From d5797cb22d791697ebe1341b720669be295a5d2f Mon Sep 17 00:00:00 2001
From: Makuru <Makuru@Makuru.org>
Date: Tue, 19 May 2026 14:47:00 +0200
Subject: [PATCH 01/61] kicad: 10.0.2 -> 10.0.3

(cherry picked from commit 25dd50acb75341a140631addc1b1477db649aa8b)
---
 pkgs/by-name/ki/kicad/versions.nix | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/pkgs/by-name/ki/kicad/versions.nix b/pkgs/by-name/ki/kicad/versions.nix
index d937edc0a41e..24a323e95c2c 100644
--- a/pkgs/by-name/ki/kicad/versions.nix
+++ b/pkgs/by-name/ki/kicad/versions.nix
@@ -3,22 +3,22 @@
 {
   "kicad" = {
     kicadVersion = {
-      version = "10.0.2";
+      version = "10.0.3";
       src = {
-        rev = "94c02dfc4a778a094cd8ad7b1d2348a96f024123";
-        sha256 = "0bk86javsfm1mwlksnv8p7pws5ii3zag6aah13gn5zlc31z295yh";
+        rev = "1d69e55fc60915f8f1569c9f6522d9b0fb5a0ba8";
+        sha256 = "0ldaj072x16452xw2wszbk20g932rz36zappjrxc4m6ygx298aa3";
       };
     };
     libVersion = {
-      version = "10.0.2";
+      version = "10.0.3";
       libSources = {
-        symbols.rev = "f31042c9759771f10754f02e54344dee750692b1";
+        symbols.rev = "299c330ab364cfc3989d1ab6e82f1eabb9ddd915";
         symbols.sha256 = "05h8dbygch2kp4s5ikspxngwv999j7jwsiwm4pzwwcrir7dqzdfl";
-        templates.rev = "db5a3e2a99d5200cabfb03199fe28a5f3ba59191";
+        templates.rev = "a7e1a3ae6255d8d9aaff13e58adf3a0d78cb90c9";
         templates.sha256 = "0zs29zn8qjgxv0w1vyr8yxmj02m8752zagn4vcraqgik46dwg2id";
-        footprints.rev = "c076368c29f8f5c3ad2ee7ed91083815b79ddb72";
-        footprints.sha256 = "1h1v44qc5lvvqvmi1i7b79jhxsfq8snk0mcfl6r73hj6w0b25l84";
-        packages3d.rev = "3720ad929a99187fc55a8d35895672ef9aaf9cb7";
+        footprints.rev = "fe0ca39d34a10036f2b6ccb9749a39bc3fa7af95";
+        footprints.sha256 = "0wdzsn7z11wc5yskk576a4a6qfagsvw0y6r034inxrnfc32aiah9";
+        packages3d.rev = "c955b94c7bdeffd94b06bac86d94588a9be03afe";
         packages3d.sha256 = "01nbjcs3890hyfmafc623ldmfi9n8sjr5m0wripz5fq5fjdnzqxl";
       };
     };

From ca57ca7d33fb283ed85e52cc83b52620ce9ad012 Mon Sep 17 00:00:00 2001
From: Thomas Butter <tbutter@gmail.com>
Date: Mon, 25 May 2026 10:28:34 +0000
Subject: [PATCH 02/61] alliance: unbreak

(cherry picked from commit a2e94ff957e4317cf3190e2ba312bbee28199047)
---
 pkgs/by-name/al/alliance/package.nix | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/pkgs/by-name/al/alliance/package.nix b/pkgs/by-name/al/alliance/package.nix
index 1e2147b38558..f5ce44ec2f59 100644
--- a/pkgs/by-name/al/alliance/package.nix
+++ b/pkgs/by-name/al/alliance/package.nix
@@ -48,7 +48,7 @@ stdenv.mkDerivation (finalAttrs: {
   ];
 
   # To avoid compiler error in LoadDataBase.c:366:27
-  env.NIX_CFLAGS_COMPILE = "-Wno-incompatible-pointer-types";
+  env.NIX_CFLAGS_COMPILE = "-std=gnu99 -Wno-incompatible-pointer-types";
 
   postPatch = ''
     # texlive for docs seems extreme
@@ -77,6 +77,5 @@ stdenv.mkDerivation (finalAttrs: {
     license = with lib.licenses; gpl2Plus;
     maintainers = [ ];
     platforms = with lib.platforms; linux;
-    broken = true;
   };
 })

From 0d052627a43692c6ef10835ab85f853505331662 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Fri, 22 May 2026 09:47:45 +0000
Subject: [PATCH 03/61] python3Packages.flask-security: 5.8.0 -> 5.8.1

(cherry picked from commit 579885fa4e3fa0d5fe53c1e261e446e49f11a7e4)
---
 pkgs/development/python-modules/flask-security/default.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/python-modules/flask-security/default.nix b/pkgs/development/python-modules/flask-security/default.nix
index 40fde723c6ed..d715cd322f53 100644
--- a/pkgs/development/python-modules/flask-security/default.nix
+++ b/pkgs/development/python-modules/flask-security/default.nix
@@ -51,14 +51,14 @@
 
 buildPythonPackage rec {
   pname = "flask-security";
-  version = "5.8.0";
+  version = "5.8.1";
   pyproject = true;
 
   src = fetchFromGitHub {
     owner = "pallets-eco";
     repo = "flask-security";
     tag = version;
-    hash = "sha256-ocHxrcdwO4nvpwMJUhT6TYmzPt7V3nkmES3HdxBkzyQ=";
+    hash = "sha256-xNWgLIk/AB5beZQX7jzh8uQ9o0Gq+W5rgowBS215pk4=";
   };
 
   build-system = [ flit-core ];

From eafcb0c23482f623c260bae66fe5685920a368fc Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Mon, 25 May 2026 02:23:23 +0200
Subject: [PATCH 04/61] shogihome: remove workaround

(cherry picked from commit b038c3cd5bac8c5ae70219ae9c2f0c51891d6030)
---
 pkgs/by-name/sh/shogihome/package.nix | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

diff --git a/pkgs/by-name/sh/shogihome/package.nix b/pkgs/by-name/sh/shogihome/package.nix
index 686c84ed90c3..df92032feb84 100644
--- a/pkgs/by-name/sh/shogihome/package.nix
+++ b/pkgs/by-name/sh/shogihome/package.nix
@@ -5,7 +5,6 @@
   fetchFromGitHub,
   makeWrapper,
   electron_40,
-  vulkan-loader,
   makeDesktopItem,
   copyDesktopItems,
   commandLineArgs ? [ ],
@@ -67,17 +66,12 @@ buildNpmPackage (finalAttrs: {
 
     cp -r ${electron.dist} electron-dist
     chmod -R u+w electron-dist
-  ''
-  # Electron builder complains about symlink in electron-dist
-  + lib.optionalString stdenv.hostPlatform.isLinux ''
-    rm electron-dist/libvulkan.so.1
-    cp '${lib.getLib vulkan-loader}/lib/libvulkan.so.1' electron-dist
-  ''
-  # Explicitly set identity to null to avoid signing on arm64 macs with newer electron-builder.
-  # See: https://github.com/electron-userland/electron-builder/pull/9007
-  + ''
+
     npm run electron:pack
 
+    # Explicitly set identity to null to avoid signing on arm64 macs with newer electron-builder.
+    # See: https://github.com/electron-userland/electron-builder/pull/9007
+
     ./node_modules/.bin/electron-builder \
         --dir \
         --config .electron-builder.config.mjs \

From 569245217095f1a74c8bc9ef4a0e0bb9b5115602 Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Mon, 25 May 2026 02:23:13 +0200
Subject: [PATCH 05/61] teams-for-linux: don't place electronDist in cwd

(cherry picked from commit 6aee68d36492713cc56399a0a597e115ef606269)
---
 pkgs/by-name/te/teams-for-linux/package.nix | 15 ++++-----------
 1 file changed, 4 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/te/teams-for-linux/package.nix b/pkgs/by-name/te/teams-for-linux/package.nix
index 5476e70d977e..d412e0435433 100644
--- a/pkgs/by-name/te/teams-for-linux/package.nix
+++ b/pkgs/by-name/te/teams-for-linux/package.nix
@@ -10,7 +10,6 @@
   makeWrapper,
   nix-update-script,
   versionCheckHook,
-  vulkan-loader,
   which,
 }:
 
@@ -46,21 +45,15 @@ buildNpmPackage rec {
   buildPhase = ''
     runHook preBuild
 
-    cp -r ${electron_41.dist} electron-dist
-    chmod -R u+w electron-dist
-  ''
-  # Electron builder complains about symlink in electron-dist
-  + lib.optionalString stdenv.hostPlatform.isLinux ''
-    rm electron-dist/libvulkan.so.1
-    cp ${lib.getLib vulkan-loader}/lib/libvulkan.so.1 electron-dist
-  ''
-  + ''
+    electron_dist="$(mktemp -d)"
+    cp -r ${electron_41.dist}/. "$electron_dist"
+    chmod -R u+w "$electron_dist"
 
     npm exec electron-builder -- \
         --dir \
         -c.npmRebuild=true \
         -c.asarUnpack="**/*.node" \
-        -c.electronDist=electron-dist \
+        -c.electronDist="$electron_dist" \
         -c.electronVersion=${electron_41.version} \
         -c.mac.identity=null
 

From 40b4cb9eeb4985f79e071cf5f3c876e3250c5382 Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Mon, 25 May 2026 03:27:57 +0200
Subject: [PATCH 06/61] caprine: don't place electronDist in cwd

(cherry picked from commit c4f908d08e8844d1318d47fc1ba157ea00487d82)
---
 pkgs/by-name/ca/caprine/package.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ca/caprine/package.nix b/pkgs/by-name/ca/caprine/package.nix
index 18161241ebc4..cd32fdc09816 100644
--- a/pkgs/by-name/ca/caprine/package.nix
+++ b/pkgs/by-name/ca/caprine/package.nix
@@ -27,14 +27,15 @@ buildNpmPackage rec {
   nativeBuildInputs = [ copyDesktopItems ];
 
   postBuild = ''
-    cp -r ${electron.dist} electron-dist
-    chmod -R u+w electron-dist
+    electron_dist="$(mktemp -d)"
+    cp -r ${electron.dist}/. "$electron_dist"
+    chmod -R u+w "$electron_dist"
 
     npm exec electron-builder -- \
         --dir \
         -c.npmRebuild=true \
         -c.asarUnpack="**/*.node" \
-        -c.electronDist=electron-dist \
+        -c.electronDist="$electron_dist" \
         -c.electronVersion=${electron.version}
   '';
 

From 770ec36f45a0de8b072d9cff07b0f21c72f57865 Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Mon, 25 May 2026 02:48:10 +0200
Subject: [PATCH 07/61] mqtt-explorer: don't place electronDist in cwd

(cherry picked from commit d9dc678568082d1fb1683d34d1b65ee71a347320)
---
 pkgs/by-name/mq/mqtt-explorer/package.nix | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/pkgs/by-name/mq/mqtt-explorer/package.nix b/pkgs/by-name/mq/mqtt-explorer/package.nix
index e5a0d9c9dbfa..1f09774684f6 100644
--- a/pkgs/by-name/mq/mqtt-explorer/package.nix
+++ b/pkgs/by-name/mq/mqtt-explorer/package.nix
@@ -86,8 +86,9 @@ stdenv.mkDerivation rec {
 
     patchShebangs {node_modules,app/node_modules,backend/node_modules}
 
-    cp -r ${electron.dist} electron-dist
-    chmod -R u+w electron-dist
+    electron_dist="$(mktemp -d)"
+    cp -r ${electron.dist}/. "$electron_dist"
+    chmod -R u+w "$electron_dist"
 
     runHook postConfigure
   '';
@@ -98,7 +99,7 @@ stdenv.mkDerivation rec {
     tsc && cd app && yarn --offline run build && cd ..
 
     yarn --offline run electron-builder --dir \
-      -c.electronDist=electron-dist \
+      -c.electronDist="$electron_dist" \
       -c.electronVersion=${electron.version}
 
     runHook postBuild
@@ -143,7 +144,7 @@ stdenv.mkDerivation rec {
   doCheck = true;
 
   checkPhase = ''
-    export ELECTRON_OVERRIDE_DIST_PATH=electron-dist/
+    export ELECTRON_OVERRIDE_DIST_PATH="$electron_dist"
 
     yarn test:app --offline
     yarn test:backend --offline

From 0601d867a9e9ce2483b4303ef59b584c99387a4e Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Mon, 25 May 2026 02:22:47 +0200
Subject: [PATCH 08/61] repath-studio: don't place electronDist in cwd

(cherry picked from commit ceba9e30446806827483c67e3b94cf434d55bd46)
---
 pkgs/by-name/re/repath-studio/package.nix | 20 ++++++--------------
 1 file changed, 6 insertions(+), 14 deletions(-)

diff --git a/pkgs/by-name/re/repath-studio/package.nix b/pkgs/by-name/re/repath-studio/package.nix
index f4560fed21e6..4502ba2dc6c9 100644
--- a/pkgs/by-name/re/repath-studio/package.nix
+++ b/pkgs/by-name/re/repath-studio/package.nix
@@ -16,8 +16,6 @@
   makeWrapper,
   replaceVars,
 
-  vulkan-loader,
-
   nixosTests,
 }:
 buildNpmPackage (finalAttrs: {
@@ -72,19 +70,13 @@ buildNpmPackage (finalAttrs: {
   buildPhase = ''
     runHook preBuild
 
-    # electronDist needs to be modifiable
-    cp -r ${electron.dist} electron-dist
-    chmod -R u+w electron-dist
-  ''
-  # Electron builder complains about symlink in electron-dist
-  + lib.optionalString stdenv.hostPlatform.isLinux ''
-    rm electron-dist/libvulkan.so.1
-    cp ${lib.getLib vulkan-loader}/lib/libvulkan.so.1 electron-dist
-  ''
-  + ''
+    electron_dist="$(mktemp -d)"
+    cp -r ${electron.dist}/. "$electron_dist"
+    chmod -R u+w "$electron_dist"
+
     npm run build
     npm exec electron-builder -- --dir \
-      -c.electronDist=electron-dist \
+      -c.electronDist="$electron_dist" \
       -c.electronVersion=${electron.version}
 
     runHook postBuild
@@ -123,7 +115,7 @@ buildNpmPackage (finalAttrs: {
   doCheck = stdenv.hostPlatform.isLinux;
   checkPhase = ''
     runHook preCheck
-    export ELECTRON_OVERRIDE_DIST_PATH=electron-dist/
+    export ELECTRON_OVERRIDE_DIST_PATH="$electron_dist"
     export PUPPETEER_EXECUTABLE_PATH=${chromium}/bin/chromium
     export CHROME_BIN=${chromium}/bin/chromium
     npm run test

From ecd15da62ecd6c3d5018d13f8e1c7731bf41b925 Mon Sep 17 00:00:00 2001
From: TomaSajt <62384384+TomaSajt@users.noreply.github.com>
Date: Mon, 25 May 2026 03:45:45 +0200
Subject: [PATCH 09/61] ivpn-ui: don't place electronDist in cwd

(cherry picked from commit 50d308b4a3e3901dd9fc091bffa2af6475d7381b)
---
 pkgs/by-name/iv/ivpn-ui/package.nix | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/iv/ivpn-ui/package.nix b/pkgs/by-name/iv/ivpn-ui/package.nix
index cc069c4a06ac..959f5b10666c 100644
--- a/pkgs/by-name/iv/ivpn-ui/package.nix
+++ b/pkgs/by-name/iv/ivpn-ui/package.nix
@@ -34,12 +34,13 @@ buildNpmPackage (finalAttrs: {
   };
 
   postBuild = ''
-    cp -r ${electron.dist} electron-dist
-    chmod -R u+w electron-dist
+    electron_dist="$(mktemp -d)"
+    cp -r ${electron.dist}/. "$electron_dist"
+    chmod -R u+w "$electron_dist"
 
     npm exec electron-builder -- \
       --dir \
-      -c.electronDist=electron-dist \
+      -c.electronDist="$electron_dist" \
       -c.electronVersion=${electron.version} \
       --config electron-builder.config.js
   '';

From 101f3b55c5fdc2895689b18173b16017bdc95851 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 25 May 2026 19:03:26 +0000
Subject: [PATCH 10/61] buf: 1.69.0 -> 1.70.0

(cherry picked from commit cbd08798ce7a36e92f56ee1b97848b128563a401)
---
 pkgs/by-name/bu/buf/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/bu/buf/package.nix b/pkgs/by-name/bu/buf/package.nix
index 33e733fdd90d..9cf5f276fa98 100644
--- a/pkgs/by-name/bu/buf/package.nix
+++ b/pkgs/by-name/bu/buf/package.nix
@@ -10,16 +10,16 @@
 
 buildGoModule (finalAttrs: {
   pname = "buf";
-  version = "1.69.0";
+  version = "1.70.0";
 
   src = fetchFromGitHub {
     owner = "bufbuild";
     repo = "buf";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-x8Dj4xl67Jq0ViWu+Tz+3lAnfIpE926dIr+oe4ul0gI=";
+    hash = "sha256-C06/5a4icjgI35ADQKvlZ6JmCCyW/9e0aF9VIpLCqn0=";
   };
 
-  vendorHash = "sha256-zhXpWpYd/bim5f4EQJujVm072LPgBusjCFGYAwK10HE=";
+  vendorHash = "sha256-Vveg7rBno66IPinVs9RJtzVJdtAJE55QZfWA3WIXGDQ=";
 
   patches = [
     # Skip a test that requires networking to be available to work.

