2 in transition mode.
+
+                            This option is supported in `"wpa3-sae"` and `"wpa3-sae-transition"` modes.
+
+                            ::: {.warning}
+                            Enable this only when every BSS in the network using this SSID supports
+                            WPA3-Personal. The indication applies to a station's entire network profile
+                            and can prevent it from connecting to WPA2-only BSSs. Therefore, the WPA3 spec
+                            requires this to be disabled by default.
+                            :::
+                          '';
+                        };
+
                        pairwiseCiphers = mkOption {
                          default = [ "CCMP" ];
                          example = [
@@ -1075,15 +1096,12 @@ in
                          wpa_key_mgmt = "SAE";
                          # Derive PWE using both hunting-and-pecking loop and hash-to-element
                          sae_pwe = 2;
-                          # Prevent downgrade attacks by indicating to clients that they should
-                          # disable any transition modes from now on.
-                          transition_disable = "0x01";
                          # Per WPA3 spec, MFP is required.
                          ieee80211w = 2;
                        }
                        // optionalAttrs (bssCfg.authentication.mode == "wpa3-sae-transition") {
                          wpa = 2;
-                          wpa_key_mgmt = "WPA-PSK-SHA256 SAE";
+                          wpa_key_mgmt = "WPA-PSK WPA-PSK-SHA256 SAE";
                          ieee80211w = 1;
                        }
                        // optionalAttrs (bssCfg.authentication.mode == "wpa2-sha1") {
@@ -1100,6 +1118,9 @@ in
                          wpa_pairwise = pairwiseCiphers;
                          rsn_pairwise = pairwiseCiphers;
                        }
+                        // optionalAttrs bssCfg.authentication.transitionDisable {
+                          transition_disable = "0x01";
+                        }
                        // optionalAttrs (bssCfg.authentication.wpaPassword != null) {
                          wpa_passphrase = bssCfg.authentication.wpaPassword;
                        }
@@ -1411,6 +1432,15 @@ in
                assertion = auth.saePasswords == [ ] || auth.saePasswordsFile == null;
                message = "hostapd radio ${radio} bss ${bss}: must use only one SAE password option (saePasswords or saePasswordsFile)";
              }
+              {
+                assertion =
+                  auth.transitionDisable
+                  -> builtins.elem auth.mode [
+                    "wpa3-sae"
+                    "wpa3-sae-transition"
+                  ];
+                message = "hostapd radio ${radio} bss ${bss}: transitionDisable requires WPA3-SAE or WPA3-SAE transition mode";
+              }
              {
                assertion = auth.mode == "wpa3-sae" -> (auth.saePasswords != [ ] || auth.saePasswordsFile != null);
                message = "hostapd radio ${radio} bss ${bss}: uses WPA3-SAE which requires defining a sae password option";
--- a/nixos/modules/services/ttys/getty.nix
+++ b/nixos/modules/services/ttys/getty.nix
@@ -28,17 +28,19 @@ let

  gettyCmd = args: "${lib.getExe' pkgs.util-linux "agetty"} ${escapeShellArgs baseArgs} ${args}";

-  autologinScript = ''
-    otherArgs="--noclear --keep-baud $TTY 115200,38400,9600 $TERM";
-    ${lib.optionalString cfg.autologinOnce ''
-      autologged="/run/agetty.autologged"
-      if test "$TTY" = tty1 && ! test -f "$autologged"; then
-        touch "$autologged"
-        exec ${gettyCmd "$otherArgs --autologin ${cfg.autologinUser}"}
-      fi
-    ''}
-    exec ${gettyCmd "$otherArgs"}
-  '';
+  autologinOnceScript =
+    otherArgs:
+    pkgs.writeShellApplication {
+      name = "autologin-once";
+      text = ''
+        autologged="/run/agetty.autologged"
+        if test "$TTY" = tty1 && ! test -f "$autologged"; then
+          touch "$autologged"
+          exec ${gettyCmd "${otherArgs} --autologin ${cfg.autologinUser}"}
+        fi
+        exec ${gettyCmd otherArgs}
+      '';
+    };

 in

@@ -179,7 +181,12 @@ in
      serviceConfig.ExecStart = [
        # override upstream default with an empty ExecStart
        ""
-        (pkgs.writers.writeDash "getty" autologinScript)
+        (
+          if cfg.autologinOnce then
+            lib.getExe (autologinOnceScript ''--noclear --keep-baud "$TTY" 115200,38400,9600 "$TERM"'')
+          else
+            gettyCmd "--noclear --keep-baud %I 115200,38400,9600 $TERM"
+        )
      ];
      environment.TTY = "%I";
      restartIfChanged = false;
--- a/nixos/modules/services/web-apps/discourse.nix
+++ b/nixos/modules/services/web-apps/discourse.nix
@@ -641,6 +641,8 @@ in
      s3_http_continue_timeout = null;
      s3_install_cors_rule = null;
      s3_asset_cdn_url = null;
+      s3_role_arn = null;
+      s3_role_session_name = null;

      max_user_api_reqs_per_minute = 20;
      max_user_api_reqs_per_day = 2880;
@@ -667,7 +669,6 @@ in
      compress_anon_cache = false;
      anon_cache_store_threshold = 2;
      allowed_theme_repos = null;
-      enable_email_sync_demon = false;
      max_digests_enqueued_per_30_mins_per_site = 10000;
      cluster_name = null;
      multisite_config_path = "config/multisite.yml";
@@ -681,6 +682,10 @@ in
      allow_impersonation = true;
      log_line_max_chars = 160000;
      yjit_enabled = false;
+      # this option is set to `true` in discourse's defaults.
+      # however, having this option enabled appears to cause a segfault in mini_racer
+      # see https://github.com/rubyjs/mini_racer/issues/422
+      mini_racer_single_threaded = false;
    };

    services.redis.servers.discourse =
@@ -951,27 +956,35 @@ in
              # asset pipeline enables this
              brotli_static on;
              gzip_static on;
+              add_header Access-Control-Allow-Origin *;
            '';
            "~ ^/plugins/".extraConfig = cache_1y;
            "~ /images/emoji/".extraConfig = cache_1y;
            "~ ^/uploads/" = proxy {
-              extraConfig = cache_1y + ''
+              extraConfig = ''
                proxy_set_header X-Sendfile-Type X-Accel-Redirect;
                proxy_set_header X-Accel-Mapping ${cfg.package}/share/discourse/public/=/downloads/;

                # custom CSS
                location ~ /stylesheet-cache/ {
+                    ${cache_1y}
                    try_files $uri =404;
                }
                # this allows us to bypass rails
                location ~* \.(gif|png|jpg|jpeg|bmp|tif|tiff|ico|webp)$ {
+                    ${cache_1y}
                    try_files $uri =404;
                }
-                # SVG needs an extra header attached
+                # force attachment so SVGs can't render as a document on direct navigation
                location ~* \.(svg)$ {
+                    ${cache_1y}
+                    add_header Access-Control-Allow-Origin *;
+                    add_header Content-Disposition attachment;
+                    try_files $uri =404;
                }
                # thumbnails & optimized images
                location ~ /_?optimized/ {
+                    ${cache_1y}
                    try_files $uri =404;
                }
              '';
--- a/nixos/modules/system/activation/top-level.nix
+++ b/nixos/modules/system/activation/top-level.nix
@@ -354,12 +354,6 @@ in
      # but some other script might still depend on them, although unlikely.
      installBootLoader = config.system.build.installBootLoader;
      distroId = config.system.nixos.distroId;
-      perl = pkgs.perl.withPackages (
-        p: with p; [
-          ConfigIniFiles
-          FileSlurp
-        ]
-      );
      # End if legacy environment variables

      preSwitchCheck = lib.mkIf (
--- a/nixos/modules/system/boot/kernel.nix
+++ b/nixos/modules/system/boot/kernel.nix
@@ -366,6 +366,10 @@ in
          "hid_corsair"

        ]
+        ++ optionals (versionAtLeast kernel.version "7.2") [
+          # xhci-pci defers AMD 800-series chipset controllers to this driver.
+          "xhci_pci_prom21"
+        ]
        ++ optionals pkgs.stdenv.hostPlatform.isx86 [
          # Misc. x86 keyboard stuff.
          "pcips2"
--- a/nixos/modules/virtualisation/qemu-vm.nix
+++ b/nixos/modules/virtualisation/qemu-vm.nix
@@ -420,6 +420,10 @@ in
      ]
      "Boot device is always persisted if you use a bootloader through the root disk image ; if this does not work for your usecase, please examine carefully what `virtualisation.{bootDevice, rootDevice, bootPartition}` options offer you and open an issue explaining your need.`"
    )
+    (mkRemovedOptionModule [
+      "virtualisation"
+      "useSecureBoot"
+    ] "The default OVMF now always supports Secure Boot.")
  ];

  options = {
@@ -986,18 +990,7 @@ in
    };

    virtualisation.efi = {
-      OVMF = mkOption {
-        type = types.package;
-        default =
-          (pkgs.OVMF.override {
-            secureBoot = cfg.useSecureBoot;
-          }).fd;
-        defaultText = ''
-          (pkgs.OVMF.override {
-                    secureBoot = cfg.useSecureBoot;
-                  }).fd'';
-        description = "OVMF firmware package, defaults to OVMF configured with secure boot if needed.";
-      };
+      OVMF = lib.mkPackageOption pkgs "OVMFFull" { };

      firmware = mkOption {
        type = types.path;
@@ -1088,14 +1081,6 @@ in
      '';
    };

-    virtualisation.useSecureBoot = mkOption {
-      type = types.bool;
-      default = false;
-      description = ''
-        Enable Secure Boot support in the EFI firmware.
-      '';
-    };
-
    virtualisation.bios = mkOption {
      type = types.nullOr types.package;
      default = null;
--- a/nixos/tests/limine/secure-boot.nix
+++ b/nixos/tests/limine/secure-boot.nix
@@ -15,8 +15,6 @@
    {
      virtualisation.useBootLoader = true;
      virtualisation.useEFIBoot = true;
-      virtualisation.useSecureBoot = true;
-      virtualisation.efi.OVMF = pkgs.OVMFFull.fd;
      virtualisation.efi.keepVariables = true;

      boot.loader.efi.canTouchEfiVariables = true;
--- a/nixos/tests/systemd-boot.nix
+++ b/nixos/tests/systemd-boot.nix
@@ -288,7 +288,6 @@ in
        {
          imports = [ common ];
          environment.systemPackages = [ pkgs.sbctl ];
-          virtualisation.useSecureBoot = true;
        };

      testScript =
--- a/nixos/tests/wpa_supplicant.nix
+++ b/nixos/tests/wpa_supplicant.nix
@@ -66,6 +66,7 @@ let
                ssid = "nixos-test-mixed";
                authentication = {
                  mode = "wpa3-sae-transition";
+                  transitionDisable = true;
                  saeAddToMacAllow = true;
                  saePasswordsFile = pkgs.writeText "password" naughtyPassphrase;
                  wpaPasswordFile = pkgs.writeText "password" naughtyPassphrase;
@@ -76,6 +77,7 @@ let
                ssid = "nixos-test-mixed";
                authentication = {
                  mode = "wpa3-sae-transition";
+                  transitionDisable = true;
                  saeAddToMacAllow = true;
                  saePasswordsFile = pkgs.writeText "password" naughtyPassphrase;
                  wpaPasswordFile = pkgs.writeText "password" naughtyPassphrase;
@@ -327,7 +329,16 @@ in
    };
  };

-  # Test connecting to a mixed SAE/WPA2 hotspot using WPA2
+  # Test connecting to a mixed SAE/WPA2 hotspot using legacy WPA2-PSK
+  mixedUsingWpa2Psk = runConnectionTest "mixed-using-wpa2-psk" {
+    fallbackToWPA2 = true;
+    networks.nixos-test-mixed = {
+      pskRaw = "ext:psk_nixos_test";
+      authProtocols = [ "WPA-PSK" ];
+    };
+  };
+
+  # Test connecting to a mixed SAE/WPA2 hotspot using WPA2-PSK-SHA256
  mixedUsingWpa2 = runConnectionTest "mixed-using-wpa2" {
    fallbackToWPA2 = true;
    networks.nixos-test-mixed = {
--- a/pkgs/applications/editors/jetbrains/ides/rust-rover.nix
+++ b/pkgs/applications/editors/jetbrains/ides/rust-rover.nix
@@ -18,16 +18,16 @@ let
  # update-script-start: urls
  urls = {
    x86_64-linux = {
-      url = "https://download.jetbrains.com/rustrover/RustRover-2026.2.tar.gz";
-      hash = "sha256-xHg0d7wdlcXy3c/5STlWaeouV3rMBENRB1lLqZSulqE=";
+      url = "https://download.jetbrains.com/rustrover/RustRover-2026.2.1.tar.gz";
+      hash = "sha256-/XuqMqaynPhnu4r8BewAHh/KdAgngZJUFhG9XT9IL1s=";
    };
    aarch64-linux = {
-      url = "https://download.jetbrains.com/rustrover/RustRover-2026.2-aarch64.tar.gz";
-      hash = "sha256-WU+OeMZp9f8QkNbA2ZKYyYG5kt65KOvaA003SkskCow=";
+      url = "https://download.jetbrains.com/rustrover/RustRover-2026.2.1-aarch64.tar.gz";
+      hash = "sha256-M90sp/Coyb49V87gX9AVP7C087HkxrTo5ZN4I3RrpNw=";
    };
    aarch64-darwin = {
-      url = "https://download.jetbrains.com/rustrover/RustRover-2026.2-aarch64.dmg";
-      hash = "sha256-/cdvXf0qYXxgIi+uh9O6I0KIAOV7Z7QQ+lV5Y2xUNy0=";
+      url = "https://download.jetbrains.com/rustrover/RustRover-2026.2.1-aarch64.dmg";
+      hash = "sha256-vz7DY+BgjLYIBE5KUCJ7AuZtMTppEuHmcTJOOT+ElRM=";
    };
  };
  # update-script-end: urls
@@ -41,8 +41,8 @@ in
  product = "RustRover";

  # update-script-start: version
-  version = "2026.2";
-  buildNumber = "262.8665.323";
+  version = "2026.2.1";
+  buildNumber = "262.9437.161";
  # update-script-end: version

  src = fetchurl (urls.${system} or (throw "Unsupported system: ${system}"));
--- a/pkgs/by-name/am/amp-cli/package.nix
+++ b/pkgs/by-name/am/amp-cli/package.nix
@@ -26,7 +26,7 @@ let
 in
 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "amp-cli";
-  version = "0.0.1785975399-gb63fe6";
+  version = "0.0.1786738049-g32e30e";

  src = finalAttrs.passthru.sources.${stdenvNoCC.hostPlatform.system};

@@ -77,9 +77,9 @@ stdenvNoCC.mkDerivation (finalAttrs: {
        url = "https://static.ampcode.com/cli/${finalAttrs.version}/amp-${platform}.gz";
        hash =
          {
-            x86_64-linux = "sha256-bVkrQPLvRJdoxrA0laDKG9DnJvp3Q7hyCj9wxRPcJas=";
-            aarch64-linux = "sha256-z0m9FLX99Y3gBwOlWVBjCqume1Uz+OEMg7W5KRm+NLw=";
-            aarch64-darwin = "sha256-EoCJ3MT7zkSq5yfmdVy40J6LhjwHcFbtdmkkycmdF6E=";
+            x86_64-linux = "sha256-8unf4fAZpdkR4LCBFQzfM/SJGJ8QAYDWEktGd9wJFhs=";
+            aarch64-linux = "sha256-YKS3uI2r5PMEXS81fpU3YUTnfC4eGR3E1uX3G+mDW40=";
+            aarch64-darwin = "sha256-x5FqwElBE4aZsF4OJtj3TWNqwTLFEsJSHM/gCQQSk4g=";
          }
          .${system'};
      }
--- a/pkgs/by-name/an/anda/package.nix
+++ b/pkgs/by-name/an/anda/package.nix
@@ -11,16 +11,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "anda";
-  version = "0.8.3";
+  version = "0.8.5";

  src = fetchFromGitHub {
    owner = "FyraLabs";
    repo = "anda";
    tag = finalAttrs.version;
-    hash = "sha256-TSO2ABMD2uKY0sCsflhCv760t7vm1fTFJ3tgsyWH7FM=";
+    hash = "sha256-1dybRFB0p5YJJMBjfc27wkW5dxKVqDdpcwaa/F1XIc4=";
  };

-  cargoHash = "sha256-viDT1AI+jhZTr75tvUycMoSyQhidq3PA6eoU2jUvBkk=";
+  cargoHash = "sha256-Z9vM03HzhepTkGZ+HLTUxqXo2OKFlLPxJt7Sda4wr6w=";

  __structuredAttrs = true;

--- a/pkgs/by-name/ap/apt/package.nix
+++ b/pkgs/by-name/ap/apt/package.nix
@@ -35,14 +35,14 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "apt";
-  version = "3.3.2";
+  version = "3.3.3";

  src = fetchFromGitLab {
    domain = "salsa.debian.org";
    owner = "apt-team";
    repo = "apt";
    rev = finalAttrs.version;
-    hash = "sha256-hHdoKLCliZw40Ai/TciVHrkEaFFAa8YTy2NDdV9k6ws=";
+    hash = "sha256-pYDd6l9SZR6YXU4/V5cgC36ggvuoHqlKNkHyL++8dp8=";
  };

  # cycle detection; lib can't be split
--- a/pkgs/by-name/aw/aws-lc/package.nix
+++ b/pkgs/by-name/aw/aws-lc/package.nix
@@ -13,13 +13,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "aws-lc";
-  version = "5.0.0";
+  version = "5.5.0";

  src = fetchFromGitHub {
    owner = "aws";
    repo = "aws-lc";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-Dvy6mzEfKgimxCGp7q2fPk9urBMJMU6gZmaZXwdZfWw=";
+    hash = "sha256-VDgyzr6d0tcKEXT/Q96IKO0XDV1ATT/17rIvPgQdhO0=";
  };

  outputs = [
--- a/pkgs/by-name/by/byobu/package.nix
+++ b/pkgs/by-name/by/byobu/package.nix
@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "byobu";
-  version = "6.15";
+  version = "7.18";

  src = fetchFromGitHub {
    owner = "dustinkirkland";
    repo = "byobu";
    tag = finalAttrs.version;
-    hash = "sha256-QovoXH8cm8CZMSYGjI7FgynHtJjahpe9R2s62F7aZvo=";
+    hash = "sha256-ahlQUdPixi91Zs782zuHzpfgNvvWJ1FnfqInwKMdvQg=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ca/cargo-rdme/package.nix
+++ b/pkgs/by-name/ca/cargo-rdme/package.nix
@@ -6,14 +6,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-rdme";
-  version = "2.2.0";
+  version = "2.2.1";

  src = fetchCrate {
    inherit (finalAttrs) pname version;
-    hash = "sha256-f0MxJVWTcBNiURJFE60Xbv0/xcj51ZoZmJEzvIP79f4=";
+    hash = "sha256-uL6jZiQc/MZsn7H/cakZBMoH1phEQm6GR5v+WxnuaBw=";
  };

-  cargoHash = "sha256-U2tw/tzFSktrKAIUk4fxyRCMVuw98uHXDkZ/YpC2aCA=";
+  cargoHash = "sha256-Q4D4ZvEKptLsnmn9/usPg5ZLse7yrXyZPTBsLpbhZWE=";

  meta = {
    description = "Cargo command to create the README.md from your crate's documentation";
--- a/pkgs/by-name/ca/cargo-tarpaulin/package.nix
+++ b/pkgs/by-name/ca/cargo-tarpaulin/package.nix
@@ -12,16 +12,16 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "cargo-tarpaulin";
-  version = "0.37.0";
+  version = "0.37.2";

  src = fetchFromGitHub {
    owner = "xd009642";
    repo = "tarpaulin";
    tag = finalAttrs.version;
-    hash = "sha256-8LD4huR6xcksxkxF3Axoh5tx3FQgzE8nYVSpeSdY7us=";
+    hash = "sha256-oD8k/M5PChKzG1ek1uH8UP7PoaL9LYot3HCO4Hmetsw=";
  };