From 0c2f5e4c311e4c6435f5da0d3656987b0435cd30 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 25 May 2026 18:30:52 +0000
Subject: [PATCH 11/61] grafanaPlugins.marcusolsson-dynamictext-panel: 6.2.0 ->
 6.2.3

(cherry picked from commit b58bb8e017b2fc1f92a9ca47f2a53ab69fa3f1d4)
---
 .../plugins/marcusolsson-dynamictext-panel/default.nix        | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/servers/monitoring/grafana/plugins/marcusolsson-dynamictext-panel/default.nix b/pkgs/servers/monitoring/grafana/plugins/marcusolsson-dynamictext-panel/default.nix
index 7bdafecf2e50..cc50b6028da4 100644
--- a/pkgs/servers/monitoring/grafana/plugins/marcusolsson-dynamictext-panel/default.nix
+++ b/pkgs/servers/monitoring/grafana/plugins/marcusolsson-dynamictext-panel/default.nix
@@ -2,8 +2,8 @@
 
 grafanaPlugin {
   pname = "marcusolsson-dynamictext-panel";
-  version = "6.2.0";
-  zipHash = "sha256-pxTmylBvI73csDM6rMoUjGN9EM5zR/PfH1ZE1XKW94c=";
+  version = "6.2.3";
+  zipHash = "sha256-Z2R/kl6y4OaN8JRqPaKOuVLRZvPy2M43wVE+al4YquI=";
   meta = {
     description = "Dynamic, data-driven text panel for Grafana";
     license = lib.licenses.asl20;

From 634627ffcc93b74b461bc8ec87343a24449d279c Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 26 May 2026 20:13:40 +0000
Subject: [PATCH 12/61] lockbook-desktop: 26.4.13 -> 26.5.22

(cherry picked from commit ceb5bf53b23ea7ba5036e34e8fd4709dacb73927)
---
 pkgs/by-name/lo/lockbook-desktop/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/lo/lockbook-desktop/package.nix b/pkgs/by-name/lo/lockbook-desktop/package.nix
index e63092003efb..dbfcaa927b4b 100644
--- a/pkgs/by-name/lo/lockbook-desktop/package.nix
+++ b/pkgs/by-name/lo/lockbook-desktop/package.nix
@@ -18,16 +18,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lockbook-desktop";
-  version = "26.4.13";
+  version = "26.5.22";
 
   src = fetchFromGitHub {
     owner = "lockbook";
     repo = "lockbook";
     tag = finalAttrs.version;
-    hash = "sha256-KkYe07uEj/AO1rxsa4bwVsNO6iyjAFJwHeWAyMH8RPY=";
+    hash = "sha256-KqqiaM0txuZsylbr1+7faTdJINy1sNttT9n/YUpqyCc=";
   };
 
-  cargoHash = "sha256-/FLR2IXsxBEV9Z6GSJ0MTjIZjApNUN9J2ellKiKtL74=";
+  cargoHash = "sha256-d4yKch2c1w5gFBjyrYZQT/6lscRi3p05wKiJEIaXhjA=";
 
   nativeBuildInputs = [
     pkg-config

From 6b8a22fb3b6ce18774b9651c2b45a18bf0ab2f0a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 26 May 2026 20:11:34 +0000
Subject: [PATCH 13/61] lockbook: 26.4.13 -> 26.5.22

(cherry picked from commit 80a62624d8f5cb76a4dc3e8321cfa6dcbee91772)
---
 pkgs/by-name/lo/lockbook/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/lo/lockbook/package.nix b/pkgs/by-name/lo/lockbook/package.nix
index 62f20bb4c598..a9e5bb46a7fb 100644
--- a/pkgs/by-name/lo/lockbook/package.nix
+++ b/pkgs/by-name/lo/lockbook/package.nix
@@ -12,16 +12,16 @@ let
 in
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "lockbook";
-  version = "26.4.13";
+  version = "26.5.22";
 
   src = fetchFromGitHub {
     owner = "lockbook";
     repo = "lockbook";
     tag = finalAttrs.version;
-    hash = "sha256-KkYe07uEj/AO1rxsa4bwVsNO6iyjAFJwHeWAyMH8RPY=";
+    hash = "sha256-KqqiaM0txuZsylbr1+7faTdJINy1sNttT9n/YUpqyCc=";
   };
 
-  cargoHash = "sha256-/FLR2IXsxBEV9Z6GSJ0MTjIZjApNUN9J2ellKiKtL74=";
+  cargoHash = "sha256-d4yKch2c1w5gFBjyrYZQT/6lscRi3p05wKiJEIaXhjA=";
 
   doCheck = false; # there are no cli tests
   cargoBuildFlags = [

From 334d1973fa60b4d7ecbfa2c0f6e4c809088d4f7a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 26 May 2026 20:59:54 +0000
Subject: [PATCH 14/61] kdlfmt: 0.1.6 -> 0.1.7

(cherry picked from commit dd5e5a35e8f9e77f8cbb5b0ef60bc771445a3399)
---
 pkgs/by-name/kd/kdlfmt/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/kd/kdlfmt/package.nix b/pkgs/by-name/kd/kdlfmt/package.nix
index 0598d7359c8a..56c309ea268a 100644
--- a/pkgs/by-name/kd/kdlfmt/package.nix
+++ b/pkgs/by-name/kd/kdlfmt/package.nix
@@ -10,16 +10,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "kdlfmt";
-  version = "0.1.6";
+  version = "0.1.7";
 
   src = fetchFromGitHub {
     owner = "hougesen";
     repo = "kdlfmt";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-W4a+pPdQv6/XOS3ps1CBCLuspcSAn7FJuvkA5hesvww=";
+    hash = "sha256-Ftzf4gI7E5tPo8U5ZxUMqlY5+AK5IEUUAll+GsEKYpg=";
   };
 
-  cargoHash = "sha256-VXg7CVsTuAvXrQNAtzlcJvd24BtS/bQYTGselh4Dzyk=";
+  cargoHash = "sha256-B/ir+Sf4uxQ9Fqmy6yEa3DMt0qdpfPrwD8lhUMOEUbo=";
 
   nativeBuildInputs = [ installShellFiles ];
 

From 3b9599a13d0fe0c2daf19e1bb1ce6f4b95cd73ac Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 26 May 2026 22:58:42 +0000
Subject: [PATCH 15/61] brainflow: 5.22.1 -> 5.22.2

(cherry picked from commit f51d9b7e4fa1bd0631e6f12d5c8a692d89eaca2b)
---
 pkgs/by-name/br/brainflow/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/br/brainflow/package.nix b/pkgs/by-name/br/brainflow/package.nix
index 4aecf07162dc..52bd6e331179 100644
--- a/pkgs/by-name/br/brainflow/package.nix
+++ b/pkgs/by-name/br/brainflow/package.nix
@@ -17,13 +17,13 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "brainflow";
-  version = "5.22.1";
+  version = "5.22.2";
 
   src = fetchFromGitHub {
     owner = "brainflow-dev";
     repo = "brainflow";
     tag = finalAttrs.version;
-    hash = "sha256-z2EoWjQfDY8eSP+YMZtY9Um7iwoGTi+9ZGJOEZozPoo=";
+    hash = "sha256-TOBttlEl7fPiGH+cGEuxozT4S1Jr/X6mKMiMtNU0NXA=";
   };
 
   patches = [ ];

From d28dad7577210469cee5993ca2b7970ff144daf7 Mon Sep 17 00:00:00 2001
From: Chenglun Hu <chenglunhu@gmail.com>
Date: Tue, 26 May 2026 14:12:25 +0800
Subject: [PATCH 16/61] qsv: 19.1.0 -> 20.1.0

(cherry picked from commit 2a49571673e926142265de8e321e041477663ee2)
---
 pkgs/by-name/qs/qsv/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/qs/qsv/package.nix b/pkgs/by-name/qs/qsv/package.nix
index 3eb96885a7e8..64be3c4f433a 100644
--- a/pkgs/by-name/qs/qsv/package.nix
+++ b/pkgs/by-name/qs/qsv/package.nix
@@ -33,7 +33,7 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "qsv";
-  version = "19.1.0";
+  version = "20.1.0";
 
   inherit buildFeatures;
 
@@ -41,10 +41,10 @@ rustPlatform.buildRustPackage (finalAttrs: {
     owner = "dathere";
     repo = "qsv";
     rev = finalAttrs.version;
-    hash = "sha256-R3Bv0Jkq5esLQSXbhk9m3Xr9K6EmqMtc3iDF7yRspJ0=";
+    hash = "sha256-dYUZ2IwvXTFwpv1cDQjmq+iq2g/vQQovpR0++/ZtSy8=";
   };
 
-  cargoHash = "sha256-Wk5OVUKVWHvhWc1ItJcOafY75Pd8ucA3XAGUR//mtqg=";
+  cargoHash = "sha256-7jZR5u32Hy0XQEeX+tWDbpkj7jM804LBUL93wgnA5bM=";
 
   buildInputs = [
     file

From 1cd74962e1db1a68765823be1664997a3fa56219 Mon Sep 17 00:00:00 2001
From: Christoph Heiss <christoph@c8h4.io>
Date: Fri, 22 May 2026 19:58:33 +0200
Subject: [PATCH 17/61] olive-editor: drop

Upstream is dead/unmaintained since 12-2024.

The build also has been broken since at least 24-11-2025 [0].

[0] https://hydra.nixos.org/build/314410468

Signed-off-by: Christoph Heiss <christoph@c8h4.io>
(cherry picked from commit 2e48fef4cad367d9f566944358821d9fce314b00)
---
 doc/release-notes/rl-2605.section.md          |   2 +
 ...kddockwidgets-fix-build-with-qt-6_10.patch |  21 ----
 pkgs/by-name/ol/olive-editor/package.nix      | 104 ------------------
 pkgs/top-level/aliases.nix                    |   1 +
 4 files changed, 3 insertions(+), 125 deletions(-)
 delete mode 100644 pkgs/by-name/ol/olive-editor/olive-editor-kddockwidgets-fix-build-with-qt-6_10.patch
 delete mode 100644 pkgs/by-name/ol/olive-editor/package.nix

diff --git a/doc/release-notes/rl-2605.section.md b/doc/release-notes/rl-2605.section.md
index 3b4c274609f8..13451b77d66c 100644
--- a/doc/release-notes/rl-2605.section.md
+++ b/doc/release-notes/rl-2605.section.md
@@ -197,6 +197,8 @@
 
 - `python3Packages.pikepdf` no longer builds with mupdf support by default, which may be nice in Jupyter and iPython. Build with `withMupdf = true` if this is required.
 
+- `olive-editor` has been dropped as upstream development ceased and no longer builds.
+
 - `python3Packages.django-mdeditor` has been removed, as it was unmaintained upstream and the latest release was vulnerable to a [critical security vulnerability](https://github.com/NixOS/nixpkgs/issues/515462).
 
 - `vicinae` has been updated to v0.20. This includes, among several other breaking changes, a complete overhaul of the configuration system. For update instructions, see the [upstream configuration documentation](https://docs.vicinae.com/config#migration-from-v0-16-x-to-v0-17-x).
diff --git a/pkgs/by-name/ol/olive-editor/olive-editor-kddockwidgets-fix-build-with-qt-6_10.patch b/pkgs/by-name/ol/olive-editor/olive-editor-kddockwidgets-fix-build-with-qt-6_10.patch
deleted file mode 100644
index 3ab25e679764..000000000000
--- a/pkgs/by-name/ol/olive-editor/olive-editor-kddockwidgets-fix-build-with-qt-6_10.patch
+++ /dev/null
@@ -1,21 +0,0 @@
-diff --git a/ext/KDDockWidgets/CMakeLists.txt b/ext/KDDockWidgets/CMakeLists.txt
-index 608a2491..d0edc399 100644
---- a/ext/KDDockWidgets/CMakeLists.txt
-+++ b/ext/KDDockWidgets/CMakeLists.txt
-@@ -160,8 +160,16 @@
- include(KDQtInstallPaths) #to set QT_INSTALL_FOO variables
- 
- set(${PROJECT_NAME}_DEPS "widgets")
-+if(Qt6Core_VERSION VERSION_GREATER_EQUAL "6.10.0")
-+    set(QT_NO_PRIVATE_MODULE_WARNING ON)
-+    find_package(Qt6 ${QT_MIN_VERSION} NO_MODULE REQUIRED COMPONENTS WidgetsPrivate)
-+endif()
- if(${PROJECT_NAME}_QTQUICK)
-     find_package(Qt${Qt_VERSION_MAJOR} NO_MODULE REQUIRED COMPONENTS Quick QuickControls2)
-+    if(Qt6Core_VERSION VERSION_GREATER_EQUAL "6.10.0")
-+        set(QT_NO_PRIVATE_MODULE_WARNING ON)
-+        find_package(Qt6 ${QT_MIN_VERSION} NO_MODULE REQUIRED COMPONENTS QuickPrivate)
-+    endif()
-     add_definitions(-DKDDOCKWIDGETS_QTQUICK)
-     set(${PROJECT_NAME}_DEPS "${${PROJECT_NAME}_DEPS} quick quickcontrols2")
- else()
diff --git a/pkgs/by-name/ol/olive-editor/package.nix b/pkgs/by-name/ol/olive-editor/package.nix
deleted file mode 100644
index 09d1b26ac1df..000000000000
--- a/pkgs/by-name/ol/olive-editor/package.nix
+++ /dev/null
@@ -1,104 +0,0 @@
-{
-  lib,
-  stdenv,
-  fetchFromGitHub,
-  fetchpatch,
-  pkg-config,
-  which,
-  frei0r,
-  opencolorio,
-  ffmpeg_6,
-  cmake,
-  openimageio,
-  openexr,
-  portaudio,
-  imath,
-  qt6,
-  fmt_10,
-}:
-
-let
-  # https://github.com/olive-editor/olive/issues/2284
-  # we patch support for 2.3+, but 2.5 fails
-  openimageio' = (openimageio.override { fmt = fmt_10; }).overrideAttrs (old: rec {
-    version = "2.4.15.0";
-    src = (
-      old.src.override {
-        tag = "v${version}";
-        hash = "sha256-I2/JPmUBDb0bw7qbSZcAkYHB2q2Uo7En7ZurMwWhg/M=";
-      }
-    );
-
-    # robin-map headers require c++17
-    cmakeFlags = (old.cmakeFlags or [ ]) ++ [ (lib.cmakeFeature "CMAKE_CXX_STANDARD" "17") ];
-  });
-in
-
-stdenv.mkDerivation {
-  pname = "olive-editor";
-  version = "0.1.2-unstable-2023-06-12";
-
-  src = fetchFromGitHub {
-    fetchSubmodules = true;
-    owner = "olive-editor";
-    repo = "olive";
-    rev = "2036fffffd0e24b7458e724b9084ae99c9507c64";
-    hash = "sha256-qee9/WTvTy5jWLowvZJOwAjrqznRhJR+u9dYsnCN/Qs=";
-  };
-
-  cmakeFlags = [
-    "-DBUILD_QT6=1"
-  ];
-
-  patches = [
-    (fetchpatch {
-      # Taken from https://github.com/olive-editor/olive/pull/2294.
-      name = "olive-editor-openimageio-2.3-compat.patch";
-      url = "https://github.com/olive-editor/olive/commit/311eeb72944f93f873d1cd1784ee2bf423e1e7c2.patch";
-      hash = "sha256-lswWn4DbXGH1qPvPla0jSgUJQXuqU7LQGHIPoXAE8ag=";
-    })
-
-    # Fix build of `kddockwidgets` with qt6-6.10, adapted from:
-    # https://github.com/KDAB/KDDockWidgets/pull/615
-    # https://github.com/KDAB/KDDockWidgets/commit/f2b50fff29bd4b49acdfed3ed8fc42eb0a502032
-    ./olive-editor-kddockwidgets-fix-build-with-qt-6_10.patch
-  ];
-
-  # https://github.com/olive-editor/olive/issues/2200
-  postPatch = ''
-    substituteInPlace ./app/node/project/serializer/serializer230220.cpp \
-      --replace 'QStringRef' 'QStringView'
-  '';
-
-  nativeBuildInputs = [
-    pkg-config
-    which
-    cmake
-    qt6.wrapQtAppsHook
-  ];
-
-  buildInputs = [
-    ffmpeg_6
-    frei0r
-    opencolorio
-    openimageio'
-    imath
-    openexr
-    portaudio
-    qt6.qtwayland
-    qt6.qtmultimedia
-    qt6.qttools
-  ];
-
-  meta = {
-    description = "Professional open-source NLE video editor";
-    homepage = "https://www.olivevideoeditor.org/";
-    downloadPage = "https://www.olivevideoeditor.org/download.php";
-    license = lib.licenses.gpl3;
-    maintainers = with lib.maintainers; [ balsoft ];
-    platforms = lib.platforms.unix;
-    # never built on aarch64-darwin since first introduction in nixpkgs
-    broken = stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isAarch64;
-    mainProgram = "olive-editor";
-  };
-}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 59ff166fa6bd..5577e9e495cd 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1592,6 +1592,7 @@ mapAliases {
   oguri = throw "'oguri' has been removed from nixpkgs because the upstream repository was archived. Please see https://github.com/vilhalmer/oguri#notice-unmaintained for upstream's suggested replacements."; # Added 2026-05-04
   oil = throw "'oil' has been renamed to/replaced by 'oils-for-unix'"; # Converted to throw 2025-10-27
   olaris-server = throw "'olaris-server' has been removed as it failed to build since 2024"; # Added 2026-01-15
+  olive-editor = throw "'olive-editor' has been removed as it is unmaintained upstream and broken"; # Added 2026-05-22
   oneDNN = onednn; # Added 2026-02-08
   oneDNN_2 = onednn_2; # Added 2026-02-08
   onevpl-intel-gpu = throw "'onevpl-intel-gpu' has been renamed to/replaced by 'vpl-gpu-rt'"; # Converted to throw 2025-10-27

From 3f8016807c5cf4c6c3f69dbb4c7b3cf0ab1a61df Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 25 May 2026 12:13:22 +0000
Subject: [PATCH 18/61] pyright: 1.1.409 -> 1.1.410

(cherry picked from commit 81a059ee93478b2f26bc8bcc615f4f51dd9e7f1d)
---
 pkgs/by-name/py/pyright/package-lock.json | 255 +++++++++++++++++-----
 pkgs/by-name/py/pyright/package.nix       |  10 +-
 2 files changed, 203 insertions(+), 62 deletions(-)

diff --git a/pkgs/by-name/py/pyright/package-lock.json b/pkgs/by-name/py/pyright/package-lock.json
index 5e1988a9e2e0..8405c08770c1 100644
--- a/pkgs/by-name/py/pyright/package-lock.json
+++ b/pkgs/by-name/py/pyright/package-lock.json
@@ -6,74 +6,123 @@
     "": {
       "name": "pyright-root",
       "devDependencies": {
-        "glob": "^8.1.0",
-        "jsonc-parser": "^3.2.0"
+        "glob": "^11.1.0",
+        "jsonc-parser": "^3.3.1"
+      }
+    },
+    "node_modules/@isaacs/cliui": {
+      "version": "9.0.0",
+      "resolved": "https://registry.npmjs.org/@isaacs/cliui/-/cliui-9.0.0.tgz",
+      "integrity": "sha512-AokJm4tuBHillT+FpMtxQ60n8ObyXBatq7jD2/JA9dxbDDokKQm8KMht5ibGzLVU9IJDIKK4TPKgMHEYMn3lMg==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=18"
       }
     },
     "node_modules/balanced-match": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
-      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
     },
     "node_modules/brace-expansion": {
-      "version": "2.1.0",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.0.tgz",
-      "integrity": "sha512-TN1kCZAgdgweJhWWpgKYrQaMNHcDULHkWwQIspdtjV4Y5aurRdZpjAqn6yX3FPqTA9ngHCc4hJxMAMgGfve85w==",
+      "version": "5.0.6",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.6.tgz",
+      "integrity": "sha512-kLpxurY4Z4r9sgMsyG0Z9uzsBlgiU/EFKhj/h91/8yHu0edo7XuixOIH3VcJ8kkxs6/jPzoI6U9Vj3WqbMQ94g==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "balanced-match": "^1.0.0"
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
       }
     },
-    "node_modules/fs.realpath": {
-      "version": "1.0.0",
-      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
-      "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==",
+    "node_modules/cross-spawn": {
+      "version": "7.0.6",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.6.tgz",
+      "integrity": "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==",
       "dev": true,
-      "license": "ISC"
+      "license": "MIT",
+      "dependencies": {
+        "path-key": "^3.1.0",
+        "shebang-command": "^2.0.0",
+        "which": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
     },
-    "node_modules/glob": {
-      "version": "8.1.0",
-      "resolved": "https://registry.npmjs.org/glob/-/glob-8.1.0.tgz",
-      "integrity": "sha512-r8hpEjiQEYlF2QU0df3dS+nxxSIreXQS1qRhMJM0Q5NDdR386C7jb7Hwwod8Fgiuex+k0GFjgft18yvxm5XoCQ==",
-      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
+    "node_modules/foreground-child": {
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/foreground-child/-/foreground-child-3.3.1.tgz",
+      "integrity": "sha512-gIXjKqtFuWEgzFRJA9WCQeSJLZDjgJUOMCMzxtvFq/37KojM1BFGufqsCy0r4qSQmYLsZYMeyRqzIWOMup03sw==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
-        "fs.realpath": "^1.0.0",
-        "inflight": "^1.0.4",
-        "inherits": "2",
-        "minimatch": "^5.0.1",
-        "once": "^1.3.0"
+        "cross-spawn": "^7.0.6",
+        "signal-exit": "^4.0.1"
       },
       "engines": {
-        "node": ">=12"
+        "node": ">=14"
       },
       "funding": {
         "url": "https://github.com/sponsors/isaacs"
       }
     },
-    "node_modules/inflight": {
-      "version": "1.0.6",
-      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
-      "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
-      "deprecated": "This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.",
+    "node_modules/glob": {
+      "version": "11.1.0",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-11.1.0.tgz",
+      "integrity": "sha512-vuNwKSaKiqm7g0THUBu2x7ckSs3XJLXE+2ssL7/MfTGPLLcrJQ/4Uq1CjPTtO5cCIiRxqvN6Twy1qOwhL0Xjcw==",
+      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
       "dev": true,
-      "license": "ISC",
+      "license": "BlueOak-1.0.0",
       "dependencies": {
-        "once": "^1.3.0",
-        "wrappy": "1"
+        "foreground-child": "^3.3.1",
+        "jackspeak": "^4.1.1",
+        "minimatch": "^10.1.1",
+        "minipass": "^7.1.2",
+        "package-json-from-dist": "^1.0.0",
+        "path-scurry": "^2.0.0"
+      },
+      "bin": {
+        "glob": "dist/esm/bin.mjs"
+      },
+      "engines": {
+        "node": "20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
       }
     },
-    "node_modules/inherits": {
-      "version": "2.0.4",
-      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
-      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+    "node_modules/isexe": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
+      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
       "dev": true,
       "license": "ISC"
     },
+    "node_modules/jackspeak": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/jackspeak/-/jackspeak-4.2.3.tgz",
+      "integrity": "sha512-ykkVRwrYvFm1nb2AJfKKYPr0emF6IiXDYUaFx4Zn9ZuIH7MrzEZ3sD5RlqGXNRpHtvUHJyOnCEFxOlNDtGo7wg==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "@isaacs/cliui": "^9.0.0"
+      },
+      "engines": {
+        "node": "20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/jsonc-parser": {
       "version": "3.3.1",
       "resolved": "https://registry.npmjs.org/jsonc-parser/-/jsonc-parser-3.3.1.tgz",
@@ -81,35 +130,127 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/minimatch": {
-      "version": "5.1.9",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.9.tgz",
-      "integrity": "sha512-7o1wEA2RyMP7Iu7GNba9vc0RWWGACJOCZBJX2GJWip0ikV+wcOsgVuY9uE8CPiyQhkGFSlhuSkZPavN7u1c2Fw==",
+    "node_modules/lru-cache": {
+      "version": "11.5.0",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-11.5.0.tgz",
+      "integrity": "sha512-5YgH9UJd7wVb9hIouI2adWpgqrrICkt070Dnj8EUY1+B4B2P9eRLPAkAAo6NICA7CEhOIeBHl46u9zSNpNu7zA==",
       "dev": true,
-      "license": "ISC",
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": "20 || >=22"
+      }
+    },
+    "node_modules/minimatch": {
+      "version": "10.2.5",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
+      "integrity": "sha512-MULkVLfKGYDFYejP07QOurDLLQpcjk7Fw+7jXS2R2czRQzR56yHRveU5NDJEOviH+hETZKSkIk5c+T23GjFUMg==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
       "dependencies": {
-        "brace-expansion": "^2.0.1"
+        "brace-expansion": "^5.0.5"
       },
       "engines": {
-        "node": ">=10"
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
       }
     },
-    "node_modules/once": {
-      "version": "1.4.0",
-      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
-      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+    "node_modules/minipass": {
+      "version": "7.1.3",
+      "resolved": "https://registry.npmjs.org/minipass/-/minipass-7.1.3.tgz",
+      "integrity": "sha512-tEBHqDnIoM/1rXME1zgka9g6Q2lcoCkxHLuc7ODJ5BxbP5d4c2Z5cGgtXAku59200Cx7diuHTOYfSBD8n6mm8A==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      }
+    },
+    "node_modules/package-json-from-dist": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/package-json-from-dist/-/package-json-from-dist-1.0.1.tgz",
+      "integrity": "sha512-UEZIS3/by4OC8vL3P2dTXRETpebLI2NiI5vIrjaD/5UtrkFX/tNbwjTSRAGC/+7CAo2pIcBaRgWmcBBHcsaCIw==",
+      "dev": true,
+      "license": "BlueOak-1.0.0"
+    },
+    "node_modules/path-key": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/path-scurry": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/path-scurry/-/path-scurry-2.0.2.tgz",
+      "integrity": "sha512-3O/iVVsJAPsOnpwWIeD+d6z/7PmqApyQePUtCndjatj/9I5LylHvt5qluFaBT3I5h3r1ejfR056c+FCv+NnNXg==",
+      "dev": true,
+      "license": "BlueOak-1.0.0",
+      "dependencies": {
+        "lru-cache": "^11.0.0",
+        "minipass": "^7.1.2"
+      },
+      "engines": {
+        "node": "18 || 20 || >=22"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/shebang-command": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "shebang-regex": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/shebang-regex": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+      "dev": true,
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/signal-exit": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/signal-exit/-/signal-exit-4.1.0.tgz",
+      "integrity": "sha512-bzyZ1e88w9O1iNJbKnOlvYTrWPDl46O1bG0D3XInv+9tkPrxrN8jUUTiFlDkkmKWgn1M6CfIA13SuGqOa9Korw==",
+      "dev": true,
+      "license": "ISC",
+      "engines": {
+        "node": ">=14"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
       "dev": true,
       "license": "ISC",
       "dependencies": {
-        "wrappy": "1"
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
       }
-    },
-    "node_modules/wrappy": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
-      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
-      "dev": true,
-      "license": "ISC"
     }
   }
 }
diff --git a/pkgs/by-name/py/pyright/package.nix b/pkgs/by-name/py/pyright/package.nix
index 0d4ccccbedb9..0becc68d6524 100644
--- a/pkgs/by-name/py/pyright/package.nix
+++ b/pkgs/by-name/py/pyright/package.nix
@@ -7,13 +7,13 @@
 }:
 
 let
-  version = "1.1.409";
+  version = "1.1.410";
 
   src = fetchFromGitHub {
     owner = "Microsoft";
     repo = "pyright";
     tag = version;
-    hash = "sha256-h0sXYwRCIQlrnNIp/a7ow55McA9fdHP2FcvrRCqWROg=";
+    hash = "sha256-ouG+Lz08eljOU6ved1IoeeW/3GJWbFT7WzdhTilWqBs=";
   };
 
   patchedPackageJSON =
@@ -32,7 +32,7 @@ let
     pname = "pyright-root";
     inherit version src;
     sourceRoot = "${src.name}"; # required for update.sh script
-    npmDepsHash = "sha256-OpXxcALwMyBJEcZz5WTnjAysufbgWkW/VKAg1zIJgDE=";
+    npmDepsHash = "sha256-Q7niMODoPmtn4zbou3OeJFAGEjRtt8j40qiw2NJvo8k=";
     dontNpmBuild = true;
     postPatch = ''
       cp ${patchedPackageJSON} ./package.json
@@ -49,7 +49,7 @@ let
     pname = "pyright-internal";
     inherit version src;
     sourceRoot = "${src.name}/packages/pyright-internal";
-    npmDepsHash = "sha256-HG2714eCHWD6aQAKGpGClMg+XDPQ08Q0ofXf3wMafg0=";
+    npmDepsHash = "sha256-lzwDayoN2qmF33Slv7r+rv1bl81utjRGGeeXI6jCd0U=";
     dontNpmBuild = true;
     installPhase = ''
       runHook preInstall
@@ -63,7 +63,7 @@ buildNpmPackage rec {
   inherit version src;
 
   sourceRoot = "${src.name}/packages/pyright";
-  npmDepsHash = "sha256-wyswu6pTtZmksj1hZUhaZLWuJnf8WKofo1htLtgKm9w=";
+  npmDepsHash = "sha256-nCfoa+c6I8khFqXBRI5AAdFzn1tO3G03KT+LPqHY82U=";
 
   postPatch = ''
     chmod +w ../../

From 5c5ef4b52012b22e3dae4cfd4454aa4855bf49fd Mon Sep 17 00:00:00 2001
From: uku <hi@uku.moe>
Date: Tue, 12 May 2026 09:40:01 +0200
Subject: [PATCH 19/61] jay: 1.12.0 -> 1.13.0

Release notes: https://github.com/mahkoh/jay/releases/tag/v1.13.0

(cherry picked from commit 1073ba402252f2abc27d73df4f9be709f7250117)
---
 pkgs/by-name/ja/jay/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ja/jay/package.nix b/pkgs/by-name/ja/jay/package.nix
index 3a05c1a848ac..7f229f096d74 100644
--- a/pkgs/by-name/ja/jay/package.nix
+++ b/pkgs/by-name/ja/jay/package.nix
@@ -19,16 +19,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "jay";
-  version = "1.12.0";
+  version = "1.13.0";
 
   src = fetchFromGitHub {
     owner = "mahkoh";
     repo = "jay";
     rev = "v${finalAttrs.version}";
-    sha256 = "sha256-JOt3xEONGDmLovk72hX0d3De01zTd51d2/J4HziBE9I=";
+    sha256 = "sha256-tC2V1BgUGsUMpZsKXjFSS8Mp28LrNI/QNu761zpgAkc=";
   };
 
-  cargoHash = "sha256-wK9v3YwP067etFAu6Ca9Sts+QrD4uL48chbL6tZKFkk=";
+  cargoHash = "sha256-96vCkZR/8dgZH0hJPeKzP7jQZ41W7XTi9yMnxFaIhoY=";
 
   nativeBuildInputs = [
     autoPatchelfHook

From 73c771cef2e60563d3bf6367697339eaf5a18909 Mon Sep 17 00:00:00 2001
From: uku <hi@uku.moe>
Date: Fri, 10 Apr 2026 14:56:31 +0200
Subject: [PATCH 20/61] jay: disable failing io_uring tests

Some tests fail in the Lix sandbox which disables io_uring.

Hydra log: https://hydra.nixos.org/build/326198517

(cherry picked from commit 14d54f4886714b4ecf1ad4b386e2e47e5f96948e)
---
 pkgs/by-name/ja/jay/package.nix | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/pkgs/by-name/ja/jay/package.nix b/pkgs/by-name/ja/jay/package.nix
index 7f229f096d74..4c424bde6f7a 100644
--- a/pkgs/by-name/ja/jay/package.nix
+++ b/pkgs/by-name/ja/jay/package.nix
@@ -50,6 +50,15 @@ rustPlatform.buildRustPackage (finalAttrs: {
     vulkan-loader
   ];
 
+  checkFlags = [
+    # these 5 tests fail in the lix sandbox because they rely on io_uring
+    "--skip=cpu_worker::tests::cancel"
+    "--skip=cpu_worker::tests::complete"
+    "--skip=eventfd_cache::tests::test"
+    "--skip=io_uring::ops::read_write_no_cancel::tests::cancel_in_kernel"
+    "--skip=io_uring::ops::read_write_no_cancel::tests::cancel_in_userspace"
+  ];
+
   postInstall = ''
     install -D etc/jay.portal $out/share/xdg-desktop-portal/portals/jay.portal
     install -D etc/jay-portals.conf $out/share/xdg-desktop-portal/jay-portals.conf

From b3fae191b56a074d86213eac6f0917570f32a4df Mon Sep 17 00:00:00 2001
From: uku <hi@uku.moe>
Date: Tue, 12 May 2026 09:42:11 +0200
Subject: [PATCH 21/61] jay: add uku3lig to maintainers

(cherry picked from commit f94260b829e919b391c95932d23831067d1caa44)
---
 pkgs/by-name/ja/jay/package.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pkgs/by-name/ja/jay/package.nix b/pkgs/by-name/ja/jay/package.nix
index 4c424bde6f7a..205581101442 100644
--- a/pkgs/by-name/ja/jay/package.nix
+++ b/pkgs/by-name/ja/jay/package.nix
@@ -81,7 +81,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
     homepage = "https://github.com/mahkoh/jay";
     license = lib.licenses.gpl3;
     platforms = lib.platforms.linux;
-    maintainers = [ ];
+    maintainers = with lib.maintainers; [ uku3lig ];
     mainProgram = "jay";
   };
 })

From 9c9a58d14940a7fb098e9b00e7879b9ff84f685f Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Mon, 25 May 2026 17:49:05 +0000
Subject: [PATCH 22/61] nezha-agent: 2.0.3 -> 2.0.4

(cherry picked from commit 58cce8fabf2c82b77e8bda8dbd5438f0753b3ac5)
---
 pkgs/by-name/ne/nezha-agent/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ne/nezha-agent/package.nix b/pkgs/by-name/ne/nezha-agent/package.nix
index 30a601ec1b81..885968b0b1ae 100644
--- a/pkgs/by-name/ne/nezha-agent/package.nix
+++ b/pkgs/by-name/ne/nezha-agent/package.nix
@@ -8,16 +8,16 @@
 }:
 buildGoModule (finalAttrs: {
   pname = "nezha-agent";
-  version = "2.0.3";
+  version = "2.0.4";
 
   src = fetchFromGitHub {
     owner = "nezhahq";
     repo = "agent";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pysEeqW/WCj+VlERl9m5pir0SfCRA92R6akIGmHTLdI=";
+    hash = "sha256-ftPJhbh3dnJotJ5J9rlTkYVpmppBb5UWvx5Qy5Y5zGA=";
   };
 
-  vendorHash = "sha256-GIdkbQzHAIgH7KVoxZ1DcbamWYaRdTuJKGTnOn8SPyk=";
+  vendorHash = "sha256-0dwrwUeHbPdI5O8KeX4PQP1jN6P+AwPznqX78kxSleM=";
 
   ldflags = [
     "-s"

From bf7b3158b9bb4c33dca5dc14a8723c11c093b920 Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Tue, 26 May 2026 19:55:27 +0000
Subject: [PATCH 23/61] jackett: 0.24.1879 -> 0.24.1954

(cherry picked from commit 629f87d2bdc6b45a5820c9447b10b8746fe9572d)
---
 pkgs/by-name/ja/jackett/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/ja/jackett/package.nix b/pkgs/by-name/ja/jackett/package.nix
index b6b311d61878..a18132aa1c88 100644
--- a/pkgs/by-name/ja/jackett/package.nix
+++ b/pkgs/by-name/ja/jackett/package.nix
@@ -12,13 +12,13 @@
 
 buildDotnetModule (finalAttrs: {
   pname = "jackett";
-  version = "0.24.1879";
+  version = "0.24.1954";
 
   src = fetchFromGitHub {
     owner = "jackett";
     repo = "jackett";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-gtDN77TB1AKLfqtvFPoQ3tatXB63Ajax2j1gokgHX4s=";
+    hash = "sha256-HuMK8nW0PRBmRYUYAr3h/hDkVhUGgQIj+7v60ChuKRw=";
   };
 
   projectFile = "src/Jackett.Server/Jackett.Server.csproj";

From 03a8cf1316b3f3169941573598944933b6cf1bda Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Wed, 27 May 2026 09:21:19 +0200
Subject: [PATCH 24/61] gnomeExtensions.gsconnect: 71 -> 72

Changelog: https://github.com/GSConnect/gnome-shell-extension-gsconnect/releases/tag/v72
Diff: https://github.com/GSConnect/gnome-shell-extension-gsconnect/compare/v71...v72
(cherry picked from commit dbe5b908346312719cb2168f05c80f4e46778e69)
---
 .../gnome/extensions/gsconnect/default.nix    |  5 ++-
 .../extensions/gsconnect/fix-paths.patch      | 44 ++++++++++++++++---
 2 files changed, 41 insertions(+), 8 deletions(-)

diff --git a/pkgs/desktops/gnome/extensions/gsconnect/default.nix b/pkgs/desktops/gnome/extensions/gsconnect/default.nix
index dd15cfee7553..0a793f5cfcf9 100644
--- a/pkgs/desktops/gnome/extensions/gsconnect/default.nix
+++ b/pkgs/desktops/gnome/extensions/gsconnect/default.nix
@@ -23,7 +23,7 @@
 
 stdenv.mkDerivation (finalAttrs: {
   pname = "gnome-shell-extension-gsconnect";
-  version = "71";
+  version = "72";
 
   outputs = [
     "out"
@@ -34,13 +34,14 @@ stdenv.mkDerivation (finalAttrs: {
     owner = "GSConnect";
     repo = "gnome-shell-extension-gsconnect";
     rev = "v${finalAttrs.version}";
-    hash = "sha256-OgASLH/mPmRmT8RcXOAZLzDhhidLnlZNcgpAQNbO30Q=";
+    hash = "sha256-w9MQVEUQUcO1lqftBi76w5xSTlryKuZJxE6Ogg1J+ho=";
   };
 
   patches = [
     # Make typelibs available in the extension
     (replaceVars ./fix-paths.patch {
       gapplication = "${glib.bin}/bin/gapplication";
+      gjs = "${gjs}/bin/gjs";
       # Replaced in postPatch
       typelibPath = null;
     })
diff --git a/pkgs/desktops/gnome/extensions/gsconnect/fix-paths.patch b/pkgs/desktops/gnome/extensions/gsconnect/fix-paths.patch
index cef649450e6f..39704dc882b2 100644
--- a/pkgs/desktops/gnome/extensions/gsconnect/fix-paths.patch
+++ b/pkgs/desktops/gnome/extensions/gsconnect/fix-paths.patch
@@ -13,14 +13,14 @@ index 3fb887c3..e8cbe1bd 100644
  Icon=org.gnome.Shell.Extensions.GSConnect
 diff --git a/src/__nix-prepend-search-paths.js b/src/__nix-prepend-search-paths.js
 new file mode 100644
-index 00000000..d009dfd9
+index 00000000..e664ad9b
 --- /dev/null
 +++ b/src/__nix-prepend-search-paths.js
 @@ -0,0 +1,2 @@
 +import GIRepository from 'gi://GIRepository';
 +'@typelibPath@'.split(':').forEach(path => GIRepository.Repository.dup_default().prepend_search_path(path));
 diff --git a/src/extension.js b/src/extension.js
-index 53ecd5fc..78782357 100644
+index b82a9754..7303ee7a 100644
 --- a/src/extension.js
 +++ b/src/extension.js
 @@ -2,6 +2,8 @@
@@ -32,11 +32,22 @@ index 53ecd5fc..78782357 100644
  import Gio from 'gi://Gio';
  import GObject from 'gi://GObject';
  
-diff --git i/src/gsconnect-preferences w/src/gsconnect-preferences
-index b16ddc7d..263dfb04 100755
+diff --git a/src/gsconnect-preferences b/src/gsconnect-preferences
+index 652f6b2e..7122bed6 100755
 --- a/src/gsconnect-preferences
 +++ b/src/gsconnect-preferences
-@@ -6,6 +6,8 @@
+@@ -15,5 +15,5 @@ if [ ! -f "./gsconnect-preferences.js" ]; then
+     fi
+     cd "$extension_dir" || exit 1
+ fi
+-exec /usr/bin/env gjs -m gsconnect-preferences.js
++exec @gjs@ -m gsconnect-preferences.js
+
+diff --git a/src/gsconnect-preferences.js b/src/gsconnect-preferences.js
+index e2b1efe9..c2060e61 100644
+--- a/src/gsconnect-preferences.js
++++ b/src/gsconnect-preferences.js
+@@ -4,6 +4,8 @@
  