-  cargoHash = "sha256-FH0skHQ0eR9qgoCqDqO+NZZLzBw8U/ijNUupTYexIGI=";
+  cargoHash = "sha256-lZ4wRI1PEcHDxGe8R1mnp/Gk0IDzqXLvosfzkZOIhug=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/cd/cdncheck/package.nix
+++ b/pkgs/by-name/cd/cdncheck/package.nix
@@ -6,13 +6,13 @@

 buildGoModule (finalAttrs: {
  pname = "cdncheck";
-  version = "1.2.48";
+  version = "1.2.49";

  src = fetchFromGitHub {
    owner = "projectdiscovery";
    repo = "cdncheck";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-GTRKX1NlIt5oZZCariCLhU62hSp7vBu/KqNVyHAZk+U=";
+    hash = "sha256-WlgyNzWBvljwzsWVLMfDWEqkDY/miwmPjktRdAPuXVs=";
  };

  vendorHash = "sha256-iJ1agL7sZ3ZKbW1wMA+qi8FgHdPa6gZLQ5BBPKJTNaQ=";
--- a/pkgs/by-name/co/console-setup/package.nix
+++ b/pkgs/by-name/co/console-setup/package.nix
@@ -26,7 +26,7 @@ stdenvNoCC.mkDerivation (finalAttrs: {
    bdfresize
    otf2bdf
    perl
-    unifont
+    unifont.bin
  ];

  makeFlags = [ "prefix=${placeholder "out"}" ];
--- a/pkgs/by-name/co/conventional-changelog-cli/package.nix
+++ b/pkgs/by-name/co/conventional-changelog-cli/package.nix
@@ -15,20 +15,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "conventional-changelog-cli";
-  version = "7.2.1";
+  version = "8.1.3";

  src = fetchFromGitHub {
    owner = "conventional-changelog";
    repo = "conventional-changelog";
    tag = "conventional-changelog-v${finalAttrs.version}";
-    hash = "sha256-1unB4/naGc/V1Fjc7Arn4DjnGvyCdicNFOofdgpvRUI=";
+    hash = "sha256-GNXM81WISXHklMb/NkyW5s42CEUGhhMI64zVhyoGs9o=";
  };

  pnpmDeps = fetchPnpmDeps {
    inherit (finalAttrs) pname version src;
    inherit pnpm;
    fetcherVersion = 3;
-    hash = "sha256-khAAFQeWUkALdkEdjW3tvCi5KiF9lN202yhLcj8ey1o=";
+    hash = "sha256-slrfozj1aDT2hQvxD6Uk0h8V3kgB8kJ9SztZKjK1gc8=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/dd/ddccontrol-db/package.nix
+++ b/pkgs/by-name/dd/ddccontrol-db/package.nix
@@ -10,13 +10,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ddccontrol-db";
-  version = "20260731";
+  version = "20260813";

  src = fetchFromGitHub {
    owner = "ddccontrol";
    repo = "ddccontrol-db";
    tag = finalAttrs.version;
-    sha256 = "sha256-CDBLEZwoVg7Wy6xOrUVWmOUyMBlvqVWNBCBzdt6Ba0M=";
+    sha256 = "sha256-8FSPHOK5/2nSpb8qSOXY/SdtkWfpzNKMq9pm8wL7UCg=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/do/docstrfmt/package.nix
+++ b/pkgs/by-name/do/docstrfmt/package.nix
@@ -1,23 +1,23 @@
 {
  lib,
-  python3,
+  python3Packages,
  fetchFromGitHub,
 }:

-python3.pkgs.buildPythonApplication (finalAttrs: {
+python3Packages.buildPythonApplication (finalAttrs: {
  pname = "docstrfmt";
-  version = "2.0.2";
+  version = "2.2.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "LilSpazJoekp";
    repo = "docstrfmt";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-N2uPFOdDvAUL9eV4kn8MYM6OTMWJm24inlyY+k9Eqm8=";
+    hash = "sha256-DMeTrFHSJpUPBsE70dZ96WwQuY6C1POAGOJkSRfa2ho=";
  };

  build-system = [
-    python3.pkgs.flit-core
+    python3Packages.flit-core
  ];

  pythonRelaxDeps = [
@@ -25,7 +25,7 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    "types-docutils"
  ];

-  dependencies = with python3.pkgs; [
+  dependencies = with python3Packages; [
    black
    click
    coverage
@@ -40,11 +40,20 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    types-docutils
  ];

-  nativeCheckInputs = with python3.pkgs; [
+  nativeCheckInputs = with python3Packages; [
    pytestCheckHook
    pytest-aiohttp
  ];

+  disabledTests = [
+    # Failure due to different behavior of click, see:
+    # https://github.com/LilSpazJoekp/docstrfmt/issues/232
+    "test_invalid_line_length[tests/test_files/test_file.rst]"
+    "test_invalid_line_length[tests/test_files/py_file.py]"
+    "test_invalid_pyproject_toml"
+    "test_cache_single_file"
+  ];
+
  pythonImportsCheck = [
    "docstrfmt"
  ];
--- a/pkgs/by-name/ei/eigenwallet/package.nix
+++ b/pkgs/by-name/ei/eigenwallet/package.nix
@@ -13,11 +13,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "eigenwallet";
-  version = "4.10.0";
+  version = "4.13.3";

  src = fetchurl {
    url = "https://github.com/eigenwallet/core/releases/download/${finalAttrs.version}/eigenwallet_${finalAttrs.version}_amd64.deb";
-    hash = "sha256-hH4XdPQ5Q6mFbEcln/eA/ayxPjGbGSKYvTBa4qxD8Cc=";
+    hash = "sha256-nVrl3XY6fN8lA/RUL2P/NzMaOdPUIFxsEYbROk7keTA=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/ei/eilmeldung/package.nix
+++ b/pkgs/by-name/ei/eilmeldung/package.nix
@@ -0,0 +1,66 @@
+{
+  lib,
+  rustPlatform,
+  fetchFromGitHub,
+  pkg-config,
+  cmake,
+  perl,
+  openssl,
+  libxml2,
+  sqlite,
+  glib,
+  versionCheckHook,
+  nix-update-script,
+}:
+
+rustPlatform.buildRustPackage (finalAttrs: {
+  pname = "eilmeldung";
+  version = "1.7.2";
+
+  __structuredAttrs = true;
+
+  src = fetchFromGitHub {
+    owner = "christo-auer";
+    repo = "eilmeldung";
+    tag = finalAttrs.version;
+    hash = "sha256-QCGtuf1XSLpWr72GYUsz20JllWHNJ7Q4cAtNTywi4JM=";
+  };
+
+  cargoHash = "sha256-8ICcVeL/wFcrWbdmvu3HVHVsts9541ZkBtxDamLjcok=";
+
+  nativeBuildInputs = [
+    pkg-config
+    cmake
+    perl
+    rustPlatform.bindgenHook
+  ];
+
+  buildInputs = [
+    openssl
+    libxml2
+    sqlite
+  ];
+
+  BINDGEN_EXTRA_CLANG_ARGS = lib.concatStringsSep " " [
+    "-I${lib.getDev glib}/include/glib-2.0"
+    "-I${lib.getLib glib}/lib/glib-2.0/include/"
+  ];
+
+  passthru.updateScript = nix-update-script { };
+
+  doInstallCheck = true;
+
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  meta = {
+    description = "Feature-rich TUI RSS reader based on the news-flash library";
+    homepage = "https://github.com/christo-auer/eilmeldung";
+    changelog = "https://github.com/christo-auer/eilmeldung/releases/tag/${finalAttrs.src.tag}";
+    license = lib.licenses.gpl3Plus;
+    maintainers = with lib.maintainers; [
+      christo-auer
+      rachitvrma
+    ];
+    mainProgram = "eilmeldung";
+  };
+})
--- a/pkgs/by-name/ff/ffuf/package.nix
+++ b/pkgs/by-name/ff/ffuf/package.nix
@@ -2,47 +2,45 @@
  lib,
  buildGoModule,
  fetchFromGitHub,
-  fetchpatch,
+  versionCheckHook,
 }:

 buildGoModule (finalAttrs: {
  pname = "ffuf";
-  version = "2.1.0";
+  version = "2.2.1";

  src = fetchFromGitHub {
    owner = "ffuf";
    repo = "ffuf";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-+wcNqQHtB8yCLiJXMBxolCWsYZbBAsBGS1hs7j1lzUU=";
+    hash = "sha256-xN7FxxxIpkaGlfBgs0RwEPlzo/HLMfioC6MAMVP2su8=";
  };

  vendorHash = "sha256-SrC6Q7RKf+gwjJbxSZkWARw+kRtkwVv1UJshc/TkNdc=";

-  patches = [
-    # Fix CSV test, https://github.com/ffuf/ffuf/pull/731
-    (fetchpatch {
-      name = "fix-csv-test.patch";
-      url = "https://github.com/ffuf/ffuf/commit/7f2aae005ad73988a1fa13c1c33dab71f4ae5bbd.patch";
-      hash = "sha256-/v9shGICmsbFfEJe4qBkBHB9PVbBlrjY3uFmODxHu9M=";
-    })
+  ldflags = [
+    "-s"
+    "-X github.com/ffuf/ffuf/v${(lib.versions.major finalAttrs.version)}/pkg/ffuf.VERSION=${finalAttrs.version}"
+    "-X github.com/ffuf/ffuf/v${(lib.versions.major finalAttrs.version)}/pkg/ffuf.VERSION_APPENDIX="
  ];

-  ldflags = [
-    "-w"
-    "-s"
-  ];
+  nativeInstallCheckInputs = [ versionCheckHook ];
+
+  doInstallCheck = true;
+
+  versionCheckProgramArg = "-V";

  meta = {
    description = "Tool for web fuzzing";
-    mainProgram = "ffuf";
    longDescription = ''
-      FFUF, or “Fuzz Faster you Fool” is an open source web fuzzing tool,
+      FFUF, or "Fuzz Faster you Fool" is an open source web fuzzing tool,
      intended for discovering elements and content within web applications
      or web servers.
    '';
    homepage = "https://github.com/ffuf/ffuf";
-    changelog = "https://github.com/ffuf/ffuf/releases/tag/v${finalAttrs.version}";
+    changelog = "https://github.com/ffuf/ffuf/releases/tag/v${finalAttrs.src.tag}";
    license = lib.licenses.mit;
    maintainers = with lib.maintainers; [ fab ];
+    mainProgram = "ffuf";
  };
 })
--- a/pkgs/by-name/fz/fzf/package.nix
+++ b/pkgs/by-name/fz/fzf/package.nix
@@ -11,7 +11,7 @@

 buildGoModule (finalAttrs: {
  pname = "fzf";
-  version = "0.74.2";
+  version = "0.74.3";

  __structuredAttrs = true;

@@ -19,7 +19,7 @@ buildGoModule (finalAttrs: {
    owner = "junegunn";
    repo = "fzf";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-b/dQOebD8pbg+oX2Q9n4hNqdKgW/xLp4HhoGKp6BaTM=";
+    hash = "sha256-DIz3Nudiov2uwxAtq6++rt2zwz0adOlv9W+c0SW3EHc=";
  };

  vendorHash = "sha256-NojjUf/3c4q4B96eQ/qcI+GdRvHakHUyMRaQ6/IZpEw=";
--- a/pkgs/by-name/ga/gauge-unwrapped/package.nix
+++ b/pkgs/by-name/ga/gauge-unwrapped/package.nix
@@ -6,7 +6,7 @@

 buildGoModule (finalAttrs: {
  pname = "gauge";
-  version = "1.6.32";
+  version = "1.6.35";

  patches = [
    # adds a check which adds an error message when trying to
@@ -18,10 +18,10 @@ buildGoModule (finalAttrs: {
    owner = "getgauge";
    repo = "gauge";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-j8nT39mwRvccZQyrhviQxPbM3Cd7F2x4X24OYFq3LYQ=";
+    hash = "sha256-6WsyW4xlKCZO4xvvVr+O+WbmkQHp0RmXGD+HBcilMgo=";
  };

-  vendorHash = "sha256-OmGKpgsouK5W/DWFi8vNT/0HSX5HqaAzNdN8eEAhNhk=";
+  vendorHash = "sha256-nQM3Ss4xQCkkOrJ1S2s0tdDr5O9SrmPnvT3Y4Ekz600=";

  excludedPackages = [
    "build"
--- a/pkgs/by-name/ge/genemichaels/package.nix
+++ b/pkgs/by-name/ge/genemichaels/package.nix
@@ -7,14 +7,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "genemichaels";
-  version = "0.9.6";
+  version = "0.12.2";

  src = fetchCrate {
    inherit (finalAttrs) pname version;
-    hash = "sha256-H/IqREaLvfKQZGOioIJ7t3GdNzTTiE3fYlMOaxXASr4=";
+    hash = "sha256-KZ0XHPeOGM1Go/144fAbfaXgj1h7Kuu/H8H3a/bf1+w=";
  };

-  cargoHash = "sha256-16axK0kQnkr99x13OvAqhCQz7hT1rRMZIRW4MgNOo40=";
+  cargoHash = "sha256-hLEFEqt4M+7H6y0oINiAhDv9Y/ifknnP8FNz7ROJA3w=";

  passthru.updateScript = nix-update-script { };

--- a/pkgs/by-name/gi/gildas/package.nix
+++ b/pkgs/by-name/gi/gildas/package.nix
@@ -26,8 +26,8 @@ let
 in

 stdenv.mkDerivation rec {
-  srcVersion = "jun26a";
-  version = "20260601_a";
+  srcVersion = "aug26a";
+  version = "20260801_a";
  pname = "gildas";

  src = fetchurl {
@@ -37,7 +37,7 @@ stdenv.mkDerivation rec {
      "http://www.iram.fr/~gildas/dist/gildas-src-${srcVersion}.tar.xz"
      "http://www.iram.fr/~gildas/dist/archive/gildas/gildas-src-${srcVersion}.tar.xz"
    ];
-    hash = "sha256-Fi6yVuTXxffkZ0lyxIZXOlDDqSbnrnP5nJI5cS3Mrt4=";
+    hash = "sha256-NqIgUyjzYoq2fsalaPEHCyxE4cbwXj+azmVxEBOPi6s=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/gi/gitaly/git-data.json
+++ b/pkgs/by-name/gi/gitaly/git-data.json
@@ -1,5 +1,5 @@
 {
-  "version": "2.53-e417bf29",
-  "rev": "e417bf2996fbd77acabbf354ed9b5adedacf91c9",
-  "hash": "sha256-enYjs2KODFwjU0hAylZeOmoV+DMEUH8pZH4JZ+P+eNI="
+  "version": "2.55.0-rc1-02bb39c5",
+  "rev": "02bb39c5cbca65a4817854477cc3e1c31ea28c49",
+  "hash": "sha256-qzGpl40fzX4VXkZfqHlb8eubx0iMqbV3tNxwB6gczRY="
 }
--- a/pkgs/by-name/gi/gitaly/package.nix
+++ b/pkgs/by-name/gi/gitaly/package.nix
@@ -7,7 +7,7 @@
 }:

 let
-  version = "19.0.4";
+  version = "19.2.2";
  package_version = "v${lib.versions.major version}";
  gitaly_package = "gitlab.com/gitlab-org/gitaly/${package_version}";

@@ -21,10 +21,10 @@ let
      owner = "gitlab-org";
      repo = "gitaly";
      rev = "v${version}";
-      hash = "sha256-IkOS2XYo+QkLkhodeqmzz5bR2FxMG68hUsT357h7cKo=";
+      hash = "sha256-S48IuJmL7Huo07ECTI953aFtjXdRJktrCWRoPHF0qjE=";
    };

-    vendorHash = "sha256-oc+H5DV2B++buxH2LI0BoaWjDUVJGRcbuofnIX69ddI=";
+    vendorHash = "sha256-4yB63q5a9GaCaasI40uObx6ZV/5FMIvkbkHt8fqD1gA=";

    ldflags = [
      "-X ${gitaly_package}/internal/version.version=${version}"
--- a/pkgs/by-name/gi/gitlab-pages/package.nix
+++ b/pkgs/by-name/gi/gitlab-pages/package.nix
@@ -6,17 +6,17 @@

 buildGoModule (finalAttrs: {
  pname = "gitlab-pages";
-  version = "19.0.4";
+  version = "19.2.2";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-pages";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-hadZk9ghc1bNJTSsonyiKsJcMiHxkvQb/lifcE3EVyw=";
+    hash = "sha256-lKLwhpHQcSfjLBumK6YcZ4TTj0sEZyJ7pmYeh1lLurY=";
  };

-  vendorHash = "sha256-PUW4cgAiM1GTtvja894OZ4pe0SWChf5JsL4/fkns2kI=";
+  vendorHash = "sha256-aTnRSas8PgxPLLcBExNb5GHYXV0eLc1gD4Ky+50/kfw=";
  subPackages = [ "." ];

  ldflags = [
--- a/pkgs/by-name/gi/gitlab-shell/package.nix
+++ b/pkgs/by-name/gi/gitlab-shell/package.nix
@@ -8,14 +8,14 @@

 buildGoModule (finalAttrs: {
  pname = "gitlab-shell";
-  version = "14.51.0";
+  version = "14.56.1";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
    owner = "gitlab-org";
    repo = "gitlab-shell";
    rev = "v${finalAttrs.version}";
-    hash = "sha256-x/dondbgw8bJGovZ7arKrxRqdEmNW8AYYgaL6UfjsZo=";
+    hash = "sha256-u32n22bjUaQT7ipc6mtzl/ZPxEB+BdUcixqpKUtWBt0=";
  };

  buildInputs = [
@@ -27,7 +27,7 @@ buildGoModule (finalAttrs: {
    ./remove-hardcoded-locations.patch
  ];

-  vendorHash = "sha256-ceSnQQTtGdLb0QGR9fDbGC0NtRPGqkyXJ6b0TRXkjQM=";
+  vendorHash = "sha256-PTWQBe1j/rjrYcyBTDa5l/l/0JPjYBi1uzSxIT0Al30=";

  subPackages = [
    "cmd/gitlab-shell"
--- a/pkgs/by-name/gi/gitlab/data.json
+++ b/pkgs/by-name/gi/gitlab/data.json
@@ -1,17 +1,17 @@
 {
-  "version": "19.0.4",
-  "repo_hash": "sha256-qDHaYzy+GfaGPsshIUq9AO5VSZzTErruy9YCUlgLBYs=",
-  "yarn_hash": "sha256-maKKpsAgbpVEB9DBkpe/ipGvK+5l1/gSRsNccK61iy8=",
+  "version": "19.2.2",
+  "repo_hash": "sha256-3JyP5xRjYegkjD3y8dVjMQ7zwLi+46GNKVcMb5bZGG4=",
+  "yarn_hash": "sha256-UJS0ZX8d6iIRNa/LQLQTSNZDtjKNm9e35RKqvsXxv3c=",
  "frontend_islands_yarn_hash": "sha256-EvGQin+5DqqIgM36jlVkVI49WcJzVvceYnkSS9ybfcY=",
  "owner": "gitlab-org",
  "repo": "gitlab",
-  "rev": "v19.0.4-ee",
+  "rev": "v19.2.2-ee",
  "passthru": {
-    "GITALY_SERVER_VERSION": "19.0.4",
-    "GITLAB_KAS_VERSION": "19.0.4",
-    "GITLAB_PAGES_VERSION": "19.0.4",
-    "GITLAB_SHELL_VERSION": "14.51.0",
+    "GITALY_SERVER_VERSION": "19.2.2",
+    "GITLAB_KAS_VERSION": "19.2.2",
+    "GITLAB_PAGES_VERSION": "19.2.2",
+    "GITLAB_SHELL_VERSION": "14.56.1",
    "GITLAB_ELASTICSEARCH_INDEXER_VERSION": "5.14.7",
-    "GITLAB_WORKHORSE_VERSION": "19.0.4"
+    "GITLAB_WORKHORSE_VERSION": "19.2.2"
  }
 }
--- a/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
+++ b/pkgs/by-name/gi/gitlab/gitlab-workhorse/default.nix
@@ -10,7 +10,7 @@ in
 buildGoModule (finalAttrs: {
  pname = "gitlab-workhorse";