  // -*- mode: js; -*-
  
@@ -46,7 +57,7 @@ index b16ddc7d..263dfb04 100755
  import 'gi://GdkPixbuf?version=2.0';
  import Gio from 'gi://Gio?version=2.0';
 diff --git a/src/prefs.js b/src/prefs.js
-index dd20fd20..5f82c53a 100644
+index e4d38f8c..e177810b 100644
 --- a/src/prefs.js
 +++ b/src/prefs.js
 @@ -2,6 +2,8 @@
@@ -58,3 +69,24 @@ index dd20fd20..5f82c53a 100644
  import Gio from 'gi://Gio';
  import GLib from 'gi://GLib';
  import Adw from 'gi://Adw';
+@@ -28,6 +30,6 @@ export default class GSConnectExtensionPreferences extends ExtensionPreferences
+ 
+         const _launcher = Gio.SubprocessLauncher.new({flags: Gio.SubprocessFlags.NONE});
+         _launcher.set_cwd(this.path);
+-        _launcher.spawnv(['gjs', '-m', 'gsconnect-preferences.js']);
++        _launcher.spawnv(['@gjs@', '-m', 'gsconnect-preferences.js']);
+     }
+ }
+diff --git a/src/service/daemon.js b/src/service/daemon.js
+index dda8b434..889c7d48 100755
+--- a/src/service/daemon.js
++++ b/src/service/daemon.js
+@@ -214,7 +214,7 @@ const Service = GObject.registerClass({
+             {flags: Gio.SubprocessFlags.NONE}
+         );
+         _launcher.set_cwd(Config.PACKAGE_DATADIR);
+-        _launcher.spawnv(['gjs', '-m', 'gsconnect-preferences.js']);
++        _launcher.spawnv(['@gjs@', '-m', 'gsconnect-preferences.js']);
+     }
+ 
+     /**

From 8bbcfa1b004576a0fc6fe7c96cfda47ae11fd3dc Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Wed, 27 May 2026 09:23:53 +0200
Subject: [PATCH 25/61] gnomeExtensions.gsconnect: add `meta.changelog`

(cherry picked from commit 3ca26fd7852e25bd16695595458942e8ccd5bcb8)
---
 pkgs/desktops/gnome/extensions/gsconnect/default.nix | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pkgs/desktops/gnome/extensions/gsconnect/default.nix b/pkgs/desktops/gnome/extensions/gsconnect/default.nix
index 0a793f5cfcf9..f08899d044db 100644
--- a/pkgs/desktops/gnome/extensions/gsconnect/default.nix
+++ b/pkgs/desktops/gnome/extensions/gsconnect/default.nix
@@ -33,7 +33,7 @@ stdenv.mkDerivation (finalAttrs: {
   src = fetchFromGitHub {
     owner = "GSConnect";
     repo = "gnome-shell-extension-gsconnect";
-    rev = "v${finalAttrs.version}";
+    tag = "v${finalAttrs.version}";
     hash = "sha256-w9MQVEUQUcO1lqftBi76w5xSTlryKuZJxE6Ogg1J+ho=";
   };
 
@@ -121,6 +121,7 @@ stdenv.mkDerivation (finalAttrs: {
   meta = {
     description = "KDE Connect implementation for Gnome Shell";
     homepage = "https://github.com/GSConnect/gnome-shell-extension-gsconnect/wiki";
+    changelog = "https://github.com/GSConnect/gnome-shell-extension-gsconnect/releases/tag/${finalAttrs.src.tag}";
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ doronbehar ];
     teams = [ lib.teams.gnome ];

From 2973d2ebae74458b16180f7c1e3bbb1e1416793b Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Sat, 23 May 2026 23:47:07 +0700
Subject: [PATCH 26/61] python3Packages.monosat: fix build with cython 3.1

(cherry picked from commit 50779b6ae83f3e0cd317a28f4ef38f83d0a04750)
---
 pkgs/by-name/mo/monosat/package.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/by-name/mo/monosat/package.nix b/pkgs/by-name/mo/monosat/package.nix
index 7d5bea0a95d9..4ae627accfb3 100644
--- a/pkgs/by-name/mo/monosat/package.nix
+++ b/pkgs/by-name/mo/monosat/package.nix
@@ -116,7 +116,11 @@ let
       # the sourceRoot if it weren't for the patch.
       postPatch =
         commonPostPatch
+        # cython 3.1 dropped the python 2 `long` builtin
         + ''
+          substituteInPlace src/monosat/api/python/monosat/monosat_p.pyx \
+            --replace-fail '(int, long)' 'int' \
+            --replace-fail '(int,long)' 'int'
           cd src/monosat/api/python
         ''
         +

From f66ebcfba1b1aab716119373eef8119572e9dc07 Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Sat, 23 May 2026 20:10:06 +0700
Subject: [PATCH 27/61] python3Packages.pytest-notebook: fix build with pytest
 9

(cherry picked from commit 81a7ca2c6dfdb6bb16b37af4fe3902af3657a7ed)
---
 .../pytest-notebook/default.nix               |  5 +++
 .../pytest9-collect-hook.patch                | 31 +++++++++++++++++++
 2 files changed, 36 insertions(+)
 create mode 100644 pkgs/development/python-modules/pytest-notebook/pytest9-collect-hook.patch

diff --git a/pkgs/development/python-modules/pytest-notebook/default.nix b/pkgs/development/python-modules/pytest-notebook/default.nix
index 6d24c8c2ac60..5273c7540626 100644
--- a/pkgs/development/python-modules/pytest-notebook/default.nix
+++ b/pkgs/development/python-modules/pytest-notebook/default.nix
@@ -38,6 +38,11 @@ buildPythonPackage rec {
     hash = "sha256-LoK0wb7rAbVbgyURCbSfckWvJDef3tPY+7V4YU1IBRU=";
   };
 
+  patches = [
+    # Rename pytest_collect_file hook parameter `path` -> `file_path` for pytest 9.
+    ./pytest9-collect-hook.patch
+  ];
+
   postPatch = ''
     # we disable the tests relying on coverage for unrelated reasons
     substituteInPlace tests/test_execution.py \
diff --git a/pkgs/development/python-modules/pytest-notebook/pytest9-collect-hook.patch b/pkgs/development/python-modules/pytest-notebook/pytest9-collect-hook.patch
new file mode 100644
index 000000000000..c35a77dd6159
--- /dev/null
+++ b/pkgs/development/python-modules/pytest-notebook/pytest9-collect-hook.patch
@@ -0,0 +1,31 @@
+--- a/pytest_notebook/plugin.py
++++ b/pytest_notebook/plugin.py
+@@ -11,6 +11,7 @@
+
+ """
+ import os
++from fnmatch import fnmatch
+ import shlex
+
+ import pytest
+@@ -263,16 +264,16 @@
+     return NBRegressionFixture(**kwargs)
+
+
+-def pytest_collect_file(path, parent):
++def pytest_collect_file(file_path, parent):
+     """Collect Jupyter notebooks using the specified pytest hook."""
+     kwargs, other_args = gather_config_options(parent.config)
+     if other_args.get("nb_test_files", False) and any(
+-        path.fnmatch(pat) for pat in other_args.get("nb_file_fnmatch", ["*.ipynb"])
++        fnmatch(file_path.name, pat) for pat in other_args.get("nb_file_fnmatch", ["*.ipynb"])
+     ):
+         try:
+-            return JupyterNbCollector.from_parent(parent, fspath=path)
++            return JupyterNbCollector.from_parent(parent, path=file_path)
+         except AttributeError:
+-            return JupyterNbCollector(path, parent)
++            return JupyterNbCollector(file_path, parent)
+
+
+ class JupyterNbCollector(pytest.File):

From 63e3952d1fe82b793d82dbbb41a7434be7516d80 Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Sat, 23 May 2026 20:07:34 +0700
Subject: [PATCH 28/61] python3Packages.stim: fix build with pybind11 3.0

(cherry picked from commit f6ce4ceeec8fbd3d5b12b3899568f377048eb905)
---
 pkgs/development/python-modules/stim/default.nix      |  5 +++++
 .../fix-measure-kickback-lambda-return-type.patch     | 11 +++++++++++
 2 files changed, 16 insertions(+)
 create mode 100644 pkgs/development/python-modules/stim/fix-measure-kickback-lambda-return-type.patch

diff --git a/pkgs/development/python-modules/stim/default.nix b/pkgs/development/python-modules/stim/default.nix
index 8df37c45ac8e..9818c2b3990a 100644
--- a/pkgs/development/python-modules/stim/default.nix
+++ b/pkgs/development/python-modules/stim/default.nix
@@ -32,6 +32,11 @@ buildPythonPackage rec {
     hash = "sha256-Wls7dJkuV/RXnMizwrYOJOKopWEf1r21FKoKHjmpEQ0=";
   };
 
+  patches = [
+    # Fix measure_kickback lambda return type deduction under pybind11 3.0.
+    ./fix-measure-kickback-lambda-return-type.patch
+  ];
+
   postPatch = ''
     # asked to relax this in https://github.com/quantumlib/Stim/issues/623
     substituteInPlace pyproject.toml \
diff --git a/pkgs/development/python-modules/stim/fix-measure-kickback-lambda-return-type.patch b/pkgs/development/python-modules/stim/fix-measure-kickback-lambda-return-type.patch
new file mode 100644
index 000000000000..bf19652bfed3
--- /dev/null
+++ b/pkgs/development/python-modules/stim/fix-measure-kickback-lambda-return-type.patch
@@ -0,0 +1,11 @@
+--- a/src/stim/simulators/tableau_simulator.pybind.cc
++++ b/src/stim/simulators/tableau_simulator.pybind.cc
+@@ -2287,7 +2287,7 @@
+
+     c.def(
+         "measure_kickback",
+-        [](TableauSimulator<MAX_BITWORD_WIDTH> &self, uint32_t target) {
++        [](TableauSimulator<MAX_BITWORD_WIDTH> &self, uint32_t target) -> pybind11::tuple {
+             self.ensure_large_enough_for_qubits(target + 1);
+             auto result = self.measure_kickback_z({target});
+             if (result.second.num_qubits == 0) {

From 967edda59b270e5e128e9171d40837f74c97b25a Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Sat, 23 May 2026 14:36:10 +0700
Subject: [PATCH 29/61] trurl: fix tests with libcurl 8.20.0 uppercase hex

(cherry picked from commit 051cb3d9ca45ac6ae3dedf41d01f0d43c8200360)
---
 pkgs/by-name/tr/trurl/package.nix             |  2 +
 .../tr/trurl/tests-uppercase-hex.patch        | 96 +++++++++++++++++++
 2 files changed, 98 insertions(+)
 create mode 100644 pkgs/by-name/tr/trurl/tests-uppercase-hex.patch

diff --git a/pkgs/by-name/tr/trurl/package.nix b/pkgs/by-name/tr/trurl/package.nix
index d9f7b7d9442b..345b14b03c74 100644
--- a/pkgs/by-name/tr/trurl/package.nix
+++ b/pkgs/by-name/tr/trurl/package.nix
@@ -26,6 +26,8 @@ stdenv.mkDerivation rec {
       url = "https://github.com/curl/trurl/commit/f22a2c45956f35702e437fb83ac05376f1956ec5.patch";
       hash = "sha256-7CkUs5tMk77WKc7SlgE2NslHtU5cViKSGhHj3IBlpWo=";
     })
+    # https://github.com/curl/trurl/pull/441
+    ./tests-uppercase-hex.patch
   ];
 
   postPatch = ''
diff --git a/pkgs/by-name/tr/trurl/tests-uppercase-hex.patch b/pkgs/by-name/tr/trurl/tests-uppercase-hex.patch
new file mode 100644
index 000000000000..8308b8e2c15f
--- /dev/null
+++ b/pkgs/by-name/tr/trurl/tests-uppercase-hex.patch
@@ -0,0 +1,96 @@
+--- a/tests.json
++++ b/tests.json
+@@ -749,6 +749,7 @@
+                 "query=user=me"
+             ]
+         },
++        "excludes": ["uppercase-hex"],
+         "expected": {
+             "stdout": "https://curl.se/hello?user%3dme\n",
+             "stderr": "",
+@@ -761,6 +762,22 @@
+                 "--url",
+                 "https://curl.se/hello",
+                 "--set",
++                "query=user=me"
++            ]
++        },
++        "required": ["uppercase-hex"],
++        "expected": {
++            "stdout": "https://curl.se/hello?user%3Dme\n",
++            "stderr": "",
++            "returncode": 0
++        }
++    },
++    {
++        "input": {
++            "arguments": [
++                "--url",
++                "https://curl.se/hello",
++                "--set",
+                 "fragment= hello"
+             ]
+         },
+@@ -2132,6 +2149,7 @@
+                 "query:=a&b&a%26b"
+             ]
+         },
++        "excludes": ["uppercase-hex"],
+         "expected": {
+             "stdout": "http://localhost/ABC%5c%5c?a&b&a%26b\n",
+             "returncode": 0,
+@@ -2141,6 +2159,26 @@
+     {
+         "input": {
+             "arguments": [
++                "-s",
++                "scheme:=http",
++                "-s",
++                "host:=localhost",
++                "-s",
++                "path:=/ABC%5C%5C",
++                "-s",
++                "query:=a&b&a%26b"
++            ]
++        },
++        "required": ["uppercase-hex"],
++        "expected": {
++            "stdout": "http://localhost/ABC%5C%5C?a&b&a%26b\n",
++            "returncode": 0,
++            "stderr": ""
++        }
++    },
++    {
++        "input": {
++            "arguments": [
+                 "-g",
+                 "{query:b}\\t{query-all:a}\\n{:query:b}\\t{:query-all:a}",
+                 "https://example.org/foo?a=1&b=%23&a=%26#hello"
+@@ -2825,11 +2863,27 @@
+                 "path=%61"
+             ]
+         },
++        "excludes": ["uppercase-hex"],
+         "expected": {
+             "stdout": "https://example.com/one/tao/%2fB/%2561\n",
+             "stderr": "",
+             "returncode": 0
+         }
++    },
++    {
++        "input": {
++            "arguments": [
++                "https://example.com/one/t%61o/%2F%42/",
++                "--append",
++                "path=%61"
++            ]
++        },
++        "required": ["uppercase-hex"],
++        "expected": {
++            "stdout": "https://example.com/one/tao/%2FB/%2561\n",
++            "stderr": "",
++            "returncode": 0
++        }
+     },
+     {
+         "input": {

From 4481e80f318a559f73daa28a7f5d55fe4fdada4e Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Fri, 22 May 2026 19:26:05 +0200
Subject: [PATCH 30/61] gnat16Packages.gprbuild{,-boot}: fix build

https://github.com/AdaCore/gprbuild/commit/6421e350274b3018a26bd058b1c90d033b053f71
https://github.com/AdaCore/gprbuild/commit/6b6be939d69d534beb7faca17664d7a1ffa9c81e

Hydra: https://hydra.nixos.org/build/329281640
(cherry picked from commit 41b2d014496ce39e98cc90f20c940875b7ad2632)
---
 pkgs/development/ada-modules/gprbuild/boot.nix    | 15 +++++++++++++++
 pkgs/development/ada-modules/gprbuild/default.nix | 12 +++++++-----
 2 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/ada-modules/gprbuild/boot.nix b/pkgs/development/ada-modules/gprbuild/boot.nix
index 3ba3c4e52daa..0f8227d50d35 100644
--- a/pkgs/development/ada-modules/gprbuild/boot.nix
+++ b/pkgs/development/ada-modules/gprbuild/boot.nix
@@ -2,6 +2,7 @@
   stdenv,
   lib,
   fetchFromGitHub,
+  fetchpatch2,
   gnat,
   which,
   xmlada, # for src
@@ -36,6 +37,20 @@ stdenv.mkDerivation {
     which
   ];
 
+  # Fix compilation with GNAT 16
+  patches = lib.optionals (lib.versionAtLeast gnat.version "16") [
+    # gpr-compilation-process.adb:44:29: error: operator for type "String" is not declared in "Env_Maps"
+    (fetchpatch2 {
+      url = "https://github.com/AdaCore/gprbuild/commit/6421e350274b3018a26bd058b1c90d033b053f71.patch?full_index=1";
+      hash = "sha256-u9bmr8abmthlyHoeqW5nS2CnaxXmbx6WVwhemxVtw+0=";
+    })
+    # gpr-compilation-protocol.adb:981:13: error: "time_t" is undefined
+    (fetchpatch2 {
+      url = "https://github.com/AdaCore/gprbuild/commit/6b6be939d69d534beb7faca17664d7a1ffa9c81e.patch?full_index=1";
+      hash = "sha256-YUjBvA4bBsrCB46o5WVHOZR6qOf2bkMg+A9qlystDbc=";
+    })
+  ];
+
   postPatch = ''
     # The Makefile uses gprbuild to build gprbuild which
     # we can't do at this point, delete it to prevent the
diff --git a/pkgs/development/ada-modules/gprbuild/default.nix b/pkgs/development/ada-modules/gprbuild/default.nix
index c8d530466ca7..b722f012d431 100644
--- a/pkgs/development/ada-modules/gprbuild/default.nix
+++ b/pkgs/development/ada-modules/gprbuild/default.nix
@@ -47,11 +47,13 @@ stdenv.mkDerivation {
     NIX_LDFLAGS = "-headerpad_max_install_names";
   };
 
-  # Fixes gprbuild being linked statically always. Based on the AUR's patch:
-  # https://aur.archlinux.org/cgit/aur.git/plain/0001-Makefile-build-relocatable-instead-of-static-binary.patch?h=gprbuild&id=bac524c76cd59c68fb91ef4dfcbe427357b9f850
-  patches = lib.optionals (!stdenv.hostPlatform.isStatic) [
-    ./gprbuild-relocatable-build.patch
-  ];
+  patches =
+    gprbuild-boot.patches
+    # Fixes gprbuild being linked statically always. Based on the AUR's patch:
+    # https://aur.archlinux.org/cgit/aur.git/plain/0001-Makefile-build-relocatable-instead-of-static-binary.patch?h=gprbuild&id=bac524c76cd59c68fb91ef4dfcbe427357b9f850
+    ++ lib.optionals (!stdenv.hostPlatform.isStatic) [
+      ./gprbuild-relocatable-build.patch
+    ];
 
   buildFlags = [
     "all"

From dbfdf9cd0ca4877441ebf47bf7cf323c58392e0e Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Fri, 22 May 2026 20:17:21 +0200
Subject: [PATCH 31/61] gnat16Packages.gnatcoll-core: fix build

https://github.com/AdaCore/gnatcoll-core/commit/b266466e0a05b30615ec43d72782c345470455b9
(cherry picked from commit 9c940973d48d3a41580352bfbd6768fa8dc891db)
---
 pkgs/development/ada-modules/gnatcoll/core.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/development/ada-modules/gnatcoll/core.nix b/pkgs/development/ada-modules/gnatcoll/core.nix
index 4e8e8b6c2e8e..90a1fb025365 100644
--- a/pkgs/development/ada-modules/gnatcoll/core.nix
+++ b/pkgs/development/ada-modules/gnatcoll/core.nix
@@ -36,6 +36,12 @@ stdenv.mkDerivation rec {
       url = "https://github.com/AdaCore/gnatcoll-core/commit/515db1c9f1eea8095f2d9ff9570159a78c981ec6.patch";
       sha256 = "1ghnkhp5fncb7qcmf59kyqvy0sd0pzf1phnr2z7b4ljwlkbmcp36";
     })
+    # Fix compilation with GNAT 16
+    (fetchpatch2 {
+      name = "gnatcoll-core-gnat-16.patch";
+      url = "https://github.com/AdaCore/gnatcoll-core/commit/b266466e0a05b30615ec43d72782c345470455b9.patch?full_index=1";
+      hash = "sha256-rG0D1y2dbXA2M2Arnto+f7iAhg3yCfTPDbDRN+pMJKQ=";
+    })
   ];
 
   postPatch = ''

From 70d7ddf85a04148cd112f19def63e15c0a6a0cfa Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Fri, 22 May 2026 20:23:42 +0200
Subject: [PATCH 32/61] gnatPackages.gnatcoll-core: remove redundant gnat 12
 patch

We don't ship gnat 12 anymore.

(cherry picked from commit a261d6ec3c79cf291e8d78c9eef0efed92b5ab14)
---
 pkgs/development/ada-modules/gnatcoll/core.nix | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/pkgs/development/ada-modules/gnatcoll/core.nix b/pkgs/development/ada-modules/gnatcoll/core.nix
index 90a1fb025365..e60230332945 100644
--- a/pkgs/development/ada-modules/gnatcoll/core.nix
+++ b/pkgs/development/ada-modules/gnatcoll/core.nix
@@ -30,12 +30,6 @@ stdenv.mkDerivation rec {
   };
 
   patches = [
-    # Fix compilation with GNAT 12 https://github.com/AdaCore/gnatcoll-core/issues/88
-    (fetchpatch2 {
-      name = "gnatcoll-core-gnat-12.patch";
-      url = "https://github.com/AdaCore/gnatcoll-core/commit/515db1c9f1eea8095f2d9ff9570159a78c981ec6.patch";
-      sha256 = "1ghnkhp5fncb7qcmf59kyqvy0sd0pzf1phnr2z7b4ljwlkbmcp36";
-    })
     # Fix compilation with GNAT 16
     (fetchpatch2 {
       name = "gnatcoll-core-gnat-16.patch";

From 0851e70d9cd27e453f3977be5c290e203fa2c1fd Mon Sep 17 00:00:00 2001
From: Tom Hunze <dev@thunze.de>
Date: Sat, 23 May 2026 22:37:05 +0200
Subject: [PATCH 33/61] gnat15Packages.gnatprove: fix build on `aarch64-linux`

Co-Authored-By: sempiternal-aurora <78790545+sempiternal-aurora@users.noreply.github.com>
(cherry picked from commit f1840faeb1c85b0d53c7e705e38d83de62bdcbda)
---
 pkgs/development/ada-modules/gnatprove/default.nix | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkgs/development/ada-modules/gnatprove/default.nix b/pkgs/development/ada-modules/gnatprove/default.nix
index 2eba4ae77a11..d4e39a3506d1 100644
--- a/pkgs/development/ada-modules/gnatprove/default.nix
+++ b/pkgs/development/ada-modules/gnatprove/default.nix
@@ -86,6 +86,9 @@ let
       patches = [
         # Disable Coq related targets which are missing in the fsf-15 branch
         ./0001-fix-install-fsf-15.patch
+
+        # Suppress warnings on aarch64: https://github.com/AdaCore/spark2014/issues/54
+        ./0002-mute-aarch64-warnings.patch
       ];
       commit_date = "2025-06-10";
     };

From ff0d1794902a156f274f9c664b6f6828b9f16483 Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Tue, 19 May 2026 16:20:32 +0700
Subject: [PATCH 34/61] halide: fix correctness_simd_op_check_x86 bf16
 disagreement

(cherry picked from commit 7513744a7a08b04768c153e16aace6e4e98a2e40)
---
 pkgs/by-name/ha/halide/package.nix | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/pkgs/by-name/ha/halide/package.nix b/pkgs/by-name/ha/halide/package.nix
index c48162371c5c..1f1cbceeebb1 100644
--- a/pkgs/by-name/ha/halide/package.nix
+++ b/pkgs/by-name/ha/halide/package.nix
@@ -3,6 +3,7 @@
   stdenv,
   llvmPackages,
   fetchFromGitHub,
+  fetchpatch2,
   cmake,
   flatbuffers,
   libffi,
@@ -37,6 +38,19 @@ stdenv.mkDerivation (finalAttrs: {
     hash = "sha256-A5EnZgXc9+L+bzWHftaL74nHmP8Jf0rnT5KJAAWvKis=";
   };
 
+  patches = [
+    # Backport: properly initialize bf16 inputs in simd_op_check.
+    (fetchpatch2 {
+      url = "https://github.com/halide/Halide/commit/acb58504f0ce02e07b8b9008668c8779d3561ec8.patch?full_index=1";
+      hash = "sha256-n9avTYe8JFYQKeJQBQQV9xoOoYp0imXD2GQgifRym/A=";
+    })
+    # Backport: add Zen4/Zen5/AVXVNNI feature flags to simd_op_check's can_run_code.
+    (fetchpatch2 {
+      url = "https://github.com/halide/Halide/commit/1b9be55dfaa162fad6a3ed3c6e8d83f966ce8af1.patch?full_index=1";
+      hash = "sha256-5f6Q2Q1pvimlFV3lCcMzIHMIze6A8TmnMjVpQ8/ceyg=";
+    })
+  ];
+
   postPatch = ''
     substituteInPlace src/runtime/CMakeLists.txt --replace-fail \
         '-isystem "''${VulkanHeaders_INCLUDE_DIR}"' \

From c686adf96108b891f2d9abac48f3c1ac690b73ac Mon Sep 17 00:00:00 2001
From: Angel J <78835633+Iamanaws@users.noreply.github.com>
Date: Sat, 16 May 2026 12:08:45 -0700
Subject: [PATCH 35/61] ocamlPackages.mirage-crypto-rng: fix tests on
 x86_64-darwin

(cherry picked from commit 1bcf9b24d8b601c4feafb4ef5e8d2dab34cb85f3)
---
 pkgs/development/ocaml-modules/mirage-crypto/rng.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/pkgs/development/ocaml-modules/mirage-crypto/rng.nix b/pkgs/development/ocaml-modules/mirage-crypto/rng.nix
index e8a22ce06571..4c80fa46ca38 100644
--- a/pkgs/development/ocaml-modules/mirage-crypto/rng.nix
+++ b/pkgs/development/ocaml-modules/mirage-crypto/rng.nix
@@ -1,4 +1,6 @@
 {
+  lib,
+  stdenv,
   buildDunePackage,
   mirage-crypto,
   ohex,
@@ -24,6 +26,14 @@ buildDunePackage {
     randomconv
   ];
 
+  # test_entropy relies on timer jitter and is flaky on x86_64-darwin.
+  postPatch = lib.optionalString (stdenv.hostPlatform.isDarwin && stdenv.hostPlatform.isx86_64) ''
+    substituteInPlace tests/dune \
+      --replace-fail \
+        '(enabled_if (and (<> %{architecture} "arm64") (<> %{architecture} "riscv")))' \
+        '(enabled_if false)'
+  '';
+
   buildInputs = [ dune-configurator ];
   propagatedBuildInputs = [
     digestif

From 73f7fa84f6ae0a86a5bcbe2ba952ce98049ecffe Mon Sep 17 00:00:00 2001
From: sinanmohd <sinan@sinanmohd.com>
Date: Wed, 27 May 2026 11:36:39 +0530
Subject: [PATCH 36/61] Revert "sdnotify-wrapper: drop"

reverts commit e8019539903b73d2ac5691d10aa362da0a19567f.
drop deprecated header from sdnotify-wrapper

(cherry picked from commit 09384d7270eed91a1eac560ad312b0b599a22b78)
---
 nixos/modules/services/desktops/seatd.nix     |   3 +-
 pkgs/development/skaware-packages/default.nix |  10 +-
 .../sdnotify-wrapper/default.nix              |  47 +++++
 .../sdnotify-wrapper/sdnotify-wrapper.c       | 174 ++++++++++++++++++
 pkgs/top-level/aliases.nix                    |   1 -
 pkgs/top-level/all-packages.nix               |   1 +
 6 files changed, 226 insertions(+), 10 deletions(-)
 create mode 100644 pkgs/development/skaware-packages/sdnotify-wrapper/default.nix
 create mode 100644 pkgs/development/skaware-packages/sdnotify-wrapper/sdnotify-wrapper.c

diff --git a/nixos/modules/services/desktops/seatd.nix b/nixos/modules/services/desktops/seatd.nix
index 939b9f338af9..bedcc9a43120 100644
--- a/nixos/modules/services/desktops/seatd.nix
+++ b/nixos/modules/services/desktops/seatd.nix
@@ -40,6 +40,7 @@ in
   config = lib.mkIf cfg.enable {
     environment.systemPackages = with pkgs; [
       seatd
+      sdnotify-wrapper
     ];
     users.groups.seat = lib.mkIf (cfg.group == "seat") { };
 
@@ -54,7 +55,7 @@ in
         Type = "notify";
         NotifyAccess = "all";
         SyslogIdentifier = "seatd";
-        ExecStart = "${lib.getExe' pkgs.s6 "s6-notify-socket-from-fd"} ${pkgs.seatd.bin}/bin/seatd -n 1 -u ${cfg.user} -g ${cfg.group} -l ${cfg.logLevel}";
+        ExecStart = "${pkgs.sdnotify-wrapper}/bin/sdnotify-wrapper ${pkgs.seatd.bin}/bin/seatd -n 1 -u ${cfg.user} -g ${cfg.group} -l ${cfg.logLevel}";
         RestartSec = 1;
         Restart = "always";
       };
diff --git a/pkgs/development/skaware-packages/default.nix b/pkgs/development/skaware-packages/default.nix
index 0ae8c4d43865..b0877ada8c36 100644
--- a/pkgs/development/skaware-packages/default.nix
+++ b/pkgs/development/skaware-packages/default.nix
@@ -1,8 +1,4 @@
-{
-  lib,
-  pkgs,
-  config,
-}:
+{ lib, pkgs }:
 
 lib.makeScope pkgs.newScope (
   self:
@@ -26,6 +22,7 @@ lib.makeScope pkgs.newScope (
     # libs
     skalibs = callPackage ./skalibs { };
     skalibs_2_10 = callPackage ./skalibs/2_10.nix { };
+    sdnotify-wrapper = callPackage ./sdnotify-wrapper { };
 
     # s6 tooling
     s6 = callPackage ./s6 { };
@@ -43,7 +40,4 @@ lib.makeScope pkgs.newScope (
     s6-portable-utils-man-pages = self.s6-portable-utils.passthru.manpages;
     s6-rc-man-pages = self.s6-rc.passthru.manpages;
   }
-  // lib.optionalAttrs config.allowAliases {
-    sdnotify-wrapper = throw "sdnotify-wrapper has been removed in favour of s6-notify-socket-from-fd in the s6 package";
-  }
 )
diff --git a/pkgs/development/skaware-packages/sdnotify-wrapper/default.nix b/pkgs/development/skaware-packages/sdnotify-wrapper/default.nix
new file mode 100644
index 000000000000..d9fa940a3294
--- /dev/null
+++ b/pkgs/development/skaware-packages/sdnotify-wrapper/default.nix
@@ -0,0 +1,47 @@
+{
+  lib,
+  runCommandCC,
+  skalibs,
+}:
+
+let
+  # From https://skarnet.org/software/misc/sdnotify-wrapper.c,
+  # which is unversioned.
+  src = ./sdnotify-wrapper.c;
+
+in
+runCommandCC "sdnotify-wrapper"
+  {
+
+    outputs = [
+      "bin"
+      "doc"
+      "out"
+    ];
+
+    meta = {
+      homepage = "https://skarnet.org/software/misc/sdnotify-wrapper.c";
+      description = "Use systemd sd_notify without having to link against libsystemd";
+      mainProgram = "sdnotify-wrapper";
+      platforms = lib.platforms.linux;
+      license = lib.licenses.isc;
+      maintainers = with lib.maintainers; [ Profpatsch ];
+    };
+
+  }
+  ''
+    mkdir -p $bin/bin
+    mkdir $out
+
+    # the -lskarnet has to come at the end to support static builds
+    $CC \
+      -o $bin/bin/sdnotify-wrapper \
+      -I${skalibs.dev}/include \
+      -L${skalibs.lib}/lib \
+      ${src} \
+      -lskarnet
+
+    mkdir -p $doc/share/doc/sdnotify-wrapper
+    # copy the documentation comment
+    sed -ne '/Usage:/,/*\//p' ${src} > $doc/share/doc/sdnotify-wrapper/README
+  ''
diff --git a/pkgs/development/skaware-packages/sdnotify-wrapper/sdnotify-wrapper.c b/pkgs/development/skaware-packages/sdnotify-wrapper/sdnotify-wrapper.c
new file mode 100644
index 000000000000..00ede0b2d706
--- /dev/null
+++ b/pkgs/development/skaware-packages/sdnotify-wrapper/sdnotify-wrapper.c
@@ -0,0 +1,174 @@
+/*
+   Copyright: (C)2015-2020 Laurent Bercot.  http://skarnet.org/
+   ISC license. See http://opensource.org/licenses/ISC
+
+   Build-time requirements: skalibs.  https://skarnet.org/software/skalibs/
+   Run-time requirements: none, if you link skalibs statically.
+
+   Compilation:
+     gcc -o sdnotify-wrapper -L/usr/lib/skalibs sdnotify-wrapper.c -lskarnet
+   Use /usr/lib/skalibs/libskarnet.a instead of -lskarnet to link statically.
+   Adapt gcc's -I and -L options to your skalibs installation paths.
+
+   Usage: if a daemon would be launched by systemd as "foobard args...",
+   launch it as "sdnotify-wrapper foobard args..." instead, and you can now
+   tell systemd that this daemon supports readiness notification.
+
+   Instead of using sd_notify() and having to link against the systemd
+   library, the daemon notifies readiness by writing whatever it wants
+   to a file descriptor (by default: stdout), then a newline. (Then it
+   should close that file descriptor.) The simplest way is something like
+   int notify_readiness() { write(1, "\n", 1) ; close(1) ; }
+   This mechanism is understandable by any notification readiness framework.
+
+   Readiness notification occurs when the newline is written, not when
+   the descriptor is closed; but since sdnotify-wrapper stops reading
+   after the first newline and will exit, any subsequent writes will
+   fail and it's best to simply close the descriptor right away.
+
+   sdnotify-wrapper sees the notification when it occurs and sends it
+   to systemd using the sd_notify format.
+
+   Options:
+     -d fd: the daemon will write its notification on descriptor fd.
+     Default is 1.
+     -f: do not doublefork. Use if the daemon waits for children it does
+     not know it has (for instance, superservers do this). When in doubt,
+     do not use that option, or you may have a zombie hanging around.
+     -t timeout: if the daemon has not sent a notification after timeout
+     milliseconds, give up and exit; systemd will not be notified.
+     -k: keep the NOTIFY_SOCKET environment variable when execing into the
+     daemon. By default, the variable is unset: the daemon should not need it.
+
+   Notes:
+     sdnotify-wrapper does not change the daemon's pid. It runs as a
+     (grand)child of the daemon.
+     If the NOTIFY_SOCKET environment variable is not set, sdnotify-wrapper
+     does nothing - it only execs into the daemon.
+     sdnotify-wrapper is more liberal than sd_notify(). It will accept
+     a relative path in NOTIFY_SOCKET.
+*/
+
+
+#include <sys/types.h>
+#include <string.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <errno.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+
+#include <skalibs/uint64.h>
+#include <skalibs/types.h>
+#include <skalibs/bytestr.h>
+#include <skalibs/sgetopt.h>
+#include <skalibs/strerr.h>
+#include <skalibs/allreadwrite.h>
+#include <skalibs/tai.h>
+#include <skalibs/iopause.h>
+#include <skalibs/djbunix.h>
+#include <skalibs/socket.h>
+#include <skalibs/exec.h>
+
+#define USAGE "sdnotify-wrapper [ -d fd ] [ -f ] [ -t timeout ] [ -k ] prog..."
+#define dieusage() strerr_dieusage(100, USAGE)
+
+#define VAR "NOTIFY_SOCKET"
+
+static inline int ipc_sendto (int fd, char const *s, size_t len, char const *path)
+{
+  struct sockaddr_un sa ;
+  size_t l = strlen(path) ;
+  if (l > IPCPATH_MAX) return (errno = ENAMETOOLONG, 0) ;
+  memset(&sa, 0, sizeof sa) ;
+  sa.sun_family = AF_UNIX ;
+  memcpy(sa.sun_path, path, l+1) ;
+  if (path[0] == '@') sa.sun_path[0] = 0 ;
+  return sendto(fd, s, len, MSG_NOSIGNAL, (struct sockaddr *)&sa, sizeof sa) >= 0 ;
+}
+
+static inline void notify_systemd (pid_t pid, char const *socketpath)
+{
+  size_t n = 16 ;
+  char fmt[16 + PID_FMT] = "READY=1\nMAINPID=" ;
+  int fd = ipc_datagram_b() ;
+  if (fd < 0) strerr_diefu1sys(111, "create socket") ;
+  n += pid_fmt(fmt + n, pid) ;
+  fmt[n++] = '\n' ;
+  if (!ipc_sendto(fd, fmt, n, socketpath))
+    strerr_diefu2sys(111, "send notification message to ", socketpath) ;
+  close(fd) ;
+}
+
+static inline int run_child (int fd, unsigned int timeout, pid_t pid, char const *s)
+{
+  char dummy[4096] ;
+  iopause_fd x = { .fd = fd, .events = IOPAUSE_READ } ;
+  tain deadline ;
+  tain_now_g() ;
+  if (timeout) tain_from_millisecs(&deadline, timeout) ;
+  else deadline = tain_infinite_relative ;
+  tain_add_g(&deadline, &deadline) ;
+  for (;;)
+  {
+    int r = iopause_g(&x, 1, &deadline) ;
+    if (r < 0) strerr_diefu1sys(111, "iopause") ;
+    if (!r) return 99 ;
+    r = sanitize_read(fd_read(fd, dummy, 4096)) ;
+    if (r < 0)
+      if (errno == EPIPE) return 1 ;
+      else strerr_diefu1sys(111, "read from parent") ;
+    else if (r && memchr(dummy, '\n', r)) break ;
+  }
+  close(fd) ;
+  notify_systemd(pid, s) ;
+  return 0 ;
+}
+
+int main (int argc, char const *const *argv)
+{
+  char const *s = getenv(VAR) ;
+  unsigned int fd = 1 ;
+  unsigned int timeout = 0 ;
+  int df = 1, keep = 0 ;
+  PROG = "sdnotify-wrapper" ;
+  {
+    subgetopt l = SUBGETOPT_ZERO ;
+    for (;;)
+    {
+      int opt = subgetopt_r(argc, argv, "d:ft:k", &l) ;
+      if (opt == -1) break ;
+      switch (opt)
+      {
+        case 'd' : if (!uint0_scan(l.arg, &fd)) dieusage() ; break ;
+        case 'f' : df = 0 ; break ;
+        case 't' : if (!uint0_scan(l.arg, &timeout)) dieusage() ; break ;
+        case 'k' : keep = 1 ; break ;
+        default : dieusage() ;
+      }
+    }
+    argc -= l.ind ; argv += l.ind ;
+  }
+  if (!argc) dieusage() ;
+
+  if (!s) xexec(argv) ;
+  else
+  {
+    pid_t parent = getpid() ;
+    pid_t child ;
+    int p[2] ;
+    if (pipe(p) < 0) strerr_diefu1sys(111, "pipe") ;
+    child = df ? doublefork() : fork() ;
+    if (child < 0) strerr_diefu1sys(111, df ? "doublefork" : "fork") ;
+    else if (!child)
+    {
+      PROG = "sdnotify-wrapper (child)" ;
+      close(p[1]) ;
+      return run_child(p[0], timeout, parent, s) ;
+    }
+    close(p[0]) ;
+    if (fd_move((int)fd, p[1]) < 0) strerr_diefu1sys(111, "move descriptor") ;
+    if (keep) xexec(argv) ;
+    else xmexec_m(argv, VAR, sizeof(VAR)) ;
+  }
+}
diff --git a/pkgs/top-level/aliases.nix b/pkgs/top-level/aliases.nix
index 5577e9e495cd..63a651c4b789 100644
--- a/pkgs/top-level/aliases.nix
+++ b/pkgs/top-level/aliases.nix
@@ -1909,7 +1909,6 @@ mapAliases {
   SDL2_classic_image = throw "'SDL2_classic_image' has been removed as part of the deprecation of 'SDL2_classic'. Consider upgrading to 'SDL2_image' built with 'sdl2-compat'."; # Added 2025-05-20
   SDL2_classic_mixer = throw "'SDL2_classic_mixer' has been removed as part of the deprecation of 'SDL2_classic'. Consider upgrading to 'SDL2_mixer' built with 'sdl2-compat'."; # Added 2025-05-20
   SDL2_classic_ttf = throw "'SDL2_classic_ttf' has been removed as part of the deprecation of 'SDL2_classic'. Consider upgrading to 'SDL2_ttf' built with 'sdl2-compat'."; # Added 2025-05-20
-  sdnotify-wrapper = skawarePackages.sdnotify-wrapper;
   seafile-server = throw "'seafile-server' has been removed as it is unmaintained"; # Added 2025-08-21
   seahub = throw "'seahub' has been removed as it is unmaintained"; # Added 2025-08-21
   semantik = throw "'semantik' has been removed as it depended on EOL qt5 webengine"; # Added 2026-04-17
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index bfbea7b08f19..77fe0d3fd505 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -7197,6 +7197,7 @@ with pkgs;
     s6-portable-utils-man-pages
     s6-rc
     s6-rc-man-pages
+    sdnotify-wrapper
     skalibs
     skalibs_2_10
     tipidee