-  version = "19.0.4";
+  version = "19.2.2";

  # nixpkgs-update: no auto update
  src = fetchFromGitLab {
@@ -22,7 +22,7 @@ buildGoModule (finalAttrs: {

  sourceRoot = "${finalAttrs.src.name}/workhorse";

-  vendorHash = "sha256-4uSwO74tfoT7QV3fUa2F1i9v6JLOuzTLPcBVpEvloXA=";
+  vendorHash = "sha256-mW58Kpn70N9zoMDzklsnouFf7NNKg8eW5MgRAXymfho=";
  buildInputs = [ git ];
  ldflags = [ "-X main.Version=${finalAttrs.version}" ];
  doCheck = false;
--- a/pkgs/by-name/gi/gitlab/package.nix
+++ b/pkgs/by-name/gi/gitlab/package.nix
@@ -66,6 +66,47 @@ let
        buildInputs = [ file ];
        buildFlags = [ "--enable-system-libraries" ];
      };
+
+      gitlab-glaz = attrs: {
+        cargoDeps = rustPlatform.fetchCargoVendor {
+          src = stdenv.mkDerivation {
+            inherit (buildRubyGem { inherit (attrs) gemName version source; })
+              name
+              src
+              unpackPhase
+              nativeBuildInputs
+              ;
+            dontBuilt = true;
+            installPhase = ''
+              cp -R ext/glaz $out
+              cp Cargo.lock $out
+            '';
+          };
+          hash = "sha256-5fGoW6TpkIQ8OIXjt2fLGzG9xhZ2TT+v2zLH1ecItII=";
+        };
+
+        dontBuild = false;
+
+        nativeBuildInputs = [
+          cargo
+          rustc
+          rustPlatform.cargoSetupHook
+          rustPlatform.bindgenHook
+        ];
+
+        disallowedReferences = [
+          rustc.unwrapped
+        ];
+
+        preInstall = ''
+          export CARGO_HOME="$PWD/../.cargo/"
+        '';
+
+        postInstall = ''
+          find $out -type f -name .rustc_info.json -delete
+        '';
+      };
+
      gitlab-glfm-markdown = attrs: {
        cargoDeps = rustPlatform.fetchCargoVendor {
          src = stdenv.mkDerivation {
@@ -135,7 +176,7 @@ let
            cp Cargo.lock $out
          '';

-          hash = "sha256-BRbBijOg2nQK2Nzrkpk7mwCjr+AaF3D/3HUrS5GwIz4=";
+          hash = "sha256-v0XIAyBqwFpO4n6EUgXaE7/yuyYAva8arv4unVPqqN4=";
        };

        postPatch = ''
@@ -196,7 +237,7 @@ let
              cp Cargo.lock $out
            '';
          };
-          hash = "sha256-7jqaf5RIsc9gq98WBCe3Dd3Fv2X+4echdXU1FSK/xnE=";
+          hash = "sha256-lhD8vlqK9a38ZLBD6YagWnJ/DQ8YqbC1NxEyzYnoLh8=";
        };

        nativeBuildInputs = [
@@ -334,6 +375,9 @@ let
      yarn run postinstall
      popd

+      # Apply node_modules patches
+      node scripts/frontend/postinstall.js
+
      # Creates a `infection_scanner.json` needed for the assets compiler to succeed.
      node scripts/frontend/infection_scanner/infection_scanner.mjs

--- a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile
@@ -20,7 +20,11 @@ gem 'bundler-checksum', '~> 0.1.0', path: 'gems/bundler-checksum', require: fals
 gem 'auto_freeze', path: 'gems/auto_freeze', feature_category: :rails_platform

 # See https://docs.gitlab.com/ee/development/gemfile.html#upgrade-rails for guidelines when upgrading Rails
-gem 'rails', '~> 7.2.3', feature_category: :rails_platform
+if next?
+  gem 'rails', '~> 8.0.0', feature_category: :rails_platform
+else
+  gem 'rails', '~> 7.2.3', feature_category: :rails_platform
+end

 # Pin Zeitwerk until https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/9408 is fixed
 gem 'zeitwerk', '= 2.6.18', feature_category: :rails_platform
@@ -43,10 +47,14 @@ gem 'ffi', '~> 1.17.3', feature_category: :shared # rubocop:todo Gemfile/Missing
 gem 'openssl', '~> 3.3.2', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839

 gem 'gitlab-safe_request_store', path: 'gems/gitlab-safe_request_store', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
+gem 'safe_zip', path: 'gems/safe_zip', feature_category: :job_artifacts

 # GitLab Monorepo Gems
 group :monorepo do
  gem 'gitlab-utils', path: 'gems/gitlab-utils', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
+  gem 'gitlab-configs', path: 'gems/gitlab-configs', feature_category: :settings
+  gem 'gitlab-email_handler', path: 'gems/gitlab-email_handler', require: false,
+    feature_category: :service_desk
 end

 gem 'gitlab-backup-cli', path: 'gems/gitlab-backup-cli', require: 'gitlab/backup/cli', feature_category: :backup_restore
@@ -65,7 +73,7 @@ gem 'view_component', '~> 3.23.2', feature_category: :shared # rubocop:todo Gemf
 gem 'pg', '~> 1.6.1', feature_category: :database

 gem 'faraday', '~> 2', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
-gem 'faraday-retry', '~> 2', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
+gem 'faraday-retry', '~> 2.4', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 # Logger is a dependency of Faraday, but Logger 1.6.0 does not work with Chef.
 gem 'logger', '~> 1.7.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839

@@ -73,9 +81,10 @@ gem 'marginalia', '~> 1.11.1', feature_category: :database

 # Authorization
 gem 'declarative_policy', '~> 2.1.0', feature_category: :permissions
+gem 'gitlab-glaz', '~> 0.0.3', feature_category: :permissions

 # For source code paths mapping
-gem 'coverband', '6.2.0', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
+gem 'coverband', '6.2.1', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839

 # Authentication libraries
 gem 'devise', '~> 4.9.3', feature_category: :system_access
@@ -90,7 +99,11 @@ gem 'ruby-saml', '~> 1.18', feature_category: :system_access
 gem 'omniauth-saml', '~> 2.2.1', feature_category: :system_access
 gem 'omniauth', '~> 2.1.0', feature_category: :system_access
 gem 'omniauth-auth0', '~> 3.1', feature_category: :system_access
-gem 'omniauth-azure-activedirectory-v2', '~> 2.0', feature_category: :system_access
+# Require the strategy directly to skip the gem's top-level entry file, which emits a
+# load-time deprecation warning about the upcoming rename to omniauth-entra-id.
+# See https://gitlab.com/gitlab-org/gitlab/-/work_items/604391.
+gem 'omniauth-azure-activedirectory-v2', '~> 2.0',
+  require: 'omniauth/strategies/azure_activedirectory_v2', feature_category: :system_access
 gem 'omniauth-alicloud', '~> 3.0.0', feature_category: :system_access
 gem 'omniauth-github', '2.0.1', feature_category: :system_access
 # See vendor/gems/omniauth-gitlab/README.md
@@ -148,19 +161,30 @@ gem 'gitlab_omniauth-ldap', '~> 2.3.0', require: 'omniauth-ldap', feature_catego
 gem 'net-ldap', '~> 0.20.0', feature_category: :system_access

 # API
-gem 'grape', '~> 2.0.0', feature_category: :api
-gem 'grape-entity', '~> 1.0.1', feature_category: :api
+if next?
+  gem 'grape', '~> 2.4', feature_category: :api
+else
+  gem 'grape', '~> 2.0.0', feature_category: :api
+end
+
+gem 'grape-entity', '~> 1.1.0', feature_category: :api
 gem 'grape-swagger', '~> 2.1.2', group: [:development, :test], feature_category: :api
 gem 'grape-swagger-entity', '~> 0.7.0', group: [:development, :test], feature_category: :api
 gem 'grape-path-helpers', '~> 2.0.1', feature_category: :api
-gem 'gitlab-grape-openapi', path: 'gems/gitlab-grape-openapi', feature_category: :api
+gem 'gitlab-grape-openapi', '~> 0.2', feature_category: :api
 gem 'rack-cors', '~> 2.0.1', require: 'rack/cors', feature_category: :api

 # GraphQL API
-gem 'graphql', '2.5.23', feature_category: :api
+gem 'graphql', '2.6.3', feature_category: :api
 gem 'graphql-docs', '~> 5.2.0', group: [:development, :test], feature_category: :api
 gem 'apollo_upload_server', '~> 2.1.6', feature_category: :api

+# IAM service gRPC client stubs
+gem 'gitlab-iam-grpc',
+  path: 'vendor/gems/gitlab-iam-grpc',
+  require: 'gitlab-iam-grpc',
+  feature_category: :system_access
+
 # Cells
 gem 'gitlab-topology-service-client', '~> 0.1',
  path: 'vendor/gems/gitlab-topology-service-client',
@@ -168,7 +192,7 @@ gem 'gitlab-topology-service-client', '~> 0.1',
  feature_category: :cell

 # Duo Workflow
-gem 'gitlab-duo-workflow-service-client', '~> 0.8',
+gem 'gitlab-duo-workflow-service-client', '~> 0.10',
  path: 'vendor/gems/gitlab-duo-workflow-service-client',
  feature_category: :duo_agent_platform

@@ -235,9 +259,9 @@ gem 'seed-fu', '~> 2.3.7', feature_category: :shared # rubocop:todo Gemfile/Miss
 gem 'elasticsearch-model', '~> 7.2', feature_category: :global_search
 gem 'elasticsearch-rails', '~> 7.2', require: 'elasticsearch/rails/instrumentation', feature_category: :global_search
 gem 'elasticsearch-api', '7.17.11', feature_category: :global_search
-gem 'aws-sdk-core', '~> 3.242.0', feature_category: :global_search
+gem 'aws-sdk-core', '~> 3.252.0', feature_category: :global_search
 gem 'aws-sdk-cloudformation', '~> 1', feature_category: :global_search
-gem 'aws-sdk-s3', '~> 1.213.0', feature_category: :global_search
+gem 'aws-sdk-s3', '~> 1.226.0', feature_category: :global_search
 gem 'faraday-typhoeus', '~> 1.1', feature_category: :global_search
 gem 'faraday_middleware-aws-sigv4', '~> 1.0.1', feature_category: :global_search
 # Used with Elasticsearch to support http keep-alive connections
@@ -248,7 +272,7 @@ gem 'gitlab-active-context', path: 'gems/gitlab-active-context', require: 'activ

 # Markdown and HTML processing
 gem 'html-pipeline', '~> 2.14.3', feature_category: :markdown
-gem 'gitlab-markup', '~> 2.0.0', require: 'github/markup', feature_category: :markdown
+gem 'gitlab-markup', '~> 2.1.0', require: 'github/markup', feature_category: :markdown
 gem 'commonmarker', '~> 0.23.10', feature_category: :markdown
 gem 'kramdown', '~> 2.5.0', feature_category: :markdown
 gem 'RedCloth', '~> 4.3.3', feature_category: :markdown
@@ -311,7 +335,7 @@ gem 're2', '~> 2.15', feature_category: :shared # rubocop:todo Gemfile/MissingFe

 # Misc

-gem 'semver_dialects', '~> 3.7', feature_category: :software_composition_analysis
+gem 'semver_dialects', '~> 4.1', feature_category: :software_composition_analysis
 gem 'version_sorter', '~> 2.3', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 gem 'csv_builder', path: 'gems/csv_builder', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839

@@ -332,7 +356,7 @@ gem 'connection_pool', '~> 2.5.3', feature_category: :shared # rubocop:todo Gemf
 gem 'redis-actionpack', '~> 5.5.0', feature_category: :redis

 # Jira integration
-gem 'jira-ruby', '~> 2.3.0', feature_category: :integrations
+gem 'jira-ruby', '~> 3.2.0', feature_category: :integrations
 gem 'atlassian-jwt', '~> 0.2.1', feature_category: :integrations

 # Slack integration
@@ -372,7 +396,7 @@ gem 'rack-proxy', '~> 0.7.7', feature_category: :shared # rubocop:todo Gemfile/M
 gem 'cssbundling-rails', '1.4.3', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 gem 'terser', '1.0.2', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839

-gem 'click_house-client', '0.8.8', feature_category: :database
+gem 'click_house-client', '0.11.0', feature_category: :database
 gem 'addressable', '~> 2.8', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 gem 'gon', '~> 6.5.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 gem 'request_store', '~> 1.7.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
@@ -393,13 +417,21 @@ gem 'pg_query', '~> 6.2.0', feature_category: :database

 gem 'gitlab-schema-validation', path: 'gems/gitlab-schema-validation', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 gem 'gitlab-http', path: 'gems/gitlab-http', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
+gem 'gitlab-bitbucket', path: 'gems/gitlab-bitbucket', require: 'bitbucket', feature_category: :importers
+gem 'gitlab-bitbucket-server', path: 'gems/gitlab-bitbucket-server',
+  require: 'bitbucket_server', feature_category: :importers

 gem 'premailer-rails', '~> 1.12.0', feature_category: :notifications
-gem 'gitlab-labkit', '~> 2.0.0', feature_category: :error_budgets
+gem 'gitlab-labkit', '~> 2.7.0', feature_category: :error_budgets
 gem 'thrift', '~> 0.22.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839

 # I18n
-gem 'rails-i18n', '~> 7.0', '>= 7.0.9', feature_category: :internationalization
+if next?
+  gem 'rails-i18n', '~> 8.0', feature_category: :internationalization
+else
+  gem 'rails-i18n', '~> 7.0', '>= 7.0.9', feature_category: :internationalization
+end
+
 gem 'gettext_i18n_rails', '~> 1.13.0', feature_category: :internationalization
 gem 'gettext', '~> 3.5', '>= 3.5.1',
  require: false,
@@ -418,7 +450,7 @@ gem 'snowplow-tracker', '~> 0.8.0', feature_category: :product_analytics

 # Metrics
 gem 'webrick', '~> 1.9.0', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
-gem 'prometheus-client-mmap', '~> 1.5.0', require: 'prometheus/client', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
+gem 'prometheus-client-mmap', '~> 1.6.0', require: 'prometheus/client', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839

 # Event-driven reactor for Ruby
 # Required manually in config/initializers/require_async_gem
@@ -453,7 +485,9 @@ group :opentelemetry do
  gem 'opentelemetry-instrumentation-ethon', feature_category: :observability
  gem 'opentelemetry-instrumentation-excon', feature_category: :observability
  gem 'opentelemetry-instrumentation-faraday', feature_category: :observability
-  gem 'opentelemetry-instrumentation-grape', feature_category: :observability
+  # Floor 0.5.1 fixes Grape 3.1 instrumentation (PR #1969); cap <0.6 avoids
+  # 0.6.0's stable HTTP semantic-convention default that can break dashboards/alerts.
+  gem 'opentelemetry-instrumentation-grape', '~> 0.5.1', feature_category: :observability
  gem 'opentelemetry-instrumentation-graphql', feature_category: :observability
  gem 'opentelemetry-instrumentation-http_client', feature_category: :observability
  gem 'opentelemetry-instrumentation-net_http', feature_category: :observability
@@ -488,7 +522,9 @@ group :development do

  gem 'ruby-lsp-rspec', "~> 0.1.28", require: false, feature_category: :tooling

-  gem 'gdk-toogle', '~> 0.9', '>= 0.9.5', require: 'toogle', feature_category: :tooling
+  gem 'gdk-toogle', '~> 1.0', require: 'toogle', feature_category: :tooling
+
+  gem 'grpc-tools', '~> 1.81.0', feature_category: :system_access

  # Used by
  # * `lib/tasks/gitlab/security/update_banned_ssh_keys.rake`
@@ -502,7 +538,7 @@ group :development, :test do
  gem 'parser', '= 3.3.11.1', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
  gem 'pry-byebug', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
  gem 'pry-rails', '~> 0.3.9', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
-  gem 'pry-shell', '~> 0.6.4', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
+  gem 'pry-shell', '~> 0.7.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839

  gem 'amazing_print', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839

@@ -516,8 +552,8 @@ group :development, :test do
  gem 'spring', '~> 4.3.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
  gem 'spring-commands-rspec', '~> 1.0.4', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839

-  gem 'gitlab-styles', '~> 14.0', feature_category: :tooling, require: false
-  gem 'haml_lint', '~> 0.58', feature_category: :tooling, require: false
+  gem 'gitlab-styles', '~> 14.1', feature_category: :tooling, require: false
+  gem 'haml_lint', '~> 0.75', feature_category: :tooling, require: false

  # Benchmarking & profiling
  gem 'benchmark-ips', '~> 2.14.0', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
@@ -542,7 +578,7 @@ group :development, :test do
  gem 'yard', '~> 0.9', require: false, feature_category: :tooling

  # Gems required for Dangerfile
-  gem 'gitlab-dangerfiles', '~> 4.11.1', require: false, feature_category: :tooling
+  gem 'gitlab-dangerfiles', '~> 4.12.0', require: false, feature_category: :tooling

  # Gems required for code coverage
  gem 'simplecov', '~> 0.22', require: false, feature_category: :tooling
@@ -575,20 +611,23 @@ group :test do
  gem 'test-prof', '~> 1.6.0', feature_category: :tooling
  gem 'rspec_junit_formatter', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
  gem 'guard-rspec', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
-  gem 'axe-core-rspec', '~> 4.10.0', feature_category: :tooling
+  gem 'axe-core-rspec', '~> 4.12.0', feature_category: :tooling
  gem 'state_machines-rspec', '~> 0.6', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839

  # Moved in `test` because https://gitlab.com/gitlab-org/gitlab/-/issues/217527
  gem 'derailed_benchmarks', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839

-  gem 'gitlab_quality-test_tooling', '~> 3.14.0', require: false, feature_category: :tooling
+  gem 'gitlab_quality-test_tooling', '~> 3.20.1', require: false, feature_category: :tooling
+
+  # Test execution result export
+  gem 'gitlab-rspec-metrics-exporter', '~> 0.2.0', require: false, feature_category: :tooling
 end

 gem 'octokit', '~> 9.0', feature_category: :importers
 # Needed by octokit: https://github.com/octokit/octokit.rb/pull/1688
 gem 'faraday-multipart', '~> 1.0', feature_category: :importers

-gem 'gitlab-mail_room', '~> 1.0.0', require: 'mail_room', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
+gem 'gitlab-mail_room', '~> 1.1.0', require: 'mail_room', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839

 gem 'email_reply_trimmer', '~> 0.1', feature_category: :team_planning
 gem 'html2text', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
@@ -617,15 +656,15 @@ gem 'ssh_data', '~> 2.0', feature_category: :shared # rubocop:todo Gemfile/Missi
 gem 'spamcheck', '~> 1.3.0', feature_category: :insider_threat

 # Gitaly GRPC protocol definitions
-gem 'gitaly', '~> 18.11.0', feature_category: :gitaly
+gem 'gitaly', '~> 19.0', feature_category: :gitaly

 # KAS GRPC protocol definitions
-gem 'gitlab-kas-grpc', '~> 18.5.0-rc4', feature_category: :deployment_management
+gem 'gitlab-kas-grpc', '~> 19.2.0-rc1', feature_category: :deployment_management

 # Knowledge Graph GRPC protocol definitions
-gem 'gitlab-gkg-proto', '~> 0.37.0', feature_category: :knowledge_graph
+gem 'gitlab-gkg-proto', '~> 0.87.0', feature_category: :knowledge_graph