From f426a0a1510214e7bcfdea4b0584737e17b2442b Mon Sep 17 00:00:00 2001
From: K900 <me@0upti.me>
Date: Wed, 27 May 2026 13:15:06 +0300
Subject: [PATCH 37/61] firefox/wrapper: better way to disable update checks

See https://bugzilla.mozilla.org/show_bug.cgi?id=2042197

(cherry picked from commit 1da3ca73732263dc0473f0d64ccdfa810eaa1fac)
---
 .../networking/browsers/firefox/wrapper.nix   | 55 ++++++++++---------
 1 file changed, 28 insertions(+), 27 deletions(-)

diff --git a/pkgs/applications/networking/browsers/firefox/wrapper.nix b/pkgs/applications/networking/browsers/firefox/wrapper.nix
index 0d2cd7bdf46e..e05899ae0e8d 100644
--- a/pkgs/applications/networking/browsers/firefox/wrapper.nix
+++ b/pkgs/applications/networking/browsers/firefox/wrapper.nix
@@ -166,36 +166,34 @@ let
           ) (lib.optionals usesNixExtensions nixExtensions);
 
       enterprisePolicies = {
-        policies = {
-          DisableAppUpdate = true;
-        }
-        // lib.optionalAttrs usesNixExtensions {
-          ExtensionSettings = {
-            "*" = {
-              blocked_install_message = "You can't have manual extension mixed with nix extensions";
-              installation_mode = "blocked";
-            };
-          }
-          // lib.foldr (
-            e: ret:
-            ret
-            // {
-              "${e.extid}" = {
-                installation_mode = "allowed";
+        policies =
+          lib.optionalAttrs usesNixExtensions {
+            ExtensionSettings = {
+              "*" = {
+                blocked_install_message = "You can't have manual extension mixed with nix extensions";
+                installation_mode = "blocked";
               };
             }
-          ) { } extensions;
+            // lib.foldr (
+              e: ret:
+              ret
+              // {
+                "${e.extid}" = {
+                  installation_mode = "allowed";
+                };
+              }
+            ) { } extensions;
 
-          Extensions = {
-            Install = lib.foldr (e: ret: ret ++ [ "${e.outPath}/${e.extid}.xpi" ]) [ ] extensions;
-          };
-        }
-        // lib.optionalAttrs smartcardSupport {
-          SecurityDevices = {
-            "OpenSC PKCS#11 Module" = "opensc-pkcs11.so";
-          };
-        }
-        // extraPolicies;
+            Extensions = {
+              Install = lib.foldr (e: ret: ret ++ [ "${e.outPath}/${e.extid}.xpi" ]) [ ] extensions;
+            };
+          }
+          // lib.optionalAttrs smartcardSupport {
+            SecurityDevices = {
+              "OpenSC PKCS#11 Module" = "opensc-pkcs11.so";
+            };
+          }
+          // extraPolicies;
       };
 
       mozillaCfg = ''
@@ -414,6 +412,9 @@ let
             ln -sfT "$target" "$out/$l"
           done
 
+          # Disable update checks
+          touch $out/${libDir}/is-packaged-app
+
           cd "$out"
 
         ''

From 899b40ceb0808a5e6031cc44090b4d97f57a1319 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Tue, 26 May 2026 07:29:40 +0200
Subject: [PATCH 38/61] =?UTF-8?q?ocamlPackages.tar:=203.3.0=20=E2=86=92=20?=
 =?UTF-8?q?3.5.0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

(cherry picked from commit a8d1e46e750abb9256955682cd257d2344f9a444)
---
 pkgs/development/ocaml-modules/tar/default.nix | 14 +++++---------
 pkgs/development/ocaml-modules/tar/eio.nix     |  8 +++++---
 pkgs/development/ocaml-modules/tar/unix.nix    |  4 ++++
 pkgs/top-level/ocaml-packages.nix              |  4 +---
 4 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/pkgs/development/ocaml-modules/tar/default.nix b/pkgs/development/ocaml-modules/tar/default.nix
index 712579e067f4..f0559a19d126 100644
--- a/pkgs/development/ocaml-modules/tar/default.nix
+++ b/pkgs/development/ocaml-modules/tar/default.nix
@@ -2,22 +2,18 @@
   lib,
   fetchurl,
   buildDunePackage,
-  camlp-streams,
   decompress,
 }:
 
-buildDunePackage rec {
+buildDunePackage (finalAttrs: {
   pname = "tar";
-  version = "3.3.0";
+  version = "3.5.0";
   src = fetchurl {
-    url = "https://github.com/mirage/ocaml-tar/releases/download/v${version}/tar-${version}.tbz";
-    hash = "sha256-89aw1nf9QP0euAvMxgu2EyIDWL5Y9mxfqL8CV/Pl65Y=";
+    url = "https://github.com/mirage/ocaml-tar/releases/download/v${finalAttrs.version}/tar-${finalAttrs.version}.tbz";
+    hash = "sha256-haKmHTDu+B5L+B4LQp0hPOtd1urtzWDJeeHLuRFJ+Qw=";
   };
 
-  minimalOCamlVersion = "4.08";
-
   propagatedBuildInputs = [
-    camlp-streams
     decompress
   ];
 
@@ -29,4 +25,4 @@ buildDunePackage rec {
     license = lib.licenses.mit;
     maintainers = [ lib.maintainers.ulrikstrid ];
   };
-}
+})
diff --git a/pkgs/development/ocaml-modules/tar/eio.nix b/pkgs/development/ocaml-modules/tar/eio.nix
index dbdf250447a0..afd379b3448f 100644
--- a/pkgs/development/ocaml-modules/tar/eio.nix
+++ b/pkgs/development/ocaml-modules/tar/eio.nix
@@ -2,7 +2,8 @@
   buildDunePackage,
   tar,
   eio,
-  git,
+  alcotest,
+  eio_main,
 }:
 
 buildDunePackage {
@@ -16,8 +17,9 @@ buildDunePackage {
     eio
   ];
 
-  nativeCheckInputs = [
-    git
+  checkInputs = [
+    alcotest
+    eio_main
   ];
 
   meta = tar.meta // {
diff --git a/pkgs/development/ocaml-modules/tar/unix.nix b/pkgs/development/ocaml-modules/tar/unix.nix
index c109b0e7a177..5ab0194fc330 100644
--- a/pkgs/development/ocaml-modules/tar/unix.nix
+++ b/pkgs/development/ocaml-modules/tar/unix.nix
@@ -1,6 +1,8 @@
 {
   buildDunePackage,
   tar,
+  fpath,
+  logs,
   lwt,
   git,
 }:
@@ -11,6 +13,8 @@ buildDunePackage {
 
   propagatedBuildInputs = [
     tar
+    fpath
+    logs
     lwt
   ];
 
diff --git a/pkgs/top-level/ocaml-packages.nix b/pkgs/top-level/ocaml-packages.nix
index 9e4950454a7e..c9c9f327a0f7 100644
--- a/pkgs/top-level/ocaml-packages.nix
+++ b/pkgs/top-level/ocaml-packages.nix
@@ -2093,9 +2093,7 @@ let
           inherit (pkgs) git;
         };
 
-        tar-eio = callPackage ../development/ocaml-modules/tar/eio.nix {
-          inherit (pkgs) git;
-        };
+        tar-eio = callPackage ../development/ocaml-modules/tar/eio.nix { };
 
         tcpip = callPackage ../development/ocaml-modules/tcpip { };
 

From 35ee486b4f5d483565518a5343307418062b12c9 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Wed, 27 May 2026 02:16:55 +0200
Subject: [PATCH 39/61] =?UTF-8?q?ocamlPackages.lua-ml:=200.9.4=20=E2=86=92?=
 =?UTF-8?q?=200.9.5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

(cherry picked from commit bcd7a4e4cb5d47d18a192bf507335774f6727e80)
---
 pkgs/development/ocaml-modules/lua-ml/default.nix | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/pkgs/development/ocaml-modules/lua-ml/default.nix b/pkgs/development/ocaml-modules/lua-ml/default.nix
index d358a7baf44e..6aeec982619f 100644
--- a/pkgs/development/ocaml-modules/lua-ml/default.nix
+++ b/pkgs/development/ocaml-modules/lua-ml/default.nix
@@ -2,23 +2,24 @@
   lib,
   fetchFromGitHub,
   buildDunePackage,
+  menhir,
 }:
 buildDunePackage (finalAttrs: {
   pname = "lua-ml";
-  version = "0.9.4";
-
-  minimalOCamlVersion = "4.07";
+  version = "0.9.5";
 
   src = fetchFromGitHub {
     owner = "lindig";
     repo = "lua-ml";
     tag = finalAttrs.version;
-    hash = "sha256-kMBTHzmlrRWNpWwG321jYcM61rE1J3YQkygSrfnZ6Wc=";
+    hash = "sha256-+kg/hwcmRoM6sSL2GXOC2GrnJRu52BR5UiNu3nl5Lnk=";
   };
 
+  nativeBuildInputs = [ menhir ];
+
   meta = {
     description = "Embeddable Lua 2.5 interpreter implemented in OCaml";
-    inherit (finalAttrs.src.meta) homepage;
+    homepage = "https://github.com/lindig/lua-ml";
     license = lib.licenses.bsd2;
     maintainers = [ lib.maintainers.vbgl ];
   };

From 4acf48b2b6d3ca260366555f6a1b5c7538055c64 Mon Sep 17 00:00:00 2001
From: Harinn <prinn.dev@pm.me>
Date: Tue, 19 May 2026 11:52:23 +0700
Subject: [PATCH 40/61] bambu-studio: mark license as agpl3Plus + unfree

(cherry picked from commit c1083c5fbfbef6a0eff94d101f83e91e0c28e19c)
---
 pkgs/by-name/ba/bambu-studio/package.nix | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/pkgs/by-name/ba/bambu-studio/package.nix b/pkgs/by-name/ba/bambu-studio/package.nix
index de869f8f2f52..9add73ea720f 100644
--- a/pkgs/by-name/ba/bambu-studio/package.nix
+++ b/pkgs/by-name/ba/bambu-studio/package.nix
@@ -192,7 +192,15 @@ stdenv.mkDerivation (finalAttrs: {
     description = "PC Software for BambuLab's 3D printers";
     homepage = "https://github.com/bambulab/BambuStudio";
     changelog = "https://github.com/bambulab/BambuStudio/releases/tag/v${finalAttrs.version}";
-    license = lib.licenses.agpl3Plus;
+    license = with lib.licenses; [
+      agpl3Plus
+      # Bambu Studio downloads and dlopens a proprietary networking library
+      # at first launch whose corresponding source is not provided. SFC ruled
+      # this an ongoing AGPLv3 violation; see:
+      # https://github.com/NixOS/nixpkgs/issues/415821
+      # https://sfconservancy.org/news/2026/may/18/bambu-studio-3d-printer-agpl-violation-response/
+      unfree
+    ];
     maintainers = with lib.maintainers; [
       zhaofengli
       dsluijk

From c8a3fa3084f26a8a01b943aef807ffe4efea4cc7 Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Wed, 27 May 2026 08:59:18 -0400
Subject: [PATCH 41/61] beam27Packages.erlang: 27.3.4.11 -> 27.3.4.12

Changelog: https://github.com/erlang/otp/releases/tag/OTP-27.3.4.12
(cherry picked from commit 69dd41b69e6e0382ce8c5ea30426e30a32f0772a)
---
 pkgs/development/interpreters/erlang/27.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/erlang/27.nix b/pkgs/development/interpreters/erlang/27.nix
index 9614575f2620..52b3e41cee8a 100644
--- a/pkgs/development/interpreters/erlang/27.nix
+++ b/pkgs/development/interpreters/erlang/27.nix
@@ -1,6 +1,6 @@
 genericBuilder:
 
 genericBuilder {
-  version = "27.3.4.11";
-  hash = "sha256-yOgsaeUv6GwFX6qPVb28zet6Hli5vg/PZCKW2s2/JEA=";
+  version = "27.3.4.12";
+  hash = "sha256-RnCBGuqEEJ+3kkbiVNLSb8sAh2i9SNyH9ixkqtAbjsk=";
 }

From 174b0d0afcb29426f06fd15e6b63b0979e72f906 Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Wed, 27 May 2026 09:00:04 -0400
Subject: [PATCH 42/61] beam28Packages.erlang: 28.5 -> 28.5.0.1

Changelog: https://github.com/erlang/otp/releases/tag/OTP-28.5.0.1
(cherry picked from commit 5658d98da4d919bd28d92551ea83e2bd6402c83c)
---
 pkgs/development/interpreters/erlang/28.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/erlang/28.nix b/pkgs/development/interpreters/erlang/28.nix
index 544fdabf13b3..bc2c9546c894 100644
--- a/pkgs/development/interpreters/erlang/28.nix
+++ b/pkgs/development/interpreters/erlang/28.nix
@@ -1,6 +1,6 @@
 genericBuilder:
 
 genericBuilder {
-  version = "28.5";
-  hash = "sha256-A4gIjfWsrfZR89xNWyynTAdJtGj6ZWth3xIQBMLqcpc=";
+  version = "28.5.0.1";
+  hash = "sha256-tZQQCBDpDcrN9QX8Qwz6HqNVATck1+emGVOviEhqsLc=";
 }

From 3b63ed363b07df03d32666c41f005fb3224a244a Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Wed, 27 May 2026 09:01:12 -0400
Subject: [PATCH 43/61] beam29Packages.erlang: 29.0 -> 29.0.1

Changelog: https://github.com/erlang/otp/releases/tag/OTP-29.0.1
(cherry picked from commit 0824a9b88cc5f5eda16accf0123407d607d30396)
---
 pkgs/development/interpreters/erlang/29.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/erlang/29.nix b/pkgs/development/interpreters/erlang/29.nix
index dc59b0dc29ba..e3c2fbd2a90e 100644
--- a/pkgs/development/interpreters/erlang/29.nix
+++ b/pkgs/development/interpreters/erlang/29.nix
@@ -1,6 +1,6 @@
 genericBuilder:
 
 genericBuilder {
-  version = "29.0";
-  hash = "sha256-AUt/Mlp84cVEypqDsyD5VbywYEGda0eikMDmSnzlKUI=";
+  version = "29.0.1";
+  hash = "sha256-0I82VBCgA8KfdNYkNWyqcH+f0Kc6al11BAErtxfVDZo=";
 }

From e7be25e617e8c62d10eef9d103976d7c9d8f3c94 Mon Sep 17 00:00:00 2001
From: Vincent Laporte <Vincent.Laporte@gmail.com>
Date: Thu, 21 May 2026 07:02:17 +0200
Subject: [PATCH 44/61] =?UTF-8?q?ocamlPackages.camlp5:=208.05.00=20?=
 =?UTF-8?q?=E2=86=92=208.05.01?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

(cherry picked from commit b5143834f645ca1fac975bda754289cf349512ee)
---
 pkgs/development/tools/ocaml/camlp5/default.nix | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/pkgs/development/tools/ocaml/camlp5/default.nix b/pkgs/development/tools/ocaml/camlp5/default.nix
index 72cdbe9d8e10..4a8cd807a53f 100644
--- a/pkgs/development/tools/ocaml/camlp5/default.nix
+++ b/pkgs/development/tools/ocaml/camlp5/default.nix
@@ -21,7 +21,7 @@ stdenv.mkDerivation (
   in
   {
 
-    version = if lib.versionAtLeast ocaml.version "4.12" && !legacy then "8.05.00" else "7.14";
+    version = if lib.versionAtLeast ocaml.version "4.12" && !legacy then "8.05.01" else "7.14";
 
     pname = "ocaml${ocaml.version}-camlp5";
 
@@ -35,7 +35,7 @@ stdenv.mkDerivation (
           "rel${builtins.replaceStrings [ "." ] [ "" ] finalAttrs.version}";
       hash =
         {
-          "8.05.00" = "sha256-Y7d72gAxtyAQOIvLGua6Pib+FCoeMlbRYa9vzc+9hRo=";
+          "8.05.01" = "sha256-ym1cZIoAIwMnkGiygZf+TZxjhyO6WHYItWRXobdcKm0=";
           "8.03.2" = "sha256-nz+VfGR/6FdBvMzPPpVpviAXXBWNqM3Ora96Yzx964o=";
           "7.14" = "sha256-/ORtS0uc/GN+g3y6N5ftjL4OBSqV6iswLRbfpeNCprU=";
         }
@@ -80,8 +80,7 @@ stdenv.mkDerivation (
     dontStrip = true;
 
     meta = {
-      broken =
-        lib.versionAtLeast ocaml.version "5.04" && !lib.versionAtLeast finalAttrs.version "8.05.00";
+      broken = lib.versionAtLeast ocaml.version "5.4" && !lib.versionAtLeast finalAttrs.version "8.04.00";
       description = "Preprocessor-pretty-printer for OCaml";
       longDescription = ''
         Camlp5 is a preprocessor and pretty-printer for OCaml programs.