-gem 'grpc', '~> 1.80.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
+gem 'grpc', '~> 1.81.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839

 gem 'google-protobuf', '>= 3.25', '< 5.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839

@@ -636,11 +675,16 @@ gem 'flipper', '~> 1.3.6', feature_category: :shared # rubocop:todo Gemfile/Miss
 gem 'flipper-active_record', '~> 1.3.6', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 gem 'flipper-active_support_cache_store', '~> 1.3.6', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 gem 'unleash', '~> 3.2.2', feature_category: :feature_flags # https://docs.gitlab.com/operations/feature_flags/
-gem 'gitlab-experiment', '~> 1.3.0', feature_category: :acquisition
+gem 'gitlab-experiment', '~> 1.6.0', feature_category: :acquisition

 # Structured logging
 gem 'lograge', '~> 0.5', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
-gem 'grape_logging', '~> 1.8', '>= 1.8.4', feature_category: :api
+
+if next?
+  gem 'grape_logging', '~> 3.0', feature_category: :api
+else
+  gem 'grape_logging', '~> 1.8', '>= 1.8.4', feature_category: :api
+end

 # DNS Lookup
 gem 'gitlab-net-dns', '~> 0.15.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
@@ -660,13 +704,15 @@ gem 'lru_redux', feature_category: :importers
 # `config/initializers/mail_starttls_patch.rb` has also been patched to
 # fix STARTTLS handling until https://github.com/mikel/mail/pull/1536 is
 # released.
-gem 'mail', '= 2.9.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
-gem 'mail-smtp_pool', '~> 0.1.0', path: 'gems/mail-smtp_pool', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
+gem 'mail', '= 2.9.0', feature_category: :notifications
+gem 'mail-smtp_pool', '~> 0.1.0', path: 'gems/mail-smtp_pool', require: false, feature_category: :notifications

-gem 'microsoft_graph_mailer', '~> 0.1.0', path: 'vendor/gems/microsoft_graph_mailer', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
+gem 'microsoft_graph_mailer', '~> 0.1.0', path: 'vendor/gems/microsoft_graph_mailer',
+  require: false, feature_category: :notifications
+gem 'aws-actionmailer-ses', '~> 1', require: false, feature_category: :notifications

 # File encryption
-gem 'lockbox', '~> 1.4.0', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
+gem 'lockbox', '~> 1.4.0', feature_category: :continuous_integration

 # Email validation
 gem 'valid_email', '~> 0.1', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
@@ -695,12 +741,13 @@ gem 'error_tracking_open_api', path: 'gems/error_tracking_open_api', feature_cat

 # Vulnerability advisories
 gem 'cvss-suite', '~> 4.1.1', require: 'cvss_suite', feature_category: :software_composition_analysis
+gem 'zstd-ruby', '~> 2.0', require: 'zstd-ruby', feature_category: :software_composition_analysis

 # Work with RPM packages
 gem 'arr-pm', '~> 0.0.12', feature_category: :package_registry

 # Remote Development
-gem 'devfile', '~> 0.5.1', feature_category: :workspaces
+gem 'devfile', '~> 0.5.3', feature_category: :workspaces
 gem 'hashdiff', '~> 1.2.0', feature_category: :workspaces

 # Apple plist parsing
@@ -718,6 +765,11 @@ gem "base64", "~> 0.2.0", feature_category: :shared # rubocop:todo Gemfile/Missi
 gem 'net-protocol', '~> 0.2.2', feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
 gem "nkf", "~> 0.2.0", feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839

+# NOTE: In Ruby 3.4 resolv-replace was moved out of the stdlib into a bundled gem.
+# It is required explicitly by the gitlab:artifacts:* rake tasks (lib/tasks/gitlab/artifacts/),
+# so `require: false` keeps it from globally replacing the DNS resolver at boot.
+gem "resolv-replace", "~> 0.2.0", require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
+
 # This is locked to 0.6.0 because we patch Net::HTTP#connect in
 # gems/gitlab-http/lib/net_http/connect_patch.rb.
 # It can be upgraded but care must be taken to preserve the patch.
@@ -733,17 +785,14 @@ gem 'paper_trail', '~> 16.0', feature_category: :workspaces

 gem "i18n_data", "~> 0.13.1", feature_category: :system_access

-gem "gitlab-cloud-connector", "~> 1.45", require: 'gitlab/cloud_connector', feature_category: :plan_provisioning
+gem "gitlab-cloud-connector", "~> 1.52", require: 'gitlab/cloud_connector', feature_category: :plan_provisioning

 gem "gvltools", "~> 0.4.0", feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839

-gem 'gitlab_query_language', '~> 0.27.1', feature_category: :integrations
+gem 'gitlab_query_language', '~> 0.29.0', feature_category: :integrations

 # standard Gem, version increase to resolve vulnerabilities
 gem "zlib", "~> 3.2", ">= 3.2.3", feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/work_items/596593

 # Gems required in omnibus-gitlab pipeline
-gem 'license_finder', '~> 7.0', require: false, feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/issues/581839
-
-# standard Gem, pin version to resolve vulnerabilities and match omnibus-gitlab
-gem "erb", "= 4.0.3.1", feature_category: :shared # rubocop:todo Gemfile/MissingFeatureCategory -- https://gitlab.com/gitlab-org/gitlab/-/work_items/596593
+gem 'license_finder', '~> 7.0', require: false, feature_category: :build
--- a/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/Gemfile.lock
--- a/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
+++ b/pkgs/by-name/gi/gitlab/rubyEnv/gemset.nix
--- a/pkgs/by-name/go/go-containerregistry/package.nix
+++ b/pkgs/by-name/go/go-containerregistry/package.nix
@@ -15,13 +15,13 @@ in

 buildGoModule (finalAttrs: {
  pname = "go-containerregistry";
-  version = "0.21.6";
+  version = "0.21.9";

  src = fetchFromGitHub {
    owner = "google";
    repo = "go-containerregistry";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-qqtcvpxqvOG+zVGse5vCdxaA8tgH3WrKjfLUTRLxA7s=";
+    sha256 = "sha256-D4N8ONuhoajYwb0SOtvwbrxI/st86KI4YXd9X1moKKQ=";
  };
  vendorHash = null;

--- a/pkgs/by-name/go/go-mockery/package.nix
+++ b/pkgs/by-name/go/go-mockery/package.nix
@@ -38,6 +38,10 @@ buildGoModule (finalAttrs: {
    gotestsum
  ];

+  # the e2e remote template tests serve fixtures from an httptest server on
+  # loopback, which the darwin sandbox blocks by default
+  __darwinAllowLocalNetworking = true;
+
  prePatch = ''
    # remove test.ci's dependency on lint since we don't need it and
    # it tries to use remote golangci-lint
--- a/pkgs/by-name/go/go2tv/package.nix
+++ b/pkgs/by-name/go/go2tv/package.nix
@@ -10,25 +10,33 @@
  libxcursor,
  libx11,
  libglvnd,
+  libxkbcommon,
+  pipewire,
  pkg-config,
+  wayland,
  withGui ? true,
 }:

 buildGoModule rec {
  pname = "go2tv" + lib.optionalString (!withGui) "-lite";
-  version = "2.1.0";
+  version = "2.5.0";

  src = fetchFromGitHub {
    owner = "alexballas";
    repo = "go2tv";
    tag = "v${version}";
-    hash = "sha256-nAvfWRXPYX5AcJ0S3QXlcOtEEIUQK0FZqSSBNxDtGu4=";
+    hash = "sha256-rNoQafBIxE0xoBFQNy6GoeIE93Uq3QEsktko77P2ps8=";
  };

-  vendorHash = "sha256-vxWvv7PE3VlU2Z9WEAvKiUgJCrK0a6QerMA3Vw+CLZo=";
+  vendorHash = "sha256-h8/DBqkaSSxIIFrdbun4doN3qyKbR3BhO4SwL5H/sfc=";

  nativeBuildInputs = [ pkg-config ];

+  env = {
+    # allow flag from `pkg-config --cflags libpipewire-0.3`
+    CGO_CFLAGS_ALLOW = "-fno-strict-overflow";
+  };
+
  buildInputs = [
    libx11
    libxcursor
@@ -38,6 +46,9 @@ buildGoModule rec {
    libxext
    libxxf86vm
    libglvnd
+    libxkbcommon
+    pipewire
+    wayland
  ];

  ldflags = [
--- a/pkgs/by-name/gs/gswatcher/package.nix
+++ b/pkgs/by-name/gs/gswatcher/package.nix
@@ -23,13 +23,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "gswatcher";
-  version = "1.7.5";
+  version = "1.8.0";

  src = fetchFromGitHub {
    owner = "lxndr";
    repo = "gswatcher";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-RnyvKAnEF1tzVS+/GEwaGQNPIXKx7KU790ZElj6hJtw=";
+    hash = "sha256-no+4JMs6d4HvUJwjGQAvSlkySDIzA6psfwCe5JqCa/8=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/he/hermitcli/package.nix
+++ b/pkgs/by-name/he/hermitcli/package.nix
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "hermit";
-  version = "0.52.1";
+  version = "0.52.3";

  src = fetchFromGitHub {
    rev = "v${finalAttrs.version}";
    owner = "cashapp";
    repo = "hermit";
-    hash = "sha256-+3iP+cJBa+EHVw+xWyH6tyaeqbzOr8E30Ig2Xr5MPkg=";
+    hash = "sha256-bcTj0JR2sAfTPBi5z0s2ZCWu16HYr51JD1qMhA8extE=";
  };

-  vendorHash = "sha256-2sNtok5J1kBvJZ0I1FOq1ZP54TsZbzqu/M3v1nA12m8=";
+  vendorHash = "sha256-+UIWiP+CvRJQhTS2hMWrb3gB8kEN6fa6xIaYBNUxHOs=";

  subPackages = [ "cmd/hermit" ];

--- a/pkgs/by-name/in/infrastructure-agent/package.nix
+++ b/pkgs/by-name/in/infrastructure-agent/package.nix
@@ -6,16 +6,16 @@
 }:
 buildGoModule (finalAttrs: {
  pname = "infrastructure-agent";
-  version = "1.77.0";
+  version = "1.78.1";

  src = fetchFromGitHub {
    owner = "newrelic";
    repo = "infrastructure-agent";
    rev = finalAttrs.version;
-    hash = "sha256-QgyQ5fP8yIgmqHqLRn927pRmngOeKcdSaxXLDkcIwqI=";
+    hash = "sha256-+Fc413KV07v4akdhg4b+rICbW+jt1f/uj6a6kWawImk=";
  };

-  vendorHash = "sha256-+ajMZ+kZ+m1vxyAfM+zvzTfcwkN63agdGoXPTNPC2i0=";
+  vendorHash = "sha256-e8lC85EWVJl/11s7qxI041hw2yOtzYR3c7Jw+1pAS3U=";

  ldflags = [
    "-s"
--- a/pkgs/by-name/in/intel-npu-driver/package.nix
+++ b/pkgs/by-name/in/intel-npu-driver/package.nix
@@ -7,19 +7,20 @@
  cmake,
  git,
  level-zero,
+  pkg-config,
  fetchFromGitHub,
 }:

 stdenv.mkDerivation rec {
  pname = "intel-npu-driver";
-  version = "1.28.0";
+  version = "1.35.0";

  src = fetchFromGitHub {
    owner = "intel";
    repo = "linux-npu-driver";
    tag = "v${version}";
    fetchSubmodules = true;
-    hash = "sha256-aH7npJompKYlyq2RPXHn/lflQ1C/yYcTp2K+6kX/L0w=";
+    hash = "sha256-n23yb6ZEJ7bfLactFixBQTcRlSIsVMOJ1QESoHLIhPg=";
  };

  buildInputs = [
@@ -31,8 +32,11 @@ stdenv.mkDerivation rec {

  nativeBuildInputs = [
    cmake
+    pkg-config
  ];

+  env.NIX_CFLAGS_COMPILE = "-Wno-error=missing-field-initializers";
+
  outputs = [
    "out"
    "validation"
@@ -40,9 +44,7 @@ stdenv.mkDerivation rec {
  ];

  postPatch = ''
-    rm -rf third_party/level-zero
    rm third_party/cmake/level-zero.cmake
-    rm third_party/cmake/FindLevelZero.cmake

    substituteInPlace third_party/yaml-cpp/CMakeLists.txt --replace-fail \
      "cmake_minimum_required" \
@@ -50,7 +52,8 @@ stdenv.mkDerivation rec {

    substituteInPlace third_party/CMakeLists.txt --replace-fail \
      "include(cmake/level-zero.cmake)" \
-      ""
+      "include(cmake/FindLevelZero.cmake)"
+
    substituteInPlace third_party/level-zero-npu-extensions/ze_graph_ext.h --replace-fail \
    "#include \"ze_api.h\"" \
    "#include <level_zero/ze_api.h>"
--- a/pkgs/by-name/ip/iprange/package.nix
+++ b/pkgs/by-name/ip/iprange/package.nix
@@ -8,13 +8,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "iprange";
-  version = "2.0.0";
+  version = "2.1.1";

  src = fetchFromGitHub {
    owner = "firehol";
    repo = "iprange";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-/rNM/5SmqpNX/yM/9EZdRYsXxgbPLp7+SL/RDtKo3+0=";
+    hash = "sha256-vmGJaDwduieMhYpNy3sunrTARgRMz24h/jT/cGSh14Y=";
  };

  nativeBuildInputs = [ autoreconfHook ];
--- a/pkgs/by-name/ja/jackett/deps.json
+++ b/pkgs/by-name/ja/jackett/deps.json
@@ -1,18 +1,18 @@
 [
  {
    "pname": "AngleSharp",
-    "version": "1.0.0",
-    "hash": "sha256-0IBx4+dgw903WujficZeHnbPCaxUN7hmlB6FnRUNtDk="
+    "version": "1.5.0",
+    "hash": "sha256-290+oGXJRDf3q06rRrcQmg3XbKYhgIa6xjn5vUJWRJ4="
  },
  {
    "pname": "AngleSharp",
-    "version": "1.5.2",
-    "hash": "sha256-81rDtnwvR0SDXNNUnPirWIa782gwkgRlz1Fbzm2ywwc="
+    "version": "1.7.1",
+    "hash": "sha256-GH/AJ8aNoPixvsUIeTRvZH5T9rmQV+dk1QnpLBz/tGc="
  },
  {
    "pname": "AngleSharp.Xml",
-    "version": "1.0.0",
-    "hash": "sha256-UzxXWH6qG2BEAH/ULosGkUn2RhghUOguyVTPYl78spM="
+    "version": "1.1.0",
+    "hash": "sha256-EPKraxfylSFngnba58kosmo4AHEUwK1fv7qiIZAFi14="
  },
  {
    "pname": "Autofac",
@@ -46,8 +46,8 @@
  },
  {
    "pname": "FlareSolverrSharp",
-    "version": "3.0.7",
-    "hash": "sha256-zropUtNiHVSG0ULK01wOhqgZSlWi+CXZ+4SKWok33BI="
+    "version": "4.0.0",
+    "hash": "sha256-R/9XS7xO9vpyCS0j/dAsZzv0POzVL33662xwD/jN2HE="
  },
  {
    "pname": "FluentAssertions",
@@ -254,11 +254,6 @@
    "version": "5.0.0",
    "hash": "sha256-LIcg1StDcQLPOABp4JRXIs837d7z0ia6+++3SF3jl1c="
  },
-  {
-    "pname": "Microsoft.NETCore.Targets",
-    "version": "1.1.0",
-    "hash": "sha256-0AqQ2gMS8iNlYkrD+BxtIg7cXMnr9xZHtKAuN4bjfaQ="
-  },
  {
    "pname": "Microsoft.Testing.Extensions.Telemetry",
    "version": "1.8.4",
@@ -304,11 +299,6 @@
    "version": "17.14.1",
    "hash": "sha256-1cxHWcvHRD7orQ3EEEPPxVGEkTpxom1/zoICC9SInJs="
  },
-  {
-    "pname": "Microsoft.Win32.Primitives",
-    "version": "4.3.0",
-    "hash": "sha256-mBNDmPXNTW54XLnPAUwBRvkIORFM7/j0D0I2SyQPDEg="
-  },
  {
    "pname": "MimeMapping",
    "version": "1.0.1.50",
@@ -339,11 +329,6 @@
    "version": "3.10.4",
    "hash": "sha256-JFczGh52OdMmsSyIGnLtTzAZXp4E8sh095JFvnfxoMY="
  },
-  {
-    "pname": "NETStandard.Library",
-    "version": "1.6.1",
-    "hash": "sha256-iNan1ix7RtncGWC9AjAZ2sk70DoxOsmEOgQ10fXm4Pw="
-  },
  {
    "pname": "NETStandard.Library",
    "version": "2.0.0",
@@ -359,11 +344,6 @@
    "version": "12.0.1",
    "hash": "sha256-4Xf3RZrJomAh3jaZrEAJX3oPmOowGV8yDB9Y3h0Dw4U="
  },
-  {
-    "pname": "Newtonsoft.Json",
-    "version": "13.0.2",
-    "hash": "sha256-ESyjt/R7y9dDvvz5Sftozk+e/3Otn38bOcLGGh69Ot0="
-  },
  {
    "pname": "Newtonsoft.Json",
    "version": "13.0.3",
@@ -424,226 +404,11 @@
    "version": "8.7.0",
    "hash": "sha256-1AT4Xym9hn2Awgul9WErwXk2bBPN58P9XfRExrIPItg="
  },
-  {
-    "pname": "runtime.any.System.Collections",
-    "version": "4.3.0",
-    "hash": "sha256-4PGZqyWhZ6/HCTF2KddDsbmTTjxs2oW79YfkberDZS8="
-  },
-  {
-    "pname": "runtime.any.System.Diagnostics.Tools",
-    "version": "4.3.0",
-    "hash": "sha256-8yLKFt2wQxkEf7fNfzB+cPUCjYn2qbqNgQ1+EeY2h/I="
-  },
-  {
-    "pname": "runtime.any.System.Diagnostics.Tracing",
-    "version": "4.3.0",
-    "hash": "sha256-dsmTLGvt8HqRkDWP8iKVXJCS+akAzENGXKPV18W2RgI="
-  },
-  {
-    "pname": "runtime.any.System.Globalization",
-    "version": "4.3.0",
-    "hash": "sha256-PaiITTFI2FfPylTEk7DwzfKeiA/g/aooSU1pDcdwWLU="
-  },
-  {
-    "pname": "runtime.any.System.Globalization.Calendars",
-    "version": "4.3.0",
-    "hash": "sha256-AYh39tgXJVFu8aLi9Y/4rK8yWMaza4S4eaxjfcuEEL4="
-  },
-  {
-    "pname": "runtime.any.System.IO",
-    "version": "4.3.0",
-    "hash": "sha256-vej7ySRhyvM3pYh/ITMdC25ivSd0WLZAaIQbYj/6HVE="
-  },
-  {
-    "pname": "runtime.any.System.Reflection",
-    "version": "4.3.0",
-    "hash": "sha256-ns6f++lSA+bi1xXgmW1JkWFb2NaMD+w+YNTfMvyAiQk="
-  },
-  {
-    "pname": "runtime.any.System.Reflection.Extensions",
-    "version": "4.3.0",
-    "hash": "sha256-Y2AnhOcJwJVYv7Rp6Jz6ma0fpITFqJW+8rsw106K2X8="
-  },
-  {
-    "pname": "runtime.any.System.Reflection.Primitives",
-    "version": "4.3.0",
-    "hash": "sha256-LkPXtiDQM3BcdYkAm5uSNOiz3uF4J45qpxn5aBiqNXQ="
-  },
-  {
-    "pname": "runtime.any.System.Resources.ResourceManager",
-    "version": "4.3.0",
-    "hash": "sha256-9EvnmZslLgLLhJ00o5MWaPuJQlbUFcUF8itGQNVkcQ4="
-  },
-  {
-    "pname": "runtime.any.System.Runtime",
-    "version": "4.3.0",
-    "hash": "sha256-qwhNXBaJ1DtDkuRacgHwnZmOZ1u9q7N8j0cWOLYOELM="
-  },
-  {
-    "pname": "runtime.any.System.Runtime.Handles",
-    "version": "4.3.0",
-    "hash": "sha256-PQRACwnSUuxgVySO1840KvqCC9F8iI9iTzxNW0RcBS4="
-  },
-  {
-    "pname": "runtime.any.System.Runtime.InteropServices",
-    "version": "4.3.0",
-    "hash": "sha256-Kaw5PnLYIiqWbsoF3VKJhy7pkpoGsUwn4ZDCKscbbzA="
-  },
-  {
-    "pname": "runtime.any.System.Text.Encoding",
-    "version": "4.3.0",
-    "hash": "sha256-Q18B9q26MkWZx68exUfQT30+0PGmpFlDgaF0TnaIGCs="
-  },
-  {
-    "pname": "runtime.any.System.Text.Encoding.Extensions",
-    "version": "4.3.0",
-    "hash": "sha256-6MYj0RmLh4EVqMtO/MRqBi0HOn5iG4x9JimgCCJ+EFM="
-  },
-  {
-    "pname": "runtime.any.System.Threading.Tasks",
-    "version": "4.3.0",
-    "hash": "sha256-agdOM0NXupfHbKAQzQT8XgbI9B8hVEh+a/2vqeHctg4="
-  },
-  {
-    "pname": "runtime.any.System.Threading.Timer",
-    "version": "4.3.0",
-    "hash": "sha256-BgHxXCIbicVZtpgMimSXixhFC3V+p5ODqeljDjO8hCs="
-  },
-  {
-    "pname": "runtime.debian.8-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-LXUPLX3DJxsU1Pd3UwjO1PO9NM2elNEDXeu2Mu/vNps="
-  },
-  {
-    "pname": "runtime.fedora.23-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-qeSqaUI80+lqw5MK4vMpmO0CZaqrmYktwp6L+vQAb0I="
-  },
-  {
-    "pname": "runtime.fedora.24-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-SrHqT9wrCBsxILWtaJgGKd6Odmxm8/Mh7Kh0CUkZVzA="
-  },
-  {
-    "pname": "runtime.native.System",
-    "version": "4.3.0",
-    "hash": "sha256-ZBZaodnjvLXATWpXXakFgcy6P+gjhshFXmglrL5xD5Y="
-  },
-  {
-    "pname": "runtime.native.System.IO.Compression",
-    "version": "4.3.0",
-    "hash": "sha256-DWnXs4vlKoU6WxxvCArTJupV6sX3iBbZh8SbqfHace8="
-  },
-  {
-    "pname": "runtime.native.System.Net.Http",
-    "version": "4.3.0",
-    "hash": "sha256-c556PyheRwpYhweBjSfIwEyZHnAUB8jWioyKEcp/2dg="
-  },
-  {
-    "pname": "runtime.native.System.Security.Cryptography.Apple",
-    "version": "4.3.0",
-    "hash": "sha256-2IhBv0i6pTcOyr8FFIyfPEaaCHUmJZ8DYwLUwJ+5waw="
-  },
-  {
-    "pname": "runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-Jy01KhtcCl2wjMpZWH+X3fhHcVn+SyllWFY8zWlz/6I="
-  },
-  {
-    "pname": "runtime.opensuse.13.2-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-wyv00gdlqf8ckxEdV7E+Ql9hJIoPcmYEuyeWb5Oz3mM="
-  },
-  {
-    "pname": "runtime.opensuse.42.1-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-zi+b4sCFrA9QBiSGDD7xPV27r3iHGlV99gpyVUjRmc4="
-  },
-  {
-    "pname": "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.Apple",
-    "version": "4.3.0",
-    "hash": "sha256-serkd4A7F6eciPiPJtUyJyxzdAtupEcWIZQ9nptEzIM="
-  },
-  {
-    "pname": "runtime.osx.10.10-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-gybQU6mPgaWV3rBG2dbH6tT3tBq8mgze3PROdsuWnX0="
-  },
-  {
-    "pname": "runtime.rhel.7-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-VsP72GVveWnGUvS/vjOQLv1U80H2K8nZ4fDAmI61Hm4="
-  },
-  {
-    "pname": "runtime.ubuntu.14.04-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-4yKGa/IrNCKuQ3zaDzILdNPD32bNdy6xr5gdJigyF5g="
-  },
-  {
-    "pname": "runtime.ubuntu.16.04-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-HmdJhhRsiVoOOCcUvAwdjpMRiyuSwdcgEv2j9hxi+Zc="
-  },
-  {
-    "pname": "runtime.ubuntu.16.10-x64.runtime.native.System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-pVFUKuPPIx0edQKjzRon3zKq8zhzHEzko/lc01V/jdw="
-  },
-  {
-    "pname": "runtime.unix.Microsoft.Win32.Primitives",
-    "version": "4.3.0",
-    "hash": "sha256-LZb23lRXzr26tRS5aA0xyB08JxiblPDoA7HBvn6awXg="
-  },
-  {
-    "pname": "runtime.unix.System.Console",
-    "version": "4.3.0",
-    "hash": "sha256-AHkdKShTRHttqfMjmi+lPpTuCrM5vd/WRy6Kbtie190="
-  },
-  {
-    "pname": "runtime.unix.System.Diagnostics.Debug",
-    "version": "4.3.0",
-    "hash": "sha256-ReoazscfbGH+R6s6jkg5sIEHWNEvjEoHtIsMbpc7+tI="
-  },
-  {
-    "pname": "runtime.unix.System.IO.FileSystem",
-    "version": "4.3.0",
-    "hash": "sha256-Pf4mRl6YDK2x2KMh0WdyNgv0VUNdSKVDLlHqozecy5I="
-  },
-  {
-    "pname": "runtime.unix.System.Net.Primitives",
-    "version": "4.3.0",
-    "hash": "sha256-pHJ+I6i16MV6m77uhTC6GPY6jWGReE3SSP3fVB59ti0="
-  },
-  {
-    "pname": "runtime.unix.System.Net.Sockets",
-    "version": "4.3.0",
-    "hash": "sha256-IvgOeA2JuBjKl5yAVGjPYMPDzs9phb3KANs95H9v1w4="
-  },
-  {
-    "pname": "runtime.unix.System.Private.Uri",
-    "version": "4.3.0",
-    "hash": "sha256-c5tXWhE/fYbJVl9rXs0uHh3pTsg44YD1dJvyOA0WoMs="
-  },
-  {
-    "pname": "runtime.unix.System.Runtime.Extensions",
-    "version": "4.3.0",
-    "hash": "sha256-l8S9gt6dk3qYG6HYonHtdlYtBKyPb29uQ6NDjmrt3V4="
-  },
  {
    "pname": "SharpZipLib",
    "version": "1.4.2",
    "hash": "sha256-/giVqikworG2XKqfN9uLyjUSXr35zBuZ2FX2r8X/WUY="
  },
-  {
-    "pname": "System.AppContext",
-    "version": "4.3.0",
-    "hash": "sha256-yg95LNQOwFlA1tWxXdQkVyJqT4AnoDc+ACmrNvzGiZg="
-  },
-  {
-    "pname": "System.Buffers",
-    "version": "4.3.0",
-    "hash": "sha256-XqZWb4Kd04960h4U9seivjKseGA/YEIpdplfHYHQ9jk="
-  },
  {
    "pname": "System.Buffers",
    "version": "4.5.0",
@@ -659,16 +424,6 @@
    "version": "4.6.0",
    "hash": "sha256-c2QlgFB16IlfBms5YLsTCFQ/QeKoS6ph1a9mdRkq/Jc="
  },
-  {
-    "pname": "System.Collections",
-    "version": "4.3.0",
-    "hash": "sha256-afY7VUtD6w/5mYqrce8kQrvDIfS2GXDINDh73IjxJKc="
-  },
-  {
-    "pname": "System.Collections.Concurrent",
-    "version": "4.3.0",
-    "hash": "sha256-KMY5DfJnDeIsa13DpqvyN8NkReZEMAFnlmNglVoFIXI="
-  },
  {
    "pname": "System.Collections.Immutable",
    "version": "8.0.0",
@@ -689,21 +444,6 @@
    "version": "4.4.0",
    "hash": "sha256-+8wGYllXnIxRzy9dLhZFB88GoPj8ivYXS0KUfcivT8I="
  },
-  {
-    "pname": "System.Console",
-    "version": "4.3.0",
-    "hash": "sha256-Xh3PPBZr0pDbDaK8AEHbdGz7ePK6Yi1ZyRWI1JM6mbo="
-  },
-  {
-    "pname": "System.Diagnostics.Debug",
-    "version": "4.3.0",
-    "hash": "sha256-fkA79SjPbSeiEcrbbUsb70u9B7wqbsdM9s1LnoKj0gM="
-  },
-  {
-    "pname": "System.Diagnostics.DiagnosticSource",
-    "version": "4.3.0",
-    "hash": "sha256-OFJRb0ygep0Z3yDBLwAgM/Tkfs4JCDtsNhwDH9cd1Xw="
-  },
  {
    "pname": "System.Diagnostics.DiagnosticSource",
    "version": "5.0.0",
@@ -719,61 +459,11 @@
    "version": "9.0.18",
    "hash": "sha256-pJBU/x5x1qwEjtSjkuTwVB6z04gAxMPPXOSdUIgYe1M="
  },
-  {
-    "pname": "System.Diagnostics.Tools",
-    "version": "4.3.0",
-    "hash": "sha256-gVOv1SK6Ape0FQhCVlNOd9cvQKBvMxRX9K0JPVi8w0Y="
-  },
-  {
-    "pname": "System.Diagnostics.Tracing",
-    "version": "4.3.0",
-    "hash": "sha256-hCETZpHHGVhPYvb4C0fh4zs+8zv4GPoixagkLZjpa9Q="
-  },
-  {
-    "pname": "System.Globalization",
-    "version": "4.3.0",
-    "hash": "sha256-caL0pRmFSEsaoeZeWN5BTQtGrAtaQPwFi8YOZPZG5rI="
-  },
-  {
-    "pname": "System.Globalization.Calendars",
-    "version": "4.3.0",
-    "hash": "sha256-uNOD0EOVFgnS2fMKvMiEtI9aOw00+Pfy/H+qucAQlPc="
-  },
-  {
-    "pname": "System.Globalization.Extensions",
-    "version": "4.3.0",
-    "hash": "sha256-mmJWA27T0GRVuFP9/sj+4TrR4GJWrzNIk2PDrbr7RQk="
-  },
-  {
-    "pname": "System.IO",
-    "version": "4.3.0",
-    "hash": "sha256-ruynQHekFP5wPrDiVyhNiRIXeZ/I9NpjK5pU+HPDiRY="
-  },
-  {
-    "pname": "System.IO.Compression",
-    "version": "4.3.0",
-    "hash": "sha256-f5PrQlQgj5Xj2ZnHxXW8XiOivaBvfqDao9Sb6AVinyA="
-  },
-  {
-    "pname": "System.IO.Compression.ZipFile",
-    "version": "4.3.0",
-    "hash": "sha256-WQl+JgWs+GaRMeiahTFUbrhlXIHapzcpTFXbRvAtvvs="
-  },
-  {
-    "pname": "System.IO.FileSystem",
-    "version": "4.3.0",
-    "hash": "sha256-vNIYnvlayuVj0WfRfYKpDrhDptlhp1pN8CYmlVd2TXw="
-  },
  {
    "pname": "System.IO.FileSystem.AccessControl",
    "version": "5.0.0",
    "hash": "sha256-c9MlDKJfj63YRvl7brRBNs59olrmbL+G1A6oTS8ytEc="
  },
-  {
-    "pname": "System.IO.FileSystem.Primitives",
-    "version": "4.3.0",
-    "hash": "sha256-LMnfg8Vwavs9cMnq9nNH8IWtAtSfk0/Fy4s4Rt9r1kg="
-  },
  {
    "pname": "System.IO.Pipelines",
    "version": "4.6.0",
@@ -789,16 +479,6 @@
    "version": "9.0.18",
    "hash": "sha256-JacrrdrxR6u7aVjeJiSDOptqAV/f3rcszgz/WdCMBkg="
  },
-  {
-    "pname": "System.Linq",
-    "version": "4.3.0",
-    "hash": "sha256-R5uiSL3l6a3XrXSSL6jz+q/PcyVQzEAByiuXZNSqD/A="
-  },
-  {
-    "pname": "System.Linq.Expressions",
-    "version": "4.3.0",
-    "hash": "sha256-+3pvhZY7rip8HCbfdULzjlC9FPZFpYoQxhkcuFm2wk8="
-  },
  {
    "pname": "System.Memory",
    "version": "4.5.3",
@@ -814,91 +494,16 @@
    "version": "4.5.5",
    "hash": "sha256-EPQ9o1Kin7KzGI5O3U3PUQAZTItSbk9h/i4rViN3WiI="
  },
-  {
-    "pname": "System.Net.Http",
-    "version": "4.3.0",
-    "hash": "sha256-UoBB7WPDp2Bne/fwxKF0nE8grJ6FzTMXdT/jfsphj8Q="
-  },
-  {
-    "pname": "System.Net.NameResolution",
-    "version": "4.3.0",
-    "hash": "sha256-eGZwCBExWsnirWBHyp2sSSSXp6g7I6v53qNmwPgtJ5c="
-  },
-  {
-    "pname": "System.Net.Primitives",
-    "version": "4.3.0",
-    "hash": "sha256-MY7Z6vOtFMbEKaLW9nOSZeAjcWpwCtdO7/W1mkGZBzE="
-  },
-  {
-    "pname": "System.Net.Sockets",
-    "version": "4.3.0",
-    "hash": "sha256-il7dr5VT/QWDg/0cuh+4Es2u8LY//+qqiY9BZmYxSus="
-  },
  {
    "pname": "System.Numerics.Vectors",
    "version": "4.4.0",
    "hash": "sha256-auXQK2flL/JpnB/rEcAcUm4vYMCYMEMiWOCAlIaqu2U="
  },
-  {
-    "pname": "System.ObjectModel",
-    "version": "4.3.0",
-    "hash": "sha256-gtmRkWP2Kwr3nHtDh0yYtce38z1wrGzb6fjm4v8wN6Q="
-  },
-  {
-    "pname": "System.Private.Uri",
-    "version": "4.3.0",
-    "hash": "sha256-fVfgcoP4AVN1E5wHZbKBIOPYZ/xBeSIdsNF+bdukIRM="
-  },
-  {
-    "pname": "System.Reflection",
-    "version": "4.3.0",
-    "hash": "sha256-NQSZRpZLvtPWDlvmMIdGxcVuyUnw92ZURo0hXsEshXY="
-  },
-  {
-    "pname": "System.Reflection.Emit",
-    "version": "4.3.0",
-    "hash": "sha256-5LhkDmhy2FkSxulXR+bsTtMzdU3VyyuZzsxp7/DwyIU="
-  },
-  {
-    "pname": "System.Reflection.Emit.ILGeneration",
-    "version": "4.3.0",
-    "hash": "sha256-mKRknEHNls4gkRwrEgi39B+vSaAz/Gt3IALtS98xNnA="
-  },
-  {
-    "pname": "System.Reflection.Emit.Lightweight",
-    "version": "4.3.0",
-    "hash": "sha256-rKx4a9yZKcajloSZHr4CKTVJ6Vjh95ni+zszPxWjh2I="
-  },
-  {
-    "pname": "System.Reflection.Extensions",
-    "version": "4.3.0",
-    "hash": "sha256-mMOCYzUenjd4rWIfq7zIX9PFYk/daUyF0A8l1hbydAk="
-  },
  {
    "pname": "System.Reflection.Metadata",
    "version": "8.0.0",
    "hash": "sha256-dQGC30JauIDWNWXMrSNOJncVa1umR1sijazYwUDdSIE="
  },
-  {
-    "pname": "System.Reflection.Primitives",
-    "version": "4.3.0",
-    "hash": "sha256-5ogwWB4vlQTl3jjk1xjniG2ozbFIjZTL9ug0usZQuBM="
-  },
-  {
-    "pname": "System.Reflection.TypeExtensions",
-    "version": "4.3.0",
-    "hash": "sha256-4U4/XNQAnddgQIHIJq3P2T80hN0oPdU2uCeghsDTWng="
-  },
-  {
-    "pname": "System.Resources.ResourceManager",
-    "version": "4.3.0",
-    "hash": "sha256-idiOD93xbbrbwwSnD4mORA9RYi/D/U48eRUsn/WnWGo="
-  },
-  {
-    "pname": "System.Runtime",
-    "version": "4.3.0",
-    "hash": "sha256-51813WXpBIsuA6fUtE5XaRQjcWdQ2/lmEokJt97u0Rg="
-  },
  {
    "pname": "System.Runtime.CompilerServices.Unsafe",
    "version": "4.5.2",
@@ -914,71 +519,16 @@
    "version": "6.0.0",
    "hash": "sha256-bEG1PnDp7uKYz/OgLOWs3RWwQSVYm+AnPwVmAmcgp2I="
  },
-  {
-    "pname": "System.Runtime.Extensions",
-    "version": "4.3.0",
-    "hash": "sha256-wLDHmozr84v1W2zYCWYxxj0FR0JDYHSVRaRuDm0bd/o="
-  },
-  {
-    "pname": "System.Runtime.Handles",
-    "version": "4.3.0",
-    "hash": "sha256-KJ5aXoGpB56Y6+iepBkdpx/AfaJDAitx4vrkLqR7gms="
-  },
-  {
-    "pname": "System.Runtime.InteropServices",
-    "version": "4.3.0",
-    "hash": "sha256-8sDH+WUJfCR+7e4nfpftj/+lstEiZixWUBueR2zmHgI="
-  },
-  {
-    "pname": "System.Runtime.InteropServices.RuntimeInformation",
-    "version": "4.3.0",
-    "hash": "sha256-MYpl6/ZyC6hjmzWRIe+iDoldOMW1mfbwXsduAnXIKGA="
-  },
-  {
-    "pname": "System.Runtime.Numerics",
-    "version": "4.3.0",
-    "hash": "sha256-P5jHCgMbgFMYiONvzmaKFeOqcAIDPu/U8bOVrNPYKqc="
-  },
  {
    "pname": "System.Security.AccessControl",
    "version": "5.0.0",
    "hash": "sha256-ueSG+Yn82evxyGBnE49N4D+ngODDXgornlBtQ3Omw54="
  },
-  {
-    "pname": "System.Security.Cryptography.Algorithms",
-    "version": "4.3.0",
-    "hash": "sha256-tAJvNSlczYBJ3Ed24Ae27a55tq/n4D3fubNQdwcKWA8="
-  },
-  {
-    "pname": "System.Security.Cryptography.Cng",
-    "version": "4.3.0",
-    "hash": "sha256-u17vy6wNhqok91SrVLno2M1EzLHZm6VMca85xbVChsw="
-  },
-  {
-    "pname": "System.Security.Cryptography.Csp",
-    "version": "4.3.0",
-    "hash": "sha256-oefdTU/Z2PWU9nlat8uiRDGq/PGZoSPRgkML11pmvPQ="
-  },
-  {
-    "pname": "System.Security.Cryptography.Encoding",
-    "version": "4.3.0",
-    "hash": "sha256-Yuge89N6M+NcblcvXMeyHZ6kZDfwBv3LPMDiF8HhJss="
-  },
-  {
-    "pname": "System.Security.Cryptography.OpenSsl",
-    "version": "4.3.0",
-    "hash": "sha256-DL+D2sc2JrQiB4oAcUggTFyD8w3aLEjJfod5JPe+Oz4="
-  },
  {
    "pname": "System.Security.Cryptography.Pkcs",
    "version": "9.0.18",
    "hash": "sha256-D16WfDikzmgkxmEspZqLa8m2UzyjgC3tivTAWCWZ87M="
  },
-  {
-    "pname": "System.Security.Cryptography.Primitives",
-    "version": "4.3.0",
-    "hash": "sha256-fnFi7B3SnVj5a+BbgXnbjnGNvWrCEU6Hp/wjsjWz318="
-  },
  {
    "pname": "System.Security.Cryptography.ProtectedData",
    "version": "4.4.0",
@@ -989,21 +539,11 @@
    "version": "9.0.18",
    "hash": "sha256-JfLdZjyzoRDHV2a6jGwq/xwuGy3T0XZNGB3zK9IAPBE="
  },
-  {
-    "pname": "System.Security.Cryptography.X509Certificates",
-    "version": "4.3.0",
-    "hash": "sha256-MG3V/owDh273GCUPsGGraNwaVpcydupl3EtPXj6TVG0="
-  },
  {
    "pname": "System.Security.Cryptography.Xml",
    "version": "9.0.18",
    "hash": "sha256-OzwTTsPo8Gui1xs4+zlILwvZgbcxXJ97m3ejKqnebu4="
  },
-  {
-    "pname": "System.Security.Principal.Windows",
-    "version": "4.3.0",
-    "hash": "sha256-mbdLVUcEwe78p3ZnB6jYsizNEqxMaCAWI3tEQNhRQAE="
-  },
  {
    "pname": "System.Security.Principal.Windows",
    "version": "5.0.0",
@@ -1014,21 +554,11 @@
    "version": "9.0.18",
    "hash": "sha256-LGttR/XVbEu/ZKz9Np0hTjP0t1TP/3lkQfGxWrhhT10="
  },
-  {
-    "pname": "System.Text.Encoding",
-    "version": "4.3.0",
-    "hash": "sha256-GctHVGLZAa/rqkBNhsBGnsiWdKyv6VDubYpGkuOkBLg="
-  },
  {
    "pname": "System.Text.Encoding.CodePages",
    "version": "9.0.18",
    "hash": "sha256-g5Ps501kdW4XXvSQrwb8qJq71I+P48+2T41uBkx42VA="
  },
-  {
-    "pname": "System.Text.Encoding.Extensions",
-    "version": "4.3.0",
-    "hash": "sha256-vufHXg8QAKxHlujPHHcrtGwAqFmsCD6HKjfDAiHyAYc="
-  },
  {
    "pname": "System.Text.Encodings.Web",
    "version": "8.0.0",
@@ -1044,26 +574,6 @@
    "version": "9.0.18",
    "hash": "sha256-tClFgkq64oP9F4UEZhi2SrvVCkgnOmjVn7p0sbpiwEw="
  },
-  {
-    "pname": "System.Text.RegularExpressions",
-    "version": "4.3.0",
-    "hash": "sha256-VLCk1D1kcN2wbAe3d0YQM/PqCsPHOuqlBY1yd2Yo+K0="
-  },
-  {
-    "pname": "System.Threading",
-    "version": "4.3.0",
-    "hash": "sha256-ZDQ3dR4pzVwmaqBg4hacZaVenQ/3yAF/uV7BXZXjiWc="
-  },
-  {
-    "pname": "System.Threading.Tasks",
-    "version": "4.3.0",
-    "hash": "sha256-Z5rXfJ1EXp3G32IKZGiZ6koMjRu0n8C1NGrwpdIen4w="
-  },
-  {
-    "pname": "System.Threading.Tasks.Extensions",
-    "version": "4.3.0",
-    "hash": "sha256-X2hQ5j+fxcmnm88Le/kSavjiGOmkcumBGTZKBLvorPc="
-  },
  {
    "pname": "System.Threading.Tasks.Extensions",
    "version": "4.5.2",
@@ -1074,26 +584,6 @@
    "version": "4.5.4",
    "hash": "sha256-owSpY8wHlsUXn5xrfYAiu847L6fAKethlvYx97Ri1ng="
  },
-  {
-    "pname": "System.Threading.ThreadPool",
-    "version": "4.3.0",
-    "hash": "sha256-wW0QdvssRoaOfQLazTGSnwYTurE4R8FxDx70pYkL+gg="
-  },
-  {
-    "pname": "System.Threading.Timer",
-    "version": "4.3.0",
-    "hash": "sha256-pmhslmhQhP32TWbBzoITLZ4BoORBqYk25OWbru04p9s="
-  },
-  {
-    "pname": "System.Xml.ReaderWriter",
-    "version": "4.3.0",
-    "hash": "sha256-QQ8KgU0lu4F5Unh+TbechO//zaAGZ4MfgvW72Cn1hzA="
-  },
-  {
-    "pname": "System.Xml.XDocument",
-    "version": "4.3.0",
-    "hash": "sha256-rWtdcmcuElNOSzCehflyKwHkDRpiOhJJs8CeQ0l1CCI="
-  },
  {
    "pname": "YamlDotNet",
    "version": "18.1.0",
--- a/pkgs/by-name/ja/jackett/package.nix
+++ b/pkgs/by-name/ja/jackett/package.nix
@@ -12,13 +12,13 @@