From 96187d7d4e89d7300cd5be63517eee1c1b5f5505 Mon Sep 17 00:00:00 2001
From: Colorman <foss@colorman.me>
Date: Fri, 1 May 2026 22:14:03 +0200
Subject: [PATCH 45/61] speed-cloudflare-cli: 2.0.3-unstable-2024-05-15 ->
 2.0.3-unstable-2025-07-31

(cherry picked from commit b9c17f2e4cf2e03826e84374a45305eabc3616de)
---
 pkgs/by-name/sp/speed-cloudflare-cli/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/sp/speed-cloudflare-cli/package.nix b/pkgs/by-name/sp/speed-cloudflare-cli/package.nix
index a1c1e27b33df..93c23291faf3 100644
--- a/pkgs/by-name/sp/speed-cloudflare-cli/package.nix
+++ b/pkgs/by-name/sp/speed-cloudflare-cli/package.nix
@@ -6,13 +6,13 @@
 }:
 stdenv.mkDerivation {
   pname = "speed-cloudflare-cli";
-  version = "2.0.3-unstable-2024-05-15";
+  version = "2.0.3-unstable-2025-07-31";
 
   src = fetchFromGitHub {
     owner = "KNawm";
     repo = "speed-cloudflare-cli";
-    rev = "dd301195e7def359a39cceeba16b1c0bedac8f5d";
-    sha256 = "sha256-kxLeQUdJbkmApf5Af3Mgd3WvS3GhXXOIvA4gNB55TGM=";
+    rev = "8eb34f4bd4f63493fbd93b1659389b9a1e5e4a36";
+    sha256 = "sha256-kJ//zXBW2IQ5V5dJfAm8iGxf9QILH0uloNYiwG3pTe4=";
   };
 
   nativeBuildInputs = [ nodejs ];

From 638de811831293540f9a5ebb50353b13361181a0 Mon Sep 17 00:00:00 2001
From: Colorman <foss@colorman.me>
Date: Fri, 1 May 2026 22:14:03 +0200
Subject: [PATCH 46/61] speed-cloudflare-cli: switch to buildNpmPackage

(cherry picked from commit cfa6db541107998cd8e1dd356628d2779d19eabf)
---
 .../sp/speed-cloudflare-cli/package.nix       | 25 +++++++++++--------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/pkgs/by-name/sp/speed-cloudflare-cli/package.nix b/pkgs/by-name/sp/speed-cloudflare-cli/package.nix
index 93c23291faf3..cdb4f20622d1 100644
--- a/pkgs/by-name/sp/speed-cloudflare-cli/package.nix
+++ b/pkgs/by-name/sp/speed-cloudflare-cli/package.nix
@@ -1,10 +1,12 @@
 {
   lib,
+  buildNpmPackage,
   fetchFromGitHub,
-  stdenv,
+  applyPatches,
+  fetchpatch,
   nodejs,
 }:
-stdenv.mkDerivation {
+buildNpmPackage {
   pname = "speed-cloudflare-cli";
   version = "2.0.3-unstable-2025-07-31";
 
@@ -15,18 +17,19 @@ stdenv.mkDerivation {
     sha256 = "sha256-kJ//zXBW2IQ5V5dJfAm8iGxf9QILH0uloNYiwG3pTe4=";
   };
 
-  nativeBuildInputs = [ nodejs ];
+  postInstall = ''
+    mkdir -p "$out/bin"
 
-  installPhase = ''
-    mkdir -p $out/bin
-
-    install -Dm755 $src/cli.js $out/bin/speed-cloudflare-cli
-    install -Dm644 $src/chalk.js $out/bin/chalk.js
-    install -Dm644 $src/stats.js $out/bin/stats.js
-
-    patchShebangs $out/bin/speed-cloudflare-cli
+    # Create an executable wrapper
+    makeWrapper ${lib.getExe nodejs} "$out/bin/speed-cloudflare-cli" \
+      --add-flags "$out/lib/node_modules/speed-cloudflare-cli/cli.js"
   '';
 
+  npmDepsHash = "sha256-CoirJgdpF9WEgbaXQbq5QlRO9wstZbNxIW2L1cJ+nXg=";
+
+  dontBuild = true;
+  dontNpmBuild = true;
+
   meta = {
     description = "Measure the speed and consistency of your internet connection using speed.cloudflare.com";
     homepage = "https://github.com/KNawm/speed-cloudflare-cli";

From 90381dc2af060b4076de31348dda5f19dd9637de Mon Sep 17 00:00:00 2001
From: Colorman <foss@colorman.me>
Date: Fri, 1 May 2026 22:14:03 +0200
Subject: [PATCH 47/61] speed-cloudflare-cli: apply patches to fix broken
 upstream

(cherry picked from commit 0f56ae0e57e46bf1eeb8503addc940f9982bdaf7)
---
 .../sp/speed-cloudflare-cli/package.nix       | 27 +++++++++++++++----
 1 file changed, 22 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/sp/speed-cloudflare-cli/package.nix b/pkgs/by-name/sp/speed-cloudflare-cli/package.nix
index cdb4f20622d1..bd8fedd91dc5 100644
--- a/pkgs/by-name/sp/speed-cloudflare-cli/package.nix
+++ b/pkgs/by-name/sp/speed-cloudflare-cli/package.nix
@@ -10,11 +10,28 @@ buildNpmPackage {
   pname = "speed-cloudflare-cli";
   version = "2.0.3-unstable-2025-07-31";
 
-  src = fetchFromGitHub {
-    owner = "KNawm";
-    repo = "speed-cloudflare-cli";
-    rev = "8eb34f4bd4f63493fbd93b1659389b9a1e5e4a36";
-    sha256 = "sha256-kJ//zXBW2IQ5V5dJfAm8iGxf9QILH0uloNYiwG3pTe4=";
+  src = applyPatches {
+    src = fetchFromGitHub {
+      owner = "KNawm";
+      repo = "speed-cloudflare-cli";
+      rev = "8eb34f4bd4f63493fbd93b1659389b9a1e5e4a36";
+      sha256 = "sha256-kJ//zXBW2IQ5V5dJfAm8iGxf9QILH0uloNYiwG3pTe4=";
+    };
+
+    # Applies the follwing PR:
+    # https://github.com/KNawm/speed-cloudflare-cli/pull/38
+    patches = [
+      # fix: handle non-array response from /locations and format
+      (fetchpatch {
+        url = "https://github.com/KNawm/speed-cloudflare-cli/commit/2682f167a1776de2f0c8085b591b06319a2aac7d.patch";
+        hash = "sha256-pkGNg7NwSP9QrBI2e0q44ZyJ8ckp0Pw/brpDkZkevdk=";
+      })
+      # docs: add logging for API errors as suggested by code review
+      (fetchpatch {
+        url = "https://github.com/KNawm/speed-cloudflare-cli/commit/2cb89f9b9af0f43c75ed2ea8f6c0a8519766b7c8.patch";
+        hash = "sha256-tLkyfXYd1s4FaMOwffyyObXZyIFlkvWvy7YkqBxU1SU=";
+      })
+    ];
   };
 
   postInstall = ''

From 61c6be594be2e3f160b3c60fa8a797f96736f556 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Tue, 26 May 2026 10:25:36 -0700
Subject: [PATCH 48/61] python3Packages.tensorboard: set meta.sourceProvenance

(cherry picked from commit 17b0fa54fe13c2ea3d24eeedebd4f64f65928f9e)
---
 pkgs/development/python-modules/tensorboard/default.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pkgs/development/python-modules/tensorboard/default.nix b/pkgs/development/python-modules/tensorboard/default.nix
index 106a5753fc98..d96daa9ed04e 100644
--- a/pkgs/development/python-modules/tensorboard/default.nix
+++ b/pkgs/development/python-modules/tensorboard/default.nix
@@ -78,5 +78,6 @@ buildPythonPackage rec {
     license = lib.licenses.asl20;
     mainProgram = "tensorboard";
     maintainers = [ ];
+    sourceProvenance = with lib.sourceTypes; [ binaryNativeCode ];
   };
 }

From e0d74c6906b7bdd45be9eaa660f82d9e4087f4f2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sch=C3=BCtz?= <nix@dotlambda.de>
Date: Sun, 24 May 2026 10:36:29 -0700
Subject: [PATCH 49/61] perlPackages.Imager: 1.025 -> 1.031

Changelog: https://metacpan.org/release/TONYC/Imager-1.031/source/Changes
(cherry picked from commit 8c5161adf0c7a915a3234ddc68e1e8fb7139f08b)
---
 pkgs/top-level/perl-packages.nix | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/pkgs/top-level/perl-packages.nix b/pkgs/top-level/perl-packages.nix
index d14e1102c16f..78b55a3f2817 100644
--- a/pkgs/top-level/perl-packages.nix
+++ b/pkgs/top-level/perl-packages.nix
@@ -17146,12 +17146,12 @@ with self;
     };
   };
 
-  Imager = buildPerlPackage {
+  Imager = buildPerlPackage rec {
     pname = "Imager";
-    version = "1.025";
+    version = "1.031";
     src = fetchurl {
-      url = "mirror://cpan/authors/id/T/TO/TONYC/Imager-1.025.tar.gz";
-      hash = "sha256-TwJ1y7HgEdfz/sYE3GtgwaxvAt78KYs9A31ur3vqcFg=";
+      url = "mirror://cpan/authors/id/T/TO/TONYC/Imager-${version}.tar.gz";
+      hash = "sha256-kL59G9/F7bfxfPgreeamYUxbAuv+Mm67b2afzaeRNAE=";
     };
     buildInputs = [
       pkgs.freetype
@@ -17168,6 +17168,7 @@ with self;
       "${pkgs.libpng.out}/lib"
     ];
     meta = {
+      changelog = "https://metacpan.org/release/TONYC/Imager-${version}/source/Changes";
       description = "Perl extension for Generating 24 bit Images";
       homepage = "http://imager.perl.org";
       license = with lib.licenses; [

From 2f3e6779d30d594426362243b8d740b50998d30a Mon Sep 17 00:00:00 2001
From: Kenichi Kamiya <kachick1@gmail.com>
Date: Mon, 25 May 2026 12:12:28 +0900
Subject: [PATCH 50/61] html2pdf: add versionCheckHook

version flag is available in 0.8.3:
https://github.com/ilaborie/html2pdf/commit/4886ded651458f8331898e81ed5ce5f2a94f957f

(cherry picked from commit 8c7c19f27a69b29e26a5736cfb372c471f18c6bc)
---
 pkgs/by-name/ht/html2pdf/package.nix | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/pkgs/by-name/ht/html2pdf/package.nix b/pkgs/by-name/ht/html2pdf/package.nix
index f92ee0545bbd..3a663c3e4084 100644
--- a/pkgs/by-name/ht/html2pdf/package.nix
+++ b/pkgs/by-name/ht/html2pdf/package.nix
@@ -6,6 +6,7 @@
   makeWrapper,
   chromium,
   withChromium ? (lib.meta.availableOn stdenv.hostPlatform chromium),
+  versionCheckHook,
   nix-update-script,
 }:
 
@@ -41,6 +42,11 @@ rustPlatform.buildRustPackage (finalAttrs: {
     ''
   );
 
+  doInstallCheck = true;
+  nativeInstallCheckInputs = [
+    versionCheckHook
+  ];
+
   passthru.updateScript = nix-update-script { };
 
   meta = {

From 2a56605ab1dd748d980111dad96755677e49b245 Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Tue, 26 May 2026 21:16:59 -0400
Subject: [PATCH 51/61] buildMozillaMach: fix darwin build

Versions before 144 vendor bindgen 0.69, which emits invalid Rust for
libc++ 21's attributed basic_string::__self_view alias on Darwin.

This was exposed by commit 0758fc3addcc ("darwin.libcxx:
20.1.0+apple-sdk-26.0 -> 21.1.6+apple-sdk-26.4"), where libc++
changed `basic_string::__self_view` from a typedef to an attributed
`using` alias. bindgen then drops the alias template parameter and emits
`basic_string___self_view = ...<_CharT>`.

The solution is to blocklist the unused `string_view` internals for the
profiler Rust API. They are not used in the actual build.

Note: Mozilla 144 updated vendored bindgen via:
https://bugzilla.mozilla.org/show_bug.cgi?id=1985509

Assisted-by: Codex gpt-5.5 xhigh
(cherry picked from commit c19203e06fb6eeb001c41fa1ab38c9a83bef7a94)
---
 .../140-bindgen-string-view.patch                 | 15 +++++++++++++++
 pkgs/build-support/build-mozilla-mach/default.nix |  8 ++++++++
 2 files changed, 23 insertions(+)
 create mode 100644 pkgs/build-support/build-mozilla-mach/140-bindgen-string-view.patch

diff --git a/pkgs/build-support/build-mozilla-mach/140-bindgen-string-view.patch b/pkgs/build-support/build-mozilla-mach/140-bindgen-string-view.patch
new file mode 100644
index 000000000000..c67dd36f95a4
--- /dev/null
+++ b/pkgs/build-support/build-mozilla-mach/140-bindgen-string-view.patch
@@ -0,0 +1,15 @@
+diff --git a/tools/profiler/rust-api/build.rs b/tools/profiler/rust-api/build.rs
+index 9bb27eb83e5e..3f09f7f01bcb 100644
+--- a/tools/profiler/rust-api/build.rs
++++ b/tools/profiler/rust-api/build.rs
+@@ -88,6 +88,10 @@ fn generate_bindings() {
+         // successfully. Otherwise, it fails to build because MarkerSchema has
+         // some std::strings as its fields.
+         .opaque_type("std::string")
++        .blocklist_type(".*basic_string_view.*")
++        .opaque_type(".*basic_string_view.*")
++        .blocklist_type(".*basic_string___self_view.*")
++        .opaque_type(".*basic_string___self_view.*")
+         // std::vector needs to be converted to an opaque type because, if it's
+         // not an opaque type, bindgen can't find its size properly and
+         // MarkerSchema's total size reduces. That causes a heap buffer overflow.
diff --git a/pkgs/build-support/build-mozilla-mach/default.nix b/pkgs/build-support/build-mozilla-mach/default.nix
index 3363d89fa7b1..4b036b558c45 100644
--- a/pkgs/build-support/build-mozilla-mach/default.nix
+++ b/pkgs/build-support/build-mozilla-mach/default.nix
@@ -332,6 +332,14 @@ buildStdenv.mkDerivation {
       # https://hg-edge.mozilla.org/mozilla-central/rev/aa8a29bd1fb9
       ./139-wayland-drag-animation.patch
     ]
+    ++ lib.optionals (lib.versionAtLeast version "140" && lib.versionOlder version "144") [
+      # Versions before 144 vendor bindgen 0.69. On Darwin, libc++ 21 changed
+      # basic_string::__self_view from a typedef to an attributed using alias;
+      # bindgen then emits it without its template parameter, producing invalid
+      # Rust. Vendored bindgen was updated in:
+      # https://bugzilla.mozilla.org/show_bug.cgi?id=1985509
+      ./140-bindgen-string-view.patch
+    ]
     ++ extraPatches;
 
   postPatch = ''

From 850d000d00f107485b0a0190e006896e54603b14 Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 27 May 2026 14:32:31 +0200
Subject: [PATCH 52/61] samba: 4.23.5 -> 4.23.8

https://www.samba.org/samba/history/samba-4.23.6.html
https://www.samba.org/samba/history/samba-4.23.7.html
https://www.samba.org/samba/history/samba-4.23.8.html

Fixes:
CVE-2026-1933, CVE-2026-2340, CVE-2026-3012, CVE-2026-3238,
CVE-2026-4408, CVE-2026-4480

(cherry picked from commit 125ed23f31a85711d8f9d908c4c78dddc0dc4de0)
---
 pkgs/servers/samba/4.x-fix-makeflags-parsing.patch | 11 -----------
 pkgs/servers/samba/4.x.nix                         |  5 ++---
 2 files changed, 2 insertions(+), 14 deletions(-)
 delete mode 100644 pkgs/servers/samba/4.x-fix-makeflags-parsing.patch

diff --git a/pkgs/servers/samba/4.x-fix-makeflags-parsing.patch b/pkgs/servers/samba/4.x-fix-makeflags-parsing.patch
deleted file mode 100644
index 7c973e5bd26a..000000000000
--- a/pkgs/servers/samba/4.x-fix-makeflags-parsing.patch
+++ /dev/null
@@ -1,11 +0,0 @@
---- a/buildtools/wafsamba/samba_utils.py	2019-04-08 01:13:47.525306574 +0000
-+++ b/buildtools/wafsamba/samba_utils.py	2019-04-08 01:14:34.805245676 +0000
-@@ -495,7 +495,7 @@
-                 Logs.zones = ['runner']
-             if Logs.verbose > 2:
-                 Logs.zones = ['*']
--        elif opt[0].isupper() and opt.find('=') != -1:
-+        elif opt[0] and opt.find('=') != -1:
-             # this allows us to set waf options on the make command line
-             # for example, if you do "make FOO=blah", then we set the
-             # option 'FOO' in Options.options, to blah. If you look in wafsamba/wscript
diff --git a/pkgs/servers/samba/4.x.nix b/pkgs/servers/samba/4.x.nix
index 69df70b61d3e..22f9cbf3aba3 100644
--- a/pkgs/servers/samba/4.x.nix
+++ b/pkgs/servers/samba/4.x.nix
@@ -81,11 +81,11 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "samba";
-  version = "4.23.5";
+  version = "4.23.8";
 
   src = fetchurl {
     url = "https://download.samba.org/pub/samba/stable/samba-${finalAttrs.version}.tar.gz";
-    hash = "sha256-WTpD3dDVeQIjffp2iI97Ast/x3RxETacsx4SbbSDa58=";
+    hash = "sha256-l2EphHRW3Ft4wA+P+3ncYFxJ1qrKiyqncv0i27afrgE=";
   };
 
   outputs = [
@@ -97,7 +97,6 @@ stdenv.mkDerivation (finalAttrs: {
   patches = [
     ./4.x-no-persistent-install.patch
     ./4.x-no-persistent-install-dynconfig.patch
-    ./4.x-fix-makeflags-parsing.patch
     ./4.x-fix-systemd-detection.patch
     (fetchpatch {
       # workaround for https://bugzilla.samba.org/show_bug.cgi?id=14164

From f70c0a4cbbffa2a91f1408a9a44bd524d777c2e2 Mon Sep 17 00:00:00 2001
From: Alex Epelde <alex@epelde.net>
Date: Tue, 26 May 2026 10:28:15 -0400
Subject: [PATCH 53/61] authelia: 4.39.19 -> 4.39.20

(cherry picked from commit 85a19d4995ca2f6743e9f4dc383d8ed6362bf6a0)
---
 pkgs/by-name/au/authelia/package.nix | 15 +++++----------
 pkgs/by-name/au/authelia/sources.nix |  8 ++++----
 pkgs/by-name/au/authelia/web.nix     |  4 ++--
 3 files changed, 11 insertions(+), 16 deletions(-)

diff --git a/pkgs/by-name/au/authelia/package.nix b/pkgs/by-name/au/authelia/package.nix
index 3b51064cd4a7..fff57cfd7e5c 100644
--- a/pkgs/by-name/au/authelia/package.nix
+++ b/pkgs/by-name/au/authelia/package.nix
@@ -4,9 +4,9 @@
   nodejs,
   fetchPnpmDeps,
   pnpmConfigHook,
-  pnpm_10,
+  pnpm_11,
   fetchFromGitHub,
-  buildGo125Module,
+  buildGo126Module,
   installShellFiles,
   callPackage,
   nixosTests,
@@ -15,16 +15,16 @@
       nodejs
       fetchPnpmDeps
       pnpmConfigHook
-      pnpm_10
+      pnpm_11
       fetchFromGitHub
       ;
   },
 }:
 
 let
-  pnpm = pnpm_10;
+  pnpm = pnpm_11;
 