 buildDotnetModule (finalAttrs: {
  pname = "jackett";
-  version = "0.24.2335";
+  version = "0.24.2406";

  src = fetchFromGitHub {
    owner = "jackett";
    repo = "jackett";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-QDpjw525VHumabdeRwDxvsUxzJXTxQneezR8YDEHdLE=";
+    hash = "sha256-IFz5U91ukmmx53Z7VOmvD+zuqzSf35k1SknjJOGDB6E=";
  };

  projectFile = "src/Jackett.Server/Jackett.Server.csproj";
--- a/pkgs/by-name/js/jsvc/package.nix
+++ b/pkgs/by-name/js/jsvc/package.nix
@@ -10,11 +10,11 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "jsvc";
-  version = "1.5.1";
+  version = "1.6.1";

  src = fetchurl {
    url = "mirror://apache/commons/daemon/source/commons-daemon-${finalAttrs.version}-src.tar.gz";
-    hash = "sha256-SPnE5jrw1zAy7vIzGrjp0+B4SwCLoufLef3XUcUgK6Y=";
+    hash = "sha256-FeqThrdgunTykm+8CmhTwQiKTA3VxG0NGGb5/wkaY2Q=";
  };

  buildInputs = [ commons-daemon ];
--- a/pkgs/by-name/ju/just-lsp/package.nix
+++ b/pkgs/by-name/ju/just-lsp/package.nix
@@ -8,7 +8,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "just-lsp";
-  version = "0.6.1";
+  version = "0.6.2";

  __structuredAttrs = true;

@@ -16,10 +16,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "terror";
    repo = "just-lsp";
    tag = finalAttrs.version;
-    hash = "sha256-oBNCY9FBdGYzKsmikQoY+sYpDhFNQCmK3x4GU6c61QQ=";
+    hash = "sha256-B9ydV1q73auAVVaW9FyYmgyPncX9OXlE4w1IPst9buU=";
  };

-  cargoHash = "sha256-kclF+p+tacyAlKimS+ilbGwKe4R7xWuzQ07lRLo4lyU=";
+  cargoHash = "sha256-vUILbwu5/EQFG/8GCr3tQtmipGrVVwzgoV1oyDHWx0o=";

  nativeInstallCheckInputs = [
    versionCheckHook
--- a/pkgs/by-name/ke/keepalived/package.nix
+++ b/pkgs/by-name/ke/keepalived/package.nix
@@ -16,13 +16,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "keepalived";
-  version = "2.3.4";
+  version = "2.4.3";

  src = fetchFromGitHub {
    owner = "acassen";
    repo = "keepalived";
    rev = "v${finalAttrs.version}";
-    sha256 = "sha256-Xv/UGIeZhRHQO5lxkaWgHDUW+3qBi3wFU4+Us1A2uE0=";
+    sha256 = "sha256-I+SbxCY3D568L7U0cvlayZ8v4VEbufMCDX1hkRxyQVE=";
  };

  buildInputs = [
--- a/pkgs/by-name/kw/kwok/package.nix
+++ b/pkgs/by-name/kw/kwok/package.nix
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "kwok";
-  version = "0.7.0";
+  version = "0.8.0";

  src = fetchFromGitHub {
    owner = "kubernetes-sigs";
    repo = "kwok";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-gtDGkAXbNCWUVGL4+C6mOkWwrPcik6+nGEQNrjLb57U=";
+    hash = "sha256-SXiZiDor/+58JcKSBPHOWijvuCqdFmP2vRKJzLTriw8=";
  };

-  vendorHash = "sha256-UNso+e/zYah0jApHZgWnQ3cUSV44HsMqPy4q4JMCyiA=";
+  vendorHash = "sha256-Y+tQKkuLPA4gGtlhQlG8rrvNB+n0whRKUpaqIf1WxX8=";

  doCheck = false; # docker is need for test

--- a/pkgs/by-name/le/ledger-live-desktop/package.nix
+++ b/pkgs/by-name/le/ledger-live-desktop/package.nix
@@ -8,11 +8,11 @@

 let
  pname = "ledger-live-desktop";
-  version = "4.13.1";
+  version = "4.15.0";

  src = fetchurl {
    url = "https://download.live.ledger.com/${pname}-${version}-linux-x86_64.AppImage";
-    hash = "sha256-0ncrYTQWiFJICaovN0iMs0pFHFUiOjYcUZosetS2r4Y=";
+    hash = "sha256-3gEzJNxuoZuCUt3+tsnR1T2DBK8wvhEGEopd+jliTVk=";
  };

  appimageContents = appimageTools.extract {
--- a/pkgs/by-name/li/libfishsound/package.nix
+++ b/pkgs/by-name/li/libfishsound/package.nix
@@ -2,7 +2,6 @@
  lib,
  stdenv,
  fetchurl,
-  fetchpatch,
  autoreconfHook,
  libvorbis,
  speex,
@@ -12,37 +11,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "libfishsound";
-  version = "1.0.0";
+  version = "1.0.1";

  src = fetchurl {
    url = "https://downloads.xiph.org/releases/libfishsound/libfishsound-${finalAttrs.version}.tar.gz";
-    sha256 = "1iz7mn6hw2wg8ljaw74f4g2zdj68ib88x4vjxxg3gjgc5z75f2rf";
+    sha256 = "sha256-A+sWAeIwatyIx3av3yEiF8ZUeZDS0PnKVE2tmoqdu48=";
  };

-  patches =
-    let
-      fetchDebPatch =
-        { name, hash }:
-        fetchpatch {
-          inherit name hash;
-          url = "https://salsa.debian.org/multimedia-team/libfishsound/-/raw/f25f31a13dd2ce008614427889b08e6f2222898f/debian/patches/${name}";
-        };
-    in
-    map fetchDebPatch [
-      {
-        name = "0001-Patch-configure.ac-to-specify-config-macro-dir.patch";
-        hash = "sha256-3cijMhgxqwFisc5nt8826QUwOqPI7H425QkDcjnD4iM=";
-      }
-      {
-        name = "0002-flac-set-vendor_string.length-0.patch";
-        hash = "sha256-8195rU9IAhFL3MgB4jLwtJv6BWgz22A38+RmIymIQoo=";
-      }
-      {
-        name = "0003-Fix-incompatible-flac-callback-types.patch";
-        hash = "sha256-BxG1hlThzhJ6VeGcsNpDEtVyKSJTLGFKeHFpFoXW54A=";
-      }
-    ];
-
  propagatedBuildInputs = [
    libvorbis
    speex
--- a/pkgs/by-name/li/libredwg/package.nix
+++ b/pkgs/by-name/li/libredwg/package.nix
@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "libredwg";
-  version = "0.13.4.8200";
+  version = "0.14";

  src = fetchFromGitHub {
    owner = "LibreDWG";
    repo = "libredwg";
    tag = finalAttrs.version;
-    hash = "sha256-HaQvJyuEeaTfuUJbmlV4qcfXiLdHJ2vO4EGInwAKJYk=";
+    hash = "sha256-851VivSnXs0rAUE/z32/G9EYvn6LHkyxbhL4bNh+Alo=";
    fetchSubmodules = true;
  };

--- a/pkgs/by-name/li/librespeed-cli/package.nix
+++ b/pkgs/by-name/li/librespeed-cli/package.nix
@@ -6,16 +6,16 @@

 buildGoModule (finalAttrs: {
  pname = "librespeed-cli";
-  version = "1.0.13";
+  version = "1.0.14";

  src = fetchFromGitHub {
    owner = "librespeed";
    repo = "speedtest-cli";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Q6JdkXl6EaM/Uh2u2xH4Afa+aFvssZh98J7uUtJv/H0=";
+    hash = "sha256-5UFF2DCFHjt+PR2neir8tR+cRe5Clx1UkB0w+dW7IKs=";
  };

-  vendorHash = "sha256-LXSCOAX3EwDBJ37mkS/BZCllgEai8tC7WFy6pebNAyo=";
+  vendorHash = "sha256-c7t6cYWB4eifhAKH5cNbzB5eA9pcdzBiJyHmNp3MCr4=";

  # Tests have additional requirements
  doCheck = false;
--- a/pkgs/by-name/li/libweaver/package.nix
+++ b/pkgs/by-name/li/libweaver/package.nix
@@ -9,13 +9,13 @@
 }:
 stdenv.mkDerivation (finalAttrs: {
  pname = "libweaver";
-  version = "0-unstable-2025-12-18";
+  version = "0-unstable-2026-07-25";

  src = fetchFromGitHub {
    owner = "isledecomp";
    repo = "SIEdit";
-    rev = "2c32d65dbab577bf3a8701bc8bcae9034a7815d9";
-    hash = "sha256-qtE7c/LCQBhVWgbdmu4e5mCo+4Pz6QkAY29dHG/Fi/U=";
+    rev = "abb6d47139d7a03c5c1bad9b89e2267849e27904";
+    hash = "sha256-T+w8aR/W19bVsK+cFWZpbB4uhPcE27Yz2yMbhzzMNnA=";
  };

  strictDeps = true;
--- a/pkgs/by-name/ly/lycheeslicer/package.nix
+++ b/pkgs/by-name/ly/lycheeslicer/package.nix
@@ -9,11 +9,11 @@
 }:
 let
  pname = "lycheeslicer";
-  version = "7.6.5";
+  version = "7.6.6";

  src = fetchurl {
    url = "https://mango-lychee.nyc3.cdn.digitaloceanspaces.com/LycheeSlicer-${version}.AppImage";
-    hash = "sha256-HVCAvukGeF4hRJ/l41iBV1MZD5i9qzIYGSgMrncNfDg=";
+    hash = "sha256-eDMhA8fCD++BYK58t4/2XUlzrhcwtbAuOzRsThQAiVs=";
  };

  desktopItem = makeDesktopItem {
--- a/pkgs/by-name/m1/m1n1/package.nix
+++ b/pkgs/by-name/m1/m1n1/package.nix
@@ -31,21 +31,20 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "m1n1";
-  version = "1.6.0";
+  version = "1.6.1";

  src = fetchFromGitHub {
    owner = "AsahiLinux";
    repo = "m1n1";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-yYXB2DhLcLqxaqwP5mII+j2PMIoXdZ35bpx/d0WSZA8=";
-    fetchSubmodules = true;
+    hash = "sha256-4Wps/hNIBH6qWr2sX683WyLIPQJmih4ADwQKqqjitDk=";
  };

  cargoDeps = rustPlatform.fetchCargoVendor {
    inherit (finalAttrs) pname version;
    src = "${finalAttrs.src}/rust";
    sourceRoot = "rust";
-    hash = "sha256-iuiRp2FA5jnb3uh/p1gpc7Sznt1s4/UR91wEtXTf97o=";
+    hash = "sha256-/2JQ31pMHbNjZsIu2RLCWzNul/qzL1O2+XB3qdOEb2U=";
  };
  cargoRoot = "rust";

--- a/pkgs/by-name/ma/mackup/package.nix
+++ b/pkgs/by-name/ma/mackup/package.nix
@@ -7,14 +7,14 @@
 }:
 python3Packages.buildPythonApplication (finalAttrs: {
  pname = "mackup";
-  version = "0.10.3";
+  version = "0.11.1";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "lra";
    repo = "mackup";
    rev = "${finalAttrs.version}";
-    hash = "sha256-xK/01vnJP8eyyqyeEp7lv+fSN8KdCGIscqjlI32D/xA=";
+    hash = "sha256-qr/+Ot2mGRn/uZ2h6mOoNKS0Oeik0mBgpV2Kt3Lc6yg=";
  };

  postPatch = ''
--- a/pkgs/by-name/me/meld/package.nix
+++ b/pkgs/by-name/me/meld/package.nix
@@ -22,13 +22,13 @@

 python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "meld";
-  version = "3.23.1";
+  version = "3.24.0";

  pyproject = false;

  src = fetchurl {
    url = "mirror://gnome/sources/meld/${lib.versions.majorMinor finalAttrs.version}/meld-${finalAttrs.version}.tar.xz";
-    hash = "sha256-c/gnkkZjx8a0UadMg4UwTZn+qhPIH04KFx2ll8aENXQ=";
+    hash = "sha256-GfA2KX58iVFFFrzS5WGC2yuyuhO0hQiTwc5ZdEUBi5Q=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/mo/monkeys-audio/package.nix
+++ b/pkgs/by-name/mo/monkeys-audio/package.nix
@@ -6,12 +6,12 @@
 }:

 stdenv.mkDerivation (finalAttrs: {
-  version = "13.22";
+  version = "13.25";
  pname = "monkeys-audio";

  src = fetchzip {
    url = "https://monkeysaudio.com/files/MAC_${builtins.concatStringsSep "" (lib.strings.splitString "." finalAttrs.version)}_SDK.zip";
-    hash = "sha256-4OtodZZMXBrypeSO6QoT0oMxj3VoNHJRi1wTWAOUTCk=";
+    hash = "sha256-WPUg8qsm/iNwRV/0SUq4cZl9G+WsOwqjakBT5NZBTN0=";
    stripRoot = false;
  };

--- a/pkgs/by-name/ne/nerd-font-patcher/package.nix
+++ b/pkgs/by-name/ne/nerd-font-patcher/package.nix
@@ -10,7 +10,7 @@ python3Packages.buildPythonApplication (finalAttrs: {

  src = fetchzip {
    url = "https://github.com/ryanoasis/nerd-fonts/releases/download/v${finalAttrs.version}/FontPatcher.zip";
-    sha256 = "sha256-Z3KpaSoJpZx3D07K5EtHBXDl4pyHxnTIg/AuXrzTWWA=";
+    hash = "sha256-Z3KpaSoJpZx3D07K5EtHBXDl4pyHxnTIg/AuXrzTWWA=";
    stripRoot = false;
  };

@@ -25,10 +25,12 @@ python3Packages.buildPythonApplication (finalAttrs: {
  dontBuild = true;

  installPhase = ''
+    runHook preInstall
    mkdir -p $out/bin $out/share $out/lib
    install -Dm755 font-patcher $out/bin/nerd-font-patcher
    cp -ra src/glyphs $out/share/
    cp -ra bin/scripts/{braille,name_parser} $out/lib/
+    runHook postInstall
  '';

  meta = {
--- a/pkgs/by-name/ne/netcat-openbsd/package.nix
+++ b/pkgs/by-name/ne/netcat-openbsd/package.nix
@@ -2,58 +2,98 @@
  lib,
  stdenv,
  fetchFromGitLab,
+  quilt,
  pkg-config,
  libbsd,
  installShellFiles,
+  strace,
+  iproute2,
+  procps,
+  util-linux,
 }:

 stdenv.mkDerivation (finalAttrs: {
  pname = "netcat-openbsd";
-  version = "1.234-2";
+  version = "1.238-1";
+  __structuredAttrs = true;
+  strictDeps = true;

  src = fetchFromGitLab {
    domain = "salsa.debian.org";
    owner = "debian";
    repo = "netcat-openbsd";
    tag = "debian/${finalAttrs.version}";
-    hash = "sha256-kA9QzEI4nutQrKonHw+SxWYbuBLtn91edMAk8JBdAhU=";
+    hash = "sha256-CCxPZmZlTRNcQ985zf1RVYE4m3OHTM8FFWol1g8Osjc=";
  };

-  strictDeps = true;
+  postPatch = ''
+    QUILT_PATCHES=debian/patches quilt push -a
+  '';
+
+  outputs = [
+    "out"
+    "man"
+  ];
+
+  doCheck = true;
+
  nativeBuildInputs = [
+    quilt
    pkg-config
    installShellFiles
  ];
-  buildInputs = [ libbsd ];

-  postPatch = ''
-    for file in $(cat debian/patches/series); do
-      patch -p1 < debian/patches/$file
-    done
-  '';
+  buildInputs = [
+    libbsd
+  ];
+
+  nativeCheckInputs = [
+    strace
+    iproute2
+    procps
+    util-linux
+  ];

  installPhase = ''
    runHook preInstall

-    install -Dm755 -t $out/bin nc
+    installBin nc
    installManPage nc.1

    runHook postInstall
  '';

-  doInstallCheck = true;
-  installCheckPhase = ''
-    $out/bin/nc -h 2> /dev/null
+  checkPhase = ''
+    runHook preCheck
+
+    substituteInPlace debian/tests/client-server debian/checks/netcat \
+      --replace-fail 'PATH="/usr/bin:/bin"' ""
+    patchShebangs debian/tests/client-server debian/checks/netcat
+
+    # normally built by debian/rules
+    $CC -shared -o debian/checks/readpassphrase${stdenv.hostPlatform.extensions.sharedLibrary} debian/checks/readpassphrase.c
+    $CC -o debian/checks/sun_path-size debian/checks/sun_path-size.c
+
+    # name resolution does not really exists in sandbox
+    rm debian/checks/07-name-resolution
+
+    debian/tests/client-server
+    debian/checks/netcat
+
+    runHook postCheck
  '';

  meta = {
    description = "TCP/IP swiss army knife. OpenBSD variant";
    homepage = "https://salsa.debian.org/debian/netcat-openbsd";
    maintainers = with lib.maintainers; [ artturin ];
-    license = lib.licenses.bsd3;
+    license = with lib.licenses; [
+      bsd2
+      bsd3
+    ];
    platforms = lib.platforms.unix;
    mainProgram = "nc";
-    # never built on aarch64-darwin, x86_64-darwin since first introduction in nixpkgs
-    broken = stdenv.hostPlatform.isDarwin;
+    # never built on aarch64-darwin since first introduction in nixpkgs
+    badPlatforms = lib.platforms.darwin;
  };
 })
--- a/pkgs/by-name/no/notesnook/package.nix
+++ b/pkgs/by-name/no/notesnook/package.nix
@@ -9,7 +9,7 @@

 let
  pname = "notesnook";
-  version = "3.3.21";
+  version = "3.4.5";

  inherit (stdenv.hostPlatform) system;
  throwSystem = throw "Unsupported system: ${system}";
@@ -26,9 +26,9 @@ let
    url = "https://github.com/streetwriters/notesnook/releases/download/v${version}/notesnook_${suffix}";
    hash =
      {
-        x86_64-linux = "sha256-NmhV+x5HrKBO7BX1bJyjChKQF/j38kQqJ3x0amSXzGU=";
-        aarch64-linux = "sha256-IU4hF/ol4pyh+ABTri2aqwqaB+cfrHLtsF7wrqE+wEY=";
-        aarch64-darwin = "sha256-9CTGpCPJY6sq6JWDpoCTyOTt/vtCazDaoDzFFUzR9zg=";
+        x86_64-linux = "sha256-Zcx6TzmyInwE2+0RbBm6+1yAL85rhcFWbr2FOSmOT6Y=";
+        aarch64-linux = "sha256-ghxdb8TG4/uh1iuN5jaQ6aeYrXJh5+oX0ZpT/j8+5Ck=";
+        aarch64-darwin = "sha256-xw8oSGqTovCioRu6FVKZIrFraE72PwPvqZms5+K3S/M=";
      }
      .${system} or throwSystem;
  };
--- a/pkgs/by-name/or/oras/package.nix
+++ b/pkgs/by-name/or/oras/package.nix
@@ -9,16 +9,19 @@

 buildGoModule (finalAttrs: {
  pname = "oras";
-  version = "1.3.0";
+  version = "1.3.3";
+
+  # required for tests
+  __darwinAllowLocalNetworking = true;

  src = fetchFromGitHub {
    owner = "oras-project";
    repo = "oras";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-kGPHW+SSmCJhvhGxpzKFlc80sjYqeCEmwr/f0ltILE4=";
+    hash = "sha256-jA9x6Y/+3PZNKbHZbOOg9EJ+APz3jAI6RgHmAa/ykQ4=";
  };

-  vendorHash = "sha256-TDYvYmzAgkL+ZrYKt9HTW7NQAGxd/cYu7e7MRYbW8ho=";
+  vendorHash = "sha256-U+CJPrj404oI51mBTMJqjZEFq265of0K55WRzMhMyOQ=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/pl/plakar/package.nix
+++ b/pkgs/by-name/pl/plakar/package.nix
@@ -3,9 +3,12 @@
  lib,
  buildGo125Module,
  fetchFromGitHub,
+  fetchpatch,
  installShellFiles,
-  fuse,
+  makeBinaryWrapper,
+  fuse3,
 }:
+
 buildGo125Module (finalAttrs: {
  pname = "plakar";
  version = "1.1.4";
@@ -13,6 +16,8 @@ buildGo125Module (finalAttrs: {
  # to avoid having all the Test(Get|Set|Validate)Service.* tests fail on darwin
  __darwinAllowLocalNetworking = true;

+  __structuredAttrs = true;
+
  src = fetchFromGitHub {
    owner = "PlakarKorp";
    repo = "plakar";
@@ -20,14 +25,32 @@ buildGo125Module (finalAttrs: {
    hash = "sha256-Urj1BG3XGhSroaa9pl9NGiKj38J1P+H9sA7noGwIhdc=";
  };

-  vendorHash = "sha256-aqHjSTVVxBbaHAZZNQaFbftN0Hbl/+7wgk5uFM664po=";
+  vendorHash = "sha256-6Y9wzK0NMG/iJMR0eQFu20x4hKidJjwFv3Yx+BVNMTg=";

-  buildInputs = [
-    fuse
+  # Remove in next release
+  patches = [
+    (fetchpatch {
+      name = "fuse3-support.patch";
+      url = "https://github.com/PlakarKorp/plakar/commit/d21d74b653a84806af79129a634b97596cbb00d8.patch";
+      includes = [ "go.mod" ];
+      hash = "sha256-K/Y7DrJJsQaQpQiEpU9OnY8JOMVXnu79L4Qaxsi2xlc=";
+    })
  ];

+  # Remove in next release
+  postPatch = ''
+    substituteInPlace go.sum \
+      --replace-fail \
+        "github.com/anacrolix/fuse v0.3.2 h1:ablJbmHt2BeYGnNrlfXkAcKN96mMMeXZN/ZAqo1AY/o=" \
+        "github.com/anacrolix/fuse v0.3.3-0.20260723023734-9e1272bc0085 h1:9cQ6o8Qv3jbLAJ0a8dQX8ZntDtWY2ESuI3DtqhqWxEs=" \
+      --replace-fail \
+        "github.com/anacrolix/fuse v0.3.2/go.mod h1:vN3X/6E+uHNjg5F8Oy9FD9I+pYxeDWeB8mNjIoxL5ds=" \
+        "github.com/anacrolix/fuse v0.3.3-0.20260723023734-9e1272bc0085/go.mod h1:V14Hqx/K8kb3e6beqqT6reYy25RPP+2Ps3c0vEXoNMA="
+  '';
+
  nativeBuildInputs = [
    installShellFiles
+    makeBinaryWrapper
  ];

  checkFlags =
@@ -35,6 +58,8 @@ buildGo125Module (finalAttrs: {
      skippedTests = [
        # hangs even outside Nix, so probably an upstream issue:
        "TestRebuildStateVersionMismatch"
+        # dry-run fails on any per-file scan error
+        "TestBackupDryRunProducesNoSnapshot"
      ]
      ++ lib.optionals stdenv.hostPlatform.isDarwin [
        "TestBTreeScanMemory"
@@ -46,6 +71,10 @@ buildGo125Module (finalAttrs: {

  postInstall = ''
    installManPage $(find $src -regex '.*\.[0-9]$')
+  ''
+  + lib.optionalString stdenv.hostPlatform.isLinux ''
+    wrapProgram $out/bin/plakar \
+      --suffix PATH : ${lib.makeBinPath [ fuse3 ]}
  '';

  meta = {
--- a/pkgs/by-name/po/poethepoet/package.nix
+++ b/pkgs/by-name/po/poethepoet/package.nix
@@ -6,14 +6,14 @@

 python3.pkgs.buildPythonApplication (finalAttrs: {
  pname = "poethepoet";
-  version = "0.46.0";
+  version = "0.48.0";
  pyproject = true;

  src = fetchFromGitHub {
    owner = "nat-n";
    repo = "poethepoet";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-K2ARb70vTEYdnNOKtUES6n5FPapdq6BFMVg25dTb12U=";
+    hash = "sha256-vxbdNzjPp7Jhfd2XDfjMYQ8iDiaIn6DfL/mCOLdjRtA=";
  };

  nativeBuildInputs = [
--- a/pkgs/by-name/pr/proftpd/package.nix
+++ b/pkgs/by-name/pr/proftpd/package.nix
@@ -19,13 +19,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
  pname = "proftpd";
-  version = "1.3.9c";
+  version = "1.3.9d";

  src = fetchFromGitHub {
    owner = "proftpd";
    repo = "proftpd";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-3Wy5Xm9vynYWmNhoFYtYXCVfAaAMU4kB/ZaRNyRwiQQ=";
+    hash = "sha256-e0E775p8+UdLy9YqdeY5NJGYn8ojWtvOLVAr+UkTEv0=";
  };

  patches = [ ./no-install-user.patch ];
--- a/pkgs/by-name/qe/qemu/package.nix
+++ b/pkgs/by-name/qe/qemu/package.nix
@@ -143,11 +143,11 @@ stdenv.mkDerivation (finalAttrs: {
    + lib.optionalString nixosTestRunner "-for-vm-tests"
    + lib.optionalString toolsOnly "-utils"
    + lib.optionalString userOnly "-user";
-  version = "11.0.3";
+  version = "11.1.0";

  src = fetchurl {
    url = "https://download.qemu.org/qemu-${finalAttrs.version}.tar.xz";
-    hash = "sha256-2l/P/DJ2KCBWi4KO1DCnKIZNNNULbS8wNYWXdgy7BSM=";
+    hash = "sha256-buHRph9oISR2snEIwm2l9EncCbYm1C+CeboNwuCPqFg=";
  };

  depsBuildBuild = [
@@ -258,7 +258,11 @@ stdenv.mkDerivation (finalAttrs: {
  ++ lib.optionals brlttySupport [ brltty ]
  ++ lib.optionals stdenv.hostPlatform.isDarwin [ apple-sdk_15 ];

-  dontUseMesonConfigure = true; # meson's configurePhase isn't compatible with qemu build
+  # QEMU uses Meson and Ninja but still wants Make to be the entrypoint.
+  dontUseMesonConfigure = true;
+  dontUseNinjaBuild = true;
+  dontUseNinjaCheck = true;
+  dontUseNinjaInstall = true;
  dontAddStaticConfigureFlags = true;

  outputs = [ "out" ] ++ lib.optional enableDocs "doc" ++ lib.optional guestAgentSupport "ga";
@@ -304,6 +308,8 @@ stdenv.mkDerivation (finalAttrs: {
    mv VERSION QEMU_VERSION
    substituteInPlace configure \
      --replace-fail '$source_path/VERSION' '$source_path/QEMU_VERSION'
+    substituteInPlace Makefile \
+      --replace-fail '$(SRC_PATH)/VERSION' '$(SRC_PATH)/QEMU_VERSION'
    substituteInPlace meson.build \
      --replace-fail "'VERSION'" "'QEMU_VERSION'"
    substituteInPlace docs/conf.py \
@@ -384,7 +390,6 @@ stdenv.mkDerivation (finalAttrs: {
    # <https://github.com/NixOS/nixpkgs/issues/83667>
    rm -f $out/nix-support/propagated-build-inputs
  '';
-  preBuild = "cd build";

  # tests can still timeout on slower systems
  doCheck = false;
@@ -396,38 +401,29 @@ stdenv.mkDerivation (finalAttrs: {
  preCheck = ''
    # time limits are a little meagre for a build machine that's
    # potentially under load.
-    substituteInPlace ../tests/unit/meson.build \
-      --replace 'timeout: slow_tests' 'timeout: 50 * slow_tests'
-    substituteInPlace ../tests/qtest/meson.build \
-      --replace 'timeout: slow_qtests' 'timeout: 50 * slow_qtests'
-    substituteInPlace ../tests/fp/meson.build \
-      --replace 'timeout: 90)' 'timeout: 300)'
-
-    # point tests towards correct binaries
-    substituteInPlace ../tests/unit/test-qga.c \
-      --replace '/bin/bash' "$(type -P bash)" \
-      --replace '/bin/echo' "$(type -P echo)"
-    substituteInPlace ../tests/unit/test-io-channel-command.c \
-      --replace '/bin/socat' "$(type -P socat)"
+    substituteInPlace tests/unit/meson.build \
+      --replace-fail 'timeout: slow_tests' 'timeout: 50 * slow_tests'
+    substituteInPlace tests/qtest/meson.build \
+      --replace-fail 'timeout: slow_qtests' 'timeout: 50 * slow_qtests'

    # combined with a long package name, some temp socket paths
    # can end up exceeding max socket name len
-    substituteInPlace ../tests/qtest/bios-tables-test.c \
-      --replace 'qemu-test_acpi_%s_tcg_%s' '%s_%s'
+    substituteInPlace tests/qtest/bios-tables-test.c \
+      --replace-fail 'qemu-test_acpi_%s_tcg_%s' '%s_%s'

    # get-fsinfo attempts to access block devices, disallowed by sandbox
    sed -i -e '/\/qga\/get-fsinfo/d' -e '/\/qga\/blacklist/d' \
-      ../tests/unit/test-qga.c
+      tests/unit/test-qga.c

    # xattrs are not allowed in the sandbox
-    substituteInPlace ../tests/qtest/virtio-9p-test.c \
+    substituteInPlace tests/qtest/virtio-9p-test.c \
      --replace-fail mapped-xattr mapped-file
  ''
  + lib.optionalString stdenv.hostPlatform.isDarwin ''
    # skip test that stalls on darwin, perhaps due to subtle differences
    # in fifo behaviour
-    substituteInPlace ../tests/unit/meson.build \
-      --replace "'test-io-channel-command'" "#'test-io-channel-command'"
+    substituteInPlace tests/unit/meson.build \
+      --replace-fail "'test-io-channel-command'" "#'test-io-channel-command'"
  '';

  # Add a ‘qemu-kvm’ wrapper for compatibility/convenience.
--- a/pkgs/by-name/ro/roboto/package.nix
+++ b/pkgs/by-name/ro/roboto/package.nix
@@ -7,12 +7,12 @@

 stdenvNoCC.mkDerivation (finalAttrs: {
  pname = "roboto";
-  version = "3.015";
+  version = "3.016";

  src = fetchzip {
    url = "https://github.com/googlefonts/roboto-3-classic/releases/download/v${finalAttrs.version}/Roboto_v${finalAttrs.version}.zip";
    stripRoot = false;
-    hash = "sha256-vfn4KmOHHSVYT9XK+mDz5f4s8LnkCAY/IyTa3Rmir2k=";
+    hash = "sha256-oIeLqZpdWvqIgnKnQFFLhWkvfuFPKfR2CniOFh5cVdM=";
  };

  nativeBuildInputs = [ installFonts ];
--- a/pkgs/by-name/ru/ruff/package.nix
+++ b/pkgs/by-name/ru/ruff/package.nix
@@ -16,7 +16,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ruff";
-  version = "0.16.2";
+  version = "0.16.3";

  __structuredAttrs = true;

@@ -24,12 +24,12 @@ rustPlatform.buildRustPackage (finalAttrs: {
    owner = "astral-sh";
    repo = "ruff";
    tag = finalAttrs.version;
-    hash = "sha256-V0sIIHt8o39q5sr9PisC/a4t34UW8CYan+zXlI575Cs=";
+    hash = "sha256-BTCsdcZA1XTQbisx1fE9VGwgDNX2ltMzP0yGHocvitA=";
  };

  cargoBuildFlags = [ "--package=ruff" ];

-  cargoHash = "sha256-eM+MdAxx6UqvFSTnUmCk7Nx1MuprrYrv/64Jy90nE0c=";
+  cargoHash = "sha256-2IclEFpxoWq1eSyKSsANuSOqnRDHx8UPNXhCPhsJKM8=";

  nativeBuildInputs = [ installShellFiles ];

--- a/pkgs/by-name/ru/rusthound-ce/package.nix
+++ b/pkgs/by-name/ru/rusthound-ce/package.nix
@@ -10,14 +10,14 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "rusthound-ce";
-  version = "2.4.91";
+  version = "2.5.1";

  src = fetchCrate {
    inherit (finalAttrs) pname version;
-    hash = "sha256-mOmTBj/NqWqsc3JfpD8vmafevWpaHTnwqM3wuKwxlxc=";
+    hash = "sha256-7t1YEgBKDFkkF1fnPsUvB9+y3GQaaBI3ywvNTbZmgZA=";
  };

-  cargoHash = "sha256-paMTih5b1RxmXUEjglnj4Hy6SRJE78m1FQP4lags6yo=";
+  cargoHash = "sha256-2UAANogFKAAe7/VY0G8o7frPFmxfEPACDC0bdv9Zb6w=";

  nativeBuildInputs = [
    pkg-config
--- a/pkgs/by-name/sa/sandbox-runtime/package.nix
+++ b/pkgs/by-name/sa/sandbox-runtime/package.nix
@@ -17,7 +17,7 @@

 buildNpmPackage (finalAttrs: {
  pname = "sandbox-runtime";
-  version = "0.0.71";
+  version = "0.0.73";

  __structuredAttrs = true;

@@ -25,7 +25,7 @@ buildNpmPackage (finalAttrs: {
    owner = "anthropic-experimental";
    repo = "sandbox-runtime";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-0qM0+IWrL7/5VLGVCzV9cclGFFv3IF2sRwEOslzNJiE=";
+    hash = "sha256-dOncsjSmkWjF5TC+BhjmqlPgZLdVSjfP7RrSzPqzRdE=";
  };

  postPatch =
@@ -37,7 +37,7 @@ buildNpmPackage (finalAttrs: {

  strictDeps = true;

-  npmDepsHash = "sha256-h9Y30CZktOoUGD0BZ86uzADt3+WWITT3Y09HOQoc0NA=";
+  npmDepsHash = "sha256-JYDqFC6OaU+uqOuQtObmoTp/JfwXv2uP6ZmC4wJcv2w=";

  postFixup =
    let
--- a/pkgs/by-name/sh/shopware-cli/package.nix
+++ b/pkgs/by-name/sh/shopware-cli/package.nix
@@ -11,12 +11,12 @@

 buildGoModule (finalAttrs: {
  pname = "shopware-cli";
-  version = "0.16.10";
+  version = "0.17.0";
  src = fetchFromGitHub {
    repo = "shopware-cli";
    owner = "shopware";
    tag = finalAttrs.version;
-    hash = "sha256-CVhzHoEMiR3t62CyMwUiKnTOrJoD0BLST985M86YTIY=";
+    hash = "sha256-VEpQUHEmShrTu+SCZh32X8f2vq7irv+lUOrZ9jZpY8c=";
  };

  nativeBuildInputs = [
@@ -28,7 +28,7 @@ buildGoModule (finalAttrs: {
    dart-sass
  ];