-  buildGoModule = buildGo125Module;
+  buildGoModule = buildGo126Module;
 
   inherit (import ./sources.nix { inherit fetchFromGitHub; })
     pname
@@ -66,11 +66,6 @@ buildGoModule (finalAttrs: {
       "-X ${p}.BuildExtra=nixpkgs"
     ];
 
-  # It is required to set this to avoid a change in the
-  # handling of sync map in go 1.24+
-  # Upstream issue: https://github.com/authelia/authelia/issues/8980
-  env.GOEXPERIMENT = "nosynchashtriemap";
-
   # several tests with networking and several that want chromium
   doCheck = false;
 
diff --git a/pkgs/by-name/au/authelia/sources.nix b/pkgs/by-name/au/authelia/sources.nix
index cd9372cc2662..d234fad15cfa 100644
--- a/pkgs/by-name/au/authelia/sources.nix
+++ b/pkgs/by-name/au/authelia/sources.nix
@@ -1,14 +1,14 @@
 { fetchFromGitHub }:
 rec {
   pname = "authelia";
-  version = "4.39.19";
+  version = "4.39.20";
 
   src = fetchFromGitHub {
     owner = "authelia";
     repo = "authelia";
     rev = "v${version}";
-    hash = "sha256-wMOurdgdjykFekn0Pej3meM6WSzq9tJ+kZV9sVDvRwM=";
+    hash = "sha256-JjpfNQsqtmSKXj14fQUJsiTgfkAlSHDfqUC/x+bE+fc=";
   };
-  vendorHash = "sha256-ZDsLRMip2B8PPZu8VxW+91FVvwC2rXzohhAZFifT26g=";
-  pnpmDepsHash = "sha256-HMrC5V+Ak2dF1uPtbh8kgFc8kZI2FPMmZHJciWRYx9w=";
+  vendorHash = "sha256-dZjsYqw/ABEn1y6tZgSjbmqamO4U20Ljj/dQMFruVjU=";
+  pnpmDepsHash = "sha256-syfPg62JrTh496xi39xW/CnIwpJYo+iU5sCPP3bD2Ys=";
 }
diff --git a/pkgs/by-name/au/authelia/web.nix b/pkgs/by-name/au/authelia/web.nix
index 3f5336adfca7..ca8a276e5e31 100644
--- a/pkgs/by-name/au/authelia/web.nix
+++ b/pkgs/by-name/au/authelia/web.nix
@@ -3,12 +3,12 @@
   nodejs,
   fetchPnpmDeps,
   pnpmConfigHook,
-  pnpm_10,
+  pnpm_11,
   fetchFromGitHub,
 }:
 
 let
-  pnpm = pnpm_10;
+  pnpm = pnpm_11;
 
   inherit (import ./sources.nix { inherit fetchFromGitHub; })
     pname

From 36598bcf49a0d9af3f6dd8d35487ffc84e9c5ac4 Mon Sep 17 00:00:00 2001
From: "Adam C. Stephens" <adam@valkor.net>
Date: Wed, 27 May 2026 15:10:44 -0400
Subject: [PATCH 54/61] beamMinimal27Packages.erlang: fix build failure from
 ignored DOC_TARGETS

Assisted-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
(cherry picked from commit 8a6342311999d8d62c3ec7244baa7d139872eb4a)
---
 pkgs/development/interpreters/erlang/generic-builder.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/development/interpreters/erlang/generic-builder.nix b/pkgs/development/interpreters/erlang/generic-builder.nix
index 646bf961f038..0e9e7f645289 100644
--- a/pkgs/development/interpreters/erlang/generic-builder.nix
+++ b/pkgs/development/interpreters/erlang/generic-builder.nix
@@ -114,6 +114,11 @@ stdenv.mkDerivation {
   # disksup requires a shell
   postPatch = ''
     substituteInPlace lib/os_mon/src/disksup.erl --replace-fail '"sh ' '"${runtimeShell} '
+  ''
+  # https://github.com/erlang/otp/issues/11151
+  + lib.optionalString (!wxSupport && major == "27") ''
+    substituteInPlace lib/wx/doc/Makefile \
+      --replace-fail $'ifneq ($(CAN_BUILD_DRIVER), true)\nDOC_TARGETS=\nendif\n' ""
   '';
 
   debugInfo = enableDebugInfo;

From 4bff5d284f2efa9440f1761cf92a85aa84dda43e Mon Sep 17 00:00:00 2001
From: Martin Weinelt <hexa@darmstadt.ccc.de>
Date: Wed, 27 May 2026 20:58:36 +0200
Subject: [PATCH 55/61] pretix: 2026.4.1 -> 2026.4.2

https://pretix.eu/about/en/blog/20260527-release-2026-4-2/
https://github.com/pretix/pretix/compare/v2026.4.1...v2026.4.2

Fixes: CVE-2026-9712
(cherry picked from commit 6f917118f8bc358659ce8e5d9fce17f0812bafc4)
---
 pkgs/by-name/pr/pretix/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/pr/pretix/package.nix b/pkgs/by-name/pr/pretix/package.nix
index b0cd94ad313b..9cd89e0d4528 100644
--- a/pkgs/by-name/pr/pretix/package.nix
+++ b/pkgs/by-name/pr/pretix/package.nix
@@ -51,13 +51,13 @@ let
   };
 
   pname = "pretix";
-  version = "2026.4.1";
+  version = "2026.4.2";
 
   src = fetchFromGitHub {
     owner = "pretix";
     repo = "pretix";
     tag = "v${version}";
-    hash = "sha256-afqhPiTg1g2rnJOl8yFYq/p2/fIxpfTp/3jbTXpiRZQ=";
+    hash = "sha256-OECVdtPnr7qqLriPZWOyRm6ZqU8yO+SYzU69zaO+9rU=";
   };
 
   npmDeps = buildNpmPackage {

From 9b7dc789ca99249a34a7c97aee0c19f3fd1be9b8 Mon Sep 17 00:00:00 2001
From: Philip Taron <philip.taron@gmail.com>
Date: Wed, 27 May 2026 12:47:02 -0700
Subject: [PATCH 56/61] rustPlatform.importCargoLock: download crates from
 static.crates.io

The crates.io API server's 1 req/sec rate limit currently surfaces as
intermittent HTTP 403 errors when vendoring lockfiles. Switch to the CDN
endpoint as recommended by upstream (rust-lang/crates.io#13482), mirroring
the fix already applied to fetchCargoVendor in #512735.

fetchurl is content-addressed by sha256, so the URL change does not affect
any downstream store paths.

Fixes #524979

(cherry picked from commit f830e6112b4dbdb98cb7668cd291ea07ffc288e8)
---
 pkgs/build-support/rust/import-cargo-lock.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/pkgs/build-support/rust/import-cargo-lock.nix b/pkgs/build-support/rust/import-cargo-lock.nix
index 9c172c7842f8..e9ebedfe98a4 100644
--- a/pkgs/build-support/rust/import-cargo-lock.nix
+++ b/pkgs/build-support/rust/import-cargo-lock.nix
@@ -130,7 +130,10 @@ let
     };
 
   registries = {
-    "https://github.com/rust-lang/crates.io-index" = "https://crates.io/api/v1/crates";
+    # Use static.crates.io (CDN) instead of crates.io/api to avoid the 1 req/sec
+    # rate limit on the API servers, which currently returns intermittent 403s.
+    # See https://github.com/rust-lang/crates.io/issues/13482
+    "https://github.com/rust-lang/crates.io-index" = "https://static.crates.io/crates";
   }
   // extraRegistries;
 

From 7a55590207aa1521e3b3e8091cab89d533b4cd6a Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 27 May 2026 13:28:38 +0000
Subject: [PATCH 57/61] matrix-authentication-service: 1.16.0 -> 1.17.0

(cherry picked from commit e5d373f0e5dcc593a8f0417d35b159f9408aa4d4)
---
 pkgs/by-name/ma/matrix-authentication-service/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ma/matrix-authentication-service/package.nix b/pkgs/by-name/ma/matrix-authentication-service/package.nix
index 5fb3113b66b5..9d063b4fa960 100644
--- a/pkgs/by-name/ma/matrix-authentication-service/package.nix
+++ b/pkgs/by-name/ma/matrix-authentication-service/package.nix
@@ -19,16 +19,16 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "matrix-authentication-service";
-  version = "1.16.0";
+  version = "1.17.0";
 
   src = fetchFromGitHub {
     owner = "element-hq";
     repo = "matrix-authentication-service";
     tag = "v${finalAttrs.version}";
-    hash = "sha256-pyL2QhvycaGBYgelsHK5Ces195Z1aY2XZyecsPXO/X4=";
+    hash = "sha256-/3NgMZ0B+B0BHPBi/vuiCS6xi70wgNKCZH0hTpkWi+U=";
   };
 
-  cargoHash = "sha256-gvG6+strULIewJgFdGg3fJ2mjUVjgi9/Q7pDredYuiU=";
+  cargoHash = "sha256-aZSnQmOwqo0OG3XXM5eups0cKNs80j/nAsZB5tnWUrY=";
 
   npmDeps = fetchNpmDeps {
     name = "${finalAttrs.pname}-${finalAttrs.version}-npm-deps";

From 255103898a210449b155493d96e7965f5126b5ad Mon Sep 17 00:00:00 2001
From: "R. Ryantm" <ryantm-bot@ryantm.com>
Date: Wed, 27 May 2026 11:46:14 +0000
Subject: [PATCH 58/61] chhoto-url: 7.0.4 -> 7.1.5

(cherry picked from commit 442080f1fd857ed69e1e5327f9f0399750492910)
---
 pkgs/by-name/ch/chhoto-url/package.nix | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pkgs/by-name/ch/chhoto-url/package.nix b/pkgs/by-name/ch/chhoto-url/package.nix
index 9df908763dcd..0cbef07a654c 100644
--- a/pkgs/by-name/ch/chhoto-url/package.nix
+++ b/pkgs/by-name/ch/chhoto-url/package.nix
@@ -8,13 +8,13 @@
 
 rustPlatform.buildRustPackage (finalAttrs: {
   pname = "chhoto-url";
-  version = "7.0.4";
+  version = "7.1.5";
 
   src = fetchFromGitHub {
     owner = "SinTan1729";
     repo = "chhoto-url";
     tag = finalAttrs.version;
-    hash = "sha256-ntI2jWV1kS8ojbkhLaZhxkjK5ZNYOp9MIbzHpnCyEu0=";
+    hash = "sha256-TREBriuK7k3ZBDkdQ5gGdptWCG/5UOdhoWcOj1Ppd/8=";
   };
 
   sourceRoot = "${finalAttrs.src.name}/actix";
@@ -24,7 +24,7 @@ rustPlatform.buildRustPackage (finalAttrs: {
       --replace-fail "./resources/" "${placeholder "out"}/share/chhoto-url/resources/"
   '';
 
-  cargoHash = "sha256-tkPMlJqkQzFYItPPYW5kqLiymlNZPkwj0j/2Zj4Ysc8=";
+  cargoHash = "sha256-S+fWxhPRB+JZPjWQkww9VYtYfc9vnXCZgUZTu+ND1So=";
 
   postInstall = ''
     mkdir -p $out/share/chhoto-url

From d8b97a63f92317d72cc935a934bc057af5696b65 Mon Sep 17 00:00:00 2001
From: Michael Daniels <mdaniels5757@gmail.com>
Date: Wed, 27 May 2026 17:45:54 -0400
Subject: [PATCH 59/61] google-chrome: 148.0.7778.178 -> 148.0.7778.215

(cherry picked from commit 2c044ef431ad5794a6cc4ab1a3b7cbc46c679d5f)
---
 pkgs/by-name/go/google-chrome/package.nix | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/pkgs/by-name/go/google-chrome/package.nix b/pkgs/by-name/go/google-chrome/package.nix
index 9cd4d80d1cd5..9d4a2a7506e8 100644
--- a/pkgs/by-name/go/google-chrome/package.nix
+++ b/pkgs/by-name/go/google-chrome/package.nix
@@ -184,11 +184,11 @@ let
 
   linux = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "148.0.7778.178";
+    version = "148.0.7778.215";
 
     src = fetchurl {
       url = "https://dl.google.com/linux/chrome/deb/pool/main/g/google-chrome-stable/google-chrome-stable_${finalAttrs.version}-1_amd64.deb";
-      hash = "sha256-3iuKxcuwt/+BIcUqC715hbeRLhUjepNU1GbB3daIokI=";
+      hash = "sha256-IyKMotjgwLJ9AKAl+gE86DWd0GCtQoBjvbbvBiYULSQ=";
     };
 
     # With strictDeps on, some shebangs were not being patched correctly
@@ -302,11 +302,11 @@ let
 
   darwin = stdenvNoCC.mkDerivation (finalAttrs: {
     inherit pname meta passthru;
-    version = "148.0.7778.179";
+    version = "148.0.7778.216";
 
     src = fetchurl {
-      url = "http://dl.google.com/release2/chrome/adxxii2zvsza6zjfnjbfh6fn4tqq_148.0.7778.179/GoogleChrome-148.0.7778.179.dmg";
-      hash = "sha256-QBHyF222wnaEmI79CQFOXQl5WkRNwneCYd/JFNMEEWU=";
+      url = "http://dl.google.com/release2/chrome/ac3wy6ujyaf3yzk7hqzmyw4nopha_148.0.7778.216/GoogleChrome-148.0.7778.216.dmg";
+      hash = "sha256-NauJr7eRVb5q1s38WXijxBAhJ2RryfrrlBc9oBg5HH4=";
     };
 
     dontPatch = true;

From 26c9e1dd653aa26b6da2dfe57a88bbf1219cff75 Mon Sep 17 00:00:00 2001
From: Thorsten Weber <cpt.chaos83@googlemail.com>
Date: Wed, 27 May 2026 20:35:18 +0200
Subject: [PATCH 60/61] libredwg: 0.13.4 -> 0.13.4.8200

Update to latest pre-release to fix multiple security vulnerabilities:

- CVE-2026-9500: heap-buffer-overflow in decode.c (decompress_R2004_section)
- CVE-2026-9501: heap-buffer-overflow in decode.c (read_2004_compressed_section)
- CVE-2026-9502: heap-buffer-overflow in decode.c (decompress_R2004_section)
- CVE-2026-9503: heap-buffer-overflow in decode.c (decompress_R2004_section)
- CVE-2026-9504: null pointer dereference in dwggrep.c (main)
- CVE-2026-9529: heap-buffer-overflow in decode.c (decompress_R2004_section)
- CVE-2026-9530: heap-buffer-overflow in decode.c (decompress_R2004_section)
- CVE-2026-9605: heap-buffer-overflow in decode.c (decompress_R2004_section)

Individual backports were not feasible as the decompressor was significantly
refactored on upstream's main branch between 0.13.4 and the fixes.

(cherry picked from commit b27ee09e7d0dc21a216ccdb0a866619046e3e993)
---
 pkgs/by-name/li/libredwg/package.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/by-name/li/libredwg/package.nix b/pkgs/by-name/li/libredwg/package.nix
index 3f79fd9f2722..bccfc12f072d 100644
--- a/pkgs/by-name/li/libredwg/package.nix
+++ b/pkgs/by-name/li/libredwg/package.nix
@@ -18,13 +18,13 @@ let
 in
 stdenv.mkDerivation (finalAttrs: {
   pname = "libredwg";
-  version = "0.13.4";
+  version = "0.13.4.8200";
 
   src = fetchFromGitHub {
     owner = "LibreDWG";
     repo = "libredwg";
     tag = finalAttrs.version;
-    hash = "sha256-FeDQCByFGKfHJDOPQA92GslXZ33nhGfB6/63t2TeugE=";
+    hash = "sha256-HaQvJyuEeaTfuUJbmlV4qcfXiLdHJ2vO4EGInwAKJYk=";
     fetchSubmodules = true;
   };
 

From ab35d8b57a51a1a01bc7a2ab2795905e291dd41a Mon Sep 17 00:00:00 2001
From: Adam Dinwoodie <adam@dinwoodie.org>
Date: Tue, 26 May 2026 13:28:16 +0100
Subject: [PATCH 61/61] fetchgit: disable git maintenance

By default, Git commands will trigger background processes to perform
repository maintenance.  As of Git v2.54.0, and in particular as of
452b12c2e0 (builtin/maintenance: use "geometric" strategy by default,
2026-02-24), Git has changed the strategy it uses to decide whether
maintenance needs performing, and as a result will kick off background
maintenance processes much more often.

These background processes will potentially change the contents of the
`.git` directory while `nix-prefetch-git` is deleting it.  This results in
effectively random failures, when files are added to the `.git`
directory during the `rm -rf` operation (causing it to fail) or after
the operation has completed (causing the `.git` directory to be
recreated and resulting in a FOD hash mismatch).

This also causes problems for the determinism of Git's own tests.
They've resolved this in 09505b1115 (t: fix races caused by background
maintenance, 2026-02-24) by having the maintenance processes run in the
foreground.  The discussion in that commit explains they considered just
disabling maintenance entirely, but opted for the foreground option
because disabling maintenance would mean the tests looked even less like
how most Git users work with Git.

`nix-prefetch-git` is nothing like most Git users.  In almost every
case, the `.git` directory will be deleted during or immediately after
the script is called.  The repositories certainly don't benefit from
ongoing maintenance.  To avoid the non-determinism created by the
background maintenance processes, just disable maintenance entirely.

This is done with `git config` after initialising the repository, rather
than `git config --global` earlier in the script, as `git config
--global` will fail if `fetchgit` was called with a `gitConfig`
argument.

It would be possible to set this option with
`GIT_CONFIG_[COUNT|KEY_<n>|VALUE_<n>]` environment variables; I've opted
against that because (a) they're less familiar to most people who might
want to come to edit this script in future and (b) because if someone is
using those values themselves via `impureEnvVars` or similar, making our
configuration play nicely with someone else's would require some fairly
complex logic.

I haven't made this a configurable option: any use of `nix-prefetch-git`
will run with maintenance disabled, as I cannot think of a use case
where it would be useful.  If there is such a use case, it would be
straightforward to extend `nix-prefetch-git` and `fetchgit` to allow
users to change the behaviour.

Fixes #524215.

(cherry picked from commit 011471c7f24920fb29e18124da24232d9faf29b0)
---
 pkgs/build-support/fetchgit/nix-prefetch-git | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/pkgs/build-support/fetchgit/nix-prefetch-git b/pkgs/build-support/fetchgit/nix-prefetch-git
index d3788d9447ad..f2d36f54a2d5 100755
--- a/pkgs/build-support/fetchgit/nix-prefetch-git
+++ b/pkgs/build-support/fetchgit/nix-prefetch-git
@@ -123,6 +123,10 @@ fi
 init_remote(){
     local url=$1
     clean_git init --initial-branch=master
+    # Disable maintenance: it's not useful for a short-lived clone, and
+    # background maintenance causes non-deterministic builds.
+    # https://github.com/NixOS/nixpkgs/issues/524215
+    clean_git config maintenance.auto false
     clean_git remote add origin "$url"
     if [ -n "$sparseCheckout" ]; then
         git config remote.origin.partialclonefilter "blob:none"