-  vendorHash = "sha256-SaNTxH2H+XtsnAvXF+CvVA3N5C+dP26VjJU4rxLO5Bk=";
+  vendorHash = "sha256-Nsvoqp+Wvf2ZCwb8C+TavpBsVrMTlGwR19fjks0Y2Gs=";

  postInstall = lib.optionalString (stdenv.buildPlatform.canExecute stdenv.hostPlatform) ''
    installShellCompletion --cmd shopware-cli \
--- a/pkgs/by-name/si/sigma-cli/package.nix
+++ b/pkgs/by-name/si/sigma-cli/package.nix
@@ -26,13 +26,13 @@ python3.pkgs.buildPythonApplication (finalAttrs: {
    colorama
    prettytable
    pysigma
+    pysigma-backend-crowdstrike
    pysigma-backend-elasticsearch
    pysigma-backend-insightidr
+    pysigma-backend-loki
    pysigma-backend-opensearch
    pysigma-backend-qradar
    pysigma-backend-splunk
-    pysigma-backend-loki
-    pysigma-pipeline-crowdstrike
    pysigma-pipeline-sysmon
    pysigma-pipeline-windows
  ];
--- a/pkgs/by-name/sl/slackdump/package.nix
+++ b/pkgs/by-name/sl/slackdump/package.nix
@@ -9,13 +9,13 @@

 buildGoModule (finalAttrs: {
  pname = "slackdump";
-  version = "4.3.0";
+  version = "4.4.3";

  src = fetchFromGitHub {
    owner = "rusq";
    repo = "slackdump";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-Ds3nggx1f389goOWelYXNviFRZ/h4XX54LgtU9oqklc=";
+    hash = "sha256-mIgdUxNrWBlqKiPJmp8mHRnvRd+2z9iNbelIre53Y6A=";
  };

  nativeCheckInputs = lib.optional stdenv.hostPlatform.isDarwin darwin.IOKitTools;
@@ -35,7 +35,7 @@ buildGoModule (finalAttrs: {
      "-skip=^${builtins.concatStringsSep "$|^" skippedTests}$"
    ];

-  vendorHash = "sha256-fRvtdl0+uVhN6cQJxRsOw1vQsrcsPvcn/Tb7US7MKmM=";
+  vendorHash = "sha256-U/Ib5IiROPiKgczz1af2R6DQi+6xxfRIu/cF3ZDkc8E=";

  __darwinAllowLocalNetworking = true;

--- a/pkgs/by-name/sv/sv-lang_10/package.nix
+++ b/pkgs/by-name/sv/sv-lang_10/package.nix
@@ -36,14 +36,10 @@ stdenv.mkDerivation (finalAttrs: {
      'set(mimalloc_min_version "2.2")' \
      'set(mimalloc_min_version "${lib.versions.majorMinor mimalloc.version}")'
  ''
-  # fmt 12 moved fmt::format's declaration out of the lightweight
-  # fmt/core.h into fmt/format.h (format.h is a strict superset, so this
-  # is safe everywhere it's used). Same fix as upstream slang applied for
-  # 11.0 (commit 5a898b4b9225d281902fcd59fe4732b1561677d2), backported here
-  # since nixpkgs pins slang 10.0 specifically for circt.
+  # fmt 12 moved fmt::format out of fmt/core.h into fmt/format.h
  + ''
-    grep -rl '#include <fmt/core.h>' --include='*.h' --include='*.cpp' . | \
-      xargs sed -i 's|#include <fmt/core.h>|#include <fmt/format.h>|'
+    substituteInPlace $(grep -rl '#include <fmt/core.h>' --include='*.cpp' --include='*.h' .) \
+      --replace-fail '#include <fmt/core.h>' '#include <fmt/format.h>'
  '';

  cmakeFlags = [
--- a/pkgs/by-name/sv/sv-lang_9/package.nix
+++ b/pkgs/by-name/sv/sv-lang_9/package.nix
@@ -27,6 +27,11 @@ stdenv.mkDerivation (finalAttrs: {
    substituteInPlace external/CMakeLists.txt --replace-fail \
      'set(mimalloc_min_version "2.2")' \
      'set(mimalloc_min_version "${lib.versions.majorMinor mimalloc.version}")'
+  ''
+  # fmt 12 moved fmt::format out of fmt/core.h into fmt/format.h
+  + ''
+    substituteInPlace $(grep -rl '#include <fmt/core.h>' --include='*.cpp' --include='*.h' .) \
+      --replace-fail '#include <fmt/core.h>' '#include <fmt/format.h>'
  '';

  cmakeFlags = [
--- a/pkgs/by-name/sy/syswatch/package.nix
+++ b/pkgs/by-name/sy/syswatch/package.nix
@@ -7,18 +7,18 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "syswatch";
-  version = "0.8.0";
+  version = "0.9.0";

  src = fetchFromGitHub {
    owner = "matthart1983";
    repo = "syswatch";
    tag = "v${finalAttrs.version}";
-    hash = "sha256-XB2m+gMzcRV2VgOpl4AdP/P/WdGXYMJdOsLg5ceRAYY=";
+    hash = "sha256-jGVgp4K51saPkbQDV798asCGqc/zhO5vJjbOuXtFWpE=";
  };

  __structuredAttrs = true;

-  cargoHash = "sha256-NmFCDu6RKrDIBxGsH+HyO0cKfd/XSQIXXKqRa4SGI1E=";
+  cargoHash = "sha256-VfwNasoraA/OqsvhIWzAw/DLc+bwSU3Wgla3xuqh0AE=";

  nativeCheckInputs = [ versionCheckHook ];

--- a/pkgs/by-name/te/teamviewer/package.nix
+++ b/pkgs/by-name/te/teamviewer/package.nix
@@ -29,7 +29,7 @@ stdenv.mkDerivation (finalAttrs: {
    "out"
    "dev"
  ];
-  version = "15.78.3";
+  version = "15.80.4";

  src =
    let
@@ -38,11 +38,11 @@ stdenv.mkDerivation (finalAttrs: {
    {
      x86_64-linux = fetchurl {
        url = "${base_url}/teamviewer_${finalAttrs.version}_amd64.deb";
-        hash = "sha256-wrmLIr8qNLvfW5MMj6faF/uhldg9Dj+eDmlckEOqnmo=";
+        hash = "sha256-nF6c3E5+xAAi0oIXawT5JVgajCn1kHXgLy7VXG9XD4I=";
      };
      aarch64-linux = fetchurl {
        url = "${base_url}/teamviewer_${finalAttrs.version}_arm64.deb";
-        hash = "sha256-RAPTxDs6jcMar74M25+j/gzIt0B1JnF+mOVROO98h0k=";
+        hash = "sha256-oAXD6ngt9/wuw0Dih5oFsV4e2W8qBFVD4JgubITuQLE=";
      };
    }
    .${stdenv.hostPlatform.system} or (throw "Unsupported system: ${stdenv.hostPlatform.system}");
--- a/pkgs/by-name/to/todoist-cli/package.nix
+++ b/pkgs/by-name/to/todoist-cli/package.nix
@@ -7,16 +7,16 @@
 }:
 buildNpmPackage rec {
  pname = "todoist-cli";
-  version = "3.1.5";
+  version = "3.1.8";

  src = fetchFromGitHub {
    owner = "Doist";
    repo = "todoist-cli";
    rev = "v${version}";
-    sha256 = "sha256-tCrcR5g26xUlx7Nd6PUooIiZnBRUcrP2GD4aiPRWlp0=";
+    sha256 = "sha256-aJfAyYkevgBX2+BhVhaYCXA4HEwNkZ5axMAbd7D/se0=";
  };

-  npmDepsHash = "sha256-osvdOfZtYhtl8DcfaKFjk2mxYq4STanvbmIy4ZHCbSE=";
+  npmDepsHash = "sha256-99kXulw63VumKlbefi4T0lnkRZs8e9TH9v4vFOvH18Y=";

  doCheck = true;

--- a/pkgs/by-name/ts/ts/package.nix
+++ b/pkgs/by-name/ts/ts/package.nix
@@ -7,7 +7,7 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "ts";
-  version = "1.0.3";
+  version = "1.0.4";

  installPhase = ''make install "PREFIX=$out"'';

@@ -17,7 +17,7 @@ stdenv.mkDerivation (finalAttrs: {

  src = fetchurl {
    url = "https://viric.name/~viric/soft/ts/ts-${finalAttrs.version}.tar.gz";
-    sha256 = "sha256-+oMzEVQ9xTW2DLerg8ZKte4xEo26qqE93jQZhOVCtCg=";
+    sha256 = "sha256-sas9tS3KNq82mReLjQ6TajAQf41chql0FjxYCCOwF5A=";
  };

  meta = {
--- a/pkgs/by-name/ty/ty/package.nix
+++ b/pkgs/by-name/ty/ty/package.nix
@@ -17,7 +17,7 @@

 rustPlatform.buildRustPackage (finalAttrs: {
  pname = "ty";
-  version = "0.0.70";
+  version = "0.0.72";
  __structuredAttrs = true;

  src = fetchFromGitHub {
@@ -25,7 +25,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
    repo = "ty";
    tag = finalAttrs.version;
    fetchSubmodules = true;
-    hash = "sha256-rlhU/987KaTAXukZDUDY0XyDUQiC6qHGIXS2epg6ziI=";
+    hash = "sha256-UkPu9lr0DiC0TjE3TqniphnbrVFCCeAyc6M2fysRuwI=";
  };

  # For Darwin platforms, remove the integration test for file notifications,
@@ -39,7 +39,7 @@ rustPlatform.buildRustPackage (finalAttrs: {

  cargoBuildFlags = [ "--package=ty" ];

-  cargoHash = "sha256-eM+MdAxx6UqvFSTnUmCk7Nx1MuprrYrv/64Jy90nE0c=";
+  cargoHash = "sha256-ZSIuwo+vA+k99xZbWh1Bpn/A/rlBPHRHGOuXmEVGVH4=";

  nativeBuildInputs = [ installShellFiles ];
  buildInputs = [ rust-jemalloc-sys ];
--- a/pkgs/by-name/un/unifont/package.nix
+++ b/pkgs/by-name/un/unifont/package.nix
@@ -42,9 +42,26 @@ stdenv.mkDerivation (finalAttrs: {

  buildFlags = [ "BUILDFONT=1" ];

+  # The `sample` variants are not intended for general use.
+  #
+  # From the 2013 changelog:
+  #
+  # > These "Unifont Sample" fonts contain combining circles, and four-digit
+  # > hexadecimal glyphs for unassigned code points and Private Use Area glyphs.
+  # > Because of the inclusion of combining cirlces, "Unifont Sample" font
+  # > versions are only intended for illustrating individual glyphs, not for
+  # > general-purpose writing.
  postInstall = ''
    moveToOutput bin "$bin"
    moveToOutput share/unifont "$doc"
+
+    # Move `sample` into its own output.
+    mkdir -vp "$sample/share/fonts/X11/misc/"
+    mkdir -vp "$sample/share/fonts/opentype/unifont/"
+    mv -vt "$sample/share/fonts/X11/misc/" \
+      "$out"/share/fonts/X11/misc/*_sample.*
+    mv -vt "$sample/share/fonts/opentype/unifont/" \
+      "$out"/share/fonts/opentype/unifont/*_sample.*
  '';

  outputs = [
@@ -53,8 +70,12 @@ stdenv.mkDerivation (finalAttrs: {
    "doc"
    "man"
    "info"
+    "sample"
  ];

+  # Don't bloat the font output with tools
+  propagatedBuildOutputs = [ ];
+
  passthru.updateScript = ./update.sh;

  meta = {
--- a/pkgs/by-name/vi/vikunja/package.nix
+++ b/pkgs/by-name/vi/vikunja/package.nix
@@ -1,5 +1,6 @@
 {
  lib,
+  callPackage,
  fetchFromGitHub,
  stdenv,
  nodejs_24,
@@ -11,6 +12,7 @@
  dart-sass,
  writeShellScriptBin,
  nixosTests,
+  nix-update-script,
 }:

 let
@@ -82,7 +84,7 @@ let
      }' ${file}
    '';
 in
-buildGoModule {
+buildGoModule (finalAttrs: {
  inherit src version;
  pname = "vikunja";

@@ -105,6 +107,7 @@ buildGoModule {
  vendorHash = "sha256-bn+bcGzeB0/KkhPNkbjK/EgKQG3iqVlJxtt6betGUNE=";

  inherit frontend;
+  veans = callPackage ./veans.nix { inherit (finalAttrs) src version meta; };

  prePatch = ''
    cp -r ${frontend} frontend/dist
@@ -143,7 +146,14 @@ buildGoModule {
  passthru = {
    tests.vikunja = nixosTests.vikunja;
    frontend = frontend;
-    updateScript = ./update.sh;
+    updateScript = nix-update-script {
+      extraArgs = [
+        "--subpackage"
+        "frontend"
+        "--subpackage"
+        "veans"
+      ];
+    };
  };

  meta = {
@@ -158,4 +168,4 @@ buildGoModule {
    mainProgram = "vikunja";
    platforms = lib.platforms.linux;
  };
-}
+})
--- a/pkgs/by-name/vi/vikunja/update.sh
+++ b/pkgs/by-name/vi/vikunja/update.sh
@@ -1,53 +0,0 @@
-#!/usr/bin/env nix-shell
-#!nix-shell -i bash -p nix wget jq nurl
-
-# shellcheck shell=bash
-
-set -euo pipefail
-
-if [[ $# -gt 1 || "${1:-}" == -* ]]; then
-    echo "Regenerates packaging data for the vikunja package."
-    echo "Usage: $0 [version]"
-    exit 1
-fi
-
-version="${1:-}"
-
-NIXPKGS_ROOT="$(git rev-parse --show-toplevel)"
-
-if [ -z "$version" ]; then
-    TOKEN_ARGS=()
-    if [ -n "${GITHUB_TOKEN:-}" ]; then
-        TOKEN_ARGS=(--header "Authorization: token $GITHUB_TOKEN")
-    fi
-    version="$(wget -q -O- ${TOKEN_ARGS[@]+"${TOKEN_ARGS[@]}"} "https://api.github.com/repos/go-vikunja/vikunja/releases?per_page=10" | jq -r '[.[] | select(.prerelease == false)][0].tag_name')"
-fi
-
-# strip leading "v"
-version="${version#v}"
-
-cd "$(dirname "$0")"
-
-# Update version, blank out all hashes so nurl can recompute them
-sed -i -E 's#version = ".*"#version = "'"$version"'"#' package.nix
-sed -i -E '/fetchFromGitHub \{/,/\};/ s#hash = ".*"#hash = ""#' package.nix
-sed -i -E '/fetchPnpmDeps \{/,/\};/ s#hash = ".*"#hash = ""#' package.nix
-sed -i -E 's#vendorHash = ".*"#vendorHash = ""#' package.nix
-
-# Source hash (must be computed first, pnpm and vendor depend on it)
-src_hash=$(nurl -e "(import $NIXPKGS_ROOT/. { }).vikunja.src")
-sed -i -E '/fetchFromGitHub \{/,/\};/ s#hash = ".*"#hash = "'"$src_hash"'"#' package.nix
-
-# pnpm dependencies hash for frontend
-pnpm_hash=$(nurl -e "(import $NIXPKGS_ROOT/. { }).vikunja.frontend.pnpmDeps")
-sed -i -E '/fetchPnpmDeps \{/,/\};/ s#hash = ".*"#hash = "'"$pnpm_hash"'"#' package.nix
-
-# Go modules vendor hash
-vendor_hash=$(nurl -e "(import $NIXPKGS_ROOT/. { }).vikunja.goModules")
-sed -i -E 's#vendorHash = ".*"#vendorHash = "'"$vendor_hash"'"#' package.nix
-
-echo "Update complete!"
-echo "Version: $version"
-echo "Source hash: $src_hash"
-echo "Frontend pnpm hash: $pnpm_hash"
-echo "Go vendor hash: $vendor_hash"
--- a/pkgs/by-name/vi/vikunja/veans.nix
+++ b/pkgs/by-name/vi/vikunja/veans.nix
@@ -0,0 +1,34 @@
+{
+  meta,
+  src,
+  version,
+
+  buildGoModule,
+}:
+
+buildGoModule (finalAttrs: {
+  pname = "veans";
+  inherit src version;
+
+  __structuredAttrs = true;
+
+  modRoot = "veans";
+
+  vendorHash = "sha256-4Ayug+r7sWL/JZI8fGCyDZ1SaTwCvSWrQpqv7uYCHhc=";
+
+  env.CGO_ENABLED = 0;
+
+  ldflags = [
+    "-s"
+    "-X main.version=v${finalAttrs.version}"
+  ];
+
+  # needs a running vikunja instance
+  doCheck = false;
+
+  meta = meta // {
+    description = "A beans-shaped CLI for Vikunja";
+    homepage = "https://vikunja.io/docs/veans/";
+    mainProgram = "veans";
+  };
+})
--- a/pkgs/by-name/vo/vokoscreen-ng/package.nix
+++ b/pkgs/by-name/vo/vokoscreen-ng/package.nix
@@ -13,13 +13,13 @@

 stdenv.mkDerivation (finalAttrs: {
  pname = "vokoscreen-ng";
-  version = "4.9.0";
+  version = "4.10.0";

  src = fetchFromGitHub {
    owner = "vkohaupt";
    repo = "vokoscreenNG";
    tag = finalAttrs.version;
-    hash = "sha256-ncN5ZKPd//yE+HKBzVud1Xw+2qHmw2bRNWHdMpVcGlw=";
+    hash = "sha256-Sp6MHX9+VHdWEG/lspoTnJCPr+J3rAHgSPgvTR+xqqQ=";
  };

  qmakeFlags = [ "src/vokoscreenNG.pro" ];
--- a/pkgs/by-name/we/wealthfolio-server/package.nix
+++ b/pkgs/by-name/we/wealthfolio-server/package.nix
@@ -28,7 +28,7 @@ rustPlatform.buildRustPackage (

        pnpm = pnpm_10;
        fetcherVersion = 3;
-        hash = "sha256-fryLXUVzyDT1jOuS5sIf9kpCJ40oHaxFRJFKMrn7EGs=";
+        hash = "sha256-D83YrsSVNUfiyX4CTV9BOlQhP3tCvQsubaJecXCP/5Q=";
      };

      nativeBuildInputs = [
@@ -54,18 +54,18 @@ rustPlatform.buildRustPackage (
    __structuredAttrs = true;

    pname = "wealthfolio-server";
-    version = "3.6.2";
+    version = "3.6.3";

    src = fetchFromGitHub {
      owner = "wealthfolio";
      repo = "wealthfolio";
      tag = "v${finalAttrs.version}";
-      hash = "sha256-2Chwr7OifQ5PgRAnxDEeAxyYaxVQqS32mezqzUBKKyU=";
+      hash = "sha256-QUie1MpYOY9B50vcL8GanPgQpj4jMh9yzmDxjcY5dW4=";
    };

    cargoRoot = ".";
    buildAndTestSubdir = "apps/server";
-    cargoHash = "sha256-pfUrfIZmuibjFYzcuh57WU/pTlXFZNWYgurNYn+Wvus=";
+    cargoHash = "sha256-UC+NhMuDisVjdZ8n25oKixosS6NLU7w9VVl7e2LtjK0=";

    nativeBuildInputs = [ makeWrapper ];

--- a/pkgs/by-name/xo/xorg-server/package.nix
+++ b/pkgs/by-name/xo/xorg-server/package.nix
@@ -176,9 +176,6 @@ stdenv.mkDerivation (finalAttrs: {
      --subst-var-by XQUARTZ_APP "$out/Applications/XQuartz.app"
  '';

-  # avoid linux rebuilds
-  ${if stdenv.hostPlatform.isDarwin then "hardeningDisable" else null} = [ "strictflexarrays1" ];
-
  # default X install symlinks this to Xorg, we want XQuartz
  postInstall = lib.optionalString stdenv.hostPlatform.isDarwin ''
    ln -sf $out/bin/Xquartz $out/bin/X
--- a/Show More
+++ b/Show More